diff --git a/DEPS b/DEPS
index d94be74..dea070f 100644
--- a/DEPS
+++ b/DEPS
@@ -133,11 +133,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': 'b8e77698ad39494d1de58d97ea7b2fb8579d2490',
+  'skia_revision': 'e700738f3c8f3eebb613eb0cb7312a13468a13bf',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': '60263cb67e90fea34c6754f4cb9242351a2cb676',
+  'v8_revision': '2de3cf380f29310984f58671153d98c4066adb0f',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -145,15 +145,15 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling ANGLE
   # and whatever else without interference from each other.
-  'angle_revision': 'e8247a574956349b7f0a9beaa63c8a7db90e2403',
+  'angle_revision': 'b86e73daf7db3f0b7ee08a49829a96a7217f71c0',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling SwiftShader
   # and whatever else without interference from each other.
-  'swiftshader_revision': '9e2844fa2744c6f600b06888ac5387a1174f5c53',
+  'swiftshader_revision': 'a453ba42f72d0e513ada6bb29409bcde5d298612',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling PDFium
   # and whatever else without interference from each other.
-  'pdfium_revision': '0958e507daa3774ac8996b6e7ee260b9154f8ee5',
+  'pdfium_revision': '2f0485479008ac708c0bc08708b123dad25dcbd0',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling BoringSSL
   # and whatever else without interference from each other.
@@ -196,7 +196,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling catapult
   # and whatever else without interference from each other.
-  'catapult_revision': '5655d8f9f1891d271489d06b6988f001e9543f25',
+  'catapult_revision': 'ea6b999d4bba12c46fb69a6b4ddd448cc238213e',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libFuzzer
   # and whatever else without interference from each other.
@@ -802,7 +802,7 @@
 
   # Build tools for Chrome OS. Note: This depends on third_party/pyelftools.
   'src/third_party/chromite': {
-      'url': Var('chromium_git') + '/chromiumos/chromite.git' + '@' + '1ffff0a0da2bcb60cd2a94c15081ff491c4f72c0',
+      'url': Var('chromium_git') + '/chromiumos/chromite.git' + '@' + '21b95024e051a0a0224739b7dcc9268c84b3eadd',
       'condition': 'checkout_linux',
   },
 
@@ -817,7 +817,7 @@
 
   # For Linux and Chromium OS.
   'src/third_party/cros_system_api': {
-      'url': Var('chromium_git') + '/chromiumos/platform2/system_api.git' + '@' + '48dde549792d89486d7d92ce033bfac0e594b7e7',
+      'url': Var('chromium_git') + '/chromiumos/platform2/system_api.git' + '@' + 'da0aa1219dc895dae36532a02f235707d9b1275b',
       'condition': 'checkout_linux',
   },
 
@@ -827,7 +827,7 @@
   },
 
   'src/third_party/depot_tools':
-    Var('chromium_git') + '/chromium/tools/depot_tools.git' + '@' + '5716400ae256163c8c91b489ce694e7c561e0c92',
+    Var('chromium_git') + '/chromium/tools/depot_tools.git' + '@' + 'd6bf517dd4f5e899d79b865e671353b4ce616f6e',
 
   'src/third_party/devtools-node-modules':
     Var('chromium_git') + '/external/github.com/ChromeDevTools/devtools-node-modules' + '@' + Var('devtools_node_modules_revision'),
@@ -1177,7 +1177,7 @@
   },
 
   'src/third_party/perfetto':
-    Var('android_git') + '/platform/external/perfetto.git' + '@' +  'c9cac42e24593ab65c8c828f7e1b428a7de35df7',
+    Var('android_git') + '/platform/external/perfetto.git' + '@' +  '945361d2c8963b58a27c2a81ce18ae5cf9d909b7',
 
   'src/third_party/perl': {
       'url': Var('chromium_git') + '/chromium/deps/perl.git' + '@' + 'ac0d98b5cee6c024b0cffeb4f8f45b6fc5ccdb78',
@@ -1345,7 +1345,7 @@
     Var('chromium_git') + '/external/khronosgroup/webgl.git' + '@' + '6f0b34abee8dba611c253738d955c59f703c147a',
 
   'src/third_party/webrtc':
-    Var('webrtc_git') + '/src.git' + '@' + '762076b88663ac0225175593cb216040471701e5',
+    Var('webrtc_git') + '/src.git' + '@' + 'd703cd022f64ddb6225b08719c2e40d1e1aa997a',
 
   'src/third_party/xdg-utils': {
       'url': Var('chromium_git') + '/chromium/deps/xdg-utils.git' + '@' + 'd80274d5869b17b8c9067a1022e4416ee7ed5e0d',
@@ -1386,7 +1386,7 @@
     Var('chromium_git') + '/v8/v8.git' + '@' +  Var('v8_revision'),
 
   'src-internal': {
-    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@e2260af0009653969ed497da3ae8fd0536338756',
+    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@8b6de23af332aa73e5e921fbedf2f4ac8be0512d',
     'condition': 'checkout_src_internal',
   },
 
diff --git a/WATCHLISTS b/WATCHLISTS
index ca45689..512e4ac 100644
--- a/WATCHLISTS
+++ b/WATCHLISTS
@@ -1512,8 +1512,12 @@
       'filepath': 'select_to_speak',
     },
     'send_tab_to_self': {
-      'filepath': 'components/send_tab_to_self' \
-        '|chrome/android/java/src/org/chromium/chrome/browser/send_tab_to_self/',
+      'filepath': 'components/send_tab_to_self'\
+                  '|chrome/android/java/src/org/chromium/chrome/browser/send_tab_to_self/'\
+                  '|chrome/browser/android/send_tab_to_self/'\
+                  '|chrome/browser/send_tab_to_self/'\
+                  '|chrome/browser/ui/send_tab_to_self'\
+                  '|ios/chrome/browser/send_tab_to_self/',
     },
     'service_worker': {
       'filepath': 'content/(browser|renderer|child|common)/service_worker/',
diff --git a/android_webview/tools/webview_log_verbosifier/README.md b/android_webview/tools/webview_log_verbosifier/README.md
index ffab171..b95d1f1e 100644
--- a/android_webview/tools/webview_log_verbosifier/README.md
+++ b/android_webview/tools/webview_log_verbosifier/README.md
@@ -13,6 +13,13 @@
 out/Default/bin/webview_log_verbosifier_apk install
 ```
 
+Alternatively, if you do not have a fully set up Chromium build
+environment, you can build with gradle:
+
+```shell
+ANDROID_SDK_ROOT=/path/to/sdk ./gradlew build
+```
+
 ## Searching logcat
 
 You can `grep` the logcat like so:
diff --git a/android_webview/tools/webview_log_verbosifier/build.gradle b/android_webview/tools/webview_log_verbosifier/build.gradle
new file mode 100644
index 0000000..6926ad8
--- /dev/null
+++ b/android_webview/tools/webview_log_verbosifier/build.gradle
@@ -0,0 +1,28 @@
+buildscript {
+    repositories {
+        google()
+        jcenter()
+    }
+    dependencies {
+        classpath 'com.android.tools.build:gradle:3.4.0'
+    }
+}
+
+allprojects {
+    repositories {
+        google()
+        jcenter()
+    }
+}
+
+apply plugin: 'com.android.application'
+
+android {
+    compileSdkVersion 26
+    sourceSets {
+        main {
+            manifest.srcFile 'AndroidManifest.xml'
+            res.srcDirs = [ './res' ]
+        }
+    }
+}
diff --git a/android_webview/tools/webview_log_verbosifier/gradle/wrapper/gradle-wrapper.jar b/android_webview/tools/webview_log_verbosifier/gradle/wrapper/gradle-wrapper.jar
new file mode 100644
index 0000000..f9ac2012b
--- /dev/null
+++ b/android_webview/tools/webview_log_verbosifier/gradle/wrapper/gradle-wrapper.jar
Binary files differ
diff --git a/android_webview/tools/webview_log_verbosifier/gradle/wrapper/gradle-wrapper.properties b/android_webview/tools/webview_log_verbosifier/gradle/wrapper/gradle-wrapper.properties
new file mode 100644
index 0000000..7bd5ab0
--- /dev/null
+++ b/android_webview/tools/webview_log_verbosifier/gradle/wrapper/gradle-wrapper.properties
@@ -0,0 +1,6 @@
+#Thu May 02 14:54:57 BST 2019
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-5.4.1-bin.zip
diff --git a/android_webview/tools/webview_log_verbosifier/gradlew b/android_webview/tools/webview_log_verbosifier/gradlew
new file mode 100755
index 0000000..4453cce
--- /dev/null
+++ b/android_webview/tools/webview_log_verbosifier/gradlew
@@ -0,0 +1,172 @@
+#!/usr/bin/env sh
+
+##############################################################################
+##
+##  Gradle start up script for UN*X
+##
+##############################################################################
+
+# Attempt to set APP_HOME
+# Resolve links: $0 may be a link
+PRG="$0"
+# Need this for relative symlinks.
+while [ -h "$PRG" ] ; do
+    ls=`ls -ld "$PRG"`
+    link=`expr "$ls" : '.*-> \(.*\)$'`
+    if expr "$link" : '/.*' > /dev/null; then
+        PRG="$link"
+    else
+        PRG=`dirname "$PRG"`"/$link"
+    fi
+done
+SAVED="`pwd`"
+cd "`dirname \"$PRG\"`/" >/dev/null
+APP_HOME="`pwd -P`"
+cd "$SAVED" >/dev/null
+
+APP_NAME="Gradle"
+APP_BASE_NAME=`basename "$0"`
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS=""
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD="maximum"
+
+warn ( ) {
+    echo "$*"
+}
+
+die ( ) {
+    echo
+    echo "$*"
+    echo
+    exit 1
+}
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "`uname`" in
+  CYGWIN* )
+    cygwin=true
+    ;;
+  Darwin* )
+    darwin=true
+    ;;
+  MINGW* )
+    msys=true
+    ;;
+  NONSTOP* )
+    nonstop=true
+    ;;
+esac
+
+CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD="$JAVA_HOME/jre/sh/java"
+    else
+        JAVACMD="$JAVA_HOME/bin/java"
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD="java"
+    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+fi
+
+# Increase the maximum file descriptors if we can.
+if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then
+    MAX_FD_LIMIT=`ulimit -H -n`
+    if [ $? -eq 0 ] ; then
+        if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
+            MAX_FD="$MAX_FD_LIMIT"
+        fi
+        ulimit -n $MAX_FD
+        if [ $? -ne 0 ] ; then
+            warn "Could not set maximum file descriptor limit: $MAX_FD"
+        fi
+    else
+        warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
+    fi
+fi
+
+# For Darwin, add options to specify how the application appears in the dock
+if $darwin; then
+    GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
+fi
+
+# For Cygwin, switch paths to Windows format before running java
+if $cygwin ; then
+    APP_HOME=`cygpath --path --mixed "$APP_HOME"`
+    CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
+    JAVACMD=`cygpath --unix "$JAVACMD"`
+
+    # We build the pattern for arguments to be converted via cygpath
+    ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
+    SEP=""
+    for dir in $ROOTDIRSRAW ; do
+        ROOTDIRS="$ROOTDIRS$SEP$dir"
+        SEP="|"
+    done
+    OURCYGPATTERN="(^($ROOTDIRS))"
+    # Add a user-defined pattern to the cygpath arguments
+    if [ "$GRADLE_CYGPATTERN" != "" ] ; then
+        OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
+    fi
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    i=0
+    for arg in "$@" ; do
+        CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
+        CHECK2=`echo "$arg"|egrep -c "^-"`                                 ### Determine if an option
+
+        if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then                    ### Added a condition
+            eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
+        else
+            eval `echo args$i`="\"$arg\""
+        fi
+        i=$((i+1))
+    done
+    case $i in
+        (0) set -- ;;
+        (1) set -- "$args0" ;;
+        (2) set -- "$args0" "$args1" ;;
+        (3) set -- "$args0" "$args1" "$args2" ;;
+        (4) set -- "$args0" "$args1" "$args2" "$args3" ;;
+        (5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
+        (6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
+        (7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
+        (8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
+        (9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
+    esac
+fi
+
+# Escape application args
+save ( ) {
+    for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done
+    echo " "
+}
+APP_ARGS=$(save "$@")
+
+# Collect all arguments for the java command, following the shell quoting and substitution rules
+eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS"
+
+# by default we should be in the correct project dir, but when run from Finder on Mac, the cwd is wrong
+if [ "$(uname)" = "Darwin" ] && [ "$HOME" = "$PWD" ]; then
+  cd "$(dirname "$0")"
+fi
+
+exec "$JAVACMD" "$@"
diff --git a/android_webview/tools/webview_log_verbosifier/gradlew.bat b/android_webview/tools/webview_log_verbosifier/gradlew.bat
new file mode 100755
index 0000000..e95643d6
--- /dev/null
+++ b/android_webview/tools/webview_log_verbosifier/gradlew.bat
@@ -0,0 +1,84 @@
+@if "%DEBUG%" == "" @echo off

+@rem ##########################################################################

+@rem

+@rem  Gradle startup script for Windows

+@rem

+@rem ##########################################################################

+

+@rem Set local scope for the variables with windows NT shell

+if "%OS%"=="Windows_NT" setlocal

+

+set DIRNAME=%~dp0

+if "%DIRNAME%" == "" set DIRNAME=.

+set APP_BASE_NAME=%~n0

+set APP_HOME=%DIRNAME%

+

+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.

+set DEFAULT_JVM_OPTS=

+

+@rem Find java.exe

+if defined JAVA_HOME goto findJavaFromJavaHome

+

+set JAVA_EXE=java.exe

+%JAVA_EXE% -version >NUL 2>&1

+if "%ERRORLEVEL%" == "0" goto init

+

+echo.

+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.

+echo.

+echo Please set the JAVA_HOME variable in your environment to match the

+echo location of your Java installation.

+

+goto fail

+

+:findJavaFromJavaHome

+set JAVA_HOME=%JAVA_HOME:"=%

+set JAVA_EXE=%JAVA_HOME%/bin/java.exe

+

+if exist "%JAVA_EXE%" goto init

+

+echo.

+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%

+echo.

+echo Please set the JAVA_HOME variable in your environment to match the

+echo location of your Java installation.

+

+goto fail

+

+:init

+@rem Get command-line arguments, handling Windows variants

+

+if not "%OS%" == "Windows_NT" goto win9xME_args

+

+:win9xME_args

+@rem Slurp the command line arguments.

+set CMD_LINE_ARGS=

+set _SKIP=2

+

+:win9xME_args_slurp

+if "x%~1" == "x" goto execute

+

+set CMD_LINE_ARGS=%*

+

+:execute

+@rem Setup the command line

+

+set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar

+

+@rem Execute Gradle

+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %CMD_LINE_ARGS%

+

+:end

+@rem End local scope for the variables with windows NT shell

+if "%ERRORLEVEL%"=="0" goto mainEnd

+

+:fail

+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of

+rem the _cmd.exe /c_ return code!

+if  not "" == "%GRADLE_EXIT_CONSOLE%" exit 1

+exit /b 1

+

+:mainEnd

+if "%OS%"=="Windows_NT" endlocal

+

+:omega

diff --git a/ash/BUILD.gn b/ash/BUILD.gn
index b3d07e3d..6b4cca1 100644
--- a/ash/BUILD.gn
+++ b/ash/BUILD.gn
@@ -532,9 +532,13 @@
     "shelf/assistant_overlay.h",
     "shelf/back_button.cc",
     "shelf/back_button.h",
+    "shelf/default_shelf_view.cc",
+    "shelf/default_shelf_view.h",
     "shelf/home_button_delegate.cc",
     "shelf/home_button_delegate.h",
     "shelf/ink_drop_button_listener.h",
+    "shelf/kiosk_next_shelf_view.cc",
+    "shelf/kiosk_next_shelf_view.h",
     "shelf/login_shelf_view.cc",
     "shelf/login_shelf_view.h",
     "shelf/overflow_bubble.cc",
@@ -758,8 +762,6 @@
     "system/network/network_section_header_view.h",
     "system/network/network_state_list_detailed_view.cc",
     "system/network/network_state_list_detailed_view.h",
-    "system/network/network_tray_icon_strategy.cc",
-    "system/network/network_tray_icon_strategy.h",
     "system/network/network_tray_view.cc",
     "system/network/network_tray_view.h",
     "system/network/sms_observer.cc",
@@ -2053,6 +2055,15 @@
 
 static_library("test_support") {
   testonly = true
+  friend = [
+    ":*",
+    "//ash/components/shortcut_viewer:*",
+    "//components/exo:*",
+    "//components/exo/wayland:*",
+  ]
+  public = [
+    "public/cpp/system_tray_test_api.h",
+  ]
   sources = [
     "accessibility/test_accessibility_controller_client.cc",
     "accessibility/test_accessibility_controller_client.h",
diff --git a/ash/kiosk_next/kiosk_next_shell_controller.cc b/ash/kiosk_next/kiosk_next_shell_controller.cc
index 88e8f49..d4623aad 100644
--- a/ash/kiosk_next/kiosk_next_shell_controller.cc
+++ b/ash/kiosk_next/kiosk_next_shell_controller.cc
@@ -17,6 +17,7 @@
 #include "ash/shelf/home_button_delegate.h"
 #include "ash/shell.h"
 #include "ash/strings/grit/ash_strings.h"
+#include "base/metrics/histogram_macros.h"
 #include "chromeos/strings/grit/chromeos_strings.h"
 #include "components/account_id/account_id.h"
 #include "components/prefs/pref_registry_simple.h"
@@ -120,6 +121,7 @@
 
   kiosk_next_shell_client_->LaunchKioskNextShell(
       session_controller->GetPrimaryUserSession()->user_info.account_id);
+  UMA_HISTOGRAM_BOOLEAN("KioskNextShell.Launched", true);
 
   shelf_model_ = CreateKioskNextShelfModel();
 
diff --git a/ash/kiosk_next/kiosk_next_shell_controller_unittest.cc b/ash/kiosk_next/kiosk_next_shell_controller_unittest.cc
index 326553b..df5d740 100644
--- a/ash/kiosk_next/kiosk_next_shell_controller_unittest.cc
+++ b/ash/kiosk_next/kiosk_next_shell_controller_unittest.cc
@@ -12,6 +12,7 @@
 #include "ash/public/cpp/ash_features.h"
 #include "ash/shell.h"
 #include "ash/test/ash_test_base.h"
+#include "base/test/metrics/histogram_tester.h"
 #include "base/test/scoped_feature_list.h"
 
 namespace ash {
@@ -53,6 +54,7 @@
  protected:
   std::unique_ptr<MockKioskNextShellClient> client_;
   base::test::ScopedFeatureList scoped_feature_list_;
+  base::HistogramTester histogram_tester_;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(KioskNextShellControllerTest);
@@ -75,6 +77,7 @@
   EXPECT_CALL(*client_, LaunchKioskNextShell(::testing::_)).Times(1);
   LogInKioskNextUser(GetSessionControllerClient());
   EXPECT_TRUE(GetKioskNextShellController()->IsEnabled());
+  histogram_tester_.ExpectUniqueSample("KioskNextShell.Launched", true, 1);
 }
 
 // Ensures that observers are notified when KioskNextUser logs in.
diff --git a/ash/media/media_notification_background.cc b/ash/media/media_notification_background.cc
index 1a8a2a3..b4e99a15 100644
--- a/ash/media/media_notification_background.cc
+++ b/ash/media/media_notification_background.cc
@@ -343,10 +343,10 @@
 }
 
 SkColor MediaNotificationBackground::GetForegroundColor() const {
-  return color_utils::GetColorWithMinimumContrast(
-      foreground_color_.value_or(views::style::GetColor(
-          *owner_, views::style::CONTEXT_LABEL, views::style::STYLE_PRIMARY)),
-      GetBackgroundColor());
+  const SkColor foreground = foreground_color_.value_or(views::style::GetColor(
+      *owner_, views::style::CONTEXT_LABEL, views::style::STYLE_PRIMARY));
+  return color_utils::BlendForMinContrast(foreground, GetBackgroundColor())
+      .color;
 }
 
 int MediaNotificationBackground::GetArtworkWidth(
diff --git a/ash/mojo_test_interface_factory.cc b/ash/mojo_test_interface_factory.cc
index fcd401d..4a06b89 100644
--- a/ash/mojo_test_interface_factory.cc
+++ b/ash/mojo_test_interface_factory.cc
@@ -10,10 +10,8 @@
 #include "ash/public/interfaces/login_screen_test_api.test-mojom.h"
 #include "ash/public/interfaces/shelf_test_api.test-mojom.h"
 #include "ash/public/interfaces/status_area_widget_test_api.test-mojom.h"
-#include "ash/public/interfaces/system_tray_test_api.test-mojom.h"
 #include "ash/shelf/shelf_test_api.h"
 #include "ash/system/status_area_widget_test_api.h"
-#include "ash/system/unified/unified_system_tray_test_api.h"
 #include "base/bind.h"
 #include "base/single_thread_task_runner.h"
 
@@ -38,11 +36,6 @@
   StatusAreaWidgetTestApi::BindRequest(std::move(request));
 }
 
-void BindSystemTrayTestApiOnMainThread(
-    mojom::SystemTrayTestApiRequest request) {
-  UnifiedSystemTrayTestApi::BindRequest(std::move(request));
-}
-
 }  // namespace
 
 void RegisterInterfaces(
@@ -54,8 +47,6 @@
                          main_thread_task_runner);
   registry->AddInterface(base::Bind(&BindStatusAreaWidgetTestApiOnMainThread),
                          main_thread_task_runner);
-  registry->AddInterface(base::Bind(&BindSystemTrayTestApiOnMainThread),
-                         main_thread_task_runner);
 }
 
 }  // namespace mojo_test_interface_factory
diff --git a/ash/public/cpp/default_frame_header.cc b/ash/public/cpp/default_frame_header.cc
index 606c9c9..3a4762a 100644
--- a/ash/public/cpp/default_frame_header.cc
+++ b/ash/public/cpp/default_frame_header.cc
@@ -172,7 +172,7 @@
   const SkColor desired_color = color_utils::IsDark(frame_color)
                                     ? SK_ColorWHITE
                                     : SkColorSetRGB(40, 40, 40);
-  return color_utils::GetColorWithMinimumContrast(desired_color, frame_color);
+  return color_utils::BlendForMinContrast(desired_color, frame_color).color;
 }
 
 ///////////////////////////////////////////////////////////////////////////////
diff --git a/ash/public/cpp/system_tray_test_api.h b/ash/public/cpp/system_tray_test_api.h
new file mode 100644
index 0000000..f6c85350
--- /dev/null
+++ b/ash/public/cpp/system_tray_test_api.h
@@ -0,0 +1,59 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef ASH_PUBLIC_CPP_SYSTEM_TRAY_TEST_API_H_
+#define ASH_PUBLIC_CPP_SYSTEM_TRAY_TEST_API_H_
+
+#include <memory>
+
+#include "ash/ash_export.h"
+#include "base/strings/string16.h"
+
+namespace ash {
+
+// Public test API for the system tray. Methods only apply to the system tray
+// on the primary display.
+class ASH_EXPORT SystemTrayTestApi {
+ public:
+  static std::unique_ptr<SystemTrayTestApi> Create();
+
+  virtual ~SystemTrayTestApi() {}
+
+  // Disables animations (e.g. the tray view icon slide-in).
+  virtual void DisableAnimations() = 0;
+
+  // Returns true if the system tray bubble menu is open.
+  virtual bool IsTrayBubbleOpen() = 0;
+
+  // Shows the system tray bubble menu.
+  virtual void ShowBubble() = 0;
+
+  // Closes the system tray bubble menu.
+  virtual void CloseBubble() = 0;
+
+  // Shows the submenu view for the given section of the bubble menu.
+  virtual void ShowAccessibilityDetailedView() = 0;
+  virtual void ShowNetworkDetailedView() = 0;
+
+  // Returns true if the view exists in the bubble and is visible.
+  // If |open_tray| is true, it also opens system tray bubble.
+  virtual bool IsBubbleViewVisible(int view_id, bool open_tray) = 0;
+
+  // Clicks the view |view_id|.
+  virtual void ClickBubbleView(int view_id) = 0;
+
+  // Returns the tooltip for a bubble view, or the empty string if the view
+  // does not exist.
+  virtual base::string16 GetBubbleViewTooltip(int view_id) = 0;
+
+  // Returns true if the clock is using 24 hour time.
+  virtual bool Is24HourClock() = 0;
+
+ protected:
+  SystemTrayTestApi() {}
+};
+
+}  // namespace ash
+
+#endif  // ASH_PUBLIC_CPP_SYSTEM_TRAY_TEST_API_H_
diff --git a/ash/public/cpp/test_manifest.cc b/ash/public/cpp/test_manifest.cc
index 1989dbfa..4422843 100644
--- a/ash/public/cpp/test_manifest.cc
+++ b/ash/public/cpp/test_manifest.cc
@@ -7,7 +7,6 @@
 #include "ash/public/interfaces/login_screen_test_api.test-mojom.h"
 #include "ash/public/interfaces/shelf_test_api.test-mojom.h"
 #include "ash/public/interfaces/status_area_widget_test_api.test-mojom.h"
-#include "ash/public/interfaces/system_tray_test_api.test-mojom.h"
 #include "base/no_destructor.h"
 #include "services/service_manager/public/cpp/manifest_builder.h"
 
@@ -16,11 +15,10 @@
 const service_manager::Manifest& GetManifestOverlayForTesting() {
   static base::NoDestructor<service_manager::Manifest> manifest{
       service_manager::ManifestBuilder()
-          .ExposeCapability(
-              "test",
-              service_manager::Manifest::InterfaceList<
-                  mojom::LoginScreenTestApi, mojom::ShelfTestApi,
-                  mojom::StatusAreaWidgetTestApi, mojom::SystemTrayTestApi>())
+          .ExposeCapability("test",
+                            service_manager::Manifest::InterfaceList<
+                                mojom::LoginScreenTestApi, mojom::ShelfTestApi,
+                                mojom::StatusAreaWidgetTestApi>())
           .Build()};
   return *manifest;
 }
diff --git a/ash/public/interfaces/BUILD.gn b/ash/public/interfaces/BUILD.gn
index 856bb4b5..35411d6f 100644
--- a/ash/public/interfaces/BUILD.gn
+++ b/ash/public/interfaces/BUILD.gn
@@ -93,7 +93,6 @@
     "login_screen_test_api.test-mojom",
     "shelf_test_api.test-mojom",
     "status_area_widget_test_api.test-mojom",
-    "system_tray_test_api.test-mojom",
   ]
   deps = [
     "//ash/public/interfaces:interfaces_internal",
diff --git a/ash/public/interfaces/system_tray_test_api.test-mojom b/ash/public/interfaces/system_tray_test_api.test-mojom
deleted file mode 100644
index 11973707..0000000
--- a/ash/public/interfaces/system_tray_test_api.test-mojom
+++ /dev/null
@@ -1,55 +0,0 @@
-// Copyright 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-module ash.mojom;
-
-import "mojo/public/mojom/base/string16.mojom";
-
-// Top-level items in the system tray bubble.
-// TODO(jamescook): Consolidate with SystemTrayItem::UmaType.
-enum TrayItem {
-  kAccessibility,
-  kNetwork,
-};
-
-// All methods operate on the system tray on the primary display.
-interface SystemTrayTestApi {
-  // Disables animations (e.g. the tray view icon slide-in).
-  DisableAnimations() => ();
-
-  // Returns true if the system tray bubble menu is open.
-  IsTrayBubbleOpen() => (bool is_open);
-
-  // Returns true if the view exists and is visible in the system tray area
-  // at the bottom of the screen. Usually these views are icons, like the Wi-Fi
-  // or battery icon.
-  IsTrayViewVisible(int32 view_id) => (bool visible);
-
-  // Shows the system tray bubble menu.
-  ShowBubble() => ();
-
-  // Closes the system tray bubble menu.
-  CloseBubble() => ();
-
-  // Shows the submenu view for |item| in the system tray bubble menu.
-  ShowDetailedView(TrayItem item) => ();
-
-  // Returns true if the view exists in the bubble and is visible.
-  // If |open_tray| is true, it also opens system tray bubble.
-  IsBubbleViewVisible(int32 view_id, bool open_tray) => (bool visible);
-
-  // Clicks the view |view_id|.
-  ClickBubbleView(int32 view_id) => ();
-
-  // Returns the tooltip for a bubble view, or the empty string if the view
-  // does not exist.
-  GetBubbleViewTooltip(int32 view_id) => (mojo_base.mojom.String16 tooltip);
-
-  // Returns the label for a bubble view, or the empty string if the view does
-  // not exist. The view must be a views::Label.
-  GetBubbleLabelText(int32 view_id) => (mojo_base.mojom.String16 tooltip);
-
-  // Returns true if the clock is using 24 hour time.
-  Is24HourClock() => (bool is_24_hour);
-};
diff --git a/ash/shelf/default_shelf_view.cc b/ash/shelf/default_shelf_view.cc
new file mode 100644
index 0000000..f08f320
--- /dev/null
+++ b/ash/shelf/default_shelf_view.cc
@@ -0,0 +1,20 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ash/shelf/default_shelf_view.h"
+
+#include "ash/public/cpp/shelf_model.h"
+#include "ash/shelf/shelf.h"
+#include "ash/shelf/shelf_widget.h"
+
+namespace ash {
+
+DefaultShelfView::DefaultShelfView(ShelfModel* model,
+                                   Shelf* shelf,
+                                   ShelfWidget* shelf_widget)
+    : ShelfView(model, shelf, shelf_widget) {}
+
+DefaultShelfView::~DefaultShelfView() = default;
+
+}  // namespace ash
diff --git a/ash/shelf/default_shelf_view.h b/ash/shelf/default_shelf_view.h
new file mode 100644
index 0000000..997a9c1d
--- /dev/null
+++ b/ash/shelf/default_shelf_view.h
@@ -0,0 +1,32 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef ASH_SHELF_DEFAULT_SHELF_VIEW_H_
+#define ASH_SHELF_DEFAULT_SHELF_VIEW_H_
+
+#include "ash/ash_export.h"
+#include "ash/shelf/shelf_view.h"
+#include "base/macros.h"
+
+namespace ash {
+
+class Shelf;
+class ShelfModel;
+class ShelfWidget;
+
+// Default shelf view.
+// TODO(agawrosnka): Move elements that are not common for default and Kiosk
+// Next shelves from ShelfView to this subclass.
+class ASH_EXPORT DefaultShelfView : public ShelfView {
+ public:
+  DefaultShelfView(ShelfModel* model, Shelf* shelf, ShelfWidget* shelf_widget);
+  ~DefaultShelfView() override;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(DefaultShelfView);
+};
+
+}  // namespace ash
+
+#endif  // ASH_SHELF_DEFAULT_SHELF_VIEW_H_
diff --git a/ash/shelf/kiosk_next_shelf_view.cc b/ash/shelf/kiosk_next_shelf_view.cc
new file mode 100644
index 0000000..529066b8
--- /dev/null
+++ b/ash/shelf/kiosk_next_shelf_view.cc
@@ -0,0 +1,89 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ash/shelf/kiosk_next_shelf_view.h"
+
+#include "ash/public/cpp/shelf_model.h"
+#include "ash/shelf/overflow_button.h"
+#include "ash/shelf/shelf.h"
+#include "ash/shelf/shelf_constants.h"
+#include "ash/shelf/shelf_widget.h"
+#include "ash/shell.h"
+#include "ash/system/status_area_widget.h"
+#include "ash/wm/tablet_mode/tablet_mode_controller.h"
+#include "base/logging.h"
+#include "ui/views/controls/separator.h"
+#include "ui/views/view.h"
+#include "ui/views/widget/widget.h"
+
+namespace ash {
+
+namespace {
+
+bool IsTabletModeEnabled() {
+  return Shell::Get()
+      ->tablet_mode_controller()
+      ->IsTabletModeWindowManagerEnabled();
+}
+
+}  // namespace
+
+KioskNextShelfView::KioskNextShelfView(ShelfModel* model,
+                                       Shelf* shelf,
+                                       ShelfWidget* shelf_widget)
+    : ShelfView(model, shelf, shelf_widget) {
+  // Kiosk next shelf has 2 buttons and it is expected to be used in tablet mode
+  // with bottom shelf alignment. It can be adapted to different requirements,
+  // but they should be explicitly verified first.
+  DCHECK(IsTabletModeEnabled());
+  DCHECK(shelf->IsHorizontalAlignment());
+  DCHECK_EQ(2, model->item_count());
+}
+
+KioskNextShelfView::~KioskNextShelfView() = default;
+
+void KioskNextShelfView::Init() {
+  ShelfView::Init();
+
+  // Needs to be called after base class call that creates below objects.
+  // TODO(agawronska): Separator and overflow button are not needed in Kiosk
+  // Next shelf. They should be moved to DefaultShelfView subclass and the below
+  // code should be removed.
+  DCHECK(separator());
+  DCHECK(overflow_button());
+  separator()->SetVisible(false);
+  overflow_button()->SetVisible(false);
+
+  set_first_visible_index(0);
+  set_last_visible_index(model()->item_count() - 1);
+}
+
+void KioskNextShelfView::CalculateIdealBounds() const {
+  DCHECK(shelf()->IsHorizontalAlignment());
+  DCHECK_EQ(2, model()->item_count());
+
+  const int total_shelf_width =
+      shelf_widget()->GetWindowBoundsInScreen().width();
+  int x = total_shelf_width / 2 - kShelfControlSize -
+          ShelfConstants::button_spacing() / 2;
+  for (int i = 0; i < view_model()->view_size(); ++i) {
+    view_model()->set_ideal_bounds(
+        i, gfx::Rect(x, 0, kShelfControlSize, kShelfButtonSize));
+    x += (kShelfControlSize + ShelfConstants::button_spacing());
+  }
+}
+
+void KioskNextShelfView::LayoutAppListAndBackButtonHighlight() {
+  const int total_shelf_width =
+      shelf_widget()->GetWindowBoundsInScreen().width();
+  const int x = total_shelf_width / 2 - kShelfControlSize -
+                ShelfConstants::button_spacing() / 2;
+  const int y = (ShelfConstants::shelf_size() - kShelfControlSize) / 2;
+  const int back_and_app_list_background_size =
+      2 * kShelfControlSize + ShelfConstants::button_spacing();
+  back_and_app_list_background()->SetBounds(
+      x, y, back_and_app_list_background_size, kShelfControlSize);
+}
+
+}  // namespace ash
diff --git a/ash/shelf/kiosk_next_shelf_view.h b/ash/shelf/kiosk_next_shelf_view.h
new file mode 100644
index 0000000..8f028ae6
--- /dev/null
+++ b/ash/shelf/kiosk_next_shelf_view.h
@@ -0,0 +1,46 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef ASH_SHELF_KIOSK_NEXT_SHELF_VIEW_H_
+#define ASH_SHELF_KIOSK_NEXT_SHELF_VIEW_H_
+
+#include "ash/ash_export.h"
+#include "ash/shelf/shelf_view.h"
+#include "base/macros.h"
+
+namespace ash {
+
+class Shelf;
+class ShelfModel;
+class ShelfWidget;
+
+// Shelf view used in Kiosk Next mode.
+// This shelf view is much simpler than the default shelf view. It is always
+// bottom aligned. It shows centered control buttons (back and home). It does
+// not display apps' buttons. Because of this alignment overflow mode is not
+// needed. This shelf view is using ShelfModel, but it could be removed in the
+// future.
+class ASH_EXPORT KioskNextShelfView : public ShelfView {
+ public:
+  KioskNextShelfView(ShelfModel* model,
+                     Shelf* shelf,
+                     ShelfWidget* shelf_widget);
+  ~KioskNextShelfView() override;
+
+  // ShelfView:
+  void Init() override;
+
+ private:
+  // ShelfView:
+  // This method is not really const, because it updates properties of the class
+  // members. The problem comes from parent class that violates constness.
+  void CalculateIdealBounds() const override;
+  void LayoutAppListAndBackButtonHighlight() override;
+
+  DISALLOW_COPY_AND_ASSIGN(KioskNextShelfView);
+};
+
+}  // namespace ash
+
+#endif  // ASH_SHELF_KIOSK_NEXT_SHELF_VIEW_H_
diff --git a/ash/shelf/shelf_view.cc b/ash/shelf/shelf_view.cc
index c24ad9e9..156948a 100644
--- a/ash/shelf/shelf_view.cc
+++ b/ash/shelf/shelf_view.cc
@@ -354,7 +354,7 @@
     : model_(model),
       shelf_(shelf),
       shelf_widget_(shelf_widget),
-      view_model_(new views::ViewModel),
+      view_model_(std::make_unique<views::ViewModel>()),
       bounds_animator_(std::make_unique<views::BoundsAnimator>(this)),
       tooltip_(this),
       focus_search_(std::make_unique<ShelfFocusSearch>(this)),
@@ -915,6 +915,176 @@
   }
 }
 
+void ShelfView::CalculateIdealBounds() const {
+  DCHECK(model_->item_count() == view_model_->view_size());
+
+  const int button_spacing = ShelfConstants::button_spacing();
+  const int available_size = shelf_->PrimaryAxisValue(width(), height());
+
+  const int separator_index = GetSeparatorIndex();
+  const AppCenteringStrategy app_centering_strategy =
+      CalculateAppCenteringStrategy();
+
+  // At this point we know that |last_visible_index_| is up to date.
+  const bool virtual_keyboard_visible =
+      Shell::Get()->system_tray_model()->virtual_keyboard()->visible();
+  // Don't show the separator if it isn't needed, or would appear after all
+  // visible items.
+  separator_->SetVisible(separator_index != -1 &&
+                         separator_index < last_visible_index_ &&
+                         !virtual_keyboard_visible);
+  int app_list_button_position;
+
+  int x = shelf_->PrimaryAxisValue(button_spacing, 0);
+  int y = shelf_->PrimaryAxisValue(0, button_spacing);
+
+  for (int i = 0; i < view_model_->view_size(); ++i) {
+    // "Primary" as in "same direction as the shelf's direction". The
+    // "secondary" (orthogonal) size is always the full shelf to maximize click
+    // targets even for control buttons.
+    const int size_primary =
+        (i <= kAppListButtonIndex) ? kShelfControlSize : kShelfButtonSize;
+    const int size_secondary = kShelfButtonSize;
+
+    if (is_overflow_mode() && i < first_visible_index_) {
+      view_model_->set_ideal_bounds(i, gfx::Rect(x, y, 0, 0));
+      continue;
+    }
+    if (i == kAppListButtonIndex + 1) {
+      // Start centering after we've laid out the app list button.
+
+      StatusAreaWidget* status_widget = shelf_widget_->status_area_widget();
+      const int status_widget_size =
+          status_widget ? shelf_->PrimaryAxisValue(
+                              status_widget->GetWindowBoundsInScreen().width(),
+                              status_widget->GetWindowBoundsInScreen().height())
+                        : 0;
+      const int screen_size = available_size + status_widget_size;
+
+      const int available_size_for_app_icons = GetAvailableSpaceForAppIcons();
+      const int icons_size = GetSizeOfAppIcons(number_of_visible_apps(),
+                                               app_centering_strategy.overflow);
+      int padding_for_centering = 0;
+
+      if (app_centering_strategy.center_on_screen) {
+        padding_for_centering = (screen_size - icons_size) / 2;
+      } else {
+        padding_for_centering =
+            kShelfButtonSpacing +
+            (IsTabletModeEnabled() ? 2 : 1) * kShelfControlSize +
+            kAppIconGroupMargin +
+            (available_size_for_app_icons - icons_size) / 2;
+      }
+
+      if (padding_for_centering >
+          app_list_button_position + kAppIconGroupMargin) {
+        // Only shift buttons to the right, never let them interfere with the
+        // left-aligned system buttons.
+        x = shelf_->PrimaryAxisValue(padding_for_centering, 0);
+        y = shelf_->PrimaryAxisValue(0, padding_for_centering);
+      }
+    }
+
+    view_model_->set_ideal_bounds(
+        i,
+        gfx::Rect(x, y, shelf_->PrimaryAxisValue(size_primary, size_secondary),
+                  shelf_->PrimaryAxisValue(size_secondary, size_primary)));
+
+    // If not in tablet mode do not increase |x| or |y|. Instead just let the
+    // next item (app list button) cover the back button, which will have
+    // opacity 0 anyways.
+    if (i == kBackButtonIndex && !IsTabletModeEnabled())
+      continue;
+
+    x = shelf_->PrimaryAxisValue(x + size_primary + button_spacing, x);
+    y = shelf_->PrimaryAxisValue(y, y + size_primary + button_spacing);
+
+    if (i == kAppListButtonIndex) {
+      app_list_button_position = shelf_->PrimaryAxisValue(x, y);
+      // A larger minimum padding after the app list button is required:
+      // increment with the necessary extra amount.
+      x += shelf_->PrimaryAxisValue(kAppIconGroupMargin - button_spacing, 0);
+      y += shelf_->PrimaryAxisValue(0, kAppIconGroupMargin - button_spacing);
+    }
+
+    if (i == separator_index) {
+      // Place the separator halfway between the two icons it separates,
+      // vertically centered.
+      int half_space = button_spacing / 2;
+      int secondary_offset =
+          (ShelfConstants::shelf_size() - kSeparatorSize) / 2;
+      x -= shelf_->PrimaryAxisValue(half_space, 0);
+      y -= shelf_->PrimaryAxisValue(0, half_space);
+      separator_->SetBounds(
+          x + shelf_->PrimaryAxisValue(0, secondary_offset),
+          y + shelf_->PrimaryAxisValue(secondary_offset, 0),
+          shelf_->PrimaryAxisValue(kSeparatorThickness, kSeparatorSize),
+          shelf_->PrimaryAxisValue(kSeparatorSize, kSeparatorThickness));
+      x += shelf_->PrimaryAxisValue(half_space, 0);
+      y += shelf_->PrimaryAxisValue(0, half_space);
+    }
+  }
+
+  if (is_overflow_mode()) {
+    const_cast<ShelfView*>(this)->UpdateAllButtonsVisibilityInOverflowMode();
+    return;
+  }
+
+  // In the main shelf, the first visible index is either the back button (in
+  // tablet mode) or the launcher button (otherwise).
+  if (!is_overflow_mode()) {
+    first_visible_index_ =
+        IsTabletModeEnabled() ? kBackButtonIndex : kAppListButtonIndex;
+  }
+
+  for (int i = 0; i < view_model_->view_size(); ++i) {
+    // To receive drag event continuously from |drag_view_| during the dragging
+    // off from the shelf, don't make |drag_view_| invisible. It will be
+    // eventually invisible and removed from the |view_model_| by
+    // FinalizeRipOffDrag().
+    if (dragged_off_shelf_ && view_model_->view_at(i) == drag_view_)
+      continue;
+    // If the virtual keyboard is visible, only the back button and the app
+    // list button are shown.
+    const bool is_visible_item = !virtual_keyboard_visible ||
+                                 i == kBackButtonIndex ||
+                                 i == kAppListButtonIndex;
+    view_model_->view_at(i)->SetVisible(i <= last_visible_index_ &&
+                                        is_visible_item);
+  }
+
+  overflow_button_->SetVisible(app_centering_strategy.overflow);
+  if (app_centering_strategy.overflow) {
+    if (overflow_bubble_.get() && overflow_bubble_->IsShowing())
+      UpdateOverflowRange(overflow_bubble_->bubble_view()->shelf_view());
+  } else {
+    if (overflow_bubble_)
+      overflow_bubble_->Hide();
+  }
+}
+
+void ShelfView::LayoutAppListAndBackButtonHighlight() {
+  // Don't show anything if this is the overflow menu.
+  if (is_overflow_mode()) {
+    back_and_app_list_background_->SetVisible(false);
+    return;
+  }
+  const int button_spacing = ShelfConstants::button_spacing();
+  // "Secondary" as in "orthogonal to the shelf primary axis".
+  const int control_secondary_padding =
+      (ShelfConstants::shelf_size() - kShelfControlSize) / 2;
+  const int back_and_app_list_background_size =
+      kShelfControlSize +
+      (IsTabletModeEnabled() ? kShelfControlSize + button_spacing : 0);
+  back_and_app_list_background_->SetBounds(
+      shelf_->PrimaryAxisValue(button_spacing, control_secondary_padding),
+      shelf_->PrimaryAxisValue(control_secondary_padding, button_spacing),
+      shelf_->PrimaryAxisValue(back_and_app_list_background_size,
+                               kShelfControlSize),
+      shelf_->PrimaryAxisValue(kShelfControlSize,
+                               back_and_app_list_background_size));
+}
+
 void ShelfView::DestroyDragIconProxy() {
   drag_image_.reset();
   drag_image_offset_ = gfx::Vector2d(0, 0);
@@ -1188,28 +1358,6 @@
   }
 }
 
-void ShelfView::LayoutAppListAndBackButtonHighlight() const {
-  // Don't show anything if this is the overflow menu.
-  if (is_overflow_mode()) {
-    back_and_app_list_background_->SetVisible(false);
-    return;
-  }
-  const int button_spacing = ShelfConstants::button_spacing();
-  // "Secondary" as in "orthogonal to the shelf primary axis".
-  const int control_secondary_padding =
-      (ShelfConstants::shelf_size() - kShelfControlSize) / 2;
-  const int back_and_app_list_background_size =
-      kShelfControlSize +
-      (IsTabletModeEnabled() ? kShelfControlSize + button_spacing : 0);
-  back_and_app_list_background_->SetBounds(
-      shelf_->PrimaryAxisValue(button_spacing, control_secondary_padding),
-      shelf_->PrimaryAxisValue(control_secondary_padding, button_spacing),
-      shelf_->PrimaryAxisValue(back_and_app_list_background_size,
-                               kShelfControlSize),
-      shelf_->PrimaryAxisValue(kShelfControlSize,
-                               back_and_app_list_background_size));
-}
-
 int ShelfView::GetAvailableSpaceForAppIcons() const {
   // Subtract space already allocated to the app list button, and the back
   // button if applicable.
@@ -1273,154 +1421,6 @@
   return strategy;
 }
 
-void ShelfView::CalculateIdealBounds() const {
-  DCHECK(model_->item_count() == view_model_->view_size());
-
-  const int button_spacing = ShelfConstants::button_spacing();
-  const int available_size = shelf_->PrimaryAxisValue(width(), height());
-
-  const int separator_index = GetSeparatorIndex();
-  const AppCenteringStrategy app_centering_strategy =
-      CalculateAppCenteringStrategy();
-
-  // At this point we know that |last_visible_index_| is up to date.
-  const bool virtual_keyboard_visible =
-      Shell::Get()->system_tray_model()->virtual_keyboard()->visible();
-  // Don't show the separator if it isn't needed, or would appear after all
-  // visible items.
-  separator_->SetVisible(separator_index != -1 &&
-                         separator_index < last_visible_index_ &&
-                         !virtual_keyboard_visible);
-  int app_list_button_position;
-
-  int x = shelf_->PrimaryAxisValue(button_spacing, 0);
-  int y = shelf_->PrimaryAxisValue(0, button_spacing);
-
-  for (int i = 0; i < view_model_->view_size(); ++i) {
-    // "Primary" as in "same direction as the shelf's direction". The
-    // "secondary" (orthogonal) size is always the full shelf to maximize click
-    // targets even for control buttons.
-    const int size_primary =
-        (i <= kAppListButtonIndex) ? kShelfControlSize : kShelfButtonSize;
-    const int size_secondary = kShelfButtonSize;
-
-    if (is_overflow_mode() && i < first_visible_index_) {
-      view_model_->set_ideal_bounds(i, gfx::Rect(x, y, 0, 0));
-      continue;
-    }
-    if (i == kAppListButtonIndex + 1) {
-      // Start centering after we've laid out the app list button.
-
-      StatusAreaWidget* status_widget = shelf_widget_->status_area_widget();
-      const int status_widget_size =
-          status_widget ? shelf_->PrimaryAxisValue(
-                              status_widget->GetWindowBoundsInScreen().width(),
-                              status_widget->GetWindowBoundsInScreen().height())
-                        : 0;
-      const int screen_size = available_size + status_widget_size;
-
-      const int available_size_for_app_icons = GetAvailableSpaceForAppIcons();
-      const int icons_size = GetSizeOfAppIcons(number_of_visible_apps(),
-                                               app_centering_strategy.overflow);
-      int padding_for_centering = 0;
-
-      if (app_centering_strategy.center_on_screen) {
-        padding_for_centering = (screen_size - icons_size) / 2;
-      } else {
-        padding_for_centering =
-            kShelfButtonSpacing +
-            (IsTabletModeEnabled() ? 2 : 1) * kShelfControlSize +
-            kAppIconGroupMargin +
-            (available_size_for_app_icons - icons_size) / 2;
-      }
-
-      if (padding_for_centering >
-          app_list_button_position + kAppIconGroupMargin) {
-        // Only shift buttons to the right, never let them interfere with the
-        // left-aligned system buttons.
-        x = shelf_->PrimaryAxisValue(padding_for_centering, 0);
-        y = shelf_->PrimaryAxisValue(0, padding_for_centering);
-      }
-    }
-
-    view_model_->set_ideal_bounds(
-        i,
-        gfx::Rect(x, y, shelf_->PrimaryAxisValue(size_primary, size_secondary),
-                  shelf_->PrimaryAxisValue(size_secondary, size_primary)));
-
-    // If not in tablet mode do not increase |x| or |y|. Instead just let the
-    // next item (app list button) cover the back button, which will have
-    // opacity 0 anyways.
-    if (i == kBackButtonIndex && !IsTabletModeEnabled())
-      continue;
-
-    x = shelf_->PrimaryAxisValue(x + size_primary + button_spacing, x);
-    y = shelf_->PrimaryAxisValue(y, y + size_primary + button_spacing);
-
-    if (i == kAppListButtonIndex) {
-      app_list_button_position = shelf_->PrimaryAxisValue(x, y);
-      // A larger minimum padding after the app list button is required:
-      // increment with the necessary extra amount.
-      x += shelf_->PrimaryAxisValue(kAppIconGroupMargin - button_spacing, 0);
-      y += shelf_->PrimaryAxisValue(0, kAppIconGroupMargin - button_spacing);
-    }
-
-    if (i == separator_index) {
-      // Place the separator halfway between the two icons it separates,
-      // vertically centered.
-      int half_space = button_spacing / 2;
-      int secondary_offset =
-          (ShelfConstants::shelf_size() - kSeparatorSize) / 2;
-      x -= shelf_->PrimaryAxisValue(half_space, 0);
-      y -= shelf_->PrimaryAxisValue(0, half_space);
-      separator_->SetBounds(
-          x + shelf_->PrimaryAxisValue(0, secondary_offset),
-          y + shelf_->PrimaryAxisValue(secondary_offset, 0),
-          shelf_->PrimaryAxisValue(kSeparatorThickness, kSeparatorSize),
-          shelf_->PrimaryAxisValue(kSeparatorSize, kSeparatorThickness));
-      x += shelf_->PrimaryAxisValue(half_space, 0);
-      y += shelf_->PrimaryAxisValue(0, half_space);
-    }
-  }
-
-  if (is_overflow_mode()) {
-    const_cast<ShelfView*>(this)->UpdateAllButtonsVisibilityInOverflowMode();
-    return;
-  }
-
-  // In the main shelf, the first visible index is either the back button (in
-  // tablet mode) or the launcher button (otherwise).
-  if (!is_overflow_mode()) {
-    first_visible_index_ =
-        IsTabletModeEnabled() ? kBackButtonIndex : kAppListButtonIndex;
-  }
-
-  for (int i = 0; i < view_model_->view_size(); ++i) {
-    // To receive drag event continuously from |drag_view_| during the dragging
-    // off from the shelf, don't make |drag_view_| invisible. It will be
-    // eventually invisible and removed from the |view_model_| by
-    // FinalizeRipOffDrag().
-    if (dragged_off_shelf_ && view_model_->view_at(i) == drag_view_)
-      continue;
-    // If the virtual keyboard is visible, only the back button and the app
-    // list button are shown.
-    const bool is_visible_item = !virtual_keyboard_visible ||
-                                 i == kBackButtonIndex ||
-                                 i == kAppListButtonIndex;
-    view_model_->view_at(i)->SetVisible(i <= last_visible_index_ &&
-                                        is_visible_item);
-  }
-
-  overflow_button_->SetVisible(app_centering_strategy.overflow);
-  if (app_centering_strategy.overflow) {
-    if (overflow_bubble_.get() && overflow_bubble_->IsShowing())
-      UpdateOverflowRange(overflow_bubble_->bubble_view()->shelf_view());
-  } else {
-    if (overflow_bubble_)
-      overflow_bubble_->Hide();
-  }
-}
-
 void ShelfView::LayoutOverflowButton() const {
   DCHECK_NE(0, view_model_->view_size());
   int x = 0;
diff --git a/ash/shelf/shelf_view.h b/ash/shelf/shelf_view.h
index 1517e75..7a2b95b 100644
--- a/ash/shelf/shelf_view.h
+++ b/ash/shelf/shelf_view.h
@@ -11,6 +11,7 @@
 #include <vector>
 
 #include "ash/app_list/views/app_list_drag_and_drop_host.h"
+#include "ash/ash_export.h"
 #include "ash/public/cpp/shelf_item_delegate.h"
 #include "ash/public/cpp/shelf_model_observer.h"
 #include "ash/public/interfaces/app_list_view.mojom.h"
@@ -128,7 +129,7 @@
   Shelf* shelf() const { return shelf_; }
   ShelfModel* model() const { return model_; }
 
-  void Init();
+  virtual void Init();
 
   // Returns the ideal bounds of the specified item, or an empty rect if id
   // isn't know. If the item is in an overflow shelf, the overflow icon location
@@ -326,6 +327,29 @@
   OverflowBubble* overflow_bubble() { return overflow_bubble_.get(); }
   views::ViewModel* view_model() { return view_model_.get(); }
 
+ protected:
+  // Calculates the ideal bounds. The bounds of each button corresponding to an
+  // item in the model is set in |view_model_|.
+  virtual void CalculateIdealBounds() const;
+
+  virtual void LayoutAppListAndBackButtonHighlight();
+
+  views::Separator* separator() { return separator_; }
+
+  OverflowButton* overflow_button() { return overflow_button_; }
+
+  views::View* back_and_app_list_background() {
+    return back_and_app_list_background_;
+  }
+
+  // view_model() is called from const method CalculateIdealBounds() that
+  // modifies it. This is needed to work around ShelfView's problem with const
+  // correctness around CalculateIdealBounds() method.
+  views::ViewModel* view_model() const { return view_model_.get(); }
+
+  void set_first_visible_index(int index) { first_visible_index_ = index; }
+  void set_last_visible_index(int index) { last_visible_index_ = index; }
+
  private:
   friend class ShelfViewTestAPI;
 
@@ -354,7 +378,6 @@
   // Update all button's visibility in overflow.
   void UpdateAllButtonsVisibilityInOverflowMode();
 
-  void LayoutAppListAndBackButtonHighlight() const;
 
   // Returns the size that's actually available for app icons. Size occupied
   // by the app list button and back button plus all appropriate margins is
@@ -365,11 +388,6 @@
   // and sets the |first_visible_index_| and |last_visible_index_| fields
   // appropriately.
   AppCenteringStrategy CalculateAppCenteringStrategy() const;
-
-  // Calculates the ideal bounds. The bounds of each button corresponding to an
-  // item in the model is set in |view_model_|.
-  void CalculateIdealBounds() const;
-
   void LayoutOverflowButton() const;
 
   // Returns the index of the last view whose max primary axis coordinate is
diff --git a/ash/shelf/shelf_view_unittest.cc b/ash/shelf/shelf_view_unittest.cc
index ec8e0a8..d9e99f8 100644
--- a/ash/shelf/shelf_view_unittest.cc
+++ b/ash/shelf/shelf_view_unittest.cc
@@ -3947,6 +3947,10 @@
     // The shelf_view_ in ShelfWidget will be replaced. Therefore, we need
     // to update |shelf_view_|.
     shelf_view_ = GetPrimaryShelf()->GetShelfViewForTesting();
+    ASSERT_GE(shelf_view_->width(), 500);
+
+    test_api_.reset(new ShelfViewTestAPI(shelf_view_));
+    test_api_->SetAnimationDuration(1);  // Speeds up animation for test.
   }
 
  private:
@@ -3977,4 +3981,34 @@
   EXPECT_EQ(1, shelf_view_->last_visible_index());
 }
 
+// Control buttons (back/home) should be centered in Kiosk Next mode.
+TEST_F(KioskNextShelfViewTest, ControlButtonsCentered) {
+  LogInKioskNextUserInternal();
+
+  // Get shelf bounds from the widget - buttons should be centered relatively to
+  // the whole shelf area (consisting of shelf view and status area).
+  const gfx::Rect shelf_bounds = GetPrimaryShelf()
+                                     ->GetShelfViewForTesting()
+                                     ->GetWidget()
+                                     ->GetWindowBoundsInScreen();
+
+  // Switch to local shelf coordinates - buttons bounds are checked in relation
+  // to shelf.
+  gfx::Rect expected_button_area_bounds = gfx::Rect(shelf_bounds.size());
+  const gfx::Size expected_button_area_size =
+      gfx::Size(2 * kShelfControlSize + ShelfConstants::button_spacing(),
+                ShelfConstants::shelf_size());
+  expected_button_area_bounds.ClampToCenteredSize(expected_button_area_size);
+
+  const gfx::Rect back_button_bounds = test_api_->GetIdealBoundsByIndex(0);
+  EXPECT_FALSE(back_button_bounds.IsEmpty());
+  EXPECT_TRUE(expected_button_area_bounds.Contains(back_button_bounds));
+
+  const gfx::Rect home_button_bounds = test_api_->GetIdealBoundsByIndex(1);
+  EXPECT_FALSE(home_button_bounds.IsEmpty());
+  EXPECT_TRUE(expected_button_area_bounds.Contains(home_button_bounds));
+
+  EXPECT_FALSE(back_button_bounds.Intersects(home_button_bounds));
+}
+
 }  // namespace ash
diff --git a/ash/shelf/shelf_widget.cc b/ash/shelf/shelf_widget.cc
index 4e17247..350a87b 100644
--- a/ash/shelf/shelf_widget.cc
+++ b/ash/shelf/shelf_widget.cc
@@ -17,6 +17,8 @@
 #include "ash/root_window_controller.h"
 #include "ash/session/session_controller_impl.h"
 #include "ash/shelf/app_list_button.h"
+#include "ash/shelf/default_shelf_view.h"
+#include "ash/shelf/kiosk_next_shelf_view.h"
 #include "ash/shelf/login_shelf_view.h"
 #include "ash/shelf/overflow_bubble.h"
 #include "ash/shelf/overflow_bubble_view.h"
@@ -325,7 +327,7 @@
                            Shell::Get()->wallpaper_controller()),
       shelf_layout_manager_(new ShelfLayoutManager(this, shelf)),
       delegate_view_(new DelegateView(this)),
-      shelf_view_(new ShelfView(ShelfModel::Get(), shelf_, this)),
+      shelf_view_(new DefaultShelfView(ShelfModel::Get(), shelf_, this)),
       login_shelf_view_(
           new LoginShelfView(RootWindowController::ForWindow(shelf_container)
                                  ->lock_screen_action_background_controller())),
@@ -603,7 +605,7 @@
   shelf_view_->SetVisible(false);
   delete shelf_view_;
 
-  shelf_view_ = new ShelfView(
+  shelf_view_ = new KioskNextShelfView(
       Shell::Get()->kiosk_next_shell_controller()->shelf_model(), shelf_, this);
   shelf_view_->Init();
   GetContentsView()->AddChildView(shelf_view_);
diff --git a/ash/system/network/active_network_icon.cc b/ash/system/network/active_network_icon.cc
index 42fc4263..1b40ac0 100644
--- a/ash/system/network/active_network_icon.cc
+++ b/ash/system/network/active_network_icon.cc
@@ -9,23 +9,24 @@
 #include "ash/system/network/network_icon.h"
 #include "ash/system/tray/tray_constants.h"
 #include "base/stl_util.h"
+#include "base/strings/utf_string_conversions.h"
 #include "chromeos/services/network_config/public/cpp/cros_network_config_util.h"
 #include "chromeos/services/network_config/public/mojom/constants.mojom.h"
 #include "services/service_manager/public/cpp/connector.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/gfx/paint_vector_icon.h"
 
+using chromeos::network_config::mojom::ConnectionStateType;
 using chromeos::network_config::mojom::DeviceStateProperties;
 using chromeos::network_config::mojom::DeviceStateType;
 using chromeos::network_config::mojom::FilterType;
 using chromeos::network_config::mojom::NetworkFilter;
 using chromeos::network_config::mojom::NetworkStateProperties;
+using chromeos::network_config::mojom::NetworkStatePropertiesPtr;
 using chromeos::network_config::mojom::NetworkType;
 
 namespace ash {
 
-using network_icon::NetworkIconState;
-
 namespace {
 
 const int kPurgeDelayMs = 500;
@@ -43,18 +44,18 @@
   return kUnifiedMenuIconColor;
 }
 
-base::Optional<NetworkIconState> GetConnectingOrConnected(
-    const NetworkStateProperties* connecting_network,
-    const NetworkStateProperties* connected_network) {
+NetworkStatePropertiesPtr GetConnectingOrConnected(
+    const NetworkStatePropertiesPtr* connecting_network,
+    const NetworkStatePropertiesPtr* connected_network) {
   if (connecting_network &&
-      (!connected_network || connecting_network->connect_requested)) {
+      (!connected_network || connecting_network->get()->connect_requested)) {
     // If connecting to a network, and there is either no connected network or
     // the connection was user requested, use the connecting network.
-    return base::make_optional<NetworkIconState>(connecting_network);
+    return connecting_network->Clone();
   }
   if (connected_network)
-    return base::make_optional<NetworkIconState>(connected_network);
-  return base::nullopt;
+    return connected_network->Clone();
+  return nullptr;
 }
 
 }  // namespace
@@ -86,6 +87,91 @@
                      base::Unretained(this), connector));
 }
 
+void ActiveNetworkIcon::GetConnectionStatusStrings(Type type,
+                                                   base::string16* a11y_name,
+                                                   base::string16* a11y_desc,
+                                                   base::string16* tooltip) {
+  const NetworkStateProperties* network = nullptr;
+  switch (type) {
+    case Type::kSingle:
+      network = default_network_.get();
+      break;
+    case Type::kPrimary:
+      // TODO(902409): Provide strings for technology or connecting.
+      network = default_network_.get();
+      break;
+    case Type::kCellular:
+      network = active_cellular_.get();
+      break;
+  }
+  if (network &&
+      chromeos::network_config::StateIsConnected(network->connection_state)) {
+    *a11y_name =
+        l10n_util::GetStringFUTF16(IDS_ASH_STATUS_TRAY_NETWORK_CONNECTED,
+                                   base::UTF8ToUTF16(network->name));
+    base::string16 signal_strength_string;
+    if (chromeos::network_config::NetworkTypeMatchesType(
+            network->type, NetworkType::kWireless)) {
+      // Retrieve the string describing the signal strength, if it is applicable
+      // to |network|.
+      int signal_strength =
+          chromeos::network_config::GetWirelessSignalStrength(network);
+      switch (network_icon::GetSignalStrength(signal_strength)) {
+        case network_icon::SignalStrength::NONE:
+          break;
+        case network_icon::SignalStrength::WEAK:
+          signal_strength_string = l10n_util::GetStringUTF16(
+              IDS_ASH_STATUS_TRAY_NETWORK_SIGNAL_WEAK);
+          break;
+        case network_icon::SignalStrength::MEDIUM:
+          signal_strength_string = l10n_util::GetStringUTF16(
+              IDS_ASH_STATUS_TRAY_NETWORK_SIGNAL_MEDIUM);
+          break;
+        case network_icon::SignalStrength::STRONG:
+          signal_strength_string = l10n_util::GetStringUTF16(
+              IDS_ASH_STATUS_TRAY_NETWORK_SIGNAL_STRONG);
+          break;
+      }
+    }
+    *a11y_desc = signal_strength_string;
+    *tooltip =
+        signal_strength_string.empty()
+            ? *a11y_name
+            : l10n_util::GetStringFUTF16(
+                  IDS_ASH_STATUS_TRAY_NETWORK_CONNECTED_ACCESSIBLE,
+                  base::UTF8ToUTF16(network->name), signal_strength_string);
+  } else if (network &&
+             network->connection_state == ConnectionStateType::kConnecting) {
+    *a11y_name = l10n_util::GetStringUTF16(
+        IDS_ASH_STATUS_TRAY_NETWORK_NOT_CONNECTED_A11Y);
+    *a11y_desc = base::string16();
+    *tooltip = l10n_util::GetStringFUTF16(
+        IDS_ASH_STATUS_TRAY_NETWORK_CONNECTING_TOOLTIP,
+        base::UTF8ToUTF16(network->name));
+  } else {
+    *a11y_name = l10n_util::GetStringUTF16(
+        IDS_ASH_STATUS_TRAY_NETWORK_NOT_CONNECTED_A11Y);
+    *a11y_desc = base::string16();
+    *tooltip = l10n_util::GetStringUTF16(
+        IDS_ASH_STATUS_TRAY_NETWORK_DISCONNECTED_TOOLTIP);
+  }
+}
+
+gfx::ImageSkia ActiveNetworkIcon::GetImage(Type type,
+                                           network_icon::IconType icon_type,
+                                           bool* animating) {
+  switch (type) {
+    case Type::kSingle:
+      return GetSingleImage(icon_type, animating);
+    case Type::kPrimary:
+      return GetDualImagePrimary(icon_type, animating);
+    case Type::kCellular:
+      return GetDualImageCellular(icon_type, animating);
+  }
+  NOTREACHED();
+  return gfx::ImageSkia();
+}
+
 gfx::ImageSkia ActiveNetworkIcon::GetSingleImage(
     network_icon::IconType icon_type,
     bool* animating) {
@@ -96,24 +182,26 @@
     return network_icon::GetConnectingImageForNetworkType(
         NetworkType::kCellular, icon_type);
   }
-  return GetDefaultImageImpl(default_network_, icon_type, animating);
+  return GetDefaultImageImpl(default_network_.get(), icon_type, animating);
 }
 
 gfx::ImageSkia ActiveNetworkIcon::GetDualImagePrimary(
     network_icon::IconType icon_type,
     bool* animating) {
   if (default_network_ && default_network_->type == NetworkType::kCellular) {
-    if (network_icon::IsConnected(*default_network_)) {
-      // TODO: Show proper technology badges.
+    if (chromeos::network_config::StateIsConnected(
+            default_network_->connection_state)) {
+      // TODO(902409): Show proper technology badges.
       if (animating)
         *animating = false;
       return gfx::CreateVectorIcon(kNetworkBadgeTechnologyLteIcon,
                                    GetDefaultColorForIconType(icon_type));
     }
     // If Cellular is connecting, use the active non cellular network.
-    return GetDefaultImageImpl(active_non_cellular_, icon_type, animating);
+    return GetDefaultImageImpl(active_non_cellular_.get(), icon_type,
+                               animating);
   }
-  return GetDefaultImageImpl(default_network_, icon_type, animating);
+  return GetDefaultImageImpl(default_network_.get(), icon_type, animating);
 }
 
 gfx::ImageSkia ActiveNetworkIcon::GetDualImageCellular(
@@ -140,20 +228,20 @@
   }
 
   return network_icon::GetImageForNonVirtualNetwork(
-      *active_cellular_, icon_type, false /* show_vpn_badge */, animating);
+      active_cellular_.get(), icon_type, false /* show_vpn_badge */, animating);
 }
 
 gfx::ImageSkia ActiveNetworkIcon::GetDefaultImageImpl(
-    const base::Optional<NetworkIconState>& default_network,
+    const NetworkStateProperties* network,
     network_icon::IconType icon_type,
     bool* animating) {
-  if (!default_network) {
+  if (!network) {
     VLOG(1) << __func__ << ": No network";
     return GetDefaultImageForNoNetwork(icon_type, animating);
   }
   // Don't show connected Ethernet in the tray unless a VPN is present.
-  if (default_network->type == NetworkType::kEthernet &&
-      IsTrayIcon(icon_type) && !active_vpn_) {
+  if (network->type == NetworkType::kEthernet && IsTrayIcon(icon_type) &&
+      !active_vpn_) {
     if (animating)
       *animating = false;
     VLOG(1) << __func__ << ": Ethernet: No icon";
@@ -161,20 +249,20 @@
   }
 
   // Connected network with a connecting VPN.
-  if (network_icon::IsConnected(*default_network) && active_vpn_ &&
-      network_icon::IsConnecting(*active_vpn_)) {
+  if (chromeos::network_config::StateIsConnected(network->connection_state) &&
+      active_vpn_ &&
+      active_vpn_->connection_state == ConnectionStateType::kConnecting) {
     if (animating)
       *animating = true;
     VLOG(1) << __func__ << ": Connected with connecting VPN";
-    return network_icon::GetConnectedNetworkWithConnectingVpnImage(
-        *default_network, icon_type);
+    return network_icon::GetConnectedNetworkWithConnectingVpnImage(network,
+                                                                   icon_type);
   }
 
   // Default behavior: connected or connecting network, possibly with VPN badge.
   bool show_vpn_badge = !!active_vpn_;
-  VLOG(1) << __func__ << ": Network: " << default_network->name
-          << " Strength: " << default_network->signal_strength;
-  return network_icon::GetImageForNonVirtualNetwork(*default_network, icon_type,
+  VLOG(1) << __func__ << ": Network: " << network->name;
+  return network_icon::GetImageForNonVirtualNetwork(network, icon_type,
                                                     show_vpn_badge, animating);
 }
 
@@ -234,52 +322,50 @@
   active_cellular_.reset();
   active_vpn_.reset();
 
-  const NetworkStateProperties* connected_network = nullptr;
-  const NetworkStateProperties* connected_non_cellular = nullptr;
-  const NetworkStateProperties* connecting_network = nullptr;
-  const NetworkStateProperties* connecting_non_cellular = nullptr;
-  for (const auto& network_ptr : networks) {
-    const NetworkStateProperties* network = network_ptr.get();
+  const NetworkStatePropertiesPtr* connected_network = nullptr;
+  const NetworkStatePropertiesPtr* connected_non_cellular = nullptr;
+  const NetworkStatePropertiesPtr* connecting_network = nullptr;
+  const NetworkStatePropertiesPtr* connecting_non_cellular = nullptr;
+  for (const NetworkStatePropertiesPtr& network : networks) {
     if (network->type == NetworkType::kVPN) {
       if (!active_vpn_)
-        active_vpn_ = base::make_optional<NetworkIconState>(network);
+        active_vpn_ = network.Clone();
       continue;
     }
     if (network->type == NetworkType::kCellular) {
       if (!active_cellular_)
-        active_cellular_ = base::make_optional<NetworkIconState>(network);
+        active_cellular_ = network.Clone();
     }
     if (chromeos::network_config::StateIsConnected(network->connection_state)) {
       if (!connected_network)
-        connected_network = network;
+        connected_network = &network;
       if (!connected_non_cellular && network->type != NetworkType::kCellular) {
-        connected_non_cellular = network;
+        connected_non_cellular = &network;
       }
       continue;
     }
     // Active non connected networks are connecting.
     if (chromeos::network_config::NetworkStateMatchesType(
-            network, NetworkType::kWireless)) {
+            network.get(), NetworkType::kWireless)) {
       if (!connecting_network)
-        connecting_network = network;
+        connecting_network = &network;
       if (!connecting_non_cellular && network->type != NetworkType::kCellular) {
-        connecting_non_cellular = network;
+        connecting_non_cellular = &network;
       }
     }
   }
 
   VLOG_IF(2, connected_network)
-      << __func__ << ": Connected network: " << connected_network->name
-      << " State: " << connected_network->connection_state;
+      << __func__ << ": Connected network: " << connected_network->get()->name
+      << " State: " << connected_network->get()->connection_state;
   VLOG_IF(2, connecting_network)
-      << __func__ << ": Connecting network: " << connecting_network->name
-      << " State: " << connecting_network->connection_state;
+      << __func__ << ": Connecting network: " << connecting_network->get()->name
+      << " State: " << connecting_network->get()->connection_state;
 
   default_network_ =
       GetConnectingOrConnected(connecting_network, connected_network);
   VLOG_IF(2, default_network_)
-      << __func__ << ": Default network: " << default_network_->name
-      << " Strength: " << default_network_->signal_strength;
+      << __func__ << ": Default network: " << default_network_->name;
 
   active_non_cellular_ =
       GetConnectingOrConnected(connecting_non_cellular, connected_non_cellular);
diff --git a/ash/system/network/active_network_icon.h b/ash/system/network/active_network_icon.h
index 70904b5..2371ae7 100644
--- a/ash/system/network/active_network_icon.h
+++ b/ash/system/network/active_network_icon.h
@@ -12,7 +12,6 @@
 #include "ash/system/network/network_icon.h"
 #include "base/containers/flat_map.h"
 #include "base/macros.h"
-#include "base/optional.h"
 #include "base/strings/string16.h"
 #include "base/time/time.h"
 #include "base/timer/timer.h"
@@ -45,28 +44,39 @@
 class ASH_EXPORT ActiveNetworkIcon
     : public chromeos::network_config::mojom::CrosNetworkConfigObserver {
  public:
+  enum class Type {
+    kSingle,    // A single network icon in the tray.
+    kPrimary,   // Multiple network icons: primary (non mobile) icon.
+    kCellular,  // Multiple network icons: cellular icon.
+  };
+
   explicit ActiveNetworkIcon(service_manager::Connector* connector);
   ~ActiveNetworkIcon() override;
 
-  // Single image mode. Returns a network icon (which may be empty) and sets
-  // |animating| if provided.
-  gfx::ImageSkia GetSingleImage(network_icon::IconType icon_type,
-                                bool* animating);
+  // Provides the a11y and tooltip strings for |type|.
+  void GetConnectionStatusStrings(Type type,
+                                  base::string16* a11y_name,
+                                  base::string16* a11y_desc,
+                                  base::string16* tooltip);
 
-  // Dual image mode. Returns the primary icon (which may be empty) and sets
-  // |animating| if provided.
-  gfx::ImageSkia GetDualImagePrimary(network_icon::IconType icon_type,
-                                     bool* animating);
-
-  // Dual image mode. Returns the Cellular icon (which may be empty) and sets
-  // |animating| if provided.
-  gfx::ImageSkia GetDualImageCellular(network_icon::IconType icon_type,
-                                      bool* animating);
+  // Returns a network icon (which may be empty) and sets |animating| if
+  // provided.
+  gfx::ImageSkia GetImage(Type type,
+                          network_icon::IconType icon_type,
+                          bool* animating);
 
  private:
   void BindCrosNetworkConfig(service_manager::Connector* connector);
+
+  gfx::ImageSkia GetSingleImage(network_icon::IconType icon_type,
+                                bool* animating);
+  gfx::ImageSkia GetDualImagePrimary(network_icon::IconType icon_type,
+                                     bool* animating);
+  gfx::ImageSkia GetDualImageCellular(network_icon::IconType icon_type,
+                                      bool* animating);
   gfx::ImageSkia GetDefaultImageImpl(
-      const base::Optional<network_icon::NetworkIconState>& default_network,
+      const chromeos::network_config::mojom::NetworkStateProperties*
+          default_network,
       network_icon::IconType icon_type,
       bool* animating);
 
@@ -100,10 +110,11 @@
   base::flat_map<chromeos::network_config::mojom::NetworkType,
                  chromeos::network_config::mojom::DeviceStatePropertiesPtr>
       devices_;
-  base::Optional<network_icon::NetworkIconState> default_network_;
-  base::Optional<network_icon::NetworkIconState> active_non_cellular_;
-  base::Optional<network_icon::NetworkIconState> active_cellular_;
-  base::Optional<network_icon::NetworkIconState> active_vpn_;
+  chromeos::network_config::mojom::NetworkStatePropertiesPtr default_network_;
+  chromeos::network_config::mojom::NetworkStatePropertiesPtr
+      active_non_cellular_;
+  chromeos::network_config::mojom::NetworkStatePropertiesPtr active_cellular_;
+  chromeos::network_config::mojom::NetworkStatePropertiesPtr active_vpn_;
   int cellular_uninitialized_msg_ = 0;
   base::Time uninitialized_state_time_;
   base::OneShotTimer purge_timer_;
diff --git a/ash/system/network/active_network_icon_unittest.cc b/ash/system/network/active_network_icon_unittest.cc
index a354f41..4a2c6c6 100644
--- a/ash/system/network/active_network_icon_unittest.cc
+++ b/ash/system/network/active_network_icon_unittest.cc
@@ -30,6 +30,7 @@
 
 const char kShillManagerClientStubCellularDevice[] =
     "/device/stub_cellular_device";
+const char kCellularNetworkGuid[] = "cellular_guid";
 
 }  // namespace
 
@@ -74,9 +75,10 @@
       network_state_helper().device_test()->AddDevice(
           kShillManagerClientStubCellularDevice, shill::kTypeCellular,
           "stub_cellular_device");
-      cellular_path_ = ConfigureService(
-          R"({"GUID": "cellular_guid", "Type": "cellular", "Technology": "LTE",
-            "State": "idle"})");
+      cellular_path_ = ConfigureService(base::StringPrintf(
+          R"({"GUID": "%s", "Type": "cellular", "Technology": "LTE",
+            "State": "idle"})",
+          kCellularNetworkGuid));
     }
     SetServiceProperty(cellular_path_, shill::kStateProperty,
                        base::Value(state));
@@ -115,8 +117,7 @@
             network_state_helper().CreateStandaloneNetworkProperties(
                 id, type, connection_state, signal_strength);
     return network_icon::GetImageForNonVirtualNetwork(
-        network_icon::NetworkIconState(reference_properties.get()), icon_type_,
-        false /* show_vpn_badge */);
+        reference_properties.get(), icon_type_, false /* show_vpn_badge */);
   }
 
   bool AreImagesEqual(const gfx::ImageSkia& image,
@@ -166,12 +167,30 @@
   DISALLOW_COPY_AND_ASSIGN(ActiveNetworkIconTest);
 };
 
+TEST_F(ActiveNetworkIconTest, GetConnectionStatusStrings) {
+  // TODO(902409): Test multi icon and improve coverage.
+  SetupCellular(shill::kStateOnline);
+  base::string16 name, desc, tooltip;
+  active_network_icon()->GetConnectionStatusStrings(
+      ActiveNetworkIcon::Type::kSingle, &name, &desc, &tooltip);
+  // Note: The guid is used for the name in ConfigureService.
+  EXPECT_EQ(l10n_util::GetStringFUTF16(IDS_ASH_STATUS_TRAY_NETWORK_CONNECTED,
+                                       base::UTF8ToUTF16(kCellularNetworkGuid)),
+            name);
+  EXPECT_EQ(
+      l10n_util::GetStringFUTF16(
+          IDS_ASH_STATUS_TRAY_NETWORK_CONNECTED_ACCESSIBLE,
+          base::UTF8ToUTF16(kCellularNetworkGuid),
+          l10n_util::GetStringUTF16(IDS_ASH_STATUS_TRAY_NETWORK_SIGNAL_STRONG)),
+      tooltip);
+}
+
 TEST_F(ActiveNetworkIconTest, GetSingleImage) {
   // Cellular only = Cellular icon
   SetupCellular(shill::kStateOnline);
   bool animating;
-  gfx::ImageSkia image =
-      active_network_icon()->GetSingleImage(icon_type(), &animating);
+  gfx::ImageSkia image = active_network_icon()->GetImage(
+      ActiveNetworkIcon::Type::kSingle, icon_type(), &animating);
   EXPECT_TRUE(AreImagesEqual(
       image,
       ImageForNetwork(NetworkType::kCellular, ConnectionStateType::kOnline)));
@@ -179,7 +198,8 @@
 
   // Cellular + WiFi connected = WiFi connected icon
   SetupWiFi(shill::kStateOnline);
-  image = active_network_icon()->GetSingleImage(icon_type(), &animating);
+  image = active_network_icon()->GetImage(ActiveNetworkIcon::Type::kSingle,
+                                          icon_type(), &animating);
   EXPECT_TRUE(AreImagesEqual(
       image,
       ImageForNetwork(NetworkType::kWiFi, ConnectionStateType::kOnline)));
@@ -191,7 +211,8 @@
   SetServiceProperty(wifi_path(), shill::kSignalStrengthProperty,
                      base::Value(50));
   base::RunLoop().RunUntilIdle();
-  image = active_network_icon()->GetSingleImage(icon_type(), &animating);
+  image = active_network_icon()->GetImage(ActiveNetworkIcon::Type::kSingle,
+                                          icon_type(), &animating);
   EXPECT_TRUE(AreImagesEqual(
       image, ImageForNetwork(NetworkType::kWiFi,
                              ConnectionStateType::kConnecting, 50)));
@@ -199,7 +220,8 @@
 
   // Cellular + WiFi connecting + Ethernet = WiFi connecting icon
   SetupEthernet();
-  image = active_network_icon()->GetSingleImage(icon_type(), &animating);
+  image = active_network_icon()->GetImage(ActiveNetworkIcon::Type::kSingle,
+                                          icon_type(), &animating);
   EXPECT_TRUE(AreImagesEqual(
       image, ImageForNetwork(NetworkType::kWiFi,
                              ConnectionStateType::kConnecting, 50)));
@@ -208,7 +230,8 @@
   // Cellular + WiFi connected + Ethernet = No icon
   SetupWiFi(shill::kStateOnline);
   network_state_handler()->SetNetworkConnectRequested(wifi_path(), false);
-  image = active_network_icon()->GetSingleImage(icon_type(), &animating);
+  image = active_network_icon()->GetImage(ActiveNetworkIcon::Type::kSingle,
+                                          icon_type(), &animating);
   EXPECT_TRUE(image.isNull());
   EXPECT_FALSE(animating);
 }
@@ -217,8 +240,8 @@
   SetCellularUninitialized(false /* scanning */);
 
   bool animating;
-  gfx::ImageSkia image =
-      active_network_icon()->GetSingleImage(icon_type(), &animating);
+  gfx::ImageSkia image = active_network_icon()->GetImage(
+      ActiveNetworkIcon::Type::kSingle, icon_type(), &animating);
   EXPECT_TRUE(
       AreImagesEqual(image, ImageForNetwork(NetworkType::kCellular,
                                             ConnectionStateType::kConnecting)));
@@ -232,8 +255,8 @@
       chromeos::NetworkTypePattern::Cellular()));
 
   bool animating;
-  gfx::ImageSkia image =
-      active_network_icon()->GetSingleImage(icon_type(), &animating);
+  gfx::ImageSkia image = active_network_icon()->GetImage(
+      ActiveNetworkIcon::Type::kSingle, icon_type(), &animating);
   EXPECT_TRUE(
       AreImagesEqual(image, ImageForNetwork(NetworkType::kCellular,
                                             ConnectionStateType::kConnecting)));
diff --git a/ash/system/network/network_feature_pod_button.cc b/ash/system/network/network_feature_pod_button.cc
index 03bac40..b5ff745 100644
--- a/ash/system/network/network_feature_pod_button.cc
+++ b/ash/system/network/network_feature_pod_button.cc
@@ -194,7 +194,8 @@
 void NetworkFeaturePodButton::Update() {
   bool animating = false;
   gfx::ImageSkia image =
-      Shell::Get()->system_tray_model()->active_network_icon()->GetSingleImage(
+      Shell::Get()->system_tray_model()->active_network_icon()->GetImage(
+          ActiveNetworkIcon::Type::kSingle,
           network_icon::ICON_TYPE_DEFAULT_VIEW, &animating);
   if (animating)
     network_icon::NetworkIconAnimation::GetInstance()->AddObserver(this);
diff --git a/ash/system/network/network_icon.cc b/ash/system/network/network_icon.cc
index 564908e..3159a91 100644
--- a/ash/system/network/network_icon.cc
+++ b/ash/system/network/network_icon.cc
@@ -28,6 +28,7 @@
 
 using chromeos::network_config::mojom::ActivationStateType;
 using chromeos::network_config::mojom::ConnectionStateType;
+using chromeos::network_config::mojom::NetworkStateProperties;
 using chromeos::network_config::mojom::NetworkType;
 using chromeos::network_config::mojom::SecurityType;
 
@@ -45,22 +46,22 @@
 
   // Determines whether or not the associated network might be dirty and if so
   // updates and generates the icon. Does nothing if network no longer exists.
-  void Update(const NetworkIconState& network, bool show_vpn_badge);
+  void Update(const NetworkStateProperties* network, bool show_vpn_badge);
 
   const gfx::ImageSkia& image() const { return image_; }
 
  private:
   // Updates |strength_index_| for wireless networks. Returns true if changed.
-  bool UpdateWirelessStrengthIndex(const NetworkIconState& network);
+  bool UpdateWirelessStrengthIndex(const NetworkStateProperties* network);
 
   // Updates the local state for cellular networks. Returns true if changed.
-  bool UpdateCellularState(const NetworkIconState& network);
+  bool UpdateCellularState(const NetworkStateProperties* network);
 
   // Gets |badges| based on |network| and the current state.
-  void GetBadges(const NetworkIconState& network, Badges* badges);
+  void GetBadges(const NetworkStateProperties* network, Badges* badges);
 
   // Gets the appropriate icon and badges and composites the image.
-  void GenerateImage(const NetworkIconState& network);
+  void GenerateImage(const NetworkStateProperties* network);
 
   // Defines color theme and VPN badging
   const IconType icon_type_;
@@ -250,10 +251,11 @@
   return zero_based_index + 1;
 }
 
-Badge BadgeForNetworkTechnology(const NetworkIconState& network,
+Badge BadgeForNetworkTechnology(const NetworkStateProperties* network,
                                 IconType icon_type) {
+  DCHECK(network->type == NetworkType::kCellular);
   Badge badge = {nullptr, GetDefaultColorForIconType(icon_type)};
-  const std::string& technology = network.network_technology;
+  const std::string& technology = network->cellular->network_technology;
   if (technology == onc::cellular::kTechnologyEvdo) {
     badge.icon = &kNetworkBadgeTechnologyEvdoIcon;
   } else if (technology == onc::cellular::kTechnologyCdma1Xrtt) {
@@ -279,21 +281,22 @@
   return badge;
 }
 
-gfx::ImageSkia GetIcon(const NetworkIconState& network,
+gfx::ImageSkia GetIcon(const NetworkStateProperties* network,
                        IconType icon_type,
                        int strength_index) {
-  if (network.type == NetworkType::kEthernet) {
+  if (network->type == NetworkType::kEthernet) {
     return gfx::CreateVectorIcon(vector_icons::kEthernetIcon,
                                  GetDefaultColorForIconType(icon_type));
   }
-  if (network.type == NetworkType::kVPN) {
+  if (network->type == NetworkType::kVPN) {
     DCHECK(!IsTrayIcon(icon_type));
     return gfx::CreateVectorIcon(kNetworkVpnIcon,
                                  GetDefaultColorForIconType(ICON_TYPE_LIST));
   }
-  DCHECK_GE(strength_index, 0) << "Strength not set for type: " << network.type;
+  DCHECK_GE(strength_index, 0)
+      << "Strength not set for type: " << network->type;
   DCHECK_LT(strength_index, kNumNetworkImages);
-  return GetImageForIndex(ImageTypeForNetworkType(network.type), icon_type,
+  return GetImageForIndex(ImageTypeForNetworkType(network->type), icon_type,
                           strength_index);
 }
 
@@ -305,41 +308,6 @@
 
 }  // namespace
 
-NetworkIconState::NetworkIconState(
-    const chromeos::network_config::mojom::NetworkStateProperties* network) {
-  guid = network->guid;
-  name = network->name;
-  type = network->type;
-  connection_state = network->connection_state;
-  if (type == NetworkType::kCellular) {
-    activation_state = network->cellular->activation_state;
-    network_technology = network->cellular->network_technology;
-    is_roaming = network->cellular->roaming;
-    signal_strength = network->cellular->signal_strength;
-  } else {
-    activation_state = ActivationStateType::kUnknown;
-  }
-  if (type == NetworkType::kTether) {
-    signal_strength = network->tether->signal_strength;
-  }
-  if (type == NetworkType::kWiFi) {
-    security = network->wifi->security;
-    signal_strength = network->wifi->signal_strength;
-  } else {
-    security = chromeos::network_config::mojom::SecurityType::kNone;
-  }
-  if (type == NetworkType::kWiMAX) {
-    signal_strength = network->wimax->signal_strength;
-  }
-}
-
-NetworkIconState::NetworkIconState(const NetworkIconState& other) = default;
-
-NetworkIconState& NetworkIconState::operator=(const NetworkIconState& other) =
-    default;
-
-NetworkIconState::~NetworkIconState() = default;
-
 //------------------------------------------------------------------------------
 // NetworkIconImpl
 
@@ -350,19 +318,19 @@
   // Default image is null.
 }
 
-void NetworkIconImpl::Update(const NetworkIconState& network,
+void NetworkIconImpl::Update(const NetworkStateProperties* network,
                              bool show_vpn_badge) {
   // Determine whether or not we need to update the icon.
   bool dirty = image_.isNull();
 
-  if (network.connection_state != connection_state_) {
+  if (network->connection_state != connection_state_) {
     VLOG(2) << "Update connection state: "
-            << static_cast<int>(network.connection_state);
-    connection_state_ = network.connection_state;
+            << static_cast<int>(network->connection_state);
+    connection_state_ = network->connection_state;
     dirty = true;
   }
 
-  NetworkType type = network.type;
+  NetworkType type = network->type;
   if (chromeos::network_config::NetworkTypeMatchesType(
           type, NetworkType::kWireless)) {
     dirty |= UpdateWirelessStrengthIndex(network);
@@ -385,8 +353,9 @@
 }
 
 bool NetworkIconImpl::UpdateWirelessStrengthIndex(
-    const NetworkIconState& network) {
-  int index = StrengthIndex(network.signal_strength);
+    const NetworkStateProperties* network) {
+  int index = StrengthIndex(
+      chromeos::network_config::GetWirelessSignalStrength(network));
   if (index != strength_index_) {
     VLOG(2) << "New strength index: " << index;
     strength_index_ = index;
@@ -395,7 +364,8 @@
   return false;
 }
 
-bool NetworkIconImpl::UpdateCellularState(const NetworkIconState& network) {
+bool NetworkIconImpl::UpdateCellularState(
+    const NetworkStateProperties* network) {
   bool dirty = false;
   if (!features::IsSeparateNetworkIconsEnabled()) {
     const Badge technology_badge =
@@ -407,29 +377,34 @@
     }
   }
 
-  if (network.is_roaming != is_roaming_) {
-    VLOG(2) << "New is_roaming: " << network.is_roaming;
-    is_roaming_ = network.is_roaming;
+  bool roaming = network->cellular->roaming;
+  if (roaming != is_roaming_) {
+    VLOG(2) << "New is_roaming: " << roaming;
+    is_roaming_ = roaming;
     dirty = true;
   }
   return dirty;
 }
 
-void NetworkIconImpl::GetBadges(const NetworkIconState& network,
+void NetworkIconImpl::GetBadges(const NetworkStateProperties* network,
                                 Badges* badges) {
-  const NetworkType type = network.type;
+  const NetworkType type = network->type;
   const SkColor icon_color = GetDefaultColorForIconType(icon_type_);
+  bool is_connected =
+      chromeos::network_config::StateIsConnected(network->connection_state);
   if (type == NetworkType::kWiFi) {
-    if (network.security != SecurityType::kNone && !IsTrayIcon(icon_type_)) {
+    if (network->wifi->security != SecurityType::kNone &&
+        !IsTrayIcon(icon_type_)) {
       badges->bottom_right = {&kUnifiedNetworkBadgeSecureIcon, icon_color};
     }
   } else if (type == NetworkType::kCellular) {
     // technology_badge_ is set in UpdateCellularState.
-    if (IsConnected(network) && network.is_roaming)
+    if (is_connected && network->cellular->roaming) {
       badges->bottom_right = {&kNetworkBadgeRoamingIcon, icon_color};
+    }
   }
   // Only show technology badge when connected.
-  if (IsConnected(network) && !features::IsSeparateNetworkIconsEnabled())
+  if (is_connected && !features::IsSeparateNetworkIconsEnabled())
     badges->top_left = technology_badge_;
   if (show_vpn_badge_)
     badges->bottom_left = {&kUnifiedNetworkBadgeVpnIcon, icon_color};
@@ -437,7 +412,7 @@
     badges->bottom_right = {&kUnifiedNetworkBadgeCaptivePortalIcon, icon_color};
 }
 
-void NetworkIconImpl::GenerateImage(const NetworkIconState& network) {
+void NetworkIconImpl::GenerateImage(const NetworkStateProperties* network) {
   gfx::ImageSkia icon = GetIcon(network, icon_type_, strength_index_);
   Badges badges;
   GetBadges(network, &badges);
@@ -446,19 +421,19 @@
 
 namespace {
 
-NetworkIconImpl* FindAndUpdateImageImpl(const NetworkIconState& network,
+NetworkIconImpl* FindAndUpdateImageImpl(const NetworkStateProperties* network,
                                         IconType icon_type,
                                         bool show_vpn_badge) {
   // Find or add the icon.
   NetworkIconMap* icon_map = GetIconMap(icon_type);
   NetworkIconImpl* icon;
-  NetworkIconMap::iterator iter = icon_map->find(network.guid);
+  NetworkIconMap::iterator iter = icon_map->find(network->guid);
   if (iter == icon_map->end()) {
-    VLOG(1) << "new NetworkIconImpl: " << network.name;
-    icon = new NetworkIconImpl(network.guid, icon_type, network.type);
-    icon_map->insert(std::make_pair(network.guid, icon));
+    VLOG(1) << "new NetworkIconImpl: " << network->name;
+    icon = new NetworkIconImpl(network->guid, icon_type, network->type);
+    icon_map->insert(std::make_pair(network->guid, icon));
   } else {
-    VLOG(1) << "found NetworkIconImpl: " << network.name;
+    VLOG(1) << "found NetworkIconImpl: " << network->name;
     icon = iter->second;
   }
 
@@ -472,15 +447,6 @@
 //------------------------------------------------------------------------------
 // Public interface
 
-bool IsConnected(const NetworkIconState& icon_state) {
-  return chromeos::network_config::StateIsConnected(
-      icon_state.connection_state);
-}
-
-bool IsConnecting(const NetworkIconState& icon_state) {
-  return icon_state.connection_state == ConnectionStateType::kConnecting;
-}
-
 const gfx::ImageSkia GetBasicImage(IconType icon_type,
                                    NetworkType network_type,
                                    bool connected) {
@@ -489,14 +455,15 @@
                           connected ? kNumNetworkImages - 1 : 0);
 }
 
-gfx::ImageSkia GetImageForNonVirtualNetwork(const NetworkIconState& network,
-                                            IconType icon_type,
-                                            bool show_vpn_badge,
-                                            bool* animating) {
-  DCHECK_NE(NetworkType::kVPN, network.type);
-  NetworkType network_type = network.type;
+gfx::ImageSkia GetImageForNonVirtualNetwork(
+    const NetworkStateProperties* network,
+    IconType icon_type,
+    bool show_vpn_badge,
+    bool* animating) {
+  DCHECK_NE(NetworkType::kVPN, network->type);
+  NetworkType network_type = network->type;
 
-  if (IsConnecting(network)) {
+  if (network->connection_state == ConnectionStateType::kConnecting) {
     if (animating)
       *animating = true;
     return GetConnectingImageForNetworkType(network_type, icon_type);
@@ -509,11 +476,11 @@
   return icon->image();
 }
 
-gfx::ImageSkia GetImageForVPN(const NetworkIconState& vpn,
+gfx::ImageSkia GetImageForVPN(const NetworkStateProperties* vpn,
                               IconType icon_type,
                               bool* animating) {
-  DCHECK_EQ(NetworkType::kVPN, vpn.type);
-  if (IsConnecting(vpn)) {
+  DCHECK_EQ(NetworkType::kVPN, vpn->type);
+  if (vpn->connection_state == ConnectionStateType::kConnecting) {
     if (animating)
       *animating = true;
     return GetConnectingVpnImage(icon_type);
@@ -554,7 +521,7 @@
 }
 
 gfx::ImageSkia GetConnectedNetworkWithConnectingVpnImage(
-    const NetworkIconState& connected_network,
+    const NetworkStateProperties* connected_network,
     IconType icon_type) {
   gfx::ImageSkia icon = GetImageForNonVirtualNetwork(
       connected_network, icon_type, false /* show_vpn_badge */);
@@ -581,23 +548,25 @@
   return CreateNetworkIconImage(icon, badges);
 }
 
-base::string16 GetLabelForNetworkList(const NetworkIconState& network) {
-  ActivationStateType activation_state = network.activation_state;
-  if (activation_state == ActivationStateType::kActivating) {
-    return l10n_util::GetStringFUTF16(
-        IDS_ASH_STATUS_TRAY_NETWORK_LIST_ACTIVATING,
-        base::UTF8ToUTF16(network.name));
+base::string16 GetLabelForNetworkList(const NetworkStateProperties* network) {
+  if (network->type == NetworkType::kCellular) {
+    ActivationStateType activation_state = network->cellular->activation_state;
+    if (activation_state == ActivationStateType::kActivating) {
+      return l10n_util::GetStringFUTF16(
+          IDS_ASH_STATUS_TRAY_NETWORK_LIST_ACTIVATING,
+          base::UTF8ToUTF16(network->name));
+    }
+    if (activation_state == ActivationStateType::kNotActivated ||
+        activation_state == ActivationStateType::kPartiallyActivated) {
+      return l10n_util::GetStringFUTF16(
+          IDS_ASH_STATUS_TRAY_NETWORK_LIST_ACTIVATE,
+          base::UTF8ToUTF16(network->name));
+    }
   }
-  if (activation_state == ActivationStateType::kNotActivated ||
-      activation_state == ActivationStateType::kPartiallyActivated) {
-    return l10n_util::GetStringFUTF16(IDS_ASH_STATUS_TRAY_NETWORK_LIST_ACTIVATE,
-                                      base::UTF8ToUTF16(network.name));
-  }
-
   // Otherwise just show the network name or 'Ethernet'.
-  if (network.type == NetworkType::kEthernet)
+  if (network->type == NetworkType::kEthernet)
     return l10n_util::GetStringUTF16(IDS_ASH_STATUS_TRAY_ETHERNET);
-  return base::UTF8ToUTF16(network.name);
+  return base::UTF8ToUTF16(network->name);
 }
 
 void PurgeNetworkIconCache(const std::set<std::string>& network_guids) {
diff --git a/ash/system/network/network_icon.h b/ash/system/network/network_icon.h
index caca2edd..4dba082 100644
--- a/ash/system/network/network_icon.h
+++ b/ash/system/network/network_icon.h
@@ -18,26 +18,6 @@
 namespace ash {
 namespace network_icon {
 
-// TODO(stevenjb): Replace with network_config::mojom::NetworkStateProperties.
-struct ASH_EXPORT NetworkIconState {
-  // Constructs a NetworkIconState from mojom::NetworkStateProperties.
-  explicit NetworkIconState(
-      const chromeos::network_config::mojom::NetworkStateProperties* network);
-  NetworkIconState(const NetworkIconState& other);
-  NetworkIconState& operator=(const NetworkIconState& other);
-  ~NetworkIconState();
-
-  std::string guid;
-  std::string name;
-  chromeos::network_config::mojom::NetworkType type;
-  chromeos::network_config::mojom::ConnectionStateType connection_state;
-  chromeos::network_config::mojom::SecurityType security;  // ONC security type
-  std::string network_technology;  // ONC network technology type
-  chromeos::network_config::mojom::ActivationStateType activation_state;
-  int signal_strength = 0;  // 0-100.
-  bool is_roaming = false;
-};
-
 // Type of icon which dictates color theme and VPN badging
 enum IconType {
   ICON_TYPE_TRAY_OOBE,     // dark icons with VPN badges, used during OOBE
@@ -50,12 +30,6 @@
 // Strength of a wireless signal.
 enum class SignalStrength { NONE, WEAK, MEDIUM, STRONG };
 
-// Returns true if |icon_state| is connected or portal.
-bool IsConnected(const NetworkIconState& icon_state);
-
-// Returns true if |icon_state| is connecting.
-bool IsConnecting(const NetworkIconState& icon_state);
-
 // Returns an image to represent either a fully connected network or a
 // disconnected network.
 const gfx::ImageSkia GetBasicImage(
@@ -70,16 +44,17 @@
 // |animating| is an optional out parameter that is set to true when the
 // returned image should be animated.
 ASH_EXPORT gfx::ImageSkia GetImageForNonVirtualNetwork(
-    const NetworkIconState& network,
+    const chromeos::network_config::mojom::NetworkStateProperties* network,
     IconType icon_type,
     bool badge_vpn,
     bool* animating = nullptr);
 
 // Similar to above but for displaying only VPN icons, e.g. for the VPN menu
 // or Settings section.
-ASH_EXPORT gfx::ImageSkia GetImageForVPN(const NetworkIconState& vpn,
-                                         IconType icon_type,
-                                         bool* animating = nullptr);
+ASH_EXPORT gfx::ImageSkia GetImageForVPN(
+    const chromeos::network_config::mojom::NetworkStateProperties* vpn,
+    IconType icon_type,
+    bool* animating = nullptr);
 
 // Returns an image for a Wi-Fi network, either full strength or strike-through
 // based on |enabled|.
@@ -95,7 +70,8 @@
 // Returns the connected image for |connected_network| and |network_type| with a
 // connecting VPN badge.
 gfx::ImageSkia GetConnectedNetworkWithConnectingVpnImage(
-    const NetworkIconState& connected_network,
+    const chromeos::network_config::mojom::NetworkStateProperties*
+        connected_network,
     IconType icon_type);
 
 // Returns the disconnected image for a shill network type.
@@ -109,7 +85,7 @@
 
 // Returns the label for |network| when displayed in a list.
 ASH_EXPORT base::string16 GetLabelForNetworkList(
-    const NetworkIconState& network);
+    const chromeos::network_config::mojom::NetworkStateProperties* network);
 
 // Called periodically with the current list of network guids. Removes cached
 // entries that are no longer in the list.
diff --git a/ash/system/network/network_icon_unittest.cc b/ash/system/network/network_icon_unittest.cc
index c57f397..b60d3bb 100644
--- a/ash/system/network/network_icon_unittest.cc
+++ b/ash/system/network/network_icon_unittest.cc
@@ -92,7 +92,7 @@
   gfx::Image GetImageForNonVirtualNetwork(const NetworkStateProperties* network,
                                           bool badge_vpn) {
     return gfx::Image(network_icon::GetImageForNonVirtualNetwork(
-        network_icon::NetworkIconState(network), icon_type_, badge_vpn));
+        network, icon_type_, badge_vpn));
   }
 
   gfx::Image ImageForNetwork(const NetworkStateProperties* network) {
@@ -100,7 +100,8 @@
   }
 
   gfx::ImageSkia GetDefaultNetworkImage(IconType icon_type, bool* animating) {
-    return active_network_icon_->GetSingleImage(icon_type, animating);
+    return active_network_icon_->GetImage(ActiveNetworkIcon::Type::kSingle,
+                                          icon_type, animating);
   }
 
   // The icon for a Tether network should be the same as one for a cellular
diff --git a/ash/system/network/network_list.cc b/ash/system/network/network_list.cc
index 0c520d2..3eaf5bc 100644
--- a/ash/system/network/network_list.cc
+++ b/ash/system/network/network_list.cc
@@ -162,13 +162,10 @@
       wifi_has_networks_ = true;
 
     auto info = std::make_unique<NetworkInfo>(network->guid);
-
-    network_icon::NetworkIconState network_icon_state(network.get());
-    info->label = network_icon::GetLabelForNetworkList(network_icon_state);
+    info->label = network_icon::GetLabelForNetworkList(network.get());
     // |network_list_| only contains non virtual networks.
     info->image = network_icon::GetImageForNonVirtualNetwork(
-        network_icon_state, network_icon::ICON_TYPE_LIST,
-        false /* badge_vpn */);
+        network.get(), network_icon::ICON_TYPE_LIST, false /* badge_vpn */);
     info->disable = activation_state == ActivationStateType::kActivating ||
                     network->prohibited_by_policy;
     if (network->prohibited_by_policy) {
diff --git a/ash/system/network/network_tray_icon_strategy.cc b/ash/system/network/network_tray_icon_strategy.cc
deleted file mode 100644
index 9213b520..0000000
--- a/ash/system/network/network_tray_icon_strategy.cc
+++ /dev/null
@@ -1,53 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "ash/system/network/network_tray_icon_strategy.h"
-
-#include "ash/session/session_controller_impl.h"
-#include "ash/shell.h"
-#include "ash/system/model/system_tray_model.h"
-#include "ash/system/network/active_network_icon.h"
-#include "ash/system/network/network_icon.h"
-#include "base/logging.h"
-#include "ui/gfx/image/image_skia.h"
-
-namespace ash {
-namespace tray {
-
-namespace {
-
-// OOBE has a white background that makes regular tray icons not visible.
-network_icon::IconType GetIconType() {
-  if (Shell::Get()->session_controller()->GetSessionState() ==
-      session_manager::SessionState::OOBE) {
-    return network_icon::ICON_TYPE_TRAY_OOBE;
-  }
-  return network_icon::ICON_TYPE_TRAY_REGULAR;
-}
-
-}  // namespace
-
-gfx::ImageSkia DefaultNetworkTrayIconStrategy::GetNetworkIcon(bool* animating) {
-  return Shell::Get()
-      ->system_tray_model()
-      ->active_network_icon()
-      ->GetDualImagePrimary(GetIconType(), animating);
-}
-
-gfx::ImageSkia MobileNetworkTrayIconStrategy::GetNetworkIcon(bool* animating) {
-  return Shell::Get()
-      ->system_tray_model()
-      ->active_network_icon()
-      ->GetDualImageCellular(GetIconType(), animating);
-}
-
-gfx::ImageSkia SingleNetworkTrayIconStrategy::GetNetworkIcon(bool* animating) {
-  return Shell::Get()
-      ->system_tray_model()
-      ->active_network_icon()
-      ->GetSingleImage(GetIconType(), animating);
-}
-
-}  // namespace tray
-}  // namespace ash
diff --git a/ash/system/network/network_tray_icon_strategy.h b/ash/system/network/network_tray_icon_strategy.h
deleted file mode 100644
index 10bbc0f..0000000
--- a/ash/system/network/network_tray_icon_strategy.h
+++ /dev/null
@@ -1,71 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef ASH_SYSTEM_NETWORK_NETWORK_TRAY_ICON_STRATEGY_H_
-#define ASH_SYSTEM_NETWORK_NETWORK_TRAY_ICON_STRATEGY_H_
-
-#include "base/macros.h"
-
-namespace gfx {
-class ImageSkia;
-}  // namespace gfx
-
-namespace ash {
-namespace tray {
-
-// Represents an abstract stategy to get the appropriate network icon image to
-// render on the system tray. Different strategies are needed for each type of
-// network icon we want to show on the tray.
-class NetworkTrayIconStrategy {
- public:
-  virtual ~NetworkTrayIconStrategy() = default;
-
-  // Returns a network icon image and sets |animating| when a network icon
-  // should be displayed on the tray.
-  // Returns a null ImageSkia when no network icon should be displyed,
-  // |animating| is not modified.
-  virtual gfx::ImageSkia GetNetworkIcon(bool* animating) = 0;
-};
-
-// Strategy for rendering non-mobile network icons.
-class DefaultNetworkTrayIconStrategy : public NetworkTrayIconStrategy {
- public:
-  DefaultNetworkTrayIconStrategy() = default;
-  ~DefaultNetworkTrayIconStrategy() override = default;
-
-  // NetworkTrayIconStrategy:
-  gfx::ImageSkia GetNetworkIcon(bool* animating) override;
-
-  DISALLOW_COPY_AND_ASSIGN(DefaultNetworkTrayIconStrategy);
-};
-
-// Strategy for rendering Mobile network icon.
-class MobileNetworkTrayIconStrategy : public NetworkTrayIconStrategy {
- public:
-  MobileNetworkTrayIconStrategy() = default;
-  ~MobileNetworkTrayIconStrategy() override = default;
-
-  // NetworkTrayIconStrategy:
-  gfx::ImageSkia GetNetworkIcon(bool* animating) override;
-
-  DISALLOW_COPY_AND_ASSIGN(MobileNetworkTrayIconStrategy);
-};
-
-// Strategy for rendering a single unified WiFi and Cellular network icon.
-// TODO(tonydeluna): Remove once the _____ is enabled by default.
-class SingleNetworkTrayIconStrategy : public NetworkTrayIconStrategy {
- public:
-  SingleNetworkTrayIconStrategy() = default;
-  ~SingleNetworkTrayIconStrategy() override = default;
-
-  // NetworkTrayIconStrategy:
-  gfx::ImageSkia GetNetworkIcon(bool* animating) override;
-
-  DISALLOW_COPY_AND_ASSIGN(SingleNetworkTrayIconStrategy);
-};
-
-}  // namespace tray
-}  // namespace ash
-
-#endif  // ASH_SYSTEM_NETWORK_NETWORK_TRAY_ICON_STRATEGY_H_
diff --git a/ash/system/network/network_tray_view.cc b/ash/system/network/network_tray_view.cc
index bbe373b..699bdccf 100644
--- a/ash/system/network/network_tray_view.cc
+++ b/ash/system/network/network_tray_view.cc
@@ -12,25 +12,31 @@
 #include "ash/system/model/system_tray_model.h"
 #include "ash/system/network/network_icon.h"
 #include "ash/system/network/network_icon_animation.h"
-#include "ash/system/network/network_tray_icon_strategy.h"
-#include "base/strings/utf_string_conversions.h"
-#include "chromeos/network/network_state.h"
-#include "chromeos/network/network_state_handler.h"
 #include "ui/accessibility/ax_node_data.h"
-#include "ui/base/l10n/l10n_util.h"
 #include "ui/views/controls/image_view.h"
 
-using chromeos::NetworkHandler;
-using chromeos::NetworkState;
-using chromeos::NetworkStateHandler;
-using chromeos::NetworkTypePattern;
-
 namespace ash {
 namespace tray {
 
-const NetworkState* GetConnectedNetwork() {
-  NetworkStateHandler* handler = NetworkHandler::Get()->network_state_handler();
-  return handler->ConnectedNetworkByType(NetworkTypePattern::NonVirtual());
+namespace {
+
+// OOBE has a white background that makes regular tray icons not visible.
+network_icon::IconType GetIconType() {
+  if (Shell::Get()->session_controller()->GetSessionState() ==
+      session_manager::SessionState::OOBE) {
+    return network_icon::ICON_TYPE_TRAY_OOBE;
+  }
+  return network_icon::ICON_TYPE_TRAY_REGULAR;
+}
+
+}  // namespace
+
+NetworkTrayView::NetworkTrayView(Shelf* shelf, ActiveNetworkIcon::Type type)
+    : TrayItemView(shelf), type_(type) {
+  Shell::Get()->system_tray_model()->network_observer()->AddObserver(this);
+  CreateImageView();
+  UpdateNetworkStateHandlerIcon();
+  UpdateConnectionStatus(true /* notify_a11y */);
 }
 
 NetworkTrayView::~NetworkTrayView() {
@@ -38,21 +44,6 @@
   Shell::Get()->system_tray_model()->network_observer()->RemoveObserver(this);
 }
 
-NetworkTrayView* NetworkTrayView::CreateForDefault(Shelf* shelf) {
-  return new NetworkTrayView(
-      shelf, std::make_unique<DefaultNetworkTrayIconStrategy>());
-}
-
-NetworkTrayView* NetworkTrayView::CreateForMobile(Shelf* shelf) {
-  return new NetworkTrayView(shelf,
-                             std::make_unique<MobileNetworkTrayIconStrategy>());
-}
-
-NetworkTrayView* NetworkTrayView::CreateForSingleIcon(Shelf* shelf) {
-  return new NetworkTrayView(shelf,
-                             std::make_unique<SingleNetworkTrayIconStrategy>());
-}
-
 const char* NetworkTrayView::GetClassName() const {
   return "NetworkTrayView";
 }
@@ -69,12 +60,12 @@
 }
 
 base::string16 NetworkTrayView::GetTooltipText(const gfx::Point& p) const {
-  return connection_status_tooltip_;
+  return tooltip_;
 }
 
 void NetworkTrayView::NetworkIconChanged() {
   UpdateNetworkStateHandlerIcon();
-  UpdateConnectionStatus(GetConnectedNetwork(), false /* notify_a11y */);
+  UpdateConnectionStatus(false /* notify_a11y */);
 }
 
 void NetworkTrayView::OnSessionStateChanged(
@@ -84,23 +75,11 @@
 
 void NetworkTrayView::ActiveNetworkStateChanged() {
   UpdateNetworkStateHandlerIcon();
-  UpdateConnectionStatus(GetConnectedNetwork(), true /* notify _a11y */);
+  UpdateConnectionStatus(true /* notify _a11y */);
 }
 
 void NetworkTrayView::NetworkListChanged() {
   UpdateNetworkStateHandlerIcon();
-  UpdateConnectionStatus(GetConnectedNetwork(), false /* notify_a11y */);
-}
-
-NetworkTrayView::NetworkTrayView(
-    Shelf* shelf,
-    std::unique_ptr<NetworkTrayIconStrategy> network_tray_icon_strategy)
-    : TrayItemView(shelf),
-      network_tray_icon_strategy_(std::move(network_tray_icon_strategy)) {
-  Shell::Get()->system_tray_model()->network_observer()->AddObserver(this);
-  CreateImageView();
-  UpdateNetworkStateHandlerIcon();
-  UpdateConnectionStatus(GetConnectedNetwork(), true /* notify_a11y */);
 }
 
 void NetworkTrayView::UpdateIcon(bool tray_icon_visible,
@@ -113,8 +92,8 @@
 void NetworkTrayView::UpdateNetworkStateHandlerIcon() {
   bool animating = false;
   gfx::ImageSkia image =
-      network_tray_icon_strategy_->GetNetworkIcon(&animating);
-
+      Shell::Get()->system_tray_model()->active_network_icon()->GetImage(
+          type_, GetIconType(), &animating);
   bool show_in_tray = !image.isNull();
   UpdateIcon(show_in_tray, image);
   if (animating)
@@ -123,63 +102,16 @@
     network_icon::NetworkIconAnimation::GetInstance()->RemoveObserver(this);
 }
 
-void NetworkTrayView::UpdateConnectionStatus(
-    const NetworkState* connected_network,
-    bool notify_a11y) {
-  using SignalStrength = network_icon::SignalStrength;
-
-  if (connected_network) {
-    base::string16 new_accessible_name = l10n_util::GetStringFUTF16(
-        IDS_ASH_STATUS_TRAY_NETWORK_CONNECTED,
-        base::UTF8ToUTF16(connected_network->name()));
-
-    if (connected_network->Matches(NetworkTypePattern::Wireless())) {
-      // Retrieve the string describing the signal strength, if it is applicable
-      // to |connected_network|.
-      base::string16 signal_strength_string;
-      switch (network_icon::GetSignalStrength(
-          connected_network->signal_strength())) {
-        case SignalStrength::NONE:
-          break;
-        case SignalStrength::WEAK:
-          signal_strength_string = l10n_util::GetStringUTF16(
-              IDS_ASH_STATUS_TRAY_NETWORK_SIGNAL_WEAK);
-          break;
-        case SignalStrength::MEDIUM:
-          signal_strength_string = l10n_util::GetStringUTF16(
-              IDS_ASH_STATUS_TRAY_NETWORK_SIGNAL_MEDIUM);
-          break;
-        case SignalStrength::STRONG:
-          signal_strength_string = l10n_util::GetStringUTF16(
-              IDS_ASH_STATUS_TRAY_NETWORK_SIGNAL_STRONG);
-          break;
-      }
-
-      accessible_description_ = signal_strength_string;
-
-      if (!signal_strength_string.empty()) {
-        connection_status_tooltip_ = l10n_util::GetStringFUTF16(
-            IDS_ASH_STATUS_TRAY_NETWORK_CONNECTED_ACCESSIBLE,
-            base::UTF8ToUTF16(connected_network->name()),
-            signal_strength_string);
-      } else {
-        // Use shorter description like "Disconnected" instead of "disconnected
-        // from network" for the tooltip, because the visual icon tells that
-        // this is about the network status.
-        connection_status_tooltip_ = l10n_util::GetStringUTF16(
-            IDS_ASH_STATUS_TRAY_NETWORK_DISCONNECTED_TOOLTIP);
-      }
-    } else {
-      accessible_description_.clear();
-    }
-
-    if (accessible_name_ == new_accessible_name)
-      return;
-
-    accessible_name_ = new_accessible_name;
-
-    if (notify_a11y && !accessible_name_.empty())
-      NotifyAccessibilityEvent(ax::mojom::Event::kAlert, true);
+void NetworkTrayView::UpdateConnectionStatus(bool notify_a11y) {
+  base::string16 prev_accessible_name = accessible_name_;
+  Shell::Get()
+      ->system_tray_model()
+      ->active_network_icon()
+      ->GetConnectionStatusStrings(type_, &accessible_name_,
+                                   &accessible_description_, &tooltip_);
+  if (notify_a11y && !accessible_name_.empty() &&
+      accessible_name_ != prev_accessible_name) {
+    NotifyAccessibilityEvent(ax::mojom::Event::kAlert, true);
   }
 }
 
diff --git a/ash/system/network/network_tray_view.h b/ash/system/network/network_tray_view.h
index 5249ea6..2e89cea 100644
--- a/ash/system/network/network_tray_view.h
+++ b/ash/system/network/network_tray_view.h
@@ -8,23 +8,18 @@
 #include <memory>
 
 #include "ash/session/session_observer.h"
+#include "ash/system/network/active_network_icon.h"
 #include "ash/system/network/network_icon_animation_observer.h"
 #include "ash/system/network/tray_network_state_observer.h"
 #include "ash/system/tray/tray_item_view.h"
 #include "base/macros.h"
 
-namespace chromeos {
-class NetworkState;
-}  // namespace chromeos
-
 namespace ash {
 namespace tray {
 
-class NetworkTrayIconStrategy;
-
-// Returns the connected, non-virtual (aka VPN), network.
-const chromeos::NetworkState* GetConnectedNetwork();
-
+// View class containing an ImageView for a network icon in the tray.
+// The ActiveNetworkIcon::Type parameter determines what type of icon is
+// displayed. Generation and update of the icon is handled by ActiveNetworkIcon.
 class NetworkTrayView : public TrayItemView,
                         public network_icon::AnimationObserver,
                         public SessionObserver,
@@ -32,12 +27,7 @@
  public:
   ~NetworkTrayView() override;
 
-  // Creates a NetworkTrayView that shows non-mobile network state.
-  static NetworkTrayView* CreateForDefault(Shelf* shelf);
-  // Creates a NetworkTrayView that only shows Mobile network state.
-  static NetworkTrayView* CreateForMobile(Shelf* shelf);
-  // Creates a NetworkTrayView that shows all networks state.
-  static NetworkTrayView* CreateForSingleIcon(Shelf* shelf);
+  NetworkTrayView(Shelf* shelf, ActiveNetworkIcon::Type type);
 
   const char* GetClassName() const override;
 
@@ -57,22 +47,26 @@
   void NetworkListChanged() override;
 
  private:
-  NetworkTrayView(Shelf* shelf,
-                  std::unique_ptr<NetworkTrayIconStrategy> network_icon_type);
-
   void UpdateIcon(bool tray_icon_visible, const gfx::ImageSkia& image);
 
   void UpdateNetworkStateHandlerIcon();
 
-  // Updates connection status and notifies accessibility event when necessary.
-  void UpdateConnectionStatus(const chromeos::NetworkState* connected_network,
-                              bool notify_a11y);
+  // Updates the tooltip and calls NotifyAccessibilityEvent when necessary.
+  void UpdateConnectionStatus(bool notify_a11y);
 
+  ActiveNetworkIcon::Type type_;
+
+  // The name provided by GetAccessibleNodeData, which includes the network
+  // name and connection state.
   base::string16 accessible_name_;
-  base::string16 accessible_description_;
-  base::string16 connection_status_tooltip_;
 
-  std::unique_ptr<NetworkTrayIconStrategy> network_tray_icon_strategy_;
+  // The description provided by GetAccessibleNodeData. For wifi networks this
+  // is the signal strength of the network. Otherwise it is empty.
+  base::string16 accessible_description_;
+
+  // The tooltip for the icon. Includes the network name and signal strength
+  // (for wireless networks).
+  base::string16 tooltip_;
 
   DISALLOW_COPY_AND_ASSIGN(NetworkTrayView);
 };
diff --git a/ash/system/network/vpn_list_view.cc b/ash/system/network/vpn_list_view.cc
index bb6a0fb..9a77317 100644
--- a/ash/system/network/vpn_list_view.cc
+++ b/ash/system/network/vpn_list_view.cc
@@ -243,10 +243,9 @@
   Reset();
   disconnect_button_ = nullptr;
 
-  network_icon::NetworkIconState vpn_icon_state(vpn);
-  gfx::ImageSkia image = network_icon::GetImageForVPN(
-      vpn_icon_state, network_icon::ICON_TYPE_LIST);
-  base::string16 label = network_icon::GetLabelForNetworkList(vpn_icon_state);
+  gfx::ImageSkia image =
+      network_icon::GetImageForVPN(vpn, network_icon::ICON_TYPE_LIST);
+  base::string16 label = network_icon::GetLabelForNetworkList(vpn);
   AddIconAndLabel(image, label);
   if (chromeos::network_config::StateIsConnected(vpn->connection_state)) {
     owner_->SetupConnectedScrollListItem(this);
diff --git a/ash/system/unified/unified_system_tray.cc b/ash/system/unified/unified_system_tray.cc
index a1469d5f..3537af9 100644
--- a/ash/system/unified/unified_system_tray.cc
+++ b/ash/system/unified/unified_system_tray.cc
@@ -135,17 +135,14 @@
   tray_container()->AddChildView(notification_counter_item_);
   tray_container()->AddChildView(quiet_mode_view_);
 
-  // It is possible in unit tests that it's missing.
-  if (chromeos::NetworkHandler::IsInitialized()) {
-    if (features::IsSeparateNetworkIconsEnabled()) {
-      tray_container()->AddChildView(
-          tray::NetworkTrayView::CreateForDefault(shelf));
-      tray_container()->AddChildView(
-          tray::NetworkTrayView::CreateForMobile(shelf));
-    } else {
-      tray_container()->AddChildView(
-          tray::NetworkTrayView::CreateForSingleIcon(shelf));
-    }
+  if (features::IsSeparateNetworkIconsEnabled()) {
+    tray_container()->AddChildView(
+        new tray::NetworkTrayView(shelf, ActiveNetworkIcon::Type::kPrimary));
+    tray_container()->AddChildView(
+        new tray::NetworkTrayView(shelf, ActiveNetworkIcon::Type::kCellular));
+  } else {
+    tray_container()->AddChildView(
+        new tray::NetworkTrayView(shelf, ActiveNetworkIcon::Type::kSingle));
   }
 
   tray_container()->AddChildView(new tray::PowerTrayView(shelf));
diff --git a/ash/system/unified/unified_system_tray_test_api.cc b/ash/system/unified/unified_system_tray_test_api.cc
index 69a2b928..4c31488 100644
--- a/ash/system/unified/unified_system_tray_test_api.cc
+++ b/ash/system/unified/unified_system_tray_test_api.cc
@@ -12,9 +12,7 @@
 #include "ash/system/unified/unified_system_tray.h"
 #include "ash/system/unified/unified_system_tray_bubble.h"
 #include "ash/system/unified/unified_system_tray_controller.h"
-#include "base/run_loop.h"
 #include "base/strings/string16.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
 #include "ui/compositor/scoped_animation_duration_scale_mode.h"
 #include "ui/events/test/event_generator.h"
 #include "ui/views/controls/label.h"
@@ -28,68 +26,42 @@
 
 UnifiedSystemTrayTestApi::~UnifiedSystemTrayTestApi() = default;
 
-// static
-void UnifiedSystemTrayTestApi::BindRequest(
-    mojom::SystemTrayTestApiRequest request) {
-  UnifiedSystemTray* tray = Shell::Get()
-                                ->GetPrimaryRootWindowController()
-                                ->GetStatusAreaWidget()
-                                ->unified_system_tray();
-  mojo::MakeStrongBinding(std::make_unique<UnifiedSystemTrayTestApi>(tray),
-                          std::move(request));
-}
-
-void UnifiedSystemTrayTestApi::DisableAnimations(DisableAnimationsCallback cb) {
+void UnifiedSystemTrayTestApi::DisableAnimations() {
   disable_animations_ = std::make_unique<ui::ScopedAnimationDurationScaleMode>(
       ui::ScopedAnimationDurationScaleMode::ZERO_DURATION);
-  std::move(cb).Run();
 }
 
-void UnifiedSystemTrayTestApi::IsTrayBubbleOpen(IsTrayBubbleOpenCallback cb) {
-  std::move(cb).Run(tray_->IsBubbleShown());
+bool UnifiedSystemTrayTestApi::IsTrayBubbleOpen() {
+  return tray_->IsBubbleShown();
 }
 
-void UnifiedSystemTrayTestApi::IsTrayViewVisible(int view_id,
-                                                 IsTrayViewVisibleCallback cb) {
-  std::move(cb).Run(false);
-}
-
-void UnifiedSystemTrayTestApi::ShowBubble(ShowBubbleCallback cb) {
+void UnifiedSystemTrayTestApi::ShowBubble() {
   tray_->ShowBubble(false /* show_by_click */);
-  std::move(cb).Run();
 }
 
-void UnifiedSystemTrayTestApi::CloseBubble(CloseBubbleCallback cb) {
+void UnifiedSystemTrayTestApi::CloseBubble() {
   tray_->CloseBubble();
-  std::move(cb).Run();
 }
 
-void UnifiedSystemTrayTestApi::ShowDetailedView(mojom::TrayItem item,
-                                                ShowDetailedViewCallback cb) {
+void UnifiedSystemTrayTestApi::ShowAccessibilityDetailedView() {
   tray_->ShowBubble(false /* show_by_click */);
-  switch (item) {
-    case mojom::TrayItem::kAccessibility:
-      tray_->bubble_->controller_->ShowAccessibilityDetailedView();
-      break;
-    case mojom::TrayItem::kNetwork:
-      tray_->bubble_->controller_->ShowNetworkDetailedView(true /* force */);
-      break;
-  }
-  std::move(cb).Run();
+  tray_->bubble_->controller_->ShowAccessibilityDetailedView();
 }
 
-void UnifiedSystemTrayTestApi::IsBubbleViewVisible(
-    int view_id,
-    bool open_tray,
-    IsBubbleViewVisibleCallback cb) {
+void UnifiedSystemTrayTestApi::ShowNetworkDetailedView() {
+  tray_->ShowBubble(false /* show_by_click */);
+  tray_->bubble_->controller_->ShowNetworkDetailedView(true /* force */);
+}
+
+bool UnifiedSystemTrayTestApi::IsBubbleViewVisible(int view_id,
+                                                   bool open_tray) {
   if (open_tray)
     tray_->ShowBubble(false /* show_by_click */);
   views::View* view = GetBubbleView(view_id);
-  std::move(cb).Run(view && view->GetVisible());
+  return view && view->GetVisible();
 }
 
-void UnifiedSystemTrayTestApi::ClickBubbleView(int32_t view_id,
-                                               ClickBubbleViewCallback cb) {
+void UnifiedSystemTrayTestApi::ClickBubbleView(int view_id) {
   views::View* view = GetBubbleView(view_id);
   if (view && view->GetVisible()) {
     gfx::Point cursor_location(1, 1);
@@ -99,35 +71,30 @@
     generator.MoveMouseTo(cursor_location);
     generator.ClickLeftButton();
   }
-  std::move(cb).Run();
 }
 
-void UnifiedSystemTrayTestApi::GetBubbleViewTooltip(
-    int view_id,
-    GetBubbleViewTooltipCallback cb) {
+base::string16 UnifiedSystemTrayTestApi::GetBubbleViewTooltip(int view_id) {
   views::View* view = GetBubbleView(view_id);
-  std::move(cb).Run(view ? view->GetTooltipText(gfx::Point())
-                         : base::string16());
+  return view ? view->GetTooltipText(gfx::Point()) : base::string16();
 }
 
-void UnifiedSystemTrayTestApi::GetBubbleLabelText(
-    int view_id,
-    GetBubbleLabelTextCallback cb) {
-  base::string16 text;
-  views::View* view = GetBubbleView(view_id);
-  if (view)
-    text = static_cast<views::Label*>(view)->text();
-  std::move(cb).Run(text);
-}
-
-void UnifiedSystemTrayTestApi::Is24HourClock(Is24HourClockCallback cb) {
+bool UnifiedSystemTrayTestApi::Is24HourClock() {
   base::HourClockType type =
       tray_->time_view_->time_view()->GetHourTypeForTesting();
-  std::move(cb).Run(type == base::k24HourClock);
+  return type == base::k24HourClock;
 }
 
 views::View* UnifiedSystemTrayTestApi::GetBubbleView(int view_id) const {
   return tray_->bubble_->bubble_view_->GetViewByID(view_id);
 }
 
+// static
+std::unique_ptr<SystemTrayTestApi> SystemTrayTestApi::Create() {
+  UnifiedSystemTray* primary_tray = Shell::Get()
+                                        ->GetPrimaryRootWindowController()
+                                        ->GetStatusAreaWidget()
+                                        ->unified_system_tray();
+  return std::make_unique<UnifiedSystemTrayTestApi>(primary_tray);
+}
+
 }  // namespace ash
diff --git a/ash/system/unified/unified_system_tray_test_api.h b/ash/system/unified/unified_system_tray_test_api.h
index 6323aacd..5671fb4 100644
--- a/ash/system/unified/unified_system_tray_test_api.h
+++ b/ash/system/unified/unified_system_tray_test_api.h
@@ -7,7 +7,7 @@
 
 #include <memory>
 
-#include "ash/public/interfaces/system_tray_test_api.test-mojom.h"
+#include "ash/public/cpp/system_tray_test_api.h"
 #include "base/macros.h"
 
 namespace ui {
@@ -23,31 +23,23 @@
 class UnifiedSystemTray;
 
 // Use by tests to access private state of UnifiedSystemTray.
-// mojo methods only apply to the system tray on the primary display.
-class UnifiedSystemTrayTestApi : public mojom::SystemTrayTestApi {
+// TODO(jamescook): Rename class to SystemTrayTestApiImpl.
+class UnifiedSystemTrayTestApi : public SystemTrayTestApi {
  public:
   explicit UnifiedSystemTrayTestApi(UnifiedSystemTray* tray);
   ~UnifiedSystemTrayTestApi() override;
 
-  // Creates and binds an instance from a remote request (e.g. from chrome).
-  static void BindRequest(mojom::SystemTrayTestApiRequest request);
-
-  // mojom::SystemTrayTestApi:
-  void DisableAnimations(DisableAnimationsCallback cb) override;
-  void IsTrayBubbleOpen(IsTrayBubbleOpenCallback cb) override;
-  void IsTrayViewVisible(int view_id, IsTrayViewVisibleCallback cb) override;
-  void ShowBubble(ShowBubbleCallback cb) override;
-  void CloseBubble(CloseBubbleCallback cb) override;
-  void ShowDetailedView(mojom::TrayItem item,
-                        ShowDetailedViewCallback cb) override;
-  void IsBubbleViewVisible(int view_id,
-                           bool open_tray,
-                           IsBubbleViewVisibleCallback cb) override;
-  void ClickBubbleView(int32_t view_id, ClickBubbleViewCallback cb) override;
-  void GetBubbleViewTooltip(int view_id,
-                            GetBubbleViewTooltipCallback cb) override;
-  void GetBubbleLabelText(int view_id, GetBubbleLabelTextCallback cb) override;
-  void Is24HourClock(Is24HourClockCallback cb) override;
+  // SystemTrayTestApi:
+  void DisableAnimations() override;
+  bool IsTrayBubbleOpen() override;
+  void ShowBubble() override;
+  void CloseBubble() override;
+  void ShowAccessibilityDetailedView() override;
+  void ShowNetworkDetailedView() override;
+  bool IsBubbleViewVisible(int view_id, bool open_tray) override;
+  void ClickBubbleView(int view_id) override;
+  base::string16 GetBubbleViewTooltip(int view_id) override;
+  bool Is24HourClock() override;
 
  private:
   // Returns a view in the bubble menu (not the tray itself). Returns null if
diff --git a/base/BUILD.gn b/base/BUILD.gn
index 5e65bd0..c9aafba 100644
--- a/base/BUILD.gn
+++ b/base/BUILD.gn
@@ -3313,17 +3313,17 @@
     java_files = [
       "test/android/javatests/src/org/chromium/base/test/ReachedCodeProfiler.java",
       "test/android/javatests/src/org/chromium/base/test/BaseJUnit4ClassRunner.java",
+      "test/android/javatests/src/org/chromium/base/test/BaseJUnit4TestRule.java",
       "test/android/javatests/src/org/chromium/base/test/BaseChromiumAndroidJUnitRunner.java",
       "test/android/javatests/src/org/chromium/base/test/BaseChromiumRunnerCommon.java",
       "test/android/javatests/src/org/chromium/base/test/BaseTestResult.java",
-      "test/android/javatests/src/org/chromium/base/test/LifetimeAssertRule.java",
       "test/android/javatests/src/org/chromium/base/test/DestroyActivitiesRule.java",
+      "test/android/javatests/src/org/chromium/base/test/LifetimeAssertRule.java",
       "test/android/javatests/src/org/chromium/base/test/ScreenshotOnFailureStatement.java",
       "test/android/javatests/src/org/chromium/base/test/SetUpTestRule.java",
       "test/android/javatests/src/org/chromium/base/test/SetUpStatement.java",
       "test/android/javatests/src/org/chromium/base/test/TestListInstrumentationRunListener.java",
       "test/android/javatests/src/org/chromium/base/test/TestTraceEvent.java",
-      "test/android/javatests/src/org/chromium/base/test/CommitSharedPreferencesTestRule.java",
       "test/android/javatests/src/org/chromium/base/test/params/ParameterizedRunner.java",
       "test/android/javatests/src/org/chromium/base/test/params/BlockJUnit4RunnerDelegate.java",
       "test/android/javatests/src/org/chromium/base/test/params/BaseJUnit4RunnerDelegate.java",
diff --git a/base/android/javatests/src/org/chromium/base/AdvancedMockContextTest.java b/base/android/javatests/src/org/chromium/base/AdvancedMockContextTest.java
index 20c626d..a11f22c 100644
--- a/base/android/javatests/src/org/chromium/base/AdvancedMockContextTest.java
+++ b/base/android/javatests/src/org/chromium/base/AdvancedMockContextTest.java
@@ -52,7 +52,7 @@
     @SmallTest
     public void testComponentCallbacksForTargetContext() {
         Context targetContext = InstrumentationRegistry.getInstrumentation().getTargetContext();
-        Application targetApplication = (Application) targetContext.getApplicationContext();
+        Application targetApplication = BaseJUnit4ClassRunner.getApplication();
         AdvancedMockContext context = new AdvancedMockContext(targetContext);
         Callback1 callback1 = new Callback1();
         Callback2 callback2 = new Callback2();
diff --git a/base/android/orderfile/orderfile_call_graph_instrumentation.cc b/base/android/orderfile/orderfile_call_graph_instrumentation.cc
index 1cd297d..936df1b 100644
--- a/base/android/orderfile/orderfile_call_graph_instrumentation.cc
+++ b/base/android/orderfile/orderfile_call_graph_instrumentation.cc
@@ -81,6 +81,7 @@
 static_assert(sizeof(g_caller_count) == 16 * (1 << 20), "");
 // Index for |g_caller_offset| and |g_caller_count|.
 std::atomic<uint32_t> g_callers_index;
+std::atomic<uint32_t> g_calls_count;
 std::atomic<bool> g_disabled;
 
 #if BUILDFLAG(DEVTOOLS_INSTRUMENTATION_DUMPING)
@@ -214,6 +215,7 @@
     callers_index = expected == 0 ? insertion_index : expected;
   }
 
+  AtomicIncrement(&g_calls_count);
   callers_index *= kTotalBuckets;
   if (caller_address <= start || caller_address > end ||
       !RecordCaller(callers_index, caller_address - start)) {
@@ -239,7 +241,11 @@
 
   // This can get very large as it  constructs the whole data structure in
   // memory before dumping it to the file.
-  ListValue root;
+  DictionaryValue root;
+  uint32_t total_calls_count = g_calls_count.load(std::memory_order_relaxed);
+  root.SetStringKey("total_calls_count",
+                    base::StringPrintf("%" PRIu32, total_calls_count));
+  ListValue call_graph;
   for (size_t i = 0; i < kMaxElements; i++) {
     auto caller_index =
         callee_map[i].load(std::memory_order_relaxed) * kTotalBuckets;
@@ -280,12 +286,12 @@
       callers_list.GetList().push_back(std::move(caller_count));
     }
     callee_element.SetKey("caller_and_count", std::move(callers_list));
-    root.GetList().push_back(std::move(callee_element));
+    call_graph.GetList().push_back(std::move(callee_element));
   }
 
+  root.SetKey("call_graph", std::move(call_graph));
   std::string output_js;
-  if (!JSONWriter::WriteWithOptions(root, JSONWriter::OPTIONS_PRETTY_PRINT,
-                                    &output_js)) {
+  if (!JSONWriter::Write(root, &output_js)) {
     LOG(FATAL) << "Error getting JSON string";
   }
   if (file.WriteAtCurrentPos(output_js.c_str(),
diff --git a/base/memory/shared_memory_mapping.h b/base/memory/shared_memory_mapping.h
index 782b150..d9569af8 100644
--- a/base/memory/shared_memory_mapping.h
+++ b/base/memory/shared_memory_mapping.h
@@ -8,6 +8,7 @@
 #include <cstddef>
 #include <type_traits>
 
+#include "base/containers/buffer_iterator.h"
 #include "base/containers/span.h"
 #include "base/macros.h"
 #include "base/unguessable_token.h"
@@ -145,6 +146,12 @@
     return span<const T>(static_cast<const T*>(raw_memory_ptr()), count);
   }
 
+  // Returns a BufferIterator of const T.
+  template <typename T>
+  BufferIterator<const T> GetMemoryAsBufferIterator() const {
+    return BufferIterator<const T>(GetMemoryAsSpan<T>());
+  }
+
  private:
   friend class ReadOnlySharedMemoryRegion;
   ReadOnlySharedMemoryMapping(void* address,
@@ -216,6 +223,12 @@
     return span<T>(static_cast<T*>(raw_memory_ptr()), count);
   }
 
+  // Returns a BufferIterator of T.
+  template <typename T>
+  BufferIterator<T> GetMemoryAsBufferIterator() {
+    return BufferIterator<T>(GetMemoryAsSpan<T>());
+  }
+
  private:
   friend WritableSharedMemoryMapping MapAtForTesting(
       subtle::PlatformSharedMemoryRegion* region,
diff --git a/base/profiler/native_unwinder_win.cc b/base/profiler/native_unwinder_win.cc
index 813351c..ed06a97 100644
--- a/base/profiler/native_unwinder_win.cc
+++ b/base/profiler/native_unwinder_win.cc
@@ -60,16 +60,24 @@
     if (ContextPC(thread_context) == 0)
       return UnwindResult::COMPLETED;
 
+    // Exclusive range of expected stack pointer values after the unwind.
+    struct {
+      uintptr_t start;
+      uintptr_t end;
+    } expected_stack_pointer_range = {prev_stack_pointer, stack_top};
+
     // Abort if the unwind produced an invalid stack pointer.
 #if defined(ARCH_CPU_ARM64)
     // Leaf frames on Arm can re-use the stack pointer, so they can validly have
     // the same stack pointer as the previous frame.
     if (stack->size() == 1u) {
-      prev_stack_pointer--;
+      expected_stack_pointer_range.start--;
     }
 #endif
-    if (RegisterContextStackPointer(thread_context) <= prev_stack_pointer ||
-        RegisterContextStackPointer(thread_context) >= stack_top) {
+    if (RegisterContextStackPointer(thread_context) <=
+            expected_stack_pointer_range.start ||
+        RegisterContextStackPointer(thread_context) >=
+            expected_stack_pointer_range.end) {
       return UnwindResult::ABORTED;
     }
 
diff --git a/base/profiler/stack_sampling_profiler.cc b/base/profiler/stack_sampling_profiler.cc
index 87ce7880..482a04c 100644
--- a/base/profiler/stack_sampling_profiler.cc
+++ b/base/profiler/stack_sampling_profiler.cc
@@ -87,7 +87,7 @@
           target(target),
           params(params),
           finished(finished),
-          native_sampler(std::move(sampler)),
+          sampler(std::move(sampler)),
           profile_builder(std::move(profile_builder)) {}
     ~CollectionContext() = default;
 
@@ -100,7 +100,7 @@
     WaitableEvent* const finished;  // Signaled when all sampling complete.
 
     // Platform-specific module that does the actual sampling.
-    std::unique_ptr<StackSampler> native_sampler;
+    std::unique_ptr<StackSampler> sampler;
 
     // Receives the sampling data and builds a CallStackProfile.
     std::unique_ptr<ProfileBuilder> profile_builder;
@@ -188,9 +188,9 @@
   // Thread:
   void CleanUp() override;
 
-  // A stack-buffer used by the native sampler for its work. This buffer can
-  // be re-used for multiple native sampler objects so long as the API calls
-  // that take it are not called concurrently.
+  // A stack-buffer used by the sampler for its work. This buffer is re-used
+  // across multiple sampler objects since their execution is serialized on the
+  // sampling thread.
   std::unique_ptr<StackSampler::StackBuffer> stack_buffer_;
 
   // A map of collection ids to collection contexts. Because this class is a
@@ -487,7 +487,7 @@
   if (loc == active_collections_.end())
     return;
 
-  loc->second->native_sampler->AddAuxUnwinder(std::move(unwinder));
+  loc->second->sampler->AddAuxUnwinder(std::move(unwinder));
 }
 
 void StackSamplingProfiler::SamplingThread::AddCollectionTask(
@@ -550,8 +550,8 @@
   }
 
   // Record a single sample.
-  collection->native_sampler->RecordStackFrames(
-      stack_buffer_.get(), collection->profile_builder.get());
+  collection->sampler->RecordStackFrames(stack_buffer_.get(),
+                                         collection->profile_builder.get());
 
   // Schedule the next sample recording if there is one.
   if (++collection->sample_count < collection->params.samples_per_profile) {
diff --git a/base/profiler/stack_sampling_profiler.h b/base/profiler/stack_sampling_profiler.h
index cc85e563..188fd55 100644
--- a/base/profiler/stack_sampling_profiler.h
+++ b/base/profiler/stack_sampling_profiler.h
@@ -34,14 +34,20 @@
 //   // To process the profiles, use a custom ProfileBuilder subclass:
 //   class SubProfileBuilder : public base::ProfileBuilder {...}
 //
+//   // Then create the profiler:
+//   base::StackSamplingProfiler profiler(base::PlatformThread::CurrentId(),
+//       params, std::make_unique<SubProfileBuilder>(...));
+//
 //   // On Android the |sampler| is not implemented in base. So, client can pass
 //   // in |sampler| to use while profiling.
-//   base::StackSamplingProfiler profiler(base::PlatformThread::CurrentId()),
+//   base::StackSamplingProfiler profiler(base::PlatformThread::CurrentId(),
 //       params, std::make_unique<SubProfileBuilder>(...), <optional> sampler);
 //
+//   // Then start the profiling.
 //   profiler.Start();
 //   // ... work being done on the target thread here ...
-//   profiler.Stop();  // optional, stops collection before complete per params
+//   // Optionally stop collection before complete per params.
+//   profiler.Stop();
 //
 // The default SamplingParams causes stacks to be recorded in a single profile
 // at a 10Hz interval for a total of 30 seconds. All of these parameters may be
diff --git a/base/task/sequence_manager/sequence_manager.cc b/base/task/sequence_manager/sequence_manager.cc
index 04a8199..0bfa797 100644
--- a/base/task/sequence_manager/sequence_manager.cc
+++ b/base/task/sequence_manager/sequence_manager.cc
@@ -41,6 +41,13 @@
   return *this;
 }
 
+SequenceManager::Settings::Builder&
+SequenceManager::Settings::Builder::SetAddQueueTimeToTasks(
+    bool add_queue_time_to_tasks_val) {
+  settings_.add_queue_time_to_tasks = add_queue_time_to_tasks_val;
+  return *this;
+}
+
 #if DCHECK_IS_ON()
 
 SequenceManager::Settings::Builder&
diff --git a/base/task/sequence_manager/sequence_manager.h b/base/task/sequence_manager/sequence_manager.h
index 8479a97..05b494e 100644
--- a/base/task/sequence_manager/sequence_manager.h
+++ b/base/task/sequence_manager/sequence_manager.h
@@ -72,6 +72,9 @@
     bool randomised_sampling_enabled = false;
     const TickClock* clock = DefaultTickClock::GetInstance();
 
+    // If true, add the timestamp the task got queued to the task.
+    bool add_queue_time_to_tasks = false;
+
 #if DCHECK_IS_ON()
     // TODO(alexclarke): Consider adding command line flags to control these.
     enum class TaskLogging {
@@ -104,6 +107,7 @@
     // a random TaskQueue for a given priority rather than the TaskQueue with
     // the oldest EnqueueOrder.
     int random_task_selection_seed = 0;
+
 #endif  // DCHECK_IS_ON()
 
     DISALLOW_COPY_AND_ASSIGN(Settings);
@@ -220,6 +224,9 @@
   // Sets the TickClock the SequenceManager uses to obtain Now.
   Builder& SetTickClock(const TickClock* clock);
 
+  // Whether or not queueing timestamp will be added to tasks.
+  Builder& SetAddQueueTimeToTasks(bool add_queue_time_to_tasks);
+
 #if DCHECK_IS_ON()
   // Controls task execution logging.
   Builder& SetTaskLogging(TaskLogging task_execution_logging);
@@ -251,6 +258,7 @@
   // random TaskQueue for a given priority rather than the TaskQueue with the
   // oldest EnqueueOrder.
   Builder& SetRandomTaskSelectionSeed(int random_task_selection_seed);
+
 #endif  // DCHECK_IS_ON()
 
   Settings Build();
diff --git a/base/task/sequence_manager/sequence_manager_impl.cc b/base/task/sequence_manager/sequence_manager_impl.cc
index c9a5172..e30b78f 100644
--- a/base/task/sequence_manager/sequence_manager_impl.cc
+++ b/base/task/sequence_manager/sequence_manager_impl.cc
@@ -153,6 +153,8 @@
       settings_(std::move(settings)),
       metric_recording_settings_(InitializeMetricRecordingSettings(
           settings_.randomised_sampling_enabled)),
+      add_queue_time_to_tasks_(settings_.add_queue_time_to_tasks),
+
       empty_queues_to_reload_(associated_thread_),
       memory_corruption_sentinel_(kMemoryCorruptionSentinelValue),
       main_thread_only_(associated_thread_, settings_),
diff --git a/base/task/sequence_manager/sequence_manager_impl.h b/base/task/sequence_manager/sequence_manager_impl.h
index 81bcc8e9..81d8e587 100644
--- a/base/task/sequence_manager/sequence_manager_impl.h
+++ b/base/task/sequence_manager/sequence_manager_impl.h
@@ -387,7 +387,7 @@
   const MetricRecordingSettings metric_recording_settings_;
 
   // Whether to add the queue time to tasks.
-  base::subtle::Atomic32 add_queue_time_to_tasks_ = 0;
+  base::subtle::Atomic32 add_queue_time_to_tasks_;
 
   AtomicFlagSet empty_queues_to_reload_;
 
diff --git a/base/test/android/javatests/src/org/chromium/base/test/BaseChromiumAndroidJUnitRunner.java b/base/test/android/javatests/src/org/chromium/base/test/BaseChromiumAndroidJUnitRunner.java
index 046e8e8..4a11bb2 100644
--- a/base/test/android/javatests/src/org/chromium/base/test/BaseChromiumAndroidJUnitRunner.java
+++ b/base/test/android/javatests/src/org/chromium/base/test/BaseChromiumAndroidJUnitRunner.java
@@ -24,9 +24,11 @@
 import dalvik.system.DexFile;
 
 import org.chromium.base.BuildConfig;
+import org.chromium.base.ContextUtils;
 import org.chromium.base.Log;
 import org.chromium.base.annotations.MainDex;
 import org.chromium.base.multidex.ChromiumMultiDexInstaller;
+import org.chromium.base.test.util.InMemorySharedPreferencesContext;
 
 import java.io.IOException;
 import java.lang.reflect.Field;
@@ -75,12 +77,14 @@
     private static final String ARGUMENT_LOG_ONLY = "log";
 
     private static final String TAG = "BaseJUnitRunner";
+    static InMemorySharedPreferencesContext sInMemorySharedPreferencesContext;
 
     @Override
     public Application newApplication(ClassLoader cl, String className, Context context)
             throws ClassNotFoundException, IllegalAccessException, InstantiationException {
+        Context targetContext = super.getTargetContext();
         boolean hasUnderTestApk =
-                !getContext().getPackageName().equals(getTargetContext().getPackageName());
+                !getContext().getPackageName().equals(targetContext.getPackageName());
         // When there is an under-test APK, BuildConfig belongs to it and does not indicate whether
         // the test apk is multidex. In this case, just assume it is.
         boolean isTestMultidex = hasUnderTestApk || BuildConfig.IS_MULTIDEX_ENABLED;
@@ -89,14 +93,28 @@
                 // Need hacks to have multidex work when there is an under-test apk :(.
                 ChromiumMultiDexInstaller.install(
                         new BaseChromiumRunnerCommon.MultiDexContextWrapper(
-                                getContext(), getTargetContext()));
-                BaseChromiumRunnerCommon.reorderDexPathElements(
-                        cl, getContext(), getTargetContext());
+                                getContext(), targetContext));
+                BaseChromiumRunnerCommon.reorderDexPathElements(cl, getContext(), targetContext);
             } else {
                 ChromiumMultiDexInstaller.install(getContext());
             }
         }
-        return super.newApplication(cl, className, context);
+
+        // We would ideally be able to wrap |context| here, and pass that to newApplication.
+        // However, there is framework code that assumes Application.getBaseContext() can be
+        // casted to ContextImpl (on KitKat for broadcast receivers. Refer to ActivityThread.java).
+        Application ret = super.newApplication(cl, className, context);
+        sInMemorySharedPreferencesContext = new InMemorySharedPreferencesContext(ret);
+        // Set this as early as possible since Application start-up could access prefs.
+        ContextUtils.initApplicationContextForTests(sInMemorySharedPreferencesContext);
+        return ret;
+    }
+
+    @Override
+    public Context getTargetContext() {
+        // The target context by default points directly at the ContextImpl, which we can't wrap.
+        // Make it instead point at the Application.
+        return sInMemorySharedPreferencesContext;
     }
 
     /**
diff --git a/base/test/android/javatests/src/org/chromium/base/test/BaseJUnit4ClassRunner.java b/base/test/android/javatests/src/org/chromium/base/test/BaseJUnit4ClassRunner.java
index 81579c7..4fa14c6 100644
--- a/base/test/android/javatests/src/org/chromium/base/test/BaseJUnit4ClassRunner.java
+++ b/base/test/android/javatests/src/org/chromium/base/test/BaseJUnit4ClassRunner.java
@@ -4,8 +4,7 @@
 
 package org.chromium.base.test;
 
-import static org.chromium.base.test.BaseChromiumAndroidJUnitRunner.shouldListTests;
-
+import android.app.Application;
 import android.content.Context;
 import android.support.annotation.CallSuper;
 import android.support.test.InstrumentationRegistry;
@@ -13,6 +12,7 @@
 import android.support.test.internal.util.AndroidRunnerParams;
 
 import org.junit.rules.MethodRule;
+import org.junit.rules.RuleChain;
 import org.junit.rules.TestRule;
 import org.junit.runner.Description;
 import org.junit.runner.notification.RunNotifier;
@@ -21,7 +21,6 @@
 import org.junit.runners.model.Statement;
 
 import org.chromium.base.CommandLine;
-import org.chromium.base.ContextUtils;
 import org.chromium.base.Log;
 import org.chromium.base.test.BaseTestResult.PreTestHook;
 import org.chromium.base.test.params.MethodParamAnnotationRule;
@@ -88,6 +87,11 @@
                 new AndroidRunnerParams(InstrumentationRegistry.getInstrumentation(),
                         InstrumentationRegistry.getArguments(), false, 0L, false));
 
+        assert InstrumentationRegistry.getInstrumentation()
+                        instanceof BaseChromiumAndroidJUnitRunner
+            : "Must use BaseChromiumAndroidJUnitRunner instrumentation with "
+              + "BaseJUnit4ClassRunner, but found: "
+              + InstrumentationRegistry.getInstrumentation().getClass();
         String traceOutput = InstrumentationRegistry.getArguments().getString(EXTRA_TRACE_FILE);
 
         if (traceOutput != null) {
@@ -102,6 +106,12 @@
         }
     }
 
+    /** Returns the singleton Application instance. */
+    public static Application getApplication() {
+        return (Application)
+                BaseChromiumAndroidJUnitRunner.sInMemorySharedPreferencesContext.getBaseContext();
+    }
+
     /**
      * Merge two List into a new ArrayList.
      *
@@ -174,7 +184,14 @@
      */
     @CallSuper
     protected List<TestRule> getDefaultTestRules() {
-        return Arrays.asList(new DestroyActivitiesRule(), new LifetimeAssertRule());
+        // Order is important here. Outer rule setUp's run first, and tearDown's run last.
+        // Base setUp() should go first to initialize ContextUtils and clear out prefs.
+        // Base's tearDown() should come last since it deletes files.
+        // Activities must be destroyed before lifetimes are checked, so DestroyActivitiesRule()
+        // must come last so that its tearDown() runs before LifetimeAssertRule's.
+        return Collections.singletonList(RuleChain.outerRule(new BaseJUnit4TestRule())
+                                                 .around(new LifetimeAssertRule())
+                                                 .around(new DestroyActivitiesRule()));
     }
 
     /**
@@ -204,12 +221,8 @@
      */
     @Override
     public void run(RunNotifier notifier) {
-        // Most tests have an Application subclass that already call this.
-        if (ContextUtils.getApplicationContext() == null) {
-            ContextUtils.initApplicationContext(
-                    InstrumentationRegistry.getTargetContext().getApplicationContext());
-        }
-        if (shouldListTests(InstrumentationRegistry.getArguments())) {
+        if (BaseChromiumAndroidJUnitRunner.shouldListTests(
+                    InstrumentationRegistry.getArguments())) {
             for (Description child : getDescription().getChildren()) {
                 notifier.fireTestStarted(child);
                 notifier.fireTestFinished(child);
@@ -277,13 +290,4 @@
     protected Statement withAfters(FrameworkMethod method, Object test, Statement base) {
         return super.withAfters(method, test, new ScreenshotOnFailureStatement(base));
     }
-
-    @Override
-    protected List<TestRule> classRules() {
-        List<TestRule> result = super.classRules();
-        // Class rules are the outermost TestRules, so CommitSharedPreferencesTestRule will commit
-        // SharedPreferences after all other rules have finished writing them.
-        result.add(new CommitSharedPreferencesTestRule());
-        return result;
-    }
 }
diff --git a/base/test/android/javatests/src/org/chromium/base/test/BaseJUnit4TestRule.java b/base/test/android/javatests/src/org/chromium/base/test/BaseJUnit4TestRule.java
new file mode 100644
index 0000000..1b736717
--- /dev/null
+++ b/base/test/android/javatests/src/org/chromium/base/test/BaseJUnit4TestRule.java
@@ -0,0 +1,75 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.base.test;
+
+import android.support.test.InstrumentationRegistry;
+import android.support.v4.content.ContextCompat;
+import android.text.TextUtils;
+
+import org.junit.rules.TestRule;
+import org.junit.runner.Description;
+import org.junit.runners.model.Statement;
+
+import org.chromium.base.ContextUtils;
+import org.chromium.base.test.util.InMemorySharedPreferencesContext;
+
+import java.io.File;
+import java.util.ArrayList;
+
+/**
+ * Holds setUp / tearDown logic common to all instrumentation tests.
+ */
+class BaseJUnit4TestRule implements TestRule {
+    @Override
+    public Statement apply(Statement base, Description description) {
+        return new Statement() {
+            @Override
+            public void evaluate() throws Throwable {
+                // Don't tests if there are prior on-disk shared prefs lying around.
+                checkOrDeleteOnDiskSharedPreferences(false);
+
+                InMemorySharedPreferencesContext context =
+                        BaseChromiumAndroidJUnitRunner.sInMemorySharedPreferencesContext;
+                // Reset Application context in case any tests have replaced it.
+                ContextUtils.initApplicationContextForTests(context);
+                // Ensure all tests start with empty (InMemory)SharedPreferences.
+                context.clearSharedPreferences();
+
+                base.evaluate();
+
+                // Do not use try/finally so that preferences asserts do not mask prior exceptions.
+                checkOrDeleteOnDiskSharedPreferences(true);
+            }
+        };
+    }
+
+    private void checkOrDeleteOnDiskSharedPreferences(boolean check) {
+        File dataDir = ContextCompat.getDataDir(InstrumentationRegistry.getTargetContext());
+        File prefsDir = new File(dataDir, "shared_prefs");
+        File[] files = prefsDir.listFiles();
+        if (files == null) {
+            return;
+        }
+        ArrayList<File> badFiles = new ArrayList<>();
+        for (File f : files) {
+            if (!f.getName().endsWith("multidex.version.xml")) {
+                if (check) {
+                    badFiles.add(f);
+                } else {
+                    f.delete();
+                }
+            }
+        }
+        if (!badFiles.isEmpty()) {
+            throw new AssertionError("Found shared prefs file(s).\n"
+                    + "Code should use ContextUtils.getApplicationContext() when accessing "
+                    + "SharedPreferences so that tests are hooked to use InMemorySharedPreferences."
+                    + " This could also mean needing to override getSharedPreferences() on custom "
+                    + " Context subclasses (e.g. ChromeBaseAppCompatActivity does this to make "
+                    + "Preferences screens work).\n"
+                    + "Files:\n * " + TextUtils.join("\n * ", badFiles));
+        }
+    }
+}
diff --git a/base/test/android/javatests/src/org/chromium/base/test/CommitSharedPreferencesTestRule.java b/base/test/android/javatests/src/org/chromium/base/test/CommitSharedPreferencesTestRule.java
deleted file mode 100644
index 05203e0..0000000
--- a/base/test/android/javatests/src/org/chromium/base/test/CommitSharedPreferencesTestRule.java
+++ /dev/null
@@ -1,33 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-package org.chromium.base.test;
-
-import org.junit.rules.TestRule;
-import org.junit.runner.Description;
-import org.junit.runners.model.Statement;
-
-import org.chromium.base.ContextUtils;
-
-class CommitSharedPreferencesTestRule implements TestRule {
-    @Override
-    public Statement apply(Statement statement, Description description) {
-        return new Statement() {
-            @Override
-            public void evaluate() throws Throwable {
-                // Clear app's SharedPreferences before each test to reduce flakiness.
-                // See https://crbug.com/908174, ttps://crbug.com/902774.
-                ContextUtils.getAppSharedPreferences().edit().clear().commit();
-                try {
-                    statement.evaluate();
-                } finally {
-                    // Some disk writes to update SharedPreferences may still be in progress if
-                    // apply() was used after editing. Commit these changes to SharedPreferences
-                    // before reporting the test as finished. See https://crbug.com/916717.
-                    ContextUtils.getAppSharedPreferences().edit().commit();
-                }
-            }
-        };
-    }
-}
diff --git a/base/test/android/javatests/src/org/chromium/base/test/LifetimeAssertRule.java b/base/test/android/javatests/src/org/chromium/base/test/LifetimeAssertRule.java
index aeb3bda..8784470 100644
--- a/base/test/android/javatests/src/org/chromium/base/test/LifetimeAssertRule.java
+++ b/base/test/android/javatests/src/org/chromium/base/test/LifetimeAssertRule.java
@@ -4,16 +4,25 @@
 
 package org.chromium.base.test;
 
-import org.junit.rules.ExternalResource;
+import org.junit.rules.TestRule;
+import org.junit.runner.Description;
+import org.junit.runners.model.Statement;
 
 import org.chromium.base.LifetimeAssert;
 
 /**
  * Ensures that all object instances that use LifetimeAssert are destroyed.
  */
-public class LifetimeAssertRule extends ExternalResource {
+public class LifetimeAssertRule implements TestRule {
     @Override
-    protected void after() {
-        LifetimeAssert.assertAllInstancesDestroyedForTesting();
+    public Statement apply(Statement base, Description description) {
+        return new Statement() {
+            @Override
+            public void evaluate() throws Throwable {
+                base.evaluate();
+                // Do not use try/finally so that lifetime asserts do not mask prior exceptions.
+                LifetimeAssert.assertAllInstancesDestroyedForTesting();
+            }
+        };
     }
 }
diff --git a/base/threading/thread_restrictions.cc b/base/threading/thread_restrictions.cc
index ffa0a5b..9030450 100644
--- a/base/threading/thread_restrictions.cc
+++ b/base/threading/thread_restrictions.cc
@@ -14,13 +14,13 @@
 
 namespace base {
 
-namespace {
-
 std::ostream& operator<<(std::ostream&out, const ThreadLocalBoolean& tl) {
   out << "currently set to " << (tl.Get() ? "true" : "false");
   return out;
 }
 
+namespace {
+
 #if defined(OS_NACL) || defined(OS_ANDROID)
 // NaCL doesn't support stack sampling and Android is slow at stack
 // sampling and this causes timeouts (crbug.com/959139).
diff --git a/build/android/gyp/generate_linker_version_script.py b/build/android/gyp/generate_linker_version_script.py
index 34c72eb8..0b6c2ef69 100755
--- a/build/android/gyp/generate_linker_version_script.py
+++ b/build/android/gyp/generate_linker_version_script.py
@@ -37,8 +37,11 @@
       help='Export Java_* JNI methods')
   parser.add_argument(
       '--export-symbol-whitelist-file',
-      help='Path to input file containing whitelist of extra '
-      'symbols to export. One symbol per line.')
+      action='append',
+      default=[],
+      dest='whitelists',
+      help='Path to an input file containing a whitelist of extra symbols to '
+      'export, one symbol per line. Multiple files may be specified.')
   options = parser.parse_args()
 
   # JNI_OnLoad is always exported.
@@ -49,8 +52,8 @@
   if options.export_java_symbols:
     symbol_list.append('Java_*')
 
-  if options.export_symbol_whitelist_file:
-    with open(options.export_symbol_whitelist_file, 'rt') as f:
+  for whitelist in options.whitelists:
+    with open(whitelist, 'rt') as f:
       for line in f:
         line = line.strip()
         if not line or line[0] == '#':
diff --git a/build/config/BUILD.gn b/build/config/BUILD.gn
index 3f37c75..514ab7ba 100644
--- a/build/config/BUILD.gn
+++ b/build/config/BUILD.gn
@@ -110,7 +110,6 @@
     defines += [
       "THREAD_SANITIZER",
       "DYNAMIC_ANNOTATIONS_EXTERNAL_IMPL=1",
-      "WTF_USE_DYNAMIC_ANNOTATIONS_NOIMPL=1",
     ]
   }
   if (is_msan) {
@@ -150,7 +149,6 @@
   defines = [
     "_DEBUG",
     "DYNAMIC_ANNOTATIONS_ENABLED=1",
-    "WTF_USE_DYNAMIC_ANNOTATIONS=1",
   ]
 
   if (is_nacl) {
@@ -158,7 +156,7 @@
   }
 
   if (is_win) {
-    if (!enable_iterator_debugging) {
+    if (!enable_iterator_debugging && !use_custom_libcxx) {
       # Iterator debugging is enabled by default by the compiler on debug
       # builds, and we have to tell it to turn it off.
       defines += [ "_HAS_ITERATOR_DEBUGGING=0" ]
@@ -176,10 +174,7 @@
 
   # Sanitizers.
   if (is_tsan) {
-    defines += [
-      "DYNAMIC_ANNOTATIONS_ENABLED=1",
-      "WTF_USE_DYNAMIC_ANNOTATIONS=1",
-    ]
+    defines += [ "DYNAMIC_ANNOTATIONS_ENABLED=1" ]
   } else {
     defines += [ "NVALGRIND" ]
     if (!is_nacl) {
diff --git a/build/config/android/linker_version_script.gni b/build/config/android/linker_version_script.gni
index 6cb3b090..a764df3 100644
--- a/build/config/android/linker_version_script.gni
+++ b/build/config/android/linker_version_script.gni
@@ -10,8 +10,8 @@
 # Variables:
 #    export_java_symbols: Optional. If true, also export all Java_* symbols
 #      exported for JNI.
-#    export_symbol_whitelist_file: Optional. Path to an input file containing
-#      a whitelist of exported symbols.
+#    export_symbol_whitelist_files: Optional. List of paths to input files containing
+#      lists of symbols to export.
 #    linker_script: Path to output linker version script.
 #
 template("generate_linker_version_script") {
@@ -27,11 +27,14 @@
       args += [ "--export-java-symbols" ]
     }
 
-    if (defined(invoker.export_symbol_whitelist_file)) {
-      inputs += [ invoker.export_symbol_whitelist_file ]
-      args +=
-          [ "--export-symbol-whitelist-file=" +
-            rebase_path(invoker.export_symbol_whitelist_file, root_build_dir) ]
+    if (defined(invoker.export_symbol_whitelist_files)) {
+      foreach(file_, invoker.export_symbol_whitelist_files) {
+        inputs += [ file_ ]
+        args += [
+          "--export-symbol-whitelist-file",
+          rebase_path(file_, root_build_dir),
+        ]
+      }
     }
   }
 }
diff --git a/build/fuchsia/linux.sdk.sha1 b/build/fuchsia/linux.sdk.sha1
index cadf9057..746d2a6 100644
--- a/build/fuchsia/linux.sdk.sha1
+++ b/build/fuchsia/linux.sdk.sha1
@@ -1 +1 @@
-8912909845839913648
\ No newline at end of file
+8912850310186308320
\ No newline at end of file
diff --git a/build/fuchsia/mac.sdk.sha1 b/build/fuchsia/mac.sdk.sha1
index 4ccb055..9c395087 100644
--- a/build/fuchsia/mac.sdk.sha1
+++ b/build/fuchsia/mac.sdk.sha1
@@ -1 +1 @@
-8912928491539290416
\ No newline at end of file
+8912853447266381072
\ No newline at end of file
diff --git a/build/sanitizers/tsan_suppressions.cc b/build/sanitizers/tsan_suppressions.cc
index 2eacbf7..edd6b77 100644
--- a/build/sanitizers/tsan_suppressions.cc
+++ b/build/sanitizers/tsan_suppressions.cc
@@ -174,9 +174,6 @@
     // https://crbug.com/459429
     "race:randomnessPid\n"
 
-    // https://crbug.com/454655
-    "race:content::BrowserTestBase::PostTaskToInProcessRendererAndWait\n"
-
     // http://crbug.com/582274
     "race:usrsctp_close\n"
 
diff --git a/chrome/android/BUILD.gn b/chrome/android/BUILD.gn
index b8c5c6b..1b4a2cb 100644
--- a/chrome/android/BUILD.gn
+++ b/chrome/android/BUILD.gn
@@ -1138,7 +1138,7 @@
     if (enable_vr) {
       if (defined(invoker.is_bundle) && invoker.is_bundle) {
         if (modularize_vr_native) {
-          public_deps += [ "//chrome/browser/android/vr:ui_module_factory" ]
+          deps += [ "//chrome/browser/android/vr:ui_module_factory" ]
         } else {
           deps += [ "//chrome/browser/android/vr:ui_module_dummy_factory" ]
         }
@@ -1454,7 +1454,7 @@
     if (enable_vr) {
       if (defined(invoker.is_bundle) && invoker.is_bundle) {
         if (modularize_vr_native) {
-          public_deps += [ "//chrome/browser/android/vr:ui_module_factory" ]
+          deps += [ "//chrome/browser/android/vr:ui_module_factory" ]
         } else {
           deps += [ "//chrome/browser/android/vr:ui_module_dummy_factory" ]
         }
diff --git a/chrome/android/chrome_common_shared_library.gni b/chrome/android/chrome_common_shared_library.gni
index efa9d7a..65b1aae 100644
--- a/chrome/android/chrome_common_shared_library.gni
+++ b/chrome/android/chrome_common_shared_library.gni
@@ -6,6 +6,8 @@
 import("//build/config/android/config.gni")
 import("//build/config/android/linker_version_script.gni")
 import("//build/config/compiler/compiler.gni")
+import("//build/partitioned_shared_library.gni")
+import("//chrome/android/features/dynamic_feature_modules.gni")
 import("//device/vr/buildflags/buildflags.gni")
 
 # These variables control whether app bundles use the same native libraries as
@@ -31,8 +33,6 @@
 # and libchromefortest (used by chrome_public_test_apk).
 #
 # Variables:
-#    export_symbol_whitelist: Optional. If set, a pre-determined list of additional
-#      methods are exposed by the resulting library.
 #    is_monochrome: Optional. If set, the library is for use in monochrome.
 #    is_webview: If true, the library is for webview, and browser-specific
 #      config is skipped.
@@ -48,14 +48,20 @@
   generate_linker_version_script(_linker_script_target) {
     linker_script = _linker_script
     export_java_symbols = _export_java_symbols
-    if (defined(invoker.export_symbol_whitelist)) {
-      export_symbol_whitelist_file =
-          "//chrome/android/feature_module_exports.lst"
+    if (use_native_modules) {
+      export_symbol_whitelist_files = native_feature_module_entrypoint_files
     }
   }
 
-  shared_library(target_name) {
-    forward_variables_from(invoker, "*", [ "export_symbol_whitelist" ])
+  if (use_native_modules) {
+    _target_type = "partitioned_shared_library"
+  } else {
+    _target_type = "shared_library"
+  }
+
+  target(_target_type, target_name) {
+    forward_variables_from(invoker, "*")
+
     if (!_is_webview) {
       deps += [ "//chrome:chrome_android_core" ]
     }
@@ -76,7 +82,7 @@
     ldflags += [ "-Wl,--version-script=" +
                  rebase_path(_linker_script, root_build_dir) ]
 
-    # Handle VR JNI regisration and dependencies.
+    # Handle VR JNI registration and dependencies.
     if (!_is_webview && enable_vr) {
       if (_export_java_symbols) {
         # NOTE: While this is file is named *_monochrome.cc, it just contains
@@ -90,6 +96,11 @@
       }
     }
 
+    if (use_native_modules) {
+      partitions = native_feature_modules
+      deps += feature_module_base_lib_deps
+    }
+
     # Compress relocations if needed.
     if ((_is_monochrome || _is_webview || chromium_linker_supported) &&
         use_lld) {
diff --git a/chrome/android/chrome_java_sources.gni b/chrome/android/chrome_java_sources.gni
index 66ffb778..60c1bf5 100644
--- a/chrome/android/chrome_java_sources.gni
+++ b/chrome/android/chrome_java_sources.gni
@@ -369,6 +369,7 @@
   "java/src/org/chromium/chrome/browser/customtabs/CustomTabBrowserControlsVisibilityDelegate.java",
   "java/src/org/chromium/chrome/browser/customtabs/CustomTabDelegateFactory.java",
   "java/src/org/chromium/chrome/browser/customtabs/CustomTabIntentDataProvider.java",
+  "java/src/org/chromium/chrome/browser/customtabs/CustomTabStatusBarColorProvider.java",
   "java/src/org/chromium/chrome/browser/customtabs/CustomTabNavigationEventObserver.java",
   "java/src/org/chromium/chrome/browser/customtabs/CustomTabNightModeStateController.java",
   "java/src/org/chromium/chrome/browser/customtabs/CustomTabObserver.java",
diff --git a/chrome/android/chrome_junit_test_java_sources.gni b/chrome/android/chrome_junit_test_java_sources.gni
index 6ba7287..4c83ff7 100644
--- a/chrome/android/chrome_junit_test_java_sources.gni
+++ b/chrome/android/chrome_junit_test_java_sources.gni
@@ -50,6 +50,7 @@
   "junit/src/org/chromium/chrome/browser/crash/LogcatExtractionRunnableUnitTest.java",
   "junit/src/org/chromium/chrome/browser/customtabs/CloseButtonNavigatorTest.java",
   "junit/src/org/chromium/chrome/browser/customtabs/CustomTabIntentDataProviderTest.java",
+  "junit/src/org/chromium/chrome/browser/customtabs/CustomTabStatusBarColorProviderTest.java",
   "junit/src/org/chromium/chrome/browser/customtabs/NavigationInfoCaptureTriggerTest.java",
   "junit/src/org/chromium/chrome/browser/customtabs/content/CustomTabActivityContentTestEnvironment.java",
   "junit/src/org/chromium/chrome/browser/customtabs/content/CustomTabActivityNavigationControllerTest.java",
diff --git a/chrome/android/features/autofill_assistant/java/res/layout/autofill_assistant_bottom_sheet_content.xml b/chrome/android/features/autofill_assistant/java/res/layout/autofill_assistant_bottom_sheet_content.xml
index 1c1facc..95f2406 100644
--- a/chrome/android/features/autofill_assistant/java/res/layout/autofill_assistant_bottom_sheet_content.xml
+++ b/chrome/android/features/autofill_assistant/java/res/layout/autofill_assistant_bottom_sheet_content.xml
@@ -10,10 +10,6 @@
     android:layout_height="wrap_content"
     android:layout_width="match_parent"
     android:paddingTop="12dp"
-    android:paddingBottom="@dimen/autofill_assistant_bottombar_vertical_spacing"
-    android:animateLayoutChanges="true"
-    android:clipChildren="false"
-    android:clipToPadding="false"
     android:orientation="vertical">
     <LinearLayout
         android:id="@+id/header"
@@ -51,4 +47,33 @@
         android:layout_marginEnd="@dimen/autofill_assistant_bottombar_horizontal_spacing"
         app:colorBackground="@color/modern_secondary_color"
         app:colorProgress="@color/default_text_color_blue"/>
+
+    <org.chromium.chrome.browser.widget.FadingEdgeScrollView
+        android:id="@+id/scrollable_content"
+        android:layout_width="match_parent"
+        android:layout_height="0dp"
+        android:layout_weight="1">
+        <LinearLayout
+            android:id="@+id/scrollable_content_container"
+            android:layout_width="match_parent"
+            android:layout_height="wrap_content"
+            android:orientation="vertical"
+            android:animateLayoutChanges="true"
+            android:clipChildren="false"
+            android:clipToPadding="false" />
+    </org.chromium.chrome.browser.widget.FadingEdgeScrollView>
+
+    <!-- This intermediate container is necessary as the actions carousel needs
+         a parent with clipChildren set to false (because of the shadow around
+         the cancel button that is drawn outside of the actions carousel). We
+         can't put it on this layout root as this breaks scroll views (and thus
+         the scrollable_content sibling above). -->
+    <LinearLayout
+        android:id="@+id/carousels_container"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:paddingBottom="@dimen/autofill_assistant_bottombar_vertical_spacing"
+        android:orientation="vertical"
+        android:clipChildren="false"
+        android:clipToPadding="false" />
 </org.chromium.chrome.browser.autofill_assistant.SizeListenableLinearLayout>
diff --git a/chrome/android/features/autofill_assistant/java/res/layout/autofill_assistant_onboarding.xml b/chrome/android/features/autofill_assistant/java/res/layout/autofill_assistant_onboarding.xml
index 91f71b4..38eb276 100644
--- a/chrome/android/features/autofill_assistant/java/res/layout/autofill_assistant_onboarding.xml
+++ b/chrome/android/features/autofill_assistant/java/res/layout/autofill_assistant_onboarding.xml
@@ -9,99 +9,85 @@
     android:id="@+id/assistant_onboarding"
     android:layout_width="match_parent"
     android:layout_height="wrap_content"
+    android:paddingTop="12dp"
+    android:paddingStart="24dp"
+    android:paddingEnd="24dp"
+    android:gravity="center_horizontal"
     android:orientation="vertical">
 
-    <org.chromium.chrome.browser.widget.FadingEdgeScrollView
-        android:id="@+id/onboarding_scroll_view"
-        android:layout_height="0dp"
-        android:layout_weight="1"
-        android:layout_width="match_parent">
+    <!-- Image background -->
+    <ImageView
+        android:id="@+id/onboarding_image"
+        tools:ignore="contentDescription"
+        android:layout_width="250dp"
+        android:layout_height="wrap_content"
+        android:scaleType="centerCrop"
+        android:src="@drawable/autofill_assistant_onboarding_bg"
+        android:layout_marginTop="12dp" />
 
-        <LinearLayout
-            android:layout_width="match_parent"
+    <!-- "Try Google Assistant in Chrome" -->
+    <ImageView
+        android:id="@+id/onboarding_try_assistant"
+        tools:ignore="contentDescription"
+        android:layout_width="185dp"
+        android:layout_height="wrap_content"
+        android:layout_marginTop="16dp"
+        android:src="@drawable/autofill_assistant_onboarding_try" />
+
+    <!-- Subtitle (e.g., 'Google Assistant saves you time...')-->
+    <LinearLayout
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content">
+        <Space
+            android:layout_width="0dp"
+            android:layout_height="1dp"
+            android:layout_weight="1"/>
+        <!-- The subtitle takes 4/6 of the screen width. -->
+        <TextView
+            android:id="@+id/onboarding_subtitle"
+            android:layout_width="0dp"
             android:layout_height="wrap_content"
+            android:layout_weight="4"
+            android:layout_marginTop="24dp"
+            android:textAppearance="@style/TextAppearance.AssistantBlackBody"
             android:gravity="center_horizontal"
-            android:orientation="vertical"
-            android:paddingStart="24dp"
-            android:paddingEnd="24dp">
+            android:text="@string/autofill_assistant_init_message" />
+        <Space
+            android:layout_width="0dp"
+            android:layout_height="1dp"
+            android:layout_weight="1"/>
+    </LinearLayout>
 
-            <Space android:layout_width="0dp" android:layout_height="12dp"/>
+    <!-- Separator -->
+    <LinearLayout
+        android:id="@+id/onboarding_separator"
+        android:layout_width="match_parent"
+        android:layout_height="wrap_content"
+        android:layout_marginTop="24dp"
+        android:gravity="center_horizontal"
+        android:orientation="horizontal"
+        android:weightSum="1.0">
+        <View style="@style/HorizontalDivider"
+            android:layout_width="0dp"
+            android:layout_height="1dp"
+            android:layout_weight="0.33"/>
+    </LinearLayout>
+    <Space android:layout_width="0dp" android:layout_height="24dp"/>
 
-            <!-- Image background -->
-            <ImageView
-                android:id="@+id/onboarding_image"
-                tools:ignore="contentDescription"
-                android:layout_width="250dp"
-                android:layout_height="wrap_content"
-                android:scaleType="centerCrop"
-                android:src="@drawable/autofill_assistant_onboarding_bg"
-                android:layout_marginTop="12dp" />
-
-            <!-- "Try Google Assistant in Chrome" -->
-            <ImageView
-                android:id="@+id/onboarding_try_assistant"
-                tools:ignore="contentDescription"
-                android:layout_width="185dp"
-                android:layout_height="wrap_content"
-                android:layout_marginTop="16dp"
-                android:src="@drawable/autofill_assistant_onboarding_try" />
-
-            <!-- Subtitle (e.g., 'Google Assistant saves you time...')-->
-            <LinearLayout
-                android:layout_width="match_parent"
-                android:layout_height="wrap_content">
-                <Space
-                    android:layout_width="0dp"
-                    android:layout_height="1dp"
-                    android:layout_weight="1"/>
-                <!-- The subtitle takes 4/6 of the screen width. -->
-                <TextView
-                    android:id="@+id/onboarding_subtitle"
-                    android:layout_width="0dp"
-                    android:layout_height="wrap_content"
-                    android:layout_weight="4"
-                    android:layout_marginTop="24dp"
-                    android:textAppearance="@style/TextAppearance.AssistantBlackBody"
-                    android:gravity="center_horizontal"
-                    android:text="@string/autofill_assistant_init_message" />
-                <Space
-                    android:layout_width="0dp"
-                    android:layout_height="1dp"
-                    android:layout_weight="1"/>
-            </LinearLayout>
-
-            <!-- Separator -->
-            <LinearLayout
-                android:id="@+id/onboarding_separator"
-                android:layout_width="match_parent"
-                android:layout_height="wrap_content"
-                android:layout_marginTop="24dp"
-                android:gravity="center_horizontal"
-                android:orientation="horizontal"
-                android:weightSum="1.0">
-                <View style="@style/HorizontalDivider"
-                    android:layout_width="0dp"
-                    android:layout_height="1dp"
-                    android:layout_weight="0.33"/>
-            </LinearLayout>
-            <Space android:layout_width="0dp" android:layout_height="24dp"/>
-
-            <!-- Terms and Conditions message and link -->
-            <LinearLayout
-                android:layout_height="wrap_content"
-                android:layout_width="match_parent"
-                android:paddingBottom="9dp">
-                <TextView
-                    android:id="@+id/google_terms_message"
-                    android:layout_width="wrap_content"
-                    android:layout_height="wrap_content"
-                    android:layout_margin="0dp"
-                    android:layout_gravity="center"
-                    android:textAppearance="@style/TextAppearance.AssistantBlackCaption"
-                    android:text="@string/autofill_assistant_google_terms_description" />
-            </LinearLayout>
-        </LinearLayout>
-    </org.chromium.chrome.browser.widget.FadingEdgeScrollView>
+    <!-- Terms and Conditions message and link -->
+    <LinearLayout
+        android:layout_height="wrap_content"
+        android:layout_width="match_parent"
+        android:paddingBottom="9dp">
+        <TextView
+            android:id="@+id/google_terms_message"
+            android:layout_width="wrap_content"
+            android:layout_height="wrap_content"
+            android:layout_margin="0dp"
+            android:layout_gravity="center"
+            android:textAppearance="@style/TextAppearance.AssistantBlackCaption"
+            android:text="@string/autofill_assistant_google_terms_description" />
+    </LinearLayout>
 
     <!-- Layout for the buttons -->
     <Space android:layout_width="0dp" android:layout_height="24dp"/>
@@ -109,9 +95,7 @@
     android:layout_width="match_parent"
     android:layout_height="wrap_content"
     android:gravity="bottom|center"
-    android:orientation="horizontal"
-    android:paddingStart="24dp"
-    android:paddingEnd="24dp">
+    android:orientation="horizontal">
 
     <!-- 'No' button -->
     <org.chromium.ui.widget.ButtonCompat
diff --git a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/AssistantBottomBarCoordinator.java b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/AssistantBottomBarCoordinator.java
index fcca1a5..d0bc650 100644
--- a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/AssistantBottomBarCoordinator.java
+++ b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/AssistantBottomBarCoordinator.java
@@ -29,7 +29,6 @@
 import org.chromium.chrome.browser.autofill_assistant.overlay.AssistantOverlayModel;
 import org.chromium.chrome.browser.autofill_assistant.overlay.AssistantOverlayState;
 import org.chromium.chrome.browser.autofill_assistant.payment.AssistantPaymentRequestCoordinator;
-import org.chromium.chrome.browser.autofill_assistant.payment.AssistantPaymentRequestModel;
 import org.chromium.chrome.browser.compositor.CompositorViewResizer;
 import org.chromium.chrome.browser.widget.bottomsheet.BottomSheet;
 import org.chromium.chrome.browser.widget.bottomsheet.BottomSheetController;
@@ -59,9 +58,6 @@
             new ObserverList<>();
     private boolean mResizeViewport;
 
-    @Nullable
-    private ScrollView mOnboardingScrollView;
-
     AssistantBottomBarCoordinator(
             Activity activity, AssistantModel model, BottomSheetController controller) {
         mModel = model;
@@ -85,28 +81,28 @@
                 mContent.mToolbarView, mContent.mBottomBarView, mSuggestionsCoordinator.getView(),
                 mActionsCoordinator.getView(), AssistantPeekHeightCoordinator.PeekMode.HANDLE);
 
-        // Add child views to bottom bar container.
-        mContent.mBottomBarView.addView(mInfoBoxCoordinator.getView());
-        mContent.mBottomBarView.addView(mDetailsCoordinator.getView());
-        mContent.mBottomBarView.addView(mPaymentRequestCoordinator.getView());
-        mContent.mBottomBarView.addView(mFormCoordinator.getView());
-        mContent.mBottomBarView.addView(mSuggestionsCoordinator.getView());
-        mContent.mBottomBarView.addView(mActionsCoordinator.getView());
+        // Add child views to bottom bar container. We put all child views in the scrollable
+        // container, except the actions and suggestions.
+        mContent.mScrollableContentContainer.addView(mInfoBoxCoordinator.getView());
+        mContent.mScrollableContentContainer.addView(mDetailsCoordinator.getView());
+        mContent.mScrollableContentContainer.addView(mPaymentRequestCoordinator.getView());
+        mContent.mScrollableContentContainer.addView(mFormCoordinator.getView());
+        mContent.mCarouselsContainer.addView(mSuggestionsCoordinator.getView());
+        mContent.mCarouselsContainer.addView(mActionsCoordinator.getView());
 
-        // Set children top margins to have a spacing between them. For the carousels, we set their
-        // margin only when they are not empty given that they are always shown, even if empty. We
-        // do not hide them because there is an incompatibility bug between the animateLayoutChanges
-        // attribute set on mBottomBarView and the animations ran by the carousels
-        // RecyclerView.
+        // Set children top margins to have a spacing between them.
         int childSpacing = activity.getResources().getDimensionPixelSize(
                 R.dimen.autofill_assistant_bottombar_vertical_spacing);
         setChildMarginTop(mDetailsCoordinator.getView(), childSpacing);
         setChildMarginTop(mPaymentRequestCoordinator.getView(), childSpacing);
         setChildMarginTop(mFormCoordinator.getView(), childSpacing);
-        setCarouselMarginTop(mSuggestionsCoordinator.getView(),
-                model.getSuggestionsModel().getChipsModel(), childSpacing);
-        setCarouselMarginTop(mActionsCoordinator.getView(), model.getActionsModel().getChipsModel(),
-                childSpacing);
+        setChildMarginTop(mSuggestionsCoordinator.getView(), childSpacing);
+        setChildMarginTop(mActionsCoordinator.getView(), childSpacing);
+
+        // Hide the carousels when they are empty.
+        hideWhenEmpty(
+                mSuggestionsCoordinator.getView(), model.getSuggestionsModel().getChipsModel());
+        hideWhenEmpty(mActionsCoordinator.getView(), model.getActionsModel().getChipsModel());
 
         // Set the horizontal margins of children. We don't set them on the payment request and the
         // carousels to allow them to take the full width of the sheet.
@@ -182,9 +178,8 @@
         // Show overlay to prevent user from interacting with the page during onboarding.
         mModel.getOverlayModel().set(AssistantOverlayModel.STATE, AssistantOverlayState.FULL);
 
-        View onboardingView = AssistantOnboardingCoordinator.show(experimentIds,
-                mContent.mBottomBarView.getContext(), mContent.mBottomBarView, accepted -> {
-                    mOnboardingScrollView = null;
+        AssistantOnboardingCoordinator.show(experimentIds, mContent.mBottomBarView.getContext(),
+                mContent.mScrollableContentContainer, accepted -> {
                     if (!accepted) {
                         callback.onResult(false);
                         return;
@@ -198,7 +193,6 @@
 
                     callback.onResult(true);
                 });
-        mOnboardingScrollView = onboardingView.findViewById(R.id.onboarding_scroll_view);
     }
 
     /** Request showing the Assistant bottom bar view and expand the sheet. */
@@ -227,10 +221,7 @@
 
     @Override
     public void setShowOnlyCarousels(boolean showOnlyCarousels) {
-        mDetailsCoordinator.setForceInvisible(showOnlyCarousels);
-        mModel.getPaymentRequestModel().set(
-                AssistantPaymentRequestModel.FORCE_INVISIBLE, showOnlyCarousels);
-        mFormCoordinator.setForceInvisible(showOnlyCarousels);
+        mContent.mScrollableContent.setVisibility(showOnlyCarousels ? View.GONE : View.VISIBLE);
     }
 
     @Override
@@ -245,29 +236,27 @@
     }
 
     /**
-     * Observe {@code model} such that we set the topMargin of {@code carouselView} to {@code
-     * marginTop} when {@code model} is not empty and set it to 0 otherwise.
+     * Observe {@code model} such that the associated view is made invisible when it is empty.
      */
-    private void setCarouselMarginTop(
-            View carouselView, ListModel<AssistantChip> chipsModel, int marginTop) {
+    private void hideWhenEmpty(View carouselView, ListModel<AssistantChip> chipsModel) {
+        setCarouselVisibility(carouselView, chipsModel);
         chipsModel.addObserver(new AbstractListObserver<Void>() {
             @Override
             public void onDataSetChanged() {
-                setChildMarginTop(carouselView, chipsModel.size() > 0 ? marginTop : 0);
+                setCarouselVisibility(carouselView, chipsModel);
             }
         });
     }
 
+    private void setCarouselVisibility(View carouselView, ListModel<AssistantChip> chipsModel) {
+        carouselView.setVisibility(chipsModel.size() > 0 ? View.VISIBLE : View.GONE);
+    }
+
     @VisibleForTesting
     public AssistantCarouselCoordinator getSuggestionsCoordinator() {
         return mSuggestionsCoordinator;
     }
 
-    @VisibleForTesting
-    public AssistantCarouselCoordinator getActionsCoordinator() {
-        return mActionsCoordinator;
-    }
-
     private void setHorizontalMargins(View view) {
         LinearLayout.MarginLayoutParams layoutParams =
                 (LinearLayout.MarginLayoutParams) view.getLayoutParams();
@@ -307,15 +296,22 @@
     }
 
     // TODO(crbug.com/806868): Move this class at the top of the file once it is a static class.
-    private class AssistantBottomSheetContent implements BottomSheet.BottomSheetContent {
+    private static class AssistantBottomSheetContent implements BottomSheet.BottomSheetContent {
         private final ViewGroup mToolbarView;
         private final SizeListenableLinearLayout mBottomBarView;
+        private final ScrollView mScrollableContent;
+        private final LinearLayout mScrollableContentContainer;
+        private final LinearLayout mCarouselsContainer;
 
         public AssistantBottomSheetContent(Context context) {
             mToolbarView = (ViewGroup) LayoutInflater.from(context).inflate(
                     R.layout.autofill_assistant_bottom_sheet_toolbar, /* root= */ null);
             mBottomBarView = (SizeListenableLinearLayout) LayoutInflater.from(context).inflate(
                     R.layout.autofill_assistant_bottom_sheet_content, /* root= */ null);
+            mScrollableContent = mBottomBarView.findViewById(R.id.scrollable_content);
+            mScrollableContentContainer =
+                    mScrollableContent.findViewById(R.id.scrollable_content_container);
+            mCarouselsContainer = mBottomBarView.findViewById(R.id.carousels_container);
         }
 
         @Override
@@ -331,21 +327,7 @@
 
         @Override
         public int getVerticalScrollOffset() {
-            // TODO(crbug.com/806868): Have a single ScrollView container that contains all child
-            // views (except carousels) instead.
-            if (mOnboardingScrollView != null && mOnboardingScrollView.isShown()) {
-                return mOnboardingScrollView.getScrollY();
-            }
-
-            if (mPaymentRequestCoordinator.getScrollView().isShown()) {
-                return mPaymentRequestCoordinator.getScrollView().getScrollY();
-            }
-
-            if (mFormCoordinator.getView().isShown()) {
-                return mFormCoordinator.getView().getScrollY();
-            }
-
-            return 0;
+            return mScrollableContent.getScrollY();
         }
 
         @Override
diff --git a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/carousel/AssistantActionsCarouselCoordinator.java b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/carousel/AssistantActionsCarouselCoordinator.java
index 3a58c1b..c909fe2 100644
--- a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/carousel/AssistantActionsCarouselCoordinator.java
+++ b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/carousel/AssistantActionsCarouselCoordinator.java
@@ -5,6 +5,7 @@
 package org.chromium.chrome.browser.autofill_assistant.carousel;
 
 import android.content.Context;
+import android.support.v7.widget.DefaultItemAnimator;
 import android.support.v7.widget.OrientationHelper;
 import android.support.v7.widget.RecyclerView;
 import android.view.View;
@@ -56,6 +57,10 @@
                 new SimpleRecyclerViewMcp<>(model.getChipsModel(),
                         AssistantChipViewHolder::getViewType, AssistantChipViewHolder::bind),
                 AssistantChipViewHolder::create));
+
+        // Disabling change animations to avoid chips that blink when setting the same, unchanged,
+        // set of chips.
+        ((DefaultItemAnimator) mView.getItemAnimator()).setSupportsChangeAnimations(false);
     }
 
     @Override
diff --git a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/details/AssistantDetailsCoordinator.java b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/details/AssistantDetailsCoordinator.java
index 1abfaa3..198bd91 100644
--- a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/details/AssistantDetailsCoordinator.java
+++ b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/details/AssistantDetailsCoordinator.java
@@ -18,7 +18,6 @@
 public class AssistantDetailsCoordinator {
     private final View mView;
     private final AssistantDetailsModel mModel;
-    private boolean mForceInvisible;
 
     public AssistantDetailsCoordinator(Context context, AssistantDetailsModel model) {
         mView = LayoutInflater.from(context).inflate(
@@ -51,19 +50,10 @@
      * listener.
      */
     private void updateVisibility() {
-        int visibility = !mForceInvisible && mModel.get(AssistantDetailsModel.DETAILS) != null
-                ? View.VISIBLE
-                : View.GONE;
+        int visibility =
+                mModel.get(AssistantDetailsModel.DETAILS) != null ? View.VISIBLE : View.GONE;
         if (mView.getVisibility() != visibility) {
             mView.setVisibility(visibility);
         }
     }
-
-    /** Force the view of this coordinator to be invisible. */
-    public void setForceInvisible(boolean forceInvisible) {
-        if (mForceInvisible == forceInvisible) return;
-
-        mForceInvisible = forceInvisible;
-        updateVisibility();
-    }
 }
diff --git a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/form/AssistantFormCoordinator.java b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/form/AssistantFormCoordinator.java
index dd4a691..c748c36f 100644
--- a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/form/AssistantFormCoordinator.java
+++ b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/form/AssistantFormCoordinator.java
@@ -9,7 +9,6 @@
 import android.view.View;
 import android.view.ViewGroup;
 import android.widget.LinearLayout;
-import android.widget.ScrollView;
 
 import org.chromium.chrome.autofill_assistant.R;
 import org.chromium.chrome.browser.autofill_assistant.AbstractListObserver;
@@ -21,35 +20,26 @@
  */
 public class AssistantFormCoordinator {
     private final AssistantFormModel mModel;
-    private final ScrollView mView;
-    private final LinearLayout mContainerView;
-
-    private boolean mForceInvisible;
+    private final LinearLayout mView;
 
     public AssistantFormCoordinator(Context context, AssistantFormModel model) {
         mModel = model;
-        mView = new ScrollView(context);
-        mContainerView = new LinearLayout(context);
-        mView.setLayoutParams(
-                new LinearLayout.LayoutParams(/* width= */ ViewGroup.LayoutParams.MATCH_PARENT,
-                        /* height= */ 0, /* weight= */ 1));
-        mContainerView.setLayoutParams(new ViewGroup.LayoutParams(
+        mView = new LinearLayout(context);
+        mView.setLayoutParams(new ViewGroup.LayoutParams(
                 ViewGroup.LayoutParams.MATCH_PARENT, ViewGroup.LayoutParams.WRAP_CONTENT));
-        mContainerView.setOrientation(LinearLayout.VERTICAL);
-        mContainerView.setDividerDrawable(AppCompatResources.getDrawable(
+        mView.setOrientation(LinearLayout.VERTICAL);
+        mView.setDividerDrawable(AppCompatResources.getDrawable(
                 context, R.drawable.autofill_assistant_form_input_divider));
-        mContainerView.setShowDividers(LinearLayout.SHOW_DIVIDER_MIDDLE);
-        mView.addView(mContainerView);
+        mView.setShowDividers(LinearLayout.SHOW_DIVIDER_MIDDLE);
 
         updateVisibility();
         mModel.getInputsModel().addObserver(new AbstractListObserver<Void>() {
             @Override
             public void onDataSetChanged() {
-                mContainerView.removeAllViews();
+                mView.removeAllViews();
                 for (AssistantFormInput input : mModel.getInputsModel()) {
-                    // Add the views to the linear layout (not the scroll view).
-                    View view = input.createView(context, mContainerView);
-                    mContainerView.addView(view);
+                    View view = input.createView(context, mView);
+                    mView.addView(view);
                 }
                 updateVisibility();
             }
@@ -57,21 +47,12 @@
     }
 
     /** Return the view associated to this coordinator. */
-    public ScrollView getView() {
+    public View getView() {
         return mView;
     }
 
-    /** Force the view of this coordinator to be invisible. */
-    public void setForceInvisible(boolean forceInvisible) {
-        if (mForceInvisible == forceInvisible) return;
-
-        mForceInvisible = forceInvisible;
-        updateVisibility();
-    }
-
     private void updateVisibility() {
-        int visibility =
-                !mForceInvisible && mModel.getInputsModel().size() > 0 ? View.VISIBLE : View.GONE;
+        int visibility = mModel.getInputsModel().size() > 0 ? View.VISIBLE : View.GONE;
         mView.setVisibility(visibility);
     }
 }
diff --git a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/payment/AssistantPaymentRequestBinder.java b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/payment/AssistantPaymentRequestBinder.java
index acbbf46..7c1776e2 100644
--- a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/payment/AssistantPaymentRequestBinder.java
+++ b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/payment/AssistantPaymentRequestBinder.java
@@ -232,14 +232,10 @@
      */
     private boolean updateRootVisibility(
             AssistantPaymentRequestModel model, PropertyKey propertyKey, ViewHolder view) {
-        if ((propertyKey != AssistantPaymentRequestModel.VISIBLE)
-                && (propertyKey != AssistantPaymentRequestModel.FORCE_INVISIBLE)) {
+        if (propertyKey != AssistantPaymentRequestModel.VISIBLE) {
             return false;
         }
-        int visibility = model.get(AssistantPaymentRequestModel.VISIBLE)
-                        && !model.get(AssistantPaymentRequestModel.FORCE_INVISIBLE)
-                ? View.VISIBLE
-                : View.GONE;
+        int visibility = model.get(AssistantPaymentRequestModel.VISIBLE) ? View.VISIBLE : View.GONE;
         if (view.mRootView.getVisibility() != visibility) {
             if (visibility == View.VISIBLE) {
                 // Update available profiles and credit cards before PR is made visible.
diff --git a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/payment/AssistantPaymentRequestCoordinator.java b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/payment/AssistantPaymentRequestCoordinator.java
index 642fc3c3..cc4eb172 100644
--- a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/payment/AssistantPaymentRequestCoordinator.java
+++ b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/payment/AssistantPaymentRequestCoordinator.java
@@ -9,10 +9,8 @@
 import android.view.View;
 import android.view.ViewGroup;
 import android.widget.LinearLayout;
-import android.widget.ScrollView;
 
 import org.chromium.chrome.autofill_assistant.R;
-import org.chromium.chrome.browser.widget.FadingEdgeScrollView;
 import org.chromium.ui.modelutil.PropertyModelChangeProcessor;
 
 // TODO(crbug.com/806868): Use mCarouselCoordinator to show chips.
@@ -24,7 +22,6 @@
     private static final String DIVIDER_TAG = "divider";
     private final Activity mActivity;
     private final LinearLayout mPaymentRequestUI;
-    private final FadingEdgeScrollView mPaymentRequestScrollView;
     private final AssistantPaymentRequestModel mModel;
     private AssistantPaymentRequestBinder.ViewHolder mViewHolder;
 
@@ -38,8 +35,8 @@
         mPaymentRequestUI = new LinearLayout(mActivity);
         mPaymentRequestUI.setOrientation(LinearLayout.VERTICAL);
         mPaymentRequestUI.setLayoutParams(
-                new LinearLayout.LayoutParams(/* width= */ ViewGroup.LayoutParams.MATCH_PARENT,
-                        /* height= */ 0, /* weight= */ 1));
+                new ViewGroup.LayoutParams(/* width= */ ViewGroup.LayoutParams.MATCH_PARENT,
+                        /* height= */ ViewGroup.LayoutParams.WRAP_CONTENT));
 
         AssistantVerticalExpanderAccordion paymentRequestExpanderAccordion =
                 new AssistantVerticalExpanderAccordion(mActivity, null);
@@ -50,13 +47,9 @@
         paymentRequestExpanderAccordion.setOnExpandedViewChangedListener(
                 expander -> mModel.set(AssistantPaymentRequestModel.EXPANDED_SECTION, expander));
 
-        mPaymentRequestScrollView = new FadingEdgeScrollView(mActivity, null);
-        mPaymentRequestScrollView.addView(paymentRequestExpanderAccordion,
+        mPaymentRequestUI.addView(paymentRequestExpanderAccordion,
                 new LinearLayout.LayoutParams(
                         ViewGroup.LayoutParams.MATCH_PARENT, ViewGroup.LayoutParams.WRAP_CONTENT));
-        mPaymentRequestUI.addView(mPaymentRequestScrollView,
-                new LinearLayout.LayoutParams(/* width= */ ViewGroup.LayoutParams.MATCH_PARENT,
-                        /* height= */ 0, /* weight= */ 1));
 
         AssistantPaymentRequestContactDetailsSection contactDetailsSection =
                 new AssistantPaymentRequestContactDetailsSection(
@@ -79,16 +72,15 @@
                 paymentMethodSection, shippingAddressSection, termsSection, DIVIDER_TAG, activity);
         AssistantPaymentRequestBinder binder = new AssistantPaymentRequestBinder();
         PropertyModelChangeProcessor.create(model, mViewHolder, binder);
+
+        // View is initially invisible.
+        model.set(AssistantPaymentRequestModel.VISIBLE, false);
     }
 
     public View getView() {
         return mPaymentRequestUI;
     }
 
-    public ScrollView getScrollView() {
-        return mPaymentRequestScrollView;
-    }
-
     /**
      * Explicitly clean up.
      */
diff --git a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/payment/AssistantPaymentRequestModel.java b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/payment/AssistantPaymentRequestModel.java
index 20ddaee..425b079 100644
--- a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/payment/AssistantPaymentRequestModel.java
+++ b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/payment/AssistantPaymentRequestModel.java
@@ -34,8 +34,6 @@
             new WritableObjectPropertyKey<>();
 
     public static final WritableBooleanPropertyKey VISIBLE = new WritableBooleanPropertyKey();
-    public static final WritableBooleanPropertyKey FORCE_INVISIBLE =
-            new WritableBooleanPropertyKey();
 
     /** The chosen shipping address. */
     public static final WritableObjectPropertyKey<AutofillAddress> SHIPPING_ADDRESS =
@@ -78,11 +76,10 @@
             new WritableObjectPropertyKey<>();
 
     public AssistantPaymentRequestModel() {
-        super(DELEGATE, WEB_CONTENTS, VISIBLE, FORCE_INVISIBLE, SHIPPING_ADDRESS, PAYMENT_METHOD,
-                CONTACT_DETAILS, TERMS_STATUS, REQUEST_NAME, REQUEST_EMAIL, REQUEST_PHONE,
-                REQUEST_SHIPPING_ADDRESS, REQUEST_PAYMENT, AVAILABLE_PROFILES,
-                AVAILABLE_AUTOFILL_PAYMENT_METHODS, SUPPORTED_BASIC_CARD_NETWORKS,
-                SUPPORTED_PAYMENT_METHODS, EXPANDED_SECTION);
+        super(DELEGATE, WEB_CONTENTS, VISIBLE, SHIPPING_ADDRESS, PAYMENT_METHOD, CONTACT_DETAILS,
+                TERMS_STATUS, REQUEST_NAME, REQUEST_EMAIL, REQUEST_PHONE, REQUEST_SHIPPING_ADDRESS,
+                REQUEST_PAYMENT, AVAILABLE_PROFILES, AVAILABLE_AUTOFILL_PAYMENT_METHODS,
+                SUPPORTED_BASIC_CARD_NETWORKS, SUPPORTED_PAYMENT_METHODS, EXPANDED_SECTION);
     }
 
     @CalledByNative
diff --git a/chrome/android/features/dynamic_feature_modules.gni b/chrome/android/features/dynamic_feature_modules.gni
index 32808a5..f2333ee 100644
--- a/chrome/android/features/dynamic_feature_modules.gni
+++ b/chrome/android/features/dynamic_feature_modules.gni
@@ -25,3 +25,18 @@
 } else {
   use_native_modules = false
 }
+
+# This block aggregates parameters from multiple modules, for use by targets
+# responsible for assembling bundles. In the future, these lists may be
+# replaced by a list of module descriptors, or a similar restructuring. See
+# http://crbug.com/950056.
+native_feature_modules = []
+feature_module_base_lib_deps = []
+native_feature_module_entrypoint_files = []
+
+if (enable_vr && modularize_vr_native) {
+  native_feature_modules += [ "vr" ]
+  feature_module_base_lib_deps += [ "//chrome/browser/vr:vr_ui" ]
+  native_feature_module_entrypoint_files +=
+      [ "//chrome/browser/vr/module_exports.lst" ]
+}
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeBaseAppCompatActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeBaseAppCompatActivity.java
index d9b28c33..b5838f1 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeBaseAppCompatActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeBaseAppCompatActivity.java
@@ -5,6 +5,7 @@
 package org.chromium.chrome.browser;
 
 import android.content.Context;
+import android.content.SharedPreferences;
 import android.content.res.Configuration;
 import android.os.Bundle;
 import android.support.annotation.CallSuper;
@@ -12,6 +13,7 @@
 import android.support.annotation.StyleRes;
 import android.support.v7.app.AppCompatActivity;
 
+import org.chromium.base.ContextUtils;
 import org.chromium.chrome.browser.night_mode.GlobalNightModeStateProviderHolder;
 import org.chromium.chrome.browser.night_mode.NightModeStateProvider;
 import org.chromium.chrome.browser.night_mode.NightModeUtils;
@@ -105,4 +107,12 @@
     public void onNightModeStateChanged() {
         if (!isFinishing()) recreate();
     }
+
+    /**
+     * Required to make preference fragments use InMemorySharedPreferences in tests.
+     */
+    @Override
+    public SharedPreferences getSharedPreferences(String name, int mode) {
+        return ContextUtils.getApplicationContext().getSharedPreferences(name, mode);
+    }
 }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeFeatureList.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeFeatureList.java
index 65a7075f..d4f2487 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeFeatureList.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeFeatureList.java
@@ -249,7 +249,6 @@
             "IntentBlockExternalFormRedirectsNoGesture";
     public static final String INTEREST_FEED_CONTENT_SUGGESTIONS = "InterestFeedContentSuggestions";
     public static final String JELLY_BEAN_SUPPORTED = "JellyBeanSupported";
-    public static final String LANGUAGES_PREFERENCE = "LanguagesPreference";
     public static final String LOOKALIKE_NAVIGATION_URL_SUGGESTIONS_UI =
             "LookalikeUrlNavigationSuggestionsUI";
     public static final String SEARCH_ENGINE_PROMO_EXISTING_DEVICE =
@@ -295,6 +294,7 @@
     public static final String PRIORITIZE_BOOTSTRAP_TASKS = "PrioritizeBootstrapTasks";
     public static final String PROGRESS_BAR_THROTTLE = "ProgressBarThrottle";
     public static final String PWA_PERSISTENT_NOTIFICATION = "PwaPersistentNotification";
+    public static final String QUERY_IN_OMNIBOX = "QueryInOmnibox";
     public static final String REACHED_CODE_PROFILER = "ReachedCodeProfiler";
     public static final String READER_MODE_IN_CCT = "ReaderModeInCCT";
     public static final String REMOVE_NAVIGATION_HISTORY = "RemoveNavigationHistory";
@@ -309,7 +309,8 @@
     public static final String SSL_COMMITTED_INTERSTITIALS = "SSLCommittedInterstitials";
     public static final String SPANNABLE_INLINE_AUTOCOMPLETE = "SpannableInlineAutocomplete";
     public static final String SUBRESOURCE_FILTER = "SubresourceFilter";
-    public static final String QUERY_IN_OMNIBOX = "QueryInOmnibox";
+    public static final String SWAP_PIXEL_FORMAT_TO_FIX_CONVERT_FROM_TRANSLUCENT =
+            "SwapPixelFormatToFixConvertFromTranslucent";
     public static final String TAB_ENGAGEMENT_REPORTING_ANDROID = "TabEngagementReportingAndroid";
     public static final String TAB_GROUPS_ANDROID = "TabGroupsAndroid";
     public static final String TAB_GROUPS_UI_IMPROVEMENTS_ANDROID =
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/background_task_scheduler/NativeBackgroundTask.java b/chrome/android/java/src/org/chromium/chrome/browser/background_task_scheduler/NativeBackgroundTask.java
index 841708d4..f33261a 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/background_task_scheduler/NativeBackgroundTask.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/background_task_scheduler/NativeBackgroundTask.java
@@ -52,7 +52,13 @@
 
     /** The id of the task from {@link TaskParameters} used for metrics logging. */
     private int mTaskId;
-  
+
+    /**
+     * If true, the task runs in Service Manager Only Mode. If false, the task runs in Full Browser
+     * Mode.
+     */
+    private boolean mRunningInServiceManagerOnlyMode;
+
     /** Make sure that we do not double record task finished metric */
     private boolean mFinishMetricRecorded;
 
@@ -85,8 +91,6 @@
             return true;
         }
 
-        BackgroundTaskSchedulerExternalUma.reportNativeTaskStarted(mTaskId);
-
         assert beforeNativeResult == StartBeforeNativeResult.LOAD_NATIVE;
         runWithNative(context,
                 buildStartWithNativeRunnable(context, taskParameters, wrappedCallback),
@@ -117,15 +121,20 @@
      * @param rescheduleRunnable A runnable that will be called to reschedule the task in case
      *    native initialization fails.
      */
-    protected final void runWithNative(final Context context,
-            final Runnable startWithNativeRunnable, final Runnable rescheduleRunnable) {
+    private final void runWithNative(final Context context, final Runnable startWithNativeRunnable,
+            final Runnable rescheduleRunnable) {
         if (isNativeLoadedInFullBrowserMode()) {
+            mRunningInServiceManagerOnlyMode = false;
+            BackgroundTaskSchedulerExternalUma.reportNativeTaskStarted(
+                    mTaskId, mRunningInServiceManagerOnlyMode);
             PostTask.postTask(UiThreadTaskTraits.DEFAULT, startWithNativeRunnable);
             return;
         }
 
         boolean wasInServiceManagerOnlyMode = isNativeLoadedInServiceManagerOnlyMode();
-        boolean startServiceManagerOnly = supportsServiceManagerOnly();
+        mRunningInServiceManagerOnlyMode = supportsServiceManagerOnly();
+        BackgroundTaskSchedulerExternalUma.reportNativeTaskStarted(
+                mTaskId, mRunningInServiceManagerOnlyMode);
 
         final BrowserParts parts = new EmptyBrowserParts() {
             @Override
@@ -134,7 +143,7 @@
             }
             @Override
             public boolean startServiceManagerOnly() {
-                return startServiceManagerOnly;
+                return mRunningInServiceManagerOnlyMode;
             }
             @Override
             public void onStartupFailure() {
@@ -153,7 +162,7 @@
                 // already started.
                 if (!wasInServiceManagerOnlyMode)
                     BackgroundTaskSchedulerExternalUma.reportTaskStartedNative(
-                            mTaskId, startServiceManagerOnly);
+                            mTaskId, mRunningInServiceManagerOnlyMode);
 
                 try {
                     ChromeBrowserInitializer.getInstance(context).handlePreNativeStartup(parts);
@@ -255,7 +264,8 @@
       ThreadUtils.assertOnUiThread();
       if (!mFinishMetricRecorded) {
         mFinishMetricRecorded = true;
-        BackgroundTaskSchedulerExternalUma.reportNativeTaskFinished(mTaskId);
+        BackgroundTaskSchedulerExternalUma.reportNativeTaskFinished(
+                mTaskId, mRunningInServiceManagerOnlyMode);
       }
     }
 }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/browserservices/trustedwebactivityui/splashscreen/SplashScreenController.java b/chrome/android/java/src/org/chromium/chrome/browser/browserservices/trustedwebactivityui/splashscreen/SplashScreenController.java
index 384f158..209fdb05 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/browserservices/trustedwebactivityui/splashscreen/SplashScreenController.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/browserservices/trustedwebactivityui/splashscreen/SplashScreenController.java
@@ -11,6 +11,8 @@
 import android.graphics.Bitmap;
 import android.graphics.Color;
 import android.graphics.Matrix;
+import android.graphics.PixelFormat;
+import android.os.Build;
 import android.os.Bundle;
 import android.support.annotation.Nullable;
 import android.support.customtabs.TrustedWebUtils;
@@ -22,6 +24,7 @@
 
 import org.chromium.base.Log;
 import org.chromium.chrome.R;
+import org.chromium.chrome.browser.ChromeActivity;
 import org.chromium.chrome.browser.browserservices.TrustedWebActivityUmaRecorder;
 import org.chromium.chrome.browser.compositor.CompositorViewHolder;
 import org.chromium.chrome.browser.customtabs.CustomTabIntentDataProvider;
@@ -33,6 +36,7 @@
 import org.chromium.chrome.browser.tab.Tab;
 import org.chromium.chrome.browser.tab.TabObserverRegistrar;
 import org.chromium.chrome.browser.util.ColorUtils;
+import org.chromium.chrome.browser.util.FeatureUtilities;
 import org.chromium.chrome.browser.util.IntentUtils;
 
 import java.lang.reflect.Method;
@@ -88,12 +92,16 @@
     @Nullable
     private ViewPropertyAnimator mFadeOutAnimator;
 
+    /**
+     * Whether to use {@link Window#setFormat()} to undo the opacity change caused by
+     * {@link Activity#convertFromTranslucent()}.
+     */
+    private boolean mSwapPixelFormatToFixConvertFromTranslucent;
+
     @Inject
     public SplashScreenController(TabObserverRegistrar tabObserverRegistrar,
-            Activity activity,
-            ActivityLifecycleDispatcher lifecycleDispatcher,
-            Lazy<CompositorViewHolder> compositorViewHolder,
-            SplashImageHolder splashImageCache,
+            ChromeActivity activity, ActivityLifecycleDispatcher lifecycleDispatcher,
+            Lazy<CompositorViewHolder> compositorViewHolder, SplashImageHolder splashImageCache,
             CustomTabIntentDataProvider intentDataProvider,
             TrustedWebActivityUmaRecorder umaRecorder) {
         mSplashImageCache = splashImageCache;
@@ -105,12 +113,26 @@
         mUmaRecorder = umaRecorder;
 
         lifecycleDispatcher.register(this);
+
+        // Activity#convertFromTranslucent() incorrectly makes the Window opaque when a surface view
+        // is attached. This is fixed in http://b/126897750#comment14 The bug causes the SurfaceView
+        // to become black. We need to manually swap the pixel format to restore it. When hardware
+        // acceleration is disabled, swapping the pixel format causes the surface to get recreated.
+        // A bug fix in Android N http://b/25672053#comment4 preserves the old surface till the new
+        // one is drawn.
+        mSwapPixelFormatToFixConvertFromTranslucent =
+                (Build.VERSION.SDK_INT >= Build.VERSION_CODES.N
+                        && FeatureUtilities.isSwapPixelFormatToFixConvertFromTranslucentEnabled());
     }
 
     @Override
     public void onPreInflationStartup() {
         createAndAttachSplashView();
-        removeTranslucency();
+        if (!mSwapPixelFormatToFixConvertFromTranslucent) {
+            // Without swapping the pixel format, removing translucency is only safe before
+            // SurfaceView is attached.
+            removeTranslucency();
+        }
     }
 
     private void removeTranslucency() {
@@ -180,8 +202,10 @@
             return;
         }
 
-        // In rare cases I see toolbar flickering. TODO(pshmakov): investigate why.
-        mActivity.findViewById(R.id.coordinator).setVisibility(View.INVISIBLE);
+        if (!mSwapPixelFormatToFixConvertFromTranslucent) {
+            // In rare cases I see toolbar flickering. TODO(pshmakov): investigate why.
+            mActivity.findViewById(R.id.coordinator).setVisibility(View.INVISIBLE);
+        }
 
         getRootView().addView(mSplashView);
         observeTab();
@@ -218,6 +242,21 @@
             private void onPageReady(Tab tab) {
                 tab.removeObserver(this); // TODO(pshmakov): make TabObserverRegistrar do this.
                 mTabObserverRegistrar.unregisterTabObserver(this);
+
+                if (mSwapPixelFormatToFixConvertFromTranslucent) {
+                    removeTranslucency();
+
+                    // Activity#convertFromTranslucent() incorrectly makes the Window opaque -
+                    // WindowStateAnimator#setOpaqueLocked(true) - when a surface view is
+                    // attached. This is fixed in http://b/126897750#comment14
+                    // The Window currently has format PixelFormat.TRANSLUCENT (Set by the
+                    // SurfaceView's ViewParent#requestTransparentRegion() call). Swap the pixel
+                    // format to force an opacity change back to non-opaque.
+                    mActivity.getWindow().setFormat(PixelFormat.TRANSPARENT);
+
+                    getRootView().invalidate();
+                }
+
                 mCompositorViewHolder.get().getCompositorView().surfaceRedrawNeededAsync(
                         SplashScreenController.this::removeSplashScreen);
             }
@@ -233,6 +272,7 @@
         final View splashView = mSplashView;
         mSplashView = null;
 
+        // Show browser UI in case we hid it in onPostInflationStartup().
         mActivity.findViewById(R.id.coordinator).setVisibility(View.VISIBLE);
 
         int fadeOutDuration = IntentUtils.safeGetInt(getSplashScreenParamsFromIntent(),
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabActivity.java
index 1a0703f6..d09918b 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabActivity.java
@@ -120,6 +120,7 @@
     private CustomTabActivityTabProvider mTabProvider;
     private CustomTabActivityTabFactory mTabFactory;
     private CustomTabActivityNavigationController mNavigationController;
+    private CustomTabStatusBarColorProvider mCustomTabStatusBarColorProvider;
 
     // This is to give the right package name while using the client's resources during an
     // overridePendingTransition call.
@@ -769,17 +770,14 @@
 
     @Override
     public int getBaseStatusBarColor() {
-        if (mIntentDataProvider.isOpenedByChrome()) return super.getBaseStatusBarColor();
-        if (getActivityTab() != null && getActivityTab().isPreview()) {
-            return ColorUtils.getDefaultThemeColor(getResources(), false);
-        }
-        return mIntentDataProvider.getToolbarColor();
+        return mCustomTabStatusBarColorProvider
+                .getBaseStatusBarColor(super.getBaseStatusBarColor());
     }
 
     @Override
     public boolean isStatusBarDefaultThemeColor() {
-        if (mIntentDataProvider.isOpenedByChrome()) return super.isStatusBarDefaultThemeColor();
-        return false;
+        return mCustomTabStatusBarColorProvider
+                .isStatusBarDefaultThemeColor(super.isStatusBarDefaultThemeColor());
     }
 
     @Override
@@ -895,6 +893,7 @@
                 ChromeApplication.getComponent().createCustomTabActivityComponent(
                         commonsModule, customTabsModule);
 
+        mCustomTabStatusBarColorProvider = component.resolveCustomTabStatusBarColorProvider();
         mTabObserverRegistrar = component.resolveTabObserverRegistrar();
         mTabController = component.resolveTabController();
         mTabProvider = component.resolveTabProvider();
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabStatusBarColorProvider.java b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabStatusBarColorProvider.java
new file mode 100644
index 0000000..80baea4
--- /dev/null
+++ b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabStatusBarColorProvider.java
@@ -0,0 +1,47 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.chrome.browser.customtabs;
+
+import android.content.res.Resources;
+
+import org.chromium.chrome.browser.customtabs.content.CustomTabActivityTabProvider;
+import org.chromium.chrome.browser.dependency_injection.ActivityScope;
+import org.chromium.chrome.browser.tab.Tab;
+import org.chromium.chrome.browser.util.ColorUtils;
+
+import javax.inject.Inject;
+
+/**
+ * Manages the status bar color for a CustomTabActivity.
+ */
+@ActivityScope
+public class CustomTabStatusBarColorProvider {
+    private final Resources mResources;
+    private final CustomTabIntentDataProvider mIntentDataProvider;
+    private final CustomTabActivityTabProvider mCustomTabActivityTabProvider;
+
+    @Inject
+    public CustomTabStatusBarColorProvider(Resources resources,
+            CustomTabIntentDataProvider intentDataProvider,
+            CustomTabActivityTabProvider customTabActivityTabProvider) {
+        mResources = resources;
+        mIntentDataProvider = intentDataProvider;
+        mCustomTabActivityTabProvider = customTabActivityTabProvider;
+    }
+
+    int getBaseStatusBarColor(int fallbackStatusBarColor) {
+        if (mIntentDataProvider.isOpenedByChrome()) return fallbackStatusBarColor;
+        Tab tab = mCustomTabActivityTabProvider.getTab();
+        if (tab!= null && tab.isPreview()) {
+            return ColorUtils.getDefaultThemeColor(mResources, false);
+        }
+        return mIntentDataProvider.getToolbarColor();
+    }
+
+    boolean isStatusBarDefaultThemeColor(boolean isFallbackColorDefault) {
+        if (mIntentDataProvider.isOpenedByChrome()) return isFallbackColorDefault;
+        return false;
+    }
+}
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/dependency_injection/CustomTabActivityComponent.java b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/dependency_injection/CustomTabActivityComponent.java
index 3079ce0f..1c1cd45a 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/dependency_injection/CustomTabActivityComponent.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/dependency_injection/CustomTabActivityComponent.java
@@ -7,6 +7,7 @@
 import org.chromium.chrome.browser.browserservices.trustedwebactivityui.TrustedWebActivityCoordinator;
 import org.chromium.chrome.browser.customtabs.CustomTabActivityLifecycleUmaTracker;
 import org.chromium.chrome.browser.customtabs.CustomTabBottomBarDelegate;
+import org.chromium.chrome.browser.customtabs.CustomTabStatusBarColorProvider;
 import org.chromium.chrome.browser.customtabs.CustomTabTabPersistencePolicy;
 import org.chromium.chrome.browser.customtabs.CustomTabTopBarDelegate;
 import org.chromium.chrome.browser.customtabs.content.CustomTabActivityInitialPageLoader;
@@ -43,6 +44,7 @@
     CustomTabActivityInitialPageLoader resolveInitialPageLoader();
     CustomTabActivityNavigationController resolveNavigationController();
     CustomTabActivityTabProvider resolveTabProvider();
+    CustomTabStatusBarColorProvider resolveCustomTabStatusBarColorProvider();
 
     CustomTabTabPersistencePolicy resolveTabPersistencePolicy(); // For testing
 }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceManager.java b/chrome/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceManager.java
index 6b4b53c..c5a53834 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceManager.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceManager.java
@@ -110,6 +110,13 @@
             "contextual_search_previous_interaction_timestamp";
 
     /**
+     * Key to cache whether
+     * {@link ChromeFeatureList#SWAP_PIXEL_FORMAT_TO_FIX_CONVERT_FROM_TRANSLUCENT} is enabled.
+     */
+    public static final String SWAP_PIXEL_FORMAT_TO_FIX_CONVERT_FROM_TRANSLUCENT =
+            "swap_pixel_format_to_fix_convert_from_translucent";
+
+    /**
      * Whether the promotion for data reduction has been skipped on first invocation.
      * Default value is false.
      */
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/preferences/MainPreferences.java b/chrome/android/java/src/org/chromium/chrome/browser/preferences/MainPreferences.java
index 839b1ec..1e03030 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/preferences/MainPreferences.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/preferences/MainPreferences.java
@@ -151,12 +151,6 @@
             getPreferenceScreen().removePreference(findPreference(PREF_NOTIFICATIONS));
         }
 
-        // This checks whether the Languages Preference *feature* is enabled on the user's device.
-        // If not, remove the languages preference.
-        if (!ChromeFeatureList.isEnabled(ChromeFeatureList.LANGUAGES_PREFERENCE)) {
-            getPreferenceScreen().removePreference(findPreference(PREF_LANGUAGES));
-        }
-
         if (!TemplateUrlService.getInstance().isLoaded()) {
             TemplateUrlService.getInstance().registerLoadListener(this);
             TemplateUrlService.getInstance().load();
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/SiteSettingsPreferences.java b/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/SiteSettingsPreferences.java
index ff9df9a3..428156d 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/SiteSettingsPreferences.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/preferences/website/SiteSettingsPreferences.java
@@ -103,11 +103,7 @@
             if (!SiteSettingsCategory.adsCategoryEnabled()) {
                 getPreferenceScreen().removePreference(findPreference(Type.ADS));
             }
-            // The new Languages Preference *feature* is an advanced version of this translate
-            // preference. Once Languages Preference is enabled, remove this setting.
-            if (ChromeFeatureList.isEnabled(ChromeFeatureList.LANGUAGES_PREFERENCE)) {
-                getPreferenceScreen().removePreference(findPreference(TRANSLATE_KEY));
-            }
+            getPreferenceScreen().removePreference(findPreference(TRANSLATE_KEY));
             if (!ChromeFeatureList.isEnabled(ChromeFeatureList.SENSOR_CONTENT_SETTING)) {
                 getPreferenceScreen().removePreference(findPreference(Type.SENSORS));
             }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/sync/ProfileSyncService.java b/chrome/android/java/src/org/chromium/chrome/browser/sync/ProfileSyncService.java
index 8e5bce5..4add6579 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/sync/ProfileSyncService.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/sync/ProfileSyncService.java
@@ -374,7 +374,7 @@
                 syncEverything ? ALL_SELECTABLE_TYPES : modelTypeSetToArray(enabledTypes));
     }
 
-    public void triggerSync() {
+    public void triggerRefresh() {
         nativeTriggerRefresh(mNativeProfileSyncServiceAndroid);
     }
 
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/util/FeatureUtilities.java b/chrome/android/java/src/org/chromium/chrome/browser/util/FeatureUtilities.java
index 6d364d29f..88db404f 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/util/FeatureUtilities.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/util/FeatureUtilities.java
@@ -212,6 +212,7 @@
         cacheServiceManagerForBackgroundPrefetch();
         cacheNetworkServiceWarmUpEnabled();
         cacheImmersiveUiModeEnabled();
+        cacheSwapPixelFormatToFixConvertFromTranslucentEnabled();
         cacheTabPersistentStoreTaskRunnerVariant();
 
         if (isHighEndPhone()) cacheGridTabSwitcherEnabled();
@@ -768,6 +769,22 @@
         return sIsImmersiveUiModeEnabled;
     }
 
+    /**
+     * Returns whether to use {@link Window#setFormat()} to undo opacity change caused by
+     * {@link Activity#convertFromTranslucent()}.
+     */
+    public static boolean isSwapPixelFormatToFixConvertFromTranslucentEnabled() {
+        return ChromePreferenceManager.getInstance().readBoolean(
+                ChromePreferenceManager.SWAP_PIXEL_FORMAT_TO_FIX_CONVERT_FROM_TRANSLUCENT, true);
+    }
+
+    public static void cacheSwapPixelFormatToFixConvertFromTranslucentEnabled() {
+        ChromePreferenceManager.getInstance().writeBoolean(
+                ChromePreferenceManager.SWAP_PIXEL_FORMAT_TO_FIX_CONVERT_FROM_TRANSLUCENT,
+                ChromeFeatureList.isEnabled(
+                        ChromeFeatureList.SWAP_PIXEL_FORMAT_TO_FIX_CONVERT_FROM_TRANSLUCENT));
+    }
+
     private static native void nativeSetCustomTabVisible(boolean visible);
     private static native void nativeSetIsInMultiWindowMode(boolean isInMultiWindowMode);
     private static native boolean nativeIsNetworkServiceWarmUpEnabled();
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/RestoreHistogramTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/RestoreHistogramTest.java
index 66b87c1b..0a8ef87 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/RestoreHistogramTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/RestoreHistogramTest.java
@@ -12,7 +12,6 @@
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
-import org.chromium.base.ContextUtils;
 import org.chromium.base.PathUtils;
 import org.chromium.base.library_loader.LibraryLoader;
 import org.chromium.base.library_loader.LibraryProcessType;
@@ -41,10 +40,6 @@
         PathUtils.setPrivateDataDirectorySuffix(PRIVATE_DATA_DIRECTORY_SUFFIX);
     }
 
-    private void clearPrefs() {
-        ContextUtils.getAppSharedPreferences().edit().clear().apply();
-    }
-
     /**
      * Test that the fundamental method for writing the histogram
      * {@link ChromeBackupAgent#recordRestoreHistogram()} works correctly
@@ -70,7 +65,6 @@
                         ChromeBackupAgent.RestoreStatus.RESTORE_STATUS_RECORDED);
 
         // Check behavior with no preference set
-        clearPrefs();
         ChromeBackupAgent.recordRestoreHistogram();
         Assert.assertEquals(1, noRestoreDelta.getDelta());
         Assert.assertEquals(0, restoreCompletedDelta.getDelta());
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/appmenu/DataSaverAppMenuTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/appmenu/DataSaverAppMenuTest.java
index f5e234d7..f83db15d 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/appmenu/DataSaverAppMenuTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/appmenu/DataSaverAppMenuTest.java
@@ -13,7 +13,6 @@
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
-import org.chromium.base.ContextUtils;
 import org.chromium.base.test.util.CommandLineFlags;
 import org.chromium.base.test.util.Feature;
 import org.chromium.base.test.util.RetryOnFailure;
@@ -109,7 +108,6 @@
     @Feature({"Browser", "Main"})
     public void testMenuDataSaver() throws Throwable {
         mActivityTestRule.runOnUiThread((Runnable) () -> {
-            ContextUtils.getAppSharedPreferences().edit().clear().apply();
             // Data Saver hasn't been turned on, the footer shouldn't show.
             Assert.assertEquals(0, mAppMenuHandler.getDelegate().getFooterResourceId());
 
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/datareduction/DataReductionSavingsMilestonePromoTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/datareduction/DataReductionSavingsMilestonePromoTest.java
index 55657f8..832b0c00 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/datareduction/DataReductionSavingsMilestonePromoTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/datareduction/DataReductionSavingsMilestonePromoTest.java
@@ -12,7 +12,6 @@
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
-import org.chromium.base.ContextUtils;
 import org.chromium.base.test.util.CommandLineFlags;
 import org.chromium.chrome.browser.ChromeSwitches;
 import org.chromium.chrome.test.ChromeJUnit4ClassRunner;
@@ -38,7 +37,6 @@
 
     @Before
     public void setUp() throws InterruptedException {
-        ContextUtils.getAppSharedPreferences().edit().clear().apply();
         mActivityTestRule.startMainActivityOnBlankPage();
     }
 
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/instantapps/InstantAppsHandlerTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/instantapps/InstantAppsHandlerTest.java
index 994b400..56dc84c 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/instantapps/InstantAppsHandlerTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/instantapps/InstantAppsHandlerTest.java
@@ -15,7 +15,6 @@
 import android.support.test.InstrumentationRegistry;
 import android.support.test.filters.SmallTest;
 
-import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Rule;
@@ -68,11 +67,6 @@
         editor.apply();
     }
 
-    @After
-    public void tearDown() throws Exception {
-        ContextUtils.getAppSharedPreferences().edit().clear().apply();
-    }
-
     @Test
     @SmallTest
     public void testInstantAppsDisabled_incognito() {
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/partnercustomizations/PartnerHomepageIntegrationTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/partnercustomizations/PartnerHomepageIntegrationTest.java
index 913716e..66cc037 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/partnercustomizations/PartnerHomepageIntegrationTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/partnercustomizations/PartnerHomepageIntegrationTest.java
@@ -6,7 +6,6 @@
 
 import android.annotation.SuppressLint;
 import android.annotation.TargetApi;
-import android.content.SharedPreferences;
 import android.net.Uri;
 import android.os.Build;
 import android.support.test.InstrumentationRegistry;
@@ -22,7 +21,6 @@
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
-import org.chromium.base.ContextUtils;
 import org.chromium.base.test.util.CallbackHelper;
 import org.chromium.base.test.util.CommandLineFlags;
 import org.chromium.base.test.util.Feature;
@@ -63,13 +61,6 @@
 
     @Before
     public void setUp() throws InterruptedException {
-        TestThreadUtils.runOnUiThreadBlocking(() -> {
-            // TODO(newt): Remove this once SharedPreferences is cleared automatically at the
-            // beginning of every test. http://crbug.com/441859
-            SharedPreferences sp = ContextUtils.getAppSharedPreferences();
-            sp.edit().clear().apply();
-        });
-
         mActivityTestRule.startMainActivityFromLauncher();
     }
 
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/preferences/autofill_assistant/AutofillAssistantPreferencesTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/preferences/autofill_assistant/AutofillAssistantPreferencesTest.java
index c4325e2..57b0c1ac 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/preferences/autofill_assistant/AutofillAssistantPreferencesTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/preferences/autofill_assistant/AutofillAssistantPreferencesTest.java
@@ -13,7 +13,6 @@
 import android.support.test.filters.SmallTest;
 
 import org.junit.Assert;
-import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.rules.TestRule;
@@ -49,11 +48,6 @@
     public IntentsTestRule<HistoryActivity> mHistoryActivityTestRule =
             new IntentsTestRule<>(HistoryActivity.class, false, false);
 
-    @Before
-    public void setUp() {
-        clearAutofillAssistantSwitch();
-    }
-
     /**
      * Set the |PREF_AUTOFILL_ASSISTANT_SWITCH| shared preference to the given |value|.
      * @param value The value to set the preference to.
@@ -76,16 +70,6 @@
     }
 
     /**
-     * Removes the |PREF_AUTOFILL_ASSISTANT_SWITCH| shared preference.
-     */
-    private void clearAutofillAssistantSwitch() {
-        ContextUtils.getAppSharedPreferences()
-                .edit()
-                .remove(AutofillAssistantPreferences.PREF_AUTOFILL_ASSISTANT_SWITCH)
-                .apply();
-    }
-
-    /**
      * Ensure that the on/off switch in "Autofill Assistant" settings works.
      */
     @Test
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/sync/BookmarksTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/sync/BookmarksTest.java
index 960cd3f..4d89d3e 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/sync/BookmarksTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/sync/BookmarksTest.java
@@ -16,7 +16,6 @@
 import org.junit.runner.RunWith;
 
 import org.chromium.base.test.util.CommandLineFlags;
-import org.chromium.base.test.util.DisabledTest;
 import org.chromium.base.test.util.Feature;
 import org.chromium.chrome.browser.ChromeSwitches;
 import org.chromium.chrome.browser.bookmarks.BookmarkBridge;
@@ -385,7 +384,6 @@
     @Test
     @LargeTest
     @Feature({"Sync"})
-    @DisabledTest(message = "https://crbug.com/964342")
     public void testDisabledNoDownloadBookmark() throws Exception {
         mSyncTestRule.disableDataType(ModelType.BOOKMARKS);
         addServerBookmark(TITLE, URL);
@@ -397,7 +395,6 @@
     @Test
     @LargeTest
     @Feature({"Sync"})
-    @DisabledTest(message = "https://crbug.com/964342")
     public void testDisabledNoUploadBookmark() throws Exception {
         mSyncTestRule.disableDataType(ModelType.BOOKMARKS);
         addClientBookmark(TITLE, URL);
diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/customtabs/CustomTabStatusBarColorProviderTest.java b/chrome/android/junit/src/org/chromium/chrome/browser/customtabs/CustomTabStatusBarColorProviderTest.java
new file mode 100644
index 0000000..acfbf052
--- /dev/null
+++ b/chrome/android/junit/src/org/chromium/chrome/browser/customtabs/CustomTabStatusBarColorProviderTest.java
@@ -0,0 +1,84 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.chrome.browser.customtabs;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.Mockito.when;
+
+import android.content.res.Resources;
+
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.MockitoAnnotations;
+import org.robolectric.annotation.Config;
+
+import org.chromium.base.test.BaseRobolectricTestRunner;
+import org.chromium.chrome.browser.customtabs.content.CustomTabActivityTabProvider;
+import org.chromium.chrome.browser.tab.Tab;
+
+/**
+ * Tests for {@link CustomTabStatusBarColorProvider}.
+ */
+@RunWith(BaseRobolectricTestRunner.class)
+@Config(manifest = Config.NONE)
+public class CustomTabStatusBarColorProviderTest {
+    private static final int DEFAULT_COLOR = 0x11223344;
+    private static final int FALLBACK_COLOR = 0x55667788;
+    private static final int USER_PROVIDED_COLOR = 0x99aabbcc;
+
+    @Mock public Resources mResources;
+    @Mock public CustomTabIntentDataProvider mCustomTabIntentDataProvider;
+    @Mock public CustomTabActivityTabProvider mCustomTabActivityTabProvider;
+    private CustomTabStatusBarColorProvider mColorProvider;
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+
+        mColorProvider = new CustomTabStatusBarColorProvider(mResources,
+                mCustomTabIntentDataProvider, mCustomTabActivityTabProvider);
+
+        // The color is accessed through ApiCompatibilityUtils which calls either
+        // Resources#getColor(int, Theme) or Resources#getColor(int) depending on the Android
+        // version. We mock out both calls so things don't break if we change the Android version
+        // the tests are run with.
+        when(mResources.getColor(anyInt(), any())).thenReturn(DEFAULT_COLOR);
+        when(mResources.getColor(anyInt())).thenReturn(DEFAULT_COLOR);
+
+        when(mCustomTabIntentDataProvider.getToolbarColor()).thenReturn(USER_PROVIDED_COLOR);
+    }
+
+    @Test
+    public void fallsBackWhenOpenedByChrome() {
+        when(mCustomTabIntentDataProvider.isOpenedByChrome()).thenReturn(true);
+
+        Assert.assertEquals(FALLBACK_COLOR, mColorProvider.getBaseStatusBarColor(FALLBACK_COLOR));
+
+        Assert.assertTrue(mColorProvider.isStatusBarDefaultThemeColor(true));
+        Assert.assertFalse(mColorProvider.isStatusBarDefaultThemeColor(false));
+    }
+
+    @Test
+    public void defaultThemeForPreviews() {
+        Tab tab = Mockito.mock(Tab.class);
+        when(tab.isPreview()).thenReturn(true);
+        when(mCustomTabActivityTabProvider.getTab()).thenReturn(tab);
+
+        Assert.assertEquals(DEFAULT_COLOR, mColorProvider.getBaseStatusBarColor(FALLBACK_COLOR));
+        Assert.assertFalse(mColorProvider.isStatusBarDefaultThemeColor(true));
+    }
+
+    @Test
+    public void userProvidedColor() {
+        Assert.assertEquals(USER_PROVIDED_COLOR,
+                mColorProvider.getBaseStatusBarColor(FALLBACK_COLOR));
+        Assert.assertFalse(mColorProvider.isStatusBarDefaultThemeColor(true));
+    }
+}
diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/offlinepages/prefetch/OfflineNotificationBackgroundTaskUnitTest.java b/chrome/android/junit/src/org/chromium/chrome/browser/offlinepages/prefetch/OfflineNotificationBackgroundTaskUnitTest.java
index 623c742..f7eb9108 100644
--- a/chrome/android/junit/src/org/chromium/chrome/browser/offlinepages/prefetch/OfflineNotificationBackgroundTaskUnitTest.java
+++ b/chrome/android/junit/src/org/chromium/chrome/browser/offlinepages/prefetch/OfflineNotificationBackgroundTaskUnitTest.java
@@ -41,7 +41,6 @@
 import org.robolectric.shadows.multidex.ShadowMultiDex;
 
 import org.chromium.base.Callback;
-import org.chromium.base.ContextUtils;
 import org.chromium.base.library_loader.ProcessInitException;
 import org.chromium.base.test.BaseRobolectricTestRunner;
 import org.chromium.chrome.browser.DeviceConditions;
@@ -157,7 +156,6 @@
         mCalendar.set(2017, 1, 1, 0, 0, 0);
 
         OfflineNotificationBackgroundTask.setCalendarForTesting(mCalendar);
-        clearPrefs();
     }
 
     @After
@@ -166,10 +164,6 @@
         verify(mPrefetchedPagesNotifier, never()).showNotification("");
     }
 
-    private void clearPrefs() {
-        ContextUtils.getAppSharedPreferences().edit().clear().apply();
-    }
-
     /**
      * Runs mOfflineNotificationBackgroundTask with the given params.
      * Asserts that reschedule was called exactly once and returns the reschedule value.
diff --git a/chrome/android/profiles/newest.txt b/chrome/android/profiles/newest.txt
index ab62d89..eb864ece 100644
--- a/chrome/android/profiles/newest.txt
+++ b/chrome/android/profiles/newest.txt
@@ -1 +1 @@
-chromeos-chrome-amd64-76.0.3798.0_rc-r1-merged.afdo.bz2
\ No newline at end of file
+chromeos-chrome-amd64-76.0.3801.0_rc-r1-merged.afdo.bz2
\ No newline at end of file
diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index b6f310e..b7cce57 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd
@@ -3055,6 +3055,20 @@
         Exit full screen
       </message>
 
+      <!-- Tab sharing infobar -->
+      <message name="IDS_TAB_SHARING_INFOBAR_SHARING_CURRENT_TAB_LABEL" desc="Text displayed on an infobar when current tab is being shared.">
+       Sharing this tab to <ph name="APP_NAME">$1<ex>meet.google.com</ex></ph>
+      </message>
+      <message name="IDS_TAB_SHARING_INFOBAR_SHARING_ANOTHER_TAB_LABEL" desc="Text displayed on an infobar when another (non-current) tab is being shared.">
+       Sharing <ph name="TAB_NAME">$1<ex>youtube.com</ex></ph> to <ph name="APP_NAME">$2<ex>meet.google.com</ex></ph>
+      </message>
+      <message name="IDS_TAB_SHARING_INFOBAR_SHARE_BUTTON" desc="Text displayed on the button to share current tab.">
+       Share this tab
+      </message>
+      <message name="IDS_TAB_SHARING_INFOBAR_STOP_BUTTON" desc="Text displayed on the button to stop sharing a tab.">
+       Stop
+      </message>
+
       <!-- Task Manager Window -->
       <if expr="not is_android">
         <if expr="not use_titlecase">
@@ -7364,26 +7378,6 @@
         <message name="IDS_SYNC_NTP_SETUP_IN_PROGRESS" desc="The message to display in the New Tab Page sync section when the sync setup is underway.">
           Setup in progress...
         </message>
-        <!-- Sync Promo New Tab Page bubble strings -->
-        <message name="IDS_SYNC_PROMO_NTP_BUBBLE_MESSAGE" desc="The body of the sync promo NTP bubble.">
-          You're now signed in to <ph name="SHORT_PRODUCT_NAME">$1<ex>Chrome</ex></ph>. Your bookmarks, history, and other settings are being synced with your Google Account.
-        </message>
-        <if expr="not use_titlecase">
-          <message name="IDS_SYNC_PROMO_NTP_BUBBLE_OK" desc="The ok button in the sync promo NTP bubble. Clicking on the button will dismiss the bubble.">
-            OK
-          </message>
-          <message name="IDS_SYNC_PROMO_NTP_BUBBLE_ADVANCED" desc="The advanced link in the sync promo NTP bubble. Clicking the link will take the user to advanced settings.">
-            Advanced...
-          </message>
-        </if>
-        <if expr="use_titlecase">
-          <message name="IDS_SYNC_PROMO_NTP_BUBBLE_OK" desc="In title case. The ok button in the sync promo NTP bubble. Clicking on the button will dismiss the bubble.">
-            OK
-          </message>
-          <message name="IDS_SYNC_PROMO_NTP_BUBBLE_ADVANCED" desc="In title case. The advanced link in the sync promo NTP bubble. Clicking the link will take the user to advanced settings.">
-            Advanced...
-          </message>
-        </if>
 
         <!-- Spinner dialog for waiting sync backend to start up -->
         <message name="IDS_SYNC_SETUP_SPINNER_TITLE" desc="The title of the sync setup dialog showing spinner.">
diff --git a/chrome/app/settings_strings.grdp b/chrome/app/settings_strings.grdp
index 8d12ea95..2d5880aa 100644
--- a/chrome/app/settings_strings.grdp
+++ b/chrome/app/settings_strings.grdp
@@ -1629,6 +1629,18 @@
     <message name="IDS_SETTINGS_KERBEROS_ACCOUNTS_REAUTHENTICATION_LABEL" desc="Label of the re-authentication button on Kerberos Accounts Settings page.">
       Sign in
     </message>
+    <message name="IDS_SETTINGS_ADD_KERBEROS_ACCOUNT" desc="In Add Kerberos Accounts dialog, the title of the dialog.">
+      Add Kerberos Account
+    </message>
+    <message name="IDS_SETTINGS_KERBEROS_USERNAME" desc="Title for the input that lets users specify their username for a Kerberos account.">
+      Username
+    </message>
+    <message name="IDS_SETTINGS_KERBEROS_PASSWORD" desc="Title for the input that lets users specify their password for a Kerberos account.">
+      Password
+    </message>
+    <message name="IDS_SETTINGS_KERBEROS_GENERAL_ERROR_MESSAGE" desc="Fallback error message displayed in the Add Kerberos.">
+      Oops! Something went wrong (error code <ph name="ERROR_CODE">$1<ex>123</ex></ph>).
+    </message>
   </if>
 
   <!-- Date/Time Page -->
diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
index bd78f6729..5abd281 100644
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc
@@ -2252,9 +2252,6 @@
     {"lsd-permission-prompt", flag_descriptions::kLsdPermissionPromptName,
      flag_descriptions::kLsdPermissionPromptDescription, kOsAndroid,
      FEATURE_VALUE_TYPE(features::kLsdPermissionPrompt)},
-    {"language-settings", flag_descriptions::kLanguagesPreferenceName,
-     flag_descriptions::kLanguagesPreferenceDescription, kOsAndroid,
-     FEATURE_VALUE_TYPE(chrome::android::kLanguagesPreference)},
 #endif
 
 #if defined(OS_CHROMEOS)
diff --git a/chrome/browser/android/chrome_feature_list.cc b/chrome/browser/android/chrome_feature_list.cc
index 838db82..73530a3c 100644
--- a/chrome/browser/android/chrome_feature_list.cc
+++ b/chrome/browser/android/chrome_feature_list.cc
@@ -145,7 +145,6 @@
     &kInlineUpdateFlow,
     &kIntentBlockExternalFormRedirectsNoGesture,
     &kJellyBeanSupported,
-    &kLanguagesPreference,
     &kNewPhotoPicker,
     &kNoCreditCardAbort,
     &kNTPButton,
@@ -167,6 +166,7 @@
     &kSpannableInlineAutocomplete,
     &kSpecialLocaleWrapper,
     &kSpecialUserDecision,
+    &kSwapPixelFormatToFixConvertFromTranslucent,
     &kTabEngagementReportingAndroid,
     &kTabGroupsAndroid,
     &kTabGroupsUiImprovementsAndroid,
@@ -438,9 +438,6 @@
 const base::Feature kJellyBeanSupported{"JellyBeanSupported",
                                         base::FEATURE_DISABLED_BY_DEFAULT};
 
-const base::Feature kLanguagesPreference{"LanguagesPreference",
-                                         base::FEATURE_ENABLED_BY_DEFAULT};
-
 const base::Feature kSearchEnginePromoExistingDevice{
     "SearchEnginePromo.ExistingDevice", base::FEATURE_ENABLED_BY_DEFAULT};
 
@@ -504,6 +501,10 @@
 const base::Feature kSpecialUserDecision{"SpecialUserDecision",
                                          base::FEATURE_DISABLED_BY_DEFAULT};
 
+const base::Feature kSwapPixelFormatToFixConvertFromTranslucent{
+    "SwapPixelFormatToFixConvertFromTranslucent",
+    base::FEATURE_ENABLED_BY_DEFAULT};
+
 const base::Feature kTabEngagementReportingAndroid{
     "TabEngagementReportingAndroid", base::FEATURE_DISABLED_BY_DEFAULT};
 
diff --git a/chrome/browser/android/chrome_feature_list.h b/chrome/browser/android/chrome_feature_list.h
index f50f97d1..37b2a60 100644
--- a/chrome/browser/android/chrome_feature_list.h
+++ b/chrome/browser/android/chrome_feature_list.h
@@ -80,7 +80,6 @@
 extern const base::Feature kInlineUpdateFlow;
 extern const base::Feature kIntentBlockExternalFormRedirectsNoGesture;
 extern const base::Feature kJellyBeanSupported;
-extern const base::Feature kLanguagesPreference;
 extern const base::Feature kSearchEnginePromoExistingDevice;
 extern const base::Feature kSearchEnginePromoNewDevice;
 extern const base::Feature kNewPhotoPicker;
@@ -102,6 +101,7 @@
 extern const base::Feature kSpannableInlineAutocomplete;
 extern const base::Feature kSpecialLocaleWrapper;
 extern const base::Feature kSpecialUserDecision;
+extern const base::Feature kSwapPixelFormatToFixConvertFromTranslucent;
 extern const base::Feature kTabEngagementReportingAndroid;
 extern const base::Feature kTabGroupsAndroid;
 extern const base::Feature kTabGroupsUiImprovementsAndroid;
diff --git a/chrome/browser/android/compositor/layer/ephemeral_tab_layer.cc b/chrome/browser/android/compositor/layer/ephemeral_tab_layer.cc
index 3ceab504..503f615 100644
--- a/chrome/browser/android/compositor/layer/ephemeral_tab_layer.cc
+++ b/chrome/browser/android/compositor/layer/ephemeral_tab_layer.cc
@@ -167,9 +167,9 @@
   if (!favicon_service)
     return;
 
-  favicon_base::FaviconRawBitmapCallback callback_runner = base::BindRepeating(
-      &OnLocalFaviconAvailable, favicon_layer_, panel_icon_, dp_to_px_,
-      panel_width_, bar_height_, bar_margin_side_);
+  favicon_base::FaviconRawBitmapCallback callback_runner =
+      base::BindOnce(&OnLocalFaviconAvailable, favicon_layer_, panel_icon_,
+                     dp_to_px_, panel_width_, bar_height_, bar_margin_side_);
 
   // Set |fallback_to_host|=true so the favicon database will fall back to
   // matching only the hostname to have the best chance of finding a favicon.
@@ -179,7 +179,8 @@
       {favicon_base::IconType::kFavicon, favicon_base::IconType::kTouchIcon,
        favicon_base::IconType::kTouchPrecomposedIcon,
        favicon_base::IconType::kWebManifestIcon},
-      size, fallback_to_host, callback_runner, cancelable_task_tracker_.get());
+      size, fallback_to_host, std::move(callback_runner),
+      cancelable_task_tracker_.get());
 }
 
 EphemeralTabLayer::EphemeralTabLayer(ui::ResourceManager* resource_manager)
diff --git a/chrome/browser/android/digital_asset_links/digital_asset_links_handler.cc b/chrome/browser/android/digital_asset_links/digital_asset_links_handler.cc
index 7dcbcd7..f14b73ce 100644
--- a/chrome/browser/android/digital_asset_links/digital_asset_links_handler.cc
+++ b/chrome/browser/android/digital_asset_links/digital_asset_links_handler.cc
@@ -150,8 +150,8 @@
     const std::string& package,
     const std::string& fingerprint,
     const std::string& relationship,
-    std::unique_ptr<base::Value> statement_list) {
-  if (!statement_list->is_list()) {
+    base::Value statement_list) {
+  if (!statement_list.is_list()) {
     std::move(callback_).Run(RelationshipCheckResult::FAILURE);
     LOG(WARNING) << "Statement List is not a list.";
     return;
@@ -160,7 +160,7 @@
   // We only output individual statement failures if none match.
   std::vector<std::string> failures;
 
-  for (const auto& statement : statement_list->GetList()) {
+  for (const auto& statement : statement_list.GetList()) {
     if (!statement.is_dict()) {
       failures.push_back("Statement is not a dictionary.");
       continue;
diff --git a/chrome/browser/android/digital_asset_links/digital_asset_links_handler.h b/chrome/browser/android/digital_asset_links/digital_asset_links_handler.h
index 6b3bb9b..4a68cba 100644
--- a/chrome/browser/android/digital_asset_links/digital_asset_links_handler.h
+++ b/chrome/browser/android/digital_asset_links/digital_asset_links_handler.h
@@ -68,7 +68,7 @@
   void OnJSONParseSucceeded(const std::string& package,
                             const std::string& fingerprint,
                             const std::string& relationship,
-                            std::unique_ptr<base::Value> result);
+                            base::Value result);
   void OnJSONParseFailed(const std::string& error_message);
 
   scoped_refptr<network::SharedURLLoaderFactory> shared_url_loader_factory_;
diff --git a/chrome/browser/android/explore_sites/ntp_json_fetcher.cc b/chrome/browser/android/explore_sites/ntp_json_fetcher.cc
index e29c64d..7fad868 100644
--- a/chrome/browser/android/explore_sites/ntp_json_fetcher.cc
+++ b/chrome/browser/android/explore_sites/ntp_json_fetcher.cc
@@ -106,14 +106,13 @@
                           weak_factory_.GetWeakPtr()));
 }
 
-void NTPJsonFetcher::OnJsonParseSuccess(
-    std::unique_ptr<base::Value> parsed_json) {
-  if (!parsed_json || !parsed_json->is_dict()) {
+void NTPJsonFetcher::OnJsonParseSuccess(base::Value parsed_json) {
+  if (!parsed_json.is_dict()) {
     OnJsonParseError("Parsed JSON is not a dictionary.");
     return;
   }
 
-  auto catalog = NTPCatalog::create(*parsed_json);
+  auto catalog = NTPCatalog::create(parsed_json);
   std::move(callback_).Run(std::move(catalog));
 }
 
diff --git a/chrome/browser/android/explore_sites/ntp_json_fetcher.h b/chrome/browser/android/explore_sites/ntp_json_fetcher.h
index d164550..c5f6a04 100644
--- a/chrome/browser/android/explore_sites/ntp_json_fetcher.h
+++ b/chrome/browser/android/explore_sites/ntp_json_fetcher.h
@@ -47,7 +47,7 @@
   // Invoked from SimpleURLLoader after download is complete.
   void OnSimpleLoaderComplete(std::unique_ptr<std::string> response_body);
   // Callbacks for SafeJsonParser.
-  void OnJsonParseSuccess(std::unique_ptr<base::Value> parsed_json);
+  void OnJsonParseSuccess(base::Value parsed_json);
   void OnJsonParseError(const std::string& error);
 
   Callback callback_;
diff --git a/chrome/browser/android/favicon_helper.cc b/chrome/browser/android/favicon_helper.cc
index 51c9d4f..63b20cc 100644
--- a/chrome/browser/android/favicon_helper.cc
+++ b/chrome/browser/android/favicon_helper.cc
@@ -110,8 +110,8 @@
     return false;
 
   favicon_base::FaviconRawBitmapCallback callback_runner =
-      base::Bind(&OnLocalFaviconAvailable,
-                 ScopedJavaGlobalRef<jobject>(j_favicon_image_callback));
+      base::BindOnce(&OnLocalFaviconAvailable,
+                     ScopedJavaGlobalRef<jobject>(j_favicon_image_callback));
 
   // |j_page_url| is an origin, and it may not have had a favicon associated
   // with it. A trickier case is when |j_page_url| only has domain-scoped
@@ -127,7 +127,7 @@
        favicon_base::IconType::kTouchPrecomposedIcon,
        favicon_base::IconType::kWebManifestIcon},
       static_cast<int>(j_desired_size_in_pixel), fallback_to_host,
-      callback_runner, cancelable_task_tracker_.get());
+      std::move(callback_runner), cancelable_task_tracker_.get());
 
   return true;
 }
@@ -188,13 +188,13 @@
   // TODO(treib): Optimize this by creating a FaviconService::HasFavicon method
   // so that we don't have to actually get the image.
   ScopedJavaGlobalRef<jobject> j_scoped_callback(env, j_availability_callback);
-  favicon_base::FaviconImageCallback callback_runner = base::Bind(
+  favicon_base::FaviconImageCallback callback_runner = base::BindOnce(
       &FaviconHelper::OnFaviconImageResultAvailable, j_scoped_callback, profile,
       web_contents, page_url, icon_url, icon_type);
   favicon::FaviconService* service = FaviconServiceFactory::GetForProfile(
       profile, ServiceAccessType::IMPLICIT_ACCESS);
   favicon::GetFaviconImageForPageURL(service, page_url, icon_type,
-                                     callback_runner,
+                                     std::move(callback_runner),
                                      cancelable_task_tracker_.get());
 }
 
diff --git a/chrome/browser/android/large_icon_bridge.cc b/chrome/browser/android/large_icon_bridge.cc
index 095fd20..fbd7d6f 100644
--- a/chrome/browser/android/large_icon_bridge.cc
+++ b/chrome/browser/android/large_icon_bridge.cc
@@ -85,14 +85,15 @@
   if (!large_icon_service)
     return false;
 
-  favicon_base::LargeIconCallback callback_runner = base::Bind(
+  favicon_base::LargeIconCallback callback_runner = base::BindOnce(
       &OnLargeIconAvailable, ScopedJavaGlobalRef<jobject>(env, j_callback));
 
   // Use desired_size = 0 for getting the icon from the cache (so that
   // the icon is not poorly rescaled by LargeIconService).
   large_icon_service->GetLargeIconRawBitmapOrFallbackStyleForPageUrl(
       GURL(ConvertJavaStringToUTF16(env, j_page_url)), min_source_size_px,
-      /*desired_size_in_pixel=*/0, callback_runner, &cancelable_task_tracker_);
+      /*desired_size_in_pixel=*/0, std::move(callback_runner),
+      &cancelable_task_tracker_);
 
   return true;
 }
diff --git a/chrome/browser/bookmarks/chrome_bookmark_client.cc b/chrome/browser/bookmarks/chrome_bookmark_client.cc
index f2bed02c..1bad4d8 100644
--- a/chrome/browser/bookmarks/chrome_bookmark_client.cc
+++ b/chrome/browser/bookmarks/chrome_bookmark_client.cc
@@ -55,12 +55,12 @@
 ChromeBookmarkClient::GetFaviconImageForPageURL(
     const GURL& page_url,
     favicon_base::IconType type,
-    const favicon_base::FaviconImageCallback& callback,
+    favicon_base::FaviconImageCallback callback,
     base::CancelableTaskTracker* tracker) {
   return favicon::GetFaviconImageForPageURL(
       FaviconServiceFactory::GetForProfile(profile_,
                                            ServiceAccessType::EXPLICIT_ACCESS),
-      page_url, type, callback, tracker);
+      page_url, type, std::move(callback), tracker);
 }
 
 bool ChromeBookmarkClient::SupportsTypedCountForUrls() {
diff --git a/chrome/browser/bookmarks/chrome_bookmark_client.h b/chrome/browser/bookmarks/chrome_bookmark_client.h
index 9b463eacb..705c118b 100644
--- a/chrome/browser/bookmarks/chrome_bookmark_client.h
+++ b/chrome/browser/bookmarks/chrome_bookmark_client.h
@@ -47,7 +47,7 @@
   base::CancelableTaskTracker::TaskId GetFaviconImageForPageURL(
       const GURL& page_url,
       favicon_base::IconType type,
-      const favicon_base::FaviconImageCallback& callback,
+      favicon_base::FaviconImageCallback callback,
       base::CancelableTaskTracker* tracker) override;
   bool SupportsTypedCountForUrls() override;
   void GetTypedCountForUrls(UrlTypedCountMap* url_typed_count_map) override;
diff --git a/chrome/browser/browser_switcher/alternative_browser_driver_posix.cc b/chrome/browser/browser_switcher/alternative_browser_driver_posix.cc
index b8e471a..18445a49 100644
--- a/chrome/browser/browser_switcher/alternative_browser_driver_posix.cc
+++ b/chrome/browser/browser_switcher/alternative_browser_driver_posix.cc
@@ -150,11 +150,13 @@
 AlternativeBrowserDriverImpl::~AlternativeBrowserDriverImpl() {}
 
 bool AlternativeBrowserDriverImpl::TryLaunch(const GURL& url) {
+#if !defined(OS_MACOSX)
   if (prefs_->GetAlternativeBrowserPath().empty()) {
     LOG(ERROR) << "Alternative browser not configured. "
                << "Aborting browser switch.";
     return false;
   }
+#endif
 
   VLOG(2) << "Launching alternative browser...";
   VLOG(2) << "  path = " << prefs_->GetAlternativeBrowserPath();
diff --git a/chrome/browser/browser_switcher/browser_switcher_prefs.cc b/chrome/browser/browser_switcher/browser_switcher_prefs.cc
index 7e042b4..bdafc50 100644
--- a/chrome/browser/browser_switcher/browser_switcher_prefs.cc
+++ b/chrome/browser/browser_switcher/browser_switcher_prefs.cc
@@ -19,6 +19,7 @@
 namespace browser_switcher {
 
 RuleSet::RuleSet() = default;
+RuleSet::RuleSet(const RuleSet&) = default;
 RuleSet::~RuleSet() = default;
 
 BrowserSwitcherPrefs::BrowserSwitcherPrefs(Profile* profile)
@@ -106,9 +107,12 @@
   registry->RegisterListPref(prefs::kUrlList);
   registry->RegisterListPref(prefs::kUrlGreylist);
   registry->RegisterStringPref(prefs::kExternalSitelistUrl, "");
+  registry->RegisterListPref(prefs::kCachedExternalSitelist);
   registry->RegisterStringPref(prefs::kExternalGreylistUrl, "");
+  registry->RegisterListPref(prefs::kCachedExternalGreylist);
 #if defined(OS_WIN)
   registry->RegisterBooleanPref(prefs::kUseIeSitelist, false);
+  registry->RegisterListPref(prefs::kCachedIeSitelist);
   registry->RegisterStringPref(prefs::kChromePath, "");
   registry->RegisterListPref(prefs::kChromeParameters);
 #endif
@@ -140,6 +144,42 @@
   return rules_;
 }
 
+RuleSet BrowserSwitcherPrefs::GetCachedExternalRules() const {
+  RuleSet rules;
+  for (const auto& url : *prefs_->GetList(prefs::kCachedExternalSitelist))
+    rules.sitelist.push_back(url.GetString());
+  for (const auto& url : *prefs_->GetList(prefs::kCachedExternalGreylist))
+    rules.greylist.push_back(url.GetString());
+  return rules;
+}
+
+void BrowserSwitcherPrefs::SetCachedExternalRules(const RuleSet& rules) const {
+  base::ListValue sitelist;
+  for (const auto& url : rules.sitelist)
+    sitelist.GetList().push_back(base::Value(url));
+  prefs_->Set(prefs::kCachedExternalSitelist, sitelist);
+  base::ListValue greylist;
+  for (const auto& url : rules.greylist)
+    greylist.GetList().push_back(base::Value(url));
+  prefs_->Set(prefs::kCachedExternalGreylist, greylist);
+}
+
+#if defined(OS_WIN)
+RuleSet BrowserSwitcherPrefs::GetCachedIeemRules() const {
+  RuleSet rules;
+  for (const auto& url : *prefs_->GetList(prefs::kCachedIeSitelist))
+    rules.sitelist.push_back(url.GetString());
+  return rules;
+}
+
+void BrowserSwitcherPrefs::SetCachedIeemRules(const RuleSet& rules) const {
+  base::ListValue sitelist;
+  for (const auto& url : rules.sitelist)
+    sitelist.GetList().push_back(base::Value(url));
+  prefs_->Set(prefs::kCachedIeSitelist, sitelist);
+}
+#endif
+
 GURL BrowserSwitcherPrefs::GetExternalSitelistUrl() const {
   if (!prefs_->IsManagedPreference(prefs::kExternalSitelistUrl))
     return GURL();
@@ -301,13 +341,18 @@
 
 // URL with an external XML sitelist file to load.
 const char kExternalSitelistUrl[] = "browser_switcher.external_sitelist_url";
+const char kCachedExternalSitelist[] =
+    "browser_switcher.cached_external_sitelist";
 
 // URL with an external XML greylist file to load.
 const char kExternalGreylistUrl[] = "browser_switcher.external_greylist_url";
+const char kCachedExternalGreylist[] =
+    "browser_switcher.cached_external_greylist";
 
 #if defined(OS_WIN)
 // If set to true, use the IE Enterprise Mode Sitelist policy.
 const char kUseIeSitelist[] = "browser_switcher.use_ie_sitelist";
+const char kCachedIeSitelist[] = "browser_switcher.cached_ie_sitelist";
 
 // Path to the Chrome executable for the alternative browser.
 const char kChromePath[] = "browser_switcher.chrome_path";
diff --git a/chrome/browser/browser_switcher/browser_switcher_prefs.h b/chrome/browser/browser_switcher/browser_switcher_prefs.h
index 8fd73b6..8cf826c 100644
--- a/chrome/browser/browser_switcher/browser_switcher_prefs.h
+++ b/chrome/browser/browser_switcher/browser_switcher_prefs.h
@@ -30,6 +30,7 @@
 // A named pair type.
 struct RuleSet {
   RuleSet();
+  RuleSet(const RuleSet&);
   ~RuleSet();
 
   std::vector<std::string> sitelist;
@@ -77,6 +78,16 @@
   // policies. If the pref is not managed, returns an empty vector.
   const RuleSet& GetRules() const;
 
+  // Returns (or sets) the sitelist + greylist that were used by a previous
+  // browser session.
+  RuleSet GetCachedExternalRules() const;
+  void SetCachedExternalRules(const RuleSet& rules) const;
+
+#if defined(OS_WIN)
+  RuleSet GetCachedIeemRules() const;
+  void SetCachedIeemRules(const RuleSet& rules) const;
+#endif
+
   // Returns the URL to download for an external XML sitelist. If the pref is
   // not managed, returns an invalid URL.
   GURL GetExternalSitelistUrl() const;
@@ -171,10 +182,13 @@
 extern const char kUrlList[];
 extern const char kUrlGreylist[];
 extern const char kExternalSitelistUrl[];
+extern const char kCachedExternalSitelist[];
 extern const char kExternalGreylistUrl[];
+extern const char kCachedExternalGreylist[];
 
 #if defined(OS_WIN)
 extern const char kUseIeSitelist[];
+extern const char kCachedIeSitelist[];
 extern const char kChromePath[];
 extern const char kChromeParameters[];
 #endif
diff --git a/chrome/browser/browser_switcher/browser_switcher_service_browsertest.cc b/chrome/browser/browser_switcher/browser_switcher_service_browsertest.cc
index 9068f6b6..d7bab0d 100644
--- a/chrome/browser/browser_switcher/browser_switcher_service_browsertest.cc
+++ b/chrome/browser/browser_switcher/browser_switcher_service_browsertest.cc
@@ -378,6 +378,48 @@
   run_loop.Run();
 }
 
+IN_PROC_BROWSER_TEST_F(BrowserSwitcherServiceTest,
+                       PRE_ExternalCachedForBrowserRestart) {
+  SetExternalUrl(kAValidUrl);
+
+  content::URLLoaderInterceptor interceptor(
+      base::BindRepeating(&ReturnValidXml));
+
+  // Execute everything and make sure the rules are applied correctly.
+  auto* service =
+      BrowserSwitcherServiceFactory::GetForBrowserContext(browser()->profile());
+  base::RunLoop run_loop;
+  base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
+      FROM_HERE,
+      base::BindOnce(
+          [](BrowserSwitcherService* service, base::OnceClosure quit) {
+            EXPECT_FALSE(ShouldSwitch(service, GURL("http://google.com/")));
+            EXPECT_TRUE(ShouldSwitch(service, GURL("http://docs.google.com/")));
+            EXPECT_FALSE(ShouldSwitch(service, GURL("http://yahoo.com/")));
+            std::move(quit).Run();
+          },
+          service, run_loop.QuitClosure()),
+      TestTimeouts::action_timeout());
+  run_loop.Run();
+}
+
+IN_PROC_BROWSER_TEST_F(BrowserSwitcherServiceTest,
+                       ExternalCachedForBrowserRestart) {
+  SetExternalUrl(kAValidUrl);
+
+  content::URLLoaderInterceptor interceptor(
+      base::BindRepeating(&ReturnValidXml));
+
+  // Execute everything and make sure the rules are applied correctly.
+  auto* service =
+      BrowserSwitcherServiceFactory::GetForBrowserContext(browser()->profile());
+  // No timeout here, since we're checking that the rules get applied *before*
+  // downloading.
+  EXPECT_FALSE(ShouldSwitch(service, GURL("http://google.com/")));
+  EXPECT_TRUE(ShouldSwitch(service, GURL("http://docs.google.com/")));
+  EXPECT_FALSE(ShouldSwitch(service, GURL("http://yahoo.com/")));
+}
+
 #if defined(OS_WIN)
 IN_PROC_BROWSER_TEST_F(BrowserSwitcherServiceTest, IeemSitelistInvalidUrl) {
   SetUseIeSitelist(true);
diff --git a/chrome/browser/browser_switcher/browser_switcher_sitelist.cc b/chrome/browser/browser_switcher/browser_switcher_sitelist.cc
index e6171bb..88ec995f 100644
--- a/chrome/browser/browser_switcher/browser_switcher_sitelist.cc
+++ b/chrome/browser/browser_switcher/browser_switcher_sitelist.cc
@@ -15,6 +15,7 @@
 #include "base/strings/strcat.h"
 #include "base/strings/string_util.h"
 #include "base/values.h"
+#include "build/build_config.h"
 #include "chrome/browser/browser_switcher/browser_switcher_prefs.h"
 #include "chrome/browser/browser_switcher/ieem_sitelist_parser.h"
 #include "components/prefs/pref_service.h"
@@ -182,7 +183,19 @@
 
 BrowserSwitcherSitelistImpl::BrowserSwitcherSitelistImpl(
     const BrowserSwitcherPrefs* prefs)
-    : prefs_(prefs) {}
+    : prefs_(prefs) {
+  // TODO(nicolaso): Rules are initialized by |GetCached...Rules()| pretty early
+  // in browser startup. If they're configured via cloud policy, they'll only be
+  // initialized on download (1 minute after browser startup).
+#if defined(OS_WIN)
+  if (prefs->UseIeSitelist())
+    ieem_sitelist_ = prefs->GetCachedIeemRules();
+#endif
+  if (prefs->GetExternalSitelistUrl().is_valid() ||
+      prefs->GetExternalGreylistUrl().is_valid()) {
+    external_sitelist_ = prefs->GetCachedExternalRules();
+  }
+}
 
 BrowserSwitcherSitelistImpl::~BrowserSwitcherSitelistImpl() = default;
 
@@ -244,6 +257,9 @@
                               parsed_xml.rules.size());
 
   ieem_sitelist_.sitelist = std::move(parsed_xml.rules);
+#if defined(OS_WIN)
+  prefs_->SetCachedIeemRules(ieem_sitelist_);
+#endif
 }
 
 void BrowserSwitcherSitelistImpl::SetExternalSitelist(ParsedXml&& parsed_xml) {
@@ -253,6 +269,7 @@
                               parsed_xml.rules.size());
 
   external_sitelist_.sitelist = std::move(parsed_xml.rules);
+  prefs_->SetCachedExternalRules(external_sitelist_);
 }
 
 void BrowserSwitcherSitelistImpl::SetExternalGreylist(ParsedXml&& parsed_xml) {
@@ -262,6 +279,7 @@
                               parsed_xml.rules.size());
 
   external_sitelist_.greylist = std::move(parsed_xml.rules);
+  prefs_->SetCachedExternalRules(external_sitelist_);
 }
 
 const RuleSet* BrowserSwitcherSitelistImpl::GetIeemSitelist() const {
diff --git a/chrome/browser/chromeos/arc/policy/arc_policy_bridge.cc b/chrome/browser/chromeos/arc/policy/arc_policy_bridge.cc
index 1eb4c0ee..e9db85d 100644
--- a/chrome/browser/chromeos/arc/policy/arc_policy_bridge.cc
+++ b/chrome/browser/chromeos/arc/policy/arc_policy_bridge.cc
@@ -533,17 +533,17 @@
 
 void ArcPolicyBridge::OnReportComplianceParseSuccess(
     base::OnceCallback<void(const std::string&)> callback,
-    std::unique_ptr<base::Value> parsed_json) {
+    base::Value parsed_json) {
   // Always returns "compliant".
   std::move(callback).Run(kPolicyCompliantJson);
   Profile::FromBrowserContext(context_)->GetPrefs()->SetBoolean(
       prefs::kArcPolicyComplianceReported, true);
 
   const base::DictionaryValue* dict = nullptr;
-  if (parsed_json->GetAsDictionary(&dict)) {
+  if (parsed_json.GetAsDictionary(&dict)) {
     UpdateComplianceReportMetrics(dict);
     for (Observer& observer : observers_) {
-      observer.OnComplianceReportReceived(parsed_json.get());
+      observer.OnComplianceReportReceived(&parsed_json);
     }
   }
 }
diff --git a/chrome/browser/chromeos/arc/policy/arc_policy_bridge.h b/chrome/browser/chromeos/arc/policy/arc_policy_bridge.h
index 96d02bd..94bf0e8c 100644
--- a/chrome/browser/chromeos/arc/policy/arc_policy_bridge.h
+++ b/chrome/browser/chromeos/arc/policy/arc_policy_bridge.h
@@ -147,7 +147,7 @@
   // Called when the compliance report from ARC is parsed.
   void OnReportComplianceParseSuccess(
       base::OnceCallback<void(const std::string&)> callback,
-      std::unique_ptr<base::Value> parsed_json);
+      base::Value parsed_json);
 
   void UpdateComplianceReportMetrics(const base::DictionaryValue* report);
 
diff --git a/chrome/browser/chromeos/first_run/chromeos_first_run_browsertest.cc b/chrome/browser/chromeos/first_run/chromeos_first_run_browsertest.cc
index 0d02dec..f16a91d 100644
--- a/chrome/browser/chromeos/first_run/chromeos_first_run_browsertest.cc
+++ b/chrome/browser/chromeos/first_run/chromeos_first_run_browsertest.cc
@@ -2,17 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "ash/public/interfaces/constants.mojom.h"
-#include "ash/public/interfaces/system_tray_test_api.test-mojom-test-utils.h"
-#include "ash/public/interfaces/system_tray_test_api.test-mojom.h"
+#include "ash/public/cpp/system_tray_test_api.h"
 #include "chrome/browser/chromeos/first_run/first_run.h"
 #include "chrome/browser/chromeos/first_run/first_run_controller.h"
 #include "chrome/browser/chromeos/first_run/step_names.h"
 #include "chrome/browser/chromeos/login/test/js_checker.h"
 #include "chrome/test/base/in_process_browser_test.h"
-#include "content/public/common/service_manager_connection.h"
 #include "content/public/test/test_utils.h"
-#include "services/service_manager/public/cpp/connector.h"
 #include "ui/aura/window.h"
 #include "ui/events/event_handler.h"
 #include "ui/events/test/event_generator.h"
@@ -65,10 +61,7 @@
 
   void SetUpOnMainThread() override {
     InProcessBrowserTest::SetUpOnMainThread();
-    // Connect to the ash test interface.
-    content::ServiceManagerConnection::GetForProcess()
-        ->GetConnector()
-        ->BindInterface(ash::mojom::kServiceName, &tray_test_api_);
+    tray_test_api_ = ash::SystemTrayTestApi::Create();
   }
 
   // FirstRunActor::Delegate overrides.
@@ -154,12 +147,7 @@
     return FirstRunController::GetInstanceForTest();
   }
 
-  bool IsTrayBubbleOpen() {
-    bool is_open = false;
-    ash::mojom::SystemTrayTestApiAsyncWaiter wait_for(tray_test_api_.get());
-    wait_for.IsTrayBubbleOpen(&is_open);
-    return is_open;
-  }
+  bool IsTrayBubbleOpen() { return tray_test_api_->IsTrayBubbleOpen(); }
 
   views::Widget* GetOverlayWidget() { return controller()->widget_.get(); }
 
@@ -168,7 +156,7 @@
   }
 
  private:
-  ash::mojom::SystemTrayTestApiPtr tray_test_api_;
+  std::unique_ptr<ash::SystemTrayTestApi> tray_test_api_;
   std::string current_step_name_;
   bool initialized_;
   bool finalized_;
diff --git a/chrome/browser/chromeos/kiosk_next_home/intent_config_helper.cc b/chrome/browser/chromeos/kiosk_next_home/intent_config_helper.cc
index e4904b3e..e1d5e764 100644
--- a/chrome/browser/chromeos/kiosk_next_home/intent_config_helper.cc
+++ b/chrome/browser/chromeos/kiosk_next_home/intent_config_helper.cc
@@ -132,11 +132,10 @@
                           weak_factory_.GetWeakPtr()));
 }
 
-void IntentConfigHelper::ParseConfigDone(
-    std::unique_ptr<base::Value> config_value) {
+void IntentConfigHelper::ParseConfigDone(base::Value config_value) {
   base::JSONValueConverter<IntentConfig> converter;
   IntentConfig parsed_config;
-  if (converter.Convert(*config_value, &parsed_config)) {
+  if (converter.Convert(config_value, &parsed_config)) {
     for (const auto& allowed_host_ptr : parsed_config.allowed_hosts)
       allowed_hosts_.emplace(std::move(*allowed_host_ptr));
 
diff --git a/chrome/browser/chromeos/kiosk_next_home/intent_config_helper.h b/chrome/browser/chromeos/kiosk_next_home/intent_config_helper.h
index 73ee068..48874e2 100644
--- a/chrome/browser/chromeos/kiosk_next_home/intent_config_helper.h
+++ b/chrome/browser/chromeos/kiosk_next_home/intent_config_helper.h
@@ -51,7 +51,7 @@
   void ParseConfig(const std::string& json_config);
 
   // Receives parsed JSON config when ready.
-  void ParseConfigDone(std::unique_ptr<base::Value> config);
+  void ParseConfigDone(base::Value config);
 
   // Called if config could not be parsed.
   void ParseConfigFailed(const std::string& error);
diff --git a/chrome/browser/chromeos/login/screens/supervision_onboarding_screen_browsertest.cc b/chrome/browser/chromeos/login/screens/supervision_onboarding_screen_browsertest.cc
index d290c78..80a4504 100644
--- a/chrome/browser/chromeos/login/screens/supervision_onboarding_screen_browsertest.cc
+++ b/chrome/browser/chromeos/login/screens/supervision_onboarding_screen_browsertest.cc
@@ -339,8 +339,15 @@
   EXPECT_EQ(1u, supervision_server()->GetReceivedRequestsCount());
 }
 
+// https://crbug.com/965369
+#if defined(OS_CHROMEOS)
+#define MAYBE_ExitWhenServerSendsWrongHeader \
+  DISABLED_ExitWhenServerSendsWrongHeader
+#else
+#define MAYBE_ExitWhenServerSendsWrongHeader ExitWhenServerSendsWrongHeader
+#endif
 IN_PROC_BROWSER_TEST_F(SupervisionOnboardingTest,
-                       ExitWhenServerSendsWrongHeader) {
+                       MAYBE_ExitWhenServerSendsWrongHeader) {
   ExpectCustomHttpHeaderValue("user-eligible-for-supervision");
   supervision_server()->set_custom_http_header_value("user-not-eligible");
 
@@ -350,7 +357,13 @@
   EXPECT_EQ(1u, supervision_server()->GetReceivedRequestsCount());
 }
 
-IN_PROC_BROWSER_TEST_F(SupervisionOnboardingTest, NextButtonExitsScreen) {
+// https://crbug.com/965369
+#if defined(OS_CHROMEOS)
+#define MAYBE_NextButtonExitsScreen DISABLED_NextButtonExitsScreen
+#else
+#define MAYBE_NextButtonExitsScreen NextButtonExitsScreen
+#endif
+IN_PROC_BROWSER_TEST_F(SupervisionOnboardingTest, MAYBE_NextButtonExitsScreen) {
   LoginAndShowScreen();
   WaitForScreen();
   EXPECT_EQ(1u, supervision_server()->GetReceivedRequestsCount());
diff --git a/chrome/browser/chromeos/policy/device_system_use_24hour_clock_browsertest.cc b/chrome/browser/chromeos/policy/device_system_use_24hour_clock_browsertest.cc
index 0279f87..a63184d 100644
--- a/chrome/browser/chromeos/policy/device_system_use_24hour_clock_browsertest.cc
+++ b/chrome/browser/chromeos/policy/device_system_use_24hour_clock_browsertest.cc
@@ -2,9 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "ash/public/interfaces/constants.mojom.h"
-#include "ash/public/interfaces/system_tray_test_api.test-mojom-test-utils.h"
-#include "ash/public/interfaces/system_tray_test_api.test-mojom.h"
+#include "ash/public/cpp/system_tray_test_api.h"
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/location.h"
@@ -20,8 +18,6 @@
 #include "chrome/browser/lifetime/application_lifetime.h"
 #include "chromeos/constants/chromeos_switches.h"
 #include "components/policy/proto/chrome_device_policy.pb.h"
-#include "content/public/common/service_manager_connection.h"
-#include "services/service_manager/public/cpp/connector.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace em = enterprise_management;
@@ -31,16 +27,12 @@
 class SystemUse24HourClockPolicyTest
     : public policy::DevicePolicyCrosBrowserTest {
  public:
-  SystemUse24HourClockPolicyTest() {
-  }
+  SystemUse24HourClockPolicyTest() = default;
 
   // policy::DevicePolicyCrosBrowserTest:
   void SetUpOnMainThread() override {
     policy::DevicePolicyCrosBrowserTest::SetUpOnMainThread();
-    // Connect to the ash test interface.
-    content::ServiceManagerConnection::GetForProcess()
-        ->GetConnector()
-        ->BindInterface(ash::mojom::kServiceName, &tray_test_api_);
+    tray_test_api_ = ash::SystemTrayTestApi::Create();
   }
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
@@ -69,10 +61,7 @@
   }
 
   bool IsPrimarySystemTrayUse24Hour() {
-    ash::mojom::SystemTrayTestApiAsyncWaiter wait_for(tray_test_api_.get());
-    bool is_24_hour = false;
-    wait_for.Is24HourClock(&is_24_hour);
-    return is_24_hour;
+    return tray_test_api_->Is24HourClock();
   }
 
   static bool SystemClockShouldUse24Hour() {
@@ -82,7 +71,7 @@
   }
 
  private:
-  ash::mojom::SystemTrayTestApiPtr tray_test_api_;
+  std::unique_ptr<ash::SystemTrayTestApi> tray_test_api_;
 
   DISALLOW_COPY_AND_ASSIGN(SystemUse24HourClockPolicyTest);
 };
diff --git a/chrome/browser/chromeos/policy/signin_profile_apps_policy_browsertest.cc b/chrome/browser/chromeos/policy/signin_profile_extensions_policy_browsertest.cc
similarity index 61%
rename from chrome/browser/chromeos/policy/signin_profile_apps_policy_browsertest.cc
rename to chrome/browser/chromeos/policy/signin_profile_extensions_policy_browsertest.cc
index 8df4b22..a6009c7 100644
--- a/chrome/browser/chromeos/policy/signin_profile_apps_policy_browsertest.cc
+++ b/chrome/browser/chromeos/policy/signin_profile_extensions_policy_browsertest.cc
@@ -54,18 +54,23 @@
 // directory):
 // * The manual testing app which is whitelisted for running in the sign-in
 //   profile:
-const char kManualTestAppId[] = "bjaiihebfngildkcjkjckolinodhliff";
-const char kManualTestAppUpdateManifestPath[] =
+const char kWhitelistedAppId[] = "bjaiihebfngildkcjkjckolinodhliff";
+const char kWhitelistedAppUpdateManifestPath[] =
     "/extensions/signin_screen_manual_test_app/update_manifest.xml";
 // * A trivial test app which is NOT whitelisted for running in the sign-in
 //   profile:
-const char kTrivialAppId[] = "mockapnacjbcdncmpkjngjalkhphojek";
-const char kTrivialAppUpdateManifestPath[] =
+const char kNotWhitelistedAppId[] = "mockapnacjbcdncmpkjngjalkhphojek";
+const char kNotWhitelistedUpdateManifestPath[] =
     "/extensions/trivial_platform_app/update_manifest.xml";
-// * A trivial test extension (note that extensions cannot be whitelisted for
-//   running in the sign-in profile):
-const char kTrivialExtensionId[] = "mockepjebcnmhmhcahfddgfcdgkdifnc";
-const char kTrivialExtensionUpdateManifestPath[] =
+// * A trivial test extension which is whitelisted for running in the sign-in
+//   profile:
+const char kWhitelistedExtensionId[] = "ngjobkbdodapjbbncmagbccommkggmnj";
+const char kWhitelistedExtensionUpdateManifestPath[] =
+    "/extensions/signin_screen_manual_test_extension/update_manifest.xml";
+// * A trivial test extension which is NOT whitelisted for running in the
+//   sign-in profile:
+const char kNotWhitelistedExtensionId[] = "mockepjebcnmhmhcahfddgfcdgkdifnc";
+const char kNotWhitelistedExtensionUpdateManifestPath[] =
     "/extensions/trivial_extension/update_manifest.xml";
 
 // Observer that allows waiting for an installation failure of a specific
@@ -137,8 +142,8 @@
 };
 
 // Returns the initial profile, which is the original profile of the sign-in
-// profile. The apps specified in the policy will be installed into the initial
-// profile, and then become available in both.
+// profile. The apps/extensions specified in the policy will be installed into
+// the initial profile, and then become available in both.
 Profile* GetProfile() {
   // Intentionally not using the |chromeos::ProfileHelper::GetSigninProfile|
   // method here, as it performs the lazy construction of the profile, while for
@@ -154,11 +159,12 @@
 
 namespace {
 
-// Base class for testing sign-in profile apps that are installed via the device
-// policy.
-class SigninProfileAppsPolicyTestBase : public DevicePolicyCrosBrowserTest {
+// Base class for testing sign-in profile apps/extensions that are installed via
+// the device policy.
+class SigninProfileExtensionsPolicyTestBase
+    : public DevicePolicyCrosBrowserTest {
  protected:
-  explicit SigninProfileAppsPolicyTestBase(version_info::Channel channel)
+  explicit SigninProfileExtensionsPolicyTestBase(version_info::Channel channel)
       : channel_(channel), scoped_current_channel_(channel) {}
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
@@ -170,9 +176,9 @@
   void SetUpOnMainThread() override {
     DevicePolicyCrosBrowserTest::SetUpOnMainThread();
 
-    embedded_test_server()->RegisterRequestHandler(
-        base::BindRepeating(&SigninProfileAppsPolicyTestBase::InterceptMockHttp,
-                            base::Unretained(this)));
+    embedded_test_server()->RegisterRequestHandler(base::BindRepeating(
+        &SigninProfileExtensionsPolicyTestBase::InterceptMockHttp,
+        base::Unretained(this)));
     ASSERT_TRUE(embedded_test_server()->Start());
   }
 
@@ -223,83 +229,130 @@
 
   const extensions::ScopedCurrentChannel scoped_current_channel_;
 
-  DISALLOW_COPY_AND_ASSIGN(SigninProfileAppsPolicyTestBase);
+  DISALLOW_COPY_AND_ASSIGN(SigninProfileExtensionsPolicyTestBase);
 };
 
-// Class for testing sign-in profile apps under different browser channels.
-class SigninProfileAppsPolicyPerChannelTest
-    : public SigninProfileAppsPolicyTestBase,
+// Class for testing sign-in profile apps/extensions under different browser
+// channels.
+class SigninProfileExtensionsPolicyPerChannelTest
+    : public SigninProfileExtensionsPolicyTestBase,
       public testing::WithParamInterface<version_info::Channel> {
  protected:
-  SigninProfileAppsPolicyPerChannelTest()
-      : SigninProfileAppsPolicyTestBase(GetParam()) {}
+  SigninProfileExtensionsPolicyPerChannelTest()
+      : SigninProfileExtensionsPolicyTestBase(GetParam()) {}
 
  private:
-  DISALLOW_COPY_AND_ASSIGN(SigninProfileAppsPolicyPerChannelTest);
+  DISALLOW_COPY_AND_ASSIGN(SigninProfileExtensionsPolicyPerChannelTest);
 };
 
 }  // namespace
 
 // Tests that a whitelisted app gets installed on any browser channel.
-IN_PROC_BROWSER_TEST_P(SigninProfileAppsPolicyPerChannelTest,
+IN_PROC_BROWSER_TEST_P(SigninProfileExtensionsPolicyPerChannelTest,
                        WhitelistedAppInstallation) {
   extensions::TestExtensionRegistryObserver registry_observer(
-      extensions::ExtensionRegistry::Get(GetProfile()), kManualTestAppId);
+      extensions::ExtensionRegistry::Get(GetProfile()), kWhitelistedAppId);
 
-  AddExtensionForForceInstallation(kManualTestAppId,
-                                   kManualTestAppUpdateManifestPath);
+  AddExtensionForForceInstallation(kWhitelistedAppId,
+                                   kWhitelistedAppUpdateManifestPath);
 
   registry_observer.WaitForExtensionLoaded();
-  EXPECT_TRUE(extensions::ExtensionRegistry::Get(GetProfile())
-                  ->enabled_extensions()
-                  .Contains(kManualTestAppId));
+  const extensions::Extension* extension =
+      extensions::ExtensionRegistry::Get(GetProfile())
+          ->enabled_extensions()
+          .GetByID(kWhitelistedAppId);
+  ASSERT_TRUE(extension);
+  EXPECT_TRUE(extension->is_platform_app());
 }
 
 // Tests that a non-whitelisted app is installed only when on Dev, Canary or
 // "unknown" (trunk) channels, but not on Beta or Stable channels.
-IN_PROC_BROWSER_TEST_P(SigninProfileAppsPolicyPerChannelTest,
+IN_PROC_BROWSER_TEST_P(SigninProfileExtensionsPolicyPerChannelTest,
                        NotWhitelistedAppInstallation) {
   extensions::TestExtensionRegistryObserver registry_observer(
-      extensions::ExtensionRegistry::Get(GetProfile()), kTrivialAppId);
+      extensions::ExtensionRegistry::Get(GetProfile()), kNotWhitelistedAppId);
   ExtensionInstallErrorObserver install_error_observer(GetProfile(),
-                                                       kTrivialAppId);
+                                                       kNotWhitelistedAppId);
 
-  AddExtensionForForceInstallation(kTrivialAppId,
-                                   kTrivialAppUpdateManifestPath);
+  AddExtensionForForceInstallation(kNotWhitelistedAppId,
+                                   kNotWhitelistedUpdateManifestPath);
 
   switch (channel_) {
     case version_info::Channel::UNKNOWN:
     case version_info::Channel::CANARY:
-    case version_info::Channel::DEV:
+    case version_info::Channel::DEV: {
       registry_observer.WaitForExtensionLoaded();
-      EXPECT_TRUE(extensions::ExtensionRegistry::Get(GetProfile())
-                      ->enabled_extensions()
-                      .Contains(kTrivialAppId));
+      const extensions::Extension* extension =
+          extensions::ExtensionRegistry::Get(GetProfile())
+              ->enabled_extensions()
+              .GetByID(kNotWhitelistedAppId);
+      ASSERT_TRUE(extension);
+      EXPECT_TRUE(extension->is_platform_app());
       break;
+    }
     case version_info::Channel::BETA:
-    case version_info::Channel::STABLE:
+    case version_info::Channel::STABLE: {
       install_error_observer.Wait();
       EXPECT_FALSE(extensions::ExtensionRegistry::Get(GetProfile())
-                       ->GetInstalledExtension(kTrivialAppId));
+                       ->GetInstalledExtension(kNotWhitelistedAppId));
       break;
+    }
   }
 }
 
-// Tests that an extension (as opposed to an app) is forbidden from installation
-// regardless of the browser channel.
-IN_PROC_BROWSER_TEST_P(SigninProfileAppsPolicyPerChannelTest,
-                       ExtensionInstallation) {
+// Tests that a whitelisted extension (as opposed to an app) gets installed when
+// on Dev, Canary or "unknown" (trunk) channels, but not on Beta or Stable
+// channels. Force-installed extensions on the sign-in screen should also
+// automatically have the |login_screen_extension| type.
+IN_PROC_BROWSER_TEST_P(SigninProfileExtensionsPolicyPerChannelTest,
+                       WhitelistedExtensionInstallation) {
+  extensions::TestExtensionRegistryObserver registry_observer(
+      extensions::ExtensionRegistry::Get(GetProfile()),
+      kWhitelistedExtensionId);
   ExtensionInstallErrorObserver install_error_observer(GetProfile(),
-                                                       kTrivialExtensionId);
-  AddExtensionForForceInstallation(kTrivialExtensionId,
-                                   kTrivialExtensionUpdateManifestPath);
+                                                       kWhitelistedExtensionId);
+
+  AddExtensionForForceInstallation(kWhitelistedExtensionId,
+                                   kWhitelistedExtensionUpdateManifestPath);
+
+  switch (channel_) {
+    case version_info::Channel::UNKNOWN:
+    case version_info::Channel::CANARY:
+    case version_info::Channel::DEV: {
+      registry_observer.WaitForExtensionLoaded();
+      const extensions::Extension* extension =
+          extensions::ExtensionRegistry::Get(GetProfile())
+              ->enabled_extensions()
+              .GetByID(kWhitelistedExtensionId);
+      ASSERT_TRUE(extension);
+      EXPECT_TRUE(extension->is_login_screen_extension());
+      break;
+    }
+    case version_info::Channel::BETA:
+    case version_info::Channel::STABLE: {
+      install_error_observer.Wait();
+      EXPECT_FALSE(extensions::ExtensionRegistry::Get(GetProfile())
+                       ->GetInstalledExtension(kWhitelistedExtensionId));
+      break;
+    }
+  }
+}
+
+// Tests that a non-whitelisted extension (as opposed to an app) is forbidden
+// from installation regardless of the browser channel.
+IN_PROC_BROWSER_TEST_P(SigninProfileExtensionsPolicyPerChannelTest,
+                       NotWhitelistedExtensionInstallation) {
+  ExtensionInstallErrorObserver install_error_observer(
+      GetProfile(), kNotWhitelistedExtensionId);
+  AddExtensionForForceInstallation(kNotWhitelistedExtensionId,
+                                   kNotWhitelistedExtensionUpdateManifestPath);
   install_error_observer.Wait();
   EXPECT_FALSE(extensions::ExtensionRegistry::Get(GetProfile())
-                   ->GetInstalledExtension(kTrivialExtensionId));
+                   ->GetInstalledExtension(kNotWhitelistedExtensionId));
 }
 
 INSTANTIATE_TEST_SUITE_P(,
-                         SigninProfileAppsPolicyPerChannelTest,
+                         SigninProfileExtensionsPolicyPerChannelTest,
                          testing::Values(version_info::Channel::UNKNOWN,
                                          version_info::Channel::CANARY,
                                          version_info::Channel::DEV,
@@ -308,22 +361,23 @@
 
 namespace {
 
-// Class for testing sign-in profile apps under the "unknown" browser channel,
-// which allows to bypass the troublesome whitelist checks.
-class SigninProfileAppsPolicyTest : public SigninProfileAppsPolicyTestBase {
+// Class for testing sign-in profile apps/extensions under the "unknown" browser
+// channel, which allows to bypass the troublesome whitelist checks.
+class SigninProfileExtensionsPolicyTest
+    : public SigninProfileExtensionsPolicyTestBase {
  protected:
-  SigninProfileAppsPolicyTest()
-      : SigninProfileAppsPolicyTestBase(version_info::Channel::UNKNOWN) {}
+  SigninProfileExtensionsPolicyTest()
+      : SigninProfileExtensionsPolicyTestBase(version_info::Channel::UNKNOWN) {}
 
  private:
-  DISALLOW_COPY_AND_ASSIGN(SigninProfileAppsPolicyTest);
+  DISALLOW_COPY_AND_ASSIGN(SigninProfileExtensionsPolicyTest);
 };
 
 }  // namespace
 
 // Tests that the extension system enables non-standard extensions in the
 // sign-in profile.
-IN_PROC_BROWSER_TEST_F(SigninProfileAppsPolicyTest, ExtensionsEnabled) {
+IN_PROC_BROWSER_TEST_F(SigninProfileExtensionsPolicyTest, ExtensionsEnabled) {
   EXPECT_TRUE(extensions::ExtensionSystem::Get(GetProfile())
                   ->extension_service()
                   ->extensions_enabled());
@@ -331,24 +385,24 @@
 
 // Tests that a background page is created for the installed sign-in profile
 // app.
-IN_PROC_BROWSER_TEST_F(SigninProfileAppsPolicyTest, BackgroundPage) {
-  ExtensionBackgroundPageReadyObserver page_observer(kTrivialAppId);
-  AddExtensionForForceInstallation(kTrivialAppId,
-                                   kTrivialAppUpdateManifestPath);
+IN_PROC_BROWSER_TEST_F(SigninProfileExtensionsPolicyTest, BackgroundPage) {
+  ExtensionBackgroundPageReadyObserver page_observer(kNotWhitelistedAppId);
+  AddExtensionForForceInstallation(kNotWhitelistedAppId,
+                                   kNotWhitelistedUpdateManifestPath);
   page_observer.Wait();
 }
 
 // Tests installation of multiple sign-in profile apps.
-IN_PROC_BROWSER_TEST_F(SigninProfileAppsPolicyTest, MultipleApps) {
+IN_PROC_BROWSER_TEST_F(SigninProfileExtensionsPolicyTest, MultipleApps) {
   extensions::TestExtensionRegistryObserver registry_observer1(
-      extensions::ExtensionRegistry::Get(GetProfile()), kManualTestAppId);
+      extensions::ExtensionRegistry::Get(GetProfile()), kWhitelistedAppId);
   extensions::TestExtensionRegistryObserver registry_observer2(
-      extensions::ExtensionRegistry::Get(GetProfile()), kTrivialAppId);
+      extensions::ExtensionRegistry::Get(GetProfile()), kNotWhitelistedAppId);
 
-  AddExtensionForForceInstallation(kManualTestAppId,
-                                   kManualTestAppUpdateManifestPath);
-  AddExtensionForForceInstallation(kTrivialAppId,
-                                   kTrivialAppUpdateManifestPath);
+  AddExtensionForForceInstallation(kWhitelistedAppId,
+                                   kWhitelistedAppUpdateManifestPath);
+  AddExtensionForForceInstallation(kNotWhitelistedAppId,
+                                   kNotWhitelistedUpdateManifestPath);
 
   registry_observer1.WaitForExtensionLoaded();
   registry_observer2.WaitForExtensionLoaded();
diff --git a/chrome/browser/chromeos/policy/status_collector/device_status_collector.cc b/chrome/browser/chromeos/policy/status_collector/device_status_collector.cc
index 300ee123..b587f855 100644
--- a/chrome/browser/chromeos/policy/status_collector/device_status_collector.cc
+++ b/chrome/browser/chromeos/policy/status_collector/device_status_collector.cc
@@ -622,6 +622,18 @@
         disk_info->set_size(storage.values().size());
       }
     }
+    if (probe_result.value().vpd_cached_size() > 0) {
+      em::SystemStatus* const system_status =
+          response_params_.device_status->mutable_system_status();
+      // vpd_cached values are a repeated field in ProbeResult protobuf,
+      // while logically it should be optional. Using iteration + value checks
+      // just for future-proofing code.
+      for (const auto& vpd_values : probe_result.value().vpd_cached()) {
+        const std::string& sku_number = vpd_values.values().vpd_sku_number();
+        if (!sku_number.empty())
+          system_status->set_vpd_sku_number(sku_number);
+      }
+    }
   }
 
   void OnEMMCLifetimeReceived(const em::DiskLifetimeEstimation& est) {
@@ -1248,6 +1260,7 @@
     request.add_categories(runtime_probe::ProbeRequest::battery);
   if (report_storage_status_)
     request.add_categories(runtime_probe::ProbeRequest::storage);
+  request.add_categories(runtime_probe::ProbeRequest::vpd_cached);
 
   auto sample = std::make_unique<SampledData>();
   sample->timestamp = base::Time::Now();
diff --git a/chrome/browser/chromeos/printing/automatic_usb_printer_configurer.cc b/chrome/browser/chromeos/printing/automatic_usb_printer_configurer.cc
index f0e6526..82f1f4d8 100644
--- a/chrome/browser/chromeos/printing/automatic_usb_printer_configurer.cc
+++ b/chrome/browser/chromeos/printing/automatic_usb_printer_configurer.cc
@@ -97,6 +97,8 @@
     return;
   }
   installation_manager_->PrinterInstalled(printer, true /* is_automatic */);
+  PrinterConfigurer::RecordUsbPrinterSetupSource(
+      UsbPrinterSetupSource::kAutoconfigured);
   CompleteConfiguration(printer);
 }
 
diff --git a/chrome/browser/chromeos/printing/automatic_usb_printer_configurer_unittest.cc b/chrome/browser/chromeos/printing/automatic_usb_printer_configurer_unittest.cc
index d34538da..064bed4 100644
--- a/chrome/browser/chromeos/printing/automatic_usb_printer_configurer_unittest.cc
+++ b/chrome/browser/chromeos/printing/automatic_usb_printer_configurer_unittest.cc
@@ -154,7 +154,7 @@
     open_notifications_.erase(printer_id);
   }
 
-  bool IsNotification(const std::string& printer_id) const override {
+  bool IsNotificationDisplayed(const std::string& printer_id) const override {
     return open_notifications_.contains(printer_id);
   }
 
@@ -310,7 +310,8 @@
 
   fake_observable_printers_manager_.AddNearbyAutomaticPrinter(printer);
 
-  EXPECT_TRUE(fake_notification_controller_->IsNotification(printer_id));
+  EXPECT_TRUE(
+      fake_notification_controller_->IsNotificationDisplayed(printer_id));
 }
 
 TEST_F(AutomaticUsbPrinterConfigurerTest,
@@ -325,7 +326,8 @@
   // result in a notification being shown.
   fake_observable_printers_manager_.AddNearbyAutomaticPrinter(printer);
 
-  EXPECT_TRUE(fake_notification_controller_->IsNotification(printer_id));
+  EXPECT_TRUE(
+      fake_notification_controller_->IsNotificationDisplayed(printer_id));
 }
 
 TEST_F(AutomaticUsbPrinterConfigurerTest, NotificationClosed) {
@@ -334,11 +336,13 @@
 
   fake_observable_printers_manager_.AddNearbyAutomaticPrinter(printer);
 
-  EXPECT_TRUE(fake_notification_controller_->IsNotification(printer_id));
+  EXPECT_TRUE(
+      fake_notification_controller_->IsNotificationDisplayed(printer_id));
 
   fake_observable_printers_manager_.RemoveAutomaticPrinter(printer_id);
 
-  EXPECT_FALSE(fake_notification_controller_->IsNotification(printer_id));
+  EXPECT_FALSE(
+      fake_notification_controller_->IsNotificationDisplayed(printer_id));
 }
 
 TEST_F(AutomaticUsbPrinterConfigurerTest, NotificationOpenedForNewDiscovered) {
@@ -347,7 +351,8 @@
 
   fake_observable_printers_manager_.AddNearbyAutomaticPrinter(printer);
 
-  EXPECT_TRUE(fake_notification_controller_->IsNotification(printer_id));
+  EXPECT_TRUE(
+      fake_notification_controller_->IsNotificationDisplayed(printer_id));
 }
 
 }  // namespace chromeos
diff --git a/chrome/browser/chromeos/printing/cups_printers_manager_unittest.cc b/chrome/browser/chromeos/printing/cups_printers_manager_unittest.cc
index 4b65ae9b..fbef3bf8 100644
--- a/chrome/browser/chromeos/printing/cups_printers_manager_unittest.cc
+++ b/chrome/browser/chromeos/printing/cups_printers_manager_unittest.cc
@@ -316,7 +316,7 @@
     saved_notifications_.erase(printer_id);
     configuration_notifications_.erase(printer_id);
   }
-  bool IsNotification(const std::string& printer_id) const override {
+  bool IsNotificationDisplayed(const std::string& printer_id) const override {
     return configuration_notifications_.contains(printer_id) ||
            saved_notifications_.contains(printer_id);
   }
diff --git a/chrome/browser/chromeos/printing/printer_configurer.h b/chrome/browser/chromeos/printing/printer_configurer.h
index 13f7f3b..600d0c18 100644
--- a/chrome/browser/chromeos/printing/printer_configurer.h
+++ b/chrome/browser/chromeos/printing/printer_configurer.h
@@ -48,9 +48,10 @@
 // enums must never be renumbered or deleted and reused.
 // Records the source of a successful USB printer setup.
 enum class UsbPrinterSetupSource {
-  kSettings = 0,      // USB printer installed via Settings.
-  kPrintPreview = 1,  // USB printer installed via Print Preview.
-  kMaxValue = kPrintPreview,
+  kSettings = 0,        // USB printer installed via Settings.
+  kPrintPreview = 1,    // USB printer installed via Print Preview.
+  kAutoconfigured = 2,  // USB printer installed automatically.
+  kMaxValue = kAutoconfigured,
 };
 
 using PrinterSetupCallback = base::OnceCallback<void(PrinterSetupResult)>;
diff --git a/chrome/browser/chromeos/printing/usb_printer_notification_controller.cc b/chrome/browser/chromeos/printing/usb_printer_notification_controller.cc
index 5b55bb2..9cb3042d 100644
--- a/chrome/browser/chromeos/printing/usb_printer_notification_controller.cc
+++ b/chrome/browser/chromeos/printing/usb_printer_notification_controller.cc
@@ -30,7 +30,7 @@
     notifications_.erase(printer_id);
   }
 
-  bool IsNotification(const std::string& printer_id) const override {
+  bool IsNotificationDisplayed(const std::string& printer_id) const override {
     return base::ContainsKey(notifications_, printer_id);
   }
 
diff --git a/chrome/browser/chromeos/printing/usb_printer_notification_controller.h b/chrome/browser/chromeos/printing/usb_printer_notification_controller.h
index 776c0f9..8c70a860 100644
--- a/chrome/browser/chromeos/printing/usb_printer_notification_controller.h
+++ b/chrome/browser/chromeos/printing/usb_printer_notification_controller.h
@@ -42,7 +42,7 @@
   virtual void RemoveNotification(const std::string& printer_id) = 0;
 
   // Returns true if there is an existing notification for |printer_id|.
-  virtual bool IsNotification(const std::string& printer_id) const = 0;
+  virtual bool IsNotificationDisplayed(const std::string& printer_id) const = 0;
 
  protected:
   UsbPrinterNotificationController() = default;
diff --git a/chrome/browser/chromeos/shutdown_policy_browsertest.cc b/chrome/browser/chromeos/shutdown_policy_browsertest.cc
index b498042..185b4223 100644
--- a/chrome/browser/chromeos/shutdown_policy_browsertest.cc
+++ b/chrome/browser/chromeos/shutdown_policy_browsertest.cc
@@ -8,9 +8,7 @@
 #include "ash/login_status.h"
 #include "ash/public/cpp/ash_switches.h"
 #include "ash/public/cpp/ash_view_ids.h"
-#include "ash/public/interfaces/constants.mojom.h"
-#include "ash/public/interfaces/system_tray_test_api.test-mojom-test-utils.h"
-#include "ash/public/interfaces/system_tray_test_api.test-mojom.h"
+#include "ash/public/cpp/system_tray_test_api.h"
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/location.h"
@@ -37,10 +35,8 @@
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_ui.h"
-#include "content/public/common/service_manager_connection.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/test_utils.h"
-#include "services/service_manager/public/cpp/connector.h"
 #include "ui/compositor/scoped_animation_duration_scale_mode.h"
 #include "ui/views/view.h"
 
@@ -64,10 +60,7 @@
   // policy::DevicePolicyCrosBrowserTest:
   void SetUpOnMainThread() override {
     policy::DevicePolicyCrosBrowserTest::SetUpOnMainThread();
-    // Connect to the ash test interface.
-    content::ServiceManagerConnection::GetForProcess()
-        ->GetConnector()
-        ->BindInterface(ash::mojom::kServiceName, &tray_test_api_);
+    tray_test_api_ = ash::SystemTrayTestApi::Create();
   }
 
   // Updates the device shutdown policy and sets it to |reboot_on_shutdown|.
@@ -101,7 +94,7 @@
 
   bool result_;
   std::unique_ptr<base::RunLoop> run_loop_;
-  ash::mojom::SystemTrayTestApiPtr tray_test_api_;
+  std::unique_ptr<ash::SystemTrayTestApi> tray_test_api_;
 };
 
 class ShutdownPolicyInSessionTest
@@ -111,23 +104,15 @@
   ~ShutdownPolicyInSessionTest() override {}
 
   // Opens the system tray menu. This creates the tray views.
-  void OpenSystemTrayMenu() {
-    ash::mojom::SystemTrayTestApiAsyncWaiter wait_for(tray_test_api_.get());
-    wait_for.ShowBubble();
-  }
+  void OpenSystemTrayMenu() { tray_test_api_->ShowBubble(); }
 
   // Closes the system tray menu. This deletes the tray views.
-  void CloseSystemTrayMenu() {
-    ash::mojom::SystemTrayTestApiAsyncWaiter wait_for(tray_test_api_.get());
-    wait_for.CloseBubble();
-  }
+  void CloseSystemTrayMenu() { tray_test_api_->CloseBubble(); }
 
-  // Returns true if the shutdown button's tooltip matches the text of the
-  // resource |message_id|.
+  // Returns true if the shutdown button's tooltip matches |tooltip|.
   bool HasShutdownButtonTooltip(const std::string& tooltip) {
-    ash::mojom::SystemTrayTestApiAsyncWaiter wait_for(tray_test_api_.get());
-    base::string16 actual_tooltip;
-    wait_for.GetBubbleViewTooltip(ash::VIEW_ID_POWER_BUTTON, &actual_tooltip);
+    base::string16 actual_tooltip =
+        tray_test_api_->GetBubbleViewTooltip(ash::VIEW_ID_POWER_BUTTON);
     return base::UTF8ToUTF16(tooltip) == actual_tooltip;
   }
 
diff --git a/chrome/browser/chromeos/smb_client/smb_service.cc b/chrome/browser/chromeos/smb_client/smb_service.cc
index ffa6d01..3421132 100644
--- a/chrome/browser/chromeos/smb_client/smb_service.cc
+++ b/chrome/browser/chromeos/smb_client/smb_service.cc
@@ -464,8 +464,12 @@
 }
 
 void SmbService::Premount(const base::FilePath& share_path) {
-  GetSmbProviderClient()->Premount(
-      share_path, IsNTLMAuthenticationEnabled(),
+  // Premounting is equivalent to remounting, but with an empty username and
+  // password.
+  GetSmbProviderClient()->Mount(
+      share_path, IsNTLMAuthenticationEnabled(), "", "",
+      temp_file_manager_->WritePasswordToFile("" /* password */),
+      true /* skip_connect */,
       base::BindOnce(&SmbService::OnPremountResponse, AsWeakPtr(), share_path));
 }
 
diff --git a/chrome/browser/chromeos/smb_client/smb_service_unittest.cc b/chrome/browser/chromeos/smb_client/smb_service_unittest.cc
index 45b8eae..c7b5714 100644
--- a/chrome/browser/chromeos/smb_client/smb_service_unittest.cc
+++ b/chrome/browser/chromeos/smb_client/smb_service_unittest.cc
@@ -10,6 +10,7 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/json/json_reader.h"
 #include "base/run_loop.h"
 #include "base/test/simple_test_tick_clock.h"
 #include "base/threading/thread_task_runner_handle.h"
@@ -20,6 +21,7 @@
 #include "chrome/browser/chromeos/file_system_provider/service.h"
 #include "chrome/browser/chromeos/login/users/fake_chrome_user_manager.h"
 #include "chrome/browser/chromeos/smb_client/smb_file_system_id.h"
+#include "chrome/common/pref_names.h"
 #include "chrome/test/base/testing_browser_process.h"
 #include "chrome/test/base/testing_profile.h"
 #include "chrome/test/base/testing_profile_manager.h"
@@ -250,5 +252,32 @@
   EXPECT_TRUE(testing::Mock::VerifyAndClearExpectations(mock_client_));
 }
 
+TEST_F(SmbServiceTest, Premount) {
+  const char kPremountPath[] = "smb://server/foobar";
+  const char kPreconfiguredShares[] =
+      "[{\"mode\":\"pre_mount\",\"share_url\":\"\\\\\\\\server\\\\foobar\"}]";
+  auto parsed_shares = base::JSONReader::Read(kPreconfiguredShares);
+  ASSERT_TRUE(parsed_shares);
+  profile_->GetPrefs()->Set(prefs::kNetworkFileSharesPreconfiguredShares,
+                            *parsed_shares);
+
+  base::RunLoop run_loop;
+  EXPECT_CALL(*mock_client_, Mount(base::FilePath(kPremountPath), _, "", "", _,
+                                   true /* skip_connect */, _))
+      .WillOnce(WithArg<6>(
+          Invoke([&run_loop](SmbProviderClient::MountCallback callback) {
+            std::move(callback).Run(smbprovider::ErrorType::ERROR_OK, 7);
+            run_loop.Quit();
+          })));
+
+  CreateFspRegistry(profile_);
+  CreateService(profile_);
+  run_loop.Run();
+
+  // Because the mock is potentially leaked, expectations needs to be manually
+  // verified.
+  EXPECT_TRUE(testing::Mock::VerifyAndClearExpectations(mock_client_));
+}
+
 }  // namespace smb_client
 }  // namespace chromeos
diff --git a/chrome/browser/chromeos/system/tray_accessibility_browsertest.cc b/chrome/browser/chromeos/system/tray_accessibility_browsertest.cc
index d7e515e6..593251a 100644
--- a/chrome/browser/chromeos/system/tray_accessibility_browsertest.cc
+++ b/chrome/browser/chromeos/system/tray_accessibility_browsertest.cc
@@ -4,8 +4,7 @@
 
 #include "ash/public/cpp/ash_pref_names.h"
 #include "ash/public/cpp/ash_view_ids.h"
-#include "ash/public/interfaces/system_tray_test_api.test-mojom-test-utils.h"
-#include "ash/public/interfaces/system_tray_test_api.test-mojom.h"
+#include "ash/public/cpp/system_tray_test_api.h"
 #include "base/callback.h"
 #include "base/command_line.h"
 #include "base/run_loop.h"
@@ -31,9 +30,7 @@
 #include "components/prefs/pref_service.h"
 #include "components/session_manager/core/session_manager.h"
 #include "components/user_manager/user_manager.h"
-#include "content/public/common/service_manager_connection.h"
 #include "content/public/test/test_utils.h"
-#include "services/service_manager/public/cpp/connector.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/compositor/scoped_animation_duration_scale_mode.h"
 #include "ui/views/controls/button/button.h"
@@ -133,18 +130,10 @@
   // The profile which should be used by these tests.
   Profile* GetProfile() { return ProfileManager::GetActiveUserProfile(); }
 
-  // Connect / reconnect to SystemTrayTestApi.
-  void BindTestApi() {
-    tray_test_api_.reset();
-    content::ServiceManagerConnection::GetForProcess()
-        ->GetConnector()
-        ->BindInterface(ash::mojom::kServiceName, &tray_test_api_);
-  }
-
   // InProcessBrowserTest:
   void SetUpOnMainThread() override {
     InProcessBrowserTest::SetUpOnMainThread();
-    BindTestApi();
+    tray_test_api_ = ash::SystemTrayTestApi::Create();
   }
 
   void SetUpInProcessBrowserTestFixture() override {
@@ -174,45 +163,32 @@
   }
 
   bool IsMenuButtonVisible() {
-    ash::mojom::SystemTrayTestApiAsyncWaiter wait_for(tray_test_api_.get());
-    bool visible = false;
-    wait_for.IsBubbleViewVisible(ash::VIEW_ID_ACCESSIBILITY_TRAY_ITEM,
-                                 true /* open_tray */, &visible);
-    wait_for.CloseBubble();
+    bool visible = tray_test_api_->IsBubbleViewVisible(
+        ash::VIEW_ID_ACCESSIBILITY_TRAY_ITEM, true /* open_tray */);
+    tray_test_api_->CloseBubble();
     return visible;
   }
 
-  void CreateDetailedMenu() {
-    ash::mojom::SystemTrayTestApiAsyncWaiter wait_for(tray_test_api_.get());
-    wait_for.ShowDetailedView(ash::mojom::TrayItem::kAccessibility);
-  }
+  void CreateDetailedMenu() { tray_test_api_->ShowAccessibilityDetailedView(); }
 
-  bool IsBubbleOpen() {
-    ash::mojom::SystemTrayTestApiAsyncWaiter wait_for(tray_test_api_.get());
-    bool is_open = false;
-    wait_for.IsTrayBubbleOpen(&is_open);
-    return is_open;
-  }
+  bool IsBubbleOpen() { return tray_test_api_->IsTrayBubbleOpen(); }
 
   void ClickVirtualKeyboardOnDetailMenu() {
-    ash::mojom::SystemTrayTestApiAsyncWaiter wait_for(tray_test_api_.get());
-    wait_for.ClickBubbleView(ash::VIEW_ID_ACCESSIBILITY_VIRTUAL_KEYBOARD);
+    tray_test_api_->ClickBubbleView(
+        ash::VIEW_ID_ACCESSIBILITY_VIRTUAL_KEYBOARD);
   }
 
   bool IsVirtualKeyboardEnabledOnDetailMenu() const {
-    ash::mojom::SystemTrayTestApiAsyncWaiter wait_for(tray_test_api_.get());
-    bool visible = false;
-    wait_for.IsBubbleViewVisible(
+    return tray_test_api_->IsBubbleViewVisible(
         ash::VIEW_ID_ACCESSIBILITY_VIRTUAL_KEYBOARD_ENABLED,
-        false /* open_tray */, &visible);
-    return visible;
+        false /* open_tray */);
   }
 
   // Disable animations so that tray icons hide immediately.
   ui::ScopedAnimationDurationScaleMode disable_animations_;
 
   policy::MockConfigurationPolicyProvider provider_;
-  ash::mojom::SystemTrayTestApiPtr tray_test_api_;
+  std::unique_ptr<ash::SystemTrayTestApi> tray_test_api_;
 };
 
 IN_PROC_BROWSER_TEST_P(TrayAccessibilityTest, ShowMenu) {
@@ -485,8 +461,9 @@
 
   // Locks the screen.
   SessionControllerClientImpl::Get()->RequestLockScreen();
-  // Resets binding because UnifiedSystemTray is recreated.
-  BindTestApi();
+
+  // Resets the test API because UnifiedSystemTray is recreated.
+  tray_test_api_ = ash::SystemTrayTestApi::Create();
   EXPECT_TRUE(IsMenuButtonVisible());
 
   // Disables high contrast mode.
diff --git a/chrome/browser/component_updater/sw_reporter_installer_win.h b/chrome/browser/component_updater/sw_reporter_installer_win.h
index dfe1859..1c1475ea 100644
--- a/chrome/browser/component_updater/sw_reporter_installer_win.h
+++ b/chrome/browser/component_updater/sw_reporter_installer_win.h
@@ -12,7 +12,7 @@
 
 #include "base/callback.h"
 #include "base/macros.h"
-#include "chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_win.h"
+#include "chrome/browser/safe_browsing/chrome_cleaner/sw_reporter_invocation_win.h"
 #include "components/component_updater/component_installer.h"
 #include "components/component_updater/component_updater_service.h"
 
diff --git a/chrome/browser/content_settings/host_content_settings_map_factory.cc b/chrome/browser/content_settings/host_content_settings_map_factory.cc
index 87ac06d4..f82e1aa 100644
--- a/chrome/browser/content_settings/host_content_settings_map_factory.cc
+++ b/chrome/browser/content_settings/host_content_settings_map_factory.cc
@@ -77,12 +77,14 @@
   // profile in order to ensure the preferences have been migrated.
   // TODO(crbug.com/277296): Remove check that profile does not equal the
   // original profile once TestingProfile::ForceIncognito is gone.
-  if (profile->IsIncognito() && profile != profile->GetOriginalProfile()) {
+  if (profile->IsIncognitoProfile() &&
+      profile != profile->GetOriginalProfile()) {
     GetForProfile(profile->GetOriginalProfile());
   }
 
   scoped_refptr<HostContentSettingsMap> settings_map(new HostContentSettingsMap(
-      profile->GetPrefs(), profile->IsIncognito(), profile->IsGuestProfile(),
+      profile->GetPrefs(), profile->IsIncognitoProfile(),
+      profile->IsGuestProfile(),
       /*store_last_modified=*/true,
       base::FeatureList::IsEnabled(features::kPermissionDelegation)));
 
diff --git a/chrome/browser/devtools/devtools_window.cc b/chrome/browser/devtools/devtools_window.cc
index 3620018..f992182 100644
--- a/chrome/browser/devtools/devtools_window.cc
+++ b/chrome/browser/devtools/devtools_window.cc
@@ -22,6 +22,7 @@
 #include "chrome/browser/devtools/devtools_eye_dropper.h"
 #include "chrome/browser/file_select_helper.h"
 #include "chrome/browser/infobars/infobar_service.h"
+#include "chrome/browser/performance_manager/performance_manager_tab_helper.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/sessions/session_tab_helper.h"
 #include "chrome/browser/task_manager/web_contents_tags.h"
@@ -943,6 +944,8 @@
   zoom::ZoomController::CreateForWebContents(main_web_contents_);
   zoom::ZoomController::FromWebContents(main_web_contents_)
       ->SetShowsNotificationBubble(false);
+  performance_manager::PerformanceManagerTabHelper::CreateForWebContents(
+      main_web_contents_);
 
   g_devtools_window_instances.Get().push_back(this);
 
@@ -1018,6 +1021,7 @@
       ui::PAGE_TRANSITION_AUTO_TOPLEVEL, std::string());
   DevToolsUIBindings* bindings =
       DevToolsUIBindings::ForWebContents(main_web_contents.get());
+
   if (!bindings)
     return nullptr;
   if (!settings.empty())
diff --git a/chrome/browser/download/download_core_service_impl.cc b/chrome/browser/download/download_core_service_impl.cc
index 76a70c88..7da36b6b 100644
--- a/chrome/browser/download/download_core_service_impl.cc
+++ b/chrome/browser/download/download_core_service_impl.cc
@@ -75,7 +75,7 @@
   }
 
   auto* download_provider = CreateDownloadOfflineContentProvider();
-  download_provider->SetDownloadManager(manager);
+  download_provider->SetSimpleDownloadManagerCoordinator(coordinator);
 
   // Pass an empty delegate when constructing the DownloadUIController. The
   // default delegate does all the notifications we need.
diff --git a/chrome/browser/download/download_offline_content_provider.cc b/chrome/browser/download/download_offline_content_provider.cc
index eac5366..a6eb0ac 100644
--- a/chrome/browser/download/download_offline_content_provider.cc
+++ b/chrome/browser/download/download_offline_content_provider.cc
@@ -77,8 +77,8 @@
     manager_->RemoveObserver(this);
 }
 
-void DownloadOfflineContentProvider::SetDownloadManager(
-    DownloadManager* manager) {
+void DownloadOfflineContentProvider::SetSimpleDownloadManagerCoordinator(
+    SimpleDownloadManagerCoordinator* manager) {
   DCHECK(manager);
   manager_ = manager;
   manager_->AddObserver(this);
@@ -133,7 +133,7 @@
 
 void DownloadOfflineContentProvider::GetAllItems(
     OfflineContentProvider::MultipleItemCallback callback) {
-  DownloadManager::DownloadVector all_items;
+  std::vector<DownloadItem*> all_items;
   GetAllDownloads(&all_items);
 
   std::vector<OfflineItem> items;
@@ -236,9 +236,8 @@
   observers_.RemoveObserver(observer);
 }
 
-void DownloadOfflineContentProvider::ManagerGoingDown(
-    DownloadManager* manager) {
-  DownloadManager::DownloadVector all_items;
+void DownloadOfflineContentProvider::OnManagerGoingDown() {
+  std::vector<DownloadItem*> all_items;
   GetAllDownloads(&all_items);
 
   for (auto* item : all_items) {
@@ -322,7 +321,7 @@
 }
 
 void DownloadOfflineContentProvider::GetAllDownloads(
-    DownloadManager::DownloadVector* all_items) {
+    std::vector<DownloadItem*>* all_items) {
   if (manager_)
     manager_->GetAllDownloads(all_items);
 }
diff --git a/chrome/browser/download/download_offline_content_provider.h b/chrome/browser/download/download_offline_content_provider.h
index 2ae6bd68..def5391 100644
--- a/chrome/browser/download/download_offline_content_provider.h
+++ b/chrome/browser/download/download_offline_content_provider.h
@@ -7,15 +7,17 @@
 
 #include <memory>
 #include <set>
+#include <vector>
 
 #include "base/macros.h"
 #include "components/download/public/common/download_item.h"
+#include "components/download/public/common/simple_download_manager_coordinator.h"
 #include "components/offline_items_collection/core/offline_content_aggregator.h"
 #include "components/offline_items_collection/core/offline_content_provider.h"
-#include "content/public/browser/download_manager.h"
 
 using DownloadItem = download::DownloadItem;
-using DownloadManager = content::DownloadManager;
+using SimpleDownloadManagerCoordinator =
+    download::SimpleDownloadManagerCoordinator;
 using ContentId = offline_items_collection::ContentId;
 using OfflineItem = offline_items_collection::OfflineItem;
 using OfflineContentProvider = offline_items_collection::OfflineContentProvider;
@@ -26,18 +28,20 @@
 class SkBitmap;
 
 // This class handles the task of observing the downloads associated with a
-// single DownloadManager (or in-progress download manager in service manager
-// only mode) and notifies UI about updates about various downloads.
-class DownloadOfflineContentProvider : public OfflineContentProvider,
-                                       public download::DownloadItem::Observer,
-                                       public DownloadManager::Observer {
+// SimpleDownloadManagerCoordinator and notifies UI about updates about various
+// downloads.
+class DownloadOfflineContentProvider
+    : public OfflineContentProvider,
+      public DownloadItem::Observer,
+      public SimpleDownloadManagerCoordinator::Observer {
  public:
   explicit DownloadOfflineContentProvider(OfflineContentAggregator* aggregator,
                                           const std::string& name_space);
   ~DownloadOfflineContentProvider() override;
 
   // Should be called when a DownloadManager is available.
-  void SetDownloadManager(DownloadManager* manager);
+  void SetSimpleDownloadManagerCoordinator(
+      SimpleDownloadManagerCoordinator* manager);
 
   // OfflineContentProvider implmentation.
   void OpenItem(LaunchLocation location, const ContentId& id) override;
@@ -73,10 +77,10 @@
   void OnDownloadRemoved(DownloadItem* item) override;
   void OnDownloadDestroyed(DownloadItem* download) override;
 
-  // DownloadManager::Observer overrides
-  void ManagerGoingDown(DownloadManager* manager) override;
+  // SimpleDownloadManagerCoordinator::Observer overrides
+  void OnManagerGoingDown() override;
 
-  void GetAllDownloads(DownloadManager::DownloadVector* all_items);
+  void GetAllDownloads(std::vector<DownloadItem*>* all_items);
   DownloadItem* GetDownload(const std::string& download_guid);
   void OnThumbnailRetrieved(const ContentId& id,
                             VisualsCallback callback,
@@ -90,7 +94,7 @@
   base::ObserverList<OfflineContentProvider::Observer>::Unchecked observers_;
   OfflineContentAggregator* aggregator_;
   std::string name_space_;
-  DownloadManager* manager_;
+  SimpleDownloadManagerCoordinator* manager_;
   std::set<std::string> completed_downloads_;
 
   base::WeakPtrFactory<DownloadOfflineContentProvider> weak_ptr_factory_;
diff --git a/chrome/browser/extensions/api/tabs/tabs_api.cc b/chrome/browser/extensions/api/tabs/tabs_api.cc
index b913acdc..bb3a4f05 100644
--- a/chrome/browser/extensions/api/tabs/tabs_api.cc
+++ b/chrome/browser/extensions/api/tabs/tabs_api.cc
@@ -1249,7 +1249,7 @@
   // Navigate the tab to a new location if the url is different.
   if (params->update_properties.url.get()) {
     std::string updated_url = *params->update_properties.url;
-    if (browser->profile()->IsIncognito() &&
+    if (browser->profile()->IsIncognitoProfile() &&
         !IsURLAllowedInIncognito(GURL(updated_url), browser->profile())) {
       return RespondNow(Error(ErrorUtils::FormatErrorMessage(
           tabs_constants::kURLsNotAllowedInIncognitoError, updated_url)));
diff --git a/chrome/browser/extensions/bookmark_app_experimental_navigation_throttle.cc b/chrome/browser/extensions/bookmark_app_experimental_navigation_throttle.cc
index 441b37b..10a5070 100644
--- a/chrome/browser/extensions/bookmark_app_experimental_navigation_throttle.cc
+++ b/chrome/browser/extensions/bookmark_app_experimental_navigation_throttle.cc
@@ -148,7 +148,7 @@
   content::BrowserContext* browser_context =
       navigation_handle->GetWebContents()->GetBrowserContext();
   Profile* profile = Profile::FromBrowserContext(browser_context);
-  if (profile->IsIncognito()) {
+  if (profile->IsIncognitoProfile()) {
     DVLOG(1) << "Don't intercept: Navigation is in incognito.";
     return nullptr;
   }
diff --git a/chrome/browser/extensions/bookmark_app_navigation_throttle.cc b/chrome/browser/extensions/bookmark_app_navigation_throttle.cc
index c1285a7..d4d7454 100644
--- a/chrome/browser/extensions/bookmark_app_navigation_throttle.cc
+++ b/chrome/browser/extensions/bookmark_app_navigation_throttle.cc
@@ -40,7 +40,7 @@
   content::BrowserContext* browser_context =
       navigation_handle->GetWebContents()->GetBrowserContext();
   Profile* profile = Profile::FromBrowserContext(browser_context);
-  if (profile->IsIncognito()) {
+  if (profile->IsIncognitoProfile()) {
     DVLOG(1) << "Don't intercept: Navigation is in incognito.";
     return nullptr;
   }
diff --git a/chrome/browser/extensions/extension_management_internal.cc b/chrome/browser/extensions/extension_management_internal.cc
index 3c8436a5..c6ee887 100644
--- a/chrome/browser/extensions/extension_management_internal.cc
+++ b/chrome/browser/extensions/extension_management_internal.cc
@@ -33,7 +33,7 @@
 IndividualSettings::IndividualSettings(
     const IndividualSettings* default_settings) {
   installation_mode = default_settings->installation_mode;
-  update_url = default_settings->installation_mode;
+  update_url = default_settings->update_url;
   blocked_permissions = default_settings->blocked_permissions.Clone();
   // We are not initializing |minimum_version_required| from |default_settings|
   // here since it's not applicable to default settings.
diff --git a/chrome/browser/extensions/extension_management_internal.h b/chrome/browser/extensions/extension_management_internal.h
index 4dafdb3a..bf3295c 100644
--- a/chrome/browser/extensions/extension_management_internal.h
+++ b/chrome/browser/extensions/extension_management_internal.h
@@ -4,6 +4,7 @@
 #ifndef CHROME_BROWSER_EXTENSIONS_EXTENSION_MANAGEMENT_INTERNAL_H_
 #define CHROME_BROWSER_EXTENSIONS_EXTENSION_MANAGEMENT_INTERNAL_H_
 
+#include <memory>
 #include <string>
 #include <vector>
 
diff --git a/chrome/browser/extensions/extension_web_ui.cc b/chrome/browser/extensions/extension_web_ui.cc
index 97a7282..7e5d418 100644
--- a/chrome/browser/extensions/extension_web_ui.cc
+++ b/chrome/browser/extensions/extension_web_ui.cc
@@ -255,11 +255,9 @@
 
 // Run favicon callback with image result. If no favicon was available then
 // |image| will be empty.
-void RunFaviconCallbackAsync(
-    const favicon_base::FaviconResultsCallback& callback,
-    const gfx::Image& image) {
-  std::vector<favicon_base::FaviconRawBitmapResult>* favicon_bitmap_results =
-      new std::vector<favicon_base::FaviconRawBitmapResult>();
+void RunFaviconCallbackAsync(favicon_base::FaviconResultsCallback callback,
+                             const gfx::Image& image) {
+  std::vector<favicon_base::FaviconRawBitmapResult> favicon_bitmap_results;
 
   const std::vector<gfx::ImageSkiaRep>& image_reps =
       image.AsImageSkia().image_reps();
@@ -276,7 +274,7 @@
       // Leave |bitmap_result|'s icon URL as the default of GURL().
       bitmap_result.icon_type = favicon_base::IconType::kFavicon;
 
-      favicon_bitmap_results->push_back(bitmap_result);
+      favicon_bitmap_results.push_back(bitmap_result);
     } else {
       NOTREACHED() << "Could not encode extension favicon";
     }
@@ -284,8 +282,7 @@
 
   base::ThreadTaskRunnerHandle::Get()->PostTask(
       FROM_HERE,
-      base::BindOnce(&favicon::FaviconService::FaviconResultsCallbackRunner,
-                     callback, base::Owned(favicon_bitmap_results)));
+      base::BindOnce(std::move(callback), std::move(favicon_bitmap_results)));
 }
 
 bool ValidateOverrideURL(const base::Value* override_url_value,
@@ -518,11 +515,11 @@
 void ExtensionWebUI::GetFaviconForURL(
     Profile* profile,
     const GURL& page_url,
-    const favicon_base::FaviconResultsCallback& callback) {
+    favicon_base::FaviconResultsCallback callback) {
   const Extension* extension = extensions::ExtensionRegistry::Get(
       profile)->enabled_extensions().GetByID(page_url.host());
   if (!extension) {
-    RunFaviconCallbackAsync(callback, gfx::Image());
+    RunFaviconCallbackAsync(std::move(callback), gfx::Image());
     return;
   }
 
@@ -562,12 +559,12 @@
       placeholder_skia.GetRepresentation(
           ui::GetScaleForScaleFactor(scale_factor));
     }
-    RunFaviconCallbackAsync(callback, gfx::Image(placeholder_skia));
+    RunFaviconCallbackAsync(std::move(callback), gfx::Image(placeholder_skia));
   } else {
     // LoadImagesAsync actually can run callback synchronously. We want to force
     // async.
     extensions::ImageLoader::Get(profile)->LoadImagesAsync(
         extension, info_list,
-        base::BindOnce(&RunFaviconCallbackAsync, callback));
+        base::BindOnce(&RunFaviconCallbackAsync, std::move(callback)));
   }
 }
diff --git a/chrome/browser/extensions/extension_web_ui.h b/chrome/browser/extensions/extension_web_ui.h
index dfa399a..d97d38c 100644
--- a/chrome/browser/extensions/extension_web_ui.h
+++ b/chrome/browser/extensions/extension_web_ui.h
@@ -66,10 +66,9 @@
 
   // Get the favicon for the extension by getting an icon from the manifest.
   // Note. |callback| is always run asynchronously.
-  static void GetFaviconForURL(
-      Profile* profile,
-      const GURL& page_url,
-      const favicon_base::FaviconResultsCallback& callback);
+  static void GetFaviconForURL(Profile* profile,
+                               const GURL& page_url,
+                               favicon_base::FaviconResultsCallback callback);
 
  private:
   // Unregister the specified override, and if it's the currently active one,
diff --git a/chrome/browser/extensions/external_provider_impl.cc b/chrome/browser/extensions/external_provider_impl.cc
index c891532..89839ba 100644
--- a/chrome/browser/extensions/external_provider_impl.cc
+++ b/chrome/browser/extensions/external_provider_impl.cc
@@ -579,17 +579,20 @@
 
 #if defined(OS_CHROMEOS)
   if (chromeos::ProfileHelper::IsSigninProfile(profile)) {
-    // Download apps installed by policy in the login profile. Flags
-    // FROM_WEBSTORE/WAS_INSTALLED_BY_DEFAULT are applied because these apps are
-    // downloaded from the webstore, and we want to treat them as built-in
-    // extensions.
+    // Download extensions/apps installed by policy in the login profile. Flags
+    // FROM_WEBSTORE/WAS_INSTALLED_BY_DEFAULT are applied because these
+    // extension/apps are downloaded from the webstore, and we want to treat
+    // them as built-in extensions. Extensions (not apps) installed through this
+    // path will have type |TYPE_LOGIN_SCREE_EXTENSION| with limited API
+    // capabilities.
     external_loader = new ExternalPolicyLoader(
         ExtensionManagementFactory::GetForBrowserContext(profile),
         ExternalPolicyLoader::FORCED);
     auto signin_profile_provider = std::make_unique<ExternalProviderImpl>(
         service, external_loader, profile, crx_location,
         Manifest::EXTERNAL_POLICY_DOWNLOAD,
-        Extension::FROM_WEBSTORE | Extension::WAS_INSTALLED_BY_DEFAULT);
+        Extension::FROM_WEBSTORE | Extension::WAS_INSTALLED_BY_DEFAULT |
+            Extension::FOR_LOGIN_SCREEN);
     signin_profile_provider->set_allow_updates(true);
     provider_list->push_back(std::move(signin_profile_provider));
     return;
diff --git a/chrome/browser/extensions/standard_management_policy_provider.cc b/chrome/browser/extensions/standard_management_policy_provider.cc
index 99cc3d5..775f131 100644
--- a/chrome/browser/extensions/standard_management_policy_provider.cc
+++ b/chrome/browser/extensions/standard_management_policy_provider.cc
@@ -108,7 +108,8 @@
     case Manifest::TYPE_HOSTED_APP:
     case Manifest::TYPE_LEGACY_PACKAGED_APP:
     case Manifest::TYPE_PLATFORM_APP:
-    case Manifest::TYPE_SHARED_MODULE: {
+    case Manifest::TYPE_SHARED_MODULE:
+    case Manifest::TYPE_LOGIN_SCREEN_EXTENSION: {
       if (!settings_->IsAllowedManifestType(extension->GetType(),
                                             extension->id()))
         return ReturnLoadError(extension, error);
diff --git a/chrome/browser/extensions/tab_helper.cc b/chrome/browser/extensions/tab_helper.cc
index b05b6997..e54ff28 100644
--- a/chrome/browser/extensions/tab_helper.cc
+++ b/chrome/browser/extensions/tab_helper.cc
@@ -192,17 +192,18 @@
 void TabHelper::FinishCreateBookmarkApp(
     const Extension* extension,
     const WebApplicationInfo& web_app_info) {
-  // Send the 'appinstalled' event and ensure any beforeinstallpromptevent
-  // cannot trigger installation again.
-  if (banners::AppBannerManagerDesktop::IsEnabled() &&
+  const bool success = (extension != nullptr);
+
+  if (success && banners::AppBannerManagerDesktop::IsEnabled() &&
       web_app_info.open_as_window) {
+    // Send the 'appinstalled' event and ensure any beforeinstallpromptevent
+    // cannot trigger installation again.
     banners::AppBannerManagerDesktop::FromWebContents(web_contents())
         ->OnInstall(false /* is_native app */,
                     blink::kWebDisplayModeStandalone);
   }
   pending_web_app_action_ = NONE;
 
-  const bool success = !!extension;
   const ExtensionId app_id = extension ? extension->id() : ExtensionId();
   std::move(install_callback_).Run(app_id, success);
 }
diff --git a/chrome/browser/extensions/webstore_data_fetcher.cc b/chrome/browser/extensions/webstore_data_fetcher.cc
index 558b721..7b9f00d 100644
--- a/chrome/browser/extensions/webstore_data_fetcher.cc
+++ b/chrome/browser/extensions/webstore_data_fetcher.cc
@@ -98,16 +98,14 @@
                      base::Unretained(this)));
 }
 
-void WebstoreDataFetcher::OnJsonParseSuccess(
-    std::unique_ptr<base::Value> parsed_json) {
-  if (!parsed_json->is_dict()) {
+void WebstoreDataFetcher::OnJsonParseSuccess(base::Value parsed_json) {
+  if (!parsed_json.is_dict()) {
     OnJsonParseFailure(kInvalidWebstoreResponseError);
     return;
   }
 
-  delegate_->OnWebstoreResponseParseSuccess(
-      std::unique_ptr<base::DictionaryValue>(
-          static_cast<base::DictionaryValue*>(parsed_json.release())));
+  delegate_->OnWebstoreResponseParseSuccess(base::DictionaryValue::From(
+      base::Value::ToUniquePtrValue(std::move(parsed_json))));
 }
 
 void WebstoreDataFetcher::OnJsonParseFailure(
diff --git a/chrome/browser/extensions/webstore_data_fetcher.h b/chrome/browser/extensions/webstore_data_fetcher.h
index 1d1edae..d054765 100644
--- a/chrome/browser/extensions/webstore_data_fetcher.h
+++ b/chrome/browser/extensions/webstore_data_fetcher.h
@@ -43,7 +43,7 @@
   }
 
  private:
-  void OnJsonParseSuccess(std::unique_ptr<base::Value> parsed_json);
+  void OnJsonParseSuccess(base::Value parsed_json);
   void OnJsonParseFailure(const std::string& error);
   void OnSimpleLoaderComplete(std::unique_ptr<std::string> response_body);
 
diff --git a/chrome/browser/extensions/webstore_install_helper.cc b/chrome/browser/extensions/webstore_install_helper.cc
index 9cc385b..f5aac8a5 100644
--- a/chrome/browser/extensions/webstore_install_helper.cc
+++ b/chrome/browser/extensions/webstore_install_helper.cc
@@ -110,15 +110,15 @@
   Release();  // Balanced in Start().
 }
 
-void WebstoreInstallHelper::OnJSONParseSucceeded(
-    std::unique_ptr<base::Value> result) {
+void WebstoreInstallHelper::OnJSONParseSucceeded(base::Value result) {
   CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   manifest_parse_complete_ = true;
-  const base::DictionaryValue* value;
-  if (result->GetAsDictionary(&value))
-    parsed_manifest_.reset(value->DeepCopy());
-  else
+  if (result.is_dict()) {
+    parsed_manifest_ = base::DictionaryValue::From(
+        base::Value::ToUniquePtrValue(std::move(result)));
+  } else {
     parse_error_ = Delegate::MANIFEST_ERROR;
+  }
 
   ReportResultsIfComplete();
 }
diff --git a/chrome/browser/extensions/webstore_install_helper.h b/chrome/browser/extensions/webstore_install_helper.h
index 7d77c52..4596edc 100644
--- a/chrome/browser/extensions/webstore_install_helper.h
+++ b/chrome/browser/extensions/webstore_install_helper.h
@@ -78,7 +78,7 @@
   ~WebstoreInstallHelper() override;
 
   // Callbacks for the SafeJsonParser.
-  void OnJSONParseSucceeded(std::unique_ptr<base::Value> result);
+  void OnJSONParseSucceeded(base::Value result);
   void OnJSONParseFailed(const std::string& error_message);
 
   // Implementing the BitmapFetcherDelegate interface.
diff --git a/chrome/browser/favicon/chrome_favicon_client.cc b/chrome/browser/favicon/chrome_favicon_client.cc
index 4f08c2d..ad17140 100644
--- a/chrome/browser/favicon/chrome_favicon_client.cc
+++ b/chrome/browser/favicon/chrome_favicon_client.cc
@@ -16,11 +16,10 @@
 
 void RunFaviconCallbackIfNotCanceled(
     const base::CancelableTaskTracker::IsCanceledCallback& is_canceled_cb,
-    const favicon_base::FaviconResultsCallback& original_callback,
+    favicon_base::FaviconResultsCallback original_callback,
     const std::vector<favicon_base::FaviconRawBitmapResult>& results) {
-  if (!is_canceled_cb.Run()) {
-    original_callback.Run(results);
-  }
+  if (!is_canceled_cb.Run())
+    std::move(original_callback).Run(results);
 }
 
 }  // namespace
@@ -40,7 +39,7 @@
 ChromeFaviconClient::GetFaviconForNativeApplicationURL(
     const GURL& url,
     const std::vector<int>& desired_sizes_in_pixel,
-    const favicon_base::FaviconResultsCallback& callback,
+    favicon_base::FaviconResultsCallback callback,
     base::CancelableTaskTracker* tracker) {
   DCHECK(tracker);
   DCHECK(IsNativeApplicationURL(url));
@@ -50,7 +49,8 @@
   if (task_id != base::CancelableTaskTracker::kBadTaskId) {
     ChromeWebUIControllerFactory::GetInstance()->GetFaviconForURL(
         profile_, url, desired_sizes_in_pixel,
-        base::Bind(&RunFaviconCallbackIfNotCanceled, is_canceled_cb, callback));
+        base::BindOnce(&RunFaviconCallbackIfNotCanceled, is_canceled_cb,
+                       std::move(callback)));
   }
   return task_id;
 }
diff --git a/chrome/browser/favicon/chrome_favicon_client.h b/chrome/browser/favicon/chrome_favicon_client.h
index a7e9de7..24b5898 100644
--- a/chrome/browser/favicon/chrome_favicon_client.h
+++ b/chrome/browser/favicon/chrome_favicon_client.h
@@ -23,7 +23,7 @@
   base::CancelableTaskTracker::TaskId GetFaviconForNativeApplicationURL(
       const GURL& url,
       const std::vector<int>& desired_sizes_in_pixel,
-      const favicon_base::FaviconResultsCallback& callback,
+      favicon_base::FaviconResultsCallback callback,
       base::CancelableTaskTracker* tracker) override;
 
   Profile* profile_;
diff --git a/chrome/browser/flag-metadata.json b/chrome/browser/flag-metadata.json
index 84123e8..a1ac790 100644
--- a/chrome/browser/flag-metadata.json
+++ b/chrome/browser/flag-metadata.json
@@ -2138,11 +2138,6 @@
     "expiry_milestone": 80
   },
   {
-    "name": "language-settings",
-    // "owners": [ "your-team" ],
-    "expiry_milestone": 76
-  },
-  {
     "name": "lcd-text-aa",
     // "owners": [ "your-team" ],
     "expiry_milestone": 76
diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc
index 3812453..732b61c2a 100644
--- a/chrome/browser/flag_descriptions.cc
+++ b/chrome/browser/flag_descriptions.cc
@@ -2255,10 +2255,6 @@
 const char kInterestFeedContentSuggestionsName[] =
     "Interest Feed Content Suggestions";
 
-const char kLanguagesPreferenceName[] = "Language Settings";
-const char kLanguagesPreferenceDescription[] =
-    "Enable this option for Language Settings feature on Android.";
-
 const char kLsdPermissionPromptName[] =
     "Location Settings Dialog Permission Prompt";
 const char kLsdPermissionPromptDescription[] =
diff --git a/chrome/browser/flag_descriptions.h b/chrome/browser/flag_descriptions.h
index 4cf2060..4282207 100644
--- a/chrome/browser/flag_descriptions.h
+++ b/chrome/browser/flag_descriptions.h
@@ -1346,9 +1346,6 @@
 extern const char kInterestFeedContentSuggestionsName[];
 extern const char kInterestFeedContentSuggestionsDescription[];
 
-extern const char kLanguagesPreferenceName[];
-extern const char kLanguagesPreferenceDescription[];
-
 extern const char kLsdPermissionPromptName[];
 extern const char kLsdPermissionPromptDescription[];
 
diff --git a/chrome/browser/history/android/android_history_provider_service.cc b/chrome/browser/history/android/android_history_provider_service.cc
index 77a7890..52f896ad 100644
--- a/chrome/browser/history/android/android_history_provider_service.cc
+++ b/chrome/browser/history/android/android_history_provider_service.cc
@@ -470,10 +470,11 @@
 base::CancelableTaskTracker::TaskId
 AndroidHistoryProviderService::GetLargestRawFaviconForID(
     favicon_base::FaviconID favicon_id,
-    const favicon_base::FaviconRawBitmapCallback& callback,
+    favicon_base::FaviconRawBitmapCallback callback,
     base::CancelableTaskTracker* tracker) {
   favicon::FaviconService* fs = FaviconServiceFactory::GetForProfile(
       profile_, ServiceAccessType::EXPLICIT_ACCESS);
   DCHECK(fs);
-  return fs->GetLargestRawFaviconForID(favicon_id, callback, tracker);
+  return fs->GetLargestRawFaviconForID(favicon_id, std::move(callback),
+                                       tracker);
 }
diff --git a/chrome/browser/history/android/android_history_provider_service.h b/chrome/browser/history/android/android_history_provider_service.h
index 65eff62..8c06ea0 100644
--- a/chrome/browser/history/android/android_history_provider_service.h
+++ b/chrome/browser/history/android/android_history_provider_service.h
@@ -177,7 +177,7 @@
   // the |callback| to return the result.
   base::CancelableTaskTracker::TaskId GetLargestRawFaviconForID(
       favicon_base::FaviconID favicon_id,
-      const favicon_base::FaviconRawBitmapCallback& callback,
+      favicon_base::FaviconRawBitmapCallback callback,
       base::CancelableTaskTracker* tracker);
 
  private:
diff --git a/chrome/browser/history/android/sqlite_cursor.cc b/chrome/browser/history/android/sqlite_cursor.cc
index cb955c8..62d7ab7 100644
--- a/chrome/browser/history/android/sqlite_cursor.cc
+++ b/chrome/browser/history/android/sqlite_cursor.cc
@@ -211,11 +211,11 @@
 
 void SQLiteCursor::GetFaviconForIDInUIThread(
     favicon_base::FaviconID id,
-    const favicon_base::FaviconRawBitmapCallback& callback) {
+    favicon_base::FaviconRawBitmapCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   if (!tracker_.get())
     tracker_.reset(new base::CancelableTaskTracker());
-  service_->GetLargestRawFaviconForID(id, callback, tracker_.get());
+  service_->GetLargestRawFaviconForID(id, std::move(callback), tracker_.get());
 }
 
 void SQLiteCursor::OnFaviconData(
diff --git a/chrome/browser/history/android/sqlite_cursor.h b/chrome/browser/history/android/sqlite_cursor.h
index fc93415..3381f0e 100644
--- a/chrome/browser/history/android/sqlite_cursor.h
+++ b/chrome/browser/history/android/sqlite_cursor.h
@@ -160,7 +160,7 @@
 
   void GetFaviconForIDInUIThread(
       favicon_base::FaviconID id,
-      const favicon_base::FaviconRawBitmapCallback& callback);
+      favicon_base::FaviconRawBitmapCallback callback);
 
   // The callback function of FaviconService::GetLargestRawFaviconForID().
   void OnFaviconData(const favicon_base::FaviconRawBitmapResult& bitmap_result);
diff --git a/chrome/browser/infobars/infobars_browsertest.cc b/chrome/browser/infobars/infobars_browsertest.cc
index d14243c..8afe0ed8 100644
--- a/chrome/browser/infobars/infobars_browsertest.cc
+++ b/chrome/browser/infobars/infobars_browsertest.cc
@@ -37,6 +37,7 @@
 #include "chrome/browser/ui/chrome_select_file_policy.h"
 #include "chrome/browser/ui/collected_cookies_infobar_delegate.h"
 #include "chrome/browser/ui/extensions/installation_error_infobar_delegate.h"
+#include "chrome/browser/ui/infobars/tab_sharing_infobar_delegate.h"
 #include "chrome/browser/ui/omnibox/alternate_nav_infobar_delegate.h"
 #include "chrome/browser/ui/page_info/page_info_infobar_delegate.h"
 #include "chrome/browser/ui/startup/automation_infobar_delegate.h"
@@ -231,6 +232,7 @@
       {"automation", IBD::AUTOMATION_INFOBAR_DELEGATE},
       {"previews_lite_page", IBD::LITE_PAGE_PREVIEWS_INFOBAR},
       {"flash_deprecation", IBD::FLASH_DEPRECATION_INFOBAR_DELEGATE},
+      {"tab_sharing", IBD::TAB_SHARING_INFOBAR_DELEGATE},
   };
   auto id = kIdentifiers.find(name);
   expected_identifiers_.push_back((id == kIdentifiers.end()) ? IBD::INVALID
@@ -411,6 +413,11 @@
     case IBD::FLASH_DEPRECATION_INFOBAR_DELEGATE:
       FlashDeprecationInfoBarDelegate::Create(GetInfoBarService());
       break;
+    case IBD::TAB_SHARING_INFOBAR_DELEGATE:
+      TabSharingInfoBarDelegate::Create(GetInfoBarService(),
+                                        base::ASCIIToUTF16("example.com"),
+                                        base::ASCIIToUTF16("application.com"));
+      break;
 
     default:
       break;
@@ -576,6 +583,13 @@
   ShowAndVerifyUi();
 }
 
+// TODO(https://crbug.com/965468) Resource generation fails on Windows.
+#if !defined(OS_WIN)
+IN_PROC_BROWSER_TEST_F(InfoBarUiTest, InvokeUi_tab_sharing) {
+  ShowAndVerifyUi();
+}
+#endif
+
 IN_PROC_BROWSER_TEST_F(InfoBarUiTest, InvokeUi_multiple_infobars) {
   ShowAndVerifyUi();
 }
diff --git a/chrome/browser/media/router/providers/cast/cast_session_client.cc b/chrome/browser/media/router/providers/cast/cast_session_client.cc
index 3d9397b64..9e6dc5c 100644
--- a/chrome/browser/media/router/providers/cast/cast_session_client.cc
+++ b/chrome/browser/media/router/providers/cast/cast_session_client.cc
@@ -136,10 +136,9 @@
       CreateErrorMessage(client_id(), std::move(error), sequence_number));
 }
 
-void CastSessionClientImpl::HandleParsedClientMessage(
-    std::unique_ptr<base::Value> message) {
+void CastSessionClientImpl::HandleParsedClientMessage(base::Value message) {
   std::unique_ptr<CastInternalMessage> cast_message =
-      CastInternalMessage::From(std::move(*message));
+      CastInternalMessage::From(std::move(message));
   if (!cast_message) {
     ReportClientMessageParseError(activity_->route().media_route_id(),
                                   "Not a Cast message");
diff --git a/chrome/browser/media/router/providers/cast/cast_session_client.h b/chrome/browser/media/router/providers/cast/cast_session_client.h
index 775cb60..a6b9ad3 100644
--- a/chrome/browser/media/router/providers/cast/cast_session_client.h
+++ b/chrome/browser/media/router/providers/cast/cast_session_client.h
@@ -146,7 +146,7 @@
       blink::mojom::PresentationConnectionCloseReason reason) override;
 
  private:
-  void HandleParsedClientMessage(std::unique_ptr<base::Value> message);
+  void HandleParsedClientMessage(base::Value message);
   void HandleV2ProtocolMessage(const CastInternalMessage& cast_message);
 
   // Resets the PresentationConnection Mojo message pipes.
diff --git a/chrome/browser/media/router/providers/dial/dial_media_route_provider.cc b/chrome/browser/media/router/providers/dial/dial_media_route_provider.cc
index 2086ca9..0208132 100644
--- a/chrome/browser/media/router/providers/dial/dial_media_route_provider.cc
+++ b/chrome/browser/media/router/providers/dial/dial_media_route_provider.cc
@@ -214,10 +214,10 @@
 
 void DialMediaRouteProvider::HandleParsedRouteMessage(
     const MediaRoute::Id& route_id,
-    std::unique_ptr<base::Value> message) {
+    base::Value message) {
   std::string error;
   std::unique_ptr<DialInternalMessage> internal_message =
-      DialInternalMessage::From(std::move(*message), &error);
+      DialInternalMessage::From(std::move(message), &error);
   if (!internal_message) {
     ReportParseError(DialParseMessageResult::kInvalidMessage, error);
     return;
diff --git a/chrome/browser/media/router/providers/dial/dial_media_route_provider.h b/chrome/browser/media/router/providers/dial/dial_media_route_provider.h
index 9540136..cae5d6ce 100644
--- a/chrome/browser/media/router/providers/dial/dial_media_route_provider.h
+++ b/chrome/browser/media/router/providers/dial/dial_media_route_provider.h
@@ -153,7 +153,7 @@
                              const std::vector<url::Origin>& origins);
 
   void HandleParsedRouteMessage(const MediaRoute::Id& route_id,
-                                std::unique_ptr<base::Value> message);
+                                base::Value message);
   void HandleClientConnect(const DialActivity& activity,
                            const MediaSinkInternal& sink);
   void SendCustomDialLaunchMessage(const MediaRoute::Id& route_id,
diff --git a/chrome/browser/metrics/extensions_metrics_provider.cc b/chrome/browser/metrics/extensions_metrics_provider.cc
index 9b28a3e0..360ad26 100644
--- a/chrome/browser/metrics/extensions_metrics_provider.cc
+++ b/chrome/browser/metrics/extensions_metrics_provider.cc
@@ -145,6 +145,8 @@
       return ExtensionInstallProto::PLATFORM_APP;
     case Manifest::TYPE_SHARED_MODULE:
       return ExtensionInstallProto::SHARED_MODULE;
+    case Manifest::TYPE_LOGIN_SCREEN_EXTENSION:
+      return ExtensionInstallProto::LOGIN_SCREEN_EXTENSION;
     case Manifest::NUM_LOAD_TYPES:
       NOTREACHED();
       // Fall through.
diff --git a/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc b/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc
index 87cad38..f39d808 100644
--- a/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc
+++ b/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc
@@ -171,22 +171,7 @@
   auto suggestions_fetcher = std::make_unique<RemoteSuggestionsFetcherImpl>(
       identity_manager, url_loader_factory, pref_service, language_histogram,
       base::Bind(
-          // TODO(crbug.com/959749): Remove this adaptor once SafeJsonParser API
-          // has been updated to pass the base::Value by value.
-          [](service_manager::Connector* connector, const std::string& json,
-             const ntp_snippets::SuccessCallback& success_callback,
-             const ntp_snippets::ErrorCallback& error_callback) {
-            data_decoder::SafeJsonParser::Parse(
-                connector, json,
-                base::Bind(
-                    [](const ntp_snippets::SuccessCallback& callback,
-                       std::unique_ptr<base::Value> value) {
-                      callback.Run(
-                          base::Value::FromUniquePtrValue(std::move(value)));
-                    },
-                    success_callback),
-                error_callback);
-          },
+          &data_decoder::SafeJsonParser::Parse,
           content::ServiceManagerConnection::GetForProcess()->GetConnector()),
       GetFetchEndpoint(), api_key, user_classifier);
 
diff --git a/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.cc b/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.cc
index 276e560..d2a948b 100644
--- a/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.cc
+++ b/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.cc
@@ -88,9 +88,9 @@
   return subframe_origin.IsSameOriginWith(mainframe_origin);
 }
 
-AdsPageLoadMetricsObserver::AdsPageLoadMetricsObserver()
+AdsPageLoadMetricsObserver::AdsPageLoadMetricsObserver(base::TickClock* clock)
     : subresource_observer_(this),
-      clock_(base::DefaultTickClock::GetInstance()) {}
+      clock_(clock ? clock : base::DefaultTickClock::GetInstance()) {}
 
 AdsPageLoadMetricsObserver::~AdsPageLoadMetricsObserver() = default;
 
@@ -159,11 +159,15 @@
   if (!GetDelegate()->GetVisibilityTracker().currently_in_foreground())
     return;
 
+  // Get the current time, considered to be when this update occurred.
+  base::TimeTicks current_time = clock_->NowTicks();
+
   FrameData::InteractiveStatus interactive_status =
       time_interactive_.is_null()
           ? FrameData::InteractiveStatus::kPreInteractive
           : FrameData::InteractiveStatus::kPostInteractive;
-  aggregate_frame_data_->UpdateCpuUsage(timing.task_time, interactive_status);
+  aggregate_frame_data_->UpdateCpuUsage(current_time, timing.task_time,
+                                        interactive_status);
 
   const auto& id_and_data =
       ad_frames_data_.find(subframe_rfh->GetFrameTreeNodeId());
@@ -172,7 +176,8 @@
 
   FrameData* ancestor_data = id_and_data->second;
   if (ancestor_data) {
-    ancestor_data->UpdateCpuUsage(timing.task_time, interactive_status);
+    ancestor_data->UpdateCpuUsage(current_time, timing.task_time,
+                                  interactive_status);
   }
 }
 
@@ -596,6 +601,21 @@
 
     page_has_relevant_ad = true;
 
+    // Report the peak windowed usage, which is independent of activation status
+    // (measured only for the unactivated period).  Only reported if there was a
+    // relevant unactivated period.
+    if ((ad_frame_data.user_activation_status() ==
+             FrameData::UserActivationStatus::kNoActivation &&
+         total_duration.InMilliseconds() > 0) ||
+        (ad_frame_data.user_activation_status() ==
+             FrameData::UserActivationStatus::kReceivedActivation &&
+         ad_frame_data.pre_activation_foreground_duration().InMilliseconds() >
+             0)) {
+      ADS_HISTOGRAM("Cpu.AdFrames.PerFrame.PeakWindowedPercent",
+                    UMA_HISTOGRAM_PERCENTAGE, visibility,
+                    ad_frame_data.peak_windowed_cpu_percent());
+    }
+
     if (ad_frame_data.user_activation_status() ==
         FrameData::UserActivationStatus::kNoActivation) {
       base::TimeDelta task_duration_pre = ad_frame_data.GetInteractiveCpuUsage(
@@ -691,6 +711,9 @@
                   GetCpuPercentage(task_duration_total, total_duration));
     ADS_HISTOGRAM("Cpu.FullPage.TotalUsage", PAGE_LOAD_HISTOGRAM, visibility,
                   task_duration_total);
+    ADS_HISTOGRAM("Cpu.FullPage.PeakWindowedPercent", UMA_HISTOGRAM_PERCENTAGE,
+                  visibility,
+                  aggregate_frame_data_->peak_windowed_cpu_percent());
   }
   if (pre_interactive_duration_.InMilliseconds() > 0) {
     ADS_HISTOGRAM(
diff --git a/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.h b/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.h
index fffa37a..aadf8c8 100644
--- a/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.h
+++ b/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer.h
@@ -43,7 +43,7 @@
 
   using ResourceMimeType = FrameData::ResourceMimeType;
 
-  AdsPageLoadMetricsObserver();
+  explicit AdsPageLoadMetricsObserver(base::TickClock* clock = nullptr);
   ~AdsPageLoadMetricsObserver() override;
 
   // page_load_metrics::PageLoadMetricsObserver
diff --git a/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer_unittest.cc b/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer_unittest.cc
index 20296d25..61d46bc2 100644
--- a/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer_unittest.cc
+++ b/chrome/browser/page_load_metrics/observers/ad_metrics/ads_page_load_metrics_observer_unittest.cc
@@ -364,6 +364,7 @@
 
   void OverrideVisibilityTrackerWithMockClock() {
     clock_ = std::make_unique<base::SimpleTestTickClock>();
+    clock_->SetNowTicks(base::TimeTicks::Now());
   }
 
   // Given the prefix of the CPU histogram to check, either "Cpu.FullPage" or
@@ -412,7 +413,7 @@
   }
 
   void RegisterObservers(page_load_metrics::PageLoadTracker* tracker) {
-    auto observer = std::make_unique<AdsPageLoadMetricsObserver>();
+    auto observer = std::make_unique<AdsPageLoadMetricsObserver>(clock_.get());
     ads_observer_ = observer.get();
     tracker->AddObserver(std::move(observer));
     // Swap out the ScopedVisibilityTracker to use the test clock.
@@ -958,6 +959,99 @@
             500);
 }
 
+TEST_F(AdsPageLoadMetricsObserverTest, TestCpuTimingMetricsWindowed) {
+  OverrideVisibilityTrackerWithMockClock();
+  RenderFrameHost* main_frame = NavigateMainFrame(kNonAdUrl);
+  RenderFrameHost* ad_frame = CreateAndNavigateSubFrame(kAdUrl, main_frame);
+
+  // Add some data to the ad frame so it gets reported.
+  ResourceDataUpdate(ad_frame, ResourceCached::NOT_CACHED, 10);
+
+  // Perform some updates on ad and non-ad frames. Usage 1%.
+  OnCpuTimingUpdate(ad_frame, base::TimeDelta::FromMilliseconds(500));
+
+  // Advance time by twelve seconds.
+  AdvancePageDuration(base::TimeDelta::FromSeconds(12));
+
+  // Do some more work on the ad frame. Usage 5%.
+  OnCpuTimingUpdate(ad_frame, base::TimeDelta::FromMilliseconds(1000));
+
+  // Advance time by twelve more seconds.
+  AdvancePageDuration(base::TimeDelta::FromSeconds(12));
+
+  // Do some more work on the ad frame. Usage 8%.
+  OnCpuTimingUpdate(ad_frame, base::TimeDelta::FromMilliseconds(1000));
+
+  // Advance time by twelve more seconds.
+  AdvancePageDuration(base::TimeDelta::FromSeconds(12));
+
+  // Perform some updates on ad and non-ad frames. Usage 10%/13%.
+  OnCpuTimingUpdate(ad_frame, base::TimeDelta::FromMilliseconds(1000));
+  OnCpuTimingUpdate(main_frame, base::TimeDelta::FromMilliseconds(1000));
+
+  // Advance time by twelve more seconds.
+  AdvancePageDuration(base::TimeDelta::FromSeconds(12));
+
+  // Perform some updates on ad and non-ad frames. Usage 8%/11%.
+  OnCpuTimingUpdate(ad_frame, base::TimeDelta::FromMilliseconds(500));
+
+  // Navigate away and check the peak windowed cpu usage.
+  NavigateFrame(kNonAdUrl, main_frame);
+  // 10% is the maximum for the individual ad frame.
+  histogram_tester().ExpectUniqueSample(
+      SuffixedHistogram("Cpu.AdFrames.PerFrame.PeakWindowedPercent"), 10, 1);
+  // 13% is the maximum for all frames (including main).
+  histogram_tester().ExpectUniqueSample(
+      SuffixedHistogram("Cpu.FullPage.PeakWindowedPercent"), 13, 1);
+}
+
+TEST_F(AdsPageLoadMetricsObserverTest, TestCpuTimingMetricsWindowedActivated) {
+  OverrideVisibilityTrackerWithMockClock();
+  RenderFrameHost* main_frame = NavigateMainFrame(kNonAdUrl);
+  RenderFrameHost* ad_frame = CreateAndNavigateSubFrame(kAdUrl, main_frame);
+
+  // Add some data to the ad frame so it gets reported.
+  ResourceDataUpdate(ad_frame, ResourceCached::NOT_CACHED, 10);
+
+  // Perform some updates on ad and non-ad frames. Usage 1%.
+  OnCpuTimingUpdate(ad_frame, base::TimeDelta::FromMilliseconds(500));
+
+  // Advance time by twelve seconds.
+  AdvancePageDuration(base::TimeDelta::FromSeconds(12));
+
+  // Do some more work on the ad frame. Usage 8%.
+  OnCpuTimingUpdate(ad_frame, base::TimeDelta::FromMilliseconds(2000));
+
+  // Advance time by twelve more seconds.
+  AdvancePageDuration(base::TimeDelta::FromSeconds(12));
+
+  // Do some more work on the ad frame. Usage 11%.
+  OnCpuTimingUpdate(ad_frame, base::TimeDelta::FromMilliseconds(1000));
+
+  // Set the page activation and advance time by twelve more seconds.
+  TriggerFirstUserActivation(ad_frame);
+  AdvancePageDuration(base::TimeDelta::FromSeconds(12));
+
+  // Perform some updates on ad and main frames. Usage 13%/16%.
+  OnCpuTimingUpdate(ad_frame, base::TimeDelta::FromMilliseconds(1000));
+  OnCpuTimingUpdate(main_frame, base::TimeDelta::FromMilliseconds(1000));
+
+  // Advance time by twelve more seconds.
+  AdvancePageDuration(base::TimeDelta::FromSeconds(12));
+
+  // Perform some updates on ad and non-ad frames. Usage 8%/11%.
+  OnCpuTimingUpdate(ad_frame, base::TimeDelta::FromMilliseconds(500));
+
+  // Navigate away and check the peak windowed cpu usage.
+  NavigateFrame(kNonAdUrl, main_frame);
+  // 11% is the maximum before activation for the ad frame.
+  histogram_tester().ExpectUniqueSample(
+      SuffixedHistogram("Cpu.AdFrames.PerFrame.PeakWindowedPercent"), 11, 1);
+  // 16% is the maximum for all frames (including main), ignores activation.
+  histogram_tester().ExpectUniqueSample(
+      SuffixedHistogram("Cpu.FullPage.PeakWindowedPercent"), 16, 1);
+}
+
 TEST_F(AdsPageLoadMetricsObserverTest, TestCpuTimingMetrics) {
   OverrideVisibilityTrackerWithMockClock();
   RenderFrameHost* main_frame = NavigateMainFrame(kNonAdUrl);
@@ -1155,6 +1249,10 @@
   CheckCpuHistograms("Cpu.FullPage", "", 0, 0, 0, 0);
   CheckCpuHistograms("Cpu.AdFrames.PerFrame", "Unactivated", 0, 0, 0, 0);
   CheckCpuHistograms("Cpu.AdFrames.PerFrame", "Activated", 0, 0, 0, 0);
+  histogram_tester().ExpectTotalCount(
+      SuffixedHistogram("Cpu.AdFrames.PerFrame.PeakWindowedPercent"), 0);
+  histogram_tester().ExpectTotalCount(
+      SuffixedHistogram("Cpu.FullPage.PeakWindowedPercent"), 0);
 
   auto entries = test_ukm_recorder().GetEntriesByName(
       ukm::builders::AdFrameLoad::kEntryName);
@@ -1231,6 +1329,10 @@
   CheckCpuHistograms("Cpu.FullPage", "", 0, 0, 0, 0);
   CheckCpuHistograms("Cpu.AdFrames.PerFrame", "Activated", 0, 0, 0, 0);
   CheckCpuHistograms("Cpu.AdFrames.PerFrame", "Unactivated", 0, 0, 0, 0);
+  histogram_tester().ExpectTotalCount(
+      SuffixedHistogram("Cpu.AdFrames.PerFrame.PeakWindowedPercent"), 0);
+  histogram_tester().ExpectTotalCount(
+      SuffixedHistogram("Cpu.FullPage.PeakWindowedPercent"), 0);
 
   auto entries = test_ukm_recorder().GetEntriesByName(
       ukm::builders::AdFrameLoad::kEntryName);
diff --git a/chrome/browser/page_load_metrics/observers/ad_metrics/frame_data.cc b/chrome/browser/page_load_metrics/observers/ad_metrics/frame_data.cc
index b54548b..43ad0bb2 100644
--- a/chrome/browser/page_load_metrics/observers/ad_metrics/frame_data.cc
+++ b/chrome/browser/page_load_metrics/observers/ad_metrics/frame_data.cc
@@ -27,6 +27,9 @@
 }  // namespace
 
 // static
+constexpr base::TimeDelta FrameData::kCpuWindowSize;
+
+// static
 FrameData::ResourceMimeType FrameData::GetResourceMimeType(
     const page_load_metrics::mojom::ResourceDataUpdatePtr& resource) {
   if (blink::IsSupportedImageMimeType(resource->mime_type))
@@ -144,11 +147,33 @@
   UpdateFrameVisibility();
 }
 
-void FrameData::UpdateCpuUsage(base::TimeDelta update,
+void FrameData::UpdateCpuUsage(base::TimeTicks update_time,
+                               base::TimeDelta update,
                                InteractiveStatus interactive) {
+  // Update the overall usage for all of the relevant buckets.
   cpu_by_interactive_period_[static_cast<size_t>(interactive)] += update;
   cpu_by_activation_period_[static_cast<size_t>(user_activation_status_)] +=
       update;
+
+  // If the frame has been activated, then we don't update the peak usage.
+  if (user_activation_status_ == UserActivationStatus::kReceivedActivation)
+    return;
+
+  // Update the peak usage.
+  cpu_total_for_current_window_ += update;
+  cpu_updates_for_current_window_.push(CpuUpdateData(update_time, update));
+  base::TimeTicks cutoff_time = update_time - kCpuWindowSize;
+  while (!cpu_updates_for_current_window_.empty() &&
+         cpu_updates_for_current_window_.front().update_time < cutoff_time) {
+    cpu_total_for_current_window_ -=
+        cpu_updates_for_current_window_.front().usage_info;
+    cpu_updates_for_current_window_.pop();
+  }
+  int current_windowed_cpu_percent =
+      100 * cpu_total_for_current_window_.InMilliseconds() /
+      kCpuWindowSize.InMilliseconds();
+  if (current_windowed_cpu_percent > peak_windowed_cpu_percent_)
+    peak_windowed_cpu_percent_ = current_windowed_cpu_percent;
 }
 
 base::TimeDelta FrameData::GetInteractiveCpuUsage(
diff --git a/chrome/browser/page_load_metrics/observers/ad_metrics/frame_data.h b/chrome/browser/page_load_metrics/observers/ad_metrics/frame_data.h
index 69272ede..e6abae2 100644
--- a/chrome/browser/page_load_metrics/observers/ad_metrics/frame_data.h
+++ b/chrome/browser/page_load_metrics/observers/ad_metrics/frame_data.h
@@ -83,6 +83,10 @@
   // Maximum number of bytes allowed to be loaded by a frame.
   static const int kFrameSizeInterventionByteThreshold = 1050 * 1024;
 
+  // Window over which to consider cpu time spent in an ad_frame.
+  static constexpr base::TimeDelta kCpuWindowSize =
+      base::TimeDelta::FromSeconds(30);
+
   using FrameTreeNodeId =
       page_load_metrics::PageLoadMetricsObserver::FrameTreeNodeId;
 
@@ -117,7 +121,9 @@
   void SetDisplayState(bool is_display_none);
 
   // Add the cpu |update| appropriately given the page |interactive| status.
-  void UpdateCpuUsage(base::TimeDelta update, InteractiveStatus interactive);
+  void UpdateCpuUsage(base::TimeTicks update_time,
+                      base::TimeDelta update,
+                      InteractiveStatus interactive);
 
   // Get the cpu usage for the appropriate interactive period.
   base::TimeDelta GetInteractiveCpuUsage(InteractiveStatus status) const;
@@ -145,6 +151,8 @@
   // events for frames that have non-zero bytes.
   void RecordAdFrameLoadUkmEvent(ukm::SourceId source_id) const;
 
+  int peak_windowed_cpu_percent() const { return peak_windowed_cpu_percent_; }
+
   FrameTreeNodeId frame_tree_node_id() const { return frame_tree_node_id_; }
 
   OriginStatus origin_status() const { return origin_status_; }
@@ -186,6 +194,15 @@
   }
 
  private:
+  // Time updates for the frame with a timestamp indicating when they arrived.
+  // Used for windowed cpu load reporting.
+  struct CpuUpdateData {
+    base::TimeTicks update_time;
+    base::TimeDelta usage_info;
+    CpuUpdateData(base::TimeTicks time, base::TimeDelta info)
+        : update_time(time), usage_info(info) {}
+  };
+
   // Updates whether or not this frame meets the criteria for visibility.
   void UpdateFrameVisibility();
 
@@ -215,6 +232,14 @@
           base::TimeDelta(), base::TimeDelta()};
   // Duration of time the page spent in the foreground before activation.
   base::TimeDelta pre_activation_foreground_duration_;
+  // The cpu time spent in the current window.
+  base::TimeDelta cpu_total_for_current_window_;
+  // The cpu updates themselves that are still relevant for the time window.
+  // Note: Since the window is 30 seconds and PageLoadMetrics updates arrive at
+  // most every half second, this can never have more than 60 elements.
+  base::queue<CpuUpdateData> cpu_updates_for_current_window_;
+  // The peak windowed cpu load during the unactivated period.
+  int peak_windowed_cpu_percent_ = 0;
 
   // The depth of this FrameData's root frame.
   unsigned int root_frame_depth_ = 0;
diff --git a/chrome/browser/page_load_metrics/observers/previews_ukm_observer.cc b/chrome/browser/page_load_metrics/observers/previews_ukm_observer.cc
index 75f40bc..52d526b 100644
--- a/chrome/browser/page_load_metrics/observers/previews_ukm_observer.cc
+++ b/chrome/browser/page_load_metrics/observers/previews_ukm_observer.cc
@@ -20,6 +20,7 @@
 #include "chrome/common/page_load_metrics/page_load_timing.h"
 #include "components/data_reduction_proxy/core/browser/data_reduction_proxy_settings.h"
 #include "components/offline_pages/buildflags/buildflags.h"
+#include "components/optimization_guide/proto/hints.pb.h"
 #include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/previews_state.h"
@@ -140,6 +141,9 @@
   offline_eligibility_reason_ = previews_user_data->EligibilityReasonForPreview(
       previews::PreviewsType::OFFLINE);
 
+  serialized_hint_version_string_ =
+      previews_user_data->serialized_hint_version_string();
+
   return CONTINUE_OBSERVING;
 }
 
@@ -168,7 +172,7 @@
     const page_load_metrics::mojom::PageLoadTiming& timing,
     const page_load_metrics::PageLoadExtraInfo& info) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  RecordPreviewsTypes(info);
+  RecordMetrics(info);
   return STOP_OBSERVING;
 }
 
@@ -177,7 +181,7 @@
     const page_load_metrics::mojom::PageLoadTiming& timing,
     const page_load_metrics::PageLoadExtraInfo& info) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  RecordPreviewsTypes(info);
+  RecordMetrics(info);
   return STOP_OBSERVING;
 }
 
@@ -185,7 +189,13 @@
     const page_load_metrics::mojom::PageLoadTiming& timing,
     const page_load_metrics::PageLoadExtraInfo& info) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  RecordMetrics(info);
+}
+
+void PreviewsUKMObserver::RecordMetrics(
+    const page_load_metrics::PageLoadExtraInfo& info) {
   RecordPreviewsTypes(info);
+  RecordOptimizationGuideInfo(info);
 }
 
 void PreviewsUKMObserver::RecordPreviewsTypes(
@@ -272,6 +282,32 @@
   builder.Record(ukm::UkmRecorder::Get());
 }
 
+void PreviewsUKMObserver::RecordOptimizationGuideInfo(
+    const page_load_metrics::PageLoadExtraInfo& info) {
+  if (!serialized_hint_version_string_.has_value()) {
+    return;
+  }
+
+  // Deserialize the serialized version string into its protobuffer.
+  optimization_guide::proto::Version hint_version;
+  if (!hint_version.ParseFromString(serialized_hint_version_string_.value())) {
+    return;
+  }
+
+  ukm::builders::OptimizationGuide builder(info.source_id);
+  if (hint_version.has_generation_timestamp() &&
+      hint_version.generation_timestamp().seconds() > 0) {
+    builder.SetHintGenerationTimestamp(
+        hint_version.generation_timestamp().seconds());
+  }
+  if (hint_version.has_hint_source() &&
+      hint_version.hint_source() !=
+          optimization_guide::proto::HINT_SOURCE_UNKNOWN) {
+    builder.SetHintSource(static_cast<int>(hint_version.hint_source()));
+  }
+  builder.Record(ukm::UkmRecorder::Get());
+}
+
 void PreviewsUKMObserver::OnLoadedResource(
     const page_load_metrics::ExtraRequestCompleteInfo&
         extra_request_complete_info) {
diff --git a/chrome/browser/page_load_metrics/observers/previews_ukm_observer.h b/chrome/browser/page_load_metrics/observers/previews_ukm_observer.h
index 1b53cfadb..dd7259e 100644
--- a/chrome/browser/page_load_metrics/observers/previews_ukm_observer.h
+++ b/chrome/browser/page_load_metrics/observers/previews_ukm_observer.h
@@ -10,6 +10,7 @@
 #include "base/sequence_checker.h"
 #include "base/time/time.h"
 #include "chrome/browser/page_load_metrics/page_load_metrics_observer.h"
+#include "components/optimization_guide/proto/hints.pb.h"
 #include "components/previews/core/previews_black_list.h"
 #include "components/previews/core/previews_experiments.h"
 
@@ -58,7 +59,10 @@
   virtual bool IsOfflinePreview(content::WebContents* web_contents) const;
 
  private:
+  void RecordMetrics(const page_load_metrics::PageLoadExtraInfo& info);
   void RecordPreviewsTypes(const page_load_metrics::PageLoadExtraInfo& info);
+  void RecordOptimizationGuideInfo(
+      const page_load_metrics::PageLoadExtraInfo& info);
 
   // The preview type that was most recently committed.
   PreviewsType committed_preview_;
@@ -86,6 +90,7 @@
       offline_eligibility_reason_ = base::nullopt;
   CoinFlipHoldbackResult coin_flip_result_ = CoinFlipHoldbackResult::kNotSet;
   base::Optional<base::TimeDelta> navigation_restart_penalty_ = base::nullopt;
+  base::Optional<std::string> serialized_hint_version_string_ = base::nullopt;
 
   SEQUENCE_CHECKER(sequence_checker_);
 
diff --git a/chrome/browser/page_load_metrics/observers/previews_ukm_observer_unittest.cc b/chrome/browser/page_load_metrics/observers/previews_ukm_observer_unittest.cc
index f7cc229..2abc583e8 100644
--- a/chrome/browser/page_load_metrics/observers/previews_ukm_observer_unittest.cc
+++ b/chrome/browser/page_load_metrics/observers/previews_ukm_observer_unittest.cc
@@ -17,6 +17,7 @@
 #include "chrome/browser/page_load_metrics/page_load_tracker.h"
 #include "chrome/browser/previews/previews_ui_tab_helper.h"
 #include "chrome/test/base/testing_browser_process.h"
+#include "components/optimization_guide/proto/hints.pb.h"
 #include "components/previews/core/previews_experiments.h"
 #include "components/previews/core/previews_features.h"
 #include "components/ukm/test_ukm_recorder.h"
@@ -52,7 +53,8 @@
       CoinFlipHoldbackResult coin_flip_result,
       std::unordered_map<PreviewsType, PreviewsEligibilityReason>
           eligibility_reasons,
-      base::Optional<base::TimeDelta> navigation_restart_penalty)
+      base::Optional<base::TimeDelta> navigation_restart_penalty,
+      base::Optional<std::string> hint_version_string)
       : committed_preview_(committed_preview),
         allowed_state_(allowed_state),
         lite_page_received_(lite_page_received),
@@ -64,7 +66,8 @@
         is_offline_preview_(is_offline_preview),
         coin_flip_result_(coin_flip_result),
         eligibility_reasons_(eligibility_reasons),
-        navigation_restart_penalty_(navigation_restart_penalty) {}
+        navigation_restart_penalty_(navigation_restart_penalty),
+        hint_version_string_(hint_version_string) {}
 
   ~TestPreviewsUKMObserver() override {}
 
@@ -133,6 +136,11 @@
       user_data->SetEligibilityReasonForPreview(iter->first, iter->second);
     }
 
+    if (hint_version_string_.has_value()) {
+      user_data->set_serialized_hint_version_string(
+          hint_version_string_.value());
+    }
+
     return PreviewsUKMObserver::OnCommit(navigation_handle, source_id);
   }
 
@@ -159,6 +167,7 @@
   std::unordered_map<PreviewsType, PreviewsEligibilityReason>
       eligibility_reasons_;
   base::Optional<base::TimeDelta> navigation_restart_penalty_;
+  base::Optional<std::string> hint_version_string_;
 
   DISALLOW_COPY_AND_ASSIGN(TestPreviewsUKMObserver);
 };
@@ -181,7 +190,8 @@
                CoinFlipHoldbackResult coin_flip_result,
                std::unordered_map<PreviewsType, PreviewsEligibilityReason>
                    eligibility_reasons,
-               base::Optional<base::TimeDelta> navigation_restart_penalty) {
+               base::Optional<base::TimeDelta> navigation_restart_penalty,
+               base::Optional<std::string> hint_version_string) {
     committed_preview_ = committed_preview;
     allowed_state_ = allowed_state;
     lite_page_received_ = lite_page_received;
@@ -194,6 +204,7 @@
     coin_flip_result_ = coin_flip_result;
     eligibility_reasons_ = eligibility_reasons;
     navigation_restart_penalty_ = navigation_restart_penalty;
+    hint_version_string_ = hint_version_string;
     auto navigation = content::NavigationSimulator::CreateBrowserInitiated(
         GURL(kDefaultTestUrl), web_contents());
     if (is_offline_preview_)
@@ -216,7 +227,63 @@
                    CoinFlipHoldbackResult coin_flip_result_expected,
                    std::unordered_map<PreviewsType, PreviewsEligibilityReason>
                        eligibility_reasons,
-                   base::Optional<base::TimeDelta> navigation_restart_penalty) {
+                   base::Optional<base::TimeDelta> navigation_restart_penalty,
+                   base::Optional<int64_t> hint_generation_timestamp,
+                   base::Optional<int> hint_source) {
+    ValidatePreviewsUKM(server_lofi_expected, client_lofi_expected,
+                        lite_page_expected, lite_page_redirect_expected,
+                        noscript_expected, resource_loading_hints_expected,
+                        opt_out_value, origin_opt_out_expected,
+                        save_data_enabled_expected, offline_preview_expected,
+                        previews_likely_expected, coin_flip_result_expected,
+                        eligibility_reasons, navigation_restart_penalty);
+    ValidateOptimizationGuideUKM(hint_generation_timestamp, hint_source);
+  }
+
+  void SetUp() override {
+    page_load_metrics::PageLoadMetricsObserverTestHarness::SetUp();
+    PreviewsUITabHelper::CreateForWebContents(web_contents());
+  }
+
+ protected:
+  void RegisterObservers(page_load_metrics::PageLoadTracker* tracker) override {
+    tracker->AddObserver(std::make_unique<TestPreviewsUKMObserver>(
+        committed_preview_, allowed_state_, lite_page_received_,
+        lite_page_redirect_received_, noscript_on_, resource_loading_hints_on_,
+        origin_opt_out_, save_data_enabled_, is_offline_preview_,
+        coin_flip_result_, eligibility_reasons_, navigation_restart_penalty_,
+        hint_version_string_));
+    // Data is only added to the first navigation after RunTest().
+    committed_preview_ = PreviewsType::NONE;
+    allowed_state_ = content::PREVIEWS_OFF;
+    lite_page_received_ = false;
+    lite_page_redirect_received_ = false;
+    noscript_on_ = false;
+    resource_loading_hints_on_ = false;
+    origin_opt_out_ = false;
+    coin_flip_result_ = CoinFlipHoldbackResult::kNotSet;
+    eligibility_reasons_.clear();
+    navigation_restart_penalty_ = base::nullopt;
+    hint_version_string_ = base::nullopt;
+  }
+
+ private:
+  void ValidatePreviewsUKM(
+      bool server_lofi_expected,
+      bool client_lofi_expected,
+      bool lite_page_expected,
+      bool lite_page_redirect_expected,
+      bool noscript_expected,
+      bool resource_loading_hints_expected,
+      int opt_out_value,
+      bool origin_opt_out_expected,
+      bool save_data_enabled_expected,
+      bool offline_preview_expected,
+      bool previews_likely_expected,
+      CoinFlipHoldbackResult coin_flip_result_expected,
+      std::unordered_map<PreviewsType, PreviewsEligibilityReason>
+          eligibility_reasons,
+      base::Optional<base::TimeDelta> navigation_restart_penalty) {
     using UkmEntry = ukm::builders::Previews;
     auto entries = test_ukm_recorder().GetEntriesByName(UkmEntry::kEntryName);
     if (!server_lofi_expected && !client_lofi_expected && !lite_page_expected &&
@@ -330,32 +397,37 @@
     }
   }
 
-  void SetUp() override {
-    page_load_metrics::PageLoadMetricsObserverTestHarness::SetUp();
-    PreviewsUITabHelper::CreateForWebContents(web_contents());
+  void ValidateOptimizationGuideUKM(
+      base::Optional<int64_t> hint_generation_timestamp,
+      base::Optional<int> hint_source) {
+    using UkmEntry = ukm::builders::OptimizationGuide;
+    auto entries = test_ukm_recorder().GetEntriesByName(UkmEntry::kEntryName);
+    if (!hint_generation_timestamp.has_value() && !hint_source.has_value()) {
+      EXPECT_EQ(0u, entries.size());
+      return;
+    }
+
+    EXPECT_EQ(1u, entries.size());
+    for (const auto* const entry : entries) {
+      test_ukm_recorder().ExpectEntrySourceHasUrl(entry, GURL(kDefaultTestUrl));
+      if (hint_generation_timestamp.has_value()) {
+        test_ukm_recorder().ExpectEntryMetric(
+            entry, UkmEntry::kHintGenerationTimestampName,
+            hint_generation_timestamp.value());
+      } else {
+        EXPECT_FALSE(test_ukm_recorder().EntryHasMetric(
+            entry, UkmEntry::kHintGenerationTimestampName));
+      }
+      if (hint_source.has_value()) {
+        test_ukm_recorder().ExpectEntryMetric(entry, UkmEntry::kHintSourceName,
+                                              hint_source.value());
+      } else {
+        EXPECT_FALSE(test_ukm_recorder().EntryHasMetric(
+            entry, UkmEntry::kHintSourceName));
+      }
+    }
   }
 
- protected:
-  void RegisterObservers(page_load_metrics::PageLoadTracker* tracker) override {
-    tracker->AddObserver(std::make_unique<TestPreviewsUKMObserver>(
-        committed_preview_, allowed_state_, lite_page_received_,
-        lite_page_redirect_received_, noscript_on_, resource_loading_hints_on_,
-        origin_opt_out_, save_data_enabled_, is_offline_preview_,
-        coin_flip_result_, eligibility_reasons_, navigation_restart_penalty_));
-    // Data is only added to the first navigation after RunTest().
-    committed_preview_ = PreviewsType::NONE;
-    allowed_state_ = content::PREVIEWS_OFF;
-    lite_page_received_ = false;
-    lite_page_redirect_received_ = false;
-    noscript_on_ = false;
-    resource_loading_hints_on_ = false;
-    origin_opt_out_ = false;
-    coin_flip_result_ = CoinFlipHoldbackResult::kNotSet;
-    eligibility_reasons_.clear();
-    navigation_restart_penalty_ = base::nullopt;
-  }
-
- private:
   PreviewsType committed_preview_ = PreviewsType::NONE;
   content::PreviewsState allowed_state_ = content::PREVIEWS_OFF;
   bool lite_page_received_ = false;
@@ -369,6 +441,7 @@
       eligibility_reasons_ = {};
   CoinFlipHoldbackResult coin_flip_result_ = CoinFlipHoldbackResult::kNotSet;
   base::Optional<base::TimeDelta> navigation_restart_penalty_ = base::nullopt;
+  base::Optional<std::string> hint_version_string_ = base::nullopt;
 
   DISALLOW_COPY_AND_ASSIGN(PreviewsUKMObserverTest);
 };
@@ -380,7 +453,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           false /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
   NavigateToUntrackedUrl();
 
   ValidateUKM(false /* server_lofi_expected */,
@@ -392,7 +466,9 @@
               false /* save_data_enabled_expected */,
               false /* offline_preview_expected */, false /* previews_likely */,
               CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, UntrackedPreviewTypeOptOut) {
@@ -402,7 +478,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           false /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
   observer()->BroadcastEventToObservers(PreviewsUITabHelper::OptOutEventKey());
   NavigateToUntrackedUrl();
 
@@ -416,7 +493,9 @@
               false /* save_data_enabled_expected */,
               false /* offline_preview_expected */, false /* previews_likely */,
               CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, LitePageSeen) {
@@ -426,7 +505,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           false /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   NavigateToUntrackedUrl();
 
@@ -439,7 +519,9 @@
               false /* save_data_enabled_expected */,
               false /* offline_preview_expected */, false /* previews_likely */,
               CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, LitePageOptOutChip) {
@@ -449,7 +531,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           false /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   observer()->BroadcastEventToObservers(PreviewsUITabHelper::OptOutEventKey());
   NavigateToUntrackedUrl();
@@ -463,7 +546,9 @@
               false /* save_data_enabled_expected */,
               false /* offline_preview_expected */, false /* previews_likely */,
               CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, LitePageRedirectSeen) {
@@ -473,7 +558,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           false /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   NavigateToUntrackedUrl();
 
@@ -486,7 +572,9 @@
               false /* save_data_enabled_expected */,
               false /* offline_preview_expected */, false /* previews_likely */,
               CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, LitePageRedirectOptOutChip) {
@@ -496,7 +584,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           false /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   observer()->BroadcastEventToObservers(PreviewsUITabHelper::OptOutEventKey());
   NavigateToUntrackedUrl();
@@ -510,17 +599,19 @@
               false /* save_data_enabled_expected */,
               false /* offline_preview_expected */, false /* previews_likely */,
               CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
-TEST_F(PreviewsUKMObserverTest, NoScriptSeen) {
+TEST_F(PreviewsUKMObserverTest, NoScriptSeenWithBadVersionString) {
   RunTest(content::PREVIEWS_UNSPECIFIED /* allowed_state */,
           PreviewsType::NOSCRIPT, false /* lite_page_received */,
           false /* lite_page_redirect_received */, true /* noscript_on */,
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           false /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */, "badversion");
 
   NavigateToUntrackedUrl();
 
@@ -532,7 +623,9 @@
       false /* save_data_enabled_expected */,
       false /* offline_preview_expected */, false /* previews_likely */,
       CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-      base::nullopt /* navigation_restart_penalty */);
+      base::nullopt /* navigation_restart_penalty */,
+      base::nullopt /* hint_generation_timestamp */,
+      base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, NoScriptOptOutChip) {
@@ -542,7 +635,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           false /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   observer()->BroadcastEventToObservers(PreviewsUITabHelper::OptOutEventKey());
   NavigateToUntrackedUrl();
@@ -555,7 +649,9 @@
       false /* save_data_enabled_expected */,
       false /* offline_preview_expected */, false /* previews_likely */,
       CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-      base::nullopt /* navigation_restart_penalty */);
+      base::nullopt /* navigation_restart_penalty */,
+      base::nullopt /* hint_generation_timestamp */,
+      base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, OfflinePreviewsSeen) {
@@ -565,7 +661,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           false /* save_data_enabled */, true /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   NavigateToUntrackedUrl();
 
@@ -578,7 +675,9 @@
               false /* save_data_enabled_expected */,
               true /* offline_preview_expected */, false /* previews_likely */,
               CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, ResourceLoadingHintsSeen) {
@@ -588,7 +687,8 @@
           true /* resource_loading_hints_on */, false /* origin_opt_out */,
           false /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   NavigateToUntrackedUrl();
 
@@ -600,7 +700,9 @@
       false /* save_data_enabled_expected */,
       false /* offline_preview_expected */, false /* previews_likely */,
       CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-      base::nullopt /* navigation_restart_penalty */);
+      base::nullopt /* navigation_restart_penalty */,
+      base::nullopt /* hint_generation_timestamp */,
+      base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, ResourceLoadingHintsOptOutChip) {
@@ -610,7 +712,8 @@
           true /* resource_loading_hints_on */, false /* origin_opt_out */,
           false /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   observer()->BroadcastEventToObservers(PreviewsUITabHelper::OptOutEventKey());
   NavigateToUntrackedUrl();
@@ -623,7 +726,9 @@
       false /* save_data_enabled_expected */,
       false /* offline_preview_expected */, false /* previews_likely */,
       CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-      base::nullopt /* navigation_restart_penalty */);
+      base::nullopt /* navigation_restart_penalty */,
+      base::nullopt /* hint_generation_timestamp */,
+      base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, ClientLoFiSeen) {
@@ -633,7 +738,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           false /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   std::unique_ptr<data_reduction_proxy::DataReductionProxyData> data =
       std::make_unique<data_reduction_proxy::DataReductionProxyData>();
@@ -668,7 +774,9 @@
               false /* save_data_enabled_expected */,
               false /* offline_preview_expected */, false /* previews_likely */,
               CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, ClientLoFiOptOutChip) {
@@ -678,7 +786,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           false /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   std::unique_ptr<data_reduction_proxy::DataReductionProxyData> data =
       std::make_unique<data_reduction_proxy::DataReductionProxyData>();
@@ -713,7 +822,9 @@
               false /* save_data_enabled_expected */,
               false /* offline_preview_expected */, false /* previews_likely */,
               CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, ServerLoFiSeen) {
@@ -723,7 +834,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           false /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   std::unique_ptr<data_reduction_proxy::DataReductionProxyData> data =
       std::make_unique<data_reduction_proxy::DataReductionProxyData>();
@@ -758,7 +870,9 @@
               false /* save_data_enabled_expected */,
               false /* offline_preview_expected */, false /* previews_likely */,
               CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, ServerLoFiOptOutChip) {
@@ -768,7 +882,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           false /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   std::unique_ptr<data_reduction_proxy::DataReductionProxyData> data =
       std::make_unique<data_reduction_proxy::DataReductionProxyData>();
@@ -804,7 +919,9 @@
               false /* save_data_enabled_expected */,
               false /* offline_preview_expected */, false /* previews_likely */,
               CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, BothLoFiSeen) {
@@ -814,7 +931,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           false /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   std::unique_ptr<data_reduction_proxy::DataReductionProxyData> data1 =
       std::make_unique<data_reduction_proxy::DataReductionProxyData>();
@@ -854,7 +972,9 @@
               false /* save_data_enabled_expected */,
               false /* offline_preview_expected */, false /* previews_likely */,
               CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, BothLoFiOptOutChip) {
@@ -864,7 +984,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           false /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   std::unique_ptr<data_reduction_proxy::DataReductionProxyData> data1 =
       std::make_unique<data_reduction_proxy::DataReductionProxyData>();
@@ -904,7 +1025,9 @@
               false /* save_data_enabled_expected */,
               false /* offline_preview_expected */, false /* previews_likely */,
               CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, OriginOptOut) {
@@ -914,7 +1037,8 @@
           false /* resource_loading_hints_on */, true /* origin_opt_out */,
           false /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   NavigateToUntrackedUrl();
 
@@ -927,7 +1051,9 @@
               false /* save_data_enabled_expected */,
               false /* offline_preview_expected */, false /* previews_likely */,
               CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, DataSaverEnabled) {
@@ -937,7 +1063,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           true /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   NavigateToUntrackedUrl();
 
@@ -950,7 +1077,9 @@
               true /* save_data_enabled_expected */,
               false /* offline_preview_expected */, false /* previews_likely */,
               CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 // Navigation restart penalty can occur independently of a preview being
@@ -963,7 +1092,8 @@
       false /* origin_opt_out */, false /* save_data_enabled */,
       false /* is_offline_preview */, CoinFlipHoldbackResult::kNotSet,
       {} /* eligibility_reasons */,
-      base::TimeDelta::FromMilliseconds(1337) /* navigation_restart_penalty */);
+      base::TimeDelta::FromMilliseconds(1337) /* navigation_restart_penalty */,
+      base::nullopt /* hint_version_string */);
 
   NavigateToUntrackedUrl();
 
@@ -976,7 +1106,9 @@
       false /* save_data_enabled_expected */,
       false /* offline_preview_expected */, false /* previews_likely */,
       CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-      base::TimeDelta::FromMilliseconds(1337) /* navigation_restart_penalty */);
+      base::TimeDelta::FromMilliseconds(1337) /* navigation_restart_penalty */,
+      base::nullopt /* hint_generation_timestamp */,
+      base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, PreviewsLikelySet_PreCommitDecision) {
@@ -986,7 +1118,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           true /* save_data_enabled */, true /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   NavigateToUntrackedUrl();
 
@@ -999,7 +1132,9 @@
               true /* save_data_enabled_expected */,
               true /* offline_preview_expected */, true /* previews_likely */,
               CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, PreviewsLikelyNotSet_PostCommitDecision) {
@@ -1009,7 +1144,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           true /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   NavigateToUntrackedUrl();
 
@@ -1022,7 +1158,9 @@
               true /* save_data_enabled_expected */,
               false /* offline_preview_expected */, false /* previews_likely */,
               CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, PreviewsLikelyNotSet_PreviewsOff) {
@@ -1032,7 +1170,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           true /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   NavigateToUntrackedUrl();
 
@@ -1045,7 +1184,9 @@
               true /* save_data_enabled_expected */,
               false /* offline_preview_expected */, false /* previews_likely */,
               CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, CoinFlipResult_Holdback) {
@@ -1055,7 +1196,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           true /* save_data_enabled */, true /* is_offline_preview */,
           CoinFlipHoldbackResult::kHoldback, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   NavigateToUntrackedUrl();
 
@@ -1068,7 +1210,9 @@
               true /* save_data_enabled_expected */,
               true /* offline_preview_expected */, true /* previews_likely */,
               CoinFlipHoldbackResult::kHoldback, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, CoinFlipResult_Allowed) {
@@ -1078,7 +1222,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           true /* save_data_enabled */, true /* is_offline_preview */,
           CoinFlipHoldbackResult::kAllowed, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   NavigateToUntrackedUrl();
 
@@ -1091,7 +1236,9 @@
               true /* save_data_enabled_expected */,
               true /* offline_preview_expected */, true /* previews_likely */,
               CoinFlipHoldbackResult::kAllowed, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, LogPreviewsEligibilityReason_WithAllowed) {
@@ -1110,7 +1257,8 @@
            // ALLOWED is equal to zero and should not be recorded.
            {PreviewsType::LITE_PAGE_REDIRECT,
             PreviewsEligibilityReason::ALLOWED}} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   NavigateToUntrackedUrl();
 
@@ -1130,7 +1278,9 @@
                {PreviewsType::NOSCRIPT,
                 PreviewsEligibilityReason::
                     BLACKLIST_DATA_NOT_LOADED}} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, LogPreviewsEligibilityReason_NoneAllowed) {
@@ -1149,7 +1299,8 @@
            {PreviewsType::LITE_PAGE_REDIRECT,
             PreviewsEligibilityReason::
                 BLACKLIST_DATA_NOT_LOADED}} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   NavigateToUntrackedUrl();
 
@@ -1171,7 +1322,93 @@
                {PreviewsType::LITE_PAGE_REDIRECT,
                 PreviewsEligibilityReason::
                     BLACKLIST_DATA_NOT_LOADED}} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
+}
+
+TEST_F(PreviewsUKMObserverTest, LogOptimizationGuideHintVersion_NoHintSource) {
+  optimization_guide::proto::Version hint_version;
+  hint_version.mutable_generation_timestamp()->set_seconds(123);
+  std::string hint_version_string;
+  hint_version.SerializeToString(&hint_version_string);
+  RunTest(content::PREVIEWS_UNSPECIFIED /* allowed_state */, PreviewsType::NONE,
+          false /* lite_page_received */,
+          false /* lite_page_redirect_received */, false /* noscript_on */,
+          false /* resource_loading_hints_on */, false /* origin_opt_out */,
+          true /* save_data_enabled */, false /* is_offline_preview */,
+          CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
+          base::nullopt /* navigation_restart_penalty */, hint_version_string);
+
+  NavigateToUntrackedUrl();
+
+  ValidateUKM(
+      false /* server_lofi_expected */, false /* client_lofi_expected */,
+      false /* lite_page_expected */, false /* lite_page_redirect_expected */,
+      false /* noscript_expected */,
+      false /* resource_loading_hints_expected */, 0 /* opt_out_value */,
+      false /* origin_opt_out_expected */,
+      true /* save_data_enabled_expected */,
+      false /* offline_preview_expected */, false /* previews_likely */,
+      CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
+      base::nullopt /* navigation_restart_penalty */,
+      123 /* hint_generation_timestamp */, base::nullopt /* hint_source */);
+}
+
+TEST_F(PreviewsUKMObserverTest,
+       LogOptimizationGuideHintVersion_NoHintGenerationTimestamp) {
+  optimization_guide::proto::Version hint_version;
+  hint_version.set_hint_source(
+      optimization_guide::proto::HINT_SOURCE_OPTIMIZATION_HINTS_COMPONENT);
+  std::string hint_version_string;
+  hint_version.SerializeToString(&hint_version_string);
+  RunTest(content::PREVIEWS_UNSPECIFIED /* allowed_state */, PreviewsType::NONE,
+          false /* lite_page_received */,
+          false /* lite_page_redirect_received */, false /* noscript_on */,
+          false /* resource_loading_hints_on */, false /* origin_opt_out */,
+          true /* save_data_enabled */, false /* is_offline_preview */,
+          CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
+          base::nullopt /* navigation_restart_penalty */, hint_version_string);
+
+  NavigateToUntrackedUrl();
+
+  ValidateUKM(
+      false /* server_lofi_expected */, false /* client_lofi_expected */,
+      false /* lite_page_expected */, false /* lite_page_redirect_expected */,
+      false /* noscript_expected */,
+      false /* resource_loading_hints_expected */, 0 /* opt_out_value */,
+      false /* origin_opt_out_expected */,
+      true /* save_data_enabled_expected */,
+      false /* offline_preview_expected */, false /* previews_likely */,
+      CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
+      base::nullopt /* navigation_restart_penalty */,
+      base::nullopt /* hint_generation_timestamp */, 1 /* hint_source */);
+}
+
+TEST_F(PreviewsUKMObserverTest,
+       LogOptimizationGuideHintVersion_NotActuallyAVersionProto) {
+  RunTest(content::PREVIEWS_UNSPECIFIED /* allowed_state */, PreviewsType::NONE,
+          false /* lite_page_received */,
+          false /* lite_page_redirect_received */, false /* noscript_on */,
+          false /* resource_loading_hints_on */, false /* origin_opt_out */,
+          true /* save_data_enabled */, false /* is_offline_preview */,
+          CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
+          base::nullopt /* navigation_restart_penalty */, "notahintversion");
+
+  NavigateToUntrackedUrl();
+
+  ValidateUKM(false /* server_lofi_expected */,
+              false /* client_lofi_expected */, false /* lite_page_expected */,
+              false /* lite_page_redirect_expected */,
+              false /* noscript_expected */,
+              false /* resource_loading_hints_expected */,
+              0 /* opt_out_value */, false /* origin_opt_out_expected */,
+              true /* save_data_enabled_expected */,
+              false /* offline_preview_expected */, false /* previews_likely */,
+              CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, CheckReportingForHidden) {
@@ -1181,7 +1418,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           true /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   web_contents()->WasHidden();
 
@@ -1194,7 +1432,9 @@
               true /* save_data_enabled_expected */,
               false /* offline_preview_expected */, false /* previews_likely */,
               CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, CheckReportingForFlushMetrics) {
@@ -1204,7 +1444,8 @@
           false /* resource_loading_hints_on */, false /* origin_opt_out */,
           true /* save_data_enabled */, false /* is_offline_preview */,
           CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-          base::nullopt /* navigation_restart_penalty */);
+          base::nullopt /* navigation_restart_penalty */,
+          base::nullopt /* hint_version_string */);
 
   SimulateAppEnterBackground();
 
@@ -1217,7 +1458,9 @@
               true /* save_data_enabled_expected */,
               false /* offline_preview_expected */, false /* previews_likely */,
               CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-              base::nullopt /* navigation_restart_penalty */);
+              base::nullopt /* navigation_restart_penalty */,
+              base::nullopt /* hint_generation_timestamp */,
+              base::nullopt /* hint_source */);
 }
 
 TEST_F(PreviewsUKMObserverTest, TestPageEndReasonUMA) {
@@ -1234,7 +1477,8 @@
             false /* resource_loading_hints_on */, false /* origin_opt_out */,
             false /* save_data_enabled */, false /* is_offline_preview */,
             CoinFlipHoldbackResult::kNotSet, {} /* eligibility_reasons */,
-            base::nullopt /* navigation_restart_penalty */);
+            base::nullopt /* navigation_restart_penalty */,
+            base::nullopt /* hint_version_string */);
 
     NavigateToUntrackedUrl();
 
diff --git a/chrome/browser/password_manager/password_accessory_controller_impl_unittest.cc b/chrome/browser/password_manager/password_accessory_controller_impl_unittest.cc
index d69782f..de40726 100644
--- a/chrome/browser/password_manager/password_accessory_controller_impl_unittest.cc
+++ b/chrome/browser/password_manager/password_accessory_controller_impl_unittest.cc
@@ -582,7 +582,14 @@
 
   EXPECT_CALL(*favicon_service(), GetRawFaviconForPageURL(GURL(kExampleSite), _,
                                                           kIconSize, _, _, _))
-      .WillOnce(favicon::PostReply<6>(favicon_base::FaviconRawBitmapResult()));
+      .WillOnce([](auto, auto, auto, auto,
+                   favicon_base::FaviconRawBitmapCallback callback,
+                   base::CancelableTaskTracker* tracker) {
+        return tracker->PostTask(
+            base::ThreadTaskRunnerHandle::Get().get(), FROM_HERE,
+            base::BindOnce(std::move(callback),
+                           favicon_base::FaviconRawBitmapResult()));
+      });
   EXPECT_CALL(mock_callback, Run);
   controller()->GetFavicon(kIconSize, mock_callback.Get());
   base::RunLoop().RunUntilIdle();
@@ -603,7 +610,14 @@
 
   EXPECT_CALL(*favicon_service(), GetRawFaviconForPageURL(GURL(kExampleSite), _,
                                                           kIconSize, _, _, _))
-      .WillOnce(favicon::PostReply<6>(favicon_base::FaviconRawBitmapResult()));
+      .WillOnce([](auto, auto, auto, auto,
+                   favicon_base::FaviconRawBitmapCallback callback,
+                   base::CancelableTaskTracker* tracker) {
+        return tracker->PostTask(
+            base::ThreadTaskRunnerHandle::Get().get(), FROM_HERE,
+            base::BindOnce(std::move(callback),
+                           favicon_base::FaviconRawBitmapResult()));
+      });
   EXPECT_CALL(mock_callback, Run).Times(2);
   controller()->GetFavicon(kIconSize, mock_callback.Get());
   // The favicon service should already start to work on the request.
@@ -644,7 +658,13 @@
 
   EXPECT_CALL(*favicon_service(), GetRawFaviconForPageURL(GURL(kExampleSite), _,
                                                           kIconSize, _, _, _))
-      .WillOnce(favicon::PostReply<6>(non_empty_result));
+      .WillOnce([=](auto, auto, auto, auto,
+                    favicon_base::FaviconRawBitmapCallback callback,
+                    base::CancelableTaskTracker* tracker) {
+        return tracker->PostTask(
+            base::ThreadTaskRunnerHandle::Get().get(), FROM_HERE,
+            base::BindOnce(std::move(callback), non_empty_result));
+      });
   EXPECT_CALL(mock_callback, Run).Times(1);
   controller()->GetFavicon(kIconSize, mock_callback.Get());
 
@@ -674,7 +694,13 @@
   // The cache was cleared, so now the service has to be queried again.
   EXPECT_CALL(*favicon_service(), GetRawFaviconForPageURL(GURL(kExampleSite), _,
                                                           kIconSize, _, _, _))
-      .WillOnce(favicon::PostReply<6>(non_empty_result));
+      .WillOnce([=](auto, auto, auto, auto,
+                    favicon_base::FaviconRawBitmapCallback callback,
+                    base::CancelableTaskTracker* tracker) {
+        return tracker->PostTask(
+            base::ThreadTaskRunnerHandle::Get().get(), FROM_HERE,
+            base::BindOnce(std::move(callback), non_empty_result));
+      });
   EXPECT_CALL(mock_callback, Run).Times(1);
   controller()->GetFavicon(kIconSize, mock_callback.Get());
   base::RunLoop().RunUntilIdle();
@@ -697,15 +723,19 @@
   // has changed.
   EXPECT_CALL(*favicon_service(), GetRawFaviconForPageURL(GURL(kExampleSite), _,
                                                           kIconSize, _, _, _))
-      .WillOnce(testing::DoAll(
-          // Triggering a navigation at this moment ensures that the focused
-          // frame origin changes after the original origin has been sent to the
-          // favicon service, but before checking whether the origins match (and
-          // maybe invoking the callback).
-          testing::InvokeWithoutArgs([this]() {
-            this->NavigateAndCommit(GURL("https://other.frame.com/"));
-          }),
-          favicon::PostReply<6>(favicon_base::FaviconRawBitmapResult())));
+      .WillOnce([=](auto, auto, auto, auto,
+                    favicon_base::FaviconRawBitmapCallback callback,
+                    base::CancelableTaskTracker* tracker) {
+        // Triggering a navigation at this moment ensures that the focused
+        // frame origin changes after the original origin has been sent to the
+        // favicon service, but before checking whether the origins match (and
+        // maybe invoking the callback).
+        this->NavigateAndCommit(GURL("https://other.frame.com/"));
+        return tracker->PostTask(
+            base::ThreadTaskRunnerHandle::Get().get(), FROM_HERE,
+            base::BindOnce(std::move(callback),
+                           favicon_base::FaviconRawBitmapResult()));
+      });
   EXPECT_CALL(mock_callback, Run).Times(0);
   controller()->GetFavicon(kIconSize, mock_callback.Get());
   EXPECT_CALL(mock_manual_filling_controller_,
diff --git a/chrome/browser/payments/chrome_payment_request_delegate.cc b/chrome/browser/payments/chrome_payment_request_delegate.cc
index 7272d11..ca4c819 100644
--- a/chrome/browser/payments/chrome_payment_request_delegate.cc
+++ b/chrome/browser/payments/chrome_payment_request_delegate.cc
@@ -105,7 +105,7 @@
 bool ChromePaymentRequestDelegate::IsIncognito() const {
   Profile* profile =
       Profile::FromBrowserContext(web_contents_->GetBrowserContext());
-  return profile && profile->IsIncognito();
+  return profile && profile->IsIncognitoProfile();
 }
 
 bool ChromePaymentRequestDelegate::IsSslCertificateValid() {
diff --git a/chrome/browser/prefs/browser_prefs.cc b/chrome/browser/prefs/browser_prefs.cc
index 9ae3aaba..9379053 100644
--- a/chrome/browser/prefs/browser_prefs.cc
+++ b/chrome/browser/prefs/browser_prefs.cc
@@ -446,6 +446,13 @@
     "ContentSuggestionsNotificationIDWithinCategory";
 #endif  // defined(OS_ANDROID)
 
+#if !defined(OS_ANDROID)
+// Deprecated 5/2019
+const char kSignInPromoShowOnFirstRunAllowed[] =
+    "sync_promo.show_on_first_run_allowed";
+const char kSignInPromoShowNTPBubble[] = "sync_promo.show_ntp_bubble";
+#endif  // !defined(OS_ANDROID)
+
 // Register prefs used only for migration (clearing or moving to a new key).
 void RegisterProfilePrefsForMigration(
     user_prefs::PrefRegistrySyncable* registry) {
@@ -502,6 +509,11 @@
   registry->RegisterIntegerPref(kContentSuggestionsNotificationsSentCount, 0);
   registry->RegisterStringPref(kNotificationIDWithinCategory, std::string());
 #endif  // defined(OS_ANDROID)
+
+#if !defined(OS_ANDROID)
+  registry->RegisterBooleanPref(kSignInPromoShowOnFirstRunAllowed, true);
+  registry->RegisterBooleanPref(kSignInPromoShowNTPBubble, false);
+#endif  // !defined(OS_ANDROID)
 }
 
 }  // namespace
@@ -1089,4 +1101,10 @@
   profile_prefs->ClearPref(kContentSuggestionsNotificationsSentCount);
   profile_prefs->ClearPref(kNotificationIDWithinCategory);
 #endif  // defined(OS_ANDROID)
+
+#if !defined(OS_ANDROID)
+  // Deprecated 5/2019
+  profile_prefs->ClearPref(kSignInPromoShowOnFirstRunAllowed);
+  profile_prefs->ClearPref(kSignInPromoShowNTPBubble);
+#endif  // !defined(OS_ANDROID)
 }
diff --git a/chrome/browser/profiles/off_the_record_profile_impl.cc b/chrome/browser/profiles/off_the_record_profile_impl.cc
index d0bc993..9c81d41a 100644
--- a/chrome/browser/profiles/off_the_record_profile_impl.cc
+++ b/chrome/browser/profiles/off_the_record_profile_impl.cc
@@ -250,7 +250,7 @@
 
 #if !defined(OS_ANDROID)
 void OffTheRecordProfileImpl::TrackZoomLevelsFromParent() {
-  DCHECK(!profile_->IsIncognito());
+  DCHECK(!profile_->IsIncognitoProfile());
 
   // Here we only want to use zoom levels stored in the main-context's default
   // storage partition. We're not interested in zoom levels in special
diff --git a/chrome/browser/profiles/profile.cc b/chrome/browser/profiles/profile.cc
index 8a95e22..f9d9232 100644
--- a/chrome/browser/profiles/profile.cc
+++ b/chrome/browser/profiles/profile.cc
@@ -233,7 +233,7 @@
   return GetProfileType() == REGULAR_PROFILE;
 }
 
-bool Profile::IsIncognito() const {
+bool Profile::IsIncognitoProfile() const {
   return GetProfileType() == INCOGNITO_PROFILE;
 }
 
diff --git a/chrome/browser/profiles/profile.h b/chrome/browser/profiles/profile.h
index b5e12192..7a87981c 100644
--- a/chrome/browser/profiles/profile.h
+++ b/chrome/browser/profiles/profile.h
@@ -307,18 +307,18 @@
 
   std::string GetDebugName();
 
-  // IsRegularProfile(), IsIncognito(), and IsGuestProfile() are mutually
+  // IsRegularProfile(), IsIncognitoProfile(), and IsGuestProfile() are mutually
   // exclusive.
   // IsSystemProfile() implies that IsRegularProfile() is true.
-  // IsOffTheRecord() is an equivalent of IsIncognito() || IsGuestProfile().
+  // IsOffTheRecord() is an equivalent of IsIncognitoProfile() ||
+  // IsGuestProfile().
 
   // Returns whether it's a regular profile.
   bool IsRegularProfile() const;
 
   // Returns whether it is an Incognito profile. An Incognito profile is an
   // off-the-record profile that is not a guest profile.
-  // TODO(https://crbug.com/947933): Replace with IsIncognitProfile.
-  bool IsIncognito() const;
+  bool IsIncognitoProfile() const;
 
   // Returns whether it is a Guest profile. A Guest profile is an off-the-record
   // profile in a guest session.
diff --git a/chrome/browser/profiles/profile_key.cc b/chrome/browser/profiles/profile_key.cc
index 946403e..602030c 100644
--- a/chrome/browser/profiles/profile_key.cc
+++ b/chrome/browser/profiles/profile_key.cc
@@ -5,12 +5,11 @@
 #include "chrome/browser/profiles/profile_key.h"
 
 #include "base/logging.h"
-#include "components/keyed_service/core/simple_dependency_manager.h"
 
 ProfileKey::ProfileKey(const base::FilePath& path, ProfileKey* original_key)
-    : SimpleFactoryKey(path), prefs_(nullptr), original_key_(original_key) {
-  SimpleDependencyManager::GetInstance()->MarkContextLive(this);
-}
+    : SimpleFactoryKey(path, original_key != nullptr /* is_off_the_record */),
+      prefs_(nullptr),
+      original_key_(original_key) {}
 
 ProfileKey::~ProfileKey() = default;
 
@@ -24,10 +23,6 @@
   prefs_ = prefs;
 }
 
-bool ProfileKey::IsOffTheRecord() const {
-  return original_key_ != nullptr;
-}
-
 // static
 ProfileKey* ProfileKey::FromSimpleFactoryKey(SimpleFactoryKey* key) {
   return key ? static_cast<ProfileKey*>(key) : nullptr;
diff --git a/chrome/browser/profiles/profile_key.h b/chrome/browser/profiles/profile_key.h
index 511b146..ed4ca905 100644
--- a/chrome/browser/profiles/profile_key.h
+++ b/chrome/browser/profiles/profile_key.h
@@ -26,9 +26,6 @@
 
   static ProfileKey* FromSimpleFactoryKey(SimpleFactoryKey* key);
 
-  // SimpleFactoryKey implementation.
-  bool IsOffTheRecord() const override;
-
  private:
   PrefService* prefs_;
 
diff --git a/chrome/browser/profiles/profile_window.cc b/chrome/browser/profiles/profile_window.cc
index 664c045..d0a458e 100644
--- a/chrome/browser/profiles/profile_window.cc
+++ b/chrome/browser/profiles/profile_window.cc
@@ -440,7 +440,7 @@
       *bubble_view_mode = BUBBLE_VIEW_MODE_PROFILE_CHOOSER;
       return;
     case BrowserWindow::AVATAR_BUBBLE_MODE_DEFAULT:
-      *bubble_view_mode = profile->IsIncognito()
+      *bubble_view_mode = profile->IsIncognitoProfile()
                               ? profiles::BUBBLE_VIEW_MODE_INCOGNITO
                               : profiles::BUBBLE_VIEW_MODE_PROFILE_CHOOSER;
   }
diff --git a/chrome/browser/resources/ntp4/new_tab.css b/chrome/browser/resources/ntp4/new_tab.css
index e9827c3..13287295 100644
--- a/chrome/browser/resources/ntp4/new_tab.css
+++ b/chrome/browser/resources/ntp4/new_tab.css
@@ -180,33 +180,6 @@
   background-position-x: left;
 }
 
-#login-status-bubble-contents {
-  font-size: 1.1em;
-}
-
-#login-status-message-container {
-  margin-bottom: 13px;
-}
-
-#login-status-learn-more {
-  display: inline-block;
-}
-
-.login-status-row {
-  -webkit-box-align: center;
-  -webkit-box-orient: horizontal;
-  -webkit-box-pack: end;
-  display: -webkit-box;
-}
-
-#login-status-advanced-container {
-  -webkit-box-flex: 1;
-}
-
-#login-status-dismiss {
-  min-width: 6em;
-}
-
 /* Trash. *********************************************************************/
 
 #trash {
diff --git a/chrome/browser/resources/ntp4/new_tab.html b/chrome/browser/resources/ntp4/new_tab.html
index af96047..d47c1c8 100644
--- a/chrome/browser/resources/ntp4/new_tab.html
+++ b/chrome/browser/resources/ntp4/new_tab.html
@@ -110,23 +110,6 @@
 <!-- A div to hold all the templates, and in the darkness bind them. -->
 <div hidden>
 
-<!-- Login status bubble -->
-<div id="login-status-bubble-contents">
-  <div id="login-status-message-container">
-    <span>$i18n{login_status_message}</span>
-    <a id="login-status-learn-more" href="$i18nRaw{login_status_url}"
-        target="_blank">$i18n{learn_more}</a>
-  </div>
-  <div class="login-status-row">
-    <div id="login-status-advanced-container">
-      <a is="action-link" id="login-status-advanced">
-        $i18n{login_status_advanced}
-      </a>
-    </div>
-    <button id="login-status-dismiss">$i18n{login_status_dismiss}</button>
-  </div>
-</div>
-
 <!-- App Contents w/ Large Icon -->
 <div id="app-large-icon-template" class="app-contents">
   <div class="app-img-container" aria-hidden="true">
diff --git a/chrome/browser/resources/ntp4/new_tab.js b/chrome/browser/resources/ntp4/new_tab.js
index 0893f9b..dff1185 100644
--- a/chrome/browser/resources/ntp4/new_tab.js
+++ b/chrome/browser/resources/ntp4/new_tab.js
@@ -20,19 +20,6 @@
   let newTabView;
 
   /**
-   * If non-null, an bubble confirming that the user has signed into sync. It
-   * points at the login status at the top of the page.
-   * @type {!cr.ui.Bubble|undefined}
-   */
-  let loginBubble;
-
-  /**
-   * true if |loginBubble| should be shown.
-   * @type {boolean}
-   */
-  let shouldShowLoginBubble = false;
-
-  /**
    * The time when all sections are ready.
    * @type {number|undefined}
    * @private
@@ -105,28 +92,6 @@
     // we can compute its layout.
     layoutFooter();
 
-    if (loadTimeData.getString('login_status_message')) {
-      loginBubble = new cr.ui.Bubble;
-      loginBubble.anchorNode = $('login-container');
-      loginBubble.arrowLocation = cr.ui.ArrowLocation.TOP_END;
-      loginBubble.bubbleAlignment =
-          cr.ui.BubbleAlignment.BUBBLE_EDGE_TO_ANCHOR_EDGE;
-      loginBubble.deactivateToDismissDelay = 2000;
-      loginBubble.closeButtonVisible = false;
-
-      $('login-status-advanced').onclick = function() {
-        chrome.send('showAdvancedLoginUI');
-      };
-      $('login-status-dismiss').onclick = loginBubble.hide.bind(loginBubble);
-
-      const bubbleContent = $('login-status-bubble-contents');
-      loginBubble.content = bubbleContent;
-
-      // The anchor node won't be updated until updateLogin is called so don't
-      // show the bubble yet.
-      shouldShowLoginBubble = true;
-    }
-
     $('login-container').addEventListener('click', showSyncLoginUI);
     if (loadTimeData.getBoolean('shouldShowSyncLogin')) {
       chrome.send('initializeSyncLogin');
@@ -295,14 +260,6 @@
       headerContainer.style.backgroundImage =
           iconURL ? getUrlForCss(iconURL) : 'none';
     }
-
-    if (shouldShowLoginBubble) {
-      window.setTimeout(loginBubble.show.bind(loginBubble), 0);
-      chrome.send('loginMessageSeen');
-      shouldShowLoginBubble = false;
-    } else if (loginBubble) {
-      loginBubble.reposition();
-    }
   }
 
   /**
@@ -363,14 +320,6 @@
   }
 
   /**
-   * Callback invoked by chrome whenever the app launcher promo pref changes.
-   * @param {boolean} show Identifies if we should show or hide the promo.
-   */
-  function appLauncherPromoPrefChangeCallback(show) {
-    newTabView.appLauncherPromoPrefChangeCallback(show);
-  }
-
-  /**
    * Called whenever tiles should be re-arranging themselves out of the way
    * of a moving or insert tile.
    */
@@ -431,7 +380,6 @@
     appMoved: appMoved,
     appRemoved: appRemoved,
     appsPrefChangeCallback: appsPrefChangeCallback,
-    appLauncherPromoPrefChangeCallback: appLauncherPromoPrefChangeCallback,
     enterRearrangeMode: enterRearrangeMode,
     getAppsCallback: getAppsCallback,
     getAppsPageIndex: getAppsPageIndex,
diff --git a/chrome/browser/resources/settings/kiosk_next_shell_page/kiosk_next_shell_confirmation_dialog.js b/chrome/browser/resources/settings/kiosk_next_shell_page/kiosk_next_shell_confirmation_dialog.js
index 5c82394a..c4dd7f15 100644
--- a/chrome/browser/resources/settings/kiosk_next_shell_page/kiosk_next_shell_confirmation_dialog.js
+++ b/chrome/browser/resources/settings/kiosk_next_shell_page/kiosk_next_shell_confirmation_dialog.js
@@ -9,6 +9,13 @@
  * shell requires a sign out, we need to provide this dialog to avoid surprising
  * users.
  */
+
+/**
+ * Histogram name for KioskNextShell enabled state.
+ * @type {string}
+ */
+const KIOSK_NEXT_SHELL_ENABLED_STATE_UMA_NAME = 'KioskNextShell.EnabledState';
+
 Polymer({
   is: 'settings-kiosk-next-shell-confirmation-dialog',
 
@@ -42,7 +49,12 @@
    */
   onConfirmClick_: function(event) {
     const prefPath = 'ash.kiosk_next_shell.enabled';
-    this.setPrefValue(prefPath, !this.getPref(prefPath).value);
+    // Toggle previous enabled state.
+    const isEnabled = !this.getPref(prefPath).value;
+    chrome.send(
+        'metricsHandler:recordBooleanHistogram',
+        [KIOSK_NEXT_SHELL_ENABLED_STATE_UMA_NAME, isEnabled]);
+    this.setPrefValue(prefPath, isEnabled);
     settings.LifetimeBrowserProxyImpl.getInstance().signOutAndRestart();
     this.$.dialog.close();
     event.stopPropagation();
diff --git a/chrome/browser/resources/settings/os_settings_resources.grd b/chrome/browser/resources/settings/os_settings_resources.grd
index d8021a7..eebda2c 100644
--- a/chrome/browser/resources/settings/os_settings_resources.grd
+++ b/chrome/browser/resources/settings/os_settings_resources.grd
@@ -1232,8 +1232,13 @@
                  type="chrome_html"/>
       <structure name="IDR_OS_SETTINGS_PEOPLE_PAGE_KERBEROS_ACCOUNTS_JS"
                  file="people_page/kerberos_accounts.js"
-                 type="chrome_html"
-                 preprocess="true" />
+                 type="chrome_html"/>
+      <structure name="IDR_OS_SETTINGS_PEOPLE_PAGE_KERBEROS_ADD_ACCOUNT_DIALOG_HTML"
+                 file="people_page/kerberos_add_account_dialog.html"
+                 type="chrome_html"/>
+      <structure name="IDR_OS_SETTINGS_PEOPLE_PAGE_KERBEROS_ADD_ACCOUNT_DIALOG_JS"
+                 file="people_page/kerberos_add_account_dialog.js"
+                 type="chrome_html"/>
       <structure name="IDR_OS_SETTINGS_PEOPLE_PAGE_KEREROS_ACCOUNTS_BROWSER_PROXY_HTML"
                  file="people_page/kerberos_accounts_browser_proxy.html"
                  type="chrome_html"/>
diff --git a/chrome/browser/resources/settings/people_page/BUILD.gn b/chrome/browser/resources/settings/people_page/BUILD.gn
index 6750eb3..68f69699 100644
--- a/chrome/browser/resources/settings/people_page/BUILD.gn
+++ b/chrome/browser/resources/settings/people_page/BUILD.gn
@@ -33,6 +33,7 @@
       ":fingerprint_list",
       ":kerberos_accounts",
       ":kerberos_accounts_browser_proxy",
+      ":kerberos_add_account_dialog",
       ":lock_screen",
       ":lock_screen_password_prompt_dialog",
       ":lock_state_behavior",
@@ -125,6 +126,15 @@
   ]
 }
 
+js_library("kerberos_add_account_dialog") {
+  deps = [
+    ":kerberos_accounts_browser_proxy",
+    "//ui/webui/resources/cr_elements/cr_input:cr_input",
+    "//ui/webui/resources/js:cr",
+    "//ui/webui/resources/js:i18n_behavior",
+    "//ui/webui/resources/js:web_ui_listener_behavior",
+  ]
+}
 js_library("lock_screen") {
   deps = [
     ":fingerprint_browser_proxy",
diff --git a/chrome/browser/resources/settings/people_page/kerberos_accounts.html b/chrome/browser/resources/settings/people_page/kerberos_accounts.html
index b977bbc..f20559b 100644
--- a/chrome/browser/resources/settings/people_page/kerberos_accounts.html
+++ b/chrome/browser/resources/settings/people_page/kerberos_accounts.html
@@ -4,13 +4,15 @@
 <link rel="import" href="chrome://resources/cr_elements/cr_icon_button/cr_icon_button.html">
 <link rel="import" href="chrome://resources/cr_elements/paper_button_style_css.html">
 <link rel="import" href="chrome://resources/html/icon.html">
-<link rel="import" href="chrome://resources/html/load_time_data.html">
 <link rel="import" href="chrome://resources/html/util.html">
 <link rel="import" href="chrome://resources/html/web_ui_listener_behavior.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/iron-flex-layout/iron-flex-layout-classes.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-button/paper-button.html">
+<link rel="import" href="../i18n_setup.html">
+<link rel="import" href="../route.html">
 <link rel="import" href="../settings_shared_css.html">
 <link rel="import" href="kerberos_accounts_browser_proxy.html">
+<link rel="import" href="kerberos_add_account_dialog.html">
 
 <dom-module id="settings-kerberos-accounts">
   <template>
@@ -63,7 +65,7 @@
       <div id="account-list-header" class="flex">
         <h2>$i18n{kerberosAccountsListHeader}</h2>
       </div>
-      <paper-button id="add-account-button" on-click="addAccount_">
+      <paper-button id="add-account-button" on-click="onAddAccountClick_">
         <div id="add-account-icon"></div>
         $i18n{kerberosAccountsAddAccountLabel}
       </paper-button>
@@ -112,6 +114,12 @@
         </button>
       </cr-action-menu>
     </div>
+
+    <template is="dom-if" if="[[showAddAccountDialog_]]" restamp>
+      <kerberos-add-account-dialog username="[[addAccountPresetUsername_]]"
+          on-close="onAddAccountDialogClosed_">
+      </kerberos-add-account-dialog>
+    </template>
   </template>
   <script src="kerberos_accounts.js"></script>
 </dom-module>
\ No newline at end of file
diff --git a/chrome/browser/resources/settings/people_page/kerberos_accounts.js b/chrome/browser/resources/settings/people_page/kerberos_accounts.js
index cf85a05..219fe4f 100644
--- a/chrome/browser/resources/settings/people_page/kerberos_accounts.js
+++ b/chrome/browser/resources/settings/people_page/kerberos_accounts.js
@@ -32,6 +32,15 @@
      * @private {?settings.KerberosAccount}
      */
     actionMenuAccount_: Object,
+
+    /** @private */
+    addAccountPresetUsername_: {
+      type: String,
+      value: '',
+    },
+
+    /** @private */
+    showAddAccountDialog_: Boolean,
   },
 
   /** @private {?settings.KerberosAccountsBrowserProxy} */
@@ -63,8 +72,9 @@
    * @param {!Event} event
    * @private
    */
-  addAccount_: function(event) {
-    this.browserProxy_.addAccount();
+  onAddAccountClick_: function(event) {
+    this.addAccountPresetUsername_ = '';
+    this.showAddAccountDialog_ = true;
   },
 
   /**
@@ -72,7 +82,13 @@
    * @private
    */
   onReauthenticationClick_: function(event) {
-    this.browserProxy_.reauthenticateAccount(event.model.item.principalName);
+    this.addAccountPresetUsername_ = event.model.item.principalName;
+    this.showAddAccountDialog_ = true;
+  },
+
+  /** @private */
+  onAddAccountDialogClosed_: function() {
+    this.showAddAccountDialog_ = false;
   },
 
   /**
diff --git a/chrome/browser/resources/settings/people_page/kerberos_accounts_browser_proxy.html b/chrome/browser/resources/settings/people_page/kerberos_accounts_browser_proxy.html
index 7ca5511cc..c74b570 100644
--- a/chrome/browser/resources/settings/people_page/kerberos_accounts_browser_proxy.html
+++ b/chrome/browser/resources/settings/people_page/kerberos_accounts_browser_proxy.html
@@ -1 +1,2 @@
+<link rel="import" href="chrome://resources/html/cr.html">
 <script src="kerberos_accounts_browser_proxy.js"></script>
\ No newline at end of file
diff --git a/chrome/browser/resources/settings/people_page/kerberos_accounts_browser_proxy.js b/chrome/browser/resources/settings/people_page/kerberos_accounts_browser_proxy.js
index a9731c7..25ec4f1 100644
--- a/chrome/browser/resources/settings/people_page/kerberos_accounts_browser_proxy.js
+++ b/chrome/browser/resources/settings/people_page/kerberos_accounts_browser_proxy.js
@@ -20,6 +20,33 @@
 settings.KerberosAccount;
 
 cr.define('settings', function() {
+  /**
+   *  @enum {number}
+   *  These values must be kept in sync with the ErrorType enum in
+   *  third_party/cros_system_api/dbus/kerberos/kerberos_service.proto.
+   */
+  const KerberosErrorType = {
+    kNone: 0,
+    kUnknown: 1,
+    kDBusFailure: 2,
+    kNetworkProblem: 3,
+    kUnknownKrb5Error: 4,
+    kBadPrincipal: 5,
+    kBadPassword: 6,
+    kPasswordExpired: 7,
+    kPasswordRejected: 8,
+    kNoCredentialsCacheFound: 9,
+    kKerberosTicketExpired: 10,
+    kKdcDoesNotSupportEncryptionType: 11,
+    kContactingKdcFailed: 12,
+    kParseRequestFailed: 13,
+    kLocalIo: 14,
+    kUnknownPrincipalName: 15,
+    kDuplicatePrincipalName: 16,
+    kInProgress: 17,
+    kParsePrincipalFailed: 18,
+  };
+
   /** @interface */
   class KerberosAccountsBrowserProxy {
     /**
@@ -30,16 +57,12 @@
     getAccounts() {}
 
     /**
-     * Triggers the 'Add account' flow.
+     * Attempts to add a new (or update an existing) Kerberos account.
+     * @param {string} principalName Kerberos principal (user@realm.com).
+     * @param {string} password Account password.
+     * @return {!Promise<!settings.KerberosErrorType>}
      */
-    addAccount() {}
-
-    /**
-     * Triggers the re-authentication flow for the account pointed to by
-     * |principalName|.
-     * @param {!string} principalName
-     */
-    reauthenticateAccount(principalName) {}
+    addAccount(principalName, password) {}
 
     /**
      * Removes |account| from the set of Kerberos accounts.
@@ -58,13 +81,8 @@
     }
 
     /** @override */
-    addAccount() {
-      chrome.send('addKerberosAccount');
-    }
-
-    /** @override */
-    reauthenticateAccount(principalName) {
-      chrome.send('reauthenticateKerberosAccount', [principalName]);
+    addAccount(principalName, password) {
+      return cr.sendWithPromise('addKerberosAccount', principalName, password);
     }
 
     /** @override */
@@ -76,6 +94,7 @@
   cr.addSingletonGetter(KerberosAccountsBrowserProxyImpl);
 
   return {
+    KerberosErrorType: KerberosErrorType,
     KerberosAccountsBrowserProxy: KerberosAccountsBrowserProxy,
     KerberosAccountsBrowserProxyImpl: KerberosAccountsBrowserProxyImpl,
   };
diff --git a/chrome/browser/resources/settings/people_page/kerberos_add_account_dialog.html b/chrome/browser/resources/settings/people_page/kerberos_add_account_dialog.html
new file mode 100644
index 0000000..c6a15532
--- /dev/null
+++ b/chrome/browser/resources/settings/people_page/kerberos_add_account_dialog.html
@@ -0,0 +1,63 @@
+<link rel="import" href="chrome://resources/html/polymer.html">
+
+<link rel="import" href="chrome://resources/cr_elements/cr_dialog/cr_dialog.html">
+<link rel="import" href="chrome://resources/cr_elements/cr_input/cr_input.html">
+<link rel="import" href="chrome://resources/cr_elements/icons.html">
+<link rel="import" href="chrome://resources/cr_elements/paper_button_style_css.html">
+<link rel="import" href="chrome://resources/cr_elements/shared_vars_css.html">
+<link rel="import" href="chrome://resources/html/i18n_behavior.html">
+<link rel="import" href="chrome://resources/html/load_time_data.html">
+<link rel="import" href="chrome://resources/html/web_ui_listener_behavior.html">
+<link rel="import" href="chrome://resources/polymer/v1_0/iron-icon/iron-icon.html">
+<link rel="import" href="chrome://resources/polymer/v1_0/paper-button/paper-button.html">
+<link rel="import" href="kerberos_accounts_browser_proxy.html">
+
+<dom-module id="kerberos-add-account-dialog">
+  <template>
+    <style include="paper-button-style">
+      .label {
+        @apply --cr-form-field-label;
+      }
+
+      #credentials > cr-input:not(:last-child) {
+        margin-bottom: var(--cr-form-field-bottom-spacing);
+      }
+
+      #general-error-container {
+        height: 48px;
+      }
+    </style>
+    <cr-dialog id="dialog">
+      <div slot="title">$i18n{addKerberosAccount}</div>
+      <div slot="body" spellcheck="false">
+        <div id="general-error-container">
+          <div hidden="[[!showError_(generalErrorText_)]]">
+            <iron-icon id="general-error-icon" icon="cr:warning"></iron-icon>
+            <div id="general-error-message">[[generalErrorText_]]</div>
+          </div>
+        </div>
+        <div id="credentials">
+          <cr-input id="username" label="$i18n{kerberosUsername}"
+              value="{{username}}" invalid="[[showError_(usernameErrorText_)]]"
+              error-message="[[usernameErrorText_]]">
+          </cr-input>
+          <cr-input id="password" type="password"
+              label="$i18n{kerberosPassword}" value="{{password_}}"
+              invalid="[[showError_(passwordErrorText_)]]"
+              error-message="[[passwordErrorText_]]">
+          </cr-input>
+        </div>
+      </div>
+      <div slot="button-container">
+        <paper-button class="cancel-button" on-click="onCancel_" id="cancel">
+          $i18n{cancel}
+        </paper-button>
+        <paper-button class="action-button" on-click="onAdd_"
+            disabled="[[inProgress_]]">
+          $i18n{add}
+        </paper-button>
+      </div>
+    </cr-dialog>
+  </template>
+  <script src="kerberos_add_account_dialog.js"></script>
+</dom-module>
\ No newline at end of file
diff --git a/chrome/browser/resources/settings/people_page/kerberos_add_account_dialog.js b/chrome/browser/resources/settings/people_page/kerberos_add_account_dialog.js
new file mode 100644
index 0000000..2b139099
--- /dev/null
+++ b/chrome/browser/resources/settings/people_page/kerberos_add_account_dialog.js
@@ -0,0 +1,151 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/**
+ * @fileoverview
+ * 'kerberos-add-account-dialog' is an element to add Kerberos accounts.
+ */
+
+Polymer({
+  is: 'kerberos-add-account-dialog',
+
+  behaviors: [I18nBehavior],
+
+  properties: {
+    username: {
+      type: String,
+      value: '',
+    },
+
+    /** @private */
+    password_: {
+      type: String,
+      value: '',
+    },
+
+    /** @private */
+    generalErrorText_: {
+      type: String,
+      value: '',
+    },
+
+    /** @private */
+    usernameErrorText_: {
+      type: String,
+      value: '',
+    },
+
+    /** @private */
+    passwordErrorText_: {
+      type: String,
+      value: '',
+    },
+
+    /** @private */
+    inProgress_: {
+      type: Boolean,
+      value: false,
+    },
+  },
+
+  /** @private {?settings.KerberosAccountsBrowserProxy} */
+  browserProxy_: null,
+
+  /** @private {!settings.KerberosErrorType} */
+  lastError_: settings.KerberosErrorType.kNone,
+
+  /** @override */
+  attached: function() {
+    this.$.dialog.showModal();
+
+    // If a non-empty username is preset, make the UI read-only.
+    // Note: At least the focus() part needs to be after showModal.
+    if (this.username) {
+      this.$.username.disabled = true;
+      this.$.password.focus();
+    }
+  },
+
+  /** @private */
+  onCancel_: function() {
+    this.$.dialog.cancel();
+  },
+
+  /** @private */
+  onAdd_: function() {
+    this.inProgress_ = true;
+    this.updateErrorMessages_(settings.KerberosErrorType.kNone);
+
+    settings.KerberosAccountsBrowserProxyImpl.getInstance()
+        .addAccount(this.username, this.password_)
+        .then(error => {
+          this.inProgress_ = false;
+
+          // Success case. Close dialog.
+          if (error == settings.KerberosErrorType.kNone) {
+            this.$.dialog.close();
+            return;
+          }
+
+          // Triggers the UI to update error messages.
+          this.updateErrorMessages_(error);
+        });
+  },
+
+  /**
+   * @param {!settings.KerberosErrorType} error Current error enum
+   * @private
+   */
+  updateErrorMessages_: function(error) {
+    this.lastError_ = error;
+
+    this.generalErrorText_ = '';
+    this.usernameErrorText_ = '';
+    this.passwordErrorText_ = '';
+
+    switch (error) {
+      // TODO(ljusten): Proper errors
+      case settings.KerberosErrorType.kNone:
+        break;
+
+      case settings.KerberosErrorType.kNetworkProblem:
+        this.generalErrorText_ = 'Network problem or bad realm';
+        break;
+      case settings.KerberosErrorType.kParsePrincipalFailed:
+        this.usernameErrorText_ = 'Username invalid (should be user@realm.com)';
+        break;
+      case settings.KerberosErrorType.kBadPrincipal:
+        this.usernameErrorText_ = 'Username not known to server';
+        break;
+      case settings.KerberosErrorType.kContactingKdcFailed:
+        this.usernameErrorText_ = 'Contacting server for realm failed';
+        break;
+
+      case settings.KerberosErrorType.kBadPassword:
+        this.passwordErrorText_ = 'Password invalid';
+        break;
+      case settings.KerberosErrorType.kPasswordExpired:
+        this.passwordErrorText_ = 'Password expired';
+        break;
+
+      case settings.KerberosErrorType.kKdcDoesNotSupportEncryptionType:
+        this.generalErrorText_ = 'KDC does not support encryption type';
+        break;
+      default:
+        this.generalErrorText_ = this.i18nDynamic(
+            this.locale, 'kerberosGeneralErrorMessage', String(error));
+    }
+  },
+
+  /**
+   * Whether an error element should be shown.
+   * Note that !! is not supported in Polymer bindings.
+   * @param {?string} errorText Error text to be displayed. Empty if no error.
+   * @return {boolean} True iff errorText is not empty.
+   * @private
+   */
+  showError_: function(errorText) {
+    return !!errorText;
+  }
+});
\ No newline at end of file
diff --git a/chrome/browser/resources/settings/settings_resources.grd b/chrome/browser/resources/settings/settings_resources.grd
index 50e2709..4b220cb 100644
--- a/chrome/browser/resources/settings/settings_resources.grd
+++ b/chrome/browser/resources/settings/settings_resources.grd
@@ -1519,6 +1519,12 @@
         <structure name="IDR_SETTINGS_PEOPLE_PAGE_KERBEROS_ACCOUNTS_JS"
                    file="people_page/kerberos_accounts.js"
                    type="chrome_html"/>
+        <structure name="IDR_OS_SETTINGS_PEOPLE_PAGE_KERBEROS_ADD_ACCOUNT_DIALOG_HTML"
+                   file="people_page/kerberos_add_account_dialog.html"
+                   type="chrome_html"/>
+        <structure name="IDR_OS_SETTINGS_PEOPLE_PAGE_KERBEROS_ADD_ACCOUNT_DIALOG_JS"
+                   file="people_page/kerberos_add_account_dialog.js"
+                   type="chrome_html"/>
         <structure name="IDR_SETTINGS_PEOPLE_PAGE_KERBEROS_ACCOUNTS_BROWSER_PROXY_HTML"
                    file="people_page/kerberos_accounts_browser_proxy.html"
                    type="chrome_html"/>
diff --git a/chrome/browser/safe_browsing/BUILD.gn b/chrome/browser/safe_browsing/BUILD.gn
index e817d3d..c0b9160 100644
--- a/chrome/browser/safe_browsing/BUILD.gn
+++ b/chrome/browser/safe_browsing/BUILD.gn
@@ -48,11 +48,8 @@
     sources += [
       "chrome_cleaner/chrome_cleaner_controller_impl_win.cc",
       "chrome_cleaner/chrome_cleaner_controller_impl_win.h",
-      "chrome_cleaner/chrome_cleaner_controller_win.cc",
-      "chrome_cleaner/chrome_cleaner_controller_win.h",
       "chrome_cleaner/chrome_cleaner_dialog_controller_impl_win.cc",
       "chrome_cleaner/chrome_cleaner_dialog_controller_impl_win.h",
-      "chrome_cleaner/chrome_cleaner_dialog_controller_win.h",
       "chrome_cleaner/chrome_cleaner_extensions_util_win.h",
       "chrome_cleaner/chrome_cleaner_fetcher_win.cc",
       "chrome_cleaner/chrome_cleaner_fetcher_win.h",
@@ -60,11 +57,8 @@
       "chrome_cleaner/chrome_cleaner_navigation_util_win.h",
       "chrome_cleaner/chrome_cleaner_reboot_dialog_controller_impl_win.cc",
       "chrome_cleaner/chrome_cleaner_reboot_dialog_controller_impl_win.h",
-      "chrome_cleaner/chrome_cleaner_reboot_dialog_controller_win.h",
       "chrome_cleaner/chrome_cleaner_runner_win.cc",
       "chrome_cleaner/chrome_cleaner_runner_win.h",
-      "chrome_cleaner/chrome_cleaner_scanner_results_win.cc",
-      "chrome_cleaner/chrome_cleaner_scanner_results_win.h",
       "chrome_cleaner/reporter_runner_win.cc",
       "chrome_cleaner/reporter_runner_win.h",
       "chrome_cleaner/settings_resetter_win.cc",
@@ -73,8 +67,6 @@
       "chrome_cleaner/srt_chrome_prompt_impl_win.h",
       "chrome_cleaner/srt_client_info_win.cc",
       "chrome_cleaner/srt_client_info_win.h",
-      "chrome_cleaner/srt_field_trial_win.cc",
-      "chrome_cleaner/srt_field_trial_win.h",
       "settings_reset_prompt/default_settings_fetcher.cc",
       "settings_reset_prompt/default_settings_fetcher.h",
       "settings_reset_prompt/settings_reset_prompt_config.cc",
@@ -89,17 +81,12 @@
       "settings_reset_prompt/settings_reset_prompt_util_win.h",
     ]
     deps += [
+      ":chrome_cleaner_types",
       "//components/keep_alive_registry",
       "//extensions/browser",
     ]
   }
 
-  if (is_chrome_branded && is_win) {
-    sources += [ "chrome_cleaner/chrome_cleaner_extension_util_win.cc" ]
-  } else {
-    sources += [ "chrome_cleaner/chrome_cleaner_extension_util_win_noop.cc" ]
-  }
-
   if (safe_browsing_mode != 0) {
     # "Safe Browsing Basic" files used for safe browsing in full mode
     # (safe_browsing=1) and mobile (=2)
@@ -307,6 +294,29 @@
   ]
 }
 
+source_set("chrome_cleaner_types") {
+  sources = [
+    "chrome_cleaner/chrome_cleaner_controller_win.cc",
+    "chrome_cleaner/chrome_cleaner_controller_win.h",
+    "chrome_cleaner/chrome_cleaner_dialog_controller_win.h",
+    "chrome_cleaner/chrome_cleaner_reboot_dialog_controller_win.h",
+    "chrome_cleaner/chrome_cleaner_scanner_results_win.cc",
+    "chrome_cleaner/chrome_cleaner_scanner_results_win.h",
+    "chrome_cleaner/srt_field_trial_win.cc",
+    "chrome_cleaner/srt_field_trial_win.h",
+    "chrome_cleaner/sw_reporter_invocation_win.cc",
+    "chrome_cleaner/sw_reporter_invocation_win.h",
+  ]
+
+  deps = [
+    "//base",
+    "//components/chrome_cleaner/public/constants",
+    "//components/chrome_cleaner/public/interfaces",
+    "//components/variations",
+    "//url",
+  ]
+}
+
 source_set("test_support") {
   if (safe_browsing_mode != 0) {
     sources = [
diff --git a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_controller_impl_win.cc b/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_controller_impl_win.cc
index 2a2082571..dcc1445 100644
--- a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_controller_impl_win.cc
+++ b/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_controller_impl_win.cc
@@ -31,6 +31,7 @@
 #include "chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_navigation_util_win.h"
 #include "chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_reboot_dialog_controller_impl_win.h"
 #include "chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_runner_win.h"
+#include "chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_win.h"
 #include "chrome/browser/safe_browsing/chrome_cleaner/settings_resetter_win.h"
 #include "chrome/browser/safe_browsing/chrome_cleaner/srt_client_info_win.h"
 #include "chrome/browser/safe_browsing/chrome_cleaner/srt_field_trial_win.h"
@@ -180,11 +181,6 @@
 
 }  // namespace
 
-void RecordCleanupStartedHistogram(CleanupStartedHistogramValue value) {
-  UMA_HISTOGRAM_ENUMERATION("SoftwareReporter.CleanupStarted", value,
-                            CLEANUP_STARTED_MAX);
-}
-
 ChromeCleanerControllerDelegate::ChromeCleanerControllerDelegate() = default;
 
 ChromeCleanerControllerDelegate::~ChromeCleanerControllerDelegate() = default;
@@ -239,10 +235,6 @@
   return ChromeCleanerControllerImpl::GetInstance();
 }
 
-ChromeCleanerController::ChromeCleanerController() = default;
-
-ChromeCleanerController::~ChromeCleanerController() = default;
-
 ChromeCleanerController::State ChromeCleanerControllerImpl::state() const {
   return state_;
 }
diff --git a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_controller_impl_win_unittest.cc b/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_controller_impl_win_unittest.cc
index d4a3351..74917f4 100644
--- a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_controller_impl_win_unittest.cc
+++ b/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_controller_impl_win_unittest.cc
@@ -594,26 +594,15 @@
         scanner_results_on_cleaning.registry_keys(),
         UnorderedElementsAreArray(scanner_results_on_infected.registry_keys()));
   }
-
-  std::set<base::string16> extension_names_infected;
-  scanner_results_on_infected.FetchExtensionNames(profile1,
-                                                  &extension_names_infected);
-  std::set<base::string16> extension_names_cleaning;
-  scanner_results_on_cleaning.FetchExtensionNames(profile1,
-                                                  &extension_names_cleaning);
-// Extension names only reported on Windows Chrome build.
-#if defined(OS_WIN) && defined(GOOGLE_CHROME_BUILD)
-  EXPECT_EQ(!extension_names_infected.empty(), ExpectedExtensionsReported());
-  EXPECT_EQ(!extension_names_cleaning.empty(),
+  EXPECT_EQ(!scanner_results_on_infected.extension_ids().empty(),
+            ExpectedExtensionsReported());
+  EXPECT_EQ(!scanner_results_on_cleaning.extension_ids().empty(),
             ExpectedExtensionsReported() && ExpectedOnCleaningCalled());
-  if (!extension_names_cleaning.empty()) {
-    EXPECT_THAT(extension_names_cleaning,
-                UnorderedElementsAreArray(extension_names_infected));
+  if (!scanner_results_on_cleaning.extension_ids().empty()) {
+    EXPECT_THAT(
+        scanner_results_on_cleaning.extension_ids(),
+        UnorderedElementsAreArray(scanner_results_on_infected.extension_ids()));
   }
-#else
-  EXPECT_TRUE(extension_names_infected.empty());
-  EXPECT_TRUE(extension_names_cleaning.empty());
-#endif
 
   EXPECT_EQ(ExpectedRebootFlowStarted(), reboot_flow_started_);
 
diff --git a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_controller_win.cc b/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_controller_win.cc
index 1aead41..f556880 100644
--- a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_controller_win.cc
+++ b/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_controller_win.cc
@@ -4,6 +4,10 @@
 
 #include "chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_controller_win.h"
 
+#include <ostream>
+
+#include "base/metrics/histogram_macros.h"
+
 namespace safe_browsing {
 
 using UserResponse = ChromeCleanerController::UserResponse;
@@ -20,4 +24,13 @@
   return out << "Resp" << static_cast<int>(response);
 }
 
+void RecordCleanupStartedHistogram(CleanupStartedHistogramValue value) {
+  UMA_HISTOGRAM_ENUMERATION("SoftwareReporter.CleanupStarted", value,
+                            CLEANUP_STARTED_MAX);
+}
+
+ChromeCleanerController::ChromeCleanerController() = default;
+
+ChromeCleanerController::~ChromeCleanerController() = default;
+
 }  // namespace safe_browsing
diff --git a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_controller_win.h b/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_controller_win.h
index 57cb3a5f..a81fefd 100644
--- a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_controller_win.h
+++ b/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_controller_win.h
@@ -11,13 +11,16 @@
 #include "base/callback.h"
 #include "base/files/file_path.h"
 #include "base/macros.h"
-#include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_scanner_results_win.h"
-#include "chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_win.h"
+#include "chrome/browser/safe_browsing/chrome_cleaner/sw_reporter_invocation_win.h"
 #include "components/chrome_cleaner/public/interfaces/chrome_prompt.mojom.h"
 
 class Profile;
 
+namespace extensions {
+class ExtensionService;
+}
+
 namespace safe_browsing {
 
 // These values are used to send UMA information and are replicated in the
diff --git a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_extension_util_win.cc b/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_extension_util_win.cc
deleted file mode 100644
index 76967d2b..0000000
--- a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_extension_util_win.cc
+++ /dev/null
@@ -1,32 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_extension_util_win.h"
-
-#include "base/strings/utf_string_conversions.h"
-#include "chrome/grit/generated_resources.h"
-#include "extensions/browser/extension_registry.h"
-#include "ui/base/l10n/l10n_util.h"
-
-namespace safe_browsing {
-
-void GetExtensionNamesFromIds(Profile* profile,
-                              const std::set<base::string16>& extension_ids,
-                              std::set<base::string16>* extension_names) {
-  extensions::ExtensionRegistry* extension_registry =
-      extensions::ExtensionRegistry::Get(profile);
-  for (const base::string16& extension_id : extension_ids) {
-    const extensions::Extension* extension =
-        extension_registry->GetInstalledExtension(
-            base::UTF16ToUTF8(extension_id));
-    if (extension) {
-      extension_names->insert(base::UTF8ToUTF16(extension->name()));
-    } else {
-      extension_names->insert(l10n_util::GetStringFUTF16(
-          IDS_SETTINGS_RESET_CLEANUP_DETAILS_EXTENSION_UNKNOWN, extension_id));
-    }
-  }
-}
-
-}  // namespace safe_browsing
diff --git a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_extension_util_win.h b/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_extension_util_win.h
deleted file mode 100644
index 5488e08..0000000
--- a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_extension_util_win.h
+++ /dev/null
@@ -1,25 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_BROWSER_SAFE_BROWSING_CHROME_CLEANER_CHROME_CLEANER_EXTENSION_UTIL_WIN_H_
-#define CHROME_BROWSER_SAFE_BROWSING_CHROME_CLEANER_CHROME_CLEANER_EXTENSION_UTIL_WIN_H_
-
-#include <set>
-
-#include "base/strings/string16.h"
-#include "chrome/browser/profiles/profile.h"
-
-namespace safe_browsing {
-
-// Retrieve extension names for |extension_ids| from |profile|'s extension
-// registry and add them to |extension_names|. If a name cannot be found for an
-// extension ID, a translated string will be added stating the item is an
-// unknown extension ID.
-void GetExtensionNamesFromIds(Profile* profile,
-                              const std::set<base::string16>& extension_ids,
-                              std::set<base::string16>* extension_names);
-
-}  // namespace safe_browsing
-
-#endif  // CHROME_BROWSER_SAFE_BROWSING_CHROME_CLEANER_CHROME_CLEANER_EXTENSION_UTIL_WIN_H_
diff --git a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_extension_util_win_noop.cc b/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_extension_util_win_noop.cc
deleted file mode 100644
index 643a0e8..0000000
--- a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_extension_util_win_noop.cc
+++ /dev/null
@@ -1,13 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_extension_util_win.h"
-
-namespace safe_browsing {
-
-void GetExtensionNamesFromIds(Profile* profile,
-                              const std::set<base::string16>& extension_ids,
-                              std::set<base::string16>* extension_names) {}
-
-}  // namespace safe_browsing
diff --git a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_runner_win.h b/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_runner_win.h
index 2ac468e9..c9fb737 100644
--- a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_runner_win.h
+++ b/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_runner_win.h
@@ -17,8 +17,8 @@
 #include "base/process/launch.h"
 #include "base/process/process.h"
 #include "base/sequenced_task_runner.h"
-#include "chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_win.h"
 #include "chrome/browser/safe_browsing/chrome_cleaner/srt_chrome_prompt_impl_win.h"
+#include "chrome/browser/safe_browsing/chrome_cleaner/sw_reporter_invocation_win.h"
 #include "components/chrome_cleaner/public/interfaces/chrome_prompt.mojom.h"
 #include "content/public/browser/browser_thread.h"
 #include "extensions/browser/extension_system.h"
diff --git a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_runner_win_unittest.cc b/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_runner_win_unittest.cc
index 41c8b39..14755c1 100644
--- a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_runner_win_unittest.cc
+++ b/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_runner_win_unittest.cc
@@ -22,6 +22,7 @@
 #include "base/threading/thread_task_runner_handle.h"
 #include "chrome/browser/safe_browsing/chrome_cleaner/mock_chrome_cleaner_process_win.h"
 #include "chrome/browser/safe_browsing/chrome_cleaner/srt_field_trial_win.h"
+#include "chrome/browser/ui/webui/settings/chrome_cleanup_handler_win.h"
 #include "chrome/test/base/testing_browser_process.h"
 #include "chrome/test/base/testing_profile.h"
 #include "chrome/test/base/testing_profile_manager.h"
@@ -437,8 +438,9 @@
     }
 
     std::set<base::string16> extension_names;
-    received_scanner_results_.FetchExtensionNames(testing_profile_,
-                                                  &extension_names);
+    settings::ChromeCleanupHandler::GetExtensionNamesFromIds(
+        testing_profile_, received_scanner_results_.extension_ids(),
+        &extension_names);
     if (cleaner_process_options_.extension_ids() &&
         extension_cleaning_feature_status_ ==
             ExtensionCleaningFeatureStatus::kEnabled) {
diff --git a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_scanner_results_win.cc b/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_scanner_results_win.cc
index 431e5010..ba24639a 100644
--- a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_scanner_results_win.cc
+++ b/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_scanner_results_win.cc
@@ -4,9 +4,6 @@
 
 #include "chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_scanner_results_win.h"
 
-#include "chrome/browser/profiles/profile_manager.h"
-#include "chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_extension_util_win.h"
-
 namespace safe_browsing {
 
 ChromeCleanerScannerResults::ChromeCleanerScannerResults() = default;
@@ -35,10 +32,4 @@
   return *this;
 }
 
-void ChromeCleanerScannerResults::FetchExtensionNames(
-    Profile* profile,
-    ChromeCleanerScannerResults::ExtensionCollection* extension_names) const {
-  GetExtensionNamesFromIds(profile, extension_ids_, extension_names);
-}
-
 }  // namespace safe_browsing
diff --git a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_scanner_results_win.h b/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_scanner_results_win.h
index fe73695..d4011c1 100644
--- a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_scanner_results_win.h
+++ b/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_scanner_results_win.h
@@ -9,7 +9,6 @@
 
 #include "base/files/file_path.h"
 #include "base/strings/string16.h"
-#include "chrome/browser/profiles/profile.h"
 
 namespace safe_browsing {
 
@@ -31,12 +30,6 @@
   ChromeCleanerScannerResults& operator=(
       const ChromeCleanerScannerResults& other);
 
-  // Retrieves the extension names of |extension_ids_| using the extension
-  // registry from |profile|. If a name cannot be found for an extension ID, a
-  // translated string is added stating that it is an unknown ID.
-  void FetchExtensionNames(Profile* profile,
-                           ExtensionCollection* extension_names) const;
-
   const FileCollection& files_to_delete() const { return files_to_delete_; }
   const RegistryKeyCollection& registry_keys() const { return registry_keys_; }
   const ExtensionCollection& extension_ids() const { return extension_ids_; }
diff --git a/chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_browsertest_win.cc b/chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_browsertest_win.cc
index 0d452e9..b8354aa 100644
--- a/chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_browsertest_win.cc
+++ b/chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_browsertest_win.cc
@@ -29,6 +29,7 @@
 #include "chrome/browser/safe_browsing/chrome_cleaner/mock_chrome_cleaner_controller_win.h"
 #include "chrome/browser/safe_browsing/chrome_cleaner/srt_client_info_win.h"
 #include "chrome/browser/safe_browsing/chrome_cleaner/srt_field_trial_win.h"
+#include "chrome/browser/safe_browsing/chrome_cleaner/sw_reporter_invocation_win.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_finder.h"
 #include "chrome/common/chrome_switches.h"
@@ -503,14 +504,6 @@
     std::move(closure).Run();
   }
 
-  OnReporterSequenceDone ExpectResultOnSequenceDoneCallback(
-      SwReporterInvocationResult expected_result,
-      base::OnceClosure closure) {
-    return base::BindOnce(&ReporterRunnerTest::ExpectResultOnSequenceDone,
-                          base::Unretained(this), expected_result,
-                          base::Passed(&closure));
-  }
-
   bool PromptDialogShouldBeShown(SwReporterInvocationType invocation_type) {
     return !IsUserInitiated(invocation_type) &&
            (incoming_seed_.empty() || (incoming_seed_ != old_seed_));
diff --git a/chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_win.cc b/chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_win.cc
index 4847e79..9402977 100644
--- a/chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_win.cc
+++ b/chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_win.cc
@@ -13,6 +13,7 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/callback.h"
 #include "base/callback_helpers.h"
 #include "base/command_line.h"
 #include "base/files/file_path.h"
@@ -603,8 +604,8 @@
     // Ensures that any component waiting for the reporter sequence result will
     // be notified if |invocations| doesn't get scheduled.
     base::ScopedClosureRunner scoped_runner(
-        base::BindOnce(&SwReporterInvocationSequence::NotifySequenceDone,
-                       base::Unretained(&invocations),
+        base::BindOnce(&ChromeCleanerController::OnReporterSequenceDone,
+                       base::Unretained(GetCleanerController()),
                        SwReporterInvocationResult::kNotScheduled));
 
     PrefService* local_state = g_browser_process->local_state();
@@ -700,6 +701,9 @@
                  ReporterRunTimeInfo&& time_info)
       : invocation_type_(invocation_type),
         invocations_(std::move(invocations)),
+        on_sequence_done_(
+            base::BindOnce(&ChromeCleanerController::OnReporterSequenceDone,
+                           base::Unretained(GetCleanerController()))),
         time_info_(std::move(time_info)) {}
 
   ~ReporterRunner() {
@@ -755,8 +759,7 @@
     // SW_REPORTER_FAILED_TO_START is logged in
     // |LaunchAndWaitForExitOnBackgroundThread|.)
     if (exit_code == kReporterNotLaunchedExitCode) {
-      invocations_.NotifySequenceDone(
-          SwReporterInvocationResult::kProcessFailedToLaunch);
+      NotifySequenceDone(SwReporterInvocationResult::kProcessFailedToLaunch);
       return;
     }
 
@@ -847,8 +850,7 @@
             ? chrome_cleaner::ChromePromptValue::kUserInitiated
             : chrome_cleaner::ChromePromptValue::kPrompted);
 
-    invocations_.NotifySequenceDone(
-        SwReporterInvocationResult::kCleanupToBeOffered);
+    NotifySequenceDone(SwReporterInvocationResult::kCleanupToBeOffered);
     cleaner_controller->Scan(finished_invocation);
 
     // If this is a periodic reporter run, then create the dialog controller, so
@@ -965,11 +967,16 @@
     DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
     DCHECK_EQ(instance_, this);
 
-    invocations_.NotifySequenceDone(result);
+    NotifySequenceDone(result);
 
     delete this;
   }
 
+  void NotifySequenceDone(SwReporterInvocationResult result) {
+    if (on_sequence_done_)
+      std::move(on_sequence_done_).Run(result);
+  }
+
   SwReporterInvocationType invocation_type() const { return invocation_type_; }
 
   // Not null if there is a sequence currently running.
@@ -988,6 +995,10 @@
   // The queue of invocations that are currently running.
   SwReporterInvocationSequence invocations_;
 
+  // Invoked once when the |invocations_| sequence run finishes or when it's
+  // aborted with an error, whichever comes first.
+  base::OnceCallback<void(SwReporterInvocationResult result)> on_sequence_done_;
+
   // Last and upcoming reporter runs and logs uploading.
   ReporterRunTimeInfo time_info_;
 
@@ -1006,159 +1017,6 @@
              SwReporterInvocationType::kUserInitiatedWithLogsDisallowed;
 }
 
-SwReporterInvocation::SwReporterInvocation(
-    const base::CommandLine& command_line)
-    : command_line_(command_line) {}
-
-SwReporterInvocation::SwReporterInvocation(const SwReporterInvocation& other)
-    : command_line_(other.command_line_),
-      supported_behaviours_(other.supported_behaviours_),
-      suffix_(other.suffix_),
-      reporter_logs_upload_enabled_(other.reporter_logs_upload_enabled_),
-      cleaner_logs_upload_enabled_(other.cleaner_logs_upload_enabled_),
-      chrome_prompt_(other.chrome_prompt_) {}
-
-void SwReporterInvocation::operator=(const SwReporterInvocation& invocation) {
-  command_line_ = invocation.command_line_;
-  supported_behaviours_ = invocation.supported_behaviours_;
-  suffix_ = invocation.suffix_;
-  reporter_logs_upload_enabled_ = invocation.reporter_logs_upload_enabled_;
-  cleaner_logs_upload_enabled_ = invocation.cleaner_logs_upload_enabled_;
-  chrome_prompt_ = invocation.chrome_prompt_;
-}
-
-SwReporterInvocation& SwReporterInvocation::WithSuffix(
-    const std::string& suffix) {
-  suffix_ = suffix;
-  return *this;
-}
-
-SwReporterInvocation& SwReporterInvocation::WithSupportedBehaviours(
-    Behaviours supported_behaviours) {
-  supported_behaviours_ = supported_behaviours;
-  return *this;
-}
-
-bool SwReporterInvocation::operator==(const SwReporterInvocation& other) const {
-  return command_line_.argv() == other.command_line_.argv() &&
-         supported_behaviours_ == other.supported_behaviours_ &&
-         suffix_ == other.suffix_ &&
-         reporter_logs_upload_enabled_ == other.reporter_logs_upload_enabled_ &&
-         cleaner_logs_upload_enabled_ == other.cleaner_logs_upload_enabled_ &&
-         chrome_prompt_ == other.chrome_prompt_;
-}
-
-const base::CommandLine& SwReporterInvocation::command_line() const {
-  return command_line_;
-}
-
-base::CommandLine& SwReporterInvocation::mutable_command_line() {
-  return command_line_;
-}
-
-SwReporterInvocation::Behaviours SwReporterInvocation::supported_behaviours()
-    const {
-  return supported_behaviours_;
-}
-
-bool SwReporterInvocation::BehaviourIsSupported(
-    SwReporterInvocation::Behaviours intended_behaviour) const {
-  return (supported_behaviours_ & intended_behaviour) != 0;
-}
-
-std::string SwReporterInvocation::suffix() const {
-  return suffix_;
-}
-
-bool SwReporterInvocation::reporter_logs_upload_enabled() const {
-  return reporter_logs_upload_enabled_;
-}
-
-void SwReporterInvocation::set_reporter_logs_upload_enabled(
-    bool reporter_logs_upload_enabled) {
-  reporter_logs_upload_enabled_ = reporter_logs_upload_enabled;
-}
-
-bool SwReporterInvocation::cleaner_logs_upload_enabled() const {
-  return cleaner_logs_upload_enabled_;
-}
-
-void SwReporterInvocation::set_cleaner_logs_upload_enabled(
-    bool cleaner_logs_upload_enabled) {
-  cleaner_logs_upload_enabled_ = cleaner_logs_upload_enabled;
-}
-
-chrome_cleaner::ChromePromptValue SwReporterInvocation::chrome_prompt() const {
-  return chrome_prompt_;
-}
-
-void SwReporterInvocation::set_chrome_prompt(
-    chrome_cleaner::ChromePromptValue chrome_prompt) {
-  chrome_prompt_ = chrome_prompt;
-}
-
-SwReporterInvocationSequence::SwReporterInvocationSequence(
-    const base::Version& version)
-    : version_(version) {
-  // Notify the cleaner controller once this sequence completes. Don't retain
-  // a reference to the controller object, since it's guaranteed to outlive the
-  // sequence.
-  on_sequence_done_ =
-      base::BindOnce(&ChromeCleanerController::OnReporterSequenceDone,
-                     base::Unretained(GetCleanerController()));
-}
-
-SwReporterInvocationSequence::SwReporterInvocationSequence(
-    SwReporterInvocationSequence&& invocations_sequence)
-    : version_(std::move(invocations_sequence.version_)),
-      container_(std::move(invocations_sequence.container_)),
-      on_sequence_done_(std::move(invocations_sequence.on_sequence_done_)) {}
-
-SwReporterInvocationSequence::SwReporterInvocationSequence(
-    const SwReporterInvocationSequence& invocations_sequence)
-    : version_(invocations_sequence.version_),
-      container_(invocations_sequence.container_) {
-  // As in the regular constructor: notify the cleaner controller once this
-  // sequence completes.
-  on_sequence_done_ =
-      base::BindOnce(&ChromeCleanerController::OnReporterSequenceDone,
-                     base::Unretained(GetCleanerController()));
-}
-
-SwReporterInvocationSequence::~SwReporterInvocationSequence() = default;
-
-void SwReporterInvocationSequence::operator=(
-    SwReporterInvocationSequence&& invocations_sequence) {
-  version_ = std::move(invocations_sequence.version_);
-  container_ = std::move(invocations_sequence.container_);
-  on_sequence_done_ = std::move(invocations_sequence.on_sequence_done_);
-}
-
-void SwReporterInvocationSequence::PushInvocation(
-    const SwReporterInvocation& invocation) {
-  container_.push(invocation);
-}
-
-void SwReporterInvocationSequence::NotifySequenceDone(
-    SwReporterInvocationResult result) {
-  if (on_sequence_done_)
-    std::move(on_sequence_done_).Run(result);
-}
-
-base::Version SwReporterInvocationSequence::version() const {
-  return version_;
-}
-
-const SwReporterInvocationSequence::Queue&
-SwReporterInvocationSequence::container() const {
-  return container_;
-}
-
-SwReporterInvocationSequence::Queue&
-SwReporterInvocationSequence::mutable_container() {
-  return container_;
-}
-
 void MaybeStartSwReporter(SwReporterInvocationType invocation_type,
                           SwReporterInvocationSequence&& invocations) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
diff --git a/chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_win.h b/chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_win.h
index d35eb83..bbeb2e6 100644
--- a/chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_win.h
+++ b/chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_win.h
@@ -6,18 +6,10 @@
 #define CHROME_BROWSER_SAFE_BROWSING_CHROME_CLEANER_REPORTER_RUNNER_WIN_H_
 
 #include <limits.h>
-#include <stdint.h>
 
-#include <memory>
-#include <queue>
-#include <string>
-
-#include "base/callback.h"
-#include "base/command_line.h"
 #include "base/time/time.h"
-#include "base/version.h"
 #include "chrome/browser/profiles/profile.h"
-#include "components/chrome_cleaner/public/constants/constants.h"
+#include "chrome/browser/safe_browsing/chrome_cleaner/sw_reporter_invocation_win.h"
 
 namespace base {
 class TaskRunner;
@@ -35,177 +27,8 @@
 // The number of days to wait before sending out reporter logs.
 const int kDaysBetweenReporterLogsSent = 7;
 
-// Identifies if an invocation was created during periodic reporter runs
-// or because the user explicitly initiated a cleanup. The invocation type
-// controls whether a prompt dialog will be shown to the user and under what
-// conditions logs may be uploaded to Google.
-//
-// These values are used to send UMA information and are replicated in the
-// enums.xml file, so the order MUST NOT CHANGE.
-enum class SwReporterInvocationType {
-  // Default value that should never be used for valid invocations.
-  kUnspecified,
-  // Periodic runs of the reporter are initiated by Chrome after startup.
-  // If removable unwanted software is found the user may be prompted to
-  // run the Chrome Cleanup tool. Logs from the software reporter will only
-  // be uploaded if the user has opted-into SBER2 and if unwanted software
-  // is found on the system. The cleaner process in scanning mode will not
-  // upload logs.
-  kPeriodicRun,
-  // User-initiated runs in which the user has opted-out of sending details
-  // to Google. Those runs are intended to be completely driven from the
-  // Settings page, so a prompt dialog will not be shown to the user if
-  // removable unwanted software is found. Logs will not be uploaded from the
-  // reporter, even if the user has opted into SBER2, and cleaner logs will not
-  // be uploaded.
-  kUserInitiatedWithLogsDisallowed,
-  // User-initiated runs in which the user has not opted-out of sending
-  // details to Google. Those runs are intended to be completely driven from
-  // the Settings page, so a prompt dialog will not be shown to the user if
-  // removable unwanted software is found. Logs will be uploaded from both
-  // the reporter and the cleaner in scanning mode (which will only run if
-  // unwanted software is found by the reporter).
-  kUserInitiatedWithLogsAllowed,
-
-  kMax,
-};
-
 bool IsUserInitiated(SwReporterInvocationType invocation_type);
 
-// Parameters used to invoke the sw_reporter component.
-class SwReporterInvocation {
- public:
-  // Flags to control behaviours the Software Reporter should support by
-  // default. These flags are set in the Reporter installer, and experimental
-  // versions of the reporter will turn on the behaviours that are not yet
-  // supported.
-  using Behaviours = uint32_t;
-  enum : Behaviours {
-    BEHAVIOUR_LOG_EXIT_CODE_TO_PREFS = 0x2,
-    BEHAVIOUR_TRIGGER_PROMPT = 0x4,
-
-    BEHAVIOURS_ENABLED_BY_DEFAULT =
-        BEHAVIOUR_LOG_EXIT_CODE_TO_PREFS | BEHAVIOUR_TRIGGER_PROMPT,
-  };
-
-  explicit SwReporterInvocation(const base::CommandLine& command_line);
-  SwReporterInvocation(const SwReporterInvocation& invocation);
-  void operator=(const SwReporterInvocation& invocation);
-
-  // Fluent interface methods, intended to be used during initialization.
-  // Sample usage:
-  //   auto invocation = SwReporterInvocation(command_line)
-  //       .WithSuffix("MySuffix")
-  //       .WithSupportedBehaviours(
-  //           SwReporterInvocation::Behaviours::BEHAVIOUR_TRIGGER_PROMPT);
-  SwReporterInvocation& WithSuffix(const std::string& suffix);
-  SwReporterInvocation& WithSupportedBehaviours(
-      Behaviours supported_behaviours);
-
-  bool operator==(const SwReporterInvocation& other) const;
-
-  const base::CommandLine& command_line() const;
-  base::CommandLine& mutable_command_line();
-
-  Behaviours supported_behaviours() const;
-  bool BehaviourIsSupported(Behaviours intended_behaviour) const;
-
-  // Experimental versions of the reporter will write metrics to registry keys
-  // ending in |suffix_|. Those metrics should be copied to UMA histograms also
-  // ending in |suffix_|. For the canonical version, |suffix_| will be empty.
-  std::string suffix() const;
-
-  // Indicates if the invocation type allows logs to be uploaded by the
-  // reporter process.
-  bool reporter_logs_upload_enabled() const;
-  void set_reporter_logs_upload_enabled(bool reporter_logs_upload_enabled);
-
-  // Indicates if the invocation type allows logs to be uploaded by the
-  // cleaner process in scanning mode.
-  bool cleaner_logs_upload_enabled() const;
-  void set_cleaner_logs_upload_enabled(bool cleaner_logs_upload_enabled);
-
-  chrome_cleaner::ChromePromptValue chrome_prompt() const;
-  void set_chrome_prompt(chrome_cleaner::ChromePromptValue chrome_prompt);
-
- private:
-  base::CommandLine command_line_;
-
-  Behaviours supported_behaviours_ = BEHAVIOURS_ENABLED_BY_DEFAULT;
-
-  std::string suffix_;
-
-  bool reporter_logs_upload_enabled_ = false;
-  bool cleaner_logs_upload_enabled_ = false;
-
-  chrome_cleaner::ChromePromptValue chrome_prompt_ =
-      chrome_cleaner::ChromePromptValue::kUnspecified;
-};
-
-// These values are used to send UMA information and are replicated in the
-// enums.xml file, so the order MUST NOT CHANGE.
-enum class SwReporterInvocationResult {
-  kUnspecified,
-  // Tried to start a new run, but a user-initiated run was already
-  // happening. The UI should never allow this to happen.
-  kNotScheduled,
-  // The reporter process timed-out while running.
-  kTimedOut,
-  // The on-demand reporter run failed to download a new version of the reporter
-  // component.
-  kComponentNotAvailable,
-  // The reporter failed to start.
-  kProcessFailedToLaunch,
-  // The reporter ended with a failure.
-  kGeneralFailure,
-  // The reporter ran successfully, but didn't find cleanable unwanted software.
-  kNothingFound,
-  // A periodic reporter sequence ran successfully and found cleanable unwanted
-  // software, but the user shouldn't be prompted at this time.
-  kCleanupNotOffered,
-  // The reporter ran successfully and found cleanable unwanted software, and
-  // a cleanup should be offered. A notification with this result should be
-  // immediately followed by an attempt to run the cleaner in scanning mode.
-  kCleanupToBeOffered,
-
-  kMax,
-};
-
-// Called when all reporter invocations have completed, with a result parameter
-// indicating if they succeeded.
-using OnReporterSequenceDone =
-    base::OnceCallback<void(SwReporterInvocationResult result)>;
-
-class SwReporterInvocationSequence {
- public:
-  using Queue = std::queue<SwReporterInvocation>;
-
-  explicit SwReporterInvocationSequence(
-      const base::Version& version = base::Version());
-  SwReporterInvocationSequence(SwReporterInvocationSequence&& queue);
-  SwReporterInvocationSequence(
-      const SwReporterInvocationSequence& invocations_sequence);
-  virtual ~SwReporterInvocationSequence();
-
-  void PushInvocation(const SwReporterInvocation& invocation);
-
-  void operator=(SwReporterInvocationSequence&& queue);
-
-  void NotifySequenceDone(SwReporterInvocationResult result);
-
-  base::Version version() const;
-
-  const Queue& container() const;
-  Queue& mutable_container();
-
- private:
-  base::Version version_;
-  Queue container_;
-  // Invoked the first time this sequence run finishes or when the object
-  // gets destroyed if it's never invoked.
-  OnReporterSequenceDone on_sequence_done_;
-};
-
 // Tries to run the given invocations. If this runs successfully, than any
 // calls made in the next |kDaysBetweenSuccessfulSwReporterRuns| days will be
 // ignored.
diff --git a/chrome/browser/safe_browsing/chrome_cleaner/sw_reporter_invocation_win.cc b/chrome/browser/safe_browsing/chrome_cleaner/sw_reporter_invocation_win.cc
new file mode 100644
index 0000000..13ff187ca2
--- /dev/null
+++ b/chrome/browser/safe_browsing/chrome_cleaner/sw_reporter_invocation_win.cc
@@ -0,0 +1,143 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/safe_browsing/chrome_cleaner/sw_reporter_invocation_win.h"
+
+#include <utility>
+
+namespace safe_browsing {
+
+SwReporterInvocation::SwReporterInvocation(
+    const base::CommandLine& command_line)
+    : command_line_(command_line) {}
+
+SwReporterInvocation::SwReporterInvocation(const SwReporterInvocation& other)
+    : command_line_(other.command_line_),
+      supported_behaviours_(other.supported_behaviours_),
+      suffix_(other.suffix_),
+      reporter_logs_upload_enabled_(other.reporter_logs_upload_enabled_),
+      cleaner_logs_upload_enabled_(other.cleaner_logs_upload_enabled_),
+      chrome_prompt_(other.chrome_prompt_) {}
+
+void SwReporterInvocation::operator=(const SwReporterInvocation& invocation) {
+  command_line_ = invocation.command_line_;
+  supported_behaviours_ = invocation.supported_behaviours_;
+  suffix_ = invocation.suffix_;
+  reporter_logs_upload_enabled_ = invocation.reporter_logs_upload_enabled_;
+  cleaner_logs_upload_enabled_ = invocation.cleaner_logs_upload_enabled_;
+  chrome_prompt_ = invocation.chrome_prompt_;
+}
+
+SwReporterInvocation& SwReporterInvocation::WithSuffix(
+    const std::string& suffix) {
+  suffix_ = suffix;
+  return *this;
+}
+
+SwReporterInvocation& SwReporterInvocation::WithSupportedBehaviours(
+    Behaviours supported_behaviours) {
+  supported_behaviours_ = supported_behaviours;
+  return *this;
+}
+
+bool SwReporterInvocation::operator==(const SwReporterInvocation& other) const {
+  return command_line_.argv() == other.command_line_.argv() &&
+         supported_behaviours_ == other.supported_behaviours_ &&
+         suffix_ == other.suffix_ &&
+         reporter_logs_upload_enabled_ == other.reporter_logs_upload_enabled_ &&
+         cleaner_logs_upload_enabled_ == other.cleaner_logs_upload_enabled_ &&
+         chrome_prompt_ == other.chrome_prompt_;
+}
+
+const base::CommandLine& SwReporterInvocation::command_line() const {
+  return command_line_;
+}
+
+base::CommandLine& SwReporterInvocation::mutable_command_line() {
+  return command_line_;
+}
+
+SwReporterInvocation::Behaviours SwReporterInvocation::supported_behaviours()
+    const {
+  return supported_behaviours_;
+}
+
+bool SwReporterInvocation::BehaviourIsSupported(
+    SwReporterInvocation::Behaviours intended_behaviour) const {
+  return (supported_behaviours_ & intended_behaviour) != 0;
+}
+
+std::string SwReporterInvocation::suffix() const {
+  return suffix_;
+}
+
+bool SwReporterInvocation::reporter_logs_upload_enabled() const {
+  return reporter_logs_upload_enabled_;
+}
+
+void SwReporterInvocation::set_reporter_logs_upload_enabled(
+    bool reporter_logs_upload_enabled) {
+  reporter_logs_upload_enabled_ = reporter_logs_upload_enabled;
+}
+
+bool SwReporterInvocation::cleaner_logs_upload_enabled() const {
+  return cleaner_logs_upload_enabled_;
+}
+
+void SwReporterInvocation::set_cleaner_logs_upload_enabled(
+    bool cleaner_logs_upload_enabled) {
+  cleaner_logs_upload_enabled_ = cleaner_logs_upload_enabled;
+}
+
+chrome_cleaner::ChromePromptValue SwReporterInvocation::chrome_prompt() const {
+  return chrome_prompt_;
+}
+
+void SwReporterInvocation::set_chrome_prompt(
+    chrome_cleaner::ChromePromptValue chrome_prompt) {
+  chrome_prompt_ = chrome_prompt;
+}
+
+SwReporterInvocationSequence::SwReporterInvocationSequence(
+    const base::Version& version)
+    : version_(version) {}
+
+SwReporterInvocationSequence::SwReporterInvocationSequence(
+    SwReporterInvocationSequence&& invocations_sequence)
+    : version_(std::move(invocations_sequence.version_)),
+      container_(std::move(invocations_sequence.container_)) {}
+
+SwReporterInvocationSequence::SwReporterInvocationSequence(
+    const SwReporterInvocationSequence& invocations_sequence)
+    : version_(invocations_sequence.version_),
+      container_(invocations_sequence.container_) {}
+
+SwReporterInvocationSequence::~SwReporterInvocationSequence() = default;
+
+void SwReporterInvocationSequence::operator=(
+    SwReporterInvocationSequence&& invocations_sequence) {
+  version_ = std::move(invocations_sequence.version_);
+  container_ = std::move(invocations_sequence.container_);
+}
+
+void SwReporterInvocationSequence::PushInvocation(
+    const SwReporterInvocation& invocation) {
+  container_.push(invocation);
+}
+
+base::Version SwReporterInvocationSequence::version() const {
+  return version_;
+}
+
+const SwReporterInvocationSequence::Queue&
+SwReporterInvocationSequence::container() const {
+  return container_;
+}
+
+SwReporterInvocationSequence::Queue&
+SwReporterInvocationSequence::mutable_container() {
+  return container_;
+}
+
+}  // namespace safe_browsing
diff --git a/chrome/browser/safe_browsing/chrome_cleaner/sw_reporter_invocation_win.h b/chrome/browser/safe_browsing/chrome_cleaner/sw_reporter_invocation_win.h
new file mode 100644
index 0000000..71e975bd
--- /dev/null
+++ b/chrome/browser/safe_browsing/chrome_cleaner/sw_reporter_invocation_win.h
@@ -0,0 +1,180 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_SAFE_BROWSING_CHROME_CLEANER_SW_REPORTER_INVOCATION_WIN_H_
+#define CHROME_BROWSER_SAFE_BROWSING_CHROME_CLEANER_SW_REPORTER_INVOCATION_WIN_H_
+
+#include <stdint.h>
+
+#include <queue>
+#include <string>
+
+#include "base/command_line.h"
+#include "base/version.h"
+#include "components/chrome_cleaner/public/constants/constants.h"
+
+namespace safe_browsing {
+
+// These values are used to send UMA information and are replicated in the
+// enums.xml file, so the order MUST NOT CHANGE.
+enum class SwReporterInvocationResult {
+  kUnspecified,
+  // Tried to start a new run, but a user-initiated run was already
+  // happening. The UI should never allow this to happen.
+  kNotScheduled,
+  // The reporter process timed-out while running.
+  kTimedOut,
+  // The on-demand reporter run failed to download a new version of the reporter
+  // component.
+  kComponentNotAvailable,
+  // The reporter failed to start.
+  kProcessFailedToLaunch,
+  // The reporter ended with a failure.
+  kGeneralFailure,
+  // The reporter ran successfully, but didn't find cleanable unwanted software.
+  kNothingFound,
+  // A periodic reporter sequence ran successfully and found cleanable unwanted
+  // software, but the user shouldn't be prompted at this time.
+  kCleanupNotOffered,
+  // The reporter ran successfully and found cleanable unwanted software, and
+  // a cleanup should be offered. A notification with this result should be
+  // immediately followed by an attempt to run the cleaner in scanning mode.
+  kCleanupToBeOffered,
+
+  kMax,
+};
+
+// Identifies if an invocation was created during periodic reporter runs
+// or because the user explicitly initiated a cleanup. The invocation type
+// controls whether a prompt dialog will be shown to the user and under what
+// conditions logs may be uploaded to Google.
+//
+// These values are used to send UMA information and are replicated in the
+// enums.xml file, so the order MUST NOT CHANGE.
+enum class SwReporterInvocationType {
+  // Default value that should never be used for valid invocations.
+  kUnspecified,
+  // Periodic runs of the reporter are initiated by Chrome after startup.
+  // If removable unwanted software is found the user may be prompted to
+  // run the Chrome Cleanup tool. Logs from the software reporter will only
+  // be uploaded if the user has opted-into SBER2 and if unwanted software
+  // is found on the system. The cleaner process in scanning mode will not
+  // upload logs.
+  kPeriodicRun,
+  // User-initiated runs in which the user has opted-out of sending details
+  // to Google. Those runs are intended to be completely driven from the
+  // Settings page, so a prompt dialog will not be shown to the user if
+  // removable unwanted software is found. Logs will not be uploaded from the
+  // reporter, even if the user has opted into SBER2, and cleaner logs will not
+  // be uploaded.
+  kUserInitiatedWithLogsDisallowed,
+  // User-initiated runs in which the user has not opted-out of sending
+  // details to Google. Those runs are intended to be completely driven from
+  // the Settings page, so a prompt dialog will not be shown to the user if
+  // removable unwanted software is found. Logs will be uploaded from both
+  // the reporter and the cleaner in scanning mode (which will only run if
+  // unwanted software is found by the reporter).
+  kUserInitiatedWithLogsAllowed,
+
+  kMax,
+};
+
+// Parameters used to invoke the sw_reporter component.
+class SwReporterInvocation {
+ public:
+  // Flags to control behaviours the Software Reporter should support by
+  // default. These flags are set in the Reporter installer, and experimental
+  // versions of the reporter will turn on the behaviours that are not yet
+  // supported.
+  using Behaviours = uint32_t;
+  enum : Behaviours {
+    BEHAVIOUR_LOG_EXIT_CODE_TO_PREFS = 0x2,
+    BEHAVIOUR_TRIGGER_PROMPT = 0x4,
+
+    BEHAVIOURS_ENABLED_BY_DEFAULT =
+        BEHAVIOUR_LOG_EXIT_CODE_TO_PREFS | BEHAVIOUR_TRIGGER_PROMPT,
+  };
+
+  explicit SwReporterInvocation(const base::CommandLine& command_line);
+  SwReporterInvocation(const SwReporterInvocation& invocation);
+  void operator=(const SwReporterInvocation& invocation);
+
+  // Fluent interface methods, intended to be used during initialization.
+  // Sample usage:
+  //   auto invocation = SwReporterInvocation(command_line)
+  //       .WithSuffix("MySuffix")
+  //       .WithSupportedBehaviours(
+  //           SwReporterInvocation::Behaviours::BEHAVIOUR_TRIGGER_PROMPT);
+  SwReporterInvocation& WithSuffix(const std::string& suffix);
+  SwReporterInvocation& WithSupportedBehaviours(
+      Behaviours supported_behaviours);
+
+  bool operator==(const SwReporterInvocation& other) const;
+
+  const base::CommandLine& command_line() const;
+  base::CommandLine& mutable_command_line();
+
+  Behaviours supported_behaviours() const;
+  bool BehaviourIsSupported(Behaviours intended_behaviour) const;
+
+  // Experimental versions of the reporter will write metrics to registry keys
+  // ending in |suffix_|. Those metrics should be copied to UMA histograms also
+  // ending in |suffix_|. For the canonical version, |suffix_| will be empty.
+  std::string suffix() const;
+
+  // Indicates if the invocation type allows logs to be uploaded by the
+  // reporter process.
+  bool reporter_logs_upload_enabled() const;
+  void set_reporter_logs_upload_enabled(bool reporter_logs_upload_enabled);
+
+  // Indicates if the invocation type allows logs to be uploaded by the
+  // cleaner process in scanning mode.
+  bool cleaner_logs_upload_enabled() const;
+  void set_cleaner_logs_upload_enabled(bool cleaner_logs_upload_enabled);
+
+  chrome_cleaner::ChromePromptValue chrome_prompt() const;
+  void set_chrome_prompt(chrome_cleaner::ChromePromptValue chrome_prompt);
+
+ private:
+  base::CommandLine command_line_;
+
+  Behaviours supported_behaviours_ = BEHAVIOURS_ENABLED_BY_DEFAULT;
+
+  std::string suffix_;
+
+  bool reporter_logs_upload_enabled_ = false;
+  bool cleaner_logs_upload_enabled_ = false;
+
+  chrome_cleaner::ChromePromptValue chrome_prompt_ =
+      chrome_cleaner::ChromePromptValue::kUnspecified;
+};
+
+class SwReporterInvocationSequence {
+ public:
+  using Queue = std::queue<SwReporterInvocation>;
+
+  explicit SwReporterInvocationSequence(
+      const base::Version& version = base::Version());
+  SwReporterInvocationSequence(SwReporterInvocationSequence&& queue);
+  SwReporterInvocationSequence(
+      const SwReporterInvocationSequence& invocations_sequence);
+  virtual ~SwReporterInvocationSequence();
+
+  void PushInvocation(const SwReporterInvocation& invocation);
+
+  void operator=(SwReporterInvocationSequence&& queue);
+
+  base::Version version() const;
+
+  const Queue& container() const;
+  Queue& mutable_container();
+
+ private:
+  base::Version version_;
+  Queue container_;
+};
+
+}  // namespace safe_browsing
+
+#endif  // CHROME_BROWSER_SAFE_BROWSING_CHROME_CLEANER_SW_REPORTER_INVOCATION_WIN_H_
diff --git a/chrome/browser/safe_json_parser_browsertest.cc b/chrome/browser/safe_json_parser_browsertest.cc
index 807cffc..8cb9229 100644
--- a/chrome/browser/safe_json_parser_browsertest.cc
+++ b/chrome/browser/safe_json_parser_browsertest.cc
@@ -29,12 +29,9 @@
 
 constexpr char kTestJson[] = "[\"awesome\", \"possum\"]";
 
-std::string MaybeToJson(const base::Value* value) {
-  if (!value)
-    return "(null)";
-
+std::string MaybeToJson(const base::Value& value) {
   std::string json;
-  if (!base::JSONWriter::Write(*value, &json))
+  if (!base::JSONWriter::Write(value, &json))
     return "(invalid value)";
 
   return json;
@@ -60,24 +57,24 @@
     DCHECK(!message_loop_runner_);
     message_loop_runner_ = new content::MessageLoopRunner;
 
-    std::string error;
-    std::unique_ptr<base::Value> value =
-        base::JSONReader::ReadAndReturnErrorDeprecated(
-            json, base::JSON_PARSE_RFC, nullptr, &error);
+    base::JSONReader::ValueWithError value_with_error =
+        base::JSONReader::ReadAndReturnValueWithError(json,
+                                                      base::JSON_PARSE_RFC);
 
     SafeJsonParser::SuccessCallback success_callback;
     SafeJsonParser::ErrorCallback error_callback;
-    if (value) {
+    if (value_with_error.value) {
       success_callback =
           base::Bind(&SafeJsonParserTest::ExpectValue, base::Unretained(this),
-                     base::Passed(&value));
+                     base::Passed(std::move(*value_with_error.value)));
       error_callback = base::Bind(&SafeJsonParserTest::FailWithError,
                                   base::Unretained(this));
     } else {
       success_callback = base::Bind(&SafeJsonParserTest::FailWithValue,
                                     base::Unretained(this));
-      error_callback = base::Bind(&SafeJsonParserTest::ExpectError,
-                                  base::Unretained(this), error);
+      error_callback =
+          base::Bind(&SafeJsonParserTest::ExpectError, base::Unretained(this),
+                     value_with_error.error_message);
     }
 
     if (batch_id) {
@@ -99,11 +96,10 @@
   }
 
  private:
-  void ExpectValue(std::unique_ptr<base::Value> expected_value,
-                   std::unique_ptr<base::Value> actual_value) {
-    EXPECT_EQ(*expected_value, *actual_value)
-        << "Expected: " << MaybeToJson(expected_value.get())
-        << " Actual: " << MaybeToJson(actual_value.get());
+  void ExpectValue(base::Value expected_value, base::Value actual_value) {
+    EXPECT_EQ(expected_value, actual_value)
+        << "Expected: " << MaybeToJson(expected_value)
+        << " Actual: " << MaybeToJson(actual_value);
     message_loop_runner_->Quit();
   }
 
@@ -113,8 +109,8 @@
     message_loop_runner_->Quit();
   }
 
-  void FailWithValue(std::unique_ptr<base::Value> value) {
-    ADD_FAILURE() << MaybeToJson(value.get());
+  void FailWithValue(base::Value value) {
+    ADD_FAILURE() << MaybeToJson(value);
     message_loop_runner_->Quit();
   }
 
diff --git a/chrome/browser/search/background/ntp_background_service.cc b/chrome/browser/search/background/ntp_background_service.cc
index 8124da2..94749ba 100644
--- a/chrome/browser/search/background/ntp_background_service.cc
+++ b/chrome/browser/search/background/ntp_background_service.cc
@@ -99,7 +99,7 @@
   auto resource_request = std::make_unique<network::ResourceRequest>();
   resource_request->url = collections_api_url_;
   resource_request->method = "POST";
-  resource_request->load_flags = net::LOAD_DO_NOT_SEND_AUTH_DATA;
+  resource_request->allow_credentials = false;
 
   collections_loader_ = network::SimpleURLLoader::Create(
       std::move(resource_request), traffic_annotation);
diff --git a/chrome/browser/search/ntp_icon_source.cc b/chrome/browser/search/ntp_icon_source.cc
index 2367e2b..fbde10ae 100644
--- a/chrome/browser/search/ntp_icon_source.cc
+++ b/chrome/browser/search/ntp_icon_source.cc
@@ -229,8 +229,10 @@
 
   // If necessary, draw the colored fallback monogram.
   if (favicon.empty()) {
-    SkColor fallback_color = color_utils::GetColorWithMinimumContrast(
-        GetBackgroundColorForUrl(icon_url), kFallbackIconLetterColor);
+    SkColor fallback_color =
+        color_utils::BlendForMinContrast(GetBackgroundColorForUrl(icon_url),
+                                         kFallbackIconLetterColor)
+            .color;
 
     int offset = (icon_size - fallback_size) / 2;
     DrawCircleInCanvas(&canvas, fallback_size, offset, fallback_color);
diff --git a/chrome/browser/search/one_google_bar/one_google_bar_loader_impl.cc b/chrome/browser/search/one_google_bar/one_google_bar_loader_impl.cc
index 31f502d..b3cdee8 100644
--- a/chrome/browser/search/one_google_bar/one_google_bar_loader_impl.cc
+++ b/chrome/browser/search/one_google_bar/one_google_bar_loader_impl.cc
@@ -240,7 +240,7 @@
 
   auto resource_request = std::make_unique<network::ResourceRequest>();
   resource_request->url = api_url_;
-  resource_request->load_flags = net::LOAD_DO_NOT_SEND_AUTH_DATA;
+  resource_request->allow_credentials = true;
   SetRequestHeaders(resource_request.get());
   resource_request->request_initiator =
       url::Origin::Create(GURL(chrome::kChromeUINewTabURL));
@@ -342,8 +342,8 @@
                           weak_ptr_factory_.GetWeakPtr()));
 }
 
-void OneGoogleBarLoaderImpl::JsonParsed(std::unique_ptr<base::Value> value) {
-  base::Optional<OneGoogleBarData> result = JsonToOGBData(*value);
+void OneGoogleBarLoaderImpl::JsonParsed(base::Value value) {
+  base::Optional<OneGoogleBarData> result = JsonToOGBData(value);
   Respond(result.has_value() ? Status::OK : Status::FATAL_ERROR, result);
 }
 
diff --git a/chrome/browser/search/one_google_bar/one_google_bar_loader_impl.h b/chrome/browser/search/one_google_bar/one_google_bar_loader_impl.h
index ac9babc..deec1d8 100644
--- a/chrome/browser/search/one_google_bar/one_google_bar_loader_impl.h
+++ b/chrome/browser/search/one_google_bar/one_google_bar_loader_impl.h
@@ -48,7 +48,7 @@
   void LoadDone(const network::SimpleURLLoader* simple_loader,
                 std::unique_ptr<std::string> response_body);
 
-  void JsonParsed(std::unique_ptr<base::Value> value);
+  void JsonParsed(base::Value value);
   void JsonParseFailed(const std::string& message);
 
   void Respond(Status status, const base::Optional<OneGoogleBarData>& data);
diff --git a/chrome/browser/search/promos/promo_service.cc b/chrome/browser/search/promos/promo_service.cc
index 35fd551e..4988005f 100644
--- a/chrome/browser/search/promos/promo_service.cc
+++ b/chrome/browser/search/promos/promo_service.cc
@@ -130,7 +130,7 @@
 
   auto resource_request = std::make_unique<network::ResourceRequest>();
   resource_request->url = GetApiUrl();
-  resource_request->load_flags = net::LOAD_DO_NOT_SEND_AUTH_DATA;
+  resource_request->allow_credentials = false;
 
   simple_loader_ = network::SimpleURLLoader::Create(std::move(resource_request),
                                                     traffic_annotation);
@@ -167,10 +167,10 @@
                           weak_ptr_factory_.GetWeakPtr()));
 }
 
-void PromoService::OnJsonParsed(std::unique_ptr<base::Value> value) {
+void PromoService::OnJsonParsed(base::Value value) {
   const GURL google_base_url = GetGoogleBaseUrl();
   base::Optional<PromoData> result;
-  if (JsonToPromoData(*value, google_base_url, result)) {
+  if (JsonToPromoData(value, google_base_url, result)) {
     PromoDataLoaded(Status::OK_WITH_PROMO, result);
   } else {
     if (result.has_value()) {
diff --git a/chrome/browser/search/promos/promo_service.h b/chrome/browser/search/promos/promo_service.h
index c3fd804..22d6103 100644
--- a/chrome/browser/search/promos/promo_service.h
+++ b/chrome/browser/search/promos/promo_service.h
@@ -69,7 +69,7 @@
 
  private:
   void OnLoadDone(std::unique_ptr<std::string> response_body);
-  void OnJsonParsed(std::unique_ptr<base::Value> value);
+  void OnJsonParsed(base::Value value);
   void OnJsonParseFailed(const std::string& message);
 
   void NotifyObservers();
diff --git a/chrome/browser/search/search_suggest/search_suggest_loader_impl.cc b/chrome/browser/search/search_suggest/search_suggest_loader_impl.cc
index b10c2da..6d3dd18 100644
--- a/chrome/browser/search/search_suggest/search_suggest_loader_impl.cc
+++ b/chrome/browser/search/search_suggest/search_suggest_loader_impl.cc
@@ -277,9 +277,9 @@
                           weak_ptr_factory_.GetWeakPtr()));
 }
 
-void SearchSuggestLoaderImpl::JsonParsed(std::unique_ptr<base::Value> value) {
+void SearchSuggestLoaderImpl::JsonParsed(base::Value value) {
   base::Optional<SearchSuggestData> result;
-  if (JsonToSearchSuggestionData(*value, result)) {
+  if (JsonToSearchSuggestionData(value, result)) {
     Respond(Status::OK_WITH_SUGGESTIONS, result);
   } else if (result.has_value()) {
     Respond(Status::OK_WITHOUT_SUGGESTIONS, result);
diff --git a/chrome/browser/search/search_suggest/search_suggest_loader_impl.h b/chrome/browser/search/search_suggest/search_suggest_loader_impl.h
index cd9d5d0d..819c5bd 100644
--- a/chrome/browser/search/search_suggest/search_suggest_loader_impl.h
+++ b/chrome/browser/search/search_suggest/search_suggest_loader_impl.h
@@ -48,7 +48,7 @@
   void LoadDone(const network::SimpleURLLoader* simple_loader,
                 std::unique_ptr<std::string> response_body);
 
-  void JsonParsed(std::unique_ptr<base::Value> value);
+  void JsonParsed(base::Value value);
   void JsonParseFailed(const std::string& message);
 
   void Respond(Status status, const base::Optional<SearchSuggestData>& data);
diff --git a/chrome/browser/send_tab_to_self/send_tab_to_self_util.cc b/chrome/browser/send_tab_to_self/send_tab_to_self_util.cc
index b2abc593b..6700e6b 100644
--- a/chrome/browser/send_tab_to_self/send_tab_to_self_util.cc
+++ b/chrome/browser/send_tab_to_self/send_tab_to_self_util.cc
@@ -53,7 +53,7 @@
 bool IsContentRequirementsMet(const GURL& url, Profile* profile) {
   bool is_http_or_https = url.SchemeIsHTTPOrHTTPS();
   bool is_native_page = url.SchemeIs(content::kChromeUIScheme);
-  bool is_incognito_mode = profile->IsIncognito();
+  bool is_incognito_mode = profile->IsIncognitoProfile();
   return is_http_or_https && !is_native_page && !is_incognito_mode;
 }
 
diff --git a/chrome/browser/signin/signin_promo.cc b/chrome/browser/signin/signin_promo.cc
index c43f554..31a1b7aba 100644
--- a/chrome/browser/signin/signin_promo.cc
+++ b/chrome/browser/signin/signin_promo.cc
@@ -142,8 +142,6 @@
 
 void RegisterProfilePrefs(
     user_prefs::PrefRegistrySyncable* registry) {
-  registry->RegisterBooleanPref(prefs::kSignInPromoShowOnFirstRunAllowed, true);
-  registry->RegisterBooleanPref(prefs::kSignInPromoShowNTPBubble, false);
   registry->RegisterIntegerPref(prefs::kDiceSigninUserMenuPromoCount, 0);
 }
 
diff --git a/chrome/browser/sync/profile_sync_service_android.cc b/chrome/browser/sync/profile_sync_service_android.cc
index 2e5f2292..0b0ad98 100644
--- a/chrome/browser/sync/profile_sync_service_android.cc
+++ b/chrome/browser/sync/profile_sync_service_android.cc
@@ -502,8 +502,7 @@
     const base::android::JavaParamRef<jobject>& obj) {
   // Only allowed to trigger refresh/schedule nudges for protocol types, things
   // like PROXY_TABS are not allowed.
-  sync_service_->TriggerRefresh(syncer::Intersection(
-      sync_service_->GetActiveDataTypes(), syncer::ProtocolTypes()));
+  sync_service_->TriggerRefresh(syncer::ProtocolTypes());
 }
 
 static jlong JNI_ProfileSyncService_Init(JNIEnv* env,
diff --git a/chrome/browser/sync/test/integration/two_client_uss_sync_test.cc b/chrome/browser/sync/test/integration/two_client_uss_sync_test.cc
deleted file mode 100644
index 040c56ce..0000000
--- a/chrome/browser/sync/test/integration/two_client_uss_sync_test.cc
+++ /dev/null
@@ -1,423 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/bind.h"
-#include "base/macros.h"
-#include "base/optional.h"
-#include "base/threading/thread_task_runner_handle.h"
-#include "build/build_config.h"
-#include "chrome/browser/sync/chrome_sync_client.h"
-#include "chrome/browser/sync/profile_sync_service_factory.h"
-#include "chrome/browser/sync/test/integration/profile_sync_service_harness.h"
-#include "chrome/browser/sync/test/integration/single_client_status_change_checker.h"
-#include "chrome/browser/sync/test/integration/status_change_checker.h"
-#include "chrome/browser/sync/test/integration/sync_integration_test_util.h"
-#include "chrome/browser/sync/test/integration/sync_test.h"
-#include "components/browser_sync/profile_sync_components_factory_impl.h"
-#include "components/sync/driver/profile_sync_service.h"
-#include "components/sync/model/fake_model_type_sync_bridge.h"
-#include "components/sync/model/metadata_change_list.h"
-#include "components/sync/model/model_error.h"
-#include "components/sync/model/model_type_change_processor.h"
-#include "components/sync/model/model_type_controller_delegate.h"
-#include "components/sync/model_impl/client_tag_based_model_type_processor.h"
-#include "components/sync/test/fake_server/fake_server_http_post_provider.h"
-#include "net/base/network_change_notifier.h"
-
-using browser_sync::ChromeSyncClient;
-using browser_sync::ProfileSyncComponentsFactoryImpl;
-using syncer::ClientTagBasedModelTypeProcessor;
-using syncer::ConflictResolution;
-using syncer::FakeModelTypeSyncBridge;
-using syncer::ModelTypeChangeProcessor;
-using syncer::ModelTypeControllerDelegate;
-using syncer::ModelTypeSyncBridge;
-
-namespace {
-
-const char kKey1[] = "key1";
-const char kKey2[] = "key2";
-const char kKey3[] = "key3";
-const char kKey4[] = "key4";
-const char kValue1[] = "value1";
-const char kValue2[] = "value2";
-const char kValue3[] = "value3";
-const char* kPassphrase = "12345";
-
-// A ChromeSyncClient that provides a ModelTypeControllerDelegate for
-// PREFERENCES.
-class TestSyncClient : public ChromeSyncClient {
- public:
-  TestSyncClient(Profile* profile, ModelTypeSyncBridge* bridge)
-      : ChromeSyncClient(profile), bridge_(bridge) {}
-
-  base::WeakPtr<ModelTypeControllerDelegate> GetControllerDelegateForModelType(
-      syncer::ModelType type) override {
-    return type == syncer::PREFERENCES
-               ? static_cast<base::WeakPtr<ModelTypeControllerDelegate>>(
-                     bridge_->change_processor()->GetControllerDelegate())
-               : ChromeSyncClient::GetControllerDelegateForModelType(type);
-  }
-
- private:
-  ModelTypeSyncBridge* const bridge_;
-};
-
-// A FakeModelTypeSyncBridge that supports observing ApplySyncChanges.
-class TestModelTypeSyncBridge : public FakeModelTypeSyncBridge {
- public:
-  class Observer {
-   public:
-    virtual void OnApplySyncChanges() = 0;
-  };
-
-  TestModelTypeSyncBridge()
-      : FakeModelTypeSyncBridge(
-            std::make_unique<ClientTagBasedModelTypeProcessor>(
-                syncer::PREFERENCES,
-                /*dump_stack=*/base::RepeatingClosure())) {
-    change_processor()->ModelReadyToSync(db().CreateMetadataBatch());
-  }
-
-  base::Optional<syncer::ModelError> ApplySyncChanges(
-      std::unique_ptr<syncer::MetadataChangeList> metadata_changes,
-      syncer::EntityChangeList entity_changes) override {
-    auto error = FakeModelTypeSyncBridge::ApplySyncChanges(
-        std::move(metadata_changes), std::move(entity_changes));
-    NotifyObservers();
-    return error;
-  }
-
-  void AddObserver(Observer* observer) { observers_.insert(observer); }
-  void RemoveObserver(Observer* observer) { observers_.erase(observer); }
-
- private:
-  void NotifyObservers() {
-    for (Observer* observer : observers_) {
-      observer->OnApplySyncChanges();
-    }
-  }
-
-  std::set<Observer*> observers_;
-};
-
-// A StatusChangeChecker for checking the status of keys in a
-// TestModelTypeSyncBridge::Store.
-class KeyChecker : public StatusChangeChecker,
-                   public TestModelTypeSyncBridge::Observer {
- public:
-  KeyChecker(TestModelTypeSyncBridge* bridge, const std::string& key)
-      : bridge_(bridge), key_(key) {
-    bridge_->AddObserver(this);
-  }
-
-  ~KeyChecker() override { bridge_->RemoveObserver(this); }
-
-  void OnApplySyncChanges() override { CheckExitCondition(); }
-
- protected:
-  TestModelTypeSyncBridge* const bridge_;
-  const std::string key_;
-};
-
-// Wait for data for a key to have a certain value.
-class DataChecker : public KeyChecker {
- public:
-  DataChecker(TestModelTypeSyncBridge* bridge,
-              const std::string& key,
-              const std::string& value)
-      : KeyChecker(bridge, key), value_(value) {}
-
-  bool IsExitConditionSatisfied() override {
-    const auto& db = bridge_->db();
-    return db.HasData(key_) && db.GetValue(key_) == value_;
-  }
-
-  std::string GetDebugMessage() const override {
-    return "Waiting for data for key '" + key_ + "' to be '" + value_ + "'.";
-  }
-
- private:
-  const std::string value_;
-};
-
-// Wait for data for a key to be absent.
-class DataAbsentChecker : public KeyChecker {
- public:
-  DataAbsentChecker(TestModelTypeSyncBridge* bridge, const std::string& key)
-      : KeyChecker(bridge, key) {}
-
-  bool IsExitConditionSatisfied() override {
-    return !bridge_->db().HasData(key_);
-  }
-
-  std::string GetDebugMessage() const override {
-    return "Waiting for data for key '" + key_ + "' to be absent.";
-  }
-};
-
-// Wait for metadata for a key to be present.
-class MetadataPresentChecker : public KeyChecker {
- public:
-  MetadataPresentChecker(TestModelTypeSyncBridge* bridge,
-                         const std::string& key)
-      : KeyChecker(bridge, key) {}
-
-  bool IsExitConditionSatisfied() override {
-    return bridge_->db().HasMetadata(key_);
-  }
-
-  std::string GetDebugMessage() const override {
-    return "Waiting for metadata for key '" + key_ + "' to be present.";
-  }
-};
-
-// Wait for metadata for a key to be absent.
-class MetadataAbsentChecker : public KeyChecker {
- public:
-  MetadataAbsentChecker(TestModelTypeSyncBridge* bridge, const std::string& key)
-      : KeyChecker(bridge, key) {}
-
-  bool IsExitConditionSatisfied() override {
-    return !bridge_->db().HasMetadata(key_);
-  }
-
-  std::string GetDebugMessage() const override {
-    return "Waiting for metadata for key '" + key_ + "' to be absent.";
-  }
-};
-
-// Wait for PREFERENCES to no longer be running.
-class PrefsNotRunningChecker : public SingleClientStatusChangeChecker {
- public:
-  explicit PrefsNotRunningChecker(syncer::ProfileSyncService* service)
-      : SingleClientStatusChangeChecker(service) {}
-
-  bool IsExitConditionSatisfied() override {
-    return !service()->IsDataTypeControllerRunningForTest(syncer::PREFERENCES);
-  }
-
-  std::string GetDebugMessage() const override {
-    return "Waiting for prefs to be not running.";
-  }
-};
-
-// Wait for sync cycle failure.
-class SyncCycleFailedChecker : public SingleClientStatusChangeChecker {
- public:
-  explicit SyncCycleFailedChecker(syncer::ProfileSyncService* service)
-      : SingleClientStatusChangeChecker(service) {}
-
-  bool IsExitConditionSatisfied() override {
-    const syncer::SyncCycleSnapshot& snap =
-        service()->GetLastCycleSnapshotForDebugging();
-    return HasSyncerError(snap.model_neutral_state());
-  }
-
-  std::string GetDebugMessage() const override {
-    return "Waiting for  sync cycle failure";
-  }
-};
-
-class TwoClientUssSyncTest : public SyncTest {
- public:
-  TwoClientUssSyncTest() : SyncTest(TWO_CLIENT) {
-    DisableVerifier();
-    sync_client_factory_ = base::Bind(&TwoClientUssSyncTest::CreateSyncClient,
-                                      base::Unretained(this));
-    ProfileSyncServiceFactory::SetSyncClientFactoryForTest(
-        &sync_client_factory_);
-    ProfileSyncComponentsFactoryImpl::OverridePrefsForUssTest(true);
-    // The test infra creates a profile before the two made for sync tests.
-    number_of_clients_ignored_ = 1;
-#if defined(OS_CHROMEOS)
-    // ChromeOS will force loading a signin profile, so we need to ignore one
-    // more client.
-    number_of_clients_ignored_ += 1;
-#endif
-  }
-
-  ~TwoClientUssSyncTest() override {
-    ProfileSyncServiceFactory::SetSyncClientFactoryForTest(nullptr);
-    ProfileSyncComponentsFactoryImpl::OverridePrefsForUssTest(false);
-  }
-
-  void SetUp() override {
-    net::NetworkChangeNotifier::SetTestNotificationsOnly(true);
-    SyncTest::SetUp();
-  }
-
-  bool TestUsesSelfNotifications() override { return false; }
-
-  TestModelTypeSyncBridge* GetModelTypeSyncBridge(int i) {
-    return bridges_.at(i).get();
-  }
-
- protected:
-  std::unique_ptr<ChromeSyncClient> CreateSyncClient(Profile* profile) {
-    if (number_of_clients_ignored_ > 0) {
-      --number_of_clients_ignored_;
-      return std::make_unique<ChromeSyncClient>(profile);
-    }
-    auto bridge = std::make_unique<TestModelTypeSyncBridge>();
-    auto client = std::make_unique<TestSyncClient>(profile, bridge.get());
-    clients_.push_back(client.get());
-    bridges_.push_back(std::move(bridge));
-    return std::move(client);
-  }
-
-  ProfileSyncServiceFactory::SyncClientFactory sync_client_factory_;
-  std::vector<std::unique_ptr<TestModelTypeSyncBridge>> bridges_;
-  std::vector<TestSyncClient*> clients_;
-  size_t number_of_clients_ignored_;
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(TwoClientUssSyncTest);
-};
-
-IN_PROC_BROWSER_TEST_F(TwoClientUssSyncTest, Sanity) {
-  ASSERT_TRUE(SetupSync());
-  ASSERT_EQ(2U, clients_.size());
-  ASSERT_EQ(2U, bridges_.size());
-  TestModelTypeSyncBridge* model0 = GetModelTypeSyncBridge(0);
-  TestModelTypeSyncBridge* model1 = GetModelTypeSyncBridge(1);
-
-  // Add an entity.
-  model0->WriteItem(kKey1, kValue1);
-  ASSERT_TRUE(DataChecker(model1, kKey1, kValue1).Wait());
-
-  // Update an entity.
-  model0->WriteItem(kKey1, kValue2);
-  ASSERT_TRUE(DataChecker(model1, kKey1, kValue2).Wait());
-
-  // Delete an entity.
-  model0->DeleteItem(kKey1);
-  ASSERT_TRUE(DataAbsentChecker(model1, kKey1).Wait());
-}
-
-IN_PROC_BROWSER_TEST_F(TwoClientUssSyncTest, DisableEnable) {
-  ASSERT_TRUE(SetupSync());
-  TestModelTypeSyncBridge* model0 = GetModelTypeSyncBridge(0);
-  TestModelTypeSyncBridge* model1 = GetModelTypeSyncBridge(1);
-
-  // Add an entity to test with.
-  model0->WriteItem(kKey1, kValue1);
-  ASSERT_TRUE(DataChecker(model1, kKey1, kValue1).Wait());
-  ASSERT_EQ(1U, model0->db().data_count());
-  ASSERT_EQ(1U, model0->db().metadata_count());
-  ASSERT_EQ(1U, model1->db().data_count());
-  ASSERT_EQ(1U, model1->db().metadata_count());
-
-  // Disable PREFERENCES.
-  syncer::UserSelectableTypeSet types = syncer::UserSelectableTypeSet::All();
-  types.Remove(syncer::UserSelectableType::kPreferences);
-  GetSyncService(0)->GetUserSettings()->SetSelectedTypes(false, types);
-
-  // Wait for it to take effect and remove the metadata.
-  ASSERT_TRUE(MetadataAbsentChecker(model0, kKey1).Wait());
-  ASSERT_EQ(1U, model0->db().data_count());
-  ASSERT_EQ(0U, model0->db().metadata_count());
-  // Model 1 should not be affected.
-  ASSERT_EQ(1U, model1->db().data_count());
-  ASSERT_EQ(1U, model1->db().metadata_count());
-
-  // Re-enable PREFERENCES.
-  GetSyncService(0)->GetUserSettings()->SetSelectedTypes(
-      true, syncer::UserSelectableTypeSet::All());
-
-  // Wait for metadata to be re-added.
-  ASSERT_TRUE(MetadataPresentChecker(model0, kKey1).Wait());
-  ASSERT_EQ(1U, model0->db().data_count());
-  ASSERT_EQ(1U, model0->db().metadata_count());
-  ASSERT_EQ(1U, model1->db().data_count());
-  ASSERT_EQ(1U, model1->db().metadata_count());
-}
-
-IN_PROC_BROWSER_TEST_F(TwoClientUssSyncTest, ConflictResolution) {
-  ASSERT_TRUE(SetupSync());
-  TestModelTypeSyncBridge* model0 = GetModelTypeSyncBridge(0);
-  TestModelTypeSyncBridge* model1 = GetModelTypeSyncBridge(1);
-  model0->SetConflictResolution(ConflictResolution::kUseRemote);
-  model1->SetConflictResolution(ConflictResolution::kUseRemote);
-
-  // Write initial value and wait for it to sync to the other client.
-  model0->WriteItem(kKey1, kValue1);
-  ASSERT_TRUE(DataChecker(model1, kKey1, kValue1).Wait());
-
-  // Disable network, write value on client 0 and wait for it to attempt
-  // committing the value. This client now has conflicting change.
-  fake_server::FakeServerHttpPostProvider::DisableNetwork();
-  model0->WriteItem(kKey1, kValue2);
-  ASSERT_TRUE(SyncCycleFailedChecker(GetSyncService(0)).Wait());
-
-  // Enable network, write different value on client 1 and wait for it to arrive
-  // on server. Server now has value different from client 0 which will cause
-  // conflict when client 0 performs GetUpdates.
-  fake_server::FakeServerHttpPostProvider::EnableNetwork();
-  model1->WriteItem(kKey1, kValue3);
-  model1->WriteItem(kKey2, kValue1);
-  ASSERT_TRUE(ServerCountMatchStatusChecker(syncer::PREFERENCES, 2).Wait());
-
-  // Trigger sync cycle on client 0 by delivering network change notification.
-  // Wait for it to resolve conflicting value using the remote value coming from
-  // the server.
-  net::NetworkChangeNotifier::NotifyObserversOfNetworkChangeForTests(
-      net::NetworkChangeNotifier::CONNECTION_ETHERNET);
-  ASSERT_TRUE(DataChecker(model0, kKey1, kValue3).Wait());
-}
-
-IN_PROC_BROWSER_TEST_F(TwoClientUssSyncTest, Error) {
-  ASSERT_TRUE(SetupSync());
-  TestModelTypeSyncBridge* model0 = GetModelTypeSyncBridge(0);
-  TestModelTypeSyncBridge* model1 = GetModelTypeSyncBridge(1);
-
-  // Add an entity.
-  model0->WriteItem(kKey1, kValue1);
-  ASSERT_TRUE(DataChecker(model1, kKey1, kValue1).Wait());
-
-  // Set an error in model 1 to trigger in the next GetUpdates.
-  model1->ErrorOnNextCall();
-  // Write an item on model 0 to trigger a GetUpdates in model 1.
-  model0->WriteItem(kKey1, kValue2);
-
-  // The type should stop syncing but keep tracking metadata.
-  ASSERT_TRUE(PrefsNotRunningChecker(GetSyncService(1)).Wait());
-  ASSERT_EQ(1U, model1->db().metadata_count());
-  model1->WriteItem(kKey2, kValue2);
-  ASSERT_EQ(2U, model1->db().metadata_count());
-}
-
-IN_PROC_BROWSER_TEST_F(TwoClientUssSyncTest, Encryption) {
-  ASSERT_TRUE(SetupSync());
-  TestModelTypeSyncBridge* model0 = GetModelTypeSyncBridge(0);
-  TestModelTypeSyncBridge* model1 = GetModelTypeSyncBridge(1);
-
-  model0->WriteItem(kKey1, kValue1);
-  ASSERT_TRUE(DataChecker(model1, kKey1, kValue1).Wait());
-
-  GetSyncService(0)->GetUserSettings()->SetEncryptionPassphrase(kPassphrase);
-  ASSERT_TRUE(PassphraseAcceptedChecker(GetSyncService(0)).Wait());
-  // Wait for client 1 to know that a passphrase is happening to avoid potential
-  // race conditions and make the functionality this case tests more consistent.
-  ASSERT_TRUE(PassphraseRequiredChecker(GetSyncService(1)).Wait());
-
-  model0->WriteItem(kKey1, kValue2);
-  model0->WriteItem(kKey2, kValue1);
-  model1->WriteItem(kKey3, kValue1);
-
-  ASSERT_TRUE(GetSyncService(1)->GetUserSettings()->SetDecryptionPassphrase(
-      kPassphrase));
-  ASSERT_TRUE(PassphraseAcceptedChecker(GetSyncService(1)).Wait());
-
-  model0->WriteItem(kKey4, kValue1);
-
-  ASSERT_TRUE(DataChecker(model1, kKey1, kValue2).Wait());
-  ASSERT_TRUE(DataChecker(model1, kKey2, kValue1).Wait());
-  ASSERT_TRUE(DataChecker(model1, kKey4, kValue1).Wait());
-
-  ASSERT_TRUE(DataChecker(model0, kKey1, kValue2).Wait());
-  ASSERT_TRUE(DataChecker(model0, kKey3, kValue1).Wait());
-}
-
-}  // namespace
diff --git a/chrome/browser/themes/browser_theme_pack.cc b/chrome/browser/themes/browser_theme_pack.cc
index 9a72375..dbd7574 100644
--- a/chrome/browser/themes/browser_theme_pack.cc
+++ b/chrome/browser/themes/browser_theme_pack.cc
@@ -812,10 +812,10 @@
     frame_text_color = color_utils::GetColorWithMaxContrast(frame_color);
     SkColor blend_target =
         color_utils::GetColorWithMaxContrast(frame_text_color);
-    SkAlpha alpha = color_utils::GetBlendValueWithMinimumContrast(
-        frame_color, blend_target, frame_text_color,
-        kPreferredReadableContrastRatio);
-    frame_color = color_utils::AlphaBlend(blend_target, frame_color, alpha);
+    frame_color = color_utils::BlendForMinContrast(
+                      frame_color, frame_text_color, blend_target,
+                      kPreferredReadableContrastRatio)
+                      .color;
 
     // Generate active tab color so that it has enough contrast with the
     // |frame_color| to avoid the isolation line in the tab strip.
@@ -1828,9 +1828,9 @@
     }
   }
 
-  const SkColor result_color =
-      color_utils::GetColorWithMinimumContrast(blend_source_color, bg_color);
-  SetColor(text_color_id, result_color);
+  SetColor(
+      text_color_id,
+      color_utils::BlendForMinContrast(blend_source_color, bg_color).color);
 }
 
 void BrowserThemePack::GenerateMissingNtpColors() {
diff --git a/chrome/browser/themes/theme_service.cc b/chrome/browser/themes/theme_service.cc
index 6dde625..d65388e2 100644
--- a/chrome/browser/themes/theme_service.cc
+++ b/chrome/browser/themes/theme_service.cc
@@ -533,16 +533,16 @@
 const ui::ThemeProvider& ThemeService::GetThemeProviderForProfile(
     Profile* profile) {
   ThemeService* service = ThemeServiceFactory::GetForProfile(profile);
-  return profile->IsIncognito() ? service->incognito_theme_provider_
-                                : service->original_theme_provider_;
+  return profile->IsIncognitoProfile() ? service->incognito_theme_provider_
+                                       : service->original_theme_provider_;
 }
 
 // static
 const ui::ThemeProvider& ThemeService::GetDefaultThemeProviderForProfile(
     Profile* profile) {
   ThemeService* service = ThemeServiceFactory::GetForProfile(profile);
-  return profile->IsIncognito() ? service->incognito_theme_provider_
-                                : service->default_theme_provider_;
+  return profile->IsIncognitoProfile() ? service->incognito_theme_provider_
+                                       : service->default_theme_provider_;
 }
 
 void ThemeService::BuildFromColor(SkColor color) {
@@ -770,12 +770,13 @@
     separator_color = color_utils::GetColorWithMaxContrast(separator_color);
   }
 
-  SkAlpha alpha = color_utils::FindBlendValueForContrastRatio(
-      frame_color, separator_color, frame_color, kContrastRatio, 0);
-  if (color_utils::GetContrastRatio(
-          color_utils::AlphaBlend(separator_color, frame_color, alpha),
-          frame_color) >= kContrastRatio) {
-    return SkColorSetA(separator_color, alpha);
+  {
+    const auto result = color_utils::BlendForMinContrast(
+        frame_color, frame_color, separator_color, kContrastRatio);
+    if (color_utils::GetContrastRatio(result.color, frame_color) >=
+        kContrastRatio) {
+      return SkColorSetA(separator_color, result.alpha);
+    }
   }
 
   separator_color = color_utils::GetColorWithMaxContrast(separator_color);
@@ -786,9 +787,9 @@
   // dark or very light, just not quite as much so as the frame color.  Blend
   // towards the opposite separator color, and compute the contrast against the
   // tab instead of the frame to ensure both contrasts hit the desired minimum.
-  alpha = color_utils::FindBlendValueForContrastRatio(
-      frame_color, separator_color, tab_color, kContrastRatio, 0);
-  return SkColorSetA(separator_color, alpha);
+  const auto result = color_utils::BlendForMinContrast(
+      frame_color, tab_color, separator_color, kContrastRatio);
+  return SkColorSetA(separator_color, result.alpha);
 }
 
 void ThemeService::DoSetTheme(const Extension* extension,
diff --git a/chrome/browser/ui/BUILD.gn b/chrome/browser/ui/BUILD.gn
index 78a50181..d230c84 100644
--- a/chrome/browser/ui/BUILD.gn
+++ b/chrome/browser/ui/BUILD.gn
@@ -114,6 +114,8 @@
     "find_bar/find_notification_details.h",
     "find_bar/find_tab_helper.cc",
     "find_bar/find_tab_helper.h",
+    "infobars/tab_sharing_infobar_delegate.cc",
+    "infobars/tab_sharing_infobar_delegate.h",
     "interventions/framebust_block_message_delegate.cc",
     "interventions/framebust_block_message_delegate.h",
     "interventions/intervention_delegate.h",
@@ -2273,8 +2275,8 @@
       "webui/conflicts/conflicts_handler.h",
       "webui/conflicts/conflicts_ui.cc",
       "webui/conflicts/conflicts_ui.h",
-      "webui/settings/chrome_cleanup_handler.cc",
-      "webui/settings/chrome_cleanup_handler.h",
+      "webui/settings/chrome_cleanup_handler_win.cc",
+      "webui/settings/chrome_cleanup_handler_win.h",
       "webui/settings_utils_win.cc",
       "webui/version_handler_win.cc",
       "webui/version_handler_win.h",
@@ -2288,6 +2290,7 @@
       "//ui/views/controls/webview",
     ]
     deps += [
+      "//chrome/browser/safe_browsing:chrome_cleaner_types",
       "//chrome/browser/win/conflicts:module_info",
       "//chrome/credential_provider/common:common_constants",
       "//components/search_engines",
diff --git a/chrome/browser/ui/ash/chrome_new_window_client_browsertest.cc b/chrome/browser/ui/ash/chrome_new_window_client_browsertest.cc
index 43aa948..f7b5ff1 100644
--- a/chrome/browser/ui/ash/chrome_new_window_client_browsertest.cc
+++ b/chrome/browser/ui/ash/chrome_new_window_client_browsertest.cc
@@ -122,7 +122,7 @@
                                       IncognitoModePrefs::ENABLED);
   ChromeNewWindowClient::Get()->NewWindow(true /* incognito */);
   EXPECT_EQ(2u, chrome::GetTotalBrowserCount());
-  EXPECT_TRUE(GetLastActiveBrowser()->profile()->IsIncognito());
+  EXPECT_TRUE(GetLastActiveBrowser()->profile()->IsIncognitoProfile());
 }
 
 IN_PROC_BROWSER_TEST_F(ChromeNewWindowClientWebAppBrowserTest, OpenWebApp) {
diff --git a/chrome/browser/ui/ash/network/networking_config_chromeos_browsertest.cc b/chrome/browser/ui/ash/network/networking_config_chromeos_browsertest.cc
index afc0924..416fb04e 100644
--- a/chrome/browser/ui/ash/network/networking_config_chromeos_browsertest.cc
+++ b/chrome/browser/ui/ash/network/networking_config_chromeos_browsertest.cc
@@ -3,19 +3,13 @@
 // found in the LICENSE file.
 
 #include "ash/public/cpp/ash_view_ids.h"
-#include "ash/public/interfaces/constants.mojom.h"
-#include "ash/public/interfaces/system_tray_test_api.test-mojom-test-utils.h"
-#include "ash/public/interfaces/system_tray_test_api.test-mojom.h"
-#include "base/macros.h"
+#include "ash/public/cpp/system_tray_test_api.h"
 #include "base/run_loop.h"
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/extensions/extension_browsertest.h"
-#include "content/public/common/service_manager_connection.h"
 #include "content/public/test/test_utils.h"
 #include "extensions/test/extension_test_message_listener.h"
-#include "services/service_manager/public/cpp/connector.h"
-#include "ui/base/l10n/l10n_util.h"
 
 namespace {
 
@@ -30,24 +24,17 @@
   ASSERT_TRUE(LoadExtension(test_data_dir_.AppendASCII("networking_config")));
   ASSERT_TRUE(listener.WaitUntilSatisfied());
 
-  // Connect to ash.
-  ash::mojom::SystemTrayTestApiPtr tray_test_api;
-  content::ServiceManagerConnection::GetForProcess()
-      ->GetConnector()
-      ->BindInterface(ash::mojom::kServiceName, &tray_test_api);
-
   // Show the network detail view.
-  ash::mojom::SystemTrayTestApiAsyncWaiter wait_for(tray_test_api.get());
-  wait_for.ShowDetailedView(ash::mojom::TrayItem::kNetwork);
+  auto tray_test_api = ash::SystemTrayTestApi::Create();
+  tray_test_api->ShowNetworkDetailedView();
   base::RunLoop().RunUntilIdle();
 
   // Expect that the extension-controlled item appears.
   base::string16 expected_tooltip = base::UTF8ToUTF16(
       "The extension \"NetworkingConfig test extension\" can help connect to "
       "this network.");
-  base::string16 tooltip;
-  wait_for.GetBubbleViewTooltip(ash::VIEW_ID_EXTENSION_CONTROLLED_WIFI,
-                                &tooltip);
+  base::string16 tooltip = tray_test_api->GetBubbleViewTooltip(
+      ash::VIEW_ID_EXTENSION_CONTROLLED_WIFI);
   EXPECT_EQ(expected_tooltip, tooltip);
 }
 
diff --git a/chrome/browser/ui/ash/system_tray_client_browsertest.cc b/chrome/browser/ui/ash/system_tray_client_browsertest.cc
index 3f6d1d7..d8071d1 100644
--- a/chrome/browser/ui/ash/system_tray_client_browsertest.cc
+++ b/chrome/browser/ui/ash/system_tray_client_browsertest.cc
@@ -5,80 +5,30 @@
 #include "chrome/browser/ui/ash/system_tray_client.h"
 
 #include "ash/public/cpp/ash_view_ids.h"
-#include "ash/public/interfaces/constants.mojom.h"
-#include "ash/public/interfaces/system_tray_test_api.test-mojom-test-utils.h"
-#include "ash/public/interfaces/system_tray_test_api.test-mojom.h"
-#include "base/i18n/time_formatting.h"
-#include "base/strings/utf_string_conversions.h"
+#include "ash/public/cpp/system_tray_test_api.h"
 #include "chrome/browser/chromeos/login/login_manager_test.h"
 #include "chrome/browser/chromeos/login/startup_utils.h"
 #include "chrome/browser/chromeos/login/ui/user_adding_screen.h"
 #include "chrome/browser/chromeos/policy/device_policy_cros_browser_test.h"
 #include "chrome/browser/chromeos/profiles/profile_helper.h"
 #include "chrome/browser/profiles/profile.h"
-#include "chrome/browser/upgrade_detector/upgrade_detector.h"
 #include "chrome/common/pref_names.h"
-#include "chrome/test/base/in_process_browser_test.h"
-#include "chromeos/dbus/dbus_thread_manager.h"
-#include "chromeos/dbus/fake_update_engine_client.h"
 #include "components/account_id/account_id.h"
 #include "components/prefs/pref_service.h"
 #include "components/user_manager/user_manager.h"
-#include "content/public/common/service_manager_connection.h"
 #include "content/public/test/test_utils.h"
-#include "services/service_manager/public/cpp/connector.h"
-#include "ui/views/controls/label.h"
 
 using chromeos::ProfileHelper;
 using user_manager::UserManager;
 
-class SystemTrayClientTest : public InProcessBrowserTest {
- public:
-  SystemTrayClientTest() = default;
-  ~SystemTrayClientTest() override = default;
-
-  void SetUp() override {
-    std::unique_ptr<chromeos::DBusThreadManagerSetter> dbus_setter =
-        chromeos::DBusThreadManager::GetSetterForTesting();
-    fake_update_engine_client_ = new chromeos::FakeUpdateEngineClient();
-    dbus_setter->SetUpdateEngineClient(
-        std::unique_ptr<chromeos::UpdateEngineClient>(
-            fake_update_engine_client_));
-    InProcessBrowserTest::SetUp();
-  }
-
-  void SetUpOnMainThread() override {
-    InProcessBrowserTest::SetUpOnMainThread();
-    // Connect to the ash test interface.
-    content::ServiceManagerConnection::GetForProcess()
-        ->GetConnector()
-        ->BindInterface(ash::mojom::kServiceName, &tray_test_api_);
-  }
-
- protected:
-  chromeos::FakeUpdateEngineClient* fake_update_engine_client_ = nullptr;
-  ash::mojom::SystemTrayTestApiPtr tray_test_api_;
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(SystemTrayClientTest);
-};
-
 using SystemTrayClientEnterpriseTest = policy::DevicePolicyCrosBrowserTest;
 
 IN_PROC_BROWSER_TEST_F(SystemTrayClientEnterpriseTest, TrayEnterprise) {
-  // Connect to ash.
-  ash::mojom::SystemTrayTestApiPtr tray_test_api;
-  content::ServiceManagerConnection::GetForProcess()
-      ->GetConnector()
-      ->BindInterface(ash::mojom::kServiceName, &tray_test_api);
-
-  ash::mojom::SystemTrayTestApiAsyncWaiter wait_for(tray_test_api.get());
+  auto test_api = ash::SystemTrayTestApi::Create();
 
   // Managed devices show an item in the menu.
-  bool view_visible = false;
-  wait_for.IsBubbleViewVisible(ash::VIEW_ID_TRAY_ENTERPRISE,
-                               true /* open_tray */, &view_visible);
-  EXPECT_TRUE(view_visible);
+  EXPECT_TRUE(test_api->IsBubbleViewVisible(ash::VIEW_ID_TRAY_ENTERPRISE,
+                                            true /* open_tray */));
 }
 
 class SystemTrayClientClockTest : public chromeos::LoginManagerTest {
@@ -119,32 +69,23 @@
 
 // Test that clock type is taken from user profile for current active user.
 IN_PROC_BROWSER_TEST_F(SystemTrayClientClockTest, TestMultiProfile24HourClock) {
-  // Connect to ash.
-  ash::mojom::SystemTrayTestApiPtr tray_test_api;
-  content::ServiceManagerConnection::GetForProcess()
-      ->GetConnector()
-      ->BindInterface(ash::mojom::kServiceName, &tray_test_api);
-  ash::mojom::SystemTrayTestApiAsyncWaiter wait_for(tray_test_api.get());
+  auto tray_test_api = ash::SystemTrayTestApi::Create();
 
   // Login a user with a 24-hour clock.
   LoginUser(account_id1_);
   SetupUserProfile(account_id1_, true /* use_24_hour_clock */);
-  bool is_24_hour = false;
-  wait_for.Is24HourClock(&is_24_hour);
-  EXPECT_TRUE(is_24_hour);
+  EXPECT_TRUE(tray_test_api->Is24HourClock());
 
   // Add a user with a 12-hour clock.
   chromeos::UserAddingScreen::Get()->Start();
   content::RunAllPendingInMessageLoop();
   AddUser(account_id2_);
   SetupUserProfile(account_id2_, false /* use_24_hour_clock */);
-  wait_for.Is24HourClock(&is_24_hour);
-  EXPECT_FALSE(is_24_hour);
+  EXPECT_FALSE(tray_test_api->Is24HourClock());
 
   // Switch back to the user with the 24-hour clock.
   UserManager::Get()->SwitchActiveUser(account_id1_);
   // Allow clock setting to be sent to ash over mojo.
   content::RunAllPendingInMessageLoop();
-  wait_for.Is24HourClock(&is_24_hour);
-  EXPECT_TRUE(is_24_hour);
+  EXPECT_TRUE(tray_test_api->Is24HourClock());
 }
diff --git a/chrome/browser/ui/ash/system_tray_tray_cast_browsertest_media_router_chromeos.cc b/chrome/browser/ui/ash/system_tray_tray_cast_browsertest_media_router_chromeos.cc
index 37835e77..2802bda 100644
--- a/chrome/browser/ui/ash/system_tray_tray_cast_browsertest_media_router_chromeos.cc
+++ b/chrome/browser/ui/ash/system_tray_tray_cast_browsertest_media_router_chromeos.cc
@@ -7,11 +7,10 @@
 
 #include "ash/public/cpp/ash_view_ids.h"
 #include "ash/public/cpp/cast_config_controller.h"
+#include "ash/public/cpp/system_tray_test_api.h"
 #include "ash/public/interfaces/ash_message_center_controller.mojom-test-utils.h"
 #include "ash/public/interfaces/ash_message_center_controller.mojom.h"
 #include "ash/public/interfaces/constants.mojom.h"
-#include "ash/public/interfaces/system_tray_test_api.test-mojom-test-utils.h"
-#include "ash/public/interfaces/system_tray_test_api.test-mojom.h"
 #include "base/macros.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/media/router/media_routes_observer.h"
@@ -51,16 +50,10 @@
   SystemTrayTrayCastMediaRouterChromeOSTest() : InProcessBrowserTest() {}
   ~SystemTrayTrayCastMediaRouterChromeOSTest() override {}
 
-  void ShowBubble() {
-    ash::mojom::SystemTrayTestApiAsyncWaiter wait_for(tray_test_api_.get());
-    wait_for.ShowBubble();
-  }
+  void ShowBubble() { tray_test_api_->ShowBubble(); }
 
   bool IsViewDrawn(int view_id) {
-    ash::mojom::SystemTrayTestApiAsyncWaiter wait_for(tray_test_api_.get());
-    bool visible = false;
-    wait_for.IsBubbleViewVisible(view_id, false /* open_tray */, &visible);
-    return visible;
+    return tray_test_api_->IsBubbleViewVisible(view_id, false /* open_tray */);
   }
 
   bool IsTrayVisible() { return IsViewDrawn(ash::VIEW_ID_CAST_MAIN_VIEW); }
@@ -114,10 +107,7 @@
 
   void SetUpOnMainThread() override {
     InProcessBrowserTest::SetUpOnMainThread();
-    // Connect to the ash test interface.
-    content::ServiceManagerConnection::GetForProcess()
-        ->GetConnector()
-        ->BindInterface(ash::mojom::kServiceName, &tray_test_api_);
+    tray_test_api_ = ash::SystemTrayTestApi::Create();
     // Connect to ash message center interface.
     content::ServiceManagerConnection::GetForProcess()
         ->GetConnector()
@@ -142,7 +132,7 @@
   std::unique_ptr<media_router::MockMediaRouter> media_router_;
   media_router::MediaSinksObserver* media_sinks_observer_ = nullptr;
   media_router::MediaRoutesObserver* media_routes_observer_ = nullptr;
-  ash::mojom::SystemTrayTestApiPtr tray_test_api_;
+  std::unique_ptr<ash::SystemTrayTestApi> tray_test_api_;
   ash::mojom::AshMessageCenterControllerPtr ash_message_center_controller_;
 
   DISALLOW_COPY_AND_ASSIGN(SystemTrayTrayCastMediaRouterChromeOSTest);
diff --git a/chrome/browser/ui/browser_command_controller.cc b/chrome/browser/ui/browser_command_controller.cc
index 36b31c8..cc19ed91 100644
--- a/chrome/browser/ui/browser_command_controller.cc
+++ b/chrome/browser/ui/browser_command_controller.cc
@@ -960,7 +960,7 @@
   command_updater_.UpdateCommandEnabled(IDC_TAKE_SCREENSHOT, true);
   // Chrome OS uses the system tray menu to handle multi-profiles. Avatar menu
   // is only required in incognito mode.
-  if (profile()->IsIncognito())
+  if (profile()->IsIncognitoProfile())
     command_updater_.UpdateCommandEnabled(IDC_SHOW_AVATAR_MENU, true);
 #else
   if (normal_window)
diff --git a/chrome/browser/ui/infobars/tab_sharing_infobar_delegate.cc b/chrome/browser/ui/infobars/tab_sharing_infobar_delegate.cc
new file mode 100644
index 0000000..4e5c156
--- /dev/null
+++ b/chrome/browser/ui/infobars/tab_sharing_infobar_delegate.cc
@@ -0,0 +1,59 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/ui/infobars/tab_sharing_infobar_delegate.h"
+
+#include <utility>
+
+#include "chrome/browser/infobars/infobar_service.h"
+#include "chrome/grit/generated_resources.h"
+#include "components/infobars/core/infobar.h"
+#include "ui/base/l10n/l10n_util.h"
+
+// static
+infobars::InfoBar* TabSharingInfoBarDelegate::Create(
+    InfoBarService* infobar_service,
+    const base::string16& shared_tab_name,
+    const base::string16& app_name) {
+  DCHECK(infobar_service);
+  return infobar_service->AddInfoBar(
+      infobar_service->CreateConfirmInfoBar(base::WrapUnique(
+          new TabSharingInfoBarDelegate(shared_tab_name, app_name))));
+}
+
+TabSharingInfoBarDelegate::TabSharingInfoBarDelegate(
+    base::string16 shared_tab_name,
+    base::string16 app_name)
+    : shared_tab_name_(std::move(shared_tab_name)),
+      app_name_(std::move(app_name)) {}
+
+infobars::InfoBarDelegate::InfoBarIdentifier
+TabSharingInfoBarDelegate::GetIdentifier() const {
+  return TAB_SHARING_INFOBAR_DELEGATE;
+}
+
+base::string16 TabSharingInfoBarDelegate::GetMessageText() const {
+  if (shared_tab_name_.empty()) {
+    return l10n_util::GetStringFUTF16(
+        IDS_TAB_SHARING_INFOBAR_SHARING_CURRENT_TAB_LABEL, app_name_);
+  }
+  return l10n_util::GetStringFUTF16(
+      IDS_TAB_SHARING_INFOBAR_SHARING_ANOTHER_TAB_LABEL, shared_tab_name_,
+      app_name_);
+}
+
+base::string16 TabSharingInfoBarDelegate::GetButtonLabel(
+    InfoBarButton button) const {
+  return l10n_util::GetStringUTF16((button == BUTTON_OK)
+                                       ? IDS_TAB_SHARING_INFOBAR_SHARE_BUTTON
+                                       : IDS_TAB_SHARING_INFOBAR_STOP_BUTTON);
+}
+
+int TabSharingInfoBarDelegate::GetButtons() const {
+  return shared_tab_name_.empty() ? BUTTON_CANCEL : BUTTON_OK | BUTTON_CANCEL;
+}
+
+bool TabSharingInfoBarDelegate::IsCloseable() const {
+  return false;
+}
diff --git a/chrome/browser/ui/infobars/tab_sharing_infobar_delegate.h b/chrome/browser/ui/infobars/tab_sharing_infobar_delegate.h
new file mode 100644
index 0000000..6fa1647c
--- /dev/null
+++ b/chrome/browser/ui/infobars/tab_sharing_infobar_delegate.h
@@ -0,0 +1,46 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_UI_INFOBARS_TAB_SHARING_INFOBAR_DELEGATE_H_
+#define CHROME_BROWSER_UI_INFOBARS_TAB_SHARING_INFOBAR_DELEGATE_H_
+
+#include "components/infobars/core/confirm_infobar_delegate.h"
+
+namespace infobars {
+class InfoBar;
+}
+
+class InfoBarService;
+
+// Creates an infobar for sharing a tab using desktopCapture() API; one delegate
+// per tab.
+// Layout for currently shared tab:
+// "Sharing this tab to |app_name_|  [Stop]"
+// Layout for all other tabs:
+// "Sharing |shared_tab_name_| to |app_name_| [Share this tab] [Stop]"
+class TabSharingInfoBarDelegate : public ConfirmInfoBarDelegate {
+ public:
+  // Creates a tab sharing infobar. If |shared_tab_name| is empty, it creates an
+  // infobar with "currently shared tab" layout (see class comment).
+  static infobars::InfoBar* Create(InfoBarService* infobar_service,
+                                   const base::string16& shared_tab_name,
+                                   const base::string16& app_name);
+  ~TabSharingInfoBarDelegate() override = default;
+
+ private:
+  TabSharingInfoBarDelegate(base::string16 shared_tab_name,
+                            base::string16 app_name);
+
+  // ConfirmInfoBarDelegate:
+  infobars::InfoBarDelegate::InfoBarIdentifier GetIdentifier() const override;
+  base::string16 GetMessageText() const override;
+  base::string16 GetButtonLabel(InfoBarButton button) const override;
+  int GetButtons() const override;
+  bool IsCloseable() const override;
+
+  const base::string16 shared_tab_name_;
+  const base::string16 app_name_;
+};
+
+#endif  // CHROME_BROWSER_UI_INFOBARS_TAB_SHARING_INFOBAR_DELEGATE_H_
diff --git a/chrome/browser/ui/libgtkui/gtk_ui.cc b/chrome/browser/ui/libgtkui/gtk_ui.cc
index 9d5254b0..26e9fd2 100644
--- a/chrome/browser/ui/libgtkui/gtk_ui.cc
+++ b/chrome/browser/ui/libgtkui/gtk_ui.cc
@@ -920,17 +920,19 @@
     color_map[ThemeProperties::COLOR_BACKGROUND_TAB_TEXT] =
         background_tab_text_color;
     color_map[ThemeProperties::COLOR_BACKGROUND_TAB_TEXT_INCOGNITO] =
-        color_utils::GetColorWithMinimumContrast(
+        color_utils::BlendForMinContrast(
             color_utils::HSLShift(background_tab_text_color,
                                   kDefaultTintFrameIncognito),
-            frame_color_incognito);
+            frame_color_incognito)
+            .color;
     color_map[ThemeProperties::COLOR_BACKGROUND_TAB_TEXT_INACTIVE] =
         background_tab_text_color_inactive;
     color_map[ThemeProperties::COLOR_BACKGROUND_TAB_TEXT_INCOGNITO_INACTIVE] =
-        color_utils::GetColorWithMinimumContrast(
+        color_utils::BlendForMinContrast(
             color_utils::HSLShift(background_tab_text_color_inactive,
                                   kDefaultTintFrameIncognito),
-            frame_color_incognito_inactive);
+            frame_color_incognito_inactive)
+            .color;
 
     // These colors represent the border drawn around tabs and between
     // the tabstrip and toolbar.
diff --git a/chrome/browser/ui/location_bar/location_bar.h b/chrome/browser/ui/location_bar/location_bar.h
index c4a0819..7217f7f 100644
--- a/chrome/browser/ui/location_bar/location_bar.h
+++ b/chrome/browser/ui/location_bar/location_bar.h
@@ -83,7 +83,7 @@
   // Returns a pointer to the testing interface.
   virtual LocationBarTesting* GetLocationBarForTesting() = 0;
 
-  Profile* profile() { return profile_; }
+  Profile* profile() const { return profile_; }
 
  protected:
   virtual ~LocationBar();
diff --git a/chrome/browser/ui/send_tab_to_self/send_tab_to_self_bubble_controller.cc b/chrome/browser/ui/send_tab_to_self/send_tab_to_self_bubble_controller.cc
index 2b4a2085..e4f68854 100644
--- a/chrome/browser/ui/send_tab_to_self/send_tab_to_self_bubble_controller.cc
+++ b/chrome/browser/ui/send_tab_to_self/send_tab_to_self_bubble_controller.cc
@@ -72,10 +72,10 @@
 }
 
 void SendTabToSelfBubbleController::OnDeviceSelected(
-    std::string target_device_id) {
-  // TODO(crbug/959698): send current tab to target device; close the bubble
-  // and hide the icon.
-  NOTIMPLEMENTED();
+    const std::string& target_device_name,
+    const std::string& target_device_guid) {
+  CreateNewEntry(web_contents_, target_device_name, target_device_guid);
+  // TODO(crbug/956189): update the omnibox icon; hide it.
 }
 
 void SendTabToSelfBubbleController::OnBubbleClosed() {
diff --git a/chrome/browser/ui/send_tab_to_self/send_tab_to_self_bubble_controller.h b/chrome/browser/ui/send_tab_to_self/send_tab_to_self_bubble_controller.h
index 96df435..755f1f8 100644
--- a/chrome/browser/ui/send_tab_to_self/send_tab_to_self_bubble_controller.h
+++ b/chrome/browser/ui/send_tab_to_self/send_tab_to_self_bubble_controller.h
@@ -46,7 +46,8 @@
 
   // Handles the action when the user click on one valid device. Sends tab to
   // the target device; closes the button and hides the omnibox icon.
-  void OnDeviceSelected(std::string target_device_id);
+  void OnDeviceSelected(const std::string& target_device_name,
+                        const std::string& target_device_guid);
   // Close the bubble when the user click on the close button.
   void OnBubbleClosed();
 
diff --git a/chrome/browser/ui/startup/credential_provider_signin_dialog_win_browsertest.cc b/chrome/browser/ui/startup/credential_provider_signin_dialog_win_browsertest.cc
index 694f88e..2f8564bbe 100644
--- a/chrome/browser/ui/startup/credential_provider_signin_dialog_win_browsertest.cc
+++ b/chrome/browser/ui/startup/credential_provider_signin_dialog_win_browsertest.cc
@@ -424,7 +424,8 @@
 IN_PROC_BROWSER_TEST_F(CredentialProviderSigninDialogWinIntegrationTest,
                        ShowDialogOnlyTest) {
   WaitForDialogToLoad();
-  EXPECT_TRUE(((Profile*)(web_contents_->GetBrowserContext()))->IsIncognito());
+  EXPECT_TRUE(
+      ((Profile*)(web_contents_->GetBrowserContext()))->IsIncognitoProfile());
   views::Widget::Widgets all_widgets = views::test::WidgetTest::GetAllWidgets();
   (*all_widgets.begin())->Close();
   RunUntilBrowserProcessQuits();
diff --git a/chrome/browser/ui/startup/startup_browser_creator_impl.cc b/chrome/browser/ui/startup/startup_browser_creator_impl.cc
index efe2e09..f5b9e87f 100644
--- a/chrome/browser/ui/startup/startup_browser_creator_impl.cc
+++ b/chrome/browser/ui/startup/startup_browser_creator_impl.cc
@@ -356,7 +356,7 @@
   // If being started for credential provider logon purpose, only show the
   // signin page.
   if (command_line_.HasSwitch(credential_provider::kGcpwSigninSwitch)) {
-    DCHECK(profile_->IsIncognito());
+    DCHECK(profile_->IsIncognitoProfile());
     // NOTE: All launch urls are ignored when running with --gcpw-logon since
     // this mode only loads Google's sign in page.
     StartGCPWSignin(command_line_, profile_);
diff --git a/chrome/browser/ui/tab_ui_helper.cc b/chrome/browser/ui/tab_ui_helper.cc
index fb91e1a..2d912ca 100644
--- a/chrome/browser/ui/tab_ui_helper.cc
+++ b/chrome/browser/ui/tab_ui_helper.cc
@@ -106,7 +106,7 @@
 
 void TabUIHelper::FetchFaviconFromHistory(
     const GURL& url,
-    const favicon_base::FaviconImageCallback& callback) {
+    favicon_base::FaviconImageCallback callback) {
   Profile* profile =
       Profile::FromBrowserContext(web_contents()->GetBrowserContext());
   favicon::FaviconService* favicon_service =
@@ -114,7 +114,7 @@
                                            ServiceAccessType::EXPLICIT_ACCESS);
   // |favicon_service| might be null when testing.
   if (favicon_service) {
-    favicon_service->GetFaviconImageForPageURL(url, callback,
+    favicon_service->GetFaviconImageForPageURL(url, std::move(callback),
                                                &favicon_tracker_);
   }
 }
diff --git a/chrome/browser/ui/tab_ui_helper.h b/chrome/browser/ui/tab_ui_helper.h
index 0c16790..6093dedc 100644
--- a/chrome/browser/ui/tab_ui_helper.h
+++ b/chrome/browser/ui/tab_ui_helper.h
@@ -66,9 +66,8 @@
   // new tab is opened in the background and its initial navigation is delayed.
   bool ShouldUseFaviconFromHistory() const;
 
-  void FetchFaviconFromHistory(
-      const GURL& url,
-      const favicon_base::FaviconImageCallback& callback);
+  void FetchFaviconFromHistory(const GURL& url,
+                               favicon_base::FaviconImageCallback callback);
   void OnURLFaviconFetched(const favicon_base::FaviconImageResult& favicon);
   void OnHostFaviconFetched(const favicon_base::FaviconImageResult& favicon);
   void UpdateFavicon(const favicon_base::FaviconImageResult& favicon);
diff --git a/chrome/browser/ui/toolbar/recent_tabs_sub_menu_model.cc b/chrome/browser/ui/toolbar/recent_tabs_sub_menu_model.cc
index 19b2d5a0..22dd672 100644
--- a/chrome/browser/ui/toolbar/recent_tabs_sub_menu_model.cc
+++ b/chrome/browser/ui/toolbar/recent_tabs_sub_menu_model.cc
@@ -136,8 +136,7 @@
     sync_sessions::SessionSyncService* session_sync_service,
     const GURL& page_url,
     scoped_refptr<base::RefCountedMemory>* sync_bitmap) {
-  if (!session_sync_service)
-    return false;
+  DCHECK(session_sync_service);
   sync_sessions::OpenTabsUIDelegate* open_tabs =
       session_sync_service->GetOpenTabsUIDelegate();
   return open_tabs &&
@@ -651,9 +650,8 @@
 
 sync_sessions::OpenTabsUIDelegate*
 RecentTabsSubMenuModel::GetOpenTabsUIDelegate() {
-  // Only return the delegate if it exists and it is done syncing sessions.
-  return session_sync_service_ ? session_sync_service_->GetOpenTabsUIDelegate()
-                               : nullptr;
+  DCHECK(session_sync_service_);
+  return session_sync_service_->GetOpenTabsUIDelegate();
 }
 
 void RecentTabsSubMenuModel::TabRestoreServiceChanged(
diff --git a/chrome/browser/ui/views/bookmarks/bookmark_bar_view.cc b/chrome/browser/ui/views/bookmarks/bookmark_bar_view.cc
index ce99958b..93fd77e 100644
--- a/chrome/browser/ui/views/bookmarks/bookmark_bar_view.cc
+++ b/chrome/browser/ui/views/bookmarks/bookmark_bar_view.cc
@@ -2028,7 +2028,8 @@
 
 SkColor BookmarkBarView::GetBookmarkBarTextColor() {
   const ui::ThemeProvider* theme_provider = GetThemeProvider();
-  return color_utils::GetColorWithMinimumContrast(
-      theme_provider->GetColor(ThemeProperties::COLOR_BOOKMARK_TEXT),
-      theme_provider->GetColor(ThemeProperties::COLOR_TOOLBAR));
+  return color_utils::BlendForMinContrast(
+             theme_provider->GetColor(ThemeProperties::COLOR_BOOKMARK_TEXT),
+             theme_provider->GetColor(ThemeProperties::COLOR_TOOLBAR))
+      .color;
 }
diff --git a/chrome/browser/ui/views/chrome_browser_main_extra_parts_views_linux.cc b/chrome/browser/ui/views/chrome_browser_main_extra_parts_views_linux.cc
index d6d98105..07f06ac6 100644
--- a/chrome/browser/ui/views/chrome_browser_main_extra_parts_views_linux.cc
+++ b/chrome/browser/ui/views/chrome_browser_main_extra_parts_views_linux.cc
@@ -45,7 +45,7 @@
 
   // Use a dark theme for incognito browser windows that aren't
   // custom-themed. Otherwise, normal Aura theme.
-  if (profile->IsIncognito() &&
+  if (profile->IsIncognitoProfile() &&
       ThemeServiceFactory::GetForProfile(profile)->UsingDefaultTheme() &&
       BrowserView::GetBrowserViewForNativeWindow(window)) {
     return ui::NativeThemeDarkAura::instance();
diff --git a/chrome/browser/ui/views/find_bar_view.cc b/chrome/browser/ui/views/find_bar_view.cc
index 201a74a..7d80c6c 100644
--- a/chrome/browser/ui/views/find_bar_view.cc
+++ b/chrome/browser/ui/views/find_bar_view.cc
@@ -357,7 +357,10 @@
 void FindBarView::AddedToWidget() {
   // Since the find bar now works/looks like a location bar bubble, make sure it
   // doesn't get dark themed in incognito mode.
-  if (find_bar_host_->browser_view()->browser()->profile()->IsIncognito())
+  if (find_bar_host_->browser_view()
+          ->browser()
+          ->profile()
+          ->IsIncognitoProfile())
     SetNativeTheme(ui::NativeTheme::GetInstanceForNativeUi());
 }
 
diff --git a/chrome/browser/ui/views/frame/browser_frame.cc b/chrome/browser/ui/views/frame/browser_frame.cc
index 6213829..ac3f9100 100644
--- a/chrome/browser/ui/views/frame/browser_frame.cc
+++ b/chrome/browser/ui/views/frame/browser_frame.cc
@@ -216,7 +216,7 @@
 
 const ui::NativeTheme* BrowserFrame::GetNativeTheme() const {
 #if defined(OS_WIN) || defined(OS_MACOSX) || defined(OS_CHROMEOS)
-  if (browser_view_->browser()->profile()->IsIncognito() &&
+  if (browser_view_->browser()->profile()->IsIncognitoProfile() &&
       ThemeServiceFactory::GetForProfile(browser_view_->browser()->profile())
           ->UsingDefaultTheme()) {
     return ui::NativeThemeDarkAura::instance();
diff --git a/chrome/browser/ui/views/frame/browser_non_client_frame_view_ash.cc b/chrome/browser/ui/views/frame/browser_non_client_frame_view_ash.cc
index a1f0bcdf..88288a6 100644
--- a/chrome/browser/ui/views/frame/browser_non_client_frame_view_ash.cc
+++ b/chrome/browser/ui/views/frame/browser_non_client_frame_view_ash.cc
@@ -733,7 +733,7 @@
   // between multi-user sessions. Note that you can't teleport an incognito
   // window.
   Browser* browser = browser_view()->browser();
-  if (browser->profile()->IsIncognito())
+  if (browser->profile()->IsIncognitoProfile())
     return false;
 
   if (!browser->is_type_tabbed() && !browser->is_app())
diff --git a/chrome/browser/ui/views/frame/browser_view.cc b/chrome/browser/ui/views/frame/browser_view.cc
index 25bbe8dc..252a06c 100644
--- a/chrome/browser/ui/views/frame/browser_view.cc
+++ b/chrome/browser/ui/views/frame/browser_view.cc
@@ -574,7 +574,7 @@
 }
 
 bool BrowserView::IsIncognito() const {
-  return browser_->profile()->IsIncognito();
+  return browser_->profile()->IsIncognitoProfile();
 }
 
 bool BrowserView::IsGuestSession() const {
diff --git a/chrome/browser/ui/views/location_bar/keyword_hint_view.cc b/chrome/browser/ui/views/location_bar/keyword_hint_view.cc
index d1029f4d..44c174e 100644
--- a/chrome/browser/ui/views/location_bar/keyword_hint_view.cc
+++ b/chrome/browser/ui/views/location_bar/keyword_hint_view.cc
@@ -34,7 +34,7 @@
       chip_container_(new views::View()),
       chip_label_(
           new views::Label(base::string16(), CONTEXT_OMNIBOX_DECORATION)) {
-  OmniboxTint tint = parent->GetTint();
+  OmniboxTint tint = parent->CalculateTint();
   const SkColor leading_label_text_color =
       GetOmniboxColor(OmniboxPart::LOCATION_BAR_TEXT_DEFAULT, tint);
   const SkColor background_color =
@@ -205,7 +205,7 @@
 }
 
 void KeywordHintView::OnThemeChanged() {
-  OmniboxTint tint = location_bar_view_->GetTint();
+  OmniboxTint tint = location_bar_view_->CalculateTint();
   const SkColor leading_label_text_color =
       GetOmniboxColor(OmniboxPart::LOCATION_BAR_TEXT_DEFAULT, tint);
   const SkColor background_color =
diff --git a/chrome/browser/ui/views/location_bar/location_bar_view.cc b/chrome/browser/ui/views/location_bar/location_bar_view.cc
index 9e8443f..1a0168f 100644
--- a/chrome/browser/ui/views/location_bar/location_bar_view.cc
+++ b/chrome/browser/ui/views/location_bar/location_bar_view.cc
@@ -145,8 +145,7 @@
       ChromeOmniboxEditController(command_updater),
       browser_(browser),
       delegate_(delegate),
-      is_popup_mode_(is_popup_mode),
-      tint_(GetTint()) {
+      is_popup_mode_(is_popup_mode) {
   edit_bookmarks_enabled_.Init(
       bookmarks::prefs::kEditBookmarksEnabled, profile->GetPrefs(),
       base::Bind(&LocationBarView::UpdateWithoutTabRestore,
@@ -289,7 +288,7 @@
 }
 
 SkColor LocationBarView::GetColor(OmniboxPart part) const {
-  return GetOmniboxColor(part, tint());
+  return GetOmniboxColor(part, CalculateTint());
 }
 
 SkColor LocationBarView::GetOpaqueBorderColor(bool incognito) const {
@@ -625,8 +624,6 @@
   if (!IsInitialized())
     return;
 
-  tint_ = GetTint();
-
   SkColor icon_color = GetColor(OmniboxPart::RESULTS_ICON);
   omnibox_page_action_icon_container_view_->SetIconColor(icon_color);
   for (PageActionIconView* icon_view : page_action_icons_)
@@ -813,10 +810,11 @@
   if (omnibox_view_->model()->is_caret_visible()) {
     background_color = border_color = GetColor(OmniboxPart::RESULTS_BACKGROUND);
   } else {
-    const SkColor normal = GetOmniboxColor(OmniboxPart::LOCATION_BAR_BACKGROUND,
-                                           tint(), OmniboxPartState::NORMAL);
+    const SkColor normal =
+        GetOmniboxColor(OmniboxPart::LOCATION_BAR_BACKGROUND, CalculateTint(),
+                        OmniboxPartState::NORMAL);
     const SkColor hovered =
-        GetOmniboxColor(OmniboxPart::LOCATION_BAR_BACKGROUND, tint(),
+        GetOmniboxColor(OmniboxPart::LOCATION_BAR_BACKGROUND, CalculateTint(),
                         OmniboxPartState::HOVERED);
     const double opacity = hover_animation_.GetCurrentValue();
     background_color = gfx::Tween::ColorValueBetween(opacity, normal, hovered);
@@ -1203,12 +1201,15 @@
   }
 }
 
-OmniboxTint LocationBarView::GetTint() {
+OmniboxTint LocationBarView::CalculateTint() const {
   ThemeService* theme_service = ThemeServiceFactory::GetForProfile(profile());
-  bool is_dark_mode = GetNativeTheme()->SystemDarkModeEnabled();
   if (theme_service->UsingDefaultTheme()) {
-    return (profile()->IsIncognito() || is_dark_mode) ? OmniboxTint::DARK
-                                                      : OmniboxTint::LIGHT;
+    if (profile()->IsIncognitoProfile() ||
+        GetNativeTheme()->SystemDarkModeEnabled()) {
+      return OmniboxTint::DARK;
+    }
+
+    return OmniboxTint::LIGHT;
   }
 
   // Check for GTK on Desktop Linux.
@@ -1216,7 +1217,8 @@
       theme_service->UsingSystemTheme())
     return OmniboxTint::NATIVE;
 
-  return is_dark_mode ? OmniboxTint::DARK : OmniboxTint::LIGHT;
+  return GetNativeTheme()->SystemDarkModeEnabled() ? OmniboxTint::DARK
+                                                   : OmniboxTint::LIGHT;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -1273,7 +1275,7 @@
 
 SkColor LocationBarView::GetSecurityChipColor(
     security_state::SecurityLevel security_level) const {
-  return GetOmniboxSecurityChipColor(tint(), security_level);
+  return GetOmniboxSecurityChipColor(CalculateTint(), security_level);
 }
 
 bool LocationBarView::ShowPageInfoDialog() {
diff --git a/chrome/browser/ui/views/location_bar/location_bar_view.h b/chrome/browser/ui/views/location_bar/location_bar_view.h
index 3d1c5c3..88f6f0c 100644
--- a/chrome/browser/ui/views/location_bar/location_bar_view.h
+++ b/chrome/browser/ui/views/location_bar/location_bar_view.h
@@ -123,16 +123,13 @@
   // be called when the receiving instance is attached to a view container.
   bool IsInitialized() const;
 
-  // Helper to get the color for |part| using the current tint().
+  // Helper to get the color for |part| using the current CalculateTint().
   SkColor GetColor(OmniboxPart part) const;
 
   // Returns the location bar border color blended with the toolbar color.
   // It's guaranteed to be opaque.
   SkColor GetOpaqueBorderColor(bool incognito) const;
 
-  // Returns the cached theme color tint for the location bar and results.
-  OmniboxTint tint() const { return tint_; }
-
   // Returns a background that paints an (optionally stroked) rounded rect with
   // the given color.
   std::unique_ptr<views::Background> CreateRoundRectBackground(
@@ -261,7 +258,7 @@
   SkColor GetLocationIconInkDropColor() const override;
 
   // Gets the theme color tint for the location bar and results.
-  OmniboxTint GetTint();
+  OmniboxTint CalculateTint() const;
 
  private:
   FRIEND_TEST_ALL_PREFIXES(SecurityIndicatorTest, CheckIndicatorText);
@@ -439,9 +436,6 @@
   // bar is read-only.
   const bool is_popup_mode_;
 
-  // The theme tint. Updated based on the profile and theme settings.
-  OmniboxTint tint_;
-
   // Tracks this preference to determine whether bookmark editing is allowed.
   BooleanPrefMember edit_bookmarks_enabled_;
 
diff --git a/chrome/browser/ui/views/omnibox/omnibox_popup_contents_view.cc b/chrome/browser/ui/views/omnibox/omnibox_popup_contents_view.cc
index 5d22d9b..110147b 100644
--- a/chrome/browser/ui/views/omnibox/omnibox_popup_contents_view.cc
+++ b/chrome/browser/ui/views/omnibox/omnibox_popup_contents_view.cc
@@ -196,9 +196,10 @@
   return model_->GetMatchIcon(match, vector_icon_color);
 }
 
-OmniboxTint OmniboxPopupContentsView::GetTint() const {
+OmniboxTint OmniboxPopupContentsView::CalculateTint() const {
   // Use LIGHT in tests.
-  return location_bar_view_ ? location_bar_view_->tint() : OmniboxTint::LIGHT;
+  return location_bar_view_ ? location_bar_view_->CalculateTint()
+                            : OmniboxTint::LIGHT;
 }
 
 void OmniboxPopupContentsView::SetSelectedLine(size_t index) {
diff --git a/chrome/browser/ui/views/omnibox/omnibox_popup_contents_view.h b/chrome/browser/ui/views/omnibox/omnibox_popup_contents_view.h
index 66ca539e..9aefcda 100644
--- a/chrome/browser/ui/views/omnibox/omnibox_popup_contents_view.h
+++ b/chrome/browser/ui/views/omnibox/omnibox_popup_contents_view.h
@@ -47,7 +47,7 @@
                           SkColor vector_icon_color) const;
 
   // Returns the theme color tint (e.g. dark or light).
-  OmniboxTint GetTint() const;
+  OmniboxTint CalculateTint() const;
 
   // Sets the line specified by |index| as selected.
   virtual void SetSelectedLine(size_t index);
diff --git a/chrome/browser/ui/views/omnibox/omnibox_popup_contents_view_browsertest.cc b/chrome/browser/ui/views/omnibox/omnibox_popup_contents_view_browsertest.cc
index 010d090..7bd2f63 100644
--- a/chrome/browser/ui/views/omnibox/omnibox_popup_contents_view_browsertest.cc
+++ b/chrome/browser/ui/views/omnibox/omnibox_popup_contents_view_browsertest.cc
@@ -153,7 +153,7 @@
 
 // Integration test for omnibox popup theming. This is a browser test since it
 // relies on initialization done in chrome_browser_main_extra_parts_views_linux
-// propagating through correctly to OmniboxPopupContentsView::GetTint().
+// propagating through correctly to OmniboxPopupContentsView::CalculateTint().
 IN_PROC_BROWSER_TEST_F(OmniboxPopupContentsViewTest, ThemeIntegration) {
   // Sanity check the bot: ensure the profile is configured to use the system
   // theme. On Linux, the default depends on a whitelist using the result of
@@ -169,7 +169,7 @@
   // Unthemed, non-incognito always has a white background. Exceptions: Inverted
   // color themes on Windows and GTK (not tested here).
   EXPECT_EQ(SK_ColorWHITE, GetOmniboxColor(OmniboxPart::RESULTS_BACKGROUND,
-                                           popup_view()->GetTint()));
+                                           popup_view()->CalculateTint()));
 
   Browser* browser_under_test = browser();
 
@@ -181,7 +181,8 @@
             ->toolbar()
             ->location_bar();
     return GetOmniboxColor(OmniboxPart::RESULTS_BACKGROUND,
-                           location_bar->tint(), OmniboxPartState::SELECTED);
+                           location_bar->CalculateTint(),
+                           OmniboxPartState::SELECTED);
   };
 
   const SkColor selection_color_light =
diff --git a/chrome/browser/ui/views/omnibox/omnibox_result_view.cc b/chrome/browser/ui/views/omnibox/omnibox_result_view.cc
index 82435884..a938d7a 100644
--- a/chrome/browser/ui/views/omnibox/omnibox_result_view.cc
+++ b/chrome/browser/ui/views/omnibox/omnibox_result_view.cc
@@ -78,7 +78,7 @@
 OmniboxResultView::~OmniboxResultView() {}
 
 SkColor OmniboxResultView::GetColor(OmniboxPart part) const {
-  return GetOmniboxColor(part, GetTint(), GetThemeState());
+  return GetOmniboxColor(part, CalculateTint(), GetThemeState());
 }
 
 void OmniboxResultView::SetMatch(const AutocompleteMatch& match) {
@@ -231,8 +231,8 @@
   return is_hovered_ ? OmniboxPartState::HOVERED : OmniboxPartState::NORMAL;
 }
 
-OmniboxTint OmniboxResultView::GetTint() const {
-  return popup_contents_view_->GetTint();
+OmniboxTint OmniboxResultView::CalculateTint() const {
+  return popup_contents_view_->CalculateTint();
 }
 
 void OmniboxResultView::OnMatchIconUpdated() {
diff --git a/chrome/browser/ui/views/omnibox/omnibox_result_view.h b/chrome/browser/ui/views/omnibox/omnibox_result_view.h
index f7b27867..c5594b43d 100644
--- a/chrome/browser/ui/views/omnibox/omnibox_result_view.h
+++ b/chrome/browser/ui/views/omnibox/omnibox_result_view.h
@@ -69,7 +69,7 @@
   bool IsSelected() const;
 
   OmniboxPartState GetThemeState() const;
-  OmniboxTint GetTint() const;
+  OmniboxTint CalculateTint() const;
 
   // Notification that the match icon has changed and schedules a repaint.
   void OnMatchIconUpdated();
diff --git a/chrome/browser/ui/views/omnibox/omnibox_tab_switch_button.cc b/chrome/browser/ui/views/omnibox/omnibox_tab_switch_button.cc
index 2185deb..e6d2e360 100644
--- a/chrome/browser/ui/views/omnibox/omnibox_tab_switch_button.cc
+++ b/chrome/browser/ui/views/omnibox/omnibox_tab_switch_button.cc
@@ -182,16 +182,17 @@
 
 SkColor OmniboxTabSwitchButton::GetBackgroundColor() const {
   return GetOmniboxColor(OmniboxPart::RESULTS_BACKGROUND,
-                         result_view_->GetTint(),
+                         result_view_->CalculateTint(),
                          state() == STATE_HOVERED ? OmniboxPartState::HOVERED
                                                   : OmniboxPartState::NORMAL);
 }
 
 void OmniboxTabSwitchButton::SetPressed() {
-  SetBgColorOverride(color_utils::AlphaBlend(
-      GetOmniboxColor(OmniboxPart::RESULTS_BACKGROUND, result_view_->GetTint(),
-                      OmniboxPartState::SELECTED),
-      SK_ColorBLACK, 0.8f));
+  SetBgColorOverride(
+      color_utils::AlphaBlend(GetOmniboxColor(OmniboxPart::RESULTS_BACKGROUND,
+                                              result_view_->CalculateTint(),
+                                              OmniboxPartState::SELECTED),
+                              SK_ColorBLACK, 0.8f));
 }
 
 size_t OmniboxTabSwitchButton::CalculateGoalWidth(size_t parent_width,
diff --git a/chrome/browser/ui/views/omnibox/rounded_omnibox_results_frame.cc b/chrome/browser/ui/views/omnibox/rounded_omnibox_results_frame.cc
index 0aa5b25c..5fecfa9 100644
--- a/chrome/browser/ui/views/omnibox/rounded_omnibox_results_frame.cc
+++ b/chrome/browser/ui/views/omnibox/rounded_omnibox_results_frame.cc
@@ -129,7 +129,7 @@
   contents_host_->layer()->SetFillsBoundsOpaquely(false);
 
   // Use a solid background. Note this is clipped to get rounded corners.
-  const OmniboxTint tint = location_bar->tint();
+  const OmniboxTint tint = location_bar->CalculateTint();
   const SkColor background_color =
       GetOmniboxColor(OmniboxPart::RESULTS_BACKGROUND, tint);
   contents_host_->SetBackground(views::CreateSolidBackground(background_color));
diff --git a/chrome/browser/ui/views/profiles/avatar_toolbar_button.cc b/chrome/browser/ui/views/profiles/avatar_toolbar_button.cc
index f2cbede..778321d 100644
--- a/chrome/browser/ui/views/profiles/avatar_toolbar_button.cc
+++ b/chrome/browser/ui/views/profiles/avatar_toolbar_button.cc
@@ -251,7 +251,7 @@
 }
 
 bool AvatarToolbarButton::IsIncognito() const {
-  return profile_->IsIncognito();
+  return profile_->IsIncognitoProfile();
 }
 
 bool AvatarToolbarButton::IsIncognitoCounterActive() const {
diff --git a/chrome/browser/ui/views/profiles/incognito_menu_view.cc b/chrome/browser/ui/views/profiles/incognito_menu_view.cc
index 836349f..121afee 100644
--- a/chrome/browser/ui/views/profiles/incognito_menu_view.cc
+++ b/chrome/browser/ui/views/profiles/incognito_menu_view.cc
@@ -29,7 +29,7 @@
                                      gfx::NativeView parent_window,
                                      Browser* browser)
     : ProfileMenuViewBase(anchor_button, anchor_rect, parent_window, browser) {
-  DCHECK(browser->profile()->IsIncognito());
+  DCHECK(browser->profile()->IsIncognitoProfile());
   GetViewAccessibility().OverrideName(GetAccessibleWindowTitle());
 
   chrome::RecordDialogCreation(
diff --git a/chrome/browser/ui/views/profiles/profile_menu_view_base.cc b/chrome/browser/ui/views/profiles/profile_menu_view_base.cc
index b752bbb0..e17a827 100644
--- a/chrome/browser/ui/views/profiles/profile_menu_view_base.cc
+++ b/chrome/browser/ui/views/profiles/profile_menu_view_base.cc
@@ -76,7 +76,7 @@
   if (IsShowing())
     return;
 
-  DCHECK_EQ(browser->profile()->IsIncognito(),
+  DCHECK_EQ(browser->profile()->IsIncognitoProfile(),
             view_mode == profiles::BUBBLE_VIEW_MODE_INCOGNITO);
 
   ProfileMenuViewBase* bubble;
diff --git a/chrome/browser/ui/views/send_tab_to_self/send_tab_to_self_bubble_view_impl.cc b/chrome/browser/ui/views/send_tab_to_self/send_tab_to_self_bubble_view_impl.cc
index e07e753..0ce40b57 100644
--- a/chrome/browser/ui/views/send_tab_to_self/send_tab_to_self_bubble_view_impl.cc
+++ b/chrome/browser/ui/views/send_tab_to_self/send_tab_to_self_bubble_view_impl.cc
@@ -136,7 +136,9 @@
   }
   SendTabToSelfBubbleDeviceButton* device_button =
       device_buttons_.at(index).get();
-  controller_->OnDeviceSelected(device_button->device_guid());
+  controller_->OnDeviceSelected(device_button->device_name(),
+                                device_button->device_guid());
+  Hide();
 }
 
 void SendTabToSelfBubbleViewImpl::MaybeSizeToContents() {
diff --git a/chrome/browser/ui/views/tabs/tab_hover_card_bubble_view_browsertest.cc b/chrome/browser/ui/views/tabs/tab_hover_card_bubble_view_browsertest.cc
index 915b63d..b3d736a 100644
--- a/chrome/browser/ui/views/tabs/tab_hover_card_bubble_view_browsertest.cc
+++ b/chrome/browser/ui/views/tabs/tab_hover_card_bubble_view_browsertest.cc
@@ -16,6 +16,7 @@
 #include "chrome/browser/ui/views/tabs/tab_strip.h"
 #include "chrome/grit/generated_resources.h"
 #include "chrome/test/base/ui_test_utils.h"
+#include "ui/gfx/animation/animation_test_api.h"
 #include "ui/views/controls/label.h"
 #include "ui/views/widget/widget.h"
 #include "ui/views/widget/widget_observer.h"
@@ -75,7 +76,9 @@
 
 class TabHoverCardBubbleViewBrowserTest : public DialogBrowserTest {
  public:
-  TabHoverCardBubbleViewBrowserTest() {
+  TabHoverCardBubbleViewBrowserTest()
+      : animation_mode_reset_(gfx::AnimationTestApi::SetRichAnimationRenderMode(
+            gfx::Animation::RichAnimationRenderMode::FORCE_DISABLED)) {
     TabHoverCardBubbleView::disable_animations_for_testing_ = true;
   }
   ~TabHoverCardBubbleViewBrowserTest() override = default;
@@ -145,9 +148,12 @@
   }
 
  private:
-  DISALLOW_COPY_AND_ASSIGN(TabHoverCardBubbleViewBrowserTest);
+  std::unique_ptr<base::AutoReset<gfx::Animation::RichAnimationRenderMode>>
+      animation_mode_reset_;
 
   base::test::ScopedFeatureList scoped_feature_list_;
+
+  DISALLOW_COPY_AND_ASSIGN(TabHoverCardBubbleViewBrowserTest);
 };
 
 // Fails on win7 (dbg): http://crbug.com/932402.
diff --git a/chrome/browser/ui/views/tabs/tab_strip.cc b/chrome/browser/ui/views/tabs/tab_strip.cc
index 644c4d04..f02090a 100644
--- a/chrome/browser/ui/views/tabs/tab_strip.cc
+++ b/chrome/browser/ui/views/tabs/tab_strip.cc
@@ -1556,6 +1556,10 @@
 void TabStrip::UpdateHoverCard(Tab* tab, bool should_show) {
   if (!base::FeatureList::IsEnabled(features::kTabHoverCards))
     return;
+  // We don't want to show a hover card for a tab while it is animating.
+  if (bounds_animator_.IsAnimating(tab) && should_show) {
+    return;
+  }
 
   if (!hover_card_) {
     // There is nothing to be done if the hover card doesn't exist and we are
@@ -1717,8 +1721,8 @@
         color_utils::AlphaBlend(default_color, background_color, 0.75f);
   }
 
-  return color_utils::GetColorWithMinimumContrast(default_color,
-                                                  background_color);
+  return color_utils::BlendForMinContrast(default_color, background_color)
+      .color;
 }
 
 // Returns the accessible tab name for the tab.
@@ -2386,14 +2390,14 @@
     return;
 
   const SkColor inactive_bg = GetTabBackgroundColor(TAB_INACTIVE);
-  const auto get_alpha = [inactive_bg](SkColor target, float contrast) {
-    return color_utils::GetBlendValueWithMinimumContrast(inactive_bg, target,
-                                                         inactive_bg, contrast);
+  const auto get_blend = [inactive_bg](SkColor target, float contrast) {
+    return color_utils::BlendForMinContrast(inactive_bg, inactive_bg, target,
+                                            contrast);
   };
 
   const SkColor active_bg = GetTabBackgroundColor(TAB_ACTIVE);
-  const auto get_hover_opacity = [active_bg, &get_alpha](float contrast) {
-    return get_alpha(active_bg, contrast) / 255.0f;
+  const auto get_hover_opacity = [active_bg, &get_blend](float contrast) {
+    return get_blend(active_bg, contrast).alpha / 255.0f;
   };
 
   // The contrast ratio for the hover effect on standard-width tabs.
@@ -2414,9 +2418,7 @@
   const SkColor inactive_fg = GetTabForegroundColor(TAB_INACTIVE, inactive_bg);
   // The contrast ratio for the separator between inactive tabs.
   constexpr float kTabSeparatorContrast = 2.5f;
-  const SkAlpha separator_alpha = get_alpha(inactive_fg, kTabSeparatorContrast);
-  separator_color_ =
-      color_utils::AlphaBlend(inactive_fg, inactive_bg, separator_alpha);
+  separator_color_ = get_blend(inactive_fg, kTabSeparatorContrast).color;
 }
 
 void TabStrip::ResizeLayoutTabs() {
diff --git a/chrome/browser/ui/views/tabs/tab_style_views.cc b/chrome/browser/ui/views/tabs/tab_style_views.cc
index ef3ebc4..95bb3d37 100644
--- a/chrome/browser/ui/views/tabs/tab_style_views.cc
+++ b/chrome/browser/ui/views/tabs/tab_style_views.cc
@@ -400,20 +400,19 @@
 
   SkColor title_color = tab_->controller()->GetTabForegroundColor(
       expected_opacity > 0.5f ? TAB_ACTIVE : TAB_INACTIVE, bg_color);
-  title_color = color_utils::GetColorWithMinimumContrast(title_color, bg_color);
+  title_color = color_utils::BlendForMinContrast(title_color, bg_color).color;
 
   const SkColor base_hovered_color = theme_provider->GetColor(
       ThemeProperties::COLOR_TAB_CLOSE_BUTTON_BACKGROUND_HOVER);
   const SkColor base_pressed_color = theme_provider->GetColor(
       ThemeProperties::COLOR_TAB_CLOSE_BUTTON_BACKGROUND_PRESSED);
 
-  const auto get_color_for_contrast_ratio = [](SkColor fg_color,
-                                               SkColor bg_color,
-                                               float contrast_ratio) {
-    const SkAlpha blend_alpha = color_utils::GetBlendValueWithMinimumContrast(
-        bg_color, fg_color, bg_color, contrast_ratio);
-    return color_utils::AlphaBlend(fg_color, bg_color, blend_alpha);
-  };
+  const auto get_color_for_contrast_ratio =
+      [](SkColor fg_color, SkColor bg_color, float contrast_ratio) {
+        return color_utils::BlendForMinContrast(bg_color, bg_color, fg_color,
+                                                contrast_ratio)
+            .color;
+      };
 
   const SkColor generated_icon_color = get_color_for_contrast_ratio(
       title_color, bg_color,
@@ -425,11 +424,11 @@
       base_pressed_color, bg_color, kMinimumPressedContrastRatio);
 
   const SkColor generated_hovered_icon_color =
-      color_utils::GetColorWithMinimumContrast(title_color,
-                                               generated_hovered_color);
+      color_utils::BlendForMinContrast(title_color, generated_hovered_color)
+          .color;
   const SkColor generated_pressed_icon_color =
-      color_utils::GetColorWithMinimumContrast(title_color,
-                                               generated_pressed_color);
+      color_utils::BlendForMinContrast(title_color, generated_pressed_color)
+          .color;
 
   return {bg_color,
           title_color,
@@ -665,9 +664,9 @@
       // Tint with group color. With a dark scheme, the tint needs a higher
       // contrast to stand out effectively.
       const float target_contrast = color_utils::IsDark(color) ? 1.8f : 1.2f;
-      const SkAlpha blend_alpha = color_utils::GetBlendValueWithMinimumContrast(
-          color, group_color.value(), color, target_contrast);
-      color = color_utils::AlphaBlend(group_color.value(), color, blend_alpha);
+      color = color_utils::BlendForMinContrast(
+                  color, color, group_color.value(), target_contrast)
+                  .color;
     }
   }
 
diff --git a/chrome/browser/ui/views/toolbar/toolbar_button.cc b/chrome/browser/ui/views/toolbar/toolbar_button.cc
index f7df132..815f670 100644
--- a/chrome/browser/ui/views/toolbar/toolbar_button.cc
+++ b/chrome/browser/ui/views/toolbar/toolbar_button.cc
@@ -313,11 +313,10 @@
 
   // Add a fudge factor to the minimum contrast ratio since we'll actually be
   // blending with the adjusted color.
-  const SkAlpha blend_alpha = color_utils::GetBlendValueWithMinimumContrast(
-      contrasting_color, limit, base_color,
-      color_utils::kMinimumReadableContrastRatio * 1.05);
-
-  return color_utils::AlphaBlend(limit, contrasting_color, blend_alpha);
+  return color_utils::BlendForMinContrast(
+             contrasting_color, base_color, limit,
+             color_utils::kMinimumReadableContrastRatio * 1.05)
+      .color;
 }
 
 bool ToolbarButton::ShouldShowMenu() {
diff --git a/chrome/browser/ui/views/toolbar/toolbar_page_action_icon_container_view.cc b/chrome/browser/ui/views/toolbar/toolbar_page_action_icon_container_view.cc
index f84d9cd..da46d679 100644
--- a/chrome/browser/ui/views/toolbar/toolbar_page_action_icon_container_view.cc
+++ b/chrome/browser/ui/views/toolbar/toolbar_page_action_icon_container_view.cc
@@ -21,7 +21,7 @@
 ToolbarPageActionIconContainerView::ToolbarPageActionIconContainerView(
     Browser* browser)
     : ToolbarIconContainerView(
-          /*uses_highlight=*/!browser->profile()->IsIncognito()),
+          /*uses_highlight=*/!browser->profile()->IsIncognitoProfile()),
       browser_(browser) {
   manage_passwords_icon_views_ =
       new ManagePasswordsIconViews(browser->command_controller(), this);
diff --git a/chrome/browser/ui/webui/app_launcher_login_handler.cc b/chrome/browser/ui/webui/app_launcher_login_handler.cc
index 683392f..575ff1b6 100644
--- a/chrome/browser/ui/webui/app_launcher_login_handler.cc
+++ b/chrome/browser/ui/webui/app_launcher_login_handler.cc
@@ -18,12 +18,10 @@
 #include "chrome/browser/profiles/profile_attributes_entry.h"
 #include "chrome/browser/profiles/profile_attributes_storage.h"
 #include "chrome/browser/profiles/profile_manager.h"
-#include "chrome/browser/profiles/profile_metrics.h"
 #include "chrome/browser/signin/identity_manager_factory.h"
 #include "chrome/browser/signin/signin_promo_util.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_finder.h"
-#include "chrome/browser/ui/browser_window.h"
 #include "chrome/browser/ui/chrome_pages.h"
 #include "chrome/browser/ui/webui/profile_info_watcher.h"
 #include "chrome/common/pref_names.h"
@@ -33,10 +31,8 @@
 #include "components/prefs/pref_service.h"
 #include "components/signin/core/browser/signin_metrics.h"
 #include "components/signin/core/browser/signin_pref_names.h"
-#include "content/public/browser/host_zoom_map.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_ui.h"
-#include "content/public/common/page_zoom.h"
 #include "net/base/escape.h"
 #include "services/identity/public/cpp/identity_manager.h"
 #include "skia/ext/image_operations.h"
@@ -47,9 +43,6 @@
 #include "ui/gfx/image/image.h"
 #include "ui/gfx/skia_util.h"
 
-using content::OpenURLParams;
-using content::Referrer;
-
 namespace {
 
 SkBitmap GetGAIAPictureForNTP(const gfx::Image& image) {
@@ -101,15 +94,7 @@
       "showSyncLoginUI",
       base::BindRepeating(&AppLauncherLoginHandler::HandleShowSyncLoginUI,
                           base::Unretained(this)));
-  web_ui()->RegisterMessageCallback(
-      "showAdvancedLoginUI",
-      base::BindRepeating(&AppLauncherLoginHandler::HandleShowAdvancedLoginUI,
-                          base::Unretained(this)));
 #endif
-  web_ui()->RegisterMessageCallback(
-      "loginMessageSeen",
-      base::BindRepeating(&AppLauncherLoginHandler::HandleLoginMessageSeen,
-                          base::Unretained(this)));
 }
 
 void AppLauncherLoginHandler::HandleInitializeSyncLogin(
@@ -152,27 +137,6 @@
                             NTP_SIGN_IN_PROMO_BUCKET_BOUNDARY);
 }
 
-void AppLauncherLoginHandler::HandleLoginMessageSeen(
-    const base::ListValue* args) {
-  Profile::FromWebUI(web_ui())->GetPrefs()->SetBoolean(
-      prefs::kSignInPromoShowNTPBubble, false);
-}
-
-#if !defined(OS_CHROMEOS)
-void AppLauncherLoginHandler::HandleShowAdvancedLoginUI(
-    const base::ListValue* args) {
-  content::WebContents* web_contents = web_ui()->GetWebContents();
-  Browser* browser = chrome::FindBrowserWithWebContents(web_contents);
-  if (!browser)
-    return;
-  signin_metrics::AccessPoint access_point =
-      web_contents->GetURL().spec() == chrome::kChromeUIAppsURL
-          ? signin_metrics::AccessPoint::ACCESS_POINT_APPS_PAGE_LINK
-          : signin_metrics::AccessPoint::ACCESS_POINT_NTP_LINK;
-  chrome::ShowBrowserSignin(browser, access_point);
-}
-#endif
-
 void AppLauncherLoginHandler::UpdateLogin() {
   std::string username = profile_info_watcher_->GetAuthenticatedUsername();
   base::string16 header, sub_header;
@@ -248,24 +212,3 @@
   return !profile->IsOffTheRecord() && is_signin_allowed;
 #endif
 }
-
-// static
-void AppLauncherLoginHandler::GetLocalizedValues(
-    Profile* profile, base::DictionaryValue* values) {
-  PrefService* prefs = profile->GetPrefs();
-  bool hide_sync = !prefs->GetBoolean(prefs::kSignInPromoShowNTPBubble);
-
-  base::string16 message = hide_sync ? base::string16() :
-      l10n_util::GetStringFUTF16(IDS_SYNC_PROMO_NTP_BUBBLE_MESSAGE,
-          l10n_util::GetStringUTF16(IDS_SHORT_PRODUCT_NAME));
-
-  values->SetString("login_status_message", message);
-  values->SetString("login_status_url",
-      hide_sync ? std::string() : chrome::kSyncLearnMoreURL);
-  values->SetString("login_status_advanced",
-      hide_sync ? base::string16() :
-      l10n_util::GetStringUTF16(IDS_SYNC_PROMO_NTP_BUBBLE_ADVANCED));
-  values->SetString("login_status_dismiss",
-      hide_sync ? base::string16() :
-      l10n_util::GetStringUTF16(IDS_SYNC_PROMO_NTP_BUBBLE_OK));
-}
diff --git a/chrome/browser/ui/webui/app_launcher_login_handler.h b/chrome/browser/ui/webui/app_launcher_login_handler.h
index c5e723a..da07c05d6 100644
--- a/chrome/browser/ui/webui/app_launcher_login_handler.h
+++ b/chrome/browser/ui/webui/app_launcher_login_handler.h
@@ -14,10 +14,6 @@
 class Profile;
 class ProfileInfoWatcher;
 
-namespace base {
-class DictionaryValue;
-}
-
 // The login handler currently simply displays the current logged in
 // username at the top of the NTP (and update itself when that changes).
 // In the future it may expand to allow users to login from the NTP.
@@ -33,10 +29,6 @@
   // for the given |profile|. |profile| must not be NULL.
   static bool ShouldShow(Profile* profile);
 
-  // Registers values (strings etc.) for the page.
-  static void GetLocalizedValues(Profile* profile,
-                                 base::DictionaryValue* values);
-
  private:
   // User actions while on the NTP when clicking on or viewing the sync promo.
   enum NTPSignInPromoBuckets {
@@ -54,20 +46,11 @@
   // appropriate UI based on the current sync state. |args| is the list of
   // arguments passed from JS and should be an empty list.
   void HandleShowSyncLoginUI(const base::ListValue* args);
-
-  // Called from JS when the user clicks on the advanced link the sync promo NTP
-  // bubble. Use use this to navigate to the sync settings page. |args| is the
-  // list of arguments passed from JS and should be an empty list.
-  void HandleShowAdvancedLoginUI(const base::ListValue* args);
 #endif
 
   // Records actions in SyncPromo.NTPPromo histogram.
   void RecordInHistogram(NTPSignInPromoBuckets type);
 
-  // Called from JS when the sync promo NTP bubble has been displayed. |args| is
-  // the list of arguments passed from JS and should be an empty list.
-  void HandleLoginMessageSeen(const base::ListValue* args);
-
   // Internal helper method
   void UpdateLogin();
 
diff --git a/chrome/browser/ui/webui/autofill_internals_ui.cc b/chrome/browser/ui/webui/autofill_internals_ui.cc
index caaf654..ef2f3d3 100644
--- a/chrome/browser/ui/webui/autofill_internals_ui.cc
+++ b/chrome/browser/ui/webui/autofill_internals_ui.cc
@@ -54,5 +54,5 @@
   web_ui()->CallJavascriptFunctionUnsafe("setUpAutofillInternals");
   web_ui()->CallJavascriptFunctionUnsafe(
       "notifyAboutIncognito",
-      base::Value(Profile::FromWebUI(web_ui())->IsIncognito()));
+      base::Value(Profile::FromWebUI(web_ui())->IsIncognitoProfile()));
 }
diff --git a/chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc b/chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc
index d5baaad..3c7026d 100644
--- a/chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc
+++ b/chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc
@@ -715,15 +715,6 @@
   return NULL;
 }
 
-void RunFaviconCallbackAsync(
-    const favicon_base::FaviconResultsCallback& callback,
-    const std::vector<favicon_base::FaviconRawBitmapResult>* results) {
-  base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE,
-      base::BindOnce(&favicon::FaviconService::FaviconResultsCallbackRunner,
-                     callback, base::Owned(results)));
-}
-
 }  // namespace
 
 WebUI::TypeID ChromeWebUIControllerFactory::GetWebUIType(
@@ -762,7 +753,7 @@
     Profile* profile,
     const GURL& page_url,
     const std::vector<int>& desired_sizes_in_pixel,
-    const favicon_base::FaviconResultsCallback& callback) const {
+    favicon_base::FaviconResultsCallback callback) const {
   // Before determining whether page_url is an extension url, we must handle
   // overrides. This changes urls in |kChromeUIScheme| to extension urls, and
   // allows to use ExtensionWebUI::GetFaviconForURL.
@@ -772,13 +763,12 @@
 
   // All extensions get their favicon from the icons part of the manifest.
   if (url.SchemeIs(extensions::kExtensionScheme)) {
-    ExtensionWebUI::GetFaviconForURL(profile, url, callback);
+    ExtensionWebUI::GetFaviconForURL(profile, url, std::move(callback));
     return;
   }
 #endif
 
-  std::vector<favicon_base::FaviconRawBitmapResult>* favicon_bitmap_results =
-      new std::vector<favicon_base::FaviconRawBitmapResult>();
+  std::vector<favicon_base::FaviconRawBitmapResult> favicon_bitmap_results;
 
   // Use ui::GetSupportedScaleFactors instead of
   // favicon_base::GetFaviconScales() because chrome favicons comes from
@@ -812,11 +802,13 @@
       // Leave |bitmap_result|'s icon URL as the default of GURL().
       bitmap_result.icon_type = favicon_base::IconType::kFavicon;
       bitmap_result.pixel_size = candidate_sizes[selected_index];
-      favicon_bitmap_results->push_back(bitmap_result);
+      favicon_bitmap_results.push_back(bitmap_result);
     }
   }
 
-  RunFaviconCallbackAsync(callback, favicon_bitmap_results);
+  base::ThreadTaskRunnerHandle::Get()->PostTask(
+      FROM_HERE,
+      base::BindOnce(std::move(callback), std::move(favicon_bitmap_results)));
 }
 
 // static
diff --git a/chrome/browser/ui/webui/chrome_web_ui_controller_factory.h b/chrome/browser/ui/webui/chrome_web_ui_controller_factory.h
index 74a21403b..acf5989 100644
--- a/chrome/browser/ui/webui/chrome_web_ui_controller_factory.h
+++ b/chrome/browser/ui/webui/chrome_web_ui_controller_factory.h
@@ -49,11 +49,10 @@
 
   // Get the favicon for |page_url| and run |callback| with result when loaded.
   // Note. |callback| is always run asynchronously.
-  void GetFaviconForURL(
-      Profile* profile,
-      const GURL& page_url,
-      const std::vector<int>& desired_sizes_in_pixel,
-      const favicon_base::FaviconResultsCallback& callback) const;
+  void GetFaviconForURL(Profile* profile,
+                        const GURL& page_url,
+                        const std::vector<int>& desired_sizes_in_pixel,
+                        favicon_base::FaviconResultsCallback callback) const;
 
  protected:
   ChromeWebUIControllerFactory();
diff --git a/chrome/browser/ui/webui/extensions/extensions_internals_source.cc b/chrome/browser/ui/webui/extensions/extensions_internals_source.cc
index ce8548e..f7449ee 100644
--- a/chrome/browser/ui/webui/extensions/extensions_internals_source.cc
+++ b/chrome/browser/ui/webui/extensions/extensions_internals_source.cc
@@ -44,6 +44,8 @@
       return "TYPE_PLATFORM_APP";
     case extensions::Manifest::TYPE_SHARED_MODULE:
       return "TYPE_SHARED_MODULE";
+    case extensions::Manifest::TYPE_LOGIN_SCREEN_EXTENSION:
+      return "TYPE_LOGIN_SCREEN_EXTENSION";
     case extensions::Manifest::NUM_LOAD_TYPES:
       break;
   }
diff --git a/chrome/browser/ui/webui/favicon_source.cc b/chrome/browser/ui/webui/favicon_source.cc
index b63d5b82..01f6dda4 100644
--- a/chrome/browser/ui/webui/favicon_source.cc
+++ b/chrome/browser/ui/webui/favicon_source.cc
@@ -45,8 +45,7 @@
     scoped_refptr<base::RefCountedMemory>* sync_bitmap) {
   sync_sessions::SessionSyncService* session_sync_service =
       SessionSyncServiceFactory::GetInstance()->GetForProfile(profile);
-  if (!session_sync_service)
-    return false;
+  DCHECK(session_sync_service);
   sync_sessions::OpenTabsUIDelegate* open_tabs =
       session_sync_service->GetOpenTabsUIDelegate();
   return open_tabs &&
diff --git a/chrome/browser/ui/webui/ntp/ntp_resource_cache.cc b/chrome/browser/ui/webui/ntp/ntp_resource_cache.cc
index 285c5318..c5531d9c 100644
--- a/chrome/browser/ui/webui/ntp/ntp_resource_cache.cc
+++ b/chrome/browser/ui/webui/ntp/ntp_resource_cache.cc
@@ -150,8 +150,6 @@
   profile_pref_change_registrar_.Add(bookmarks::prefs::kShowBookmarkBar,
                                      callback);
   profile_pref_change_registrar_.Add(prefs::kNtpShownPage, callback);
-  profile_pref_change_registrar_.Add(prefs::kSignInPromoShowNTPBubble,
-                                     callback);
   profile_pref_change_registrar_.Add(prefs::kHideWebStoreIcon, callback);
 
   theme_observer_.Add(ui::NativeTheme::GetInstanceForNativeUi());
@@ -458,7 +456,6 @@
                             CanShowAppInfoDialog());
 
   AppLauncherHandler::GetLocalizedValues(profile_, &load_time_data);
-  AppLauncherLoginHandler::GetLocalizedValues(profile_, &load_time_data);
 
   webui::SetLoadTimeDataDefaults(app_locale, &load_time_data);
 
diff --git a/chrome/browser/ui/webui/settings/chrome_cleanup_handler.cc b/chrome/browser/ui/webui/settings/chrome_cleanup_handler_win.cc
similarity index 90%
rename from chrome/browser/ui/webui/settings/chrome_cleanup_handler.cc
rename to chrome/browser/ui/webui/settings/chrome_cleanup_handler_win.cc
index 8f06cb1..d7a9cd51 100644
--- a/chrome/browser/ui/webui/settings/chrome_cleanup_handler.cc
+++ b/chrome/browser/ui/webui/settings/chrome_cleanup_handler_win.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/ui/webui/settings/chrome_cleanup_handler.h"
+#include "chrome/browser/ui/webui/settings/chrome_cleanup_handler_win.h"
 
 #include <memory>
 #include <string>
@@ -15,20 +15,21 @@
 #include "base/metrics/user_metrics.h"
 #include "base/metrics/user_metrics_action.h"
 #include "base/strings/string16.h"
+#include "base/strings/utf_string_conversions.h"
 #include "base/synchronization/lock.h"
 #include "base/values.h"
 #include "build/build_config.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/profiles/profile.h"
-#include "chrome/browser/safe_browsing/chrome_cleaner/reporter_runner_win.h"
-#include "chrome/browser/safe_browsing/chrome_cleaner/srt_field_trial_win.h"
+#include "chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_controller_win.h"
 #include "chrome/grit/generated_resources.h"
 #include "components/component_updater/pref_names.h"
 #include "components/prefs/pref_service.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_ui.h"
 #include "content/public/browser/web_ui_message_handler.h"
+#include "extensions/browser/extension_registry.h"
 #include "extensions/browser/extension_system.h"
 #include "ui/base/l10n/l10n_util.h"
 
@@ -70,7 +71,8 @@
   value.SetList("registryKeys",
                 GetStringSetAsListStorage(scanner_results.registry_keys()));
   std::set<base::string16> extensions;
-  scanner_results.FetchExtensionNames(profile, &extensions);
+  ChromeCleanupHandler::GetExtensionNamesFromIds(
+      profile, scanner_results.extension_ids(), &extensions);
   value.SetList("extensions", GetStringSetAsListStorage(extensions));
   return value;
 }
@@ -112,6 +114,28 @@
   controller_->RemoveObserver(this);
 }
 
+// static
+void ChromeCleanupHandler::GetExtensionNamesFromIds(
+    Profile* profile,
+    const std::set<base::string16>& extension_ids,
+    std::set<base::string16>* extension_names) {
+#if defined(GOOGLE_CHROME_BUILD)
+  extensions::ExtensionRegistry* extension_registry =
+      extensions::ExtensionRegistry::Get(profile);
+  for (const base::string16& extension_id : extension_ids) {
+    const extensions::Extension* extension =
+        extension_registry->GetInstalledExtension(
+            base::UTF16ToUTF8(extension_id));
+    if (extension) {
+      extension_names->insert(base::UTF8ToUTF16(extension->name()));
+    } else {
+      extension_names->insert(l10n_util::GetStringFUTF16(
+          IDS_SETTINGS_RESET_CLEANUP_DETAILS_EXTENSION_UNKNOWN, extension_id));
+    }
+  }
+#endif
+}
+
 void ChromeCleanupHandler::RegisterMessages() {
   web_ui()->RegisterMessageCallback(
       "registerChromeCleanerObserver",
diff --git a/chrome/browser/ui/webui/settings/chrome_cleanup_handler.h b/chrome/browser/ui/webui/settings/chrome_cleanup_handler_win.h
similarity index 86%
rename from chrome/browser/ui/webui/settings/chrome_cleanup_handler.h
rename to chrome/browser/ui/webui/settings/chrome_cleanup_handler_win.h
index fffa41c1..5f966e8f 100644
--- a/chrome/browser/ui/webui/settings/chrome_cleanup_handler.h
+++ b/chrome/browser/ui/webui/settings/chrome_cleanup_handler_win.h
@@ -2,13 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CHROME_BROWSER_UI_WEBUI_SETTINGS_CHROME_CLEANUP_HANDLER_H_
-#define CHROME_BROWSER_UI_WEBUI_SETTINGS_CHROME_CLEANUP_HANDLER_H_
+#ifndef CHROME_BROWSER_UI_WEBUI_SETTINGS_CHROME_CLEANUP_HANDLER_WIN_H_
+#define CHROME_BROWSER_UI_WEBUI_SETTINGS_CHROME_CLEANUP_HANDLER_WIN_H_
 
 #include <set>
 
 #include "base/files/file_path.h"
 #include "base/macros.h"
+#include "base/strings/string16.h"
 #include "chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_controller_win.h"
 #include "chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_scanner_results_win.h"
 #include "chrome/browser/ui/webui/settings/settings_page_ui_handler.h"
@@ -16,6 +17,10 @@
 
 class Profile;
 
+namespace safe_browsing {
+class ChromeCleanerController;
+}
+
 namespace settings {
 
 // Chrome Cleanup settings page UI handler.
@@ -26,6 +31,15 @@
   explicit ChromeCleanupHandler(Profile* profile);
   ~ChromeCleanupHandler() override;
 
+  // Retrieves extension names for |extension_ids| from |profile|'s extension
+  // registry and adds them to |extension_names|. If a name cannot be found for
+  // an extension ID, instead adds a translated string stating the item is an
+  // unknown extension ID.
+  static void GetExtensionNamesFromIds(
+      Profile* profile,
+      const std::set<base::string16>& extension_ids,
+      std::set<base::string16>* extension_names);
+
   // SettingsPageUIHandler implementation.
   void RegisterMessages() override;
   void OnJavascriptAllowed() override;
@@ -90,4 +104,4 @@
 
 }  // namespace settings
 
-#endif  // CHROME_BROWSER_UI_WEBUI_SETTINGS_CHROME_CLEANUP_HANDLER_H_
+#endif  // CHROME_BROWSER_UI_WEBUI_SETTINGS_CHROME_CLEANUP_HANDLER_WIN_H_
diff --git a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_extension_util_win_unittest.cc b/chrome/browser/ui/webui/settings/chrome_cleanup_handler_win_unittest.cc
similarity index 62%
rename from chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_extension_util_win_unittest.cc
rename to chrome/browser/ui/webui/settings/chrome_cleanup_handler_win_unittest.cc
index 9697bc9..a9fb0bb 100644
--- a/chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_extension_util_win_unittest.cc
+++ b/chrome/browser/ui/webui/settings/chrome_cleanup_handler_win_unittest.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_extension_util_win.h"
+#include "chrome/browser/ui/webui/settings/chrome_cleanup_handler_win.h"
 
 #include "chrome/browser/safe_browsing/chrome_cleaner/mock_chrome_cleaner_process_win.h"
 #include "chrome/grit/generated_resources.h"
@@ -14,14 +14,15 @@
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/base/l10n/l10n_util.h"
 
-namespace safe_browsing {
+namespace settings {
 
-TEST(ChromeCleanerExtensionUtilTest, GetExtensionNamesFromIds) {
+using safe_browsing::MockChromeCleanerProcess;
+
+TEST(ChromeCleanupHandlerTest, GetExtensionsNamesFromIds) {
   content::TestBrowserThreadBundle test_browser_thread_bundle_;
   TestingProfileManager profile_manager_(TestingBrowserProcess::GetGlobal());
 
-  // Set up the testing profile, so chrome_cleaner_win_util can get the
-  // extensions registry from it.
+  // Set up the testing profile to get the extensions registry from it.
   ASSERT_TRUE(profile_manager_.SetUp());
   TestingProfile* testing_profile_ =
       profile_manager_.CreateTestingProfile("DummyProfile");
@@ -34,16 +35,21 @@
   };
 
   std::set<base::string16> expected_names = {
-      MockChromeCleanerProcess::kInstalledExtensionName1,
-      MockChromeCleanerProcess::kInstalledExtensionName2,
-      l10n_util::GetStringFUTF16(
-          IDS_SETTINGS_RESET_CLEANUP_DETAILS_EXTENSION_UNKNOWN,
-          MockChromeCleanerProcess::kUnknownExtensionId),
+#if defined(GOOGLE_CHROME_BUILD)
+    // Extension names are only available in Google-branded builds.
+    MockChromeCleanerProcess::kInstalledExtensionName1,
+    MockChromeCleanerProcess::kInstalledExtensionName2,
+    l10n_util::GetStringFUTF16(
+        IDS_SETTINGS_RESET_CLEANUP_DETAILS_EXTENSION_UNKNOWN,
+        MockChromeCleanerProcess::kUnknownExtensionId),
+#endif
   };
 
   std::set<base::string16> actual_names;
-  GetExtensionNamesFromIds(testing_profile_, test_ids, &actual_names);
+  ChromeCleanupHandler::GetExtensionNamesFromIds(testing_profile_, test_ids,
+                                                 &actual_names);
+
   EXPECT_THAT(actual_names, testing::ContainerEq(expected_names));
 }
 
-}  // namespace safe_browsing
+}  // namespace settings
diff --git a/chrome/browser/ui/webui/settings/chromeos/kerberos_accounts_handler.cc b/chrome/browser/ui/webui/settings/chromeos/kerberos_accounts_handler.cc
index de13b59..16074ee8 100644
--- a/chrome/browser/ui/webui/settings/chromeos/kerberos_accounts_handler.cc
+++ b/chrome/browser/ui/webui/settings/chromeos/kerberos_accounts_handler.cc
@@ -44,11 +44,6 @@
       base::BindRepeating(&KerberosAccountsHandler::HandleAddKerberosAccount,
                           weak_factory_.GetWeakPtr()));
   web_ui()->RegisterMessageCallback(
-      "reauthenticateKerberosAccount",
-      base::BindRepeating(
-          &KerberosAccountsHandler::HandleReauthenticateKerberosAccount,
-          weak_factory_.GetWeakPtr()));
-  web_ui()->RegisterMessageCallback(
       "removeKerberosAccount",
       base::BindRepeating(&KerberosAccountsHandler::HandleRemoveKerberosAccount,
                           weak_factory_.GetWeakPtr()));
@@ -100,23 +95,28 @@
   //   - Prevent account changes when Kerberos is disabled.
   //   - Remove all accounts when Kerberos is disabled.
 
-  // TODO(ljusten): Call KerberosAddAccountDialog::Show() instead when that's
-  // implemented.
+  CHECK_EQ(3U, args->GetSize());
 
-  static int count = 0;
+  std::string callback_id;
+  CHECK(args->GetString(0, &callback_id));
+
+  std::string principal_name;
+  CHECK(args->GetString(1, &principal_name));
+
+  std::string password;
+  CHECK(args->GetString(2, &password));
+
   KerberosCredentialsManager::Get().AddAccountAndAuthenticate(
-      base::StringPrintf("user%i@realm", ++count), "password",
-      EmptyResultCallback());
+      std::move(principal_name), password,
+      base::BindOnce(&KerberosAccountsHandler::OnAddAccountAndAuthenticate,
+                     weak_factory_.GetWeakPtr(), callback_id));
 }
 
-void KerberosAccountsHandler::HandleReauthenticateKerberosAccount(
-    const base::ListValue* args) {
-  AllowJavascript();
-
-  CHECK(!args->GetList().empty());
-
-  // TODO(ljusten): Add KerberosAddAccountDialog::Show(principal_name) when
-  // that's implemented.
+void KerberosAccountsHandler::OnAddAccountAndAuthenticate(
+    const std::string& callback_id,
+    kerberos::ErrorType error) {
+  ResolveJavascriptCallback(base::Value(callback_id),
+                            base::Value(static_cast<int>(error)));
 }
 
 void KerberosAccountsHandler::HandleRemoveKerberosAccount(
diff --git a/chrome/browser/ui/webui/settings/chromeos/kerberos_accounts_handler.h b/chrome/browser/ui/webui/settings/chromeos/kerberos_accounts_handler.h
index 16316ac..c15457f 100644
--- a/chrome/browser/ui/webui/settings/chromeos/kerberos_accounts_handler.h
+++ b/chrome/browser/ui/webui/settings/chromeos/kerberos_accounts_handler.h
@@ -44,13 +44,14 @@
   // WebUI "addKerberosAccount" message callback.
   void HandleAddKerberosAccount(const base::ListValue* args);
 
-  // WebUI "reauthenticateKerberosAccount" message callback.
-  void HandleReauthenticateKerberosAccount(const base::ListValue* args);
+  // Callback for the credential manager's AddAccountAndAuthenticate method.
+  void OnAddAccountAndAuthenticate(const std::string& callback_id,
+                                   kerberos::ErrorType error);
 
   // WebUI "removeKerberosAccount" message callback.
   void HandleRemoveKerberosAccount(const base::ListValue* args);
 
-  // Callback for the Kerberos daemon's ListAccounts D-Bus method.
+  // Callback for the credential manager's ListAccounts method.
   void OnListAccounts(base::Value callback_id,
                       const kerberos::ListAccountsResponse& response);
 
diff --git a/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc b/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
index 387fac0..179d032 100644
--- a/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
+++ b/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
@@ -1699,6 +1699,11 @@
     {"kerberosAccountsSignedOut", IDS_SETTINGS_KERBEROS_ACCOUNTS_SIGNED_OUT},
     {"kerberosAccountsReauthenticationLabel",
      IDS_SETTINGS_KERBEROS_ACCOUNTS_REAUTHENTICATION_LABEL},
+    {"addKerberosAccount", IDS_SETTINGS_ADD_KERBEROS_ACCOUNT},
+    {"kerberosUsername", IDS_SETTINGS_KERBEROS_USERNAME},
+    {"kerberosPassword", IDS_SETTINGS_KERBEROS_PASSWORD},
+    {"kerberosGeneralErrorMessage",
+     IDS_SETTINGS_KERBEROS_GENERAL_ERROR_MESSAGE},
     {"lockScreenAddFingerprint",
      IDS_SETTINGS_PEOPLE_LOCK_SCREEN_ADD_FINGERPRINT_BUTTON},
     {"lockScreenChangePinButton",
diff --git a/chrome/browser/ui/webui/settings/settings_ui.cc b/chrome/browser/ui/webui/settings/settings_ui.cc
index fbee7b1..aac3336 100644
--- a/chrome/browser/ui/webui/settings/settings_ui.cc
+++ b/chrome/browser/ui/webui/settings/settings_ui.cc
@@ -62,7 +62,7 @@
 #if defined(OS_WIN)
 #include "chrome/browser/safe_browsing/chrome_cleaner/chrome_cleaner_controller_win.h"
 #include "chrome/browser/safe_browsing/chrome_cleaner/srt_field_trial_win.h"
-#include "chrome/browser/ui/webui/settings/chrome_cleanup_handler.h"
+#include "chrome/browser/ui/webui/settings/chrome_cleanup_handler_win.h"
 #if defined(GOOGLE_CHROME_BUILD)
 #include "chrome/browser/ui/webui/settings/incompatible_applications_handler_win.h"
 #include "chrome/browser/win/conflicts/incompatible_applications_updater.h"
diff --git a/chrome/browser/vr/BUILD.gn b/chrome/browser/vr/BUILD.gn
index d133f58d..52312a7 100644
--- a/chrome/browser/vr/BUILD.gn
+++ b/chrome/browser/vr/BUILD.gn
@@ -3,6 +3,7 @@
 # found in the LICENSE file.
 
 import("//build/buildflag_header.gni")
+import("//chrome/android/features/dynamic_feature_modules.gni")
 import("//chrome/browser/vr/features.gni")
 import("//chrome/common/features.gni")
 import("//device/vr/buildflags/buildflags.gni")
@@ -193,6 +194,12 @@
     "//skia",
   ]
 
+  if (use_native_modules && modularize_vr_native) {
+    # Mark symbols in this library as belonging to the VR partition. Only
+    # exported symbols (module entrypoints) are affected.
+    cflags = [ "-fsymbol-partition=libvr.so" ]
+  }
+
   defines = [ "VR_UI_IMPLEMENTATION" ]
 
   if (use_command_buffer) {
diff --git a/chrome/browser/vr/module_exports.lst b/chrome/browser/vr/module_exports.lst
new file mode 100644
index 0000000..22df3725
--- /dev/null
+++ b/chrome/browser/vr/module_exports.lst
@@ -0,0 +1,8 @@
+# Copyright 2019 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# This file lists the entrypoints to be exposed from the VR native feature
+# library.
+
+CreateUi
diff --git a/chrome/browser/vr/webxr_vr_consent_dialog_browser_test.cc b/chrome/browser/vr/webxr_vr_consent_dialog_browser_test.cc
index 91cf129..c8c1783 100644
--- a/chrome/browser/vr/webxr_vr_consent_dialog_browser_test.cc
+++ b/chrome/browser/vr/webxr_vr_consent_dialog_browser_test.cc
@@ -32,6 +32,9 @@
 WebXrVrConsentDialogBrowserTest::WebXrVrConsentDialogBrowserTest() {
   enable_features_.push_back(features::kOpenVR);
   enable_features_.push_back(features::kWebXr);
+#if BUILDFLAG(ENABLE_WINDOWS_MR)
+  disable_features_.push_back(features::kWindowsMixedReality);
+#endif
 }
 
 void WebXrVrConsentDialogBrowserTest::SetupFakeConsentManager(
diff --git a/chrome/browser/web_applications/bookmark_apps/bookmark_app_install_manager.cc b/chrome/browser/web_applications/bookmark_apps/bookmark_app_install_manager.cc
index 9a8788a..2db515cf8 100644
--- a/chrome/browser/web_applications/bookmark_apps/bookmark_app_install_manager.cc
+++ b/chrome/browser/web_applications/bookmark_apps/bookmark_app_install_manager.cc
@@ -22,6 +22,7 @@
 #include "chrome/browser/web_applications/components/web_app_constants.h"
 #include "chrome/browser/web_applications/components/web_app_data_retriever.h"
 #include "chrome/browser/web_applications/components/web_app_helpers.h"
+#include "chrome/browser/web_applications/components/web_app_install_utils.h"
 #include "chrome/common/web_application_info.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_observer.h"
@@ -142,30 +143,6 @@
       FROM_HERE, base::BindOnce(DestroyInstallTask, std::move(install_task)));
 }
 
-WebappInstallSource ConvertOptionsToMetricsInstallSource(
-    const web_app::InstallOptions& options) {
-  WebappInstallSource metrics_install_source = WebappInstallSource::COUNT;
-  switch (options.install_source) {
-    case web_app::InstallSource::kInternal:
-      metrics_install_source = WebappInstallSource::INTERNAL_DEFAULT;
-      break;
-    case web_app::InstallSource::kExternalDefault:
-      metrics_install_source = WebappInstallSource::EXTERNAL_DEFAULT;
-      break;
-    case web_app::InstallSource::kExternalPolicy:
-      metrics_install_source = WebappInstallSource::EXTERNAL_POLICY;
-      break;
-    case web_app::InstallSource::kSystemInstalled:
-      metrics_install_source = WebappInstallSource::SYSTEM_DEFAULT;
-      break;
-    case web_app::InstallSource::kArc:
-      NOTREACHED();
-      break;
-  }
-
-  return metrics_install_source;
-}
-
 void SetBookmarkAppHelperOptions(const web_app::InstallOptions& options,
                                  BookmarkAppHelper* helper) {
   switch (options.launch_container) {
@@ -229,7 +206,7 @@
   }
 
   WebappInstallSource metrics_install_source =
-      ConvertOptionsToMetricsInstallSource(install_options);
+      web_app::ConvertOptionsToMetricsInstallSource(install_options);
 
   Profile* profile = Profile::FromBrowserContext(
       install_task->web_contents()->GetBrowserContext());
diff --git a/chrome/browser/web_applications/components/web_app_constants.h b/chrome/browser/web_applications/components/web_app_constants.h
index 0a7e518..1364a76d 100644
--- a/chrome/browser/web_applications/components/web_app_constants.h
+++ b/chrome/browser/web_applications/components/web_app_constants.h
@@ -38,7 +38,8 @@
   kUserInstallDeclined = 7,
   kInstallManagerDestroyed = 8,
   kWindowOpened = 9,
-  kMaxValue = kWindowOpened,
+  kNotValidManifestForWebApp = 10,
+  kMaxValue = kNotValidManifestForWebApp,
 };
 
 // Where an app was installed from. This affects what flags will be used when
diff --git a/chrome/browser/web_applications/components/web_app_install_utils.cc b/chrome/browser/web_applications/components/web_app_install_utils.cc
index 68bfdd46..40e60b7 100644
--- a/chrome/browser/web_applications/components/web_app_install_utils.cc
+++ b/chrome/browser/web_applications/components/web_app_install_utils.cc
@@ -12,6 +12,8 @@
 #include "chrome/browser/banners/app_banner_manager_desktop.h"
 #include "chrome/browser/banners/app_banner_settings_helper.h"
 #include "chrome/browser/installable/installable_data.h"
+#include "chrome/browser/installable/installable_metrics.h"
+#include "chrome/browser/web_applications/components/install_options.h"
 #include "chrome/browser/web_applications/components/web_app_icon_generator.h"
 #include "chrome/common/web_application_info.h"
 #include "third_party/blink/public/common/manifest/manifest.h"
@@ -200,4 +202,28 @@
       base::Time::Now());
 }
 
+WebappInstallSource ConvertOptionsToMetricsInstallSource(
+    const InstallOptions& options) {
+  auto metrics_install_source = WebappInstallSource::COUNT;
+  switch (options.install_source) {
+    case InstallSource::kInternal:
+      metrics_install_source = WebappInstallSource::INTERNAL_DEFAULT;
+      break;
+    case InstallSource::kExternalDefault:
+      metrics_install_source = WebappInstallSource::EXTERNAL_DEFAULT;
+      break;
+    case InstallSource::kExternalPolicy:
+      metrics_install_source = WebappInstallSource::EXTERNAL_POLICY;
+      break;
+    case InstallSource::kSystemInstalled:
+      metrics_install_source = WebappInstallSource::SYSTEM_DEFAULT;
+      break;
+    case InstallSource::kArc:
+      NOTREACHED();
+      break;
+  }
+
+  return metrics_install_source;
+}
+
 }  // namespace web_app
diff --git a/chrome/browser/web_applications/components/web_app_install_utils.h b/chrome/browser/web_applications/components/web_app_install_utils.h
index dce8466f..32cfd77 100644
--- a/chrome/browser/web_applications/components/web_app_install_utils.h
+++ b/chrome/browser/web_applications/components/web_app_install_utils.h
@@ -11,6 +11,7 @@
 
 #include "url/gurl.h"
 
+enum class WebappInstallSource;
 struct InstallableData;
 struct WebApplicationInfo;
 class SkBitmap;
@@ -26,6 +27,7 @@
 namespace web_app {
 
 struct BitmapAndSource;
+struct InstallOptions;
 
 enum class ForInstallableSite {
   kYes,
@@ -92,6 +94,9 @@
 // shown for this app.
 void RecordAppBanner(content::WebContents* contents, const GURL& app_url);
 
+WebappInstallSource ConvertOptionsToMetricsInstallSource(
+    const InstallOptions& options);
+
 }  // namespace web_app
 
 #endif  // CHROME_BROWSER_WEB_APPLICATIONS_COMPONENTS_WEB_APP_INSTALL_UTILS_H_
diff --git a/chrome/browser/web_applications/web_app_install_manager.cc b/chrome/browser/web_applications/web_app_install_manager.cc
index 505bb1e..ff3ccd4 100644
--- a/chrome/browser/web_applications/web_app_install_manager.cc
+++ b/chrome/browser/web_applications/web_app_install_manager.cc
@@ -98,8 +98,14 @@
     content::WebContents* web_contents,
     const InstallOptions& install_options,
     OnceInstallCallback callback) {
-  // TODO(loyso): Implement it.
-  NOTIMPLEMENTED();
+  auto task = std::make_unique<WebAppInstallTask>(
+      profile(), install_finalizer_, data_retriever_factory_.Run());
+  task->InstallWebAppWithOptions(
+      web_contents, install_options,
+      base::BindOnce(&WebAppInstallManager::OnTaskCompleted,
+                     base::Unretained(this), task.get(), std::move(callback)));
+
+  tasks_.insert(std::move(task));
 }
 
 void WebAppInstallManager::InstallOrUpdateWebAppFromSync(
diff --git a/chrome/browser/web_applications/web_app_install_task.cc b/chrome/browser/web_applications/web_app_install_task.cc
index 123e490..3948bda 100644
--- a/chrome/browser/web_applications/web_app_install_task.cc
+++ b/chrome/browser/web_applications/web_app_install_task.cc
@@ -87,6 +87,8 @@
                                        web_application_info.get());
 
   install_source_ = install_source;
+  background_installation_ = true;
+
   // |for_installable_site| arg is determined by fetching a manifest and running
   // the eligibility check on it. If we don't hit the network, assume that the
   // app represetned by |web_application_info| is installable.
@@ -104,6 +106,24 @@
                                       std::move(callback));
 }
 
+void WebAppInstallTask::InstallWebAppWithOptions(
+    content::WebContents* contents,
+    const InstallOptions& install_options,
+    InstallManager::OnceInstallCallback install_callback) {
+  CheckInstallPreconditions();
+
+  Observe(contents);
+  install_callback_ = std::move(install_callback);
+  install_source_ = ConvertOptionsToMetricsInstallSource(install_options);
+  install_options_ = install_options;
+  background_installation_ = true;
+
+  data_retriever_->GetWebApplicationInfo(
+      web_contents(),
+      base::BindOnce(&WebAppInstallTask::OnGetWebApplicationInfo,
+                     base::Unretained(this), /*force_shortcut_app=*/false));
+}
+
 void WebAppInstallTask::InstallWebAppFromInfoRetrieveIcons(
     content::WebContents* web_contents,
     std::unique_ptr<WebApplicationInfo> web_application_info,
@@ -115,6 +135,7 @@
   Observe(web_contents);
   install_callback_ = std::move(callback);
   install_source_ = install_source;
+  background_installation_ = true;
 
   std::vector<GURL> icon_urls =
       GetValidIconUrlsToDownload(*web_application_info, /*data=*/nullptr);
@@ -194,8 +215,12 @@
     return;
   }
 
+  bool bypass_service_worker_check = false;
+  if (install_options_)
+    bypass_service_worker_check = install_options_->bypass_service_worker_check;
+
   data_retriever_->CheckInstallabilityAndRetrieveManifest(
-      web_contents(), /*bypass_service_worker_check=*/false,
+      web_contents(), bypass_service_worker_check,
       base::BindOnce(&WebAppInstallTask::OnDidPerformInstallableCheck,
                      base::Unretained(this), std::move(web_app_info),
                      force_shortcut_app));
@@ -212,6 +237,14 @@
 
   DCHECK(web_app_info);
 
+  if (install_options_ && install_options_->require_manifest &&
+      !valid_manifest_for_web_app) {
+    LOG(WARNING) << "Did not install " << web_app_info->app_url.spec()
+                 << " because it didn't have a manifest for web app";
+    CallInstallCallback(AppId(), InstallResultCode::kNotValidManifestForWebApp);
+    return;
+  }
+
   const auto for_installable_site = is_installable && !force_shortcut_app
                                         ? ForInstallableSite::kYes
                                         : ForInstallableSite::kNo;
@@ -222,6 +255,12 @@
   std::vector<GURL> icon_urls =
       GetValidIconUrlsToDownload(*web_app_info, /*data=*/nullptr);
 
+  // A system app should always have a manifest icon.
+  if (install_options_ &&
+      install_options_->install_source == InstallSource::kSystemInstalled) {
+    DCHECK(!manifest.icons.empty());
+  }
+
   // If the manifest specified icons, don't use the page icons.
   const bool skip_page_favicons = !manifest.icons.empty();
 
@@ -288,11 +327,18 @@
   ResizeDownloadedIconsGenerateMissing(std::move(downloaded_icons),
                                        web_app_info.get());
 
-  std::move(dialog_callback_)
-      .Run(
-          web_contents(), std::move(web_app_info), for_installable_site,
-          base::BindOnce(&WebAppInstallTask::OnDialogCompleted,
-                         weak_ptr_factory_.GetWeakPtr(), for_installable_site));
+  if (background_installation_) {
+    DCHECK(!dialog_callback_);
+    OnDialogCompleted(for_installable_site, /*user_accepted=*/true,
+                      std::move(web_app_info));
+  } else {
+    DCHECK(dialog_callback_);
+    std::move(dialog_callback_)
+        .Run(web_contents(), std::move(web_app_info), for_installable_site,
+             base::BindOnce(&WebAppInstallTask::OnDialogCompleted,
+                            weak_ptr_factory_.GetWeakPtr(),
+                            for_installable_site));
+  }
 }
 
 void WebAppInstallTask::OnDialogCompleted(
@@ -312,10 +358,32 @@
   // This metric is recorded regardless of the installation result.
   RecordInstallEvent(for_installable_site);
 
-  InstallFinalizer::FinalizeOptions options;
+  InstallFinalizer::FinalizeOptions finalize_options;
+  if (install_options_) {
+    finalize_options.force_launch_container =
+        install_options_->launch_container;
+
+    switch (install_options_->install_source) {
+      // TODO(nigeltao/ortuno): should these two cases lead to different
+      // Manifest::Location values: INTERNAL vs EXTERNAL_PREF_DOWNLOAD?
+      case InstallSource::kInternal:
+      case InstallSource::kExternalDefault:
+        finalize_options.source = InstallFinalizer::Source::kDefaultInstalled;
+        break;
+      case InstallSource::kExternalPolicy:
+        finalize_options.source = InstallFinalizer::Source::kPolicyInstalled;
+        break;
+      case InstallSource::kSystemInstalled:
+        finalize_options.source = InstallFinalizer::Source::kSystemInstalled;
+        break;
+      case InstallSource::kArc:
+        NOTREACHED();
+        break;
+    }
+  }
 
   install_finalizer_->FinalizeInstall(
-      web_app_info_copy, options,
+      web_app_info_copy, finalize_options,
       base::BindOnce(&WebAppInstallTask::OnInstallFinalizedCreateShortcuts,
                      weak_ptr_factory_.GetWeakPtr(), std::move(web_app_info)));
 
@@ -348,12 +416,22 @@
   RecordWebAppInstallationTimestamp(profile_->GetPrefs(), app_id,
                                     install_source_);
 
-  // TODO(loyso): Implement |create_shortcuts| to skip OS shortcuts creation.
+  bool add_to_applications_menu = true;
+  bool add_to_desktop = true;
+
+  if (install_options_) {
+    add_to_applications_menu = install_options_->add_to_applications_menu;
+    add_to_desktop = install_options_->add_to_desktop;
+  }
+
   auto create_shortcuts_callback = base::BindOnce(
       &WebAppInstallTask::OnShortcutsCreated, weak_ptr_factory_.GetWeakPtr(),
       std::move(web_app_info), app_id);
-  if (install_finalizer_->CanCreateOsShortcuts()) {
-    install_finalizer_->CreateOsShortcuts(app_id, /*add_to_dekstop=*/true,
+
+  if (add_to_applications_menu && install_finalizer_->CanCreateOsShortcuts()) {
+    // TODO(ortuno): Make adding a shortcut to the applications menu independent
+    // from adding a shortcut to desktop.
+    install_finalizer_->CreateOsShortcuts(app_id, add_to_desktop,
                                           std::move(create_shortcuts_callback));
   } else {
     std::move(create_shortcuts_callback).Run(false /* created_shortcuts */);
@@ -367,17 +445,25 @@
   if (ShouldStopInstall())
     return;
 
-  if (install_finalizer_->CanPinAppToShelf())
+  bool add_to_quick_launch_bar = true;
+  if (install_options_)
+    add_to_quick_launch_bar = install_options_->add_to_quick_launch_bar;
+
+  if (add_to_quick_launch_bar && install_finalizer_->CanPinAppToShelf())
     install_finalizer_->PinAppToShelf(app_id);
 
-  // TODO(loyso): Implement |reparent_tab| to skip tab reparenting logic.
-  if (web_app_info->open_as_window &&
-      install_finalizer_->CanReparentTab(app_id, shortcut_created)) {
-    install_finalizer_->ReparentTab(app_id, web_contents());
-  }
+  // TODO(loyso): Reparenting must be implemented in
+  // chrome/browser/ui/web_applications/ UI layer as a post-install step.
+  if (!background_installation_) {
+    const bool can_reparent_tab =
+        install_finalizer_->CanReparentTab(app_id, shortcut_created);
+    if (can_reparent_tab && web_app_info->open_as_window)
+      install_finalizer_->ReparentTab(app_id, web_contents());
 
-  if (install_finalizer_->CanRevealAppShim())
-    install_finalizer_->RevealAppShim(app_id);
+    // TODO(loyso): Make revealing app shim independent from CanReparentTab.
+    if (can_reparent_tab && install_finalizer_->CanRevealAppShim())
+      install_finalizer_->RevealAppShim(app_id);
+  }
 
   CallInstallCallback(app_id, InstallResultCode::kSuccess);
 }
diff --git a/chrome/browser/web_applications/web_app_install_task.h b/chrome/browser/web_applications/web_app_install_task.h
index 6a0edd6..e17061d 100644
--- a/chrome/browser/web_applications/web_app_install_task.h
+++ b/chrome/browser/web_applications/web_app_install_task.h
@@ -10,8 +10,10 @@
 #include "base/callback.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
+#include "base/optional.h"
 #include "chrome/browser/installable/installable_metrics.h"
 #include "chrome/browser/web_applications/components/install_manager.h"
+#include "chrome/browser/web_applications/components/install_options.h"
 #include "chrome/browser/web_applications/components/web_app_install_utils.h"
 #include "content/public/browser/web_contents_observer.h"
 
@@ -39,7 +41,7 @@
   ~WebAppInstallTask() override;
 
   // Checks a WebApp installability, retrieves manifest and icons and
-  // than performs the actual installation.
+  // then performs the actual installation.
   void InstallWebAppFromManifest(
       content::WebContents* web_contents,
       WebappInstallSource install_source,
@@ -47,7 +49,7 @@
       InstallManager::OnceInstallCallback callback);
 
   // This method infers WebApp info from the blink renderer process
-  // and than retrieves a manifest in a way similar to
+  // and then retrieves a manifest in a way similar to
   // |InstallWebAppFromManifest|. If manifest is incomplete or missing, the
   // inferred info is used.
   void InstallWebAppFromManifestWithFallback(
@@ -68,6 +70,14 @@
       WebappInstallSource install_source,
       InstallManager::OnceInstallCallback callback);
 
+  // Starts a background web app installation process for a given
+  // |web_contents|. This method infers WebApp info from the blink renderer
+  // process and then retrieves a manifest in a way similar to
+  // |InstallWebAppFromManifestWithFallback|.
+  void InstallWebAppWithOptions(content::WebContents* web_contents,
+                                const InstallOptions& install_options,
+                                InstallManager::OnceInstallCallback callback);
+
   // Starts background installation of a web app: does not show UI dialog.
   // |web_application_info| contains all the data needed for installation. Icons
   // will be downloaded from the icon URLs provided in |web_application_info|.
@@ -128,6 +138,8 @@
 
   InstallManager::WebAppInstallDialogCallback dialog_callback_;
   InstallManager::OnceInstallCallback install_callback_;
+  base::Optional<InstallOptions> install_options_;
+  bool background_installation_ = false;
 
   // The mechanism via which the app creation was triggered.
   static constexpr WebappInstallSource kNoInstallSource =
diff --git a/chrome/browser/web_applications/web_app_provider.cc b/chrome/browser/web_applications/web_app_provider.cc
index e58c8fda..07c7476 100644
--- a/chrome/browser/web_applications/web_app_provider.cc
+++ b/chrome/browser/web_applications/web_app_provider.cc
@@ -75,12 +75,12 @@
     CreateWebAppsSubsystems(profile_);
   else
     CreateBookmarkAppsSubsystems(profile_);
+
+  notification_registrar_.Add(this, chrome::NOTIFICATION_PROFILE_DESTROYED,
+                              content::Source<Profile>(profile_));
 }
 
 void WebAppProvider::StartRegistry() {
-  notification_registrar_.Add(this, chrome::NOTIFICATION_PROFILE_DESTROYED,
-                              content::Source<Profile>(profile_));
-
   registrar_->Init(base::BindOnce(&WebAppProvider::OnRegistryReady,
                                   weak_ptr_factory_.GetWeakPtr()));
 }
@@ -235,7 +235,8 @@
   // but after DCHECK'ing that no RenderProcessHosts are being leaked. The
   // "chrome::NOTIFICATION_PROFILE_DESTROYED" notification gets sent before the
   // DCHECK so we use that to clean up RenderProcessHosts instead.
-  pending_app_manager_->Shutdown();
+  if (pending_app_manager_)
+    pending_app_manager_->Shutdown();
 }
 
 void WebAppProvider::SetRegistryReadyCallback(base::OnceClosure callback) {
diff --git a/chrome/browser/webauthn/chrome_authenticator_request_delegate.cc b/chrome/browser/webauthn/chrome_authenticator_request_delegate.cc
index 1ff518c..d94290e 100644
--- a/chrome/browser/webauthn/chrome_authenticator_request_delegate.cc
+++ b/chrome/browser/webauthn/chrome_authenticator_request_delegate.cc
@@ -351,7 +351,7 @@
   }
 
   weak_dialog_model_->set_incognito_mode(
-      Profile::FromBrowserContext(browser_context())->IsIncognito());
+      Profile::FromBrowserContext(browser_context())->IsIncognitoProfile());
 
   weak_dialog_model_->StartFlow(std::move(data), GetLastTransportUsed(),
                                 GetPreviouslyPairedFidoBleDeviceIds());
diff --git a/chrome/common/extensions/api/_features.md b/chrome/common/extensions/api/_features.md
index 11e5917..9be74e8a 100644
--- a/chrome/common/extensions/api/_features.md
+++ b/chrome/common/extensions/api/_features.md
@@ -245,7 +245,8 @@
 allowed in certain extension classes, rather than available to all types.
 
 Accepted values are lists of strings from `extension`, `hosted_app`,
-`legacy_packaged_app`, `platform_app`, `shared_module`, and `theme`.
+`legacy_packaged_app`, `platform_app`, `shared_module`, `theme`, and
+`login_screen_extension`.
 
 ### location
 
@@ -320,7 +321,7 @@
 `regular` session is a session launched for a regular, authenticated user.
 
 `kiosk` session is a session launched for a kiosk app - an app that runs on its
-own, in full control of the current session. 
+own, in full control of the current session.
 
 `kiosk.autolaunched` represents auto-launched kiosk session - a kiosk session
 that is launched automatically from Chrome OS login screen, without any user
diff --git a/chrome/common/extensions/api/_manifest_features.json b/chrome/common/extensions/api/_manifest_features.json
index 8eab422..402b0319 100644
--- a/chrome/common/extensions/api/_manifest_features.json
+++ b/chrome/common/extensions/api/_manifest_features.json
@@ -86,7 +86,14 @@
     // "event_rules" does not grant any capabilities, it's just
     // an optimisation for any API which uses events, so it's safe
     // to expose to all extension types.
-    "extension_types": "all"
+    "extension_types": [
+      "extension",
+      "legacy_packaged_app",
+      "platform_app",
+      "hosted_app",
+      "shared_module",
+      "theme"
+    ]
   },
   "devtools_page": {
     "channel": "stable",
diff --git a/chrome/common/extensions/manifest_tests/extension_manifests_platformapp_unittest.cc b/chrome/common/extensions/manifest_tests/extension_manifests_platformapp_unittest.cc
index 15d29da..6d6241b 100644
--- a/chrome/common/extensions/manifest_tests/extension_manifests_platformapp_unittest.cc
+++ b/chrome/common/extensions/manifest_tests/extension_manifests_platformapp_unittest.cc
@@ -54,12 +54,12 @@
           "apps, but this is a packaged app."),
       Testcase("init_invalid_platform_app_4.json",
                "'background' is only allowed for extensions, legacy packaged "
-               "apps, and"
-               " hosted apps, but this is a packaged app."),
+               "apps, hosted apps, and login screen extensions, but this is a "
+               "packaged app."),
       Testcase("init_invalid_platform_app_5.json",
                "'background' is only allowed for extensions, legacy packaged "
-               "apps, and"
-               " hosted apps, but this is a packaged app."),
+               "apps, hosted apps, and login screen extensions, but this is a "
+               "packaged app."),
       Testcase("incognito_invalid_platform_app.json",
                "'incognito' is only allowed for extensions and legacy packaged "
                "apps, "
diff --git a/chrome/common/extensions/manifest_unittest.cc b/chrome/common/extensions/manifest_unittest.cc
index 0879fcf..ea51906e 100644
--- a/chrome/common/extensions/manifest_unittest.cc
+++ b/chrome/common/extensions/manifest_unittest.cc
@@ -40,10 +40,12 @@
     EXPECT_EQ(type == Manifest::TYPE_HOSTED_APP, manifest->is_hosted_app());
     EXPECT_EQ(type == Manifest::TYPE_SHARED_MODULE,
               manifest->is_shared_module());
+    EXPECT_EQ(type == Manifest::TYPE_LOGIN_SCREEN_EXTENSION,
+              manifest->is_login_screen_extension());
   }
 
   // Helper function that replaces the Manifest held by |manifest| with a copy
-  // with its |key| changed to |value|. If |value| is NULL, then |key| will
+  // with its |key| changed to |value|. If |value| is nullptr, then |key| will
   // instead be deleted.
   void MutateManifest(std::unique_ptr<Manifest>* manifest,
                       const std::string& key,
@@ -52,11 +54,25 @@
     if (value)
       manifest_value->Set(key, std::move(value));
     else
-      manifest_value->Remove(key, NULL);
+      manifest_value->Remove(key, nullptr);
     manifest->reset(
         new Manifest(Manifest::INTERNAL, std::move(manifest_value)));
   }
 
+  // Helper function that replaces the manifest held by |manifest| with a copy
+  // and uses the |for_login_screen| during creation to determine its type.
+  void MutateManifestForLoginScreen(std::unique_ptr<Manifest>* manifest,
+                                    bool for_login_screen) {
+    auto manifest_value = manifest->get()->value()->CreateDeepCopy();
+    if (for_login_screen) {
+      *manifest = Manifest::CreateManifestForLoginScreen(
+          Manifest::EXTERNAL_POLICY, std::move(manifest_value));
+    } else {
+      *manifest = std::make_unique<Manifest>(Manifest::INTERNAL,
+                                             std::move(manifest_value));
+    }
+  }
+
   std::string default_value_;
 };
 
@@ -114,43 +130,48 @@
   // By default, the type is Extension.
   AssertType(manifest.get(), Manifest::TYPE_EXTENSION);
 
+  // Login screen extension
+  MutateManifestForLoginScreen(&manifest, true);
+  AssertType(manifest.get(), Manifest::TYPE_LOGIN_SCREEN_EXTENSION);
+  MutateManifestForLoginScreen(&manifest, false);
+
   // Theme.
   MutateManifest(&manifest, keys::kTheme,
                  std::make_unique<base::DictionaryValue>());
   AssertType(manifest.get(), Manifest::TYPE_THEME);
-  MutateManifest(
-      &manifest, keys::kTheme, NULL);
+  MutateManifest(&manifest, keys::kTheme, nullptr);
 
   // Shared module.
   MutateManifest(&manifest, keys::kExport,
                  std::make_unique<base::DictionaryValue>());
   AssertType(manifest.get(), Manifest::TYPE_SHARED_MODULE);
-  MutateManifest(
-      &manifest, keys::kExport, NULL);
+  MutateManifest(&manifest, keys::kExport, nullptr);
 
   // Packaged app.
   MutateManifest(&manifest, keys::kApp,
                  std::make_unique<base::DictionaryValue>());
   AssertType(manifest.get(), Manifest::TYPE_LEGACY_PACKAGED_APP);
 
+  // Packaged app for login screen remains a packaged app.
+  MutateManifestForLoginScreen(&manifest, true);
+  AssertType(manifest.get(), Manifest::TYPE_LEGACY_PACKAGED_APP);
+  MutateManifestForLoginScreen(&manifest, false);
+
   // Platform app with event page.
   MutateManifest(&manifest, keys::kPlatformAppBackground,
                  std::make_unique<base::DictionaryValue>());
   AssertType(manifest.get(), Manifest::TYPE_PLATFORM_APP);
-  MutateManifest(
-      &manifest, keys::kPlatformAppBackground, NULL);
+  MutateManifest(&manifest, keys::kPlatformAppBackground, nullptr);
 
   // Hosted app.
   MutateManifest(&manifest, keys::kWebURLs,
                  std::make_unique<base::ListValue>());
   AssertType(manifest.get(), Manifest::TYPE_HOSTED_APP);
-  MutateManifest(
-      &manifest, keys::kWebURLs, NULL);
+  MutateManifest(&manifest, keys::kWebURLs, nullptr);
   MutateManifest(&manifest, keys::kLaunchWebURL,
                  std::make_unique<base::Value>("foo"));
   AssertType(manifest.get(), Manifest::TYPE_HOSTED_APP);
-  MutateManifest(
-      &manifest, keys::kLaunchWebURL, NULL);
+  MutateManifest(&manifest, keys::kLaunchWebURL, nullptr);
 }
 
 // Verifies that the getters filter restricted keys.
@@ -168,7 +189,7 @@
   EXPECT_TRUE(warnings.empty());
 
   // "Commands" requires manifest version 2.
-  const base::Value* output = NULL;
+  const base::Value* output = nullptr;
   MutateManifest(&manifest, keys::kCommands,
                  std::make_unique<base::DictionaryValue>());
   EXPECT_FALSE(manifest->HasKey(keys::kCommands));
@@ -191,8 +212,7 @@
   AssertType(manifest.get(), Manifest::TYPE_PLATFORM_APP);
   EXPECT_FALSE(manifest->HasKey(keys::kPageAction));
   EXPECT_FALSE(manifest->Get(keys::kPageAction, &output));
-  MutateManifest(
-      &manifest, keys::kPlatformAppBackground, NULL);
+  MutateManifest(&manifest, keys::kPlatformAppBackground, nullptr);
 
   // Platform apps also can't have a "Commands" key.
   EXPECT_FALSE(manifest->HasKey(keys::kCommands));
diff --git a/chrome/common/extensions/sync_helper.cc b/chrome/common/extensions/sync_helper.cc
index 64a59f9..05a8df6 100644
--- a/chrome/common/extensions/sync_helper.cc
+++ b/chrome/common/extensions/sync_helper.cc
@@ -58,6 +58,7 @@
 
     case Manifest::TYPE_UNKNOWN:
     case Manifest::TYPE_SHARED_MODULE:
+    case Manifest::TYPE_LOGIN_SCREEN_EXTENSION:
       return false;
 
     case Manifest::NUM_LOAD_TYPES:
diff --git a/chrome/common/pref_names.cc b/chrome/common/pref_names.cc
index 15e8c82d..94d4b5e 100644
--- a/chrome/common/pref_names.cc
+++ b/chrome/common/pref_names.cc
@@ -1635,16 +1635,6 @@
 // Tracks the number of times the dice signin promo has been shown in the user
 // menu.
 const char kDiceSigninUserMenuPromoCount[] = "sync_promo.user_menu_show_count";
-
-// Boolean that specifies if the sign in promo is allowed to show on first run.
-// This preference is specified in the master preference file to suppress the
-// sign in promo for some installations.
-const char kSignInPromoShowOnFirstRunAllowed[] =
-    "sync_promo.show_on_first_run_allowed";
-
-// Boolean that specifies if we should show a bubble in the new tab page.
-// The bubble is used to confirm that the user is signed into sync.
-const char kSignInPromoShowNTPBubble[] = "sync_promo.show_ntp_bubble";
 #endif
 
 // Create web application shortcut dialog preferences.
diff --git a/chrome/common/pref_names.h b/chrome/common/pref_names.h
index 7de8ce38..d723b4a 100644
--- a/chrome/common/pref_names.h
+++ b/chrome/common/pref_names.h
@@ -563,8 +563,6 @@
 
 #if !defined(OS_ANDROID)
 extern const char kDiceSigninUserMenuPromoCount[];
-extern const char kSignInPromoShowOnFirstRunAllowed[];
-extern const char kSignInPromoShowNTPBubble[];
 #endif
 
 extern const char kWebAppCreateOnDesktop[];
diff --git a/chrome/renderer/BUILD.gn b/chrome/renderer/BUILD.gn
index cc5a38a2..e5f98be2 100644
--- a/chrome/renderer/BUILD.gn
+++ b/chrome/renderer/BUILD.gn
@@ -330,20 +330,6 @@
       "media/cast_transport_ipc.h",
       "media/cast_udp_transport.cc",
       "media/cast_udp_transport.h",
-      "resources/extensions/browser_action_custom_bindings.js",
-      "resources/extensions/declarative_content_custom_bindings.js",
-      "resources/extensions/enterprise_platform_keys_custom_bindings.js",
-      "resources/extensions/gcm_custom_bindings.js",
-      "resources/extensions/identity_custom_bindings.js",
-      "resources/extensions/image_writer_private_custom_bindings.js",
-      "resources/extensions/input.ime_custom_bindings.js",
-      "resources/extensions/notifications_custom_bindings.js",
-      "resources/extensions/omnibox_custom_bindings.js",
-      "resources/extensions/page_action_custom_bindings.js",
-      "resources/extensions/page_capture_custom_bindings.js",
-      "resources/extensions/system_indicator_custom_bindings.js",
-      "resources/extensions/tts_custom_bindings.js",
-      "resources/extensions/tts_engine_custom_bindings.js",
     ]
     deps += [
       # TODO(hclam): See crbug.com/298380 for details.
diff --git a/chrome/services/util_win/av_products_unittest.cc b/chrome/services/util_win/av_products_unittest.cc
index f051c47..83c2932 100644
--- a/chrome/services/util_win/av_products_unittest.cc
+++ b/chrome/services/util_win/av_products_unittest.cc
@@ -18,7 +18,7 @@
 
 }  // namespace
 
-TEST(AvProductsTest, ResultCodeHistogram) {
+TEST(AvProductsTest, DISABLED_ResultCodeHistogram) {
   base::win::ScopedCOMInitializer scoped_com_initializer;
   base::HistogramTester histograms;
 
diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
index c0f35e61..9064f25 100644
--- a/chrome/test/BUILD.gn
+++ b/chrome/test/BUILD.gn
@@ -2003,7 +2003,7 @@
         "../browser/chromeos/policy/login_screen_default_policy_browsertest.cc",
         "../browser/chromeos/policy/power_policy_browsertest.cc",
         "../browser/chromeos/policy/restore_on_startup_browsertest_chromeos.cc",
-        "../browser/chromeos/policy/signin_profile_apps_policy_browsertest.cc",
+        "../browser/chromeos/policy/signin_profile_extensions_policy_browsertest.cc",
         "../browser/chromeos/policy/site_isolation_flag_handling_browsertest.cc",
         "../browser/chromeos/policy/status_collector/child_status_collector_browsertest.cc",
         "../browser/chromeos/policy/status_collector/device_status_collector_browsertest.cc",
@@ -2555,7 +2555,7 @@
 }
 
 test("unit_tests") {
-  sources = [
+  inputs = [
     # enums.xml is analyzed by AboutFlagsHistogramTest, so this
     # dependency is needed to make commit bots run unit_tests on
     # enums.xml changes.
@@ -2566,7 +2566,8 @@
     # flag-never-expire-list.json.
     "../browser/flag-metadata.json",
     "../browser/flag-never-expire-list.json",
-
+  ]
+  sources = [
     # All unittests in browser, common, renderer and service.
     "../browser/about_flags_unittest.cc",
     "../browser/active_use_util_unittest.cc",
@@ -3608,9 +3609,6 @@
     if (is_posix || is_fuchsia) {
       sources += [ "../browser/process_singleton_posix_unittest.cc" ]
     }
-    if (is_chrome_branded && is_win) {
-      sources += [ "../browser/safe_browsing/chrome_cleaner/chrome_cleaner_extension_util_win_unittest.cc" ]
-    }
 
     deps += [
       "//chrome/browser/resource_coordinator:tab_metrics_event_proto",
@@ -4120,6 +4118,7 @@
       "../browser/sync_file_system/sync_file_system_test_util.h",
       "../browser/sync_file_system/sync_process_runner_unittest.cc",
       "../browser/sync_file_system/syncable_file_system_util_unittest.cc",
+      "../browser/ui/webui/settings/chrome_cleanup_handler_win_unittest.cc",
       "../common/apps/platform_apps/media_galleries_permission_unittest.cc",
       "../common/extensions/api/commands/commands_manifest_unittest.cc",
       "../common/extensions/api/common_extension_api_unittest.cc",
@@ -5665,7 +5664,6 @@
       "../browser/sync/test/integration/two_client_themes_sync_test.cc",
       "../browser/sync/test/integration/two_client_typed_urls_sync_test.cc",
       "../browser/sync/test/integration/two_client_user_events_sync_test.cc",
-      "../browser/sync/test/integration/two_client_uss_sync_test.cc",
       "../browser/sync/test/integration/two_client_wallet_sync_test.cc",
     ]
 
diff --git a/chrome/test/android/javatests/src/org/chromium/chrome/test/util/ApplicationData.java b/chrome/test/android/javatests/src/org/chromium/chrome/test/util/ApplicationData.java
index cc544f1..2210626 100644
--- a/chrome/test/android/javatests/src/org/chromium/chrome/test/util/ApplicationData.java
+++ b/chrome/test/android/javatests/src/org/chromium/chrome/test/util/ApplicationData.java
@@ -79,7 +79,6 @@
             // SharedPreferences are cached in memory, so clearing their files doesn't help anyways.
             // Some preferences need to persist (e.g. multidex.version.xml).
             if (file.getName().equals("shared_prefs")) {
-                removeSharedPrefs(file);
                 continue;
             }
             if (!FileUtils.recursivelyDeleteFile(file)) {
@@ -88,13 +87,4 @@
         }
         return true;
     }
-
-    // TODO(agrieve): Use InMemorySharedPrefs rather than having to delete from disk.
-    private static void removeSharedPrefs(File sharedPrefsDir) {
-        for (File f : sharedPrefsDir.listFiles()) {
-            if (!f.getName().endsWith("multidex.version.xml")) {
-                f.delete();
-            }
-        }
-    }
 }
diff --git a/chrome/test/android/javatests/src/org/chromium/chrome/test/util/browser/sync/SyncTestUtil.java b/chrome/test/android/javatests/src/org/chromium/chrome/test/util/browser/sync/SyncTestUtil.java
index e6b1c2d..cfac4ee1 100644
--- a/chrome/test/android/javatests/src/org/chromium/chrome/test/util/browser/sync/SyncTestUtil.java
+++ b/chrome/test/android/javatests/src/org/chromium/chrome/test/util/browser/sync/SyncTestUtil.java
@@ -103,7 +103,7 @@
      * Triggers a sync cycle.
      */
     public static void triggerSync() {
-        TestThreadUtils.runOnUiThreadBlocking(() -> { ProfileSyncService.get().triggerSync(); });
+        TestThreadUtils.runOnUiThreadBlocking(() -> { ProfileSyncService.get().triggerRefresh(); });
     }
 
     /**
diff --git a/chrome/test/base/js2gtest.gni b/chrome/test/base/js2gtest.gni
index 157018bf..e8e95aa 100644
--- a/chrome/test/base/js2gtest.gni
+++ b/chrome/test/base/js2gtest.gni
@@ -116,7 +116,7 @@
                              "defines",
                              "visibility",
                            ])
-    sources = get_target_outputs(":$action_name")
+    sources = process_file_template(invoker.sources, [ gen_source_pattern ])
 
     # This empty public header is intentional to remove unnecessary build
     # dependency.
diff --git a/chrome/test/chromedriver/js/call_function.js b/chrome/test/chromedriver/js/call_function.js
index 0e512c17..4ff5d86 100644
--- a/chrome/test/chromedriver/js/call_function.js
+++ b/chrome/test/chromedriver/js/call_function.js
@@ -65,6 +65,18 @@
 };
 
 /**
+ * Constructs new error to be thrown with given code and message.
+ * @param {string} message Message reported to user.
+ * @param {StatusCode} code StatusCode for error.
+ * @return {!Error} Error object that can be thrown.
+ */
+function newError(message, code) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+/**
  * A cache which maps IDs <-> cached objects for the purpose of identifying
  * a script object remotely. Uses UUIDs for identification.
  * @constructor
@@ -100,10 +112,8 @@
     var item = this.cache_[id];
     if (item)
       return item;
-    var error = new Error('not in cache');
-    error.code = StatusCode.STALE_ELEMENT_REFERENCE;
-    error.message = 'element is not attached to the page document';
-    throw error;
+    throw newError('element is not attached to the page document',
+                   StatusCode.STALE_ELEMENT_REFERENCE);
   },
 
   /**
@@ -170,10 +180,8 @@
     var item = this.cache_[id];
     if (item)
       return item;
-    var error = new Error('not in cache');
-    error.code = StatusCode.STALE_ELEMENT_REFERENCE;
-    error.message = 'element is not attached to the page document';
-    throw error;
+    throw newError('element is not attached to the page document',
+                   StatusCode.STALE_ELEMENT_REFERENCE);
   },
 
   /**
@@ -246,13 +254,11 @@
 }
 
 /**
- * Wraps the given value to be transmitted remotely by converting
- * appropriate objects to cached object IDs.
- *
- * @param {*} value The value to wrap.
- * @return {*} The wrapped value.
+ * Returns whether given value is an element.
+ * @param {*} value The value to identify as object.
+ * @return {boolean} True if value is a cacheable element.
  */
-function wrap(value) {
+function isElement(value) {
   // As of crrev.com/1316933002, typeof() for some elements will return
   // 'function', not 'object'. So we need to check for both non-null objects, as
   // well Elements that also happen to be callable functions (e.g. <embed> and
@@ -260,60 +266,125 @@
   // since this does not work with frames/iframes, for example
   // frames[0].document.body instanceof Object == false even though
   // typeof(frames[0].document.body) == 'object'.
-  if ((typeof(value) == 'object' && value != null) ||
-      (value instanceof HTMLAllCollection) ||
-      (typeof(value) == 'function' && value.nodeName &&
-       value.nodeType == NodeType.ELEMENT)) {
-    var nodeType = value['nodeType'];
-    if (nodeType == NodeType.ELEMENT || nodeType == NodeType.DOCUMENT
-        || (SHADOW_DOM_ENABLED && value instanceof ShadowRoot)) {
-      var wrapped = {};
-      var root = getNodeRootThroughAnyShadows(value);
-      wrapped[ELEMENT_KEY] = getPageCache(root, w3cEnabled).storeItem(value);
-      return wrapped;
-    }
-
-    var obj;
-    if (typeof(value.length) == 'number') {
-      obj = [];
-      for (var i = 0; i < value.length; i++)
-        obj[i] = wrap(value[i]);
-    } else {
-      obj = {};
-      for (var prop in value)
-        obj[prop] = wrap(value[prop]);
-    }
-    return obj;
-  }
-  return value;
+  return ((typeof(value) == 'object' && value != null) ||
+            (typeof(value) == 'function' && value.nodeName &&
+            value.nodeType == NodeType.ELEMENT)) &&
+          (value.nodeType == NodeType.ELEMENT   ||
+           value.nodeType == NodeType.DOCUMENT  ||
+           (SHADOW_DOM_ENABLED && value instanceof ShadowRoot));
 }
 
 /**
- * Unwraps the given value by converting from object IDs to the cached
- * objects.
- *
- * @param {*} value The value to unwrap.
- * @param {Cache} cache The cache to retrieve wrapped elements from.
- * @return {*} The unwrapped value.
+ * Returns whether given value is a collection (iterable with
+ * 'length' property).
+ * @param {*} value The value to identify as a collection.
+ * @return {boolean} True if value is an iterable collection.
  */
-function unwrap(value, cache) {
-  if (typeof(value) == 'object' && value != null) {
-    if (ELEMENT_KEY in value)
-      return cache.retrieveItem(value[ELEMENT_KEY]);
+function isCollection(value) {
+  return (typeof value[Symbol.iterator] === 'function');
+}
 
-    var obj;
-    if (typeof(value.length) == 'number') {
-      obj = [];
-      for (var i = 0; i < value.length; i++)
-        obj[i] = unwrap(value[i], cache);
-    } else {
-      obj = {};
-      for (var prop in value)
-        obj[prop] = unwrap(value[prop], cache);
+/**
+ * Deep-clones item, given object references in seen, using cloning algorithm
+ * algo. Implements "clone an object" from W3C-spec (#dfn-clone-an-object).
+ * @param {*} item Object or collection to deep clone.
+ * @param {!Array<*>} seen Object references that have already been seen.
+ * @param {function(*, Array<*>, ?Cache) : *} algo Cloning algorithm to use to
+ *     deep clone properties of item.
+ * @param {?Cache} opt_cache Optional cache to use for cloning.
+ * @return {*} Clone of item with status of cloning.
+ */
+function cloneWithAlgorithm(item, seen, algo, opt_cache) {
+  let tmp = null;
+  function maybeCopyProperty(prop) {
+    let sourceValue = null;
+    try {
+      sourceValue = item[prop];
+    } catch(e) {
+      throw newError('error reading property', StatusCode.JAVA_SCRIPT_ERROR);
     }
-    return obj;
+    return algo(sourceValue, seen, opt_cache);
   }
-  return value;
+
+  if (isCollection(item)) {
+    tmp = new Array(item.length);
+    for (let i = 0; i < item.length; ++i)
+      tmp[i] = maybeCopyProperty(i);
+  } else {
+    tmp = {};
+    for (let prop in item)
+      tmp[prop] = maybeCopyProperty(prop);
+  }
+  return tmp;
+}
+
+
+/**
+ * Returns deep clone of given value, replacing element references with a
+ * serialized string representing that element.
+ * @param {*} item Object or collection to deep clone.
+ * @param {!Array<*>} seen Object references that have already been seen.
+ * @return {*} Clone of item with status of cloning.
+ */
+function jsonSerialize(item, seen) {
+  if (item === undefined || item === null)
+    return null;
+  if (typeof item === 'boolean' ||
+      typeof item === 'number' ||
+      typeof item === 'string')
+    return item;
+  if (isElement(item)) {
+    const root = getNodeRootThroughAnyShadows(item);
+    const cache = getPageCache(root, w3cEnabled);
+    if (!cache.isNodeReachable_(item))
+      throw newError('stale element not found',
+                     StatusCode.STALE_ELEMENT_REFERENCE);
+    const ret = {};
+    ret[ELEMENT_KEY] = cache.storeItem(item);
+    return ret;
+  }
+  // TODO(rohpavone): Implement WindowProxy serialization.
+  if (typeof item.toJSON === 'function' &&
+      (item.hasOwnProperty('toJSON') ||
+       Object.getPrototypeOf(item).hasOwnProperty('toJSON')))
+    return item.toJSON();
+
+  // Deep clone collections and Objects.
+  if (seen.includes(item))
+    throw newError('circular reference', StatusCode.JAVA_SCRIPT_ERROR);
+  seen.push(item);
+  const result = cloneWithAlgorithm(item, seen, jsonSerialize);
+  seen.pop();
+  return result;
+}
+
+/**
+ * Returns deserialized deep clone of given value, replacing serialized string
+ * references to elements with a element reference, if found.
+ * @param {*} item Object or collection to deep clone.
+ * @param {?Array<*>} opt_seen Object references that have already been seen.
+ * @param {?Cache} opt_cache Document cache containing serialized elements.
+ * @return {*} Clone of item with status of cloning.
+ */
+function jsonDeserialize(item, opt_seen, opt_cache) {
+  if (opt_seen === undefined || opt_seen === null)
+    opt_seen = []
+  if (item === undefined ||
+      item === null ||
+      typeof item === 'boolean' ||
+      typeof item === 'number' ||
+      typeof item === 'string')
+    return item;
+  if (item.hasOwnProperty(ELEMENT_KEY)) {
+    if (opt_cache === undefined || opt_cache === null) {
+      const root = getNodeRootThroughAnyShadows(item);
+      opt_cache = getPageCache(root, w3cEnabled);
+    }
+    return  opt_cache.retrieveItem(item[ELEMENT_KEY]);
+  }
+  if (isCollection(item) || typeof item === 'object')
+    return cloneWithAlgorithm(item, opt_seen, jsonDeserialize, opt_cache);
+  throw newError('unhandled object', StatusCode.JAVA_SCRIPT_ERROR);
 }
 
 /**
@@ -341,21 +412,23 @@
     ELEMENT_KEY = 'element-6066-11e4-a52e-4f735466cecf';
 
   }
-  var cache = getPageCache(null, w3cEnabled);
+  const cache = getPageCache(null, w3cEnabled);
   cache.clearStale();
 
-  if (opt_unwrappedReturn)
-    return func.apply(null, unwrap(args, cache));
-
-  var status = 0;
+  let status = 0;
+  let returnValue;
   try {
-    var returnValue = wrap(func.apply(null, unwrap(args, cache)));
+    const unwrappedArgs = jsonDeserialize(args, [], cache);
+    if (opt_unwrappedReturn)
+      return func.apply(null, unwrappedArgs);
+    const tmp = jsonSerialize(func.apply(null, unwrappedArgs), []);
+    returnValue = tmp;
   } catch (error) {
     status = error.code || StatusCode.JAVA_SCRIPT_ERROR;
-    var returnValue = error.message;
+    returnValue = error.message;
   }
   return {
       status: status,
       value: returnValue
-  }
+  };
 }
diff --git a/chrome/test/chromedriver/js/call_function_test.html b/chrome/test/chromedriver/js/call_function_test.html
index c3539e7..d54eb8e0 100644
--- a/chrome/test/chromedriver/js/call_function_test.html
+++ b/chrome/test/chromedriver/js/call_function_test.html
@@ -4,6 +4,14 @@
 <script src='call_function.js'></script>
 <script>
 
+function wrap(value) {
+  return jsonSerialize(value, []);
+}
+
+function unwrap(value, opt_cache) {
+  return jsonDeserialize(value, [], opt_cache);
+}
+
 function clearCache() {
   getPageCache().cache_ = {};
 }
@@ -92,9 +100,6 @@
   assertEquals(null, unwrap(null));
   assertEquals(undefined, wrap(undefined));
   assertEquals(undefined, unwrap(undefined));
-  function func() {}
-  assertEquals(func, wrap(func));
-  assertEquals(func, unwrap(func));
 
   var cache = getPageCache();
   var arr = [1, new Array(1, new Object({a: 1, b: {a: 1, b: {}, c: 3}}), 3)];
@@ -109,6 +114,25 @@
   assertEquals(originalJson, JSON.stringify(unwrapped));
 }
 
+function testObjectWithLengthProperty() {
+  clearCache();
+
+  let obj = {length: 200};
+  assertEquals(200, wrap({length: 200})['length'])
+  assertEquals(JSON.stringify(obj), JSON.stringify(wrap({length: 200})))
+
+  obj = {bar: 'foo', bazz: {length: 150}};
+  let wrappedObj = wrap(obj);
+  assertEquals('foo', wrappedObj['bar'])
+  assertEquals(150, wrappedObj['bazz']['length'])
+  assertEquals(JSON.stringify(obj), JSON.stringify(wrappedObj));
+
+  let unwrappedObj = unwrap(obj);
+  assertEquals('foo', unwrappedObj['bar'])
+  assertEquals(150, unwrappedObj['bazz']['length'])
+  assertEquals(JSON.stringify(obj), JSON.stringify(unwrappedObj));
+}
+
 function testCacheDoubleWrap() {
   clearCache();
 
diff --git a/chrome/test/data/extensions/signin_screen_manual_test_extension/OWNERS b/chrome/test/data/extensions/signin_screen_manual_test_extension/OWNERS
new file mode 100644
index 0000000..aef9c2c4
--- /dev/null
+++ b/chrome/test/data/extensions/signin_screen_manual_test_extension/OWNERS
@@ -0,0 +1 @@
+hendrich@chromium.org
diff --git a/chrome/test/data/extensions/signin_screen_manual_test_extension/README b/chrome/test/data/extensions/signin_screen_manual_test_extension/README
new file mode 100644
index 0000000..d4d72825
--- /dev/null
+++ b/chrome/test/data/extensions/signin_screen_manual_test_extension/README
@@ -0,0 +1,9 @@
+The extension_signed_by_webstore.crx package must be a one signed by WebStore,
+in order for the extension to have the expected ID which is whitelisted in
+Chrome - "ngjobkbdodapjbbncmagbccommkggmnj".
+
+This extension is primarily intended to be used for the manual testing of the
+extensions on the Chrome OS sign-in screen.
+
+In case a new version of the test extension has to be published on WebStore,
+please reach out to the managed-devices@ mailing list.
diff --git a/chrome/test/data/extensions/signin_screen_manual_test_extension/extension/background.js b/chrome/test/data/extensions/signin_screen_manual_test_extension/extension/background.js
new file mode 100644
index 0000000..022f51e
--- /dev/null
+++ b/chrome/test/data/extensions/signin_screen_manual_test_extension/extension/background.js
@@ -0,0 +1,5 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+console.log('The Trivial Test Extension background page loaded');
diff --git a/chrome/test/data/extensions/signin_screen_manual_test_extension/extension/manifest.json b/chrome/test/data/extensions/signin_screen_manual_test_extension/extension/manifest.json
new file mode 100644
index 0000000..a682fd66
--- /dev/null
+++ b/chrome/test/data/extensions/signin_screen_manual_test_extension/extension/manifest.json
@@ -0,0 +1,9 @@
+{
+  "name": "Sign-in Screen Test Extension",
+  "version": "2.0",
+  "manifest_version": 2,
+  "description": "The extension for manual testing of the extensions installation in the Chrome OS sign-in profile",
+  "background": {
+    "scripts": ["background.js"]
+  }
+}
diff --git a/chrome/test/data/extensions/signin_screen_manual_test_extension/extension_signed_by_webstore.crx b/chrome/test/data/extensions/signin_screen_manual_test_extension/extension_signed_by_webstore.crx
new file mode 100644
index 0000000..c9fadd51
--- /dev/null
+++ b/chrome/test/data/extensions/signin_screen_manual_test_extension/extension_signed_by_webstore.crx
Binary files differ
diff --git a/chrome/test/data/extensions/signin_screen_manual_test_extension/update_manifest.xml b/chrome/test/data/extensions/signin_screen_manual_test_extension/update_manifest.xml
new file mode 100644
index 0000000..e571080
--- /dev/null
+++ b/chrome/test/data/extensions/signin_screen_manual_test_extension/update_manifest.xml
@@ -0,0 +1,12 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<!--
+  This update manifest points to the ./extension.crx file. "mock.http" is a
+  placeholder that gets substituted with the test server address in runtime.
+-->
+<gupdate xmlns='http://www.google.com/update2/response' protocol='2.0'>
+  <app appid='ngjobkbdodapjbbncmagbccommkggmnj'>
+    <updatecheck
+        codebase='http://mock.http/extensions/signin_screen_manual_test_extension/extension_signed_by_webstore.crx'
+        version='2.0' />
+   </app>
+</gupdate>
diff --git a/chrome/test/data/webui/settings/cr_settings_browsertest.js b/chrome/test/data/webui/settings/cr_settings_browsertest.js
index 1e02026..74b8c44a 100644
--- a/chrome/test/data/webui/settings/cr_settings_browsertest.js
+++ b/chrome/test/data/webui/settings/cr_settings_browsertest.js
@@ -590,8 +590,7 @@
   ]),
 };
 
-// Test is consistently failing. http://crbug.com/960837
-TEST_F('CrSettingsPeoplePageKerberosAccountsTest', 'DISABLED_All', function() {
+TEST_F('CrSettingsPeoplePageKerberosAccountsTest', 'All', function() {
   mocha.run();
 });
 
diff --git a/chrome/test/data/webui/settings/people_page_kerberos_accounts_test.js b/chrome/test/data/webui/settings/people_page_kerberos_accounts_test.js
index 855e0a44..8c7427c 100644
--- a/chrome/test/data/webui/settings/people_page_kerberos_accounts_test.js
+++ b/chrome/test/data/webui/settings/people_page_kerberos_accounts_test.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+'use strict';
+
 cr.define('settings_people_page_kerberos_accounts', function() {
   /** @implements {settings.KerberosAccountsBrowserProxy} */
   class TestKerberosAccountsBrowserProxy extends TestBrowserProxy {
@@ -9,9 +11,11 @@
       super([
         'getAccounts',
         'addAccount',
-        'reauthenticateAccount',
         'removeAccount',
       ]);
+
+      // Simulated error from a addKerberosAccount call.
+      this.addAccountError = settings.KerberosErrorType.kNone;
     }
 
     /** @override */
@@ -33,13 +37,9 @@
     }
 
     /** @override */
-    addAccount() {
-      this.methodCalled('addAccount');
-    }
-
-    /** @override */
-    reauthenticateAccount(principalName) {
-      this.methodCalled('reauthenticateAccount', principalName);
+    addAccount(principalName, password) {
+      this.methodCalled('addAccount', [principalName, password]);
+      return Promise.resolve(this.addAccountError);
     }
 
     /** @override */
@@ -48,6 +48,7 @@
     }
   }
 
+  // Tests for the Kerberos Accounts settings page.
   suite('KerberosAccountsTests', function() {
     let browserProxy = null;
     let kerberosAccounts = null;
@@ -79,22 +80,34 @@
     });
 
     test('AddAccount', function() {
+      assertTrue(!kerberosAccounts.$$('kerberos-add-account-dialog'));
       assertFalse(kerberosAccounts.$$('#add-account-button').disabled);
       kerberosAccounts.$$('#add-account-button').click();
-      assertEquals(1, browserProxy.getCallCount('addAccount'));
+      Polymer.dom.flush();
+      const addDialog = kerberosAccounts.$$('kerberos-add-account-dialog');
+      assertTrue(!!addDialog);
+      assertEquals('', addDialog.username);
     });
 
     test('ReauthenticateAccount', function() {
+      // Wait until accounts are loaded.
       return browserProxy.whenCalled('getAccounts').then(() => {
         Polymer.dom.flush();
+
+        // The kerberos-add-account-dialog shouldn't be open yet.
+        assertTrue(!kerberosAccounts.$$('kerberos-add-account-dialog'));
+
+        // Click "Sign-In" on an existing account.
         // Note that both accounts have a reauth button, but [0] is hidden, so
         // click [1] (clicking a hidden button works, but it feels weird).
         kerberosAccounts.root.querySelectorAll('.reauth-button')[1].click();
-        assertEquals(1, browserProxy.getCallCount('reauthenticateAccount'));
-        return browserProxy.whenCalled('reauthenticateAccount')
-            .then((principalName) => {
-              assertEquals('user2@REALM2', principalName);
-            });
+        Polymer.dom.flush();
+
+        // Now the kerberos-add-account-dialog should be open with preset
+        // username.
+        const addDialog = kerberosAccounts.$$('kerberos-add-account-dialog');
+        assertTrue(!!addDialog);
+        assertEquals('user2@REALM2', addDialog.username);
       });
     });
 
@@ -118,4 +131,143 @@
       assertEquals(2, browserProxy.getCallCount('getAccounts'));
     });
   });
-});
+
+  // Tests for the kerberos-add-account-dialog element.
+  suite('KerberosAddAccountTests', function() {
+    let browserProxy = null;
+    let dialog = null;
+    let username = null;
+    let password = null;
+    let addButton = null;
+    let generalError = null;
+
+    setup(function() {
+      browserProxy = new TestKerberosAccountsBrowserProxy();
+      settings.KerberosAccountsBrowserProxyImpl.instance_ = browserProxy;
+      PolymerTest.clearBody();
+
+      dialog = document.createElement('kerberos-add-account-dialog');
+      document.body.appendChild(dialog);
+
+      username = dialog.$.username;
+      assertTrue(!!username);
+
+      password = dialog.$.password;
+      assertTrue(!!password);
+
+      addButton = dialog.$$('.action-button');
+      assertTrue(!!addButton);
+
+      generalError = dialog.$['general-error-message'];
+      assertTrue(!!generalError);
+    });
+
+    teardown(function() {
+      dialog.remove();
+    });
+
+    // Sets |error| as error result for addAccount(), simulates a click on the
+    // addAccount button and checks that |errorElement| has an non-empty
+    // innerText value afterwards.
+    function checkAddAccountError(error, errorElement) {
+      Polymer.dom.flush();
+      assertEquals(0, errorElement.innerText.length);
+      browserProxy.addAccountError = error;
+      addButton.click();
+      return browserProxy.whenCalled('addAccount').then(function() {
+        Polymer.dom.flush();
+        assertNotEquals(0, errorElement.innerText.length);
+      });
+    }
+
+    // The username input field is not disabled by default.
+    test('UsernameFieldNotDisabledByDefault', function() {
+      assertFalse(username.disabled);
+    });
+
+    // The username input field is disabled if a username is preset before the
+    // dialog is appended to the document.
+    test('UsernameFieldDisabledIfPreset', function() {
+      const newDialog = document.createElement('kerberos-add-account-dialog');
+      newDialog.username = 'user';
+      document.body.appendChild(newDialog);
+      assertTrue(newDialog.$.username.disabled);
+    });
+
+    // By clicking the "Add account", the username and password values are
+    // passed to the 'addAccount' browser proxy method.
+    test('AddButtonPassesCredentials', function() {
+      const EXPECTED_USER = 'testuser';
+      const EXPECTED_PASS = 'testpass';
+      username.value = EXPECTED_USER;
+      password.value = EXPECTED_PASS;
+      assertFalse(addButton.disabled);
+      addButton.click();
+      return browserProxy.whenCalled('addAccount').then(function(args) {
+        assertEquals(EXPECTED_USER, args[0]);
+        assertEquals(EXPECTED_PASS, args[1]);
+      });
+    });
+
+    // While an account is being added, the "Add account" is disabled.
+    test('AddButtonDisableWhileInProgress', function() {
+      assertFalse(addButton.disabled);
+      addButton.click();
+      assertTrue(addButton.disabled);
+      return browserProxy.whenCalled('addAccount').then(function(args) {
+        assertFalse(addButton.disabled);
+      });
+    });
+
+    // addAccount: KerberosErrorType.kNetworkProblem spawns a general error.
+    test('AddAccountError_NetworkProblem', function() {
+      checkAddAccountError(
+          settings.KerberosErrorType.kNetworkProblem, generalError);
+    });
+
+    // addAccount: KerberosErrorType.kParsePrincipalFailed spawns a username
+    // error.
+    test('AddAccountError_ParsePrincipalFailed', function() {
+      checkAddAccountError(
+          settings.KerberosErrorType.kParsePrincipalFailed, username.$.error);
+    });
+
+    // addAccount: KerberosErrorType.kBadPrincipal spawns a username error.
+    test('AddAccountError_BadPrincipal', function() {
+      checkAddAccountError(
+          settings.KerberosErrorType.kBadPrincipal, username.$.error);
+    });
+
+    // addAccount: KerberosErrorType.kContactingKdcFailed spawns a username
+    // error.
+    test('AddAccountError_ContactingKdcFailed', function() {
+      checkAddAccountError(
+          settings.KerberosErrorType.kContactingKdcFailed, username.$.error);
+    });
+
+    // addAccount: KerberosErrorType.kBadPassword spawns a password error.
+    test('AddAccountError_BadPassword', function() {
+      checkAddAccountError(
+          settings.KerberosErrorType.kBadPassword, password.$.error);
+    });
+
+    // addAccount: KerberosErrorType.kPasswordExpired spawns a password error.
+    test('AddAccountError_PasswordExpired', function() {
+      checkAddAccountError(
+          settings.KerberosErrorType.kPasswordExpired, password.$.error);
+    });
+
+    // addAccount: KerberosErrorType.kKdcDoesNotSupportEncryptionType spawns a
+    // general error.
+    test('AddAccountError_KdcDoesNotSupportEncryptionType', function() {
+      checkAddAccountError(
+          settings.KerberosErrorType.kKdcDoesNotSupportEncryptionType,
+          generalError);
+    });
+
+    // addAccount: KerberosErrorType.kUnknown spawns a general error.
+    test('AddAccountError_Unknown', function() {
+      checkAddAccountError(settings.KerberosErrorType.kUnknown, generalError);
+    });
+  });
+});
\ No newline at end of file
diff --git a/chromeos/CHROMEOS_LKGM b/chromeos/CHROMEOS_LKGM
index f0e838e..3c7ff88f 100644
--- a/chromeos/CHROMEOS_LKGM
+++ b/chromeos/CHROMEOS_LKGM
@@ -1 +1 @@
-12204.0.0
\ No newline at end of file
+12216.0.0
\ No newline at end of file
diff --git a/chromeos/constants/chromeos_features.cc b/chromeos/constants/chromeos_features.cc
index ae129e4..5902fca 100644
--- a/chromeos/constants/chromeos_features.cc
+++ b/chromeos/constants/chromeos_features.cc
@@ -51,9 +51,9 @@
 const base::Feature kEnableFileManagerFeedbackPanel{
     "EnableFeedbackPanel", base::FEATURE_DISABLED_BY_DEFAULT};
 
-// Enable the piex-wasm module for raw image extraction. Offical builds only.
+// Enable the piex-wasm module for raw image preview image extraction.
 const base::Feature kEnableFileManagerPiexWasm{
-    "PiexWasm", base::FEATURE_DISABLED_BY_DEFAULT};
+    "PiexWasm", base::FEATURE_ENABLED_BY_DEFAULT};
 
 // Enables or disables web push for background notifications in
 // Android Messages Integration on Chrome OS.
diff --git a/chromeos/dbus/concierge_client.cc b/chromeos/dbus/concierge_client.cc
index b1f43c9..d482f2e 100644
--- a/chromeos/dbus/concierge_client.cc
+++ b/chromeos/dbus/concierge_client.cc
@@ -117,6 +117,28 @@
                        weak_ptr_factory_.GetWeakPtr(), std::move(callback)));
   }
 
+  void CancelDiskImageOperation(
+      const vm_tools::concierge::CancelDiskImageRequest& request,
+      DBusMethodCallback<vm_tools::concierge::CancelDiskImageResponse> callback)
+      override {
+    dbus::MethodCall method_call(vm_tools::concierge::kVmConciergeInterface,
+                                 vm_tools::concierge::kCancelDiskImageMethod);
+    dbus::MessageWriter writer(&method_call);
+
+    if (!writer.AppendProtoAsArrayOfBytes(request)) {
+      LOG(ERROR) << "Failed to encode CancelDiskImageRequest protobuf";
+      base::ThreadTaskRunnerHandle::Get()->PostTask(
+          FROM_HERE, base::BindOnce(std::move(callback), base::nullopt));
+      return;
+    }
+
+    concierge_proxy_->CallMethod(
+        &method_call, dbus::ObjectProxy::TIMEOUT_USE_DEFAULT,
+        base::BindOnce(&ConciergeClientImpl::OnDBusProtoResponse<
+                           vm_tools::concierge::CancelDiskImageResponse>,
+                       weak_ptr_factory_.GetWeakPtr(), std::move(callback)));
+  }
+
   void DiskImageStatus(
       const vm_tools::concierge::DiskImageStatusRequest& request,
       DBusMethodCallback<vm_tools::concierge::DiskImageStatusResponse> callback)
diff --git a/chromeos/dbus/concierge_client.h b/chromeos/dbus/concierge_client.h
index 9ec5bcdf..f6366f7 100644
--- a/chromeos/dbus/concierge_client.h
+++ b/chromeos/dbus/concierge_client.h
@@ -80,7 +80,7 @@
       DBusMethodCallback<vm_tools::concierge::DestroyDiskImageResponse>
           callback) = 0;
 
-  // Import a VM disk image
+  // Imports a VM disk image.
   // |callback| is called after the method call finishes.
   virtual void ImportDiskImage(
       base::ScopedFD fd,
@@ -88,7 +88,15 @@
       DBusMethodCallback<vm_tools::concierge::ImportDiskImageResponse>
           callback) = 0;
 
-  // Retrieve the status of a disk image operation
+  // Cancels a VM disk image operation (import or export) that is being
+  // executed.
+  // |callback| is called after the method call finishes.
+  virtual void CancelDiskImageOperation(
+      const vm_tools::concierge::CancelDiskImageRequest& request,
+      DBusMethodCallback<vm_tools::concierge::CancelDiskImageResponse>
+          callback) = 0;
+
+  // Retrieves the status of a disk image operation
   // |callback| is called after the method call finishes.
   virtual void DiskImageStatus(
       const vm_tools::concierge::DiskImageStatusRequest& request,
@@ -130,22 +138,22 @@
       DBusMethodCallback<vm_tools::concierge::ContainerSshKeysResponse>
           callback) = 0;
 
-  // Attaches a USB device to a VM
-  // |callback| is called once the method call has finished
+  // Attaches a USB device to a VM.
+  // |callback| is called once the method call has finished.
   virtual void AttachUsbDevice(base::ScopedFD fd,
       const vm_tools::concierge::AttachUsbDeviceRequest& request,
       DBusMethodCallback<vm_tools::concierge::AttachUsbDeviceResponse>
           callback) = 0;
 
-  // Remove a USB device from a VM it's been attached to
-  // |callback| is called once the method call has finished
+  // Removes a USB device from a VM it's been attached to.
+  // |callback| is called once the method call has finished.
   virtual void DetachUsbDevice(
       const vm_tools::concierge::DetachUsbDeviceRequest& request,
       DBusMethodCallback<vm_tools::concierge::DetachUsbDeviceResponse>
           callback) = 0;
 
-  // List all the USB devices currently attached to a given VM
-  // |callback| is called once the method call has finished
+  // Lists all the USB devices currently attached to a given VM.
+  // |callback| is called once the method call has finished.
   virtual void ListUsbDevices(
       const vm_tools::concierge::ListUsbDeviceRequest& request,
       DBusMethodCallback<vm_tools::concierge::ListUsbDeviceResponse>
diff --git a/chromeos/dbus/dbus_clients_browser.cc b/chromeos/dbus/dbus_clients_browser.cc
index 3112330..9546b4a0 100644
--- a/chromeos/dbus/dbus_clients_browser.cc
+++ b/chromeos/dbus/dbus_clients_browser.cc
@@ -101,7 +101,7 @@
   update_engine_client_.reset(UpdateEngineClient::Create(client_impl_type));
   virtual_file_provider_client_ =
       CREATE_DBUS_CLIENT(VirtualFileProviderClient, use_real_clients);
-  vm_plugin_dispatcher_client =
+  vm_plugin_dispatcher_client_ =
       CREATE_DBUS_CLIENT(VmPluginDispatcherClient, use_real_clients);
   wilco_dtc_supportd_client_ =
       CREATE_DBUS_CLIENT(WilcoDtcSupportdClient, use_real_clients);
@@ -131,7 +131,7 @@
   smb_provider_client_->Init(system_bus);
   update_engine_client_->Init(system_bus);
   virtual_file_provider_client_->Init(system_bus);
-  vm_plugin_dispatcher_client->Init(system_bus);
+  vm_plugin_dispatcher_client_->Init(system_bus);
   wilco_dtc_supportd_client_->Init(system_bus);
 }
 
diff --git a/chromeos/dbus/dbus_clients_browser.h b/chromeos/dbus/dbus_clients_browser.h
index b4b78806..ba62632 100644
--- a/chromeos/dbus/dbus_clients_browser.h
+++ b/chromeos/dbus/dbus_clients_browser.h
@@ -72,7 +72,7 @@
   std::unique_ptr<SmbProviderClient> smb_provider_client_;
   std::unique_ptr<UpdateEngineClient> update_engine_client_;
   std::unique_ptr<VirtualFileProviderClient> virtual_file_provider_client_;
-  std::unique_ptr<VmPluginDispatcherClient> vm_plugin_dispatcher_client;
+  std::unique_ptr<VmPluginDispatcherClient> vm_plugin_dispatcher_client_;
   std::unique_ptr<WilcoDtcSupportdClient> wilco_dtc_supportd_client_;
 
   DISALLOW_COPY_AND_ASSIGN(DBusClientsBrowser);
diff --git a/chromeos/dbus/dbus_thread_manager.cc b/chromeos/dbus/dbus_thread_manager.cc
index c5b5c43..ea856f110 100644
--- a/chromeos/dbus/dbus_thread_manager.cc
+++ b/chromeos/dbus/dbus_thread_manager.cc
@@ -235,7 +235,7 @@
 }
 
 VmPluginDispatcherClient* DBusThreadManager::GetVmPluginDispatcherClient() {
-  return clients_browser_ ? clients_browser_->vm_plugin_dispatcher_client.get()
+  return clients_browser_ ? clients_browser_->vm_plugin_dispatcher_client_.get()
                           : nullptr;
 }
 
diff --git a/chromeos/dbus/fake_concierge_client.cc b/chromeos/dbus/fake_concierge_client.cc
index d05e7c5..18517578 100644
--- a/chromeos/dbus/fake_concierge_client.cc
+++ b/chromeos/dbus/fake_concierge_client.cc
@@ -72,6 +72,14 @@
                      weak_ptr_factory_.GetWeakPtr(), std::move(callback)));
 }
 
+void FakeConciergeClient::CancelDiskImageOperation(
+    const vm_tools::concierge::CancelDiskImageRequest& request,
+    DBusMethodCallback<vm_tools::concierge::CancelDiskImageResponse> callback) {
+  base::ThreadTaskRunnerHandle::Get()->PostTask(
+      FROM_HERE,
+      base::BindOnce(std::move(callback), cancel_disk_image_response_));
+}
+
 void FakeConciergeClient::FakeImportCallbacks(
     DBusMethodCallback<vm_tools::concierge::ImportDiskImageResponse> callback) {
   std::move(callback).Run(import_disk_image_response_);
diff --git a/chromeos/dbus/fake_concierge_client.h b/chromeos/dbus/fake_concierge_client.h
index 9b4dee94..cfc0354 100644
--- a/chromeos/dbus/fake_concierge_client.h
+++ b/chromeos/dbus/fake_concierge_client.h
@@ -61,6 +61,13 @@
       DBusMethodCallback<vm_tools::concierge::ImportDiskImageResponse> callback)
       override;
 
+  // Fake version of the method that cancels a VM disk image operation (import
+  // or export).
+  void CancelDiskImageOperation(
+      const vm_tools::concierge::CancelDiskImageRequest& request,
+      DBusMethodCallback<vm_tools::concierge::CancelDiskImageResponse> callback)
+      override;
+
   // Fake version of the method that returns the status of a disk image
   // operation.
   void DiskImageStatus(
@@ -169,6 +176,11 @@
           import_disk_image_response) {
     import_disk_image_response_ = import_disk_image_response;
   }
+  void set_cancel_disk_image_response(
+      const vm_tools::concierge::CancelDiskImageResponse&
+          cancel_disk_image_response) {
+    cancel_disk_image_response_ = cancel_disk_image_response;
+  }
   void set_disk_image_status_response(
       const vm_tools::concierge::DiskImageStatusResponse&
           disk_image_status_response) {
@@ -247,6 +259,7 @@
   vm_tools::concierge::CreateDiskImageResponse create_disk_image_response_;
   vm_tools::concierge::DestroyDiskImageResponse destroy_disk_image_response_;
   vm_tools::concierge::ImportDiskImageResponse import_disk_image_response_;
+  vm_tools::concierge::CancelDiskImageResponse cancel_disk_image_response_;
   vm_tools::concierge::DiskImageStatusResponse disk_image_status_response_;
   vm_tools::concierge::ListVmDisksResponse list_vm_disks_response_;
   vm_tools::concierge::StartVmResponse start_vm_response_;
diff --git a/chromeos/services/network_config/public/cpp/cros_network_config_util.cc b/chromeos/services/network_config/public/cpp/cros_network_config_util.cc
index b7b19437b..e8bcfeb52 100644
--- a/chromeos/services/network_config/public/cpp/cros_network_config_util.cc
+++ b/chromeos/services/network_config/public/cpp/cros_network_config_util.cc
@@ -53,5 +53,28 @@
   return false;
 }
 
+int GetWirelessSignalStrength(const mojom::NetworkStateProperties* network) {
+  switch (network->type) {
+    case mojom::NetworkType::kCellular:
+      return network->cellular->signal_strength;
+    case mojom::NetworkType::kEthernet:
+      return 0;
+    case mojom::NetworkType::kTether:
+      return network->tether->signal_strength;
+    case mojom::NetworkType::kVPN:
+      return 0;
+    case mojom::NetworkType::kWiFi:
+      return network->wifi->signal_strength;
+    case mojom::NetworkType::kWiMAX:
+      return network->wimax->signal_strength;
+    case mojom::NetworkType::kAll:
+    case mojom::NetworkType::kMobile:
+    case mojom::NetworkType::kWireless:
+      break;
+  }
+  NOTREACHED();
+  return 0;
+}
+
 }  // namespace network_config
 }  // namespace chromeos
diff --git a/chromeos/services/network_config/public/cpp/cros_network_config_util.h b/chromeos/services/network_config/public/cpp/cros_network_config_util.h
index 9ba0659..38899ec1 100644
--- a/chromeos/services/network_config/public/cpp/cros_network_config_util.h
+++ b/chromeos/services/network_config/public/cpp/cros_network_config_util.h
@@ -22,6 +22,9 @@
 // Returns true if |connection_state| is in a connected state, including portal.
 bool StateIsConnected(mojom::ConnectionStateType connection_state);
 
+// Returns the signal strength for wireless network types or 0 for other types.
+int GetWirelessSignalStrength(const mojom::NetworkStateProperties* network);
+
 }  // namespace network_config
 }  // namespace chromeos
 
diff --git a/components/BUILD.gn b/components/BUILD.gn
index 6eabe20..ae2242b9 100644
--- a/components/BUILD.gn
+++ b/components/BUILD.gn
@@ -569,7 +569,6 @@
       # a MANUAL component_browsertest.
       sources += [ "dom_distiller/standalone/content_extractor_browsertest.cc" ]
       deps += [
-        "//components/keyed_service/core:test_support",
         "//components/leveldb_proto",
         "//components/leveldb_proto/content:factory",
         "//components/prefs:test_support",
diff --git a/components/arc/common/video_decode_accelerator.mojom b/components/arc/common/video_decode_accelerator.mojom
index 1b5e896..a9350d0 100644
--- a/components/arc/common/video_decode_accelerator.mojom
+++ b/components/arc/common/video_decode_accelerator.mojom
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Next MinVersion: 3
+// Next MinVersion: 4
 
 // This file defines the mojo interface between Android and Chromium for video
 // decoding. Any Mojo callee that returns a value does so by callback.
@@ -132,12 +132,12 @@
 };
 
 // Deprecated method IDs: 0
-// Next method ID: 5
+// Next method ID: 6
 interface VideoDecodeClient {
 
   // Callback to tell client how many and what size of buffers to provide.
   [MinVersion=1]
-  ProvidePictureBuffers@4(PictureBufferFormat format);
+  ProvidePictureBuffersDeprecated@4(PictureBufferFormat format);
 
   // Called to notify the client that |picture| is ready to be displayed.
   // The calls to PictureReady() are in display order and Picture should
@@ -153,4 +153,8 @@
   // The errors in Initialize(), Reset() and Flush(), will not be reported here,
   // but will be returned in its callback function.
   NotifyError@3(VideoDecodeAccelerator.Result error);
+
+  // Callback to tell client how many and what size of buffers to provide.
+  [MinVersion=3]
+  ProvidePictureBuffers@5(PictureBufferFormat format, Rect visible_rect);
 };
diff --git a/components/arc/video_accelerator/gpu_arc_video_decode_accelerator.cc b/components/arc/video_accelerator/gpu_arc_video_decode_accelerator.cc
index b012033..746ed231 100644
--- a/components/arc/video_accelerator/gpu_arc_video_decode_accelerator.cc
+++ b/components/arc/video_accelerator/gpu_arc_video_decode_accelerator.cc
@@ -109,6 +109,7 @@
 
   return true;
 }
+
 }  // namespace
 
 namespace arc {
@@ -120,7 +121,8 @@
     const gpu::GpuPreferences& gpu_preferences,
     scoped_refptr<ProtectedBufferManager> protected_buffer_manager)
     : gpu_preferences_(gpu_preferences),
-      protected_buffer_manager_(std::move(protected_buffer_manager)) {}
+      protected_buffer_manager_(std::move(protected_buffer_manager)),
+      weak_this_factory_(this) {}
 
 GpuArcVideoDecodeAccelerator::~GpuArcVideoDecodeAccelerator() {
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
@@ -128,12 +130,32 @@
     client_count_--;
 }
 
+// TODO(crbug.com/949898): Remove if all clients support a newer
+// ProvidePictureBuffers().
+void GpuArcVideoDecodeAccelerator::GetClientVersion(base::OnceClosure callback,
+                                                    uint32_t version) {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  client_version_ = version;
+  std::move(callback).Run();
+}
+
 void GpuArcVideoDecodeAccelerator::ProvidePictureBuffers(
     uint32_t requested_num_of_buffers,
     media::VideoPixelFormat format,
     uint32_t textures_per_buffer,
     const gfx::Size& dimensions,
     uint32_t texture_target) {
+  NOTIMPLEMENTED() << "VDA must call ProvidePictureBuffersWithVisibleRect() "
+                   << "for ARC++ video decoding";
+}
+
+void GpuArcVideoDecodeAccelerator::ProvidePictureBuffersWithVisibleRect(
+    uint32_t requested_num_of_buffers,
+    media::VideoPixelFormat format,
+    uint32_t textures_per_buffer,
+    const gfx::Size& dimensions,
+    const gfx::Rect& visible_rect,
+    uint32_t texture_target) {
   VLOGF(2);
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
   DCHECK(client_);
@@ -143,7 +165,28 @@
   auto pbf = mojom::PictureBufferFormat::New();
   pbf->min_num_buffers = requested_num_of_buffers;
   pbf->coded_size = dimensions;
-  client_->ProvidePictureBuffers(std::move(pbf));
+
+  // TODO(crbug.com/949898): Remove if all clients support a newer
+  // ProvidePictureBuffers().
+  if (client_version_ == std::numeric_limits<uint32_t>::max()) {
+    // Base::Unretained(this) is safe here. |this| is ensured to be valid when
+    // GetClientVersion is called.
+    auto callback = base::BindOnce(
+        &GpuArcVideoDecodeAccelerator::ProvidePictureBuffersWithVisibleRect,
+        base::Unretained(this), requested_num_of_buffers, format,
+        textures_per_buffer, dimensions, visible_rect, texture_target);
+    client_.QueryVersion(base::BindRepeating(
+        &GpuArcVideoDecodeAccelerator::GetClientVersion,
+        weak_this_factory_.GetWeakPtr(), base::Passed(std::move(callback))));
+    return;
+  }
+
+  if (client_version_ >=
+      ::arc::mojom::VideoDecodeClient::kProvidePictureBuffersMinVersion) {
+    client_->ProvidePictureBuffers(std::move(pbf), visible_rect);
+  } else {
+    client_->ProvidePictureBuffersDeprecated(std::move(pbf));
+  }
 }
 
 void GpuArcVideoDecodeAccelerator::DismissPictureBuffer(
diff --git a/components/arc/video_accelerator/gpu_arc_video_decode_accelerator.h b/components/arc/video_accelerator/gpu_arc_video_decode_accelerator.h
index 10dda69..9e8d37d 100644
--- a/components/arc/video_accelerator/gpu_arc_video_decode_accelerator.h
+++ b/components/arc/video_accelerator/gpu_arc_video_decode_accelerator.h
@@ -46,6 +46,12 @@
                              uint32_t textures_per_buffer,
                              const gfx::Size& dimensions,
                              uint32_t texture_target) override;
+  void ProvidePictureBuffersWithVisibleRect(uint32_t requested_num_of_buffers,
+                                            media::VideoPixelFormat format,
+                                            uint32_t textures_per_buffer,
+                                            const gfx::Size& dimensions,
+                                            const gfx::Rect& visible_rect,
+                                            uint32_t texture_target) override;
   void PictureReady(const media::Picture& picture) override;
   void DismissPictureBuffer(int32_t picture_buffer_id) override;
   void NotifyEndOfBitstreamBuffer(int32_t bitstream_buffer_id) override;
@@ -102,6 +108,10 @@
                      PendingCallback cb,
                      media::VideoDecodeAccelerator* vda);
 
+  // TODO(crbug.com/949898): Remove if all clients support a newer
+  // ProvidePictureBuffers().
+  void GetClientVersion(base::OnceClosure callback, uint32_t version);
+
   // Global counter that keeps track of the number of active clients (i.e., how
   // many VDAs in use by this class).
   // Since this class only works on the same thread, it's safe to access
@@ -146,7 +156,12 @@
   bool secure_mode_ = false;
   size_t output_buffer_count_ = 0;
 
+  uint32_t client_version_ = std::numeric_limits<uint32_t>::max();
+
   THREAD_CHECKER(thread_checker_);
+
+  base::WeakPtrFactory<GpuArcVideoDecodeAccelerator> weak_this_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(GpuArcVideoDecodeAccelerator);
 };
 
diff --git a/components/autofill/core/browser/BUILD.gn b/components/autofill/core/browser/BUILD.gn
index d9f3683..6b29ee3 100644
--- a/components/autofill/core/browser/BUILD.gn
+++ b/components/autofill/core/browser/BUILD.gn
@@ -436,7 +436,6 @@
     "//base/test:test_support",
     "//components/autofill/core/browser",
     "//components/autofill/core/common",
-    "//components/keyed_service/core:test_support",
     "//components/leveldb_proto",
     "//components/os_crypt",
     "//components/os_crypt:test_support",
@@ -592,7 +591,6 @@
     "//base",
     "//base/test:test_support",
     "//components/autofill/core/common",
-    "//components/keyed_service/core:test_support",
     "//components/leveldb_proto",
     "//components/os_crypt",
     "//components/os_crypt:test_support",
diff --git a/components/autofill/core/browser/payments/legacy_strike_database_unittest.cc b/components/autofill/core/browser/payments/legacy_strike_database_unittest.cc
index c23e0c87..559a516 100644
--- a/components/autofill/core/browser/payments/legacy_strike_database_unittest.cc
+++ b/components/autofill/core/browser/payments/legacy_strike_database_unittest.cc
@@ -14,7 +14,6 @@
 #include "base/test/scoped_task_environment.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "components/autofill/core/browser/proto/strike_data.pb.h"
-#include "components/keyed_service/core/test_simple_factory_key.h"
 #include "components/leveldb_proto/public/proto_database.h"
 #include "components/leveldb_proto/public/proto_database_provider.h"
 #include "testing/gtest/include/gtest/gtest.h"
diff --git a/components/autofill/core/browser/payments/strike_database_integrator_test_strike_database_unittest.cc b/components/autofill/core/browser/payments/strike_database_integrator_test_strike_database_unittest.cc
index c8edc9a..645c6b8 100644
--- a/components/autofill/core/browser/payments/strike_database_integrator_test_strike_database_unittest.cc
+++ b/components/autofill/core/browser/payments/strike_database_integrator_test_strike_database_unittest.cc
@@ -15,7 +15,6 @@
 #include "components/autofill/core/browser/proto/strike_data.pb.h"
 #include "components/autofill/core/browser/test_autofill_clock.h"
 #include "components/autofill/core/common/autofill_clock.h"
-#include "components/keyed_service/core/test_simple_factory_key.h"
 #include "components/leveldb_proto/public/proto_database.h"
 #include "components/leveldb_proto/public/proto_database_provider.h"
 #include "testing/gtest/include/gtest/gtest.h"
diff --git a/components/autofill/core/browser/payments/strike_database_unittest.cc b/components/autofill/core/browser/payments/strike_database_unittest.cc
index 8cbc34b..f03e13c 100644
--- a/components/autofill/core/browser/payments/strike_database_unittest.cc
+++ b/components/autofill/core/browser/payments/strike_database_unittest.cc
@@ -14,7 +14,6 @@
 #include "base/test/scoped_task_environment.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "components/autofill/core/browser/proto/strike_data.pb.h"
-#include "components/keyed_service/core/test_simple_factory_key.h"
 #include "components/leveldb_proto/public/proto_database.h"
 #include "components/leveldb_proto/public/proto_database_provider.h"
 #include "testing/gtest/include/gtest/gtest.h"
diff --git a/components/background_task_scheduler/android/java/src/org/chromium/components/background_task_scheduler/BackgroundTaskSchedulerExternalUma.java b/components/background_task_scheduler/android/java/src/org/chromium/components/background_task_scheduler/BackgroundTaskSchedulerExternalUma.java
index 1b27c2b..7ca0403 100644
--- a/components/background_task_scheduler/android/java/src/org/chromium/components/background_task_scheduler/BackgroundTaskSchedulerExternalUma.java
+++ b/components/background_task_scheduler/android/java/src/org/chromium/components/background_task_scheduler/BackgroundTaskSchedulerExternalUma.java
@@ -25,17 +25,25 @@
     /**
      * Report metrics for starting a NativeBackgroundTask. This does not consider tasks that are
      * short-circuited before any work is done.
+     * @param taskId An id from {@link TaskIds}.
+     * @param serviceManagerOnlyMode Whether the task will run in Service Manager Only Mode (Reduced
+     *                               Mode) instead of Full Browser Mode.
      */
-    public static void reportNativeTaskStarted(int taskId) {
-        BackgroundTaskSchedulerUma.getInstance().reportNativeTaskStarted(taskId);
+    public static void reportNativeTaskStarted(int taskId, boolean serviceManagerOnlyMode) {
+        BackgroundTaskSchedulerUma.getInstance().reportNativeTaskStarted(
+                taskId, serviceManagerOnlyMode);
     }
 
     /**
      * Reports metrics that a NativeBackgroundTask has been finished cleanly (i.e., no unexpected
      * exits because of chrome crash or OOM). This includes tasks that have been stopped due to
      * timeout.
+     * @param taskId An id from {@link TaskIds}.
+     * @param serviceManagerOnlyMode Whether the task will run in Service Manager Only Mode (Reduced
+     *                               Mode) instead of Full Browser Mode.
      */
-    public static void reportNativeTaskFinished(int taskId) {
-        BackgroundTaskSchedulerUma.getInstance().reportNativeTaskFinished(taskId);
+    public static void reportNativeTaskFinished(int taskId, boolean serviceManagerOnlyMode) {
+        BackgroundTaskSchedulerUma.getInstance().reportNativeTaskFinished(
+                taskId, serviceManagerOnlyMode);
     }
 }
\ No newline at end of file
diff --git a/components/background_task_scheduler/android/java/src/org/chromium/components/background_task_scheduler/BackgroundTaskSchedulerUma.java b/components/background_task_scheduler/android/java/src/org/chromium/components/background_task_scheduler/BackgroundTaskSchedulerUma.java
index 9c738e3..500522b 100644
--- a/components/background_task_scheduler/android/java/src/org/chromium/components/background_task_scheduler/BackgroundTaskSchedulerUma.java
+++ b/components/background_task_scheduler/android/java/src/org/chromium/components/background_task_scheduler/BackgroundTaskSchedulerUma.java
@@ -154,7 +154,12 @@
         cacheEvent("Android.BackgroundTaskScheduler.TaskStopped", toUmaEnumValueFromTaskId(taskId));
     }
 
-    /** Reports metrics for when a NativeBackgroundTask loads the native library. */
+    /**
+     * Reports metrics for when a NativeBackgroundTask loads the native library.
+     * @param taskId An id from {@link TaskIds}.
+     * @param serviceManagerOnlyMode Whether the task will start native in Service Manager Only Mode
+     *                              (Reduced Mode) instead of Full Browser Mode.
+     */
     public void reportTaskStartedNative(int taskId, boolean serviceManagerOnlyMode) {
         int umaEnumValue = toUmaEnumValueFromTaskId(taskId);
         cacheEvent("Android.BackgroundTaskScheduler.TaskLoadedNative", umaEnumValue);
@@ -170,18 +175,36 @@
     /**
      * Report metrics for starting a NativeBackgroundTask. This does not consider tasks that are
      * short-circuited before any work is done.
+     * @param taskId An id from {@link TaskIds}.
+     * @param serviceManagerOnlyMode Whether the task will run in Service Manager Only Mode (Reduced
+     *                               Mode) instead of Full Browser Mode.
      */
-    public void reportNativeTaskStarted(int taskId) {
-        cacheEvent("Android.NativeBackgroundTask.TaskStarted", toUmaEnumValueFromTaskId(taskId));
+    public void reportNativeTaskStarted(int taskId, boolean serviceManagerOnlyMode) {
+        int umaEnumValue = toUmaEnumValueFromTaskId(taskId);
+        cacheEvent("Android.NativeBackgroundTask.TaskStarted", umaEnumValue);
+        if (serviceManagerOnlyMode) {
+            cacheEvent("Android.NativeBackgroundTask.TaskStarted.ReducedMode", umaEnumValue);
+        } else {
+            cacheEvent("Android.NativeBackgroundTask.TaskStarted.FullBrowser", umaEnumValue);
+        }
     }
 
     /**
      * Reports metrics that a NativeBackgroundTask has been finished cleanly (i.e., no unexpected
      * exits because of chrome crash or OOM). This includes tasks that have been stopped due to
      * timeout.
+     * @param taskId An id from {@link TaskIds}.
+     * @param serviceManagerOnlyMode Whether the task will run in Service Manager Only Mode (Reduced
+     *                               Mode) instead of Full Browser Mode.
      */
-    public void reportNativeTaskFinished(int taskId) {
-        cacheEvent("Android.NativeBackgroundTask.TaskFinished", toUmaEnumValueFromTaskId(taskId));
+    public void reportNativeTaskFinished(int taskId, boolean serviceManagerOnlyMode) {
+        int umaEnumValue = toUmaEnumValueFromTaskId(taskId);
+        cacheEvent("Android.NativeBackgroundTask.TaskFinished", umaEnumValue);
+        if (serviceManagerOnlyMode) {
+            cacheEvent("Android.NativeBackgroundTask.TaskFinished.ReducedMode", umaEnumValue);
+        } else {
+            cacheEvent("Android.NativeBackgroundTask.TaskFinished.FullBrowser", umaEnumValue);
+        }
     }
 
     /** Method that actually invokes histogram recording. Extracted for testing. */
diff --git a/components/background_task_scheduler/android/junit/src/org/chromium/components/background_task_scheduler/BackgroundTaskSchedulerUmaTest.java b/components/background_task_scheduler/android/junit/src/org/chromium/components/background_task_scheduler/BackgroundTaskSchedulerUmaTest.java
index 10dc187..69a8b3d 100644
--- a/components/background_task_scheduler/android/junit/src/org/chromium/components/background_task_scheduler/BackgroundTaskSchedulerUmaTest.java
+++ b/components/background_task_scheduler/android/junit/src/org/chromium/components/background_task_scheduler/BackgroundTaskSchedulerUmaTest.java
@@ -254,4 +254,72 @@
                 .cacheEvent(eq("Android.BackgroundTaskScheduler.TaskLoadedNative.FullBrowser"),
                         eq(BackgroundTaskSchedulerUma.BACKGROUND_TASK_DOWNLOAD_SERVICE));
     }
+
+    @Test
+    @Feature({"BackgroundTaskScheduler"})
+    public void testReportNativeTaskStartedFullBrowser() {
+        doNothing().when(mUmaSpy).cacheEvent(anyString(), anyInt());
+        BackgroundTaskSchedulerExternalUma.reportNativeTaskStarted(
+                TaskIds.DOWNLOAD_SERVICE_JOB_ID, false);
+        verify(mUmaSpy, times(1))
+                .cacheEvent(eq("Android.NativeBackgroundTask.TaskStarted"),
+                        eq(BackgroundTaskSchedulerUma.BACKGROUND_TASK_DOWNLOAD_SERVICE));
+        verify(mUmaSpy, never())
+                .cacheEvent(eq("Android.NativeBackgroundTask.TaskStarted.ReducedMode"),
+                        eq(BackgroundTaskSchedulerUma.BACKGROUND_TASK_DOWNLOAD_SERVICE));
+        verify(mUmaSpy, times(1))
+                .cacheEvent(eq("Android.NativeBackgroundTask.TaskStarted.FullBrowser"),
+                        eq(BackgroundTaskSchedulerUma.BACKGROUND_TASK_DOWNLOAD_SERVICE));
+    }
+
+    @Test
+    @Feature({"BackgroundTaskScheduler"})
+    public void testReportNativeTaskStartedReducedMode() {
+        doNothing().when(mUmaSpy).cacheEvent(anyString(), anyInt());
+        BackgroundTaskSchedulerExternalUma.reportNativeTaskStarted(
+                TaskIds.DOWNLOAD_SERVICE_JOB_ID, true);
+        verify(mUmaSpy, times(1))
+                .cacheEvent(eq("Android.NativeBackgroundTask.TaskStarted"),
+                        eq(BackgroundTaskSchedulerUma.BACKGROUND_TASK_DOWNLOAD_SERVICE));
+        verify(mUmaSpy, times(1))
+                .cacheEvent(eq("Android.NativeBackgroundTask.TaskStarted.ReducedMode"),
+                        eq(BackgroundTaskSchedulerUma.BACKGROUND_TASK_DOWNLOAD_SERVICE));
+        verify(mUmaSpy, never())
+                .cacheEvent(eq("Android.NativeBackgroundTask.TaskStarted.FullBrowser"),
+                        eq(BackgroundTaskSchedulerUma.BACKGROUND_TASK_DOWNLOAD_SERVICE));
+    }
+
+    @Test
+    @Feature({"BackgroundTaskScheduler"})
+    public void testReportNativeTaskFinishedFullBrowser() {
+        doNothing().when(mUmaSpy).cacheEvent(anyString(), anyInt());
+        BackgroundTaskSchedulerExternalUma.reportNativeTaskFinished(
+                TaskIds.DOWNLOAD_SERVICE_JOB_ID, false);
+        verify(mUmaSpy, times(1))
+                .cacheEvent(eq("Android.NativeBackgroundTask.TaskFinished"),
+                        eq(BackgroundTaskSchedulerUma.BACKGROUND_TASK_DOWNLOAD_SERVICE));
+        verify(mUmaSpy, never())
+                .cacheEvent(eq("Android.NativeBackgroundTask.TaskFinished.ReducedMode"),
+                        eq(BackgroundTaskSchedulerUma.BACKGROUND_TASK_DOWNLOAD_SERVICE));
+        verify(mUmaSpy, times(1))
+                .cacheEvent(eq("Android.NativeBackgroundTask.TaskFinished.FullBrowser"),
+                        eq(BackgroundTaskSchedulerUma.BACKGROUND_TASK_DOWNLOAD_SERVICE));
+    }
+
+    @Test
+    @Feature({"BackgroundTaskScheduler"})
+    public void testReportNativeTaskFinishedReducedMode() {
+        doNothing().when(mUmaSpy).cacheEvent(anyString(), anyInt());
+        BackgroundTaskSchedulerExternalUma.reportNativeTaskFinished(
+                TaskIds.DOWNLOAD_SERVICE_JOB_ID, true);
+        verify(mUmaSpy, times(1))
+                .cacheEvent(eq("Android.NativeBackgroundTask.TaskFinished"),
+                        eq(BackgroundTaskSchedulerUma.BACKGROUND_TASK_DOWNLOAD_SERVICE));
+        verify(mUmaSpy, times(1))
+                .cacheEvent(eq("Android.NativeBackgroundTask.TaskFinished.ReducedMode"),
+                        eq(BackgroundTaskSchedulerUma.BACKGROUND_TASK_DOWNLOAD_SERVICE));
+        verify(mUmaSpy, never())
+                .cacheEvent(eq("Android.NativeBackgroundTask.TaskFinished.FullBrowser"),
+                        eq(BackgroundTaskSchedulerUma.BACKGROUND_TASK_DOWNLOAD_SERVICE));
+    }
 }
diff --git a/components/bookmarks/browser/bookmark_client.cc b/components/bookmarks/browser/bookmark_client.cc
index a031ee7..c33d0ae 100644
--- a/components/bookmarks/browser/bookmark_client.cc
+++ b/components/bookmarks/browser/bookmark_client.cc
@@ -17,7 +17,7 @@
 base::CancelableTaskTracker::TaskId BookmarkClient::GetFaviconImageForPageURL(
     const GURL& page_url,
     favicon_base::IconType type,
-    const favicon_base::FaviconImageCallback& callback,
+    favicon_base::FaviconImageCallback callback,
     base::CancelableTaskTracker* tracker) {
   return base::CancelableTaskTracker::kBadTaskId;
 }
diff --git a/components/bookmarks/browser/bookmark_client.h b/components/bookmarks/browser/bookmark_client.h
index a999669..a537bc5 100644
--- a/components/bookmarks/browser/bookmark_client.h
+++ b/components/bookmarks/browser/bookmark_client.h
@@ -54,7 +54,7 @@
   virtual base::CancelableTaskTracker::TaskId GetFaviconImageForPageURL(
       const GURL& page_url,
       favicon_base::IconType type,
-      const favicon_base::FaviconImageCallback& callback,
+      favicon_base::FaviconImageCallback callback,
       base::CancelableTaskTracker* tracker);
 
   // Returns true if the embedder supports typed count for URL.
diff --git a/components/browser_sync/profile_sync_components_factory_impl.cc b/components/browser_sync/profile_sync_components_factory_impl.cc
index 9cd48ac..a4cf6436 100644
--- a/components/browser_sync/profile_sync_components_factory_impl.cc
+++ b/components/browser_sync/profile_sync_components_factory_impl.cc
@@ -313,19 +313,13 @@
   }
 
   if (!disabled_types.Has(syncer::PREFERENCES)) {
-    if (override_prefs_controller_to_uss_for_test_) {
-      controllers.push_back(CreateModelTypeControllerForModelRunningOnUIThread(
-          syncer::PREFERENCES));
-    } else {
-      controllers.push_back(
-          std::make_unique<SyncableServiceBasedModelTypeController>(
-              syncer::PREFERENCES,
-              sync_client_->GetModelTypeStoreService()->GetStoreFactory(),
-              base::BindOnce(&syncer::SyncClient::GetSyncableServiceForType,
-                             base::Unretained(sync_client_),
-                             syncer::PREFERENCES),
-              dump_stack));
-    }
+    controllers.push_back(
+        std::make_unique<SyncableServiceBasedModelTypeController>(
+            syncer::PREFERENCES,
+            sync_client_->GetModelTypeStoreService()->GetStoreFactory(),
+            base::BindOnce(&syncer::SyncClient::GetSyncableServiceForType,
+                           base::Unretained(sync_client_), syncer::PREFERENCES),
+            dump_stack));
   }
 
   if (!disabled_types.Has(syncer::PRIORITY_PREFERENCES)) {
@@ -355,14 +349,10 @@
   }
 
   if (!disabled_types.Has(syncer::USER_EVENTS)) {
-    // TODO(crbug.com/867801): Switch to forwarding delegate.
     controllers.push_back(
         std::make_unique<syncer::UserEventModelTypeController>(
             sync_service,
-            std::make_unique<syncer::ForwardingModelTypeControllerDelegate>(
-                sync_client_
-                    ->GetControllerDelegateForModelType(syncer::USER_EVENTS)
-                    .get())));
+            CreateForwardingControllerDelegate(syncer::USER_EVENTS)));
   }
 
   if (!disabled_types.Has(syncer::SEND_TAB_TO_SELF) &&
@@ -379,22 +369,12 @@
   // Forward both on-disk and in-memory storage modes to the same delegate,
   // since behavior for USER_CONSENTS does not differ (they are always
   // persisted).
-  // TODO(crbug.com/867801): Replace the proxy delegates below with a simpler
-  // forwarding delegate that involves no posting of tasks.
   controllers.push_back(std::make_unique<ModelTypeController>(
       syncer::USER_CONSENTS,
       /*delegate_on_disk=*/
-      std::make_unique<syncer::ProxyModelTypeControllerDelegate>(
-          ui_thread_, base::BindRepeating(&browser_sync::BrowserSyncClient::
-                                              GetControllerDelegateForModelType,
-                                          base::Unretained(sync_client_),
-                                          syncer::USER_CONSENTS)),
+      CreateForwardingControllerDelegate(syncer::USER_CONSENTS),
       /*delegate_in_memory=*/
-      std::make_unique<syncer::ProxyModelTypeControllerDelegate>(
-          ui_thread_, base::BindRepeating(&browser_sync::BrowserSyncClient::
-                                              GetControllerDelegateForModelType,
-                                          base::Unretained(sync_client_),
-                                          syncer::USER_CONSENTS))));
+      CreateForwardingControllerDelegate(syncer::USER_CONSENTS)));
 
   return controllers;
 }
@@ -447,24 +427,17 @@
   return components;
 }
 
-// static
-void ProfileSyncComponentsFactoryImpl::OverridePrefsForUssTest(bool use_uss) {
-  override_prefs_controller_to_uss_for_test_ = use_uss;
+std::unique_ptr<syncer::ModelTypeControllerDelegate>
+ProfileSyncComponentsFactoryImpl::CreateForwardingControllerDelegate(
+    syncer::ModelType type) {
+  return std::make_unique<syncer::ForwardingModelTypeControllerDelegate>(
+      sync_client_->GetControllerDelegateForModelType(type).get());
 }
 
-bool ProfileSyncComponentsFactoryImpl::
-    override_prefs_controller_to_uss_for_test_ = false;
-
 std::unique_ptr<ModelTypeController> ProfileSyncComponentsFactoryImpl::
     CreateModelTypeControllerForModelRunningOnUIThread(syncer::ModelType type) {
-  // TODO(crbug.com/867801): Replace the proxy delegate below with a simpler
-  // forwarding delegate that involves no posting of tasks.
   return std::make_unique<ModelTypeController>(
-      type, std::make_unique<syncer::ProxyModelTypeControllerDelegate>(
-                ui_thread_,
-                base::BindRepeating(&browser_sync::BrowserSyncClient::
-                                        GetControllerDelegateForModelType,
-                                    base::Unretained(sync_client_), type)));
+      type, CreateForwardingControllerDelegate(type));
 }
 
 std::unique_ptr<ModelTypeController>
diff --git a/components/browser_sync/profile_sync_components_factory_impl.h b/components/browser_sync/profile_sync_components_factory_impl.h
index c92badf..73f9459 100644
--- a/components/browser_sync/profile_sync_components_factory_impl.h
+++ b/components/browser_sync/profile_sync_components_factory_impl.h
@@ -79,16 +79,17 @@
       std::unique_ptr<syncer::DataTypeErrorHandler> error_handler,
       syncer::UserShare* user_share) override;
 
-  // Sets a bit that determines whether PREFERENCES should be registered with a
-  // ModelTypeController for testing purposes.
-  static void OverridePrefsForUssTest(bool use_uss);
-
  private:
   // Factory function for ModelTypeController instances for models living on
   // |ui_thread_|.
   std::unique_ptr<syncer::ModelTypeController>
   CreateModelTypeControllerForModelRunningOnUIThread(syncer::ModelType type);
 
+  // Factory function for ModelTypeControllerDelegate instances for models
+  // living in |ui_thread_| that have their delegate accessible via SyncClient.
+  std::unique_ptr<syncer::ModelTypeControllerDelegate>
+  CreateForwardingControllerDelegate(syncer::ModelType type);
+
   // Factory function for ModelTypeController instances for wallet-related
   // datatypes, which live in |db_thread_| and have a delegate accessible via
   // AutofillWebDataService.
@@ -121,9 +122,6 @@
   const scoped_refptr<password_manager::PasswordStore> password_store_;
   sync_bookmarks::BookmarkSyncService* const bookmark_sync_service_;
 
-  // Whether to override PREFERENCES to use USS.
-  static bool override_prefs_controller_to_uss_for_test_;
-
   DISALLOW_COPY_AND_ASSIGN(ProfileSyncComponentsFactoryImpl);
 };
 
diff --git a/components/cast_channel/cast_message_handler.cc b/components/cast_channel/cast_message_handler.cc
index 23838b4..3eb5f28 100644
--- a/components/cast_channel/cast_message_handler.cc
+++ b/components/cast_channel/cast_message_handler.cc
@@ -326,8 +326,8 @@
     int channel_id,
     const std::string& source_id,
     const std::string& destination_id,
-    std::unique_ptr<base::Value> payload) {
-  if (!payload->is_dict()) {
+    base::Value payload) {
+  if (!payload.is_dict()) {
     ReportParseError("Parsed message not a dictionary");
     return;
   }
@@ -339,16 +339,16 @@
     return;
   }
 
-  base::Optional<int> request_id = GetRequestIdFromResponse(*payload);
+  base::Optional<int> request_id = GetRequestIdFromResponse(payload);
   if (request_id) {
     auto requests_it = pending_requests_.find(channel_id);
     if (requests_it != pending_requests_.end())
-      requests_it->second->HandlePendingRequest(*request_id, *payload);
+      requests_it->second->HandlePendingRequest(*request_id, payload);
   }
 
-  CastMessageType type = ParseMessageTypeFromPayload(*payload);
+  CastMessageType type = ParseMessageTypeFromPayload(payload);
   if (type == CastMessageType::kOther) {
-    DVLOG(2) << "Unknown message type: " << *payload;
+    DVLOG(2) << "Unknown message type: " << payload;
     return;
   }
 
@@ -359,7 +359,7 @@
     return;
   }
 
-  InternalMessage internal_message(type, std::move(*payload));
+  InternalMessage internal_message(type, std::move(payload));
   for (auto& observer : observers_)
     observer.OnInternalMessage(channel_id, internal_message);
 }
diff --git a/components/cast_channel/cast_message_handler.h b/components/cast_channel/cast_message_handler.h
index 8c4407b..877ee9e 100644
--- a/components/cast_channel/cast_message_handler.h
+++ b/components/cast_channel/cast_message_handler.h
@@ -280,7 +280,7 @@
   void HandleCastInternalMessage(int channel_id,
                                  const std::string& source_id,
                                  const std::string& destination_id,
-                                 std::unique_ptr<base::Value> payload);
+                                 base::Value payload);
 
   // Set of pending requests keyed by socket ID.
   base::flat_map<int, std::unique_ptr<PendingRequests>> pending_requests_;
diff --git a/components/cast_channel/cast_message_handler_unittest.cc b/components/cast_channel/cast_message_handler_unittest.cc
index 2139463..944cbea 100644
--- a/components/cast_channel/cast_message_handler_unittest.cc
+++ b/components/cast_channel/cast_message_handler_unittest.cc
@@ -21,7 +21,7 @@
 #include "testing/gtest/include/gtest/gtest.h"
 
 using base::test::IsJson;
-using base::test::ParseJsonDeprecated;
+using base::test::ParseJson;
 using testing::_;
 using testing::AnyNumber;
 using testing::InSequence;
@@ -138,8 +138,7 @@
                                       get_app_availability_callback_.Get());
       handler_.SendSetVolumeRequest(
           channel_id_,
-          *ParseJsonDeprecated(
-              R"({"sessionId": "theSessionId", "type": "SET_VOLUME"})"),
+          ParseJson(R"({"sessionId": "theSessionId", "type": "SET_VOLUME"})"),
           "theSourceId", set_volume_callback_.Get());
     }
     handler_.StopSession(channel_id_, "theSessionId", "theSourceId",
@@ -374,9 +373,8 @@
             "requestId": 1,
             "type": "PLAY",
           })";
-          auto expected =
-              CreateMediaRequest(*ParseJsonDeprecated(expected_body), 1,
-                                 "theSourceId", "theDestinationId");
+          auto expected = CreateMediaRequest(ParseJson(expected_body), 1,
+                                             "theSourceId", "theDestinationId");
           EXPECT_EQ(expected.namespace_(), message.namespace_());
           EXPECT_EQ(expected.source_id(), message.source_id());
           EXPECT_EQ(expected.destination_id(), message.destination_id());
@@ -391,9 +389,8 @@
   std::string message_str = R"({
     "type": "PLAY",
   })";
-  base::Optional<int> request_id =
-      handler_.SendMediaRequest(channel_id_, *ParseJsonDeprecated(message_str),
-                                "theSourceId", "theDestinationId");
+  base::Optional<int> request_id = handler_.SendMediaRequest(
+      channel_id_, ParseJson(message_str), "theSourceId", "theDestinationId");
   EXPECT_EQ(1, request_id);
 }
 
@@ -409,8 +406,8 @@
             "requestId": 1,
             "type": "SET_VOLUME",
           })";
-          auto expected = CreateSetVolumeRequest(
-              *ParseJsonDeprecated(expected_body), 1, "theSourceId");
+          auto expected = CreateSetVolumeRequest(ParseJson(expected_body), 1,
+                                                 "theSourceId");
           EXPECT_EQ(expected.namespace_(), message.namespace_());
           EXPECT_EQ(expected.source_id(), message.source_id());
           EXPECT_EQ(expected.destination_id(), message.destination_id());
@@ -426,7 +423,7 @@
     "sessionId": "theSessionId",
     "type": "SET_VOLUME",
   })";
-  handler_.SendSetVolumeRequest(channel_id_, *ParseJsonDeprecated(message_str),
+  handler_.SendSetVolumeRequest(channel_id_, ParseJson(message_str),
                                 "theSourceId", base::DoNothing::Once<Result>());
 }
 
@@ -471,7 +468,7 @@
 
   // Handle pending launch session request.
   handler_.HandleCastInternalMessage(channel_id_, "theSourceId",
-                                     "theDestinationId", ParseJsonDeprecated(R"(
+                                     "theDestinationId", ParseJson(R"(
       {
         "requestId": 1,
         "type": "RECEIVER_STATUS",
@@ -480,29 +477,29 @@
 
   // Handle both pending get app availability requests.
   handler_.HandleCastInternalMessage(channel_id_, "theSourceId",
-                                     "theDestinationId", ParseJsonDeprecated(R"(
+                                     "theDestinationId", ParseJson(R"(
       {
         "requestId": 2,
         "availability": {"theAppId": "APP_AVAILABLE"},
       })"));
 
   // Handle pending set volume request (1 of 2).
-  handler_.HandleCastInternalMessage(
-      channel_id_, "theSourceId", "theDestinationId",
-      ParseJsonDeprecated(R"({"requestId": 3})"));
+  handler_.HandleCastInternalMessage(channel_id_, "theSourceId",
+                                     "theDestinationId",
+                                     ParseJson(R"({"requestId": 3})"));
 
   // Skip request_id == 4, since it was used by the second get app availability
   // request.
 
   // Handle pending set volume request (2 of 2).
-  handler_.HandleCastInternalMessage(
-      channel_id_, "theSourceId", "theDestinationId",
-      ParseJsonDeprecated(R"({"requestId": 5})"));
+  handler_.HandleCastInternalMessage(channel_id_, "theSourceId",
+                                     "theDestinationId",
+                                     ParseJson(R"({"requestId": 5})"));
 
   // Handle pending stop session request.
-  handler_.HandleCastInternalMessage(
-      channel_id_, "theSourceId", "theDestinationId",
-      ParseJsonDeprecated(R"({"requestId": 6})"));
+  handler_.HandleCastInternalMessage(channel_id_, "theSourceId",
+                                     "theDestinationId",
+                                     ParseJson(R"({"requestId": 6})"));
 }
 
 // Check that set volume requests time out correctly.
@@ -514,7 +511,7 @@
     "type": "SET_VOLUME",
   })";
   base::MockCallback<ResultCallback> callback;
-  handler_.SendSetVolumeRequest(channel_id_, *ParseJsonDeprecated(message_str),
+  handler_.SendSetVolumeRequest(channel_id_, ParseJson(message_str),
                                 "theSourceId", callback.Get());
   EXPECT_CALL(callback, Run(Result::kFailed));
   thread_bundle_.FastForwardBy(kRequestTimeout);
diff --git a/components/download/internal/common/base_file.cc b/components/download/internal/common/base_file.cc
index d2b4aca..d220a7bc 100644
--- a/components/download/internal/common/base_file.cc
+++ b/components/download/internal/common/base_file.cc
@@ -154,9 +154,10 @@
   if (detached_)
     RecordDownloadCount(APPEND_TO_DETACHED_FILE_COUNT);
 
-  if (!file_.IsValid())
+  if (!file_.IsValid()) {
     return LogInterruptReason("No file stream on append", 0,
                               DOWNLOAD_INTERRUPT_REASON_FILE_FAILED);
+  }
 
   // TODO(phajdan.jr): get rid of this check.
   if (data_len == 0)
@@ -204,6 +205,27 @@
   return DOWNLOAD_INTERRUPT_REASON_NONE;
 }
 
+bool BaseFile::ValidateDataInFile(int64_t offset,
+                                  const char* data,
+                                  size_t data_len) {
+  if (!file_.IsValid())
+    return false;
+
+  // Only validate the first chunk of the file. So |offset| cannot be
+  // larger than bytes received.
+  if (offset > bytes_so_far_)
+    return false;
+
+  if (data_len <= 0)
+    return true;
+
+  std::unique_ptr<char[]> buffer(new char[data_len]);
+  if (file_.Read(offset, buffer.get(), data_len) <= 0)
+    return false;
+
+  return memcmp(data, buffer.get(), data_len) == 0;
+}
+
 DownloadInterruptReason BaseFile::Rename(const base::FilePath& new_path) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DownloadInterruptReason rename_result = DOWNLOAD_INTERRUPT_REASON_NONE;
diff --git a/components/download/internal/common/base_file_unittest.cc b/components/download/internal/common/base_file_unittest.cc
index f86edf1b..921ad87a 100644
--- a/components/download/internal/common/base_file_unittest.cc
+++ b/components/download/internal/common/base_file_unittest.cc
@@ -757,4 +757,25 @@
   ExpectHashValue(kHashOfTestData1To3, base_file_->Finish());
 }
 
+// Test that validating data in a file works.
+TEST_F(BaseFileTest, ValidateDataInFile) {
+  ASSERT_TRUE(InitializeFile());
+  ASSERT_TRUE(AppendDataToFile(kTestData1));
+
+  ASSERT_TRUE(base_file_->ValidateDataInFile(0, "Let's", 5));
+  ASSERT_TRUE(base_file_->ValidateDataInFile(1, "et's ", 5));
+  ASSERT_TRUE(base_file_->ValidateDataInFile(
+      0, "Let's write some data to the file!\n", kTestDataLength1));
+  ASSERT_TRUE(base_file_->ValidateDataInFile(kTestDataLength1 - 1, "\n", 1));
+  ASSERT_FALSE(base_file_->ValidateDataInFile(kTestDataLength1, "\n", 1));
+  ASSERT_FALSE(base_file_->ValidateDataInFile(kTestDataLength1 - 1, "y\n", 2));
+  ASSERT_FALSE(base_file_->ValidateDataInFile(0, "et's ", 5));
+  ASSERT_FALSE(base_file_->ValidateDataInFile(
+      0, "Let's write some data to the file1\n", kTestDataLength1));
+  ASSERT_FALSE(base_file_->ValidateDataInFile(
+      0, "Let's write some data to the file1!\n", kTestDataLength1 + 1));
+
+  base_file_->Finish();
+}
+
 }  // namespace download
diff --git a/components/download/internal/common/download_file_impl.cc b/components/download/internal/common/download_file_impl.cc
index 7d9155e..b56fb8f 100644
--- a/components/download/internal/common/download_file_impl.cc
+++ b/components/download/internal/common/download_file_impl.cc
@@ -129,19 +129,6 @@
     std::unique_ptr<InputStream> stream,
     uint32_t download_id,
     base::WeakPtr<DownloadDestinationObserver> observer)
-    : DownloadFileImpl(std::move(save_info),
-                       default_download_directory,
-                       download_id,
-                       observer) {
-  source_streams_[save_info_->offset] = std::make_unique<SourceStream>(
-      save_info_->offset, save_info_->length, std::move(stream));
-}
-
-DownloadFileImpl::DownloadFileImpl(
-    std::unique_ptr<DownloadSaveInfo> save_info,
-    const base::FilePath& default_download_directory,
-    uint32_t download_id,
-    base::WeakPtr<DownloadDestinationObserver> observer)
     : file_(download_id),
       save_info_(std::move(save_info)),
       default_download_directory_(default_download_directory),
@@ -161,6 +148,9 @@
   TRACE_EVENT_NESTABLE_ASYNC_BEGIN0("download", "DownloadFileActive",
                                     download_id);
 
+  source_streams_[save_info_->offset] = std::make_unique<SourceStream>(
+      save_info_->offset, save_info_->length, std::move(stream));
+
   DETACH_FROM_SEQUENCE(sequence_checker_);
 }
 
diff --git a/components/download/public/common/base_file.h b/components/download/public/common/base_file.h
index d671623..dd8ed1b1 100644
--- a/components/download/public/common/base_file.h
+++ b/components/download/public/common/base_file.h
@@ -114,6 +114,10 @@
                                           const char* data,
                                           size_t data_len);
 
+  // Validates that the content starting from |offset| matches that of |data|
+  // with the given length.
+  bool ValidateDataInFile(int64_t offset, const char* data, size_t data_len);
+
   // Rename the download file. Returns a DownloadInterruptReason indicating the
   // result of the operation. A return code of NONE indicates that the rename
   // was successful. After a failure, the full_path() and in_progress() can be
diff --git a/components/download/public/common/download_file_impl.h b/components/download/public/common/download_file_impl.h
index fbe6142..8c350fb4 100644
--- a/components/download/public/common/download_file_impl.h
+++ b/components/download/public/common/download_file_impl.h
@@ -188,11 +188,6 @@
  private:
   friend class DownloadFileTest;
 
-  DownloadFileImpl(std::unique_ptr<DownloadSaveInfo> save_info,
-                   const base::FilePath& default_downloads_directory,
-                   uint32_t download_id,
-                   base::WeakPtr<DownloadDestinationObserver> observer);
-
   // Options for RenameWithRetryInternal.
   enum RenameOption {
     UNIQUIFY = 1 << 0,  // If there's already a file on disk that conflicts with
diff --git a/components/encrypted_messages/BUILD.gn b/components/encrypted_messages/BUILD.gn
index 49fc5a0..417f26cc 100644
--- a/components/encrypted_messages/BUILD.gn
+++ b/components/encrypted_messages/BUILD.gn
@@ -6,7 +6,6 @@
 
 static_library("encrypted_messages") {
   sources = [
-    "encrypted_message.proto",
     "message_encrypter.cc",
     "message_encrypter.h",
   ]
diff --git a/components/favicon/content/content_favicon_driver_unittest.cc b/components/favicon/content/content_favicon_driver_unittest.cc
index 3d4d6156..5dac5cea 100644
--- a/components/favicon/content/content_favicon_driver_unittest.cc
+++ b/components/favicon/content/content_favicon_driver_unittest.cc
@@ -25,7 +25,6 @@
 namespace favicon {
 namespace {
 
-using testing::ElementsAre;
 using testing::Return;
 using testing::SizeIs;
 using testing::_;
@@ -34,15 +33,30 @@
  protected:
   const std::vector<gfx::Size> kEmptyIconSizes;
   const std::vector<SkBitmap> kEmptyIcons;
-  const std::vector<favicon_base::FaviconRawBitmapResult> kEmptyRawBitmapResult;
   const GURL kPageURL = GURL("http://www.google.com/");
   const GURL kIconURL = GURL("http://www.google.com/favicon.ico");
 
   ContentFaviconDriverTest() {
     ON_CALL(favicon_service_, UpdateFaviconMappingsAndFetch(_, _, _, _, _, _))
-        .WillByDefault(PostReply<6>(kEmptyRawBitmapResult));
+        .WillByDefault([](auto, auto, auto, auto,
+                          favicon_base::FaviconResultsCallback callback,
+                          base::CancelableTaskTracker* tracker) {
+          return tracker->PostTask(
+              base::ThreadTaskRunnerHandle::Get().get(), FROM_HERE,
+              base::BindOnce(
+                  std::move(callback),
+                  std::vector<favicon_base::FaviconRawBitmapResult>()));
+        });
     ON_CALL(favicon_service_, GetFaviconForPageURL(_, _, _, _, _))
-        .WillByDefault(PostReply<5>(kEmptyRawBitmapResult));
+        .WillByDefault([](auto, auto, auto,
+                          favicon_base::FaviconResultsCallback callback,
+                          base::CancelableTaskTracker* tracker) {
+          return tracker->PostTask(
+              base::ThreadTaskRunnerHandle::Get().get(), FROM_HERE,
+              base::BindOnce(
+                  std::move(callback),
+                  std::vector<favicon_base::FaviconRawBitmapResult>()));
+        });
   }
 
   ~ContentFaviconDriverTest() override {}
diff --git a/components/favicon/core/BUILD.gn b/components/favicon/core/BUILD.gn
index 247aa7f..bb3a731b0 100644
--- a/components/favicon/core/BUILD.gn
+++ b/components/favicon/core/BUILD.gn
@@ -18,7 +18,6 @@
     "favicon_request_handler.h",
     "favicon_server_fetcher_params.cc",
     "favicon_server_fetcher_params.h",
-    "favicon_service.cc",
     "favicon_service.h",
     "favicon_service_impl.cc",
     "favicon_service_impl.h",
diff --git a/components/favicon/core/favicon_client.h b/components/favicon/core/favicon_client.h
index 71dce4e..45833c7 100644
--- a/components/favicon/core/favicon_client.h
+++ b/components/favicon/core/favicon_client.h
@@ -34,7 +34,7 @@
   virtual base::CancelableTaskTracker::TaskId GetFaviconForNativeApplicationURL(
       const GURL& url,
       const std::vector<int>& desired_sizes_in_pixel,
-      const favicon_base::FaviconResultsCallback& callback,
+      favicon_base::FaviconResultsCallback callback,
       base::CancelableTaskTracker* tracker) = 0;
 
  private:
diff --git a/components/favicon/core/favicon_handler.cc b/components/favicon/core/favicon_handler.cc
index 330f665..bbf84c2 100644
--- a/components/favicon/core/favicon_handler.cc
+++ b/components/favicon/core/favicon_handler.cc
@@ -628,12 +628,13 @@
 void FaviconHandler::GetFaviconAndUpdateMappingsUnlessIncognito(
     const GURL& icon_url,
     favicon_base::IconType icon_type,
-    const favicon_base::FaviconResultsCallback& callback) {
+    favicon_base::FaviconResultsCallback callback) {
   // We don't know the favicon, but we may have previously downloaded the
   // favicon for another page that shares the same favicon. Ask for the
   // favicon given the favicon URL.
   if (delegate_->IsOffTheRecord()) {
-    service_->GetFavicon(icon_url, icon_type, preferred_icon_size(), callback,
+    service_->GetFavicon(icon_url, icon_type, preferred_icon_size(),
+                         std::move(callback),
                          &cancelable_task_tracker_for_candidates_);
   } else {
     // Ask the history service for the icon. This does two things:
@@ -642,8 +643,8 @@
     //    include the mapping between the page url and the favicon url.
     // This is asynchronous. The history service will call back when done.
     service_->UpdateFaviconMappingsAndFetch(
-        page_urls_, icon_url, icon_type, preferred_icon_size(), callback,
-        &cancelable_task_tracker_for_candidates_);
+        page_urls_, icon_url, icon_type, preferred_icon_size(),
+        std::move(callback), &cancelable_task_tracker_for_candidates_);
   }
 }
 
diff --git a/components/favicon/core/favicon_handler.h b/components/favicon/core/favicon_handler.h
index 5d2d67b..8a1cf2e 100644
--- a/components/favicon/core/favicon_handler.h
+++ b/components/favicon/core/favicon_handler.h
@@ -226,7 +226,7 @@
   void GetFaviconAndUpdateMappingsUnlessIncognito(
       const GURL& icon_url,
       favicon_base::IconType icon_type,
-      const favicon_base::FaviconResultsCallback& callback);
+      favicon_base::FaviconResultsCallback callback);
 
   // See description above class for details.
   void OnFaviconData(const std::vector<favicon_base::FaviconRawBitmapResult>&
diff --git a/components/favicon/core/favicon_handler_unittest.cc b/components/favicon/core/favicon_handler_unittest.cc
index 190cadf..24d2156 100644
--- a/components/favicon/core/favicon_handler_unittest.cc
+++ b/components/favicon/core/favicon_handler_unittest.cc
@@ -371,18 +371,18 @@
       const GURL& icon_url,
       favicon_base::IconType icon_type,
       int desired_size_in_dip,
-      const favicon_base::FaviconResultsCallback& callback,
+      favicon_base::FaviconResultsCallback callback,
       base::CancelableTaskTracker* tracker) {
-    return GetFaviconForPageOrIconURL(icon_url, callback, tracker);
+    return GetFaviconForPageOrIconURL(icon_url, std::move(callback), tracker);
   }
 
   base::CancelableTaskTracker::TaskId GetFaviconForPageURL(
       const GURL& page_url,
       const favicon_base::IconTypeSet& icon_types,
       int desired_size_in_dip,
-      const favicon_base::FaviconResultsCallback& callback,
+      favicon_base::FaviconResultsCallback callback,
       base::CancelableTaskTracker* tracker) {
-    return GetFaviconForPageOrIconURL(page_url, callback, tracker);
+    return GetFaviconForPageOrIconURL(page_url, std::move(callback), tracker);
   }
 
   base::CancelableTaskTracker::TaskId UpdateFaviconMappingsAndFetch(
@@ -390,9 +390,9 @@
       const GURL& icon_url,
       favicon_base::IconType icon_type,
       int desired_size_in_dip,
-      const favicon_base::FaviconResultsCallback& callback,
+      favicon_base::FaviconResultsCallback callback,
       base::CancelableTaskTracker* tracker) {
-    return GetFaviconForPageOrIconURL(icon_url, callback, tracker);
+    return GetFaviconForPageOrIconURL(icon_url, std::move(callback), tracker);
   }
 
   // Disables automatic callback for |url|. This is useful for emulating a
@@ -420,12 +420,12 @@
  private:
   base::CancelableTaskTracker::TaskId GetFaviconForPageOrIconURL(
       const GURL& page_or_icon_url,
-      const favicon_base::FaviconResultsCallback& callback,
+      favicon_base::FaviconResultsCallback callback,
       base::CancelableTaskTracker* tracker) {
     db_requests_.push_back(page_or_icon_url);
 
-    base::Closure bound_callback =
-        base::Bind(callback, results_[page_or_icon_url]);
+    base::OnceClosure bound_callback =
+        base::BindOnce(std::move(callback), results_[page_or_icon_url]);
 
     // In addition to checking the URL against |manual_callback_url_|, we also
     // defer responses if there are already pending responses (i.e. a previous
@@ -434,14 +434,14 @@
     if (page_or_icon_url != manual_callback_url_ &&
         !HasPendingManualCallback()) {
       return tracker->PostTask(base::ThreadTaskRunnerHandle::Get().get(),
-                               FROM_HERE, bound_callback);
+                               FROM_HERE, std::move(bound_callback));
     }
 
     // We use PostTaskAndReply() to cause |callback| being run in the current
     // TaskRunner.
     return tracker->PostTaskAndReply(manual_callback_task_runner_.get(),
                                      FROM_HERE, base::DoNothing(),
-                                     bound_callback);
+                                     std::move(bound_callback));
   }
 
   std::map<GURL, std::vector<favicon_base::FaviconRawBitmapResult>> results_;
diff --git a/components/favicon/core/favicon_request_handler.cc b/components/favicon/core/favicon_request_handler.cc
index a8e6dbdb..09e1789 100644
--- a/components/favicon/core/favicon_request_handler.cc
+++ b/components/favicon/core/favicon_request_handler.cc
@@ -38,7 +38,7 @@
 void FaviconRequestHandler::GetRawFaviconForPageURL(
     const GURL& page_url,
     int desired_size_in_pixel,
-    const favicon_base::FaviconRawBitmapCallback& callback,
+    favicon_base::FaviconRawBitmapCallback callback,
     FaviconRequestOrigin request_origin,
     FaviconService* favicon_service,
     FaviconRequestHandler::SyncedFaviconGetter synced_favicon_getter,
@@ -46,7 +46,7 @@
   if (!favicon_service) {
     RecordFaviconRequestMetric(request_origin,
                                FaviconAvailability::kNotAvailable);
-    callback.Run(favicon_base::FaviconRawBitmapResult());
+    std::move(callback).Run(favicon_base::FaviconRawBitmapResult());
     return;
   }
 
@@ -54,16 +54,16 @@
   favicon_service->GetRawFaviconForPageURL(
       page_url, GetIconTypesForLocalQuery(), desired_size_in_pixel,
       kFallbackToHost,
-      base::BindRepeating(&FaviconRequestHandler::OnBitmapLocalDataAvailable,
-                          weak_ptr_factory_.GetWeakPtr(), page_url,
-                          /*response_callback=*/callback, request_origin,
-                          base::Passed(&synced_favicon_getter)),
+      base::BindOnce(&FaviconRequestHandler::OnBitmapLocalDataAvailable,
+                     weak_ptr_factory_.GetWeakPtr(), page_url,
+                     /*response_callback=*/std::move(callback), request_origin,
+                     std::move(synced_favicon_getter)),
       tracker);
 }
 
 void FaviconRequestHandler::GetFaviconImageForPageURL(
     const GURL& page_url,
-    const favicon_base::FaviconImageCallback& callback,
+    favicon_base::FaviconImageCallback callback,
     FaviconRequestOrigin request_origin,
     FaviconService* favicon_service,
     FaviconRequestHandler::SyncedFaviconGetter synced_favicon_getter,
@@ -71,29 +71,29 @@
   if (!favicon_service) {
     RecordFaviconRequestMetric(request_origin,
                                FaviconAvailability::kNotAvailable);
-    callback.Run(favicon_base::FaviconImageResult());
+    std::move(callback).Run(favicon_base::FaviconImageResult());
     return;
   }
 
   // First attempt to find the icon locally.
   favicon_service->GetFaviconImageForPageURL(
       page_url,
-      base::BindRepeating(&FaviconRequestHandler::OnImageLocalDataAvailable,
-                          weak_ptr_factory_.GetWeakPtr(), page_url,
-                          /*response_callback=*/callback, request_origin,
-                          base::Passed(&synced_favicon_getter)),
+      base::BindOnce(&FaviconRequestHandler::OnImageLocalDataAvailable,
+                     weak_ptr_factory_.GetWeakPtr(), page_url,
+                     /*response_callback=*/std::move(callback), request_origin,
+                     std::move(synced_favicon_getter)),
       tracker);
 }
 
 void FaviconRequestHandler::OnBitmapLocalDataAvailable(
     const GURL& page_url,
-    const favicon_base::FaviconRawBitmapCallback& response_callback,
+    favicon_base::FaviconRawBitmapCallback response_callback,
     FaviconRequestOrigin origin,
     FaviconRequestHandler::SyncedFaviconGetter synced_favicon_getter,
     const favicon_base::FaviconRawBitmapResult& bitmap_result) const {
   if (bitmap_result.is_valid()) {
     RecordFaviconRequestMetric(origin, FaviconAvailability::kLocal);
-    response_callback.Run(bitmap_result);
+    std::move(response_callback).Run(bitmap_result);
     return;
   }
 
@@ -102,24 +102,24 @@
     RecordFaviconRequestMetric(origin, FaviconAvailability::kSync);
     favicon_base::FaviconRawBitmapResult sync_bitmap_result;
     sync_bitmap_result.bitmap_data = sync_bitmap;
-    response_callback.Run(sync_bitmap_result);
+    std::move(response_callback).Run(sync_bitmap_result);
     return;
   }
 
   // If sync does not have the favicon, send empty response.
   RecordFaviconRequestMetric(origin, FaviconAvailability::kNotAvailable);
-  response_callback.Run(favicon_base::FaviconRawBitmapResult());
+  std::move(response_callback).Run(favicon_base::FaviconRawBitmapResult());
 }
 
 void FaviconRequestHandler::OnImageLocalDataAvailable(
     const GURL& page_url,
-    const favicon_base::FaviconImageCallback& response_callback,
+    favicon_base::FaviconImageCallback response_callback,
     FaviconRequestOrigin origin,
     FaviconRequestHandler::SyncedFaviconGetter synced_favicon_getter,
     const favicon_base::FaviconImageResult& image_result) const {
   if (!image_result.image.IsEmpty()) {
     RecordFaviconRequestMetric(origin, FaviconAvailability::kLocal);
-    response_callback.Run(image_result);
+    std::move(response_callback).Run(image_result);
     return;
   }
 
@@ -130,13 +130,13 @@
     // Convert bitmap to image.
     sync_image_result.image =
         gfx::Image::CreateFrom1xPNGBytes(sync_bitmap.get());
-    response_callback.Run(sync_image_result);
+    std::move(response_callback).Run(sync_image_result);
     return;
   }
 
   // If sync does not have the favicon, send empty response.
   RecordFaviconRequestMetric(origin, FaviconAvailability::kNotAvailable);
-  response_callback.Run(favicon_base::FaviconImageResult());
+  std::move(response_callback).Run(favicon_base::FaviconImageResult());
 }
 
 }  // namespace favicon
diff --git a/components/favicon/core/favicon_request_handler.h b/components/favicon/core/favicon_request_handler.h
index 05a14ca..e3abb920 100644
--- a/components/favicon/core/favicon_request_handler.h
+++ b/components/favicon/core/favicon_request_handler.h
@@ -36,24 +36,22 @@
   // Requests favicon bitmap at |page_url| of size |desired_size_in_pixel|.
   // Tries to fetch the icon from local storage and falls back to sync if it's
   // not found.
-  void GetRawFaviconForPageURL(
-      const GURL& page_url,
-      int desired_size_in_pixel,
-      const favicon_base::FaviconRawBitmapCallback& callback,
-      FaviconRequestOrigin request_origin,
-      FaviconService* favicon_service,
-      SyncedFaviconGetter synced_favicon_getter,
-      base::CancelableTaskTracker* tracker);
+  void GetRawFaviconForPageURL(const GURL& page_url,
+                               int desired_size_in_pixel,
+                               favicon_base::FaviconRawBitmapCallback callback,
+                               FaviconRequestOrigin request_origin,
+                               FaviconService* favicon_service,
+                               SyncedFaviconGetter synced_favicon_getter,
+                               base::CancelableTaskTracker* tracker);
 
   // Requests favicon image at |page_url|. Tries to fetch the icon from local
   // storage and falls back to sync if it's not found.
-  void GetFaviconImageForPageURL(
-      const GURL& page_url,
-      const favicon_base::FaviconImageCallback& callback,
-      FaviconRequestOrigin request_origin,
-      FaviconService* favicon_service,
-      SyncedFaviconGetter synced_favicon_getter,
-      base::CancelableTaskTracker* tracker);
+  void GetFaviconImageForPageURL(const GURL& page_url,
+                                 favicon_base::FaviconImageCallback callback,
+                                 FaviconRequestOrigin request_origin,
+                                 FaviconService* favicon_service,
+                                 SyncedFaviconGetter synced_favicon_getter,
+                                 base::CancelableTaskTracker* tracker);
 
  private:
   // Called after the first attempt to retrieve the icon bitmap from local
@@ -61,7 +59,7 @@
   // retrieve from sync.
   void OnBitmapLocalDataAvailable(
       const GURL& page_url,
-      const favicon_base::FaviconRawBitmapCallback& response_callback,
+      favicon_base::FaviconRawBitmapCallback response_callback,
       FaviconRequestOrigin origin,
       SyncedFaviconGetter synced_favicon_getter,
       const favicon_base::FaviconRawBitmapResult& bitmap_result) const;
@@ -71,7 +69,7 @@
   // retrieve from sync.
   void OnImageLocalDataAvailable(
       const GURL& page_url,
-      const favicon_base::FaviconImageCallback& response_callback,
+      favicon_base::FaviconImageCallback response_callback,
       FaviconRequestOrigin origin,
       SyncedFaviconGetter synced_favicon_getter,
       const favicon_base::FaviconImageResult& image_result) const;
diff --git a/components/favicon/core/favicon_request_handler_unittest.cc b/components/favicon/core/favicon_request_handler_unittest.cc
index 21ae3b8..8d849062 100644
--- a/components/favicon/core/favicon_request_handler_unittest.cc
+++ b/components/favicon/core/favicon_request_handler_unittest.cc
@@ -25,7 +25,7 @@
 const char kDummyPageUrl[] = "https://www.example.com";
 const int kDesiredSizeInPixel = 16;
 const SkColor kTestColor = SK_ColorRED;
-base::CancelableTaskTracker::TaskId kDummyTaskId;
+base::CancelableTaskTracker::TaskId kDummyTaskId = 1;
 const FaviconRequestOrigin kOrigin = FaviconRequestOrigin::UNKNOWN;
 
 scoped_refptr<base::RefCountedBytes> CreateTestBitmapBytes() {
@@ -49,16 +49,6 @@
   return result;
 }
 
-ACTION_P(ReturnBitmapFromLocal, bitmap) {
-  arg4.Run(bitmap);
-  return kDummyTaskId;
-}
-
-ACTION_P(ReturnImageFromLocal, image) {
-  arg1.Run(image);
-  return kDummyTaskId;
-}
-
 ACTION_P(ReturnFaviconFromSync, should_return_valid) {
   if (should_return_valid) {
     *arg1 = CreateTestBitmapBytes();
@@ -92,7 +82,11 @@
   EXPECT_CALL(mock_favicon_service_,
               GetRawFaviconForPageURL(GURL(kDummyPageUrl), _,
                                       kDesiredSizeInPixel, _, _, &tracker_))
-      .WillOnce(ReturnBitmapFromLocal(favicon_base::FaviconRawBitmapResult()));
+      .WillOnce([](auto, auto, auto, auto,
+                   favicon_base::FaviconRawBitmapCallback callback, auto) {
+        std::move(callback).Run(favicon_base::FaviconRawBitmapResult());
+        return kDummyTaskId;
+      });
   EXPECT_CALL(synced_favicon_getter_, Run(GURL(kDummyPageUrl), _))
       .WillOnce(ReturnFaviconFromSync(/*should_return_valid=*/false));
   favicon_base::FaviconRawBitmapResult result;
@@ -107,7 +101,11 @@
   EXPECT_CALL(mock_favicon_service_,
               GetRawFaviconForPageURL(GURL(kDummyPageUrl), _,
                                       kDesiredSizeInPixel, _, _, &tracker_))
-      .WillOnce(ReturnBitmapFromLocal(favicon_base::FaviconRawBitmapResult()));
+      .WillOnce([](auto, auto, auto, auto,
+                   favicon_base::FaviconRawBitmapCallback callback, auto) {
+        std::move(callback).Run(favicon_base::FaviconRawBitmapResult());
+        return kDummyTaskId;
+      });
   EXPECT_CALL(synced_favicon_getter_, Run(GURL(kDummyPageUrl), _))
       .WillOnce(ReturnFaviconFromSync(/*should_return_valid=*/true));
   favicon_base::FaviconRawBitmapResult result;
@@ -122,7 +120,11 @@
   EXPECT_CALL(mock_favicon_service_,
               GetRawFaviconForPageURL(GURL(kDummyPageUrl), _,
                                       kDesiredSizeInPixel, _, _, &tracker_))
-      .WillOnce(ReturnBitmapFromLocal(CreateTestBitmapResult()));
+      .WillOnce([](auto, auto, auto, auto,
+                   favicon_base::FaviconRawBitmapCallback callback, auto) {
+        std::move(callback).Run(CreateTestBitmapResult());
+        return kDummyTaskId;
+      });
   EXPECT_CALL(synced_favicon_getter_, Run(GURL(kDummyPageUrl), _)).Times(0);
   favicon_base::FaviconRawBitmapResult result;
   favicon_request_handler_.GetRawFaviconForPageURL(
@@ -135,7 +137,10 @@
 TEST_F(FaviconRequestHandlerTest, ShouldGetEmptyImage) {
   EXPECT_CALL(mock_favicon_service_,
               GetFaviconImageForPageURL(GURL(kDummyPageUrl), _, &tracker_))
-      .WillOnce(ReturnImageFromLocal(favicon_base::FaviconImageResult()));
+      .WillOnce([](auto, favicon_base::FaviconImageCallback callback, auto) {
+        std::move(callback).Run(favicon_base::FaviconImageResult());
+        return kDummyTaskId;
+      });
   EXPECT_CALL(synced_favicon_getter_, Run(GURL(kDummyPageUrl), _))
       .WillOnce(ReturnFaviconFromSync(/*should_return_valid=*/false));
   favicon_base::FaviconImageResult result;
@@ -148,7 +153,10 @@
 TEST_F(FaviconRequestHandlerTest, ShouldGetSyncImage) {
   EXPECT_CALL(mock_favicon_service_,
               GetFaviconImageForPageURL(GURL(kDummyPageUrl), _, &tracker_))
-      .WillOnce(ReturnImageFromLocal(favicon_base::FaviconImageResult()));
+      .WillOnce([](auto, favicon_base::FaviconImageCallback callback, auto) {
+        std::move(callback).Run(favicon_base::FaviconImageResult());
+        return kDummyTaskId;
+      });
   EXPECT_CALL(synced_favicon_getter_, Run(GURL(kDummyPageUrl), _))
       .WillOnce(ReturnFaviconFromSync(/*should_return_valid=*/true));
   favicon_base::FaviconImageResult result;
@@ -161,7 +169,10 @@
 TEST_F(FaviconRequestHandlerTest, ShouldGetLocalImage) {
   EXPECT_CALL(mock_favicon_service_,
               GetFaviconImageForPageURL(GURL(kDummyPageUrl), _, &tracker_))
-      .WillOnce(ReturnImageFromLocal(CreateTestImageResult()));
+      .WillOnce([](auto, favicon_base::FaviconImageCallback callback, auto) {
+        std::move(callback).Run(CreateTestImageResult());
+        return kDummyTaskId;
+      });
   EXPECT_CALL(synced_favicon_getter_, Run(GURL(kDummyPageUrl), _)).Times(0);
   favicon_base::FaviconImageResult result;
   favicon_request_handler_.GetFaviconImageForPageURL(
diff --git a/components/favicon/core/favicon_service.cc b/components/favicon/core/favicon_service.cc
deleted file mode 100644
index c657e6a..0000000
--- a/components/favicon/core/favicon_service.cc
+++ /dev/null
@@ -1,16 +0,0 @@
-// Copyright (c) 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "components/favicon/core/favicon_service.h"
-
-namespace favicon {
-
-// static
-void FaviconService::FaviconResultsCallbackRunner(
-    const favicon_base::FaviconResultsCallback& callback,
-    const std::vector<favicon_base::FaviconRawBitmapResult>* results) {
-  callback.Run(*results);
-}
-
-}  // namespace favicon
diff --git a/components/favicon/core/favicon_service.h b/components/favicon/core/favicon_service.h
index 342fb987..ee0ce0c 100644
--- a/components/favicon/core/favicon_service.h
+++ b/components/favicon/core/favicon_service.h
@@ -24,12 +24,6 @@
 
 class FaviconService : public KeyedService {
  public:
-  // We usually pass parameters with pointer to avoid copy. This function is a
-  // helper to run FaviconResultsCallback with pointer parameters.
-  static void FaviconResultsCallbackRunner(
-      const favicon_base::FaviconResultsCallback& callback,
-      const std::vector<favicon_base::FaviconRawBitmapResult>* results);
-
   //////////////////////////////////////////////////////////////////////////////
   // Methods to request favicon bitmaps from the history backend for |icon_url|.
   // |icon_url| is the URL of the icon itself.
@@ -42,7 +36,7 @@
   // the bitmaps with the best matching sizes are resized.
   virtual base::CancelableTaskTracker::TaskId GetFaviconImage(
       const GURL& icon_url,
-      const favicon_base::FaviconImageCallback& callback,
+      favicon_base::FaviconImageCallback callback,
       base::CancelableTaskTracker* tracker) = 0;
 
   // Requests the favicon at |icon_url| of |icon_type| of size
@@ -54,7 +48,7 @@
       const GURL& icon_url,
       favicon_base::IconType icon_type,
       int desired_size_in_pixel,
-      const favicon_base::FaviconRawBitmapCallback& callback,
+      favicon_base::FaviconRawBitmapCallback callback,
       base::CancelableTaskTracker* tracker) = 0;
 
   // The first argument for |callback| is the set of bitmaps for the passed in
@@ -68,7 +62,7 @@
       const GURL& icon_url,
       favicon_base::IconType icon_type,
       int desired_size_in_dip,
-      const favicon_base::FaviconResultsCallback& callback,
+      favicon_base::FaviconResultsCallback callback,
       base::CancelableTaskTracker* tracker) = 0;
 
   //////////////////////////////////////////////////////////////////////////////
@@ -84,7 +78,7 @@
   // are resized.
   virtual base::CancelableTaskTracker::TaskId GetFaviconImageForPageURL(
       const GURL& page_url,
-      const favicon_base::FaviconImageCallback& callback,
+      favicon_base::FaviconImageCallback callback,
       base::CancelableTaskTracker* tracker) = 0;
 
   // Requests the favicon for the page at |page_url| with one of |icon_types|
@@ -102,7 +96,7 @@
       const favicon_base::IconTypeSet& icon_types,
       int desired_size_in_pixel,
       bool fallback_to_host,
-      const favicon_base::FaviconRawBitmapCallback& callback,
+      favicon_base::FaviconRawBitmapCallback callback,
       base::CancelableTaskTracker* tracker) = 0;
 
   // See HistoryService::GetLargestFaviconForPageURL().
@@ -110,14 +104,14 @@
       const GURL& page_url,
       const std::vector<favicon_base::IconTypeSet>& icon_types,
       int minimum_size_in_pixels,
-      const favicon_base::FaviconRawBitmapCallback& callback,
+      favicon_base::FaviconRawBitmapCallback callback,
       base::CancelableTaskTracker* tracker) = 0;
 
   virtual base::CancelableTaskTracker::TaskId GetFaviconForPageURL(
       const GURL& page_url,
       const favicon_base::IconTypeSet& icon_types,
       int desired_size_in_dip,
-      const favicon_base::FaviconResultsCallback& callback,
+      favicon_base::FaviconResultsCallback callback,
       base::CancelableTaskTracker* tracker) = 0;
 
   // Maps |page_urls| to the favicon at |icon_url| if there is an entry in the
@@ -131,7 +125,7 @@
       const GURL& icon_url,
       favicon_base::IconType icon_type,
       int desired_size_in_dip,
-      const favicon_base::FaviconResultsCallback& callback,
+      favicon_base::FaviconResultsCallback callback,
       base::CancelableTaskTracker* tracker) = 0;
 
   // Deletes favicon mappings for each URL in |page_urls| and their redirects.
@@ -144,7 +138,7 @@
   // returned.
   virtual base::CancelableTaskTracker::TaskId GetLargestRawFaviconForID(
       favicon_base::FaviconID favicon_id,
-      const favicon_base::FaviconRawBitmapCallback& callback,
+      favicon_base::FaviconRawBitmapCallback callback,
       base::CancelableTaskTracker* tracker) = 0;
 
   // Marks all types of favicon for the page as being out of date.
diff --git a/components/favicon/core/favicon_service_impl.cc b/components/favicon/core/favicon_service_impl.cc
index ed2d4c87..c0007f2 100644
--- a/components/favicon/core/favicon_service_impl.cc
+++ b/components/favicon/core/favicon_service_impl.cc
@@ -66,62 +66,64 @@
 
 base::CancelableTaskTracker::TaskId FaviconServiceImpl::GetFaviconImage(
     const GURL& icon_url,
-    const favicon_base::FaviconImageCallback& callback,
+    favicon_base::FaviconImageCallback callback,
     base::CancelableTaskTracker* tracker) {
   TRACE_EVENT0("browser", "FaviconServiceImpl::GetFaviconImage");
-  favicon_base::FaviconResultsCallback callback_runner =
-      base::Bind(&FaviconServiceImpl::RunFaviconImageCallbackWithBitmapResults,
-                 base::Unretained(this), callback, gfx::kFaviconSize);
+  favicon_base::FaviconResultsCallback callback_runner = base::BindOnce(
+      &FaviconServiceImpl::RunFaviconImageCallbackWithBitmapResults,
+      base::Unretained(this), std::move(callback), gfx::kFaviconSize);
   return history_service_->GetFavicon(
       icon_url, favicon_base::IconType::kFavicon,
-      GetPixelSizesForFaviconScales(gfx::kFaviconSize), callback_runner,
-      tracker);
+      GetPixelSizesForFaviconScales(gfx::kFaviconSize),
+      std::move(callback_runner), tracker);
 }
 
 base::CancelableTaskTracker::TaskId FaviconServiceImpl::GetRawFavicon(
     const GURL& icon_url,
     favicon_base::IconType icon_type,
     int desired_size_in_pixel,
-    const favicon_base::FaviconRawBitmapCallback& callback,
+    favicon_base::FaviconRawBitmapCallback callback,
     base::CancelableTaskTracker* tracker) {
   TRACE_EVENT0("browser", "FaviconServiceImpl::GetRawFavicon");
-  favicon_base::FaviconResultsCallback callback_runner = base::Bind(
+  favicon_base::FaviconResultsCallback callback_runner = base::BindOnce(
       &FaviconServiceImpl::RunFaviconRawBitmapCallbackWithBitmapResults,
-      base::Unretained(this), callback, desired_size_in_pixel);
+      base::Unretained(this), std::move(callback), desired_size_in_pixel);
 
   std::vector<int> desired_sizes_in_pixel;
   desired_sizes_in_pixel.push_back(desired_size_in_pixel);
 
-  return history_service_->GetFavicon(
-      icon_url, icon_type, desired_sizes_in_pixel, callback_runner, tracker);
+  return history_service_->GetFavicon(icon_url, icon_type,
+                                      desired_sizes_in_pixel,
+                                      std::move(callback_runner), tracker);
 }
 
 base::CancelableTaskTracker::TaskId FaviconServiceImpl::GetFavicon(
     const GURL& icon_url,
     favicon_base::IconType icon_type,
     int desired_size_in_dip,
-    const favicon_base::FaviconResultsCallback& callback,
+    favicon_base::FaviconResultsCallback callback,
     base::CancelableTaskTracker* tracker) {
   TRACE_EVENT0("browser", "FaviconServiceImpl::GetFavicon");
   std::vector<GURL> icon_urls;
   icon_urls.push_back(icon_url);
   return history_service_->GetFavicon(
       icon_url, icon_type, GetPixelSizesForFaviconScales(desired_size_in_dip),
-      callback, tracker);
+      std::move(callback), tracker);
 }
 
 base::CancelableTaskTracker::TaskId
 FaviconServiceImpl::GetFaviconImageForPageURL(
     const GURL& page_url,
-    const favicon_base::FaviconImageCallback& callback,
+    favicon_base::FaviconImageCallback callback,
     base::CancelableTaskTracker* tracker) {
   TRACE_EVENT0("browser", "FaviconServiceImpl::GetFaviconImageForPageURL");
   return GetFaviconForPageURLImpl(
       page_url, {favicon_base::IconType::kFavicon},
       GetPixelSizesForFaviconScales(gfx::kFaviconSize),
       /*fallback_to_host=*/false,
-      base::Bind(&FaviconServiceImpl::RunFaviconImageCallbackWithBitmapResults,
-                 base::Unretained(this), callback, gfx::kFaviconSize),
+      base::BindOnce(
+          &FaviconServiceImpl::RunFaviconImageCallbackWithBitmapResults,
+          base::Unretained(this), std::move(callback), gfx::kFaviconSize),
       tracker);
 }
 
@@ -130,16 +132,16 @@
     const favicon_base::IconTypeSet& icon_types,
     int desired_size_in_pixel,
     bool fallback_to_host,
-    const favicon_base::FaviconRawBitmapCallback& callback,
+    favicon_base::FaviconRawBitmapCallback callback,
     base::CancelableTaskTracker* tracker) {
   TRACE_EVENT0("browser", "FaviconServiceImpl::GetRawFaviconForPageURL");
   std::vector<int> desired_sizes_in_pixel;
   desired_sizes_in_pixel.push_back(desired_size_in_pixel);
   return GetFaviconForPageURLImpl(
       page_url, icon_types, desired_sizes_in_pixel, fallback_to_host,
-      base::Bind(
+      base::BindOnce(
           &FaviconServiceImpl::RunFaviconRawBitmapCallbackWithBitmapResults,
-          base::Unretained(this), callback, desired_size_in_pixel),
+          base::Unretained(this), std::move(callback), desired_size_in_pixel),
       tracker);
 }
 
@@ -148,32 +150,34 @@
     const GURL& page_url,
     const std::vector<favicon_base::IconTypeSet>& icon_types,
     int minimum_size_in_pixels,
-    const favicon_base::FaviconRawBitmapCallback& callback,
+    favicon_base::FaviconRawBitmapCallback callback,
     base::CancelableTaskTracker* tracker) {
   TRACE_EVENT0("browser", "FaviconServiceImpl::GetLargestRawFaviconForPageURL");
-  favicon_base::FaviconResultsCallback favicon_results_callback = base::Bind(
-      &FaviconServiceImpl::RunFaviconRawBitmapCallbackWithBitmapResults,
-      base::Unretained(this), callback, 0);
   if (favicon_client_ && favicon_client_->IsNativeApplicationURL(page_url)) {
     std::vector<int> desired_sizes_in_pixel;
     desired_sizes_in_pixel.push_back(0);
     return favicon_client_->GetFaviconForNativeApplicationURL(
-        page_url, desired_sizes_in_pixel, favicon_results_callback, tracker);
+        page_url, desired_sizes_in_pixel,
+        base::BindOnce(
+            &FaviconServiceImpl::RunFaviconRawBitmapCallbackWithBitmapResults,
+            base::Unretained(this), std::move(callback), 0),
+        tracker);
   }
   return history_service_->GetLargestFaviconForURL(
-      page_url, icon_types, minimum_size_in_pixels, callback, tracker);
+      page_url, icon_types, minimum_size_in_pixels, std::move(callback),
+      tracker);
 }
 
 base::CancelableTaskTracker::TaskId FaviconServiceImpl::GetFaviconForPageURL(
     const GURL& page_url,
     const favicon_base::IconTypeSet& icon_types,
     int desired_size_in_dip,
-    const favicon_base::FaviconResultsCallback& callback,
+    favicon_base::FaviconResultsCallback callback,
     base::CancelableTaskTracker* tracker) {
   TRACE_EVENT0("browser", "FaviconServiceImpl::GetFaviconForPageURL");
   return GetFaviconForPageURLImpl(
       page_url, icon_types, GetPixelSizesForFaviconScales(desired_size_in_dip),
-      /*fallback_to_host=*/false, callback, tracker);
+      /*fallback_to_host=*/false, std::move(callback), tracker);
 }
 
 base::CancelableTaskTracker::TaskId
@@ -182,11 +186,12 @@
     const GURL& icon_url,
     favicon_base::IconType icon_type,
     int desired_size_in_dip,
-    const favicon_base::FaviconResultsCallback& callback,
+    favicon_base::FaviconResultsCallback callback,
     base::CancelableTaskTracker* tracker) {
   return history_service_->UpdateFaviconMappingsAndFetch(
       page_urls, icon_url, icon_type,
-      GetPixelSizesForFaviconScales(desired_size_in_dip), callback, tracker);
+      GetPixelSizesForFaviconScales(desired_size_in_dip), std::move(callback),
+      tracker);
 }
 
 void FaviconServiceImpl::DeleteFaviconMappings(
@@ -198,18 +203,18 @@
 base::CancelableTaskTracker::TaskId
 FaviconServiceImpl::GetLargestRawFaviconForID(
     favicon_base::FaviconID favicon_id,
-    const favicon_base::FaviconRawBitmapCallback& callback,
+    favicon_base::FaviconRawBitmapCallback callback,
     base::CancelableTaskTracker* tracker) {
   TRACE_EVENT0("browser", "FaviconServiceImpl::GetLargestRawFaviconForID");
   // Use 0 as |desired_size| to get the largest bitmap for |favicon_id| without
   // any resizing.
   int desired_size = 0;
-  favicon_base::FaviconResultsCallback callback_runner = base::Bind(
+  favicon_base::FaviconResultsCallback callback_runner = base::BindOnce(
       &FaviconServiceImpl::RunFaviconRawBitmapCallbackWithBitmapResults,
-      base::Unretained(this), callback, desired_size);
+      base::Unretained(this), std::move(callback), desired_size);
 
   return history_service_->GetFaviconForID(favicon_id, desired_size,
-                                           callback_runner, tracker);
+                                           std::move(callback_runner), tracker);
 }
 
 void FaviconServiceImpl::SetFaviconOutOfDateForPage(const GURL& page_url) {
@@ -297,19 +302,19 @@
     const favicon_base::IconTypeSet& icon_types,
     const std::vector<int>& desired_sizes_in_pixel,
     bool fallback_to_host,
-    const favicon_base::FaviconResultsCallback& callback,
+    favicon_base::FaviconResultsCallback callback,
     base::CancelableTaskTracker* tracker) {
   if (favicon_client_ && favicon_client_->IsNativeApplicationURL(page_url)) {
     return favicon_client_->GetFaviconForNativeApplicationURL(
-        page_url, desired_sizes_in_pixel, callback, tracker);
+        page_url, desired_sizes_in_pixel, std::move(callback), tracker);
   }
   return history_service_->GetFaviconsForURL(
-      page_url, icon_types, desired_sizes_in_pixel, fallback_to_host, callback,
-      tracker);
+      page_url, icon_types, desired_sizes_in_pixel, fallback_to_host,
+      std::move(callback), tracker);
 }
 
 void FaviconServiceImpl::RunFaviconImageCallbackWithBitmapResults(
-    const favicon_base::FaviconImageCallback& callback,
+    favicon_base::FaviconImageCallback callback,
     int desired_size_in_dip,
     const std::vector<favicon_base::FaviconRawBitmapResult>&
         favicon_bitmap_results) {
@@ -324,18 +329,18 @@
   image_result.icon_url = image_result.image.IsEmpty()
                               ? GURL()
                               : favicon_bitmap_results[0].icon_url;
-  callback.Run(image_result);
+  std::move(callback).Run(image_result);
 }
 
 void FaviconServiceImpl::RunFaviconRawBitmapCallbackWithBitmapResults(
-    const favicon_base::FaviconRawBitmapCallback& callback,
+    favicon_base::FaviconRawBitmapCallback callback,
     int desired_size_in_pixel,
     const std::vector<favicon_base::FaviconRawBitmapResult>&
         favicon_bitmap_results) {
   TRACE_EVENT0(
       "browser",
       "FaviconServiceImpl::RunFaviconRawBitmapCallbackWithBitmapResults");
-  callback.Run(
+  std::move(callback).Run(
       ResizeFaviconBitmapResult(favicon_bitmap_results, desired_size_in_pixel));
 }
 
diff --git a/components/favicon/core/favicon_service_impl.h b/components/favicon/core/favicon_service_impl.h
index 21d62fb5..0f289e4e 100644
--- a/components/favicon/core/favicon_service_impl.h
+++ b/components/favicon/core/favicon_service_impl.h
@@ -44,55 +44,55 @@
   // FaviconService implementation.
   base::CancelableTaskTracker::TaskId GetFaviconImage(
       const GURL& icon_url,
-      const favicon_base::FaviconImageCallback& callback,
+      favicon_base::FaviconImageCallback callback,
       base::CancelableTaskTracker* tracker) override;
   base::CancelableTaskTracker::TaskId GetRawFavicon(
       const GURL& icon_url,
       favicon_base::IconType icon_type,
       int desired_size_in_pixel,
-      const favicon_base::FaviconRawBitmapCallback& callback,
+      favicon_base::FaviconRawBitmapCallback callback,
       base::CancelableTaskTracker* tracker) override;
   base::CancelableTaskTracker::TaskId GetFavicon(
       const GURL& icon_url,
       favicon_base::IconType icon_type,
       int desired_size_in_dip,
-      const favicon_base::FaviconResultsCallback& callback,
+      favicon_base::FaviconResultsCallback callback,
       base::CancelableTaskTracker* tracker) override;
   base::CancelableTaskTracker::TaskId GetFaviconImageForPageURL(
       const GURL& page_url,
-      const favicon_base::FaviconImageCallback& callback,
+      favicon_base::FaviconImageCallback callback,
       base::CancelableTaskTracker* tracker) override;
   base::CancelableTaskTracker::TaskId GetRawFaviconForPageURL(
       const GURL& page_url,
       const favicon_base::IconTypeSet& icon_types,
       int desired_size_in_pixel,
       bool fallback_to_host,
-      const favicon_base::FaviconRawBitmapCallback& callback,
+      favicon_base::FaviconRawBitmapCallback callback,
       base::CancelableTaskTracker* tracker) override;
   base::CancelableTaskTracker::TaskId GetLargestRawFaviconForPageURL(
       const GURL& page_url,
       const std::vector<favicon_base::IconTypeSet>& icon_types,
       int minimum_size_in_pixels,
-      const favicon_base::FaviconRawBitmapCallback& callback,
+      favicon_base::FaviconRawBitmapCallback callback,
       base::CancelableTaskTracker* tracker) override;
   base::CancelableTaskTracker::TaskId GetFaviconForPageURL(
       const GURL& page_url,
       const favicon_base::IconTypeSet& icon_types,
       int desired_size_in_dip,
-      const favicon_base::FaviconResultsCallback& callback,
+      favicon_base::FaviconResultsCallback callback,
       base::CancelableTaskTracker* tracker) override;
   base::CancelableTaskTracker::TaskId UpdateFaviconMappingsAndFetch(
       const base::flat_set<GURL>& page_urls,
       const GURL& icon_url,
       favicon_base::IconType icon_type,
       int desired_size_in_dip,
-      const favicon_base::FaviconResultsCallback& callback,
+      favicon_base::FaviconResultsCallback callback,
       base::CancelableTaskTracker* tracker) override;
   void DeleteFaviconMappings(const base::flat_set<GURL>& page_urls,
                              favicon_base::IconType icon_type) override;
   base::CancelableTaskTracker::TaskId GetLargestRawFaviconForID(
       favicon_base::FaviconID favicon_id,
-      const favicon_base::FaviconRawBitmapCallback& callback,
+      favicon_base::FaviconRawBitmapCallback callback,
       base::CancelableTaskTracker* tracker) override;
   void SetFaviconOutOfDateForPage(const GURL& page_url) override;
   void TouchOnDemandFavicon(const GURL& icon_url) override;
@@ -136,7 +136,7 @@
       const favicon_base::IconTypeSet& icon_types,
       const std::vector<int>& desired_sizes_in_pixel,
       bool fallback_to_host,
-      const favicon_base::FaviconResultsCallback& callback,
+      favicon_base::FaviconResultsCallback callback,
       base::CancelableTaskTracker* tracker);
 
   // Intermediate callback for GetFaviconImage() and GetFaviconImageForPageURL()
@@ -144,7 +144,7 @@
   // Builds favicon_base::FaviconImageResult from |favicon_bitmap_results| and
   // runs |callback|.
   void RunFaviconImageCallbackWithBitmapResults(
-      const favicon_base::FaviconImageCallback& callback,
+      favicon_base::FaviconImageCallback callback,
       int desired_size_in_dip,
       const std::vector<favicon_base::FaviconRawBitmapResult>&
           favicon_bitmap_results);
@@ -154,7 +154,7 @@
   // Resizes favicon_base::FaviconRawBitmapResult if necessary and runs
   // |callback|.
   void RunFaviconRawBitmapCallbackWithBitmapResults(
-      const favicon_base::FaviconRawBitmapCallback& callback,
+      favicon_base::FaviconRawBitmapCallback callback,
       int desired_size_in_pixel,
       const std::vector<favicon_base::FaviconRawBitmapResult>&
           favicon_bitmap_results);
diff --git a/components/favicon/core/favicon_util.cc b/components/favicon/core/favicon_util.cc
index 161bdcb..d884298 100644
--- a/components/favicon/core/favicon_util.cc
+++ b/components/favicon/core/favicon_util.cc
@@ -14,17 +14,17 @@
 // Adapter to convert a FaviconImageCallback into a FaviconRawBitmapCallback
 // for GetFaviconImageForPageURL.
 void RunCallbackWithImage(
-    const favicon_base::FaviconImageCallback& callback,
+    favicon_base::FaviconImageCallback callback,
     const favicon_base::FaviconRawBitmapResult& bitmap_result) {
   favicon_base::FaviconImageResult result;
   if (bitmap_result.is_valid()) {
     result.image = gfx::Image::CreateFrom1xPNGBytes(
         bitmap_result.bitmap_data->front(), bitmap_result.bitmap_data->size());
     result.icon_url = bitmap_result.icon_url;
-    callback.Run(result);
+    std::move(callback).Run(result);
     return;
   }
-  callback.Run(result);
+  std::move(callback).Run(result);
 }
 
 }  // namespace
@@ -33,19 +33,19 @@
     FaviconService* favicon_service,
     const GURL& page_url,
     favicon_base::IconType type,
-    const favicon_base::FaviconImageCallback& callback,
+    favicon_base::FaviconImageCallback callback,
     base::CancelableTaskTracker* tracker) {
   if (!favicon_service)
     return base::CancelableTaskTracker::kBadTaskId;
 
   if (type == favicon_base::IconType::kFavicon) {
-    return favicon_service->GetFaviconImageForPageURL(page_url, callback,
-                                                      tracker);
+    return favicon_service->GetFaviconImageForPageURL(
+        page_url, std::move(callback), tracker);
   }
 
   return favicon_service->GetRawFaviconForPageURL(
       page_url, {type}, 0, /*fallback_to_host=*/false,
-      base::Bind(&RunCallbackWithImage, callback), tracker);
+      base::BindOnce(&RunCallbackWithImage, std::move(callback)), tracker);
 }
 
 }  // namespace favicon
diff --git a/components/favicon/core/favicon_util.h b/components/favicon/core/favicon_util.h
index cd55594..392ee73 100644
--- a/components/favicon/core/favicon_util.h
+++ b/components/favicon/core/favicon_util.h
@@ -27,7 +27,7 @@
     FaviconService* favicon_service,
     const GURL& page_url,
     favicon_base::IconType type,
-    const favicon_base::FaviconImageCallback& callback,
+    favicon_base::FaviconImageCallback callback,
     base::CancelableTaskTracker* tracker);
 
 }  // namespace favicon
diff --git a/components/favicon/core/large_icon_service.h b/components/favicon/core/large_icon_service.h
index f14555d..9bd46315 100644
--- a/components/favicon/core/large_icon_service.h
+++ b/components/favicon/core/large_icon_service.h
@@ -45,7 +45,7 @@
       const GURL& page_url,
       int min_source_size_in_pixel,
       int desired_size_in_pixel,
-      const favicon_base::LargeIconCallback& callback,
+      favicon_base::LargeIconCallback callback,
       base::CancelableTaskTracker* tracker) = 0;
 
   // Behaves the same as GetLargeIconRawBitmapOrFallbackStyleForPageUrl(), only
@@ -55,7 +55,7 @@
       const GURL& page_url,
       int min_source_size_in_pixel,
       int desired_size_in_pixel,
-      const favicon_base::LargeIconImageCallback& callback,
+      favicon_base::LargeIconImageCallback callback,
       base::CancelableTaskTracker* tracker) = 0;
 
   // Behaves the same as GetLargeIconRawBitmapOrFallbackStyleForPageUrl, except
@@ -65,7 +65,7 @@
       const GURL& icon_url,
       int min_source_size_in_pixel,
       int desired_size_in_pixel,
-      const favicon_base::LargeIconCallback& callback,
+      favicon_base::LargeIconCallback callback,
       base::CancelableTaskTracker* tracker) = 0;
 
   // Fetches the best large icon for the page at |page_url| from a Google
@@ -97,7 +97,7 @@
       std::unique_ptr<FaviconServerFetcherParams> params,
       bool may_page_url_be_private,
       const net::NetworkTrafficAnnotationTag& traffic_annotation,
-      const favicon_base::GoogleFaviconServerCallback& callback) = 0;
+      favicon_base::GoogleFaviconServerCallback callback) = 0;
 
   // Update the time that the icon at |icon_url| was requested. This should be
   // called after obtaining the icon by GetLargeIcon*OrFallbackStyle() for any
diff --git a/components/favicon/core/large_icon_service_impl.cc b/components/favicon/core/large_icon_service_impl.cc
index a76327c..ab107c66 100644
--- a/components/favicon/core/large_icon_service_impl.cc
+++ b/components/favicon/core/large_icon_service_impl.cc
@@ -196,10 +196,10 @@
 }
 
 void FinishServerRequestAsynchronously(
-    const favicon_base::GoogleFaviconServerCallback& callback,
+    favicon_base::GoogleFaviconServerCallback callback,
     favicon_base::GoogleFaviconServerRequestStatus status) {
   base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, base::BindOnce(callback, status));
+      FROM_HERE, base::BindOnce(std::move(callback), status));
 }
 
 // Singleton map keyed by organization-identifying domain (excludes registrar
@@ -330,8 +330,8 @@
     base::CancelableTaskTracker* tracker)
     : min_source_size_in_pixel_(min_source_size_in_pixel),
       desired_size_in_pixel_(desired_size_in_pixel),
-      raw_bitmap_callback_(raw_bitmap_callback),
-      image_callback_(image_callback),
+      raw_bitmap_callback_(std::move(raw_bitmap_callback)),
+      image_callback_(std::move(image_callback)),
       background_task_runner_(base::CreateTaskRunnerWithTraits(
           {base::MayBlock(), base::TaskPriority::BEST_EFFORT,
            base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN})),
@@ -360,22 +360,23 @@
   // If |raw_bitmap_callback_| is provided, return the raw result.
   if (raw_bitmap_callback_) {
     if (raw_bitmap_result_.is_valid()) {
-      raw_bitmap_callback_.Run(
-          favicon_base::LargeIconResult(raw_bitmap_result_));
+      std::move(raw_bitmap_callback_)
+          .Run(favicon_base::LargeIconResult(raw_bitmap_result_));
       return;
     }
-    raw_bitmap_callback_.Run(
-        favicon_base::LargeIconResult(fallback_icon_style_.release()));
+    std::move(raw_bitmap_callback_)
+        .Run(favicon_base::LargeIconResult(fallback_icon_style_.release()));
     return;
   }
 
   if (!bitmap_result_.isNull()) {
-    image_callback_.Run(favicon_base::LargeIconImageResult(
-        gfx::Image::CreateFrom1xBitmap(bitmap_result_), icon_url_));
+    std::move(image_callback_)
+        .Run(favicon_base::LargeIconImageResult(
+            gfx::Image::CreateFrom1xBitmap(bitmap_result_), icon_url_));
     return;
   }
-  image_callback_.Run(
-      favicon_base::LargeIconImageResult(fallback_icon_style_.release()));
+  std::move(image_callback_)
+      .Run(favicon_base::LargeIconImageResult(fallback_icon_style_.release()));
 }
 
 void LargeIconWorker::LogSuspiciousURLMismatches(
@@ -403,10 +404,11 @@
 }
 
 void OnSetOnDemandFaviconComplete(
-    const favicon_base::GoogleFaviconServerCallback& callback,
+    favicon_base::GoogleFaviconServerCallback callback,
     bool success) {
-  callback.Run(success ? GoogleFaviconServerRequestStatus::SUCCESS
-                       : GoogleFaviconServerRequestStatus::FAILURE_ON_WRITE);
+  std::move(callback).Run(
+      success ? GoogleFaviconServerRequestStatus::SUCCESS
+              : GoogleFaviconServerRequestStatus::FAILURE_ON_WRITE);
 }
 
 void OnFetchIconFromGoogleServerComplete(
@@ -414,14 +416,14 @@
     const GURL& page_url,
     const GURL& server_request_url,
     favicon_base::IconType icon_type,
-    const favicon_base::GoogleFaviconServerCallback& callback,
+    favicon_base::GoogleFaviconServerCallback callback,
     const gfx::Image& image,
     const image_fetcher::RequestMetadata& metadata) {
   if (image.IsEmpty()) {
     DLOG(WARNING) << "large icon server fetch empty "
                   << server_request_url.spec();
     favicon_service->UnableToDownloadFavicon(server_request_url);
-    callback.Run(
+    std::move(callback).Run(
         metadata.http_response_code ==
                 image_fetcher::RequestMetadata::RESPONSE_CODE_INVALID
             ? GoogleFaviconServerRequestStatus::FAILURE_CONNECTION_ERROR
@@ -446,7 +448,7 @@
   // page any time in the future.
   favicon_service->SetOnDemandFavicons(
       page_url, GURL(original_icon_url), icon_type, image,
-      base::BindOnce(&OnSetOnDemandFaviconComplete, callback));
+      base::BindOnce(&OnSetOnDemandFaviconComplete, std::move(callback)));
 }
 
 }  // namespace
@@ -472,11 +474,12 @@
     const GURL& page_url,
     int min_source_size_in_pixel,
     int desired_size_in_pixel,
-    const favicon_base::LargeIconCallback& raw_bitmap_callback,
+    favicon_base::LargeIconCallback raw_bitmap_callback,
     base::CancelableTaskTracker* tracker) {
   return GetLargeIconOrFallbackStyleImpl(
       page_url, min_source_size_in_pixel, desired_size_in_pixel,
-      raw_bitmap_callback, favicon_base::LargeIconImageCallback(), tracker);
+      std::move(raw_bitmap_callback), favicon_base::LargeIconImageCallback(),
+      tracker);
 }
 
 base::CancelableTaskTracker::TaskId
@@ -484,11 +487,11 @@
     const GURL& page_url,
     int min_source_size_in_pixel,
     int desired_size_in_pixel,
-    const favicon_base::LargeIconImageCallback& image_callback,
+    favicon_base::LargeIconImageCallback image_callback,
     base::CancelableTaskTracker* tracker) {
   return GetLargeIconOrFallbackStyleImpl(
       page_url, min_source_size_in_pixel, desired_size_in_pixel,
-      favicon_base::LargeIconCallback(), image_callback, tracker);
+      favicon_base::LargeIconCallback(), std::move(image_callback), tracker);
 }
 
 base::CancelableTaskTracker::TaskId
@@ -496,21 +499,22 @@
     const GURL& icon_url,
     int min_source_size_in_pixel,
     int desired_size_in_pixel,
-    const favicon_base::LargeIconCallback& raw_bitmap_callback,
+    favicon_base::LargeIconCallback raw_bitmap_callback,
     base::CancelableTaskTracker* tracker) {
   DCHECK_LE(1, min_source_size_in_pixel);
   DCHECK_LE(0, desired_size_in_pixel);
 
   scoped_refptr<LargeIconWorker> worker = base::MakeRefCounted<LargeIconWorker>(
-      min_source_size_in_pixel, desired_size_in_pixel, raw_bitmap_callback,
-      favicon_base::LargeIconImageCallback(), tracker);
+      min_source_size_in_pixel, desired_size_in_pixel,
+      std::move(raw_bitmap_callback), favicon_base::LargeIconImageCallback(),
+      tracker);
 
   int max_size_in_pixel =
       std::max(desired_size_in_pixel, min_source_size_in_pixel);
   return favicon_service_->GetRawFavicon(
       icon_url, favicon_base::IconType::kFavicon, max_size_in_pixel,
-      base::BindRepeating(&LargeIconWorker::OnIconLookupComplete, worker,
-                          /*page_url_for_uma=*/GURL()),
+      base::BindOnce(&LargeIconWorker::OnIconLookupComplete, worker,
+                     /*page_url_for_uma=*/GURL()),
       tracker);
 }
 
@@ -519,27 +523,30 @@
         std::unique_ptr<FaviconServerFetcherParams> params,
         bool may_page_url_be_private,
         const net::NetworkTrafficAnnotationTag& traffic_annotation,
-        const favicon_base::GoogleFaviconServerCallback& callback) {
+        favicon_base::GoogleFaviconServerCallback callback) {
   DCHECK_LE(0, params->min_source_size_in_pixel());
 
   if (net::NetworkChangeNotifier::IsOffline()) {
     // By exiting early when offline, we avoid caching the failure and thus
     // allow icon fetches later when coming back online.
     FinishServerRequestAsynchronously(
-        callback, GoogleFaviconServerRequestStatus::FAILURE_CONNECTION_ERROR);
+        std::move(callback),
+        GoogleFaviconServerRequestStatus::FAILURE_CONNECTION_ERROR);
     return;
   }
 
   if (!params->page_url().is_valid()) {
     FinishServerRequestAsynchronously(
-        callback, GoogleFaviconServerRequestStatus::FAILURE_TARGET_URL_INVALID);
+        std::move(callback),
+        GoogleFaviconServerRequestStatus::FAILURE_TARGET_URL_INVALID);
     return;
   }
 
   const GURL trimmed_page_url = TrimPageUrlForGoogleServer(params->page_url());
   if (!trimmed_page_url.is_valid()) {
     FinishServerRequestAsynchronously(
-        callback, GoogleFaviconServerRequestStatus::FAILURE_TARGET_URL_SKIPPED);
+        std::move(callback),
+        GoogleFaviconServerRequestStatus::FAILURE_TARGET_URL_SKIPPED);
     return;
   }
 
@@ -549,7 +556,8 @@
       may_page_url_be_private);
   if (!server_request_url.is_valid()) {
     FinishServerRequestAsynchronously(
-        callback, GoogleFaviconServerRequestStatus::FAILURE_SERVER_URL_INVALID);
+        std::move(callback),
+        GoogleFaviconServerRequestStatus::FAILURE_SERVER_URL_INVALID);
     return;
   }
 
@@ -557,7 +565,8 @@
   // |server_request_url|.
   if (favicon_service_->WasUnableToDownloadFavicon(server_request_url)) {
     FinishServerRequestAsynchronously(
-        callback, GoogleFaviconServerRequestStatus::FAILURE_HTTP_ERROR_CACHED);
+        std::move(callback),
+        GoogleFaviconServerRequestStatus::FAILURE_HTTP_ERROR_CACHED);
     return;
   }
 
@@ -566,7 +575,7 @@
       base::BindOnce(&LargeIconServiceImpl::OnCanSetOnDemandFaviconComplete,
                      weak_ptr_factory_.GetWeakPtr(), server_request_url,
                      params->page_url(), params->icon_type(),
-                     traffic_annotation, callback));
+                     traffic_annotation, std::move(callback)));
 }
 
 void LargeIconServiceImpl::TouchIconFromGoogleServer(const GURL& icon_url) {
@@ -597,15 +606,15 @@
     const GURL& page_url,
     int min_source_size_in_pixel,
     int desired_size_in_pixel,
-    const favicon_base::LargeIconCallback& raw_bitmap_callback,
-    const favicon_base::LargeIconImageCallback& image_callback,
+    favicon_base::LargeIconCallback raw_bitmap_callback,
+    favicon_base::LargeIconImageCallback image_callback,
     base::CancelableTaskTracker* tracker) {
   DCHECK_LE(1, min_source_size_in_pixel);
   DCHECK_LE(0, desired_size_in_pixel);
 
-  scoped_refptr<LargeIconWorker> worker =
-      new LargeIconWorker(min_source_size_in_pixel, desired_size_in_pixel,
-                          raw_bitmap_callback, image_callback, tracker);
+  scoped_refptr<LargeIconWorker> worker = new LargeIconWorker(
+      min_source_size_in_pixel, desired_size_in_pixel,
+      std::move(raw_bitmap_callback), std::move(image_callback), tracker);
 
   int max_size_in_pixel =
       std::max(desired_size_in_pixel, min_source_size_in_pixel);
@@ -615,8 +624,7 @@
   //   URL of a large icon is known but its bitmap is not available.
   return favicon_service_->GetLargestRawFaviconForPageURL(
       page_url, large_icon_types_, max_size_in_pixel,
-      base::BindRepeating(&LargeIconWorker::OnIconLookupComplete, worker,
-                          page_url),
+      base::BindOnce(&LargeIconWorker::OnIconLookupComplete, worker, page_url),
       tracker);
 }
 
@@ -625,10 +633,11 @@
     const GURL& page_url,
     favicon_base::IconType icon_type,
     const net::NetworkTrafficAnnotationTag& traffic_annotation,
-    const favicon_base::GoogleFaviconServerCallback& callback,
+    favicon_base::GoogleFaviconServerCallback callback,
     bool can_set_on_demand_favicon) {
   if (!can_set_on_demand_favicon) {
-    callback.Run(GoogleFaviconServerRequestStatus::FAILURE_ICON_EXISTS_IN_DB);
+    std::move(callback).Run(
+        GoogleFaviconServerRequestStatus::FAILURE_ICON_EXISTS_IN_DB);
     return;
   }
 
@@ -637,7 +646,8 @@
   image_fetcher_->FetchImage(
       server_request_url,
       base::BindOnce(&OnFetchIconFromGoogleServerComplete, favicon_service_,
-                     page_url, server_request_url, icon_type, callback),
+                     page_url, server_request_url, icon_type,
+                     std::move(callback)),
       std::move(params));
 }
 
diff --git a/components/favicon/core/large_icon_service_impl.h b/components/favicon/core/large_icon_service_impl.h
index e9fceb0..f22a5baa 100644
--- a/components/favicon/core/large_icon_service_impl.h
+++ b/components/favicon/core/large_icon_service_impl.h
@@ -41,27 +41,27 @@
       const GURL& page_url,
       int min_source_size_in_pixel,
       int desired_size_in_pixel,
-      const favicon_base::LargeIconCallback& callback,
+      favicon_base::LargeIconCallback callback,
       base::CancelableTaskTracker* tracker) override;
   base::CancelableTaskTracker::TaskId
   GetLargeIconImageOrFallbackStyleForPageUrl(
       const GURL& page_url,
       int min_source_size_in_pixel,
       int desired_size_in_pixel,
-      const favicon_base::LargeIconImageCallback& callback,
+      favicon_base::LargeIconImageCallback callback,
       base::CancelableTaskTracker* tracker) override;
   base::CancelableTaskTracker::TaskId
   GetLargeIconRawBitmapOrFallbackStyleForIconUrl(
       const GURL& icon_url,
       int min_source_size_in_pixel,
       int desired_size_in_pixel,
-      const favicon_base::LargeIconCallback& callback,
+      favicon_base::LargeIconCallback callback,
       base::CancelableTaskTracker* tracker) override;
   void GetLargeIconOrFallbackStyleFromGoogleServerSkippingLocalCache(
       std::unique_ptr<FaviconServerFetcherParams> params,
       bool may_page_url_be_private,
       const net::NetworkTrafficAnnotationTag& traffic_annotation,
-      const favicon_base::GoogleFaviconServerCallback& callback) override;
+      favicon_base::GoogleFaviconServerCallback callback) override;
   void TouchIconFromGoogleServer(const GURL& icon_url) override;
   // Extracts the organization-identifying domain from |url| which excludes
   // registrar portion (e.g. final ".com"). Used for logging UMA metrics.
@@ -73,8 +73,8 @@
       const GURL& page_url,
       int min_source_size_in_pixel,
       int desired_size_in_pixel,
-      const favicon_base::LargeIconCallback& raw_bitmap_callback,
-      const favicon_base::LargeIconImageCallback& image_callback,
+      favicon_base::LargeIconCallback raw_bitmap_callback,
+      favicon_base::LargeIconImageCallback image_callback,
       base::CancelableTaskTracker* tracker);
 
   void OnCanSetOnDemandFaviconComplete(
@@ -82,7 +82,7 @@
       const GURL& page_url,
       favicon_base::IconType icon_type,
       const net::NetworkTrafficAnnotationTag& traffic_annotation,
-      const favicon_base::GoogleFaviconServerCallback& callback,
+      favicon_base::GoogleFaviconServerCallback callback,
       bool can_set_on_demand_favicon);
 
   FaviconService* favicon_service_;
diff --git a/components/favicon/core/large_icon_service_impl_unittest.cc b/components/favicon/core/large_icon_service_impl_unittest.cc
index 3e93fa1..024e8c2 100644
--- a/components/favicon/core/large_icon_service_impl_unittest.cc
+++ b/components/favicon/core/large_icon_service_impl_unittest.cc
@@ -41,17 +41,17 @@
 namespace {
 
 using image_fetcher::MockImageFetcher;
+using testing::_;
 using testing::ElementsAre;
-using testing::IsEmpty;
-using testing::IsNull;
 using testing::Eq;
 using testing::HasSubstr;
+using testing::IsEmpty;
+using testing::IsNull;
 using testing::NiceMock;
 using testing::Not;
 using testing::Property;
 using testing::Return;
 using testing::SaveArg;
-using testing::_;
 
 const char kDummyUrl[] = "http://www.example.com";
 const char kDummyIconUrl[] = "http://www.example.com/touch_icon.png";
@@ -68,16 +68,6 @@
       FROM_HERE, base::BindOnce(std::move(*arg2), p0, p1));
 }
 
-ACTION_P(PostBoolReplyToArg4, p0) {
-  base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, base::BindOnce(std::move(*arg4), p0));
-}
-
-ACTION_P(PostBoolReplyToArg2, p0) {
-  base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, base::BindOnce(std::move(*arg2), p0));
-}
-
 SkBitmap CreateTestSkBitmap(int w, int h, SkColor color) {
   SkBitmap bitmap;
   bitmap.allocN32Pixels(w, h);
@@ -157,7 +147,10 @@
   EXPECT_CALL(mock_favicon_service_,
               CanSetOnDemandFavicons(GURL(kDummyUrl),
                                      favicon_base::IconType::kTouchIcon, _))
-      .WillOnce(PostBoolReplyToArg2(true));
+      .WillOnce([](auto, auto, base::OnceCallback<void(bool)> callback) {
+        return base::ThreadTaskRunnerHandle::Get()->PostTask(
+            FROM_HERE, base::BindOnce(std::move(callback), true));
+      });
 
   base::MockCallback<favicon_base::GoogleFaviconServerCallback> callback;
   EXPECT_CALL(*mock_image_fetcher_,
@@ -167,7 +160,11 @@
   EXPECT_CALL(mock_favicon_service_,
               SetOnDemandFavicons(GURL(kDummyUrl), kExpectedServerUrl,
                                   favicon_base::IconType::kTouchIcon, _, _))
-      .WillOnce(PostBoolReplyToArg4(true));
+      .WillOnce(
+          [](auto, auto, auto, auto, base::OnceCallback<void(bool)> callback) {
+            return base::ThreadTaskRunnerHandle::Get()->PostTask(
+                FROM_HERE, base::BindOnce(std::move(callback), true));
+          });
 
   large_icon_service_
       .GetLargeIconOrFallbackStyleFromGoogleServerSkippingLocalCache(
@@ -195,7 +192,10 @@
   EXPECT_CALL(mock_favicon_service_,
               CanSetOnDemandFavicons(GURL(kDummyUrl),
                                      favicon_base::IconType::kFavicon, _))
-      .WillOnce(PostBoolReplyToArg2(true));
+      .WillOnce([](auto, auto, base::OnceCallback<void(bool)> callback) {
+        return base::ThreadTaskRunnerHandle::Get()->PostTask(
+            FROM_HERE, base::BindOnce(std::move(callback), true));
+      });
 
   base::MockCallback<favicon_base::GoogleFaviconServerCallback> callback;
   EXPECT_CALL(*mock_image_fetcher_,
@@ -205,7 +205,11 @@
   EXPECT_CALL(mock_favicon_service_,
               SetOnDemandFavicons(GURL(kDummyUrl), kExpectedServerUrl,
                                   favicon_base::IconType::kFavicon, _, _))
-      .WillOnce(PostBoolReplyToArg4(true));
+      .WillOnce(
+          [](auto, auto, auto, auto, base::OnceCallback<void(bool)> callback) {
+            return base::ThreadTaskRunnerHandle::Get()->PostTask(
+                FROM_HERE, base::BindOnce(std::move(callback), true));
+          });
 
   large_icon_service_
       .GetLargeIconOrFallbackStyleFromGoogleServerSkippingLocalCache(
@@ -238,7 +242,10 @@
   EXPECT_CALL(mock_favicon_service_,
               CanSetOnDemandFavicons(GURL(kDummyUrl),
                                      favicon_base::IconType::kTouchIcon, _))
-      .WillOnce(PostBoolReplyToArg2(true));
+      .WillOnce([](auto, auto, base::OnceCallback<void(bool)> callback) {
+        return base::ThreadTaskRunnerHandle::Get()->PostTask(
+            FROM_HERE, base::BindOnce(std::move(callback), true));
+      });
 
   base::MockCallback<favicon_base::GoogleFaviconServerCallback> callback;
   EXPECT_CALL(*mock_image_fetcher_,
@@ -248,7 +255,11 @@
   EXPECT_CALL(mock_favicon_service_,
               SetOnDemandFavicons(GURL(kDummyUrl), kExpectedServerUrl,
                                   favicon_base::IconType::kTouchIcon, _, _))
-      .WillOnce(PostBoolReplyToArg4(true));
+      .WillOnce(
+          [](auto, auto, auto, auto, base::OnceCallback<void(bool)> callback) {
+            return base::ThreadTaskRunnerHandle::Get()->PostTask(
+                FROM_HERE, base::BindOnce(std::move(callback), true));
+          });
 
   large_icon_service_
       .GetLargeIconOrFallbackStyleFromGoogleServerSkippingLocalCache(
@@ -274,7 +285,10 @@
   EXPECT_CALL(mock_favicon_service_,
               CanSetOnDemandFavicons(GURL(kDummyUrl),
                                      favicon_base::IconType::kTouchIcon, _))
-      .WillOnce(PostBoolReplyToArg2(true));
+      .WillOnce([](auto, auto, base::OnceCallback<void(bool)> callback) {
+        return base::ThreadTaskRunnerHandle::Get()->PostTask(
+            FROM_HERE, base::BindOnce(std::move(callback), true));
+      });
 
   image_fetcher::RequestMetadata expected_metadata;
   expected_metadata.content_location_header = kExpectedOriginalUrl.spec();
@@ -287,7 +301,11 @@
   EXPECT_CALL(mock_favicon_service_,
               SetOnDemandFavicons(GURL(kDummyUrl), kExpectedOriginalUrl,
                                   favicon_base::IconType::kTouchIcon, _, _))
-      .WillOnce(PostBoolReplyToArg4(true));
+      .WillOnce(
+          [](auto, auto, auto, auto, base::OnceCallback<void(bool)> callback) {
+            return base::ThreadTaskRunnerHandle::Get()->PostTask(
+                FROM_HERE, base::BindOnce(std::move(callback), true));
+          });
 
   base::MockCallback<favicon_base::GoogleFaviconServerCallback> callback;
   large_icon_service_
@@ -314,7 +332,10 @@
   EXPECT_CALL(mock_favicon_service_,
               CanSetOnDemandFavicons(GURL(kDummyUrlWithQuery),
                                      favicon_base::IconType::kTouchIcon, _))
-      .WillOnce(PostBoolReplyToArg2(true));
+      .WillOnce([](auto, auto, base::OnceCallback<void(bool)> callback) {
+        return base::ThreadTaskRunnerHandle::Get()->PostTask(
+            FROM_HERE, base::BindOnce(std::move(callback), true));
+      });
 
   EXPECT_CALL(*mock_image_fetcher_,
               FetchImageAndData_(kExpectedServerUrl, _, _, _))
@@ -340,7 +361,11 @@
   EXPECT_CALL(mock_favicon_service_,
               CanSetOnDemandFavicons(GURL(kDummyUrl),
                                      favicon_base::IconType::kTouchIcon, _))
-      .WillOnce(PostBoolReplyToArg2(true));
+      .WillOnce([](auto, auto, base::OnceCallback<void(bool)> callback) {
+        return base::ThreadTaskRunnerHandle::Get()->PostTask(
+            FROM_HERE, base::BindOnce(std::move(callback), true));
+      });
+
   // The request has no "check_seen=true"; full URL is tested elsewhere.
   EXPECT_CALL(
       *mock_image_fetcher_,
@@ -421,7 +446,10 @@
   EXPECT_CALL(mock_favicon_service_,
               CanSetOnDemandFavicons(GURL(kDummyUrl),
                                      favicon_base::IconType::kTouchIcon, _))
-      .WillOnce(PostBoolReplyToArg2(true));
+      .WillOnce([](auto, auto, base::OnceCallback<void(bool)> callback) {
+        return base::ThreadTaskRunnerHandle::Get()->PostTask(
+            FROM_HERE, base::BindOnce(std::move(callback), true));
+      });
   EXPECT_CALL(mock_favicon_service_, SetOnDemandFavicons(_, _, _, _, _))
       .Times(0);
 
@@ -485,7 +513,10 @@
   EXPECT_CALL(mock_favicon_service_,
               CanSetOnDemandFavicons(GURL(kDummyUrl),
                                      favicon_base::IconType::kTouchIcon, _))
-      .WillOnce(PostBoolReplyToArg2(false));
+      .WillOnce([](auto, auto, base::OnceCallback<void(bool)> callback) {
+        return base::ThreadTaskRunnerHandle::Get()->PostTask(
+            FROM_HERE, base::BindOnce(std::move(callback), false));
+      });
 
   EXPECT_CALL(*mock_image_fetcher_, FetchImageAndData_(_, _, _, _)).Times(0);
   EXPECT_CALL(mock_favicon_service_, SetOnDemandFavicons(_, _, _, _, _))
@@ -562,12 +593,20 @@
     }
   }
 
-  void InjectMockResult(
-      const GURL& page_url,
-      const favicon_base::FaviconRawBitmapResult& mock_result) {
+  // The parameter |mock_result| needs to be passed by value otherwise the
+  // lambda injected into the mock may capture a reference to a temporary,
+  // which would cause Undefined Behaviour.
+  void InjectMockResult(const GURL& page_url,
+                        favicon_base::FaviconRawBitmapResult mock_result) {
     ON_CALL(mock_favicon_service_,
             GetLargestRawFaviconForPageURL(page_url, _, _, _, _))
-        .WillByDefault(PostReply<5>(mock_result));
+        .WillByDefault([=](auto, auto, auto,
+                           favicon_base::FaviconRawBitmapCallback callback,
+                           base::CancelableTaskTracker* tracker) {
+          return tracker->PostTask(
+              base::ThreadTaskRunnerHandle::Get().get(), FROM_HERE,
+              base::BindOnce(std::move(callback), mock_result));
+        });
   }
 
  protected:
diff --git a/components/favicon/core/test/mock_favicon_service.h b/components/favicon/core/test/mock_favicon_service.h
index 546ff66..2384679 100644
--- a/components/favicon/core/test/mock_favicon_service.h
+++ b/components/favicon/core/test/mock_favicon_service.h
@@ -18,15 +18,6 @@
 
 namespace favicon {
 
-ACTION_TEMPLATE(PostReply,
-                HAS_1_TEMPLATE_PARAMS(int, K),
-                AND_1_VALUE_PARAMS(p0)) {
-  auto callback = ::testing::get<K - 2>(args);
-  base::CancelableTaskTracker* tracker = ::testing::get<K - 1>(args);
-  return tracker->PostTask(base::ThreadTaskRunnerHandle::Get().get(), FROM_HERE,
-                           base::BindOnce(callback, p0));
-}
-
 class MockFaviconService : public FaviconService {
  public:
   MockFaviconService();
@@ -35,26 +26,26 @@
   MOCK_METHOD3(GetFaviconImage,
                base::CancelableTaskTracker::TaskId(
                    const GURL& icon_url,
-                   const favicon_base::FaviconImageCallback& callback,
+                   favicon_base::FaviconImageCallback callback,
                    base::CancelableTaskTracker* tracker));
   MOCK_METHOD5(GetRawFavicon,
                base::CancelableTaskTracker::TaskId(
                    const GURL& icon_url,
                    favicon_base::IconType icon_type,
                    int desired_size_in_pixel,
-                   const favicon_base::FaviconRawBitmapCallback& callback,
+                   favicon_base::FaviconRawBitmapCallback callback,
                    base::CancelableTaskTracker* tracker));
   MOCK_METHOD5(GetFavicon,
                base::CancelableTaskTracker::TaskId(
                    const GURL& icon_url,
                    favicon_base::IconType icon_type,
                    int desired_size_in_dip,
-                   const favicon_base::FaviconResultsCallback& callback,
+                   favicon_base::FaviconResultsCallback callback,
                    base::CancelableTaskTracker* tracker));
   MOCK_METHOD3(GetFaviconImageForPageURL,
                base::CancelableTaskTracker::TaskId(
                    const GURL& page_url,
-                   const favicon_base::FaviconImageCallback& callback,
+                   favicon_base::FaviconImageCallback callback,
                    base::CancelableTaskTracker* tracker));
   MOCK_METHOD6(GetRawFaviconForPageURL,
                base::CancelableTaskTracker::TaskId(
@@ -62,21 +53,21 @@
                    const favicon_base::IconTypeSet& icon_types,
                    int desired_size_in_pixel,
                    bool fallback_to_host,
-                   const favicon_base::FaviconRawBitmapCallback& callback,
+                   favicon_base::FaviconRawBitmapCallback callback,
                    base::CancelableTaskTracker* tracker));
   MOCK_METHOD5(GetLargestRawFaviconForPageURL,
                base::CancelableTaskTracker::TaskId(
                    const GURL& page_url,
                    const std::vector<favicon_base::IconTypeSet>& icon_types,
                    int minimum_size_in_pixels,
-                   const favicon_base::FaviconRawBitmapCallback& callback,
+                   favicon_base::FaviconRawBitmapCallback callback,
                    base::CancelableTaskTracker* tracker));
   MOCK_METHOD5(GetFaviconForPageURL,
                base::CancelableTaskTracker::TaskId(
                    const GURL& page_url,
                    const favicon_base::IconTypeSet& icon_types,
                    int desired_size_in_dip,
-                   const favicon_base::FaviconResultsCallback& callback,
+                   favicon_base::FaviconResultsCallback callback,
                    base::CancelableTaskTracker* tracker));
   MOCK_METHOD6(UpdateFaviconMappingsAndFetch,
                base::CancelableTaskTracker::TaskId(
@@ -84,7 +75,7 @@
                    const GURL& icon_url,
                    favicon_base::IconType icon_type,
                    int desired_size_in_dip,
-                   const favicon_base::FaviconResultsCallback& callback,
+                   favicon_base::FaviconResultsCallback callback,
                    base::CancelableTaskTracker* tracker));
   MOCK_METHOD2(DeleteFaviconMappings,
                void(const base::flat_set<GURL>& page_urls,
@@ -92,7 +83,7 @@
   MOCK_METHOD3(GetLargestRawFaviconForID,
                base::CancelableTaskTracker::TaskId(
                    favicon_base::FaviconID favicon_id,
-                   const favicon_base::FaviconRawBitmapCallback& callback,
+                   favicon_base::FaviconRawBitmapCallback callback,
                    base::CancelableTaskTracker* tracker));
   MOCK_METHOD1(SetFaviconOutOfDateForPage, void(const GURL& page_url));
   MOCK_METHOD1(TouchOnDemandFavicon, void(const GURL& icon_url));
@@ -115,32 +106,16 @@
                void(const GURL& page_url_to_read,
                     const favicon_base::IconTypeSet& icon_types,
                     const base::flat_set<GURL>& page_urls_to_write));
-
-  void CanSetOnDemandFavicons(
-      const GURL& page_url,
-      favicon_base::IconType icon_type,
-      base::OnceCallback<void(bool)> callback) const override {
-    // This is a hack to get around Gmock's lack of support for move-only types.
-    return CanSetOnDemandFavicons(page_url, icon_type, &callback);
-  }
   MOCK_CONST_METHOD3(CanSetOnDemandFavicons,
                      void(const GURL& page_url,
                           favicon_base::IconType icon_type,
-                          base::OnceCallback<void(bool)>* callback));
-  void SetOnDemandFavicons(const GURL& page_url,
-                           const GURL& icon_url,
-                           favicon_base::IconType icon_type,
-                           const gfx::Image& image,
-                           base::OnceCallback<void(bool)> callback) override {
-    // This is a hack to get around Gmock's lack of support for move-only types.
-    return SetOnDemandFavicons(page_url, icon_url, icon_type, image, &callback);
-  }
+                          base::OnceCallback<void(bool)> callback));
   MOCK_METHOD5(SetOnDemandFavicons,
                void(const GURL& page_url,
                     const GURL& icon_url,
                     favicon_base::IconType icon_type,
                     const gfx::Image& image,
-                    base::OnceCallback<void(bool)>* callback));
+                    base::OnceCallback<void(bool)> callback));
   MOCK_METHOD1(UnableToDownloadFavicon, void(const GURL& icon_url));
   MOCK_CONST_METHOD1(WasUnableToDownloadFavicon, bool(const GURL& icon_url));
   MOCK_METHOD0(ClearUnableToDownloadFavicons, void());
diff --git a/components/favicon_base/favicon_callback.h b/components/favicon_base/favicon_callback.h
index 318f64c..11ff2d9 100644
--- a/components/favicon_base/favicon_callback.h
+++ b/components/favicon_base/favicon_callback.h
@@ -19,33 +19,34 @@
 
 // Callback for functions that can be used to return a |gfx::Image| and the
 // |GURL| it is loaded from. They are returned as a |FaviconImageResult| object.
-typedef base::Callback<void(const FaviconImageResult&)> FaviconImageCallback;
+typedef base::OnceCallback<void(const FaviconImageResult&)>
+    FaviconImageCallback;
 
 // Callback for functions returning raw data for a favicon. In
 // |FaviconRawBitmapResult|, the data is not yet converted as a |gfx::Image|.
-typedef base::Callback<void(const FaviconRawBitmapResult&)>
+typedef base::OnceCallback<void(const FaviconRawBitmapResult&)>
     FaviconRawBitmapCallback;
 
 // Callback for functions returning raw data for a favicon in multiple
 // resolution. In |FaviconRawBitmapResult|, the data is not yet converted as a
 // |gfx::Image|.
-typedef base::Callback<void(const std::vector<FaviconRawBitmapResult>&)>
+typedef base::OnceCallback<void(const std::vector<FaviconRawBitmapResult>&)>
     FaviconResultsCallback;
 
 // Callback for functions returning data for a large icon. |LargeIconResult|
 // will contain either the raw bitmap for a large icon or the style of the
 // fallback to use if a sufficiently large icon could not be found.
 // TODO(jkrcal): Rename LargeIcon* to LargeIconRawBitmap*.
-typedef base::Callback<void(const LargeIconResult&)> LargeIconCallback;
+typedef base::OnceCallback<void(const LargeIconResult&)> LargeIconCallback;
 
 // Callback for functions returning decoded data for a large icon.
 // |LargeIconImageResult| will contain either the decoded image of a large
 // icon or the style of the fallback to use if a sufficiently large icon could
 // not be found.
-typedef base::Callback<void(const LargeIconImageResult&)>
+typedef base::OnceCallback<void(const LargeIconImageResult&)>
     LargeIconImageCallback;
 
-typedef base::Callback<void(GoogleFaviconServerRequestStatus)>
+typedef base::OnceCallback<void(GoogleFaviconServerRequestStatus)>
     GoogleFaviconServerCallback;
 
 }  // namespace favicon_base
diff --git a/components/history/core/browser/history_service.cc b/components/history/core/browser/history_service.cc
index 9bcaa45..2190d18 100644
--- a/components/history/core/browser/history_service.cc
+++ b/components/history/core/browser/history_service.cc
@@ -70,16 +70,15 @@
 static const char* kHistoryThreadName = "Chrome_HistoryThread";
 
 void RunWithFaviconResults(
-    const favicon_base::FaviconResultsCallback& callback,
+    favicon_base::FaviconResultsCallback callback,
     std::vector<favicon_base::FaviconRawBitmapResult>* bitmap_results) {
   TRACE_EVENT0("browser", "RunWithFaviconResults");
-  callback.Run(*bitmap_results);
+  std::move(callback).Run(*bitmap_results);
 }
 
-void RunWithFaviconResult(
-    const favicon_base::FaviconRawBitmapCallback& callback,
-    favicon_base::FaviconRawBitmapResult* bitmap_result) {
-  callback.Run(*bitmap_result);
+void RunWithFaviconResult(favicon_base::FaviconRawBitmapCallback callback,
+                          favicon_base::FaviconRawBitmapResult* bitmap_result) {
+  std::move(callback).Run(*bitmap_result);
 }
 
 void RunWithQueryURLResult(HistoryService::QueryURLCallback callback,
@@ -480,7 +479,7 @@
     const GURL& icon_url,
     favicon_base::IconType icon_type,
     const std::vector<int>& desired_sizes,
-    const favicon_base::FaviconResultsCallback& callback,
+    favicon_base::FaviconResultsCallback callback,
     base::CancelableTaskTracker* tracker) {
   TRACE_EVENT0("browser", "HistoryService::GetFavicons");
   DCHECK(backend_task_runner_) << "History service being called after cleanup";
@@ -491,7 +490,8 @@
       backend_task_runner_.get(), FROM_HERE,
       base::BindOnce(&HistoryBackend::GetFavicon, history_backend_, icon_url,
                      icon_type, desired_sizes, results),
-      base::BindOnce(&RunWithFaviconResults, callback, base::Owned(results)));
+      base::BindOnce(&RunWithFaviconResults, std::move(callback),
+                     base::Owned(results)));
 }
 
 base::CancelableTaskTracker::TaskId HistoryService::GetFaviconsForURL(
@@ -499,7 +499,7 @@
     const favicon_base::IconTypeSet& icon_types,
     const std::vector<int>& desired_sizes,
     bool fallback_to_host,
-    const favicon_base::FaviconResultsCallback& callback,
+    favicon_base::FaviconResultsCallback callback,
     base::CancelableTaskTracker* tracker) {
   TRACE_EVENT0("browser", "HistoryService::GetFaviconsForURL");
   DCHECK(backend_task_runner_) << "History service being called after cleanup";
@@ -511,14 +511,15 @@
       base::BindOnce(&HistoryBackend::GetFaviconsForURL, history_backend_,
                      page_url, icon_types, desired_sizes, fallback_to_host,
                      results),
-      base::BindOnce(&RunWithFaviconResults, callback, base::Owned(results)));
+      base::BindOnce(&RunWithFaviconResults, std::move(callback),
+                     base::Owned(results)));
 }
 
 base::CancelableTaskTracker::TaskId HistoryService::GetLargestFaviconForURL(
     const GURL& page_url,
     const std::vector<favicon_base::IconTypeSet>& icon_types,
     int minimum_size_in_pixels,
-    const favicon_base::FaviconRawBitmapCallback& callback,
+    favicon_base::FaviconRawBitmapCallback callback,
     base::CancelableTaskTracker* tracker) {
   DCHECK(backend_task_runner_) << "History service being called after cleanup";
   DCHECK(thread_checker_.CalledOnValidThread());
@@ -528,13 +529,14 @@
       backend_task_runner_.get(), FROM_HERE,
       base::BindOnce(&HistoryBackend::GetLargestFaviconForURL, history_backend_,
                      page_url, icon_types, minimum_size_in_pixels, result),
-      base::BindOnce(&RunWithFaviconResult, callback, base::Owned(result)));
+      base::BindOnce(&RunWithFaviconResult, std::move(callback),
+                     base::Owned(result)));
 }
 
 base::CancelableTaskTracker::TaskId HistoryService::GetFaviconForID(
     favicon_base::FaviconID favicon_id,
     int desired_size,
-    const favicon_base::FaviconResultsCallback& callback,
+    favicon_base::FaviconResultsCallback callback,
     base::CancelableTaskTracker* tracker) {
   TRACE_EVENT0("browser", "HistoryService::GetFaviconForID");
   DCHECK(backend_task_runner_) << "History service being called after cleanup";
@@ -545,7 +547,8 @@
       backend_task_runner_.get(), FROM_HERE,
       base::BindOnce(&HistoryBackend::GetFaviconForID, history_backend_,
                      favicon_id, desired_size, results),
-      base::BindOnce(&RunWithFaviconResults, callback, base::Owned(results)));
+      base::BindOnce(&RunWithFaviconResults, std::move(callback),
+                     base::Owned(results)));
 }
 
 base::CancelableTaskTracker::TaskId
@@ -554,7 +557,7 @@
     const GURL& icon_url,
     favicon_base::IconType icon_type,
     const std::vector<int>& desired_sizes,
-    const favicon_base::FaviconResultsCallback& callback,
+    favicon_base::FaviconResultsCallback callback,
     base::CancelableTaskTracker* tracker) {
   TRACE_EVENT0("browser", "HistoryService::UpdateFaviconMappingsAndFetch");
   DCHECK(backend_task_runner_) << "History service being called after cleanup";
@@ -566,7 +569,8 @@
       base::BindOnce(&HistoryBackend::UpdateFaviconMappingsAndFetch,
                      history_backend_, page_urls, icon_url, icon_type,
                      desired_sizes, results),
-      base::BindOnce(&RunWithFaviconResults, callback, base::Owned(results)));
+      base::BindOnce(&RunWithFaviconResults, std::move(callback),
+                     base::Owned(results)));
 }
 
 void HistoryService::DeleteFaviconMappings(
diff --git a/components/history/core/browser/history_service.h b/components/history/core/browser/history_service.h
index c5c79155..102fe88 100644
--- a/components/history/core/browser/history_service.h
+++ b/components/history/core/browser/history_service.h
@@ -638,7 +638,7 @@
       const GURL& icon_url,
       favicon_base::IconType icon_type,
       const std::vector<int>& desired_sizes,
-      const favicon_base::FaviconResultsCallback& callback,
+      favicon_base::FaviconResultsCallback callback,
       base::CancelableTaskTracker* tracker);
 
   // Used by the FaviconService to get favicons mapped to |page_url| for
@@ -658,7 +658,7 @@
       const favicon_base::IconTypeSet& icon_types,
       const std::vector<int>& desired_sizes,
       bool fallback_to_host,
-      const favicon_base::FaviconResultsCallback& callback,
+      favicon_base::FaviconResultsCallback callback,
       base::CancelableTaskTracker* tracker);
 
   // Used by FaviconService to find the first favicon bitmap whose width and
@@ -676,7 +676,7 @@
       const GURL& page_url,
       const std::vector<favicon_base::IconTypeSet>& icon_types,
       int minimum_size_in_pixels,
-      const favicon_base::FaviconRawBitmapCallback& callback,
+      favicon_base::FaviconRawBitmapCallback callback,
       base::CancelableTaskTracker* tracker);
 
   // Used by the FaviconService to get the favicon bitmap which most closely
@@ -686,7 +686,7 @@
   base::CancelableTaskTracker::TaskId GetFaviconForID(
       favicon_base::FaviconID favicon_id,
       int desired_size,
-      const favicon_base::FaviconResultsCallback& callback,
+      favicon_base::FaviconResultsCallback callback,
       base::CancelableTaskTracker* tracker);
 
   // Maps |page_urls| to the favicon at |icon_url| if there is an entry in the
@@ -700,7 +700,7 @@
       const GURL& icon_url,
       favicon_base::IconType icon_type,
       const std::vector<int>& desired_sizes,
-      const favicon_base::FaviconResultsCallback& callback,
+      favicon_base::FaviconResultsCallback callback,
       base::CancelableTaskTracker* tracker);
 
   // Deletes favicon mappings for each URL in |page_urls| and their redirects.
diff --git a/components/infobars/core/infobar_delegate.h b/components/infobars/core/infobar_delegate.h
index 4977559..3cc5079 100644
--- a/components/infobars/core/infobar_delegate.h
+++ b/components/infobars/core/infobar_delegate.h
@@ -161,6 +161,7 @@
     INLINE_UPDATE_FAILED_INFOBAR_ANDROID = 90,
     FLASH_DEPRECATION_INFOBAR_DELEGATE = 91,
     SEND_TAB_TO_SELF_INFOBAR_DELEGATE = 92,
+    TAB_SHARING_INFOBAR_DELEGATE = 93,
   };
 
   // Describes navigation events, used to decide whether infobars should be
@@ -185,7 +186,7 @@
 
   // Returns a unique value identifying the infobar.
   // New implementers must append a new value to the InfoBarIdentifier enum here
-  // and in histograms.xml.
+  // and in histograms/enums.xml.
   virtual InfoBarIdentifier GetIdentifier() const = 0;
 
   virtual InfoBarAutomationType GetInfoBarAutomationType() const;
diff --git a/components/invalidation/impl/json_unsafe_parser.cc b/components/invalidation/impl/json_unsafe_parser.cc
index 8f72ad6..acfa5648 100644
--- a/components/invalidation/impl/json_unsafe_parser.cc
+++ b/components/invalidation/impl/json_unsafe_parser.cc
@@ -22,17 +22,15 @@
           [](const std::string& unsafe_json,
              const SuccessCallback& success_callback,
              const ErrorCallback& error_callback) {
-            std::string error_msg;
-            int error_line, error_column;
-            std::unique_ptr<base::Value> value =
-                base::JSONReader::ReadAndReturnErrorDeprecated(
-                    unsafe_json, base::JSON_ALLOW_TRAILING_COMMAS, nullptr,
-                    &error_msg, &error_line, &error_column);
-            if (value) {
-              success_callback.Run(std::move(value));
+            base::JSONReader::ValueWithError value_with_error =
+                base::JSONReader::ReadAndReturnValueWithError(
+                    unsafe_json, base::JSON_ALLOW_TRAILING_COMMAS);
+            if (value_with_error.value) {
+              success_callback.Run(std::move(*value_with_error.value));
             } else {
               error_callback.Run(base::StringPrintf(
-                  "%s (%d:%d)", error_msg.c_str(), error_line, error_column));
+                  "%s (%d:%d)", value_with_error.error_message.c_str(),
+                  value_with_error.error_line, value_with_error.error_column));
             }
           },
           unsafe_json, success_callback, error_callback));
diff --git a/components/invalidation/impl/json_unsafe_parser.h b/components/invalidation/impl/json_unsafe_parser.h
index c5db7b8..f7dee9c 100644
--- a/components/invalidation/impl/json_unsafe_parser.h
+++ b/components/invalidation/impl/json_unsafe_parser.h
@@ -28,8 +28,7 @@
 // parser is refactored.
 class JsonUnsafeParser {
  public:
-  using SuccessCallback =
-      base::RepeatingCallback<void(std::unique_ptr<base::Value>)>;
+  using SuccessCallback = base::RepeatingCallback<void(base::Value)>;
   using ErrorCallback = base::RepeatingCallback<void(const std::string&)>;
 
   // As with SafeJsonParser, runs either success_callback or error_callback on
diff --git a/components/invalidation/impl/per_user_topic_registration_request.cc b/components/invalidation/impl/per_user_topic_registration_request.cc
index 423690bd..0b2335a 100644
--- a/components/invalidation/impl/per_user_topic_registration_request.cc
+++ b/components/invalidation/impl/per_user_topic_registration_request.cc
@@ -23,14 +23,12 @@
 const char kPublicTopicNameKey[] = "publicTopicName";
 const char kPrivateTopicNameKey[] = "privateTopicName";
 
-base::Value* GetTopicName(base::Value* value) {
-  if (!value || !value->is_dict()) {
+const std::string* GetTopicName(base::Value& value) {
+  if (!value.is_dict())
     return nullptr;
-  }
-  if (value->FindBoolKey("isPublic").value_or(false)) {
-    return value->FindKeyOfType(kPublicTopicNameKey, base::Value::Type::STRING);
-  }
-  return value->FindKeyOfType(kPrivateTopicNameKey, base::Value::Type::STRING);
+  if (value.FindBoolKey("isPublic").value_or(false))
+    return value.FindStringKey(kPublicTopicNameKey);
+  return value.FindStringKey(kPrivateTopicNameKey);
 }
 
 // Subscription status values for UMA_HISTOGRAM.
@@ -181,14 +179,12 @@
            std::string());
 }
 
-void PerUserTopicRegistrationRequest::OnJsonParseSuccess(
-    std::unique_ptr<base::Value> value) {
-  const base::Value* private_topic_name_value = GetTopicName(value.get());
+void PerUserTopicRegistrationRequest::OnJsonParseSuccess(base::Value value) {
+  const std::string* private_topic_name = GetTopicName(value);
   RecordRequestStatus(SubscriptionStatus::kSuccess, type_, topic_);
-  if (private_topic_name_value) {
+  if (private_topic_name) {
     std::move(request_completed_callback_)
-        .Run(Status(StatusCode::SUCCESS, std::string()),
-             private_topic_name_value->GetString());
+        .Run(Status(StatusCode::SUCCESS, std::string()), *private_topic_name);
   } else {
     RecordRequestStatus(SubscriptionStatus::kParsingFailure, type_, topic_);
     std::move(request_completed_callback_)
diff --git a/components/invalidation/impl/per_user_topic_registration_request.h b/components/invalidation/impl/per_user_topic_registration_request.h
index 6083b22..0f07dad 100644
--- a/components/invalidation/impl/per_user_topic_registration_request.h
+++ b/components/invalidation/impl/per_user_topic_registration_request.h
@@ -93,7 +93,7 @@
                                   std::unique_ptr<std::string> response_body);
 
   void OnJsonParseFailure(const std::string& error);
-  void OnJsonParseSuccess(std::unique_ptr<base::Value> parsed_json);
+  void OnJsonParseSuccess(base::Value parsed_json);
 
   // For tests only. Returns the full URL of the request.
   GURL getUrl() const { return url_; }
diff --git a/components/invalidation/public/invalidation_util.h b/components/invalidation/public/invalidation_util.h
index 4e1dd79..d8d8e0d 100644
--- a/components/invalidation/public/invalidation_util.h
+++ b/components/invalidation/public/invalidation_util.h
@@ -50,8 +50,7 @@
 // TODO(https://crbug.com/842655): Convert Repeating to Once.
 using ParseJSONCallback = base::RepeatingCallback<void(
     const std::string& unsafe_json,
-    const base::RepeatingCallback<void(std::unique_ptr<base::Value>)>&
-        success_callback,
+    const base::RepeatingCallback<void(base::Value)>& success_callback,
     const base::RepeatingCallback<void(const std::string&)>& error_callback)>;
 
 struct INVALIDATION_EXPORT ObjectIdLessThan {
diff --git a/components/journey/journey_info_fetcher.cc b/components/journey/journey_info_fetcher.cc
index 7f4d112f..b4aadb51 100644
--- a/components/journey/journey_info_fetcher.cc
+++ b/components/journey/journey_info_fetcher.cc
@@ -28,7 +28,7 @@
     std::vector<int64_t> timestamps,
     FetchResponseAvailableCallback callback) {
   if (!identity_manager_->HasPrimaryAccount()) {
-    FetchFinished(std::move(callback), /*result=*/nullptr,
+    FetchFinished(std::move(callback), /*result=*/base::nullopt,
                   "Primary Account is not Available. Sign in is required");
     return;
   }
@@ -83,8 +83,8 @@
         timestamp_and_callback = std::move(pending_requests_.front());
     pending_requests_.pop();
 
-    FetchFinished(std::move(timestamp_and_callback.second), /*result=*/nullptr,
-                  error.ToString());
+    FetchFinished(std::move(timestamp_and_callback.second),
+                  /*result=*/base::nullopt, error.ToString());
   }
 }
 
@@ -115,7 +115,7 @@
 void JourneyInfoFetcher::JsonRequestDone(
     std::unique_ptr<JourneyInfoJsonRequest> request,
     FetchResponseAvailableCallback callback,
-    std::unique_ptr<base::Value> result,
+    base::Optional<base::Value> result,
     const std::string& error_detail) {
   DCHECK(request);
 
@@ -124,7 +124,7 @@
 }
 
 void JourneyInfoFetcher::FetchFinished(FetchResponseAvailableCallback callback,
-                                       std::unique_ptr<base::Value> result,
+                                       base::Optional<base::Value> result,
                                        const std::string& error_detail) {
   DCHECK((result && !result->is_none()) || error_detail != "");
 
diff --git a/components/journey/journey_info_fetcher.h b/components/journey/journey_info_fetcher.h
index 3dbb84c..a66bf89 100644
--- a/components/journey/journey_info_fetcher.h
+++ b/components/journey/journey_info_fetcher.h
@@ -31,7 +31,7 @@
 class JourneyInfoJsonRequest;
 
 using FetchResponseAvailableCallback =
-    base::OnceCallback<void(std::unique_ptr<base::Value>, const std::string&)>;
+    base::OnceCallback<void(base::Optional<base::Value>, const std::string&)>;
 
 // This class is used to fetch SwitcherJourney information from the server.
 class JourneyInfoFetcher {
@@ -65,12 +65,12 @@
   void AccessTokenError(const GoogleServiceAuthError& error);
 
   void FetchFinished(FetchResponseAvailableCallback callback,
-                     std::unique_ptr<base::Value> result,
+                     base::Optional<base::Value> result,
                      const std::string& error_detail);
 
   void JsonRequestDone(std::unique_ptr<JourneyInfoJsonRequest> request,
                        FetchResponseAvailableCallback callback,
-                       std::unique_ptr<base::Value> result,
+                       base::Optional<base::Value> result,
                        const std::string& error_detail);
 
   identity::IdentityManager* identity_manager_;
diff --git a/components/journey/journey_info_fetcher_unittest.cc b/components/journey/journey_info_fetcher_unittest.cc
index 773cc7793..9b00265 100644
--- a/components/journey/journey_info_fetcher_unittest.cc
+++ b/components/journey/journey_info_fetcher_unittest.cc
@@ -156,7 +156,7 @@
   SetFakeResponse(GURL(kJourneyServer), json_response_string, net::HTTP_OK,
                   net::OK);
   EXPECT_CALL(journey_info_available_callback(),
-              Run(testing::NotNull(), kEmptyErrorString));
+              Run(testing::Ne(base::nullopt), kEmptyErrorString));
 
   SendAndAwaitResponse(kTimestamps);
 
@@ -168,7 +168,7 @@
   identity_test_env().SetAutomaticIssueOfAccessTokens(false);
 
   EXPECT_CALL(journey_info_available_callback(),
-              Run(_, testing::Ne(kEmptyErrorString)));
+              Run(testing::Eq(base::nullopt), testing::Ne(kEmptyErrorString)));
 
   journey_info_fetcher()->FetchJourneyInfo(
       kTimestamps, journey_info_available_callback().Get());
@@ -184,7 +184,7 @@
   SignOut();
 
   EXPECT_CALL(journey_info_available_callback(),
-              Run(_, testing::Ne(kEmptyErrorString)));
+              Run(testing::Eq(base::nullopt), testing::Ne(kEmptyErrorString)));
 
   SendAndAwaitResponse(kTimestamps);
 
@@ -197,7 +197,7 @@
   SetFakeResponse(GURL(kJourneyServer), json_response_string, net::HTTP_OK,
                   net::OK);
   EXPECT_CALL(journey_info_available_callback(),
-              Run(_, testing::Ne(kEmptyErrorString)));
+              Run(testing::Eq(base::nullopt), testing::Ne(kEmptyErrorString)));
 
   SendAndAwaitResponse(kTimestamps);
 
@@ -210,7 +210,7 @@
   SetFakeResponse(GURL(kJourneyServer), json_response_string, net::HTTP_OK,
                   net::OK);
   EXPECT_CALL(journey_info_available_callback(),
-              Run(testing::NotNull(), kEmptyErrorString));
+              Run(testing::Ne(base::nullopt), kEmptyErrorString));
 
   SendAndAwaitResponse(kTimestamps);
 
@@ -223,7 +223,7 @@
   SetFakeResponse(GURL(kJourneyServer), json_response_string, net::HTTP_OK,
                   net::ERR_FAILED);
   EXPECT_CALL(journey_info_available_callback(),
-              Run(_, testing::Ne(kEmptyErrorString)));
+              Run(testing::Eq(base::nullopt), testing::Ne(kEmptyErrorString)));
 
   SendAndAwaitResponse(kTimestamps);
 
@@ -235,7 +235,7 @@
   SetFakeResponse(GURL(kJourneyServer), json_response_string,
                   net::HTTP_BAD_REQUEST, net::OK);
   EXPECT_CALL(journey_info_available_callback(),
-              Run(_, testing::Ne(kEmptyErrorString)));
+              Run(testing::Eq(base::nullopt), testing::Ne(kEmptyErrorString)));
 
   SendAndAwaitResponse(kTimestamps);
 
diff --git a/components/journey/journey_info_json_request.cc b/components/journey/journey_info_json_request.cc
index ead12ccb..b8cba83 100644
--- a/components/journey/journey_info_json_request.cc
+++ b/components/journey/journey_info_json_request.cc
@@ -77,10 +77,11 @@
 
   if (net_error != net::OK) {
     std::move(completed_callback_)
-        .Run(nullptr, base::StringPrintf("Network error code: %d", net_error));
+        .Run(base::nullopt,
+             base::StringPrintf("Network error code: %d", net_error));
   } else if (response_code / 100 != 2) {
     std::move(completed_callback_)
-        .Run(nullptr,
+        .Run(base::nullopt,
              base::StringPrintf("Http response error code: %d", response_code));
   } else {
     last_response_string_ = std::move(*response_body);
@@ -93,14 +94,14 @@
   }
 }
 
-void JourneyInfoJsonRequest::OnJsonParsed(std::unique_ptr<base::Value> result) {
+void JourneyInfoJsonRequest::OnJsonParsed(base::Value result) {
   std::move(completed_callback_).Run(std::move(result), std::string());
 }
 
 void JourneyInfoJsonRequest::OnJsonError(const std::string& error) {
   DLOG(WARNING) << "Received invalid JSON (" << error
                 << "): " << last_response_string_;
-  std::move(completed_callback_).Run(nullptr, error);
+  std::move(completed_callback_).Run(base::nullopt, error);
 }
 
 JourneyInfoJsonRequest::Builder::Builder()
diff --git a/components/journey/journey_info_json_request.h b/components/journey/journey_info_json_request.h
index b8ecffe..2b144afc 100644
--- a/components/journey/journey_info_json_request.h
+++ b/components/journey/journey_info_json_request.h
@@ -33,15 +33,14 @@
 // serializing the request body protos.
 class JourneyInfoJsonRequest {
   // Callbacks for JSON parsing to allow injecting platform-dependent code.
-  using SuccessCallback =
-      base::RepeatingCallback<void(std::unique_ptr<base::Value> result)>;
+  using SuccessCallback = base::RepeatingCallback<void(base::Value result)>;
   using ErrorCallback = base::RepeatingCallback<void(const std::string& error)>;
   using ParseJSONCallback =
       base::RepeatingCallback<void(const std::string& raw_json_string,
                                    const SuccessCallback& success_callback,
                                    const ErrorCallback& error_callback)>;
   using CompletedCallback =
-      base::OnceCallback<void(std::unique_ptr<base::Value> result,
+      base::OnceCallback<void(base::Optional<base::Value> result,
                               const std::string& error_detail)>;
 
  public:
@@ -87,7 +86,7 @@
 
  private:
   void OnSimpleURLLoaderComplete(std::unique_ptr<std::string> response_body);
-  void OnJsonParsed(std::unique_ptr<base::Value> result);
+  void OnJsonParsed(base::Value result);
   void OnJsonError(const std::string& error);
 
   // This callback is called to parse a json string. It contains callbacks for
diff --git a/components/keyed_service/core/BUILD.gn b/components/keyed_service/core/BUILD.gn
index 26cfa413..28c3516d 100644
--- a/components/keyed_service/core/BUILD.gn
+++ b/components/keyed_service/core/BUILD.gn
@@ -45,23 +45,6 @@
   ]
 }
 
-component("test_support") {
-  testonly = true
-
-  output_name = "keyed_service_test_support"
-  sources = [
-    "test_simple_factory_key.cc",
-    "test_simple_factory_key.h",
-  ]
-
-  defines = [ "KEYED_SERVICE_IMPLEMENTATION" ]
-
-  deps = [
-    ":core",
-    "//base",
-  ]
-}
-
 source_set("unit_tests") {
   testonly = true
   sources = [
diff --git a/components/keyed_service/core/simple_factory_key.cc b/components/keyed_service/core/simple_factory_key.cc
index 818c73f9..fae5e1e 100644
--- a/components/keyed_service/core/simple_factory_key.cc
+++ b/components/keyed_service/core/simple_factory_key.cc
@@ -4,6 +4,12 @@
 
 #include "components/keyed_service/core/simple_factory_key.h"
 
-SimpleFactoryKey::SimpleFactoryKey(const base::FilePath& path) : path_(path) {}
+#include "components/keyed_service/core/simple_dependency_manager.h"
+
+SimpleFactoryKey::SimpleFactoryKey(const base::FilePath& path,
+                                   bool is_off_the_record)
+    : path_(path), is_off_the_record_(is_off_the_record) {
+  SimpleDependencyManager::GetInstance()->MarkContextLive(this);
+}
 
 SimpleFactoryKey::~SimpleFactoryKey() = default;
diff --git a/components/keyed_service/core/simple_factory_key.h b/components/keyed_service/core/simple_factory_key.h
index 07ba7d8..6467ff0f 100644
--- a/components/keyed_service/core/simple_factory_key.h
+++ b/components/keyed_service/core/simple_factory_key.h
@@ -17,15 +17,16 @@
 // responsibility of the embedder.
 class KEYED_SERVICE_EXPORT SimpleFactoryKey {
  public:
-  explicit SimpleFactoryKey(const base::FilePath& path);
+  SimpleFactoryKey(const base::FilePath& path, bool is_off_the_record = false);
   virtual ~SimpleFactoryKey();
 
   const base::FilePath& GetPath() const { return path_; }
 
-  virtual bool IsOffTheRecord() const = 0;
+  bool IsOffTheRecord() const { return is_off_the_record_; }
 
  private:
   base::FilePath path_;
+  bool is_off_the_record_;
 
   DISALLOW_COPY_AND_ASSIGN(SimpleFactoryKey);
 };
diff --git a/components/keyed_service/core/test_simple_factory_key.cc b/components/keyed_service/core/test_simple_factory_key.cc
deleted file mode 100644
index 6472137..0000000
--- a/components/keyed_service/core/test_simple_factory_key.cc
+++ /dev/null
@@ -1,15 +0,0 @@
-// Copyright 2019 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "components/keyed_service/core/test_simple_factory_key.h"
-
-TestSimpleFactoryKey::TestSimpleFactoryKey(const base::FilePath& path,
-                                           bool is_off_the_record)
-    : SimpleFactoryKey(path), is_off_the_record_(is_off_the_record) {}
-
-TestSimpleFactoryKey::~TestSimpleFactoryKey() = default;
-
-bool TestSimpleFactoryKey::IsOffTheRecord() const {
-  return is_off_the_record_;
-}
diff --git a/components/keyed_service/core/test_simple_factory_key.h b/components/keyed_service/core/test_simple_factory_key.h
deleted file mode 100644
index d0fcf7c..0000000
--- a/components/keyed_service/core/test_simple_factory_key.h
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright 2019 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef COMPONENTS_KEYED_SERVICE_CORE_TEST_SIMPLE_FACTORY_KEY_H_
-#define COMPONENTS_KEYED_SERVICE_CORE_TEST_SIMPLE_FACTORY_KEY_H_
-
-#include "base/files/file_path.h"
-#include "base/macros.h"
-#include "components/keyed_service/core/simple_factory_key.h"
-
-// A fake SimpleFactoryKey for testing.
-class KEYED_SERVICE_EXPORT TestSimpleFactoryKey : public SimpleFactoryKey {
- public:
-  TestSimpleFactoryKey(const base::FilePath& path,
-                       bool is_off_the_record = false);
-  ~TestSimpleFactoryKey() override;
-
-  // SimpleFactoryKey implementation.
-  bool IsOffTheRecord() const override;
-
- private:
-  bool is_off_the_record_;
-
-  DISALLOW_COPY_AND_ASSIGN(TestSimpleFactoryKey);
-};
-
-#endif  // COMPONENTS_KEYED_SERVICE_CORE_TEST_SIMPLE_FACTORY_KEY_H_
diff --git a/components/nacl/browser/nacl_process_host.cc b/components/nacl/browser/nacl_process_host.cc
index 565dfc2..eadd21e9 100644
--- a/components/nacl/browser/nacl_process_host.cc
+++ b/components/nacl/browser/nacl_process_host.cc
@@ -409,10 +409,6 @@
     }
   }
 
-  // Create a shared memory region that the renderer and plugin share for
-  // reporting crash information.
-  crash_info_shmem_.CreateAnonymous(kNaClCrashInfoShmemSize);
-
   // Launch the process
   if (!LaunchSelLdr()) {
     delete this;
@@ -629,20 +625,19 @@
 void NaClProcessHost::ReplyToRenderer(
     mojo::ScopedMessagePipeHandle ppapi_channel_handle,
     mojo::ScopedMessagePipeHandle trusted_channel_handle,
-    mojo::ScopedMessagePipeHandle manifest_service_channel_handle) {
+    mojo::ScopedMessagePipeHandle manifest_service_channel_handle,
+    base::ReadOnlySharedMemoryRegion crash_info_shmem_region) {
   // Hereafter, we always send an IPC message with handles created above
   // which, on Windows, are not closable in this process.
   std::string error_message;
-  base::SharedMemoryHandle crash_info_shmem_renderer_handle =
-      crash_info_shmem_.handle().Duplicate();
-  if (!crash_info_shmem_renderer_handle.IsValid()) {
+  if (!uses_nonsfi_mode_ && !crash_info_shmem_region.IsValid()) {
     // On error, we do not send "IPC::ChannelHandle"s to the renderer process.
     // Note that some other FDs/handles still get sent to the renderer, but
     // will be closed there.
     ppapi_channel_handle.reset();
     trusted_channel_handle.reset();
     manifest_service_channel_handle.reset();
-    error_message = "handle duplication failed";
+    error_message = "shared memory region not valid";
   }
 
   const ChildProcessData& data = process_->GetData();
@@ -650,12 +645,8 @@
       NaClLaunchResult(
           ppapi_channel_handle.release(), trusted_channel_handle.release(),
           manifest_service_channel_handle.release(), data.GetProcess().Pid(),
-          data.id, crash_info_shmem_renderer_handle),
+          data.id, std::move(crash_info_shmem_region)),
       error_message);
-
-  // Now that the crash information shmem handles have been shared with the
-  // plugin and the renderer, the browser can close its handle.
-  crash_info_shmem_.Close();
 }
 
 void NaClProcessHost::SendErrorToRenderer(const std::string& error_message) {
@@ -797,9 +788,12 @@
 #endif
   }
 
-  params.crash_info_shmem_handle = crash_info_shmem_.handle().Duplicate();
-  if (!params.crash_info_shmem_handle.IsValid()) {
-    DLOG(ERROR) << "Failed to duplicate a shared memory buffer";
+  // Create a shared memory region that the renderer and the plugin share to
+  // report crash information.
+  params.crash_info_shmem_region =
+      base::WritableSharedMemoryRegion::Create(kNaClCrashInfoShmemSize);
+  if (!params.crash_info_shmem_region.IsValid()) {
+    DLOG(ERROR) << "Failed to create a shared memory buffer";
     return false;
   }
 
@@ -832,14 +826,16 @@
       // into the plugin process.
       base::PostTaskWithTraitsAndReplyWithResult(
           FROM_HERE, {base::MayBlock(), base::TaskPriority::BEST_EFFORT},
-          base::Bind(OpenNaClReadExecImpl, file_path, true /* is_executable */),
-          base::Bind(&NaClProcessHost::StartNaClFileResolved,
-                     weak_factory_.GetWeakPtr(), params, file_path));
+          base::BindOnce(OpenNaClReadExecImpl, file_path,
+                         true /* is_executable */),
+          base::BindOnce(&NaClProcessHost::StartNaClFileResolved,
+                         weak_factory_.GetWeakPtr(), std::move(params),
+                         file_path));
       return true;
     }
   }
 
-  StartNaClFileResolved(params, base::FilePath(), base::File());
+  StartNaClFileResolved(std::move(params), base::FilePath(), base::File());
   return true;
 }
 
@@ -878,10 +874,12 @@
 
     // On success, send back a success message to the renderer process,
     // and transfer the channel handles for the NaCl loader process to
-    // |params|.
+    // |params|. Also send an invalid shared memory region as nonsfi_mode
+    // does not use the region.
     ReplyToRenderer(std::move(ppapi_renderer_channel.handle1),
                     std::move(trusted_service_channel.handle1),
-                    std::move(manifest_service_channel.handle1));
+                    std::move(manifest_service_channel.handle1),
+                    base::ReadOnlySharedMemoryRegion());
     params.ppapi_browser_channel_handle =
         ppapi_browser_channel.handle0.release();
     params.ppapi_renderer_channel_handle =
@@ -893,7 +891,7 @@
   }
 #endif
 
-  process_->Send(new NaClProcessMsg_Start(params));
+  process_->Send(new NaClProcessMsg_Start(std::move(params)));
 }
 
 bool NaClProcessHost::StartPPAPIProxy(
@@ -965,7 +963,8 @@
     const IPC::ChannelHandle& raw_ppapi_browser_channel_handle,
     const IPC::ChannelHandle& raw_ppapi_renderer_channel_handle,
     const IPC::ChannelHandle& raw_trusted_renderer_channel_handle,
-    const IPC::ChannelHandle& raw_manifest_service_channel_handle) {
+    const IPC::ChannelHandle& raw_manifest_service_channel_handle,
+    base::ReadOnlySharedMemoryRegion crash_info_shmem_region) {
   DCHECK(raw_ppapi_browser_channel_handle.is_mojo_channel_handle());
   DCHECK(raw_ppapi_renderer_channel_handle.is_mojo_channel_handle());
   DCHECK(raw_trusted_renderer_channel_handle.is_mojo_channel_handle());
@@ -988,7 +987,8 @@
   // Let the renderer know that the IPC channels are established.
   ReplyToRenderer(std::move(ppapi_renderer_channel_handle),
                   std::move(trusted_renderer_channel_handle),
-                  std::move(manifest_service_channel_handle));
+                  std::move(manifest_service_channel_handle),
+                  std::move(crash_info_shmem_region));
 }
 
 bool NaClProcessHost::StartWithLaunchedProcess() {
diff --git a/components/nacl/browser/nacl_process_host.h b/components/nacl/browser/nacl_process_host.h
index 9771dbae..afdd695b 100644
--- a/components/nacl/browser/nacl_process_host.h
+++ b/components/nacl/browser/nacl_process_host.h
@@ -15,8 +15,8 @@
 #include "base/files/file.h"
 #include "base/files/file_path.h"
 #include "base/macros.h"
+#include "base/memory/read_only_shared_memory_region.h"
 #include "base/memory/ref_counted.h"
-#include "base/memory/shared_memory.h"
 #include "base/memory/weak_ptr.h"
 #include "base/process/process.h"
 #include "components/nacl/common/nacl_types.h"
@@ -144,7 +144,8 @@
   void ReplyToRenderer(
       mojo::ScopedMessagePipeHandle ppapi_channel_handle,
       mojo::ScopedMessagePipeHandle trusted_channel_handle,
-      mojo::ScopedMessagePipeHandle manifest_service_channel_handle);
+      mojo::ScopedMessagePipeHandle manifest_service_channel_handle,
+      base::ReadOnlySharedMemoryRegion crash_info_shmem_region);
 
   // Sends the reply with error message to the renderer.
   void SendErrorToRenderer(const std::string& error_message);
@@ -194,7 +195,8 @@
       const IPC::ChannelHandle& ppapi_browser_channel_handle,
       const IPC::ChannelHandle& ppapi_renderer_channel_handle,
       const IPC::ChannelHandle& trusted_renderer_channel_handle,
-      const IPC::ChannelHandle& manifest_service_channel_handle);
+      const IPC::ChannelHandle& manifest_service_channel_handle,
+      base::ReadOnlySharedMemoryRegion crash_info_shmem_region);
 
   GURL manifest_url_;
   base::File nexe_file_;
@@ -246,10 +248,6 @@
   // Throttling time in milliseconds for PpapiHostMsg_Keepalive IPCs.
   static unsigned keepalive_throttle_interval_milliseconds_;
 
-  // Shared memory provided to the plugin and renderer for
-  // reporting crash information.
-  base::SharedMemory crash_info_shmem_;
-
   base::WeakPtrFactory<NaClProcessHost> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(NaClProcessHost);
diff --git a/components/nacl/common/nacl_host_messages.h b/components/nacl/common/nacl_host_messages.h
index f7c55882..da22992 100644
--- a/components/nacl/common/nacl_host_messages.h
+++ b/components/nacl/common/nacl_host_messages.h
@@ -44,7 +44,7 @@
   IPC_STRUCT_TRAITS_MEMBER(manifest_service_ipc_channel_handle)
   IPC_STRUCT_TRAITS_MEMBER(plugin_pid)
   IPC_STRUCT_TRAITS_MEMBER(plugin_child_id)
-  IPC_STRUCT_TRAITS_MEMBER(crash_info_shmem_handle)
+  IPC_STRUCT_TRAITS_MEMBER(crash_info_shmem_region)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(nacl::PnaclCacheInfo)
diff --git a/components/nacl/common/nacl_messages.h b/components/nacl/common/nacl_messages.h
index d6862ab0..052527a 100644
--- a/components/nacl/common/nacl_messages.h
+++ b/components/nacl/common/nacl_messages.h
@@ -8,6 +8,7 @@
 
 #include <stdint.h>
 
+#include "base/memory/read_only_shared_memory_region.h"
 #include "base/process/process.h"
 #include "build/build_config.h"
 #include "components/nacl/common/nacl_types.h"
@@ -38,7 +39,7 @@
   IPC_STRUCT_TRAITS_MEMBER(version)
   IPC_STRUCT_TRAITS_MEMBER(enable_debug_stub)
   IPC_STRUCT_TRAITS_MEMBER(process_type)
-  IPC_STRUCT_TRAITS_MEMBER(crash_info_shmem_handle)
+  IPC_STRUCT_TRAITS_MEMBER(crash_info_shmem_region)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(nacl::NaClResourcePrefetchResult)
@@ -129,8 +130,10 @@
 // created successfully.
 // This is used for SFI mode only. Non-SFI mode passes channel handles in
 // NaClStartParams instead.
-IPC_MESSAGE_CONTROL4(NaClProcessHostMsg_PpapiChannelsCreated,
-                     IPC::ChannelHandle, /* browser_channel_handle */
-                     IPC::ChannelHandle, /* ppapi_renderer_channel_handle */
-                     IPC::ChannelHandle, /* trusted_renderer_channel_handle */
-                     IPC::ChannelHandle /* manifest_service_channel_handle */)
+IPC_MESSAGE_CONTROL5(
+    NaClProcessHostMsg_PpapiChannelsCreated,
+    IPC::ChannelHandle, /* browser_channel_handle */
+    IPC::ChannelHandle, /* ppapi_renderer_channel_handle */
+    IPC::ChannelHandle, /* trusted_renderer_channel_handle */
+    IPC::ChannelHandle, /* manifest_service_channel_handle */
+    base::ReadOnlySharedMemoryRegion /* crash_info_shmem_region */)
diff --git a/components/nacl/common/nacl_types.cc b/components/nacl/common/nacl_types.cc
index 76bbfa65..88934a1 100644
--- a/components/nacl/common/nacl_types.cc
+++ b/components/nacl/common/nacl_types.cc
@@ -19,7 +19,7 @@
       process_type(kUnknownNaClProcessType) {
 }
 
-NaClStartParams::NaClStartParams(const NaClStartParams& other) = default;
+NaClStartParams::NaClStartParams(NaClStartParams&& other) = default;
 
 NaClStartParams::~NaClStartParams() {
 }
@@ -98,14 +98,13 @@
     const IPC::ChannelHandle& manifest_service_ipc_channel_handle,
     base::ProcessId plugin_pid,
     int plugin_child_id,
-    base::SharedMemoryHandle crash_info_shmem_handle)
+    base::ReadOnlySharedMemoryRegion crash_info_shmem_region)
     : ppapi_ipc_channel_handle(ppapi_ipc_channel_handle),
       trusted_ipc_channel_handle(trusted_ipc_channel_handle),
       manifest_service_ipc_channel_handle(manifest_service_ipc_channel_handle),
       plugin_pid(plugin_pid),
       plugin_child_id(plugin_child_id),
-      crash_info_shmem_handle(crash_info_shmem_handle) {
-}
+      crash_info_shmem_region(std::move(crash_info_shmem_region)) {}
 
 NaClLaunchResult::~NaClLaunchResult() {
 }
diff --git a/components/nacl/common/nacl_types.h b/components/nacl/common/nacl_types.h
index 6c99162..495629a 100644
--- a/components/nacl/common/nacl_types.h
+++ b/components/nacl/common/nacl_types.h
@@ -11,7 +11,8 @@
 #include <utility>
 #include <vector>
 
-#include "base/memory/shared_memory.h"
+#include "base/memory/read_only_shared_memory_region.h"
+#include "base/memory/writable_shared_memory_region.h"
 #include "base/process/process_handle.h"
 #include "build/build_config.h"
 #include "ipc/ipc_channel.h"
@@ -67,7 +68,7 @@
 // Parameters sent to the NaCl process when we start it.
 struct NaClStartParams {
   NaClStartParams();
-  NaClStartParams(const NaClStartParams& other);
+  NaClStartParams(NaClStartParams&& other);
   ~NaClStartParams();
 
   IPC::PlatformFileForTransit nexe_file;
@@ -103,11 +104,14 @@
   NaClAppProcessType process_type;
 
   // For NaCl <-> renderer crash information reporting.
-  base::SharedMemoryHandle crash_info_shmem_handle;
+  base::WritableSharedMemoryRegion crash_info_shmem_region;
 
   // NOTE: Any new fields added here must also be added to the IPC
   // serialization in nacl_messages.h and (for POD fields) the constructor
   // in nacl_types.cc.
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(NaClStartParams);
 };
 
 // Parameters sent to the browser process to have it launch a NaCl process.
@@ -153,7 +157,7 @@
       const IPC::ChannelHandle& manifest_service_ipc_channel_handle,
       base::ProcessId plugin_pid,
       int plugin_child_id,
-      base::SharedMemoryHandle crash_info_shmem_handle);
+      base::ReadOnlySharedMemoryRegion crash_info_shmem_region);
   ~NaClLaunchResult();
 
   // For plugin <-> renderer PPAPI communication.
@@ -170,7 +174,10 @@
   int plugin_child_id;
 
   // For NaCl <-> renderer crash information reporting.
-  base::SharedMemoryHandle crash_info_shmem_handle;
+  base::ReadOnlySharedMemoryRegion crash_info_shmem_region;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(NaClLaunchResult);
 };
 
 }  // namespace nacl
diff --git a/components/nacl/loader/nacl_listener.cc b/components/nacl/loader/nacl_listener.cc
index db8875fb..8f89078 100644
--- a/components/nacl/loader/nacl_listener.cc
+++ b/components/nacl/loader/nacl_listener.cc
@@ -19,6 +19,7 @@
 
 #include "base/command_line.h"
 #include "base/logging.h"
+#include "base/memory/read_only_shared_memory_region.h"
 #include "base/message_loop/message_loop.h"
 #include "base/rand_util.h"
 #include "base/run_loop.h"
@@ -282,7 +283,7 @@
   }
 }
 
-void NaClListener::OnStart(const nacl::NaClStartParams& params) {
+void NaClListener::OnStart(nacl::NaClStartParams params) {
   is_started_ = true;
 #if defined(OS_LINUX) || defined(OS_MACOSX)
   int urandom_fd = HANDLE_EINTR(dup(base::GetUrandomFD()));
@@ -294,10 +295,13 @@
   struct NaClApp* nap = NULL;
   NaClChromeMainInit();
 
-  CHECK(base::SharedMemory::IsHandleValid(params.crash_info_shmem_handle));
-  crash_info_shmem_.reset(new base::SharedMemory(
-      params.crash_info_shmem_handle, false /* not readonly */));
-  CHECK(crash_info_shmem_->Map(nacl::kNaClCrashInfoShmemSize));
+  CHECK(params.crash_info_shmem_region.IsValid());
+  crash_info_shmem_mapping_ = params.crash_info_shmem_region.Map();
+  base::ReadOnlySharedMemoryRegion ro_shmem_region =
+      base::WritableSharedMemoryRegion::ConvertToReadOnly(
+          std::move(params.crash_info_shmem_region));
+  CHECK(crash_info_shmem_mapping_.IsValid());
+  CHECK(ro_shmem_region.IsValid());
   NaClSetFatalErrorCallback(&FatalLogHandler);
 
   nap = NaClAppCreate();
@@ -330,7 +334,7 @@
   if (!Send(new NaClProcessHostMsg_PpapiChannelsCreated(
           browser_handle, ppapi_renderer_handle,
           MakeRequest(&renderer_host).PassMessagePipe().release(),
-          manifest_service_handle)))
+          manifest_service_handle, ro_shmem_region)))
     LOG(FATAL) << "Failed to send IPC channel handle to NaClProcessHost.";
 
   trusted_listener_ = std::make_unique<NaClTrustedListener>(
diff --git a/components/nacl/loader/nacl_listener.h b/components/nacl/loader/nacl_listener.h
index ed95cc37..e3be7cc 100644
--- a/components/nacl/loader/nacl_listener.h
+++ b/components/nacl/loader/nacl_listener.h
@@ -14,7 +14,7 @@
 
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
-#include "base/memory/shared_memory.h"
+#include "base/memory/shared_memory_mapping.h"
 #include "base/single_thread_task_runner.h"
 #include "base/synchronization/waitable_event.h"
 #include "base/threading/thread.h"
@@ -50,7 +50,9 @@
   }
 #endif
 
-  void* crash_info_shmem_memory() const { return crash_info_shmem_->memory(); }
+  void* crash_info_shmem_memory() const {
+    return crash_info_shmem_mapping_.memory();
+  }
 
   NaClTrustedListener* trusted_listener() const {
     return trusted_listener_.get();
@@ -79,7 +81,7 @@
 
   void OnAddPrefetchedResource(
       const nacl::NaClResourcePrefetchResult& prefetched_resource_file);
-  void OnStart(const nacl::NaClStartParams& params);
+  void OnStart(nacl::NaClStartParams params);
 
   // A channel back to the browser.
   std::unique_ptr<IPC::SyncChannel> channel_;
@@ -102,7 +104,7 @@
   int number_of_cores_;
 #endif
 
-  std::unique_ptr<base::SharedMemory> crash_info_shmem_;
+  base::WritableSharedMemoryMapping crash_info_shmem_mapping_;
 
   std::unique_ptr<NaClTrustedListener> trusted_listener_;
 
diff --git a/components/nacl/renderer/nexe_load_manager.cc b/components/nacl/renderer/nexe_load_manager.cc
index 206bab7..2f2bd61 100644
--- a/components/nacl/renderer/nexe_load_manager.cc
+++ b/components/nacl/renderer/nexe_load_manager.cc
@@ -9,6 +9,7 @@
 
 #include "base/command_line.h"
 #include "base/logging.h"
+#include "base/memory/shared_memory_mapping.h"
 #include "base/metrics/histogram.h"
 #include "base/strings/string_tokenizer.h"
 #include "base/strings/string_util.h"
@@ -101,8 +102,6 @@
     base::TimeDelta uptime = base::Time::Now() - ready_time_;
     HistogramTimeLarge("NaCl.ModuleUptime.Normal", uptime.InMilliseconds());
   }
-  if (base::SharedMemory::IsHandleValid(crash_info_shmem_handle_))
-    base::SharedMemory::CloseHandle(crash_info_shmem_handle_);
 }
 
 void NexeLoadManager::NexeFileDidOpen(int32_t pp_error,
@@ -260,23 +259,15 @@
   // invocation will just be a no-op, since the entire crash log will
   // have been received and we'll just get an EOF indication.
 
-  base::SharedMemory shmem(crash_info_shmem_handle_, true);
-  // When shmem goes out of scope, the handle will be closed. Invalidate
-  // our handle so our destructor doesn't try to close it again.
-  crash_info_shmem_handle_ = base::SharedMemoryHandle();
-  if (shmem.Map(kNaClCrashInfoShmemSize)) {
-    uint32_t crash_log_length;
-    // We cast the length value to volatile here to prevent the compiler from
-    // reordering instructions in a way that could introduce a TOCTTOU race.
-    crash_log_length = *(static_cast<volatile uint32_t*>(shmem.memory()));
-    crash_log_length = std::min<uint32_t>(crash_log_length,
-                                          kNaClCrashInfoMaxLogSize);
-
-    std::unique_ptr<char[]> crash_log_data(new char[kNaClCrashInfoShmemSize]);
-    memcpy(crash_log_data.get(),
-           static_cast<char*>(shmem.memory()) + sizeof(uint32_t),
-           crash_log_length);
-    std::string crash_log(crash_log_data.get(), crash_log_length);
+  base::ReadOnlySharedMemoryMapping shmem_mapping =
+      crash_info_shmem_region_.MapAt(0, kNaClCrashInfoShmemSize);
+  if (shmem_mapping.IsValid()) {
+    base::BufferIterator<const uint8_t> buffer =
+        shmem_mapping.GetMemoryAsBufferIterator<uint8_t>();
+    const uint32_t* crash_log_length = buffer.Object<uint32_t>();
+    base::span<const uint8_t> data = buffer.Span<uint8_t>(
+        std::min<uint32_t>(*crash_log_length, kNaClCrashInfoMaxLogSize));
+    std::string crash_log(data.begin(), data.end());
     CopyCrashLogToJsConsole(crash_log);
   }
 }
diff --git a/components/nacl/renderer/nexe_load_manager.h b/components/nacl/renderer/nexe_load_manager.h
index ae68b2f..e6a07f7 100644
--- a/components/nacl/renderer/nexe_load_manager.h
+++ b/components/nacl/renderer/nexe_load_manager.h
@@ -13,7 +13,7 @@
 
 #include "base/files/file.h"
 #include "base/macros.h"
-#include "base/memory/shared_memory.h"
+#include "base/memory/read_only_shared_memory_region.h"
 #include "base/memory/weak_ptr.h"
 #include "base/time/time.h"
 #include "components/nacl/renderer/ppb_nacl_private.h"
@@ -115,8 +115,9 @@
 
   const std::string& program_url() const { return program_url_; }
 
-  void set_crash_info_shmem_handle(base::SharedMemoryHandle h) {
-    crash_info_shmem_handle_ = h;
+  void set_crash_info_shmem_region(
+      base::ReadOnlySharedMemoryRegion shmem_region) {
+    crash_info_shmem_region_ = std::move(shmem_region);
   }
 
   bool nonsfi() const { return nonsfi_; }
@@ -184,7 +185,7 @@
   // A flag that indicates if the plugin is using Non-SFI mode.
   bool nonsfi_;
 
-  base::SharedMemoryHandle crash_info_shmem_handle_;
+  base::ReadOnlySharedMemoryRegion crash_info_shmem_region_;
 
   std::unique_ptr<TrustedPluginChannel> trusted_plugin_channel_;
   std::unique_ptr<ManifestServiceChannel> manifest_service_channel_;
diff --git a/components/nacl/renderer/ppb_nacl_private_impl.cc b/components/nacl/renderer/ppb_nacl_private_impl.cc
index 0cb13c17..31cc2fec 100644
--- a/components/nacl/renderer/ppb_nacl_private_impl.cc
+++ b/components/nacl/renderer/ppb_nacl_private_impl.cc
@@ -487,10 +487,6 @@
     // Even on error, some FDs/handles may be passed to here.
     // We must release those resources.
     // See also nacl_process_host.cc.
-    if (base::SharedMemory::IsHandleValid(
-            launch_result.crash_info_shmem_handle))
-      base::SharedMemory::CloseHandle(launch_result.crash_info_shmem_handle);
-
     if (PP_ToBool(main_service_runtime)) {
       load_manager->ReportLoadError(PP_NACL_ERROR_SEL_LDR_LAUNCH,
                                     "ServiceRuntime: failed to start",
@@ -527,8 +523,8 @@
   }
 
   // Store the crash information shared memory handle.
-  load_manager->set_crash_info_shmem_handle(
-      launch_result.crash_info_shmem_handle);
+  load_manager->set_crash_info_shmem_region(
+      std::move(launch_result.crash_info_shmem_region));
 
   // Create the trusted plugin channel.
   if (!IsValidChannelHandle(launch_result.trusted_ipc_channel_handle)) {
diff --git a/components/ntp_tiles/json_unsafe_parser.cc b/components/ntp_tiles/json_unsafe_parser.cc
index e1281f0..0399d5a 100644
--- a/components/ntp_tiles/json_unsafe_parser.cc
+++ b/components/ntp_tiles/json_unsafe_parser.cc
@@ -22,17 +22,15 @@
           [](const std::string& unsafe_json,
              const SuccessCallback& success_callback,
              const ErrorCallback& error_callback) {
-            std::string error_msg;
-            int error_line, error_column;
-            std::unique_ptr<base::Value> value =
-                base::JSONReader::ReadAndReturnErrorDeprecated(
-                    unsafe_json, base::JSON_ALLOW_TRAILING_COMMAS, nullptr,
-                    &error_msg, &error_line, &error_column);
-            if (value) {
-              success_callback.Run(std::move(value));
+            base::JSONReader::ValueWithError value_with_error =
+                base::JSONReader::ReadAndReturnValueWithError(
+                    unsafe_json, base::JSON_ALLOW_TRAILING_COMMAS);
+            if (value_with_error.value) {
+              success_callback.Run(std::move(*value_with_error.value));
             } else {
               error_callback.Run(base::StringPrintf(
-                  "%s (%d:%d)", error_msg.c_str(), error_line, error_column));
+                  "%s (%d:%d)", value_with_error.error_message.c_str(),
+                  value_with_error.error_line, value_with_error.error_column));
             }
           },
           unsafe_json, success_callback, error_callback));
diff --git a/components/ntp_tiles/json_unsafe_parser.h b/components/ntp_tiles/json_unsafe_parser.h
index 4a5a1f47..c985357 100644
--- a/components/ntp_tiles/json_unsafe_parser.h
+++ b/components/ntp_tiles/json_unsafe_parser.h
@@ -23,7 +23,7 @@
 // iOS), then this class mimics its API without its safety.
 class JsonUnsafeParser {
  public:
-  using SuccessCallback = base::Callback<void(std::unique_ptr<base::Value>)>;
+  using SuccessCallback = base::Callback<void(base::Value)>;
   using ErrorCallback = base::Callback<void(const std::string&)>;
 
   // As with SafeJsonParser, runs either success_callback or error_callback on
diff --git a/components/ntp_tiles/popular_sites_impl.cc b/components/ntp_tiles/popular_sites_impl.cc
index a7dae36..f1c72c88 100644
--- a/components/ntp_tiles/popular_sites_impl.cc
+++ b/components/ntp_tiles/popular_sites_impl.cc
@@ -471,9 +471,9 @@
                              weak_ptr_factory_.GetWeakPtr()));
 }
 
-void PopularSitesImpl::OnJsonParsed(std::unique_ptr<base::Value> json) {
+void PopularSitesImpl::OnJsonParsed(base::Value json) {
   std::unique_ptr<base::ListValue> list =
-      base::ListValue::From(std::move(json));
+      base::ListValue::From(base::Value::ToUniquePtrValue(std::move(json)));
   if (!list) {
     DLOG(WARNING) << "JSON is not a list";
     OnDownloadFailed();
diff --git a/components/ntp_tiles/popular_sites_impl.h b/components/ntp_tiles/popular_sites_impl.h
index 43588d0..ab84011 100644
--- a/components/ntp_tiles/popular_sites_impl.h
+++ b/components/ntp_tiles/popular_sites_impl.h
@@ -41,7 +41,7 @@
 
 using ParseJSONCallback = base::Callback<void(
     const std::string& unsafe_json,
-    const base::Callback<void(std::unique_ptr<base::Value>)>& success_callback,
+    const base::Callback<void(base::Value)>& success_callback,
     const base::Callback<void(const std::string&)>& error_callback)>;
 
 // Actual (non-test) implementation of the PopularSites interface. Caches the
@@ -80,7 +80,7 @@
   // Called once SimpleURLLoader completes the network request.
   void OnSimpleLoaderComplete(std::unique_ptr<std::string> response_body);
 
-  void OnJsonParsed(std::unique_ptr<base::Value> json);
+  void OnJsonParsed(base::Value json);
   void OnJsonParseFailed(const std::string& error_message);
   void OnDownloadFailed();
 
diff --git a/components/omnibox/browser/favicon_cache_unittest.cc b/components/omnibox/browser/favicon_cache_unittest.cc
index 0c596573..985cb2e9 100644
--- a/components/omnibox/browser/favicon_cache_unittest.cc
+++ b/components/omnibox/browser/favicon_cache_unittest.cc
@@ -14,7 +14,6 @@
 using testing::_;
 using testing::DoAll;
 using testing::Return;
-using testing::SaveArg;
 
 namespace {
 
@@ -65,8 +64,10 @@
           GetFaviconImageForPageURL(kUrlA, _ /* callback */, _ /* tracker */))
           .Times(a_site_calls)
           .WillRepeatedly(
-              DoAll(SaveArg<1>(&favicon_service_a_site_response_),
-                    Return(base::CancelableTaskTracker::kBadTaskId)));
+              [&](auto, favicon_base::FaviconImageCallback callback, auto) {
+                favicon_service_a_site_response_ = std::move(callback);
+                return base::CancelableTaskTracker::kBadTaskId;
+              });
     }
 
     if (b_site_calls > 0) {
@@ -75,8 +76,10 @@
           GetFaviconImageForPageURL(kUrlB, _ /* callback */, _ /* tracker */))
           .Times(b_site_calls)
           .WillRepeatedly(
-              DoAll(SaveArg<1>(&favicon_service_b_site_response_),
-                    Return(base::CancelableTaskTracker::kBadTaskId)));
+              [&](auto, favicon_base::FaviconImageCallback callback, auto) {
+                favicon_service_b_site_response_ = std::move(callback);
+                return base::CancelableTaskTracker::kBadTaskId;
+              });
     }
   }
 
@@ -103,7 +106,7 @@
   // Expect the synchronous result to be empty.
   EXPECT_TRUE(result.IsEmpty());
 
-  favicon_service_a_site_response_.Run(GetDummyFaviconResult());
+  std::move(favicon_service_a_site_response_).Run(GetDummyFaviconResult());
 
   // Re-request the same favicon and expect a non-empty result now that the
   // cache is populated. The above EXPECT_CALL will also verify that the
@@ -135,7 +138,7 @@
         kUrlA, base::BindOnce(&VerifyFetchedFaviconAndCount, &response_count));
   }
 
-  favicon_service_a_site_response_.Run(GetDummyFaviconResult());
+  std::move(favicon_service_a_site_response_).Run(GetDummyFaviconResult());
 
   EXPECT_EQ(10, response_count);
 }
@@ -158,7 +161,7 @@
   EXPECT_EQ(0, a_site_response_count);
   EXPECT_EQ(0, b_site_response_count);
 
-  favicon_service_b_site_response_.Run(GetDummyFaviconResult());
+  std::move(favicon_service_b_site_response_).Run(GetDummyFaviconResult());
 
   EXPECT_EQ(0, a_site_response_count);
   EXPECT_EQ(1, b_site_response_count);
@@ -173,7 +176,7 @@
   EXPECT_EQ(0, a_site_response_count);
   EXPECT_EQ(1, b_site_response_count);
 
-  favicon_service_a_site_response_.Run(GetDummyFaviconResult());
+  std::move(favicon_service_a_site_response_).Run(GetDummyFaviconResult());
 
   EXPECT_EQ(2, a_site_response_count);
   EXPECT_EQ(1, b_site_response_count);
@@ -195,8 +198,8 @@
       cache_.GetFaviconForPageUrl(kUrlB, base::BindOnce(&VerifyFetchedFavicon))
           .IsEmpty());
 
-  favicon_service_a_site_response_.Run(GetDummyFaviconResult());
-  favicon_service_b_site_response_.Run(GetDummyFaviconResult());
+  std::move(favicon_service_a_site_response_).Run(GetDummyFaviconResult());
+  std::move(favicon_service_b_site_response_).Run(GetDummyFaviconResult());
 
   EXPECT_FALSE(
       cache_.GetFaviconForPageUrl(kUrlA, base::BindOnce(&Fail)).IsEmpty());
@@ -216,7 +219,7 @@
       cache_.GetFaviconForPageUrl(kUrlB, base::BindOnce(&Fail)).IsEmpty());
 
   // Restore the cache entry for kUrlA.
-  favicon_service_a_site_response_.Run(GetDummyFaviconResult());
+  std::move(favicon_service_a_site_response_).Run(GetDummyFaviconResult());
 
   // Delete all history.
   cache_.OnURLsDeleted(nullptr /* history_service */,
@@ -235,7 +238,8 @@
 
   EXPECT_TRUE(
       cache_.GetFaviconForPageUrl(kUrlA, base::BindOnce(&Fail)).IsEmpty());
-  favicon_service_a_site_response_.Run(favicon_base::FaviconImageResult());
+  std::move(favicon_service_a_site_response_)
+      .Run(favicon_base::FaviconImageResult());
 
   // The mock FaviconService's EXPECT_CALL verifies that we do not make another
   // call to FaviconService.
@@ -248,7 +252,8 @@
 
   EXPECT_TRUE(
       cache_.GetFaviconForPageUrl(kUrlA, base::BindOnce(&Fail)).IsEmpty());
-  favicon_service_a_site_response_.Run(favicon_base::FaviconImageResult());
+  std::move(favicon_service_a_site_response_)
+      .Run(favicon_base::FaviconImageResult());
 
   cache_.OnURLVisited(nullptr /* history_service */, ui::PAGE_TRANSITION_LINK,
                       history::URLRow(kUrlA), history::RedirectList(),
@@ -259,7 +264,7 @@
   EXPECT_TRUE(
       cache_.GetFaviconForPageUrl(kUrlA, base::BindOnce(&VerifyFetchedFavicon))
           .IsEmpty());
-  favicon_service_a_site_response_.Run(GetDummyFaviconResult());
+  std::move(favicon_service_a_site_response_).Run(GetDummyFaviconResult());
   EXPECT_FALSE(
       cache_.GetFaviconForPageUrl(kUrlA, base::BindOnce(&Fail)).IsEmpty());
 }
@@ -273,8 +278,10 @@
       cache_.GetFaviconForPageUrl(kUrlB, base::BindOnce(&Fail)).IsEmpty());
 
   // Simulate responses to both requests.
-  favicon_service_a_site_response_.Run(favicon_base::FaviconImageResult());
-  favicon_service_b_site_response_.Run(favicon_base::FaviconImageResult());
+  std::move(favicon_service_a_site_response_)
+      .Run(favicon_base::FaviconImageResult());
+  std::move(favicon_service_b_site_response_)
+      .Run(favicon_base::FaviconImageResult());
 
   cache_.OnFaviconsChanged({kUrlA}, GURL());
 
diff --git a/components/omnibox/browser/omnibox_field_trial.cc b/components/omnibox/browser/omnibox_field_trial.cc
index 36f811f..565495d 100644
--- a/components/omnibox/browser/omnibox_field_trial.cc
+++ b/components/omnibox/browser/omnibox_field_trial.cc
@@ -314,7 +314,7 @@
     // enough to be inline autocompleted (1400+), even after demotion it will
     // score above 850 ( 1400 * 0.61 > 850).  850 is the maximum score for
     // queries when the input has been detected as URL-seeking.
-    constexpr char kDemoteURLs[] = "1:61,2:61,3:61,4:61,16:61";
+    constexpr char kDemoteURLs[] = "1:61,2:61,3:61,4:61,16:61,24:61";
 #if defined(OS_ANDROID)
     if (current_page_classification == OmniboxEventProto::
         SEARCH_RESULT_PAGE_NO_SEARCH_TERM_REPLACEMENT)
diff --git a/components/optimization_guide/proto/hints.proto b/components/optimization_guide/proto/hints.proto
index 1401eb62..a45de45 100644
--- a/components/optimization_guide/proto/hints.proto
+++ b/components/optimization_guide/proto/hints.proto
@@ -301,3 +301,33 @@
   // A list of per-optimization blacklists.
   repeated OptimizationFilter optimization_blacklists = 2;
 }
+
+message Timestamp {
+  // Represents seconds of UTC time since Unix epoch
+  // 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
+  // 9999-12-31T23:59:59Z inclusive.
+  optional int64 seconds = 1;
+
+  // Non-negative fractions of a second at nanosecond resolution. Negative
+  // second values with fractions must still have non-negative nanos values
+  // that count forward in time. Must be from 0 to 999,999,999
+  // inclusive.
+  optional int32 nanos = 2;
+}
+
+enum HintSource {
+  HINT_SOURCE_UNKNOWN = 0;
+  // Served from the Chrome Optimization Hints Component.
+  HINT_SOURCE_OPTIMIZATION_HINTS_COMPONENT = 1;
+  // Served from the Chrome Optimization Guide Service.
+  HINT_SOURCE_OPTIMIZATION_GUIDE_SERVICE = 2;
+}
+
+message Version {
+  reserved 2;
+
+  // The time the hint was generated.
+  optional Timestamp generation_timestamp = 1;
+  // The source from which the hint was served from.
+  optional HintSource hint_source = 3;
+}
diff --git a/components/password_manager/core/browser/new_password_form_manager.cc b/components/password_manager/core/browser/new_password_form_manager.cc
index b31542e..8cbe1ec4 100644
--- a/components/password_manager/core/browser/new_password_form_manager.cc
+++ b/components/password_manager/core/browser/new_password_form_manager.cc
@@ -593,8 +593,9 @@
 }
 
 bool NewPasswordFormManager::ProvisionallySave(
-    const autofill::FormData& submitted_form,
-    const PasswordManagerDriver* driver) {
+    const FormData& submitted_form,
+    const PasswordManagerDriver* driver,
+    bool is_gaia_with_skip_save_password_form) {
   DCHECK(DoesManage(submitted_form, driver));
 
   std::unique_ptr<PasswordForm> parsed_submitted_form =
@@ -609,6 +610,8 @@
     return is_submitted_;
 
   parsed_submitted_form_ = std::move(parsed_submitted_form);
+  parsed_submitted_form_->is_gaia_with_skip_save_password_form =
+      is_gaia_with_skip_save_password_form;
   submitted_form_ = submitted_form;
   is_submitted_ = true;
   CalculateFillingAssistanceMetric(submitted_form);
diff --git a/components/password_manager/core/browser/new_password_form_manager.h b/components/password_manager/core/browser/new_password_form_manager.h
index 8f5c08c..80cbe48 100644
--- a/components/password_manager/core/browser/new_password_form_manager.h
+++ b/components/password_manager/core/browser/new_password_form_manager.h
@@ -86,8 +86,11 @@
   // |submitted_form| and |driver|) then saves |submitted_form| to
   // |submitted_form_| field, sets |is_submitted| = true and returns true.
   // Otherwise returns false.
+  // |is_gaia_with_skip_save_password_form| is true iff this is Gaia form which
+  // should be skipped on saving.
   bool ProvisionallySave(const autofill::FormData& submitted_form,
-                         const PasswordManagerDriver* driver);
+                         const PasswordManagerDriver* driver,
+                         bool is_gaia_with_skip_save_password_form);
 
   // If |submitted_form| is managed by *this then saves |submitted_form| to
   // |submitted_form_| field, sets |is_submitted| = true and returns true.
diff --git a/components/password_manager/core/browser/new_password_form_manager_unittest.cc b/components/password_manager/core/browser/new_password_form_manager_unittest.cc
index 303e1c5..3c6e16d 100644
--- a/components/password_manager/core/browser/new_password_form_manager_unittest.cc
+++ b/components/password_manager/core/browser/new_password_form_manager_unittest.cc
@@ -552,7 +552,8 @@
 
 TEST_F(NewPasswordFormManagerTest, SetSubmitted) {
   EXPECT_FALSE(form_manager_->is_submitted());
-  EXPECT_TRUE(form_manager_->ProvisionallySave(submitted_form_, &driver_));
+  EXPECT_TRUE(
+      form_manager_->ProvisionallySave(submitted_form_, &driver_, false));
   EXPECT_TRUE(form_manager_->is_submitted());
 
   FormData another_form = submitted_form_;
@@ -560,13 +561,14 @@
 #if !defined(OS_IOS)
   // |another_form| is managed because the same |unique_renderer_id| as
   // |observed_form_|.
-  EXPECT_TRUE(form_manager_->ProvisionallySave(another_form, &driver_));
+  EXPECT_TRUE(form_manager_->ProvisionallySave(another_form, &driver_, false));
   EXPECT_TRUE(form_manager_->is_submitted());
 #endif
 }
 
 TEST_F(NewPasswordFormManagerTest, SetSubmittedMultipleTimes) {
-  EXPECT_TRUE(form_manager_->ProvisionallySave(submitted_form_, &driver_));
+  EXPECT_TRUE(
+      form_manager_->ProvisionallySave(submitted_form_, &driver_, false));
   EXPECT_TRUE(form_manager_->is_submitted());
 
   // Make the submitted form to be invalid password form.
@@ -574,7 +576,8 @@
 
   // Expect that |form_manager_| is still in submitted state because the first
   // time the submited form was valid.
-  EXPECT_TRUE(form_manager_->ProvisionallySave(submitted_form_, &driver_));
+  EXPECT_TRUE(
+      form_manager_->ProvisionallySave(submitted_form_, &driver_, false));
   EXPECT_TRUE(form_manager_->is_submitted());
   EXPECT_TRUE(form_manager_->GetSubmittedForm());
 }
@@ -649,7 +652,8 @@
   TestMockTimeTaskRunner::ScopedContext scoped_context(task_runner_.get());
   fetcher_->NotifyFetchCompleted();
 
-  EXPECT_TRUE(form_manager_->ProvisionallySave(submitted_form_, &driver_));
+  EXPECT_TRUE(
+      form_manager_->ProvisionallySave(submitted_form_, &driver_, false));
   CheckPendingCredentials(parsed_submitted_form_,
                           form_manager_->GetPendingCredentials());
   EXPECT_EQ(UserAction::kOverrideUsernameAndPassword,
@@ -662,7 +666,8 @@
   TestMockTimeTaskRunner::ScopedContext scoped_context(task_runner_.get());
   SetNonFederatedAndNotifyFetchCompleted({&saved_match_});
 
-  EXPECT_TRUE(form_manager_->ProvisionallySave(submitted_form_, &driver_));
+  EXPECT_TRUE(
+      form_manager_->ProvisionallySave(submitted_form_, &driver_, false));
   CheckPendingCredentials(parsed_submitted_form_,
                           form_manager_->GetPendingCredentials());
   EXPECT_EQ(UserAction::kOverrideUsernameAndPassword,
@@ -686,7 +691,8 @@
   for (bool is_incognito : {false, true}) {
     EXPECT_CALL(client_, IsIncognito).WillOnce(Return(is_incognito));
     form_manager_->Fill();
-    EXPECT_TRUE(form_manager_->ProvisionallySave(submitted_form_, &driver_));
+    EXPECT_TRUE(
+        form_manager_->ProvisionallySave(submitted_form_, &driver_, false));
     CheckPendingCredentials(/* expected */ saved_match_,
                             form_manager_->GetPendingCredentials());
     EXPECT_EQ(is_incognito ? UserAction::kChoose : UserAction::kNone,
@@ -711,7 +717,8 @@
   submitted_form_.fields[kPasswordFieldIndex].value =
       saved_match_.password_value;
 
-  EXPECT_TRUE(form_manager_->ProvisionallySave(submitted_form_, &driver_));
+  EXPECT_TRUE(
+      form_manager_->ProvisionallySave(submitted_form_, &driver_, false));
   CheckPendingCredentials(expected, form_manager_->GetPendingCredentials());
   EXPECT_EQ(UserAction::kChoosePslMatch,
             form_manager_->GetMetricsRecorder()->GetUserAction());
@@ -729,7 +736,8 @@
   submitted_form_.fields[kUsernameFieldIndex].value =
       saved_match_.username_value;
   submitted_form_.fields[kPasswordFieldIndex].value = expected.password_value;
-  EXPECT_TRUE(form_manager_->ProvisionallySave(submitted_form_, &driver_));
+  EXPECT_TRUE(
+      form_manager_->ProvisionallySave(submitted_form_, &driver_, false));
   CheckPendingCredentials(expected, form_manager_->GetPendingCredentials());
   EXPECT_EQ(UserAction::kOverridePassword,
             form_manager_->GetMetricsRecorder()->GetUserAction());
@@ -748,7 +756,8 @@
   PasswordForm expected = saved_match_;
   expected.password_value = ASCIIToUTF16("verystrongpassword");
 
-  EXPECT_TRUE(form_manager_->ProvisionallySave(submitted_form, &driver_));
+  EXPECT_TRUE(
+      form_manager_->ProvisionallySave(submitted_form, &driver_, false));
   CheckPendingCredentials(expected, form_manager_->GetPendingCredentials());
   EXPECT_EQ(UserAction::kOverridePassword,
             form_manager_->GetMetricsRecorder()->GetUserAction());
@@ -770,7 +779,8 @@
   PasswordForm expected = saved_match_;
   expected.password_value = ASCIIToUTF16("verystrongpassword");
 
-  EXPECT_TRUE(form_manager_->ProvisionallySave(submitted_form, &driver_));
+  EXPECT_TRUE(
+      form_manager_->ProvisionallySave(submitted_form, &driver_, false));
   CheckPendingCredentials(expected, form_manager_->GetPendingCredentials());
 }
 
@@ -789,7 +799,8 @@
 
   form_manager_->ProcessServerPredictions(predictions);
 
-  EXPECT_TRUE(form_manager_->ProvisionallySave(anonymous_signup, &driver_));
+  EXPECT_TRUE(
+      form_manager_->ProvisionallySave(anonymous_signup, &driver_, false));
   EXPECT_EQ(ASCIIToUTF16("a password"),
             form_manager_->GetPendingCredentials().password_value);
 }
@@ -809,7 +820,7 @@
   submitted_form.fields[kPasswordFieldIndex].value = ASCIIToUTF16("password");
 
   // Expect no crash.
-  form_manager_->ProvisionallySave(submitted_form, &driver_);
+  form_manager_->ProvisionallySave(submitted_form, &driver_, false);
 }
 
 TEST_F(NewPasswordFormManagerTest, IsEqualToSubmittedForm) {
@@ -825,7 +836,8 @@
   // No submitted form yet.
   EXPECT_FALSE(form_manager_->IsEqualToSubmittedForm(submitted_form));
 
-  ASSERT_TRUE(form_manager_->ProvisionallySave(submitted_form, &driver_));
+  ASSERT_TRUE(
+      form_manager_->ProvisionallySave(submitted_form, &driver_, false));
 
   observed_form_.unique_renderer_id += 10;
   observed_form_.fields.clear();
@@ -849,7 +861,8 @@
   submitted_form.fields[kUsernameFieldIndex].value = new_username;
   submitted_form.fields[kPasswordFieldIndex].value = new_password;
 
-  EXPECT_TRUE(form_manager_->ProvisionallySave(submitted_form, &driver_));
+  EXPECT_TRUE(
+      form_manager_->ProvisionallySave(submitted_form, &driver_, false));
   EXPECT_TRUE(form_manager_->IsNewLogin());
 
   MockFormSaver& form_saver = MockFormSaver::Get(form_manager_.get());
@@ -898,7 +911,8 @@
   submitted_form.fields[kPasswordFieldIndex].value =
       psl_saved_match_.password_value;
 
-  EXPECT_TRUE(form_manager_->ProvisionallySave(submitted_form, &driver_));
+  EXPECT_TRUE(
+      form_manager_->ProvisionallySave(submitted_form, &driver_, false));
   EXPECT_TRUE(form_manager_->IsNewLogin());
   EXPECT_TRUE(form_manager_->IsPendingCredentialsPublicSuffixMatch());
 
@@ -934,7 +948,8 @@
   submitted_form.fields[kUsernameFieldIndex].value = username;
   submitted_form.fields[kPasswordFieldIndex].value = new_password;
 
-  EXPECT_TRUE(form_manager_->ProvisionallySave(submitted_form, &driver_));
+  EXPECT_TRUE(
+      form_manager_->ProvisionallySave(submitted_form, &driver_, false));
   EXPECT_FALSE(form_manager_->IsNewLogin());
   EXPECT_TRUE(form_manager_->IsPasswordOverridden());
 
@@ -969,7 +984,8 @@
   base::string16 new_password = saved_match_.password_value + ASCIIToUTF16("1");
   submitted_form.fields[1].value = new_password;
 
-  EXPECT_TRUE(form_manager_->ProvisionallySave(submitted_form, &driver_));
+  EXPECT_TRUE(
+      form_manager_->ProvisionallySave(submitted_form, &driver_, false));
   EXPECT_FALSE(form_manager_->IsNewLogin());
   EXPECT_TRUE(form_manager_->IsPasswordOverridden());
   EXPECT_TRUE(form_manager_->IsPasswordUpdate());
@@ -1006,7 +1022,8 @@
     auto new_password = saved_match_.password_value + ASCIIToUTF16("1");
     submitted_form.fields[1].value = new_password;
 
-    EXPECT_TRUE(form_manager_->ProvisionallySave(submitted_form, &driver_));
+    EXPECT_TRUE(
+        form_manager_->ProvisionallySave(submitted_form, &driver_, false));
 
     std::map<base::string16, autofill::ServerFieldType> expected_types;
     expected_types[ASCIIToUTF16("password")] = autofill::PASSWORD;
@@ -1036,7 +1053,7 @@
   TestMockTimeTaskRunner::ScopedContext scoped_context(task_runner_.get());
   fetcher_->NotifyFetchCompleted();
 
-  form_manager_->ProvisionallySave(submitted_form_, &driver_);
+  form_manager_->ProvisionallySave(submitted_form_, &driver_, false);
 
   base::string16 new_username =
       parsed_submitted_form_.username_value + ASCIIToUTF16("1");
@@ -1059,7 +1076,7 @@
       ASCIIToUTF16("automatically_chosen_username");
   submitted_form_.fields[0].value = user_chosen_username;
   submitted_form_.fields[1].value = automatically_chosen_username;
-  form_manager_->ProvisionallySave(submitted_form_, &driver_);
+  form_manager_->ProvisionallySave(submitted_form_, &driver_, false);
 
   EXPECT_EQ(automatically_chosen_username,
             form_manager_->GetPendingCredentials().username_value);
@@ -1088,7 +1105,7 @@
   TestMockTimeTaskRunner::ScopedContext scoped_context(task_runner_.get());
   SetNonFederatedAndNotifyFetchCompleted({&saved_match_});
 
-  form_manager_->ProvisionallySave(submitted_form_, &driver_);
+  form_manager_->ProvisionallySave(submitted_form_, &driver_, false);
 
   base::string16 new_username = saved_match_.username_value;
   base::string16 expected_password = parsed_submitted_form_.password_value;
@@ -1106,7 +1123,7 @@
   TestMockTimeTaskRunner::ScopedContext scoped_context(task_runner_.get());
   fetcher_->NotifyFetchCompleted();
 
-  form_manager_->ProvisionallySave(submitted_form_, &driver_);
+  form_manager_->ProvisionallySave(submitted_form_, &driver_, false);
 
   base::string16 new_password =
       parsed_submitted_form_.password_value + ASCIIToUTF16("1");
@@ -1134,7 +1151,7 @@
   // Emulate submitting form with known username and different password.
   submitted_form_.fields[kUsernameFieldIndex].value =
       saved_match_.username_value;
-  form_manager_->ProvisionallySave(submitted_form_, &driver_);
+  form_manager_->ProvisionallySave(submitted_form_, &driver_, false);
 
   // The user changes password to already saved one.
   base::string16 password = saved_match_.password_value;
@@ -1155,7 +1172,7 @@
   base::string16 pin = ASCIIToUTF16("pin");
   form.fields[0].value = password;
   form.fields[1].value = pin;
-  form_manager_->ProvisionallySave(form, &driver_);
+  form_manager_->ProvisionallySave(form, &driver_, false);
 
   // Check that a second password field is chosen for saving.
   EXPECT_EQ(pin, form_manager_->GetPendingCredentials().password_value);
@@ -1212,7 +1229,8 @@
   fetcher_->NotifyFetchCompleted();
 
   // Provisionally save in order to create pending credentials.
-  ASSERT_TRUE(form_manager_->ProvisionallySave(submitted_form_, &driver_));
+  ASSERT_TRUE(
+      form_manager_->ProvisionallySave(submitted_form_, &driver_, false));
 
   std::unique_ptr<NewPasswordFormManager> cloned_manager =
       form_manager_->Clone();
@@ -1307,7 +1325,8 @@
   ukm::TestAutoSetUkmRecorder test_ukm_recorder;
   SetNonFederatedAndNotifyFetchCompleted({&saved_match_});
 
-  EXPECT_TRUE(form_manager_->ProvisionallySave(submitted_form_, &driver_));
+  EXPECT_TRUE(
+      form_manager_->ProvisionallySave(submitted_form_, &driver_, false));
 
   // Destroy the form manager to destroy the UKM recorder it owns. The recorder
   // only records metrics in its destructor.
@@ -1331,7 +1350,8 @@
 
   FormData malformed_form = submitted_form_;
   malformed_form.fields.clear();
-  EXPECT_FALSE(form_manager_->ProvisionallySave(malformed_form, &driver_));
+  EXPECT_FALSE(
+      form_manager_->ProvisionallySave(malformed_form, &driver_, false));
 
   // Destroy the form manager to destroy the UKM recorder it owns. The recorder
   // only records metrics in its destructor.
@@ -1476,7 +1496,8 @@
       .WillOnce(SaveArg<0>(&saved_form));
   EXPECT_CALL(client_, UpdateFormManagers());
 
-  EXPECT_TRUE(form_manager_->ProvisionallySave(submitted_form_, &driver_));
+  EXPECT_TRUE(
+      form_manager_->ProvisionallySave(submitted_form_, &driver_, false));
   form_manager_->Save();
 
   EXPECT_EQ(submitted_form_.fields[kUsernameFieldIndex].value,
@@ -1709,7 +1730,8 @@
   submitted_form.fields[kUsernameFieldIndex].value = username;
   submitted_form.fields[kPasswordFieldIndex].value = new_password;
 
-  EXPECT_TRUE(form_manager_->ProvisionallySave(submitted_form, &driver_));
+  EXPECT_TRUE(
+      form_manager_->ProvisionallySave(submitted_form, &driver_, false));
 
   MockFormSaver& form_saver = MockFormSaver::Get(form_manager_.get());
   PasswordForm updated_form;
@@ -1750,7 +1772,7 @@
 
   base::HistogramTester histogram_tester;
   //  Simulate successful submission.
-  form_manager_->ProvisionallySave(submitted_form_, &driver_);
+  form_manager_->ProvisionallySave(submitted_form_, &driver_, false);
   form_manager_->GetMetricsRecorder()->LogSubmitPassed();
 
   form_manager_.reset();
@@ -1767,7 +1789,8 @@
     CreateFormManager(observed_form_);
     fetcher_->NotifyFetchCompleted();
 
-    EXPECT_TRUE(form_manager_->ProvisionallySave(submitted_form_, &driver_));
+    EXPECT_TRUE(
+        form_manager_->ProvisionallySave(submitted_form_, &driver_, false));
 
     if (password_revealed)
       form_manager_->OnPasswordsRevealed();
@@ -1794,7 +1817,8 @@
       form_manager_->SetGenerationPopupWasShown(
           true /*generation_popup_was_shown*/, false /*is_manual_generation*/);
     }
-    EXPECT_TRUE(form_manager_->ProvisionallySave(submitted_form_, &driver_));
+    EXPECT_TRUE(
+        form_manager_->ProvisionallySave(submitted_form_, &driver_, false));
 
     EXPECT_CALL(
         mock_autofill_download_manager_,
@@ -1819,7 +1843,8 @@
       form_manager_->SetGenerationPopupWasShown(
           true /*generation_popup_was_shown*/, false /*is_manual_generation*/);
     }
-    EXPECT_TRUE(form_manager_->ProvisionallySave(submitted_form_, &driver_));
+    EXPECT_TRUE(
+        form_manager_->ProvisionallySave(submitted_form_, &driver_, false));
 
     EXPECT_CALL(
         mock_autofill_download_manager_,
diff --git a/components/password_manager/core/browser/password_autofill_manager_unittest.cc b/components/password_manager/core/browser/password_autofill_manager_unittest.cc
index 243eca4..d4a2e06 100644
--- a/components/password_manager/core/browser/password_autofill_manager_unittest.cc
+++ b/components/password_manager/core/browser/password_autofill_manager_unittest.cc
@@ -254,15 +254,18 @@
     favicon::MockFaviconService favicon_service;
     EXPECT_CALL(*client, GetFaviconService())
         .WillOnce(Return(&favicon_service));
-    favicon_base::FaviconImageCallback callback;
+    favicon_base::FaviconImageCallback saved_callback;
     EXPECT_CALL(favicon_service, GetFaviconImageForPageURL(data.origin, _, _))
-        .WillOnce(DoAll(testing::SaveArg<1>(&callback), Return(1)));
+        .WillOnce([&](auto, favicon_base::FaviconImageCallback callback, auto) {
+          saved_callback = std::move(callback);
+          return 1;
+        });
     password_autofill_manager_->OnAddPasswordFillData(data);
 
     // Resolve the favicon.
     favicon_base::FaviconImageResult image_result;
     image_result.image = gfx::test::CreateImage(16, 16);
-    callback.Run(image_result);
+    std::move(saved_callback).Run(image_result);
 
     std::vector<autofill::PopupItemId> ids = {
         is_suggestion_on_password_field
diff --git a/components/password_manager/core/browser/password_manager.cc b/components/password_manager/core/browser/password_manager.cc
index 76f1a5b1..2d2b194c 100644
--- a/components/password_manager/core/browser/password_manager.cc
+++ b/components/password_manager/core/browser/password_manager.cc
@@ -647,7 +647,8 @@
     password_manager::PasswordManagerDriver* driver,
     const PasswordForm& password_form) {
   if (IsNewFormParsingForSavingEnabled())
-    ProvisionallySaveForm(password_form.form_data, driver, false);
+    ProvisionallySaveForm(password_form.form_data, driver, false,
+                          password_form.is_gaia_with_skip_save_password_form);
 
   ProvisionallySavePassword(password_form, driver);
 }
@@ -682,8 +683,10 @@
     return;
   }
 
-  if (IsNewFormParsingForSavingEnabled())
-    ProvisionallySaveForm(password_form.form_data, driver, false);
+  if (IsNewFormParsingForSavingEnabled()) {
+    ProvisionallySaveForm(password_form.form_data, driver, false,
+                          password_form.is_gaia_with_skip_save_password_form);
+  }
 
   ProvisionallySavePassword(password_form, driver);
 
@@ -703,8 +706,9 @@
 
   std::unique_ptr<PasswordFormManagerInterface> manager;
   if (IsNewFormParsingForSavingEnabled()) {
-    NewPasswordFormManager* matched_manager =
-        ProvisionallySaveForm(password_form.form_data, driver, true);
+    NewPasswordFormManager* matched_manager = ProvisionallySaveForm(
+        password_form.form_data, driver, true,
+        password_form.is_gaia_with_skip_save_password_form);
     manager = matched_manager ? matched_manager->Clone() : nullptr;
   } else {
     manager = FindAndCloneMatchedPasswordFormManager(
@@ -916,7 +920,8 @@
 NewPasswordFormManager* PasswordManager::ProvisionallySaveForm(
     const FormData& submitted_form,
     PasswordManagerDriver* driver,
-    bool is_manual_fallback) {
+    bool is_manual_fallback,
+    bool is_gaia_with_skip_save_password_form) {
   std::unique_ptr<BrowserSavePasswordProgressLogger> logger;
   if (password_manager_util::IsLoggingActive(client_)) {
     logger.reset(
@@ -972,7 +977,8 @@
     return nullptr;
   }
 
-  if (!matched_manager->ProvisionallySave(submitted_form, driver))
+  if (!matched_manager->ProvisionallySave(submitted_form, driver,
+                                          is_gaia_with_skip_save_password_form))
     return nullptr;
 
   // Set all other form managers to no submission state.
@@ -1162,8 +1168,14 @@
                             visible_forms.begin(),
                             visible_forms.end());
 
-  if (!did_stop_loading)
+  if (!did_stop_loading && !submitted_manager->GetSubmittedForm()
+                                ->is_gaia_with_skip_save_password_form) {
+    // |is_gaia_with_skip_save_password_form| = true means that this is a Chrome
+    // sign-in page. Chrome sign-in pages are redirected to an empty pages, and
+    // for some reasons |did_stop_loading| might be false. So |did_stop_loading|
+    // is ignored for them.
     return;
+  }
 
   // If we see the login form again, then the login failed.
   if (submitted_manager->GetPendingCredentials().scheme ==
diff --git a/components/password_manager/core/browser/password_manager.h b/components/password_manager/core/browser/password_manager.h
index 8a28fd38..e4e6af0 100644
--- a/components/password_manager/core/browser/password_manager.h
+++ b/components/password_manager/core/browser/password_manager.h
@@ -282,9 +282,15 @@
   // and the matched form manager has not recieved yet response from the
   // password store, then nullptr is returned. Returns manager which manages
   // |form|.
-  NewPasswordFormManager* ProvisionallySaveForm(const autofill::FormData& form,
-                                                PasswordManagerDriver* driver,
-                                                bool is_manual_fallback);
+  // |is_gaia_with_skip_save_password_form| is true iff this is Gaia form which
+  // should be skipped on saving.
+  // TODO(https://crbug.com/949519): move |is_gaia_with_skip_save_password_form|
+  // from PasswordForm to FormData, and remove it from arguments.
+  NewPasswordFormManager* ProvisionallySaveForm(
+      const autofill::FormData& form,
+      PasswordManagerDriver* driver,
+      bool is_manual_fallback,
+      bool is_gaia_with_skip_save_password_form);
 
   // Passes |form| to NewPasswordFormManager that manages it for using it after
   // detecting submission success for saving.
diff --git a/components/password_manager/core/browser/password_manager_unittest.cc b/components/password_manager/core/browser/password_manager_unittest.cc
index 548567e..65e726f 100644
--- a/components/password_manager/core/browser/password_manager_unittest.cc
+++ b/components/password_manager/core/browser/password_manager_unittest.cc
@@ -330,6 +330,7 @@
   PasswordForm MakeSimpleGAIAForm() {
     PasswordForm form = MakeSimpleForm();
     form.origin = GURL("https://accounts.google.com");
+    form.form_data.url = form.origin;
     form.signon_realm = form.origin.spec();
     return form;
   }
@@ -1285,31 +1286,53 @@
 
 #if defined(SYNC_PASSWORD_REUSE_DETECTION_ENABLED)
 TEST_F(PasswordManagerTest, HashSavedOnGaiaFormWithSkipSavePassword) {
-  std::vector<PasswordForm> observed;
-  PasswordForm form(MakeSimpleGAIAForm());
-  // Simulate that this is Gaia form that should be ignored for saving/filling.
-  form.is_gaia_with_skip_save_password_form = true;
-  observed.push_back(form);
-  EXPECT_CALL(client_, IsSavingAndFillingEnabled(form.origin))
-      .WillRepeatedly(Return(true));
-  manager()->OnPasswordFormsParsed(&driver_, observed);
-  manager()->OnPasswordFormsRendered(&driver_, observed, true);
+  for (bool did_stop_loading : {false, true}) {
+    for (bool only_new_parser : {false, true}) {
+      SCOPED_TRACE(testing::Message("did_stop_loading = ")
+                   << did_stop_loading
+                   << testing::Message(" only_new_parser = ")
+                   << only_new_parser);
+      base::test::ScopedFeatureList scoped_feature_list;
+      if (only_new_parser) {
+        TurnOnOnlyNewParser(&scoped_feature_list);
+        EXPECT_CALL(*store_, GetLogins(_, _))
+            .WillRepeatedly(WithArg<1>(InvokeEmptyConsumerWithForms()));
+      } else {
+        TurnOnNewParsingForFilling(&scoped_feature_list, true);
+      }
 
-  ON_CALL(*client_.GetStoreResultFilter(), ShouldSaveGaiaPasswordHash(_))
-      .WillByDefault(Return(true));
-  ON_CALL(*client_.GetStoreResultFilter(), ShouldSave(_))
-      .WillByDefault(Return(false));
-  ON_CALL(*client_.GetStoreResultFilter(), IsSyncAccountEmail(_))
-      .WillByDefault(Return(true));
+      std::vector<PasswordForm> observed;
+      PasswordForm form(MakeSimpleGAIAForm());
+      // Simulate that this is Gaia form that should be ignored for
+      // saving/filling.
+      form.is_gaia_with_skip_save_password_form = true;
+      observed.push_back(form);
+      EXPECT_CALL(client_, IsSavingAndFillingEnabled(form.origin))
+          .WillRepeatedly(Return(true));
+      manager()->OnPasswordFormsParsed(&driver_, observed);
+      manager()->OnPasswordFormsRendered(&driver_, observed, true);
 
-  EXPECT_CALL(*store_,
-              SaveGaiaPasswordHash(
-                  "googleuser", form.password_value,
-                  metrics_util::SyncPasswordHashChange::SAVED_IN_CONTENT_AREA));
+      ON_CALL(*client_.GetStoreResultFilter(), ShouldSaveGaiaPasswordHash(_))
+          .WillByDefault(Return(true));
+      ON_CALL(*client_.GetStoreResultFilter(), ShouldSave(_))
+          .WillByDefault(Return(false));
+      ON_CALL(*client_.GetStoreResultFilter(), IsSyncAccountEmail(_))
+          .WillByDefault(Return(true));
 
-  OnPasswordFormSubmitted(form);
-  observed.clear();
-  manager()->OnPasswordFormsRendered(&driver_, observed, true);
+      EXPECT_CALL(client_, PromptUserToSaveOrUpdatePasswordPtr(_)).Times(0);
+      EXPECT_CALL(
+          *store_,
+          SaveGaiaPasswordHash(
+              "googleuser", form.password_value,
+              metrics_util::SyncPasswordHashChange::SAVED_IN_CONTENT_AREA));
+
+      OnPasswordFormSubmitted(form);
+      observed.clear();
+      manager()->OnPasswordFormsRendered(&driver_, observed, did_stop_loading);
+      testing::Mock::VerifyAndClearExpectations(&client_);
+      testing::Mock::VerifyAndClearExpectations(&store_);
+    }
+  }
 }
 #endif
 
diff --git a/components/payments/content/utility/payment_manifest_parser.cc b/components/payments/content/utility/payment_manifest_parser.cc
index c228346..bb4dc1d 100644
--- a/components/payments/content/utility/payment_manifest_parser.cc
+++ b/components/payments/content/utility/payment_manifest_parser.cc
@@ -335,9 +335,10 @@
       : parser_callback_(std::move(parser_callback)),
         client_callback_(std::move(client_callback)) {}
 
-  void OnSuccess(std::unique_ptr<base::Value> value) {
+  void OnSuccess(base::Value value) {
     std::move(parser_callback_)
-        .Run(std::move(client_callback_), std::move(value),
+        .Run(std::move(client_callback_),
+             base::Value::ToUniquePtrValue(std::move(value)),
              /*error_message=*/std::string());
   }
 
diff --git a/components/policy/core/common/BUILD.gn b/components/policy/core/common/BUILD.gn
index 9a78893..fd4a40db 100644
--- a/components/policy/core/common/BUILD.gn
+++ b/components/policy/core/common/BUILD.gn
@@ -331,7 +331,6 @@
 source_set("unit_tests") {
   testonly = true
   sources = [
-    "//extensions/buildflags",
     "cloud/cloud_policy_client_unittest.cc",
     "cloud/cloud_policy_core_unittest.cc",
     "cloud/cloud_policy_manager_unittest.cc",
diff --git a/components/policy/proto/device_management_backend.proto b/components/policy/proto/device_management_backend.proto
index 75344041..53a285cd 100644
--- a/components/policy/proto/device_management_backend.proto
+++ b/components/policy/proto/device_management_backend.proto
@@ -922,6 +922,11 @@
   repeated ThermalInfo thermal_infos = 1;
 }
 
+// Status for various system-wide non-hardware elements.
+message SystemStatus {
+  optional string vpd_sku_number = 1;
+}
+
 // Report device level status.
 message DeviceStatusReportRequest {
   reserved 4, 7, 13, 20;
@@ -999,6 +1004,9 @@
 
   // Status of various main board components.
   optional BoardStatus board_status = 27;
+
+  // Status for various system-wide non-hardware elements.
+  optional SystemStatus system_status = 28;
 }
 
 message OsUpdateStatus {
diff --git a/components/prefs/pref_service.cc b/components/prefs/pref_service.cc
index 1ef51ec..f0796fe 100644
--- a/components/prefs/pref_service.cc
+++ b/components/prefs/pref_service.cc
@@ -562,22 +562,28 @@
     return nullptr;
   }
 
-  // Look for an existing preference in the user store. If it doesn't
-  // exist, create a new user preference.
+  // Look for an existing preference in the user store. Return it in case it
+  // exists and has the correct type.
   base::Value* value = nullptr;
-  if (user_pref_store_->GetMutableValue(path, &value)) {
-    // TODO(crbug.com/859477): Remove once root cause has been found.
-    if (value->type() != type)
-      base::debug::DumpWithoutCrashing();
+  if (user_pref_store_->GetMutableValue(path, &value) &&
+      value->type() == type) {
     return value;
   }
 
-  // If no user preference exists, clone default value.
+  // TODO(crbug.com/859477): Remove once root cause has been found.
+  if (value && value->type() != type) {
+    DEBUG_ALIAS_FOR_CSTR(path_copy, path.c_str(), 1024);
+    base::debug::DumpWithoutCrashing();
+  }
+
+  // If no user preference of the correct type exists, clone default value.
   const base::Value* default_value = nullptr;
   pref_registry_->defaults()->GetValue(path, &default_value);
   // TODO(crbug.com/859477): Revert to DCHECK once root cause has been found.
-  if (default_value->type() != type)
+  if (default_value->type() != type) {
+    DEBUG_ALIAS_FOR_CSTR(path_copy, path.c_str(), 1024);
     base::debug::DumpWithoutCrashing();
+  }
   user_pref_store_->SetValueSilently(path, default_value->CreateDeepCopy(),
                                      GetWriteFlags(pref));
   user_pref_store_->GetMutableValue(path, &value);
diff --git a/components/previews/content/BUILD.gn b/components/previews/content/BUILD.gn
index 0094cc05..efeb0d2e 100644
--- a/components/previews/content/BUILD.gn
+++ b/components/previews/content/BUILD.gn
@@ -67,7 +67,6 @@
     "//components/blacklist/opt_out_blacklist",
     "//components/data_reduction_proxy/core/browser",
     "//components/data_reduction_proxy/core/common",
-    "//components/keyed_service/core:test_support",
     "//components/leveldb_proto:test_support",
     "//components/leveldb_proto/content:factory",
     "//components/optimization_guide",
diff --git a/components/previews/content/hint_cache_unittest.cc b/components/previews/content/hint_cache_unittest.cc
index 3079f54e..a4d10f08 100644
--- a/components/previews/content/hint_cache_unittest.cc
+++ b/components/previews/content/hint_cache_unittest.cc
@@ -12,7 +12,6 @@
 #include "base/macros.h"
 #include "base/run_loop.h"
 #include "base/test/scoped_task_environment.h"
-#include "components/keyed_service/core/test_simple_factory_key.h"
 #include "components/leveldb_proto/content/proto_database_provider_factory.h"
 #include "components/previews/content/hint_cache_store.h"
 #include "components/previews/content/proto_database_provider_test_base.h"
diff --git a/components/previews/content/previews_decider_impl_unittest.cc b/components/previews/content/previews_decider_impl_unittest.cc
index b0b5ef8..3c5ba59 100644
--- a/components/previews/content/previews_decider_impl_unittest.cc
+++ b/components/previews/content/previews_decider_impl_unittest.cc
@@ -37,7 +37,6 @@
 #include "components/blacklist/opt_out_blacklist/opt_out_blacklist_item.h"
 #include "components/blacklist/opt_out_blacklist/opt_out_store.h"
 #include "components/data_reduction_proxy/core/common/data_reduction_proxy_switches.h"
-#include "components/keyed_service/core/test_simple_factory_key.h"
 #include "components/leveldb_proto/content/proto_database_provider_factory.h"
 #include "components/optimization_guide/optimization_guide_service.h"
 #include "components/prefs/testing_pref_service.h"
diff --git a/components/previews/content/previews_hints.cc b/components/previews/content/previews_hints.cc
index 25039c7..d52a110 100644
--- a/components/previews/content/previews_hints.cc
+++ b/components/previews/content/previews_hints.cc
@@ -378,7 +378,8 @@
     const GURL& url,
     PreviewsType type,
     int* out_inflation_percent,
-    net::EffectiveConnectionType* out_ect_threshold) const {
+    net::EffectiveConnectionType* out_ect_threshold,
+    std::string* out_serialized_hint_version_string) const {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK(hint_cache_);
 
@@ -426,6 +427,9 @@
       *out_ect_threshold = ConvertProtoEffectiveConnectionType(
           matched_page_hint->max_ect_trigger());
     }
+
+    *out_serialized_hint_version_string = hint->version();
+
     return true;
   }
 
diff --git a/components/previews/content/previews_hints.h b/components/previews/content/previews_hints.h
index 4dbf364..84ba8f1 100644
--- a/components/previews/content/previews_hints.h
+++ b/components/previews/content/previews_hints.h
@@ -56,12 +56,14 @@
   void Initialize(HintCache* hint_cache, base::OnceClosure callback);
 
   // Whether the URL is whitelisted for the given previews type. If so,
-  // |out_inflation_percent| and |out_ect_threshold| will be populated if
-  // metadata is available for them.
+  // |out_inflation_percent|, |out_ect_threshold|,
+  // |out_serialized_hints_version_string| will be populated if metadata is
+  // available for them.
   bool IsWhitelisted(const GURL& url,
                      PreviewsType type,
                      int* out_inflation_percent,
-                     net::EffectiveConnectionType* out_ect_threshold) const;
+                     net::EffectiveConnectionType* out_ect_threshold,
+                     std::string* out_serialized_hints_version_string) const;
 
   // Whether the URL is blacklisted for the given previews type.
   bool IsBlacklisted(const GURL& url, PreviewsType type) const;
diff --git a/components/previews/content/previews_hints_unittest.cc b/components/previews/content/previews_hints_unittest.cc
index 88cc1cfd..af22ac8c 100644
--- a/components/previews/content/previews_hints_unittest.cc
+++ b/components/previews/content/previews_hints_unittest.cc
@@ -14,7 +14,6 @@
 #include "base/test/metrics/histogram_tester.h"
 #include "base/test/scoped_feature_list.h"
 #include "base/test/scoped_task_environment.h"
-#include "components/keyed_service/core/test_simple_factory_key.h"
 #include "components/leveldb_proto/content/proto_database_provider_factory.h"
 #include "components/optimization_guide/hints_component_info.h"
 #include "components/optimization_guide/proto/hints.pb.h"
@@ -133,7 +132,8 @@
       const GURL& url,
       PreviewsType type,
       int* out_inflation_percent,
-      net::EffectiveConnectionType* out_ect_threshold);
+      net::EffectiveConnectionType* out_ect_threshold,
+      std::string* serialized_hint_version_string);
 
   void MaybeLoadHintAndLogHintCacheMatch(const GURL& url,
                                          bool is_committed,
@@ -176,10 +176,12 @@
     const GURL& url,
     PreviewsType type,
     int* out_inflation_percent,
-    net::EffectiveConnectionType* out_ect_threshold) {
+    net::EffectiveConnectionType* out_ect_threshold,
+    std::string* out_serialized_hint_version_string) {
   MaybeLoadHint(url);
   return previews_hints_->IsWhitelisted(url, type, out_inflation_percent,
-                                        out_ect_threshold);
+                                        out_ect_threshold,
+                                        out_serialized_hint_version_string);
 }
 
 void PreviewsHintsTest::MaybeLoadHintAndLogHintCacheMatch(
@@ -379,6 +381,7 @@
   optimization_guide::proto::Hint* hint1 = config.add_hints();
   hint1->set_key("somedomain.org");
   hint1->set_key_representation(optimization_guide::proto::HOST_SUFFIX);
+  hint1->set_version("someversion");
 
   // Page hint for "/has_inflation_percent/"
   optimization_guide::proto::PageHint* page_hint1 = hint1->add_page_hints();
@@ -422,29 +425,33 @@
   resource_hint2b->set_resource_pattern("resource2b.js");
   ParseConfig(config);
 
-  // Verify optimization providing inflation_percent.
+  // Verify optimization providing inflation_percent and hints version.
   int inflation_percent = 0;
   net::EffectiveConnectionType ect_threshold =
       net::EffectiveConnectionType::EFFECTIVE_CONNECTION_TYPE_UNKNOWN;
+  std::string serialized_hint_version_string;
   EXPECT_TRUE(MaybeLoadHintAndCheckIsWhitelisted(
       GURL("https://www.somedomain.org/has_inflation_percent/"),
-      PreviewsType::RESOURCE_LOADING_HINTS, &inflation_percent,
-      &ect_threshold));
+      PreviewsType::RESOURCE_LOADING_HINTS, &inflation_percent, &ect_threshold,
+      &serialized_hint_version_string));
   EXPECT_EQ(55, inflation_percent);
   EXPECT_EQ(net::EffectiveConnectionType::EFFECTIVE_CONNECTION_TYPE_UNKNOWN,
             ect_threshold);
+  EXPECT_EQ("someversion", serialized_hint_version_string);
 
   // Verify page hint providing ECT trigger.
   inflation_percent = 0;
   ect_threshold =
       net::EffectiveConnectionType::EFFECTIVE_CONNECTION_TYPE_UNKNOWN;
+  serialized_hint_version_string = "";
   EXPECT_TRUE(MaybeLoadHintAndCheckIsWhitelisted(
       GURL("https://www.somedomain.org/has_max_ect_trigger/"),
-      PreviewsType::RESOURCE_LOADING_HINTS, &inflation_percent,
-      &ect_threshold));
+      PreviewsType::RESOURCE_LOADING_HINTS, &inflation_percent, &ect_threshold,
+      &serialized_hint_version_string));
   EXPECT_EQ(0, inflation_percent);
   EXPECT_EQ(net::EffectiveConnectionType::EFFECTIVE_CONNECTION_TYPE_4G,
             ect_threshold);
+  EXPECT_EQ("someversion", serialized_hint_version_string);
 
   // Verify getting resource patterns to block.
   std::vector<std::string> patterns_to_block1;
@@ -472,6 +479,7 @@
   optimization_guide::proto::Hint* hint1 = config.add_hints();
   hint1->set_key("somedomain.org");
   hint1->set_key_representation(optimization_guide::proto::HOST_SUFFIX);
+  hint1->set_version("someversion");
 
   // Page hint with NOSCRIPT optimization
   optimization_guide::proto::PageHint* page_hint1 = hint1->add_page_hints();
@@ -489,13 +497,15 @@
   int inflation_percent = 0;
   net::EffectiveConnectionType ect_threshold =
       net::EffectiveConnectionType::EFFECTIVE_CONNECTION_TYPE_UNKNOWN;
+  std::string serialized_hint_version_string;
   EXPECT_TRUE(MaybeLoadHintAndCheckIsWhitelisted(
       GURL("https://www.somedomain.org/has_multiple_optimizations/"),
-      PreviewsType::NOSCRIPT, &inflation_percent, &ect_threshold));
+      PreviewsType::NOSCRIPT, &inflation_percent, &ect_threshold,
+      &serialized_hint_version_string));
   EXPECT_FALSE(MaybeLoadHintAndCheckIsWhitelisted(
       GURL("https://www.somedomain.org/has_multiple_optimizations/"),
-      PreviewsType::RESOURCE_LOADING_HINTS, &inflation_percent,
-      &ect_threshold));
+      PreviewsType::RESOURCE_LOADING_HINTS, &inflation_percent, &ect_threshold,
+      &serialized_hint_version_string));
 }
 
 TEST_F(PreviewsHintsTest,
@@ -508,6 +518,7 @@
   optimization_guide::proto::Hint* hint1 = config.add_hints();
   hint1->set_key("somedomain.org");
   hint1->set_key_representation(optimization_guide::proto::HOST_SUFFIX);
+  hint1->set_version("someversion");
 
   // Page hint with NOSCRIPT optimization
   optimization_guide::proto::PageHint* page_hint1 = hint1->add_page_hints();
@@ -525,13 +536,15 @@
   int inflation_percent = 0;
   net::EffectiveConnectionType ect_threshold =
       net::EffectiveConnectionType::EFFECTIVE_CONNECTION_TYPE_UNKNOWN;
+  std::string serialized_hint_version_string;
   EXPECT_TRUE(MaybeLoadHintAndCheckIsWhitelisted(
       GURL("https://www.somedomain.org/has_multiple_optimizations/"),
-      PreviewsType::RESOURCE_LOADING_HINTS, &inflation_percent,
-      &ect_threshold));
+      PreviewsType::RESOURCE_LOADING_HINTS, &inflation_percent, &ect_threshold,
+      &serialized_hint_version_string));
   EXPECT_FALSE(MaybeLoadHintAndCheckIsWhitelisted(
       GURL("https://www.somedomain.org/has_multiple_optimizations/"),
-      PreviewsType::NOSCRIPT, &inflation_percent, &ect_threshold));
+      PreviewsType::NOSCRIPT, &inflation_percent, &ect_threshold,
+      &serialized_hint_version_string));
 }
 
 TEST_F(PreviewsHintsTest, IsWhitelistedForExperimentalPreview) {
@@ -542,6 +555,7 @@
   optimization_guide::proto::Hint* hint1 = config.add_hints();
   hint1->set_key("somedomain.org");
   hint1->set_key_representation(optimization_guide::proto::HOST_SUFFIX);
+  hint1->set_version("someversion");
 
   // Page hint for "/experimental_preview/"
   optimization_guide::proto::PageHint* page_hint1 = hint1->add_page_hints();
@@ -583,14 +597,16 @@
     int inflation_percent = 0;
     net::EffectiveConnectionType ect_threshold =
         net::EffectiveConnectionType::EFFECTIVE_CONNECTION_TYPE_UNKNOWN;
+    std::string serialized_hint_version_string;
     EXPECT_TRUE(MaybeLoadHintAndCheckIsWhitelisted(
         GURL("https://www.somedomain.org/experimental_preview/"
              "experimental_resource.js"),
         PreviewsType::RESOURCE_LOADING_HINTS, &inflation_percent,
-        &ect_threshold));
+        &ect_threshold, &serialized_hint_version_string));
     EXPECT_EQ(33, inflation_percent);
     EXPECT_EQ(net::EffectiveConnectionType::EFFECTIVE_CONNECTION_TYPE_3G,
               ect_threshold);
+    EXPECT_EQ("someversion", serialized_hint_version_string);
 
     std::vector<std::string> patterns_to_block;
     previews_hints()->GetResourceLoadingHints(
@@ -610,14 +626,16 @@
     int inflation_percent = 0;
     net::EffectiveConnectionType ect_threshold =
         net::EffectiveConnectionType::EFFECTIVE_CONNECTION_TYPE_2G;
+    std::string serialized_hint_version_string;
     EXPECT_TRUE(MaybeLoadHintAndCheckIsWhitelisted(
         GURL("https://www.somedomain.org/experimental_preview/"
              "experimental_resource.js"),
         PreviewsType::RESOURCE_LOADING_HINTS, &inflation_percent,
-        &ect_threshold));
+        &ect_threshold, &serialized_hint_version_string));
     EXPECT_EQ(99, inflation_percent);
     EXPECT_EQ(net::EffectiveConnectionType::EFFECTIVE_CONNECTION_TYPE_3G,
               ect_threshold);
+    EXPECT_EQ("someversion", serialized_hint_version_string);
 
     std::vector<std::string> patterns_to_block;
     previews_hints()->GetResourceLoadingHints(
@@ -636,6 +654,7 @@
   optimization_guide::proto::Hint* hint1 = config.add_hints();
   hint1->set_key("somedomain.org");
   hint1->set_key_representation(optimization_guide::proto::HOST_SUFFIX);
+  hint1->set_version("someversion");
 
   // Page hint for "/experimental_preview/"
   optimization_guide::proto::PageHint* page_hint1 = hint1->add_page_hints();
@@ -670,11 +689,12 @@
     int inflation_percent = 0;
     net::EffectiveConnectionType ect_threshold =
         net::EffectiveConnectionType::EFFECTIVE_CONNECTION_TYPE_UNKNOWN;
+    std::string serialized_hint_version_string;
     EXPECT_TRUE(MaybeLoadHintAndCheckIsWhitelisted(
         GURL("https://www.somedomain.org/experimental_preview/"
              "experimental_resource.js"),
         PreviewsType::RESOURCE_LOADING_HINTS, &inflation_percent,
-        &ect_threshold));
+        &ect_threshold, &serialized_hint_version_string));
   }
 
   // Now enable the experiment and verify experimental no-op screens the
@@ -688,11 +708,12 @@
     int inflation_percent = 0;
     net::EffectiveConnectionType ect_threshold =
         net::EffectiveConnectionType::EFFECTIVE_CONNECTION_TYPE_2G;
+    std::string serialized_hint_version_string;
     EXPECT_FALSE(MaybeLoadHintAndCheckIsWhitelisted(
         GURL("https://www.somedomain.org/experimental_preview/"
              "experimental_resource.js"),
         PreviewsType::RESOURCE_LOADING_HINTS, &inflation_percent,
-        &ect_threshold));
+        &ect_threshold, &serialized_hint_version_string));
   }
 }
 
@@ -704,6 +725,7 @@
   optimization_guide::proto::Hint* hint1 = config.add_hints();
   hint1->set_key("somedomain.org");
   hint1->set_key_representation(optimization_guide::proto::HOST_SUFFIX);
+  hint1->set_version("someversion");
 
   // Page hint for "/experimental_preview/"
   optimization_guide::proto::PageHint* page_hint1 = hint1->add_page_hints();
@@ -737,6 +759,7 @@
   int inflation_percent = 0;
   net::EffectiveConnectionType ect_threshold =
       net::EffectiveConnectionType::EFFECTIVE_CONNECTION_TYPE_UNKNOWN;
+  std::string serialized_hint_version_string;
 
   // Test with the experiment disabled and verify first optimization allowed.
   {
@@ -744,7 +767,7 @@
         GURL("https://www.somedomain.org/experimental_preview/"
              "not_excluded_case"),
         PreviewsType::RESOURCE_LOADING_HINTS, &inflation_percent,
-        &ect_threshold));
+        &ect_threshold, &serialized_hint_version_string));
 
     std::vector<std::string> patterns_to_block;
     previews_hints()->GetResourceLoadingHints(
@@ -765,7 +788,7 @@
         GURL("https://www.somedomain.org/experimental_preview/"
              "fallthrough_case"),
         PreviewsType::RESOURCE_LOADING_HINTS, &inflation_percent,
-        &ect_threshold));
+        &ect_threshold, &serialized_hint_version_string));
 
     std::vector<std::string> patterns_to_block;
     previews_hints()->GetResourceLoadingHints(
@@ -784,6 +807,7 @@
   optimization_guide::proto::Hint* hint1 = config.add_hints();
   hint1->set_key("somedomain.org");
   hint1->set_key_representation(optimization_guide::proto::HOST_SUFFIX);
+  hint1->set_version("someversion");
   optimization_guide::proto::PageHint* page_hint1 = hint1->add_page_hints();
   page_hint1->set_page_pattern("/news/");
   optimization_guide::proto::Optimization* optimization1 =
diff --git a/components/previews/content/previews_optimization_guide.cc b/components/previews/content/previews_optimization_guide.cc
index b6007cb..229c422 100644
--- a/components/previews/content/previews_optimization_guide.cc
+++ b/components/previews/content/previews_optimization_guide.cc
@@ -173,8 +173,9 @@
 
   *out_ect_threshold = params::GetECTThresholdForPreview(type);
   int inflation_percent = 0;
-  if (!hints_->IsWhitelisted(url, type, &inflation_percent,
-                             out_ect_threshold)) {
+  std::string serialized_hint_version_string;
+  if (!hints_->IsWhitelisted(url, type, &inflation_percent, out_ect_threshold,
+                             &serialized_hint_version_string)) {
     return false;
   }
 
@@ -182,6 +183,11 @@
     previews_data->set_data_savings_inflation_percent(inflation_percent);
   }
 
+  if (!serialized_hint_version_string.empty() && previews_data) {
+    previews_data->set_serialized_hint_version_string(
+        serialized_hint_version_string);
+  }
+
   return true;
 }
 
diff --git a/components/previews/content/previews_optimization_guide_unittest.cc b/components/previews/content/previews_optimization_guide_unittest.cc
index d037cf2..c9ca50c 100644
--- a/components/previews/content/previews_optimization_guide_unittest.cc
+++ b/components/previews/content/previews_optimization_guide_unittest.cc
@@ -24,7 +24,6 @@
 #include "base/test/simple_test_clock.h"
 #include "components/data_reduction_proxy/core/common/data_reduction_proxy_pref_names.h"
 #include "components/data_reduction_proxy/core/common/data_reduction_proxy_switches.h"
-#include "components/keyed_service/core/test_simple_factory_key.h"
 #include "components/leveldb_proto/content/proto_database_provider_factory.h"
 #include "components/optimization_guide/hints_component_info.h"
 #include "components/optimization_guide/optimization_guide_service.h"
@@ -406,6 +405,7 @@
   optimization_guide::proto::Hint* hint1 = config.add_hints();
   hint1->set_key("somedomain.org");
   hint1->set_key_representation(optimization_guide::proto::HOST_SUFFIX);
+  hint1->set_version("someversion");
 
   // Page hint for "/news/"
   optimization_guide::proto::PageHint* page_hint1 = hint1->add_page_hints();
@@ -1699,6 +1699,35 @@
       PreviewsType::RESOURCE_LOADING_HINTS, &ect_threshold));
 }
 
+TEST_F(PreviewsOptimizationGuideTest, PreviewsUserDataPopulatedCorrectly) {
+  base::test::ScopedFeatureList scoped_list;
+  scoped_list.InitAndEnableFeature(features::kResourceLoadingHints);
+
+  InitializeFixedCountResourceLoadingHints();
+
+  EXPECT_TRUE(guide()->MaybeLoadOptimizationHints(
+      GURL("https://somedomain.org/"), base::DoNothing()));
+  EXPECT_TRUE(guide()->MaybeLoadOptimizationHints(
+      GURL("https://www.somedomain.org/news/football"), base::DoNothing()));
+  EXPECT_FALSE(guide()->MaybeLoadOptimizationHints(
+      GURL("https://www.unknown.com"), base::DoNothing()));
+
+  RunUntilIdle();
+
+  PreviewsUserData user_data(kDefaultPageId);
+  net::EffectiveConnectionType ect_threshold;
+  // Verify whitelisting from loaded page hints.
+  EXPECT_FALSE(MaybeLoadOptimizationHintsAndCheckIsWhitelisted(
+      &user_data, GURL("https://www.somedomain.org/unhinted"),
+      PreviewsType::RESOURCE_LOADING_HINTS, &ect_threshold));
+  EXPECT_EQ(base::nullopt, user_data.serialized_hint_version_string());
+  EXPECT_TRUE(MaybeLoadOptimizationHintsAndCheckIsWhitelisted(
+      &user_data,
+      GURL("https://www.somedomain.org/news/weather/raininginseattle"),
+      PreviewsType::RESOURCE_LOADING_HINTS, &ect_threshold));
+  EXPECT_EQ("someversion", user_data.serialized_hint_version_string());
+}
+
 TEST_F(PreviewsOptimizationGuideTest, IsBlacklisted) {
   base::test::ScopedFeatureList scoped_list;
   scoped_list.InitAndEnableFeature(features::kLitePageServerPreviews);
diff --git a/components/previews/content/previews_user_data.h b/components/previews/content/previews_user_data.h
index 504fb3b..5553858 100644
--- a/components/previews/content/previews_user_data.h
+++ b/components/previews/content/previews_user_data.h
@@ -170,6 +170,15 @@
     server_lite_page_info_ = std::move(info);
   }
 
+  // The serialized hints version for the hint that was used for the page load.
+  base::Optional<std::string> serialized_hint_version_string() const {
+    return serialized_hint_version_string_;
+  }
+  void set_serialized_hint_version_string(
+      const std::string& serialized_hint_version_string) {
+    serialized_hint_version_string_ = serialized_hint_version_string;
+  }
+
  private:
   // A session unique ID related to this navigation.
   const uint64_t page_id_;
@@ -222,6 +231,9 @@
   std::unordered_map<PreviewsType, PreviewsEligibilityReason>
       preview_eligibility_reasons_ = {};
 
+  // The serialized hints version for the hint that was used for the page load.
+  base::Optional<std::string> serialized_hint_version_string_ = base::nullopt;
+
   DISALLOW_ASSIGN(PreviewsUserData);
 };
 
diff --git a/components/previews/content/previews_user_data_unittest.cc b/components/previews/content/previews_user_data_unittest.cc
index 981acce..2ac8829 100644
--- a/components/previews/content/previews_user_data_unittest.cc
+++ b/components/previews/content/previews_user_data_unittest.cc
@@ -46,6 +46,7 @@
   EXPECT_FALSE(data->black_listed_for_lite_page());
   EXPECT_FALSE(data->offline_preview_used());
   EXPECT_EQ(data->server_lite_page_info(), nullptr);
+  EXPECT_EQ(base::nullopt, data->serialized_hint_version_string());
 
   base::TimeTicks now = base::TimeTicks::Now();
 
@@ -57,6 +58,7 @@
   data->set_server_lite_page_info(
       std::make_unique<PreviewsUserData::ServerLitePageInfo>());
   data->server_lite_page_info()->original_navigation_start = now;
+  data->set_serialized_hint_version_string("someversion");
 
   PreviewsUserData data_copy(*data);
   EXPECT_EQ(id, data_copy.page_id());
@@ -69,6 +71,7 @@
   EXPECT_TRUE(data_copy.offline_preview_used());
   EXPECT_NE(data->server_lite_page_info(), nullptr);
   EXPECT_EQ(data->server_lite_page_info()->original_navigation_start, now);
+  EXPECT_EQ("someversion", data->serialized_hint_version_string());
 }
 
 }  // namespace previews
diff --git a/components/previews/content/proto_database_provider_test_base.cc b/components/previews/content/proto_database_provider_test_base.cc
index e9030c3..977d748 100644
--- a/components/previews/content/proto_database_provider_test_base.cc
+++ b/components/previews/content/proto_database_provider_test_base.cc
@@ -15,8 +15,7 @@
   ASSERT_TRUE(temp_dir_.CreateUniqueTempDir());
   // Create a SimpleFactoryKey, to be used to retrieve a ProtoDatabaseProvider
   // to initialize a HintCacheStore.
-  simple_factory_key_ =
-      std::make_unique<TestSimpleFactoryKey>(temp_dir_.GetPath());
+  simple_factory_key_ = std::make_unique<SimpleFactoryKey>(temp_dir_.GetPath());
   db_provider_ =
       leveldb_proto::ProtoDatabaseProviderFactory::GetInstance()->GetForKey(
           simple_factory_key_.get());
@@ -30,4 +29,4 @@
   simple_factory_key_.reset();
 }
 
-}  // namespace previews
\ No newline at end of file
+}  // namespace previews
diff --git a/components/previews/content/proto_database_provider_test_base.h b/components/previews/content/proto_database_provider_test_base.h
index d29c1ca5..6c23a6b 100644
--- a/components/previews/content/proto_database_provider_test_base.h
+++ b/components/previews/content/proto_database_provider_test_base.h
@@ -6,7 +6,7 @@
 #define COMPONENTS_PREVIEWS_CONTENT_PROTO_DATABASE_PROVIDER_TEST_BASE_H_
 
 #include "base/files/scoped_temp_dir.h"
-#include "components/keyed_service/core/test_simple_factory_key.h"
+#include "components/keyed_service/core/simple_factory_key.h"
 #include "components/leveldb_proto/public/proto_database_provider.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -26,10 +26,10 @@
 
  protected:
   base::ScopedTempDir temp_dir_;
-  std::unique_ptr<TestSimpleFactoryKey> simple_factory_key_;
+  std::unique_ptr<SimpleFactoryKey> simple_factory_key_;
   leveldb_proto::ProtoDatabaseProvider* db_provider_;
 };
 
 }  // namespace previews
 
-#endif  // COMPONENTS_PREVIEWS_CONTENT_PROTO_DATABASE_PROVIDER_TEST_BASE_H_
\ No newline at end of file
+#endif  // COMPONENTS_PREVIEWS_CONTENT_PROTO_DATABASE_PROVIDER_TEST_BASE_H_
diff --git a/components/send_tab_to_self/send_tab_to_self_bridge.cc b/components/send_tab_to_self/send_tab_to_self_bridge.cc
index 9aa757d6..76d7bea7 100644
--- a/components/send_tab_to_self/send_tab_to_self_bridge.cc
+++ b/components/send_tab_to_self/send_tab_to_self_bridge.cc
@@ -647,7 +647,8 @@
 
     // Only keep one device per device name. We only keep the first occurrence
     // which is the most recent.
-    TargetDeviceInfo target_device_info(device->guid(), device->device_type());
+    TargetDeviceInfo target_device_info(device->guid(), device->device_type(),
+                                        device->last_updated_timestamp());
     target_device_name_to_cache_info_.emplace(device->client_name(),
                                               target_device_info);
     oldest_non_expired_device_timestamp_ = device->last_updated_timestamp();
diff --git a/components/send_tab_to_self/send_tab_to_self_bridge_unittest.cc b/components/send_tab_to_self/send_tab_to_self_bridge_unittest.cc
index d4c5638..ff11cd87 100644
--- a/components/send_tab_to_self/send_tab_to_self_bridge_unittest.cc
+++ b/components/send_tab_to_self/send_tab_to_self_bridge_unittest.cc
@@ -705,11 +705,13 @@
       /*send_tab_to_self_receiving_enabled=*/true);
   AddTestDevice(&older_device);
 
-  TargetDeviceInfo target_device_info(kRecentGuid,
-                                      sync_pb::SyncEnums_DeviceType_TYPE_LINUX);
+  TargetDeviceInfo target_device_info(recent_device.guid(),
+                                      recent_device.device_type(),
+                                      recent_device.last_updated_timestamp());
 
-  EXPECT_THAT(bridge()->GetTargetDeviceNameToCacheInfoMap(),
-              ElementsAre(Pair("device_name", target_device_info)));
+  EXPECT_THAT(
+      bridge()->GetTargetDeviceNameToCacheInfoMap(),
+      ElementsAre(Pair(recent_device.client_name(), target_device_info)));
 }
 
 // Tests that only devices that have the send tab to self receiving feature
@@ -732,17 +734,18 @@
       /*send_tab_to_self_receiving_enabled=*/false);
   AddTestDevice(&disabled_device);
 
-  TargetDeviceInfo target_device_info("enabled_guid",
-                                      sync_pb::SyncEnums_DeviceType_TYPE_LINUX);
+  TargetDeviceInfo target_device_info(enabled_device.guid(),
+                                      enabled_device.device_type(),
+                                      enabled_device.last_updated_timestamp());
 
-  EXPECT_THAT(bridge()->GetTargetDeviceNameToCacheInfoMap(),
-              ElementsAre(Pair("enabled_device_name", target_device_info)));
+  EXPECT_THAT(
+      bridge()->GetTargetDeviceNameToCacheInfoMap(),
+      ElementsAre(Pair(enabled_device.client_name(), target_device_info)));
 }
 
-// TODO(crbug/959487):
 // Tests that only devices that are not expired are returned.
 TEST_F(SendTabToSelfBridgeTest,
-       DISABLED_GetTargetDeviceNameToCacheInfoMap_NoExpiredDevices) {
+       GetTargetDeviceNameToCacheInfoMap_NoExpiredDevices) {
   InitializeBridge();
 
   syncer::DeviceInfo expired_device(
@@ -759,11 +762,13 @@
       /*send_tab_to_self_receiving_enabled=*/true);
   AddTestDevice(&valid_device);
 
-  TargetDeviceInfo target_device_info("valid_guid",
-                                      sync_pb::SyncEnums_DeviceType_TYPE_LINUX);
+  TargetDeviceInfo target_device_info(valid_device.guid(),
+                                      valid_device.device_type(),
+                                      valid_device.last_updated_timestamp());
 
-  EXPECT_THAT(bridge()->GetTargetDeviceNameToCacheInfoMap(),
-              ElementsAre(Pair("valid_device_name", target_device_info)));
+  EXPECT_THAT(
+      bridge()->GetTargetDeviceNameToCacheInfoMap(),
+      ElementsAre(Pair(valid_device.client_name(), target_device_info)));
 }
 
 // Tests that the local device is not returned.
@@ -785,17 +790,18 @@
       /*send_tab_to_self_receiving_enabled=*/true);
   AddTestDevice(&other_device);
 
-  TargetDeviceInfo target_device_info("other_guid",
-                                      sync_pb::SyncEnums_DeviceType_TYPE_LINUX);
+  TargetDeviceInfo target_device_info(other_device.guid(),
+                                      other_device.device_type(),
+                                      other_device.last_updated_timestamp());
 
-  EXPECT_THAT(bridge()->GetTargetDeviceNameToCacheInfoMap(),
-              ElementsAre(Pair("other_device_name", target_device_info)));
+  EXPECT_THAT(
+      bridge()->GetTargetDeviceNameToCacheInfoMap(),
+      ElementsAre(Pair(other_device.client_name(), target_device_info)));
 }
 
-// TODO(crbug/959487):
 // Tests that the local device is not returned.
 TEST_F(SendTabToSelfBridgeTest,
-       DISABLED_GetTargetDeviceNameToCacheInfoMap_Updated_DeviceExpired) {
+       GetTargetDeviceNameToCacheInfoMap_Updated_DeviceExpired) {
   InitializeBridge();
 
   // Set a device that is about to expire and a more recent device.
@@ -813,22 +819,26 @@
       /*send_tab_to_self_receiving_enabled=*/true);
   AddTestDevice(&recent_device);
 
-  TargetDeviceInfo device_info_1("older_guid",
-                                 sync_pb::SyncEnums_DeviceType_TYPE_LINUX);
-  TargetDeviceInfo device_info_2("recent_guid",
-                                 sync_pb::SyncEnums_DeviceType_TYPE_LINUX);
+  TargetDeviceInfo older_device_info(older_device.guid(),
+                                     older_device.device_type(),
+                                     older_device.last_updated_timestamp());
+  TargetDeviceInfo recent_device_info(recent_device.guid(),
+                                      recent_device.device_type(),
+                                      recent_device.last_updated_timestamp());
 
   // Set the map by calling it. Make sure it has the 2 devices.
   EXPECT_THAT(bridge()->GetTargetDeviceNameToCacheInfoMap(),
-              UnorderedElementsAre(Pair("older_name", device_info_1),
-                                   Pair("recent_name", device_info_2)));
+              UnorderedElementsAre(
+                  Pair(older_device.client_name(), older_device_info),
+                  Pair(recent_device.client_name(), recent_device_info)));
 
   // Advance the time so that the older device expires.
   clock()->Advance(base::TimeDelta::FromDays(5));
 
   // Make sure only the recent device is in the map.
-  EXPECT_THAT(bridge()->GetTargetDeviceNameToCacheInfoMap(),
-              ElementsAre(Pair("recent_name", device_info_2)));
+  EXPECT_THAT(
+      bridge()->GetTargetDeviceNameToCacheInfoMap(),
+      ElementsAre(Pair(recent_device.client_name(), recent_device_info)));
 }
 
 // Tests that the local device is not returned.
@@ -844,11 +854,11 @@
   AddTestDevice(&device);
 
   // Set the map by calling it. Make sure it has the device.
-  TargetDeviceInfo device_info_1("guid",
-                                 sync_pb::SyncEnums_DeviceType_TYPE_LINUX);
+  TargetDeviceInfo device_info(device.guid(), device.device_type(),
+                               device.last_updated_timestamp());
 
   EXPECT_THAT(bridge()->GetTargetDeviceNameToCacheInfoMap(),
-              ElementsAre(Pair("name", device_info_1)));
+              ElementsAre(Pair(device.client_name(), device_info)));
 
   // Add a new device.
   syncer::DeviceInfo new_device("new_guid", "new_name", "72", "agent",
@@ -859,12 +869,13 @@
   AddTestDevice(&new_device);
 
   // Make sure both devices are in the map.
-  TargetDeviceInfo device_info_2("new_guid",
-                                 sync_pb::SyncEnums_DeviceType_TYPE_LINUX);
+  TargetDeviceInfo new_device_info(new_device.guid(), new_device.device_type(),
+                                   new_device.last_updated_timestamp());
 
-  EXPECT_THAT(bridge()->GetTargetDeviceNameToCacheInfoMap(),
-              UnorderedElementsAre(Pair("name", device_info_1),
-                                   Pair("new_name", device_info_2)));
+  EXPECT_THAT(
+      bridge()->GetTargetDeviceNameToCacheInfoMap(),
+      UnorderedElementsAre(Pair(device.client_name(), device_info),
+                           Pair(new_device.client_name(), new_device_info)));
 }
 
 TEST_F(SendTabToSelfBridgeTest, NotifyRemoteSendTabToSelfEntryOpened) {
diff --git a/components/send_tab_to_self/send_tab_to_self_entry.cc b/components/send_tab_to_self/send_tab_to_self_entry.cc
index ffac4e2fd..67ed8a5 100644
--- a/components/send_tab_to_self/send_tab_to_self_entry.cc
+++ b/components/send_tab_to_self/send_tab_to_self_entry.cc
@@ -143,14 +143,12 @@
     navigation_time = ProtoTimeToTime(pb_entry.navigation_time_usec());
   }
 
-  bool opened = pb_entry.opened();
-
   // Protobuf parsing enforces utf8 encoding for all strings.
   auto entry = std::make_unique<SendTabToSelfEntry>(
       guid, url, pb_entry.title(), shared_time, navigation_time,
       pb_entry.device_name(), pb_entry.target_device_sync_cache_guid());
 
-  if (opened) {
+  if (pb_entry.opened()) {
     entry->MarkOpened();
   }
   return entry;
diff --git a/components/send_tab_to_self/target_device_info.cc b/components/send_tab_to_self/target_device_info.cc
index d735aec..77b8f5fe 100644
--- a/components/send_tab_to_self/target_device_info.cc
+++ b/components/send_tab_to_self/target_device_info.cc
@@ -8,12 +8,16 @@
 
 TargetDeviceInfo::TargetDeviceInfo(
     const std::string& cache_guid,
-    const sync_pb::SyncEnums::DeviceType device_type)
-    : cache_guid(cache_guid), device_type(device_type) {}
+    const sync_pb::SyncEnums::DeviceType device_type,
+    base::Time last_updated_timestamp)
+    : cache_guid(cache_guid),
+      device_type(device_type),
+      last_updated_timestamp(last_updated_timestamp) {}
 
 bool TargetDeviceInfo::operator==(const TargetDeviceInfo& rhs) const {
   return this->cache_guid == rhs.cache_guid &&
-         this->device_type == rhs.device_type;
+         this->device_type == rhs.device_type &&
+         this->last_updated_timestamp == rhs.last_updated_timestamp;
 }
 
 }  // namespace send_tab_to_self
diff --git a/components/send_tab_to_self/target_device_info.h b/components/send_tab_to_self/target_device_info.h
index 2a394ef..2950430 100644
--- a/components/send_tab_to_self/target_device_info.h
+++ b/components/send_tab_to_self/target_device_info.h
@@ -7,6 +7,7 @@
 
 #include <string>
 
+#include "base/time/time.h"
 #include "components/sync/protocol/sync.pb.h"
 
 namespace send_tab_to_self {
@@ -14,7 +15,8 @@
 struct TargetDeviceInfo {
  public:
   TargetDeviceInfo(const std::string& cache_guid,
-                   const sync_pb::SyncEnums::DeviceType device_type);
+                   const sync_pb::SyncEnums::DeviceType device_type,
+                   base::Time last_updated_timestamp);
   TargetDeviceInfo(const TargetDeviceInfo& other) = default;
   ~TargetDeviceInfo() = default;
 
@@ -24,6 +26,8 @@
   std::string cache_guid;
   // Device type.
   sync_pb::SyncEnums::DeviceType device_type;
+  // Last updated timestamp.
+  base::Time last_updated_timestamp;
 };
 
 }  // namespace send_tab_to_self
diff --git a/components/signin/core/browser/account_fetcher_service.cc b/components/signin/core/browser/account_fetcher_service.cc
index 059f0e3..6ff6a04 100644
--- a/components/signin/core/browser/account_fetcher_service.cc
+++ b/components/signin/core/browser/account_fetcher_service.cc
@@ -331,7 +331,6 @@
 void AccountFetcherService::OnUserInfoFetchFailure(
     const std::string& account_id) {
   LOG(WARNING) << "Failed to get UserInfo for " << account_id;
-  account_tracker_service_->NotifyAccountUpdateFailed(account_id);
   user_info_requests_.erase(account_id);
 }
 
diff --git a/components/signin/core/browser/account_tracker_service.cc b/components/signin/core/browser/account_tracker_service.cc
index 202a291..c30ba07 100644
--- a/components/signin/core/browser/account_tracker_service.cc
+++ b/components/signin/core/browser/account_tracker_service.cc
@@ -213,12 +213,6 @@
     observer.OnAccountUpdated(account_info);
 }
 
-void AccountTrackerService::NotifyAccountUpdateFailed(
-    const CoreAccountId& account_id) {
-  for (auto& observer : observer_list_)
-    observer.OnAccountUpdateFailed(account_id);
-}
-
 void AccountTrackerService::NotifyAccountRemoved(
     const AccountInfo& account_info) {
   DCHECK(!account_info.gaia.empty());
diff --git a/components/signin/core/browser/account_tracker_service.h b/components/signin/core/browser/account_tracker_service.h
index 30591e6..e0511f89 100644
--- a/components/signin/core/browser/account_tracker_service.h
+++ b/components/signin/core/browser/account_tracker_service.h
@@ -56,7 +56,6 @@
    public:
     virtual ~Observer() {}
     virtual void OnAccountUpdated(const AccountInfo& info) {}
-    virtual void OnAccountUpdateFailed(const CoreAccountId& account_id) {}
     virtual void OnAccountRemoved(const AccountInfo& info) {}
   };
 
@@ -159,7 +158,6 @@
       const std::string&);
 
   void NotifyAccountUpdated(const AccountInfo& account_info);
-  void NotifyAccountUpdateFailed(const CoreAccountId& account_id);
   void NotifyAccountRemoved(const AccountInfo& account_info);
 
   void StartTrackingAccount(const CoreAccountId& account_id);
diff --git a/components/signin/core/browser/mutable_profile_oauth2_token_service_delegate_unittest.cc b/components/signin/core/browser/mutable_profile_oauth2_token_service_delegate_unittest.cc
index af26b9b7..86c568f 100644
--- a/components/signin/core/browser/mutable_profile_oauth2_token_service_delegate_unittest.cc
+++ b/components/signin/core/browser/mutable_profile_oauth2_token_service_delegate_unittest.cc
@@ -204,12 +204,12 @@
   }
 
   // OAuth2TokenService::DiagnosticsObserver implementation
-  void OnRefreshTokenAvailableFromSource(const std::string& account_id,
+  void OnRefreshTokenAvailableFromSource(const CoreAccountId& account_id,
                                          bool is_refresh_token_valid,
                                          const std::string& source) override {
     source_for_refresh_token_available_ = source;
   }
-  void OnRefreshTokenRevokedFromSource(const std::string& account_id,
+  void OnRefreshTokenRevokedFromSource(const CoreAccountId& account_id,
                                        const std::string& source) override {
     source_for_refresh_token_revoked_ = source;
   }
diff --git a/components/subresource_filter/tools/ruleset_converter/BUILD.gn b/components/subresource_filter/tools/ruleset_converter/BUILD.gn
index e44e367..e82c5377 100644
--- a/components/subresource_filter/tools/ruleset_converter/BUILD.gn
+++ b/components/subresource_filter/tools/ruleset_converter/BUILD.gn
@@ -4,7 +4,6 @@
 
 source_set("support") {
   sources = [
-    "//third_party/protobuf:protobuf_lite",
     "rule_stream.cc",
     "rule_stream.h",
     "ruleset_converter.cc",
diff --git a/components/sync/android/javatests/src/org/chromium/components/sync/notifier/InvalidationPreferencesTest.java b/components/sync/android/javatests/src/org/chromium/components/sync/notifier/InvalidationPreferencesTest.java
index 8bde9fbe..455fb63c 100644
--- a/components/sync/android/javatests/src/org/chromium/components/sync/notifier/InvalidationPreferencesTest.java
+++ b/components/sync/android/javatests/src/org/chromium/components/sync/notifier/InvalidationPreferencesTest.java
@@ -10,13 +10,11 @@
 import com.google.ipc.invalidation.external.client.types.ObjectId;
 
 import org.junit.Assert;
-import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
 import org.chromium.base.ApiCompatibilityUtils;
 import org.chromium.base.CollectionUtil;
-import org.chromium.base.ContextUtils;
 import org.chromium.base.test.BaseJUnit4ClassRunner;
 import org.chromium.base.test.util.Feature;
 import org.chromium.base.test.util.RetryOnFailure;
@@ -32,11 +30,6 @@
 @RunWith(BaseJUnit4ClassRunner.class)
 @RetryOnFailure
 public class InvalidationPreferencesTest {
-    @Before
-    public void setUp() {
-        // Make sure the SharedPreferences start out empty.
-        ContextUtils.getAppSharedPreferences().edit().clear().apply();
-    }
 
     @Test
     @SmallTest
diff --git a/components/sync_bookmarks/bookmark_specifics_conversions_unittest.cc b/components/sync_bookmarks/bookmark_specifics_conversions_unittest.cc
index 4be58ae..b644be9 100644
--- a/components/sync_bookmarks/bookmark_specifics_conversions_unittest.cc
+++ b/components/sync_bookmarks/bookmark_specifics_conversions_unittest.cc
@@ -37,11 +37,11 @@
   base::CancelableTaskTracker::TaskId GetFaviconImageForPageURL(
       const GURL& page_url,
       favicon_base::IconType type,
-      const favicon_base::FaviconImageCallback& callback,
+      favicon_base::FaviconImageCallback callback,
       base::CancelableTaskTracker* tracker) override {
     ++load_favicon_requests;
-    return TestBookmarkClient::GetFaviconImageForPageURL(page_url, type,
-                                                         callback, tracker);
+    return TestBookmarkClient::GetFaviconImageForPageURL(
+        page_url, type, std::move(callback), tracker);
   }
 
   int GetLoadFaviconRequestsForTest() { return load_favicon_requests; }
diff --git a/components/sync_sessions/favicon_cache_unittest.cc b/components/sync_sessions/favicon_cache_unittest.cc
index 8fd9be4..1b5a5c8 100644
--- a/components/sync_sessions/favicon_cache_unittest.cc
+++ b/components/sync_sessions/favicon_cache_unittest.cc
@@ -4,6 +4,8 @@
 
 #include "components/sync_sessions/favicon_cache.h"
 
+#include <utility>
+
 #include "base/memory/ptr_util.h"
 #include "base/run_loop.h"
 #include "base/strings/string_number_conversions.h"
@@ -455,7 +457,13 @@
 
   ON_CALL(mock_favicon_service_,
           GetFaviconForPageURL(test_data.page_url, _, _, _, _))
-      .WillByDefault(favicon::PostReply<5>(bitmap_results));
+      .WillByDefault([=](auto, auto, auto,
+                         favicon_base::FaviconResultsCallback callback,
+                         base::CancelableTaskTracker* tracker) {
+        return tracker->PostTask(
+            base::ThreadTaskRunnerHandle::Get().get(), FROM_HERE,
+            base::BindOnce(std::move(callback), bitmap_results));
+      });
 }
 
 void SyncFaviconCacheTest::TriggerSyncFaviconReceived(
@@ -468,14 +476,20 @@
         new base::RefCountedString());
     temp_string->data() = icon_bytes;
 
-    std::vector<favicon_base::FaviconRawBitmapResult> result;
-    result.push_back(favicon_base::FaviconRawBitmapResult());
-    result.back().icon_url = icon_url;
-    result.back().bitmap_data = temp_string;
-    result.back().pixel_size = gfx::Size(16, 16);
+    std::vector<favicon_base::FaviconRawBitmapResult> bitmap_results;
+    bitmap_results.push_back(favicon_base::FaviconRawBitmapResult());
+    bitmap_results.back().icon_url = icon_url;
+    bitmap_results.back().bitmap_data = temp_string;
+    bitmap_results.back().pixel_size = gfx::Size(16, 16);
 
     ON_CALL(mock_favicon_service_, GetFaviconForPageURL(page_url, _, _, _, _))
-        .WillByDefault(favicon::PostReply<5>(result));
+        .WillByDefault([=](auto, auto, auto,
+                           favicon_base::FaviconResultsCallback callback,
+                           base::CancelableTaskTracker* tracker) {
+          return tracker->PostTask(
+              base::ThreadTaskRunnerHandle::Get().get(), FROM_HERE,
+              base::BindOnce(std::move(callback), bitmap_results));
+        });
 
     // Mimic the icon itself having been cached long time ago.
     cache()->OnPageFaviconUpdated(page_url, base::Time::UnixEpoch());
diff --git a/components/translate/core/browser/translate_prefs.cc b/components/translate/core/browser/translate_prefs.cc
index 0a8723b..613ea869 100644
--- a/components/translate/core/browser/translate_prefs.cc
+++ b/components/translate/core/browser/translate_prefs.cc
@@ -83,7 +83,13 @@
                                  base::FEATURE_ENABLED_BY_DEFAULT};
 
 const base::Feature kTranslateMobileManualTrigger{
-    "TranslateAndroidManualTrigger", base::FEATURE_DISABLED_BY_DEFAULT};
+  "TranslateAndroidManualTrigger",
+#if defined(OS_IOS)
+      base::FEATURE_DISABLED_BY_DEFAULT
+#else
+      base::FEATURE_ENABLED_BY_DEFAULT
+#endif
+};
 
 const base::Feature kCompactTranslateInfobarIOS{
     "CompactTranslateInfobarIOS", base::FEATURE_DISABLED_BY_DEFAULT};
@@ -201,6 +207,8 @@
 
   prefs_->ClearPref(kPrefTranslateLastDeniedTimeForLanguage);
   prefs_->ClearPref(kPrefTranslateTooOftenDeniedForLanguage);
+
+  prefs_->ClearPref(prefs::kOfferTranslateEnabled);
 }
 
 bool TranslatePrefs::IsBlockedLanguage(
diff --git a/components/translate/core/browser/translate_prefs_unittest.cc b/components/translate/core/browser/translate_prefs_unittest.cc
index 95a33aa..b4c4ac8 100644
--- a/components/translate/core/browser/translate_prefs_unittest.cc
+++ b/components/translate/core/browser/translate_prefs_unittest.cc
@@ -20,6 +20,7 @@
 #include "components/sync_preferences/testing_pref_service_syncable.h"
 #include "components/translate/core/browser/translate_accept_languages.h"
 #include "components/translate/core/browser/translate_download_manager.h"
+#include "components/translate/core/browser/translate_pref_names.h"
 #include "components/translate/core/common/translate_util.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -74,6 +75,9 @@
 #if defined(OS_CHROMEOS)
     prefs_->SetString(kPreferredLanguagesPref, std::string());
 #endif
+    prefs_->registry()->RegisterBooleanPref(
+        prefs::kOfferTranslateEnabled, true,
+        user_prefs::PrefRegistrySyncable::SYNCABLE_PREF);
   }
 
   void SetLastDeniedTime(const std::string& language, base::Time time) {
diff --git a/components/variations/BUILD.gn b/components/variations/BUILD.gn
index 917a73c..6349f45 100644
--- a/components/variations/BUILD.gn
+++ b/components/variations/BUILD.gn
@@ -30,9 +30,6 @@
     "pref_names.h",
     "processed_study.cc",
     "processed_study.h",
-    "proto/client_variations.proto",
-    "proto/study.proto",
-    "proto/variations_seed.proto",
     "seed_response.cc",
     "seed_response.h",
     "study_filtering.cc",
diff --git a/components/web_resource/web_resource_service.cc b/components/web_resource/web_resource_service.cc
index 332b8526..22fc070 100644
--- a/components/web_resource/web_resource_service.cc
+++ b/components/web_resource/web_resource_service.cc
@@ -25,9 +25,6 @@
 
 // No anonymous namespace, because const variables automatically get internal
 // linkage.
-const char kInvalidDataTypeError[] =
-    "Data from web resource server is missing or not valid JSON.";
-
 const char kUnexpectedJSONFormatError[] =
     "Data from web resource server does not have expected format.";
 
@@ -84,7 +81,7 @@
     // (on Android in particular) we short-cut the full parsing in the case of
     // trivially "empty" JSONs.
     if (response_body->empty() || *response_body == "{}") {
-      OnUnpackFinished(std::make_unique<base::DictionaryValue>());
+      OnUnpackFinished(base::Value(base::Value::Type::DICTIONARY));
     } else {
       parse_json_callback_.Run(*response_body,
                                base::Bind(&WebResourceService::OnUnpackFinished,
@@ -172,14 +169,9 @@
   in_fetch_ = false;
 }
 
-void WebResourceService::OnUnpackFinished(std::unique_ptr<base::Value> value) {
-  if (!value) {
-    // Page information not properly read, or corrupted.
-    OnUnpackError(kInvalidDataTypeError);
-    return;
-  }
+void WebResourceService::OnUnpackFinished(base::Value value) {
   const base::DictionaryValue* dict = nullptr;
-  if (!value->GetAsDictionary(&dict)) {
+  if (!value.GetAsDictionary(&dict)) {
     OnUnpackError(kUnexpectedJSONFormatError);
     return;
   }
diff --git a/components/web_resource/web_resource_service.h b/components/web_resource/web_resource_service.h
index ba9d1407..749b4bc 100644
--- a/components/web_resource/web_resource_service.h
+++ b/components/web_resource/web_resource_service.h
@@ -37,7 +37,7 @@
 class WebResourceService : public ResourceRequestAllowedNotifier::Observer {
  public:
   // Callbacks for JSON parsing.
-  using SuccessCallback = base::Callback<void(std::unique_ptr<base::Value>)>;
+  using SuccessCallback = base::Callback<void(base::Value)>;
   using ErrorCallback = base::Callback<void(const std::string&)>;
   using ParseJSONCallback = base::Callback<
       void(const std::string&, const SuccessCallback&, const ErrorCallback&)>;
@@ -93,7 +93,7 @@
   void EndFetch();
 
   // Callbacks from the JSON parser.
-  void OnUnpackFinished(std::unique_ptr<base::Value> value);
+  void OnUnpackFinished(base::Value value);
   void OnUnpackError(const std::string& error_message);
 
   // Implements ResourceRequestAllowedNotifier::Observer.
diff --git a/components/web_resource/web_resource_service_unittest.cc b/components/web_resource/web_resource_service_unittest.cc
index 6b7faed..00f3f22 100644
--- a/components/web_resource/web_resource_service_unittest.cc
+++ b/components/web_resource/web_resource_service_unittest.cc
@@ -131,11 +131,10 @@
   static void Parse(const std::string& unsafe_json,
                     const WebResourceService::SuccessCallback& success_callback,
                     const WebResourceService::ErrorCallback& error_callback) {
-    std::unique_ptr<base::Value> value;
     if (!error_message_.empty())
       error_callback.Run(error_message_);
     else
-      success_callback.Run(std::move(value));
+      success_callback.Run(base::Value());
   }
 
   WebResourceService* web_resource_service() {
diff --git a/content/app_shim_remote_cocoa/render_widget_host_view_cocoa.mm b/content/app_shim_remote_cocoa/render_widget_host_view_cocoa.mm
index 4128537..8284524 100644
--- a/content/app_shim_remote_cocoa/render_widget_host_view_cocoa.mm
+++ b/content/app_shim_remote_cocoa/render_widget_host_view_cocoa.mm
@@ -1572,7 +1572,8 @@
 }
 
 - (NSRange)selectedRange {
-  return textSelectionRange_.ToNSRange();
+  return NSMakeRange(textSelectionRange_.GetMin() + textSelectionOffset_,
+                     textSelectionRange_.length());
 }
 
 - (NSRange)markedRange {
diff --git a/content/browser/after_startup_task_utils.cc b/content/browser/after_startup_task_utils.cc
index 66d25548..3693f619 100644
--- a/content/browser/after_startup_task_utils.cc
+++ b/content/browser/after_startup_task_utils.cc
@@ -11,7 +11,7 @@
 namespace content {
 
 void SetBrowserStartupIsCompleteForTesting() {
-  content::BrowserTaskExecutor::EnableBestEffortQueues();
+  content::BrowserTaskExecutor::EnableAllQueues();
   // Forward the message to ContentBrowserClient if one is registered (there are
   // many tests where one isn't but that's fine as that also means they get the
   // default ContentBrowserClient::IsBrowserStartupComplete() which is always
diff --git a/content/browser/browser_main_loop.cc b/content/browser/browser_main_loop.cc
index 6a24bdf8..5f22028 100644
--- a/content/browser/browser_main_loop.cc
+++ b/content/browser/browser_main_loop.cc
@@ -1190,7 +1190,8 @@
   // TODO(https://crbug.com/863341): Replace with a better API
   GetContentClient()->browser()->PostAfterStartupTask(
       FROM_HERE, base::SequencedTaskRunnerHandle::Get(), base::BindOnce([]() {
-        content::BrowserTaskExecutor::EnableBestEffortQueues();
+        // Non best effort queues will already have been enabled
+        content::BrowserTaskExecutor::EnableAllQueues();
       }));
 }
 
diff --git a/content/browser/browser_plugin/browser_plugin_guest.cc b/content/browser/browser_plugin/browser_plugin_guest.cc
index 19967b3..dfd38d52 100644
--- a/content/browser/browser_plugin/browser_plugin_guest.cc
+++ b/content/browser/browser_plugin/browser_plugin_guest.cc
@@ -126,7 +126,7 @@
       has_render_view_(has_render_view),
       is_in_destruction_(false),
       initialized_(false),
-      guest_proxy_routing_id_(MSG_ROUTING_NONE),
+      guest_render_view_routing_id_(MSG_ROUTING_NONE),
       last_drag_status_(blink::kWebDragStatusUnknown),
       seen_embedder_system_drag_ended_(false),
       seen_embedder_drag_source_ended_at_(false),
@@ -139,54 +139,10 @@
   RecordAction(base::UserMetricsAction("BrowserPlugin.Guest.Create"));
 }
 
-int BrowserPluginGuest::GetGuestProxyRoutingID() {
-  if (GuestMode::IsCrossProcessFrameGuest(GetWebContents())) {
-    // We don't use the proxy to send postMessage in --site-per-process, since
-    // we use the contentWindow directly from the frame element instead.
-    return MSG_ROUTING_NONE;
-  }
-
-  if (guest_proxy_routing_id_ != MSG_ROUTING_NONE)
-    return guest_proxy_routing_id_;
-
-  // In order to enable the embedder to post messages to the
-  // guest, we need to create a RenderFrameProxyHost in root node of guest
-  // WebContents' frame tree (i.e., create a RenderFrameProxy in the embedder
-  // process which can be used by the embedder to post messages to the guest).
-  // The creation of RFPH for the reverse path, which enables the guest to post
-  // messages to the embedder, will be postponed to when the embedder posts its
-  // first message to the guest.
-  //
-  // TODO(fsamuel): Make sure this works for transferring guests across
-  // owners in different processes. We probably need to clear the
-  // |guest_proxy_routing_id_| and perform any necessary cleanup on Detach
-  // to enable this.
-  //
-  // TODO(ekaramad): If the guest is embedded inside a cross-process <iframe>
-  // (e.g., <embed>-ed PDF), the reverse proxy will not be created and the
-  // posted message's source attribute will be null which in turn breaks the
-  // two-way messaging between the guest and the embedder. We should either
-  // create a RenderFrameProxyHost for the reverse path, or implement
-  // MimeHandlerViewGuest using OOPIF (https://crbug.com/659750).
-  SiteInstance* owner_site_instance = delegate_->GetOwnerSiteInstance();
-  if (!owner_site_instance)
-    return MSG_ROUTING_NONE;
-
-  RenderFrameHostManager* rfh_manager =
-      GetWebContents()->GetFrameTree()->root()->render_manager();
-  rfh_manager->CreateRenderFrameProxy(owner_site_instance);
-  guest_proxy_routing_id_ =
-      rfh_manager->GetRenderFrameProxyHost(owner_site_instance)
-          ->GetRenderViewHost()
-          ->GetRoutingID();
-
-  return guest_proxy_routing_id_;
-}
-
 int BrowserPluginGuest::LoadURLWithParams(
     const NavigationController::LoadURLParams& load_params) {
   GetWebContents()->GetController().LoadURLWithParams(load_params);
-  return GetGuestProxyRoutingID();
+  return GetGuestRenderViewRoutingID();
 }
 
 void BrowserPluginGuest::EnableAutoResize(const gfx::Size& min_size,
@@ -875,7 +831,7 @@
   attached_ = true;
   SendQueuedMessages();
 
-  delegate_->DidAttach(GetGuestProxyRoutingID());
+  delegate_->DidAttach(GetGuestRenderViewRoutingID());
   RenderWidgetHostViewGuest* rwhv = static_cast<RenderWidgetHostViewGuest*>(
       web_contents()->GetRenderWidgetHostView());
   if (rwhv)
@@ -1166,4 +1122,48 @@
       browser_plugin_instance_id(), reverse));
 }
 
+int BrowserPluginGuest::GetGuestRenderViewRoutingID() {
+  if (GuestMode::IsCrossProcessFrameGuest(GetWebContents())) {
+    // We don't use the proxy to send postMessage in --site-per-process, since
+    // we use the contentWindow directly from the frame element instead.
+    return MSG_ROUTING_NONE;
+  }
+
+  if (guest_render_view_routing_id_ != MSG_ROUTING_NONE)
+    return guest_render_view_routing_id_;
+
+  // In order to enable the embedder to post messages to the
+  // guest, we need to create a RenderFrameProxyHost in root node of guest
+  // WebContents' frame tree (i.e., create a RenderFrameProxy in the embedder
+  // process which can be used by the embedder to post messages to the guest).
+  // The creation of RFPH for the reverse path, which enables the guest to post
+  // messages to the embedder, will be postponed to when the embedder posts its
+  // first message to the guest.
+  //
+  // TODO(fsamuel): Make sure this works for transferring guests across
+  // owners in different processes. We probably need to clear the
+  // |guest_render_view_routing_id_| and perform any necessary cleanup on Detach
+  // to enable this.
+  //
+  // TODO(ekaramad): If the guest is embedded inside a cross-process <iframe>
+  // (e.g., <embed>-ed PDF), the reverse proxy will not be created and the
+  // posted message's source attribute will be null which in turn breaks the
+  // two-way messaging between the guest and the embedder. We should either
+  // create a RenderFrameProxyHost for the reverse path, or implement
+  // MimeHandlerViewGuest using OOPIF (https://crbug.com/659750).
+  SiteInstance* owner_site_instance = delegate_->GetOwnerSiteInstance();
+  if (!owner_site_instance)
+    return MSG_ROUTING_NONE;
+
+  RenderFrameHostManager* rfh_manager =
+      GetWebContents()->GetFrameTree()->root()->render_manager();
+  rfh_manager->CreateRenderFrameProxy(owner_site_instance);
+  guest_render_view_routing_id_ =
+      rfh_manager->GetRenderFrameProxyHost(owner_site_instance)
+          ->GetRenderViewHost()
+          ->GetRoutingID();
+
+  return guest_render_view_routing_id_;
+}
+
 }  // namespace content
diff --git a/content/browser/browser_plugin/browser_plugin_guest.h b/content/browser/browser_plugin/browser_plugin_guest.h
index a40fd2e..dbc5aa6 100644
--- a/content/browser/browser_plugin/browser_plugin_guest.h
+++ b/content/browser/browser_plugin/browser_plugin_guest.h
@@ -154,10 +154,6 @@
   WebContentsImpl* CreateNewGuestWindow(
       const WebContents::CreateParams& params);
 
-  // Creates, if necessary, and returns the routing ID of a proxy for the guest
-  // in the owner's renderer process.
-  int GetGuestProxyRoutingID();
-
   // Returns the identifier that uniquely identifies a browser plugin guest
   // within an embedder.
   int browser_plugin_instance_id() const { return browser_plugin_instance_id_; }
@@ -401,6 +397,10 @@
 
   void SendTextInputTypeChangedToView(RenderWidgetHostViewBase* guest_rwhv);
 
+  // Creates, if necessary, and returns the routing ID of a render view for the
+  // guest in the owner's renderer process.
+  int GetGuestRenderViewRoutingID();
+
   // The last tooltip that was set with SetTooltipText().
   base::string16 current_tooltip_text_;
 
@@ -442,7 +442,7 @@
 
   // The is the routing ID for a swapped out RenderView for the guest
   // WebContents in the embedder's process.
-  int guest_proxy_routing_id_;
+  int guest_render_view_routing_id_;
   // Last seen state of drag status update.
   blink::WebDragStatus last_drag_status_;
   // Whether or not our embedder has seen a SystemDragEnded() call.
diff --git a/content/browser/browser_thread_unittest.cc b/content/browser/browser_thread_unittest.cc
index 72e7cfd2..075a187 100644
--- a/content/browser/browser_thread_unittest.cc
+++ b/content/browser/browser_thread_unittest.cc
@@ -40,13 +40,14 @@
         BrowserUIThreadScheduler::CreateForTesting(
             sequence_manager_.get(), sequence_manager_->GetRealTimeDomain());
 
-    default_task_runner_ = browser_ui_thread_scheduler->GetHandle().task_runner(
-        BrowserUIThreadScheduler::QueueType::kDefault);
+    default_task_runner_ =
+        browser_ui_thread_scheduler->GetHandle().GetDefaultTaskRunner();
 
     sequence_manager_->SetDefaultTaskRunner(default_task_runner_);
 
     BrowserTaskExecutor::CreateWithBrowserUIThreadSchedulerForTesting(
         std::move(browser_ui_thread_scheduler));
+    BrowserTaskExecutor::EnableAllQueues();
   }
 
   ~SequenceManagerTaskEnvironment() override {
diff --git a/content/browser/devtools/devtools_background_services_context_impl.cc b/content/browser/devtools/devtools_background_services_context_impl.cc
index 21ba92eb..1c1331c 100644
--- a/content/browser/devtools/devtools_background_services_context_impl.cc
+++ b/content/browser/devtools/devtools_background_services_context_impl.cc
@@ -60,8 +60,7 @@
     BrowserContext* browser_context,
     scoped_refptr<ServiceWorkerContextWrapper> service_worker_context)
     : browser_context_(browser_context),
-      service_worker_context_(std::move(service_worker_context)),
-      weak_ptr_factory_(this) {
+      service_worker_context_(std::move(service_worker_context)) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   auto expiration_times =
@@ -148,7 +147,7 @@
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&DevToolsBackgroundServicesContextImpl::
                          GetLoggedBackgroundServiceEventsOnIO,
-                     weak_ptr_factory_.GetWeakPtr(), service,
+                     weak_ptr_factory_io_.GetWeakPtr(), service,
                      std::move(callback)));
 }
 
@@ -161,7 +160,7 @@
   service_worker_context_->GetUserDataForAllRegistrationsByKeyPrefix(
       CreateEntryKeyPrefix(service),
       base::BindOnce(&DevToolsBackgroundServicesContextImpl::DidGetUserData,
-                     weak_ptr_factory_.GetWeakPtr(), std::move(callback)));
+                     weak_ptr_factory_io_.GetWeakPtr(), std::move(callback)));
 }
 
 void DevToolsBackgroundServicesContextImpl::DidGetUserData(
@@ -209,7 +208,7 @@
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&DevToolsBackgroundServicesContextImpl::
                          ClearLoggedBackgroundServiceEventsOnIO,
-                     weak_ptr_factory_.GetWeakPtr(), service));
+                     weak_ptr_factory_io_.GetWeakPtr(), service));
 }
 
 void DevToolsBackgroundServicesContextImpl::
@@ -234,7 +233,7 @@
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           &DevToolsBackgroundServicesContextImpl::LogBackgroundServiceEventOnIO,
-          weak_ptr_factory_.GetWeakPtr(), service_worker_registration_id,
+          weak_ptr_factory_io_.GetWeakPtr(), service_worker_registration_id,
           origin, service, event_name, instance_id, event_metadata));
 }
 
@@ -257,7 +256,7 @@
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(
             &DevToolsBackgroundServicesContextImpl::OnRecordingTimeExpired,
-            weak_ptr_factory_.GetWeakPtr(), ServiceToProtoEnum(service)));
+            weak_ptr_factory_ui_.GetWeakPtr(), ServiceToProtoEnum(service)));
     return;
   }
 
@@ -281,7 +280,7 @@
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(
           &DevToolsBackgroundServicesContextImpl::NotifyEventObservers,
-          weak_ptr_factory_.GetWeakPtr(), std::move(event)));
+          weak_ptr_factory_ui_.GetWeakPtr(), std::move(event)));
 }
 
 void DevToolsBackgroundServicesContextImpl::NotifyEventObservers(
diff --git a/content/browser/devtools/devtools_background_services_context_impl.h b/content/browser/devtools/devtools_background_services_context_impl.h
index 2a5b560..c378fb54 100644
--- a/content/browser/devtools/devtools_background_services_context_impl.h
+++ b/content/browser/devtools/devtools_background_services_context_impl.h
@@ -136,7 +136,10 @@
 
   base::ObserverList<EventObserver> observers_;
 
-  base::WeakPtrFactory<DevToolsBackgroundServicesContextImpl> weak_ptr_factory_;
+  base::WeakPtrFactory<DevToolsBackgroundServicesContextImpl>
+      weak_ptr_factory_ui_{this};
+  base::WeakPtrFactory<DevToolsBackgroundServicesContextImpl>
+      weak_ptr_factory_io_{this};
 
   DISALLOW_COPY_AND_ASSIGN(DevToolsBackgroundServicesContextImpl);
 };
diff --git a/content/browser/devtools/protocol/background_service_handler.cc b/content/browser/devtools/protocol/background_service_handler.cc
index 17b91e8..d5a174a 100644
--- a/content/browser/devtools/protocol/background_service_handler.cc
+++ b/content/browser/devtools/protocol/background_service_handler.cc
@@ -22,6 +22,12 @@
   } else if (service_name ==
              BackgroundService::ServiceNameEnum::BackgroundSync) {
     return devtools::proto::BackgroundService::BACKGROUND_SYNC;
+  } else if (service_name ==
+             BackgroundService::ServiceNameEnum::PushMessaging) {
+    return devtools::proto::BackgroundService::PUSH_MESSAGING;
+  } else if (service_name ==
+             BackgroundService::ServiceNameEnum::Notifications) {
+    return devtools::proto::BackgroundService::NOTIFICATIONS;
   }
   return devtools::proto::BackgroundService::UNKNOWN;
 }
@@ -32,6 +38,10 @@
       return BackgroundService::ServiceNameEnum::BackgroundFetch;
     case devtools::proto::BackgroundService::BACKGROUND_SYNC:
       return BackgroundService::ServiceNameEnum::BackgroundSync;
+    case devtools::proto::BackgroundService::PUSH_MESSAGING:
+      return BackgroundService::ServiceNameEnum::PushMessaging;
+    case devtools::proto::BackgroundService::NOTIFICATIONS:
+      return BackgroundService::ServiceNameEnum::Notifications;
     default:
       NOTREACHED();
   }
diff --git a/content/browser/loader/prefetched_signed_exchange_cache.cc b/content/browser/loader/prefetched_signed_exchange_cache.cc
index e5256bf..7583d1b 100644
--- a/content/browser/loader/prefetched_signed_exchange_cache.cc
+++ b/content/browser/loader/prefetched_signed_exchange_cache.cc
@@ -447,21 +447,30 @@
   if (it == exchanges_.end())
     return nullptr;
   return std::make_unique<PrefetchedNavigationLoaderInterceptor>(
-      it->second->Clone(), GetInfoList());
+      it->second->Clone(), GetInfoListForNavigation(outer_url));
 }
 
 std::vector<PrefetchedSignedExchangeInfo>
-PrefetchedSignedExchangeCache::GetInfoList() const {
+PrefetchedSignedExchangeCache::GetInfoListForNavigation(
+    const GURL& outer_url) const {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   std::vector<PrefetchedSignedExchangeInfo> info_list;
+  const url::Origin outer_url_origin = url::Origin::Create(outer_url);
 
-  for (const auto& exchange : exchanges_) {
+  for (const auto& exchanges_it : exchanges_) {
+    const std::unique_ptr<const Entry>& exchange = exchanges_it.second;
+    if (!outer_url_origin.IsSameOriginWith(
+            url::Origin::Create(exchange->outer_url()))) {
+      // Restrict the main SXG and the subresources SXGs to be served from the
+      // same origin.
+      continue;
+    }
     network::mojom::URLLoaderFactoryPtrInfo loader_factory_info;
     new SubresourceSignedExchangeURLLoaderFactory(
-        mojo::MakeRequest(&loader_factory_info), exchange.second->Clone());
+        mojo::MakeRequest(&loader_factory_info), exchange->Clone());
     info_list.emplace_back(
-        exchange.second->outer_url(), *exchange.second->header_integrity(),
-        exchange.second->inner_url(), *exchange.second->inner_response(),
+        exchange->outer_url(), *exchange->header_integrity(),
+        exchange->inner_url(), *exchange->inner_response(),
         std::move(loader_factory_info).PassHandle().release());
   }
   return info_list;
diff --git a/content/browser/loader/prefetched_signed_exchange_cache.h b/content/browser/loader/prefetched_signed_exchange_cache.h
index 28576709b..fa0e0da9 100644
--- a/content/browser/loader/prefetched_signed_exchange_cache.h
+++ b/content/browser/loader/prefetched_signed_exchange_cache.h
@@ -109,7 +109,8 @@
   using EntryMap = std::map<GURL /* outer_url */, std::unique_ptr<const Entry>>;
 
   ~PrefetchedSignedExchangeCache();
-  std::vector<PrefetchedSignedExchangeInfo> GetInfoList() const;
+  std::vector<PrefetchedSignedExchangeInfo> GetInfoListForNavigation(
+      const GURL& outer_url) const;
 
   EntryMap exchanges_;
 
diff --git a/content/browser/oop_browsertest.cc b/content/browser/oop_browsertest.cc
index 0b7c5bf..d020fbdd 100644
--- a/content/browser/oop_browsertest.cc
+++ b/content/browser/oop_browsertest.cc
@@ -50,7 +50,12 @@
 
 // This test calls into system GL which is not instrumented with MSAN.
 #if !defined(MEMORY_SANITIZER)
-IN_PROC_BROWSER_TEST_F(OOPBrowserTest, Basic) {
+#if defined(OS_LINUX) || defined(OS_CHROMEOS)
+#define MAYBE_Basic DISABLED_Basic
+#else
+#define MAYBE_Basic Basic
+#endif
+IN_PROC_BROWSER_TEST_F(OOPBrowserTest, MAYBE_Basic) {
   // Create a div to ensure we don't use solid color quads.
   GURL url = GURL(
       "data:text/html,"
diff --git a/content/browser/origin_trials/OWNERS b/content/browser/origin_trials/OWNERS
new file mode 100644
index 0000000..73686a7
--- /dev/null
+++ b/content/browser/origin_trials/OWNERS
@@ -0,0 +1 @@
+file://third_party/blink/common/origin_trials/OWNERS
diff --git a/content/browser/origin_trials/origin_trials_browsertest.cc b/content/browser/origin_trials/origin_trials_browsertest.cc
new file mode 100644
index 0000000..7823896
--- /dev/null
+++ b/content/browser/origin_trials/origin_trials_browsertest.cc
@@ -0,0 +1,78 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/strings/strcat.h"
+#include "base/test/bind_test_util.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/test/browser_test_utils.h"
+#include "content/public/test/content_browser_test.h"
+#include "content/public/test/content_browser_test_utils.h"
+#include "content/public/test/url_loader_interceptor.h"
+#include "content/shell/browser/shell.h"
+#include "content/shell/common/shell_switches.h"
+
+using content::URLLoaderInterceptor;
+
+namespace {
+constexpr char kBaseDataDir[] = "content/test/data/origin_trials/";
+}  // namespace
+
+namespace content {
+
+class OriginTrialsBrowserTest : public content::ContentBrowserTest {
+ public:
+  OriginTrialsBrowserTest() : ContentBrowserTest() {}
+  ~OriginTrialsBrowserTest() override {}
+
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    ContentBrowserTest::SetUpCommandLine(command_line);
+    command_line->AppendSwitch(switches::kExposeInternalsForTesting);
+  }
+
+  void SetUpOnMainThread() override {
+    ContentBrowserTest::SetUpOnMainThread();
+
+    // We use a URLLoaderInterceptor, rather than the EmbeddedTestServer, since
+    // the origin trial token in the response is associated with a fixed
+    // origin, whereas EmbeddedTestServer serves content on a random port.
+    url_loader_interceptor_ =
+        std::make_unique<URLLoaderInterceptor>(base::BindLambdaForTesting(
+            [&](URLLoaderInterceptor::RequestParams* params) -> bool {
+              URLLoaderInterceptor::WriteResponse(
+                  base::StrCat(
+                      {kBaseDataDir, params->url_request.url.path_piece()}),
+                  params->client.get());
+              return true;
+            }));
+  }
+
+  void TearDownOnMainThread() override {
+    url_loader_interceptor_.reset();
+    ContentBrowserTest::TearDownOnMainThread();
+  }
+
+ private:
+  std::unique_ptr<URLLoaderInterceptor> url_loader_interceptor_;
+
+  DISALLOW_COPY_AND_ASSIGN(OriginTrialsBrowserTest);
+};
+
+IN_PROC_BROWSER_TEST_F(OriginTrialsBrowserTest, Basic) {
+  NavigateToURL(shell(), GURL("https://example.test/basic.html"));
+  // Ensure we can invoke normalMethod(), which is only available when the
+  // Frobulate OT is enabled.
+  EXPECT_TRUE(content::ExecJs(shell()->web_contents()->GetMainFrame(),
+                              "internals.originTrialsTest().normalMethod();"));
+}
+
+IN_PROC_BROWSER_TEST_F(OriginTrialsBrowserTest, Navigation) {
+  NavigateToURL(shell(), GURL("https://example.test/navigation.html"));
+  // Ensure we can invoke navigationMethod(), which is only available when the
+  // FrobulateNavigation OT is enabled.
+  EXPECT_TRUE(
+      content::ExecJs(shell()->web_contents()->GetMainFrame(),
+                      "internals.originTrialsTest().navigationMethod();"));
+}
+
+}  // namespace content
diff --git a/content/browser/renderer_host/render_widget_host_view_mac_unittest.mm b/content/browser/renderer_host/render_widget_host_view_mac_unittest.mm
index 113f5f3e..ecbabcc 100644
--- a/content/browser/renderer_host/render_widget_host_view_mac_unittest.mm
+++ b/content/browser/renderer_host/render_widget_host_view_mac_unittest.mm
@@ -568,9 +568,11 @@
 // This test verifies that RenderWidgetHostViewCocoa's implementation of
 // NSTextInputClientConformance conforms to requirements.
 TEST_F(RenderWidgetHostViewMacTest, NSTextInputClientConformance) {
-  NSRange selectedRange = [rwhv_cocoa_ selectedRange];
-  EXPECT_EQ(0u, selectedRange.location);
-  EXPECT_EQ(0u, selectedRange.length);
+  EXPECT_NSEQ(NSMakeRange(0, 0), [rwhv_cocoa_ selectedRange]);
+
+  rwhv_mac_->SelectionChanged(base::UTF8ToUTF16("llo, world!"), 2,
+                              gfx::Range(5, 10));
+  EXPECT_NSEQ(NSMakeRange(7, 5), [rwhv_cocoa_ selectedRange]);
 
   NSRange actualRange = NSMakeRange(1u, 2u);
   NSAttributedString* actualString = [rwhv_cocoa_
diff --git a/content/browser/scheduler/browser_task_executor.cc b/content/browser/scheduler/browser_task_executor.cc
index 01535ef..8fda483 100644
--- a/content/browser/scheduler/browser_task_executor.cc
+++ b/content/browser/scheduler/browser_task_executor.cc
@@ -169,6 +169,8 @@
   DCHECK(!base::ThreadTaskRunnerHandle::IsSet());
   g_browser_task_executor =
       new BrowserTaskExecutor(std::make_unique<BrowserUIThreadScheduler>());
+  g_browser_task_executor->browser_ui_thread_handle_
+      .EnableAllExceptBestEffortQueues();
   base::RegisterTaskExecutor(BrowserTaskTraitsExtension::kExtensionId,
                              g_browser_task_executor);
 #if defined(OS_ANDROID)
@@ -182,6 +184,8 @@
   DCHECK(!g_browser_task_executor);
   g_browser_task_executor =
       new BrowserTaskExecutor(std::move(browser_ui_thread_scheduler));
+  g_browser_task_executor->browser_ui_thread_handle_
+      .EnableAllExceptBestEffortQueues();
   base::RegisterTaskExecutor(BrowserTaskTraitsExtension::kExtensionId,
                              g_browser_task_executor);
 #if defined(OS_ANDROID)
@@ -328,13 +332,14 @@
   switch (task_type) {
     case BrowserTaskType::kBootstrap:
       // Note we currently ignore the priority for bootstrap tasks.
-      return browser_ui_thread_handle_.task_runner(QueueType::kBootstrap);
+      return browser_ui_thread_handle_.GetBrowserTaskRunner(
+          QueueType::kBootstrap);
 
     case BrowserTaskType::kNavigation:
     case BrowserTaskType::kPreconnect:
       // Note we currently ignore the priority for navigation and preconnection
       // tasks.
-      return browser_ui_thread_handle_.task_runner(
+      return browser_ui_thread_handle_.GetBrowserTaskRunner(
           QueueType::kNavigationAndPreconnection);
 
     case BrowserTaskType::kDefault:
@@ -347,13 +352,16 @@
 
   switch (traits.priority()) {
     case base::TaskPriority::BEST_EFFORT:
-      return browser_ui_thread_handle_.task_runner(QueueType::kBestEffort);
+      return browser_ui_thread_handle_.GetBrowserTaskRunner(
+          QueueType::kBestEffort);
 
     case base::TaskPriority::USER_VISIBLE:
-      return browser_ui_thread_handle_.task_runner(QueueType::kDefault);
+      return browser_ui_thread_handle_.GetBrowserTaskRunner(
+          QueueType::kDefault);
 
     case base::TaskPriority::USER_BLOCKING:
-      return browser_ui_thread_handle_.task_runner(QueueType::kUserBlocking);
+      return browser_ui_thread_handle_.GetBrowserTaskRunner(
+          QueueType::kUserBlocking);
   }
 }
 
@@ -370,9 +378,9 @@
 }
 
 // static
-void BrowserTaskExecutor::EnableBestEffortQueues() {
+void BrowserTaskExecutor::EnableAllQueues() {
   DCHECK(g_browser_task_executor);
-  g_browser_task_executor->browser_ui_thread_handle_.EnableBestEffortQueues();
+  g_browser_task_executor->browser_ui_thread_handle_.EnableAllQueues();
 }
 
 }  // namespace content
diff --git a/content/browser/scheduler/browser_task_executor.h b/content/browser/scheduler/browser_task_executor.h
index d13dbf7f..8addddf 100644
--- a/content/browser/scheduler/browser_task_executor.h
+++ b/content/browser/scheduler/browser_task_executor.h
@@ -27,8 +27,16 @@
   // Creates and registers a BrowserTaskExecutor on the current thread which
   // owns a BrowserUIThreadScheduler. This facilitates posting tasks to a
   // BrowserThread via //base/task/post_task.h.
+  // All BrowserThread::UI task queues except best effort ones are also enabled.
+  // TODO(carlscab): These queues should be enabled in
+  // BrowserMainLoop::InitializeMainThread() but some Android tests fail if we
+  // do so.
   static void Create();
 
+  // Enables all queues on all threads.
+  // Can be called multiple times.
+  static void EnableAllQueues();
+
   // As Create but with the user provided |browser_ui_thread_scheduler|.
   static void CreateWithBrowserUIThreadSchedulerForTesting(
       std::unique_ptr<BrowserUIThreadScheduler> browser_ui_thread_scheduler);
@@ -42,8 +50,6 @@
   // called.
   static void Shutdown();
 
-  static void EnableBestEffortQueues();
-
   // Unregister and delete the TaskExecutor after a test.
   static void ResetForTesting();
 
diff --git a/content/browser/scheduler/browser_task_executor_unittest.cc b/content/browser/scheduler/browser_task_executor_unittest.cc
index 0e490f02..a9b1f3c 100644
--- a/content/browser/scheduler/browser_task_executor_unittest.cc
+++ b/content/browser/scheduler/browser_task_executor_unittest.cc
@@ -70,23 +70,18 @@
   ContentBrowserClient* old_browser_client_;
 };
 
-TEST_F(BrowserTaskExecutorTest, EnsureUIThreadTraitPointsToExpectedQueue) {
-  EXPECT_EQ(base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::UI}),
-            thread_bundle_.GetMainThreadTaskRunner());
-}
-
 TEST_F(BrowserTaskExecutorTest, EnsureIOThreadTraitPointsToExpectedQueue) {
   EXPECT_EQ(
       base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::IO}),
       BrowserTaskExecutor::GetProxyTaskRunnerForThread(BrowserThread::IO));
 }
 
-using MockTask =
+using StrictMockTask =
     testing::StrictMock<base::MockCallback<base::RepeatingCallback<void()>>>;
 
 TEST_F(BrowserTaskExecutorTest, RunAllPendingTasksForTestingOnUI) {
-  MockTask task_1;
-  MockTask task_2;
+  StrictMockTask task_1;
+  StrictMockTask task_2;
   EXPECT_CALL(task_1, Run).WillOnce(testing::Invoke([&]() {
     base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE, task_2.Get());
   }));
@@ -102,8 +97,8 @@
 }
 
 TEST_F(BrowserTaskExecutorTest, RunAllPendingTasksForTestingOnIO) {
-  MockTask task_1;
-  MockTask task_2;
+  StrictMockTask task_1;
+  StrictMockTask task_2;
   EXPECT_CALL(task_1, Run).WillOnce(testing::Invoke([&]() {
     base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE, task_2.Get());
   }));
@@ -119,9 +114,9 @@
 }
 
 TEST_F(BrowserTaskExecutorTest, RunAllPendingTasksForTestingOnIOIsReentrant) {
-  MockTask task_1;
-  MockTask task_2;
-  MockTask task_3;
+  StrictMockTask task_1;
+  StrictMockTask task_2;
+  StrictMockTask task_3;
 
   EXPECT_CALL(task_1, Run).WillOnce(Invoke([&]() {
     base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE, task_2.Get());
@@ -155,7 +150,7 @@
           BrowserUIThreadScheduler::CreateForTesting(sequence_manager(),
                                                      GetTimeDomain());
       DeferredInitFromSubclass(
-          browser_ui_thread_scheduler->GetHandle().task_runner(
+          browser_ui_thread_scheduler->GetHandle().GetBrowserTaskRunner(
               QueueType::kDefault));
       browser_ui_thread_scheduler_ = browser_ui_thread_scheduler.get();
       BrowserTaskExecutor::CreateWithBrowserUIThreadSchedulerForTesting(
@@ -186,16 +181,16 @@
   EXPECT_EQ(base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::UI}),
             scoped_task_environment_.browser_ui_thread_scheduler()
                 ->GetHandle()
-                .task_runner(QueueType::kDefault));
+                .GetBrowserTaskRunner(QueueType::kDefault));
   EXPECT_EQ(base::CreateSingleThreadTaskRunnerWithTraits({BrowserThread::UI}),
             scoped_task_environment_.GetMainThreadTaskRunner());
 }
 
 TEST_F(BrowserTaskExecutorWithCustomSchedulerTest,
        UserVisibleOrBlockingTasksRunDuringStartup) {
-  MockTask best_effort;
-  MockTask user_visible;
-  MockTask user_blocking;
+  StrictMockTask best_effort;
+  StrictMockTask user_visible;
+  StrictMockTask user_blocking;
 
   base::PostTaskWithTraits(FROM_HERE,
                            {BrowserThread::UI, base::TaskPriority::BEST_EFFORT},
@@ -218,7 +213,7 @@
   auto ui_best_effort_runner = base::CreateSingleThreadTaskRunnerWithTraits(
       {BrowserThread::UI, base::TaskPriority::BEST_EFFORT});
 
-  MockTask best_effort;
+  StrictMockTask best_effort;
 
   ui_best_effort_runner->PostTask(FROM_HERE, best_effort.Get());
   ui_best_effort_runner->PostDelayedTask(
@@ -231,7 +226,7 @@
                            best_effort.Get());
   scoped_task_environment_.RunUntilIdle();
 
-  BrowserTaskExecutor::EnableBestEffortQueues();
+  BrowserTaskExecutor::EnableAllQueues();
   EXPECT_CALL(best_effort, Run).Times(4);
   scoped_task_environment_.FastForwardBy(
       base::TimeDelta::FromMilliseconds(100));
diff --git a/content/browser/scheduler/browser_task_queues.cc b/content/browser/scheduler/browser_task_queues.cc
index e80f2686..b95e60f 100644
--- a/content/browser/scheduler/browser_task_queues.cc
+++ b/content/browser/scheduler/browser_task_queues.cc
@@ -18,6 +18,11 @@
 
 namespace content {
 namespace {
+
+using QueuePriority = ::base::sequence_manager::TaskQueue::QueuePriority;
+using InsertFencePosition =
+    ::base::sequence_manager::TaskQueue::InsertFencePosition;
+
 const char* GetControlTaskQueueName(BrowserThread::ID thread_id) {
   switch (thread_id) {
     case BrowserThread::UI:
@@ -88,6 +93,19 @@
   return "";
 }
 
+const char* GetDefaultQueueName(BrowserThread::ID thread_id) {
+  switch (thread_id) {
+    case BrowserThread::UI:
+      return "ui_thread_tq";
+    case BrowserThread::IO:
+      return "io_thread_tq";
+    case BrowserThread::ID_COUNT:
+      break;
+  }
+  NOTREACHED();
+  return "";
+}
+
 }  // namespace
 
 BrowserTaskQueues::Handle::Handle(Handle&&) = default;
@@ -101,7 +119,8 @@
 BrowserTaskQueues::Handle::Handle(BrowserTaskQueues* outer)
     : outer_(outer),
       control_task_runner_(outer_->control_queue_->task_runner()),
-      regular_task_runners_(outer_->CreateRegularTaskRunners()) {}
+      default_task_runner_(outer_->default_task_queue_->task_runner()),
+      browser_task_runners_(outer_->CreateBrowserTaskRunners()) {}
 
 void BrowserTaskQueues::Handle::PostFeatureListInitializationSetup() {
   control_task_runner_->PostTask(
@@ -110,12 +129,19 @@
                      base::Unretained(outer_)));
 }
 
-void BrowserTaskQueues::Handle::EnableBestEffortQueues() {
+void BrowserTaskQueues::Handle::EnableAllQueues() {
   control_task_runner_->PostTask(
-      FROM_HERE, base::BindOnce(&BrowserTaskQueues::EnableBestEffortQueues,
+      FROM_HERE, base::BindOnce(&BrowserTaskQueues::EnableAllQueues,
                                 base::Unretained(outer_)));
 }
 
+void BrowserTaskQueues::Handle::EnableAllExceptBestEffortQueues() {
+  control_task_runner_->PostTask(
+      FROM_HERE,
+      base::BindOnce(&BrowserTaskQueues::EnableAllExceptBestEffortQueues,
+                     base::Unretained(outer_)));
+}
+
 void BrowserTaskQueues::Handle::ScheduleRunAllPendingTasksForTesting(
     base::OnceClosure on_pending_task_ran) {
   control_task_runner_->PostTask(
@@ -130,28 +156,31 @@
     BrowserThread::ID thread_id,
     base::sequence_manager::SequenceManager* sequence_manager,
     base::sequence_manager::TimeDomain* time_domain) {
-  for (size_t i = 0; i < regular_queues_.size(); ++i) {
-    regular_queues_[i] = sequence_manager->CreateTaskQueue(
+  for (size_t i = 0; i < browser_queues_and_voters_.size(); ++i) {
+    browser_queues_and_voters_[i].first = sequence_manager->CreateTaskQueue(
         base::sequence_manager::TaskQueue::Spec(
             GetTaskQueueName(thread_id, static_cast<QueueType>(i)))
             .SetTimeDomain(time_domain));
+    browser_queues_and_voters_[i].second =
+        browser_queues_and_voters_[i].first->CreateQueueEnabledVoter();
+    browser_queues_and_voters_[i].second->SetVoteToEnable(false);
   }
 
+  // Default task queue
+  default_task_queue_ = sequence_manager->CreateTaskQueue(
+      base::sequence_manager::TaskQueue::Spec(GetDefaultQueueName(thread_id))
+          .SetTimeDomain(time_domain));
+
   // Best effort queue
-  best_effort_voter_ =
-      regular_queue(QueueType::kBestEffort)->CreateQueueEnabledVoter();
-  regular_queue(QueueType::kBestEffort)
-      ->SetQueuePriority(
-          base::sequence_manager::TaskQueue::kBestEffortPriority);
-  best_effort_voter_->SetVoteToEnable(false);
+  GetBrowserTaskQueue(QueueType::kBestEffort)
+      ->SetQueuePriority(QueuePriority::kBestEffortPriority);
 
   // Control queue
   control_queue_ =
       sequence_manager->CreateTaskQueue(base::sequence_manager::TaskQueue::Spec(
                                             GetControlTaskQueueName(thread_id))
                                             .SetTimeDomain(time_domain));
-  control_queue_->SetQueuePriority(
-      base::sequence_manager::TaskQueue::kControlPriority);
+  control_queue_->SetQueuePriority(QueuePriority::kControlPriority);
 
   // Run all pending queue
   run_all_pending_tasks_queue_ = sequence_manager->CreateTaskQueue(
@@ -159,42 +188,52 @@
           GetRunAllPendingTaskQueueName(thread_id))
           .SetTimeDomain(time_domain));
   run_all_pending_tasks_queue_->SetQueuePriority(
-      base::sequence_manager::TaskQueue::kBestEffortPriority);
+      QueuePriority::kBestEffortPriority);
 }
 
 BrowserTaskQueues::~BrowserTaskQueues() {
-  for (auto& queue : regular_queues_) {
-    queue->ShutdownTaskQueue();
+  for (auto& queue : browser_queues_and_voters_) {
+    queue.first->ShutdownTaskQueue();
   }
   control_queue_->ShutdownTaskQueue();
+  default_task_queue_->ShutdownTaskQueue();
   run_all_pending_tasks_queue_->ShutdownTaskQueue();
 }
 
 std::array<scoped_refptr<base::SingleThreadTaskRunner>,
            BrowserTaskQueues::kNumQueueTypes>
-BrowserTaskQueues::CreateRegularTaskRunners() const {
+BrowserTaskQueues::CreateBrowserTaskRunners() const {
   std::array<scoped_refptr<base::SingleThreadTaskRunner>, kNumQueueTypes>
       task_runners;
-  for (size_t i = 0; i < regular_queues_.size(); ++i) {
-    task_runners[i] = regular_queues_[i]->task_runner();
+  for (size_t i = 0; i < browser_queues_and_voters_.size(); ++i) {
+    task_runners[i] = browser_queues_and_voters_[i].first->task_runner();
   }
   return task_runners;
 }
 
 void BrowserTaskQueues::PostFeatureListInitializationSetup() {
   if (base::FeatureList::IsEnabled(features::kPrioritizeBootstrapTasks)) {
-    regular_queue(QueueType::kBootstrap)
-        ->SetQueuePriority(base::sequence_manager::TaskQueue::kHighestPriority);
+    GetBrowserTaskQueue(QueueType::kBootstrap)
+        ->SetQueuePriority(QueuePriority::kHighestPriority);
 
     // Navigation and preconnection tasks are also important during startup so
     // prioritize them too.
-    regular_queue(QueueType::kNavigationAndPreconnection)
-        ->SetQueuePriority(base::sequence_manager::TaskQueue::kHighPriority);
+    GetBrowserTaskQueue(QueueType::kNavigationAndPreconnection)
+        ->SetQueuePriority(QueuePriority::kHighPriority);
   }
 }
 
-void BrowserTaskQueues::EnableBestEffortQueues() {
-  best_effort_voter_->SetVoteToEnable(true);
+void BrowserTaskQueues::EnableAllQueues() {
+  for (size_t i = 0; i < browser_queues_and_voters_.size(); ++i) {
+    browser_queues_and_voters_[i].second->SetVoteToEnable(true);
+  }
+}
+
+void BrowserTaskQueues::EnableAllExceptBestEffortQueues() {
+  for (size_t i = 0; i < browser_queues_and_voters_.size(); ++i) {
+    if (i != static_cast<size_t>(QueueType::kBestEffort))
+      browser_queues_and_voters_[i].second->SetVoteToEnable(true);
+  }
 }
 
 // To run all pending tasks we do the following. We insert a fence in all queues
@@ -211,10 +250,10 @@
 void BrowserTaskQueues::StartRunAllPendingTasksForTesting(
     base::ScopedClosureRunner on_pending_task_ran) {
   ++run_all_pending_nesting_level_;
-  for (const auto& queue : regular_queues_) {
-    queue->InsertFence(
-        base::sequence_manager::TaskQueue::InsertFencePosition::kNow);
+  for (const auto& queue : browser_queues_and_voters_) {
+    queue.first->InsertFence(InsertFencePosition::kNow);
   }
+  default_task_queue_->InsertFence(InsertFencePosition::kNow);
   run_all_pending_tasks_queue_->task_runner()->PostTask(
       FROM_HERE,
       base::BindOnce(&BrowserTaskQueues::EndRunAllPendingTasksForTesting,
@@ -225,9 +264,10 @@
     base::ScopedClosureRunner on_pending_task_ran) {
   --run_all_pending_nesting_level_;
   if (run_all_pending_nesting_level_ == 0) {
-    for (const auto& queue : regular_queues_) {
-      queue->RemoveFence();
+    for (const auto& queue : browser_queues_and_voters_) {
+      queue.first->RemoveFence();
     }
+    default_task_queue_->RemoveFence();
   }
 }
 
diff --git a/content/browser/scheduler/browser_task_queues.h b/content/browser/scheduler/browser_task_queues.h
index e22c2bc5..5c81ebe 100644
--- a/content/browser/scheduler/browser_task_queues.h
+++ b/content/browser/scheduler/browser_task_queues.h
@@ -32,8 +32,8 @@
 // associated thread unless noted otherwise. If you need to perform operations
 // from a different thread use the a Handle instance instead.
 //
-// Best effort queues are initially disabled, that is, tasks will not be run for
-// them.
+// Attention: All queues are initially disabled, that is, tasks will not be run
+// for them.
 class CONTENT_EXPORT BrowserTaskQueues {
  public:
   enum class QueueType {
@@ -78,9 +78,15 @@
     Handle& operator=(Handle&&) noexcept;
     Handle& operator=(const Handle&);
 
-    const scoped_refptr<base::SingleThreadTaskRunner>& task_runner(
+    // Returns the task runner that should be returned by
+    // ThreadTaskRunnerHandle::Get().
+    const scoped_refptr<base::SingleThreadTaskRunner>& GetDefaultTaskRunner() {
+      return default_task_runner_;
+    }
+
+    const scoped_refptr<base::SingleThreadTaskRunner>& GetBrowserTaskRunner(
         QueueType queue_type) const {
-      return regular_task_runners_[static_cast<size_t>(queue_type)];
+      return browser_task_runners_[static_cast<size_t>(queue_type)];
     }
 
     // Initializes any scheduler experiments. Should be called after
@@ -88,8 +94,12 @@
     // queues are set up).
     void PostFeatureListInitializationSetup();
 
-    // Enables best effort tasks queues. Can be called multiple times.
-    void EnableBestEffortQueues();
+    // Enables all tasks queues. Can be called multiple times.
+    void EnableAllQueues();
+
+    // Enables all task queues except the effort ones. Can be called multiple
+    // times.
+    void EnableAllExceptBestEffortQueues();
 
     // Schedules |on_pending_task_ran| to run when all pending tasks (at the
     // time this method was invoked) have run. Only "runnable" tasks are taken
@@ -117,8 +127,9 @@
     // runners.
     BrowserTaskQueues* outer_ = nullptr;
     scoped_refptr<base::SingleThreadTaskRunner> control_task_runner_;
+    scoped_refptr<base::SingleThreadTaskRunner> default_task_runner_;
     std::array<scoped_refptr<base::SingleThreadTaskRunner>, kNumQueueTypes>
-        regular_task_runners_;
+        browser_task_runners_;
   };
 
   // |sequence_manager| and |time_domain| must outlive this instance.
@@ -140,24 +151,32 @@
       base::ScopedClosureRunner on_pending_task_ran);
   void EndRunAllPendingTasksForTesting(
       base::ScopedClosureRunner on_pending_task_ran);
-  void EnableBestEffortQueues();
+  void EnableAllQueues();
+  void EnableAllExceptBestEffortQueues();
   void PostFeatureListInitializationSetup();
 
-  base::sequence_manager::TaskQueue* regular_queue(QueueType type) const {
-    return regular_queues_[static_cast<size_t>(type)].get();
+  base::sequence_manager::TaskQueue* GetBrowserTaskQueue(QueueType type) const {
+    return browser_queues_and_voters_[static_cast<size_t>(type)].first.get();
   }
 
   std::array<scoped_refptr<base::SingleThreadTaskRunner>, kNumQueueTypes>
-  CreateRegularTaskRunners() const;
+  CreateBrowserTaskRunners() const;
 
-  std::array<scoped_refptr<base::sequence_manager::TaskQueue>, kNumQueueTypes>
-      regular_queues_;
-  std::unique_ptr<base::sequence_manager::TaskQueue::QueueEnabledVoter>
-      best_effort_voter_;
+  using QueueVoterPair = std::pair<
+      scoped_refptr<base::sequence_manager::TaskQueue>,
+      std::unique_ptr<base::sequence_manager::TaskQueue::QueueEnabledVoter>>;
+
+  std::array<QueueVoterPair, kNumQueueTypes> browser_queues_and_voters_;
   // Helper queue to make sure private methods run on the associated thread. the
   // control queue has maximum priority and will never be disabled.
   scoped_refptr<base::sequence_manager::TaskQueue> control_queue_;
 
+  // Queue that backs the default TaskRunner registered with SequenceManager.
+  // This will be the one returned by ThreadTaskRunnerHandle::Get(). Note this
+  // is different from QueueType:kDefault as this queue needs to be enabled from
+  // the beginning.
+  scoped_refptr<base::sequence_manager::TaskQueue> default_task_queue_;
+
   // Helper queue to run all pending tasks.
   scoped_refptr<base::sequence_manager::TaskQueue> run_all_pending_tasks_queue_;
   int run_all_pending_nesting_level_ = 0;
diff --git a/content/browser/scheduler/browser_task_queues_unittest.cc b/content/browser/scheduler/browser_task_queues_unittest.cc
index 37b183c..93918ff 100644
--- a/content/browser/scheduler/browser_task_queues_unittest.cc
+++ b/content/browser/scheduler/browser_task_queues_unittest.cc
@@ -26,7 +26,7 @@
 using ::testing::Invoke;
 using ::testing::Mock;
 
-using MockTask =
+using StrictMockTask =
     testing::StrictMock<base::MockCallback<base::RepeatingCallback<void()>>>;
 
 using QueueType = BrowserTaskQueues::QueueType;
@@ -41,8 +41,7 @@
             sequence_manager_.get(),
             sequence_manager_->GetRealTimeDomain())),
         handle_(queues_->CreateHandle()) {
-    sequence_manager_->SetDefaultTaskRunner(
-        handle_.task_runner(QueueType::kDefault));
+    sequence_manager_->SetDefaultTaskRunner(handle_.GetDefaultTaskRunner());
   }
 
   std::unique_ptr<SequenceManager> sequence_manager_;
@@ -50,13 +49,78 @@
   BrowserTaskQueues::Handle handle_;
 };
 
-TEST_F(BrowserTaskQueuesTest, SimplePosting) {
-  scoped_refptr<base::SingleThreadTaskRunner> tq =
-      handle_.task_runner(QueueType::kDefault);
+TEST_F(BrowserTaskQueuesTest, NoTaskRunsUntilQueuesAreEnabled) {
+  StrictMockTask task;
+  for (size_t i = 0; i < BrowserTaskQueues::kNumQueueTypes; ++i) {
+    handle_.GetBrowserTaskRunner(static_cast<QueueType>(i))
+        ->PostTask(FROM_HERE, task.Get());
+  }
 
-  MockTask task_1;
-  MockTask task_2;
-  MockTask task_3;
+  {
+    RunLoop run_loop;
+    handle_.ScheduleRunAllPendingTasksForTesting(run_loop.QuitClosure());
+    run_loop.Run();
+  }
+
+  handle_.EnableAllQueues();
+
+  {
+    RunLoop run_loop;
+    handle_.ScheduleRunAllPendingTasksForTesting(run_loop.QuitClosure());
+    EXPECT_CALL(task, Run).Times(BrowserTaskQueues::kNumQueueTypes);
+    run_loop.Run();
+  }
+}
+
+TEST_F(BrowserTaskQueuesTest, OnlyDefaultQueueRunsTasksOnCreation) {
+  StrictMockTask task;
+  for (size_t i = 0; i < BrowserTaskQueues::kNumQueueTypes; ++i) {
+    handle_.GetBrowserTaskRunner(static_cast<QueueType>(i))
+        ->PostTask(FROM_HERE, task.Get());
+  }
+
+  StrictMockTask default_task;
+  handle_.GetDefaultTaskRunner()->PostTask(FROM_HERE, default_task.Get());
+
+  {
+    RunLoop run_loop;
+    handle_.ScheduleRunAllPendingTasksForTesting(run_loop.QuitClosure());
+    EXPECT_CALL(default_task, Run);
+    run_loop.Run();
+  }
+}
+
+TEST_F(BrowserTaskQueuesTest, TasksRunWhenQueuesAreEnabled) {
+  StrictMockTask task;
+  for (size_t i = 0; i < BrowserTaskQueues::kNumQueueTypes; ++i) {
+    handle_.GetBrowserTaskRunner(static_cast<QueueType>(i))
+        ->PostTask(FROM_HERE, task.Get());
+  }
+
+  {
+    RunLoop run_loop;
+    handle_.ScheduleRunAllPendingTasksForTesting(run_loop.QuitClosure());
+    run_loop.Run();
+  }
+
+  handle_.EnableAllQueues();
+
+  {
+    RunLoop run_loop;
+    handle_.ScheduleRunAllPendingTasksForTesting(run_loop.QuitClosure());
+    EXPECT_CALL(task, Run).Times(BrowserTaskQueues::kNumQueueTypes);
+    run_loop.Run();
+  }
+}
+
+TEST_F(BrowserTaskQueuesTest, SimplePosting) {
+  handle_.EnableAllQueues();
+  scoped_refptr<base::SingleThreadTaskRunner> tq =
+      handle_.GetBrowserTaskRunner(QueueType::kDefault);
+
+  StrictMockTask task_1;
+  StrictMockTask task_2;
+  StrictMockTask task_3;
 
   {
     testing::InSequence s;
@@ -73,18 +137,19 @@
 }
 
 TEST_F(BrowserTaskQueuesTest, RunAllPendingTasksForTesting) {
-  handle_.EnableBestEffortQueues();
+  handle_.EnableAllQueues();
 
-  MockTask task;
-  MockTask followup_task;
+  StrictMockTask task;
+  StrictMockTask followup_task;
   EXPECT_CALL(task, Run).WillOnce(Invoke([&]() {
     for (size_t i = 0; i < BrowserTaskQueues::kNumQueueTypes; ++i) {
-      handle_.task_runner(static_cast<QueueType>(i))
+      handle_.GetBrowserTaskRunner(static_cast<QueueType>(i))
           ->PostTask(FROM_HERE, followup_task.Get());
     }
   }));
 
-  handle_.task_runner(QueueType::kDefault)->PostTask(FROM_HERE, task.Get());
+  handle_.GetBrowserTaskRunner(QueueType::kDefault)
+      ->PostTask(FROM_HERE, task.Get());
 
   {
     RunLoop run_loop;
@@ -102,14 +167,14 @@
 
 TEST_F(BrowserTaskQueuesTest, RunAllPendingTasksForTestingRunsAllTasks) {
   constexpr size_t kTasksPerPriority = 100;
-  handle_.EnableBestEffortQueues();
+  handle_.EnableAllQueues();
 
-  MockTask task;
+  StrictMockTask task;
   EXPECT_CALL(task, Run).Times(BrowserTaskQueues::kNumQueueTypes *
                                kTasksPerPriority);
   for (size_t i = 0; i < BrowserTaskQueues::kNumQueueTypes; ++i) {
     for (size_t j = 0; j < kTasksPerPriority; ++j) {
-      handle_.task_runner(static_cast<QueueType>(i))
+      handle_.GetBrowserTaskRunner(static_cast<QueueType>(i))
           ->PostTask(FROM_HERE, task.Get());
     }
   }
@@ -120,22 +185,26 @@
 }
 
 TEST_F(BrowserTaskQueuesTest, RunAllPendingTasksForTestingIsReentrant) {
-  MockTask task_1;
-  MockTask task_2;
-  MockTask task_3;
+  handle_.EnableAllQueues();
+  StrictMockTask task_1;
+  StrictMockTask task_2;
+  StrictMockTask task_3;
 
   EXPECT_CALL(task_1, Run).WillOnce(Invoke([&]() {
-    handle_.task_runner(QueueType::kDefault)->PostTask(FROM_HERE, task_2.Get());
+    handle_.GetBrowserTaskRunner(QueueType::kDefault)
+        ->PostTask(FROM_HERE, task_2.Get());
     RunLoop run_loop(RunLoop::Type::kNestableTasksAllowed);
     handle_.ScheduleRunAllPendingTasksForTesting(run_loop.QuitClosure());
     run_loop.Run();
   }));
 
   EXPECT_CALL(task_2, Run).WillOnce(Invoke([&]() {
-    handle_.task_runner(QueueType::kDefault)->PostTask(FROM_HERE, task_3.Get());
+    handle_.GetBrowserTaskRunner(QueueType::kDefault)
+        ->PostTask(FROM_HERE, task_3.Get());
   }));
 
-  handle_.task_runner(QueueType::kDefault)->PostTask(FROM_HERE, task_1.Get());
+  handle_.GetBrowserTaskRunner(QueueType::kDefault)
+      ->PostTask(FROM_HERE, task_1.Get());
 
   RunLoop run_loop;
   handle_.ScheduleRunAllPendingTasksForTesting(run_loop.QuitClosure());
@@ -144,12 +213,13 @@
 
 TEST_F(BrowserTaskQueuesTest,
        RunAllPendingTasksForTestingIgnoresBestEffortIfNotEnabled) {
-  MockTask best_effort_task;
-  MockTask default_task;
+  handle_.EnableAllExceptBestEffortQueues();
+  StrictMockTask best_effort_task;
+  StrictMockTask default_task;
 
-  handle_.task_runner(QueueType::kBestEffort)
+  handle_.GetBrowserTaskRunner(QueueType::kBestEffort)
       ->PostTask(FROM_HERE, best_effort_task.Get());
-  handle_.task_runner(QueueType::kDefault)
+  handle_.GetBrowserTaskRunner(QueueType::kDefault)
       ->PostTask(FROM_HERE, default_task.Get());
 
   EXPECT_CALL(default_task, Run);
@@ -161,21 +231,23 @@
 
 TEST_F(BrowserTaskQueuesTest,
        RunAllPendingTasksForTestingRunsBestEffortTasksWhenEnabled) {
-  MockTask task_1;
-  MockTask task_2;
-  MockTask task_3;
+  handle_.EnableAllExceptBestEffortQueues();
+  StrictMockTask task_1;
+  StrictMockTask task_2;
+  StrictMockTask task_3;
 
   EXPECT_CALL(task_1, Run).WillOnce(Invoke([&]() {
     // This task should not run as it is posted after the
     // RunAllPendingTasksForTesting() call
-    handle_.task_runner(QueueType::kBestEffort)
+    handle_.GetBrowserTaskRunner(QueueType::kBestEffort)
         ->PostTask(FROM_HERE, task_3.Get());
-    handle_.EnableBestEffortQueues();
+    handle_.EnableAllQueues();
   }));
   EXPECT_CALL(task_2, Run);
 
-  handle_.task_runner(QueueType::kDefault)->PostTask(FROM_HERE, task_1.Get());
-  handle_.task_runner(QueueType::kBestEffort)
+  handle_.GetBrowserTaskRunner(QueueType::kDefault)
+      ->PostTask(FROM_HERE, task_1.Get());
+  handle_.GetBrowserTaskRunner(QueueType::kBestEffort)
       ->PostTask(FROM_HERE, task_2.Get());
 
   RunLoop run_loop;
@@ -184,16 +256,16 @@
 }
 
 TEST_F(BrowserTaskQueuesTest, HandleStillWorksWhenQueuesDestroyed) {
-  MockTask task;
+  handle_.EnableAllQueues();
+  StrictMockTask task;
   queues_.reset();
 
   for (size_t i = 0; i < BrowserTaskQueues::kNumQueueTypes; ++i) {
     EXPECT_FALSE(
-        handle_.task_runner(static_cast<QueueType>(i))
+        handle_.GetBrowserTaskRunner(static_cast<QueueType>(i))
             ->PostTask(FROM_HERE, base::BindLambdaForTesting([]() {})));
   }
 
-  handle_.EnableBestEffortQueues();
   RunLoop run_loop;
   handle_.ScheduleRunAllPendingTasksForTesting(run_loop.QuitClosure());
   run_loop.Run();
diff --git a/content/browser/scheduler/browser_ui_thread_scheduler.cc b/content/browser/scheduler/browser_ui_thread_scheduler.cc
index 733528d..09c293d 100644
--- a/content/browser/scheduler/browser_ui_thread_scheduler.cc
+++ b/content/browser/scheduler/browser_ui_thread_scheduler.cc
@@ -45,8 +45,7 @@
                    owned_sequence_manager_->GetRealTimeDomain()),
       handle_(task_queues_.CreateHandle()) {
   CommonSequenceManagerSetup(owned_sequence_manager_.get());
-  owned_sequence_manager_->SetDefaultTaskRunner(
-      handle_.task_runner(QueueType::kDefault));
+  owned_sequence_manager_->SetDefaultTaskRunner(handle_.GetDefaultTaskRunner());
 
   owned_sequence_manager_->BindToMessagePump(
       base::MessageLoop::CreateMessagePumpForType(base::MessageLoop::TYPE_UI));
diff --git a/content/browser/scheduler/browser_ui_thread_scheduler_unittest.cc b/content/browser/scheduler/browser_ui_thread_scheduler_unittest.cc
index 79c4c8a..fb88e16 100644
--- a/content/browser/scheduler/browser_ui_thread_scheduler_unittest.cc
+++ b/content/browser/scheduler/browser_ui_thread_scheduler_unittest.cc
@@ -14,12 +14,16 @@
 #include "base/task/post_task.h"
 #include "base/task/thread_pool/thread_pool.h"
 #include "base/test/mock_callback.h"
+#include "base/threading/thread_task_runner_handle.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace content {
 namespace {
 
+using StrictMockTask =
+    testing::StrictMock<base::MockCallback<base::RepeatingCallback<void()>>>;
+
 base::OnceClosure RunOnDestruction(base::OnceClosure task) {
   return base::BindOnce(
       [](std::unique_ptr<base::ScopedClosureRunner>) {},
@@ -40,8 +44,10 @@
 TEST(BrowserUIThreadSchedulerTest, DestructorPostChainDuringShutdown) {
   auto browser_ui_thread_scheduler_ =
       std::make_unique<BrowserUIThreadScheduler>();
-  auto task_queue = browser_ui_thread_scheduler_->GetHandle().task_runner(
-      BrowserUIThreadScheduler::QueueType::kDefault);
+  browser_ui_thread_scheduler_->GetHandle().EnableAllQueues();
+  auto task_queue =
+      browser_ui_thread_scheduler_->GetHandle().GetBrowserTaskRunner(
+          BrowserUIThreadScheduler::QueueType::kDefault);
 
   bool run = false;
   task_queue->PostTask(
@@ -58,6 +64,18 @@
   EXPECT_TRUE(run);
 }
 
+TEST(BrowserUIThreadSchedulerTest,
+     TaskPostedWithThreadHandleRunBeforeQueuesAreEnabled) {
+  auto browser_ui_thread_scheduler_ =
+      std::make_unique<BrowserUIThreadScheduler>();
+
+  StrictMockTask task;
+  base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE, task.Get());
+
+  EXPECT_CALL(task, Run);
+  base::RunLoop().RunUntilIdle();
+}
+
 }  // namespace
 
 }  // namespace content
diff --git a/content/browser/site_per_process_hit_test_browsertest.cc b/content/browser/site_per_process_hit_test_browsertest.cc
index 84ceaef..8799023 100644
--- a/content/browser/site_per_process_hit_test_browsertest.cc
+++ b/content/browser/site_per_process_hit_test_browsertest.cc
@@ -5943,7 +5943,7 @@
   DISABLED_MouseClickWithNonIntegerScaleFactor
 #else
 #define MAYBE_MouseClickWithNonIntegerScaleFactor \
-  DISABLED_MouseClickWithNonIntegerScaleFactor  // http://crbug.com/961136
+  MouseClickWithNonIntegerScaleFactor
 #endif
 IN_PROC_BROWSER_TEST_P(SitePerProcessNonIntegerScaleFactorHitTestBrowserTest,
                        MAYBE_MouseClickWithNonIntegerScaleFactor) {
diff --git a/content/browser/site_per_process_unload_browsertest.cc b/content/browser/site_per_process_unload_browsertest.cc
index b17d101d..38155e0 100644
--- a/content/browser/site_per_process_unload_browsertest.cc
+++ b/content/browser/site_per_process_unload_browsertest.cc
@@ -1036,4 +1036,58 @@
   delete_B2.WaitUntilDeleted();
 }
 
+// Test that an unloading child can PostMessage its cross-process parent.
+IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
+                       UnloadPostMessageToParentCrossProcess) {
+  GURL main_url(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(b)"));
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
+  RenderFrameHostImpl* A1 = web_contents()->GetMainFrame();
+  RenderFrameHostImpl* B2 = A1->child_at(0)->current_frame_host();
+  RenderFrameDeletedObserver delete_B2(B2);
+  EXPECT_TRUE(ExecJs(B2, R"(
+    window.addEventListener("unload", function() {
+      window.parent.postMessage("B2 message", "*");
+    });
+  )"));
+  EXPECT_TRUE(ExecJs(A1, R"(
+    window.received_message = "nothing received";
+    var received = false;
+    window.addEventListener('message', function(event) {
+      received_message = event.data;
+    });
+    document.querySelector('iframe').remove();
+  )"));
+  delete_B2.WaitUntilDeleted();
+  // TODO(https://crbug.com/964950): PostMessage called from an unloading frame
+  // must work. A1 must received 'B2 message'. This is not the case here.
+  EXPECT_EQ("nothing received", EvalJs(A1, "received_message"));
+}
+
+// Test that an unloading child can PostMessage its same-process parent.
+IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
+                       UnloadPostMessageToParentSameProcess) {
+  GURL main_url(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(a)"));
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
+  RenderFrameHostImpl* A1 = web_contents()->GetMainFrame();
+  RenderFrameHostImpl* A2 = A1->child_at(0)->current_frame_host();
+  RenderFrameDeletedObserver delete_A1(A2);
+  EXPECT_TRUE(ExecJs(A2, R"(
+    window.addEventListener("unload", function() {
+      window.parent.postMessage("A2 message", "*");
+    });
+  )"));
+  EXPECT_TRUE(ExecJs(A1, R"(
+    window.received_message = "nothing received";
+    var received = false;
+    window.addEventListener('message', function(event) {
+      received_message = event.data;
+    });
+    document.querySelector('iframe').remove();
+  )"));
+  delete_A1.WaitUntilDeleted();
+  EXPECT_EQ("A2 message", EvalJs(A1, "received_message"));
+}
+
 }  // namespace content
diff --git a/content/browser/web_package/signed_exchange_subresource_prefetch_browsertest.cc b/content/browser/web_package/signed_exchange_subresource_prefetch_browsertest.cc
index 579c44d..0f11ca1 100644
--- a/content/browser/web_package/signed_exchange_subresource_prefetch_browsertest.cc
+++ b/content/browser/web_package/signed_exchange_subresource_prefetch_browsertest.cc
@@ -22,6 +22,7 @@
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "net/base/features.h"
+#include "net/dns/mock_host_resolver.h"
 #include "services/network/public/cpp/features.h"
 #include "storage/browser/blob/blob_storage_context.h"
 
@@ -67,6 +68,11 @@
     PrefetchBrowserTestBase::SetUp();
   }
 
+  void SetUpOnMainThread() override {
+    host_resolver()->AddRule("*", "127.0.0.1");
+    PrefetchBrowserTestBase::SetUpOnMainThread();
+  }
+
  protected:
   static constexpr size_t kTestBlobStorageIPCThresholdBytes = 20;
   static constexpr size_t kTestBlobStorageMaxSharedMemoryBytes = 50;
@@ -389,6 +395,112 @@
 }
 
 IN_PROC_BROWSER_TEST_P(SignedExchangeSubresourcePrefetchBrowserTest,
+                       PrefetchAlternativeSubresourceSXG_DifferentOrigin) {
+  int script_sxg_fetch_count = 0;
+  int script_fetch_count = 0;
+  const char* prefetch_path = "/prefetch.html";
+  const char* target_sxg_path = "/target.sxg";
+  const char* target_path = "/target.html";
+  const char* script_sxg_path = "/script_js.sxg";
+  const char* script_path = "/script.js";
+
+  base::RunLoop script_sxg_prefetch_waiter;
+  RegisterRequestMonitor(embedded_test_server(), script_sxg_path,
+                         &script_sxg_fetch_count, &script_sxg_prefetch_waiter);
+  base::RunLoop script_prefetch_waiter;
+  RegisterRequestMonitor(embedded_test_server(), script_path,
+                         &script_fetch_count, &script_prefetch_waiter);
+  RegisterRequestHandler(embedded_test_server());
+  ASSERT_TRUE(embedded_test_server()->Start());
+  EXPECT_EQ(0, prefetch_url_loader_called_);
+
+  const GURL target_sxg_url = embedded_test_server()->GetURL(target_sxg_path);
+  const GURL target_url = embedded_test_server()->GetURL(target_path);
+  // script_js.sxg is served from different origin.
+  const GURL script_sxg_url =
+      embedded_test_server()->GetURL("example.com", script_sxg_path);
+  const GURL script_url = embedded_test_server()->GetURL(script_path);
+
+  const net::SHA256HashValue target_header_integrity = {{0x01}};
+  const net::SHA256HashValue script_header_integrity = {{0x02}};
+  const std::string script_header_integrity_string =
+      GetHeaderIntegrityString(script_header_integrity);
+
+  const std::string outer_link_header = base::StringPrintf(
+      "<%s>;"
+      "rel=\"alternate\";"
+      "type=\"application/signed-exchange;v=b3\";"
+      "anchor=\"%s\"",
+      script_sxg_url.spec().c_str(), script_url.spec().c_str());
+  const std::string inner_link_headers = base::StringPrintf(
+      "Link: "
+      "<%s>;rel=\"allowed-alt-sxg\";header-integrity=\"%s\","
+      "<%s>;rel=\"preload\";as=\"script\"",
+      script_url.spec().c_str(), script_header_integrity_string.c_str(),
+      script_url.spec().c_str());
+
+  RegisterResponse(
+      prefetch_path,
+      ResponseEntry(base::StringPrintf(
+          "<body><link rel='prefetch' href='%s'></body>", target_sxg_path)));
+  RegisterResponse(script_path, ResponseEntry("document.title=\"from server\";",
+                                              "text/javascript"));
+  RegisterResponse(target_sxg_path,
+                   // We mock the SignedExchangeHandler, so just return a HTML
+                   // content as "application/signed-exchange;v=b3".
+                   ResponseEntry("<head><title>Prefetch Target (SXG)</title>"
+                                 "<script src=\"./script.js\"></script></head>",
+                                 "application/signed-exchange;v=b3",
+                                 {{"x-content-type-options", "nosniff"},
+                                  {"link", outer_link_header}}));
+  RegisterResponse(script_sxg_path,
+                   // We mock the SignedExchangeHandler, so just return a JS
+                   // content as "application/signed-exchange;v=b3".
+                   ResponseEntry("document.title=\"done\";",
+                                 "application/signed-exchange;v=b3",
+                                 {{"x-content-type-options", "nosniff"}}));
+  MockSignedExchangeHandlerFactory factory(
+      {MockSignedExchangeHandlerParams(
+           target_sxg_url, SignedExchangeLoadResult::kSuccess, net::OK,
+           target_url, "text/html", {inner_link_headers},
+           target_header_integrity),
+       MockSignedExchangeHandlerParams(
+           script_sxg_url, SignedExchangeLoadResult::kSuccess, net::OK,
+           script_url, "text/javascript", {}, script_header_integrity)});
+  ScopedSignedExchangeHandlerFactory scoped_factory(&factory);
+
+  NavigateToURL(shell(), embedded_test_server()->GetURL(prefetch_path));
+  script_sxg_prefetch_waiter.Run();
+  EXPECT_EQ(1, script_sxg_fetch_count);
+  EXPECT_EQ(0, script_fetch_count);
+
+  WaitUntilLoaded(target_sxg_url);
+  WaitUntilLoaded(script_sxg_url);
+
+  const auto& cached_exchanges = GetCachedExchanges();
+  EXPECT_EQ(2u, cached_exchanges.size());
+
+  const auto target_it = cached_exchanges.find(target_sxg_url);
+  ASSERT_TRUE(target_it != cached_exchanges.end());
+  EXPECT_EQ(target_sxg_url, target_it->second->outer_url());
+  EXPECT_EQ(target_url, target_it->second->inner_url());
+  EXPECT_EQ(target_header_integrity, *target_it->second->header_integrity());
+
+  const auto script_it = cached_exchanges.find(script_sxg_url);
+  ASSERT_TRUE(script_it != cached_exchanges.end());
+  EXPECT_EQ(script_sxg_url, script_it->second->outer_url());
+  EXPECT_EQ(script_url, script_it->second->inner_url());
+  EXPECT_EQ(script_header_integrity, *script_it->second->header_integrity());
+
+  // script_js.sxg was served from different origin from target.sxg. So
+  // script.js is loaded from the server.
+  NavigateToURLAndWaitTitle(target_sxg_url, "from server");
+
+  EXPECT_EQ(1, script_sxg_fetch_count);
+  EXPECT_EQ(1, script_fetch_count);
+}
+
+IN_PROC_BROWSER_TEST_P(SignedExchangeSubresourcePrefetchBrowserTest,
                        PrefetchAlternativeSubresourceSXG_MultipleResources) {
   int script1_sxg_fetch_count = 0;
   int script1_fetch_count = 0;
diff --git a/content/browser/webauth/authenticator_common.cc b/content/browser/webauth/authenticator_common.cc
index 21eca3df..60a0dec 100644
--- a/content/browser/webauth/authenticator_common.cc
+++ b/content/browser/webauth/authenticator_common.cc
@@ -1304,7 +1304,7 @@
       break;
     case AuthenticatorRequestClientDelegate::InterestingFailureReason::
         kKeyNotRegistered:
-      status = blink::mojom::AuthenticatorStatus::CREDENTIAL_NOT_RECOGNIZED;
+      status = blink::mojom::AuthenticatorStatus::NOT_ALLOWED_ERROR;
       break;
     case AuthenticatorRequestClientDelegate::InterestingFailureReason::kTimeout:
       status = blink::mojom::AuthenticatorStatus::NOT_ALLOWED_ERROR;
diff --git a/content/browser/webauth/authenticator_impl_unittest.cc b/content/browser/webauth/authenticator_impl_unittest.cc
index ce7224a..dcdeb5ac 100644
--- a/content/browser/webauth/authenticator_impl_unittest.cc
+++ b/content/browser/webauth/authenticator_impl_unittest.cc
@@ -728,7 +728,7 @@
     SCOPED_TRACE(std::string(test_case.origin) + " " +
                  std::string(test_case.claimed_authority));
 
-    EXPECT_EQ(AuthenticatorStatus::CREDENTIAL_NOT_RECOGNIZED,
+    EXPECT_EQ(AuthenticatorStatus::NOT_ALLOWED_ERROR,
               TryAuthenticationWithAppId(test_case.origin,
                                          test_case.claimed_authority));
   }
@@ -1084,7 +1084,7 @@
     if (should_be_valid) {
       EXPECT_EQ(AuthenticatorStatus::SUCCESS, callback_receiver.status());
     } else {
-      EXPECT_EQ(AuthenticatorStatus::CREDENTIAL_NOT_RECOGNIZED,
+      EXPECT_EQ(AuthenticatorStatus::NOT_ALLOWED_ERROR,
                 callback_receiver.status());
     }
   }
@@ -1169,7 +1169,7 @@
       // The virtual device will return an error because
       // |reject_silent_authentication_requests| is true and then it'll
       // immediately resolve the touch request.
-      EXPECT_EQ(AuthenticatorStatus::CREDENTIAL_NOT_RECOGNIZED,
+      EXPECT_EQ(AuthenticatorStatus::NOT_ALLOWED_ERROR,
                 callback_receiver.status());
     }
   }
@@ -1394,7 +1394,7 @@
     authenticator->GetAssertion(GetTestPublicKeyCredentialRequestOptions(),
                                 callback_receiver.callback());
     callback_receiver.WaitForCallback();
-    EXPECT_EQ(AuthenticatorStatus::CREDENTIAL_NOT_RECOGNIZED,
+    EXPECT_EQ(AuthenticatorStatus::NOT_ALLOWED_ERROR,
               callback_receiver.status());
     // The user must have pressed the authenticator for the operation to
     // resolve.
@@ -2505,8 +2505,7 @@
                               callback_receiver.callback());
 
   callback_receiver.WaitForCallback();
-  EXPECT_EQ(AuthenticatorStatus::CREDENTIAL_NOT_RECOGNIZED,
-            callback_receiver.status());
+  EXPECT_EQ(AuthenticatorStatus::NOT_ALLOWED_ERROR, callback_receiver.status());
 
   ASSERT_TRUE(failure_reason_receiver.was_called());
   EXPECT_EQ(content::AuthenticatorRequestClientDelegate::
@@ -2662,9 +2661,8 @@
     base::RunLoop().RunUntilIdle();
     callback_receiver.WaitForCallback();
     EXPECT_EQ(callback_receiver.status(),
-              has_allowed_credential
-                  ? AuthenticatorStatus::SUCCESS
-                  : AuthenticatorStatus::CREDENTIAL_NOT_RECOGNIZED);
+              has_allowed_credential ? AuthenticatorStatus::SUCCESS
+                                     : AuthenticatorStatus::NOT_ALLOWED_ERROR);
   }
 }
 
@@ -3083,7 +3081,7 @@
 
         switch (expected[support_level][uv_level]) {
           case kFailure:
-            EXPECT_EQ(AuthenticatorStatus::CREDENTIAL_NOT_RECOGNIZED,
+            EXPECT_EQ(AuthenticatorStatus::NOT_ALLOWED_ERROR,
                       callback_receiver.status());
             break;
 
@@ -3270,7 +3268,7 @@
       callback_receiver.WaitForCallback();
 
       if (should_be_unrecognized) {
-        EXPECT_EQ(AuthenticatorStatus::CREDENTIAL_NOT_RECOGNIZED,
+        EXPECT_EQ(AuthenticatorStatus::NOT_ALLOWED_ERROR,
                   callback_receiver.status());
       } else {
         EXPECT_EQ(AuthenticatorStatus::SUCCESS, callback_receiver.status());
diff --git a/content/browser/webauth/webauth_browsertest.cc b/content/browser/webauth/webauth_browsertest.cc
index 138f417d..3e147cfc 100644
--- a/content/browser/webauth/webauth_browsertest.cc
+++ b/content/browser/webauth/webauth_browsertest.cc
@@ -75,7 +75,7 @@
     "webauth: NotSupportedError: Required parameters missing in "
     "`options.publicKey`.";
 
-constexpr char kTimeoutErrorMessage[] =
+constexpr char kNotAllowedErrorMessage[] =
     "webauth: NotAllowedError: The operation either timed out or was not "
     "allowed. See: https://w3c.github.io/webauthn/#sec-assertion-privacy.";
 
@@ -93,10 +93,6 @@
 constexpr char kRelyingPartyRpIconUrlSecurityErrorMessage[] =
     "webauth: SecurityError: 'rp.icon' should be a secure URL";
 
-constexpr char kInvalidStateError[] =
-    "webauth: InvalidStateError: The user attempted to use an authenticator "
-    "that recognized none of the provided credentials.";
-
 constexpr char kAbortErrorMessage[] =
     "webauth: AbortError: The user aborted a request.";
 
@@ -814,7 +810,7 @@
     ASSERT_TRUE(content::ExecuteScriptAndExtractString(
         shell()->web_contents()->GetMainFrame(),
         BuildCreateCallWithParameters(parameters), &result));
-    ASSERT_EQ(kTimeoutErrorMessage, result);
+    ASSERT_EQ(kNotAllowedErrorMessage, result);
   }
 }
 
@@ -852,7 +848,7 @@
         shell()->web_contents()->GetMainFrame(),
         BuildCreateCallWithParameters(parameters), &result));
 
-    ASSERT_EQ(kTimeoutErrorMessage, result);
+    ASSERT_EQ(kNotAllowedErrorMessage, result);
   }
 }
 
@@ -871,7 +867,7 @@
         shell()->web_contents()->GetMainFrame(),
         BuildCreateCallWithParameters(parameters), &result));
 
-    ASSERT_EQ(kTimeoutErrorMessage, result);
+    ASSERT_EQ(kNotAllowedErrorMessage, result);
   }
 }
 // Tests that when navigator.credentials.create() is called with abort
@@ -949,7 +945,7 @@
     ASSERT_TRUE(content::ExecuteScriptAndExtractString(
         shell()->web_contents()->GetMainFrame(),
         BuildGetCallWithParameters(parameters), &result));
-    ASSERT_EQ(kInvalidStateError, result);
+    ASSERT_EQ(kNotAllowedErrorMessage, result);
   }
 }
 
@@ -968,7 +964,7 @@
 }
 
 // Tests that when navigator.credentials.get() is called with abort
-// signal's aborted flag not set, we get a kInvalidStateError, because the
+// signal's aborted flag not set, we get a NOT_ALLOWED_ERROR, because the
 // virtual device does not have any registered credentials.
 IN_PROC_BROWSER_TEST_F(WebAuthJavascriptClientBrowserTest,
                        GetPublicKeyCredentialWithAbortNotSet) {
@@ -986,7 +982,7 @@
 
     ASSERT_TRUE(content::ExecuteScriptAndExtractString(
         shell()->web_contents()->GetMainFrame(), script, &result));
-    ASSERT_EQ(kInvalidStateError, result);
+    ASSERT_EQ(kNotAllowedErrorMessage, result);
   }
 }
 
@@ -1206,7 +1202,7 @@
       shell()->web_contents(),
       BuildCreateCallWithParameters(CreateParameters()), "webauth: ");
   ASSERT_TRUE(result);
-  ASSERT_EQ(kTimeoutErrorMessage, *result);
+  ASSERT_EQ(kNotAllowedErrorMessage, *result);
 }
 
 IN_PROC_BROWSER_TEST_F(WebAuthJavascriptClientBrowserTest, WinGetAssertion) {
@@ -1228,7 +1224,7 @@
       shell()->web_contents(), BuildGetCallWithParameters(GetParameters()),
       "webauth: ");
   ASSERT_TRUE(result);
-  ASSERT_EQ(kTimeoutErrorMessage, *result);
+  ASSERT_EQ(kNotAllowedErrorMessage, *result);
 }
 
 IN_PROC_BROWSER_TEST_F(WebAuthJavascriptClientBrowserTest,
@@ -1244,7 +1240,7 @@
       shell()->web_contents(), BuildGetCallWithParameters(GetParameters()),
       "webauth: ");
   ASSERT_TRUE(result);
-  ASSERT_EQ(kTimeoutErrorMessage, *result);
+  ASSERT_EQ(kNotAllowedErrorMessage, *result);
 }
 #endif
 
@@ -1331,7 +1327,7 @@
     authenticator()->GetAssertion(std::move(get_assertion_request_params),
                                   get_callback_receiver.callback());
     get_callback_receiver.WaitForCallback();
-    EXPECT_EQ(AuthenticatorStatus::CREDENTIAL_NOT_RECOGNIZED,
+    EXPECT_EQ(AuthenticatorStatus::NOT_ALLOWED_ERROR,
               get_callback_receiver.status());
   }
 }
diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.cc
index 32584efb..de0f502 100644
--- a/content/child/runtime_features.cc
+++ b/content/child/runtime_features.cc
@@ -67,6 +67,9 @@
   WebRuntimeFeatures::EnableBlinkHeapIncrementalMarking(
       base::FeatureList::IsEnabled(features::kBlinkHeapIncrementalMarking));
 
+  WebRuntimeFeatures::EnableBlinkHeapUnifiedGCScheduling(
+      base::FeatureList::IsEnabled(features::kBlinkHeapUnifiedGCScheduling));
+
   if (base::FeatureList::IsEnabled(features::kBloatedRendererDetection))
     WebRuntimeFeatures::EnableBloatedRendererDetection(true);
 
diff --git a/content/public/common/content_features.cc b/content/public/common/content_features.cc
index 40b99e7..2111f8c 100644
--- a/content/public/common/content_features.cc
+++ b/content/public/common/content_features.cc
@@ -68,6 +68,9 @@
 const base::Feature kBlinkHeapIncrementalMarking{
     "BlinkHeapIncrementalMarking", base::FEATURE_ENABLED_BY_DEFAULT};
 
+const base::Feature kBlinkHeapUnifiedGCScheduling{
+    "BlinkHeapUnifiedGCScheduling", base::FEATURE_DISABLED_BY_DEFAULT};
+
 // Enable bloated renderer detection.
 const base::Feature kBloatedRendererDetection{
     "BloatedRendererDetection", base::FEATURE_DISABLED_BY_DEFAULT};
diff --git a/content/public/common/content_features.h b/content/public/common/content_features.h
index dff5ecccf..df61a2d 100644
--- a/content/public/common/content_features.h
+++ b/content/public/common/content_features.h
@@ -30,6 +30,7 @@
 CONTENT_EXPORT extern const base::Feature kBackgroundFetch;
 CONTENT_EXPORT extern const base::Feature kBackForwardCache;
 CONTENT_EXPORT extern const base::Feature kBlinkHeapIncrementalMarking;
+CONTENT_EXPORT extern const base::Feature kBlinkHeapUnifiedGCScheduling;
 CONTENT_EXPORT extern const base::Feature kBloatedRendererDetection;
 CONTENT_EXPORT extern const base::Feature kBlockCredentialedSubresources;
 CONTENT_EXPORT extern const base::Feature kCacheInlineScriptCode;
diff --git a/content/public/renderer/render_frame.h b/content/public/renderer/render_frame.h
index 3e23941..36b2f87 100644
--- a/content/public/renderer/render_frame.h
+++ b/content/public/renderer/render_frame.h
@@ -189,7 +189,7 @@
   // |unthrottle_callback| will be called.
   virtual void RegisterPeripheralPlugin(
       const url::Origin& content_origin,
-      const base::Closure& unthrottle_callback) = 0;
+      base::OnceClosure unthrottle_callback) = 0;
 
   // Returns the peripheral content heuristic decision.
   //
diff --git a/content/public/test/test_browser_thread_bundle.cc b/content/public/test/test_browser_thread_bundle.cc
index c645142d..ba6ca64a 100644
--- a/content/public/test/test_browser_thread_bundle.cc
+++ b/content/public/test/test_browser_thread_bundle.cc
@@ -89,9 +89,8 @@
   std::unique_ptr<BrowserUIThreadScheduler> browser_ui_thread_scheduler =
       BrowserUIThreadScheduler::CreateForTesting(sequence_manager(),
                                                  GetTimeDomain());
-  scoped_refptr<base::SingleThreadTaskRunner> default_task_runner =
-      browser_ui_thread_scheduler->GetHandle().task_runner(
-          BrowserUIThreadScheduler::QueueType::kDefault);
+  auto default_task_runner =
+      browser_ui_thread_scheduler->GetHandle().GetDefaultTaskRunner();
   BrowserTaskExecutor::CreateWithBrowserUIThreadSchedulerForTesting(
       std::move(browser_ui_thread_scheduler));
   DeferredInitFromSubclass(std::move(default_task_runner));
diff --git a/content/renderer/media/video_capture/local_video_capturer_source.cc b/content/renderer/media/video_capture/local_video_capturer_source.cc
index 3c8d30f3..103a4202 100644
--- a/content/renderer/media/video_capture/local_video_capturer_source.cc
+++ b/content/renderer/media/video_capture/local_video_capturer_source.cc
@@ -26,7 +26,7 @@
 
 LocalVideoCapturerSource::~LocalVideoCapturerSource() {
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
-  release_device_cb_.Run();
+  std::move(release_device_cb_).Run();
 }
 
 media::VideoCaptureFormats LocalVideoCapturerSource::GetPreferredFormats() {
@@ -53,7 +53,7 @@
 
 void LocalVideoCapturerSource::RequestRefreshFrame() {
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
-  if (stop_capture_cb_.is_null())
+  if (!stop_capture_cb_)
     return;  // Do not request frames if the source is stopped.
   manager_->RequestRefreshFrame(session_id_);
 }
@@ -71,7 +71,7 @@
 void LocalVideoCapturerSource::StopCapture() {
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
   // Immediately make sure we don't provide more frames.
-  if (!stop_capture_cb_.is_null())
+  if (stop_capture_cb_)
     std::move(stop_capture_cb_).Run();
 }
 
@@ -104,7 +104,7 @@
     case blink::VIDEO_CAPTURE_STATE_STOPPED:
     case blink::VIDEO_CAPTURE_STATE_ERROR:
     case blink::VIDEO_CAPTURE_STATE_ENDED:
-      release_device_cb_.Run();
+      std::move(release_device_cb_).Run();
       release_device_cb_ = manager_->UseDevice(session_id_);
       OnLog(
           "LocalVideoCapturerSource::OnStateUpdate signaling to "
diff --git a/content/renderer/media/video_capture/local_video_capturer_source.h b/content/renderer/media/video_capture/local_video_capturer_source.h
index 8579fc0..9076ce3 100644
--- a/content/renderer/media/video_capture/local_video_capturer_source.h
+++ b/content/renderer/media/video_capture/local_video_capturer_source.h
@@ -58,13 +58,13 @@
 
   VideoCaptureImplManager* const manager_;
 
-  base::Closure release_device_cb_;
+  base::OnceClosure release_device_cb_;
 
   // These two are valid between StartCapture() and StopCapture().
   // |running_call_back_| is run when capture is successfully started, and when
   // it is stopped or error happens.
   RunningCallback running_callback_;
-  base::Closure stop_capture_cb_;
+  base::OnceClosure stop_capture_cb_;
 
   scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
 
diff --git a/content/renderer/media/video_capture/video_capture_impl.cc b/content/renderer/media/video_capture/video_capture_impl.cc
index e162e31..24cb7b2 100644
--- a/content/renderer/media/video_capture/video_capture_impl.cc
+++ b/content/renderer/media/video_capture/video_capture_impl.cc
@@ -248,21 +248,21 @@
 }
 
 void VideoCaptureImpl::GetDeviceSupportedFormats(
-    const blink::VideoCaptureDeviceFormatsCB& callback) {
+    blink::VideoCaptureDeviceFormatsCB callback) {
   DCHECK(io_thread_checker_.CalledOnValidThread());
   GetVideoCaptureHost()->GetDeviceSupportedFormats(
       device_id_, session_id_,
       base::BindOnce(&VideoCaptureImpl::OnDeviceSupportedFormats,
-                     weak_factory_.GetWeakPtr(), callback));
+                     weak_factory_.GetWeakPtr(), std::move(callback)));
 }
 
 void VideoCaptureImpl::GetDeviceFormatsInUse(
-    const blink::VideoCaptureDeviceFormatsCB& callback) {
+    blink::VideoCaptureDeviceFormatsCB callback) {
   DCHECK(io_thread_checker_.CalledOnValidThread());
   GetVideoCaptureHost()->GetDeviceFormatsInUse(
       device_id_, session_id_,
       base::BindOnce(&VideoCaptureImpl::OnDeviceFormatsInUse,
-                     weak_factory_.GetWeakPtr(), callback));
+                     weak_factory_.GetWeakPtr(), std::move(callback)));
 }
 
 void VideoCaptureImpl::OnFrameDropped(
@@ -549,17 +549,17 @@
 }
 
 void VideoCaptureImpl::OnDeviceSupportedFormats(
-    const blink::VideoCaptureDeviceFormatsCB& callback,
+    blink::VideoCaptureDeviceFormatsCB callback,
     const media::VideoCaptureFormats& supported_formats) {
   DCHECK(io_thread_checker_.CalledOnValidThread());
-  callback.Run(supported_formats);
+  std::move(callback).Run(supported_formats);
 }
 
 void VideoCaptureImpl::OnDeviceFormatsInUse(
-    const blink::VideoCaptureDeviceFormatsCB& callback,
+    blink::VideoCaptureDeviceFormatsCB callback,
     const media::VideoCaptureFormats& formats_in_use) {
   DCHECK(io_thread_checker_.CalledOnValidThread());
-  callback.Run(formats_in_use);
+  std::move(callback).Run(formats_in_use);
 }
 
 bool VideoCaptureImpl::RemoveClient(int client_id, ClientInfoMap* clients) {
diff --git a/content/renderer/media/video_capture/video_capture_impl.h b/content/renderer/media/video_capture/video_capture_impl.h
index 8ab48fb6..63afdcea 100644
--- a/content/renderer/media/video_capture/video_capture_impl.h
+++ b/content/renderer/media/video_capture/video_capture_impl.h
@@ -56,13 +56,11 @@
 
   // Get capturing formats supported by this device.
   // |callback| will be invoked with the results.
-  void GetDeviceSupportedFormats(
-      const blink::VideoCaptureDeviceFormatsCB& callback);
+  void GetDeviceSupportedFormats(blink::VideoCaptureDeviceFormatsCB callback);
 
   // Get capturing formats currently in use by this device.
   // |callback| will be invoked with the results.
-  void GetDeviceFormatsInUse(
-      const blink::VideoCaptureDeviceFormatsCB& callback);
+  void GetDeviceFormatsInUse(blink::VideoCaptureDeviceFormatsCB callback);
 
   void OnFrameDropped(media::VideoCaptureFrameDropReason reason);
   void OnLog(const std::string& message);
@@ -105,9 +103,9 @@
   void StartCaptureInternal();
 
   void OnDeviceSupportedFormats(
-      const blink::VideoCaptureDeviceFormatsCB& callback,
+      blink::VideoCaptureDeviceFormatsCB callback,
       const media::VideoCaptureFormats& supported_formats);
-  void OnDeviceFormatsInUse(const blink::VideoCaptureDeviceFormatsCB& callback,
+  void OnDeviceFormatsInUse(blink::VideoCaptureDeviceFormatsCB callback,
                             const media::VideoCaptureFormats& formats_in_use);
 
   // Tries to remove |client_id| from |clients|, returning false if not found.
diff --git a/content/renderer/media/video_capture/video_capture_impl_manager.cc b/content/renderer/media/video_capture/video_capture_impl_manager.cc
index 1b5e783..bc42c23 100644
--- a/content/renderer/media/video_capture/video_capture_impl_manager.cc
+++ b/content/renderer/media/video_capture/video_capture_impl_manager.cc
@@ -75,7 +75,7 @@
   devices_.clear();
 }
 
-base::Closure VideoCaptureImplManager::UseDevice(
+base::OnceClosure VideoCaptureImplManager::UseDevice(
     media::VideoCaptureSessionId id) {
   DVLOG(1) << __func__ << " session id: " << id;
   DCHECK(render_main_task_runner_->BelongsToCurrentThread());
@@ -101,11 +101,11 @@
   if (it->is_individually_suspended)
     Resume(id);
 
-  return base::Bind(&VideoCaptureImplManager::UnrefDevice,
-                    weak_factory_.GetWeakPtr(), id);
+  return base::BindOnce(&VideoCaptureImplManager::UnrefDevice,
+                        weak_factory_.GetWeakPtr(), id);
 }
 
-base::Closure VideoCaptureImplManager::StartCapture(
+base::OnceClosure VideoCaptureImplManager::StartCapture(
     media::VideoCaptureSessionId id,
     const media::VideoCaptureParams& params,
     const blink::VideoCaptureStateUpdateCB& state_update_cb,
@@ -125,8 +125,8 @@
       FROM_HERE, base::BindOnce(&VideoCaptureImpl::StartCapture,
                                 base::Unretained(it->impl.get()), client_id,
                                 params, state_update_cb, deliver_frame_cb));
-  return base::Bind(&VideoCaptureImplManager::StopCapture,
-                    weak_factory_.GetWeakPtr(), client_id, id);
+  return base::BindOnce(&VideoCaptureImplManager::StopCapture,
+                        weak_factory_.GetWeakPtr(), client_id, id);
 }
 
 void VideoCaptureImplManager::RequestRefreshFrame(
@@ -183,7 +183,7 @@
 
 void VideoCaptureImplManager::GetDeviceSupportedFormats(
     media::VideoCaptureSessionId id,
-    const blink::VideoCaptureDeviceFormatsCB& callback) {
+    blink::VideoCaptureDeviceFormatsCB callback) {
   DCHECK(render_main_task_runner_->BelongsToCurrentThread());
   const auto it = std::find_if(
       devices_.begin(), devices_.end(),
@@ -192,13 +192,14 @@
   // Use of base::Unretained() is safe because |devices_| is released on the
   // |io_task_runner()| as well.
   ChildProcess::current()->io_task_runner()->PostTask(
-      FROM_HERE, base::BindOnce(&VideoCaptureImpl::GetDeviceSupportedFormats,
-                                base::Unretained(it->impl.get()), callback));
+      FROM_HERE,
+      base::BindOnce(&VideoCaptureImpl::GetDeviceSupportedFormats,
+                     base::Unretained(it->impl.get()), std::move(callback)));
 }
 
 void VideoCaptureImplManager::GetDeviceFormatsInUse(
     media::VideoCaptureSessionId id,
-    const blink::VideoCaptureDeviceFormatsCB& callback) {
+    blink::VideoCaptureDeviceFormatsCB callback) {
   DCHECK(render_main_task_runner_->BelongsToCurrentThread());
   const auto it = std::find_if(
       devices_.begin(), devices_.end(),
@@ -207,8 +208,9 @@
   // Use of base::Unretained() is safe because |devices_| is released on the
   // |io_task_runner()| as well.
   ChildProcess::current()->io_task_runner()->PostTask(
-      FROM_HERE, base::BindOnce(&VideoCaptureImpl::GetDeviceFormatsInUse,
-                                base::Unretained(it->impl.get()), callback));
+      FROM_HERE,
+      base::BindOnce(&VideoCaptureImpl::GetDeviceFormatsInUse,
+                     base::Unretained(it->impl.get()), std::move(callback)));
 }
 
 std::unique_ptr<VideoCaptureImpl>
diff --git a/content/renderer/media/video_capture/video_capture_impl_manager.h b/content/renderer/media/video_capture/video_capture_impl_manager.h
index 2db45a8..76be1e4 100644
--- a/content/renderer/media/video_capture/video_capture_impl_manager.h
+++ b/content/renderer/media/video_capture/video_capture_impl_manager.h
@@ -48,7 +48,7 @@
   // is used.
   // Returns a callback that should be used to release the acquired
   // resources.
-  base::Closure UseDevice(media::VideoCaptureSessionId id);
+  base::OnceClosure UseDevice(media::VideoCaptureSessionId id);
 
   // Start receiving video frames for the given session ID.
   //
@@ -67,7 +67,7 @@
   // video capture is not synchronous. Client should handle the case where
   // callbacks are called after capturing is instructed to stop, typically
   // by binding the passed callbacks on a WeakPtr.
-  base::Closure StartCapture(
+  base::OnceClosure StartCapture(
       media::VideoCaptureSessionId id,
       const media::VideoCaptureParams& params,
       const blink::VideoCaptureStateUpdateCB& state_update_cb,
@@ -83,15 +83,13 @@
 
   // Get supported formats supported by the device for the given session
   // ID. |callback| will be called on the IO thread.
-  void GetDeviceSupportedFormats(
-      media::VideoCaptureSessionId id,
-      const blink::VideoCaptureDeviceFormatsCB& callback);
+  void GetDeviceSupportedFormats(media::VideoCaptureSessionId id,
+                                 blink::VideoCaptureDeviceFormatsCB callback);
 
   // Get supported formats currently in use for the given session ID.
   // |callback| will be called on the IO thread.
-  void GetDeviceFormatsInUse(
-      media::VideoCaptureSessionId id,
-      const blink::VideoCaptureDeviceFormatsCB& callback);
+  void GetDeviceFormatsInUse(media::VideoCaptureSessionId id,
+                             blink::VideoCaptureDeviceFormatsCB callback);
 
   // Make all VideoCaptureImpl instances in the input |video_devices|
   // stop/resume delivering video frames to their clients, depends on flag
diff --git a/content/renderer/media/video_capture/video_capture_impl_manager_unittest.cc b/content/renderer/media/video_capture/video_capture_impl_manager_unittest.cc
index 39b48bc3..be0be6fa 100644
--- a/content/renderer/media/video_capture/video_capture_impl_manager_unittest.cc
+++ b/content/renderer/media/video_capture/video_capture_impl_manager_unittest.cc
@@ -142,10 +142,11 @@
  protected:
   static constexpr size_t kNumClients = 3;
 
-  std::array<base::Closure, kNumClients> StartCaptureForAllClients(
+  std::array<base::OnceClosure, kNumClients> StartCaptureForAllClients(
       bool same_session_id) {
     base::RunLoop run_loop;
-    base::Closure quit_closure = BindToCurrentLoop(run_loop.QuitClosure());
+    base::RepeatingClosure quit_closure =
+        BindToCurrentLoop(run_loop.QuitClosure());
 
     InSequence s;
     if (!same_session_id) {
@@ -158,7 +159,7 @@
     EXPECT_CALL(*this, OnStarted(_))
         .WillOnce(RunClosure(std::move(quit_closure)))
         .RetiresOnSaturation();
-    std::array<base::Closure, kNumClients> stop_callbacks;
+    std::array<base::OnceClosure, kNumClients> stop_callbacks;
     media::VideoCaptureParams params;
     params.requested_format = media::VideoCaptureFormat(
         gfx::Size(176, 144), 30, media::PIXEL_FORMAT_I420);
@@ -172,17 +173,18 @@
   }
 
   void StopCaptureForAllClients(
-      std::array<base::Closure, kNumClients>* stop_callbacks) {
+      std::array<base::OnceClosure, kNumClients>* stop_callbacks) {
     base::RunLoop run_loop;
-    base::Closure quit_closure = BindToCurrentLoop(run_loop.QuitClosure());
+    base::RepeatingClosure quit_closure =
+        BindToCurrentLoop(run_loop.QuitClosure());
     EXPECT_CALL(*this, OnStopped(_))
         .Times(kNumClients - 1)
         .RetiresOnSaturation();
     EXPECT_CALL(*this, OnStopped(_))
         .WillOnce(RunClosure(std::move(quit_closure)))
         .RetiresOnSaturation();
-    for (const auto& stop_callback : *stop_callbacks)
-      stop_callback.Run();
+    for (auto& stop_callback : *stop_callbacks)
+      std::move(stop_callback).Run();
     run_loop.Run();
   }
 
@@ -204,8 +206,8 @@
       NOTREACHED();
   }
 
-  base::Closure StartCapture(media::VideoCaptureSessionId id,
-                             const media::VideoCaptureParams& params) {
+  base::OnceClosure StartCapture(media::VideoCaptureSessionId id,
+                                 const media::VideoCaptureParams& params) {
     return manager_->StartCapture(
         id, params,
         base::Bind(&VideoCaptureImplManagerTest::OnStateUpdate,
@@ -226,14 +228,14 @@
 // Multiple clients with the same session id. There is only one
 // media::VideoCapture object.
 TEST_F(VideoCaptureImplManagerTest, MultipleClients) {
-  std::array<base::Closure, kNumClients> release_callbacks;
+  std::array<base::OnceClosure, kNumClients> release_callbacks;
   for (size_t i = 0; i < kNumClients; ++i)
     release_callbacks[i] = manager_->UseDevice(0);
-  std::array<base::Closure, kNumClients> stop_callbacks =
+  std::array<base::OnceClosure, kNumClients> stop_callbacks =
       StartCaptureForAllClients(true);
   StopCaptureForAllClients(&stop_callbacks);
-  for (const auto& release_callback : release_callbacks)
-    release_callback.Run();
+  for (auto& release_callback : release_callbacks)
+    std::move(release_callback).Run();
   cleanup_run_loop_.Run();
 }
 
@@ -244,7 +246,7 @@
 }
 
 TEST_F(VideoCaptureImplManagerTest, SuspendAndResumeSessions) {
-  std::array<base::Closure, kNumClients> release_callbacks;
+  std::array<base::OnceClosure, kNumClients> release_callbacks;
   blink::MediaStreamDevices video_devices;
   for (size_t i = 0; i < kNumClients; ++i) {
     release_callbacks[i] =
@@ -253,14 +255,15 @@
     video_device.session_id = static_cast<media::VideoCaptureSessionId>(i);
     video_devices.push_back(video_device);
   }
-  std::array<base::Closure, kNumClients> stop_callbacks =
+  std::array<base::OnceClosure, kNumClients> stop_callbacks =
       StartCaptureForAllClients(false);
 
   // Call SuspendDevices(true) to suspend all clients, and expect all to be
   // paused.
   {
     base::RunLoop run_loop;
-    base::Closure quit_closure = BindToCurrentLoop(run_loop.QuitClosure());
+    base::RepeatingClosure quit_closure =
+        BindToCurrentLoop(run_loop.QuitClosure());
     EXPECT_CALL(*this, OnPaused(0)).Times(1).RetiresOnSaturation();
     EXPECT_CALL(*this, OnPaused(1)).Times(1).RetiresOnSaturation();
     EXPECT_CALL(*this, OnPaused(2))
@@ -273,7 +276,8 @@
   // Call SuspendDevices(false) and expect all to be resumed.
   {
     base::RunLoop run_loop;
-    base::Closure quit_closure = BindToCurrentLoop(run_loop.QuitClosure());
+    base::RepeatingClosure quit_closure =
+        BindToCurrentLoop(run_loop.QuitClosure());
     EXPECT_CALL(*this, OnResumed(0)).Times(1).RetiresOnSaturation();
     EXPECT_CALL(*this, OnResumed(1)).Times(1).RetiresOnSaturation();
     EXPECT_CALL(*this, OnResumed(2))
@@ -287,7 +291,8 @@
   // paused.
   {
     base::RunLoop run_loop;
-    base::Closure quit_closure = BindToCurrentLoop(run_loop.QuitClosure());
+    base::RepeatingClosure quit_closure =
+        BindToCurrentLoop(run_loop.QuitClosure());
     EXPECT_CALL(*this, OnPaused(0))
         .WillOnce(RunClosure(std::move(quit_closure)))
         .RetiresOnSaturation();
@@ -299,7 +304,8 @@
   // clients to be paused.
   {
     base::RunLoop run_loop;
-    base::Closure quit_closure = BindToCurrentLoop(run_loop.QuitClosure());
+    base::RepeatingClosure quit_closure =
+        BindToCurrentLoop(run_loop.QuitClosure());
     EXPECT_CALL(*this, OnPaused(1)).Times(1).RetiresOnSaturation();
     EXPECT_CALL(*this, OnPaused(2))
         .WillOnce(RunClosure(std::move(quit_closure)))
@@ -318,7 +324,8 @@
   // Now, call SuspendDevices(false) and expect all to be resumed.
   {
     base::RunLoop run_loop;
-    base::Closure quit_closure = BindToCurrentLoop(run_loop.QuitClosure());
+    base::RepeatingClosure quit_closure =
+        BindToCurrentLoop(run_loop.QuitClosure());
     EXPECT_CALL(*this, OnResumed(0)).Times(1).RetiresOnSaturation();
     EXPECT_CALL(*this, OnResumed(1)).Times(1).RetiresOnSaturation();
     EXPECT_CALL(*this, OnResumed(2))
@@ -329,8 +336,8 @@
   }
 
   StopCaptureForAllClients(&stop_callbacks);
-  for (const auto& release_callback : release_callbacks)
-    release_callback.Run();
+  for (auto& release_callback : release_callbacks)
+    std::move(release_callback).Run();
   cleanup_run_loop_.Run();
 }
 
diff --git a/content/renderer/pepper/message_channel.cc b/content/renderer/pepper/message_channel.cc
index 963e509..76c0a99 100644
--- a/content/renderer/pepper/message_channel.cc
+++ b/content/renderer/pepper/message_channel.cc
@@ -385,11 +385,9 @@
   // support for Messaging.)
   // TODO(raymes): Possibly change this to use TryCatch to do the conversion and
   // throw an exception if necessary.
-  V8VarConverter::VarResult conversion_result =
-      var_converter_.FromV8Value(
-          v8_value,
-          v8::Isolate::GetCurrent()->GetCurrentContext(),
-          base::Bind(&MessageChannel::FromV8ValueComplete,
+  V8VarConverter::VarResult conversion_result = var_converter_.FromV8Value(
+      v8_value, v8::Isolate::GetCurrent()->GetCurrentContext(),
+      base::BindOnce(&MessageChannel::FromV8ValueComplete,
                      weak_ptr_factory_.GetWeakPtr(),
                      &plugin_message_queue_.back()));
   if (conversion_result.completed_synchronously) {
@@ -459,21 +457,20 @@
 }
 
 void MessageChannel::UnregisterSyncMessageStatusObserver() {
-  if (!unregister_observer_callback_.is_null()) {
-    unregister_observer_callback_.Run();
-    unregister_observer_callback_.Reset();
-  }
+  if (unregister_observer_callback_)
+    std::move(unregister_observer_callback_).Run();
 }
 
 v8::Local<v8::FunctionTemplate> MessageChannel::GetFunctionTemplate(
     v8::Isolate* isolate,
     const std::string& name,
-    void (MessageChannel::*memberFuncPtr)(gin::Arguments* args)) {
+    void (MessageChannel::*member_func_ptr)(gin::Arguments* args)) {
   v8::Local<v8::FunctionTemplate> function_template = template_cache_.Get(name);
   if (!function_template.IsEmpty())
     return function_template;
   function_template = gin::CreateFunctionTemplate(
-      isolate, base::Bind(memberFuncPtr, weak_ptr_factory_.GetWeakPtr()));
+      isolate,
+      base::BindRepeating(member_func_ptr, weak_ptr_factory_.GetWeakPtr()));
   template_cache_.Set(name, function_template);
   return function_template;
 }
diff --git a/content/renderer/pepper/message_channel.h b/content/renderer/pepper/message_channel.h
index 5d0c7e0..93169b2 100644
--- a/content/renderer/pepper/message_channel.h
+++ b/content/renderer/pepper/message_channel.h
@@ -194,7 +194,7 @@
 
   // A callback to invoke at shutdown to ensure we unregister ourselves as
   // Observers for sync messages.
-  base::Closure unregister_observer_callback_;
+  base::OnceClosure unregister_observer_callback_;
 
   v8::StdGlobalValueMap<std::string, v8::FunctionTemplate> template_cache_;
 
diff --git a/content/renderer/pepper/pepper_device_enumeration_host_helper.cc b/content/renderer/pepper/pepper_device_enumeration_host_helper.cc
index b6e43a6..3d3fd05 100644
--- a/content/renderer/pepper/pepper_device_enumeration_host_helper.cc
+++ b/content/renderer/pepper/pepper_device_enumeration_host_helper.cc
@@ -30,8 +30,8 @@
  public:
   // |owner| must outlive this object.
   ScopedEnumerationRequest(PepperDeviceEnumerationHostHelper* owner,
-                           const Delegate::DevicesCallback& callback)
-      : callback_(callback), requested_(false), sync_call_(false) {
+                           Delegate::DevicesOnceCallback callback)
+      : callback_(std::move(callback)), requested_(false), sync_call_(false) {
     if (!owner->delegate_) {
       // If no delegate, return an empty list of devices.
       base::ThreadTaskRunnerHandle::Get()->PostTask(
@@ -53,8 +53,8 @@
     sync_call_ = true;
     owner->delegate_->EnumerateDevices(
         owner->device_type_,
-        base::Bind(&ScopedEnumerationRequest::EnumerateDevicesCallbackBody,
-                   AsWeakPtr()));
+        base::BindOnce(&ScopedEnumerationRequest::EnumerateDevicesCallbackBody,
+                       AsWeakPtr()));
     sync_call_ = false;
   }
 
@@ -70,12 +70,12 @@
               &ScopedEnumerationRequest::EnumerateDevicesCallbackBody,
               AsWeakPtr(), devices));
     } else {
-      callback_.Run(devices);
+      std::move(callback_).Run(devices);
       // This object may have been destroyed at this point.
     }
   }
 
-  PepperDeviceEnumerationHostHelper::Delegate::DevicesCallback callback_;
+  PepperDeviceEnumerationHostHelper::Delegate::DevicesOnceCallback callback_;
   bool requested_;
   bool sync_call_;
 
@@ -89,9 +89,9 @@
  public:
   // |owner| must outlive this object.
   ScopedMonitoringRequest(PepperDeviceEnumerationHostHelper* owner,
-                          const Delegate::DevicesCallback& callback)
+                          Delegate::DevicesCallback callback)
       : owner_(owner),
-        callback_(callback),
+        callback_(std::move(callback)),
         requested_(false),
         subscription_id_(0u) {
     DCHECK(owner_);
@@ -104,7 +104,7 @@
     // |callback| is never called synchronously by StartMonitoringDevices(),
     // so it is OK to pass it directly, even if |callback| destroys |this|.
     subscription_id_ = owner_->delegate_->StartMonitoringDevices(
-        owner_->device_type_, callback);
+        owner_->device_type_, callback_);
   }
 
   ~ScopedMonitoringRequest() {
@@ -170,10 +170,10 @@
   if (enumerate_devices_context_.is_valid())
     return PP_ERROR_INPROGRESS;
 
-  enumerate_.reset(new ScopedEnumerationRequest(
-      this,
-      base::Bind(&PepperDeviceEnumerationHostHelper::OnEnumerateDevicesComplete,
-                 base::Unretained(this))));
+  enumerate_ = std::make_unique<ScopedEnumerationRequest>(
+      this, base::BindOnce(
+                &PepperDeviceEnumerationHostHelper::OnEnumerateDevicesComplete,
+                base::Unretained(this)));
   if (!enumerate_->requested())
     return PP_ERROR_FAILED;
 
@@ -184,9 +184,10 @@
 int32_t PepperDeviceEnumerationHostHelper::OnMonitorDeviceChange(
     HostMessageContext* /* context */,
     uint32_t callback_id) {
-  monitor_.reset(new ScopedMonitoringRequest(
-      this, base::Bind(&PepperDeviceEnumerationHostHelper::OnNotifyDeviceChange,
-                       base::Unretained(this), callback_id)));
+  monitor_ = std::make_unique<ScopedMonitoringRequest>(
+      this, base::BindRepeating(
+                &PepperDeviceEnumerationHostHelper::OnNotifyDeviceChange,
+                base::Unretained(this), callback_id));
 
   return monitor_->requested() ? PP_OK : PP_ERROR_FAILED;
 }
diff --git a/content/renderer/pepper/pepper_device_enumeration_host_helper.h b/content/renderer/pepper/pepper_device_enumeration_host_helper.h
index 98c746a..5c2d101 100644
--- a/content/renderer/pepper/pepper_device_enumeration_host_helper.h
+++ b/content/renderer/pepper/pepper_device_enumeration_host_helper.h
@@ -44,12 +44,14 @@
    public:
     virtual ~Delegate() {}
 
-    using DevicesCallback = base::Callback<void(
+    using DevicesCallback = base::RepeatingCallback<void(
+        const std::vector<ppapi::DeviceRefData>& /* devices */)>;
+    using DevicesOnceCallback = base::OnceCallback<void(
         const std::vector<ppapi::DeviceRefData>& /* devices */)>;
 
     // Enumerates devices of the specified type.
     virtual void EnumerateDevices(PP_DeviceType_Dev type,
-                                  const DevicesCallback& callback) = 0;
+                                  DevicesOnceCallback callback) = 0;
 
     // Starts monitoring devices of the specified |type|. Returns a
     // subscription ID that must be used to stop monitoring for the device
diff --git a/content/renderer/pepper/pepper_device_enumeration_host_helper_unittest.cc b/content/renderer/pepper/pepper_device_enumeration_host_helper_unittest.cc
index 8e20a934..f040b60 100644
--- a/content/renderer/pepper/pepper_device_enumeration_host_helper_unittest.cc
+++ b/content/renderer/pepper/pepper_device_enumeration_host_helper_unittest.cc
@@ -53,8 +53,8 @@
   ~TestDelegate() override { CHECK(monitoring_callbacks_.empty()); }
 
   void EnumerateDevices(PP_DeviceType_Dev /* type */,
-                        const DevicesCallback& callback) override {
-    callback.Run(TestEnumerationData());
+                        DevicesOnceCallback callback) override {
+    std::move(callback).Run(TestEnumerationData());
   }
 
   size_t StartMonitoringDevices(PP_DeviceType_Dev /* type */,
diff --git a/content/renderer/pepper/pepper_file_chooser_host.cc b/content/renderer/pepper/pepper_file_chooser_host.cc
index 435b28d5..d666743 100644
--- a/content/renderer/pepper/pepper_file_chooser_host.cc
+++ b/content/renderer/pepper/pepper_file_chooser_host.cc
@@ -124,12 +124,9 @@
 
   if (!files.empty()) {
     renderer_ppapi_host_->CreateBrowserResourceHosts(
-        pp_instance(),
-        create_msgs,
-        base::Bind(&PepperFileChooserHost::DidCreateResourceHosts,
-                   weak_factory_.GetWeakPtr(),
-                   file_paths,
-                   display_names));
+        pp_instance(), create_msgs,
+        base::BindOnce(&PepperFileChooserHost::DidCreateResourceHosts,
+                       weak_factory_.GetWeakPtr(), file_paths, display_names));
   } else {
     reply_context_.params.set_result(PP_ERROR_USERCANCEL);
     std::vector<ppapi::FileRefCreateInfo> chosen_files;
diff --git a/content/renderer/pepper/pepper_in_process_router.cc b/content/renderer/pepper/pepper_in_process_router.cc
index be02edb..ce05b4a 100644
--- a/content/renderer/pepper/pepper_in_process_router.cc
+++ b/content/renderer/pepper/pepper_in_process_router.cc
@@ -23,7 +23,7 @@
 
 class PepperInProcessRouter::Channel : public IPC::Sender {
  public:
-  Channel(const base::Callback<bool(IPC::Message*)>& callback)
+  Channel(const base::RepeatingCallback<bool(IPC::Message*)>& callback)
       : callback_(callback) {}
 
   ~Channel() override {}
@@ -31,7 +31,7 @@
   bool Send(IPC::Message* message) override { return callback_.Run(message); }
 
  private:
-  base::Callback<bool(IPC::Message*)> callback_;
+  base::RepeatingCallback<bool(IPC::Message*)> callback_;
 };
 
 PepperInProcessRouter::PepperInProcessRouter(RendererPpapiHostImpl* host_impl)
@@ -39,12 +39,12 @@
       pending_message_id_(0),
       reply_result_(false),
       weak_factory_(this) {
-  browser_channel_.reset(new Channel(base::Bind(
+  browser_channel_.reset(new Channel(base::BindRepeating(
       &PepperInProcessRouter::SendToBrowser, base::Unretained(this))));
-  host_to_plugin_router_.reset(new Channel(base::Bind(
+  host_to_plugin_router_.reset(new Channel(base::BindRepeating(
       &PepperInProcessRouter::SendToPlugin, base::Unretained(this))));
-  plugin_to_host_router_.reset(new Channel(
-      base::Bind(&PepperInProcessRouter::SendToHost, base::Unretained(this))));
+  plugin_to_host_router_.reset(new Channel(base::BindRepeating(
+      &PepperInProcessRouter::SendToHost, base::Unretained(this))));
 }
 
 PepperInProcessRouter::~PepperInProcessRouter() {}
diff --git a/content/renderer/pepper/pepper_media_device_manager.cc b/content/renderer/pepper/pepper_media_device_manager.cc
index 72f55ccd..f882acaa 100644
--- a/content/renderer/pepper/pepper_media_device_manager.cc
+++ b/content/renderer/pepper/pepper_media_device_manager.cc
@@ -101,9 +101,8 @@
   DCHECK(open_callbacks_.empty());
 }
 
-void PepperMediaDeviceManager::EnumerateDevices(
-    PP_DeviceType_Dev type,
-    const DevicesCallback& callback) {
+void PepperMediaDeviceManager::EnumerateDevices(PP_DeviceType_Dev type,
+                                                DevicesOnceCallback callback) {
   bool request_audio_input = type == PP_DEVICETYPE_DEV_AUDIOCAPTURE;
   bool request_video_input = type == PP_DEVICETYPE_DEV_VIDEOCAPTURE;
   bool request_audio_output = type == PP_DEVICETYPE_DEV_AUDIOOUTPUT;
@@ -113,7 +112,7 @@
       false /* request_video_input_capabilities */,
       false /* request_audio_input_capabilities */,
       base::BindOnce(&PepperMediaDeviceManager::DevicesEnumerated, AsWeakPtr(),
-                     callback, ToMediaDeviceType(type)));
+                     std::move(callback), ToMediaDeviceType(type)));
 }
 
 size_t PepperMediaDeviceManager::StartMonitoringDevices(
@@ -151,8 +150,8 @@
 int PepperMediaDeviceManager::OpenDevice(PP_DeviceType_Dev type,
                                          const std::string& device_id,
                                          PP_Instance pp_instance,
-                                         const OpenDeviceCallback& callback) {
-  open_callbacks_[next_id_] = callback;
+                                         OpenDeviceCallback callback) {
+  open_callbacks_[next_id_] = std::move(callback);
   int request_id = next_id_++;
 
   RendererPpapiHostImpl* host =
@@ -246,21 +245,22 @@
   if (success)
     GetMediaStreamDeviceObserver()->AddStream(label, device);
 
-  OpenDeviceCallback callback = iter->second;
+  OpenDeviceCallback callback = std::move(iter->second);
   open_callbacks_.erase(iter);
 
   std::move(callback).Run(request_id, success, success ? label : std::string());
 }
 
 void PepperMediaDeviceManager::DevicesEnumerated(
-    const DevicesCallback& client_callback,
+    DevicesOnceCallback client_callback,
     blink::MediaDeviceType type,
     const std::vector<blink::WebMediaDeviceInfoArray>& enumeration,
     std::vector<blink::mojom::VideoInputDeviceCapabilitiesPtr>
         video_input_capabilities,
     std::vector<blink::mojom::AudioInputDeviceCapabilitiesPtr>
         audio_input_capabilities) {
-  client_callback.Run(FromMediaDeviceInfoArray(type, enumeration[type]));
+  std::move(client_callback)
+      .Run(FromMediaDeviceInfoArray(type, enumeration[type]));
 }
 
 const blink::mojom::MediaStreamDispatcherHostPtr&
diff --git a/content/renderer/pepper/pepper_media_device_manager.h b/content/renderer/pepper/pepper_media_device_manager.h
index dd6f3e6..9449668 100644
--- a/content/renderer/pepper/pepper_media_device_manager.h
+++ b/content/renderer/pepper/pepper_media_device_manager.h
@@ -37,7 +37,7 @@
 
   // PepperDeviceEnumerationHostHelper::Delegate implementation:
   void EnumerateDevices(PP_DeviceType_Dev type,
-                        const DevicesCallback& callback) override;
+                        DevicesOnceCallback callback) override;
   size_t StartMonitoringDevices(PP_DeviceType_Dev type,
                                 const DevicesCallback& callback) override;
   void StopMonitoringDevices(PP_DeviceType_Dev type,
@@ -48,10 +48,10 @@
       blink::MediaDeviceType type,
       const blink::WebMediaDeviceInfoArray& device_infos) override;
 
-  typedef base::Callback<void(int /* request_id */,
+  using OpenDeviceCallback =
+      base::OnceCallback<void(int /* request_id */,
                               bool /* succeeded */,
-                              const std::string& /* label */)>
-      OpenDeviceCallback;
+                              const std::string& /* label */)>;
 
   // Opens the specified device. The request ID passed into the callback will be
   // the same as the return value. If successful, the label passed into the
@@ -60,7 +60,7 @@
   int OpenDevice(PP_DeviceType_Dev type,
                  const std::string& device_id,
                  PP_Instance pp_instance,
-                 const OpenDeviceCallback& callback);
+                 OpenDeviceCallback callback);
   // Cancels an request to open device, using the request ID returned by
   // OpenDevice(). It is guaranteed that the callback passed into OpenDevice()
   // won't be called afterwards.
@@ -88,7 +88,7 @@
                       const blink::MediaStreamDevice& device);
 
   void DevicesEnumerated(
-      const DevicesCallback& callback,
+      DevicesOnceCallback callback,
       blink::MediaDeviceType type,
       const std::vector<blink::WebMediaDeviceInfoArray>& enumeration,
       std::vector<blink::mojom::VideoInputDeviceCapabilitiesPtr>
diff --git a/content/renderer/pepper/pepper_media_stream_video_track_host.cc b/content/renderer/pepper/pepper_media_stream_video_track_host.cc
index fecfa31..30faa9f 100644
--- a/content/renderer/pepper/pepper_media_stream_video_track_host.cc
+++ b/content/renderer/pepper/pepper_media_stream_video_track_host.cc
@@ -434,8 +434,8 @@
   blink::MediaStreamVideoSink::ConnectToTrack(
       track_,
       media::BindToCurrentLoop(
-          base::Bind(&PepperMediaStreamVideoTrackHost::OnVideoFrame,
-                     weak_factory_.GetWeakPtr())),
+          base::BindRepeating(&PepperMediaStreamVideoTrackHost::OnVideoFrame,
+                              weak_factory_.GetWeakPtr())),
       false);
 }
 
diff --git a/content/renderer/pepper/pepper_platform_audio_input.cc b/content/renderer/pepper/pepper_platform_audio_input.cc
index fe4a9778..05702dd2 100644
--- a/content/renderer/pepper/pepper_platform_audio_input.cc
+++ b/content/renderer/pepper/pepper_platform_audio_input.cc
@@ -166,7 +166,7 @@
       device_id.empty() ? media::AudioDeviceDescription::kDefaultDeviceId
                         : device_id,
       client->pp_instance(),
-      base::Bind(&PepperPlatformAudioInput::OnDeviceOpened, this));
+      base::BindOnce(&PepperPlatformAudioInput::OnDeviceOpened, this));
   pending_open_device_ = true;
 
   return true;
diff --git a/content/renderer/pepper/pepper_platform_camera_device.cc b/content/renderer/pepper/pepper_platform_camera_device.cc
index 1eb801ba2..f066404 100644
--- a/content/renderer/pepper/pepper_platform_camera_device.cc
+++ b/content/renderer/pepper/pepper_platform_camera_device.cc
@@ -35,8 +35,8 @@
   if (device_manager) {
     pending_open_device_id_ = device_manager->OpenDevice(
         PP_DEVICETYPE_DEV_VIDEOCAPTURE, device_id, handler->pp_instance(),
-        base::Bind(&PepperPlatformCameraDevice::OnDeviceOpened,
-                   weak_factory_.GetWeakPtr()));
+        base::BindOnce(&PepperPlatformCameraDevice::OnDeviceOpened,
+                       weak_factory_.GetWeakPtr()));
     pending_open_device_ = true;
   }
 }
@@ -47,7 +47,7 @@
       RenderThreadImpl::current()->video_capture_impl_manager();
   manager->GetDeviceSupportedFormats(
       session_id_,
-      media::BindToCurrentLoop(base::Bind(
+      media::BindToCurrentLoop(base::BindOnce(
           &PepperPlatformCameraDevice::OnDeviceSupportedFormatsEnumerated,
           weak_factory_.GetWeakPtr())));
 }
@@ -55,7 +55,7 @@
 void PepperPlatformCameraDevice::DetachEventHandler() {
   DCHECK(thread_checker_.CalledOnValidThread());
   handler_ = nullptr;
-  if (!release_device_cb_.is_null()) {
+  if (release_device_cb_) {
     std::move(release_device_cb_).Run();
   }
   if (!label_.empty()) {
@@ -75,7 +75,7 @@
 
 PepperPlatformCameraDevice::~PepperPlatformCameraDevice() {
   DCHECK(thread_checker_.CalledOnValidThread());
-  DCHECK(release_device_cb_.is_null());
+  DCHECK(!release_device_cb_);
   DCHECK(label_.empty());
   DCHECK(!pending_open_device_);
 }
diff --git a/content/renderer/pepper/pepper_platform_camera_device.h b/content/renderer/pepper/pepper_platform_camera_device.h
index 84975f34..938f5f52 100644
--- a/content/renderer/pepper/pepper_platform_camera_device.h
+++ b/content/renderer/pepper/pepper_platform_camera_device.h
@@ -49,7 +49,7 @@
 
   std::string label_;
   int session_id_;
-  base::Closure release_device_cb_;
+  base::OnceClosure release_device_cb_;
 
   PepperCameraDeviceHost* handler_;
 
diff --git a/content/renderer/pepper/pepper_platform_video_capture.cc b/content/renderer/pepper/pepper_platform_video_capture.cc
index ead6fc7..f0bd250 100644
--- a/content/renderer/pepper/pepper_platform_video_capture.cc
+++ b/content/renderer/pepper/pepper_platform_video_capture.cc
@@ -34,8 +34,8 @@
   if (device_manager) {
     pending_open_device_id_ = device_manager->OpenDevice(
         PP_DEVICETYPE_DEV_VIDEOCAPTURE, device_id, handler->pp_instance(),
-        base::Bind(&PepperPlatformVideoCapture::OnDeviceOpened,
-                   weak_factory_.GetWeakPtr()));
+        base::BindOnce(&PepperPlatformVideoCapture::OnDeviceOpened,
+                       weak_factory_.GetWeakPtr()));
     pending_open_device_ = true;
   }
 }
@@ -43,35 +43,32 @@
 void PepperPlatformVideoCapture::StartCapture(
     const media::VideoCaptureParams& params) {
   DCHECK(thread_checker_.CalledOnValidThread());
-  if (!stop_capture_cb_.is_null())
+  if (stop_capture_cb_)
     return;
   VideoCaptureImplManager* manager =
       RenderThreadImpl::current()->video_capture_impl_manager();
   stop_capture_cb_ =
-      manager->StartCapture(session_id_,
-                            params,
-                            media::BindToCurrentLoop(base::Bind(
+      manager->StartCapture(session_id_, params,
+                            media::BindToCurrentLoop(base::BindRepeating(
                                 &PepperPlatformVideoCapture::OnStateUpdate,
                                 weak_factory_.GetWeakPtr())),
-                            media::BindToCurrentLoop(base::Bind(
+                            media::BindToCurrentLoop(base::BindRepeating(
                                 &PepperPlatformVideoCapture::OnFrameReady,
                                 weak_factory_.GetWeakPtr())));
 }
 
 void PepperPlatformVideoCapture::StopCapture() {
   DCHECK(thread_checker_.CalledOnValidThread());
-  if (stop_capture_cb_.is_null())
+  if (!stop_capture_cb_)
     return;
-  stop_capture_cb_.Run();
-  stop_capture_cb_.Reset();
+  std::move(stop_capture_cb_).Run();
 }
 
 void PepperPlatformVideoCapture::DetachEventHandler() {
   handler_ = nullptr;
   StopCapture();
-  if (!release_device_cb_.is_null()) {
-    release_device_cb_.Run();
-    release_device_cb_.Reset();
+  if (release_device_cb_) {
+    std::move(release_device_cb_).Run();
   }
   if (!label_.empty()) {
     PepperMediaDeviceManager* const device_manager = GetMediaDeviceManager();
@@ -89,8 +86,8 @@
 }
 
 PepperPlatformVideoCapture::~PepperPlatformVideoCapture() {
-  DCHECK(stop_capture_cb_.is_null());
-  DCHECK(release_device_cb_.is_null());
+  DCHECK(!stop_capture_cb_);
+  DCHECK(!release_device_cb_);
   DCHECK(label_.empty());
   DCHECK(!pending_open_device_);
 }
@@ -140,7 +137,7 @@
 void PepperPlatformVideoCapture::OnFrameReady(
     scoped_refptr<media::VideoFrame> frame,
     base::TimeTicks estimated_capture_time) {
-  if (handler_ && !stop_capture_cb_.is_null())
+  if (handler_ && stop_capture_cb_)
     handler_->OnFrameReady(*frame);
 }
 
diff --git a/content/renderer/pepper/pepper_platform_video_capture.h b/content/renderer/pepper/pepper_platform_video_capture.h
index ca62be7b..46ac124 100644
--- a/content/renderer/pepper/pepper_platform_video_capture.h
+++ b/content/renderer/pepper/pepper_platform_video_capture.h
@@ -54,8 +54,8 @@
 
   std::string label_;
   int session_id_;
-  base::Closure release_device_cb_;
-  base::Closure stop_capture_cb_;
+  base::OnceClosure release_device_cb_;
+  base::OnceClosure stop_capture_cb_;
 
   PepperVideoCaptureHost* handler_;
 
diff --git a/content/renderer/pepper/pepper_plugin_instance_impl.cc b/content/renderer/pepper/pepper_plugin_instance_impl.cc
index 9d641eda..03ae763 100644
--- a/content/renderer/pepper/pepper_plugin_instance_impl.cc
+++ b/content/renderer/pepper/pepper_plugin_instance_impl.cc
@@ -400,8 +400,8 @@
     PluginModule* module,
     WebPluginContainer* container,
     const GURL& plugin_url) {
-  base::Callback<const void*(const char*)> get_plugin_interface_func =
-      base::Bind(&PluginModule::GetPluginInterface, module);
+  base::RepeatingCallback<const void*(const char*)> get_plugin_interface_func =
+      base::BindRepeating(&PluginModule::GetPluginInterface, module);
   PPP_Instance_Combined* ppp_instance_combined =
       PPP_Instance_Combined::Create(std::move(get_plugin_interface_func));
   if (!ppp_instance_combined)
@@ -2956,8 +2956,8 @@
   // can shut it down by calling its DidDestroy in our Delete() method.
   original_instance_interface_ = std::move(instance_interface_);
 
-  base::Callback<const void*(const char*)> get_plugin_interface_func =
-      base::Bind(&PluginModule::GetPluginInterface, module_);
+  base::RepeatingCallback<const void*(const char*)> get_plugin_interface_func =
+      base::BindRepeating(&PluginModule::GetPluginInterface, module_);
   PPP_Instance_Combined* ppp_instance_combined =
       PPP_Instance_Combined::Create(std::move(get_plugin_interface_func));
   if (!ppp_instance_combined) {
diff --git a/content/renderer/pepper/plugin_instance_throttler_impl.cc b/content/renderer/pepper/plugin_instance_throttler_impl.cc
index 961d0b2a..1720f22b 100644
--- a/content/renderer/pepper/plugin_instance_throttler_impl.cc
+++ b/content/renderer/pepper/plugin_instance_throttler_impl.cc
@@ -171,8 +171,9 @@
     // is disabled.
     frame->RegisterPeripheralPlugin(
         content_origin,
-        base::Bind(&PluginInstanceThrottlerImpl::MarkPluginEssential,
-                   weak_factory_.GetWeakPtr(), UNTHROTTLE_METHOD_BY_WHITELIST));
+        base::BindOnce(&PluginInstanceThrottlerImpl::MarkPluginEssential,
+                       weak_factory_.GetWeakPtr(),
+                       UNTHROTTLE_METHOD_BY_WHITELIST));
   }
 }
 
diff --git a/content/renderer/pepper/plugin_object.cc b/content/renderer/pepper/plugin_object.cc
index 71e4a9b..35001d16 100644
--- a/content/renderer/pepper/plugin_object.cc
+++ b/content/renderer/pepper/plugin_object.cc
@@ -299,10 +299,9 @@
   v8::Local<v8::FunctionTemplate> function_template = template_cache_.Get(name);
   if (!function_template.IsEmpty())
     return function_template;
-  function_template =
-      gin::CreateFunctionTemplate(
-          isolate, base::Bind(&PluginObject::Call, weak_factory_.GetWeakPtr(),
-                              name));
+  function_template = gin::CreateFunctionTemplate(
+      isolate, base::BindRepeating(&PluginObject::Call,
+                                   weak_factory_.GetWeakPtr(), name));
   template_cache_.Set(name, function_template);
   return function_template;
 }
diff --git a/content/renderer/pepper/plugin_power_saver_helper.cc b/content/renderer/pepper/plugin_power_saver_helper.cc
index 7b5c4db..77f3095 100644
--- a/content/renderer/pepper/plugin_power_saver_helper.cc
+++ b/content/renderer/pepper/plugin_power_saver_helper.cc
@@ -31,15 +31,17 @@
 
 PluginPowerSaverHelper::PeripheralPlugin::PeripheralPlugin(
     const url::Origin& content_origin,
-    const base::Closure& unthrottle_callback)
+    base::OnceClosure unthrottle_callback)
     : content_origin(content_origin),
-      unthrottle_callback(unthrottle_callback) {}
+      unthrottle_callback(std::move(unthrottle_callback)) {}
 
-PluginPowerSaverHelper::PeripheralPlugin::PeripheralPlugin(
-    const PeripheralPlugin& other) = default;
+PluginPowerSaverHelper::PeripheralPlugin::~PeripheralPlugin() = default;
 
-PluginPowerSaverHelper::PeripheralPlugin::~PeripheralPlugin() {
-}
+PluginPowerSaverHelper::PeripheralPlugin::PeripheralPlugin(PeripheralPlugin&&) =
+    default;
+PluginPowerSaverHelper::PeripheralPlugin&
+PluginPowerSaverHelper::PeripheralPlugin::operator=(PeripheralPlugin&&) =
+    default;
 
 PluginPowerSaverHelper::PluginPowerSaverHelper(RenderFrame* render_frame)
     : RenderFrameObserver(render_frame) {}
@@ -82,8 +84,8 @@
     if (origin_whitelist.count(it->content_origin)) {
       // Because the unthrottle callback may register another peripheral plugin
       // and invalidate our iterator, we cannot run it synchronously.
-      base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE,
-                                                    it->unthrottle_callback);
+      base::ThreadTaskRunnerHandle::Get()->PostTask(
+          FROM_HERE, std::move(it->unthrottle_callback));
       it = peripheral_plugins_.erase(it);
     } else {
       ++it;
@@ -93,9 +95,9 @@
 
 void PluginPowerSaverHelper::RegisterPeripheralPlugin(
     const url::Origin& content_origin,
-    const base::Closure& unthrottle_callback) {
+    base::OnceClosure unthrottle_callback) {
   peripheral_plugins_.push_back(
-      PeripheralPlugin(content_origin, unthrottle_callback));
+      PeripheralPlugin(content_origin, std::move(unthrottle_callback)));
 }
 
 RenderFrame::PeripheralContentStatus
diff --git a/content/renderer/pepper/plugin_power_saver_helper.h b/content/renderer/pepper/plugin_power_saver_helper.h
index e178201b..ba682b0a 100644
--- a/content/renderer/pepper/plugin_power_saver_helper.h
+++ b/content/renderer/pepper/plugin_power_saver_helper.h
@@ -31,17 +31,19 @@
 
   struct PeripheralPlugin {
     PeripheralPlugin(const url::Origin& content_origin,
-                     const base::Closure& unthrottle_callback);
-    PeripheralPlugin(const PeripheralPlugin& other);
+                     base::OnceClosure unthrottle_callback);
     ~PeripheralPlugin();
 
+    PeripheralPlugin(PeripheralPlugin&&);
+    PeripheralPlugin& operator=(PeripheralPlugin&&);
+
     url::Origin content_origin;
-    base::Closure unthrottle_callback;
+    base::OnceClosure unthrottle_callback;
   };
 
   // See RenderFrame for documentation.
   void RegisterPeripheralPlugin(const url::Origin& content_origin,
-                                const base::Closure& unthrottle_callback);
+                                base::OnceClosure unthrottle_callback);
   RenderFrame::PeripheralContentStatus GetPeripheralContentStatus(
       const url::Origin& main_frame_origin,
       const url::Origin& content_origin,
diff --git a/content/renderer/pepper/resource_converter.cc b/content/renderer/pepper/resource_converter.cc
index e97b9af..cb4e045 100644
--- a/content/renderer/pepper/resource_converter.cc
+++ b/content/renderer/pepper/resource_converter.cc
@@ -32,14 +32,14 @@
 namespace {
 
 void FlushComplete(
-    const base::Callback<void(bool)>& callback,
-    const std::vector<scoped_refptr<content::HostResourceVar> >& browser_vars,
+    base::OnceCallback<void(bool)> callback,
+    const std::vector<scoped_refptr<content::HostResourceVar>>& browser_vars,
     const std::vector<int>& pending_host_ids) {
   CHECK(browser_vars.size() == pending_host_ids.size());
   for (size_t i = 0; i < browser_vars.size(); ++i) {
     browser_vars[i]->set_pending_browser_host_id(pending_host_ids[i]);
   }
-  callback.Run(true);
+  std::move(callback).Run(true);
 }
 
 PP_FileSystemType WebFileSystemTypeToPPAPI(blink::WebFileSystemType type) {
@@ -272,11 +272,10 @@
   return !browser_host_create_messages_.empty();
 }
 
-void ResourceConverterImpl::Flush(const base::Callback<void(bool)>& callback) {
+void ResourceConverterImpl::Flush(base::OnceCallback<void(bool)> callback) {
   RendererPpapiHost::GetForPPInstance(instance_)->CreateBrowserResourceHosts(
-      instance_,
-      browser_host_create_messages_,
-      base::Bind(&FlushComplete, callback, browser_vars_));
+      instance_, browser_host_create_messages_,
+      base::BindOnce(&FlushComplete, std::move(callback), browser_vars_));
   browser_host_create_messages_.clear();
   browser_vars_.clear();
 }
diff --git a/content/renderer/pepper/resource_converter.h b/content/renderer/pepper/resource_converter.h
index 68f18d5..012b750 100644
--- a/content/renderer/pepper/resource_converter.h
+++ b/content/renderer/pepper/resource_converter.h
@@ -38,7 +38,7 @@
   // If NeedsFlush() is true then Flush() must be called before any vars created
   // by the ResourceConverter are valid. It handles creating any resource hosts
   // that need to be created. |callback| will always be called asynchronously.
-  virtual void Flush(const base::Callback<void(bool)>& callback) = 0;
+  virtual void Flush(base::OnceCallback<void(bool)> callback) = 0;
 
   // Attempts to convert a V8 object to a PP_Var with type PP_VARTYPE_RESOURCE.
   // On success, writes the resulting var to |result|, sets |was_resource| to
@@ -65,7 +65,7 @@
   // ResourceConverter overrides.
   void Reset() override;
   bool NeedsFlush() override;
-  void Flush(const base::Callback<void(bool)>& callback) override;
+  void Flush(base::OnceCallback<void(bool)> callback) override;
   bool FromV8Value(v8::Local<v8::Object> val,
                    v8::Local<v8::Context> context,
                    PP_Var* result,
diff --git a/content/renderer/pepper/v8_var_converter.cc b/content/renderer/pepper/v8_var_converter.cc
index 55a5dea..97d125e3 100644
--- a/content/renderer/pepper/v8_var_converter.cc
+++ b/content/renderer/pepper/v8_var_converter.cc
@@ -446,14 +446,14 @@
 V8VarConverter::VarResult V8VarConverter::FromV8Value(
     v8::Local<v8::Value> val,
     v8::Local<v8::Context> context,
-    const base::Callback<void(const ScopedPPVar&, bool)>& callback) {
+    base::OnceCallback<void(const ScopedPPVar&, bool)> callback) {
   VarResult result;
   result.success = FromV8ValueInternal(val, context, &result.var);
   if (!result.success)
     resource_converter_->Reset();
   result.completed_synchronously = !resource_converter_->NeedsFlush();
   if (!result.completed_synchronously)
-    resource_converter_->Flush(base::Bind(callback, result.var));
+    resource_converter_->Flush(base::BindOnce(std::move(callback), result.var));
 
   return result;
 }
diff --git a/content/renderer/pepper/v8_var_converter.h b/content/renderer/pepper/v8_var_converter.h
index 835a8e48..6496df5 100644
--- a/content/renderer/pepper/v8_var_converter.h
+++ b/content/renderer/pepper/v8_var_converter.h
@@ -69,7 +69,7 @@
   VarResult FromV8Value(
       v8::Local<v8::Value> val,
       v8::Local<v8::Context> context,
-      const base::Callback<void(const ppapi::ScopedPPVar&, bool)>& callback);
+      base::OnceCallback<void(const ppapi::ScopedPPVar&, bool)> callback);
   bool FromV8ValueSync(v8::Local<v8::Value> val,
                        v8::Local<v8::Context> context,
                        ppapi::ScopedPPVar* result_var);
diff --git a/content/renderer/pepper/v8_var_converter_unittest.cc b/content/renderer/pepper/v8_var_converter_unittest.cc
index 1f016c03..5fe799bd 100644
--- a/content/renderer/pepper/v8_var_converter_unittest.cc
+++ b/content/renderer/pepper/v8_var_converter_unittest.cc
@@ -58,9 +58,7 @@
   ~MockResourceConverter() override {}
   void Reset() override {}
   bool NeedsFlush() override { return false; }
-  void Flush(const base::Callback<void(bool)>& callback) override {
-    NOTREACHED();
-  }
+  void Flush(base::OnceCallback<void(bool)> callback) override { NOTREACHED(); }
   bool FromV8Value(v8::Local<v8::Object> val,
                    v8::Local<v8::Context> context,
                    PP_Var* result,
@@ -199,10 +197,8 @@
   bool FromV8ValueSync(v8::Local<v8::Value> val,
                        v8::Local<v8::Context> context,
                        PP_Var* result) {
-    V8VarConverter::VarResult conversion_result =
-        converter_->FromV8Value(val,
-                                context,
-                                base::Bind(&FromV8ValueComplete));
+    V8VarConverter::VarResult conversion_result = converter_->FromV8Value(
+        val, context, base::BindOnce(&FromV8ValueComplete));
     DCHECK(conversion_result.completed_synchronously);
     if (conversion_result.success)
       *result = conversion_result.var.Release();
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 151bcb0..4e6a498a 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -3165,9 +3165,9 @@
 #if BUILDFLAG(ENABLE_PLUGINS)
 void RenderFrameImpl::RegisterPeripheralPlugin(
     const url::Origin& content_origin,
-    const base::Closure& unthrottle_callback) {
+    base::OnceClosure unthrottle_callback) {
   return plugin_power_saver_helper_->RegisterPeripheralPlugin(
-      content_origin, unthrottle_callback);
+      content_origin, std::move(unthrottle_callback));
 }
 
 RenderFrame::PeripheralContentStatus
diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
index 31218b0..a2e8b0e7 100644
--- a/content/renderer/render_frame_impl.h
+++ b/content/renderer/render_frame_impl.h
@@ -480,9 +480,8 @@
   blink::AssociatedInterfaceRegistry* GetAssociatedInterfaceRegistry() override;
   blink::AssociatedInterfaceProvider* GetRemoteAssociatedInterfaces() override;
 #if BUILDFLAG(ENABLE_PLUGINS)
-  void RegisterPeripheralPlugin(
-      const url::Origin& content_origin,
-      const base::Closure& unthrottle_callback) override;
+  void RegisterPeripheralPlugin(const url::Origin& content_origin,
+                                base::OnceClosure unthrottle_callback) override;
   RenderFrame::PeripheralContentStatus GetPeripheralContentStatus(
       const url::Origin& main_frame_origin,
       const url::Origin& content_origin,
diff --git a/content/renderer/render_process_impl.cc b/content/renderer/render_process_impl.cc
index 42ab7a3..e1abf545 100644
--- a/content/renderer/render_process_impl.cc
+++ b/content/renderer/render_process_impl.cc
@@ -156,6 +156,9 @@
   SetV8FlagIfNotFeature(features::kAwaitOptimization,
                         "--no-harmony-await-optimization");
 
+  SetV8FlagIfFeature(features::kBlinkHeapUnifiedGCScheduling,
+                     "--global-gc-scheduling");
+
   SetV8FlagIfNotFeature(features::kWebAssemblyTrapHandler,
                         "--no-wasm-trap-handler");
 #if defined(OS_LINUX) && defined(ARCH_CPU_X86_64)
diff --git a/content/shell/BUILD.gn b/content/shell/BUILD.gn
index db4bdbb1..18d525e 100644
--- a/content/shell/BUILD.gn
+++ b/content/shell/BUILD.gn
@@ -294,7 +294,6 @@
     "//components/download/public/background_service:public",
     "//components/download/public/common:public",
     "//components/keyed_service/content",
-    "//components/keyed_service/core:test_support",
     "//components/network_session_configurator/browser",
     "//components/plugins/renderer",
     "//components/url_formatter",
diff --git a/content/shell/browser/shell_browser_context.cc b/content/shell/browser/shell_browser_context.cc
index 544b49c..3a964c1 100644
--- a/content/shell/browser/shell_browser_context.cc
+++ b/content/shell/browser/shell_browser_context.cc
@@ -17,8 +17,8 @@
 #include "build/build_config.h"
 #include "components/keyed_service/content/browser_context_dependency_manager.h"
 #include "components/keyed_service/core/simple_dependency_manager.h"
+#include "components/keyed_service/core/simple_factory_key.h"
 #include "components/keyed_service/core/simple_key_map.h"
-#include "components/keyed_service/core/test_simple_factory_key.h"
 #include "components/network_session_configurator/common/network_switches.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
@@ -143,7 +143,7 @@
 
 void ShellBrowserContext::FinishInitWhileIOAllowed() {
   BrowserContext::Initialize(this, path_);
-  key_ = std::make_unique<TestSimpleFactoryKey>(path_, off_the_record_);
+  key_ = std::make_unique<SimpleFactoryKey>(path_, off_the_record_);
   SimpleKeyMap::GetInstance()->Associate(this, key_.get());
 }
 
diff --git a/content/shell/renderer/web_test/blink_test_helpers.cc b/content/shell/renderer/web_test/blink_test_helpers.cc
index 40b58ed1d..a99fbfc 100644
--- a/content/shell/renderer/web_test/blink_test_helpers.cc
+++ b/content/shell/renderer/web_test/blink_test_helpers.cc
@@ -19,6 +19,7 @@
 #include "net/base/filename_util.h"
 
 #if defined(OS_MACOSX)
+#include "base/mac/bundle_locations.h"
 #include "base/mac/foundation_util.h"
 #endif
 
@@ -155,20 +156,18 @@
 }
 
 base::FilePath GetBuildDirectory() {
+#if defined(OS_MACOSX)
+  if (base::mac::AmIBundled()) {
+    // If this is a bundled Content Shell.app, go up one from the outer bundle
+    // directory.
+    return base::mac::OuterBundlePath().DirName();
+  }
+#endif
+
   base::FilePath result;
   bool success = base::PathService::Get(base::DIR_EXE, &result);
   CHECK(success);
 
-#if defined(OS_MACOSX)
-  if (base::mac::AmIBundled()) {
-    // The bundled app executables live three levels down from the build
-    // directory, eg:
-    // Content Shell.app/Contents/Frameworks/Content Shell Helper.app
-    // And this helper executable lives an additional three levels down:
-    // Content Shell Helper.app/Contents/MacOS/Content Shell Helper
-    result = result.DirName().DirName().DirName().DirName().DirName().DirName();
-  }
-#endif
   return result;
 }
 
diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
index 49763cbd..ebc80306 100644
--- a/content/test/BUILD.gn
+++ b/content/test/BUILD.gn
@@ -862,6 +862,7 @@
     "../browser/network_service_browsertest.cc",
     "../browser/network_service_restart_browsertest.cc",
     "../browser/oop_browsertest.cc",
+    "../browser/origin_trials/origin_trials_browsertest.cc",
     "../browser/payments/payment_app_browsertest.cc",
     "../browser/performance_memory_browsertest.cc",
     "../browser/pointer_lock_browsertest.cc",
diff --git a/content/test/data/origin_trials/OWNERS b/content/test/data/origin_trials/OWNERS
new file mode 100644
index 0000000..73686a7
--- /dev/null
+++ b/content/test/data/origin_trials/OWNERS
@@ -0,0 +1 @@
+file://third_party/blink/common/origin_trials/OWNERS
diff --git a/content/test/data/origin_trials/basic.html b/content/test/data/origin_trials/basic.html
new file mode 100644
index 0000000..3f09fe3
--- /dev/null
+++ b/content/test/data/origin_trials/basic.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Origin Trial Test</title>
+<!-- TODO(iclelland): Generate this sample token during the build. The token
+   below will expire in 2033, but it would be better to always have a token which
+   is guaranteed to be valid when the tests are run.
+   Generate this token with the command:
+   generate_token.py https://example.test Frobulate -expire-timestamp=2000000000 -->
+<meta http-equiv="origin-trial" content="AlrgXVXDH5RSr6sDZiO6/8Hejv3BIhODCSS/0zD8VmDDLNPn463JzEq/Cv/wqt8cRHacGD3cUhKkibGIGQbaXAMAAABUeyJvcmlnaW4iOiAiaHR0cHM6Ly9leGFtcGxlLnRlc3Q6NDQzIiwgImZlYXR1cmUiOiAiRnJvYnVsYXRlIiwgImV4cGlyeSI6IDIwMDAwMDAwMDB9">
+</head>
+</html>
diff --git a/content/test/data/origin_trials/navigation.html b/content/test/data/origin_trials/navigation.html
new file mode 100644
index 0000000..34cb36a
--- /dev/null
+++ b/content/test/data/origin_trials/navigation.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Navigation Origin Trial Test</title>
+<!-- TODO(iclelland): Generate this sample token during the build. The token
+   below will expire in 2033, but it would be better to always have a token which
+   is guaranteed to be valid when the tests are run.
+   Generate this token with the command:
+   generate_token.py https://example.test FrobulateNavigation -expire-timestamp=2000000000 -->
+<meta http-equiv="origin-trial" content="AiSDtnMbPArghZ2A/kg59foCBNhCCgYJDSLWEYcAZzayqmSabwt7AWu9AdvOavoMykGgAL07nX6ZEoLrDNdyjwMAAABeeyJvcmlnaW4iOiAiaHR0cHM6Ly9leGFtcGxlLnRlc3Q6NDQzIiwgImZlYXR1cmUiOiAiRnJvYnVsYXRlTmF2aWdhdGlvbiIsICJleHBpcnkiOiAyMDAwMDAwMDAwfQ==">
+</head>
+</html>
diff --git a/extensions/browser/api/declarative_net_request/ruleset_source.cc b/extensions/browser/api/declarative_net_request/ruleset_source.cc
index 1cdc81c6..7a3c34f 100644
--- a/extensions/browser/api/declarative_net_request/ruleset_source.cc
+++ b/extensions/browser/api/declarative_net_request/ruleset_source.cc
@@ -146,12 +146,10 @@
 void OnSafeJSONParserSuccess(
     const RulesetSource& source,
     RulesetSource::IndexAndPersistJSONRulesetCallback callback,
-    std::unique_ptr<base::Value> root) {
-  DCHECK(root);
-
+    base::Value root) {
   base::ElapsedTimer timer;
   ReadJSONRulesResult result =
-      ParseRulesFromJSON(*root, source.rule_count_limit());
+      ParseRulesFromJSON(root, source.rule_count_limit());
   if (result.status != Status::kSuccess) {
     std::move(callback).Run(IndexAndPersistJSONRulesetResult::CreateErrorResult(
         GetErrorWithFilename(source.json_path(), result.error)));
diff --git a/extensions/browser/api/management/management_api.cc b/extensions/browser/api/management/management_api.cc
index ef2857b..e028420 100644
--- a/extensions/browser/api/management/management_api.cc
+++ b/extensions/browser/api/management/management_api.cc
@@ -123,6 +123,8 @@
       info.type = management::EXTENSION_TYPE_PACKAGED_APP;
   } else if (extension.is_theme()) {
     info.type = management::EXTENSION_TYPE_THEME;
+  } else if (extension.is_login_screen_extension()) {
+    info.type = management::EXTENSION_TYPE_LOGIN_SCREEN_EXTENSION;
   } else {
     info.type = management::EXTENSION_TYPE_EXTENSION;
   }
@@ -347,13 +349,12 @@
 }
 
 void ManagementGetPermissionWarningsByManifestFunction::OnParseSuccess(
-    std::unique_ptr<base::Value> value) {
-  if (!value->is_dict()) {
+    base::Value value) {
+  const base::DictionaryValue* parsed_manifest;
+  if (!value.GetAsDictionary(&parsed_manifest)) {
     OnParseFailure(keys::kManifestParseError);
     return;
   }
-  const base::DictionaryValue* parsed_manifest =
-      static_cast<const base::DictionaryValue*>(value.get());
 
   std::string error;
   scoped_refptr<Extension> extension =
diff --git a/extensions/browser/api/management/management_api.h b/extensions/browser/api/management/management_api.h
index caa6296..9648478d 100644
--- a/extensions/browser/api/management/management_api.h
+++ b/extensions/browser/api/management/management_api.h
@@ -79,7 +79,7 @@
                              MANAGEMENT_GETPERMISSIONWARNINGSBYMANIFEST)
 
   // Called when utility process finishes.
-  void OnParseSuccess(std::unique_ptr<base::Value> value);
+  void OnParseSuccess(base::Value value);
   void OnParseFailure(const std::string& error);
 
  protected:
diff --git a/extensions/browser/zipfile_installer.cc b/extensions/browser/zipfile_installer.cc
index 864cc3e4..5efc4e4 100644
--- a/extensions/browser/zipfile_installer.cc
+++ b/extensions/browser/zipfile_installer.cc
@@ -148,11 +148,11 @@
   ReportFailure(std::string(kExtensionHandlerFileUnzipError));
 }
 
-void ZipFileInstaller::ManifestParsed(
-    const base::FilePath& unzip_dir,
-    std::unique_ptr<base::Value> manifest_value) {
+void ZipFileInstaller::ManifestParsed(const base::FilePath& unzip_dir,
+                                      base::Value manifest_value) {
   std::unique_ptr<base::DictionaryValue> manifest_dictionary =
-      base::DictionaryValue::From(std::move(manifest_value));
+      base::DictionaryValue::From(
+          base::Value::ToUniquePtrValue(std::move(manifest_value)));
   if (!manifest_dictionary) {
     ReportFailure(std::string(kExtensionHandlerFileUnzipError));
     return;
diff --git a/extensions/browser/zipfile_installer.h b/extensions/browser/zipfile_installer.h
index 9d44b5f..26ed0c55 100644
--- a/extensions/browser/zipfile_installer.h
+++ b/extensions/browser/zipfile_installer.h
@@ -68,8 +68,7 @@
   void ManifestRead(const base::FilePath& unzip_dir,
                     base::Optional<std::string> manifest_content);
   void ManifestParsingFailed(const std::string& error);
-  void ManifestParsed(const base::FilePath& unzip_dir,
-                      std::unique_ptr<base::Value> manifest);
+  void ManifestParsed(const base::FilePath& unzip_dir, base::Value manifest);
   void UnzipDone(const base::FilePath& unzip_dir, bool success);
 
   // On failure, report the |error| reason.
diff --git a/extensions/common/api/_behavior_features.json b/extensions/common/api/_behavior_features.json
index 0e5d400..ee13bda 100644
--- a/extensions/common/api/_behavior_features.json
+++ b/extensions/common/api/_behavior_features.json
@@ -76,6 +76,19 @@
       "2FCBCE08B34CCA1728A85F1EFBD9A34DD2558B2E",  // ChromeVox
       "7910EAFDAF64B947E1CB31B333A9BD14CA556B6C"   // Feedback extension
     ]
+  }, {
+    // Extensions that are force-installed on the login screen through policy
+    // will receive type "login_screen_extension" and have limited API
+    // capabilities. Nonetheless, we only allow specifically whitelisted
+    // extensions here.
+    "channel": "dev",
+    "component_extensions_auto_granted": false,
+    "extension_types": ["login_screen_extension"],
+    "location": "policy",
+    "platforms": ["chromeos"],
+    "whitelist": [
+      "FA84F98B32AFC3013F5711F8711F8F38DB210AB7" // Sign-in Screen Test Extension
+    ]
   }],
   "allow_deprecated_audio_api": {
     "channel": "stable",
diff --git a/extensions/common/api/_manifest_features.json b/extensions/common/api/_manifest_features.json
index 6ce25c7..95aad7e 100644
--- a/extensions/common/api/_manifest_features.json
+++ b/extensions/common/api/_manifest_features.json
@@ -45,7 +45,7 @@
     "channel": "stable",
     "extension_types": [
       // Platform apps specify their background page via app.background.
-      "extension", "legacy_packaged_app", "hosted_app"
+      "extension", "legacy_packaged_app", "hosted_app", "login_screen_extension"
     ]
   },
   "background.persistent": {
@@ -288,7 +288,11 @@
   "permissions": {
     "channel": "stable",
     "extension_types": [
-      "extension", "legacy_packaged_app", "hosted_app", "platform_app"
+      "extension",
+      "legacy_packaged_app",
+      "hosted_app",
+      "platform_app",
+      "login_screen_extension"
     ]
   },
   "replacement_web_app": {
diff --git a/extensions/common/api/management.json b/extensions/common/api/management.json
index 47089bb..4a7ba8a 100644
--- a/extensions/common/api/management.json
+++ b/extensions/common/api/management.json
@@ -32,7 +32,7 @@
         "id": "ExtensionType",
         "description": "The type of this extension, app, or theme.",
         "type": "string",
-        "enum": ["extension", "hosted_app", "packaged_app", "legacy_packaged_app", "theme"]
+        "enum": ["extension", "hosted_app", "packaged_app", "legacy_packaged_app", "theme", "login_screen_extension"]
       },
       {
         "id": "ExtensionInstallType",
diff --git a/extensions/common/extension.cc b/extensions/common/extension.cc
index 7858de7..463f92a1 100644
--- a/extensions/common/extension.cc
+++ b/extensions/common/extension.cc
@@ -126,7 +126,7 @@
 
 }  // namespace
 
-const int Extension::kInitFromValueFlagBits = 13;
+const int Extension::kInitFromValueFlagBits = 14;
 
 const char Extension::kMimeType[] = "application/x-chrome-extension";
 
@@ -171,8 +171,14 @@
   base::ElapsedTimer timer;
   DCHECK(utf8_error);
   base::string16 error;
-  std::unique_ptr<extensions::Manifest> manifest(
-      new extensions::Manifest(location, value.CreateDeepCopy()));
+
+  std::unique_ptr<extensions::Manifest> manifest;
+  if (flags & FOR_LOGIN_SCREEN) {
+    manifest = Manifest::CreateManifestForLoginScreen(location,
+                                                      value.CreateDeepCopy());
+  } else {
+    manifest = std::make_unique<Manifest>(location, value.CreateDeepCopy());
+  }
 
   if (!InitExtensionID(manifest.get(), path, explicit_id, flags, &error)) {
     *utf8_error = base::UTF16ToUTF8(error);
@@ -459,6 +465,10 @@
   return manifest()->is_theme();
 }
 
+bool Extension::is_login_screen_extension() const {
+  return manifest()->is_login_screen_extension();
+}
+
 void Extension::AddWebExtentPattern(const URLPattern& pattern) {
   // Bookmark apps are permissionless.
   if (from_bookmark())
diff --git a/extensions/common/extension.h b/extensions/common/extension.h
index a99bf4c8..bcc4fed 100644
--- a/extensions/common/extension.h
+++ b/extensions/common/extension.h
@@ -134,6 +134,12 @@
     // before they are fully installed and enabled.
     MAY_BE_UNTRUSTED = 1 << 12,
 
+    // |FOR_LOGIN_SCREEN| means that this extension was force-installed through
+    // policy for the login screen. Extensions created with this flag will have
+    // type |TYPE_LOGIN_SCREEN_EXTENSION| (with limited API capabilities)
+    // instead of the usual |TYPE_EXTENSION|.
+    FOR_LOGIN_SCREEN = 1 << 13,
+
     // When adding new flags, make sure to update kInitFromValueFlagBits.
   };
 
@@ -312,6 +318,7 @@
   bool is_extension() const;            // Regular browser extension, not an app
   bool is_shared_module() const;        // Shared module
   bool is_theme() const;                // Theme
+  bool is_login_screen_extension() const;  // Extension on login screen.
 
   // True if this is a platform app, hosted app, or legacy packaged app.
   bool is_app() const;
diff --git a/extensions/common/extension_unittest.cc b/extensions/common/extension_unittest.cc
index c2dba669..2d61d832 100644
--- a/extensions/common/extension_unittest.cc
+++ b/extensions/common/extension_unittest.cc
@@ -67,6 +67,26 @@
   return testing::AssertionSuccess();
 }
 
+testing::AssertionResult RunCreationWithFlags(
+    const base::DictionaryValue* manifest,
+    Manifest::Location location,
+    Manifest::Type expected_type,
+    Extension::InitFromValueFlags custom_flag = Extension::NO_FLAGS) {
+  std::string error;
+  scoped_refptr<const Extension> extension = Extension::Create(
+      base::FilePath(), location, *manifest, custom_flag, &error);
+  if (!extension) {
+    return testing::AssertionFailure()
+           << "Extension creation failed: " << error;
+  }
+
+  if (extension->GetType() != expected_type) {
+    return testing::AssertionFailure()
+           << "Wrong type: " << extension->GetType();
+  }
+  return testing::AssertionSuccess();
+}
+
 }  // namespace
 
 // TODO(devlin): Move tests from chrome/common/extensions/extension_unittest.cc
@@ -203,4 +223,20 @@
       get_manifest(1), Extension::REQUIRE_MODERN_MANIFEST_VERSION));
 }
 
+TEST(ExtensionTest, LoginScreenFlag) {
+  DictionaryBuilder builder;
+  builder.Set("name", "My Extension")
+      .Set("version", "0.1")
+      .Set("description", "An awesome extension")
+      .Set("manifest_version", 2);
+  std::unique_ptr<base::DictionaryValue> manifest = builder.Build();
+
+  EXPECT_TRUE(RunCreationWithFlags(manifest.get(), Manifest::EXTERNAL_POLICY,
+                                   Manifest::TYPE_EXTENSION,
+                                   Extension::NO_FLAGS));
+  EXPECT_TRUE(RunCreationWithFlags(manifest.get(), Manifest::EXTERNAL_POLICY,
+                                   Manifest::TYPE_LOGIN_SCREEN_EXTENSION,
+                                   Extension::FOR_LOGIN_SCREEN));
+}
+
 }  // namespace extensions
diff --git a/extensions/common/features/feature_provider_unittest.cc b/extensions/common/features/feature_provider_unittest.cc
index 049a182..223de38c 100644
--- a/extensions/common/features/feature_provider_unittest.cc
+++ b/extensions/common/features/feature_provider_unittest.cc
@@ -30,7 +30,7 @@
   ASSERT_TRUE(feature);
   const std::vector<Manifest::Type>& extension_types =
       feature->extension_types();
-  EXPECT_EQ(6u, extension_types.size());
+  EXPECT_EQ(7u, extension_types.size());
   EXPECT_EQ(1, base::STLCount(extension_types, Manifest::TYPE_EXTENSION));
   EXPECT_EQ(
       1, base::STLCount(extension_types, Manifest::TYPE_LEGACY_PACKAGED_APP));
@@ -38,6 +38,8 @@
   EXPECT_EQ(1, base::STLCount(extension_types, Manifest::TYPE_HOSTED_APP));
   EXPECT_EQ(1, base::STLCount(extension_types, Manifest::TYPE_THEME));
   EXPECT_EQ(1, base::STLCount(extension_types, Manifest::TYPE_SHARED_MODULE));
+  EXPECT_EQ(1, base::STLCount(extension_types,
+                              Manifest::TYPE_LOGIN_SCREEN_EXTENSION));
 }
 
 // Tests that real manifest features have the correct availability for an
diff --git a/extensions/common/features/simple_feature.cc b/extensions/common/features/simple_feature.cc
index f8f6318..986a631 100644
--- a/extensions/common/features/simple_feature.cc
+++ b/extensions/common/features/simple_feature.cc
@@ -84,6 +84,8 @@
       return "user script";
     case Manifest::TYPE_SHARED_MODULE:
       return "shared module";
+    case Manifest::TYPE_LOGIN_SCREEN_EXTENSION:
+      return "login screen extension";
     case Manifest::NUM_LOAD_TYPES:
       NOTREACHED();
   }
diff --git a/extensions/common/manifest.cc b/extensions/common/manifest.cc
index 588e6f1..031756e9 100644
--- a/extensions/common/manifest.cc
+++ b/extensions/common/manifest.cc
@@ -8,6 +8,7 @@
 
 #include "base/lazy_instance.h"
 #include "base/logging.h"
+#include "base/memory/ptr_util.h"
 #include "base/strings/string_split.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
@@ -113,7 +114,8 @@
 
 // static
 Manifest::Type Manifest::GetTypeFromManifestValue(
-    const base::DictionaryValue& value) {
+    const base::DictionaryValue& value,
+    bool for_login_screen) {
   Type type = TYPE_UNKNOWN;
   if (value.HasKey(keys::kTheme)) {
     type = TYPE_THEME;
@@ -128,6 +130,8 @@
     } else {
       type = TYPE_LEGACY_PACKAGED_APP;
     }
+  } else if (for_login_screen) {
+    type = TYPE_LOGIN_SCREEN_EXTENSION;
   } else {
     type = TYPE_EXTENSION;
   }
@@ -152,11 +156,25 @@
   return false;
 }
 
+// static
+std::unique_ptr<Manifest> Manifest::CreateManifestForLoginScreen(
+    Location location,
+    std::unique_ptr<base::DictionaryValue> value) {
+  CHECK(IsPolicyLocation(location));
+  // Use base::WrapUnique + new because the constructor is private.
+  return base::WrapUnique(new Manifest(location, std::move(value), true));
+}
+
 Manifest::Manifest(Location location,
                    std::unique_ptr<base::DictionaryValue> value)
+    : Manifest(location, std::move(value), false) {}
+
+Manifest::Manifest(Location location,
+                   std::unique_ptr<base::DictionaryValue> value,
+                   bool for_login_screen)
     : location_(location),
       value_(std::move(value)),
-      type_(GetTypeFromManifestValue(*value_)) {}
+      type_(GetTypeFromManifestValue(*value_, for_login_screen)) {}
 
 Manifest::~Manifest() {
 }
diff --git a/extensions/common/manifest.h b/extensions/common/manifest.h
index d9709f4a..f3c89d90 100644
--- a/extensions/common/manifest.h
+++ b/extensions/common/manifest.h
@@ -80,6 +80,7 @@
     TYPE_LEGACY_PACKAGED_APP = 5,
     TYPE_PLATFORM_APP = 6,
     TYPE_SHARED_MODULE = 7,
+    TYPE_LOGIN_SCREEN_EXTENSION = 8,
 
     // New enum values must go above here.
     NUM_LOAD_TYPES
@@ -92,10 +93,8 @@
 
   // Whether the |location| is external or not.
   static inline bool IsExternalLocation(Location location) {
-    return location == EXTERNAL_PREF ||
-           location == EXTERNAL_REGISTRY ||
-           location == EXTERNAL_PREF_DOWNLOAD ||
-           location == EXTERNAL_POLICY ||
+    return location == EXTERNAL_PREF || location == EXTERNAL_REGISTRY ||
+           location == EXTERNAL_PREF_DOWNLOAD || location == EXTERNAL_POLICY ||
            location == EXTERNAL_POLICY_DOWNLOAD ||
            location == EXTERNAL_COMPONENT;
   }
@@ -108,15 +107,13 @@
   // Whether extensions with |location| are auto-updatable or not.
   static inline bool IsAutoUpdateableLocation(Location location) {
     // Only internal and external extensions can be autoupdated.
-    return location == INTERNAL ||
-           IsExternalLocation(location);
+    return location == INTERNAL || IsExternalLocation(location);
   }
 
   // Whether the |location| is a source of extensions force-installed through
   // policy.
   static inline bool IsPolicyLocation(Location location) {
-    return location == EXTERNAL_POLICY ||
-           location == EXTERNAL_POLICY_DOWNLOAD;
+    return location == EXTERNAL_POLICY || location == EXTERNAL_POLICY_DOWNLOAD;
   }
 
   // Whether the |location| is an extension intended to be an internal part of
@@ -136,13 +133,21 @@
   }
 
   // Returns the Manifest::Type for the given |value|.
-  static Type GetTypeFromManifestValue(const base::DictionaryValue& value);
+  static Type GetTypeFromManifestValue(const base::DictionaryValue& value,
+                                       bool for_login_screen = false);
 
   // Returns true if an item with the given |location| should always be loaded,
   // even if extensions are otherwise disabled.
   static bool ShouldAlwaysLoadExtension(Manifest::Location location,
                                         bool is_theme);
 
+  // Creates a Manifest for a login screen context. Note that this won't always
+  // result in a Manifest of TYPE_LOGIN_SCREEN_EXTENSION, since other items
+  // (like platform apps) may be installed in the same login screen profile.
+  static std::unique_ptr<Manifest> CreateManifestForLoginScreen(
+      Location location,
+      std::unique_ptr<base::DictionaryValue> value);
+
   Manifest(Location location, std::unique_ptr<base::DictionaryValue> value);
   virtual ~Manifest();
 
@@ -178,6 +183,9 @@
     return type_ == TYPE_LEGACY_PACKAGED_APP;
   }
   bool is_extension() const { return type_ == TYPE_EXTENSION; }
+  bool is_login_screen_extension() const {
+    return type_ == TYPE_LOGIN_SCREEN_EXTENSION;
+  }
   bool is_shared_module() const { return type_ == TYPE_SHARED_MODULE; }
 
   // These access the wrapped manifest value, returning false when the property
@@ -219,6 +227,9 @@
   const base::DictionaryValue* value() const { return value_.get(); }
 
  private:
+  Manifest(Location location,
+           std::unique_ptr<base::DictionaryValue> value,
+           bool for_login_screen);
   // Returns true if the extension can specify the given |path|.
   bool CanAccessPath(const std::string& path) const;
   bool CanAccessPath(const base::span<const base::StringPiece> path) const;
diff --git a/extensions/renderer/BUILD.gn b/extensions/renderer/BUILD.gn
index acdd450..a5a7e0707 100644
--- a/extensions/renderer/BUILD.gn
+++ b/extensions/renderer/BUILD.gn
@@ -182,60 +182,6 @@
     "renderer_extension_registry.h",
     "resource_bundle_source_map.cc",
     "resource_bundle_source_map.h",
-    "resources/app_runtime_custom_bindings.js",
-    "resources/app_window_custom_bindings.js",
-    "resources/automation/automation_custom_bindings.js",
-    "resources/context_menus_custom_bindings.js",
-    "resources/declarative_webrequest_custom_bindings.js",
-    "resources/entry_id_manager.js",
-    "resources/extension.css",
-    "resources/extension_fonts.css",
-    "resources/feedback_private_custom_bindings.js",
-    "resources/file_entry_binding_util.js",
-    "resources/file_system_custom_bindings.js",
-    "resources/greasemonkey_api.js",
-    "resources/guest_view/app_view/app_view.js",
-    "resources/guest_view/app_view/app_view_element.js",
-    "resources/guest_view/extension_options/extension_options.js",
-    "resources/guest_view/extension_options/extension_options_attributes.js",
-    "resources/guest_view/extension_options/extension_options_constants.js",
-    "resources/guest_view/extension_options/extension_options_element.js",
-    "resources/guest_view/extension_options/extension_options_events.js",
-    "resources/guest_view/extension_view/extension_view.js",
-    "resources/guest_view/extension_view/extension_view_api_methods.js",
-    "resources/guest_view/extension_view/extension_view_attributes.js",
-    "resources/guest_view/extension_view/extension_view_constants.js",
-    "resources/guest_view/extension_view/extension_view_element.js",
-    "resources/guest_view/extension_view/extension_view_events.js",
-    "resources/guest_view/extension_view/extension_view_internal.js",
-    "resources/guest_view/guest_view.js",
-    "resources/guest_view/guest_view_attributes.js",
-    "resources/guest_view/guest_view_container.js",
-    "resources/guest_view/guest_view_container_element.js",
-    "resources/guest_view/guest_view_deny.js",
-    "resources/guest_view/guest_view_events.js",
-    "resources/guest_view/guest_view_iframe.js",
-    "resources/guest_view/guest_view_iframe_container.js",
-    "resources/guest_view/safe_methods.js",
-    "resources/guest_view/web_view/extensions_web_view_element.js",
-    "resources/guest_view/web_view/web_view.js",
-    "resources/guest_view/web_view/web_view_action_requests.js",
-    "resources/guest_view/web_view/web_view_api_methods.js",
-    "resources/guest_view/web_view/web_view_attributes.js",
-    "resources/guest_view/web_view/web_view_constants.js",
-    "resources/guest_view/web_view/web_view_element.js",
-    "resources/guest_view/web_view/web_view_events.js",
-    "resources/guest_view/web_view/web_view_internal.js",
-    "resources/guest_view/web_view/web_view_request_custom_bindings.js",
-    "resources/image_util.js",
-    "resources/permissions_custom_bindings.js",
-    "resources/platform_app.css",
-    "resources/platform_app.js",
-    "resources/set_icon.js",
-    "resources/test_custom_bindings.js",
-    "resources/uncaught_exception_handler.js",
-    "resources/utils.js",
-    "resources/web_request_custom_bindings.js",
     "runtime_custom_bindings.cc",
     "runtime_custom_bindings.h",
     "runtime_hooks_delegate.cc",
diff --git a/google_apis/gaia/oauth2_token_service.h b/google_apis/gaia/oauth2_token_service.h
index fedd6f3c..44ac84e 100644
--- a/google_apis/gaia/oauth2_token_service.h
+++ b/google_apis/gaia/oauth2_token_service.h
@@ -20,6 +20,7 @@
 #include "base/observer_list.h"
 #include "base/sequence_checker.h"
 #include "base/time/time.h"
+#include "google_apis/gaia/core_account_id.h"
 #include "google_apis/gaia/google_service_auth_error.h"
 #include "google_apis/gaia/oauth2_access_token_consumer.h"
 #include "google_apis/gaia/oauth2_access_token_fetcher.h"
@@ -130,32 +131,33 @@
   class DiagnosticsObserver {
    public:
     // Called when receiving request for access token.
-    virtual void OnAccessTokenRequested(const std::string& account_id,
+    virtual void OnAccessTokenRequested(const CoreAccountId& account_id,
                                         const std::string& consumer_id,
                                         const ScopeSet& scopes) {}
     // Called when access token fetching finished successfully or
     // unsuccessfully. |expiration_time| are only valid with
     // successful completion.
-    virtual void OnFetchAccessTokenComplete(const std::string& account_id,
+    virtual void OnFetchAccessTokenComplete(const CoreAccountId& account_id,
                                             const std::string& consumer_id,
                                             const ScopeSet& scopes,
                                             GoogleServiceAuthError error,
                                             base::Time expiration_time) {}
     // Called when an access token was removed.
-    virtual void OnAccessTokenRemoved(const std::string& account_id,
+    virtual void OnAccessTokenRemoved(const CoreAccountId& account_id,
                                       const ScopeSet& scopes) {}
 
     // Caled when a new refresh token is available. Contains diagnostic
     // information about the source of the update credentials operation.
     virtual void OnRefreshTokenAvailableFromSource(
-        const std::string& account_id,
+        const CoreAccountId& account_id,
         bool is_refresh_token_valid,
         const std::string& source) {}
 
     // Called when a refreh token is revoked. Contains diagnostic information
     // about the source that initiated the revokation operation.
-    virtual void OnRefreshTokenRevokedFromSource(const std::string& account_id,
-                                                 const std::string& source) {}
+    virtual void OnRefreshTokenRevokedFromSource(
+        const CoreAccountId& account_id,
+        const std::string& source) {}
   };
 
   explicit OAuth2TokenService(
diff --git a/headless/BUILD.gn b/headless/BUILD.gn
index d127356c2..97635c17 100644
--- a/headless/BUILD.gn
+++ b/headless/BUILD.gn
@@ -492,7 +492,7 @@
   # use external v8 startup data too.
   if ((is_win && is_component_build) || !is_win) {
     if (v8_use_external_startup_data) {
-      sources += [ "$root_out_dir/natives_blob.bin" ]
+      data += [ "$root_out_dir/natives_blob.bin" ]
       public_deps += [ "//v8" ]
       if (use_v8_context_snapshot) {
         data += [ "$root_out_dir/v8_context_snapshot.bin" ]
diff --git a/ios/chrome/app/main_controller.mm b/ios/chrome/app/main_controller.mm
index 6735c18..9d39f98 100644
--- a/ios/chrome/app/main_controller.mm
+++ b/ios/chrome/app/main_controller.mm
@@ -1701,7 +1701,6 @@
   }
   _settingsNavigationController =
       [SettingsNavigationController newSyncController:_mainBrowserState
-                               allowSwitchSyncAccount:YES
                                              delegate:self];
   [baseViewController presentViewController:_settingsNavigationController
                                    animated:YES
diff --git a/ios/chrome/app/spotlight/spotlight_manager_unittest.mm b/ios/chrome/app/spotlight/spotlight_manager_unittest.mm
index 2f62642..473da51a 100644
--- a/ios/chrome/app/spotlight/spotlight_manager_unittest.mm
+++ b/ios/chrome/app/spotlight/spotlight_manager_unittest.mm
@@ -33,7 +33,6 @@
 #error "This file requires ARC support."
 #endif
 
-using favicon::PostReply;
 using testing::_;
 
 const char kDummyIconUrl[] = "http://www.example.com/touch_icon.png";
@@ -73,7 +72,13 @@
 
     EXPECT_CALL(mock_favicon_service_,
                 GetLargestRawFaviconForPageURL(_, _, _, _, _))
-        .WillRepeatedly(PostReply<5>(CreateTestBitmap(24, 24)));
+        .WillRepeatedly([](auto, auto, auto,
+                           favicon_base::FaviconRawBitmapCallback callback,
+                           base::CancelableTaskTracker* tracker) {
+          return tracker->PostTask(
+              base::ThreadTaskRunnerHandle::Get().get(), FROM_HERE,
+              base::BindOnce(std::move(callback), CreateTestBitmap(24, 24)));
+        });
   }
 
   ~SpotlightManagerTest() override { [bookmarksSpotlightManager_ shutdown]; }
diff --git a/ios/chrome/browser/bookmarks/bookmark_client_impl.cc b/ios/chrome/browser/bookmarks/bookmark_client_impl.cc
index e551e0b..5ba4d5ec 100644
--- a/ios/chrome/browser/bookmarks/bookmark_client_impl.cc
+++ b/ios/chrome/browser/bookmarks/bookmark_client_impl.cc
@@ -38,12 +38,12 @@
 BookmarkClientImpl::GetFaviconImageForPageURL(
     const GURL& page_url,
     favicon_base::IconType type,
-    const favicon_base::FaviconImageCallback& callback,
+    favicon_base::FaviconImageCallback callback,
     base::CancelableTaskTracker* tracker) {
   return favicon::GetFaviconImageForPageURL(
       ios::FaviconServiceFactory::GetForBrowserState(
           browser_state_, ServiceAccessType::EXPLICIT_ACCESS),
-      page_url, type, callback, tracker);
+      page_url, type, std::move(callback), tracker);
 }
 
 bool BookmarkClientImpl::SupportsTypedCountForUrls() {
diff --git a/ios/chrome/browser/bookmarks/bookmark_client_impl.h b/ios/chrome/browser/bookmarks/bookmark_client_impl.h
index 170b78d..5d3236e 100644
--- a/ios/chrome/browser/bookmarks/bookmark_client_impl.h
+++ b/ios/chrome/browser/bookmarks/bookmark_client_impl.h
@@ -41,7 +41,7 @@
   base::CancelableTaskTracker::TaskId GetFaviconImageForPageURL(
       const GURL& page_url,
       favicon_base::IconType type,
-      const favicon_base::FaviconImageCallback& callback,
+      favicon_base::FaviconImageCallback callback,
       base::CancelableTaskTracker* tracker) override;
   bool SupportsTypedCountForUrls() override;
   void GetTypedCountForUrls(UrlTypedCountMap* url_typed_count_map) override;
diff --git a/ios/chrome/browser/favicon/favicon_client_impl.h b/ios/chrome/browser/favicon/favicon_client_impl.h
index 0680303..f9ad125 100644
--- a/ios/chrome/browser/favicon/favicon_client_impl.h
+++ b/ios/chrome/browser/favicon/favicon_client_impl.h
@@ -26,7 +26,7 @@
   base::CancelableTaskTracker::TaskId GetFaviconForNativeApplicationURL(
       const GURL& url,
       const std::vector<int>& desired_sizes_in_pixel,
-      const favicon_base::FaviconResultsCallback& callback,
+      favicon_base::FaviconResultsCallback callback,
       base::CancelableTaskTracker* tracker) override;
 
   DISALLOW_COPY_AND_ASSIGN(FaviconClientImpl);
diff --git a/ios/chrome/browser/favicon/favicon_client_impl.mm b/ios/chrome/browser/favicon/favicon_client_impl.mm
index 0379124..fbbfdc766 100644
--- a/ios/chrome/browser/favicon/favicon_client_impl.mm
+++ b/ios/chrome/browser/favicon/favicon_client_impl.mm
@@ -87,18 +87,16 @@
 FaviconClientImpl::GetFaviconForNativeApplicationURL(
     const GURL& url,
     const std::vector<int>& desired_sizes_in_pixel,
-    const favicon_base::FaviconResultsCallback& callback,
+    favicon_base::FaviconResultsCallback callback,
     base::CancelableTaskTracker* tracker) {
   DCHECK(tracker);
   DCHECK(IsNativeApplicationURL(url));
 
-  auto favicon_bitmap_results =
-      std::make_unique<std::vector<favicon_base::FaviconRawBitmapResult>>();
+  std::vector<favicon_base::FaviconRawBitmapResult> favicon_bitmap_results;
   GetFaviconBitmapForNativeURL(url, desired_sizes_in_pixel,
-                               favicon_bitmap_results.get());
+                               &favicon_bitmap_results);
 
   return tracker->PostTask(
       base::ThreadTaskRunnerHandle::Get().get(), FROM_HERE,
-      base::Bind(&favicon::FaviconService::FaviconResultsCallbackRunner,
-                 callback, base::Owned(favicon_bitmap_results.release())));
+      base::BindOnce(std::move(callback), std::move(favicon_bitmap_results)));
 }
diff --git a/ios/chrome/browser/favicon/favicon_loader_unittest.mm b/ios/chrome/browser/favicon/favicon_loader_unittest.mm
index df3b375..58dfeca 100644
--- a/ios/chrome/browser/favicon/favicon_loader_unittest.mm
+++ b/ios/chrome/browser/favicon/favicon_loader_unittest.mm
@@ -48,7 +48,7 @@
       const GURL& page_url,
       int min_source_size_in_pixel,
       int desired_size_in_pixel,
-      const favicon_base::LargeIconCallback& callback,
+      favicon_base::LargeIconCallback callback,
       base::CancelableTaskTracker* tracker) override {
     if (page_url.spec() == kTestFaviconURL) {
       favicon_base::FaviconRawBitmapResult bitmapResult;
@@ -62,13 +62,13 @@
       bitmapResult.bitmap_data = data;
 
       favicon_base::LargeIconResult result(bitmapResult);
-      callback.Run(result);
+      std::move(callback).Run(result);
     } else {
       favicon_base::FallbackIconStyle* fallback =
           new favicon_base::FallbackIconStyle();
       favicon_base::LargeIconResult result(fallback);
       fallback = NULL;
-      callback.Run(result);
+      std::move(callback).Run(result);
     }
 
     return 1;
@@ -80,11 +80,11 @@
       const GURL& icon_url,
       int min_source_size_in_pixel,
       int desired_size_in_pixel,
-      const favicon_base::LargeIconCallback& callback,
+      favicon_base::LargeIconCallback callback,
       base::CancelableTaskTracker* tracker) override {
     return GetLargeIconRawBitmapOrFallbackStyleForPageUrl(
-        icon_url, min_source_size_in_pixel, desired_size_in_pixel, callback,
-        tracker);
+        icon_url, min_source_size_in_pixel, desired_size_in_pixel,
+        std::move(callback), tracker);
   }
 };
 
diff --git a/ios/chrome/browser/passwords/ios_chrome_update_password_infobar_delegate.mm b/ios/chrome/browser/passwords/ios_chrome_update_password_infobar_delegate.mm
index 9a8b416..ca510471 100644
--- a/ios/chrome/browser/passwords/ios_chrome_update_password_infobar_delegate.mm
+++ b/ios/chrome/browser/passwords/ios_chrome_update_password_infobar_delegate.mm
@@ -64,6 +64,8 @@
   form_to_save()->GetMetricsRecorder()->RecordPasswordBubbleShown(
       form_to_save()->GetCredentialSource(),
       password_manager::metrics_util::AUTOMATIC_WITH_PASSWORD_PENDING_UPDATE);
+  password_manager::metrics_util::LogUIDisplayDisposition(
+      password_manager::metrics_util::AUTOMATIC_WITH_PASSWORD_PENDING_UPDATE);
 }
 
 bool IOSChromeUpdatePasswordInfoBarDelegate::ShowMultipleAccounts() const {
diff --git a/ios/chrome/browser/prerender/preload_controller.mm b/ios/chrome/browser/prerender/preload_controller.mm
index a0a6e32..814c1d4 100644
--- a/ios/chrome/browser/prerender/preload_controller.mm
+++ b/ios/chrome/browser/prerender/preload_controller.mm
@@ -30,6 +30,7 @@
 #import "ios/web/public/navigation_item.h"
 #import "ios/web/public/navigation_manager.h"
 #import "ios/web/public/web_state/ui/crw_native_content.h"
+#import "ios/web/public/web_state/ui/crw_native_content_holder.h"
 #import "ios/web/public/web_state/web_state.h"
 #include "ios/web/public/web_state/web_state_observer_bridge.h"
 #import "ios/web/public/web_state/web_state_policy_decider_bridge.h"
@@ -277,7 +278,7 @@
   DCHECK(![self isWebStatePrerendered:webState.get()]);
 
   Tab* tab = LegacyTabHelper::GetTabForWebState(webState.get());
-  [[tab webController] setNativeProvider:nil];
+  [tab.webController nativeContentHolder].nativeProvider = nil;
 
   webState->RemoveObserver(webStateObserver_.get());
   breakpad::StopMonitoringURLsForWebState(webState.get());
@@ -403,7 +404,7 @@
   Tab* tab = LegacyTabHelper::GetTabForWebState(webState_.get());
   DCHECK(tab);
 
-  [[tab webController] setNativeProvider:self];
+  [tab.webController nativeContentHolder].nativeProvider = nil;
 
   webState_->SetDelegate(webStateDelegate_.get());
   webState_->AddObserver(webStateObserver_.get());
@@ -448,7 +449,7 @@
                             PRERENDER_FINAL_STATUS_MAX);
 
   Tab* tab = LegacyTabHelper::GetTabForWebState(webState_.get());
-  [[tab webController] setNativeProvider:nil];
+  [tab.webController nativeContentHolder].nativeProvider = nil;
   webState_->RemoveObserver(webStateObserver_.get());
   breakpad::StopMonitoringURLsForWebState(webState_.get());
   webState_->SetDelegate(nullptr);
diff --git a/ios/chrome/browser/sync/consent_auditor_factory.cc b/ios/chrome/browser/sync/consent_auditor_factory.cc
index 16839f6..d463e11 100644
--- a/ios/chrome/browser/sync/consent_auditor_factory.cc
+++ b/ios/chrome/browser/sync/consent_auditor_factory.cc
@@ -89,10 +89,6 @@
       base::DefaultClock::GetInstance());
 }
 
-bool ConsentAuditorFactory::ServiceIsNULLWhileTesting() const {
-  return true;
-}
-
 void ConsentAuditorFactory::RegisterBrowserStatePrefs(
     user_prefs::PrefRegistrySyncable* registry) {
   consent_auditor::ConsentAuditorImpl::RegisterProfilePrefs(registry);
diff --git a/ios/chrome/browser/sync/consent_auditor_factory.h b/ios/chrome/browser/sync/consent_auditor_factory.h
index 7caad14..30dae8e 100644
--- a/ios/chrome/browser/sync/consent_auditor_factory.h
+++ b/ios/chrome/browser/sync/consent_auditor_factory.h
@@ -41,7 +41,6 @@
   // BrowserStateKeyedServiceFactory implementation.
   std::unique_ptr<KeyedService> BuildServiceInstanceFor(
       web::BrowserState* context) const override;
-  bool ServiceIsNULLWhileTesting() const override;
   void RegisterBrowserStatePrefs(
       user_prefs::PrefRegistrySyncable* registry) override;
 
diff --git a/ios/chrome/browser/ui/browser_view/browser_view_controller.mm b/ios/chrome/browser/ui/browser_view/browser_view_controller.mm
index 17650d8a..b6d9c7e 100644
--- a/ios/chrome/browser/ui/browser_view/browser_view_controller.mm
+++ b/ios/chrome/browser/ui/browser_view/browser_view_controller.mm
@@ -210,6 +210,7 @@
 #import "ios/web/public/web_state/context_menu_params.h"
 #import "ios/web/public/web_state/js/crw_js_injection_receiver.h"
 #import "ios/web/public/web_state/navigation_context.h"
+#import "ios/web/public/web_state/ui/crw_native_content_holder.h"
 #import "ios/web/public/web_state/ui/crw_native_content_provider.h"
 #import "ios/web/public/web_state/ui/crw_web_view_proxy.h"
 #import "ios/web/public/web_state/ui/crw_web_view_scroll_view_proxy.h"
@@ -2741,7 +2742,7 @@
   Tab* tab = LegacyTabHelper::GetTabForWebState(webState);
 
   // Install the proper CRWWebController delegates.
-  tab.webController.nativeProvider = self;
+  [tab.webController nativeContentHolder].nativeProvider = self;
   tab.webController.swipeRecognizerProvider = self.sideSwipeController;
   tab.webState->SetDelegate(_webStateDelegate.get());
   SadTabTabHelper::FromWebState(webState)->SetDelegate(_sadTabCoordinator);
@@ -2795,7 +2796,7 @@
   // TODO(crbug.com/960950): Remove this once webController is moved out of tab.
   Tab* tab = LegacyTabHelper::GetTabForWebState(webState);
 
-  tab.webController.nativeProvider = nil;
+  [tab.webController nativeContentHolder].nativeProvider = nil;
   tab.webController.swipeRecognizerProvider = nil;
   webState->SetDelegate(nullptr);
   if (AccountConsistencyService* accountConsistencyService =
@@ -2834,7 +2835,8 @@
 }
 
 - (id)nativeControllerForTab:(Tab*)tab {
-  id nativeController = tab.webController.nativeController;
+  id nativeController =
+      [tab.webController nativeContentHolder].nativeController;
   return nativeController ? nativeController : _temporaryNativeController;
 }
 
@@ -3649,7 +3651,7 @@
   Tab* currentTab = self.tabModel.currentTab;
   if (!self.currentWebState ||
       self.currentWebState->GetLastCommittedURL() != url ||
-      [currentTab.webController.nativeController
+      [[currentTab.webController nativeContentHolder].nativeController
           isKindOfClass:[nativeController class]]) {
     _temporaryNativeController = nativeController;
   }
diff --git a/ios/chrome/browser/ui/infobars/banners/infobar_banner_view_controller.mm b/ios/chrome/browser/ui/infobars/banners/infobar_banner_view_controller.mm
index a444db3..0cbbd5b1 100644
--- a/ios/chrome/browser/ui/infobars/banners/infobar_banner_view_controller.mm
+++ b/ios/chrome/browser/ui/infobars/banners/infobar_banner_view_controller.mm
@@ -42,6 +42,7 @@
 const CGFloat kButtonWidth = 100.0;
 const CGFloat kButtonSeparatorWidth = 1.0;
 const int kButtonSeparatorColor = 0xF1F3F4;
+const CGFloat kButtonMaxFontSize = 45;
 
 // Container Stack constants.
 const CGFloat kContainerStackSpacing = 18.0;
@@ -152,8 +153,10 @@
   // Button setup.
   self.infobarButton = [UIButton buttonWithType:UIButtonTypeSystem];
   [self.infobarButton setTitle:self.buttonText forState:UIControlStateNormal];
-  self.infobarButton.titleLabel.font =
-      [UIFont preferredFontForTextStyle:UIFontTextStyleHeadline];
+  self.infobarButton.titleLabel.font = [[UIFontMetrics defaultMetrics]
+      scaledFontForFont:[UIFont
+                            preferredFontForTextStyle:UIFontTextStyleHeadline]
+       maximumPointSize:kButtonMaxFontSize];
   [self.infobarButton addTarget:self
                          action:@selector(bannerInfobarButtonWasPressed:)
                forControlEvents:UIControlEventTouchUpInside];
@@ -177,6 +180,7 @@
   containerStack.layoutMarginsRelativeArrangement = YES;
   containerStack.directionalLayoutMargins = NSDirectionalEdgeInsetsMake(
       kContainerStackVerticalPadding, 0, kContainerStackVerticalPadding, 0);
+  containerStack.insetsLayoutMarginsFromSafeArea = NO;
   [self.view addSubview:containerStack];
 
   // Constraints setup.
diff --git a/ios/chrome/browser/ui/omnibox/omnibox_consumer.h b/ios/chrome/browser/ui/omnibox/omnibox_consumer.h
index 7bfbaea3..261efa8 100644
--- a/ios/chrome/browser/ui/omnibox/omnibox_consumer.h
+++ b/ios/chrome/browser/ui/omnibox/omnibox_consumer.h
@@ -17,6 +17,10 @@
 // changes. (This is usually when the default search engine changes).
 - (void)updateSearchByImageSupported:(BOOL)searchByImageSupported;
 
+// Notifies the consumer to set the following image as an image
+// in an omnibox with empty text
+- (void)setEmptyTextLeadingImage:(UIImage*)icon;
+
 @end
 
 #endif  // IOS_CHROME_BROWSER_UI_OMNIBOX_OMNIBOX_CONSUMER_H_
diff --git a/ios/chrome/browser/ui/omnibox/omnibox_coordinator.mm b/ios/chrome/browser/ui/omnibox/omnibox_coordinator.mm
index 6b329447..ce4893b 100644
--- a/ios/chrome/browser/ui/omnibox/omnibox_coordinator.mm
+++ b/ios/chrome/browser/ui/omnibox/omnibox_coordinator.mm
@@ -65,7 +65,6 @@
 
   self.viewController.defaultLeadingImage =
       GetOmniboxSuggestionIcon(DEFAULT_FAVICON);
-  self.viewController.emptyTextLeadingImage = GetOmniboxSuggestionIcon(SEARCH);
   self.viewController.dispatcher =
       static_cast<id<BrowserCommands, LoadQueryCommands, OmniboxFocuser>>(
           self.dispatcher);
diff --git a/ios/chrome/browser/ui/omnibox/omnibox_mediator.mm b/ios/chrome/browser/ui/omnibox/omnibox_mediator.mm
index 7b83642e..dff27a4 100644
--- a/ios/chrome/browser/ui/omnibox/omnibox_mediator.mm
+++ b/ios/chrome/browser/ui/omnibox/omnibox_mediator.mm
@@ -30,6 +30,8 @@
 
 // The latest URL used to fetch the favicon.
 @property(nonatomic, assign) GURL latestFaviconURL;
+// The latest URL used to fetch the default search engine favicon.
+@property(nonatomic, assign) const TemplateURL* latestDefaultSearchEngine;
 
 @end
 
@@ -51,6 +53,22 @@
   _consumer = consumer;
   [consumer
       updateSearchByImageSupported:self.searchEngineSupportsSearchByImage];
+
+  if (base::FeatureList::IsEnabled(kNewOmniboxPopupLayout)) {
+    // Show Default Search Engine favicon.
+    // Remember what is the Default Search Engine provider that the icon is for,
+    // in case the user changes Default Search Engine while this is being
+    // loaded.
+    __weak OmniboxMediator* weakSelf = self;
+    const TemplateURL* defaultSearchEngine =
+        _templateURLService->GetDefaultSearchProvider();
+    self.latestDefaultSearchEngine = defaultSearchEngine;
+    [self loadDefaultSearchEngineFaviconWithCompletion:^(UIImage* image) {
+      if (weakSelf.latestDefaultSearchEngine == defaultSearchEngine) {
+        [weakSelf.consumer setEmptyTextLeadingImage:image];
+      }
+    }];
+  }
 }
 
 - (void)setTemplateURLService:(TemplateURLService*)templateURLService {
@@ -90,60 +108,108 @@
       matchType, /* is_starred */ false);
   [self.consumer updateAutocompleteIcon:image];
 
-  if (!base::FeatureList::IsEnabled(kNewOmniboxPopupLayout)) {
-    return;
+  if (base::FeatureList::IsEnabled(kNewOmniboxPopupLayout)) {
+    __weak OmniboxMediator* weakSelf = self;
+    if (AutocompleteMatch::IsSearchType(matchType)) {
+      // Show Default Search Engine favicon.
+      // Remember what is the Default Search Engine provider that the icon is
+      // for, in case the user changes Default Search Engine while this is being
+      // loaded.
+      const TemplateURL* defaultSearchEngine =
+          _templateURLService->GetDefaultSearchProvider();
+      self.latestDefaultSearchEngine = defaultSearchEngine;
+      [self loadDefaultSearchEngineFaviconWithCompletion:^(UIImage* image) {
+        if (weakSelf.latestDefaultSearchEngine == defaultSearchEngine) {
+          [weakSelf.consumer updateAutocompleteIcon:image];
+        }
+      }];
+    } else {
+      // Show favicon.
+      // Remember which favicon is loaded in case we start loading a new one
+      // before this one completes.
+      self.latestFaviconURL = faviconURL;
+      [self loadFaviconByPageURL:faviconURL
+                      completion:^(UIImage* image) {
+                        if (weakSelf.latestFaviconURL == faviconURL) {
+                          [weakSelf.consumer updateAutocompleteIcon:image];
+                        }
+                      }];
+    }
   }
+}
 
+// Loads a favicon for a given page URL.
+// |pageURL| is url for the page that needs a favicon
+// |completion| handler might be called multiple
+// times, synchronously and asynchronously. It will always be called on the main
+// thread.
+- (void)loadFaviconByPageURL:(GURL)pageURL
+                  completion:(void (^)(UIImage* image))completion {
   // Can't load favicons without a favicon loader.
   DCHECK(self.faviconLoader);
 
-  BOOL showsDefaultSearchEngineFavicon =
-      base::FeatureList::IsEnabled(kOmniboxUseDefaultSearchEngineFavicon) &&
-      AutocompleteMatch::IsSearchType(matchType);
-
-  const TemplateURL* default_provider =
-      _templateURLService->GetDefaultSearchProvider();
-  // Prepopulated search engines use empty search URL for favicon retrieval;
-  // custom search engines use a direct favicon URL.
-  BOOL shouldUseFaviconURL = default_provider->prepopulate_id() == 0;
-
-  if (showsDefaultSearchEngineFavicon) {
-    if (shouldUseFaviconURL) {
-      faviconURL = default_provider->favicon_url();
-    } else {
-      // Fake up a page URL for favicons of prepopulated search engines, since
-      // favicons may be fetched from Google server which doesn't suppoprt
-      // icon URL.
-      std::string emptyPageUrl = default_provider->url_ref().ReplaceSearchTerms(
-          TemplateURLRef::SearchTermsArgs(base::string16()),
-          _templateURLService->search_terms_data());
-      faviconURL = GURL(emptyPageUrl);
+  auto handleFaviconResult = ^void(FaviconAttributes* faviconCacheResult) {
+    if (faviconCacheResult.faviconImage &&
+        !faviconCacheResult.usesDefaultImage) {
+      if (completion) {
+        completion(faviconCacheResult.faviconImage);
+      }
     }
-  }
-
-  __weak OmniboxMediator* weakSelf = self;
-
-  auto useFaviconAttributes = ^void(FaviconAttributes* attributes) {
-    if (attributes.faviconImage && !attributes.usesDefaultImage &&
-        weakSelf.latestFaviconURL == faviconURL)
-      [weakSelf.consumer updateAutocompleteIcon:attributes.faviconImage];
   };
 
   // Remember the last request URL to avoid showing favicons for past requests.
-  self.latestFaviconURL = faviconURL;
+  self.latestFaviconURL = pageURL;
   // Download the favicon.
   // The code below mimics that in OmniboxPopupMediator.
-  FaviconAttributes* cachedAttributes = nil;
-  if (shouldUseFaviconURL) {
-    cachedAttributes = self.faviconLoader->FaviconForIconUrl(
-        faviconURL, kOmniboxIconSize, kOmniboxIconSize, useFaviconAttributes);
-  } else {
-    cachedAttributes = self.faviconLoader->FaviconForPageUrl(
-        faviconURL, kOmniboxIconSize, kOmniboxIconSize,
-        /*fallback_to_google_server=*/YES, useFaviconAttributes);
+  FaviconAttributes* faviconCacheResult = self.faviconLoader->FaviconForPageUrl(
+      pageURL, kOmniboxIconSize, kOmniboxIconSize,
+      /*fallback_to_google_server=*/YES, handleFaviconResult);
+  // Handle the synchronously returned cache result. If the favicon loader did
+  // an async fetch, |handleFaviconResult| may be called again later.
+  handleFaviconResult(faviconCacheResult);
+}
+
+// Loads a favicon for the current default search engine.
+// |completion| handler might be called multiple times, synchronously
+// and asynchronously. It will always be called on the main
+// thread.
+- (void)loadDefaultSearchEngineFaviconWithCompletion:
+    (void (^)(UIImage* image))completion {
+  // Can't load favicons without a favicon loader.
+  DCHECK(self.faviconLoader);
+  DCHECK(base::FeatureList::IsEnabled(kOmniboxUseDefaultSearchEngineFavicon));
+
+  const TemplateURL* defaultProvider =
+      _templateURLService->GetDefaultSearchProvider();
+
+  // Prepopulated search engines don't have a favicon URL, so the favicon is
+  // loaded with an empty query search page URL.
+  if (defaultProvider->prepopulate_id() != 0) {
+    // Fake up a page URL for favicons of prepopulated search engines, since
+    // favicons may be fetched from Google server which doesn't suppoprt
+    // icon URL.
+    std::string emptyPageUrl = defaultProvider->url_ref().ReplaceSearchTerms(
+        TemplateURLRef::SearchTermsArgs(base::string16()),
+        _templateURLService->search_terms_data());
+    [self loadFaviconByPageURL:GURL(emptyPageUrl) completion:completion];
+    return;
   }
 
-  useFaviconAttributes(cachedAttributes);
+  auto handleFaviconResult = ^void(FaviconAttributes* faviconCacheResult) {
+    if (faviconCacheResult.faviconImage &&
+        !faviconCacheResult.usesDefaultImage) {
+      if (completion) {
+        completion(faviconCacheResult.faviconImage);
+      }
+    }
+  };
+
+  // Download the favicon.
+  // The code below mimics that in OmniboxPopupMediator.
+  FaviconAttributes* faviconCacheResult = self.faviconLoader->FaviconForIconUrl(
+      defaultProvider->favicon_url(), kOmniboxIconSize, kOmniboxIconSize,
+      handleFaviconResult);
+  handleFaviconResult(faviconCacheResult);
 }
 
 @end
diff --git a/ios/chrome/browser/ui/reading_list/offline_page_native_content.mm b/ios/chrome/browser/ui/reading_list/offline_page_native_content.mm
index 55998688..604e57d 100644
--- a/ios/chrome/browser/ui/reading_list/offline_page_native_content.mm
+++ b/ios/chrome/browser/ui/reading_list/offline_page_native_content.mm
@@ -77,7 +77,7 @@
   [super close];
 }
 
-- (GURL)virtualURL {
+- (const GURL&)virtualURL {
   return _virtualURL;
 }
 
diff --git a/ios/chrome/browser/ui/reading_list/reading_list_mediator_unittest.mm b/ios/chrome/browser/ui/reading_list/reading_list_mediator_unittest.mm
index 3f8d306..8284469 100644
--- a/ios/chrome/browser/ui/reading_list/reading_list_mediator_unittest.mm
+++ b/ios/chrome/browser/ui/reading_list/reading_list_mediator_unittest.mm
@@ -48,8 +48,14 @@
     model_ = std::make_unique<ReadingListModelImpl>(nullptr, nullptr, &clock_);
     EXPECT_CALL(mock_favicon_service_,
                 GetLargestRawFaviconForPageURL(_, _, _, _, _))
-        .WillRepeatedly(
-            favicon::PostReply<5>(favicon_base::FaviconRawBitmapResult()));
+        .WillRepeatedly([](auto, auto, auto,
+                           favicon_base::FaviconRawBitmapCallback callback,
+                           base::CancelableTaskTracker* tracker) {
+          return tracker->PostTask(
+              base::ThreadTaskRunnerHandle::Get().get(), FROM_HERE,
+              base::BindOnce(std::move(callback),
+                             favicon_base::FaviconRawBitmapResult()));
+        });
 
     no_title_entry_url_ = GURL("http://chromium.org/unread3");
     // The first 3 have the same update time on purpose.
diff --git a/ios/chrome/browser/ui/settings/add_language_table_view_controller.mm b/ios/chrome/browser/ui/settings/add_language_table_view_controller.mm
index 5ebf0252..254f18a 100644
--- a/ios/chrome/browser/ui/settings/add_language_table_view_controller.mm
+++ b/ios/chrome/browser/ui/settings/add_language_table_view_controller.mm
@@ -8,8 +8,10 @@
 #import "ios/chrome/browser/ui/list_model/list_item+Controller.h"
 #import "ios/chrome/browser/ui/settings/cells/language_item.h"
 #import "ios/chrome/browser/ui/settings/language_settings_data_source.h"
+#import "ios/chrome/browser/ui/table_view/table_view_navigation_controller_constants.h"
 #include "ios/chrome/browser/ui/ui_feature_flags.h"
 #import "ios/chrome/browser/ui/util/uikit_ui_util.h"
+#import "ios/chrome/common/ui_util/constraints_ui_util.h"
 #include "ios/chrome/grit/ios_strings.h"
 #include "ui/base/l10n/l10n_util_mac.h"
 
@@ -20,7 +22,11 @@
 namespace {
 
 NSString* const kAddLanguageTableViewAccessibilityIdentifier =
-    @"add_language_table_view";
+    @"kAddLanguageTableViewAccessibilityIdentifier";
+NSString* const kAddLanguageSearchControllerAccessibilityIdentifier =
+    @"kAddLanguageSearchControllerAccessibilityIdentifier";
+NSString* const kAddLanguageSearchScrimAccessibilityIdentifier =
+    @"kAddLanguageSearchScrimAccessibilityIdentifier";
 
 typedef NS_ENUM(NSInteger, SectionIdentifier) {
   SectionIdentifierLanguages = kSectionIdentifierEnumZero,
@@ -32,7 +38,7 @@
 
 }  // namespace
 
-@interface AddLanguageTableViewController ()
+@interface AddLanguageTableViewController () <UISearchResultsUpdating>
 
 // The data source passed to this instance.
 @property(nonatomic, strong) id<LanguageSettingsDataSource> dataSource;
@@ -40,6 +46,18 @@
 // The delegate passed to this instance.
 @property(nonatomic, weak) id<AddLanguageTableViewControllerDelegate> delegate;
 
+// This ViewController's search controller.
+@property(nonatomic, strong) UISearchController* searchController;
+
+// The list of supported languages fetched from the data source.
+@property(nonatomic, strong) NSArray<LanguageItem*>* supportedLanguages;
+
+// The current search filter. May be nil.
+@property(nonatomic, strong) NSPredicate* searchPredicate;
+
+// Scrim overlay covering the entire tableView when the search bar is focused.
+@property(nonatomic, strong) UIControl* scrimView;
+
 @end
 
 @implementation AddLanguageTableViewController
@@ -72,16 +90,72 @@
   self.tableView.accessibilityIdentifier =
       kAddLanguageTableViewAccessibilityIdentifier;
 
+  // Search controller.
+  self.searchController =
+      [[UISearchController alloc] initWithSearchResultsController:nil];
+  self.searchController.dimsBackgroundDuringPresentation = NO;
+  self.searchController.searchResultsUpdater = self;
+  self.searchController.searchBar.accessibilityIdentifier =
+      kAddLanguageSearchControllerAccessibilityIdentifier;
+  // Presentation of searchController will walk up the view controller hierarchy
+  // until it finds the root view controller or one that defines a presentation
+  // context. Make this view controller the presentation context so that the
+  // searchController does not present on top of the navigation controller.
+  self.definesPresentationContext = YES;
+  // Place the search bar in the navigation bar.
+  self.navigationItem.searchController = self.searchController;
+  self.navigationItem.hidesSearchBarWhenScrolling = NO;
+  // Center the search bar vertically so it looks centered in the header when
+  // searching in iPad and in landscape mode.
+  self.searchController.searchBar.searchFieldBackgroundPositionAdjustment =
+      UIOffsetMake(0.0f, kTableViewNavigationVerticalOffsetForSearchHeader);
+
+  // Scrim.
+  self.scrimView = [[UIControl alloc] init];
+  self.scrimView.alpha = 0.0f;
+  self.scrimView.backgroundColor =
+      [UIColor colorWithWhite:0
+                        alpha:kTableViewNavigationWhiteAlphaForSearchScrim];
+  self.scrimView.translatesAutoresizingMaskIntoConstraints = NO;
+  self.scrimView.accessibilityIdentifier =
+      kAddLanguageSearchScrimAccessibilityIdentifier;
+  [self.scrimView addTarget:self
+                     action:@selector(dismissSearchController:)
+           forControlEvents:UIControlEventTouchUpInside];
+
   [self loadModel];
 }
 
+- (void)viewWillAppear:(BOOL)animated {
+  [super viewWillAppear:animated];
+
+  // Center search bar's cancel button vertically so it looks centered in the
+  // header when searching in iPad and in landscape mode.
+  UIOffset offset =
+      UIOffsetMake(0.0f, kTableViewNavigationVerticalOffsetForSearchHeader);
+  UIBarButtonItem* cancelButton = [UIBarButtonItem
+      appearanceWhenContainedInInstancesOfClasses:@ [[UISearchBar class]]];
+  [cancelButton setTitlePositionAdjustment:offset
+                             forBarMetrics:UIBarMetricsDefault];
+}
+
+- (void)viewWillDisappear:(BOOL)animated {
+  [super viewWillDisappear:animated];
+
+  // Restore the origin offset for the cancel button proxy style to default.
+  UIBarButtonItem* cancelButton = [UIBarButtonItem
+      appearanceWhenContainedInInstancesOfClasses:@ [[UISearchBar class]]];
+  [cancelButton setTitlePositionAdjustment:UIOffsetZero
+                             forBarMetrics:UIBarMetricsDefault];
+}
+
 #pragma mark - ChromeTableViewController
 
 - (void)loadModel {
   [super loadModel];
 
   [self.tableViewModel addSectionWithIdentifier:SectionIdentifierLanguages];
-  [self populateLanguagesSection];
+  [self populateLanguagesSectionFromDataSource:YES];
 }
 
 #pragma mark - UITableViewDelegate
@@ -95,20 +169,60 @@
                           didSelectLanguageCode:languageItem.languageCode];
 }
 
+#pragma mark - UISearchResultsUpdating
+
+- (void)updateSearchResultsForSearchController:
+    (UISearchController*)searchController {
+  NSString* searchText = searchController.searchBar.text;
+
+  // Set the current search filter to filter the languages based on the display
+  // name of the language in the current locale and the language locale. The
+  // search is case insensitive and diacritic insensitive. If the search text is
+  // empty all languages will be displayed.
+  self.searchPredicate = [[NSPredicate
+      predicateWithFormat:@"$searchText.length == 0 OR text CONTAINS[cd] "
+                          @"$searchText OR leadingDetailText "
+                          @"CONTAINS[cd] $searchText"]
+      predicateWithSubstitutionVariables:@{@"searchText" : searchText}];
+
+  // Show the scrim overlay only if the search text is empty and the search
+  // controller is active (it is not being dismissed); Otherwise hide it.
+  if (searchText.length == 0 && self.searchController.active) {
+    [self showScrim];
+  } else {
+    [self hideScrim];
+  }
+
+  [self updateLanguagesSectionFromDataSource:NO];
+}
+
 #pragma mark - Public methods
 
 - (void)supportedLanguagesListChanged {
   // Update the model and the table view.
-  [self updateLanguagesSection];
+  [self updateLanguagesSectionFromDataSource:YES];
 }
 
 #pragma mark - Helper methods
 
-- (void)populateLanguagesSection {
+// Populates the language items in the language section. Queries the data source
+// if |fromDataSource| is true. Otherwise uses the previously loaded items.
+- (void)populateLanguagesSectionFromDataSource:(BOOL)fromDataSource {
   TableViewModel* model = self.tableViewModel;
 
+  if (fromDataSource) {
+    self.supportedLanguages = [self.dataSource supportedLanguagesItems];
+  }
+
+  // Filter the language items based on the current search text, if applicable.
+  NSArray<LanguageItem*>* filteredSupportedLanguages = self.supportedLanguages;
+  if (self.searchPredicate) {
+    filteredSupportedLanguages = [self.supportedLanguages
+        filteredArrayUsingPredicate:self.searchPredicate];
+  }
+
   // Languages items.
-  [[self.dataSource supportedLanguagesItems]
+  [filteredSupportedLanguages
       enumerateObjectsUsingBlock:^(LanguageItem* item, NSUInteger index,
                                    BOOL* stop) {
         item.type = ItemTypeLanguage;
@@ -116,11 +230,13 @@
       }];
 }
 
-- (void)updateLanguagesSection {
+// Reloads the language items in the language section. Queries the data source
+// if |fromDataSource| is true. Otherwise uses the previously loaded items.
+- (void)updateLanguagesSectionFromDataSource:(BOOL)fromDataSource {
   // Update the model.
   [self.tableViewModel
       deleteAllItemsFromSectionWithIdentifier:SectionIdentifierLanguages];
-  [self populateLanguagesSection];
+  [self populateLanguagesSectionFromDataSource:fromDataSource];
 
   // Update the table view.
   NSUInteger index = [self.tableViewModel
@@ -129,4 +245,35 @@
                 withRowAnimation:UITableViewRowAnimationNone];
 }
 
+// Shows the scrim overlay.
+- (void)showScrim {
+  self.tableView.scrollEnabled = NO;
+  [self.tableView addSubview:self.scrimView];
+  // Attach constraints to the superview because tableView is a scrollView and
+  // the scrim view will have an empty frame when attaching constraints to it.
+  AddSameConstraints(self.scrimView, self.tableView.superview);
+  [UIView animateWithDuration:kTableViewNavigationScrimFadeDuration
+                   animations:^{
+                     self.scrimView.alpha = 1.0f;
+                     [self.view layoutIfNeeded];
+                   }];
+}
+
+// Hides the scrim overlay.
+- (void)hideScrim {
+  [UIView animateWithDuration:kTableViewNavigationScrimFadeDuration
+      animations:^{
+        self.scrimView.alpha = 0.0f;
+      }
+      completion:^(BOOL finished) {
+        [self.scrimView removeFromSuperview];
+        self.tableView.scrollEnabled = YES;
+      }];
+}
+
+// Dismisses the search controller when the scrim overlay is tapped.
+- (void)dismissSearchController:(UIControl*)sender {
+  self.searchController.active = NO;
+}
+
 @end
diff --git a/ios/chrome/browser/ui/settings/language_details_table_view_controller.mm b/ios/chrome/browser/ui/settings/language_details_table_view_controller.mm
index 5b0f2eb1..3c57448 100644
--- a/ios/chrome/browser/ui/settings/language_details_table_view_controller.mm
+++ b/ios/chrome/browser/ui/settings/language_details_table_view_controller.mm
@@ -22,7 +22,7 @@
 namespace {
 
 NSString* const kLanguageDetailsTableViewAccessibilityIdentifier =
-    @"language_details_table_view";
+    @"kLanguageDetailsTableViewAccessibilityIdentifier";
 
 typedef NS_ENUM(NSInteger, SectionIdentifier) {
   SectionIdentifierOptions = kSectionIdentifierEnumZero,
diff --git a/ios/chrome/browser/ui/settings/language_settings_table_view_controller.mm b/ios/chrome/browser/ui/settings/language_settings_table_view_controller.mm
index 363c214..60e3e0a 100644
--- a/ios/chrome/browser/ui/settings/language_settings_table_view_controller.mm
+++ b/ios/chrome/browser/ui/settings/language_settings_table_view_controller.mm
@@ -30,10 +30,11 @@
 namespace {
 
 NSString* const kLanguageSettingsTableViewAccessibilityIdentifier =
-    @"language_settings_table_view";
+    @"kLanguageSettingsTableViewAccessibilityIdentifier";
 NSString* const kAddLanguageButtonAccessibilityIdentifier =
-    @"add_language_button";
-NSString* const kTranslateSwitchAccessibilityIdentifier = @"translate_switch";
+    @"kAddLanguageButtonAccessibilityIdentifier";
+NSString* const kTranslateSwitchAccessibilityIdentifier =
+    @"kTranslateSwitchAccessibilityIdentifier";
 
 typedef NS_ENUM(NSInteger, SectionIdentifier) {
   SectionIdentifierLanguages = kSectionIdentifierEnumZero,
diff --git a/ios/chrome/browser/ui/settings/settings_navigation_controller.h b/ios/chrome/browser/ui/settings/settings_navigation_controller.h
index d6613f6..94c11a6 100644
--- a/ios/chrome/browser/ui/settings/settings_navigation_controller.h
+++ b/ios/chrome/browser/ui/settings/settings_navigation_controller.h
@@ -74,7 +74,6 @@
 // not be nil. |delegate| may be nil.
 + (SettingsNavigationController*)
      newSyncController:(ios::ChromeBrowserState*)browserState
-allowSwitchSyncAccount:(BOOL)allowSwitchSyncAccount
               delegate:(id<SettingsNavigationControllerDelegate>)delegate;
 
 // Creates a new SyncEncryptionPassphraseCollectionViewController and the chrome
diff --git a/ios/chrome/browser/ui/settings/settings_navigation_controller.mm b/ios/chrome/browser/ui/settings/settings_navigation_controller.mm
index 5df9a52..670ba801 100644
--- a/ios/chrome/browser/ui/settings/settings_navigation_controller.mm
+++ b/ios/chrome/browser/ui/settings/settings_navigation_controller.mm
@@ -94,12 +94,10 @@
 
 + (SettingsNavigationController*)
      newSyncController:(ios::ChromeBrowserState*)browserState
-allowSwitchSyncAccount:(BOOL)allowSwitchSyncAccount
               delegate:(id<SettingsNavigationControllerDelegate>)delegate {
   SyncSettingsTableViewController* controller =
-      [[SyncSettingsTableViewController alloc]
-            initWithBrowserState:browserState
-          allowSwitchSyncAccount:allowSwitchSyncAccount];
+      [[SyncSettingsTableViewController alloc] initWithBrowserState:browserState
+                                             allowSwitchSyncAccount:YES];
   controller.dispatcher = [delegate dispatcherForSettings];
   SettingsNavigationController* nc = [[SettingsNavigationController alloc]
       initWithRootViewController:controller
diff --git a/ios/chrome/browser/ui/settings/sync/utils/BUILD.gn b/ios/chrome/browser/ui/settings/sync/utils/BUILD.gn
index b08652bd..dfd0400 100644
--- a/ios/chrome/browser/ui/settings/sync/utils/BUILD.gn
+++ b/ios/chrome/browser/ui/settings/sync/utils/BUILD.gn
@@ -20,6 +20,7 @@
     "//components/signin/core/browser",
     "//components/strings",
     "//components/sync",
+    "//components/unified_consent",
     "//google_apis",
     "//ios/chrome/app/strings",
     "//ios/chrome/browser/browser_state",
diff --git a/ios/chrome/browser/ui/settings/sync/utils/sync_error_infobar_delegate.mm b/ios/chrome/browser/ui/settings/sync/utils/sync_error_infobar_delegate.mm
index d41ae814..d002c44 100644
--- a/ios/chrome/browser/ui/settings/sync/utils/sync_error_infobar_delegate.mm
+++ b/ios/chrome/browser/ui/settings/sync/utils/sync_error_infobar_delegate.mm
@@ -15,6 +15,7 @@
 #include "components/infobars/core/infobar_delegate.h"
 #include "components/infobars/core/infobar_manager.h"
 #include "components/sync/driver/sync_service.h"
+#include "components/unified_consent/feature.h"
 #import "ios/chrome/browser/browser_state/chrome_browser_state.h"
 #include "ios/chrome/browser/sync/profile_sync_service_factory.h"
 #include "ios/chrome/browser/sync/sync_setup_service.h"
@@ -93,11 +94,13 @@
   if (ShouldShowSyncSignin(error_state_)) {
     [presenter_ showReauthenticateSignin];
   } else if (ShouldShowSyncSettings(error_state_)) {
-    [presenter_ showSyncSettings];
+    if (unified_consent::IsUnifiedConsentFeatureEnabled()) {
+      [presenter_ showGoogleServicesSettings];
+    } else {
+      [presenter_ showSyncSettings];
+    }
   } else if (ShouldShowSyncPassphraseSettings(error_state_)) {
     [presenter_ showSyncPassphraseSettings];
-  } else if (ShouldShowGoogleServicesSettings(error_state_)) {
-    [presenter_ showGoogleServicesSettings];
   }
   return false;
 }
diff --git a/ios/chrome/browser/ui/settings/sync/utils/sync_util.h b/ios/chrome/browser/ui/settings/sync/utils/sync_util.h
index 986f4e6d..4ae4de6c 100644
--- a/ios/chrome/browser/ui/settings/sync/utils/sync_util.h
+++ b/ios/chrome/browser/ui/settings/sync/utils/sync_util.h
@@ -45,12 +45,8 @@
 bool ShouldShowSyncPassphraseSettings(
     SyncSetupService::SyncServiceState syncState);
 
-// Returns true if Google services settings should be displayed based on
-// |syncState|.
-bool ShouldShowGoogleServicesSettings(
-    SyncSetupService::SyncServiceState syncState);
-
-// Returns true if sync settings should be displayed based on |syncState|.
+// Returns true if sync settings (or the google services settings when unified
+// consent is enabled) should be displayed based on |syncState|.
 bool ShouldShowSyncSettings(SyncSetupService::SyncServiceState syncState);
 
 // Check for sync errors, and display any that ought to be shown to the user.
diff --git a/ios/chrome/browser/ui/settings/sync/utils/sync_util.mm b/ios/chrome/browser/ui/settings/sync/utils/sync_util.mm
index 189594e3..5ce2011 100644
--- a/ios/chrome/browser/ui/settings/sync/utils/sync_util.mm
+++ b/ios/chrome/browser/ui/settings/sync/utils/sync_util.mm
@@ -7,6 +7,7 @@
 #include "base/metrics/histogram_macros.h"
 #include "components/infobars/core/infobar_manager.h"
 #include "components/strings/grit/components_strings.h"
+#include "components/unified_consent/feature.h"
 #import "ios/chrome/browser/browser_state/chrome_browser_state.h"
 #include "ios/chrome/browser/infobars/infobar_manager_impl.h"
 #include "ios/chrome/browser/sync/sync_setup_service.h"
@@ -125,19 +126,16 @@
   return syncState == SyncSetupService::kSyncServiceNeedsPassphrase;
 }
 
-bool ShouldShowGoogleServicesSettings(
-    SyncSetupService::SyncServiceState syncState) {
-  return syncState == SyncSetupService::kSyncSettingsNotConfirmed;
-}
-
 bool ShouldShowSyncSettings(SyncSetupService::SyncServiceState syncState) {
   switch (syncState) {
     case SyncSetupService::kSyncServiceCouldNotConnect:
     case SyncSetupService::kSyncServiceServiceUnavailable:
     case SyncSetupService::kSyncServiceUnrecoverableError:
     case SyncSetupService::kNoSyncServiceError:
+    case SyncSetupService::kSyncSettingsNotConfirmed:
       return true;
-    default:
+    case SyncSetupService::kSyncServiceSignInNeedsUpdate:
+    case SyncSetupService::kSyncServiceNeedsPassphrase:
       return false;
   }
 }
diff --git a/ios/chrome/browser/ui/table_view/cells/table_view_detail_icon_item.mm b/ios/chrome/browser/ui/table_view/cells/table_view_detail_icon_item.mm
index 11a35f7..567709f 100644
--- a/ios/chrome/browser/ui/table_view/cells/table_view_detail_icon_item.mm
+++ b/ios/chrome/browser/ui/table_view/cells/table_view_detail_icon_item.mm
@@ -105,7 +105,6 @@
     _textLabel.adjustsFontForContentSizeCategory = YES;
     _textLabel.textColor = [UIColor blackColor];
     _textLabel.backgroundColor = [UIColor clearColor];
-    _textLabel.textAlignment = NSTextAlignmentLeft;
     [contentView addSubview:_textLabel];
 
     _detailTextLabel = [[UILabel alloc] init];
@@ -115,7 +114,6 @@
     _detailTextLabel.adjustsFontForContentSizeCategory = YES;
     _detailTextLabel.textColor = UIColorFromRGB(kSettingsCellsDetailTextColor);
     _detailTextLabel.backgroundColor = [UIColor clearColor];
-    _detailTextLabel.textAlignment = NSTextAlignmentRight;
     [contentView addSubview:_detailTextLabel];
 
     // Set up the constraints for when the icon is visible and hidden.  One of
@@ -268,11 +266,21 @@
   if (accessibilityContentSizeCategory) {
     [NSLayoutConstraint deactivateConstraints:_standardConstraints];
     [NSLayoutConstraint activateConstraints:_accessibilityConstraints];
+    // detailTextLabel is laid below textLabel with accessibility content size
+    // category.
+    _detailTextLabel.textAlignment = NSTextAlignmentNatural;
     _detailTextLabel.numberOfLines = 0;
     _textLabel.numberOfLines = 0;
   } else {
     [NSLayoutConstraint deactivateConstraints:_accessibilityConstraints];
     [NSLayoutConstraint activateConstraints:_standardConstraints];
+    // detailTextLabel is laid after textLabel and should have a trailing text
+    // alignment with non-accessibility content size category.
+    _detailTextLabel.textAlignment =
+        self.effectiveUserInterfaceLayoutDirection ==
+                UIUserInterfaceLayoutDirectionLeftToRight
+            ? NSTextAlignmentRight
+            : NSTextAlignmentLeft;
     _detailTextLabel.numberOfLines = 1;
     _textLabel.numberOfLines = 1;
   }
diff --git a/ios/chrome/browser/web_resource/web_resource_util.cc b/ios/chrome/browser/web_resource/web_resource_util.cc
index 65c7d1c..8496648 100644
--- a/ios/chrome/browser/web_resource/web_resource_util.cc
+++ b/ios/chrome/browser/web_resource/web_resource_util.cc
@@ -50,10 +50,8 @@
     return;
   }
 
-  task_runner->PostTask(
-      FROM_HERE,
-      base::BindOnce(success_callback,
-                     base::Value::ToUniquePtrValue(std::move(value).value())));
+  task_runner->PostTask(FROM_HERE,
+                        base::BindOnce(success_callback, std::move(*value)));
 }
 
 // Starts the parsing of |data| as a JSON string asynchronously on a background
diff --git a/ios/chrome/browser/web_resource/web_resource_util_unittest.cc b/ios/chrome/browser/web_resource/web_resource_util_unittest.cc
index decd97a..682d807 100644
--- a/ios/chrome/browser/web_resource/web_resource_util_unittest.cc
+++ b/ios/chrome/browser/web_resource/web_resource_util_unittest.cc
@@ -35,7 +35,7 @@
   }
 
   // Called on success.
-  void OnParseSuccess(std::unique_ptr<base::Value> value) {
+  void OnParseSuccess(base::Value value) {
     success_called_ = true;
     value_ = std::move(value);
   }
@@ -57,7 +57,7 @@
 
   base::test::ScopedTaskEnvironment scoped_task_environment_;
   std::string error_;
-  std::unique_ptr<base::Value> value_;
+  base::Optional<base::Value> value_;
   bool error_called_;
   bool success_called_;
 };
diff --git a/ios/chrome/test/earl_grey/chrome_earl_grey.h b/ios/chrome/test/earl_grey/chrome_earl_grey.h
index 06826e8..d7a8b4d 100644
--- a/ios/chrome/test/earl_grey/chrome_earl_grey.h
+++ b/ios/chrome/test/earl_grey/chrome_earl_grey.h
@@ -45,6 +45,22 @@
 
 #pragma mark - Navigation Utilities (EG2)
 
+// Loads |URL| in the current WebState with transition type
+// ui::PAGE_TRANSITION_TYPED, and if waitForCompletion is YES
+// waits for the loading to complete within a timeout.
+// Returns nil on success, or else an NSError indicating why the operation
+// failed.
+- (NSError*)loadURL:(const GURL&)URL waitForCompletion:(BOOL)wait;
+
+// Loads |URL| in the current WebState with transition type
+// ui::PAGE_TRANSITION_TYPED, and waits for the loading to complete within a
+// timeout.
+// If the condition is not met within a timeout returns an NSError indicating
+// why the operation failed, otherwise nil.
+// TODO(crbug.com/963613): Change return type to avoid when
+// CHROME_EG_ASSERT_NO_ERROR is removed.
+- (NSError*)loadURL:(const GURL&)URL;
+
 // Navigates back to the previous page and waits for the loading to complete
 // within a timeout, or a GREYAssert is induced.
 // TODO(crbug.com/963613): Change return type to void when
@@ -74,22 +90,6 @@
 
 #pragma mark - Navigation Utilities
 
-// Loads |URL| in the current WebState with transition type
-// ui::PAGE_TRANSITION_TYPED, and if waitForCompletion is YES
-// waits for the loading to complete within a timeout.
-// Returns nil on success, or else an NSError indicating why the operation
-// failed.
-- (NSError*)loadURL:(const GURL&)URL waitForCompletion:(BOOL)wait;
-
-// Loads |URL| in the current WebState with transition type
-// ui::PAGE_TRANSITION_TYPED, and waits for the loading to complete within a
-// timeout.
-// If the condition is not met within a timeout returns an NSError indicating
-// why the operation failed, otherwise nil.
-// TODO(crbug.com/963613): Change return type to avoid when
-// CHROME_EG_ASSERT_NO_ERROR is removed.
-- (NSError*)loadURL:(const GURL&)URL;
-
 // Checks whether current WebState is loading.
 - (BOOL)isLoading WARN_UNUSED_RESULT;
 
diff --git a/ios/chrome/test/earl_grey/chrome_earl_grey.mm b/ios/chrome/test/earl_grey/chrome_earl_grey.mm
index 4e454bab..aa11fbf5 100644
--- a/ios/chrome/test/earl_grey/chrome_earl_grey.mm
+++ b/ios/chrome/test/earl_grey/chrome_earl_grey.mm
@@ -57,7 +57,7 @@
 
 @implementation ChromeEarlGreyImpl
 
-#pragma mark - History Utilities
+#pragma mark - History Utilities (EG2)
 
 - (void)clearBrowsingHistory {
   EG_TEST_HELPER_ASSERT_NO_ERROR(
@@ -88,6 +88,25 @@
   return nil;
 }
 
+#pragma mark - Navigation Utilities (EG2)
+
+- (NSError*)loadURL:(const GURL&)URL waitForCompletion:(BOOL)wait {
+  [ChromeEarlGreyAppInterface
+      startLoadingURL:base::SysUTF8ToNSString(URL.spec())];
+  if (wait) {
+    [self waitForPageToFinishLoading];
+    EG_TEST_HELPER_ASSERT_TRUE(
+        [ChromeEarlGreyAppInterface waitForWindowIDInjectionIfNeeded],
+        @"WindowID failed to inject");
+  }
+
+  return nil;
+}
+
+- (NSError*)loadURL:(const GURL&)URL {
+  return [self loadURL:URL waitForCompletion:YES];
+}
+
 @end
 
 // The helpers below only compile under EarlGrey1.
@@ -155,25 +174,6 @@
 
 #pragma mark - Navigation Utilities
 
-- (NSError*)loadURL:(const GURL&)URL waitForCompletion:(BOOL)wait {
-  chrome_test_util::LoadUrl(URL);
-  if (wait) {
-    [self waitForPageToFinishLoading];
-  }
-
-  web::WebState* webState = chrome_test_util::GetCurrentWebState();
-  if (webState->ContentIsHTML()) {
-    bool windowIDInjected = web::WaitUntilWindowIdInjected(webState);
-    EG_TEST_HELPER_ASSERT_TRUE(windowIDInjected, @"WindowID failed to inject");
-  }
-
-  return nil;
-}
-
-- (NSError*)loadURL:(const GURL&)URL {
-  return [ChromeEarlGrey loadURL:URL waitForCompletion:YES];
-}
-
 - (BOOL)isLoading {
   return chrome_test_util::IsLoading();
 }
diff --git a/ios/chrome/test/earl_grey/chrome_earl_grey_app_interface.h b/ios/chrome/test/earl_grey/chrome_earl_grey_app_interface.h
index 034e305e..2865017 100644
--- a/ios/chrome/test/earl_grey/chrome_earl_grey_app_interface.h
+++ b/ios/chrome/test/earl_grey/chrome_earl_grey_app_interface.h
@@ -17,6 +17,15 @@
 // operation failed.
 + (NSError*)clearBrowsingHistory;
 
+// Loads |URL| in the current WebState with transition type
+// ui::PAGE_TRANSITION_TYPED and returns without waiting for the page to load.
++ (void)startLoadingURL:(NSString*)URL;
+
+// If the current WebState is HTML content, will wait until the window ID is
+// injected. Returns YES if the injection is successful or if the WebState is
+// not HTML content.
++ (BOOL)waitForWindowIDInjectionIfNeeded;
+
 // Returns YES if the current WebState is loading.
 + (BOOL)isLoading;
 
diff --git a/ios/chrome/test/earl_grey/chrome_earl_grey_app_interface.mm b/ios/chrome/test/earl_grey/chrome_earl_grey_app_interface.mm
index f9ef2c8..b32c423 100644
--- a/ios/chrome/test/earl_grey/chrome_earl_grey_app_interface.mm
+++ b/ios/chrome/test/earl_grey/chrome_earl_grey_app_interface.mm
@@ -4,10 +4,12 @@
 
 #import "ios/chrome/test/earl_grey/chrome_earl_grey_app_interface.h"
 
+#include "base/strings/sys_string_conversions.h"
 #import "ios/chrome/test/app/chrome_test_util.h"
 #import "ios/chrome/test/app/history_test_util.h"
 #include "ios/chrome/test/app/navigation_test_util.h"
 #import "ios/testing/nserror_util.h"
+#import "ios/web/public/test/earl_grey/js_test_util.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
 #error "This file requires ARC support."
@@ -24,6 +26,20 @@
       @"Clearing browser history timed out");
 }
 
++ (void)startLoadingURL:(NSString*)URL {
+  chrome_test_util::LoadUrl(GURL(base::SysNSStringToUTF8(URL)));
+}
+
++ (BOOL)waitForWindowIDInjectionIfNeeded {
+  web::WebState* webState = chrome_test_util::GetCurrentWebState();
+
+  if (webState->ContentIsHTML()) {
+    return web::WaitUntilWindowIdInjected(webState);
+  }
+
+  return true;
+}
+
 + (bool)isLoading {
   return chrome_test_util::IsLoading();
 }
diff --git a/ios/chrome/test/earl_grey2/smoke_egtest.mm b/ios/chrome/test/earl_grey2/smoke_egtest.mm
index 204df80..32107e3 100644
--- a/ios/chrome/test/earl_grey2/smoke_egtest.mm
+++ b/ios/chrome/test/earl_grey2/smoke_egtest.mm
@@ -108,4 +108,11 @@
   [ChromeEarlGreyUI reload];
 }
 
+// Tests navigation-related converted helpers in chrome_earl_grey.h.
+- (void)testURLNavigation {
+  [ChromeEarlGrey loadURL:GURL("chrome://terms")];
+  [ChromeEarlGrey goBack];
+  [ChromeEarlGrey loadURL:GURL("chrome://version")];
+}
+
 @end
diff --git a/ios/web/public/BUILD.gn b/ios/web/public/BUILD.gn
index 065cf150..73fcb5be 100644
--- a/ios/web/public/BUILD.gn
+++ b/ios/web/public/BUILD.gn
@@ -66,6 +66,7 @@
     "web_state/session_certificate_policy_cache.h",
     "web_state/ui/crw_context_menu_delegate.h",
     "web_state/ui/crw_native_content.h",
+    "web_state/ui/crw_native_content_holder.h",
     "web_state/ui/crw_native_content_provider.h",
     "web_state/ui/crw_web_view_proxy.h",
     "web_state/ui/crw_web_view_scroll_view_proxy.h",
diff --git a/ios/web/public/test/fakes/test_native_content.mm b/ios/web/public/test/fakes/test_native_content.mm
index 8dde74c..ec6f21a 100644
--- a/ios/web/public/test/fakes/test_native_content.mm
+++ b/ios/web/public/test/fakes/test_native_content.mm
@@ -38,7 +38,7 @@
   return _URL;
 }
 
-- (GURL)virtualURL {
+- (const GURL&)virtualURL {
   return _virtualURL;
 }
 
diff --git a/ios/web/public/test/native_controller_test_util.mm b/ios/web/public/test/native_controller_test_util.mm
index 18ea8ad..b3eaa8d 100644
--- a/ios/web/public/test/native_controller_test_util.mm
+++ b/ios/web/public/test/native_controller_test_util.mm
@@ -4,6 +4,7 @@
 
 #import "ios/web/public/test/native_controller_test_util.h"
 
+#import "ios/web/public/web_state/ui/crw_native_content_holder.h"
 #import "ios/web/web_state/ui/crw_web_controller.h"
 #import "ios/web/web_state/web_state_impl.h"
 
@@ -17,7 +18,8 @@
 id<CRWNativeContent> GetCurrentNativeController(WebState* web_state) {
   web::WebStateImpl* web_state_impl =
       static_cast<web::WebStateImpl*>(web_state);
-  return [web_state_impl->GetWebController() nativeController];
+  return [[web_state_impl->GetWebController() nativeContentHolder]
+      nativeController];
 }
 
 }  // namespace test
diff --git a/ios/web/public/web_state/ui/crw_native_content.h b/ios/web/public/web_state/ui/crw_native_content.h
index b85f004..a84f4d8 100644
--- a/ios/web/public/web_state/ui/crw_native_content.h
+++ b/ios/web/public/web_state/ui/crw_native_content.h
@@ -77,7 +77,7 @@
 
 // The URL that will be displayed to the user when presenting this native
 // content.
-- (GURL)virtualURL;
+- (const GURL&)virtualURL;
 
 // The content inset and offset of this native view.
 - (CGPoint)contentOffset;
diff --git a/ios/web/public/web_state/ui/crw_native_content_holder.h b/ios/web/public/web_state/ui/crw_native_content_holder.h
new file mode 100644
index 0000000..7dc9bc08
--- /dev/null
+++ b/ios/web/public/web_state/ui/crw_native_content_holder.h
@@ -0,0 +1,24 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_WEB_PUBLIC_WEB_STATE_UI_CRW_NATIVE_CONTENT_HOLDER_H_
+#define IOS_WEB_PUBLIC_WEB_STATE_UI_CRW_NATIVE_CONTENT_HOLDER_H_
+
+#import <Foundation/Foundation.h>
+
+@protocol CRWNativeContent;
+@protocol CRWNativeContentProvider;
+
+// Protocol describing an object having ownership of a native controller.
+@protocol CRWNativeContentHolder
+
+// The provider for the native content.
+@property(nonatomic, weak) id<CRWNativeContentProvider> nativeProvider;
+
+// The native controller owned by this object.
+- (id<CRWNativeContent>)nativeController;
+
+@end
+
+#endif  // IOS_WEB_PUBLIC_WEB_STATE_UI_CRW_NATIVE_CONTENT_HOLDER_H_
diff --git a/ios/web/web_state/ui/BUILD.gn b/ios/web/web_state/ui/BUILD.gn
index 07508d8..fe77541 100644
--- a/ios/web/web_state/ui/BUILD.gn
+++ b/ios/web/web_state/ui/BUILD.gn
@@ -36,6 +36,7 @@
     "//ios/web/web_state:web_view_internal_creation_util",
     "//ios/web/web_state/js",
     "//ios/web/web_state/ui:wk_web_view_configuration_provider",
+    "//ios/web/web_state/ui/controller",
     "//ios/web/web_view",
     "//ios/web/webui:webui",
     "//services/metrics/public/cpp:ukm_builders",
diff --git a/ios/web/web_state/ui/controller/BUILD.gn b/ios/web/web_state/ui/controller/BUILD.gn
new file mode 100644
index 0000000..dcfdbca4
--- /dev/null
+++ b/ios/web/web_state/ui/controller/BUILD.gn
@@ -0,0 +1,24 @@
+# Copyright 2019 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+source_set("controller") {
+  sources = [
+    "crw_legacy_native_content_controller.h",
+    "crw_legacy_native_content_controller.mm",
+    "crw_legacy_native_content_controller_delegate.h",
+  ]
+
+  deps = [
+    "//ios/web/navigation:core",
+    "//ios/web/net",
+    "//ios/web/public",
+    "//ios/web/web_state:web_state_impl_header",
+    "//ui/base",
+    "//url",
+  ]
+
+  libs = [ "WebKit.framework" ]
+
+  configs += [ "//build/config/compiler:enable_arc" ]
+}
diff --git a/ios/web/web_state/ui/controller/crw_legacy_native_content_controller.h b/ios/web/web_state/ui/controller/crw_legacy_native_content_controller.h
new file mode 100644
index 0000000..f81c354
--- /dev/null
+++ b/ios/web/web_state/ui/controller/crw_legacy_native_content_controller.h
@@ -0,0 +1,96 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_WEB_WEB_STATE_UI_CONTROLLER_CRW_LEGACY_NATIVE_CONTENT_CONTROLLER_H_
+#define IOS_WEB_WEB_STATE_UI_CONTROLLER_CRW_LEGACY_NATIVE_CONTENT_CONTROLLER_H_
+
+#include <UIKit/UIKit.h>
+
+#import "ios/web/public/web_state/ui/crw_native_content_holder.h"
+
+namespace web {
+class NavigationContextImpl;
+class NavigationItemImpl;
+class WebStateImpl;
+}
+@protocol CRWLegacyNativeContentControllerDelegate;
+@protocol CRWNativeContent;
+class GURL;
+
+// Object managing the native content controller and its interactions with other
+// objects.
+@interface CRWLegacyNativeContentController : NSObject <CRWNativeContentHolder>
+
+- (instancetype)initWithWebState:(web::WebStateImpl*)webState
+    NS_DESIGNATED_INITIALIZER;
+- (instancetype)init NS_UNAVAILABLE;
+
+@property(nonatomic, weak) id<CRWLegacyNativeContentControllerDelegate>
+    delegate;
+
+// Return YES if there is a native content controller currently initialized.
+- (BOOL)hasController;
+
+// Returns |YES| if |URL| should be loaded in a native view.
+- (BOOL)shouldLoadURLInNativeView:(const GURL&)URL;
+
+// Informs the native controller if web usage is allowed or not.
+- (void)setNativeControllerWebUsageEnabled:(BOOL)webUsageEnabled;
+
+// Loads the current URL in a native controller if using the legacy navigation
+// stack. If the new navigation stack is used, start loading a placeholder
+// into the web view, upon the completion of which the native controller will
+// be triggered.
+- (void)loadCurrentURLInNativeViewWithRendererInitiatedNavigation:
+    (BOOL)rendererInitiated;
+
+// Notifies the native content that the navigation associated with |context| and
+// |item| did finish.
+- (void)webViewDidFinishNavigationWithContext:
+            (web::NavigationContextImpl*)context
+                                      andItem:(web::NavigationItemImpl*)item;
+
+// Lets the native content handle its part when there is a cancellation error.
+- (void)handleCancelledErrorForContext:(web::NavigationContextImpl*)context;
+
+// Lets the native content handle its part when there is an SSL error.
+- (void)handleSSLError;
+
+// Stops the loading of the Native Content.
+- (void)stopLoading;
+
+// Removes the current native controller.
+- (void)resetNativeController;
+
+// *****************************************
+// ** Calls related to the NativeContent. **
+// *****************************************
+
+// Notifies the CRWNativeContent that it has been shown.
+- (void)wasShown;
+
+// Notifies the CRWNativeContent that it has been hidden.
+- (void)wasHidden;
+
+// Dismisses any outstanding modal interaction elements (e.g. modal view
+// controllers, context menus, etc).
+- (void)dismissModals;
+
+// A native content controller should do any clean up at this time when
+// WebController closes.
+- (void)close;
+
+// The URL represented by the content being displayed.
+- (const GURL&)URL;
+
+// Reloads any displayed data to ensure the view is up to date.
+- (void)reload;
+
+// The content inset and offset of the native content.
+- (CGPoint)contentOffset;
+- (UIEdgeInsets)contentInset;
+
+@end
+
+#endif  // IOS_WEB_WEB_STATE_UI_CONTROLLER_CRW_LEGACY_NATIVE_CONTENT_CONTROLLER_H_
diff --git a/ios/web/web_state/ui/controller/crw_legacy_native_content_controller.mm b/ios/web/web_state/ui/controller/crw_legacy_native_content_controller.mm
new file mode 100644
index 0000000..538695a
--- /dev/null
+++ b/ios/web/web_state/ui/controller/crw_legacy_native_content_controller.mm
@@ -0,0 +1,328 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/web/web_state/ui/controller/crw_legacy_native_content_controller.h"
+
+#include "base/mac/foundation_util.h"
+#include "base/strings/sys_string_conversions.h"
+#import "ios/web/navigation/navigation_context_impl.h"
+#import "ios/web/navigation/navigation_item_impl.h"
+#import "ios/web/public/navigation_item.h"
+#import "ios/web/public/web_client.h"
+#import "ios/web/public/web_state/ui/crw_native_content.h"
+#import "ios/web/public/web_state/ui/crw_native_content_provider.h"
+#import "ios/web/web_state/ui/controller/crw_legacy_native_content_controller_delegate.h"
+#import "ios/web/web_state/web_state_impl.h"
+#include "url/gurl.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+@interface CRWLegacyNativeContentController () <CRWNativeContentDelegate>
+
+// The currently displayed native controller, if any.
+@property(nonatomic, strong) id<CRWNativeContent> nativeController;
+@property(nonatomic, assign) web::WebStateImpl* webStateImpl;
+@property(nonatomic, assign, readonly)
+    web::NavigationManagerImpl* navigationManagerImpl;
+@property(nonatomic, assign, readonly) web::NavigationItemImpl* currentNavItem;
+@end
+
+@implementation CRWLegacyNativeContentController
+
+@synthesize nativeProvider = _nativeProvider;
+
+- (instancetype)initWithWebState:(web::WebStateImpl*)webState {
+  self = [super init];
+  if (self) {
+    DCHECK(webState);
+    _webStateImpl = webState;
+  }
+  return self;
+}
+
+#pragma mark - Properties
+
+- (void)setNativeController:(id<CRWNativeContent>)nativeController {
+  // Check for pointer equality.
+  if (_nativeController == nativeController)
+    return;
+
+  // Unset the delegate on the previous instance.
+  if ([_nativeController respondsToSelector:@selector(setDelegate:)])
+    [_nativeController setDelegate:nil];
+
+  id<CRWNativeContent> previousController = _nativeController;
+  _nativeController = nativeController;
+  [self.delegate legacyNativeContentController:self
+                        nativeContentDidChange:previousController];
+  [self setNativeControllerWebUsageEnabled:
+            [self.delegate legacyNativeContentControllerWebUsageEnabled:self]];
+}
+
+- (web::NavigationManagerImpl*)navigationManagerImpl {
+  return self.webStateImpl ? &(self.webStateImpl->GetNavigationManagerImpl())
+                           : nil;
+}
+
+- (web::NavigationItemImpl*)currentNavItem {
+  return self.navigationManagerImpl
+             ? self.navigationManagerImpl->GetCurrentItemImpl()
+             : nullptr;
+}
+
+#pragma mark - Public
+
+- (BOOL)hasController {
+  return self.nativeController != nil;
+}
+
+- (BOOL)shouldLoadURLInNativeView:(const GURL&)URL {
+  // App-specific URLs that don't require WebUI are loaded in native views.
+  return web::GetWebClient()->IsAppSpecificURL(URL) &&
+         !self.webStateImpl->HasWebUI() &&
+         [self.nativeProvider hasControllerForURL:URL];
+}
+
+- (void)setNativeControllerWebUsageEnabled:(BOOL)webUsageEnabled {
+  if ([self.nativeController
+          respondsToSelector:@selector(setWebUsageEnabled:)]) {
+    [self.nativeController setWebUsageEnabled:webUsageEnabled];
+  }
+}
+
+- (void)loadCurrentURLInNativeViewWithRendererInitiatedNavigation:
+    (BOOL)rendererInitiated {
+  if (!web::GetWebClient()->IsSlimNavigationManagerEnabled()) {
+    // Free the web view.
+    [self.delegate legacyNativeContentControllerRemoveWebView:self];
+    [self presentNativeContentForNavigationItem:self.currentNavItem];
+    [self didLoadNativeContentForNavigationItem:self.currentNavItem
+                             placeholderContext:nullptr
+                              rendererInitiated:rendererInitiated];
+  } else {
+    // Just present the native view now. Leave the rest of native content load
+    // until the placeholder navigation finishes.
+    [self presentNativeContentForNavigationItem:self.currentNavItem];
+    web::NavigationContextImpl* context = [self.delegate
+         legacyNativeContentController:self
+        loadPlaceholderInWebViewForURL:self.currentNavItem->GetVirtualURL()
+                     rendererInitiated:rendererInitiated
+                            forContext:nullptr];
+    context->SetIsNativeContentPresented(true);
+  }
+}
+
+- (void)webViewDidFinishNavigationWithContext:
+            (web::NavigationContextImpl*)context
+                                      andItem:(web::NavigationItemImpl*)item {
+  // Native content may have already been presented if this navigation is
+  // started in
+  // |-loadCurrentURLInNativeViewWithRendererInitiatedNavigation:|. If
+  // not, present it now.
+  if (!context->IsNativeContentPresented()) {
+    [self presentNativeContentForNavigationItem:item];
+  }
+  bool rendererInitiated = context->IsRendererInitiated();
+  [self didLoadNativeContentForNavigationItem:item
+                           placeholderContext:context
+                            rendererInitiated:rendererInitiated];
+}
+
+- (void)handleCancelledErrorForContext:(web::NavigationContextImpl*)context {
+  // If discarding the non-committed entries results in native content URL,
+  // reload it in its native view. For WKBasedNavigationManager, this is not
+  // necessary because WKWebView takes care of reloading the placeholder URL,
+  // which triggers native view upon completion.
+  if (!web::GetWebClient()->IsSlimNavigationManagerEnabled() &&
+      ![self hasController]) {
+    GURL lastCommittedURL = self.webStateImpl->GetLastCommittedURL();
+    if ([self shouldLoadURLInNativeView:lastCommittedURL]) {
+      [self loadCurrentURLInNativeViewWithRendererInitiatedNavigation:
+                context->IsRendererInitiated()];
+    }
+  }
+}
+
+- (void)handleSSLError {
+  // If discarding non-committed items results in a NavigationItem that
+  // should be loaded via a native controller, load that URL, as its
+  // native controller will need to be recreated.  Note that a
+  // successful preload of a page with an certificate error will result
+  // in this block executing on a CRWWebController with no
+  // NavigationManager.  Additionally, if a page with a certificate
+  // error is opened in a new tab, its last committed NavigationItem
+  // will be null.
+  web::NavigationManager* navigationManager = self.navigationManagerImpl;
+  web::NavigationItem* item =
+      navigationManager ? navigationManager->GetLastCommittedItem() : nullptr;
+  if (item && [self shouldLoadURLInNativeView:item->GetURL()]) {
+    // RendererInitiated flag is meaningless for showing previous native
+    // content page. RendererInitiated is used as less previledged.
+    [self loadCurrentURLInNativeViewWithRendererInitiatedNavigation:YES];
+  }
+}
+
+- (void)stopLoading {
+  web::NavigationItem* item = self.currentNavItem;
+  GURL navigationURL = item ? item->GetVirtualURL() : GURL::EmptyGURL();
+  // If discarding the non-committed entries results in an app-specific URL,
+  // reload it in its native view.
+  if (![self hasController] && [self shouldLoadURLInNativeView:navigationURL]) {
+    // RendererInitiated flag is meaningless for showing previous native
+    // content page. RendererInitiated is used as less previledged.
+    [self loadCurrentURLInNativeViewWithRendererInitiatedNavigation:YES];
+  }
+}
+
+- (void)resetNativeController {
+  _nativeController = nil;
+}
+
+- (void)wasShown {
+  if ([self.nativeController respondsToSelector:@selector(wasShown)]) {
+    [self.nativeController wasShown];
+  }
+}
+
+- (void)wasHidden {
+  if ([self.nativeController respondsToSelector:@selector(wasHidden)]) {
+    [self.nativeController wasHidden];
+  }
+}
+
+- (void)dismissModals {
+  if ([self.nativeController respondsToSelector:@selector(dismissModals)])
+    [self.nativeController dismissModals];
+}
+
+- (void)close {
+  self.nativeProvider = nil;
+  if ([self.nativeController respondsToSelector:@selector(close)])
+    [self.nativeController close];
+  if ([self.nativeController respondsToSelector:@selector(setDelegate:)])
+    [self.nativeController setDelegate:nil];
+}
+
+- (const GURL&)URL {
+  if ([self.nativeController respondsToSelector:@selector(virtualURL)]) {
+    return [self.nativeController virtualURL];
+  } else {
+    return [self.nativeController url];
+  }
+}
+
+- (void)reload {
+  [self.nativeController reload];
+}
+
+- (CGPoint)contentOffset {
+  if ([self.nativeController respondsToSelector:@selector(contentOffset)])
+    return [self.nativeController contentOffset];
+  return CGPointZero;
+}
+
+- (UIEdgeInsets)contentInset {
+  if ([self.nativeController respondsToSelector:@selector(contentInset)])
+    return [self.nativeController contentInset];
+  return UIEdgeInsetsZero;
+}
+
+#pragma mark - CRWNativeContentDelegate methods
+
+- (void)nativeContent:(id)content titleDidChange:(NSString*)title {
+  [self.delegate legacyNativeContentController:self
+                         setNativeContentTitle:title];
+}
+
+- (void)nativeContent:(id)content
+    handleContextMenu:(const web::ContextMenuParams&)params {
+  if ([self.delegate legacyNativeContentControllerIsBeingDestroyed:self]) {
+    return;
+  }
+  self.webStateImpl->HandleContextMenu(params);
+}
+
+#pragma mark - Private
+
+// Presents native content using the native controller for |item| without
+// notifying WebStateObservers. This method does not modify the underlying web
+// view. It simply covers the web view with the native content.
+// |-didLoadNativeContentForNavigationItem| must be called some time later
+// to notify WebStateObservers.
+- (void)presentNativeContentForNavigationItem:(web::NavigationItem*)item {
+  const GURL targetURL = item ? item->GetURL() : GURL::EmptyGURL();
+  id<CRWNativeContent> nativeContent =
+      [self.nativeProvider controllerForURL:targetURL
+                                   webState:self.webStateImpl];
+  // Unlike the WebView case, always create a new controller and view.
+  // TODO(crbug.com/759178): What to do if this does return nil?
+  [self setNativeController:nativeContent];
+  if ([nativeContent respondsToSelector:@selector(virtualURL)]) {
+    item->SetVirtualURL([nativeContent virtualURL]);
+  }
+
+  NSString* title = [self.nativeController title];
+  if (title && item) {
+    base::string16 newTitle = base::SysNSStringToUTF16(title);
+    item->SetTitle(newTitle);
+  }
+}
+
+// Notifies WebStateObservers the completion of this navigation.
+- (void)didLoadNativeContentForNavigationItem:(web::NavigationItemImpl*)item
+                           placeholderContext:
+                               (web::NavigationContextImpl*)placeholderContext
+                            rendererInitiated:(BOOL)rendererInitiated {
+  DCHECK(!placeholderContext || placeholderContext->IsPlaceholderNavigation());
+  const GURL targetURL = item ? item->GetURL() : GURL::EmptyGURL();
+  const web::Referrer referrer;
+  ui::PageTransition transition = self.currentNavItem
+                                      ? self.currentNavItem->GetTransitionType()
+                                      : ui::PageTransitionFromInt(0);
+
+  std::unique_ptr<web::NavigationContextImpl> context =
+      [self.delegate legacyNativeContentController:self
+                         registerLoadRequestForURL:targetURL
+                                          referrer:referrer
+                                        transition:transition
+                            sameDocumentNavigation:NO
+                                    hasUserGesture:YES
+                                 rendererInitiated:rendererInitiated
+                             placeholderNavigation:NO];
+
+  self.webStateImpl->OnNavigationStarted(context.get());
+  [self.delegate legacyNativeContentControllerDidStartLoading:self];
+  if (placeholderContext && placeholderContext->GetItem()) {
+    DCHECK_EQ(placeholderContext->GetItem(), item);
+    self.navigationManagerImpl->CommitPendingItem(
+        placeholderContext->ReleaseItem());
+  } else {
+    self.navigationManagerImpl->CommitPendingItem();
+  }
+  context->SetHasCommitted(true);
+  self.webStateImpl->OnNavigationFinished(context.get());
+
+  if (item && web::GetWebClient()->IsAppSpecificURL(item->GetURL())) {
+    // Report the successful navigation to the ErrorRetryStateMachine.
+    item->error_retry_state_machine().SetNoNavigationError();
+  }
+
+  NSString* title = [self.nativeController title];
+  if (title) {
+    [self.delegate legacyNativeContentController:self
+                           setNativeContentTitle:title];
+  }
+
+  if ([self.nativeController respondsToSelector:@selector(setDelegate:)]) {
+    [self.nativeController setDelegate:self];
+  }
+
+  [self.delegate legacyNativeContentController:self
+             nativeContentLoadDidFinishWithURL:targetURL
+                                       context:context.get()];
+}
+
+@end
diff --git a/ios/web/web_state/ui/controller/crw_legacy_native_content_controller_delegate.h b/ios/web/web_state/ui/controller/crw_legacy_native_content_controller_delegate.h
new file mode 100644
index 0000000..d373f74
--- /dev/null
+++ b/ios/web/web_state/ui/controller/crw_legacy_native_content_controller_delegate.h
@@ -0,0 +1,87 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_WEB_WEB_STATE_UI_CONTROLLER_CRW_LEGACY_NATIVE_CONTENT_CONTROLLER_DELEGATE_H_
+#define IOS_WEB_WEB_STATE_UI_CONTROLLER_CRW_LEGACY_NATIVE_CONTENT_CONTROLLER_DELEGATE_H_
+
+#include "ios/web/public/referrer.h"
+#include "ui/base/page_transition_types.h"
+
+namespace web {
+class NavigationContextImpl;
+}
+@protocol CRWNativeContent;
+@class CRWLegacyNativeContentController;
+class GURL;
+
+// Delegate for the CRWLegacyNativeContentController.
+@protocol CRWLegacyNativeContentControllerDelegate
+
+// Whether the web usage is enabled.
+- (BOOL)legacyNativeContentControllerWebUsageEnabled:
+    (CRWLegacyNativeContentController*)contentController;
+
+// Whether the delegate is being destroyed.
+- (BOOL)legacyNativeContentControllerIsBeingDestroyed:
+    (CRWLegacyNativeContentController*)contentController;
+
+// Asks the delegate to remove the web view.
+- (void)legacyNativeContentControllerRemoveWebView:
+    (CRWLegacyNativeContentController*)contentController;
+
+// Called when a page (native or web) has actually started loading (i.e., for
+// a web page the document has actually changed), or after the load request has
+// been registered for a non-document-changing URL change. Updates internal
+// state not specific to web pages.
+- (void)legacyNativeContentControllerDidStartLoading:
+    (CRWLegacyNativeContentController*)contentController;
+
+// Loads a blank page directly into WKWebView as a placeholder for a Native View
+// or WebUI URL. This page has the URL about:blank?for=<encoded original URL>.
+// If |originalContext| is provided, reuse it for the placeholder navigation
+// instead of creating a new one. See "Handling App-specific URLs"
+// section of go/bling-navigation-experiment for details.
+- (web::NavigationContextImpl*)
+     legacyNativeContentController:
+         (CRWLegacyNativeContentController*)contentController
+    loadPlaceholderInWebViewForURL:(const GURL&)originalURL
+                 rendererInitiated:(BOOL)rendererInitiated
+                        forContext:(std::unique_ptr<web::NavigationContextImpl>)
+                                       originalContext;
+
+// Prepares web controller and delegates for anticipated page change.
+// Allows several methods to invoke webWill/DidAddPendingURL on anticipated page
+// change, using the same cached request and calculated transition types.
+// Returns navigation context for this request.
+- (std::unique_ptr<web::NavigationContextImpl>)
+    legacyNativeContentController:
+        (CRWLegacyNativeContentController*)contentController
+        registerLoadRequestForURL:(const GURL&)requestURL
+                         referrer:(const web::Referrer&)referrer
+                       transition:(ui::PageTransition)transition
+           sameDocumentNavigation:(BOOL)sameDocumentNavigation
+                   hasUserGesture:(BOOL)hasUserGesture
+                rendererInitiated:(BOOL)rendererInitiated
+            placeholderNavigation:(BOOL)placeholderNavigation;
+
+// Set the title of the native content.
+- (void)legacyNativeContentController:
+            (CRWLegacyNativeContentController*)contentController
+                setNativeContentTitle:(NSString*)title;
+
+// Notifies the delegate that the native content did change.
+- (void)legacyNativeContentController:
+            (CRWLegacyNativeContentController*)contentController
+               nativeContentDidChange:
+                   (id<CRWNativeContent>)previousNativeController;
+
+// Notifies the delegate that the native controller finished loading the URL.
+- (void)legacyNativeContentController:
+            (CRWLegacyNativeContentController*)contentController
+    nativeContentLoadDidFinishWithURL:(const GURL&)targetURL
+                              context:(web::NavigationContextImpl*)context;
+
+@end
+
+#endif  // IOS_WEB_WEB_STATE_UI_CONTROLLER_CRW_LEGACY_NATIVE_CONTENT_CONTROLLER_DELEGATE_H_
diff --git a/ios/web/web_state/ui/crw_web_controller.h b/ios/web/web_state/ui/crw_web_controller.h
index 0701f8bf..f91f9e28 100644
--- a/ios/web/web_state/ui/crw_web_controller.h
+++ b/ios/web/web_state/ui/crw_web_controller.h
@@ -21,8 +21,7 @@
 }  // namespace web
 
 @class CRWJSInjector;
-@protocol CRWNativeContent;
-@protocol CRWNativeContentProvider;
+@protocol CRWNativeContentHolder;
 @protocol CRWSwipeRecognizerProvider;
 @class CRWWebViewContentView;
 @protocol CRWWebViewProxy;
@@ -47,7 +46,6 @@
 // Defaults to NO; this should be enabled before attempting to access the view.
 @property(nonatomic, assign) BOOL webUsageEnabled;
 
-@property(nonatomic, weak) id<CRWNativeContentProvider> nativeProvider;
 @property(nonatomic, weak) id<CRWSwipeRecognizerProvider>
     swipeRecognizerProvider;
 
@@ -176,8 +174,9 @@
 // Notifies the CRWWebController that it has been hidden.
 - (void)wasHidden;
 
-// Returns the native controller (if any) current mananging the content.
-- (id<CRWNativeContent>)nativeController;
+// Returns the object holding the native controller (if any) currently managing
+// the content.
+- (id<CRWNativeContentHolder>)nativeContentHolder;
 
 // Called when NavigationManager has completed go to index same-document
 // navigation. Updates HTML5 history state, current document URL and sends
diff --git a/ios/web/web_state/ui/crw_web_controller.mm b/ios/web/web_state/ui/crw_web_controller.mm
index a50ebde2..cb0bd9086 100644
--- a/ios/web/web_state/ui/crw_web_controller.mm
+++ b/ios/web/web_state/ui/crw_web_controller.mm
@@ -94,6 +94,8 @@
 #import "ios/web/web_state/error_translation_util.h"
 #import "ios/web/web_state/page_viewport_state.h"
 #import "ios/web/web_state/session_certificate_policy_cache_impl.h"
+#import "ios/web/web_state/ui/controller/crw_legacy_native_content_controller.h"
+#import "ios/web/web_state/ui/controller/crw_legacy_native_content_controller_delegate.h"
 #import "ios/web/web_state/ui/crw_context_menu_controller.h"
 #import "ios/web/web_state/ui/crw_js_injector.h"
 #import "ios/web/web_state/ui/crw_swipe_recognizer_provider.h"
@@ -217,7 +219,7 @@
                                 CRWWKNavigationHandlerDelegate,
                                 CRWContextMenuDelegate,
                                 CRWJSInjectorDelegate,
-                                CRWNativeContentDelegate,
+                                CRWLegacyNativeContentControllerDelegate,
                                 CRWSSLStatusUpdaterDataSource,
                                 CRWSSLStatusUpdaterDelegate,
                                 CRWWebControllerContainerViewDelegate,
@@ -308,8 +310,8 @@
 // The current page state of the web view. Writing to this property
 // asynchronously applies the passed value to the current web view.
 @property(nonatomic, readwrite) web::PageDisplayState pageDisplayState;
-// The currently displayed native controller, if any.
-@property(weak, nonatomic, readwrite) id<CRWNativeContent> nativeController;
+@property(nonatomic, strong)
+    CRWLegacyNativeContentController* legacyNativeController;
 // Dictionary where keys are the names of WKWebView properties and values are
 // selector names which should be called when a corresponding property has
 // changed. e.g. @{ @"URL" : @"webViewURLDidChange" } means that
@@ -546,6 +548,9 @@
     web::BrowsingDataRemover::FromBrowserState(browserState)->AddObserver(self);
     web::WebFramesManagerImpl::CreateForWebState(_webStateImpl);
     web::FindInPageManagerImpl::CreateForWebState(_webStateImpl);
+    _legacyNativeController =
+        [[CRWLegacyNativeContentController alloc] initWithWebState:webState];
+    _legacyNativeController.delegate = self;
     [[NSNotificationCenter defaultCenter]
         addObserver:self
            selector:@selector(orientationDidChange)
@@ -584,7 +589,8 @@
   // Deferring WKProcessPool deallocation may lead to issues with cookie
   // clearing and and Browsing Data Partitioning implementation.
   @autoreleasepool {
-    [self setNativeControllerWebUsageEnabled:_webUsageEnabled];
+    [self.legacyNativeController
+        setNativeControllerWebUsageEnabled:_webUsageEnabled];
     if (enabled) {
       // Don't create the web view; let it be lazy created as needed.
     } else {
@@ -692,15 +698,11 @@
   web::PageDisplayState displayState;
   // If a native controller is present, record its display state instead of that
   // of the underlying placeholder webview.
-  if (self.nativeController) {
-    if ([self.nativeController respondsToSelector:@selector(contentOffset)]) {
-      displayState.scroll_state().set_content_offset(
-          [self.nativeController contentOffset]);
-    }
-    if ([self.nativeController respondsToSelector:@selector(contentInset)]) {
-      displayState.scroll_state().set_content_inset(
-          [self.nativeController contentInset]);
-    }
+  if ([self.legacyNativeController hasController]) {
+    displayState.scroll_state().set_content_offset(
+        [self.legacyNativeController contentOffset]);
+    displayState.scroll_state().set_content_inset(
+        [self.legacyNativeController contentInset]);
   } else if (self.webView) {
     displayState.set_scroll_state(web::PageScrollState(
         self.scrollPosition, self.webScrollView.contentInset));
@@ -730,19 +732,6 @@
   }
 }
 
-- (void)setNativeController:(id<CRWNativeContent>)nativeController {
-  // Check for pointer equality.
-  if (self.nativeController == nativeController)
-    return;
-
-  // Unset the delegate on the previous instance.
-  if ([self.nativeController respondsToSelector:@selector(setDelegate:)])
-    [self.nativeController setDelegate:nil];
-
-  [_containerView displayNativeContent:nativeController];
-  [self setNativeControllerWebUsageEnabled:_webUsageEnabled];
-}
-
 - (NSDictionary*)WKWebViewObservers {
   return @{
     @"serverTrust" : @"webViewSecurityFeaturesDidChange",
@@ -908,8 +897,7 @@
 }
 
 - (void)dismissModals {
-  if ([self.nativeController respondsToSelector:@selector(dismissModals)])
-    [self.nativeController dismissModals];
+  [self.legacyNativeController dismissModals];
 }
 
 // Caller must reset the delegate before calling.
@@ -919,10 +907,8 @@
   _SSLStatusUpdater = nil;
   _mojoFacade.reset();
 
-  self.nativeProvider = nil;
   self.swipeRecognizerProvider = nil;
-  if ([self.nativeController respondsToSelector:@selector(close)])
-    [self.nativeController close];
+  [self.legacyNativeController close];
 
   if (!_isHalted) {
     [self terminateNetworkActivity];
@@ -945,9 +931,6 @@
   DCHECK(!self.webView);
   // TODO(crbug.com/662860): Don't set the delegate to nil.
   [_containerView setDelegate:nil];
-  if ([self.nativeController respondsToSelector:@selector(setDelegate:)]) {
-    [self.nativeController setDelegate:nil];
-  }
   _touchTrackingRecognizer.touchTrackingDelegate = nil;
   [[_webViewProxy scrollViewProxy] removeObserver:self];
   [[NSNotificationCenter defaultCenter] removeObserver:self];
@@ -982,12 +965,8 @@
   }
   // Any non-web URL source is trusted.
   *trustLevel = web::URLVerificationTrustLevel::kAbsolute;
-  if (self.nativeController) {
-    if ([self.nativeController respondsToSelector:@selector(virtualURL)]) {
-      return [self.nativeController virtualURL];
-    } else {
-      return [self.nativeController url];
-    }
+  if ([self.legacyNativeController hasController]) {
+    return [self.legacyNativeController URL];
   }
   web::NavigationItem* item =
       self.navigationManagerImpl
@@ -1003,7 +982,7 @@
   _userInteractionState.SetLastUserInteraction(nullptr);
   base::RecordAction(base::UserMetricsAction("Reload"));
   GURL URL = self.currentNavItem->GetURL();
-  if ([self shouldLoadURLInNativeView:URL]) {
+  if ([self.legacyNativeController shouldLoadURLInNativeView:URL]) {
     std::unique_ptr<web::NavigationContextImpl> navigationContext = [self
         registerLoadRequestForURL:URL
                          referrer:self.currentNavItemReferrer
@@ -1016,7 +995,7 @@
     [self didStartLoading];
     self.navigationManagerImpl->CommitPendingItem(
         navigationContext->ReleaseItem());
-    [self.nativeController reload];
+    [self.legacyNativeController reload];
     navigationContext->SetHasCommitted(true);
     self.webStateImpl->OnNavigationFinished(navigationContext.get());
     [self loadCompleteWithSuccess:YES forContext:nullptr];
@@ -1071,16 +1050,7 @@
   // observers of the change via |-abortLoad|.
   self.navigationManagerImpl->DiscardNonCommittedItems();
   [self abortLoad];
-  web::NavigationItem* item = self.currentNavItem;
-  GURL navigationURL = item ? item->GetVirtualURL() : GURL::EmptyGURL();
-  // If discarding the non-committed entries results in an app-specific URL,
-  // reload it in its native view.
-  if (!self.nativeController &&
-      [self shouldLoadURLInNativeView:navigationURL]) {
-    // RendererInitiated flag is meaningless for showing previous native
-    // content page. RendererInitiated is used as less previledged.
-    [self loadCurrentURLInNativeViewWithRendererInitiatedNavigation:YES];
-  }
+  [self.legacyNativeController stopLoading];
 }
 
 - (void)loadCurrentURLWithRendererInitiatedNavigation:(BOOL)rendererInitiated {
@@ -1119,7 +1089,7 @@
       web::GetWebClient()->IsAppSpecificURL(currentURL);
   // If it's a chrome URL, but not a native one, create the WebUI instance.
   if (isCurrentURLAppSpecific &&
-      ![_nativeProvider hasControllerForURL:currentURL]) {
+      ![self.legacyNativeController shouldLoadURLInNativeView:currentURL]) {
     if (!(item->GetTransitionType() & ui::PAGE_TRANSITION_TYPED ||
           item->GetTransitionType() & ui::PAGE_TRANSITION_AUTO_BOOKMARK) &&
         self.hasOpener) {
@@ -1136,9 +1106,10 @@
   // Loading a new url, must check here if it's a native chrome URL and
   // replace the appropriate view if so, or transition back to a web view from
   // a native view.
-  if ([self shouldLoadURLInNativeView:currentURL]) {
-    [self loadCurrentURLInNativeViewWithRendererInitiatedNavigation:
-              rendererInitiated];
+  if ([self.legacyNativeController shouldLoadURLInNativeView:currentURL]) {
+    [self.legacyNativeController
+        loadCurrentURLInNativeViewWithRendererInitiatedNavigation:
+            rendererInitiated];
   } else {
     [self loadCurrentURLInWebView];
   }
@@ -1276,9 +1247,7 @@
 
 - (void)wasShown {
   self.visible = YES;
-  if ([self.nativeController respondsToSelector:@selector(wasShown)]) {
-    [self.nativeController wasShown];
-  }
+  [self.legacyNativeController wasShown];
 }
 
 - (void)wasHidden {
@@ -1286,13 +1255,11 @@
   if (_isHalted)
     return;
   [self recordStateInHistory];
-  if ([self.nativeController respondsToSelector:@selector(wasHidden)]) {
-    [self.nativeController wasHidden];
-  }
+  [self.legacyNativeController wasHidden];
 }
 
-- (id<CRWNativeContent>)nativeController {
-  return [_containerView nativeController];
+- (id<CRWNativeContentHolder>)nativeContentHolder {
+  return self.legacyNativeController;
 }
 
 - (void)setKeepsRenderProcessAlive:(BOOL)keepsRenderProcessAlive {
@@ -1657,7 +1624,7 @@
   // because it may incorrectly clobber the incoming page if this is a
   // back/forward navigation. WKWebView restores page scroll state for web view
   // pages anyways so this only impacts user if WKWebView is deleted.
-  if (!redirect && !self.nativeController &&
+  if (!redirect && ![self.legacyNativeController hasController] &&
       !web::GetWebClient()->IsSlimNavigationManagerEnabled()) {
     [self recordStateInHistory];
   }
@@ -1692,7 +1659,8 @@
     // load of NativeContent is synchronous. No need to transfer the ownership
     // for WebUI navigations, because those navigation do not have access to
     // NavigationContext.
-    if (![_nativeProvider hasControllerForURL:context->GetUrl()]) {
+    if (![self.legacyNativeController
+            shouldLoadURLInNativeView:context->GetUrl()]) {
       if (self.navigationManagerImpl->GetPendingItemIndex() == -1) {
         context->SetItem(self.navigationManagerImpl->ReleasePendingItem());
       }
@@ -2393,117 +2361,78 @@
   [_jsInjector executeJavaScript:script completionHandler:nil];
 }
 
-#pragma mark - Native Content
+#pragma mark - CRWLegacyNativeContentControllerDelegate
 
-// Returns |YES| if |url| should be loaded in a native view.
-- (BOOL)shouldLoadURLInNativeView:(const GURL&)url {
-  // App-specific URLs that don't require WebUI are loaded in native views.
-  return web::GetWebClient()->IsAppSpecificURL(url) &&
-         !self.webStateImpl->HasWebUI() &&
-         [_nativeProvider hasControllerForURL:url];
+- (BOOL)legacyNativeContentControllerWebUsageEnabled:
+    (CRWLegacyNativeContentController*)contentController {
+  return [self webUsageEnabled];
 }
 
-// Informs the native controller if web usage is allowed or not.
-- (void)setNativeControllerWebUsageEnabled:(BOOL)webUsageEnabled {
-  if ([self.nativeController
-          respondsToSelector:@selector(setWebUsageEnabled:)]) {
-    [self.nativeController setWebUsageEnabled:webUsageEnabled];
-  }
+- (BOOL)legacyNativeContentControllerIsBeingDestroyed:
+    (CRWLegacyNativeContentController*)contentController {
+  return _isBeingDestroyed;
 }
 
-// Loads the current URL in a native controller if using the legacy navigation
-// stack. If the new navigation stack is used, start loading a placeholder
-// into the web view, upon the completion of which the native controller will
-// be triggered.
-- (void)loadCurrentURLInNativeViewWithRendererInitiatedNavigation:
-    (BOOL)rendererInitiated {
-  if (!web::GetWebClient()->IsSlimNavigationManagerEnabled()) {
-    // Free the web view.
-    [self removeWebView];
-    [self presentNativeContentForNavigationItem:self.currentNavItem];
-    [self didLoadNativeContentForNavigationItem:self.currentNavItem
-                             placeholderContext:nullptr
-                              rendererInitiated:rendererInitiated];
-  } else {
-    // Just present the native view now. Leave the rest of native content load
-    // until the placeholder navigation finishes.
-    [self presentNativeContentForNavigationItem:self.currentNavItem];
-    web::NavigationContextImpl* context = [self
-        loadPlaceholderInWebViewForURL:self.currentNavItem->GetVirtualURL()
-                     rendererInitiated:rendererInitiated
-                            forContext:nullptr];
-    context->SetIsNativeContentPresented(true);
-  }
+- (void)legacyNativeContentControllerRemoveWebView:
+    (CRWLegacyNativeContentController*)contentController {
+  [self removeWebView];
 }
 
-// Presents native content using the native controller for |item| without
-// notifying WebStateObservers. This method does not modify the underlying web
-// view. It simply covers the web view with the native content.
-// |-didLoadNativeContentForNavigationItem| must be called some time later
-// to notify WebStateObservers.
-- (void)presentNativeContentForNavigationItem:(web::NavigationItem*)item {
-  const GURL targetURL = item ? item->GetURL() : GURL::EmptyGURL();
-  id<CRWNativeContent> nativeContent =
-      [_nativeProvider controllerForURL:targetURL webState:self.webState];
-  // Unlike the WebView case, always create a new controller and view.
-  // TODO(crbug.com/759178): What to do if this does return nil?
-  [self setNativeController:nativeContent];
-  if ([nativeContent respondsToSelector:@selector(virtualURL)]) {
-    item->SetVirtualURL([nativeContent virtualURL]);
-  }
-
-  NSString* title = [self.nativeController title];
-  if (title && item) {
-    base::string16 newTitle = base::SysNSStringToUTF16(title);
-    item->SetTitle(newTitle);
-  }
-}
-
-// Notifies WebStateObservers the completion of this navigation.
-- (void)didLoadNativeContentForNavigationItem:(web::NavigationItemImpl*)item
-                           placeholderContext:
-                               (web::NavigationContextImpl*)placeholderContext
-                            rendererInitiated:(BOOL)rendererInitiated {
-  DCHECK(!placeholderContext || placeholderContext->IsPlaceholderNavigation());
-  const GURL targetURL = item ? item->GetURL() : GURL::EmptyGURL();
-  const web::Referrer referrer;
-  std::unique_ptr<web::NavigationContextImpl> context =
-      [self registerLoadRequestForURL:targetURL
-                             referrer:referrer
-                           transition:self.currentTransition
-               sameDocumentNavigation:NO
-                       hasUserGesture:YES
-                    rendererInitiated:rendererInitiated
-                placeholderNavigation:NO];
-
-  self.webStateImpl->OnNavigationStarted(context.get());
+- (void)legacyNativeContentControllerDidStartLoading:
+    (CRWLegacyNativeContentController*)contentController {
   [self didStartLoading];
-  if (placeholderContext && placeholderContext->GetItem()) {
-    DCHECK_EQ(placeholderContext->GetItem(), item);
-    self.navigationManagerImpl->CommitPendingItem(
-        placeholderContext->ReleaseItem());
-  } else {
-    self.navigationManagerImpl->CommitPendingItem();
-  }
-  context->SetHasCommitted(true);
-  self.webStateImpl->OnNavigationFinished(context.get());
+}
 
-  if (item && web::GetWebClient()->IsAppSpecificURL(item->GetURL())) {
-    // Report the successful navigation to the ErrorRetryStateMachine.
-    item->error_retry_state_machine().SetNoNavigationError();
-  }
+- (web::NavigationContextImpl*)
+     legacyNativeContentController:
+         (CRWLegacyNativeContentController*)contentController
+    loadPlaceholderInWebViewForURL:(const GURL&)originalURL
+                 rendererInitiated:(BOOL)rendererInitiated
+                        forContext:(std::unique_ptr<web::NavigationContextImpl>)
+                                       originalContext {
+  return [self loadPlaceholderInWebViewForURL:originalURL
+                            rendererInitiated:rendererInitiated
+                                   forContext:std::move(originalContext)];
+}
 
-  NSString* title = [self.nativeController title];
-  if (title) {
-    [self setNavigationItemTitle:title];
-  }
+- (std::unique_ptr<web::NavigationContextImpl>)
+    legacyNativeContentController:
+        (CRWLegacyNativeContentController*)contentController
+        registerLoadRequestForURL:(const GURL&)requestURL
+                         referrer:(const web::Referrer&)referrer
+                       transition:(ui::PageTransition)transition
+           sameDocumentNavigation:(BOOL)sameDocumentNavigation
+                   hasUserGesture:(BOOL)hasUserGesture
+                rendererInitiated:(BOOL)rendererInitiated
+            placeholderNavigation:(BOOL)placeholderNavigation {
+  return [self registerLoadRequestForURL:requestURL
+                                referrer:referrer
+                              transition:transition
+                  sameDocumentNavigation:sameDocumentNavigation
+                          hasUserGesture:hasUserGesture
+                       rendererInitiated:rendererInitiated
+                   placeholderNavigation:placeholderNavigation];
+}
 
-  if ([self.nativeController respondsToSelector:@selector(setDelegate:)]) {
-    [self.nativeController setDelegate:self];
-  }
+- (void)legacyNativeContentController:
+            (CRWLegacyNativeContentController*)contentController
+                setNativeContentTitle:(NSString*)title {
+  [self setNavigationItemTitle:title];
+}
 
+- (void)legacyNativeContentController:
+            (CRWLegacyNativeContentController*)contentController
+               nativeContentDidChange:
+                   (id<CRWNativeContent>)previousNativeController {
+  [_containerView nativeContentDidChange:previousNativeController];
+}
+
+- (void)legacyNativeContentController:
+            (CRWLegacyNativeContentController*)contentController
+    nativeContentLoadDidFinishWithURL:(const GURL&)targetURL
+                              context:(web::NavigationContextImpl*)context {
   self.navigationHandler.navigationState = web::WKNavigationState::FINISHED;
-  [self didFinishWithURL:targetURL loadSuccess:YES context:context.get()];
+  [self didFinishWithURL:targetURL loadSuccess:YES context:context];
 }
 
 #pragma mark - CRWWebControllerContainerViewDelegate
@@ -2515,7 +2444,8 @@
 
 - (UIEdgeInsets)nativeContentInsetsForContainerView:
     (CRWWebControllerContainerView*)containerView {
-  return [self.nativeProvider nativeContentInsetForWebState:self.webState];
+  return [[self nativeContentHolder].nativeProvider
+      nativeContentInsetForWebState:self.webState];
 }
 
 - (BOOL)shouldKeepRenderProcessAliveForContainerView:
@@ -2528,6 +2458,16 @@
   [web::GetWebClient()->GetWindowedContainer() addSubview:viewToStash];
 }
 
+- (void)containerViewResetNativeController:
+    (CRWWebControllerContainerView*)containerView {
+  [self.legacyNativeController resetNativeController];
+}
+
+- (id<CRWNativeContentHolder>)containerViewNativeContentHolder:
+    (CRWWebControllerContainerView*)containerView {
+  return self.nativeContentHolder;
+}
+
 #pragma mark - JavaScript message Helpers (Private)
 
 - (BOOL)respondToMessage:(base::DictionaryValue*)message
@@ -3514,24 +3454,7 @@
           // the browser allows to proceed with the load.
           [self loadCurrentURLWithRendererInitiatedNavigation:NO];
         } else {
-          // If discarding non-committed items results in a NavigationItem that
-          // should be loaded via a native controller, load that URL, as its
-          // native controller will need to be recreated.  Note that a
-          // successful preload of a page with an certificate error will result
-          // in this block executing on a CRWWebController with no
-          // NavigationManager.  Additionally, if a page with a certificate
-          // error is opened in a new tab, its last committed NavigationItem
-          // will be null.
-          NavigationManager* navigationManager = self.navigationManagerImpl;
-          web::NavigationItem* item =
-              navigationManager ? navigationManager->GetLastCommittedItem()
-                                : nullptr;
-          if (item && [self shouldLoadURLInNativeView:item->GetURL()]) {
-            // RendererInitiated flag is meaningless for showing previous native
-            // content page. RendererInitiated is used as less previledged.
-            [self
-                loadCurrentURLInNativeViewWithRendererInitiatedNavigation:YES];
-          }
+          [self.legacyNativeController handleSSLError];
         }
       }));
 
@@ -3614,7 +3537,7 @@
         self.navigationManagerImpl->GetVisibleItem();
     const GURL& visibleURL =
         visibleItem ? visibleItem->GetURL() : GURL::EmptyGURL();
-    if (![self shouldLoadURLInNativeView:visibleURL])
+    if (![self.legacyNativeController shouldLoadURLInNativeView:visibleURL])
       [self displayWebView];
   }
 }
@@ -4273,18 +4196,11 @@
         item->SetURL(ExtractUrlFromPlaceholderUrl(webViewURL));
       }
 
-      if ([self shouldLoadURLInNativeView:item->GetURL()]) {
-        // Native content may have already been presented if this navigation is
-        // started in
-        // |-loadCurrentURLInNativeViewWithRendererInitiatedNavigation:|. If
-        // not, present it now.
-        if (!context->IsNativeContentPresented()) {
-          [self presentNativeContentForNavigationItem:item];
-        }
-        bool rendererInitiated = context->IsRendererInitiated();
-        [self didLoadNativeContentForNavigationItem:item
-                                 placeholderContext:context
-                                  rendererInitiated:rendererInitiated];
+      if ([self.legacyNativeController
+              shouldLoadURLInNativeView:item->GetURL()]) {
+        [self.legacyNativeController
+            webViewDidFinishNavigationWithContext:context
+                                          andItem:item];
       } else if (web::GetWebClient()->IsSlimNavigationManagerEnabled() &&
                  item->error_retry_state_machine().state() ==
                      web::ErrorRetryState::kNoNavigationError) {
@@ -4616,18 +4532,9 @@
             contextForNavigation:navigation];
     [self loadCancelled];
     self.navigationManagerImpl->DiscardNonCommittedItems();
-    // If discarding the non-committed entries results in native content URL,
-    // reload it in its native view. For WKBasedNavigationManager, this is not
-    // necessary because WKWebView takes care of reloading the placeholder URL,
-    // which triggers native view upon completion.
-    if (!web::GetWebClient()->IsSlimNavigationManagerEnabled() &&
-        !self.nativeController) {
-      GURL lastCommittedURL = self.webState->GetLastCommittedURL();
-      if ([self shouldLoadURLInNativeView:lastCommittedURL]) {
-        [self loadCurrentURLInNativeViewWithRendererInitiatedNavigation:
-                  navigationContext->IsRendererInitiated()];
-      }
-    }
+
+    [self.legacyNativeController
+        handleCancelledErrorForContext:navigationContext];
 
     if (provisionalLoad) {
       self.webStateImpl->OnNavigationFinished(navigationContext);
@@ -4762,20 +4669,6 @@
   [self touched:YES];
 }
 
-#pragma mark - CRWNativeContentDelegate methods
-
-- (void)nativeContent:(id)content titleDidChange:(NSString*)title {
-  [self setNavigationItemTitle:title];
-}
-
-- (void)nativeContent:(id)content
-    handleContextMenu:(const web::ContextMenuParams&)params {
-  if (_isBeingDestroyed) {
-    return;
-  }
-  self.webStateImpl->HandleContextMenu(params);
-}
-
 #pragma mark - KVO Observation
 
 - (void)observeValueForKeyPath:(NSString*)keyPath
@@ -5276,7 +5169,7 @@
 
 - (BOOL)navigationHandler:(CRWWKNavigationHandler*)navigationHandler
     shouldLoadURLInNativeView:(const GURL&)url {
-  return [self shouldLoadURLInNativeView:url];
+  return [self.legacyNativeController shouldLoadURLInNativeView:url];
 }
 
 - (void)navigationHandlerRequirePageReconstruction:
diff --git a/ios/web/web_state/ui/crw_web_controller_container_view.h b/ios/web/web_state/ui/crw_web_controller_container_view.h
index a2d0b1b..e32a523 100644
--- a/ios/web/web_state/ui/crw_web_controller_container_view.h
+++ b/ios/web/web_state/ui/crw_web_controller_container_view.h
@@ -9,10 +9,11 @@
 
 #import "ios/web/common/crw_content_view.h"
 
+@protocol CRWNativeContent;
+@protocol CRWNativeContentHolder;
 @class CRWWebControllerContainerView;
 @class CRWWebViewContentView;
 @class CRWWebViewProxyImpl;
-@protocol CRWNativeContent;
 
 @protocol CRWWebControllerContainerViewDelegate<NSObject>
 
@@ -30,11 +31,19 @@
 - (BOOL)shouldKeepRenderProcessAliveForContainerView:
     (CRWWebControllerContainerView*)containerView;
 
-// Instructs the delegate to add the |viewToStash| to the view hieararchy to
+// Instructs the delegate to add the |viewToStash| to the view hierarchy to
 // keep the render process alive.
 - (void)containerView:(CRWWebControllerContainerView*)containerView
     storeWebViewInWindow:(UIView*)viewToStash;
 
+// Resets the native controller.
+- (void)containerViewResetNativeController:
+    (CRWWebControllerContainerView*)containerView;
+
+// Returns the native content holder.
+- (id<CRWNativeContentHolder>)containerViewNativeContentHolder:
+    (CRWWebControllerContainerView*)containerView;
+
 @end
 
 // Container view class that manages the display of content within
@@ -45,8 +54,6 @@
 // The web view content view being displayed.
 @property(nonatomic, strong, readonly)
     CRWWebViewContentView* webViewContentView;
-// The native controller whose content is being displayed.
-@property(nonatomic, strong, readonly) id<CRWNativeContent> nativeController;
 // The currently displayed transient content view.
 @property(nonatomic, strong, readonly) CRWContentView* transientContentView;
 @property(nonatomic, weak) id<CRWWebControllerContainerViewDelegate>
@@ -77,8 +84,8 @@
 // Replaces the currently displayed content with |webViewContentView|.
 - (void)displayWebViewContentView:(CRWWebViewContentView*)webViewContentView;
 
-// Replaces the currently displayed content with |nativeController|'s view.
-- (void)displayNativeContent:(id<CRWNativeContent>)nativeController;
+// Notifies the container that the native content changed
+- (void)nativeContentDidChange:(id<CRWNativeContent>)previousNativeController;
 
 // Adds |transientContentView| as a subview above previously displayed content.
 - (void)displayTransientContent:(CRWContentView*)transientContentView;
diff --git a/ios/web/web_state/ui/crw_web_controller_container_view.mm b/ios/web/web_state/ui/crw_web_controller_container_view.mm
index deeca4c8..6b2ff9eb 100644
--- a/ios/web/web_state/ui/crw_web_controller_container_view.mm
+++ b/ios/web/web_state/ui/crw_web_controller_container_view.mm
@@ -9,6 +9,7 @@
 #import "ios/web/common/crw_web_view_content_view.h"
 #include "ios/web/common/features.h"
 #import "ios/web/public/web_state/ui/crw_native_content.h"
+#import "ios/web/public/web_state/ui/crw_native_content_holder.h"
 #import "ios/web/web_state/ui/crw_web_view_proxy_impl.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
@@ -20,17 +21,18 @@
 // Redefine properties as readwrite.
 @property(nonatomic, strong, readwrite)
     CRWWebViewContentView* webViewContentView;
-@property(nonatomic, strong, readwrite) id<CRWNativeContent> nativeController;
 @property(nonatomic, strong, readwrite) CRWContentView* transientContentView;
 
 // Convenience getter for the proxy object.
 @property(nonatomic, weak, readonly) CRWWebViewProxyImpl* contentViewProxy;
 
+// The native controller whose content is being displayed.
+@property(nonatomic, strong, readonly) id<CRWNativeContent> nativeController;
+
 @end
 
 @implementation CRWWebControllerContainerView
 @synthesize webViewContentView = _webViewContentView;
-@synthesize nativeController = _nativeController;
 @synthesize transientContentView = _transientContentView;
 @synthesize delegate = _delegate;
 
@@ -63,6 +65,11 @@
 
 #pragma mark Accessors
 
+- (id<CRWNativeContent>)nativeController {
+  return
+      [[self.delegate containerViewNativeContentHolder:self] nativeController];
+}
+
 - (void)setWebViewContentView:(CRWWebViewContentView*)webViewContentView {
   if (![_webViewContentView isEqual:webViewContentView]) {
     [_webViewContentView removeFromSuperview];
@@ -72,20 +79,6 @@
   }
 }
 
-- (void)setNativeController:(id<CRWNativeContent>)nativeController {
-  if (![_nativeController isEqual:nativeController]) {
-    __weak id oldController = _nativeController;
-    if ([oldController respondsToSelector:@selector(willBeDismissed)]) {
-      [oldController willBeDismissed];
-    }
-    [[oldController view] removeFromSuperview];
-    _nativeController = nativeController;
-    // TODO(crbug.com/503297): Re-enable this DCHECK once native controller
-    // leaks are fixed.
-    //    DCHECK(!oldController);
-  }
-}
-
 - (void)setTransientContentView:(CRWContentView*)transientContentView {
   if (![_transientContentView isEqual:transientContentView]) {
     [_transientContentView removeFromSuperview];
@@ -173,9 +166,21 @@
 
 #pragma mark Content Setters
 
+- (void)resetNativeContent:(id<CRWNativeContent>)nativeControllerToReset {
+  __weak id oldController = nativeControllerToReset;
+  if ([oldController respondsToSelector:@selector(willBeDismissed)]) {
+    [oldController willBeDismissed];
+  }
+  [[oldController view] removeFromSuperview];
+  // TODO(crbug.com/503297): Re-enable this DCHECK once native controller
+  // leaks are fixed.
+  //    DCHECK(!oldController);
+}
+
 - (void)resetContent {
   self.webViewContentView = nil;
-  self.nativeController = nil;
+  [self resetNativeContent:self.nativeController];
+  [self.delegate containerViewResetNativeController:self];
   self.transientContentView = nil;
   self.contentViewProxy.contentView = nil;
 }
@@ -183,17 +188,20 @@
 - (void)displayWebViewContentView:(CRWWebViewContentView*)webViewContentView {
   DCHECK(webViewContentView);
   self.webViewContentView = webViewContentView;
-  self.nativeController = nil;
+  [self resetNativeContent:self.nativeController];
+  [self.delegate containerViewResetNativeController:self];
   self.transientContentView = nil;
   self.contentViewProxy.contentView = self.webViewContentView;
   [self updateWebViewContentViewForContainerWindow:self.window];
   [self setNeedsLayout];
 }
 
-- (void)displayNativeContent:(id<CRWNativeContent>)nativeController {
-  DCHECK(nativeController);
+- (void)nativeContentDidChange:(id<CRWNativeContent>)previousNativeController {
+  DCHECK(self.nativeController);
   self.webViewContentView = nil;
-  self.nativeController = nativeController;
+  if (![self.nativeController isEqual:previousNativeController]) {
+    [self resetNativeContent:previousNativeController];
+  }
   self.transientContentView = nil;
   self.contentViewProxy.contentView = nil;
   [self setNeedsLayout];
diff --git a/ios/web/web_state/ui/crw_web_controller_unittest.mm b/ios/web/web_state/ui/crw_web_controller_unittest.mm
index ed39638..0fa00fb 100644
--- a/ios/web/web_state/ui/crw_web_controller_unittest.mm
+++ b/ios/web/web_state/ui/crw_web_controller_unittest.mm
@@ -40,6 +40,7 @@
 #import "ios/web/public/test/fakes/test_web_view_content_view.h"
 #import "ios/web/public/test/web_view_content_test_util.h"
 #import "ios/web/public/web_state/ui/crw_native_content.h"
+#import "ios/web/public/web_state/ui/crw_native_content_holder.h"
 #import "ios/web/public/web_state/ui/crw_native_content_provider.h"
 #include "ios/web/public/web_state/url_verification_constants.h"
 #include "ios/web/public/web_state/web_state_observer.h"
@@ -307,7 +308,8 @@
   TestNativeContent* content =
       [[TestNativeContent alloc] initWithURL:native_url virtualURL:native_url];
   [mock_native_provider setController:content forURL:native_url];
-  [web_controller() setNativeProvider:mock_native_provider];
+  [[web_controller() nativeContentHolder]
+      setNativeProvider:mock_native_provider];
 
   AddPendingItem(native_url, ui::PAGE_TRANSITION_TYPED);
 
@@ -1003,7 +1005,8 @@
   void SetUp() override {
     ProgrammaticWebTestWithWebController::SetUp();
     mock_native_provider_ = [[TestNativeContentProvider alloc] init];
-    [web_controller() setNativeProvider:mock_native_provider_];
+    [[web_controller() nativeContentHolder]
+        setNativeProvider:mock_native_provider_];
   }
 
   void Load(const GURL& URL) {
diff --git a/ios/web/web_state/web_state_impl.mm b/ios/web/web_state/web_state_impl.mm
index e2f546c7..df85751 100644
--- a/ios/web/web_state/web_state_impl.mm
+++ b/ios/web/web_state/web_state_impl.mm
@@ -33,6 +33,7 @@
 #import "ios/web/public/web_client.h"
 #import "ios/web/public/web_state/context_menu_params.h"
 #import "ios/web/public/web_state/ui/crw_native_content.h"
+#import "ios/web/public/web_state/ui/crw_native_content_holder.h"
 #import "ios/web/public/web_state/web_state_delegate.h"
 #include "ios/web/public/web_state/web_state_interface_provider.h"
 #include "ios/web/public/web_state/web_state_observer.h"
@@ -702,7 +703,7 @@
       navigation_manager_->GetLastCommittedItemImpl();
   GURL lastCommittedURL;
   if (item) {
-    if ([web_controller_.nativeController
+    if ([[web_controller_ nativeContentHolder].nativeController
             respondsToSelector:@selector(virtualURL)] ||
         item->error_retry_state_machine().state() ==
             ErrorRetryState::kReadyToDisplayErrorForFailedNavigation) {
diff --git a/ios/web/web_state/web_state_observer_inttest.mm b/ios/web/web_state/web_state_observer_inttest.mm
index f4f5fd9e..0ccf2b6 100644
--- a/ios/web/web_state/web_state_observer_inttest.mm
+++ b/ios/web/web_state/web_state_observer_inttest.mm
@@ -30,6 +30,7 @@
 #import "ios/web/public/test/web_view_interaction_test_util.h"
 #import "ios/web/public/web_client.h"
 #import "ios/web/public/web_state/navigation_context.h"
+#import "ios/web/public/web_state/ui/crw_native_content_holder.h"
 #include "ios/web/public/web_state/web_state_observer.h"
 #import "ios/web/public/web_state/web_state_policy_decider.h"
 #include "ios/web/test/test_url_constants.h"
@@ -866,7 +867,8 @@
                                            virtualURL:GURL::EmptyGURL()];
 
     WebStateImpl* web_state_impl = reinterpret_cast<WebStateImpl*>(web_state());
-    web_state_impl->GetWebController().nativeProvider = provider_;
+    [web_state_impl->GetWebController() nativeContentHolder].nativeProvider =
+        provider_;
 
     test_server_ = std::make_unique<EmbeddedTestServer>();
     test_server_->RegisterRequestHandler(
diff --git a/ios/web_view/internal/sync/web_view_sync_client.mm b/ios/web_view/internal/sync/web_view_sync_client.mm
index a39dddff..100f80f 100644
--- a/ios/web_view/internal/sync/web_view_sync_client.mm
+++ b/ios/web_view/internal/sync/web_view_sync_client.mm
@@ -200,8 +200,12 @@
 
 base::WeakPtr<syncer::ModelTypeControllerDelegate>
 WebViewSyncClient::GetControllerDelegateForModelType(syncer::ModelType type) {
-  NOTREACHED();
-  // TODO(crbug.com/873790): Figure out if USER_CONSENTS need to be enabled.
+  // Even though USER_CONSENTS are disabled, the component factory will create
+  // its controller and ask for a delegate; this client later removes the
+  // controller. No other data type should ask for its delegate.
+  // TODO(crbug.com/873790): Figure out if USER_CONSENTS need to be enabled or
+  // find a better way how to disable it.
+  DCHECK_EQ(type, syncer::USER_CONSENTS);
   return base::WeakPtr<syncer::ModelTypeControllerDelegate>();
 }
 
diff --git a/media/capture/video_capturer_source.h b/media/capture/video_capturer_source.h
index d98f6079a..50fecbd 100644
--- a/media/capture/video_capturer_source.h
+++ b/media/capture/video_capturer_source.h
@@ -46,7 +46,7 @@
                                    base::TimeTicks estimated_capture_time)>;
 
   using VideoCaptureDeviceFormatsCB =
-      base::Callback<void(const media::VideoCaptureFormats&)>;
+      base::OnceCallback<void(const media::VideoCaptureFormats&)>;
 
   using RunningCallback = base::Callback<void(bool)>;
 
diff --git a/media/gpu/accelerated_video_decoder.h b/media/gpu/accelerated_video_decoder.h
index fb7acd82..11c4ad9 100644
--- a/media/gpu/accelerated_video_decoder.h
+++ b/media/gpu/accelerated_video_decoder.h
@@ -11,6 +11,7 @@
 #include "base/macros.h"
 #include "media/base/decrypt_config.h"
 #include "media/gpu/media_gpu_export.h"
+#include "ui/gfx/geometry/rect.h"
 #include "ui/gfx/geometry/size.h"
 
 namespace media {
@@ -66,11 +67,12 @@
   // we need a new set of them, or when an error occurs.
   virtual DecodeResult Decode() WARN_UNUSED_RESULT = 0;
 
-  // Return dimensions/required number of pictures that client should be ready
-  // to provide for the decoder to function properly (of which up to
-  // GetNumReferenceFrames() might be needed for internal decoding). To be used
-  // after Decode() returns kAllocateNewSurfaces.
+  // Return dimensions/visible rectangle/required number of pictures that client
+  // should be ready to provide for the decoder to function properly (of which
+  // up to GetNumReferenceFrames() might be needed for internal decoding). To be
+  // used after Decode() returns kAllocateNewSurfaces.
   virtual gfx::Size GetPicSize() const = 0;
+  virtual gfx::Rect GetVisibleRect() const = 0;
   virtual size_t GetRequiredNumOfPictures() const = 0;
   virtual size_t GetNumReferenceFrames() const = 0;
 
diff --git a/media/gpu/h264_decoder.cc b/media/gpu/h264_decoder.cc
index 89a02918..f621695 100644
--- a/media/gpu/h264_decoder.cc
+++ b/media/gpu/h264_decoder.cc
@@ -1416,6 +1416,10 @@
   return pic_size_;
 }
 
+gfx::Rect H264Decoder::GetVisibleRect() const {
+  return visible_rect_;
+}
+
 size_t H264Decoder::GetRequiredNumOfPictures() const {
   constexpr size_t kPicsInPipeline = limits::kMaxVideoFrames + 1;
   return GetNumReferenceFrames() + kPicsInPipeline;
diff --git a/media/gpu/h264_decoder.h b/media/gpu/h264_decoder.h
index b1651d7..0c8250f 100644
--- a/media/gpu/h264_decoder.h
+++ b/media/gpu/h264_decoder.h
@@ -159,6 +159,7 @@
   void Reset() override;
   DecodeResult Decode() override WARN_UNUSED_RESULT;
   gfx::Size GetPicSize() const override;
+  gfx::Rect GetVisibleRect() const override;
   size_t GetRequiredNumOfPictures() const override;
   size_t GetNumReferenceFrames() const override;
 
diff --git a/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.cc b/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.cc
index 057918a..e4c8191 100644
--- a/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.cc
+++ b/media/gpu/v4l2/v4l2_slice_video_decode_accelerator.cc
@@ -550,12 +550,12 @@
 
   VideoPixelFormat pixel_format =
       V4L2Device::V4L2PixFmtToVideoPixelFormat(output_format_fourcc_);
-
   child_task_runner_->PostTask(
       FROM_HERE,
-      base::BindOnce(&VideoDecodeAccelerator::Client::ProvidePictureBuffers,
-                     client_, num_pictures, pixel_format, 1, coded_size_,
-                     device_->GetTextureTarget()));
+      base::BindOnce(
+          &VideoDecodeAccelerator::Client::ProvidePictureBuffersWithVisibleRect,
+          client_, num_pictures, pixel_format, 1, coded_size_,
+          decoder_->GetVisibleRect(), device_->GetTextureTarget()));
 
   // Go into kAwaitingPictureBuffers to prevent us from doing any more decoding
   // or event handling while we are waiting for AssignPictureBuffers(). Not
diff --git a/media/gpu/v4l2/v4l2_video_decode_accelerator.cc b/media/gpu/v4l2/v4l2_video_decode_accelerator.cc
index 2ef7218d..7e55c00 100644
--- a/media/gpu/v4l2/v4l2_video_decode_accelerator.cc
+++ b/media/gpu/v4l2/v4l2_video_decode_accelerator.cc
@@ -2551,9 +2551,10 @@
           : PIXEL_FORMAT_UNKNOWN;
 
   child_task_runner_->PostTask(
-      FROM_HERE, base::BindOnce(&Client::ProvidePictureBuffers, client_,
-                                buffer_count, pixel_format, 1, egl_image_size_,
-                                device_->GetTextureTarget()));
+      FROM_HERE,
+      base::BindOnce(&Client::ProvidePictureBuffersWithVisibleRect, client_,
+                     buffer_count, pixel_format, 1, egl_image_size_,
+                     gfx::Rect(visible_size_), device_->GetTextureTarget()));
 
   // Go into kAwaitingPictureBuffers to prevent us from doing any more decoding
   // or event handling while we are waiting for AssignPictureBuffers(). Not
diff --git a/media/gpu/vaapi/vaapi_video_decode_accelerator.cc b/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
index d0ceeda5..bdce795 100644
--- a/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
+++ b/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
@@ -452,7 +452,8 @@
             base::BindOnce(
                 &VaapiVideoDecodeAccelerator::InitiateSurfaceSetChange,
                 weak_this_, decoder_->GetRequiredNumOfPictures(),
-                decoder_->GetPicSize(), decoder_->GetNumReferenceFrames()));
+                decoder_->GetPicSize(), decoder_->GetNumReferenceFrames(),
+                decoder_->GetVisibleRect()));
         // We'll get rescheduled once ProvidePictureBuffers() finishes.
         return;
 
@@ -492,7 +493,8 @@
 void VaapiVideoDecodeAccelerator::InitiateSurfaceSetChange(
     size_t num_pics,
     gfx::Size size,
-    size_t num_reference_frames) {
+    size_t num_reference_frames,
+    const gfx::Rect& visible_rect) {
   DCHECK(task_runner_->BelongsToCurrentThread());
   DCHECK(!awaiting_va_surfaces_recycle_);
   DCHECK_GT(num_pics, num_reference_frames);
@@ -506,6 +508,7 @@
   awaiting_va_surfaces_recycle_ = true;
 
   requested_pic_size_ = size;
+  requested_visible_rect_ = visible_rect;
 
   if (buffer_allocation_mode_ == BufferAllocationMode::kSuperReduced) {
     // Add one to the reference frames for the one being currently egressed.
@@ -576,10 +579,10 @@
   const VideoPixelFormat format = GfxBufferFormatToVideoPixelFormat(
       vaapi_picture_factory_->GetBufferFormat());
   task_runner_->PostTask(
-      FROM_HERE,
-      base::BindOnce(&Client::ProvidePictureBuffers, client_,
-                     requested_num_pics_, format, 1, requested_pic_size_,
-                     vaapi_picture_factory_->GetGLTextureTarget()));
+      FROM_HERE, base::BindOnce(&Client::ProvidePictureBuffersWithVisibleRect,
+                                client_, requested_num_pics_, format, 1,
+                                requested_pic_size_, requested_visible_rect_,
+                                vaapi_picture_factory_->GetGLTextureTarget()));
   // |client_| may respond via AssignPictureBuffers().
 }
 
diff --git a/media/gpu/vaapi/vaapi_video_decode_accelerator.h b/media/gpu/vaapi/vaapi_video_decode_accelerator.h
index 7bb6c00..2d7fb0b0 100644
--- a/media/gpu/vaapi/vaapi_video_decode_accelerator.h
+++ b/media/gpu/vaapi/vaapi_video_decode_accelerator.h
@@ -183,7 +183,8 @@
   // by |decoder_|.
   void InitiateSurfaceSetChange(size_t num_pics,
                                 gfx::Size size,
-                                size_t num_reference_frames);
+                                size_t num_reference_frames,
+                                const gfx::Rect& visible_rect);
 
   // Check if the surfaces have been released or post ourselves for later.
   void TryFinishSurfaceSetChange();
@@ -313,9 +314,11 @@
   // to be returned before we can free them. Only used on |task_runner_|.
   bool awaiting_va_surfaces_recycle_;
 
-  // Last requested number/resolution of output PictureBuffers.
+  // Last requested number/resolution/visible rectangle of output
+  // PictureBuffers.
   size_t requested_num_pics_;
   gfx::Size requested_pic_size_;
+  gfx::Rect requested_visible_rect_;
   // Potential extra PictureBuffers to request, used only on
   // BufferAllocationMode::kNone, see DecideBufferAllocationMode().
   size_t num_extra_pics_ = 0;
diff --git a/media/gpu/vaapi/vaapi_video_decode_accelerator_unittest.cc b/media/gpu/vaapi/vaapi_video_decode_accelerator_unittest.cc
index a98824ea..ebff5f27 100644
--- a/media/gpu/vaapi/vaapi_video_decode_accelerator_unittest.cc
+++ b/media/gpu/vaapi/vaapi_video_decode_accelerator_unittest.cc
@@ -60,6 +60,7 @@
   MOCK_METHOD0(Reset, void());
   MOCK_METHOD0(Decode, DecodeResult());
   MOCK_CONST_METHOD0(GetPicSize, gfx::Size());
+  MOCK_CONST_METHOD0(GetVisibleRect, gfx::Rect());
   MOCK_CONST_METHOD0(GetRequiredNumOfPictures, size_t());
   MOCK_CONST_METHOD0(GetNumReferenceFrames, size_t());
 };
diff --git a/media/gpu/vaapi/vaapi_video_encode_accelerator.cc b/media/gpu/vaapi/vaapi_video_encode_accelerator.cc
index ba1da76..ea93b9b 100644
--- a/media/gpu/vaapi/vaapi_video_encode_accelerator.cc
+++ b/media/gpu/vaapi/vaapi_video_encode_accelerator.cc
@@ -1308,15 +1308,7 @@
   pic_param.luma_dc_qindex_delta = frame_header->quant_params.delta_q_y_dc;
   pic_param.chroma_ac_qindex_delta = frame_header->quant_params.delta_q_uv_ac;
   pic_param.chroma_dc_qindex_delta = frame_header->quant_params.delta_q_uv_dc;
-
-  // TODO(crbug.com/924786): Unlike the current vp8 implementation,
-  // SegmentationParams and LoopFilterParams are the part of Parser structure
-  // rather than included them in FrameHeader. So, for now, we are not taking
-  // segmentation and loopfilter related parameter from frame_hdr. But since the
-  // filter level may affect on quality at lower bitrates, we set a constant
-  // value (== 10) which is what other VA-API implementations like libyami and
-  // gstreamer-vaapi are using.
-  pic_param.filter_level = 10;
+  pic_param.filter_level = frame_header->loop_filter.level;
   pic_param.log2_tile_rows = frame_header->tile_rows_log2;
   pic_param.log2_tile_columns = frame_header->tile_cols_log2;
 
diff --git a/media/gpu/vaapi/vp9_encoder.cc b/media/gpu/vaapi/vp9_encoder.cc
index 60f72c6..36d013d01 100644
--- a/media/gpu/vaapi/vp9_encoder.cc
+++ b/media/gpu/vaapi/vp9_encoder.cc
@@ -21,6 +21,11 @@
 constexpr int kMinQP = 4;
 constexpr int kMaxQP = 112;
 constexpr int kDefaultQP = (3 * kMinQP + kMaxQP) / 4;
+
+// filter level may affect on quality at lower bitrates; for now,
+// we set a constant value (== 10) which is what other VA-API
+// implementations like libyami and gstreamer-vaapi are using.
+constexpr uint8_t kDefaultLfLevel = 10;
 }  // namespace
 
 VP9Encoder::EncodeParams::EncodeParams()
@@ -161,7 +166,7 @@
   DCHECK_EQ(current_params_.initial_qp, kDefaultQP);
   constexpr uint8_t kDefaultQPACQIndex = 24;
   current_frame_hdr_.quant_params.base_q_idx = kDefaultQPACQIndex;
-
+  current_frame_hdr_.loop_filter.level = kDefaultLfLevel;
   current_frame_hdr_.show_frame = true;
 }
 
diff --git a/media/gpu/vp8_decoder.cc b/media/gpu/vp8_decoder.cc
index 94570a6f..840b5fa 100644
--- a/media/gpu/vp8_decoder.cc
+++ b/media/gpu/vp8_decoder.cc
@@ -168,6 +168,10 @@
   return pic_size_;
 }
 
+gfx::Rect VP8Decoder::GetVisibleRect() const {
+  return gfx::Rect(pic_size_);
+}
+
 size_t VP8Decoder::GetRequiredNumOfPictures() const {
   constexpr size_t kPicsInPipeline = limits::kMaxVideoFrames + 1;
   return kVP8NumFramesActive + kPicsInPipeline;
diff --git a/media/gpu/vp8_decoder.h b/media/gpu/vp8_decoder.h
index 8ed398b89..8f53609f 100644
--- a/media/gpu/vp8_decoder.h
+++ b/media/gpu/vp8_decoder.h
@@ -71,6 +71,7 @@
   void Reset() override;
   DecodeResult Decode() override WARN_UNUSED_RESULT;
   gfx::Size GetPicSize() const override;
+  gfx::Rect GetVisibleRect() const override;
   size_t GetRequiredNumOfPictures() const override;
   size_t GetNumReferenceFrames() const override;
 
diff --git a/media/gpu/vp9_decoder.cc b/media/gpu/vp9_decoder.cc
index f5ecfbbd..6cb9071 100644
--- a/media/gpu/vp9_decoder.cc
+++ b/media/gpu/vp9_decoder.cc
@@ -135,8 +135,17 @@
 
     gfx::Size new_pic_size(curr_frame_hdr_->frame_width,
                            curr_frame_hdr_->frame_height);
-    DCHECK(!new_pic_size.IsEmpty());
+    gfx::Rect new_render_rect(curr_frame_hdr_->render_width,
+                              curr_frame_hdr_->render_height);
+    // For safety, check the validity of render size or leave it as (0, 0).
+    if (!gfx::Rect(new_pic_size).Contains(new_render_rect)) {
+      DVLOG(1) << "Render size exceeds picture size. render size: "
+               << new_render_rect.ToString()
+               << ", picture size: " << new_pic_size.ToString();
+      new_render_rect = gfx::Rect();
+    }
 
+    DCHECK(!new_pic_size.IsEmpty());
     if (new_pic_size != pic_size_) {
       DVLOG(1) << "New resolution: " << new_pic_size.ToString();
 
@@ -164,6 +173,7 @@
       ref_frames_.Clear();
 
       pic_size_ = new_pic_size;
+      visible_rect_ = new_render_rect;
       size_change_failure_counter_ = 0;
       return kAllocateNewSurfaces;
     }
@@ -171,16 +181,6 @@
     scoped_refptr<VP9Picture> pic = accelerator_->CreateVP9Picture();
     if (!pic)
       return kRanOutOfSurfaces;
-
-    gfx::Rect new_render_rect(curr_frame_hdr_->render_width,
-                              curr_frame_hdr_->render_height);
-    // For safety, check the validity of render size or leave it as (0, 0).
-    if (!gfx::Rect(pic_size_).Contains(new_render_rect)) {
-      DVLOG(1) << "Render size exceeds picture size. render size: "
-               << new_render_rect.ToString()
-               << ", picture size: " << pic_size_.ToString();
-      new_render_rect = gfx::Rect();
-    }
     DVLOG(2) << "Render resolution: " << new_render_rect.ToString();
 
     pic->set_visible_rect(new_render_rect);
@@ -252,6 +252,10 @@
   return pic_size_;
 }
 
+gfx::Rect VP9Decoder::GetVisibleRect() const {
+  return visible_rect_;
+}
+
 size_t VP9Decoder::GetRequiredNumOfPictures() const {
   constexpr size_t kPicsInPipeline = limits::kMaxVideoFrames + 1;
   return kPicsInPipeline + GetNumReferenceFrames();
diff --git a/media/gpu/vp9_decoder.h b/media/gpu/vp9_decoder.h
index 81b49881..0bc33f0 100644
--- a/media/gpu/vp9_decoder.h
+++ b/media/gpu/vp9_decoder.h
@@ -106,6 +106,7 @@
   void Reset() override;
   DecodeResult Decode() override WARN_UNUSED_RESULT;
   gfx::Size GetPicSize() const override;
+  gfx::Rect GetVisibleRect() const override;
   size_t GetRequiredNumOfPictures() const override;
   size_t GetNumReferenceFrames() const override;
 
@@ -149,6 +150,9 @@
   // Current coded resolution.
   gfx::Size pic_size_;
 
+  // Visible rectangle on the most recent allocation.
+  gfx::Rect visible_rect_;
+
   size_t size_change_failure_counter_ = 0;
 
   const std::unique_ptr<VP9Accelerator> accelerator_;
diff --git a/media/video/video_decode_accelerator.cc b/media/video/video_decode_accelerator.cc
index e3d4880..58f6665 100644
--- a/media/video/video_decode_accelerator.cc
+++ b/media/video/video_decode_accelerator.cc
@@ -29,6 +29,17 @@
   NOTREACHED() << "By default deferred initialization is not supported.";
 }
 
+void VideoDecodeAccelerator::Client::ProvidePictureBuffersWithVisibleRect(
+    uint32_t requested_num_of_buffers,
+    VideoPixelFormat format,
+    uint32_t textures_per_buffer,
+    const gfx::Size& dimensions,
+    const gfx::Rect& visible_rect,
+    uint32_t texture_target) {
+  ProvidePictureBuffers(requested_num_of_buffers, format, textures_per_buffer,
+                        dimensions, texture_target);
+}
+
 VideoDecodeAccelerator::~VideoDecodeAccelerator() = default;
 
 void VideoDecodeAccelerator::Decode(scoped_refptr<DecoderBuffer> buffer,
diff --git a/media/video/video_decode_accelerator.h b/media/video/video_decode_accelerator.h
index c3a334bc..b0a5448 100644
--- a/media/video/video_decode_accelerator.h
+++ b/media/video/video_decode_accelerator.h
@@ -212,6 +212,17 @@
                                        const gfx::Size& dimensions,
                                        uint32_t texture_target) = 0;
 
+    // This is the same as ProvidePictureBuffers() except that |visible_rect| is
+    // also included. The default implementation of VDA would call
+    // ProvidePictureBuffers().
+    virtual void ProvidePictureBuffersWithVisibleRect(
+        uint32_t requested_num_of_buffers,
+        VideoPixelFormat format,
+        uint32_t textures_per_buffer,
+        const gfx::Size& dimensions,
+        const gfx::Rect& visible_rect,
+        uint32_t texture_target);
+
     // Callback to dismiss picture buffer that was assigned earlier.
     virtual void DismissPictureBuffer(int32_t picture_buffer_id) = 0;
 
diff --git a/net/http/transport_security_state_static.json b/net/http/transport_security_state_static.json
index 1646218..ad92e654 100644
--- a/net/http/transport_security_state_static.json
+++ b/net/http/transport_security_state_static.json
@@ -3619,7 +3619,6 @@
     { "name": "motd.ch", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "namorico.me", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "nekomimi.pl", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "netprofile.com.au", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "numericacu.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "oshayr.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "ourevents.net", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -6158,7 +6157,6 @@
     { "name": "mycoted.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "mysoundtalks.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "mytty.net", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "mytweeps.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "n0psled.nl", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "naminam.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "nathanmfarrugia.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -6895,7 +6893,6 @@
     { "name": "mce55.eu", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "mdscomp.net", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "meap.xyz", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "mediastorm.us", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "melnikov.ch", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "mentax.net", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "mesmoque.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -7319,7 +7316,6 @@
     { "name": "nekosc.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "nerull7.info", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "netulo.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "nilrem.org", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "nnya.cat", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "nottres.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "ofcourselanguages.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -8094,7 +8090,6 @@
     { "name": "kroodle.nl", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "kwidz.fr", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "kwikmed.eu", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "lesharris.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "linkages.org", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "loveto.at", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "ls-a.org", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -8753,7 +8748,6 @@
     { "name": "dogfi.sh", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "doku-gilde.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "dolarcanadense.com.br", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "dolphinswithlasers.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "domadillo.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "donotspellitgav.in", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "dontcageus.org", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -9146,7 +9140,6 @@
     { "name": "hopesb.org", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "hory.me", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "hosiet.me", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "hosmussynergie.nl", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "hostam.link", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "hostinaus.com.au", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "hostmijnpagina.nl", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -10804,7 +10797,6 @@
     { "name": "clickandshoot.nl", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "chateauconstellation.ch", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "compliancedictionary.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "compagnia-buffo.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "convergemagazine.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "creativeartifice.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "cookiesoft.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -10896,7 +10888,6 @@
     { "name": "elonbase.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "emi-air-comprime.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "endlessdiy.ca", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "elena-baykova.ru", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "eltagroup.co.uk", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "encoder.pw", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "embroideryexpress.co.uk", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -11002,7 +10993,6 @@
     { "name": "hatcherlawgroupnm.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "hepteract.us", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "hartlep.email", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "hcs-company.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "heritagedentistry.ca", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "hdsmigrationtool.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "hiexmerida-mailing.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -15330,7 +15320,6 @@
     { "name": "r2d2pc.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "radreisetraumtreibstoff.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "randomkoalafacts.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "remote.so", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "rapidshit.net", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "radionicabg.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "randomprecision.co.uk", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -15807,7 +15796,6 @@
     { "name": "xn--8mr166hf6s.xn--fiqs8s", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "yhori.xyz", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "xmlbeam.org", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "zinc-x.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "wpdublin.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "zcr.ca", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "weddingibiza.nl", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -17283,7 +17271,6 @@
     { "name": "anotherchef.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "altkremsmuensterer.at", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "0o0.ooo", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "anacruz.es", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "agentseeker.ca", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "artiming.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "asuhe.win", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -17438,7 +17425,6 @@
     { "name": "brockmeyer.net", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "brickftp.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "blackdown.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "bcmguide.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "bitpumpe.net", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "bugsmashed.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "brandtrapselfie.nl", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -18355,7 +18341,6 @@
     { "name": "lel.ovh", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "kids-at-home.ch", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "kuaza.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "leonhooijer.nl", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "lijero.co", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "lexicography.online", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "languageterminal.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -18536,7 +18521,6 @@
     { "name": "mondedie.fr", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "mticareportal.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "mxihan.xyz", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "millstep.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "moefactory.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "moobo.xyz", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "mooselook.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -18708,7 +18692,6 @@
     { "name": "oppejoud.ee", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "okad.eu", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "orkestar-krizevci.hr", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "online-eikaiwa-guide.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "orthodoxy.lt", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "partridge.tech", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "nutricuerpo.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -20151,7 +20134,6 @@
     { "name": "elizabethbuitrago.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "droomhuis-in-sudwest-fryslan-kopen.nl", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "egablo.black", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "employer411.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "eigpropertyauctions.co.uk", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "drevo-door.cz", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "elektro-diehm.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -22800,7 +22782,6 @@
     { "name": "pet-life.top", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "pflegedienst-gratia.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "philadelphiacandies.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "philippheenen.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "phuket-idc.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "pic.sr", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "piclect.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -24592,7 +24573,6 @@
     { "name": "guildofmusicsupervisors.co.uk", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "guillaumecote.me", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "guillaumematheron.fr", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "guillemaud.me", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "gulfcoast-sandbox.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "gulshankumar.net", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "guusvandewal.nl", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -24725,8 +24705,6 @@
     { "name": "howtofreelance.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "howtolaser.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "hpepub.asia", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "hpepub.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "hpepub.org", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "hppub.info", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "hppub.org", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "hppub.site", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -25123,7 +25101,6 @@
     { "name": "lettland-firma.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "level-10.net", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "levermann.eu", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "lexpierce.social", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "lfaz.org", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "lgbt.io", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "lgsg.us", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -26535,7 +26512,6 @@
     { "name": "thomas-suchon.fr", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "thomasbeckers.be", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "thomasfoster.co", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "thomasvt.xyz", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "thomsonscleaning.co.uk", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "thot.space", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "threebrothersbrewing.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -28788,7 +28764,6 @@
     { "name": "kiteschoolzandvoort.nl", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "koptev.ru", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "kode-it.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "kylebaldw.in", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "kitashop.com.br", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "kiteadventure.nl", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "krugermillions.org", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -32114,7 +32089,6 @@
     { "name": "ocrn.nl", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "ojdip.net", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "mireiaseuba.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "over25tips.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "orangecomputers.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "orleika.io", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "oliverniebuhr.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -32711,7 +32685,6 @@
     { "name": "viaje-a-china.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "viaggio-in-cina.it", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "u4mh-dev-accesscontroller.azurewebsites.net", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "victoriapemberton.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "uwfreelanceopticien.nl", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "visaya.com.co", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "tioat.net", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -34448,7 +34421,6 @@
     { "name": "besb66.us", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "beserberg.tk", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "beslider.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "bestbonuses.co.uk", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "betecnet.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "bewerbungsfoto-deinfoto.ch", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "bewertet.de", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -35750,7 +35722,6 @@
     { "name": "thriftdiving.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "ticketluck.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "ticketsmate.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "tickit.ca", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "tiffanytravels.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "tijo.ch", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "tik.edu.ee", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -36014,7 +35985,6 @@
     { "name": "100mani.it", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "123movies.fyi", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "173vpnv.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "188dv.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "189dv.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "33836.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "38blog.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -36143,7 +36113,6 @@
     { "name": "dice.tokyo", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "digilicious.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "digitalcash.cf", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
-    { "name": "digitalcreationclass.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "din-hkd.jp", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "disinfestazioni.net", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
     { "name": "dlyl888.com", "policy": "bulk-18-weeks", "mode": "force-https", "include_subdomains": true },
@@ -36643,7 +36612,6 @@
     { "name": "abbottscastles.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "abcbouncycastlessurrey.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "abcbouncyfactory.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "abcdobebe.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "abcpartyhire.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "aberdeencastles.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "abibruce.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -38267,7 +38235,6 @@
     { "name": "benevita.organic", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "bergfex.at", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "beschriftung-metz.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "biglagoonrentals.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "bikehistory.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "bizstarter.cz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "blackmonday.gr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -38406,7 +38373,6 @@
     { "name": "etoto.pl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "euexia.fr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "exgen.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "f9digital.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "fabiobier.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "familytreehq.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "fashion24.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -38622,7 +38588,6 @@
     { "name": "neurexcellence.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "nigensha.co.jp", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "nix.black", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "nodepositcasinouk.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "nojok.es", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "nonemu.ninja", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "norad.sytes.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -38764,7 +38729,6 @@
     { "name": "stadsbygd.info", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "stahlfors.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "starsbattle.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "stefanvanburen.xyz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "stig.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "storytime.hu", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "strengthroots.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -39805,7 +39769,6 @@
     { "name": "origamika.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "oscarmashauri.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "overstemmen.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "parkwayminyan.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "paulward.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "pbqs.site", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "pcmkrembangan.or.id", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -40350,7 +40313,6 @@
     { "name": "bitenose.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "bitenose.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "bitgrapes.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "bitxel.com.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "bjl5689.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "bjl5689.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "bkhayes.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -42162,7 +42124,6 @@
     { "name": "consciouschoices.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "conseil-gli.fr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "contaquanto.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "conversionsciences.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "cookwithmanali.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "copdfoundation.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "corbi.net.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -42393,7 +42354,6 @@
     { "name": "imyvm.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "incoherent.ch", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "infobae.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "inkspire.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "innohb.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "inscomers.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "intae.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -46087,7 +46047,6 @@
     { "name": "caterkids.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "ccsource.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "cellartracker.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "centricbeats.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "certchannel.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "chatbot.one", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "chikatomo-ryugaku.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -46557,7 +46516,6 @@
     { "name": "sonic.studio", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "splunk.zone", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "sranje.rocks", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "srihash.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "sso.to", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "starcoachservices.ca", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "steamstat.us", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -46962,7 +46920,6 @@
     { "name": "thehouseofgod.org.nz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "thenowheremen.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "toddfry.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "tofu.cf", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "tomjn.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "tunaut.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "undeductive.media", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -47439,7 +47396,6 @@
     { "name": "die-pizzabaeckerei.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "digital-liberal.ch", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "digital.govt.nz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "diplona.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "directelectricalltd.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "discoveryaima.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "disinfestazioneblatte.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -47854,7 +47810,6 @@
     { "name": "s0laris.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "sacprincesse.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "safestore.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "sagargandecha.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "samdev.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "sammenlignakasser.dk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "satal.in", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -48007,8 +47962,6 @@
     { "name": "xone.cz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "xq55.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "yannik-buerkle.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "yeswecan.co.bw", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "yhndnzj.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "youjizz.bz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "ysun.xyz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "yvonnethomet.ch", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -48607,7 +48560,6 @@
     { "name": "riverviewcourtapts.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "rkfp.cz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "rodinneodpoledne2018.cz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "rohankrishnadev.in", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "rolleyes.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "romapa.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "rotkreuzshop.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -48725,7 +48677,6 @@
     { "name": "united-coders.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "unixapp.ml", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "unsourirealecole.fr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "uptrex.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "urcentral.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "use.ci", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "uwelilienthal.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -48802,7 +48753,6 @@
     { "name": "zlypi.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "zonehomesolutions.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "zqwqz.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "zrkr.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "zs-ohradni.cz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "zum-baur.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "00778899.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -49658,7 +49608,6 @@
     { "name": "vilabiamodas.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "villa-bellarte.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "vioye.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "viral32111.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "virtualcloud.ddns.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "visualgrafix.com.mx", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "vocustest.aero", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -50073,7 +50022,6 @@
     { "name": "hj-mosaiques.be", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hks.pw", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hnonline.sk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hockey.academy", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hollandsdiep.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hosting-swiss.ch", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hrstapps-dev.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -50251,7 +50199,6 @@
     { "name": "myrepublic.us.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "namuwikiusercontent.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "narrative.network", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "narrative.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "nathaliedijkxhoorn.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "nathaliedijkxhoorn.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "nathanaeldawe.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -50493,7 +50440,6 @@
     { "name": "tyler.coach", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "tylercoach.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "typeof.pw", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ukunlocks.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "unausa.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "unblocked.vet", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "unkrn.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -51566,7 +51512,6 @@
     { "name": "redcatrampageforum.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "reher.pro", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "relojeriajoyeria.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "repkord.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "researchstory.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "resistav.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "responsivepaper.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -51680,7 +51625,6 @@
     { "name": "teensexgo.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "teknoforums.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "teleshop.be", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "teltonica.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "templum.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "the-gdn.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "thecamels.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -51853,7 +51797,6 @@
     { "name": "aoaprograms.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "autoschadeschreuder.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "axtudo.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "balilingo.ooo", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "banes.ch", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "behindthethrills.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "benjaminkopelke.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -52169,7 +52112,6 @@
     { "name": "297computers.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "314553.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "360rail.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "364553.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "394553.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "3deeplearner.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "3ik.us", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -52401,7 +52343,6 @@
     { "name": "christianlis.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "chrysanthos.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "chuppa.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "cindydudley.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "cirurgicasalutar.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "cisofy.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "cispeo.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -53085,7 +53026,6 @@
     { "name": "quitimes.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "quoteidiot.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "r7.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "racdek.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "racozo.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "raft.pub", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "rail-o-rama.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -53576,7 +53516,6 @@
     { "name": "comosefazisto.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "compservice.in.ua", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "coquibus.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "corporativoarval.info", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "corrick.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "costablanca.villas", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "countermats.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -53615,7 +53554,6 @@
     { "name": "elcontadorsac.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "elekharris.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "elonm.ru", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "emeraldcbdshop.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "enord.fr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "erics.site", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "establo.pro", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -53708,7 +53646,6 @@
     { "name": "infrapass.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "integratedintegrations.xyz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "iposm.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ipstoragesolutions.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "irandp.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "isitpatchtuesday.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "it-seems-to.work", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -53739,7 +53676,6 @@
     { "name": "keditor.biz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kersmexico.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "keyhomechecker.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "kinnettmemorial.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kiwi.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kloudboy.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "krazyboi.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -53797,7 +53733,6 @@
     { "name": "mchel.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "mcon.se", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "mds-paris.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "mebaneattorney.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "mebanesteakhouse.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "meditel.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "medmarkt24.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -53819,7 +53754,6 @@
     { "name": "mrgiveaways.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "mtiryaki.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "mundomagicotv.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "musaccostore.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "mvisioncorp.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "mwezi-foundation.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "mwezi.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -53835,7 +53769,6 @@
     { "name": "ncloud.freeddns.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "neowa.tk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "networkmon.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "newbasemedia.us", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "newfangledscoop.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "newposts.ru", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "nickhitch.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -53959,7 +53892,6 @@
     { "name": "serendeputy.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "serwusik.pl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "shadowkingdomrecords.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "shishkabobnc.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "shoeracks.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "shop-hellsheadbangers.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "silicon-north.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -54166,7 +54098,6 @@
     { "name": "bakanin.ru", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "balancedbrawl.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "bardes.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "bdbxml.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "behamepresrdce.sk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "bernat.ch", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "bigwiseguide.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -54244,11 +54175,9 @@
     { "name": "eaglexiang.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "elfring.eu", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "eluft.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "endpointsystems.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "entersoftsecurity.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "epiphanyofourlordchurch.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "erichogue.ca", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ericvaughn-flam.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "esp-desarrolladores.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "etherderbies.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "evermarkstudios.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -54394,7 +54323,6 @@
     { "name": "raconteur.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "ratinq.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "rault.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "reedyforkfarm.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "regularflolloping.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "resine.roma.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "romancloud.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -55375,7 +55303,6 @@
     { "name": "stjscatholicchurch.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "stjustin.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "stlukenh.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "storageshedsnc.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "strawberry-laser.gr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "streamkit.gg", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "stroseoflima.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -55748,7 +55675,6 @@
     { "name": "comprasoffie.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "computer-science-schools.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "conclinica.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "conspiracyservers.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "construction-colleges.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "costellofc.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "covaci.pro", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -56524,7 +56450,6 @@
     { "name": "aaex.cloud", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "adnanoktar.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "advancedsurgicalconsultantsllc.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "adventaholdings.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "aegisinsight.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "aeronautix.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "akademie-frankfurt.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -56838,7 +56763,6 @@
     { "name": "ourladyqueenofmartyrs.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "paccolat.name", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "paginaweb4u.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "panzerscreen.dk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "patrick21.ch", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "pension-am-alten-waschhaus.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "peperstraat.online", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -57283,7 +57207,6 @@
     { "name": "metron-networks.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "mikkelladegaard.dk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "minecraftstal.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "miningtronics.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "morbius.cz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "mosaicmarble.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "movacare.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -57346,7 +57269,6 @@
     { "name": "qaq.sh", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "qiu521119.host", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "questoj.cn", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "racdek.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "rafleatherdesign.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "rainiv.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "raphaelschmid.eu", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -59264,8 +59186,6 @@
     { "name": "hindimoviedownload.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hindimovieonline.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hiteshbrahmbhatt.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hj99vip.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hjyl9898.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hks-projekt.at", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hm773.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hogarthdavieslloyd.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -61067,7 +60987,6 @@
     { "name": "kabos.art", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kamata-shinkyu-seikotsu.jp", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kameari-za.space", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "kamilki.me", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kaplatzis.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "katarsisuib.no", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "katjavoneysmondt.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -61431,7 +61350,6 @@
     { "name": "wildercerron.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "woblex.cz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "wooc.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "worknrby.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "wotsunduk.ru", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "wscore.me", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "wunschpreisauto.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -62548,7 +62466,6 @@
     { "name": "proxirealtime.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "psauxit.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "pseric.site", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "psicometricas.mx", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "pubkit.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "publi-all.be", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "punchlinetheatre.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -63336,7 +63253,6 @@
     { "name": "chinookwebdesign.ca", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "chshealthcare.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "citadelnet.works", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "cjbeckert.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "ckrubble.co.za", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "cloud9vets.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "cncs.gov.pt", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -64000,7 +63916,6 @@
     { "name": "suchem.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "superenduro.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "suppwatch.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "svenrath.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "sweetenedcondensed.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "systemctl.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "tandartszilverschoon.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -64460,8 +64375,6 @@
     { "name": "721172.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "797715.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "877791.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "8889ks.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "8898ks.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "998081.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "abjay.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "accreditamento.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -64536,7 +64449,6 @@
     { "name": "crowdspire.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "current-usa.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "cyberdiscoverycommunity.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "cyraus.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "davethom.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "denkeandersblog.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "derpy.pp.ua", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -64650,7 +64562,6 @@
     { "name": "julian-post.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "k0.gg", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kagucho.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "kb3030.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kdcp.pw", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "keepleft.gr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kevertje.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -64659,7 +64570,6 @@
     { "name": "khorne.me", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kidsdaysout.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kordamed.ee", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks626.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "la-laitonnerie.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "lawlessenglish.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "lawlessfrench.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -64795,7 +64705,6 @@
     { "name": "takipone.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "tech-ninja.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "teetje-doko.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "telemessage.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "terrorismattacks.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "terrybutler.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "textbrawlers.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -64854,7 +64763,6 @@
     { "name": "130497.xyz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "133846.xyz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "158306.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "159ks.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "162263.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "163132.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "188198.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -65195,7 +65103,6 @@
     { "name": "svpoa.org.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "sw-machines.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "t-pc.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "tapety-na-pulpit.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "tasarimgazetesi.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "taxationweb.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "taxi-legroux.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -65484,7 +65391,6 @@
     { "name": "kaktuskola.se", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "karrot.world", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kastgroup.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "kb5151.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "keevault.pm", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kevincramer.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kevindavid.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -65740,7 +65646,6 @@
     { "name": "adoll.ml", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "afinterio.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "africankitchen.gallery", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "afrishade.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "akrep.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "albareport.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "alexlambertz.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -65801,7 +65706,6 @@
     { "name": "cceputnam360.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "chat-love.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "chriscutts.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "cistitguru.ru", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "clearview-creative.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "cloudsprt.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "club-jose.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -66106,10 +66010,8 @@
     { "name": "00334.vip", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "025ks.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "060258.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "0768ks.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "0x80.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "101010.pl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "198ks.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "361183.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "43klive.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "47.rs", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -66274,7 +66176,6 @@
     { "name": "kozossegireklamozas.hu", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "krinnovations.ie", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kryptux.xyz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks181.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "l-1.xyz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "l-2.xyz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "l-3.xyz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -66411,13 +66312,11 @@
     { "name": "tech-banker.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "thc-stadvdzon.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "thecyberaid.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "thesoftwarehouse.co.za", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "tmadev.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "tonnie.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "topshelf.tech", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "totalaccessnicaragua.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "touhou.tw", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "tracor.es", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "tradavenue.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "trastornoevitacion.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "tronlaserarena.cz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -66647,7 +66546,6 @@
     { "name": "kaizenjuku.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kamilmagdziak.pl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "katsunet.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "keypointfrancine.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kimkuhlmanphoto.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kizzedbykelz.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kolitel.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -67295,7 +67193,6 @@
     { "name": "1111k8.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "123derivatives.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "145ks.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "147ks.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "162223.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "17kpw.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "182wh.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -67356,15 +67253,10 @@
     { "name": "780aa.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "80780780.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "886k8.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "8880ks.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "8pc.ru", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "911216.xyz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "9181181.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "9182289.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "92kb88.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "93kb88.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "95kb88.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "96kb88.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "99lib.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "a122.cc", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "a22z.xyz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -67571,7 +67463,6 @@
     { "name": "codedo.info", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "cogeneration-energy.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "coladv.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "collare.mx", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "collegegirlhd.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "collegesexvid.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "comercialbelzunces.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -67780,7 +67671,6 @@
     { "name": "hackingarise.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "halihali.cc", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hamiltonweather.ca", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hansalbrecht.eu", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "haruhi.org.ua", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "headlinesclub.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "helm-pokale.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -67796,31 +67686,10 @@
     { "name": "hisregistries.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hisregistries.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hiteshchandwani.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hj111777.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hj2375.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hj2565.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hj3586.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hj3639.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hj5386.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hj6298.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hj6585.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hj6929.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hj9379.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hj99111.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hj99177.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hj99188.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hj99199.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hj99333.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hjyl.xn--fiqs8s", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hjyl1888.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hjyl1999.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hjyl2828.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hjyl2888.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hjyl299.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hjyl3999.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hjyl699.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hjyl6999.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hjyl7999.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "homoo.social", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hr28.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hsn-tsn.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -67900,12 +67769,7 @@
     { "name": "katieriker.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kaypasocks.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kb09.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "kb4141.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "kb4343.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "kb8823.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kb883.cc", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "kb88777.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "kb88md06.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kee.pm", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kevchia.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kexino.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -67929,30 +67793,13 @@
     { "name": "koreaninhd.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "korem011-tniad.mil.id", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "krikorianconstruction.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks0299.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "ks0718.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "ks0768.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "ks0877.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks099.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "ks0996.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks106.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks152.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks1908.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks1909.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks2022.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks2055.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks2500.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks2600.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks2608.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks2700.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks2806.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "ks5000.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks5055.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "ks5660.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks6363.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks6767.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "ks88.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks8832.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "ksoc.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kumbayops.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kumpulannamabayi.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -68183,7 +68030,6 @@
     { "name": "poc997.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "poc998.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "ponnau.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "poolmans.se", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "pornforwomentube.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "potionlabs.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "powersergemployeesonly.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -68310,7 +68156,6 @@
     { "name": "sgombero.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "sgrub.xyz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "sharer.link", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "sheey.moe", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "shieldblaze.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "shiji.info", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "shinomiya.group", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -68731,7 +68576,6 @@
     { "name": "djbobbytables.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "dmarc.tech", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "doggo.email", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "doggo.social", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "dotweb.cloud", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "dragcave.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "e-referendum.cz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -69016,8 +68860,6 @@
     { "name": "xpertcube.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "xrp.pp.ua", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "xylerfox.ca", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ying518.vip", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ymm18.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "yulaiz.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "zanshinkankarate.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "zen-solutions.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -69226,7 +69068,6 @@
     { "name": "9297e.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "9297f.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "9297g.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "9297h.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "9297hb.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "9297hd.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "9297i.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -69239,7 +69080,6 @@
     { "name": "9297q.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "9297r.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "9297s.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "9297t.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "9297u.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "9297v.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "9297w.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -69438,7 +69278,6 @@
     { "name": "gdsqua.re", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "geektier.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "gentcdn.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "gentlent.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "gentlent.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "giveoneup.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "gladiac.duckdns.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -69624,7 +69463,6 @@
     { "name": "royjr.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "rueduparticulier.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "sagitta.hr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "saitama.xyz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "schokoladensouffle.eu", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "schoolofphilosophy.org.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "scitheory.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -70543,7 +70381,6 @@
     { "name": "skulblaka.cloud", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "skyparlourfilms.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "solarloon.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "solutionsforest.com.ar", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "sondebase.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "spilnu.dk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "spmswiss.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -70726,7 +70563,6 @@
     { "name": "zhaotongjun.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "zl016.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "zl7373.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "zl861.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "zl8849.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "zl9292.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "zl9696.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -70777,7 +70613,6 @@
     { "name": "726217.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "77321365.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "78936565.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "866ks.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "88321365.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "9118.la", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "9181182.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -70788,7 +70623,6 @@
     { "name": "9181187.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "9181189.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "99321365.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "9agks.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "aaminntourtravel.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "abmackenzie.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "academica.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -70799,7 +70633,6 @@
     { "name": "addictic.fr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "adrian.web.id", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "affairefacile.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "agks888.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "aguarani.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "akuseorangtraveler.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "alamowellnessalliance.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -70961,7 +70794,6 @@
     { "name": "gamster.tv", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "garagesmart.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "gaspapp.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "gassyukumenkyoguide.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "gelsey.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "glyptodon.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "gomedium.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -70972,7 +70804,6 @@
     { "name": "hackendoz.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hackerone.events", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hacktober.dk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "hair-care-guide.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "hamburgobgyn.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "harititan.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "heartcomms.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -70995,7 +70826,6 @@
     { "name": "impresapuliziebergamo.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "incarceratedwombats.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "invuite.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "iryodatumoguide.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "isamay.es", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "isterfaslur.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "isusemasa.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -71030,9 +70860,7 @@
     { "name": "johngmchenrymd.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "juristique.us", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kagicomb.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "kalyanmatka.guru", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "katalogkapsli.pl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "kb864.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kb8882.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kb88dc23.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "keyyek.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -71043,15 +70871,9 @@
     { "name": "kpopsource.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "krasnodar-pravoved.ru", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "ks080.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks0888.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "ks191.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "ks381.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks386.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks5880.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "ks628.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks6690.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks8862.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "ks996.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kulturmel.ch", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kuwichitagastro.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "kylianvermeulen.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -71418,7 +71240,6 @@
     { "name": "nashuaradiology.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "nettgiro.no", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "nhhoteljobs.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "nichijyodesu.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "nickmchardy.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "niourk.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "noleggiobagnichimici.perugia.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -71582,7 +71403,6 @@
     { "name": "w2design.eu", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "watboeithet.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "weavers.space", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
-    { "name": "weijte.rs", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "wfschicago.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "wgcaobgyn.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "wikiwp.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
@@ -71647,6 +71467,979 @@
     { "name": "zd8882.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "zingpetfood.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     { "name": "zl9889.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "01918.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "05am8.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "06918.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "08918.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "09btt.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "118btt.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "155175.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "15918.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "168btt.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "168btt.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "176f88.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "180btt.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "1994.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "19btt.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "218btt.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "224918.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "22918.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "321666365.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "33am8.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "360hosting.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "3oneseven.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "420.nerdpol.ovh", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "432666365.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "516btt.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "516btt.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "543666365.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "555btt.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "558btt.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "567666365.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "616f88.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "618btt.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "618btt.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "666365app.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "666365ios.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "666365iosapp.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729a.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729aa.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729aa.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729apk.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729app.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729b.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729b.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729bb.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729bb.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729c.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729c.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729cc.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729cc.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729d.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729d.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729dd.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729dd.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729dh.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729dns.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729dz.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729e.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729e.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729ee.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729ee.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729f.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729f.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729ff.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729ff.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729g.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729g.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729gg.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729gg.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729h.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729h.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729hb.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729hd.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729hh.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729i.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729i.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729ii.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729ii.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729ipa.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729j.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729j.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729jj.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729jj.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729k.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729k.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729kk.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729l.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729l.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729ll.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729ll.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729m.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729m.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729nn.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729o.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729o.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729oo.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729oo.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729p.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729pp.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729pp.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729q.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729q.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729qq.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729qq.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729r.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729r.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729rr.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729rr.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729s.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729s.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729ss.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729ss.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729sx.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729t.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729t.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729tt.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729tt.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729u.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729uu.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729v.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729vv.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729vv.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729w.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729w.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729ww.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729ww.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729x.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729x.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729xx.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729xx.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729xy.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729y.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729y.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729yy.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729z.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729z.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729zz.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6729zz.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957a.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957a.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957aa.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957aa.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957apk.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957app.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957b.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957b.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957bb.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957bb.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957c.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957c.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957cc.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957d.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957d.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957dd.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957dd.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957dh.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957dz.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957e.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957ee.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957ee.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957f.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957f.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957ff.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957g.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957g.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957gg.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957gg.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957h.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957h.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957hd.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957hh.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957hh.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957i.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957i.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957ii.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957ii.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957ipa.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957j.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957j.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957jj.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957jj.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957k.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957k.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957kk.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957kk.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957l.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957l.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957ll.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957ll.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957m.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957m.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957mm.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957n.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957n.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957nn.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957nn.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957o.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957o.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957oo.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957oo.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957p.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957p.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957qq.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957r.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957r.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957rr.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957s.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957s.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957ss.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957ss.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957sx.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957t.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957t.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957tt.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957tt.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957u.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957u.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957uu.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957uu.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957v.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957v.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957vv.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957vv.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957w.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957w.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957ww.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957ww.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957x.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957x.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957xx.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957xx.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957xy.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957y.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957yy.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957yy.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957z.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957z.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957zz.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "6957zz.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "7ka.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "86btt.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "876666365.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "8809d88.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "8826ks.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "8858ks.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "8868ks.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "88btt.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "89btt.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "9180nn.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "9180tt.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "9180vv.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "9180xx.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "9180yy.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "9180zz.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "91816.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "9186119.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "91891849.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "91891854.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "91891856.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "91891878.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918aak.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918ajj.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918akk.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918amj.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918att.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918bbm.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918bby.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918bcf.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918bcw.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918btt.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918btt.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918btty.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918bttz.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918ca.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918caa.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918cch.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918ch.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918cr.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918cx.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918dc04.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918dc16.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918dc20.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918dp.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918ee.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918ej.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918ev.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918fq.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918fr.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918fv.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918hr.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918hu.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918iz.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918kx.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918mc.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918md10.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918md16.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918md25.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918mf.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918nc.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918nd.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918nu.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918ny.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918qa.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918rw.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918sn.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918ta.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918tj.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918tr.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918tw.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918uh.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918um.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918vb.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918ve.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918vi.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918vz.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918wa.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918we.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918wo.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918wq.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918ww.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918xn.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918zm.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918zv.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "918zw.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "987666365.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "a291.cc", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "a6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "a6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "a6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "a88fc.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "aa6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "aa6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "aa6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "aa6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "aaron-russell.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "aboutpublishers.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ac-cosmetics.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "acarreosvillavicencio.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "aerlux.md", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "agenziapubblicitaria.roma.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "airship.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "albaniareiser.no", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "algawell.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "algorithmic.ml", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "alphapoker.ru", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "altaynews.kz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ambulanza.roma.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "amruta.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "amstelveentje.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "animefever.tv", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "anthony-bardon.eu", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "app666365.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "appspacehosted.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "arctus-security.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "arlartistadigital.com.mx", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ashenm.ml", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "atbwebservices.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "autofficina.roma.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "autospurghi.milano.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "azotobacter.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "b6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "b6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bahadirh.ml", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "barankababra.hu", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bb6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bb6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bb6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bc-reloaded.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "beachmarketing.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "beproduct.ru", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bettaline.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bevhills.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bezmlska.cz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "biancapulizie.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bibliotherapie-existentiale.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bilibili.sh", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "black-holes.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "blastair.fr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "boran.cl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bphostels.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bruckmuehler-kanu-club.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "brunetderochebrune.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bta00.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bta55.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt-39.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt-59.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt0303.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt1212.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt138g.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt2020.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt2121.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt213.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt217.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt219.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt225.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt256.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt3535.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt381g.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt529g.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt686.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt776.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt8.me", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt88.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt88818.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt891.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt8989a.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt907.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt9090.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt918.cn", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt945g.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt9797.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btt9898.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btta13.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btta15.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btta27.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "btta30.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bttna.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bttt222.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bttt333.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bttt999.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bttyulecheng0.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bttyulecheng7.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "bularmas.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "c6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "c6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "c6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "c6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "call-centervko.kz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "candidateexperiencemarketing.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "candinya.me", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "caph.info", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "carls-fallout-4-guide.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cc6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cc6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cc6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cc6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cendata.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "center-elite.ml", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "centralconvergence.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "chlo-products.biz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "chlo-products.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "chrisluen.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "christianrasch.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "clica.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cloudsharp.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "collare.com.mx", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "compassbest.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "compratecno.cl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "contentq.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cordobaaldia.com.mx", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "corevetconnect.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "coronersconnect.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cortealcastello.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "crimsonconnect.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cs.money", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "cubeperformancecentre.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "custodiamobili.roma.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "d6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "d6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "datisstom.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dd6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dd6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dd6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "decal-times.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "declarationlocationmeublee.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "delphia.ai", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "delphia.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "depop.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "df3312.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "df3313.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "df3314.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "df3315.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "df3316.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "df3317.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "df3318.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "df3319.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dh6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dicelab-rhul.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dipro.id", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "discarica.firenze.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "djvintagevinyl.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "docdoc.ru", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "domainvoider.cf", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "domarkperu.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dongcdn.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dortmund.directory", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dspace.pl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dz6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dz6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "dziura.me", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "e6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "e6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "e6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "e6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "eastwind.cloud", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ecuatask.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ee6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ee6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "elevationtech.co.za", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "elitebike.com.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "elpaseadordeperros.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "elysium.coop", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "emiliemunsch.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "eminententerprises.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "emissary.coffee", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "emrah.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "emulovers.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "erikw.me", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ethicalconsumer.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "exploretsp.gov", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "f6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "f6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "f6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "f6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "f88288.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "f88da.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "f88fine.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "f88good.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "f88ll.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "f88yule111.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "f88yule122.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "fairr.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "fairr.online", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "fantgames.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "fatfueled.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "fbhackpass.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "fe-data.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ff6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ff6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ff6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "filecloud.fun", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "files.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "fizjoterapia.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "fokos.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "foxroy.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "frtib.gov", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "fucknazis.cf", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "fucknazis.tk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "g116688.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "g6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "g6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "g6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "gambler.ru", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "georgewatson.me", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "getcard.cc", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "gg6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "gg6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "gg6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "gg6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "globecollege.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "goehler-baumpflege.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "goprimal.eu", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "gosportweather.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "gunbrig.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "h6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "h6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "h6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "hanazono.tokyo", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "hb6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "hd6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "hd6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "heino-peters.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "hgw777.cc", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "hh6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "hh6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "hh6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "hh6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "hidroshoping.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "hoofdredacteuren.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "horochx.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "hrbanen.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "htmdom.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "huipc.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "i6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "i6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "i6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "i6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "iamhealthystore.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ictbaneninnederland.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "igorandandre.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ii6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ii6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ii918.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "indigoblack.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "inkopers.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "inmueblescartagena.com.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "innatocol.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "insurancesloans.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "intellimax.ir", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "interviewme.pl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "investigatore.roma.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "investigazione.roma.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ipdsols.co.za", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ips-consult.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "iryogakkai.jp", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ithelfer.ch", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "itsok.link", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ivoid.cf", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "j-ph.ovh", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "j6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "j6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "j6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "jbridal.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "jcontspoord.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "jdmgarage.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "jj6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "jj6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "jj6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "jj6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "jobalicious.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "jobsindemedia.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "johnkraal.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "johnnybegood.tk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "joinhahobby.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "joshjanzen.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "jttech.se", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "jw1.ca", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "k6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "k6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "k6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "k86990.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "kaleidlink.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "kbc.be", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "kids-world.dk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "kk6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "kk6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "kk6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "kk6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "kli.is", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ks0618.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ks0776.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ks681.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "kupiewszystkieauta.pl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "l6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "l6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "l6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "l6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "laeryn.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "lamargheritalruoto.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "landegge.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "learningaboutcarinsurance.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "legalplace.fr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "legalsearch.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "leolemos.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "liandongyoupin.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "lisinphotography.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ll6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ll6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ll6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ll6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "lock.me", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "lockme.at", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "lockme.ch", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "lockme.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "lockme.pl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "lookgadgets.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "lumenbrowser.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "m6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "m6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "m6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "m6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "madwarlock.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "maesinox.be", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "magdeburg.directory", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "maltarea.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mariasbonitas.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "marktguru.at", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "marktguru.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "marolu.one", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "maxedgymequipment.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mc-web.se", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mdrsp.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "medialys.ca", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "medlabmediagroup.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "menshealthinsurance.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "midt.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mishkan-israel.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "missblisshair.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mktenlared.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mlan-server.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mm6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mm6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mm6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mm6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mneti.ru", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "modelemax.pl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mononom.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "monospazzole.roma.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mouche.fr", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "mrichard333.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ms-a.at", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "myparisiankitchen.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "n6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "n6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "n6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "n6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "n8ta.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "nattiam.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "netexpat.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "networg.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "networg.cz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "networg.pl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "newinternet.media", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "nextrec.site", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "nickfrost.rocks", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "nim-news.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "nirhub.ru", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "nn6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "nn6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "nn6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "nn6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "nophelet.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "nousyukum.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "nullxsec.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "o6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "o6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "o6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "o6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "okashi.me", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "olenergies.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "omny.info", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "onionplay.eu", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "oo6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "oo6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "oo6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "oo6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "oo918.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "orologeria.roma.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "p1979.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "p6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "panevo.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "partyhelfer.ch", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "pchancs.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "pe-bank.jp", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "pis.eu.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "playelephant.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "plexnet.cz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "plichso.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "plumbing-arlington.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "pocze.ch", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "pointforwardinc.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "pollendine.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "poopthereitisla.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "potsdam.directory", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "pp6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "pp6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "praleria.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "prepagosyescortforyou.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "primos-tech.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "programarya.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "projet-saara.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "prvnirodinna.cz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "publicholidays.im", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "q6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "q6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "q6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "q6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "qq6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "qq6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "qq6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "qq6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "quic.network", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "r6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "r6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "r6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "r6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "redchip.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "redjuice.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "residence-donatello.be", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "resumelab.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "rettig.xyz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "richardlangham.plumbing", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "richelelahaise.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "rioxmarketing.us", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "rlahaise.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "romancoinsforsale.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "roohanionlinespiritualhelp.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "roya-holding.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "royalfitnesschennai.in", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "royveenendaal.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "rpoplus.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "rr6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "rr6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "rr6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "rssl.me", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "russelljohn.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "rylandgoldman.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "s6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "s6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "s6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "samkoandmikotoywarehouse.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "sampaguide.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "saxowert.de", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "scde.ventures", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "schipholwatch.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "seaelba.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "serrande.roma.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "serviceair.com.ar", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "setesat.com.br", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "sexyfotosvandep.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "shelbymunsch.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "shibbydex.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "siikaflix.tv", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "sjamaan.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "sjp.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "skolnilogin.cz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "skolniweby.cz", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "sldlcdn.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "smileserver.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "smuns.ch", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "soczu.duckdns.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "solutions-marquagedelignes.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "solxsys.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "sonofsunart.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "sound.as", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "spectrumelectrical-brisbane.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "spedizioni.roma.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "sqdll.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ss6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ss6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ss6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "sspanel.host", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "stariders.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "starvizyon.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "strippersondemand.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "swo.re", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "sx6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "t6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "t6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "taalmeisje.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "talxis.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tampacific.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tampacific.vn", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tappezzeria.roma.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "taunusstein.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tda602-secure-login.tk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tegtech.com.au", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tentech.io", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "termoidraulica.roma.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "thealchemistatelier.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "theantarticx.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "theaviationagency.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "thecavalries.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "thecr3ative.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "thecr3ative.tk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "thedailyshirts.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "themenmedia.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "thetipo01.tk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "thewoosh.me", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tielecingenieria.com.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tipo01.tk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tldtattoo.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tmheatingcooling.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "todaysbestinsurance.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "toest.bg", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tomaszdwornicki.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "trendyaccessoriesonline.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "trousers.co.uk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tt6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tt6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tt6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tt6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tt918.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "tyree.tech", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "u6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "u6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "u6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "udvalgte-ordsprog.dk", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "uplotnitel.online", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "uu6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "uu6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "uu6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "uu6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ux-designers.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "uxdesignerjobs.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "v6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "v6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "vega-rumia.pl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "veterinario.milano.it", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "videownload.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "viennadancecrew.at", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "vip918.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "vipf88.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "vivo.vn", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "vtuber.land", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "vv6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "vv6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "w6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "w6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "w6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "wang.by", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "wellgreece.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "welltycoon.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "werkenbijsherpa.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "wervingenselectieamsterdam.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "wikibuy.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "winterparkphotography.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "workingon.tech", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "wowin58.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "wowin88.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ww6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ww6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ww6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ww6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "x6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo190.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo269.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo380.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo398.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo399.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo401.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo406.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo407.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo466.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo468.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo478.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo480.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo496.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo498.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo506.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo508.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo516.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo526.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo528.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo536.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo538.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo556.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo566.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo570.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo576.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo578.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo580.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo586.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo590.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo600.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo608.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo609.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xinbo610.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xn----ncfb.ws", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xn--kl-oja.is", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xx6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xx6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xx6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xx6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xy6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "xy6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "y6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "y6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "y6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "yamei9911.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "yamei9922.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "yappy.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ybos.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "yesod.in", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "yjst.cn", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "ym181.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "yorgosbos.nl", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "youneedfame.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "yovko.net", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "yy6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "yy6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "z6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "z6729.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "z6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "z6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "zer0-day.pw", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "zety.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "zhaoxixiangban.cc", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "zhenggangzhao.org", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "zz6729.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "zz6957.co", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
+    { "name": "zz6957.com", "policy": "bulk-1-year", "mode": "force-https", "include_subdomains": true },
     // END OF 1-YEAR BULK HSTS ENTRIES
 
     // Only eTLD+1 domains can be submitted automatically to hstspreload.org,
diff --git a/net/quic/platform/impl/quic_flag_utils_impl.h b/net/quic/platform/impl/quic_flag_utils_impl.h
index 846826c..b50e3e0 100644
--- a/net/quic/platform/impl/quic_flag_utils_impl.h
+++ b/net/quic/platform/impl/quic_flag_utils_impl.h
@@ -8,12 +8,12 @@
 #include "base/logging.h"
 
 #define QUIC_RELOADABLE_FLAG_COUNT_IMPL(flag) \
-  DVLOG(2) << "FLAG_" #flag ": " << FLAGS_quic_reloadable_flag_##flag
+  DVLOG(3) << "FLAG_" #flag ": " << FLAGS_quic_reloadable_flag_##flag
 #define QUIC_RELOADABLE_FLAG_COUNT_N_IMPL(flag, instance, total) \
   QUIC_RELOADABLE_FLAG_COUNT_IMPL(flag)
 
 #define QUIC_RESTART_FLAG_COUNT_IMPL(flag) \
-  DVLOG(2) << "FLAG_" #flag ": " << FLAGS_quic_restart_flag_##flag
+  DVLOG(3) << "FLAG_" #flag ": " << FLAGS_quic_restart_flag_##flag
 #define QUIC_RESTART_FLAG_COUNT_N_IMPL(flag, instance, total) \
   QUIC_RESTART_FLAG_COUNT_IMPL(flag)
 
diff --git a/ppapi/proxy/host_dispatcher.cc b/ppapi/proxy/host_dispatcher.cc
index d09b366..8a69dfc0 100644
--- a/ppapi/proxy/host_dispatcher.cc
+++ b/ppapi/proxy/host_dispatcher.cc
@@ -240,12 +240,11 @@
   return NULL;
 }
 
-base::Closure HostDispatcher::AddSyncMessageStatusObserver(
+base::OnceClosure HostDispatcher::AddSyncMessageStatusObserver(
     SyncMessageStatusObserver* obs) {
   sync_status_observer_list_.AddObserver(obs);
-  return base::Bind(&HostDispatcher::RemoveSyncMessageStatusObserver,
-                    weak_ptr_factory_.GetWeakPtr(),
-                    obs);
+  return base::BindOnce(&HostDispatcher::RemoveSyncMessageStatusObserver,
+                        weak_ptr_factory_.GetWeakPtr(), obs);
 }
 
 void HostDispatcher::RemoveSyncMessageStatusObserver(
diff --git a/ppapi/proxy/host_dispatcher.h b/ppapi/proxy/host_dispatcher.h
index 2a64556..8c7e9fc 100644
--- a/ppapi/proxy/host_dispatcher.h
+++ b/ppapi/proxy/host_dispatcher.h
@@ -110,10 +110,11 @@
 
   // Register an observer that will be invoked when the dispatcher begins
   // sending a sync message and finishes sending a sync message.
-  // Returns a Closure that can be used to unregister the observer (the Closure
-  // is bound to a weak pointer, so is safe to call even after the
+  // Returns a OnceClosure that can be used to unregister the observer (the
+  // OnceClosure is bound to a weak pointer, so is safe to call even after the
   // HostDispatcher is gone.)
-  base::Closure AddSyncMessageStatusObserver(SyncMessageStatusObserver* obs);
+  base::OnceClosure AddSyncMessageStatusObserver(
+      SyncMessageStatusObserver* obs);
 
   void AddFilter(IPC::Listener* listener);
 
diff --git a/sandbox/BUILD.gn b/sandbox/BUILD.gn
index c22d6abc..81e7aff 100644
--- a/sandbox/BUILD.gn
+++ b/sandbox/BUILD.gn
@@ -53,7 +53,6 @@
 fuzzer_test("sandbox_ipc_fuzzer") {
   set_sources_assignment_filter([])
   sources = [
-    "ipc.dict",
     "win/fuzzer/fuzzer_types.h",
     "win/fuzzer/sandbox_ipc_fuzzer.cc",
     "win/src/crosscall_server.cc",
diff --git a/services/data_decoder/public/cpp/json_sanitizer.cc b/services/data_decoder/public/cpp/json_sanitizer.cc
index 9a730c4..7b3ec4a 100644
--- a/services/data_decoder/public/cpp/json_sanitizer.cc
+++ b/services/data_decoder/public/cpp/json_sanitizer.cc
@@ -35,7 +35,7 @@
   friend std::default_delete<OopJsonSanitizer>;
   ~OopJsonSanitizer() {}
 
-  void OnParseSuccess(std::unique_ptr<base::Value> value);
+  void OnParseSuccess(base::Value value);
   void OnParseError(const std::string& error);
 
   StringCallback success_callback_;
@@ -55,13 +55,13 @@
       base::Bind(&OopJsonSanitizer::OnParseError, base::Unretained(this)));
 }
 
-void OopJsonSanitizer::OnParseSuccess(std::unique_ptr<base::Value> value) {
+void OopJsonSanitizer::OnParseSuccess(base::Value value) {
   // Self-destruct at the end of this method.
   std::unique_ptr<OopJsonSanitizer> deleter(this);
 
   // A valid JSON document may only have a dictionary or list as its top-level
   // type, but the JSON parser also accepts other types, so we filter them out.
-  base::Value::Type type = value->type();
+  base::Value::Type type = value.type();
   if (type != base::Value::Type::DICTIONARY &&
       type != base::Value::Type::LIST) {
     error_callback_.Run("Invalid top-level type");
@@ -69,7 +69,7 @@
   }
 
   std::string json;
-  if (!base::JSONWriter::Write(*value, &json)) {
+  if (!base::JSONWriter::Write(value, &json)) {
     error_callback_.Run("Encoding error");
     return;
   }
diff --git a/services/data_decoder/public/cpp/safe_json_parser.h b/services/data_decoder/public/cpp/safe_json_parser.h
index 9ba222d..568d85c 100644
--- a/services/data_decoder/public/cpp/safe_json_parser.h
+++ b/services/data_decoder/public/cpp/safe_json_parser.h
@@ -28,7 +28,7 @@
 // deletes itself.
 class SafeJsonParser {
  public:
-  using SuccessCallback = base::Callback<void(std::unique_ptr<base::Value>)>;
+  using SuccessCallback = base::Callback<void(base::Value)>;
   using ErrorCallback = base::Callback<void(const std::string&)>;
 
   using Factory = SafeJsonParser* (*)(const std::string& unsafe_json,
diff --git a/services/data_decoder/public/cpp/safe_json_parser_android.cc b/services/data_decoder/public/cpp/safe_json_parser_android.cc
index 294bc8d..80555ed9 100644
--- a/services/data_decoder/public/cpp/safe_json_parser_android.cc
+++ b/services/data_decoder/public/cpp/safe_json_parser_android.cc
@@ -38,18 +38,16 @@
   // Self-destruct at the end of this method.
   std::unique_ptr<SafeJsonParserAndroid> deleter(this);
 
-  int error_code;
-  std::string error;
-  std::unique_ptr<base::Value> value =
-      base::JSONReader::ReadAndReturnErrorDeprecated(
-          sanitized_json, base::JSON_PARSE_RFC, &error_code, &error);
+  base::JSONReader::ValueWithError value_with_error =
+      base::JSONReader::ReadAndReturnValueWithError(sanitized_json,
+                                                    base::JSON_PARSE_RFC);
 
-  if (!value) {
-    error_callback_.Run(error);
+  if (!value_with_error.value) {
+    error_callback_.Run(value_with_error.error_message);
     return;
   }
 
-  success_callback_.Run(std::move(value));
+  success_callback_.Run(std::move(*value_with_error.value));
 }
 
 void SafeJsonParserAndroid::OnSanitizationError(const std::string& error) {
diff --git a/services/data_decoder/public/cpp/safe_json_parser_impl.cc b/services/data_decoder/public/cpp/safe_json_parser_impl.cc
index 147a909..8dc81d8 100644
--- a/services/data_decoder/public/cpp/safe_json_parser_impl.cc
+++ b/services/data_decoder/public/cpp/safe_json_parser_impl.cc
@@ -51,7 +51,8 @@
   // Shut down the utility process.
   json_parser_ptr_.reset();
 
-  ReportResults(nullptr, "Connection error with the json parser process.");
+  ReportResults(base::nullopt,
+                "Connection error with the json parser process.");
 }
 
 void SafeJsonParserImpl::OnParseDone(base::Optional<base::Value> result,
@@ -61,18 +62,15 @@
   // Shut down the utility process.
   json_parser_ptr_.reset();
 
-  std::unique_ptr<base::Value> result_ptr =
-      result ? base::Value::ToUniquePtrValue(std::move(result.value()))
-             : nullptr;
-  ReportResults(std::move(result_ptr), error.value_or(""));
+  ReportResults(std::move(result), error.value_or(""));
 }
 
-void SafeJsonParserImpl::ReportResults(std::unique_ptr<base::Value> parsed_json,
+void SafeJsonParserImpl::ReportResults(base::Optional<base::Value> parsed_json,
                                        const std::string& error) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   if (error.empty() && parsed_json) {
     if (!success_callback_.is_null())
-      success_callback_.Run(std::move(parsed_json));
+      success_callback_.Run(std::move(*parsed_json));
   } else {
     if (!error_callback_.is_null())
       error_callback_.Run(error);
diff --git a/services/data_decoder/public/cpp/safe_json_parser_impl.h b/services/data_decoder/public/cpp/safe_json_parser_impl.h
index 6c45730..59d78df 100644
--- a/services/data_decoder/public/cpp/safe_json_parser_impl.h
+++ b/services/data_decoder/public/cpp/safe_json_parser_impl.h
@@ -47,7 +47,7 @@
 
   // Reports the result on the calling task runner via the |success_callback_|
   // or the |error_callback_|.
-  void ReportResults(std::unique_ptr<base::Value> parsed_json,
+  void ReportResults(base::Optional<base::Value> parsed_json,
                      const std::string& error);
 
   const std::string unsafe_json_;
diff --git a/services/data_decoder/public/cpp/testing_json_parser.cc b/services/data_decoder/public/cpp/testing_json_parser.cc
index 921f8f7..934397f 100644
--- a/services/data_decoder/public/cpp/testing_json_parser.cc
+++ b/services/data_decoder/public/cpp/testing_json_parser.cc
@@ -45,18 +45,19 @@
 TestingJsonParser::~TestingJsonParser() {}
 
 void TestingJsonParser::Start() {
-  int error_code;
-  std::string error;
-  std::unique_ptr<base::Value> value =
-      base::JSONReader::ReadAndReturnErrorDeprecated(
-          unsafe_json_, base::JSON_PARSE_RFC, &error_code, &error);
+  base::JSONReader::ValueWithError value_with_error =
+      base::JSONReader::ReadAndReturnValueWithError(unsafe_json_,
+                                                    base::JSON_PARSE_RFC);
 
   // Run the callback asynchronously. Post the delete task first, so that the
   // completion callbacks may quit the run loop without leaking |this|.
   base::SequencedTaskRunnerHandle::Get()->DeleteSoon(FROM_HERE, this);
   base::SequencedTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, value ? base::Bind(success_callback_, base::Passed(&value))
-                       : base::Bind(error_callback_, error));
+      FROM_HERE,
+      value_with_error.value
+          ? base::Bind(success_callback_,
+                       base::Passed(std::move(*value_with_error.value)))
+          : base::Bind(error_callback_, value_with_error.error_message));
 }
 
 }  // namespace data_decoder
diff --git a/services/data_decoder/public/cpp/testing_json_parser_unittest.cc b/services/data_decoder/public/cpp/testing_json_parser_unittest.cc
index dee490f0..097f4e3c 100644
--- a/services/data_decoder/public/cpp/testing_json_parser_unittest.cc
+++ b/services/data_decoder/public/cpp/testing_json_parser_unittest.cc
@@ -36,16 +36,14 @@
  private:
   static void SuccessCallback(TestingJsonParserTest* test,
                               base::Closure quit_closure,
-                              std::unique_ptr<base::Value> value) {
+                              base::Value value) {
     test->did_success_ = true;
     quit_closure.Run();
 
-    ASSERT_TRUE(value->is_dict());
-    base::DictionaryValue* dict;
-    ASSERT_TRUE(value->GetAsDictionary(&dict));
-    int key_value = 0;
-    EXPECT_TRUE(dict->GetInteger("key", &key_value));
-    EXPECT_EQ(2, key_value);
+    ASSERT_TRUE(value.is_dict());
+    base::Optional<int> key_value = value.FindIntKey("key");
+    ASSERT_TRUE(key_value.has_value());
+    EXPECT_EQ(2, *key_value);
   }
 
   static void ErrorCallback(TestingJsonParserTest* test,
diff --git a/services/identity/public/cpp/access_token_fetcher_unittest.cc b/services/identity/public/cpp/access_token_fetcher_unittest.cc
index 6865567c..e5b287b4 100644
--- a/services/identity/public/cpp/access_token_fetcher_unittest.cc
+++ b/services/identity/public/cpp/access_token_fetcher_unittest.cc
@@ -109,7 +109,7 @@
  private:
   // OAuth2TokenService::DiagnosticsObserver:
   void OnAccessTokenRequested(
-      const std::string& account_id,
+      const CoreAccountId& account_id,
       const std::string& consumer_id,
       const OAuth2TokenService::ScopeSet& scopes) override {
     if (on_access_token_request_callback_)
diff --git a/services/identity/public/cpp/identity_manager.cc b/services/identity/public/cpp/identity_manager.cc
index 457221c..7bdf6ab 100644
--- a/services/identity/public/cpp/identity_manager.cc
+++ b/services/identity/public/cpp/identity_manager.cc
@@ -564,7 +564,7 @@
 }
 
 void IdentityManager::OnAccessTokenRequested(
-    const std::string& account_id,
+    const CoreAccountId& account_id,
     const std::string& consumer_id,
     const OAuth2TokenService::ScopeSet& scopes) {
   for (auto& observer : diagnostics_observer_list_) {
@@ -572,24 +572,25 @@
   }
 }
 
-void IdentityManager::OnFetchAccessTokenComplete(const std::string& account_id,
-                                                 const std::string& consumer_id,
-                                                 const ScopeSet& scopes,
-                                                 GoogleServiceAuthError error,
-                                                 base::Time expiration_time) {
+void IdentityManager::OnFetchAccessTokenComplete(
+    const CoreAccountId& account_id,
+    const std::string& consumer_id,
+    const ScopeSet& scopes,
+    GoogleServiceAuthError error,
+    base::Time expiration_time) {
   for (auto& observer : diagnostics_observer_list_)
     observer.OnAccessTokenRequestCompleted(account_id, consumer_id, scopes,
                                            error, expiration_time);
 }
 
-void IdentityManager::OnAccessTokenRemoved(const std::string& account_id,
+void IdentityManager::OnAccessTokenRemoved(const CoreAccountId& account_id,
                                            const ScopeSet& scopes) {
   for (auto& observer : diagnostics_observer_list_)
     observer.OnAccessTokenRemovedFromCache(account_id, scopes);
 }
 
 void IdentityManager::OnRefreshTokenAvailableFromSource(
-    const std::string& account_id,
+    const CoreAccountId& account_id,
     bool is_refresh_token_valid,
     const std::string& source) {
   for (auto& observer : diagnostics_observer_list_)
@@ -598,7 +599,7 @@
 }
 
 void IdentityManager::OnRefreshTokenRevokedFromSource(
-    const std::string& account_id,
+    const CoreAccountId& account_id,
     const std::string& source) {
   for (auto& observer : diagnostics_observer_list_)
     observer.OnRefreshTokenRemovedForAccountFromSource(account_id, source);
diff --git a/services/identity/public/cpp/identity_manager.h b/services/identity/public/cpp/identity_manager.h
index dafa6854..30d6ab7 100644
--- a/services/identity/public/cpp/identity_manager.h
+++ b/services/identity/public/cpp/identity_manager.h
@@ -609,20 +609,20 @@
 
   // OAuth2TokenService::DiagnosticsObserver:
   void OnAccessTokenRequested(
-      const std::string& account_id,
+      const CoreAccountId& account_id,
       const std::string& consumer_id,
       const OAuth2TokenService::ScopeSet& scopes) override;
-  void OnFetchAccessTokenComplete(const std::string& account_id,
+  void OnFetchAccessTokenComplete(const CoreAccountId& account_id,
                                   const std::string& consumer_id,
                                   const ScopeSet& scopes,
                                   GoogleServiceAuthError error,
                                   base::Time expiration_time) override;
-  void OnAccessTokenRemoved(const std::string& account_id,
+  void OnAccessTokenRemoved(const CoreAccountId& account_id,
                             const ScopeSet& scopes) override;
-  void OnRefreshTokenAvailableFromSource(const std::string& account_id,
+  void OnRefreshTokenAvailableFromSource(const CoreAccountId& account_id,
                                          bool is_refresh_token_valid,
                                          const std::string& source) override;
-  void OnRefreshTokenRevokedFromSource(const std::string& account_id,
+  void OnRefreshTokenRevokedFromSource(const CoreAccountId& account_id,
                                        const std::string& source) override;
 
   // AccountTrackerService::Observer:
diff --git a/services/network/cors/cors_url_loader.cc b/services/network/cors/cors_url_loader.cc
index fb36d27..4a253df 100644
--- a/services/network/cors/cors_url_loader.cc
+++ b/services/network/cors/cors_url_loader.cc
@@ -157,6 +157,7 @@
     request_.headers.RemoveHeader(name);
   request_.headers.MergeFrom(modified_headers);
 
+  const std::string original_method = std::move(request_.method);
   request_.url = redirect_info_.new_url;
   request_.method = redirect_info_.new_method;
   request_.referrer = GURL(redirect_info_.new_referrer);
@@ -173,26 +174,32 @@
   // We cannot use FollowRedirect for a request with preflight (i.e., when both
   // |fetch_cors_flag_| and |NeedsPreflight(request_)| are true).
   //
-  // Additionally, when |original_fetch_cors_flag| is false,
-  // |fetch_cors_flag_| is true and |NeedsPreflight(request)| is false, the net/
-  // implementation won't attach an "origin" header on redirect, as the original
-  // request didn't have one. In such a case we need to re-issue a request
-  // manually in order to attach the correct origin header.
-  // For "no-cors" requests we rely on redirect logic in net/ (specifically
-  // in net/url_request/redirect_util.cc).
-  if ((original_fetch_cors_flag && !NeedsPreflight(request_)) ||
-      !fetch_cors_flag_) {
-    response_tainting_ = CalculateResponseTainting(
-        request_.url, request_.fetch_request_mode, request_.request_initiator,
-        fetch_cors_flag_, tainted_, origin_access_list_);
-    network_loader_->FollowRedirect(removed_headers, modified_headers, new_url);
+  // When |original_fetch_cors_flag| is false, |fetch_cors_flag_| is true and
+  // |NeedsPreflight(request)| is false, the net/ implementation won't attach an
+  // "origin" header on redirect, as the original request didn't have one.
+  //
+  // When the request method is changed (due to 302 status code, for example),
+  // the net/ implementation removes the origin header.
+  //
+  // In such cases we need to re-issue a request manually in order to attach the
+  // correct origin header. For "no-cors" requests we rely on redirect logic in
+  // net/ (specifically in net/url_request/redirect_util.cc).
+  //
+  // After both OOR-CORS and network service are fully shipped, we may be able
+  // to remove the logic in net/.
+  if ((fetch_cors_flag_ && NeedsPreflight(request_)) ||
+      (!original_fetch_cors_flag && fetch_cors_flag_) ||
+      (fetch_cors_flag_ && original_method != request_.method)) {
+    DCHECK_NE(request_.fetch_request_mode, mojom::FetchRequestMode::kNoCors);
+    network_client_binding_.Unbind();
+    StartRequest();
     return;
   }
-  DCHECK_NE(request_.fetch_request_mode, mojom::FetchRequestMode::kNoCors);
 
-  network_client_binding_.Unbind();
-
-  StartRequest();
+  response_tainting_ = CalculateResponseTainting(
+      request_.url, request_.fetch_request_mode, request_.request_initiator,
+      fetch_cors_flag_, tainted_, origin_access_list_);
+  network_loader_->FollowRedirect(removed_headers, modified_headers, new_url);
 }
 
 void CorsURLLoader::ProceedWithResponse() {
diff --git a/services/service_manager/sandbox/win/sandbox_win.cc b/services/service_manager/sandbox/win/sandbox_win.cc
index 491ce82..7f4b3a6 100644
--- a/services/service_manager/sandbox/win/sandbox_win.cc
+++ b/services/service_manager/sandbox/win/sandbox_win.cc
@@ -919,14 +919,17 @@
 #endif
 
   // Post-startup mitigations.
-  mitigations = sandbox::MITIGATION_STRICT_HANDLE_CHECKS |
-                sandbox::MITIGATION_DLL_SEARCH_ORDER;
+  mitigations = sandbox::MITIGATION_DLL_SEARCH_ORDER;
   if (!cmd_line->HasSwitch(switches::kAllowThirdPartyModules))
     mitigations |= sandbox::MITIGATION_FORCE_MS_SIGNED_BINS;
   if (sandbox_type == SANDBOX_TYPE_NETWORK ||
       sandbox_type == SANDBOX_TYPE_AUDIO) {
     mitigations |= sandbox::MITIGATION_DYNAMIC_CODE_DISABLE;
   }
+  // TODO(wfh): Relax strict handle checks for network process until root cause
+  // for this crash can be resolved. See https://crbug.com/939590.
+  if (sandbox_type != SANDBOX_TYPE_NETWORK)
+    mitigations |= sandbox::MITIGATION_STRICT_HANDLE_CHECKS;
 
   result = policy->SetDelayedProcessMitigations(mitigations);
   if (result != sandbox::SBOX_ALL_OK)
diff --git a/testing/variations/fieldtrial_testing_config.json b/testing/variations/fieldtrial_testing_config.json
index 59e11996..d2a9d41f 100644
--- a/testing/variations/fieldtrial_testing_config.json
+++ b/testing/variations/fieldtrial_testing_config.json
@@ -396,21 +396,6 @@
             ]
         }
     ],
-    "AndroidLanguageSettings": [
-        {
-            "platforms": [
-                "android"
-            ],
-            "experiments": [
-                {
-                    "name": "Enabled",
-                    "enable_features": [
-                        "LanguagesPreference"
-                    ]
-                }
-            ]
-        }
-    ],
     "AndroidMediaProcessPriority": [
         {
             "platforms": [
diff --git a/third_party/blink/public/mojom/credentialmanager/credential_manager.mojom b/third_party/blink/public/mojom/credentialmanager/credential_manager.mojom
index b4963ea..b17ae07 100644
--- a/third_party/blink/public/mojom/credentialmanager/credential_manager.mojom
+++ b/third_party/blink/public/mojom/credentialmanager/credential_manager.mojom
@@ -27,7 +27,11 @@
   NOT_ALLOWED,
   INVALID_DOMAIN,
   CREDENTIAL_EXCLUDED,
+
+  // TODO(crbug/964439): Unused in Desktop, but kept around for Android. Delete
+  // once it's fully obsolete.
   CREDENTIAL_NOT_RECOGNIZED,
+
   NOT_IMPLEMENTED,
   NOT_FOCUSED,
   RESIDENT_CREDENTIALS_UNSUPPORTED,
diff --git a/third_party/blink/public/mojom/webauthn/authenticator.mojom b/third_party/blink/public/mojom/webauthn/authenticator.mojom
index 9cc5438..fe3dfdf2 100644
--- a/third_party/blink/public/mojom/webauthn/authenticator.mojom
+++ b/third_party/blink/public/mojom/webauthn/authenticator.mojom
@@ -18,7 +18,11 @@
   NOT_ALLOWED_ERROR,
   INVALID_DOMAIN,
   CREDENTIAL_EXCLUDED,
+
+  // TODO(crbug/964439): Unused in Desktop, but kept around for Android. Delete
+  // once it's fully obsolete.
   CREDENTIAL_NOT_RECOGNIZED,
+
   NOT_IMPLEMENTED,
   NOT_FOCUSED,
   RESIDENT_CREDENTIALS_UNSUPPORTED,
diff --git a/third_party/blink/public/platform/web_runtime_features.h b/third_party/blink/public/platform/web_runtime_features.h
index 8dc52ea..6b34e87 100644
--- a/third_party/blink/public/platform/web_runtime_features.h
+++ b/third_party/blink/public/platform/web_runtime_features.h
@@ -83,6 +83,7 @@
   BLINK_PLATFORM_EXPORT static void EnableAudioOutputDevices(bool);
   BLINK_PLATFORM_EXPORT static void EnableBackgroundFetch(bool);
   BLINK_PLATFORM_EXPORT static void EnableBlinkHeapIncrementalMarking(bool);
+  BLINK_PLATFORM_EXPORT static void EnableBlinkHeapUnifiedGCScheduling(bool);
   BLINK_PLATFORM_EXPORT static void EnableBloatedRendererDetection(bool);
   BLINK_PLATFORM_EXPORT static void EnableBlockingFocusWithoutUserActivation(
       bool);
diff --git a/third_party/blink/public/platform/web_thread_type.h b/third_party/blink/public/platform/web_thread_type.h
index 38ace6b..b7d8ec51 100644
--- a/third_party/blink/public/platform/web_thread_type.h
+++ b/third_party/blink/public/platform/web_thread_type.h
@@ -20,7 +20,7 @@
   kAudioWorkletThread = 7,
   kFileThread = 8,
   kDatabaseThread = 9,
-  kWebAudioThread = 10,
+  // 10 was kWebAudioThread, which was deleted (crbug.com/965093)
   // 11 was kScriptStreamerThread, which was deleted
   kOfflineAudioRenderThread = 12,
   kReverbConvolutionBackgroundThread = 13,
diff --git a/third_party/blink/renderer/bindings/core/v8/worker_or_worklet_script_controller.cc b/third_party/blink/renderer/bindings/core/v8/worker_or_worklet_script_controller.cc
index 26a0f26..7f25150 100644
--- a/third_party/blink/renderer/bindings/core/v8/worker_or_worklet_script_controller.cc
+++ b/third_party/blink/renderer/bindings/core/v8/worker_or_worklet_script_controller.cc
@@ -142,7 +142,7 @@
   script_state_->DissociateContext();
 }
 
-bool WorkerOrWorkletScriptController::Initialize(const KURL& url_for_debugger) {
+void WorkerOrWorkletScriptController::Initialize(const KURL& url_for_debugger) {
   v8::HandleScope handle_scope(isolate_);
 
   DCHECK(!IsContextInitialized());
@@ -154,8 +154,7 @@
       script_wrappable->GetWrapperTypeInfo();
   v8::Local<v8::FunctionTemplate> global_interface_template =
       wrapper_type_info->DomTemplate(isolate_, *world_);
-  if (global_interface_template.IsEmpty())
-    return false;
+  DCHECK(!global_interface_template.IsEmpty());
   v8::Local<v8::ObjectTemplate> global_template =
       global_interface_template->InstanceTemplate();
   v8::Local<v8::Context> context;
@@ -174,8 +173,7 @@
                                v8::DeserializeInternalFieldsCallback(),
                                agent->event_loop()->microtask_queue());
   }
-  if (context.IsEmpty())
-    return false;
+  DCHECK(!context.IsEmpty());
 
   script_state_ = MakeGarbageCollected<ScriptState>(context, world_);
 
@@ -269,8 +267,6 @@
     // call this here.
     PrepareForEvaluation();
   }
-
-  return true;
 }
 
 void WorkerOrWorkletScriptController::PrepareForEvaluation() {
diff --git a/third_party/blink/renderer/bindings/core/v8/worker_or_worklet_script_controller.h b/third_party/blink/renderer/bindings/core/v8/worker_or_worklet_script_controller.h
index fd3f5a3a..b67f3f8d 100644
--- a/third_party/blink/renderer/bindings/core/v8/worker_or_worklet_script_controller.h
+++ b/third_party/blink/renderer/bindings/core/v8/worker_or_worklet_script_controller.h
@@ -73,7 +73,7 @@
   // For main thread WorkletGlobalScope, WorkerOrWorkletGlobalScope::Name() is
   // used for setting DOMWrapperWorld's human readable name.
   // This should be called only once.
-  bool Initialize(const KURL& url_for_debugger);
+  void Initialize(const KURL& url_for_debugger);
 
   // Prepares for script evaluation. This must be called after Initialize()
   // before Evaluate().
diff --git a/third_party/blink/renderer/config.gni b/third_party/blink/renderer/config.gni
index c33b59a..5145101 100644
--- a/third_party/blink/renderer/config.gni
+++ b/third_party/blink/renderer/config.gni
@@ -46,10 +46,6 @@
 
 feature_defines_list = []
 
-if (is_debug) {
-  feature_defines_list += [ "WTF_USE_DYNAMIC_ANNOTATIONS=1" ]
-}
-
 if (use_low_quality_image_interpolation) {
   feature_defines_list += [ "WTF_USE_LOW_QUALITY_IMAGE_INTERPOLATION=1" ]
 }
diff --git a/third_party/blink/renderer/core/animation/animation_effect_test.cc b/third_party/blink/renderer/core/animation/animation_effect_test.cc
index 60805f61..37203016 100644
--- a/third_party/blink/renderer/core/animation/animation_effect_test.cc
+++ b/third_party/blink/renderer/core/animation/animation_effect_test.cc
@@ -35,6 +35,7 @@
 #include "third_party/blink/renderer/core/animation/animation_effect_owner.h"
 #include "third_party/blink/renderer/core/animation/computed_effect_timing.h"
 #include "third_party/blink/renderer/core/animation/optional_effect_timing.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -70,13 +71,10 @@
 
 class TestAnimationEffect : public AnimationEffect {
  public:
-  static TestAnimationEffect* Create(const Timing& specified) {
-    return MakeGarbageCollected<TestAnimationEffect>(
-        specified, MakeGarbageCollected<TestAnimationEffectEventDelegate>());
-  }
-
-  TestAnimationEffect(const Timing& specified,
-                      TestAnimationEffectEventDelegate* event_delegate)
+  TestAnimationEffect(
+      const Timing& specified,
+      TestAnimationEffectEventDelegate* event_delegate =
+          MakeGarbageCollected<TestAnimationEffectEventDelegate>())
       : AnimationEffect(specified, event_delegate),
         event_delegate_(event_delegate) {}
 
@@ -128,7 +126,7 @@
 TEST(AnimationAnimationEffectTest, Sanity) {
   Timing timing;
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(2);
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(0);
 
@@ -174,7 +172,7 @@
 TEST(AnimationAnimationEffectTest, FillAuto) {
   Timing timing;
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(1);
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(-1);
   EXPECT_EQ(0, animation_node->Progress());
@@ -187,7 +185,7 @@
   Timing timing;
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(1);
   timing.fill_mode = Timing::FillMode::FORWARDS;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(-1);
   EXPECT_FALSE(animation_node->Progress());
@@ -200,7 +198,7 @@
   Timing timing;
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(1);
   timing.fill_mode = Timing::FillMode::BACKWARDS;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(-1);
   EXPECT_EQ(0, animation_node->Progress());
@@ -213,7 +211,7 @@
   Timing timing;
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(1);
   timing.fill_mode = Timing::FillMode::BOTH;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(-1);
   EXPECT_EQ(0, animation_node->Progress());
@@ -227,7 +225,7 @@
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(1);
   timing.fill_mode = Timing::FillMode::FORWARDS;
   timing.start_delay = 0.5;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(0);
   EXPECT_FALSE(animation_node->Progress());
@@ -244,7 +242,7 @@
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(1);
   timing.fill_mode = Timing::FillMode::FORWARDS;
   timing.iteration_count = 0;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(-1);
   EXPECT_EQ(0, animation_node->RepeatedDuration());
@@ -262,7 +260,7 @@
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(1);
   timing.fill_mode = Timing::FillMode::FORWARDS;
   timing.iteration_count = std::numeric_limits<double>::infinity();
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(-1);
   EXPECT_TRUE(IsNull(animation_node->CurrentIteration()));
@@ -280,7 +278,7 @@
   Timing timing;
   timing.iteration_count = 2;
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(2);
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(0);
   EXPECT_EQ(0, animation_node->CurrentIteration());
@@ -309,7 +307,7 @@
   timing.iteration_count = 2.2;
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(1);
   timing.fill_mode = Timing::FillMode::BOTH;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(-1);
   EXPECT_EQ(1, animation_node->CurrentIteration());
@@ -329,7 +327,7 @@
   timing.iteration_count = 10;
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(1);
   timing.direction = Timing::PlaybackDirection::ALTERNATE_NORMAL;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(0.75);
   EXPECT_EQ(0, animation_node->CurrentIteration());
@@ -349,7 +347,7 @@
   timing.iteration_count = 10;
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(1);
   timing.direction = Timing::PlaybackDirection::ALTERNATE_REVERSE;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(0.75);
   EXPECT_EQ(0, animation_node->CurrentIteration());
@@ -366,7 +364,7 @@
 
 TEST(AnimationAnimationEffectTest, ZeroDurationSanity) {
   Timing timing;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(0);
 
@@ -392,7 +390,7 @@
 TEST(AnimationAnimationEffectTest, ZeroDurationFillForwards) {
   Timing timing;
   timing.fill_mode = Timing::FillMode::FORWARDS;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(-1);
   EXPECT_FALSE(animation_node->Progress());
@@ -407,7 +405,7 @@
 TEST(AnimationAnimationEffectTest, ZeroDurationFillBackwards) {
   Timing timing;
   timing.fill_mode = Timing::FillMode::BACKWARDS;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(-1);
   EXPECT_EQ(0, animation_node->Progress());
@@ -422,7 +420,7 @@
 TEST(AnimationAnimationEffectTest, ZeroDurationFillBoth) {
   Timing timing;
   timing.fill_mode = Timing::FillMode::BOTH;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(-1);
   EXPECT_EQ(0, animation_node->Progress());
@@ -438,7 +436,7 @@
   Timing timing;
   timing.fill_mode = Timing::FillMode::FORWARDS;
   timing.start_delay = 0.5;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(0);
   EXPECT_FALSE(animation_node->Progress());
@@ -456,7 +454,7 @@
   timing.iteration_count = 0.2;
   timing.fill_mode = Timing::FillMode::BOTH;
   timing.start_delay = 0.3;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(0);
   EXPECT_EQ(0.1, animation_node->Progress());
@@ -473,7 +471,7 @@
   Timing timing;
   timing.fill_mode = Timing::FillMode::FORWARDS;
   timing.iteration_count = std::numeric_limits<double>::infinity();
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(-1);
   EXPECT_EQ(0, animation_node->RepeatedDuration());
@@ -491,7 +489,7 @@
   Timing timing;
   timing.fill_mode = Timing::FillMode::FORWARDS;
   timing.iteration_count = 2;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(-1);
   EXPECT_TRUE(IsNull(animation_node->CurrentIteration()));
@@ -511,7 +509,7 @@
   timing.iteration_start = 1.2;
   timing.iteration_count = 2.2;
   timing.fill_mode = Timing::FillMode::BOTH;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(-1);
   EXPECT_EQ(1, animation_node->CurrentIteration());
@@ -531,7 +529,7 @@
   timing.fill_mode = Timing::FillMode::FORWARDS;
   timing.iteration_count = 2;
   timing.direction = Timing::PlaybackDirection::ALTERNATE_NORMAL;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(-1);
   EXPECT_TRUE(IsNull(animation_node->CurrentIteration()));
@@ -551,7 +549,7 @@
   timing.fill_mode = Timing::FillMode::FORWARDS;
   timing.iteration_count = 2;
   timing.direction = Timing::PlaybackDirection::ALTERNATE_REVERSE;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(-1);
   EXPECT_TRUE(IsNull(animation_node->CurrentIteration()));
@@ -570,7 +568,7 @@
   Timing timing;
   timing.iteration_duration = AnimationTimeDelta::Max();
   timing.iteration_count = 1;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(0);
 
@@ -600,7 +598,7 @@
   Timing timing;
   timing.iteration_duration = AnimationTimeDelta::Max();
   timing.iteration_count = 0;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(0);
 
@@ -627,7 +625,7 @@
   Timing timing;
   timing.iteration_duration = AnimationTimeDelta::Max();
   timing.iteration_count = std::numeric_limits<double>::infinity();
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(0);
 
@@ -658,7 +656,7 @@
   timing.end_delay = 2;
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(4);
   timing.iteration_count = 2;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
   EXPECT_EQ(11, animation_node->EndTimeInternal());
 }
 
@@ -668,7 +666,7 @@
   timing.fill_mode = Timing::FillMode::FORWARDS;
   timing.iteration_count = 2;
   timing.start_delay = 1;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(0.0, kTimingUpdateOnDemand);
   EXPECT_FALSE(animation_node->EventDelegate()->EventTriggered());
@@ -691,7 +689,7 @@
   timing.iteration_count = 2.5;
   timing.start_delay = 1;
   timing.direction = Timing::PlaybackDirection::ALTERNATE_NORMAL;
-  TestAnimationEffect* animation_node = TestAnimationEffect::Create(timing);
+  auto* animation_node = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   animation_node->UpdateInheritedTime(0);
   EXPECT_EQ(0, animation_node->TakeLocalTime());
@@ -724,7 +722,7 @@
 
 TEST(AnimationAnimationEffectTest, UpdateTiming) {
   Timing timing;
-  TestAnimationEffect* effect = TestAnimationEffect::Create(timing);
+  auto* effect = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   EXPECT_EQ(0, effect->getTiming()->delay());
   OptionalEffectTiming* effect_timing = OptionalEffectTiming::Create();
@@ -778,7 +776,7 @@
 
 TEST(AnimationAnimationEffectTest, UpdateTimingThrowsWhenExpected) {
   Timing timing;
-  TestAnimationEffect* effect = TestAnimationEffect::Create(timing);
+  auto* effect = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   DummyExceptionStateForTesting exception_state;
 
@@ -826,7 +824,7 @@
 
 TEST(AnimationAnimationEffectTest, UpdateTimingInformsOwnerOnChange) {
   Timing timing;
-  TestAnimationEffect* effect = TestAnimationEffect::Create(timing);
+  auto* effect = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   MockAnimationEffectOwner* owner =
       MakeGarbageCollected<MockAnimationEffectOwner>();
@@ -849,7 +847,7 @@
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(2);
   timing.direction = Timing::PlaybackDirection::ALTERNATE_REVERSE;
   timing.timing_function = CubicBezierTimingFunction::Create(1, 1, 0.3, 0.3);
-  TestAnimationEffect* effect = TestAnimationEffect::Create(timing);
+  auto* effect = MakeGarbageCollected<TestAnimationEffect>(timing);
 
   MockAnimationEffectOwner* owner =
       MakeGarbageCollected<MockAnimationEffectOwner>();
diff --git a/third_party/blink/renderer/core/animation/animation_sim_test.cc b/third_party/blink/renderer/core/animation/animation_sim_test.cc
index 80aa614..aed7877 100644
--- a/third_party/blink/renderer/core/animation/animation_sim_test.cc
+++ b/third_party/blink/renderer/core/animation/animation_sim_test.cc
@@ -12,6 +12,7 @@
 #include "third_party/blink/renderer/core/testing/sim/sim_compositor.h"
 #include "third_party/blink/renderer/core/testing/sim/sim_request.h"
 #include "third_party/blink/renderer/core/testing/sim/sim_test.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/testing/runtime_enabled_features_test_helpers.h"
 #include "third_party/blink/renderer/platform/wtf/time.h"
 
@@ -66,7 +67,7 @@
   EXPECT_FALSE(exception_state.HadException());
 
   // target.animate({'--x': '100%'}, 1000);
-  StringKeyframe* keyframe = StringKeyframe::Create();
+  auto* keyframe = MakeGarbageCollected<StringKeyframe>();
   keyframe->SetCSSPropertyValue("--x", GetDocument().GetPropertyRegistry(),
                                 "100%", GetDocument().GetSecureContextMode(),
                                 GetDocument().ElementSheet().Contents());
@@ -75,7 +76,8 @@
   Timing timing;
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(1);
   ElementAnimation::animateInternal(
-      *target, StringKeyframeEffectModel::Create(keyframes), timing);
+      *target, MakeGarbageCollected<StringKeyframeEffectModel>(keyframes),
+      timing);
 
   // This sets the baseComputedStyle on the animation exit frame.
   Compositor().BeginFrame(1);
@@ -87,7 +89,7 @@
   EXPECT_FALSE(exception_state.HadException());
 
   // target.animate({'--x': '100%'}, 1000);
-  keyframe = StringKeyframe::Create();
+  keyframe = MakeGarbageCollected<StringKeyframe>();
   keyframe->SetCSSPropertyValue("--x", GetDocument().GetPropertyRegistry(),
                                 "100%", GetDocument().GetSecureContextMode(),
                                 GetDocument().ElementSheet().Contents());
@@ -96,7 +98,8 @@
   timing = Timing::Defaults();
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(1);
   ElementAnimation::animateInternal(
-      *target, StringKeyframeEffectModel::Create(keyframes), timing);
+      *target, MakeGarbageCollected<StringKeyframeEffectModel>(keyframes),
+      timing);
 
   // This (previously) would not clear the existing baseComputedStyle and would
   // crash on the equality assertion in the exit frame when it tried to update
diff --git a/third_party/blink/renderer/core/animation/animation_test.cc b/third_party/blink/renderer/core/animation/animation_test.cc
index ed31579d..577f8983 100644
--- a/third_party/blink/renderer/core/animation/animation_test.cc
+++ b/third_party/blink/renderer/core/animation/animation_test.cc
@@ -31,6 +31,7 @@
 #include "third_party/blink/renderer/core/animation/animation.h"
 
 #include <memory>
+
 #include "base/bits.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/renderer/core/animation/animation_clock.h"
@@ -47,6 +48,7 @@
 #include "third_party/blink/renderer/core/paint/paint_layer.h"
 #include "third_party/blink/renderer/core/testing/core_unit_test_helper.h"
 #include "third_party/blink/renderer/core/testing/dummy_page_holder.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/testing/histogram_tester.h"
 #include "third_party/blink/renderer/platform/testing/runtime_enabled_features_test_helpers.h"
 #include "third_party/blink/renderer/platform/weborigin/kurl.h"
@@ -102,7 +104,7 @@
     keyframes.push_back(start_keyframe);
     keyframes.push_back(end_keyframe);
 
-    return TransitionKeyframeEffectModel::Create(keyframes);
+    return MakeGarbageCollected<TransitionKeyframeEffectModel>(keyframes);
   }
 
   void ResetWithCompositedAnimation() {
@@ -117,11 +119,13 @@
     Timing timing;
     timing.iteration_duration = AnimationTimeDelta::FromSecondsD(30);
 
-    Persistent<StringKeyframe> start_keyframe = StringKeyframe::Create();
+    Persistent<StringKeyframe> start_keyframe =
+        MakeGarbageCollected<StringKeyframe>();
     start_keyframe->SetCSSPropertyValue(CSSPropertyID::kOpacity, "1.0",
                                         SecureContextMode::kInsecureContext,
                                         nullptr);
-    Persistent<StringKeyframe> end_keyframe = StringKeyframe::Create();
+    Persistent<StringKeyframe> end_keyframe =
+        MakeGarbageCollected<StringKeyframe>();
     end_keyframe->SetCSSPropertyValue(CSSPropertyID::kOpacity, "0.0",
                                       SecureContextMode::kInsecureContext,
                                       nullptr);
@@ -131,9 +135,9 @@
     keyframes.push_back(end_keyframe);
 
     Element* element = GetElementById("target");
-    StringKeyframeEffectModel* model =
-        StringKeyframeEffectModel::Create(keyframes);
-    animation = timeline->Play(KeyframeEffect::Create(element, model, timing));
+    auto* model = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
+    animation = timeline->Play(
+        MakeGarbageCollected<KeyframeEffect>(element, model, timing));
 
     // After creating the animation we need to clean the lifecycle so that the
     // animation can be pushed to the compositor.
@@ -144,13 +148,15 @@
   }
 
   KeyframeEffectModelBase* MakeEmptyEffectModel() {
-    return StringKeyframeEffectModel::Create(StringKeyframeVector());
+    return MakeGarbageCollected<StringKeyframeEffectModel>(
+        StringKeyframeVector());
   }
 
   KeyframeEffect* MakeAnimation(double duration = 30) {
     Timing timing;
     timing.iteration_duration = AnimationTimeDelta::FromSecondsD(duration);
-    return KeyframeEffect::Create(nullptr, MakeEmptyEffectModel(), timing);
+    return MakeGarbageCollected<KeyframeEffect>(nullptr, MakeEmptyEffectModel(),
+                                                timing);
   }
 
   bool SimulateFrame(double time) {
@@ -530,8 +536,8 @@
   Timing timing;
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(1);
   timing.iteration_count = std::numeric_limits<double>::infinity();
-  animation->setEffect(
-      KeyframeEffect::Create(nullptr, MakeEmptyEffectModel(), timing));
+  animation->setEffect(MakeGarbageCollected<KeyframeEffect>(
+      nullptr, MakeEmptyEffectModel(), timing));
   animation->SetCurrentTimeInternal(10);
 
   DummyExceptionStateForTesting exception_state;
@@ -744,8 +750,8 @@
   timing.start_delay = 1;
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(1);
   timing.end_delay = 1;
-  KeyframeEffect* keyframe_effect =
-      KeyframeEffect::Create(nullptr, MakeEmptyEffectModel(), timing);
+  auto* keyframe_effect = MakeGarbageCollected<KeyframeEffect>(
+      nullptr, MakeEmptyEffectModel(), timing);
   animation = timeline->Play(keyframe_effect);
   animation->setStartTime(0, false);
 
@@ -849,8 +855,8 @@
   Persistent<Element> element = document->CreateElementForBinding("foo");
 
   Timing timing;
-  KeyframeEffect* keyframe_effect =
-      KeyframeEffect::Create(element.Get(), MakeEmptyEffectModel(), timing);
+  auto* keyframe_effect = MakeGarbageCollected<KeyframeEffect>(
+      element.Get(), MakeEmptyEffectModel(), timing);
   Animation* animation = timeline->Play(keyframe_effect);
   SimulateFrame(0);
   timeline->ServiceAnimations(kTimingUpdateForAnimationFrame);
@@ -952,12 +958,12 @@
 
   Timing timing;
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(30);
-  KeyframeEffect* keyframe_effect_composited = KeyframeEffect::Create(
+  auto* keyframe_effect_composited = MakeGarbageCollected<KeyframeEffect>(
       ToElement(object_composited->GetNode()), MakeSimpleEffectModel(), timing);
   Animation* animation_composited = timeline->Play(keyframe_effect_composited);
-  KeyframeEffect* keyframe_effect_not_composited =
-      KeyframeEffect::Create(ToElement(object_not_composited->GetNode()),
-                             MakeSimpleEffectModel(), timing);
+  auto* keyframe_effect_not_composited = MakeGarbageCollected<KeyframeEffect>(
+      ToElement(object_not_composited->GetNode()), MakeSimpleEffectModel(),
+      timing);
   Animation* animation_not_composited =
       timeline->Play(keyframe_effect_not_composited);
 
@@ -1064,10 +1070,12 @@
   animation->setPlaybackRate(1);
 
   // Finally, change the keyframes to something unsupported by the compositor.
-  Persistent<StringKeyframe> start_keyframe = StringKeyframe::Create();
+  Persistent<StringKeyframe> start_keyframe =
+      MakeGarbageCollected<StringKeyframe>();
   start_keyframe->SetCSSPropertyValue(
       CSSPropertyID::kLeft, "0", SecureContextMode::kInsecureContext, nullptr);
-  Persistent<StringKeyframe> end_keyframe = StringKeyframe::Create();
+  Persistent<StringKeyframe> end_keyframe =
+      MakeGarbageCollected<StringKeyframe>();
   end_keyframe->SetCSSPropertyValue(CSSPropertyID::kLeft, "100px",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
@@ -1095,11 +1103,13 @@
 
   // Now change the keyframes; this should mark the animation as compositor
   // pending as we need to sync the compositor side.
-  Persistent<StringKeyframe> start_keyframe = StringKeyframe::Create();
+  Persistent<StringKeyframe> start_keyframe =
+      MakeGarbageCollected<StringKeyframe>();
   start_keyframe->SetCSSPropertyValue(CSSPropertyID::kOpacity, "0.0",
                                       SecureContextMode::kInsecureContext,
                                       nullptr);
-  Persistent<StringKeyframe> end_keyframe = StringKeyframe::Create();
+  Persistent<StringKeyframe> end_keyframe =
+      MakeGarbageCollected<StringKeyframe>();
   end_keyframe->SetCSSPropertyValue(CSSPropertyID::kOpacity, "1.0",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
diff --git a/third_party/blink/renderer/core/animation/compositor_animations_test.cc b/third_party/blink/renderer/core/animation/compositor_animations_test.cc
index 53e06b53..f38984d 100644
--- a/third_party/blink/renderer/core/animation/compositor_animations_test.cc
+++ b/third_party/blink/renderer/core/animation/compositor_animations_test.cc
@@ -66,6 +66,7 @@
 #include "third_party/blink/renderer/platform/geometry/float_box.h"
 #include "third_party/blink/renderer/platform/geometry/int_size.h"
 #include "third_party/blink/renderer/platform/graphics/compositing/paint_artifact_compositor.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/testing/histogram_tester.h"
 #include "third_party/blink/renderer/platform/testing/paint_test_configurations.h"
 #include "third_party/blink/renderer/platform/testing/unit_test_helpers.h"
@@ -116,11 +117,11 @@
 
     keyframe_vector2_ = CreateCompositableFloatKeyframeVector(2);
     keyframe_animation_effect2_ =
-        StringKeyframeEffectModel::Create(*keyframe_vector2_);
+        MakeGarbageCollected<StringKeyframeEffectModel>(*keyframe_vector2_);
 
     keyframe_vector5_ = CreateCompositableFloatKeyframeVector(5);
     keyframe_animation_effect5_ =
-        StringKeyframeEffectModel::Create(*keyframe_vector5_);
+        MakeGarbageCollected<StringKeyframeEffectModel>(*keyframe_vector5_);
 
     GetAnimationClock().ResetTimeForTesting();
 
@@ -198,7 +199,7 @@
     frames.push_back(frame);
     frames.push_back(ToStringKeyframe(second));
     return CanStartEffectOnCompositor(
-        timing_, *StringKeyframeEffectModel::Create(frames));
+        timing_, *MakeGarbageCollected<StringKeyframeEffectModel>(frames));
   }
 
   // -------------------------------------------------------------------
@@ -218,7 +219,7 @@
   StringKeyframe* CreateReplaceOpKeyframe(CSSPropertyID id,
                                           const String& value,
                                           double offset = 0) {
-    StringKeyframe* keyframe = StringKeyframe::Create();
+    auto* keyframe = MakeGarbageCollected<StringKeyframe>();
     keyframe->SetCSSPropertyValue(id, value,
                                   SecureContextMode::kInsecureContext, nullptr);
     keyframe->SetComposite(EffectModel::kCompositeReplace);
@@ -230,7 +231,7 @@
   StringKeyframe* CreateReplaceOpKeyframe(const String& property_name,
                                           const String& value,
                                           double offset = 0) {
-    StringKeyframe* keyframe = StringKeyframe::Create();
+    auto* keyframe = MakeGarbageCollected<StringKeyframe>();
     keyframe->SetCSSPropertyValue(AtomicString(property_name),
                                   GetDocument().GetPropertyRegistry(), value,
                                   GetDocument().GetSecureContextMode(),
@@ -375,7 +376,7 @@
   StringKeyframe* CreateSVGKeyframe(const QualifiedName& name,
                                     const String& value,
                                     double offset) {
-    StringKeyframe* keyframe = StringKeyframe::Create();
+    auto* keyframe = MakeGarbageCollected<StringKeyframe>();
     keyframe->SetSVGAttributeValue(name, value);
     keyframe->SetComposite(EffectModel::kCompositeReplace);
     keyframe->SetOffset(offset);
@@ -406,7 +407,7 @@
       EXPECT_EQ(to->CheckedOffset(), 1.0);
     }
     if (!HasFatalFailure()) {
-      return StringKeyframeEffectModel::Create(frames);
+      return MakeGarbageCollected<StringKeyframeEffectModel>(frames);
     }
     return nullptr;
   }
@@ -561,18 +562,19 @@
   frames_same.push_back(CreateDefaultKeyframe(
       CSSPropertyID::kColor, EffectModel::kCompositeReplace, 1.0));
   EXPECT_TRUE(CanStartEffectOnCompositor(
-                  timing_, *StringKeyframeEffectModel::Create(frames_same)) &
+                  timing_, *MakeGarbageCollected<StringKeyframeEffectModel>(
+                               frames_same)) &
               CompositorAnimations::kUnsupportedCSSProperty);
 
   StringKeyframeVector frames_mixed_properties;
-  StringKeyframe* keyframe = StringKeyframe::Create();
+  auto* keyframe = MakeGarbageCollected<StringKeyframe>();
   keyframe->SetOffset(0);
   keyframe->SetCSSPropertyValue(CSSPropertyID::kColor, "red",
                                 SecureContextMode::kInsecureContext, nullptr);
   keyframe->SetCSSPropertyValue(CSSPropertyID::kOpacity, "0",
                                 SecureContextMode::kInsecureContext, nullptr);
   frames_mixed_properties.push_back(keyframe);
-  keyframe = StringKeyframe::Create();
+  keyframe = MakeGarbageCollected<StringKeyframe>();
   keyframe->SetOffset(1);
   keyframe->SetCSSPropertyValue(CSSPropertyID::kColor, "green",
                                 SecureContextMode::kInsecureContext, nullptr);
@@ -580,8 +582,8 @@
                                 SecureContextMode::kInsecureContext, nullptr);
   frames_mixed_properties.push_back(keyframe);
   EXPECT_TRUE(CanStartEffectOnCompositor(
-                  timing_,
-                  *StringKeyframeEffectModel::Create(frames_mixed_properties)) &
+                  timing_, *MakeGarbageCollected<StringKeyframeEffectModel>(
+                               frames_mixed_properties)) &
               CompositorAnimations::kUnsupportedCSSProperty);
 }
 
@@ -787,11 +789,11 @@
        CanStartEffectOnCompositorNonLinearTimingFunctionOnFirstOrLastFrame) {
   keyframe_vector2_->at(0)->SetEasing(cubic_ease_timing_function_.get());
   keyframe_animation_effect2_ =
-      StringKeyframeEffectModel::Create(*keyframe_vector2_);
+      MakeGarbageCollected<StringKeyframeEffectModel>(*keyframe_vector2_);
 
   keyframe_vector5_->at(3)->SetEasing(cubic_ease_timing_function_.get());
   keyframe_animation_effect5_ =
-      StringKeyframeEffectModel::Create(*keyframe_vector5_);
+      MakeGarbageCollected<StringKeyframeEffectModel>(*keyframe_vector5_);
 
   timing_.timing_function = cubic_ease_timing_function_;
   EXPECT_EQ(CanStartEffectOnCompositor(timing_, *keyframe_animation_effect2_),
@@ -815,14 +817,14 @@
   key_frames.push_back(CreateDefaultKeyframe(
       CSSPropertyID::kOpacity, EffectModel::kCompositeReplace, 1.0));
   KeyframeEffectModelBase* animation_effect =
-      StringKeyframeEffectModel::Create(key_frames);
+      MakeGarbageCollected<StringKeyframeEffectModel>(key_frames);
 
   Timing timing;
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(1);
 
   // The first animation for opacity is ok to run on compositor.
-  KeyframeEffect* keyframe_effect1 =
-      KeyframeEffect::Create(element_, animation_effect, timing);
+  auto* keyframe_effect1 =
+      MakeGarbageCollected<KeyframeEffect>(element_, animation_effect, timing);
   Animation* animation = timeline_->Play(keyframe_effect1);
   auto style = ComputedStyle::Create();
   animation_effect->SnapshotAllCompositorKeyframesIfNecessary(*element_.Get(),
@@ -858,8 +860,8 @@
       CreateReplaceOpKeyframe(target_property1.PropertyID(), "dotted", 0),
       CreateReplaceOpKeyframe(target_property1.PropertyID(), "dashed", 1.0));
 
-  KeyframeEffect* keyframe_effect1 =
-      KeyframeEffect::Create(element_.Get(), effect1, timing_);
+  auto* keyframe_effect1 =
+      MakeGarbageCollected<KeyframeEffect>(element_.Get(), effect1, timing_);
 
   Animation* animation1 = timeline_->Play(keyframe_effect1);
   effect1->SnapshotAllCompositorKeyframesIfNecessary(*element_.Get(), *style,
@@ -881,8 +883,8 @@
       CreateReplaceOpKeyframe(target_property2.PropertyID(), "1", 0),
       CreateReplaceOpKeyframe(target_property2.PropertyID(), "3", 1.0));
 
-  KeyframeEffect* keyframe_effect2 =
-      KeyframeEffect::Create(inline_.Get(), effect2, timing_);
+  auto* keyframe_effect2 =
+      MakeGarbageCollected<KeyframeEffect>(inline_.Get(), effect2, timing_);
 
   Animation* animation2 = timeline_->Play(keyframe_effect2);
   effect2->SnapshotAllCompositorKeyframesIfNecessary(*inline_.Get(), *style,
@@ -907,8 +909,8 @@
       CreateMockReplaceKeyframe(target_property3.PropertyID(), "10px", 0.0),
       CreateMockReplaceKeyframe(target_property3.PropertyID(), "20px", 1.0));
 
-  KeyframeEffect* keyframe_effect3 =
-      KeyframeEffect::Create(element_.Get(), effect3, timing_);
+  auto* keyframe_effect3 =
+      MakeGarbageCollected<KeyframeEffect>(element_.Get(), effect3, timing_);
 
   Animation* animation3 = timeline_->Play(keyframe_effect3);
   effect3->SnapshotAllCompositorKeyframesIfNecessary(*element_.Get(), *style,
@@ -937,8 +939,8 @@
       CreateReplaceOpKeyframe(CSSPropertyID::kFilter, "none", 0),
       CreateReplaceOpKeyframe(CSSPropertyID::kFilter, "sepia(50%)", 1.0));
 
-  KeyframeEffect* keyframe_effect1 =
-      KeyframeEffect::Create(element_.Get(), effect1, timing_);
+  auto* keyframe_effect1 =
+      MakeGarbageCollected<KeyframeEffect>(element_.Get(), effect1, timing_);
 
   Animation* animation1 = timeline_->Play(keyframe_effect1);
   auto style = ComputedStyle::Create();
@@ -955,8 +957,8 @@
       CreateReplaceOpKeyframe(CSSPropertyID::kFilter, "none", 0),
       CreateReplaceOpKeyframe(CSSPropertyID::kFilter, "blur(10px)", 1.0));
 
-  KeyframeEffect* keyframe_effect2 =
-      KeyframeEffect::Create(element_.Get(), effect2, timing_);
+  auto* keyframe_effect2 =
+      MakeGarbageCollected<KeyframeEffect>(element_.Get(), effect2, timing_);
 
   Animation* animation2 = timeline_->Play(keyframe_effect2);
   effect2->SnapshotAllCompositorKeyframesIfNecessary(*element_.Get(), *style,
@@ -979,8 +981,8 @@
       CreateReplaceOpKeyframe(CSSPropertyID::kTransform, "none", 0),
       CreateReplaceOpKeyframe(CSSPropertyID::kTransform, "rotate(45deg)", 1.0));
 
-  KeyframeEffect* keyframe_effect1 =
-      KeyframeEffect::Create(element_.Get(), effect1, timing_);
+  auto* keyframe_effect1 =
+      MakeGarbageCollected<KeyframeEffect>(element_.Get(), effect1, timing_);
 
   Animation* animation1 = timeline_->Play(keyframe_effect1);
   effect1->SnapshotAllCompositorKeyframesIfNecessary(*element_.Get(), *style,
@@ -1000,8 +1002,8 @@
                               1.0),
       CreateReplaceOpKeyframe(CSSPropertyID::kRotate, "45deg", 1.0));
 
-  KeyframeEffect* keyframe_effect2 =
-      KeyframeEffect::Create(element_.Get(), effect2, timing_);
+  auto* keyframe_effect2 =
+      MakeGarbageCollected<KeyframeEffect>(element_.Get(), effect2, timing_);
 
   Animation* animation2 = timeline_->Play(keyframe_effect2);
   effect2->SnapshotAllCompositorKeyframesIfNecessary(*element_.Get(), *style,
@@ -1016,13 +1018,13 @@
        CanStartEffectOnCompositorTimingFunctionChainedCubicMatchingOffsets) {
   keyframe_vector2_->at(0)->SetEasing(cubic_ease_timing_function_.get());
   keyframe_animation_effect2_ =
-      StringKeyframeEffectModel::Create(*keyframe_vector2_);
+      MakeGarbageCollected<StringKeyframeEffectModel>(*keyframe_vector2_);
   EXPECT_EQ(CanStartEffectOnCompositor(timing_, *keyframe_animation_effect2_),
             CompositorAnimations::kNoFailure);
 
   keyframe_vector2_->at(0)->SetEasing(cubic_custom_timing_function_.get());
   keyframe_animation_effect2_ =
-      StringKeyframeEffectModel::Create(*keyframe_vector2_);
+      MakeGarbageCollected<StringKeyframeEffectModel>(*keyframe_vector2_);
   EXPECT_EQ(CanStartEffectOnCompositor(timing_, *keyframe_animation_effect2_),
             CompositorAnimations::kNoFailure);
 
@@ -1031,7 +1033,7 @@
   keyframe_vector5_->at(2)->SetEasing(cubic_custom_timing_function_.get());
   keyframe_vector5_->at(3)->SetEasing(cubic_custom_timing_function_.get());
   keyframe_animation_effect5_ =
-      StringKeyframeEffectModel::Create(*keyframe_vector5_);
+      MakeGarbageCollected<StringKeyframeEffectModel>(*keyframe_vector5_);
   EXPECT_EQ(CanStartEffectOnCompositor(timing_, *keyframe_animation_effect5_),
             CompositorAnimations::kNoFailure);
 }
@@ -1043,7 +1045,7 @@
   keyframe_vector5_->at(2)->SetEasing(cubic_ease_timing_function_.get());
   keyframe_vector5_->at(3)->SetEasing(linear_timing_function_.get());
   keyframe_animation_effect5_ =
-      StringKeyframeEffectModel::Create(*keyframe_vector5_);
+      MakeGarbageCollected<StringKeyframeEffectModel>(*keyframe_vector5_);
   EXPECT_EQ(CanStartEffectOnCompositor(timing_, *keyframe_animation_effect5_),
             CompositorAnimations::kNoFailure);
 }
@@ -1052,7 +1054,7 @@
        CanStartEffectOnCompositorTimingFunctionWithStepOrFrameOkay) {
   keyframe_vector2_->at(0)->SetEasing(step_timing_function_.get());
   keyframe_animation_effect2_ =
-      StringKeyframeEffectModel::Create(*keyframe_vector2_);
+      MakeGarbageCollected<StringKeyframeEffectModel>(*keyframe_vector2_);
   EXPECT_EQ(CanStartEffectOnCompositor(timing_, *keyframe_animation_effect2_),
             CompositorAnimations::kNoFailure);
 
@@ -1060,7 +1062,7 @@
   keyframe_vector5_->at(1)->SetEasing(linear_timing_function_.get());
   keyframe_vector5_->at(2)->SetEasing(cubic_ease_timing_function_.get());
   keyframe_animation_effect5_ =
-      StringKeyframeEffectModel::Create(*keyframe_vector5_);
+      MakeGarbageCollected<StringKeyframeEffectModel>(*keyframe_vector5_);
   EXPECT_EQ(CanStartEffectOnCompositor(timing_, *keyframe_animation_effect5_),
             CompositorAnimations::kNoFailure);
 
@@ -1068,7 +1070,7 @@
   keyframe_vector5_->at(2)->SetEasing(cubic_ease_timing_function_.get());
   keyframe_vector5_->at(3)->SetEasing(linear_timing_function_.get());
   keyframe_animation_effect5_ =
-      StringKeyframeEffectModel::Create(*keyframe_vector5_);
+      MakeGarbageCollected<StringKeyframeEffectModel>(*keyframe_vector5_);
   EXPECT_EQ(CanStartEffectOnCompositor(timing_, *keyframe_animation_effect5_),
             CompositorAnimations::kNoFailure);
 
@@ -1076,7 +1078,7 @@
   keyframe_vector5_->at(2)->SetEasing(cubic_ease_timing_function_.get());
   keyframe_vector5_->at(3)->SetEasing(step_timing_function_.get());
   keyframe_animation_effect5_ =
-      StringKeyframeEffectModel::Create(*keyframe_vector5_);
+      MakeGarbageCollected<StringKeyframeEffectModel>(*keyframe_vector5_);
   EXPECT_EQ(CanStartEffectOnCompositor(timing_, *keyframe_animation_effect5_),
             CompositorAnimations::kNoFailure);
 }
@@ -1097,22 +1099,23 @@
       CSSPropertyID::kOpacity, EffectModel::kCompositeReplace, 1.0));
 
   basic_frames_vector[0]->SetEasing(linear_timing_function_.get());
-  StringKeyframeEffectModel* basic_frames =
-      StringKeyframeEffectModel::Create(basic_frames_vector);
+  auto* basic_frames =
+      MakeGarbageCollected<StringKeyframeEffectModel>(basic_frames_vector);
   EXPECT_EQ(CanStartEffectOnCompositor(timing_, *basic_frames),
             CompositorAnimations::kNoFailure);
 
   basic_frames_vector[0]->SetEasing(CubicBezierTimingFunction::Preset(
       CubicBezierTimingFunction::EaseType::EASE_IN));
-  basic_frames = StringKeyframeEffectModel::Create(basic_frames_vector);
+  basic_frames =
+      MakeGarbageCollected<StringKeyframeEffectModel>(basic_frames_vector);
   EXPECT_EQ(CanStartEffectOnCompositor(timing_, *basic_frames),
             CompositorAnimations::kNoFailure);
 
   non_basic_frames_vector[0]->SetEasing(linear_timing_function_.get());
   non_basic_frames_vector[1]->SetEasing(CubicBezierTimingFunction::Preset(
       CubicBezierTimingFunction::EaseType::EASE_IN));
-  StringKeyframeEffectModel* non_basic_frames =
-      StringKeyframeEffectModel::Create(non_basic_frames_vector);
+  auto* non_basic_frames =
+      MakeGarbageCollected<StringKeyframeEffectModel>(non_basic_frames_vector);
   EXPECT_EQ(CanStartEffectOnCompositor(timing_, *non_basic_frames),
             CompositorAnimations::kNoFailure);
 
@@ -1121,8 +1124,8 @@
       CSSPropertyID::kOpacity, EffectModel::kCompositeAdd, 0.1));
   non_allowed_frames_vector.push_back(CreateDefaultKeyframe(
       CSSPropertyID::kOpacity, EffectModel::kCompositeAdd, 0.25));
-  StringKeyframeEffectModel* non_allowed_frames =
-      StringKeyframeEffectModel::Create(non_allowed_frames_vector);
+  auto* non_allowed_frames = MakeGarbageCollected<StringKeyframeEffectModel>(
+      non_allowed_frames_vector);
   EXPECT_TRUE(CanStartEffectOnCompositor(timing_, *non_allowed_frames) &
               CompositorAnimations::kEffectHasNonReplaceCompositeMode);
 
@@ -1133,8 +1136,8 @@
   StringKeyframeVector non_css_frames_vector;
   non_css_frames_vector.push_back(CreateSVGKeyframe(fake_name, "cargo", 0.0));
   non_css_frames_vector.push_back(CreateSVGKeyframe(fake_name, "cargo", 1.0));
-  StringKeyframeEffectModel* non_css_frames =
-      StringKeyframeEffectModel::Create(non_css_frames_vector);
+  auto* non_css_frames =
+      MakeGarbageCollected<StringKeyframeEffectModel>(non_css_frames_vector);
   EXPECT_TRUE(CanStartEffectOnCompositor(timing_, *non_css_frames) &
               CompositorAnimations::kAnimationAffectsNonCSSProperties);
   // NB: Important that non_css_frames_vector goes away and cleans up
@@ -1297,7 +1300,7 @@
   frames[0]->SetEasing(cubic_ease_timing_function_.get());
   frames[1]->SetEasing(linear_timing_function_.get());
   frames[2]->SetEasing(cubic_custom_timing_function_.get());
-  StringKeyframeEffectModel* effect = StringKeyframeEffectModel::Create(frames);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(frames);
 
   timing_.timing_function = linear_timing_function_.get();
   timing_.iteration_duration = AnimationTimeDelta::FromSecondsD(2);
@@ -1362,7 +1365,7 @@
       CubicBezierTimingFunction::EaseType::EASE_IN));
   frames[1]->SetEasing(linear_timing_function_.get());
   frames[2]->SetEasing(cubic_easy_flip_timing_function.get());
-  StringKeyframeEffectModel* effect = StringKeyframeEffectModel::Create(frames);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(frames);
 
   timing_.timing_function = linear_timing_function_.get();
   timing_.iteration_count = 10;
@@ -1564,16 +1567,16 @@
   key_frames->push_back(CreateDefaultKeyframe(
       CSSPropertyID::kOpacity, EffectModel::kCompositeReplace, 1.0));
   KeyframeEffectModelBase* animation_effect1 =
-      StringKeyframeEffectModel::Create(*key_frames);
+      MakeGarbageCollected<StringKeyframeEffectModel>(*key_frames);
   KeyframeEffectModelBase* animation_effect2 =
-      StringKeyframeEffectModel::Create(*key_frames);
+      MakeGarbageCollected<StringKeyframeEffectModel>(*key_frames);
 
   Timing timing;
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(1);
 
   // The first animation for opacity is ok to run on compositor.
-  KeyframeEffect* keyframe_effect1 =
-      KeyframeEffect::Create(element_.Get(), animation_effect1, timing);
+  auto* keyframe_effect1 = MakeGarbageCollected<KeyframeEffect>(
+      element_.Get(), animation_effect1, timing);
   Animation* animation1 = timeline_->Play(keyframe_effect1);
   auto style = ComputedStyle::Create();
   animation_effect1->SnapshotAllCompositorKeyframesIfNecessary(*element_.Get(),
@@ -1583,8 +1586,8 @@
             CompositorAnimations::kNoFailure);
 
   // The second animation for opacity is not ok to run on compositor.
-  KeyframeEffect* keyframe_effect2 =
-      KeyframeEffect::Create(element_.Get(), animation_effect2, timing);
+  auto* keyframe_effect2 = MakeGarbageCollected<KeyframeEffect>(
+      element_.Get(), animation_effect2, timing);
   Animation* animation2 = timeline_->Play(keyframe_effect2);
   animation_effect2->SnapshotAllCompositorKeyframesIfNecessary(*element_.Get(),
                                                                *style, nullptr);
diff --git a/third_party/blink/renderer/core/animation/css/css_animations.cc b/third_party/blink/renderer/core/animation/css/css_animations.cc
index 15a7ac9..2f5cfc03 100644
--- a/third_party/blink/renderer/core/animation/css/css_animations.cc
+++ b/third_party/blink/renderer/core/animation/css/css_animations.cc
@@ -32,6 +32,7 @@
 
 #include <algorithm>
 #include <bitset>
+
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/renderer/core/animation/animation.h"
 #include "third_party/blink/renderer/core/animation/compositor_animations.h"
@@ -69,6 +70,7 @@
 #include "third_party/blink/renderer/core/paint/paint_layer.h"
 #include "third_party/blink/renderer/core/style_property_shorthand.h"
 #include "third_party/blink/renderer/platform/animation/timing_function.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/histogram.h"
 #include "third_party/blink/renderer/platform/wtf/hash_set.h"
 
@@ -102,7 +104,7 @@
   PropertySet specified_properties_for_use_counter;
   for (wtf_size_t i = 0; i < style_keyframes.size(); ++i) {
     const StyleRuleKeyframe* style_keyframe = style_keyframes[i].Get();
-    StringKeyframe* keyframe = StringKeyframe::Create();
+    auto* keyframe = MakeGarbageCollected<StringKeyframe>();
     const Vector<double>& offsets = style_keyframe->Keys();
     DCHECK(!offsets.IsEmpty());
     keyframe->SetOffset(offsets[0]);
@@ -168,14 +170,14 @@
   // Add 0% and 100% keyframes if absent.
   StringKeyframe* start_keyframe = keyframes.IsEmpty() ? nullptr : keyframes[0];
   if (!start_keyframe || keyframes[0]->CheckedOffset() != 0) {
-    start_keyframe = StringKeyframe::Create();
+    start_keyframe = MakeGarbageCollected<StringKeyframe>();
     start_keyframe->SetOffset(0);
     start_keyframe->SetEasing(default_timing_function);
     keyframes.push_front(start_keyframe);
   }
   StringKeyframe* end_keyframe = keyframes[keyframes.size() - 1];
   if (end_keyframe->CheckedOffset() != 1) {
-    end_keyframe = StringKeyframe::Create();
+    end_keyframe = MakeGarbageCollected<StringKeyframe>();
     end_keyframe->SetOffset(1);
     end_keyframe->SetEasing(default_timing_function);
     keyframes.push_back(end_keyframe);
@@ -184,7 +186,7 @@
   DCHECK_EQ(keyframes.front()->CheckedOffset(), 0);
   DCHECK_EQ(keyframes.back()->CheckedOffset(), 1);
 
-  StringKeyframeEffectModel* model = StringKeyframeEffectModel::Create(
+  auto* model = MakeGarbageCollected<StringKeyframeEffectModel>(
       keyframes, EffectModel::kCompositeReplace, &keyframes[0]->Easing());
   if (animation_index > 0 && model->HasSyntheticKeyframes()) {
     UseCounter::Count(element_for_scoping->GetDocument(),
@@ -199,7 +201,7 @@
     Animation* animation,
     double inherited_time) {
   KeyframeEffect* effect = ToKeyframeEffect(animation->effect());
-  InertEffect* inert_animation_for_sampling = InertEffect::Create(
+  auto* inert_animation_for_sampling = MakeGarbageCollected<InertEffect>(
       effect->Model(), effect->SpecifiedTiming(), false, inherited_time);
   HeapVector<Member<Interpolation>> sample;
   inert_animation_for_sampling->Sample(sample);
@@ -275,8 +277,10 @@
     return;
 
   const ComputedStyle* old_style = animating_element->GetComputedStyle();
-  if (!old_style || !old_style->ShouldCompositeForCurrentAnimations())
+  if (!old_style || old_style->IsEnsuredInDisplayNone() ||
+      !old_style->ShouldCompositeForCurrentAnimations()) {
     return;
+  }
 
   bool transform_zoom_changed =
       old_style->HasCurrentTransformAnimation() &&
@@ -413,7 +417,7 @@
           DCHECK(!is_animation_style_change);
           update.UpdateAnimation(
               existing_animation_index, animation,
-              *InertEffect::Create(
+              *MakeGarbageCollected<InertEffect>(
                   CreateKeyframeEffectModel(resolver, animating_element,
                                             element, &style, parent_style, name,
                                             keyframe_timing_function.get(), i),
@@ -427,7 +431,7 @@
         DCHECK(!is_animation_style_change);
         update.StartAnimation(
             name, name_index,
-            *InertEffect::Create(
+            *MakeGarbageCollected<InertEffect>(
                 CreateKeyframeEffectModel(resolver, animating_element, element,
                                           &style, parent_style, name,
                                           keyframe_timing_function.get(), i),
@@ -536,7 +540,7 @@
     const InertEffect* inert_animation = entry.effect.Get();
     AnimationEventDelegate* event_delegate =
         MakeGarbageCollected<AnimationEventDelegate>(element, entry.name);
-    KeyframeEffect* effect = KeyframeEffect::Create(
+    auto* effect = MakeGarbageCollected<KeyframeEffect>(
         element, inert_animation->Model(), inert_animation->SpecifiedTiming(),
         KeyframeEffect::kDefaultPriority, event_delegate);
     Animation* animation = element->GetDocument().Timeline().Play(effect);
@@ -604,7 +608,7 @@
 
     KeyframeEffectModelBase* model = inert_animation->Model();
 
-    KeyframeEffect* transition = KeyframeEffect::Create(
+    auto* transition = MakeGarbageCollected<KeyframeEffect>(
         element, model, inert_animation->SpecifiedTiming(),
         KeyframeEffect::kTransitionPriority, event_delegate);
     Animation* animation = element->GetDocument().Timeline().Play(transition);
@@ -817,15 +821,14 @@
     end_keyframe->SetCompositorValue(to);
   }
 
-  TransitionKeyframeEffectModel* model =
-      TransitionKeyframeEffectModel::Create(keyframes);
+  auto* model = MakeGarbageCollected<TransitionKeyframeEffectModel>(keyframes);
   if (!state.cloned_style) {
     state.cloned_style = ComputedStyle::Clone(state.style);
   }
-  state.update.StartTransition(property, &state.old_style, state.cloned_style,
-                               reversing_adjusted_start_value,
-                               reversing_shortening_factor,
-                               *InertEffect::Create(model, timing, false, 0));
+  state.update.StartTransition(
+      property, &state.old_style, state.cloned_style,
+      reversing_adjusted_start_value, reversing_shortening_factor,
+      *MakeGarbageCollected<InertEffect>(model, timing, false, 0));
   DCHECK(!state.animating_element->GetElementAnimations() ||
          !state.animating_element->GetElementAnimations()
               ->IsAnimationStyleChange());
@@ -910,7 +913,7 @@
   bool any_transition_had_transition_all = false;
   const ComputedStyle* old_style = animating_element->GetComputedStyle();
   if (!animation_style_recalc && style.Display() != EDisplay::kNone &&
-      old_style && transition_data) {
+      old_style && !old_style->IsEnsuredInDisplayNone() && transition_data) {
     TransitionUpdateState state = {
         update,  animating_element,  *old_style,        style,
         nullptr, active_transitions, listed_properties, *transition_data};
diff --git a/third_party/blink/renderer/core/animation/document_timeline_test.cc b/third_party/blink/renderer/core/animation/document_timeline_test.cc
index 1cbe452..fcd145c 100644
--- a/third_party/blink/renderer/core/animation/document_timeline_test.cc
+++ b/third_party/blink/renderer/core/animation/document_timeline_test.cc
@@ -30,7 +30,6 @@
 
 #include "third_party/blink/renderer/core/animation/document_timeline.h"
 
-#include <memory>
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/renderer/core/animation/animation_clock.h"
@@ -42,6 +41,7 @@
 #include "third_party/blink/renderer/core/dom/element.h"
 #include "third_party/blink/renderer/core/dom/qualified_name.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/weborigin/kurl.h"
 
 namespace {
@@ -91,7 +91,8 @@
   }
 
   KeyframeEffectModelBase* CreateEmptyEffectModel() {
-    return StringKeyframeEffectModel::Create(StringKeyframeVector());
+    return MakeGarbageCollected<StringKeyframeEffectModel>(
+        StringKeyframeVector());
   }
 
   Persistent<Document> document;
@@ -106,10 +107,10 @@
 };
 
 TEST_F(AnimationDocumentTimelineTest, EmptyKeyframeAnimation) {
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(StringKeyframeVector());
-  KeyframeEffect* keyframe_effect =
-      KeyframeEffect::Create(element.Get(), effect, timing);
+  auto* effect =
+      MakeGarbageCollected<StringKeyframeEffectModel>(StringKeyframeVector());
+  auto* keyframe_effect =
+      MakeGarbageCollected<KeyframeEffect>(element.Get(), effect, timing);
 
   timeline->Play(keyframe_effect);
 
@@ -122,11 +123,11 @@
 }
 
 TEST_F(AnimationDocumentTimelineTest, EmptyForwardsKeyframeAnimation) {
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(StringKeyframeVector());
+  auto* effect =
+      MakeGarbageCollected<StringKeyframeEffectModel>(StringKeyframeVector());
   timing.fill_mode = Timing::FillMode::FORWARDS;
-  KeyframeEffect* keyframe_effect =
-      KeyframeEffect::Create(element.Get(), effect, timing);
+  auto* keyframe_effect =
+      MakeGarbageCollected<KeyframeEffect>(element.Get(), effect, timing);
 
   timeline->Play(keyframe_effect);
 
@@ -377,10 +378,10 @@
 TEST_F(AnimationDocumentTimelineTest, PauseForTesting) {
   float seek_time = 1;
   timing.fill_mode = Timing::FillMode::FORWARDS;
-  KeyframeEffect* anim1 =
-      KeyframeEffect::Create(element.Get(), CreateEmptyEffectModel(), timing);
-  KeyframeEffect* anim2 =
-      KeyframeEffect::Create(element.Get(), CreateEmptyEffectModel(), timing);
+  auto* anim1 = MakeGarbageCollected<KeyframeEffect>(
+      element.Get(), CreateEmptyEffectModel(), timing);
+  auto* anim2 = MakeGarbageCollected<KeyframeEffect>(
+      element.Get(), CreateEmptyEffectModel(), timing);
   Animation* animation1 = timeline->Play(anim1);
   Animation* animation2 = timeline->Play(anim2);
   timeline->PauseAnimationsForTesting(seek_time);
@@ -393,8 +394,8 @@
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(2);
   timing.start_delay = 5;
 
-  KeyframeEffect* keyframe_effect =
-      KeyframeEffect::Create(element.Get(), CreateEmptyEffectModel(), timing);
+  auto* keyframe_effect = MakeGarbageCollected<KeyframeEffect>(
+      element.Get(), CreateEmptyEffectModel(), timing);
 
   timeline->Play(keyframe_effect);
 
@@ -428,8 +429,8 @@
   timeline = &document->Timeline();
   document = nullptr;
 
-  KeyframeEffect* keyframe_effect =
-      KeyframeEffect::Create(nullptr, CreateEmptyEffectModel(), timing);
+  auto* keyframe_effect = MakeGarbageCollected<KeyframeEffect>(
+      nullptr, CreateEmptyEffectModel(), timing);
   // Test passes if this does not crash.
   timeline->Play(keyframe_effect);
 }
diff --git a/third_party/blink/renderer/core/animation/effect_input.cc b/third_party/blink/renderer/core/animation/effect_input.cc
index 4e15e0f..6e79380 100644
--- a/third_party/blink/renderer/core/animation/effect_input.cc
+++ b/third_party/blink/renderer/core/animation/effect_input.cc
@@ -51,6 +51,7 @@
 #include "third_party/blink/renderer/core/frame/frame_console.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/inspector/console_message.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/wtf/hash_set.h"
 #include "third_party/blink/renderer/platform/wtf/text/ascii_ctype.h"
 #include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
@@ -345,7 +346,7 @@
     // offset and composite values; conceptually these were actually added in
     // step 5 above but we didn't have a keyframe object then.
     const BaseKeyframe* base_keyframe = processed_base_keyframes[i];
-    StringKeyframe* keyframe = StringKeyframe::Create();
+    auto* keyframe = MakeGarbageCollected<StringKeyframe>();
     if (base_keyframe->hasOffset()) {
       keyframe->SetOffset(base_keyframe->offset());
     }
@@ -518,7 +519,7 @@
 
       auto result = keyframes.insert(computed_offset, nullptr);
       if (result.is_new_entry)
-        result.stored_value->value = StringKeyframe::Create();
+        result.stored_value->value = MakeGarbageCollected<StringKeyframe>();
 
       SetKeyframeValue(element, document, *result.stored_value->value, property,
                        values[i], execution_context);
@@ -662,9 +663,8 @@
 
   composite = ResolveCompositeOperation(composite, parsed_keyframes);
 
-  StringKeyframeEffectModel* keyframe_effect_model =
-      StringKeyframeEffectModel::Create(parsed_keyframes, composite,
-                                        LinearTimingFunction::Shared());
+  auto* keyframe_effect_model = MakeGarbageCollected<StringKeyframeEffectModel>(
+      parsed_keyframes, composite, LinearTimingFunction::Shared());
 
   if (!RuntimeEnabledFeatures::CSSAdditiveAnimationsEnabled()) {
     // This should be enforced by the parsing code.
diff --git a/third_party/blink/renderer/core/animation/effect_stack_test.cc b/third_party/blink/renderer/core/animation/effect_stack_test.cc
index 83731772..f662694 100644
--- a/third_party/blink/renderer/core/animation/effect_stack_test.cc
+++ b/third_party/blink/renderer/core/animation/effect_stack_test.cc
@@ -15,6 +15,7 @@
 #include "third_party/blink/renderer/core/animation/pending_animations.h"
 #include "third_party/blink/renderer/core/animation/string_keyframe.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -49,21 +50,21 @@
   KeyframeEffectModelBase* MakeEffectModel(CSSPropertyID id,
                                            const String& value) {
     StringKeyframeVector keyframes(2);
-    keyframes[0] = StringKeyframe::Create();
+    keyframes[0] = MakeGarbageCollected<StringKeyframe>();
     keyframes[0]->SetOffset(0.0);
     keyframes[0]->SetCSSPropertyValue(
         id, value, SecureContextMode::kInsecureContext, nullptr);
-    keyframes[1] = StringKeyframe::Create();
+    keyframes[1] = MakeGarbageCollected<StringKeyframe>();
     keyframes[1]->SetOffset(1.0);
     keyframes[1]->SetCSSPropertyValue(
         id, value, SecureContextMode::kInsecureContext, nullptr);
-    return StringKeyframeEffectModel::Create(keyframes);
+    return MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   }
 
   InertEffect* MakeInertEffect(KeyframeEffectModelBase* effect) {
     Timing timing;
     timing.fill_mode = Timing::FillMode::BOTH;
-    return InertEffect::Create(effect, timing, false, 0);
+    return MakeGarbageCollected<InertEffect>(effect, timing, false, 0);
   }
 
   KeyframeEffect* MakeKeyframeEffect(KeyframeEffectModelBase* effect,
@@ -71,7 +72,7 @@
     Timing timing;
     timing.fill_mode = Timing::FillMode::BOTH;
     timing.iteration_duration = AnimationTimeDelta::FromSecondsD(duration);
-    return KeyframeEffect::Create(element.Get(), effect, timing);
+    return MakeGarbageCollected<KeyframeEffect>(element.Get(), effect, timing);
   }
 
   double GetFontSizeValue(
diff --git a/third_party/blink/renderer/core/animation/element_animation.cc b/third_party/blink/renderer/core/animation/element_animation.cc
index cc83c606..bbc894a 100644
--- a/third_party/blink/renderer/core/animation/element_animation.cc
+++ b/third_party/blink/renderer/core/animation/element_animation.cc
@@ -17,6 +17,7 @@
 #include "third_party/blink/renderer/core/feature_policy/layout_animations_policy.h"
 #include "third_party/blink/renderer/platform/bindings/exception_state.h"
 #include "third_party/blink/renderer/platform/bindings/script_state.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 namespace {
@@ -103,8 +104,8 @@
                                              KeyframeEffectModelBase* effect,
                                              const Timing& timing) {
   ReportFeaturePolicyViolationsIfNecessary(element.GetDocument(), *effect);
-  KeyframeEffect* keyframe_effect =
-      KeyframeEffect::Create(&element, effect, timing);
+  auto* keyframe_effect =
+      MakeGarbageCollected<KeyframeEffect>(&element, effect, timing);
   return element.GetDocument().Timeline().Play(keyframe_effect);
 }
 
diff --git a/third_party/blink/renderer/core/animation/inert_effect.cc b/third_party/blink/renderer/core/animation/inert_effect.cc
index d8d601b..939c679 100644
--- a/third_party/blink/renderer/core/animation/inert_effect.cc
+++ b/third_party/blink/renderer/core/animation/inert_effect.cc
@@ -34,14 +34,6 @@
 
 namespace blink {
 
-InertEffect* InertEffect::Create(KeyframeEffectModelBase* effect,
-                                 const Timing& timing,
-                                 bool paused,
-                                 double inherited_time) {
-  return MakeGarbageCollected<InertEffect>(effect, timing, paused,
-                                           inherited_time);
-}
-
 InertEffect::InertEffect(KeyframeEffectModelBase* model,
                          const Timing& timing,
                          bool paused,
diff --git a/third_party/blink/renderer/core/animation/inert_effect.h b/third_party/blink/renderer/core/animation/inert_effect.h
index b622198..c3d1526 100644
--- a/third_party/blink/renderer/core/animation/inert_effect.h
+++ b/third_party/blink/renderer/core/animation/inert_effect.h
@@ -42,11 +42,6 @@
 // Interpolation sampling.
 class CORE_EXPORT InertEffect final : public AnimationEffect {
  public:
-  static InertEffect* Create(KeyframeEffectModelBase*,
-                             const Timing&,
-                             bool paused,
-                             double inherited_time);
-
   InertEffect(KeyframeEffectModelBase*,
               const Timing&,
               bool paused,
diff --git a/third_party/blink/renderer/core/animation/invalidatable_interpolation.h b/third_party/blink/renderer/core/animation/invalidatable_interpolation.h
index 5c602516..d644929 100644
--- a/third_party/blink/renderer/core/animation/invalidatable_interpolation.h
+++ b/third_party/blink/renderer/core/animation/invalidatable_interpolation.h
@@ -31,14 +31,6 @@
 // objects.
 class CORE_EXPORT InvalidatableInterpolation : public Interpolation {
  public:
-  static InvalidatableInterpolation* Create(
-      const PropertyHandle& property,
-      PropertySpecificKeyframe* start_keyframe,
-      PropertySpecificKeyframe* end_keyframe) {
-    return MakeGarbageCollected<InvalidatableInterpolation>(
-        property, start_keyframe, end_keyframe);
-  }
-
   InvalidatableInterpolation(const PropertyHandle& property,
                              PropertySpecificKeyframe* start_keyframe,
                              PropertySpecificKeyframe* end_keyframe)
diff --git a/third_party/blink/renderer/core/animation/keyframe.cc b/third_party/blink/renderer/core/animation/keyframe.cc
index eceb25e..a6b48a5 100644
--- a/third_party/blink/renderer/core/animation/keyframe.cc
+++ b/third_party/blink/renderer/core/animation/keyframe.cc
@@ -7,6 +7,7 @@
 #include "third_party/blink/renderer/bindings/core/v8/v8_object_builder.h"
 #include "third_party/blink/renderer/core/animation/effect_model.h"
 #include "third_party/blink/renderer/core/animation/invalidatable_interpolation.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -24,7 +25,7 @@
     const PropertyHandle& property_handle,
     const Keyframe::PropertySpecificKeyframe& end) const {
   // const_cast to take refs.
-  return InvalidatableInterpolation::Create(
+  return MakeGarbageCollected<InvalidatableInterpolation>(
       property_handle, const_cast<PropertySpecificKeyframe*>(this),
       const_cast<PropertySpecificKeyframe*>(&end));
 }
diff --git a/third_party/blink/renderer/core/animation/keyframe_effect.cc b/third_party/blink/renderer/core/animation/keyframe_effect.cc
index 82c868c..da241c6 100644
--- a/third_party/blink/renderer/core/animation/keyframe_effect.cc
+++ b/third_party/blink/renderer/core/animation/keyframe_effect.cc
@@ -44,19 +44,11 @@
 #include "third_party/blink/renderer/core/style/computed_style.h"
 #include "third_party/blink/renderer/core/svg/svg_element.h"
 #include "third_party/blink/renderer/platform/bindings/exception_state.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 
 namespace blink {
 
-KeyframeEffect* KeyframeEffect::Create(Element* target,
-                                       KeyframeEffectModelBase* model,
-                                       const Timing& timing,
-                                       Priority priority,
-                                       EventDelegate* event_delegate) {
-  return MakeGarbageCollected<KeyframeEffect>(target, model, timing, priority,
-                                              event_delegate);
-}
-
 KeyframeEffect* KeyframeEffect::Create(
     ScriptState* script_state,
     Element* element,
@@ -84,7 +76,7 @@
       element, keyframes, composite, script_state, exception_state);
   if (exception_state.HadException())
     return nullptr;
-  return Create(element, model, timing);
+  return MakeGarbageCollected<KeyframeEffect>(element, model, timing);
 }
 
 KeyframeEffect* KeyframeEffect::Create(ScriptState* script_state,
@@ -101,7 +93,7 @@
                            script_state, exception_state);
   if (exception_state.HadException())
     return nullptr;
-  return Create(element, model, Timing());
+  return MakeGarbageCollected<KeyframeEffect>(element, model, Timing());
 }
 
 KeyframeEffect* KeyframeEffect::Create(ScriptState* script_state,
diff --git a/third_party/blink/renderer/core/animation/keyframe_effect.h b/third_party/blink/renderer/core/animation/keyframe_effect.h
index e04533b..5c5c7e6 100644
--- a/third_party/blink/renderer/core/animation/keyframe_effect.h
+++ b/third_party/blink/renderer/core/animation/keyframe_effect.h
@@ -54,11 +54,6 @@
  public:
   enum Priority { kDefaultPriority, kTransitionPriority };
 
-  static KeyframeEffect* Create(Element*,
-                                KeyframeEffectModelBase*,
-                                const Timing&,
-                                Priority = kDefaultPriority,
-                                EventDelegate* = nullptr);
   // Web Animations API Bindings constructors.
   static KeyframeEffect* Create(
       ScriptState*,
@@ -75,8 +70,8 @@
   KeyframeEffect(Element*,
                  KeyframeEffectModelBase*,
                  const Timing&,
-                 Priority,
-                 EventDelegate*);
+                 Priority = kDefaultPriority,
+                 EventDelegate* = nullptr);
   ~KeyframeEffect() override;
 
   bool IsKeyframeEffect() const override { return true; }
diff --git a/third_party/blink/renderer/core/animation/keyframe_effect_model.h b/third_party/blink/renderer/core/animation/keyframe_effect_model.h
index 1d02dbd..970d670 100644
--- a/third_party/blink/renderer/core/animation/keyframe_effect_model.h
+++ b/third_party/blink/renderer/core/animation/keyframe_effect_model.h
@@ -42,6 +42,7 @@
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/platform/animation/timing_function.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/wtf/hash_map.h"
 #include "third_party/blink/renderer/platform/wtf/hash_set.h"
 #include "third_party/blink/renderer/platform/wtf/vector.h"
@@ -209,17 +210,10 @@
 class KeyframeEffectModel final : public KeyframeEffectModelBase {
  public:
   using KeyframeVector = HeapVector<Member<K>>;
-  static KeyframeEffectModel<K>* Create(
+  KeyframeEffectModel(
       const KeyframeVector& keyframes,
       CompositeOperation composite = kCompositeReplace,
-      scoped_refptr<TimingFunction> default_keyframe_easing = nullptr) {
-    return MakeGarbageCollected<KeyframeEffectModel<K>>(
-        keyframes, composite, std::move(default_keyframe_easing));
-  }
-
-  KeyframeEffectModel(const KeyframeVector& keyframes,
-                      CompositeOperation composite,
-                      scoped_refptr<TimingFunction> default_keyframe_easing)
+      scoped_refptr<TimingFunction> default_keyframe_easing = nullptr)
       : KeyframeEffectModelBase(composite, std::move(default_keyframe_easing)) {
     keyframes_.AppendVector(keyframes);
   }
@@ -230,7 +224,8 @@
       Keyframe* new_keyframe = keyframe->Clone();
       keyframes.push_back(static_cast<K*>(new_keyframe));
     }
-    return Create(keyframes, composite_, default_keyframe_easing_);
+    return MakeGarbageCollected<KeyframeEffectModel<K>>(
+        keyframes, composite_, default_keyframe_easing_);
   }
 
  private:
diff --git a/third_party/blink/renderer/core/animation/keyframe_effect_model_test.cc b/third_party/blink/renderer/core/animation/keyframe_effect_model_test.cc
index 8ccdb6d..832f4f3 100644
--- a/third_party/blink/renderer/core/animation/keyframe_effect_model_test.cc
+++ b/third_party/blink/renderer/core/animation/keyframe_effect_model_test.cc
@@ -43,6 +43,7 @@
 #include "third_party/blink/renderer/core/dom/element.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/testing/runtime_enabled_features_test_helpers.h"
 
 namespace blink {
@@ -98,11 +99,11 @@
                                            const String& zero_value,
                                            const String& one_value) {
   StringKeyframeVector keyframes(2);
-  keyframes[0] = StringKeyframe::Create();
+  keyframes[0] = MakeGarbageCollected<StringKeyframe>();
   keyframes[0]->SetOffset(0.0);
   keyframes[0]->SetCSSPropertyValue(
       property, zero_value, SecureContextMode::kInsecureContext, nullptr);
-  keyframes[1] = StringKeyframe::Create();
+  keyframes[1] = MakeGarbageCollected<StringKeyframe>();
   keyframes[1]->SetOffset(1.0);
   keyframes[1]->SetCSSPropertyValue(
       property, one_value, SecureContextMode::kInsecureContext, nullptr);
@@ -115,12 +116,12 @@
     const String& zero_value,
     const String& one_value) {
   StringKeyframeVector keyframes(2);
-  keyframes[0] = StringKeyframe::Create();
+  keyframes[0] = MakeGarbageCollected<StringKeyframe>();
   keyframes[0]->SetOffset(0.0);
   keyframes[0]->SetCSSPropertyValue(
       property_name, property_registry, zero_value,
       SecureContextMode::kInsecureContext, nullptr);
-  keyframes[1] = StringKeyframe::Create();
+  keyframes[1] = MakeGarbageCollected<StringKeyframe>();
   keyframes[1]->SetOffset(1.0);
   keyframes[1]->SetCSSPropertyValue(property_name, property_registry, one_value,
                                     SecureContextMode::kInsecureContext,
@@ -152,8 +153,7 @@
 TEST_F(AnimationKeyframeEffectModel, BasicOperation) {
   StringKeyframeVector keyframes =
       KeyframesAtZeroAndOne(CSSPropertyID::kFontFamily, "serif", "cursive");
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   HeapVector<Member<Interpolation>> values;
   effect->Sample(0, 0.6, kDuration, values);
   ASSERT_EQ(1UL, values.size());
@@ -166,8 +166,7 @@
       KeyframesAtZeroAndOne(CSSPropertyID::kFontFamily, "serif", "cursive");
   keyframes[0]->SetComposite(EffectModel::kCompositeReplace);
   keyframes[1]->SetComposite(EffectModel::kCompositeReplace);
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   HeapVector<Member<Interpolation>> values;
   effect->Sample(0, 0.6, kDuration, values);
   ExpectNonInterpolableValue("cursive", values.at(0));
@@ -178,8 +177,7 @@
       KeyframesAtZeroAndOne(CSSPropertyID::kLeft, "3px", "5px");
   keyframes[0]->SetComposite(EffectModel::kCompositeReplace);
   keyframes[1]->SetComposite(EffectModel::kCompositeReplace);
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   HeapVector<Member<Interpolation>> values;
   effect->Sample(0, 0.6, kDuration, values);
   ExpectLengthValue(3.0 * 0.4 + 5.0 * 0.6, values.at(0));
@@ -191,8 +189,7 @@
       KeyframesAtZeroAndOne(CSSPropertyID::kLeft, "3px", "5px");
   keyframes[0]->SetComposite(EffectModel::kCompositeAdd);
   keyframes[1]->SetComposite(EffectModel::kCompositeAdd);
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   HeapVector<Member<Interpolation>> values;
   effect->Sample(0, 0.6, kDuration, values);
   ExpectLengthValue((7.0 + 3.0) * 0.4 + (7.0 + 5.0) * 0.6, values.at(0));
@@ -205,8 +202,7 @@
   keyframes[0]->SetEasing(CubicBezierTimingFunction::Preset(
       CubicBezierTimingFunction::EaseType::EASE_IN));
   keyframes[1]->SetComposite(EffectModel::kCompositeReplace);
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   HeapVector<Member<Interpolation>> values;
   effect->Sample(0, 0.6, kDuration, values);
   ExpectLengthValue(3.8579516, values.at(0));
@@ -220,8 +216,7 @@
   keyframes[0]->SetComposite(EffectModel::kCompositeReplace);
   keyframes[0]->SetEasing(CubicBezierTimingFunction::Create(0.42, 0, 0.58, 1));
   keyframes[1]->SetComposite(EffectModel::kCompositeReplace);
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   HeapVector<Member<Interpolation>> values;
   effect->Sample(0, 0.6, kDuration, values);
   ExpectLengthValue(4.3363357, values.at(0));
@@ -234,8 +229,7 @@
       KeyframesAtZeroAndOne(CSSPropertyID::kFontFamily, "serif", "cursive");
   keyframes[0]->SetComposite(EffectModel::kCompositeReplace);
   keyframes[1]->SetComposite(EffectModel::kCompositeReplace);
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   HeapVector<Member<Interpolation>> values;
   effect->Sample(0, 1.6, kDuration, values);
   ExpectNonInterpolableValue("cursive", values.at(0));
@@ -244,8 +238,7 @@
 TEST_F(AnimationKeyframeEffectModel, ExtrapolateReplace) {
   StringKeyframeVector keyframes =
       KeyframesAtZeroAndOne(CSSPropertyID::kLeft, "3px", "5px");
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   keyframes[0]->SetComposite(EffectModel::kCompositeReplace);
   keyframes[1]->SetComposite(EffectModel::kCompositeReplace);
   HeapVector<Member<Interpolation>> values;
@@ -259,16 +252,15 @@
       KeyframesAtZeroAndOne(CSSPropertyID::kLeft, "3px", "5px");
   keyframes[0]->SetComposite(EffectModel::kCompositeAdd);
   keyframes[1]->SetComposite(EffectModel::kCompositeAdd);
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   HeapVector<Member<Interpolation>> values;
   effect->Sample(0, 1.6, kDuration, values);
   ExpectLengthValue((7.0 + 3.0) * -0.6 + (7.0 + 5.0) * 1.6, values.at(0));
 }
 
 TEST_F(AnimationKeyframeEffectModel, ZeroKeyframes) {
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(StringKeyframeVector());
+  auto* effect =
+      MakeGarbageCollected<StringKeyframeEffectModel>(StringKeyframeVector());
   HeapVector<Member<Interpolation>> values;
   effect->Sample(0, 0.5, kDuration, values);
   EXPECT_TRUE(values.IsEmpty());
@@ -277,14 +269,13 @@
 // FIXME: Re-enable this test once compositing of CompositeAdd is supported.
 TEST_F(AnimationKeyframeEffectModel, DISABLED_SingleKeyframeAtOffsetZero) {
   StringKeyframeVector keyframes(1);
-  keyframes[0] = StringKeyframe::Create();
+  keyframes[0] = MakeGarbageCollected<StringKeyframe>();
   keyframes[0]->SetOffset(0.0);
   keyframes[0]->SetCSSPropertyValue(CSSPropertyID::kFontFamily, "serif",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
 
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   HeapVector<Member<Interpolation>> values;
   effect->Sample(0, 0.6, kDuration, values);
   ExpectNonInterpolableValue("serif", values.at(0));
@@ -293,14 +284,13 @@
 // FIXME: Re-enable this test once compositing of CompositeAdd is supported.
 TEST_F(AnimationKeyframeEffectModel, DISABLED_SingleKeyframeAtOffsetOne) {
   StringKeyframeVector keyframes(1);
-  keyframes[0] = StringKeyframe::Create();
+  keyframes[0] = MakeGarbageCollected<StringKeyframe>();
   keyframes[0]->SetOffset(1.0);
   keyframes[0]->SetCSSPropertyValue(CSSPropertyID::kLeft, "5px",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
 
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   HeapVector<Member<Interpolation>> values;
   effect->Sample(0, 0.6, kDuration, values);
   ExpectLengthValue(7.0 * 0.4 + 5.0 * 0.6, values.at(0));
@@ -308,24 +298,23 @@
 
 TEST_F(AnimationKeyframeEffectModel, MoreThanTwoKeyframes) {
   StringKeyframeVector keyframes(3);
-  keyframes[0] = StringKeyframe::Create();
+  keyframes[0] = MakeGarbageCollected<StringKeyframe>();
   keyframes[0]->SetOffset(0.0);
   keyframes[0]->SetCSSPropertyValue(CSSPropertyID::kFontFamily, "serif",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
-  keyframes[1] = StringKeyframe::Create();
+  keyframes[1] = MakeGarbageCollected<StringKeyframe>();
   keyframes[1]->SetOffset(0.5);
   keyframes[1]->SetCSSPropertyValue(CSSPropertyID::kFontFamily, "sans-serif",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
-  keyframes[2] = StringKeyframe::Create();
+  keyframes[2] = MakeGarbageCollected<StringKeyframe>();
   keyframes[2]->SetOffset(1.0);
   keyframes[2]->SetCSSPropertyValue(CSSPropertyID::kFontFamily, "cursive",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
 
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   HeapVector<Member<Interpolation>> values;
   effect->Sample(0, 0.3, kDuration, values);
   ExpectNonInterpolableValue("sans-serif", values.at(0));
@@ -335,22 +324,21 @@
 
 TEST_F(AnimationKeyframeEffectModel, EndKeyframeOffsetsUnspecified) {
   StringKeyframeVector keyframes(3);
-  keyframes[0] = StringKeyframe::Create();
+  keyframes[0] = MakeGarbageCollected<StringKeyframe>();
   keyframes[0]->SetCSSPropertyValue(CSSPropertyID::kFontFamily, "serif",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
-  keyframes[1] = StringKeyframe::Create();
+  keyframes[1] = MakeGarbageCollected<StringKeyframe>();
   keyframes[1]->SetOffset(0.5);
   keyframes[1]->SetCSSPropertyValue(CSSPropertyID::kFontFamily, "cursive",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
-  keyframes[2] = StringKeyframe::Create();
+  keyframes[2] = MakeGarbageCollected<StringKeyframe>();
   keyframes[2]->SetCSSPropertyValue(CSSPropertyID::kFontFamily, "serif",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
 
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   HeapVector<Member<Interpolation>> values;
   effect->Sample(0, 0.1, kDuration, values);
   ExpectNonInterpolableValue("serif", values.at(0));
@@ -362,24 +350,23 @@
 
 TEST_F(AnimationKeyframeEffectModel, SampleOnKeyframe) {
   StringKeyframeVector keyframes(3);
-  keyframes[0] = StringKeyframe::Create();
+  keyframes[0] = MakeGarbageCollected<StringKeyframe>();
   keyframes[0]->SetOffset(0.0);
   keyframes[0]->SetCSSPropertyValue(CSSPropertyID::kFontFamily, "serif",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
-  keyframes[1] = StringKeyframe::Create();
+  keyframes[1] = MakeGarbageCollected<StringKeyframe>();
   keyframes[1]->SetOffset(0.5);
   keyframes[1]->SetCSSPropertyValue(CSSPropertyID::kFontFamily, "cursive",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
-  keyframes[2] = StringKeyframe::Create();
+  keyframes[2] = MakeGarbageCollected<StringKeyframe>();
   keyframes[2]->SetOffset(1.0);
   keyframes[2]->SetCSSPropertyValue(CSSPropertyID::kFontFamily, "serif",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
 
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   HeapVector<Member<Interpolation>> values;
   effect->Sample(0, 0.0, kDuration, values);
   ExpectNonInterpolableValue("serif", values.at(0));
@@ -391,54 +378,53 @@
 
 TEST_F(AnimationKeyframeEffectModel, MultipleKeyframesWithSameOffset) {
   StringKeyframeVector keyframes(9);
-  keyframes[0] = StringKeyframe::Create();
+  keyframes[0] = MakeGarbageCollected<StringKeyframe>();
   keyframes[0]->SetOffset(0.0);
   keyframes[0]->SetCSSPropertyValue(CSSPropertyID::kFontFamily, "serif",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
-  keyframes[1] = StringKeyframe::Create();
+  keyframes[1] = MakeGarbageCollected<StringKeyframe>();
   keyframes[1]->SetOffset(0.1);
   keyframes[1]->SetCSSPropertyValue(CSSPropertyID::kFontFamily, "sans-serif",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
-  keyframes[2] = StringKeyframe::Create();
+  keyframes[2] = MakeGarbageCollected<StringKeyframe>();
   keyframes[2]->SetOffset(0.1);
   keyframes[2]->SetCSSPropertyValue(CSSPropertyID::kFontFamily, "monospace",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
-  keyframes[3] = StringKeyframe::Create();
+  keyframes[3] = MakeGarbageCollected<StringKeyframe>();
   keyframes[3]->SetOffset(0.5);
   keyframes[3]->SetCSSPropertyValue(CSSPropertyID::kFontFamily, "cursive",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
-  keyframes[4] = StringKeyframe::Create();
+  keyframes[4] = MakeGarbageCollected<StringKeyframe>();
   keyframes[4]->SetOffset(0.5);
   keyframes[4]->SetCSSPropertyValue(CSSPropertyID::kFontFamily, "fantasy",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
-  keyframes[5] = StringKeyframe::Create();
+  keyframes[5] = MakeGarbageCollected<StringKeyframe>();
   keyframes[5]->SetOffset(0.5);
   keyframes[5]->SetCSSPropertyValue(CSSPropertyID::kFontFamily, "system-ui",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
-  keyframes[6] = StringKeyframe::Create();
+  keyframes[6] = MakeGarbageCollected<StringKeyframe>();
   keyframes[6]->SetOffset(0.9);
   keyframes[6]->SetCSSPropertyValue(CSSPropertyID::kFontFamily, "serif",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
-  keyframes[7] = StringKeyframe::Create();
+  keyframes[7] = MakeGarbageCollected<StringKeyframe>();
   keyframes[7]->SetOffset(0.9);
   keyframes[7]->SetCSSPropertyValue(CSSPropertyID::kFontFamily, "sans-serif",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
-  keyframes[8] = StringKeyframe::Create();
+  keyframes[8] = MakeGarbageCollected<StringKeyframe>();
   keyframes[8]->SetOffset(1.0);
   keyframes[8]->SetCSSPropertyValue(CSSPropertyID::kFontFamily, "monospace",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
 
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   HeapVector<Member<Interpolation>> values;
   effect->Sample(0, 0.0, kDuration, values);
   ExpectNonInterpolableValue("serif", values.at(0));
@@ -459,20 +445,19 @@
 // FIXME: Re-enable this test once compositing of CompositeAdd is supported.
 TEST_F(AnimationKeyframeEffectModel, DISABLED_PerKeyframeComposite) {
   StringKeyframeVector keyframes(2);
-  keyframes[0] = StringKeyframe::Create();
+  keyframes[0] = MakeGarbageCollected<StringKeyframe>();
   keyframes[0]->SetOffset(0.0);
   keyframes[0]->SetCSSPropertyValue(CSSPropertyID::kLeft, "3px",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
-  keyframes[1] = StringKeyframe::Create();
+  keyframes[1] = MakeGarbageCollected<StringKeyframe>();
   keyframes[1]->SetOffset(1.0);
   keyframes[1]->SetCSSPropertyValue(CSSPropertyID::kLeft, "5px",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
   keyframes[1]->SetComposite(EffectModel::kCompositeAdd);
 
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   HeapVector<Member<Interpolation>> values;
   effect->Sample(0, 0.6, kDuration, values);
   ExpectLengthValue(3.0 * 0.4 + (7.0 + 5.0) * 0.6, values.at(0));
@@ -480,7 +465,7 @@
 
 TEST_F(AnimationKeyframeEffectModel, MultipleProperties) {
   StringKeyframeVector keyframes(2);
-  keyframes[0] = StringKeyframe::Create();
+  keyframes[0] = MakeGarbageCollected<StringKeyframe>();
   keyframes[0]->SetOffset(0.0);
   keyframes[0]->SetCSSPropertyValue(CSSPropertyID::kFontFamily, "serif",
                                     SecureContextMode::kInsecureContext,
@@ -488,7 +473,7 @@
   keyframes[0]->SetCSSPropertyValue(CSSPropertyID::kFontStyle, "normal",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
-  keyframes[1] = StringKeyframe::Create();
+  keyframes[1] = MakeGarbageCollected<StringKeyframe>();
   keyframes[1]->SetOffset(1.0);
   keyframes[1]->SetCSSPropertyValue(CSSPropertyID::kFontFamily, "cursive",
                                     SecureContextMode::kInsecureContext,
@@ -497,8 +482,7 @@
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
 
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   HeapVector<Member<Interpolation>> values;
   effect->Sample(0, 0.6, kDuration, values);
   EXPECT_EQ(2UL, values.size());
@@ -516,8 +500,7 @@
       KeyframesAtZeroAndOne(CSSPropertyID::kLeft, "3px", "5px");
   keyframes[0]->SetComposite(EffectModel::kCompositeAdd);
   keyframes[1]->SetComposite(EffectModel::kCompositeAdd);
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   HeapVector<Member<Interpolation>> values;
   effect->Sample(0, 0.6, kDuration, values);
   ExpectLengthValue((7.0 + 3.0) * 0.4 + (7.0 + 5.0) * 0.6, values.at(0));
@@ -527,8 +510,7 @@
 TEST_F(AnimationKeyframeEffectModel, MultipleIterations) {
   StringKeyframeVector keyframes =
       KeyframesAtZeroAndOne(CSSPropertyID::kLeft, "1px", "3px");
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   HeapVector<Member<Interpolation>> values;
   effect->Sample(0, 0.5, kDuration, values);
   ExpectLengthValue(2.0, values.at(0));
@@ -541,25 +523,24 @@
 // FIXME: Re-enable this test once compositing of CompositeAdd is supported.
 TEST_F(AnimationKeyframeEffectModel, DISABLED_DependsOnUnderlyingValue) {
   StringKeyframeVector keyframes(3);
-  keyframes[0] = StringKeyframe::Create();
+  keyframes[0] = MakeGarbageCollected<StringKeyframe>();
   keyframes[0]->SetOffset(0.0);
   keyframes[0]->SetCSSPropertyValue(CSSPropertyID::kLeft, "1px",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
   keyframes[0]->SetComposite(EffectModel::kCompositeAdd);
-  keyframes[1] = StringKeyframe::Create();
+  keyframes[1] = MakeGarbageCollected<StringKeyframe>();
   keyframes[1]->SetOffset(0.5);
   keyframes[1]->SetCSSPropertyValue(CSSPropertyID::kLeft, "1px",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
-  keyframes[2] = StringKeyframe::Create();
+  keyframes[2] = MakeGarbageCollected<StringKeyframe>();
   keyframes[2]->SetOffset(1.0);
   keyframes[2]->SetCSSPropertyValue(CSSPropertyID::kLeft, "1px",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
 
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   HeapVector<Member<Interpolation>> values;
   effect->Sample(0, 0, kDuration, values);
   EXPECT_TRUE(values.at(0));
@@ -583,14 +564,13 @@
 
 TEST_F(AnimationKeyframeEffectModel, AddSyntheticKeyframes) {
   StringKeyframeVector keyframes(1);
-  keyframes[0] = StringKeyframe::Create();
+  keyframes[0] = MakeGarbageCollected<StringKeyframe>();
   keyframes[0]->SetOffset(0.5);
   keyframes[0]->SetCSSPropertyValue(CSSPropertyID::kLeft, "4px",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
 
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
   const StringPropertySpecificKeyframeVector& property_specific_keyframes =
       effect->GetPropertySpecificKeyframes(
           PropertyHandle(GetCSSPropertyLeft()));
@@ -602,8 +582,7 @@
 
 TEST_F(AnimationKeyframeEffectModel, ToKeyframeEffectModel) {
   StringKeyframeVector keyframes(0);
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
 
   EffectModel* base_effect = effect;
   EXPECT_TRUE(ToStringKeyframeEffectModel(base_effect));
@@ -612,8 +591,7 @@
 TEST_F(AnimationKeyframeEffectModel, CompositorSnapshotUpdateBasic) {
   StringKeyframeVector keyframes =
       KeyframesAtZeroAndOne(CSSPropertyID::kOpacity, "0", "1");
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
 
   auto style = GetDocument().EnsureStyleResolver().StyleForElement(element);
 
@@ -650,8 +628,8 @@
        CompositorSnapshotUpdateAfterKeyframeChange) {
   StringKeyframeVector opacity_keyframes =
       KeyframesAtZeroAndOne(CSSPropertyID::kOpacity, "0", "1");
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(opacity_keyframes);
+  auto* effect =
+      MakeGarbageCollected<StringKeyframeEffectModel>(opacity_keyframes);
 
   auto style = GetDocument().EnsureStyleResolver().StyleForElement(element);
 
@@ -700,8 +678,7 @@
                                 exception_state);
   EXPECT_FALSE(exception_state.HadException());
 
-  StringKeyframeEffectModel* effect =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect = MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
 
   auto style = GetDocument().EnsureStyleResolver().StyleForElement(element);
 
@@ -733,12 +710,12 @@
 
 TEST_F(KeyframeEffectModelTest, EvenlyDistributed1) {
   KeyframeVector keyframes(5);
-  keyframes[0] = StringKeyframe::Create();
+  keyframes[0] = MakeGarbageCollected<StringKeyframe>();
   keyframes[0]->SetOffset(0.125);
-  keyframes[1] = StringKeyframe::Create();
-  keyframes[2] = StringKeyframe::Create();
-  keyframes[3] = StringKeyframe::Create();
-  keyframes[4] = StringKeyframe::Create();
+  keyframes[1] = MakeGarbageCollected<StringKeyframe>();
+  keyframes[2] = MakeGarbageCollected<StringKeyframe>();
+  keyframes[3] = MakeGarbageCollected<StringKeyframe>();
+  keyframes[4] = MakeGarbageCollected<StringKeyframe>();
   keyframes[4]->SetOffset(0.625);
 
   const Vector<double> result = GetComputedOffsets(keyframes);
@@ -752,13 +729,13 @@
 
 TEST_F(KeyframeEffectModelTest, EvenlyDistributed2) {
   KeyframeVector keyframes(6);
-  keyframes[0] = StringKeyframe::Create();
-  keyframes[1] = StringKeyframe::Create();
-  keyframes[2] = StringKeyframe::Create();
-  keyframes[3] = StringKeyframe::Create();
+  keyframes[0] = MakeGarbageCollected<StringKeyframe>();
+  keyframes[1] = MakeGarbageCollected<StringKeyframe>();
+  keyframes[2] = MakeGarbageCollected<StringKeyframe>();
+  keyframes[3] = MakeGarbageCollected<StringKeyframe>();
   keyframes[3]->SetOffset(0.75);
-  keyframes[4] = StringKeyframe::Create();
-  keyframes[5] = StringKeyframe::Create();
+  keyframes[4] = MakeGarbageCollected<StringKeyframe>();
+  keyframes[5] = MakeGarbageCollected<StringKeyframe>();
 
   const Vector<double> result = GetComputedOffsets(keyframes);
   EXPECT_EQ(6U, result.size());
@@ -772,21 +749,21 @@
 
 TEST_F(KeyframeEffectModelTest, EvenlyDistributed3) {
   KeyframeVector keyframes(12);
-  keyframes[0] = StringKeyframe::Create();
+  keyframes[0] = MakeGarbageCollected<StringKeyframe>();
   keyframes[0]->SetOffset(0);
-  keyframes[1] = StringKeyframe::Create();
-  keyframes[2] = StringKeyframe::Create();
-  keyframes[3] = StringKeyframe::Create();
-  keyframes[4] = StringKeyframe::Create();
+  keyframes[1] = MakeGarbageCollected<StringKeyframe>();
+  keyframes[2] = MakeGarbageCollected<StringKeyframe>();
+  keyframes[3] = MakeGarbageCollected<StringKeyframe>();
+  keyframes[4] = MakeGarbageCollected<StringKeyframe>();
   keyframes[4]->SetOffset(0.5);
-  keyframes[5] = StringKeyframe::Create();
-  keyframes[6] = StringKeyframe::Create();
-  keyframes[7] = StringKeyframe::Create();
+  keyframes[5] = MakeGarbageCollected<StringKeyframe>();
+  keyframes[6] = MakeGarbageCollected<StringKeyframe>();
+  keyframes[7] = MakeGarbageCollected<StringKeyframe>();
   keyframes[7]->SetOffset(0.8);
-  keyframes[8] = StringKeyframe::Create();
-  keyframes[9] = StringKeyframe::Create();
-  keyframes[10] = StringKeyframe::Create();
-  keyframes[11] = StringKeyframe::Create();
+  keyframes[8] = MakeGarbageCollected<StringKeyframe>();
+  keyframes[9] = MakeGarbageCollected<StringKeyframe>();
+  keyframes[10] = MakeGarbageCollected<StringKeyframe>();
+  keyframes[11] = MakeGarbageCollected<StringKeyframe>();
 
   const Vector<double> result = GetComputedOffsets(keyframes);
   EXPECT_EQ(12U, result.size());
diff --git a/third_party/blink/renderer/core/animation/keyframe_effect_test.cc b/third_party/blink/renderer/core/animation/keyframe_effect_test.cc
index cd7c113..49c46cf 100644
--- a/third_party/blink/renderer/core/animation/keyframe_effect_test.cc
+++ b/third_party/blink/renderer/core/animation/keyframe_effect_test.cc
@@ -23,6 +23,7 @@
 #include "third_party/blink/renderer/core/dom/node_computed_style.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/testing/runtime_enabled_features_test_helpers.h"
 #include "v8/include/v8.h"
 
@@ -37,7 +38,8 @@
   }
 
   KeyframeEffectModelBase* CreateEmptyEffectModel() {
-    return StringKeyframeEffectModel::Create(StringKeyframeVector());
+    return MakeGarbageCollected<StringKeyframeEffectModel>(
+        StringKeyframeVector());
   }
 
   Persistent<Element> element;
@@ -339,8 +341,8 @@
   timing.start_delay = 100;
   timing.end_delay = 100;
   timing.fill_mode = Timing::FillMode::NONE;
-  KeyframeEffect* keyframe_effect =
-      KeyframeEffect::Create(nullptr, CreateEmptyEffectModel(), timing);
+  auto* keyframe_effect = MakeGarbageCollected<KeyframeEffect>(
+      nullptr, CreateEmptyEffectModel(), timing);
   Animation* animation = GetDocument().Timeline().Play(keyframe_effect);
   double inf = std::numeric_limits<double>::infinity();
 
@@ -373,8 +375,8 @@
 
   // No keyframes results in an invalid animation.
   {
-    KeyframeEffect* keyframe_effect =
-        KeyframeEffect::Create(element, CreateEmptyEffectModel(), timing);
+    auto* keyframe_effect = MakeGarbageCollected<KeyframeEffect>(
+        element, CreateEmptyEffectModel(), timing);
     EXPECT_TRUE(keyframe_effect->CheckCanStartAnimationOnCompositor(
                     nullptr, animation_playback_rate) &
                 CompositorAnimations::kInvalidAnimationOrEffect);
@@ -383,15 +385,15 @@
   // Keyframes but no properties results in an invalid animation.
   {
     StringKeyframeVector keyframes(2);
-    keyframes[0] = StringKeyframe::Create();
+    keyframes[0] = MakeGarbageCollected<StringKeyframe>();
     keyframes[0]->SetOffset(0.0);
-    keyframes[1] = StringKeyframe::Create();
+    keyframes[1] = MakeGarbageCollected<StringKeyframe>();
     keyframes[1]->SetOffset(1.0);
-    StringKeyframeEffectModel* effect_model =
-        StringKeyframeEffectModel::Create(keyframes);
+    auto* effect_model =
+        MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
 
-    KeyframeEffect* keyframe_effect =
-        KeyframeEffect::Create(element, effect_model, timing);
+    auto* keyframe_effect =
+        MakeGarbageCollected<KeyframeEffect>(element, effect_model, timing);
     EXPECT_TRUE(keyframe_effect->CheckCanStartAnimationOnCompositor(
                     nullptr, animation_playback_rate) &
                 CompositorAnimations::kInvalidAnimationOrEffect);
@@ -404,21 +406,21 @@
 
   // No target results in an invalid animation.
   StringKeyframeVector keyframes(2);
-  keyframes[0] = StringKeyframe::Create();
+  keyframes[0] = MakeGarbageCollected<StringKeyframe>();
   keyframes[0]->SetOffset(0.0);
   keyframes[0]->SetCSSPropertyValue(CSSPropertyID::kLeft, "0px",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
-  keyframes[1] = StringKeyframe::Create();
+  keyframes[1] = MakeGarbageCollected<StringKeyframe>();
   keyframes[1]->SetOffset(1.0);
   keyframes[1]->SetCSSPropertyValue(CSSPropertyID::kLeft, "10px",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
-  StringKeyframeEffectModel* effect_model =
-      StringKeyframeEffectModel::Create(keyframes);
+  auto* effect_model =
+      MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
 
-  KeyframeEffect* keyframe_effect =
-      KeyframeEffect::Create(nullptr, effect_model, timing);
+  auto* keyframe_effect =
+      MakeGarbageCollected<KeyframeEffect>(nullptr, effect_model, timing);
   EXPECT_TRUE(keyframe_effect->CheckCanStartAnimationOnCompositor(
                   nullptr, animation_playback_rate) &
               CompositorAnimations::kInvalidAnimationOrEffect);
@@ -429,20 +431,20 @@
   Timing timing;
 
   StringKeyframeVector keyframes(2);
-  keyframes[0] = StringKeyframe::Create();
+  keyframes[0] = MakeGarbageCollected<StringKeyframe>();
   keyframes[0]->SetOffset(0.0);
   keyframes[0]->SetCSSPropertyValue(CSSPropertyID::kLeft, "0px",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
-  keyframes[1] = StringKeyframe::Create();
+  keyframes[1] = MakeGarbageCollected<StringKeyframe>();
   keyframes[1]->SetOffset(1.0);
   keyframes[1]->SetCSSPropertyValue(CSSPropertyID::kLeft, "10px",
                                     SecureContextMode::kInsecureContext,
                                     nullptr);
-  StringKeyframeEffectModel* effect_model =
-      StringKeyframeEffectModel::Create(keyframes);
-  KeyframeEffect* keyframe_effect =
-      KeyframeEffect::Create(element, effect_model, timing);
+  auto* effect_model =
+      MakeGarbageCollected<StringKeyframeEffectModel>(keyframes);
+  auto* keyframe_effect =
+      MakeGarbageCollected<KeyframeEffect>(element, effect_model, timing);
 
   // If the target has a CSS offset we can't composite it.
   UpdateAllLifecyclePhasesForTest();
diff --git a/third_party/blink/renderer/core/animation/string_keyframe.cc b/third_party/blink/renderer/core/animation/string_keyframe.cc
index 90ad43fb..f43b0f77 100644
--- a/third_party/blink/renderer/core/animation/string_keyframe.cc
+++ b/third_party/blink/renderer/core/animation/string_keyframe.cc
@@ -11,6 +11,7 @@
 #include "third_party/blink/renderer/core/css/resolver/style_resolver.h"
 #include "third_party/blink/renderer/core/style_property_shorthand.h"
 #include "third_party/blink/renderer/core/svg/svg_element.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -152,19 +153,19 @@
   EffectModel::CompositeOperation composite =
       composite_.value_or(effect_composite);
   if (property.IsCSSProperty()) {
-    return CSSPropertySpecificKeyframe::Create(
+    return MakeGarbageCollected<CSSPropertySpecificKeyframe>(
         offset, &Easing(), &CssPropertyValue(property), composite);
   }
 
   if (property.IsPresentationAttribute()) {
-    return CSSPropertySpecificKeyframe::Create(
+    return MakeGarbageCollected<CSSPropertySpecificKeyframe>(
         offset, &Easing(),
         &PresentationAttributeValue(property.PresentationAttribute()),
         composite);
   }
 
   DCHECK(property.IsSVGAttribute());
-  return SVGPropertySpecificKeyframe::Create(
+  return MakeGarbageCollected<SVGPropertySpecificKeyframe>(
       offset, &Easing(), SvgPropertyValue(property.SvgAttribute()), composite);
 }
 
@@ -183,7 +184,8 @@
 StringKeyframe::CSSPropertySpecificKeyframe::NeutralKeyframe(
     double offset,
     scoped_refptr<TimingFunction> easing) const {
-  return Create(offset, std::move(easing), nullptr, EffectModel::kCompositeAdd);
+  return MakeGarbageCollected<CSSPropertySpecificKeyframe>(
+      offset, std::move(easing), nullptr, EffectModel::kCompositeAdd);
 }
 
 void StringKeyframe::CSSPropertySpecificKeyframe::Trace(Visitor* visitor) {
@@ -195,23 +197,24 @@
 Keyframe::PropertySpecificKeyframe*
 StringKeyframe::CSSPropertySpecificKeyframe::CloneWithOffset(
     double offset) const {
-  CSSPropertySpecificKeyframe* clone =
-      Create(offset, easing_, value_.Get(), composite_);
+  auto* clone = MakeGarbageCollected<CSSPropertySpecificKeyframe>(
+      offset, easing_, value_.Get(), composite_);
   clone->compositor_keyframe_value_cache_ = compositor_keyframe_value_cache_;
   return clone;
 }
 
 Keyframe::PropertySpecificKeyframe*
 SVGPropertySpecificKeyframe::CloneWithOffset(double offset) const {
-  return Create(offset, easing_, value_, composite_);
+  return MakeGarbageCollected<SVGPropertySpecificKeyframe>(offset, easing_,
+                                                           value_, composite_);
 }
 
 Keyframe::PropertySpecificKeyframe*
 SVGPropertySpecificKeyframe::NeutralKeyframe(
     double offset,
     scoped_refptr<TimingFunction> easing) const {
-  return Create(offset, std::move(easing), String(),
-                EffectModel::kCompositeAdd);
+  return MakeGarbageCollected<SVGPropertySpecificKeyframe>(
+      offset, std::move(easing), String(), EffectModel::kCompositeAdd);
 }
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/animation/string_keyframe.h b/third_party/blink/renderer/core/animation/string_keyframe.h
index c4afa7da..f8748808 100644
--- a/third_party/blink/renderer/core/animation/string_keyframe.h
+++ b/third_party/blink/renderer/core/animation/string_keyframe.h
@@ -7,7 +7,7 @@
 
 #include "third_party/blink/renderer/core/animation/keyframe.h"
 #include "third_party/blink/renderer/core/css/css_property_value_set.h"
-
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/wtf/hash_map.h"
 
 namespace blink {
@@ -27,15 +27,12 @@
 // expand shorthand properties; that is done for computed keyframes.
 class CORE_EXPORT StringKeyframe : public Keyframe {
  public:
-  static StringKeyframe* Create() {
-    return MakeGarbageCollected<StringKeyframe>();
-  }
-
   StringKeyframe()
-      : css_property_map_(
-            MutableCSSPropertyValueSet::Create(kHTMLStandardMode)),
+      : css_property_map_(MakeGarbageCollected<MutableCSSPropertyValueSet>(
+            kHTMLStandardMode)),
         presentation_attribute_map_(
-            MutableCSSPropertyValueSet::Create(kHTMLStandardMode)) {}
+            MakeGarbageCollected<MutableCSSPropertyValueSet>(
+                kHTMLStandardMode)) {}
   StringKeyframe(const StringKeyframe& copy_from);
 
   MutableCSSPropertyValueSet::SetResult SetCSSPropertyValue(
@@ -92,15 +89,6 @@
   class CSSPropertySpecificKeyframe
       : public Keyframe::PropertySpecificKeyframe {
    public:
-    static CSSPropertySpecificKeyframe* Create(
-        double offset,
-        scoped_refptr<TimingFunction> easing,
-        const CSSValue* value,
-        EffectModel::CompositeOperation composite) {
-      return MakeGarbageCollected<CSSPropertySpecificKeyframe>(
-          offset, std::move(easing), value, composite);
-    }
-
     CSSPropertySpecificKeyframe(double offset,
                                 scoped_refptr<TimingFunction> easing,
                                 const CSSValue* value,
@@ -140,15 +128,6 @@
   class SVGPropertySpecificKeyframe
       : public Keyframe::PropertySpecificKeyframe {
    public:
-    static SVGPropertySpecificKeyframe* Create(
-        double offset,
-        scoped_refptr<TimingFunction> easing,
-        const String& value,
-        EffectModel::CompositeOperation composite) {
-      return MakeGarbageCollected<SVGPropertySpecificKeyframe>(
-          offset, std::move(easing), value, composite);
-    }
-
     SVGPropertySpecificKeyframe(double offset,
                                 scoped_refptr<TimingFunction> easing,
                                 const String& value,
diff --git a/third_party/blink/renderer/core/css/active_style_sheets_test.cc b/third_party/blink/renderer/core/css/active_style_sheets_test.cc
index 2faff4b..f93cc867 100644
--- a/third_party/blink/renderer/core/css/active_style_sheets_test.cc
+++ b/third_party/blink/renderer/core/css/active_style_sheets_test.cc
@@ -18,6 +18,7 @@
 #include "third_party/blink/renderer/core/frame/local_frame_view.h"
 #include "third_party/blink/renderer/core/html/html_element.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -25,7 +26,7 @@
  protected:
   static CSSStyleSheet* CreateSheet(const String& css_text = String()) {
     StyleSheetContents* contents =
-        StyleSheetContents::Create(CSSParserContext::Create(
+        StyleSheetContents::Create(MakeGarbageCollected<CSSParserContext>(
             kHTMLStandardMode, SecureContextMode::kInsecureContext));
     contents->ParseString(css_text);
     contents->EnsureRuleSet(MediaQueryEvaluator(),
diff --git a/third_party/blink/renderer/core/css/css_default_style_sheets.cc b/third_party/blink/renderer/core/css/css_default_style_sheets.cc
index 175651e5..98ecd1d 100644
--- a/third_party/blink/renderer/core/css/css_default_style_sheets.cc
+++ b/third_party/blink/renderer/core/css/css_default_style_sheets.cc
@@ -38,6 +38,7 @@
 #include "third_party/blink/renderer/core/layout/layout_theme.h"
 #include "third_party/blink/renderer/core/mathml_names.h"
 #include "third_party/blink/renderer/platform/data_resource_helper.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 #include "third_party/blink/renderer/platform/wtf/leak_annotations.h"
 
@@ -65,7 +66,7 @@
 static StyleSheetContents* ParseUASheet(const String& str) {
   // UA stylesheets always parse in the insecure context mode.
   StyleSheetContents* sheet =
-      StyleSheetContents::Create(CSSParserContext::Create(
+      StyleSheetContents::Create(MakeGarbageCollected<CSSParserContext>(
           kUASheetMode, SecureContextMode::kInsecureContext));
   sheet->ParseString(str);
   // User Agent stylesheets are parsed once for the lifetime of the renderer
diff --git a/third_party/blink/renderer/core/css/css_font_face_src_value.cc b/third_party/blink/renderer/core/css/css_font_face_src_value.cc
index b7b52c32..a17355c2 100644
--- a/third_party/blink/renderer/core/css/css_font_face_src_value.cc
+++ b/third_party/blink/renderer/core/css/css_font_face_src_value.cc
@@ -85,8 +85,9 @@
                                          FontResourceClient* client) const {
   if (!fetched_) {
     ResourceRequest resource_request(absolute_resource_);
-    resource_request.SetHttpReferrer(SecurityPolicy::GenerateReferrer(
-        referrer_.referrer_policy, resource_request.Url(), referrer_.referrer));
+    resource_request.SetReferrerPolicy(
+        ReferrerPolicyResolveDefault(referrer_.referrer_policy));
+    resource_request.SetReferrerString(referrer_.referrer);
     ResourceLoaderOptions options;
     options.initiator_info.name = fetch_initiator_type_names::kCSS;
     FetchParameters params(resource_request, options);
diff --git a/third_party/blink/renderer/core/css/css_grouping_rule.cc b/third_party/blink/renderer/core/css/css_grouping_rule.cc
index ad32b8f..93b790c 100644
--- a/third_party/blink/renderer/core/css/css_grouping_rule.cc
+++ b/third_party/blink/renderer/core/css/css_grouping_rule.cc
@@ -36,6 +36,7 @@
 #include "third_party/blink/renderer/core/execution_context/execution_context.h"
 #include "third_party/blink/renderer/core/frame/use_counter.h"
 #include "third_party/blink/renderer/platform/bindings/exception_state.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/wtf/text/string_builder.h"
 
 namespace blink {
@@ -64,7 +65,7 @@
   }
 
   CSSStyleSheet* style_sheet = parentStyleSheet();
-  CSSParserContext* context = CSSParserContext::CreateWithStyleSheet(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       ParserContext(execution_context->GetSecureContextMode()), style_sheet);
   StyleRuleBase* new_rule = CSSParser::ParseRule(
       context, style_sheet ? style_sheet->Contents() : nullptr, rule_string);
diff --git a/third_party/blink/renderer/core/css/css_image_set_value.cc b/third_party/blink/renderer/core/css/css_image_set_value.cc
index a8cd7be2..bbb39a7f 100644
--- a/third_party/blink/renderer/core/css/css_image_set_value.cc
+++ b/third_party/blink/renderer/core/css/css_image_set_value.cc
@@ -64,9 +64,8 @@
 
     ImageWithScale image;
     image.image_url = image_url;
-    image.referrer = SecurityPolicy::GenerateReferrer(
-        image_value.GetReferrer().referrer_policy, KURL(image_url),
-        image_value.GetReferrer().referrer);
+    image.referrer.referrer = image_value.GetReferrer().referrer;
+    image.referrer.referrer_policy = image_value.GetReferrer().referrer_policy;
     image.scale_factor = scale_factor;
     images_in_set_.push_back(image);
     ++i;
@@ -114,7 +113,9 @@
     // transforms. https://bugs.webkit.org/show_bug.cgi?id=81698
     ImageWithScale image = BestImageForScaleFactor(device_scale_factor);
     ResourceRequest resource_request(document.CompleteURL(image.image_url));
-    resource_request.SetHttpReferrer(image.referrer);
+    resource_request.SetReferrerPolicy(
+        ReferrerPolicyResolveDefault(image.referrer.referrer_policy));
+    resource_request.SetReferrerString(image.referrer.referrer);
     ResourceLoaderOptions options;
     options.initiator_info.name = parser_mode_ == kUASheetMode
                                       ? fetch_initiator_type_names::kUacss
diff --git a/third_party/blink/renderer/core/css/css_image_value.cc b/third_party/blink/renderer/core/css/css_image_value.cc
index f0b8c04..ec63168 100644
--- a/third_party/blink/renderer/core/css/css_image_value.cc
+++ b/third_party/blink/renderer/core/css/css_image_value.cc
@@ -62,8 +62,9 @@
     if (absolute_url_.IsEmpty())
       ReResolveURL(document);
     ResourceRequest resource_request(absolute_url_);
-    resource_request.SetHttpReferrer(SecurityPolicy::GenerateReferrer(
-        referrer_.referrer_policy, resource_request.Url(), referrer_.referrer));
+    resource_request.SetReferrerPolicy(
+        ReferrerPolicyResolveDefault(referrer_.referrer_policy));
+    resource_request.SetReferrerString(referrer_.referrer);
     ResourceLoaderOptions options;
     options.initiator_info.name = initiator_name_.IsEmpty()
                                       ? fetch_initiator_type_names::kCSS
diff --git a/third_party/blink/renderer/core/css/css_keyframes_rule.cc b/third_party/blink/renderer/core/css/css_keyframes_rule.cc
index ae213fb..14af5ae 100644
--- a/third_party/blink/renderer/core/css/css_keyframes_rule.cc
+++ b/third_party/blink/renderer/core/css/css_keyframes_rule.cc
@@ -26,12 +26,14 @@
 #include "third_party/blink/renderer/core/css/css_keyframes_rule.h"
 
 #include <memory>
+
 #include "third_party/blink/renderer/core/css/css_keyframe_rule.h"
 #include "third_party/blink/renderer/core/css/css_rule_list.h"
 #include "third_party/blink/renderer/core/css/css_style_sheet.h"
 #include "third_party/blink/renderer/core/css/parser/css_parser.h"
 #include "third_party/blink/renderer/core/execution_context/execution_context.h"
 #include "third_party/blink/renderer/core/frame/use_counter.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/wtf/text/string_builder.h"
 
 namespace blink {
@@ -96,7 +98,7 @@
             keyframes_rule_->Keyframes().size());
 
   CSSStyleSheet* style_sheet = parentStyleSheet();
-  CSSParserContext* context = CSSParserContext::CreateWithStyleSheet(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       ParserContext(execution_context->GetSecureContextMode()), style_sheet);
   StyleRuleKeyframe* keyframe =
       CSSParser::ParseKeyframeRule(context, rule_text);
diff --git a/third_party/blink/renderer/core/css/css_page_rule.cc b/third_party/blink/renderer/core/css/css_page_rule.cc
index b5e3e72..bcac8e8 100644
--- a/third_party/blink/renderer/core/css/css_page_rule.cc
+++ b/third_party/blink/renderer/core/css/css_page_rule.cc
@@ -28,6 +28,7 @@
 #include "third_party/blink/renderer/core/css/style_rule.h"
 #include "third_party/blink/renderer/core/css/style_rule_css_style_declaration.h"
 #include "third_party/blink/renderer/core/execution_context/execution_context.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/wtf/text/string_builder.h"
 
 namespace blink {
@@ -59,8 +60,8 @@
 
 void CSSPageRule::setSelectorText(const ExecutionContext* execution_context,
                                   const String& selector_text) {
-  CSSParserContext* context = CSSParserContext::Create(
-      ParserContext(execution_context->GetSecureContextMode()), nullptr);
+  auto* context = MakeGarbageCollected<CSSParserContext>(
+      ParserContext(execution_context->GetSecureContextMode()));
   DCHECK(context);
   CSSSelectorList selector_list = CSSParser::ParsePageSelector(
       *context, parentStyleSheet() ? parentStyleSheet()->Contents() : nullptr,
diff --git a/third_party/blink/renderer/core/css/css_property_value_set.cc b/third_party/blink/renderer/core/css/css_property_value_set.cc
index 26163af..a843fc2 100644
--- a/third_party/blink/renderer/core/css/css_property_value_set.cc
+++ b/third_party/blink/renderer/core/css/css_property_value_set.cc
@@ -32,6 +32,7 @@
 #include "third_party/blink/renderer/core/css/style_sheet_contents.h"
 #include "third_party/blink/renderer/core/frame/use_counter.h"
 #include "third_party/blink/renderer/core/style_property_shorthand.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/wtf/text/string_builder.h"
 
 #ifndef NDEBUG
@@ -445,11 +446,12 @@
 
   CSSParserContext* context;
   if (context_style_sheet) {
-    context = CSSParserContext::CreateWithStyleSheetContents(
+    context = MakeGarbageCollected<CSSParserContext>(
         context_style_sheet->ParserContext(), context_style_sheet);
     context->SetMode(CssParserMode());
   } else {
-    context = CSSParserContext::Create(CssParserMode(), secure_context_mode);
+    context = MakeGarbageCollected<CSSParserContext>(CssParserMode(),
+                                                     secure_context_mode);
   }
 
   CSSParser::ParseDeclarationList(context, this, style_declaration);
diff --git a/third_party/blink/renderer/core/css/css_property_value_set_test.cc b/third_party/blink/renderer/core/css/css_property_value_set_test.cc
index 2f4d297..096f9e69 100644
--- a/third_party/blink/renderer/core/css/css_property_value_set_test.cc
+++ b/third_party/blink/renderer/core/css/css_property_value_set_test.cc
@@ -9,6 +9,7 @@
 #include "third_party/blink/renderer/core/css/style_rule.h"
 #include "third_party/blink/renderer/core/css/style_sheet_contents.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -20,7 +21,7 @@
 };
 
 TEST_F(CSSPropertyValueSetTest, MergeAndOverrideOnConflictCustomProperty) {
-  CSSParserContext* context = CSSParserContext::Create(GetDocument());
+  auto* context = MakeGarbageCollected<CSSParserContext>(GetDocument());
   StyleSheetContents* style_sheet = StyleSheetContents::Create(context);
 
   String sheet_text = R"CSS(
diff --git a/third_party/blink/renderer/core/css/css_selector_watch.cc b/third_party/blink/renderer/core/css/css_selector_watch.cc
index 0c6ad72..dbd37898 100644
--- a/third_party/blink/renderer/core/css/css_selector_watch.cc
+++ b/third_party/blink/renderer/core/css/css_selector_watch.cc
@@ -38,6 +38,7 @@
 #include "third_party/blink/renderer/core/execution_context/execution_context.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/frame/local_frame_client.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -151,7 +152,7 @@
       ImmutableCSSPropertyValueSet::Create(nullptr, 0, kUASheetMode);
 
   // UA stylesheets always parse in the insecure context mode.
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kUASheetMode, SecureContextMode::kInsecureContext);
   for (const auto& selector : selectors) {
     CSSSelectorList selector_list =
diff --git a/third_party/blink/renderer/core/css/css_style_rule.cc b/third_party/blink/renderer/core/css/css_style_rule.cc
index d8aae2f4..b612a98b 100644
--- a/third_party/blink/renderer/core/css/css_style_rule.cc
+++ b/third_party/blink/renderer/core/css/css_style_rule.cc
@@ -29,6 +29,7 @@
 #include "third_party/blink/renderer/core/css/style_rule.h"
 #include "third_party/blink/renderer/core/css/style_rule_css_style_declaration.h"
 #include "third_party/blink/renderer/core/execution_context/execution_context.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/wtf/text/string_builder.h"
 
 namespace blink {
@@ -72,8 +73,8 @@
 
 void CSSStyleRule::setSelectorText(const ExecutionContext* execution_context,
                                    const String& selector_text) {
-  const CSSParserContext* context = CSSParserContext::Create(
-      ParserContext(execution_context->GetSecureContextMode()), nullptr);
+  const auto* context = MakeGarbageCollected<CSSParserContext>(
+      ParserContext(execution_context->GetSecureContextMode()));
   CSSSelectorList selector_list = CSSParser::ParseSelector(
       context, parentStyleSheet() ? parentStyleSheet()->Contents() : nullptr,
       selector_text);
diff --git a/third_party/blink/renderer/core/css/css_style_sheet.cc b/third_party/blink/renderer/core/css/css_style_sheet.cc
index 69e5d94..d54ccb594 100644
--- a/third_party/blink/renderer/core/css/css_style_sheet.cc
+++ b/third_party/blink/renderer/core/css/css_style_sheet.cc
@@ -45,6 +45,7 @@
 #include "third_party/blink/renderer/platform/bindings/exception_state.h"
 #include "third_party/blink/renderer/platform/bindings/script_state.h"
 #include "third_party/blink/renderer/platform/bindings/v8_per_isolate_data.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/weborigin/security_origin.h"
 #include "third_party/blink/renderer/platform/wtf/text/string_builder.h"
 
@@ -102,7 +103,7 @@
                                      ExceptionState& exception_state) {
   // Folowing steps at spec draft
   // https://wicg.github.io/construct-stylesheets/#dom-cssstylesheet-cssstylesheet
-  CSSParserContext* parser_context = CSSParserContext::Create(document);
+  auto* parser_context = MakeGarbageCollected<CSSParserContext>(document);
   StyleSheetContents* contents = StyleSheetContents::Create(parser_context);
   CSSStyleSheet* sheet = MakeGarbageCollected<CSSStyleSheet>(contents, nullptr);
   sheet->SetAssociatedDocument(&document);
@@ -149,7 +150,7 @@
                                            const KURL& base_url,
                                            const TextPosition& start_position,
                                            const WTF::TextEncoding& encoding) {
-  CSSParserContext* parser_context = CSSParserContext::Create(
+  auto* parser_context = MakeGarbageCollected<CSSParserContext>(
       owner_node.GetDocument(), owner_node.GetDocument().BaseURL(),
       true /* origin_clean */, owner_node.GetDocument().GetReferrerPolicy(),
       encoding);
@@ -359,8 +360,8 @@
             ").");
     return 0;
   }
-  const CSSParserContext* context =
-      CSSParserContext::CreateWithStyleSheet(contents_->ParserContext(), this);
+  const auto* context =
+      MakeGarbageCollected<CSSParserContext>(contents_->ParserContext(), this);
   StyleRuleBase* rule =
       CSSParser::ParseRule(context, contents_.Get(), rule_string);
 
diff --git a/third_party/blink/renderer/core/css/cssom/css_style_value.cc b/third_party/blink/renderer/core/css/cssom/css_style_value.cc
index 8a25124..cdf051c 100644
--- a/third_party/blink/renderer/core/css/cssom/css_style_value.cc
+++ b/third_party/blink/renderer/core/css/cssom/css_style_value.cc
@@ -12,6 +12,7 @@
 #include "third_party/blink/renderer/core/css/property_registration.h"
 #include "third_party/blink/renderer/core/style_property_shorthand.h"
 #include "third_party/blink/renderer/platform/bindings/exception_state.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -42,7 +43,7 @@
 
   const auto style_values = StyleValueFactory::FromString(
       property_id, custom_property_name, registration, value,
-      CSSParserContext::Create(*execution_context));
+      MakeGarbageCollected<CSSParserContext>(*execution_context));
   if (style_values.IsEmpty()) {
     exception_state.ThrowTypeError("The value provided ('" + value +
                                    "') could not be parsed as a '" +
diff --git a/third_party/blink/renderer/core/css/cssom/style_property_map.cc b/third_party/blink/renderer/core/css/cssom/style_property_map.cc
index 421725ee..45f6154 100644
--- a/third_party/blink/renderer/core/css/cssom/style_property_map.cc
+++ b/third_party/blink/renderer/core/css/cssom/style_property_map.cc
@@ -18,6 +18,7 @@
 #include "third_party/blink/renderer/core/css/property_registry.h"
 #include "third_party/blink/renderer/core/style_property_shorthand.h"
 #include "third_party/blink/renderer/platform/bindings/exception_state.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -129,7 +130,7 @@
       !(property_id == CSSPropertyID::kVariable && registration)) {
     return CSSParser::ParseSingleValue(
         property.PropertyID(), style_value.toString(),
-        CSSParserContext::Create(execution_context));
+        MakeGarbageCollected<CSSParserContext>(execution_context));
   }
 
   // Handle properties that use ad-hoc structures for their CSSValues:
@@ -139,7 +140,8 @@
     case CSSPropertyID::kVariable:
       if (registration &&
           style_value.GetType() != CSSStyleValue::kUnparsedType) {
-        CSSParserContext* context = CSSParserContext::Create(execution_context);
+        auto* context =
+            MakeGarbageCollected<CSSParserContext>(execution_context);
         String string =
             StyleValueToString(property, style_value, syntax_component);
         return CreateVariableReferenceValue(string, *context);
@@ -290,7 +292,8 @@
     DCHECK(value.IsString());
     const auto values = StyleValueFactory::FromString(
         property.PropertyID(), custom_property_name, registration,
-        value.GetAsString(), CSSParserContext::Create(execution_context));
+        value.GetAsString(),
+        MakeGarbageCollected<CSSParserContext>(execution_context));
     if (values.size() != 1U)
       return nullptr;
 
@@ -320,7 +323,7 @@
     return nullptr;
 
   if (property.IDEquals(CSSPropertyID::kVariable) && registration) {
-    CSSParserContext* context = CSSParserContext::Create(execution_context);
+    auto* context = MakeGarbageCollected<CSSParserContext>(execution_context);
     return CreateVariableReferenceValue(property, custom_property_name,
                                         *registration, style_values, *context);
   }
@@ -461,8 +464,8 @@
 
       if (!incoming_style_values.IsEmpty()) {
         style_values.AppendVector(incoming_style_values);
-        CSSParserContext* context =
-            CSSParserContext::Create(*execution_context);
+        auto* context =
+            MakeGarbageCollected<CSSParserContext>(*execution_context);
         result =
             CreateVariableReferenceValue(property, custom_property_name,
                                          *registration, style_values, *context);
diff --git a/third_party/blink/renderer/core/css/cssom/style_value_factory.cc b/third_party/blink/renderer/core/css/cssom/style_value_factory.cc
index 5cebbb2c..7638247 100644
--- a/third_party/blink/renderer/core/css/cssom/style_value_factory.cc
+++ b/third_party/blink/renderer/core/css/cssom/style_value_factory.cc
@@ -28,6 +28,7 @@
 #include "third_party/blink/renderer/core/css/properties/css_property.h"
 #include "third_party/blink/renderer/core/css/property_registration.h"
 #include "third_party/blink/renderer/core/style_property_shorthand.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -329,8 +330,10 @@
       style_values.push_back(*value.GetAsCSSStyleValue());
     } else {
       DCHECK(value.IsString());
-      if (!parser_context)
-        parser_context = CSSParserContext::Create(execution_context);
+      if (!parser_context) {
+        parser_context =
+            MakeGarbageCollected<CSSParserContext>(execution_context);
+      }
 
       const auto subvalues = StyleValueFactory::FromString(
           property.PropertyID(), custom_property_name, registration,
diff --git a/third_party/blink/renderer/core/css/font_face.cc b/third_party/blink/renderer/core/css/font_face.cc
index 4127521e..d7be19da 100644
--- a/third_party/blink/renderer/core/css/font_face.cc
+++ b/third_party/blink/renderer/core/css/font_face.cc
@@ -63,6 +63,7 @@
 #include "third_party/blink/renderer/platform/bindings/exception_state.h"
 #include "third_party/blink/renderer/platform/bindings/script_state.h"
 #include "third_party/blink/renderer/platform/font_family_names.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/histogram.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 #include "third_party/blink/renderer/platform/shared_buffer.h"
@@ -75,8 +76,9 @@
                               const String& value,
                               AtRuleDescriptorID descriptor_id) {
   CSSParserContext* parser_context =
-      IsA<Document>(context) ? CSSParserContext::Create(*To<Document>(context))
-                             : CSSParserContext::Create(*context);
+      IsA<Document>(context)
+          ? MakeGarbageCollected<CSSParserContext>(*To<Document>(context))
+          : MakeGarbageCollected<CSSParserContext>(*context);
   return AtRuleDescriptorParser::ParseFontFaceDescriptor(descriptor_id, value,
                                                          *parser_context);
 }
diff --git a/third_party/blink/renderer/core/css/parser/css_lazy_parsing_state.cc b/third_party/blink/renderer/core/css/parser/css_lazy_parsing_state.cc
index 9188af0..387d1f69 100644
--- a/third_party/blink/renderer/core/css/parser/css_lazy_parsing_state.cc
+++ b/third_party/blink/renderer/core/css/parser/css_lazy_parsing_state.cc
@@ -7,6 +7,7 @@
 #include "third_party/blink/renderer/core/css/parser/css_parser_token_stream.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/frame/use_counter.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -31,7 +32,7 @@
     document_ = owning_contents_->AnyOwnerDocument();
 
   if (!context_->IsDocumentHandleEqual(document_))
-    context_ = CSSParserContext::Create(context_, document_);
+    context_ = MakeGarbageCollected<CSSParserContext>(context_, document_);
   return context_;
 }
 
diff --git a/third_party/blink/renderer/core/css/parser/css_lazy_parsing_test.cc b/third_party/blink/renderer/core/css/parser/css_lazy_parsing_test.cc
index 3f398d4..152a35c 100644
--- a/third_party/blink/renderer/core/css/parser/css_lazy_parsing_test.cc
+++ b/third_party/blink/renderer/core/css/parser/css_lazy_parsing_test.cc
@@ -32,7 +32,7 @@
 };
 
 TEST_F(CSSLazyParsingTest, Simple) {
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kInsecureContext);
   StyleSheetContents* style_sheet = StyleSheetContents::Create(context);
 
@@ -46,7 +46,7 @@
 }
 
 TEST_F(CSSLazyParsingTest, LazyParseBeforeAfter) {
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kInsecureContext);
   StyleSheetContents* style_sheet = StyleSheetContents::Create(context);
 
@@ -64,7 +64,7 @@
 // dangerous API because callers will expect the set of matching rules to be
 // identical if the stylesheet is not mutated.
 TEST_F(CSSLazyParsingTest, ShouldConsiderForMatchingRulesDoesntChange1) {
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kInsecureContext);
   StyleSheetContents* style_sheet = StyleSheetContents::Create(context);
 
@@ -89,7 +89,7 @@
 // Test the same thing as above with lazy parsing off to ensure that we perform
 // the optimization where possible.
 TEST_F(CSSLazyParsingTest, ShouldConsiderForMatchingRulesSimple) {
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kInsecureContext);
   StyleSheetContents* style_sheet = StyleSheetContents::Create(context);
 
@@ -110,7 +110,7 @@
   auto dummy_holder = std::make_unique<DummyPageHolder>(IntSize(500, 500));
   Page::InsertOrdinaryPageForTesting(&dummy_holder->GetPage());
 
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kInsecureContext,
       CSSParserContext::kLiveProfile, &dummy_holder->GetDocument());
   cached_contents_ = StyleSheetContents::Create(context);
diff --git a/third_party/blink/renderer/core/css/parser/css_parser.cc b/third_party/blink/renderer/core/css/parser/css_parser.cc
index 135aa51..07e2056 100644
--- a/third_party/blink/renderer/core/css/parser/css_parser.cc
+++ b/third_party/blink/renderer/core/css/parser/css_parser.cc
@@ -5,6 +5,7 @@
 #include "third_party/blink/renderer/core/css/parser/css_parser.h"
 
 #include <memory>
+
 #include "third_party/blink/renderer/core/css/css_color_value.h"
 #include "third_party/blink/renderer/core/css/css_keyframe_rule.h"
 #include "third_party/blink/renderer/core/css/parser/css_parser_fast_paths.h"
@@ -18,6 +19,7 @@
 #include "third_party/blink/renderer/core/css/style_rule.h"
 #include "third_party/blink/renderer/core/css/style_sheet_contents.h"
 #include "third_party/blink/renderer/core/layout/layout_theme.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -119,10 +121,12 @@
   }
   CSSParserContext* context;
   if (style_sheet) {
-    context = CSSParserContext::Create(style_sheet->ParserContext(), nullptr);
+    context =
+        MakeGarbageCollected<CSSParserContext>(style_sheet->ParserContext());
     context->SetMode(parser_mode);
   } else {
-    context = CSSParserContext::Create(parser_mode, secure_context_mode);
+    context = MakeGarbageCollected<CSSParserContext>(parser_mode,
+                                                     secure_context_mode);
   }
   return ParseValue(declaration, unresolved_property, string, important,
                     context);
@@ -146,10 +150,12 @@
   CSSParserMode parser_mode = declaration->CssParserMode();
   CSSParserContext* context;
   if (style_sheet) {
-    context = CSSParserContext::Create(style_sheet->ParserContext(), nullptr);
+    context =
+        MakeGarbageCollected<CSSParserContext>(style_sheet->ParserContext());
     context->SetMode(parser_mode);
   } else {
-    context = CSSParserContext::Create(parser_mode, secure_context_mode);
+    context = MakeGarbageCollected<CSSParserContext>(parser_mode,
+                                                     secure_context_mode);
   }
   return CSSParserImpl::ParseVariableValue(declaration, property_name, registry,
                                            value, important, context,
diff --git a/third_party/blink/renderer/core/css/parser/css_parser_context.cc b/third_party/blink/renderer/core/css/parser/css_parser_context.cc
index 6b57500a..abf881dab 100644
--- a/third_party/blink/renderer/core/css/parser/css_parser_context.cc
+++ b/third_party/blink/renderer/core/css/parser/css_parser_context.cc
@@ -21,131 +21,126 @@
 
 namespace blink {
 
-// static
-CSSParserContext* CSSParserContext::Create(const ExecutionContext& context) {
-  const Referrer referrer(context.Url().StrippedForUseAsReferrer(),
-                          context.GetReferrerPolicy());
-
-  ContentSecurityPolicyDisposition policy_disposition;
-  if (ContentSecurityPolicy::ShouldBypassMainWorld(&context))
-    policy_disposition = kDoNotCheckContentSecurityPolicy;
-  else
-    policy_disposition = kCheckContentSecurityPolicy;
-
-  return MakeGarbageCollected<CSSParserContext>(
-      context.Url(), true /* origin_clean */, WTF::TextEncoding(),
-      kHTMLStandardMode, kHTMLStandardMode, kLiveProfile, referrer, true, false,
-      context.GetSecureContextMode(), policy_disposition,
-      DynamicTo<Document>(context));
+CSSParserContext::CSSParserContext(const CSSParserContext* other,
+                                   const CSSStyleSheet* style_sheet)
+    : CSSParserContext(other, CSSStyleSheet::SingleOwnerDocument(style_sheet)) {
 }
 
-// static
-CSSParserContext* CSSParserContext::CreateWithStyleSheet(
+CSSParserContext::CSSParserContext(
     const CSSParserContext* other,
-    const CSSStyleSheet* style_sheet) {
-  return CSSParserContext::Create(
-      other, CSSStyleSheet::SingleOwnerDocument(style_sheet));
-}
+    const StyleSheetContents* style_sheet_contents)
+    : CSSParserContext(
+          other,
+          StyleSheetContents::SingleOwnerDocument(style_sheet_contents)) {}
 
-// static
-CSSParserContext* CSSParserContext::CreateWithStyleSheetContents(
-    const CSSParserContext* other,
-    const StyleSheetContents* style_sheet_contents) {
-  return CSSParserContext::Create(
-      other, StyleSheetContents::SingleOwnerDocument(style_sheet_contents));
-}
+CSSParserContext::CSSParserContext(const CSSParserContext* other,
+                                   const Document* use_counter_document)
+    : CSSParserContext(other->base_url_,
+                       other->origin_clean_,
+                       other->charset_,
+                       other->mode_,
+                       other->match_mode_,
+                       other->profile_,
+                       other->referrer_,
+                       other->is_html_document_,
+                       other->use_legacy_background_size_shorthand_behavior_,
+                       other->secure_context_mode_,
+                       other->should_check_content_security_policy_,
+                       use_counter_document) {}
 
-// static
-CSSParserContext* CSSParserContext::Create(
-    const CSSParserContext* other,
-    const Document* use_counter_document) {
-  return MakeGarbageCollected<CSSParserContext>(
-      other->base_url_, other->origin_clean_, other->charset_, other->mode_,
-      other->match_mode_, other->profile_, other->referrer_,
-      other->is_html_document_,
-      other->use_legacy_background_size_shorthand_behavior_,
-      other->secure_context_mode_, other->should_check_content_security_policy_,
-      use_counter_document);
-}
-
-// static
-CSSParserContext* CSSParserContext::Create(
+CSSParserContext::CSSParserContext(
     const CSSParserContext* other,
     const KURL& base_url,
     bool origin_clean,
     network::mojom::ReferrerPolicy referrer_policy,
     const WTF::TextEncoding& charset,
-    const Document* use_counter_document) {
-  return MakeGarbageCollected<CSSParserContext>(
-      base_url, origin_clean, charset, other->mode_, other->match_mode_,
-      other->profile_,
-      Referrer(base_url.StrippedForUseAsReferrer(), referrer_policy),
-      other->is_html_document_,
-      other->use_legacy_background_size_shorthand_behavior_,
-      other->secure_context_mode_, other->should_check_content_security_policy_,
-      use_counter_document);
-}
+    const Document* use_counter_document)
+    : CSSParserContext(
+          base_url,
+          origin_clean,
+          charset,
+          other->mode_,
+          other->match_mode_,
+          other->profile_,
+          Referrer(base_url.StrippedForUseAsReferrer(), referrer_policy),
+          other->is_html_document_,
+          other->use_legacy_background_size_shorthand_behavior_,
+          other->secure_context_mode_,
+          other->should_check_content_security_policy_,
+          use_counter_document) {}
 
-// static
-CSSParserContext* CSSParserContext::Create(
-    CSSParserMode mode,
-    SecureContextMode secure_context_mode,
-    SelectorProfile profile,
-    const Document* use_counter_document) {
-  return MakeGarbageCollected<CSSParserContext>(
-      KURL(), true /* origin_clean */, WTF::TextEncoding(), mode, mode, profile,
-      Referrer(), false, false, secure_context_mode,
-      kDoNotCheckContentSecurityPolicy, use_counter_document);
-}
+CSSParserContext::CSSParserContext(CSSParserMode mode,
+                                   SecureContextMode secure_context_mode,
+                                   SelectorProfile profile,
+                                   const Document* use_counter_document)
+    : CSSParserContext(KURL(),
+                       true /* origin_clean */,
+                       WTF::TextEncoding(),
+                       mode,
+                       mode,
+                       profile,
+                       Referrer(),
+                       false,
+                       false,
+                       secure_context_mode,
+                       kDoNotCheckContentSecurityPolicy,
+                       use_counter_document) {}
 
-// static
-CSSParserContext* CSSParserContext::Create(const Document& document) {
-  return CSSParserContext::Create(
-      document, document.BaseURL(), true /* origin_clean */,
-      document.GetReferrerPolicy(), WTF::TextEncoding(), kLiveProfile);
-}
+CSSParserContext::CSSParserContext(const Document& document)
+    : CSSParserContext(document,
+                       document.BaseURL(),
+                       true /* origin_clean */,
+                       document.GetReferrerPolicy(),
+                       WTF::TextEncoding(),
+                       kLiveProfile) {}
 
-// static
-CSSParserContext* CSSParserContext::Create(
+CSSParserContext::CSSParserContext(
     const Document& document,
     const KURL& base_url_override,
     bool origin_clean,
     network::mojom::ReferrerPolicy referrer_policy_override,
     const WTF::TextEncoding& charset,
-    SelectorProfile profile) {
-  CSSParserMode mode =
-      document.InQuirksMode() ? kHTMLQuirksMode : kHTMLStandardMode;
-  CSSParserMode match_mode;
-  HTMLImportsController* imports_controller = document.ImportsController();
-  if (imports_controller && profile == kLiveProfile) {
-    match_mode = imports_controller->Master()->InQuirksMode()
+    SelectorProfile profile)
+    : CSSParserContext(
+          base_url_override,
+          origin_clean,
+          charset,
+          document.InQuirksMode() ? kHTMLQuirksMode : kHTMLStandardMode,
+          document.ImportsController() && profile == kLiveProfile
+              ? (document.ImportsController()->Master()->InQuirksMode()
                      ? kHTMLQuirksMode
-                     : kHTMLStandardMode;
-  } else {
-    match_mode = mode;
-  }
+                     : kHTMLStandardMode)
+              : document.InQuirksMode() ? kHTMLQuirksMode : kHTMLStandardMode,
+          profile,
+          Referrer(base_url_override.StrippedForUseAsReferrer(),
+                   referrer_policy_override),
+          document.IsHTMLDocument(),
+          document.GetSettings()
+              ? document.GetSettings()
+                    ->GetUseLegacyBackgroundSizeShorthandBehavior()
+              : false,
+          document.GetSecureContextMode(),
+          ContentSecurityPolicy::ShouldBypassMainWorld(&document)
+              ? kDoNotCheckContentSecurityPolicy
+              : kCheckContentSecurityPolicy,
+          &document) {}
 
-  const Referrer referrer(base_url_override.StrippedForUseAsReferrer(),
-                          referrer_policy_override);
-
-  bool use_legacy_background_size_shorthand_behavior =
-      document.GetSettings()
-          ? document.GetSettings()
-                ->GetUseLegacyBackgroundSizeShorthandBehavior()
-          : false;
-
-  ContentSecurityPolicyDisposition policy_disposition;
-  if (ContentSecurityPolicy::ShouldBypassMainWorld(&document))
-    policy_disposition = kDoNotCheckContentSecurityPolicy;
-  else
-    policy_disposition = kCheckContentSecurityPolicy;
-
-  return MakeGarbageCollected<CSSParserContext>(
-      base_url_override, origin_clean, charset, mode, match_mode, profile,
-      referrer, document.IsHTMLDocument(),
-      use_legacy_background_size_shorthand_behavior,
-      document.GetSecureContextMode(), policy_disposition, &document);
-}
+CSSParserContext::CSSParserContext(const ExecutionContext& context)
+    : CSSParserContext(context.Url(),
+                       true /* origin_clean */,
+                       WTF::TextEncoding(),
+                       kHTMLStandardMode,
+                       kHTMLStandardMode,
+                       kLiveProfile,
+                       Referrer(context.Url().StrippedForUseAsReferrer(),
+                                context.GetReferrerPolicy()),
+                       true,
+                       false,
+                       context.GetSecureContextMode(),
+                       ContentSecurityPolicy::ShouldBypassMainWorld(&context)
+                           ? kDoNotCheckContentSecurityPolicy
+                           : kCheckContentSecurityPolicy,
+                       DynamicTo<Document>(context)) {}
 
 CSSParserContext::CSSParserContext(
     const KURL& base_url,
@@ -196,7 +191,8 @@
           ? *secure_strict_context_pool
           : *strict_context_pool;
   if (!context) {
-    context = CSSParserContext::Create(kHTMLStandardMode, secure_context_mode);
+    context = MakeGarbageCollected<CSSParserContext>(kHTMLStandardMode,
+                                                     secure_context_mode);
     context.RegisterAsStaticReference();
   }
 
diff --git a/third_party/blink/renderer/core/css/parser/css_parser_context.h b/third_party/blink/renderer/core/css/parser/css_parser_context.h
index ddc715d..d6f870b4 100644
--- a/third_party/blink/renderer/core/css/parser/css_parser_context.h
+++ b/third_party/blink/renderer/core/css/parser/css_parser_context.h
@@ -29,42 +29,36 @@
   // https://drafts.csswg.org/selectors/#profiles
   enum SelectorProfile { kLiveProfile, kSnapshotProfile };
 
-  // All three of these factories copy the context and override the current
+  // All three of these constructors copy the context and override the current
   // Document handle used for UseCounter.
-  static CSSParserContext* CreateWithStyleSheet(const CSSParserContext*,
-                                                const CSSStyleSheet*);
-  static CSSParserContext* CreateWithStyleSheetContents(
-      const CSSParserContext*,
-      const StyleSheetContents*);
+  CSSParserContext(const CSSParserContext*, const CSSStyleSheet*);
+  CSSParserContext(const CSSParserContext*, const StyleSheetContents*);
   // FIXME: This constructor shouldn't exist if we properly piped the UseCounter
   // through the CSS subsystem. Currently the UseCounter life time is too crazy
   // and we need a way to override it.
-  static CSSParserContext* Create(const CSSParserContext* other,
-                                  const Document* use_counter_document);
+  CSSParserContext(const CSSParserContext* other,
+                   const Document* use_counter_document = nullptr);
 
-  static CSSParserContext* Create(
-      const CSSParserContext* other,
-      const KURL& base_url_override,
-      bool origin_clean,
-      network::mojom::ReferrerPolicy referrer_policy_override,
-      const WTF::TextEncoding& charset_override,
-      const Document* use_counter_document);
+  CSSParserContext(const CSSParserContext* other,
+                   const KURL& base_url_override,
+                   bool origin_clean,
+                   network::mojom::ReferrerPolicy referrer_policy_override,
+                   const WTF::TextEncoding& charset_override,
+                   const Document* use_counter_document);
+  CSSParserContext(CSSParserMode,
+                   SecureContextMode,
+                   SelectorProfile = kLiveProfile,
+                   const Document* use_counter_document = nullptr);
+  CSSParserContext(const Document&);
+  CSSParserContext(const Document&,
+                   const KURL& base_url_override,
+                   bool origin_clean,
+                   network::mojom::ReferrerPolicy referrer_policy_override,
+                   const WTF::TextEncoding& charset = WTF::TextEncoding(),
+                   SelectorProfile = kLiveProfile);
 
-  static CSSParserContext* Create(
-      CSSParserMode,
-      SecureContextMode,
-      SelectorProfile = kLiveProfile,
-      const Document* use_counter_document = nullptr);
-  static CSSParserContext* Create(const Document&);
-  static CSSParserContext* Create(
-      const Document&,
-      const KURL& base_url_override,
-      bool origin_clean,
-      network::mojom::ReferrerPolicy referrer_policy_override,
-      const WTF::TextEncoding& charset = WTF::TextEncoding(),
-      SelectorProfile = kLiveProfile);
   // This is used for workers, where we don't have a document.
-  static CSSParserContext* Create(const ExecutionContext&);
+  CSSParserContext(const ExecutionContext& context);
 
   CSSParserContext(const KURL& base_url,
                    bool origin_clean,
diff --git a/third_party/blink/renderer/core/css/parser/css_parser_impl.cc b/third_party/blink/renderer/core/css/parser/css_parser_impl.cc
index ebce2aa..6567257 100644
--- a/third_party/blink/renderer/core/css/parser/css_parser_impl.cc
+++ b/third_party/blink/renderer/core/css/parser/css_parser_impl.cc
@@ -35,6 +35,7 @@
 #include "third_party/blink/renderer/core/dom/element.h"
 #include "third_party/blink/renderer/core/frame/deprecation.h"
 #include "third_party/blink/renderer/core/frame/use_counter.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/instrumentation/tracing/trace_event.h"
 
 namespace blink {
@@ -179,7 +180,7 @@
     const String& string,
     Element* element) {
   Document& document = element->GetDocument();
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       document.ElementSheet().Contents()->ParserContext(), &document);
   CSSParserMode mode = element->IsHTMLElement() && !document.InQuirksMode()
                            ? kHTMLStandardMode
@@ -196,8 +197,8 @@
     const String& string,
     CSSParserMode parser_mode,
     SecureContextMode secure_context_mode) {
-  CSSParserContext* context =
-      CSSParserContext::Create(parser_mode, secure_context_mode);
+  auto* context =
+      MakeGarbageCollected<CSSParserContext>(parser_mode, secure_context_mode);
   CSSParserImpl parser(context);
   CSSTokenizer tokenizer(string);
   CSSParserTokenStream stream(tokenizer);
diff --git a/third_party/blink/renderer/core/css/parser/css_parser_proto_fuzzer.cc b/third_party/blink/renderer/core/css/parser/css_parser_proto_fuzzer.cc
index 0b3fbab65..6cc8e02d 100644
--- a/third_party/blink/renderer/core/css/parser/css_parser_proto_fuzzer.cc
+++ b/third_party/blink/renderer/core/css/parser/css_parser_proto_fuzzer.cc
@@ -11,6 +11,7 @@
 #include "third_party/blink/renderer/core/css/parser/css.pb.h"
 #include "third_party/blink/renderer/core/css/parser/css_parser.h"
 #include "third_party/blink/renderer/core/css/style_sheet_contents.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/testing/blink_fuzzer_test_support.h"
 #include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
 
@@ -50,7 +51,7 @@
     defer_property_parsing = blink::CSSDeferPropertyParsing::kYes;
   else
     defer_property_parsing = blink::CSSDeferPropertyParsing::kNo;
-  blink::CSSParserContext* context = blink::CSSParserContext::Create(
+  auto* context = blink::MakeGarbageCollected<blink::CSSParserContext>(
       mode, secure_context_mode, selector_profile);
 
   blink::StyleSheetContents* style_sheet =
diff --git a/third_party/blink/renderer/core/css/parser/css_property_parser_test.cc b/third_party/blink/renderer/core/css/parser/css_property_parser_test.cc
index 0af6b22..d60910e 100644
--- a/third_party/blink/renderer/core/css/parser/css_property_parser_test.cc
+++ b/third_party/blink/renderer/core/css/parser/css_property_parser_test.cc
@@ -14,6 +14,7 @@
 #include "third_party/blink/renderer/core/css/style_sheet_contents.h"
 #include "third_party/blink/renderer/core/html/html_html_element.h"
 #include "third_party/blink/renderer/core/testing/dummy_page_holder.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/testing/runtime_enabled_features_test_helpers.h"
 
 namespace blink {
@@ -309,7 +310,7 @@
   auto dummy_holder = std::make_unique<DummyPageHolder>(IntSize(500, 500));
   Document* doc = &dummy_holder->GetDocument();
   Page::InsertOrdinaryPageForTesting(&dummy_holder->GetPage());
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kSecureContext,
       CSSParserContext::kLiveProfile, doc);
 
@@ -439,9 +440,9 @@
   void TearDown() override { dummy_page_holder_ = nullptr; }
 
   void ParseProperty(CSSPropertyID property, const char* value_string) {
-    const CSSValue* value =
-        CSSParser::ParseSingleValue(property, String(value_string),
-                                    CSSParserContext::Create(GetDocument()));
+    const CSSValue* value = CSSParser::ParseSingleValue(
+        property, String(value_string),
+        MakeGarbageCollected<CSSParserContext>(GetDocument()));
     DCHECK(value);
   }
 
diff --git a/third_party/blink/renderer/core/css/parser/css_selector_parser_test.cc b/third_party/blink/renderer/core/css/parser/css_selector_parser_test.cc
index 47789e85..c45dd7c7 100644
--- a/third_party/blink/renderer/core/css/parser/css_selector_parser_test.cc
+++ b/third_party/blink/renderer/core/css/parser/css_selector_parser_test.cc
@@ -11,6 +11,7 @@
 #include "third_party/blink/renderer/core/css/style_sheet_contents.h"
 #include "third_party/blink/renderer/core/frame/use_counter.h"
 #include "third_party/blink/renderer/core/testing/dummy_page_holder.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -129,8 +130,8 @@
     CSSParserTokenRange range(tokens);
     CSSSelectorList list = CSSSelectorParser::ParseSelector(
         range,
-        CSSParserContext::Create(kHTMLStandardMode,
-                                 SecureContextMode::kInsecureContext),
+        MakeGarbageCollected<CSSParserContext>(
+            kHTMLStandardMode, SecureContextMode::kInsecureContext),
         nullptr);
     EXPECT_EQ(test_case[1], list.SelectorsText());
   }
@@ -152,8 +153,8 @@
     CSSParserTokenRange range(tokens);
     CSSSelectorList list = CSSSelectorParser::ParseSelector(
         range,
-        CSSParserContext::Create(kHTMLStandardMode,
-                                 SecureContextMode::kInsecureContext),
+        MakeGarbageCollected<CSSParserContext>(
+            kHTMLStandardMode, SecureContextMode::kInsecureContext),
         nullptr);
     EXPECT_FALSE(list.IsValid());
   }
@@ -174,8 +175,8 @@
     CSSParserTokenRange range(tokens);
     CSSSelectorList list = CSSSelectorParser::ParseSelector(
         range,
-        CSSParserContext::Create(kHTMLStandardMode,
-                                 SecureContextMode::kInsecureContext),
+        MakeGarbageCollected<CSSParserContext>(
+            kHTMLStandardMode, SecureContextMode::kInsecureContext),
         nullptr);
     EXPECT_TRUE(list.IsValid());
   }
@@ -208,8 +209,8 @@
     CSSParserTokenRange range(tokens);
     CSSSelectorList list = CSSSelectorParser::ParseSelector(
         range,
-        CSSParserContext::Create(kHTMLStandardMode,
-                                 SecureContextMode::kInsecureContext),
+        MakeGarbageCollected<CSSParserContext>(
+            kHTMLStandardMode, SecureContextMode::kInsecureContext),
         nullptr);
     EXPECT_FALSE(list.IsValid());
   }
@@ -227,8 +228,8 @@
     CSSParserTokenRange range(tokens);
     CSSSelectorList list = CSSSelectorParser::ParseSelector(
         range,
-        CSSParserContext::Create(kUASheetMode,
-                                 SecureContextMode::kInsecureContext),
+        MakeGarbageCollected<CSSParserContext>(
+            kUASheetMode, SecureContextMode::kInsecureContext),
         nullptr);
     EXPECT_TRUE(list.IsValid());
   }
@@ -243,8 +244,8 @@
     CSSParserTokenRange range(tokens);
     CSSSelectorList list = CSSSelectorParser::ParseSelector(
         range,
-        CSSParserContext::Create(kHTMLStandardMode,
-                                 SecureContextMode::kInsecureContext),
+        MakeGarbageCollected<CSSParserContext>(
+            kHTMLStandardMode, SecureContextMode::kInsecureContext),
         nullptr);
     EXPECT_TRUE(list.IsValid());
   }
@@ -261,8 +262,8 @@
     CSSParserTokenRange range(tokens);
     CSSSelectorList list = CSSSelectorParser::ParseSelector(
         range,
-        CSSParserContext::Create(kHTMLStandardMode,
-                                 SecureContextMode::kInsecureContext),
+        MakeGarbageCollected<CSSParserContext>(
+            kHTMLStandardMode, SecureContextMode::kInsecureContext),
         nullptr);
     EXPECT_FALSE(list.IsValid());
   }
@@ -271,7 +272,7 @@
 TEST(CSSSelectorParserTest, UnresolvedNamespacePrefix) {
   const char* test_cases[] = {"ns|div", "div ns|div", "div ns|div "};
 
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kInsecureContext);
   StyleSheetContents* sheet = StyleSheetContents::Create(context);
 
@@ -298,7 +299,7 @@
       {"ns|*::-webkit-volume-slider", "ns|*::-webkit-volume-slider"},
       {"ns|*::cue(i)", "ns|*::cue(i)"}};
 
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kInsecureContext);
   StyleSheetContents* sheet = StyleSheetContents::Create(context);
   sheet->ParserAddNamespace("ns", "http://ns.org");
@@ -318,7 +319,7 @@
 TEST(CSSSelectorParserTest, AttributeSelectorUniversalInvalid) {
   const char* test_cases[] = {"[*]", "[*|*]"};
 
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kInsecureContext);
   StyleSheetContents* sheet = StyleSheetContents::Create(context);
 
@@ -351,15 +352,15 @@
 
     CSSSelectorList author_list = CSSSelectorParser::ParseSelector(
         range,
-        CSSParserContext::Create(kHTMLStandardMode,
-                                 SecureContextMode::kInsecureContext),
+        MakeGarbageCollected<CSSParserContext>(
+            kHTMLStandardMode, SecureContextMode::kInsecureContext),
         nullptr);
     EXPECT_FALSE(author_list.IsValid());
 
     CSSSelectorList ua_list = CSSSelectorParser::ParseSelector(
         range,
-        CSSParserContext::Create(kUASheetMode,
-                                 SecureContextMode::kInsecureContext),
+        MakeGarbageCollected<CSSParserContext>(
+            kUASheetMode, SecureContextMode::kInsecureContext),
         nullptr);
     EXPECT_TRUE(ua_list.IsValid());
   }
@@ -384,7 +385,7 @@
                               ":nth-of-type(:is(.a))",
                               "::slotted(:is(.a))"};
 
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kInsecureContext);
   StyleSheetContents* sheet = StyleSheetContents::Create(context);
 
@@ -424,7 +425,7 @@
                               ":is(:first-letter)",
                               ":is(:first-line)"};
 
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kInsecureContext);
   StyleSheetContents* sheet = StyleSheetContents::Create(context);
 
@@ -458,7 +459,7 @@
                               ":nth-of-type(:where(.a))",
                               "::slotted(:where(.a))"};
 
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kInsecureContext);
   StyleSheetContents* sheet = StyleSheetContents::Create(context);
 
@@ -502,7 +503,7 @@
       {".\\212alass", u"\u212alass", SelectorValue},
       {"#\\212alass", u"\u212alass", SelectorValue}};
 
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kInsecureContext);
   StyleSheetContents* sheet = StyleSheetContents::Create(context);
 
@@ -527,7 +528,7 @@
       {".\\212aLASS", u"\u212alass", SelectorValue},
       {"#\\212aLASS", u"\u212alass", SelectorValue}};
 
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kHTMLQuirksMode, SecureContextMode::kInsecureContext);
   StyleSheetContents* sheet = StyleSheetContents::Create(context);
 
@@ -557,8 +558,8 @@
     CSSParserTokenRange range(tokens);
     CSSSelectorList list = CSSSelectorParser::ParseSelector(
         range,
-        CSSParserContext::Create(kHTMLStandardMode,
-                                 SecureContextMode::kInsecureContext),
+        MakeGarbageCollected<CSSParserContext>(
+            kHTMLStandardMode, SecureContextMode::kInsecureContext),
         nullptr);
     EXPECT_EQ(test_case, list.SelectorsText());
   }
@@ -577,8 +578,8 @@
     CSSParserTokenRange range(tokens);
     CSSSelectorList list = CSSSelectorParser::ParseSelector(
         range,
-        CSSParserContext::Create(kHTMLStandardMode,
-                                 SecureContextMode::kInsecureContext),
+        MakeGarbageCollected<CSSParserContext>(
+            kHTMLStandardMode, SecureContextMode::kInsecureContext),
         nullptr);
     EXPECT_EQ(test_case, list.SelectorsText());
   }
@@ -588,7 +589,7 @@
   auto dummy_holder = std::make_unique<DummyPageHolder>(IntSize(500, 500));
   Document* doc = &dummy_holder->GetDocument();
   Page::InsertOrdinaryPageForTesting(&dummy_holder->GetPage());
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kSecureContext,
       CSSParserContext::kLiveProfile, doc);
   StyleSheetContents* sheet = StyleSheetContents::Create(context);
@@ -765,7 +766,7 @@
       },
   };
 
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kInsecureContext);
   StyleSheetContents* sheet = StyleSheetContents::Create(context);
 
diff --git a/third_party/blink/renderer/core/css/properties/longhands/custom_property_test.cc b/third_party/blink/renderer/core/css/properties/longhands/custom_property_test.cc
index 6ec1e0a..24cc6ba 100644
--- a/third_party/blink/renderer/core/css/properties/longhands/custom_property_test.cc
+++ b/third_party/blink/renderer/core/css/properties/longhands/custom_property_test.cc
@@ -12,6 +12,7 @@
 #include "third_party/blink/renderer/core/dom/node_computed_style.h"
 #include "third_party/blink/renderer/core/html/html_element.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -41,7 +42,7 @@
     CSSTokenizer tokenizer(value);
     const auto tokens = tokenizer.TokenizeToEOF();
     CSSParserTokenRange range(tokens);
-    CSSParserContext* context = CSSParserContext::Create(GetDocument());
+    auto* context = MakeGarbageCollected<CSSParserContext>(GetDocument());
     return property.ParseSingleValue(range, *context, local_context);
   }
 };
diff --git a/third_party/blink/renderer/core/css/resolver/css_variable_resolver_test.cc b/third_party/blink/renderer/core/css/resolver/css_variable_resolver_test.cc
index 1c60d40..8bdbfd10 100644
--- a/third_party/blink/renderer/core/css/resolver/css_variable_resolver_test.cc
+++ b/third_party/blink/renderer/core/css/resolver/css_variable_resolver_test.cc
@@ -24,6 +24,7 @@
 #include "third_party/blink/renderer/core/html/html_element.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/wtf/text/string_builder.h"
 
 namespace blink {
@@ -75,14 +76,15 @@
       const String& value) {
     const auto tokens = CSSTokenizer(value).TokenizeToEOF();
     return CSSVariableParser::ParseDeclarationValue(
-        name, tokens, false, *CSSParserContext::Create(GetDocument()));
+        name, tokens, false,
+        *MakeGarbageCollected<CSSParserContext>(GetDocument()));
   }
 
   const CSSVariableReferenceValue* CreateVariableReference(
       const String& value) {
     const auto tokens = CSSTokenizer(value).TokenizeToEOF();
 
-    const CSSParserContext* context = CSSParserContext::Create(GetDocument());
+    const auto* context = MakeGarbageCollected<CSSParserContext>(GetDocument());
     const bool is_animation_tainted = false;
     const bool needs_variable_resolution = true;
 
@@ -289,7 +291,7 @@
   ASSERT_TRUE(token_syntax);
   String initial_value_str("foo");
   const auto tokens = CSSTokenizer(initial_value_str).TokenizeToEOF();
-  const CSSParserContext* context = CSSParserContext::Create(GetDocument());
+  const auto* context = MakeGarbageCollected<CSSParserContext>(GetDocument());
   const CSSValue* initial_value =
       token_syntax->Parse(CSSParserTokenRange(tokens), context, false);
   ASSERT_TRUE(initial_value);
diff --git a/third_party/blink/renderer/core/css/resolver/selector_filter_parent_scope_test.cc b/third_party/blink/renderer/core/css/resolver/selector_filter_parent_scope_test.cc
index 3df1f62..068f3a2 100644
--- a/third_party/blink/renderer/core/css/resolver/selector_filter_parent_scope_test.cc
+++ b/third_party/blink/renderer/core/css/resolver/selector_filter_parent_scope_test.cc
@@ -8,6 +8,7 @@
 #include "third_party/blink/renderer/core/css/parser/css_parser.h"
 #include "third_party/blink/renderer/core/html/html_element.h"
 #include "third_party/blink/renderer/core/testing/dummy_page_holder.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -38,8 +39,8 @@
     SelectorFilterParentScope::EnsureParentStackIsPushed();
 
     CSSSelectorList selectors = CSSParser::ParseSelector(
-        CSSParserContext::Create(kHTMLStandardMode,
-                                 SecureContextMode::kInsecureContext),
+        MakeGarbageCollected<CSSParserContext>(
+            kHTMLStandardMode, SecureContextMode::kInsecureContext),
         nullptr, "html, body, .match, #myId");
 
     for (const CSSSelector* selector = selectors.First(); selector;
@@ -67,8 +68,8 @@
   SelectorFilterParentScope::EnsureParentStackIsPushed();
 
   CSSSelectorList selectors = CSSParser::ParseSelector(
-      CSSParserContext::Create(kHTMLStandardMode,
-                               SecureContextMode::kInsecureContext),
+      MakeGarbageCollected<CSSParserContext>(
+          kHTMLStandardMode, SecureContextMode::kInsecureContext),
       nullptr, "html, body, div, span, .x, #y");
 
   for (const CSSSelector* selector = selectors.First(); selector;
diff --git a/third_party/blink/renderer/core/css/selector_query.cc b/third_party/blink/renderer/core/css/selector_query.cc
index b941e07..5d41921 100644
--- a/third_party/blink/renderer/core/css/selector_query.cc
+++ b/third_party/blink/renderer/core/css/selector_query.cc
@@ -40,6 +40,7 @@
 #include "third_party/blink/renderer/core/dom/static_node_list.h"
 #include "third_party/blink/renderer/core/html_names.h"
 #include "third_party/blink/renderer/platform/bindings/exception_state.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 // Uncomment to run the SelectorQueryTests for stats in a release build.
 // #define RELEASE_QUERY_STATS
@@ -533,7 +534,7 @@
     return it->value.get();
 
   CSSSelectorList selector_list = CSSParser::ParseSelector(
-      CSSParserContext::Create(
+      MakeGarbageCollected<CSSParserContext>(
           document, document.BaseURL(), true /* origin_clean */,
           document.GetReferrerPolicy(), WTF::TextEncoding(),
           CSSParserContext::kSnapshotProfile),
diff --git a/third_party/blink/renderer/core/css/selector_query_test.cc b/third_party/blink/renderer/core/css/selector_query_test.cc
index f33c08bb..1931b0df 100644
--- a/third_party/blink/renderer/core/css/selector_query_test.cc
+++ b/third_party/blink/renderer/core/css/selector_query_test.cc
@@ -71,10 +71,10 @@
       "<body><style>span::before { content: 'X' }</style><span></span></body>");
 
   CSSSelectorList selector_list = CSSParser::ParseSelector(
-      CSSParserContext::Create(*document, NullURL(), true /* origin_clean */,
-                               network::mojom::ReferrerPolicy::kDefault,
-                               WTF::TextEncoding(),
-                               CSSParserContext::kSnapshotProfile),
+      MakeGarbageCollected<CSSParserContext>(
+          *document, NullURL(), true /* origin_clean */,
+          network::mojom::ReferrerPolicy::kDefault, WTF::TextEncoding(),
+          CSSParserContext::kSnapshotProfile),
       nullptr, "span::before");
   std::unique_ptr<SelectorQuery> query =
       SelectorQuery::Adopt(std::move(selector_list));
@@ -82,10 +82,10 @@
   EXPECT_EQ(nullptr, elm);
 
   selector_list = CSSParser::ParseSelector(
-      CSSParserContext::Create(*document, NullURL(), true /* origin_clean */,
-                               network::mojom::ReferrerPolicy::kDefault,
-                               WTF::TextEncoding(),
-                               CSSParserContext::kSnapshotProfile),
+      MakeGarbageCollected<CSSParserContext>(
+          *document, NullURL(), true /* origin_clean */,
+          network::mojom::ReferrerPolicy::kDefault, WTF::TextEncoding(),
+          CSSParserContext::kSnapshotProfile),
       nullptr, "span");
   query = SelectorQuery::Adopt(std::move(selector_list));
   elm = query->QueryFirst(*document);
@@ -102,10 +102,10 @@
   document->body()->BeginParsingChildren();
 
   CSSSelectorList selector_list = CSSParser::ParseSelector(
-      CSSParserContext::Create(*document, NullURL(), true /* origin_clean */,
-                               network::mojom::ReferrerPolicy::kDefault,
-                               WTF::TextEncoding(),
-                               CSSParserContext::kSnapshotProfile),
+      MakeGarbageCollected<CSSParserContext>(
+          *document, NullURL(), true /* origin_clean */,
+          network::mojom::ReferrerPolicy::kDefault, WTF::TextEncoding(),
+          CSSParserContext::kSnapshotProfile),
       nullptr, "p:last-of-type");
   std::unique_ptr<SelectorQuery> query =
       SelectorQuery::Adopt(std::move(selector_list));
diff --git a/third_party/blink/renderer/core/css/style_engine.cc b/third_party/blink/renderer/core/css/style_engine.cc
index bc8d618..c05c938 100644
--- a/third_party/blink/renderer/core/css/style_engine.cc
+++ b/third_party/blink/renderer/core/css/style_engine.cc
@@ -71,6 +71,7 @@
 #include "third_party/blink/renderer/core/svg/svg_style_element.h"
 #include "third_party/blink/renderer/platform/fonts/font_cache.h"
 #include "third_party/blink/renderer/platform/fonts/font_selector.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/instrumentation/tracing/trace_event.h"
 #include "third_party/blink/renderer/platform/wtf/vector.h"
 
@@ -197,8 +198,8 @@
   if (inspector_style_sheet_)
     return *inspector_style_sheet_;
 
-  StyleSheetContents* contents =
-      StyleSheetContents::Create(CSSParserContext::Create(*document_));
+  StyleSheetContents* contents = StyleSheetContents::Create(
+      MakeGarbageCollected<CSSParserContext>(*document_));
   inspector_style_sheet_ = CSSStyleSheet::Create(contents, *document_);
   MarkDocumentDirty();
   // TODO(futhark@chromium.org): Making the active stylesheets up-to-date here
diff --git a/third_party/blink/renderer/core/css/style_engine_test.cc b/third_party/blink/renderer/core/css/style_engine_test.cc
index d138d970..6fe7eb4 100644
--- a/third_party/blink/renderer/core/css/style_engine_test.cc
+++ b/third_party/blink/renderer/core/css/style_engine_test.cc
@@ -82,7 +82,7 @@
 StyleEngineTest::ScheduleInvalidationsForRules(TreeScope& tree_scope,
                                                const String& css_text) {
   StyleSheetContents* sheet =
-      StyleSheetContents::Create(CSSParserContext::Create(
+      StyleSheetContents::Create(MakeGarbageCollected<CSSParserContext>(
           kHTMLStandardMode, SecureContextMode::kInsecureContext));
   sheet->ParseString(css_text);
   HeapHashSet<Member<RuleSet>> rule_sets;
@@ -97,8 +97,8 @@
 }
 
 TEST_F(StyleEngineTest, DocumentDirtyAfterInject) {
-  StyleSheetContents* parsed_sheet =
-      StyleSheetContents::Create(CSSParserContext::Create(GetDocument()));
+  StyleSheetContents* parsed_sheet = StyleSheetContents::Create(
+      MakeGarbageCollected<CSSParserContext>(GetDocument()));
   parsed_sheet->ParseString("div {}");
   GetStyleEngine().InjectSheet("", parsed_sheet);
   EXPECT_FALSE(IsDocumentStyleSheetCollectionClean());
@@ -160,8 +160,8 @@
 
   const unsigned initial_count = GetStyleEngine().StyleForElementCount();
 
-  StyleSheetContents* green_parsed_sheet =
-      StyleSheetContents::Create(CSSParserContext::Create(GetDocument()));
+  StyleSheetContents* green_parsed_sheet = StyleSheetContents::Create(
+      MakeGarbageCollected<CSSParserContext>(GetDocument()));
   green_parsed_sheet->ParseString(
       "#t1 { color: green !important }"
       "#t2 { color: white !important }"
@@ -186,8 +186,8 @@
   EXPECT_EQ(MakeRGB(0, 0, 0), t3->GetComputedStyle()->VisitedDependentColor(
                                   GetCSSPropertyColor()));
 
-  StyleSheetContents* blue_parsed_sheet =
-      StyleSheetContents::Create(CSSParserContext::Create(GetDocument()));
+  StyleSheetContents* blue_parsed_sheet = StyleSheetContents::Create(
+      MakeGarbageCollected<CSSParserContext>(GetDocument()));
   blue_parsed_sheet->ParseString(
       "#t1 { color: blue !important }"
       "#t2 { color: silver }"
@@ -264,8 +264,8 @@
   ASSERT_EQ(capabilities.slope,
             FontSelectionRange({NormalSlopeValue(), NormalSlopeValue()}));
 
-  StyleSheetContents* font_face_parsed_sheet =
-      StyleSheetContents::Create(CSSParserContext::Create(GetDocument()));
+  StyleSheetContents* font_face_parsed_sheet = StyleSheetContents::Create(
+      MakeGarbageCollected<CSSParserContext>(GetDocument()));
   font_face_parsed_sheet->ParseString(
       "@font-face {"
       " font-family: 'Cool Font';"
@@ -345,8 +345,8 @@
   ASSERT_FALSE(GetStyleEngine().Resolver()->FindKeyframesRule(
       t5, AtomicString("dummy-animation")));
 
-  StyleSheetContents* keyframes_parsed_sheet =
-      StyleSheetContents::Create(CSSParserContext::Create(GetDocument()));
+  StyleSheetContents* keyframes_parsed_sheet = StyleSheetContents::Create(
+      MakeGarbageCollected<CSSParserContext>(GetDocument()));
   keyframes_parsed_sheet->ParseString("@keyframes dummy-animation { from {} }");
   StyleSheetKey keyframes_key("keyframes");
   GetStyleEngine().InjectSheet(keyframes_key, keyframes_parsed_sheet,
@@ -405,7 +405,8 @@
       t7->GetComputedStyle()->VisitedDependentColor(GetCSSPropertyColor()));
 
   StyleSheetContents* custom_properties_parsed_sheet =
-      StyleSheetContents::Create(CSSParserContext::Create(GetDocument()));
+      StyleSheetContents::Create(
+          MakeGarbageCollected<CSSParserContext>(GetDocument()));
   custom_properties_parsed_sheet->ParseString(
       ":root {"
       " --stop-color: red !important;"
@@ -444,8 +445,8 @@
       MakeRGB(255, 255, 255),
       t8->GetComputedStyle()->VisitedDependentColor(GetCSSPropertyColor()));
 
-  StyleSheetContents* media_queries_parsed_sheet =
-      StyleSheetContents::Create(CSSParserContext::Create(GetDocument()));
+  StyleSheetContents* media_queries_parsed_sheet = StyleSheetContents::Create(
+      MakeGarbageCollected<CSSParserContext>(GetDocument()));
   media_queries_parsed_sheet->ParseString(
       "@media screen {"
       " #t8 {"
@@ -498,8 +499,8 @@
   EXPECT_EQ(MakeRGB(0, 0, 0), t10->GetComputedStyle()->VisitedDependentColor(
                                    GetCSSPropertyColor()));
 
-  StyleSheetContents* parsed_author_sheet =
-      StyleSheetContents::Create(CSSParserContext::Create(GetDocument()));
+  StyleSheetContents* parsed_author_sheet = StyleSheetContents::Create(
+      MakeGarbageCollected<CSSParserContext>(GetDocument()));
   parsed_author_sheet->ParseString(
       "#t9 {"
       " color: green;"
@@ -540,8 +541,8 @@
       MakeRGB(255, 255, 255),
       t11->GetComputedStyle()->VisitedDependentColor(GetCSSPropertyColor()));
 
-  StyleSheetContents* parsed_removable_red_sheet =
-      StyleSheetContents::Create(CSSParserContext::Create(GetDocument()));
+  StyleSheetContents* parsed_removable_red_sheet = StyleSheetContents::Create(
+      MakeGarbageCollected<CSSParserContext>(GetDocument()));
   parsed_removable_red_sheet->ParseString("#t11 { color: red !important; }");
   StyleSheetKey removable_red_sheet_key("removable_red_sheet");
   GetStyleEngine().InjectSheet(removable_red_sheet_key,
@@ -553,8 +554,8 @@
   EXPECT_EQ(MakeRGB(255, 0, 0), t11->GetComputedStyle()->VisitedDependentColor(
                                      GetCSSPropertyColor()));
 
-  StyleSheetContents* parsed_removable_green_sheet =
-      StyleSheetContents::Create(CSSParserContext::Create(GetDocument()));
+  StyleSheetContents* parsed_removable_green_sheet = StyleSheetContents::Create(
+      MakeGarbageCollected<CSSParserContext>(GetDocument()));
   parsed_removable_green_sheet->ParseString(
       "#t11 { color: green !important; }");
   StyleSheetKey removable_green_sheet_key("removable_green_sheet");
@@ -567,8 +568,8 @@
   EXPECT_EQ(MakeRGB(0, 128, 0), t11->GetComputedStyle()->VisitedDependentColor(
                                      GetCSSPropertyColor()));
 
-  StyleSheetContents* parsed_removable_red_sheet2 =
-      StyleSheetContents::Create(CSSParserContext::Create(GetDocument()));
+  StyleSheetContents* parsed_removable_red_sheet2 = StyleSheetContents::Create(
+      MakeGarbageCollected<CSSParserContext>(GetDocument()));
   parsed_removable_red_sheet2->ParseString("#t11 { color: red !important; }");
   GetStyleEngine().InjectSheet(removable_red_sheet_key,
                                parsed_removable_red_sheet2,
@@ -632,8 +633,8 @@
   EXPECT_TRUE(cache->Get(font_description, "Author"));
   EXPECT_FALSE(cache->Get(font_description, "User"));
 
-  StyleSheetContents* user_sheet =
-      StyleSheetContents::Create(CSSParserContext::Create(GetDocument()));
+  StyleSheetContents* user_sheet = StyleSheetContents::Create(
+      MakeGarbageCollected<CSSParserContext>(GetDocument()));
   user_sheet->ParseString(
       "@font-face {"
       "  font-family: 'User';"
diff --git a/third_party/blink/renderer/core/css/style_rule_import.cc b/third_party/blink/renderer/core/css/style_rule_import.cc
index 53df25a2..119adfa5 100644
--- a/third_party/blink/renderer/core/css/style_rule_import.cc
+++ b/third_party/blink/renderer/core/css/style_rule_import.cc
@@ -25,6 +25,7 @@
 #include "third_party/blink/renderer/core/css/style_sheet_contents.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/loader/resource/css_style_sheet_resource.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/loader/fetch/fetch_initiator_type_names.h"
 #include "third_party/blink/renderer/platform/loader/fetch/fetch_parameters.h"
 #include "third_party/blink/renderer/platform/loader/fetch/resource_fetcher.h"
@@ -73,7 +74,7 @@
     document = parent_style_sheet_->SingleOwnerDocument();
     context = parent_style_sheet_->ParserContext();
   }
-  context = CSSParserContext::Create(
+  context = MakeGarbageCollected<CSSParserContext>(
       context, cached_style_sheet->GetResponse().ResponseUrl(),
       cached_style_sheet->GetResponse().IsCorsSameOrigin(),
       cached_style_sheet->GetReferrerPolicy(), cached_style_sheet->Encoding(),
diff --git a/third_party/blink/renderer/core/css/style_sheet_contents.cc b/third_party/blink/renderer/core/css/style_sheet_contents.cc
index 9585cc1..b971c12 100644
--- a/third_party/blink/renderer/core/css/style_sheet_contents.cc
+++ b/third_party/blink/renderer/core/css/style_sheet_contents.cc
@@ -32,6 +32,7 @@
 #include "third_party/blink/renderer/core/frame/use_counter.h"
 #include "third_party/blink/renderer/core/inspector/inspector_trace_events.h"
 #include "third_party/blink/renderer/core/loader/resource/css_style_sheet_resource.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/instrumentation/tracing/trace_event.h"
 #include "third_party/blink/renderer/platform/weborigin/security_origin.h"
 
@@ -343,8 +344,8 @@
     source_map_url_ = response.HttpHeaderField(http_names::kXSourceMap);
   }
 
-  const CSSParserContext* context =
-      CSSParserContext::CreateWithStyleSheetContents(ParserContext(), this);
+  const auto* context =
+      MakeGarbageCollected<CSSParserContext>(ParserContext(), this);
   CSSParser::ParseSheet(context, this, sheet_text,
                         CSSDeferPropertyParsing::kYes);
 }
@@ -359,8 +360,8 @@
     const String& sheet_text,
     const TextPosition& start_position,
     bool allow_import_rules) {
-  const CSSParserContext* context =
-      CSSParserContext::CreateWithStyleSheetContents(ParserContext(), this);
+  const auto* context =
+      MakeGarbageCollected<CSSParserContext>(ParserContext(), this);
   return CSSParser::ParseSheet(context, this, sheet_text,
                                CSSDeferPropertyParsing::kNo,
                                allow_import_rules);
diff --git a/third_party/blink/renderer/core/css/style_sheet_contents_fuzzer.cc b/third_party/blink/renderer/core/css/style_sheet_contents_fuzzer.cc
index 374f2aa..4807d84 100644
--- a/third_party/blink/renderer/core/css/style_sheet_contents_fuzzer.cc
+++ b/third_party/blink/renderer/core/css/style_sheet_contents_fuzzer.cc
@@ -4,6 +4,7 @@
 
 #include "third_party/blink/renderer/core/css/style_sheet_contents.h"
 
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/testing/blink_fuzzer_test_support.h"
 #include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
 
@@ -17,7 +18,7 @@
   const int is_secure_context_mode =
       (std::hash<size_t>()(data_hash) & std::numeric_limits<int>::max()) % 2;
 
-  blink::CSSParserContext* context = blink::CSSParserContext::Create(
+  auto* context = blink::MakeGarbageCollected<blink::CSSParserContext>(
       is_strict_mode ? blink::kHTMLStandardMode : blink::kHTMLQuirksMode,
       is_secure_context_mode ? blink::SecureContextMode::kSecureContext
                              : blink::SecureContextMode::kInsecureContext);
diff --git a/third_party/blink/renderer/core/css/style_sheet_contents_test.cc b/third_party/blink/renderer/core/css/style_sheet_contents_test.cc
index a42c0025..1bc890b 100644
--- a/third_party/blink/renderer/core/css/style_sheet_contents_test.cc
+++ b/third_party/blink/renderer/core/css/style_sheet_contents_test.cc
@@ -6,11 +6,12 @@
 
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/renderer/core/css/parser/css_parser.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
 TEST(StyleSheetContentsTest, InsertMediaRule) {
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kInsecureContext);
 
   StyleSheetContents* style_sheet = StyleSheetContents::Create(context);
@@ -34,7 +35,7 @@
 }
 
 TEST(StyleSheetContentsTest, InsertFontFaceRule) {
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kInsecureContext);
 
   StyleSheetContents* style_sheet = StyleSheetContents::Create(context);
@@ -58,7 +59,7 @@
 }
 
 TEST(StyleSheetContentsTest, HasViewportRule) {
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kInsecureContext);
 
   StyleSheetContents* style_sheet = StyleSheetContents::Create(context);
@@ -68,7 +69,7 @@
 }
 
 TEST(StyleSheetContentsTest, HasViewportRuleAfterInsertion) {
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kInsecureContext);
 
   StyleSheetContents* style_sheet = StyleSheetContents::Create(context);
@@ -85,7 +86,7 @@
 }
 
 TEST(StyleSheetContentsTest, HasViewportRuleAfterInsertionIntoMediaRule) {
-  CSSParserContext* context = CSSParserContext::Create(
+  auto* context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kInsecureContext);
 
   StyleSheetContents* style_sheet = StyleSheetContents::Create(context);
diff --git a/third_party/blink/renderer/core/css/threaded/css_parser_threaded_test.cc b/third_party/blink/renderer/core/css/threaded/css_parser_threaded_test.cc
index b08b970f..89a6ea3 100644
--- a/third_party/blink/renderer/core/css/threaded/css_parser_threaded_test.cc
+++ b/third_party/blink/renderer/core/css/threaded/css_parser_threaded_test.cc
@@ -9,6 +9,7 @@
 #include "third_party/blink/renderer/core/css/css_property_names.h"
 #include "third_party/blink/renderer/core/css/css_property_value_set.h"
 #include "third_party/blink/renderer/core/css/threaded/multi_threaded_test_util.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -66,7 +67,7 @@
 
 TSAN_TEST_F(CSSParserThreadedTest, FontFaceDescriptor) {
   RunOnThreads([]() {
-    CSSParserContext* ctx = CSSParserContext::Create(
+    auto* ctx = MakeGarbageCollected<CSSParserContext>(
         kCSSFontFaceRuleMode, SecureContextMode::kInsecureContext);
     const CSSValue* v = CSSParser::ParseFontFaceDescriptor(
         CSSPropertyID::kSrc, "url(myfont.ttf)", ctx);
diff --git a/third_party/blink/renderer/core/dom/child_frame_disconnector.cc b/third_party/blink/renderer/core/dom/child_frame_disconnector.cc
index b91a478..7412bbf 100644
--- a/third_party/blink/renderer/core/dom/child_frame_disconnector.cc
+++ b/third_party/blink/renderer/core/dom/child_frame_disconnector.cc
@@ -55,7 +55,7 @@
     HTMLFrameOwnerElement* owner = frame_owners_[i].Get();
     // Don't need to traverse up the tree for the first owner since no
     // script could have moved it.
-    if (!i || Root().IsShadowIncludingInclusiveAncestorOf(owner))
+    if (!i || Root().IsShadowIncludingInclusiveAncestorOf(*owner))
       owner->DisconnectContentFrame();
   }
 }
diff --git a/third_party/blink/renderer/core/dom/document.cc b/third_party/blink/renderer/core/dom/document.cc
index 0b046f7..709e8f7 100644
--- a/third_party/blink/renderer/core/dom/document.cc
+++ b/third_party/blink/renderer/core/dom/document.cc
@@ -4587,8 +4587,7 @@
   // We can't be focused if we're not in the document.
   if (!node.isConnected())
     return;
-  bool contains =
-      node.IsShadowIncludingInclusiveAncestorOf(focused_element_.Get());
+  bool contains = node.IsShadowIncludingInclusiveAncestorOf(*focused_element_);
   if (contains && (focused_element_ != &node || !among_children_only))
     ClearFocusedElement();
 }
diff --git a/third_party/blink/renderer/core/dom/element.cc b/third_party/blink/renderer/core/dom/element.cc
index 0b067e0..0000141 100644
--- a/third_party/blink/renderer/core/dom/element.cc
+++ b/third_party/blink/renderer/core/dom/element.cc
@@ -3367,7 +3367,9 @@
     return;
 
   if (AuthorShadowRoot() && AuthorShadowRoot()->delegatesFocus()) {
-    if (IsShadowIncludingInclusiveAncestorOf(GetDocument().FocusedElement()))
+    Element* focused_element = GetDocument().FocusedElement();
+    if (focused_element &&
+        IsShadowIncludingInclusiveAncestorOf(*focused_element))
       return;
 
     // Slide the focus to its inner node.
@@ -3375,7 +3377,7 @@
                          .GetPage()
                          ->GetFocusController()
                          .FindFocusableElementInShadowHost(*this);
-    if (found && IsShadowIncludingInclusiveAncestorOf(found)) {
+    if (found && IsShadowIncludingInclusiveAncestorOf(*found)) {
       found->focus(FocusParams(SelectionBehaviorOnFocus::kReset,
                                kWebFocusTypeForward, nullptr, params.options));
       return;
diff --git a/third_party/blink/renderer/core/dom/events/event.h b/third_party/blink/renderer/core/dom/events/event.h
index bce7cf1..caf97646 100644
--- a/third_party/blink/renderer/core/dom/events/event.h
+++ b/third_party/blink/renderer/core/dom/events/event.h
@@ -344,8 +344,6 @@
   // https://dom.spec.whatwg.org/#concept-event-listener-inner-invoke
   unsigned legacy_did_listeners_throw_flag_ : 1;
 
-  // This fields are effective only when
-  // CallCaptureListenersAtCapturePhaseAtShadowHosts runtime flag is enabled.
   unsigned fire_only_capture_listeners_at_target_ : 1;
   unsigned fire_only_non_capture_listeners_at_target_ : 1;
 
diff --git a/third_party/blink/renderer/core/dom/events/event_dispatcher.cc b/third_party/blink/renderer/core/dom/events/event_dispatcher.cc
index 3b6dab5..90c8500c 100644
--- a/third_party/blink/renderer/core/dom/events/event_dispatcher.cc
+++ b/third_party/blink/renderer/core/dom/events/event_dispatcher.cc
@@ -239,9 +239,6 @@
   for (wtf_size_t i = event_->GetEventPath().size() - 1; i > 0; --i) {
     const NodeEventContext& event_context = event_->GetEventPath()[i];
     if (event_context.CurrentTargetSameAsTarget()) {
-      if (!RuntimeEnabledFeatures::
-              CallCaptureListenersAtCapturePhaseAtShadowHostsEnabled())
-        continue;
       event_->SetEventPhase(Event::kAtTarget);
       event_->SetFireOnlyCaptureListenersAtTarget(true);
       event_context.HandleLocalEvents(*event_);
@@ -272,14 +269,9 @@
     if (event_context.CurrentTargetSameAsTarget()) {
       // TODO(hayato): Need to check cancelBubble() also here?
       event_->SetEventPhase(Event::kAtTarget);
-      if (RuntimeEnabledFeatures::
-              CallCaptureListenersAtCapturePhaseAtShadowHostsEnabled()) {
-        event_->SetFireOnlyNonCaptureListenersAtTarget(true);
-        event_context.HandleLocalEvents(*event_);
-        event_->SetFireOnlyNonCaptureListenersAtTarget(false);
-      } else {
-        event_context.HandleLocalEvents(*event_);
-      }
+      event_->SetFireOnlyNonCaptureListenersAtTarget(true);
+      event_context.HandleLocalEvents(*event_);
+      event_->SetFireOnlyNonCaptureListenersAtTarget(false);
     } else if (event_->bubbles() && !event_->cancelBubble()) {
       event_->SetEventPhase(Event::kBubblingPhase);
       event_context.HandleLocalEvents(*event_);
diff --git a/third_party/blink/renderer/core/dom/events/registered_event_listener.cc b/third_party/blink/renderer/core/dom/events/registered_event_listener.cc
index f2977bc..13c187c5 100644
--- a/third_party/blink/renderer/core/dom/events/registered_event_listener.cc
+++ b/third_party/blink/renderer/core/dom/events/registered_event_listener.cc
@@ -84,24 +84,14 @@
 }
 
 bool RegisteredEventListener::ShouldFire(const Event& event) const {
-  if (RuntimeEnabledFeatures::
-          CallCaptureListenersAtCapturePhaseAtShadowHostsEnabled()) {
-    if (event.FireOnlyCaptureListenersAtTarget()) {
-      DCHECK_EQ(event.eventPhase(), Event::kAtTarget);
-      return Capture();
-    }
-    if (event.FireOnlyNonCaptureListenersAtTarget()) {
-      DCHECK_EQ(event.eventPhase(), Event::kAtTarget);
-      return !Capture();
-    }
-    if (event.eventPhase() == Event::kCapturingPhase)
-      return Capture();
-    if (event.eventPhase() == Event::kBubblingPhase)
-      return !Capture();
-    return true;
+  if (event.FireOnlyCaptureListenersAtTarget()) {
+    DCHECK_EQ(event.eventPhase(), Event::kAtTarget);
+    return Capture();
   }
-  DCHECK(!event.FireOnlyCaptureListenersAtTarget());
-  DCHECK(!event.FireOnlyNonCaptureListenersAtTarget());
+  if (event.FireOnlyNonCaptureListenersAtTarget()) {
+    DCHECK_EQ(event.eventPhase(), Event::kAtTarget);
+    return !Capture();
+  }
   if (event.eventPhase() == Event::kCapturingPhase)
     return Capture();
   if (event.eventPhase() == Event::kBubblingPhase)
diff --git a/third_party/blink/renderer/core/dom/node.cc b/third_party/blink/renderer/core/dom/node.cc
index bb39343..94c87f5 100644
--- a/third_party/blink/renderer/core/dom/node.cc
+++ b/third_party/blink/renderer/core/dom/node.cc
@@ -1322,11 +1322,8 @@
   return this == node || node->IsDescendantOf(this);
 }
 
-bool Node::IsShadowIncludingInclusiveAncestorOf(const Node* node) const {
-  if (!node)
-    return false;
-
-  return this == node || IsShadowIncludingAncestorOf(*node);
+bool Node::IsShadowIncludingInclusiveAncestorOf(const Node& node) const {
+  return this == &node || IsShadowIncludingAncestorOf(node);
 }
 
 bool Node::IsShadowIncludingAncestorOf(const Node& node) const {
diff --git a/third_party/blink/renderer/core/dom/node.h b/third_party/blink/renderer/core/dom/node.h
index c4babc4d..ecdd8bf 100644
--- a/third_party/blink/renderer/core/dom/node.h
+++ b/third_party/blink/renderer/core/dom/node.h
@@ -640,8 +640,7 @@
   bool IsDescendantOf(const Node*) const;
   bool contains(const Node*) const;
   // https://dom.spec.whatwg.org/#concept-shadow-including-inclusive-ancestor
-  // TODO(tkent): The argument should be |const Node&|.
-  bool IsShadowIncludingInclusiveAncestorOf(const Node*) const;
+  bool IsShadowIncludingInclusiveAncestorOf(const Node&) const;
   // https://dom.spec.whatwg.org/#concept-shadow-including-ancestor
   bool IsShadowIncludingAncestorOf(const Node&) const;
   bool ContainsIncludingHostElements(const Node&) const;
diff --git a/third_party/blink/renderer/core/dom/node_child_removal_tracker.h b/third_party/blink/renderer/core/dom/node_child_removal_tracker.h
index aa3456ec..5b278fb 100644
--- a/third_party/blink/renderer/core/dom/node_child_removal_tracker.h
+++ b/third_party/blink/renderer/core/dom/node_child_removal_tracker.h
@@ -40,6 +40,7 @@
   explicit NodeChildRemovalTracker(Node&);
   ~NodeChildRemovalTracker();
 
+  // TODO(tkent): The argument should be |const Node&|.
   static bool IsBeingRemoved(Node*);
 
  private:
@@ -63,9 +64,11 @@
 }
 
 inline bool NodeChildRemovalTracker::IsBeingRemoved(Node* node) {
+  if (!node)
+    return false;
   for (NodeChildRemovalTracker* removal = last_; removal;
        removal = removal->Previous()) {
-    if (removal->GetNode().IsShadowIncludingInclusiveAncestorOf(node))
+    if (removal->GetNode().IsShadowIncludingInclusiveAncestorOf(*node))
       return true;
   }
 
diff --git a/third_party/blink/renderer/core/dom/processing_instruction.cc b/third_party/blink/renderer/core/dom/processing_instruction.cc
index fce0804..8eadee77 100644
--- a/third_party/blink/renderer/core/dom/processing_instruction.cc
+++ b/third_party/blink/renderer/core/dom/processing_instruction.cc
@@ -21,6 +21,7 @@
 #include "third_party/blink/renderer/core/dom/processing_instruction.h"
 
 #include <memory>
+
 #include "third_party/blink/renderer/core/css/css_style_sheet.h"
 #include "third_party/blink/renderer/core/css/media_list.h"
 #include "third_party/blink/renderer/core/css/style_engine.h"
@@ -32,6 +33,7 @@
 #include "third_party/blink/renderer/core/xml/document_xslt.h"
 #include "third_party/blink/renderer/core/xml/parser/xml_document_parser.h"  // for parseAttributes()
 #include "third_party/blink/renderer/core/xml/xsl_style_sheet.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/loader/fetch/fetch_initiator_type_names.h"
 #include "third_party/blink/renderer/platform/loader/fetch/fetch_parameters.h"
 #include "third_party/blink/renderer/platform/loader/fetch/resource_fetcher.h"
@@ -206,7 +208,7 @@
   } else {
     DCHECK(is_css_);
     CSSStyleSheetResource* style_resource = ToCSSStyleSheetResource(resource);
-    CSSParserContext* parser_context = CSSParserContext::Create(
+    auto* parser_context = MakeGarbageCollected<CSSParserContext>(
         GetDocument(), style_resource->GetResponse().ResponseUrl(),
         style_resource->GetResponse().IsCorsSameOrigin(),
         style_resource->GetReferrerPolicy(), style_resource->Encoding());
diff --git a/third_party/blink/renderer/core/editing/drag_caret.cc b/third_party/blink/renderer/core/editing/drag_caret.cc
index de2bf34..c368dd36 100644
--- a/third_party/blink/renderer/core/editing/drag_caret.cc
+++ b/third_party/blink/renderer/core/editing/drag_caret.cc
@@ -76,7 +76,7 @@
   Node* const anchor_node = position_.GetPosition().AnchorNode();
   if (!anchor_node || anchor_node == container)
     return;
-  if (!container.IsShadowIncludingInclusiveAncestorOf(anchor_node))
+  if (!container.IsShadowIncludingInclusiveAncestorOf(*anchor_node))
     return;
   Clear();
 }
@@ -87,7 +87,7 @@
   Node* const anchor_node = position_.GetPosition().AnchorNode();
   if (!anchor_node)
     return;
-  if (!node.IsShadowIncludingInclusiveAncestorOf(anchor_node))
+  if (!node.IsShadowIncludingInclusiveAncestorOf(*anchor_node))
     return;
   Clear();
 }
diff --git a/third_party/blink/renderer/core/editing/editing_utilities.cc b/third_party/blink/renderer/core/editing/editing_utilities.cc
index 3d2bd13..281b298 100644
--- a/third_party/blink/renderer/core/editing/editing_utilities.cc
+++ b/third_party/blink/renderer/core/editing/editing_utilities.cc
@@ -1335,37 +1335,45 @@
                                        const Node& node) {
   if (position.IsNull())
     return position;
+  Node* container_node;
+  Node* anchor_node;
   switch (position.AnchorType()) {
     case PositionAnchorType::kBeforeChildren:
-      if (!node.IsShadowIncludingInclusiveAncestorOf(
-              position.ComputeContainerNode())) {
+      container_node = position.ComputeContainerNode();
+      if (!container_node ||
+          !node.IsShadowIncludingInclusiveAncestorOf(*container_node)) {
         return position;
       }
       return Position::InParentBeforeNode(node);
     case PositionAnchorType::kAfterChildren:
-      if (!node.IsShadowIncludingInclusiveAncestorOf(
-              position.ComputeContainerNode())) {
+      container_node = position.ComputeContainerNode();
+      if (!container_node ||
+          !node.IsShadowIncludingInclusiveAncestorOf(*container_node)) {
         return position;
       }
       return Position::InParentAfterNode(node);
     case PositionAnchorType::kOffsetInAnchor:
-      if (position.ComputeContainerNode() == node.parentNode() &&
+      container_node = position.ComputeContainerNode();
+      if (container_node == node.parentNode() &&
           static_cast<unsigned>(position.OffsetInContainerNode()) >
               node.NodeIndex()) {
-        return Position(position.ComputeContainerNode(),
-                        position.OffsetInContainerNode() - 1);
+        return Position(container_node, position.OffsetInContainerNode() - 1);
       }
-      if (!node.IsShadowIncludingInclusiveAncestorOf(
-              position.ComputeContainerNode())) {
+      if (!container_node ||
+          !node.IsShadowIncludingInclusiveAncestorOf(*container_node)) {
         return position;
       }
       return Position::InParentBeforeNode(node);
     case PositionAnchorType::kAfterAnchor:
-      if (!node.IsShadowIncludingInclusiveAncestorOf(position.AnchorNode()))
+      anchor_node = position.AnchorNode();
+      if (!anchor_node ||
+          !node.IsShadowIncludingInclusiveAncestorOf(*anchor_node))
         return position;
       return Position::InParentAfterNode(node);
     case PositionAnchorType::kBeforeAnchor:
-      if (!node.IsShadowIncludingInclusiveAncestorOf(position.AnchorNode()))
+      anchor_node = position.AnchorNode();
+      if (!anchor_node ||
+          !node.IsShadowIncludingInclusiveAncestorOf(*anchor_node))
         return position;
       return Position::InParentBeforeNode(node);
   }
diff --git a/third_party/blink/renderer/core/exported/web_document.cc b/third_party/blink/renderer/core/exported/web_document.cc
index c9c313f7..45774eb 100644
--- a/third_party/blink/renderer/core/exported/web_document.cc
+++ b/third_party/blink/renderer/core/exported/web_document.cc
@@ -59,6 +59,7 @@
 #include "third_party/blink/renderer/core/layout/layout_object.h"
 #include "third_party/blink/renderer/core/layout/layout_view.h"
 #include "third_party/blink/renderer/core/loader/document_loader.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/weborigin/security_origin.h"
 #include "third_party/blink/renderer/platform/wtf/casting.h"
 
@@ -208,8 +209,8 @@
                                                CSSOrigin origin) {
   Document* document = Unwrap<Document>();
   DCHECK(document);
-  StyleSheetContents* parsed_sheet =
-      StyleSheetContents::Create(CSSParserContext::Create(*document));
+  StyleSheetContents* parsed_sheet = StyleSheetContents::Create(
+      MakeGarbageCollected<CSSParserContext>(*document));
   parsed_sheet->ParseString(source_code);
   const WebStyleSheetKey& injection_key =
       key && !key->IsNull() ? *key : GenerateStyleSheetKey();
diff --git a/third_party/blink/renderer/core/exported/web_page_popup_impl.cc b/third_party/blink/renderer/core/exported/web_page_popup_impl.cc
index 0985f8556..12a48516 100644
--- a/third_party/blink/renderer/core/exported/web_page_popup_impl.cc
+++ b/third_party/blink/renderer/core/exported/web_page_popup_impl.cc
@@ -64,6 +64,7 @@
 #include "third_party/blink/renderer/platform/bindings/script_forbidden_scope.h"
 #include "third_party/blink/renderer/platform/graphics/graphics_layer.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/instrumentation/tracing/trace_event.h"
 #include "third_party/blink/renderer/platform/web_test_support.h"
 
@@ -287,10 +288,10 @@
   ProvideContextFeaturesTo(*page_, std::make_unique<PagePopupFeaturesClient>());
   DEFINE_STATIC_LOCAL(Persistent<LocalFrameClient>, empty_local_frame_client,
                       (MakeGarbageCollected<EmptyLocalFrameClient>()));
-  LocalFrame* frame =
-      LocalFrame::Create(empty_local_frame_client, *page_, nullptr);
+  auto* frame = MakeGarbageCollected<LocalFrame>(empty_local_frame_client,
+                                                 *page_, nullptr);
   frame->SetPagePopupOwner(popup_client_->OwnerElement());
-  frame->SetView(LocalFrameView::Create(*frame));
+  frame->SetView(MakeGarbageCollected<LocalFrameView>(*frame));
   frame->Init();
   frame->View()->SetParentVisible(true);
   frame->View()->SetSelfVisible(true);
diff --git a/third_party/blink/renderer/core/exported/web_remote_frame_impl.cc b/third_party/blink/renderer/core/exported/web_remote_frame_impl.cc
index b0dbcfb..9483857 100644
--- a/third_party/blink/renderer/core/exported/web_remote_frame_impl.cc
+++ b/third_party/blink/renderer/core/exported/web_remote_frame_impl.cc
@@ -38,6 +38,7 @@
 #include "third_party/blink/renderer/platform/geometry/float_quad.h"
 #include "third_party/blink/renderer/platform/geometry/layout_rect.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "v8/include/v8.h"
 
 namespace blink {
@@ -149,9 +150,10 @@
     const WebFrameOwnerProperties& frame_owner_properties,
     FrameOwnerElementType frame_owner_element_type,
     WebFrame* opener) {
-  WebLocalFrameImpl* child = WebLocalFrameImpl::Create(
+  auto* child = MakeGarbageCollected<WebLocalFrameImpl>(
       scope, client, interface_registry,
-      std::move(document_interface_broker_handle), opener);
+      std::move(document_interface_broker_handle));
+  child->SetOpener(opener);
   InsertAfter(child, previous_sibling);
   auto* owner = MakeGarbageCollected<RemoteFrameOwner>(
       frame_policy, frame_owner_properties, frame_owner_element_type);
@@ -163,7 +165,8 @@
 void WebRemoteFrameImpl::InitializeCoreFrame(Page& page,
                                              FrameOwner* owner,
                                              const AtomicString& name) {
-  SetCoreFrame(RemoteFrame::Create(frame_client_.Get(), page, owner));
+  SetCoreFrame(
+      MakeGarbageCollected<RemoteFrame>(frame_client_.Get(), page, owner));
   GetFrame()->CreateView();
   frame_->Tree().SetName(name);
 }
diff --git a/third_party/blink/renderer/core/frame/dom_visual_viewport.h b/third_party/blink/renderer/core/frame/dom_visual_viewport.h
index 0b1ef8ee..3a0f832 100644
--- a/third_party/blink/renderer/core/frame/dom_visual_viewport.h
+++ b/third_party/blink/renderer/core/frame/dom_visual_viewport.h
@@ -47,10 +47,6 @@
   DEFINE_WRAPPERTYPEINFO();
 
  public:
-  static DOMVisualViewport* Create(LocalDOMWindow* window) {
-    return MakeGarbageCollected<DOMVisualViewport>(window);
-  }
-
   explicit DOMVisualViewport(LocalDOMWindow*);
   ~DOMVisualViewport() override;
 
diff --git a/third_party/blink/renderer/core/frame/frame_console.h b/third_party/blink/renderer/core/frame/frame_console.h
index e6615719..3c1460a2 100644
--- a/third_party/blink/renderer/core/frame/frame_console.h
+++ b/third_party/blink/renderer/core/frame/frame_console.h
@@ -51,10 +51,6 @@
 class CORE_EXPORT FrameConsole final
     : public GarbageCollectedFinalized<FrameConsole> {
  public:
-  static FrameConsole* Create(LocalFrame& frame) {
-    return MakeGarbageCollected<FrameConsole>(frame);
-  }
-
   explicit FrameConsole(LocalFrame&);
 
   void AddMessage(ConsoleMessage*);
diff --git a/third_party/blink/renderer/core/frame/frame_test_helpers.cc b/third_party/blink/renderer/core/frame/frame_test_helpers.cc
index 0178359..5468a33 100644
--- a/third_party/blink/renderer/core/frame/frame_test_helpers.cc
+++ b/third_party/blink/renderer/core/frame/frame_test_helpers.cc
@@ -30,6 +30,7 @@
 
 #include "third_party/blink/renderer/core/frame/frame_test_helpers.h"
 
+#include <memory>
 #include <utility>
 
 #include "base/bind.h"
@@ -54,6 +55,7 @@
 #include "third_party/blink/renderer/core/loader/document_loader.h"
 #include "third_party/blink/renderer/core/testing/core_unit_test_helper.h"
 #include "third_party/blink/renderer/core/testing/fake_web_plugin.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/scheduler/public/thread.h"
 #include "third_party/blink/renderer/platform/testing/unit_test_helpers.h"
 #include "third_party/blink/renderer/platform/testing/url_test_helpers.h"
@@ -255,7 +257,8 @@
 WebRemoteFrameImpl* CreateRemote(TestWebRemoteFrameClient* client) {
   std::unique_ptr<TestWebRemoteFrameClient> owned_client;
   client = CreateDefaultClientIfNeeded(client, owned_client);
-  auto* frame = WebRemoteFrameImpl::Create(WebTreeScopeType::kDocument, client);
+  auto* frame = MakeGarbageCollected<WebRemoteFrameImpl>(
+      WebTreeScopeType::kDocument, client);
   client->Bind(frame, std::move(owned_client));
   return frame;
 }
diff --git a/third_party/blink/renderer/core/frame/frame_view_auto_size_info.h b/third_party/blink/renderer/core/frame/frame_view_auto_size_info.h
index 6d99f1d..94318fc 100644
--- a/third_party/blink/renderer/core/frame/frame_view_auto_size_info.h
+++ b/third_party/blink/renderer/core/frame/frame_view_auto_size_info.h
@@ -18,10 +18,6 @@
 class FrameViewAutoSizeInfo final
     : public GarbageCollected<FrameViewAutoSizeInfo> {
  public:
-  static FrameViewAutoSizeInfo* Create(LocalFrameView* frame_view) {
-    return MakeGarbageCollected<FrameViewAutoSizeInfo>(frame_view);
-  }
-
   explicit FrameViewAutoSizeInfo(LocalFrameView*);
 
   void ConfigureAutoSizeMode(const IntSize& min_size, const IntSize& max_size);
diff --git a/third_party/blink/renderer/core/frame/history.h b/third_party/blink/renderer/core/frame/history.h
index 9c970acb..bafaf32 100644
--- a/third_party/blink/renderer/core/frame/history.h
+++ b/third_party/blink/renderer/core/frame/history.h
@@ -51,10 +51,6 @@
   USING_GARBAGE_COLLECTED_MIXIN(History);
 
  public:
-  static History* Create(LocalFrame* frame) {
-    return MakeGarbageCollected<History>(frame);
-  }
-
   explicit History(LocalFrame*);
 
   unsigned length(ExceptionState&) const;
diff --git a/third_party/blink/renderer/core/frame/local_frame.cc b/third_party/blink/renderer/core/frame/local_frame.cc
index 29a339c..063a9ec 100644
--- a/third_party/blink/renderer/core/frame/local_frame.cc
+++ b/third_party/blink/renderer/core/frame/local_frame.cc
@@ -107,6 +107,7 @@
 #include "third_party/blink/renderer/platform/graphics/paint/paint_canvas.h"
 #include "third_party/blink/renderer/platform/graphics/paint/paint_controller.h"
 #include "third_party/blink/renderer/platform/graphics/paint/scoped_paint_chunk_properties.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/heap/persistent.h"
 #include "third_party/blink/renderer/platform/histogram.h"
 #include "third_party/blink/renderer/platform/instrumentation/resource_coordinator/document_resource_coordinator.h"
@@ -209,21 +210,6 @@
 
 template class CORE_TEMPLATE_EXPORT Supplement<LocalFrame>;
 
-// static
-LocalFrame* LocalFrame::Create(LocalFrameClient* client,
-                               Page& page,
-                               FrameOwner* owner,
-                               InterfaceRegistry* interface_registry) {
-  LocalFrame* frame = MakeGarbageCollected<LocalFrame>(
-      client, page, owner,
-      interface_registry ? interface_registry
-                         : InterfaceRegistry::GetEmptyInterfaceRegistry());
-  frame->Initialize();
-
-  probe::FrameAttachedToParent(frame);
-  return frame;
-}
-
 void LocalFrame::Init() {
   CoreInitializer::GetInstance().InitLocalFrame(*this);
 
@@ -252,12 +238,12 @@
 
   LocalFrameView* frame_view = nullptr;
   if (is_local_root) {
-    frame_view = LocalFrameView::Create(*this, viewport_size);
+    frame_view = MakeGarbageCollected<LocalFrameView>(*this, viewport_size);
 
     // The layout size is set by WebViewImpl to support @viewport
     frame_view->SetLayoutSizeFixedToFrameSize(false);
   } else {
-    frame_view = LocalFrameView::Create(*this);
+    frame_view = MakeGarbageCollected<LocalFrameView>(*this);
   }
 
   SetView(frame_view);
@@ -902,10 +888,10 @@
   return View() && View()->ShouldThrottleRendering();
 }
 
-inline LocalFrame::LocalFrame(LocalFrameClient* client,
-                              Page& page,
-                              FrameOwner* owner,
-                              InterfaceRegistry* interface_registry)
+LocalFrame::LocalFrame(LocalFrameClient* client,
+                       Page& page,
+                       FrameOwner* owner,
+                       InterfaceRegistry* interface_registry)
     : Frame(client,
             page,
             owner,
@@ -934,7 +920,9 @@
       in_view_source_mode_(false),
       inspector_task_runner_(InspectorTaskRunner::Create(
           GetTaskRunner(TaskType::kInternalInspector))),
-      interface_registry_(interface_registry),
+      interface_registry_(interface_registry
+                              ? interface_registry
+                              : InterfaceRegistry::GetEmptyInterfaceRegistry()),
       is_save_data_enabled_(
           !(GetSettings() && GetSettings()->GetDataSaverHoldbackWebApi()) &&
           GetNetworkStateNotifier().SaveDataEnabled()) {
@@ -964,6 +952,10 @@
   }
   DCHECK(ad_tracker_ ? RuntimeEnabledFeatures::AdTaggingEnabled()
                      : !RuntimeEnabledFeatures::AdTaggingEnabled());
+
+  Initialize();
+
+  probe::FrameAttachedToParent(this);
 }
 
 FrameScheduler* LocalFrame::GetFrameScheduler() {
diff --git a/third_party/blink/renderer/core/frame/local_frame.h b/third_party/blink/renderer/core/frame/local_frame.h
index 3929b639..25884090 100644
--- a/third_party/blink/renderer/core/frame/local_frame.h
+++ b/third_party/blink/renderer/core/frame/local_frame.h
@@ -118,12 +118,10 @@
   USING_GARBAGE_COLLECTED_MIXIN(LocalFrame);
 
  public:
-  static LocalFrame* Create(LocalFrameClient*,
-                            Page&,
-                            FrameOwner*,
-                            InterfaceRegistry* = nullptr);
-
-  LocalFrame(LocalFrameClient*, Page&, FrameOwner*, InterfaceRegistry*);
+  LocalFrame(LocalFrameClient*,
+             Page&,
+             FrameOwner*,
+             InterfaceRegistry* = nullptr);
 
   void Init();
   void SetView(LocalFrameView*);
diff --git a/third_party/blink/renderer/core/frame/local_frame_view.cc b/third_party/blink/renderer/core/frame/local_frame_view.cc
index 38c36dcf..f622c9fb 100644
--- a/third_party/blink/renderer/core/frame/local_frame_view.cc
+++ b/third_party/blink/renderer/core/frame/local_frame_view.cc
@@ -221,6 +221,17 @@
 
 static bool g_initial_track_all_paint_invalidations = false;
 
+LocalFrameView::LocalFrameView(LocalFrame& frame)
+    : LocalFrameView(frame, IntRect()) {
+  Show();
+}
+
+LocalFrameView::LocalFrameView(LocalFrame& frame, const IntSize& initial_size)
+    : LocalFrameView(frame, IntRect(IntPoint(), initial_size)) {
+  SetLayoutSizeInternal(initial_size);
+  Show();
+}
+
 LocalFrameView::LocalFrameView(LocalFrame& frame, IntRect frame_rect)
     : FrameView(frame_rect),
       frame_(frame),
@@ -280,22 +291,6 @@
     SetCanHaveScrollbars(false);
 }
 
-LocalFrameView* LocalFrameView::Create(LocalFrame& frame) {
-  LocalFrameView* view = MakeGarbageCollected<LocalFrameView>(frame, IntRect());
-  view->Show();
-  return view;
-}
-
-LocalFrameView* LocalFrameView::Create(LocalFrame& frame,
-                                       const IntSize& initial_size) {
-  LocalFrameView* view = MakeGarbageCollected<LocalFrameView>(
-      frame, IntRect(IntPoint(), initial_size));
-  view->SetLayoutSizeInternal(initial_size);
-
-  view->Show();
-  return view;
-}
-
 LocalFrameView::~LocalFrameView() {
 #if DCHECK_IS_ON()
   DCHECK(has_been_disposed_);
diff --git a/third_party/blink/renderer/core/frame/local_frame_view.h b/third_party/blink/renderer/core/frame/local_frame_view.h
index 8314a00..de2b9b48 100644
--- a/third_party/blink/renderer/core/frame/local_frame_view.h
+++ b/third_party/blink/renderer/core/frame/local_frame_view.h
@@ -27,7 +27,6 @@
 #define THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_LOCAL_FRAME_VIEW_H_
 
 #include <memory>
-#include <utility>
 
 #include "third_party/blink/public/common/manifest/web_display_mode.h"
 #include "third_party/blink/public/mojom/frame/lifecycle.mojom-blink.h"
@@ -121,10 +120,8 @@
     virtual void DidFinishLifecycleUpdate(const LocalFrameView&) = 0;
   };
 
-  static LocalFrameView* Create(LocalFrame&);
-  static LocalFrameView* Create(LocalFrame&, const IntSize& initial_size);
-
-  explicit LocalFrameView(LocalFrame&, IntRect);
+  explicit LocalFrameView(LocalFrame&);
+  LocalFrameView(LocalFrame&, const IntSize& initial_size);
   ~LocalFrameView() override;
 
   void Invalidate() { InvalidateRect(IntRect(0, 0, Width(), Height())); }
@@ -717,6 +714,8 @@
   }
 
  private:
+  LocalFrameView(LocalFrame&, IntRect);
+
 #if DCHECK_IS_ON()
   class DisallowLayoutInvalidationScope {
     STACK_ALLOCATED();
diff --git a/third_party/blink/renderer/core/frame/pausable_script_executor.cc b/third_party/blink/renderer/core/frame/pausable_script_executor.cc
index 8e4321f..c3c11621 100644
--- a/third_party/blink/renderer/core/frame/pausable_script_executor.cc
+++ b/third_party/blink/renderer/core/frame/pausable_script_executor.cc
@@ -19,6 +19,7 @@
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/dom/user_gesture_indicator.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/wtf/functional.h"
 #include "third_party/blink/renderer/platform/wtf/vector.h"
 
@@ -134,19 +135,6 @@
 
 }  // namespace
 
-PausableScriptExecutor* PausableScriptExecutor::Create(
-    LocalFrame* frame,
-    scoped_refptr<DOMWrapperWorld> world,
-    const HeapVector<ScriptSourceCode>& sources,
-    bool user_gesture,
-    WebScriptExecutionCallback* callback) {
-  ScriptState* script_state = ToScriptState(frame, *world);
-  return MakeGarbageCollected<PausableScriptExecutor>(
-      frame, script_state, callback,
-      MakeGarbageCollected<WebScriptExecutor>(sources, world->GetWorldId(),
-                                              user_gesture));
-}
-
 void PausableScriptExecutor::CreateAndRun(
     LocalFrame* frame,
     v8::Isolate* isolate,
@@ -187,6 +175,20 @@
 
 PausableScriptExecutor::PausableScriptExecutor(
     LocalFrame* frame,
+    scoped_refptr<DOMWrapperWorld> world,
+    const HeapVector<ScriptSourceCode>& sources,
+    bool user_gesture,
+    WebScriptExecutionCallback* callback)
+    : PausableScriptExecutor(
+          frame,
+          ToScriptState(frame, *world),
+          callback,
+          MakeGarbageCollected<WebScriptExecutor>(sources,
+                                                  world->GetWorldId(),
+                                                  user_gesture)) {}
+
+PausableScriptExecutor::PausableScriptExecutor(
+    LocalFrame* frame,
     ScriptState* script_state,
     WebScriptExecutionCallback* callback,
     Executor* executor)
diff --git a/third_party/blink/renderer/core/frame/pausable_script_executor.h b/third_party/blink/renderer/core/frame/pausable_script_executor.h
index be27df6..fd4a7af 100644
--- a/third_party/blink/renderer/core/frame/pausable_script_executor.h
+++ b/third_party/blink/renderer/core/frame/pausable_script_executor.h
@@ -29,12 +29,6 @@
  public:
   enum BlockingOption { kNonBlocking, kOnloadBlocking };
 
-  static PausableScriptExecutor* Create(
-      LocalFrame*,
-      scoped_refptr<DOMWrapperWorld>,
-      const HeapVector<ScriptSourceCode>& sources,
-      bool user_gesture,
-      WebScriptExecutionCallback*);
   static void CreateAndRun(LocalFrame*,
                            v8::Isolate*,
                            v8::Local<v8::Context>,
@@ -54,6 +48,11 @@
   };
 
   PausableScriptExecutor(LocalFrame*,
+                         scoped_refptr<DOMWrapperWorld>,
+                         const HeapVector<ScriptSourceCode>&,
+                         bool,
+                         WebScriptExecutionCallback*);
+  PausableScriptExecutor(LocalFrame*,
                          ScriptState*,
                          WebScriptExecutionCallback*,
                          Executor*);
diff --git a/third_party/blink/renderer/core/frame/remote_frame.cc b/third_party/blink/renderer/core/frame/remote_frame.cc
index 6418063..c192c6c 100644
--- a/third_party/blink/renderer/core/frame/remote_frame.cc
+++ b/third_party/blink/renderer/core/frame/remote_frame.cc
@@ -23,6 +23,7 @@
 #include "third_party/blink/renderer/core/paint/paint_layer.h"
 #include "third_party/blink/renderer/core/probe/core_probes.h"
 #include "third_party/blink/renderer/platform/graphics/graphics_layer.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/loader/fetch/fetch_client_settings_object.h"
 #include "third_party/blink/renderer/platform/loader/fetch/resource_fetcher.h"
 #include "third_party/blink/renderer/platform/loader/fetch/resource_fetcher_properties.h"
@@ -32,9 +33,9 @@
 
 namespace blink {
 
-inline RemoteFrame::RemoteFrame(RemoteFrameClient* client,
-                                Page& page,
-                                FrameOwner* owner)
+RemoteFrame::RemoteFrame(RemoteFrameClient* client,
+                         Page& page,
+                         FrameOwner* owner)
     : Frame(client,
             page,
             owner,
@@ -43,14 +44,8 @@
   dom_window_ = MakeGarbageCollected<RemoteDOMWindow>(*this);
   UpdateInertIfPossible();
   UpdateInheritedEffectiveTouchActionIfPossible();
-}
 
-RemoteFrame* RemoteFrame::Create(RemoteFrameClient* client,
-                                 Page& page,
-                                 FrameOwner* owner) {
-  RemoteFrame* frame = MakeGarbageCollected<RemoteFrame>(client, page, owner);
-  frame->Initialize();
-  return frame;
+  Initialize();
 }
 
 RemoteFrame::~RemoteFrame() {
@@ -214,7 +209,7 @@
 
   DCHECK(!DeprecatedLocalOwner()->OwnedEmbeddedContentView());
 
-  SetView(RemoteFrameView::Create(this));
+  SetView(MakeGarbageCollected<RemoteFrameView>(this));
 
   if (OwnerLayoutObject())
     DeprecatedLocalOwner()->SetEmbeddedContentView(view_);
diff --git a/third_party/blink/renderer/core/frame/remote_frame.h b/third_party/blink/renderer/core/frame/remote_frame.h
index 748273f..fbdb476 100644
--- a/third_party/blink/renderer/core/frame/remote_frame.h
+++ b/third_party/blink/renderer/core/frame/remote_frame.h
@@ -24,8 +24,6 @@
 
 class CORE_EXPORT RemoteFrame final : public Frame {
  public:
-  static RemoteFrame* Create(RemoteFrameClient*, Page&, FrameOwner*);
-
   RemoteFrame(RemoteFrameClient*, Page&, FrameOwner*);
   ~RemoteFrame() override;
 
diff --git a/third_party/blink/renderer/core/frame/remote_frame_view.cc b/third_party/blink/renderer/core/frame/remote_frame_view.cc
index eae54cf..f61ac6e 100644
--- a/third_party/blink/renderer/core/frame/remote_frame_view.cc
+++ b/third_party/blink/renderer/core/frame/remote_frame_view.cc
@@ -24,6 +24,7 @@
 RemoteFrameView::RemoteFrameView(RemoteFrame* remote_frame)
     : FrameView(IntRect()), remote_frame_(remote_frame) {
   DCHECK(remote_frame);
+  Show();
 }
 
 RemoteFrameView::~RemoteFrameView() = default;
@@ -78,12 +79,6 @@
   SetAttached(false);
 }
 
-RemoteFrameView* RemoteFrameView::Create(RemoteFrame* remote_frame) {
-  RemoteFrameView* view = MakeGarbageCollected<RemoteFrameView>(remote_frame);
-  view->Show();
-  return view;
-}
-
 bool RemoteFrameView::UpdateViewportIntersectionsForSubtree(
     unsigned parent_flags) {
   UpdateViewportIntersection(parent_flags, needs_occlusion_tracking_);
diff --git a/third_party/blink/renderer/core/frame/remote_frame_view.h b/third_party/blink/renderer/core/frame/remote_frame_view.h
index 04c1ccb..8c0ef2a 100644
--- a/third_party/blink/renderer/core/frame/remote_frame_view.h
+++ b/third_party/blink/renderer/core/frame/remote_frame_view.h
@@ -29,8 +29,6 @@
   USING_GARBAGE_COLLECTED_MIXIN(RemoteFrameView);
 
  public:
-  static RemoteFrameView* Create(RemoteFrame*);
-
   explicit RemoteFrameView(RemoteFrame*);
   ~RemoteFrameView() override;
 
diff --git a/third_party/blink/renderer/core/frame/screen.h b/third_party/blink/renderer/core/frame/screen.h
index bcf0265c..ffc558e 100644
--- a/third_party/blink/renderer/core/frame/screen.h
+++ b/third_party/blink/renderer/core/frame/screen.h
@@ -46,10 +46,6 @@
   USING_GARBAGE_COLLECTED_MIXIN(Screen);
 
  public:
-  static Screen* Create(LocalFrame* frame) {
-    return MakeGarbageCollected<Screen>(frame);
-  }
-
   explicit Screen(LocalFrame*);
 
   int height() const;
diff --git a/third_party/blink/renderer/core/frame/web_local_frame_impl.cc b/third_party/blink/renderer/core/frame/web_local_frame_impl.cc
index 856d787..c8174f4b 100644
--- a/third_party/blink/renderer/core/frame/web_local_frame_impl.cc
+++ b/third_party/blink/renderer/core/frame/web_local_frame_impl.cc
@@ -253,6 +253,7 @@
 #include "third_party/blink/renderer/platform/graphics/paint/scoped_paint_chunk_properties.h"
 #include "third_party/blink/renderer/platform/graphics/skia/skia_utils.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/instrumentation/tracing/trace_event.h"
 #include "third_party/blink/renderer/platform/loader/fetch/fetch_context.h"
 #include "third_party/blink/renderer/platform/loader/fetch/resource_fetcher.h"
@@ -803,7 +804,7 @@
   DCHECK(GetFrame());
 
   scoped_refptr<DOMWrapperWorld> main_world = &DOMWrapperWorld::MainWorld();
-  PausableScriptExecutor* executor = PausableScriptExecutor::Create(
+  auto* executor = MakeGarbageCollected<PausableScriptExecutor>(
       GetFrame(), std::move(main_world), CreateSourcesVector(&source, 1),
       user_gesture, callback);
   executor->Run();
@@ -835,7 +836,7 @@
 
   scoped_refptr<DOMWrapperWorld> isolated_world =
       DOMWrapperWorld::EnsureIsolatedWorld(ToIsolate(GetFrame()), world_id);
-  PausableScriptExecutor* executor = PausableScriptExecutor::Create(
+  auto* executor = MakeGarbageCollected<PausableScriptExecutor>(
       GetFrame(), std::move(isolated_world),
       CreateSourcesVector(sources_in, num_sources), user_gesture, callback);
   switch (option) {
@@ -956,10 +957,10 @@
   String referrer = referrer_url.IsEmpty()
                         ? GetFrame()->GetDocument()->OutgoingReferrer()
                         : String(referrer_url.GetString());
-  request.ToMutableResourceRequest().SetHttpReferrer(
-      SecurityPolicy::GenerateReferrer(
-          GetFrame()->GetDocument()->GetReferrerPolicy(), request.Url(),
-          referrer));
+  ResourceRequest& resource_request = request.ToMutableResourceRequest();
+  resource_request.SetReferrerPolicy(
+      GetFrame()->GetDocument()->GetReferrerPolicy());
+  resource_request.SetReferrerString(referrer);
 }
 
 WebAssociatedURLLoader* WebLocalFrameImpl::CreateAssociatedURLLoader(
@@ -1617,19 +1618,6 @@
       previous_frame, frame_policy);
 }
 
-WebLocalFrameImpl* WebLocalFrameImpl::Create(
-    WebTreeScopeType scope,
-    WebLocalFrameClient* client,
-    blink::InterfaceRegistry* interface_registry,
-    mojo::ScopedMessagePipeHandle document_interface_broker_handle,
-    WebFrame* opener) {
-  WebLocalFrameImpl* frame = MakeGarbageCollected<WebLocalFrameImpl>(
-      scope, client, interface_registry,
-      std::move(document_interface_broker_handle));
-  frame->SetOpener(opener);
-  return frame;
-}
-
 WebLocalFrameImpl* WebLocalFrameImpl::CreateMainFrame(
     WebView* web_view,
     WebLocalFrameClient* client,
@@ -1661,9 +1649,10 @@
     WebFrame* previous_web_frame,
     const FramePolicy& frame_policy) {
   DCHECK(client);
-  WebLocalFrameImpl* web_frame = MakeGarbageCollected<WebLocalFrameImpl>(
-      previous_web_frame, client, interface_registry,
-      std::move(document_interface_broker_handle));
+  auto* web_frame = MakeGarbageCollected<WebLocalFrameImpl>(
+      previous_web_frame->InShadowTree() ? WebTreeScopeType::kShadow
+                                         : WebTreeScopeType::kDocument,
+      client, interface_registry, std::move(document_interface_broker_handle));
   Frame* previous_frame = ToCoreFrame(*previous_web_frame);
   web_frame->SetParent(previous_web_frame->Parent());
   web_frame->SetOpener(previous_web_frame->Opener());
@@ -1734,18 +1723,6 @@
   client_->BindToFrame(this);
 }
 
-WebLocalFrameImpl::WebLocalFrameImpl(
-    WebFrame* previous_web_frame,
-    WebLocalFrameClient* client,
-    blink::InterfaceRegistry* interface_registry,
-    mojo::ScopedMessagePipeHandle document_interface_broker_handle)
-    : WebLocalFrameImpl(previous_web_frame->InShadowTree()
-                            ? WebTreeScopeType::kShadow
-                            : WebTreeScopeType::kDocument,
-                        client,
-                        interface_registry,
-                        std::move(document_interface_broker_handle)) {}
-
 WebLocalFrameImpl::~WebLocalFrameImpl() {
   // The widget for the frame, if any, must have already been closed.
   DCHECK(!frame_widget_);
@@ -1770,8 +1747,8 @@
 void WebLocalFrameImpl::InitializeCoreFrame(Page& page,
                                             FrameOwner* owner,
                                             const AtomicString& name) {
-  SetCoreFrame(LocalFrame::Create(local_frame_client_.Get(), page, owner,
-                                  interface_registry_));
+  SetCoreFrame(MakeGarbageCollected<LocalFrame>(local_frame_client_.Get(), page,
+                                                owner, interface_registry_));
   frame_->Tree().SetName(name);
   // We must call init() after frame_ is assigned because it is referenced
   // during init().
diff --git a/third_party/blink/renderer/core/frame/web_local_frame_impl.h b/third_party/blink/renderer/core/frame/web_local_frame_impl.h
index c88c8e8..3db1bec 100644
--- a/third_party/blink/renderer/core/frame/web_local_frame_impl.h
+++ b/third_party/blink/renderer/core/frame/web_local_frame_impl.h
@@ -35,7 +35,6 @@
 #include <set>
 
 #include "base/single_thread_task_runner.h"
-
 #include "third_party/blink/public/mojom/ad_tagging/ad_frame.mojom-blink.h"
 #include "third_party/blink/public/mojom/devtools/devtools_agent.mojom-blink.h"
 #include "third_party/blink/public/mojom/frame/find_in_page.mojom-blink.h"
@@ -345,11 +344,6 @@
   void WillBeDetached();
   void WillDetachParent();
 
-  static WebLocalFrameImpl* Create(WebTreeScopeType,
-                                   WebLocalFrameClient*,
-                                   InterfaceRegistry*,
-                                   mojo::ScopedMessagePipeHandle,
-                                   WebFrame* opener);
   static WebLocalFrameImpl* CreateMainFrame(WebView*,
                                             WebLocalFrameClient*,
                                             InterfaceRegistry*,
@@ -368,10 +362,6 @@
                     WebLocalFrameClient*,
                     blink::InterfaceRegistry*,
                     mojo::ScopedMessagePipeHandle);
-  WebLocalFrameImpl(WebFrame*,
-                    WebLocalFrameClient*,
-                    blink::InterfaceRegistry*,
-                    mojo::ScopedMessagePipeHandle);
   ~WebLocalFrameImpl() override;
 
   LocalFrame* CreateChildFrame(const AtomicString& name,
diff --git a/third_party/blink/renderer/core/html/forms/html_label_element.cc b/third_party/blink/renderer/core/html/forms/html_label_element.cc
index f4fe9a8..4e1e6ee 100644
--- a/third_party/blink/renderer/core/html/forms/html_label_element.cc
+++ b/third_party/blink/renderer/core/html/forms/html_label_element.cc
@@ -125,7 +125,7 @@
 }
 
 bool HTMLLabelElement::IsInInteractiveContent(Node* node) const {
-  if (!IsShadowIncludingInclusiveAncestorOf(node))
+  if (!node || !IsShadowIncludingInclusiveAncestorOf(*node))
     return false;
   while (node && this != node) {
     auto* html_element = DynamicTo<HTMLElement>(node);
@@ -142,13 +142,17 @@
 
     // If we can't find a control or if the control received the click
     // event, then there's no need for us to do anything.
-    if (!element ||
-        (evt.target() &&
-         element->IsShadowIncludingInclusiveAncestorOf(evt.target()->ToNode())))
+    if (!element)
       return;
+    if (evt.target()) {
+      Node* target_node = evt.target()->ToNode();
+      if (target_node &&
+          element->IsShadowIncludingInclusiveAncestorOf(*target_node))
+        return;
 
-    if (evt.target() && IsInInteractiveContent(evt.target()->ToNode()))
-      return;
+      if (IsInInteractiveContent(target_node))
+        return;
+    }
 
     //   Behaviour of label element is as follows:
     //     - If there is double click, two clicks will be passed to control
diff --git a/third_party/blink/renderer/core/html/forms/listed_element.cc b/third_party/blink/renderer/core/html/forms/listed_element.cc
index ae88649..879e5dd 100644
--- a/third_party/blink/renderer/core/html/forms/listed_element.cc
+++ b/third_party/blink/renderer/core/html/forms/listed_element.cc
@@ -404,7 +404,7 @@
     return;
   String message;
   if (element.GetLayoutObject() && WillValidate() &&
-      ToHTMLElement().IsShadowIncludingInclusiveAncestorOf(&element))
+      ToHTMLElement().IsShadowIncludingInclusiveAncestorOf(element))
     message = validationMessage().StripWhiteSpace();
 
   has_validation_message_ = true;
diff --git a/third_party/blink/renderer/core/html/forms/search_input_type.cc b/third_party/blink/renderer/core/html/forms/search_input_type.cc
index 2a2e080..edcf51c 100644
--- a/third_party/blink/renderer/core/html/forms/search_input_type.cc
+++ b/third_party/blink/renderer/core/html/forms/search_input_type.cc
@@ -41,6 +41,7 @@
 #include "third_party/blink/renderer/core/input_type_names.h"
 #include "third_party/blink/renderer/core/layout/layout_search_field.h"
 #include "third_party/blink/renderer/platform/bindings/exception_state.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -77,9 +78,9 @@
       shadow_element_names::EditingViewPort());
   DCHECK(container);
   DCHECK(view_port);
-  container->InsertBefore(
-      SearchFieldCancelButtonElement::Create(GetElement().GetDocument()),
-      view_port->nextSibling());
+  container->InsertBefore(MakeGarbageCollected<SearchFieldCancelButtonElement>(
+                              GetElement().GetDocument()),
+                          view_port->nextSibling());
 }
 
 void SearchInputType::HandleKeydownEvent(KeyboardEvent& event) {
diff --git a/third_party/blink/renderer/core/html/forms/text_control_inner_elements.cc b/third_party/blink/renderer/core/html/forms/text_control_inner_elements.cc
index 8dae233..acd7a01 100644
--- a/third_party/blink/renderer/core/html/forms/text_control_inner_elements.cc
+++ b/third_party/blink/renderer/core/html/forms/text_control_inner_elements.cc
@@ -41,14 +41,8 @@
 using namespace html_names;
 
 TextControlInnerContainer::TextControlInnerContainer(Document& document)
-    : HTMLDivElement(document) {}
-
-TextControlInnerContainer* TextControlInnerContainer::Create(
-    Document& document) {
-  TextControlInnerContainer* element =
-      MakeGarbageCollected<TextControlInnerContainer>(document);
-  element->setAttribute(kIdAttr, shadow_element_names::TextFieldContainer());
-  return element;
+    : HTMLDivElement(document) {
+  setAttribute(kIdAttr, shadow_element_names::TextFieldContainer());
 }
 
 LayoutObject* TextControlInnerContainer::CreateLayoutObject(
@@ -62,13 +56,7 @@
 EditingViewPortElement::EditingViewPortElement(Document& document)
     : HTMLDivElement(document) {
   SetHasCustomStyleCallbacks();
-}
-
-EditingViewPortElement* EditingViewPortElement::Create(Document& document) {
-  EditingViewPortElement* element =
-      MakeGarbageCollected<EditingViewPortElement>(document);
-  element->setAttribute(kIdAttr, shadow_element_names::EditingViewPort());
-  return element;
+  setAttribute(kIdAttr, shadow_element_names::EditingViewPort());
 }
 
 scoped_refptr<ComputedStyle>
@@ -97,11 +85,6 @@
   SetHasCustomStyleCallbacks();
 }
 
-TextControlInnerEditorElement* TextControlInnerEditorElement::Create(
-    Document& document) {
-  return MakeGarbageCollected<TextControlInnerEditorElement>(document);
-}
-
 void TextControlInnerEditorElement::DefaultEventHandler(Event& event) {
   // FIXME: In the future, we should add a way to have default event listeners.
   // Then we would add one to the text field's inner div, and we wouldn't need
@@ -213,17 +196,11 @@
 
 // ----------------------------
 
-inline SearchFieldCancelButtonElement::SearchFieldCancelButtonElement(
+SearchFieldCancelButtonElement::SearchFieldCancelButtonElement(
     Document& document)
-    : HTMLDivElement(document) {}
-
-SearchFieldCancelButtonElement* SearchFieldCancelButtonElement::Create(
-    Document& document) {
-  SearchFieldCancelButtonElement* element =
-      MakeGarbageCollected<SearchFieldCancelButtonElement>(document);
-  element->SetShadowPseudoId(AtomicString("-webkit-search-cancel-button"));
-  element->setAttribute(kIdAttr, shadow_element_names::SearchClearButton());
-  return element;
+    : HTMLDivElement(document) {
+  SetShadowPseudoId(AtomicString("-webkit-search-cancel-button"));
+  setAttribute(kIdAttr, shadow_element_names::SearchClearButton());
 }
 
 void SearchFieldCancelButtonElement::DefaultEventHandler(Event& event) {
diff --git a/third_party/blink/renderer/core/html/forms/text_control_inner_elements.h b/third_party/blink/renderer/core/html/forms/text_control_inner_elements.h
index 0abb2d6..8d7c67b 100644
--- a/third_party/blink/renderer/core/html/forms/text_control_inner_elements.h
+++ b/third_party/blink/renderer/core/html/forms/text_control_inner_elements.h
@@ -34,8 +34,6 @@
 
 class TextControlInnerContainer final : public HTMLDivElement {
  public:
-  static TextControlInnerContainer* Create(Document&);
-
   explicit TextControlInnerContainer(Document&);
 
  protected:
@@ -45,8 +43,6 @@
 
 class EditingViewPortElement final : public HTMLDivElement {
  public:
-  static EditingViewPortElement* Create(Document&);
-
   explicit EditingViewPortElement(Document&);
 
  protected:
@@ -59,8 +55,6 @@
 
 class TextControlInnerEditorElement final : public HTMLDivElement {
  public:
-  static TextControlInnerEditorElement* Create(Document&);
-
   explicit TextControlInnerEditorElement(Document&);
 
   void DefaultEventHandler(Event&) override;
@@ -78,8 +72,6 @@
 
 class SearchFieldCancelButtonElement final : public HTMLDivElement {
  public:
-  static SearchFieldCancelButtonElement* Create(Document&);
-
   explicit SearchFieldCancelButtonElement(Document&);
 
   void DefaultEventHandler(Event&) override;
diff --git a/third_party/blink/renderer/core/html/forms/text_field_input_type.cc b/third_party/blink/renderer/core/html/forms/text_field_input_type.cc
index e23a4545..ef55cd7 100644
--- a/third_party/blink/renderer/core/html/forms/text_field_input_type.cc
+++ b/third_party/blink/renderer/core/html/forms/text_field_input_type.cc
@@ -296,14 +296,13 @@
     return;
   }
 
-  TextControlInnerContainer* container =
-      TextControlInnerContainer::Create(document);
+  auto* container = MakeGarbageCollected<TextControlInnerContainer>(document);
   container->SetShadowPseudoId(
       AtomicString("-webkit-textfield-decoration-container"));
   shadow_root->AppendChild(container);
 
-  EditingViewPortElement* editing_view_port =
-      EditingViewPortElement::Create(document);
+  auto* editing_view_port =
+      MakeGarbageCollected<EditingViewPortElement>(document);
   editing_view_port->AppendChild(inner_editor);
   container->AppendChild(editing_view_port);
 
@@ -355,12 +354,14 @@
       // FIXME: The following code is similar to createShadowSubtree(),
       // but they are different. We should simplify the code by making
       // containerElement mandatory.
-      Element* rp_container = TextControlInnerContainer::Create(document);
+      auto* rp_container =
+          MakeGarbageCollected<TextControlInnerContainer>(document);
       rp_container->SetShadowPseudoId(
           AtomicString("-webkit-textfield-decoration-container"));
       Element* inner_editor = GetElement().InnerEditorElement();
       inner_editor->parentNode()->ReplaceChild(rp_container, inner_editor);
-      Element* editing_view_port = EditingViewPortElement::Create(document);
+      auto* editing_view_port =
+          MakeGarbageCollected<EditingViewPortElement>(document);
       editing_view_port->AppendChild(inner_editor);
       rp_container->AppendChild(editing_view_port);
       rp_container->AppendChild(
diff --git a/third_party/blink/renderer/core/html/html_content_element.cc b/third_party/blink/renderer/core/html/html_content_element.cc
index c4475a93..b8685a2 100644
--- a/third_party/blink/renderer/core/html/html_content_element.cc
+++ b/third_party/blink/renderer/core/html/html_content_element.cc
@@ -33,6 +33,7 @@
 #include "third_party/blink/renderer/core/dom/shadow_root_v0.h"
 #include "third_party/blink/renderer/core/frame/use_counter.h"
 #include "third_party/blink/renderer/core/html_names.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -55,7 +56,7 @@
   DCHECK(should_parse_select_);
 
   selector_list_ = CSSParser::ParseSelector(
-      CSSParserContext::Create(GetDocument()), nullptr, select_);
+      MakeGarbageCollected<CSSParserContext>(GetDocument()), nullptr, select_);
   should_parse_select_ = false;
   is_valid_selector_ = ValidateSelect();
   if (!is_valid_selector_)
diff --git a/third_party/blink/renderer/core/html/html_marquee_element.cc b/third_party/blink/renderer/core/html/html_marquee_element.cc
index ede4e62..838cd6aa 100644
--- a/third_party/blink/renderer/core/html/html_marquee_element.cc
+++ b/third_party/blink/renderer/core/html/html_marquee_element.cc
@@ -246,23 +246,23 @@
       mover_->GetDocument().GetSecureContextMode();
 
   StringKeyframeVector keyframes;
-  StringKeyframe* keyframe1 = StringKeyframe::Create();
+  auto* keyframe1 = MakeGarbageCollected<StringKeyframe>();
   set_result = keyframe1->SetCSSPropertyValue(
       CSSPropertyID::kTransform, parameters.transform_begin,
       secure_context_mode, style_sheet_contents);
   DCHECK(set_result.did_parse);
   keyframes.push_back(keyframe1);
 
-  StringKeyframe* keyframe2 = StringKeyframe::Create();
+  auto* keyframe2 = MakeGarbageCollected<StringKeyframe>();
   set_result = keyframe2->SetCSSPropertyValue(
       CSSPropertyID::kTransform, parameters.transform_end, secure_context_mode,
       style_sheet_contents);
   DCHECK(set_result.did_parse);
   keyframes.push_back(keyframe2);
 
-  return StringKeyframeEffectModel::Create(keyframes,
-                                           EffectModel::kCompositeReplace,
-                                           LinearTimingFunction::Shared());
+  return MakeGarbageCollected<StringKeyframeEffectModel>(
+      keyframes, EffectModel::kCompositeReplace,
+      LinearTimingFunction::Shared());
 }
 
 void HTMLMarqueeElement::ContinueAnimation() {
@@ -295,8 +295,8 @@
       UnrestrictedDoubleOrString::FromUnrestrictedDouble(duration));
   TimingInput::Update(timing, effect_timing, nullptr, ASSERT_NO_EXCEPTION);
 
-  KeyframeEffect* keyframe_effect =
-      KeyframeEffect::Create(mover_, effect_model, timing);
+  auto* keyframe_effect =
+      MakeGarbageCollected<KeyframeEffect>(mover_, effect_model, timing);
   Animation* player = mover_->GetDocument().Timeline().Play(keyframe_effect);
   player->setId(g_empty_string);
   player->setOnfinish(MakeGarbageCollected<AnimationFinished>(this));
diff --git a/third_party/blink/renderer/core/html/image_document.cc b/third_party/blink/renderer/core/html/image_document.cc
index 65ff3bad..22a86c3 100644
--- a/third_party/blink/renderer/core/html/image_document.cc
+++ b/third_party/blink/renderer/core/html/image_document.cc
@@ -243,9 +243,7 @@
     div_element_->setAttribute(kStyleAttr,
                                "display: flex;"
                                "flex-direction: column;"
-                               "justify-content: center;"
-                               "align-items: center;"
-                               "min-height: min-content;"
+                               "align-items: flex-start;"
                                "min-width: min-content;"
                                "height: 100%;"
                                "width: 100%;");
@@ -382,6 +380,7 @@
   if (ShouldShrinkToFit()) {
     if (shrink_to_fit_mode_ == kViewport)
       image_style.Append("max-width: 100%;");
+    image_style.Append("margin: auto;");
 
     if (image_is_loaded_) {
       MouseCursorMode new_cursor_mode = kDefault;
diff --git a/third_party/blink/renderer/core/html/link_style.cc b/third_party/blink/renderer/core/html/link_style.cc
index e914f08..401c420 100644
--- a/third_party/blink/renderer/core/html/link_style.cc
+++ b/third_party/blink/renderer/core/html/link_style.cc
@@ -17,6 +17,7 @@
 #include "third_party/blink/renderer/core/loader/link_load_parameters.h"
 #include "third_party/blink/renderer/core/loader/resource/css_style_sheet_resource.h"
 #include "third_party/blink/renderer/core/loader/subresource_integrity_helper.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/histogram.h"
 #include "third_party/blink/renderer/platform/loader/fetch/fetch_parameters.h"
 #include "third_party/blink/renderer/platform/loader/subresource_integrity.h"
@@ -86,7 +87,7 @@
     }
   }
 
-  CSSParserContext* parser_context = CSSParserContext::Create(
+  auto* parser_context = MakeGarbageCollected<CSSParserContext>(
       GetDocument(), cached_style_sheet->GetResponse().ResponseUrl(),
       cached_style_sheet->GetResponse().IsCorsSameOrigin(),
       cached_style_sheet->GetReferrerPolicy(), cached_style_sheet->Encoding());
diff --git a/third_party/blink/renderer/core/html/media/html_media_element.cc b/third_party/blink/renderer/core/html/media/html_media_element.cc
index dc286d6..6c8d67c 100644
--- a/third_party/blink/renderer/core/html/media/html_media_element.cc
+++ b/third_party/blink/renderer/core/html/media/html_media_element.cc
@@ -2759,8 +2759,8 @@
            << (AtomicString)kind_string << "', '" << (String)label << "', '"
            << (String)language << "', " << BoolString(enabled) << ")";
 
-  AudioTrack* audio_track =
-      AudioTrack::Create(id, kind_string, label, language, enabled);
+  auto* audio_track = MakeGarbageCollected<AudioTrack>(id, kind_string, label,
+                                                       language, enabled);
   audioTracks().Add(audio_track);
 
   return audio_track->id();
@@ -3664,7 +3664,7 @@
     to_be_inserted = second_child;
   }
 
-  TextTrackContainer* text_track_container = TextTrackContainer::Create(*this);
+  auto* text_track_container = MakeGarbageCollected<TextTrackContainer>(*this);
 
   // The text track container should be inserted before the media controls,
   // so that they are rendered behind them.
diff --git a/third_party/blink/renderer/core/html/media/html_media_element_test.cc b/third_party/blink/renderer/core/html/media/html_media_element_test.cc
index 783b3fc..f38e4f1 100644
--- a/third_party/blink/renderer/core/html/media/html_media_element_test.cc
+++ b/third_party/blink/renderer/core/html/media/html_media_element_test.cc
@@ -96,7 +96,8 @@
       media_ = MakeGarbageCollected<HTMLAudioElement>(
           dummy_page_holder_->GetDocument());
     } else {
-      media_ = HTMLVideoElement::Create(dummy_page_holder_->GetDocument());
+      media_ = MakeGarbageCollected<HTMLVideoElement>(
+          dummy_page_holder_->GetDocument());
     }
   }
 
diff --git a/third_party/blink/renderer/core/html/media/html_video_element.cc b/third_party/blink/renderer/core/html/media/html_video_element.cc
index 3912b67..8244dcc1 100644
--- a/third_party/blink/renderer/core/html/media/html_video_element.cc
+++ b/third_party/blink/renderer/core/html/media/html_video_element.cc
@@ -107,10 +107,6 @@
   UpdateStateIfNeeded();
 }
 
-HTMLVideoElement* HTMLVideoElement::Create(Document& document) {
-  return MakeGarbageCollected<HTMLVideoElement>(document);
-}
-
 void HTMLVideoElement::Trace(Visitor* visitor) {
   visitor->Trace(image_loader_);
   visitor->Trace(custom_controls_fullscreen_detector_);
diff --git a/third_party/blink/renderer/core/html/media/html_video_element.h b/third_party/blink/renderer/core/html/media/html_video_element.h
index 4c1c87ff..bd710023 100644
--- a/third_party/blink/renderer/core/html/media/html_video_element.h
+++ b/third_party/blink/renderer/core/html/media/html_video_element.h
@@ -55,8 +55,6 @@
  public:
   static const int kNoAlreadyUploadedFrame = -1;
 
-  static HTMLVideoElement* Create(Document&);
-
   HTMLVideoElement(Document&);
   void Trace(Visitor*) override;
 
diff --git a/third_party/blink/renderer/core/html/media/html_video_element_test.cc b/third_party/blink/renderer/core/html/media/html_video_element_test.cc
index 37e149c..d5a1f3d1 100644
--- a/third_party/blink/renderer/core/html/media/html_video_element_test.cc
+++ b/third_party/blink/renderer/core/html/media/html_video_element_test.cc
@@ -16,6 +16,7 @@
 #include "third_party/blink/renderer/core/loader/empty_clients.h"
 #include "third_party/blink/renderer/core/paint/paint_layer.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/testing/empty_web_media_player.h"
 #include "third_party/blink/renderer/platform/testing/unit_test_helpers.h"
 
@@ -38,7 +39,7 @@
                          MakeGarbageCollected<test::MediaStubLocalFrameClient>(
                              std::move(mock_media_player)),
                          nullptr);
-    video_ = HTMLVideoElement::Create(GetDocument());
+    video_ = MakeGarbageCollected<HTMLVideoElement>(GetDocument());
     GetDocument().body()->appendChild(video_);
   }
 
diff --git a/third_party/blink/renderer/core/html/media/media_document.cc b/third_party/blink/renderer/core/html/media/media_document.cc
index c1f3144f..8751b11 100644
--- a/third_party/blink/renderer/core/html/media/media_document.cc
+++ b/third_party/blink/renderer/core/html/media/media_document.cc
@@ -92,7 +92,7 @@
   meta->setAttribute(kContentAttr, "width=device-width");
   head->AppendChild(meta);
 
-  HTMLVideoElement* media = HTMLVideoElement::Create(*GetDocument());
+  auto* media = MakeGarbageCollected<HTMLVideoElement>(*GetDocument());
   media->setAttribute(kControlsAttr, "");
   media->setAttribute(kAutoplayAttr, "");
   media->setAttribute(kNameAttr, "media");
diff --git a/third_party/blink/renderer/core/html/media/video_wake_lock_test.cc b/third_party/blink/renderer/core/html/media/video_wake_lock_test.cc
index ca56c94..5fc8dfd 100644
--- a/third_party/blink/renderer/core/html/media/video_wake_lock_test.cc
+++ b/third_party/blink/renderer/core/html/media/video_wake_lock_test.cc
@@ -12,6 +12,7 @@
 #include "third_party/blink/renderer/core/html/media/html_video_element.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
 #include "third_party/blink/renderer/core/testing/wait_for_event.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/testing/empty_web_media_player.h"
 #include "third_party/blink/renderer/platform/testing/unit_test_helpers.h"
 
@@ -109,7 +110,7 @@
         WTF::BindRepeating(&VideoWakeLockPictureInPictureService::Bind,
                            WTF::Unretained(&pip_service_)));
 
-    video_ = HTMLVideoElement::Create(GetDocument());
+    video_ = MakeGarbageCollected<HTMLVideoElement>(GetDocument());
     video_->SetReadyState(HTMLMediaElement::ReadyState::kHaveMetadata);
     video_wake_lock_ = MakeGarbageCollected<VideoWakeLock>(*video_.Get());
 
diff --git a/third_party/blink/renderer/core/html/parser/html_construction_site.cc b/third_party/blink/renderer/core/html/parser/html_construction_site.cc
index 3f6cbc6..f0be937 100644
--- a/third_party/blink/renderer/core/html/parser/html_construction_site.cc
+++ b/third_party/blink/renderer/core/html/parser/html_construction_site.cc
@@ -420,7 +420,8 @@
   }
   SetAttributes(element, token, parser_content_policy_);
   AttachLater(attachment_root_, element);
-  open_elements_.PushHTMLHtmlElement(HTMLStackItem::Create(element, token));
+  open_elements_.PushHTMLHtmlElement(
+      MakeGarbageCollected<HTMLStackItem>(element, token));
 
   ExecuteQueuedTasks();
   element->InsertedByParser();
@@ -670,7 +671,8 @@
 
 void HTMLConstructionSite::InsertHTMLHeadElement(AtomicHTMLToken* token) {
   DCHECK(!ShouldFosterParent());
-  head_ = HTMLStackItem::Create(CreateElement(token, xhtmlNamespaceURI), token);
+  head_ = MakeGarbageCollected<HTMLStackItem>(
+      CreateElement(token, xhtmlNamespaceURI), token);
   AttachLater(CurrentNode(), head_->GetElement());
   open_elements_.PushHTMLHeadElement(head_);
 }
@@ -679,7 +681,8 @@
   DCHECK(!ShouldFosterParent());
   Element* body = CreateElement(token, xhtmlNamespaceURI);
   AttachLater(CurrentNode(), body);
-  open_elements_.PushHTMLBodyElement(HTMLStackItem::Create(body, token));
+  open_elements_.PushHTMLBodyElement(
+      MakeGarbageCollected<HTMLStackItem>(body, token));
   if (document_)
     document_->WillInsertBody();
 }
@@ -695,13 +698,13 @@
                       WebFeature::kDemotedFormElement);
   }
   AttachLater(CurrentNode(), form_element);
-  open_elements_.Push(HTMLStackItem::Create(form_element, token));
+  open_elements_.Push(MakeGarbageCollected<HTMLStackItem>(form_element, token));
 }
 
 void HTMLConstructionSite::InsertHTMLElement(AtomicHTMLToken* token) {
   Element* element = CreateElement(token, xhtmlNamespaceURI);
   AttachLater(CurrentNode(), element);
-  open_elements_.Push(HTMLStackItem::Create(element, token));
+  open_elements_.Push(MakeGarbageCollected<HTMLStackItem>(element, token));
 }
 
 void HTMLConstructionSite::InsertSelfClosingHTMLElementDestroyingToken(
@@ -746,7 +749,7 @@
   SetAttributes(element, token, parser_content_policy_);
   if (ScriptingContentIsAllowed(parser_content_policy_))
     AttachLater(CurrentNode(), element);
-  open_elements_.Push(HTMLStackItem::Create(element, token));
+  open_elements_.Push(MakeGarbageCollected<HTMLStackItem>(element, token));
 }
 
 void HTMLConstructionSite::InsertForeignElement(
@@ -761,8 +764,10 @@
       !element->IsScriptElement()) {
     AttachLater(CurrentNode(), element, token->SelfClosing());
   }
-  if (!token->SelfClosing())
-    open_elements_.Push(HTMLStackItem::Create(element, token, namespace_uri));
+  if (!token->SelfClosing()) {
+    open_elements_.Push(
+        MakeGarbageCollected<HTMLStackItem>(element, token, namespace_uri));
+  }
 }
 
 void HTMLConstructionSite::InsertTextNode(const StringView& string,
@@ -999,7 +1004,8 @@
   AtomicHTMLToken fake_token(HTMLToken::kStartTag, item->LocalName(),
                              item->Attributes());
   element = CreateElement(&fake_token, item->NamespaceURI());
-  return HTMLStackItem::Create(element, &fake_token, item->NamespaceURI());
+  return MakeGarbageCollected<HTMLStackItem>(element, &fake_token,
+                                             item->NamespaceURI());
 }
 
 bool HTMLConstructionSite::IndexOfFirstUnopenFormattingElement(
diff --git a/third_party/blink/renderer/core/html/parser/html_document_parser.cc b/third_party/blink/renderer/core/html/parser/html_document_parser.cc
index 003433b..c8ab1dd 100644
--- a/third_party/blink/renderer/core/html/parser/html_document_parser.cc
+++ b/third_party/blink/renderer/core/html/parser/html_document_parser.cc
@@ -56,6 +56,7 @@
 #include "third_party/blink/renderer/platform/bindings/v8_per_isolate_data.h"
 #include "third_party/blink/renderer/platform/cross_thread_functional.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/histogram.h"
 #include "third_party/blink/renderer/platform/instrumentation/tracing/trace_event.h"
 #include "third_party/blink/renderer/platform/loader/fetch/resource_fetcher.h"
@@ -100,8 +101,8 @@
     : HTMLDocumentParser(document, kAllowScriptingContent, sync_policy) {
   script_runner_ =
       HTMLParserScriptRunner::Create(ReentryPermit(), &document, this);
-  tree_builder_ =
-      HTMLTreeBuilder::Create(this, document, kAllowScriptingContent, options_);
+  tree_builder_ = MakeGarbageCollected<HTMLTreeBuilder>(
+      this, document, kAllowScriptingContent, options_);
 }
 
 HTMLDocumentParser::HTMLDocumentParser(
@@ -112,8 +113,8 @@
                          parser_content_policy,
                          kForceSynchronousParsing) {
   // No script_runner_ in fragment parser.
-  tree_builder_ = HTMLTreeBuilder::Create(this, fragment, context_element,
-                                          parser_content_policy, options_);
+  tree_builder_ = MakeGarbageCollected<HTMLTreeBuilder>(
+      this, fragment, context_element, parser_content_policy, options_);
 
   // For now document fragment parsing never reports errors.
   bool report_errors = false;
@@ -135,10 +136,11 @@
                      ? std::make_unique<HTMLTokenizer>(options_)
                      : nullptr),
       loading_task_runner_(document.GetTaskRunner(TaskType::kNetworking)),
-      parser_scheduler_(
-          sync_policy == kAllowAsynchronousParsing
-              ? HTMLParserScheduler::Create(this, loading_task_runner_.get())
-              : nullptr),
+      parser_scheduler_(sync_policy == kAllowAsynchronousParsing
+                            ? MakeGarbageCollected<HTMLParserScheduler>(
+                                  this,
+                                  loading_task_runner_.get())
+                            : nullptr),
       xss_auditor_delegate_(&document),
       pending_csp_meta_token_(nullptr),
       should_use_threading_(sync_policy == kAllowAsynchronousParsing),
@@ -170,7 +172,7 @@
       !document.IsPrefetchOnly())
     return;
 
-  preloader_ = HTMLResourcePreloader::Create(document);
+  preloader_ = MakeGarbageCollected<HTMLResourcePreloader>(document);
 }
 
 HTMLDocumentParser::~HTMLDocumentParser() = default;
@@ -1130,7 +1132,7 @@
     DocumentFragment* fragment,
     Element* context_element,
     ParserContentPolicy parser_content_policy) {
-  HTMLDocumentParser* parser = HTMLDocumentParser::Create(
+  auto* parser = MakeGarbageCollected<HTMLDocumentParser>(
       fragment, context_element, parser_content_policy);
   parser->Append(source);
   parser->Finish();
diff --git a/third_party/blink/renderer/core/html/parser/html_document_parser.h b/third_party/blink/renderer/core/html/parser/html_document_parser.h
index 2384523d..c935616 100644
--- a/third_party/blink/renderer/core/html/parser/html_document_parser.h
+++ b/third_party/blink/renderer/core/html/parser/html_document_parser.h
@@ -71,13 +71,6 @@
   USING_PRE_FINALIZER(HTMLDocumentParser, Dispose);
 
  public:
-  static HTMLDocumentParser* Create(
-      HTMLDocument& document,
-      ParserSynchronizationPolicy background_parsing_policy) {
-    return MakeGarbageCollected<HTMLDocumentParser>(document,
-                                                    background_parsing_policy);
-  }
-
   HTMLDocumentParser(HTMLDocument&, ParserSynchronizationPolicy);
   HTMLDocumentParser(DocumentFragment*,
                      Element* context_element,
@@ -150,12 +143,6 @@
   void ForcePlaintextForTextDocument();
 
  private:
-  static HTMLDocumentParser* Create(DocumentFragment* fragment,
-                                    Element* context_element,
-                                    ParserContentPolicy parser_content_policy) {
-    return MakeGarbageCollected<HTMLDocumentParser>(fragment, context_element,
-                                                    parser_content_policy);
-  }
   HTMLDocumentParser(Document&,
                      ParserContentPolicy,
                      ParserSynchronizationPolicy);
diff --git a/third_party/blink/renderer/core/html/parser/html_document_parser_test.cc b/third_party/blink/renderer/core/html/parser/html_document_parser_test.cc
index 325fbbd..33750ce 100644
--- a/third_party/blink/renderer/core/html/parser/html_document_parser_test.cc
+++ b/third_party/blink/renderer/core/html/parser/html_document_parser_test.cc
@@ -12,6 +12,7 @@
 #include "third_party/blink/renderer/core/loader/prerenderer_client.h"
 #include "third_party/blink/renderer/core/loader/text_resource_decoder_builder.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -52,8 +53,8 @@
   }
 
   HTMLDocumentParser* CreateParser(HTMLDocument& document) {
-    HTMLDocumentParser* parser =
-        HTMLDocumentParser::Create(document, kForceSynchronousParsing);
+    auto* parser = MakeGarbageCollected<HTMLDocumentParser>(
+        document, kForceSynchronousParsing);
     std::unique_ptr<TextResourceDecoder> decoder(
         BuildTextResourceDecoderFor(&document, "text/html", g_null_atom));
     parser->SetDecoder(std::move(decoder));
diff --git a/third_party/blink/renderer/core/html/parser/html_parser_scheduler.h b/third_party/blink/renderer/core/html/parser/html_parser_scheduler.h
index bff4686..612dd39f 100644
--- a/third_party/blink/renderer/core/html/parser/html_parser_scheduler.h
+++ b/third_party/blink/renderer/core/html/parser/html_parser_scheduler.h
@@ -26,8 +26,6 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_HTML_PARSER_HTML_PARSER_SCHEDULER_H_
 #define THIRD_PARTY_BLINK_RENDERER_CORE_HTML_PARSER_HTML_PARSER_SCHEDULER_H_
 
-#include <memory>
-
 #include "base/macros.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/single_thread_task_runner.h"
@@ -58,13 +56,6 @@
 class HTMLParserScheduler final
     : public GarbageCollectedFinalized<HTMLParserScheduler> {
  public:
-  static HTMLParserScheduler* Create(
-      HTMLDocumentParser* parser,
-      scoped_refptr<base::SingleThreadTaskRunner> loading_task_runner) {
-    return MakeGarbageCollected<HTMLParserScheduler>(
-        parser, std::move(loading_task_runner));
-  }
-
   HTMLParserScheduler(HTMLDocumentParser*,
                       scoped_refptr<base::SingleThreadTaskRunner>);
   ~HTMLParserScheduler();
diff --git a/third_party/blink/renderer/core/html/parser/html_resource_preloader.cc b/third_party/blink/renderer/core/html/parser/html_resource_preloader.cc
index 69a9792..4e16dc0 100644
--- a/third_party/blink/renderer/core/html/parser/html_resource_preloader.cc
+++ b/third_party/blink/renderer/core/html/parser/html_resource_preloader.cc
@@ -40,10 +40,6 @@
 HTMLResourcePreloader::HTMLResourcePreloader(Document& document)
     : document_(document) {}
 
-HTMLResourcePreloader* HTMLResourcePreloader::Create(Document& document) {
-  return MakeGarbageCollected<HTMLResourcePreloader>(document);
-}
-
 void HTMLResourcePreloader::Trace(Visitor* visitor) {
   visitor->Trace(document_);
 }
diff --git a/third_party/blink/renderer/core/html/parser/html_resource_preloader.h b/third_party/blink/renderer/core/html/parser/html_resource_preloader.h
index de995b53..f161004 100644
--- a/third_party/blink/renderer/core/html/parser/html_resource_preloader.h
+++ b/third_party/blink/renderer/core/html/parser/html_resource_preloader.h
@@ -45,8 +45,6 @@
   friend class HTMLResourcePreloaderTest;
 
  public:
-  static HTMLResourcePreloader* Create(Document&);
-
   explicit HTMLResourcePreloader(Document&);
 
   void Trace(Visitor*);
diff --git a/third_party/blink/renderer/core/html/parser/html_resource_preloader_test.cc b/third_party/blink/renderer/core/html/parser/html_resource_preloader_test.cc
index bdab3f7..4255c0b 100644
--- a/third_party/blink/renderer/core/html/parser/html_resource_preloader_test.cc
+++ b/third_party/blink/renderer/core/html/parser/html_resource_preloader_test.cc
@@ -72,8 +72,8 @@
     DCHECK(preload_request);
     if (test_case.is_cors)
       preload_request->SetCrossOrigin(kCrossOriginAttributeAnonymous);
-    HTMLResourcePreloader* preloader =
-        HTMLResourcePreloader::Create(GetDocument());
+    auto* preloader =
+        MakeGarbageCollected<HTMLResourcePreloader>(GetDocument());
     preloader->Preload(std::move(preload_request));
     ASSERT_TRUE(platform_->GetMockPrescientNetworking().DidPreconnect());
     ASSERT_NE(test_case.is_cors,
diff --git a/third_party/blink/renderer/core/html/parser/html_stack_item.h b/third_party/blink/renderer/core/html/parser/html_stack_item.h
index d2778af..e300375 100644
--- a/third_party/blink/renderer/core/html/parser/html_stack_item.h
+++ b/third_party/blink/renderer/core/html/parser/html_stack_item.h
@@ -41,19 +41,6 @@
  public:
   enum ItemType { kItemForContextElement, kItemForDocumentFragmentNode };
 
-  // Used by document fragment node and context element.
-  static HTMLStackItem* Create(ContainerNode* node, ItemType type) {
-    return MakeGarbageCollected<HTMLStackItem>(node, type);
-  }
-
-  // Used by HTMLElementStack and HTMLFormattingElementList.
-  static HTMLStackItem* Create(
-      ContainerNode* node,
-      AtomicHTMLToken* token,
-      const AtomicString& namespace_uri = html_names::xhtmlNamespaceURI) {
-    return MakeGarbageCollected<HTMLStackItem>(node, token, namespace_uri);
-  }
-
   HTMLStackItem(ContainerNode* node, ItemType type) : node_(node) {
     switch (type) {
       case kItemForDocumentFragmentNode:
diff --git a/third_party/blink/renderer/core/html/parser/html_tree_builder.cc b/third_party/blink/renderer/core/html/parser/html_tree_builder.cc
index 2ca0829..2d3956c 100644
--- a/third_party/blink/renderer/core/html/parser/html_tree_builder.cc
+++ b/third_party/blink/renderer/core/html/parser/html_tree_builder.cc
@@ -51,6 +51,7 @@
 #include "third_party/blink/renderer/platform/bindings/exception_state.h"
 #include "third_party/blink/renderer/platform/bindings/runtime_call_stats.h"
 #include "third_party/blink/renderer/platform/bindings/v8_per_isolate_data.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/text/platform_locale.h"
 #include "third_party/blink/renderer/platform/wtf/text/character_names.h"
 
@@ -249,7 +250,7 @@
   // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-end.html#fragment-case
   // For efficiency, we skip step 4.2 ("Let root be a new html element with no
   // attributes") and instead use the DocumentFragment as a root node.
-  tree_.OpenElements()->PushRootNode(HTMLStackItem::Create(
+  tree_.OpenElements()->PushRootNode(MakeGarbageCollected<HTMLStackItem>(
       fragment, HTMLStackItem::kItemForDocumentFragmentNode));
 
   if (IsHTMLTemplateElement(*context_element))
@@ -265,7 +266,7 @@
   DCHECK(fragment);
   DCHECK(!fragment->HasChildren());
   fragment_ = fragment;
-  context_element_stack_item_ = HTMLStackItem::Create(
+  context_element_stack_item_ = MakeGarbageCollected<HTMLStackItem>(
       context_element, HTMLStackItem::kItemForContextElement);
 }
 
diff --git a/third_party/blink/renderer/core/html/parser/html_tree_builder.h b/third_party/blink/renderer/core/html/parser/html_tree_builder.h
index cc8f5145..af7b90d7 100644
--- a/third_party/blink/renderer/core/html/parser/html_tree_builder.h
+++ b/third_party/blink/renderer/core/html/parser/html_tree_builder.h
@@ -52,22 +52,6 @@
   // editing code.
   // TODO(kouhei): Fix editing code to always invoke HTML parser on
   // HTMLDocument.
-  static HTMLTreeBuilder* Create(HTMLDocumentParser* parser,
-                                 Document& document,
-                                 ParserContentPolicy parser_content_policy,
-                                 const HTMLParserOptions& options) {
-    return MakeGarbageCollected<HTMLTreeBuilder>(
-        parser, document, parser_content_policy, options);
-  }
-  static HTMLTreeBuilder* Create(HTMLDocumentParser* parser,
-                                 DocumentFragment* fragment,
-                                 Element* context_element,
-                                 ParserContentPolicy parser_content_policy,
-                                 const HTMLParserOptions& options) {
-    return MakeGarbageCollected<HTMLTreeBuilder>(
-        parser, fragment, context_element, parser_content_policy, options);
-  }
-
   HTMLTreeBuilder(HTMLDocumentParser*,
                   Document&,
                   ParserContentPolicy,
diff --git a/third_party/blink/renderer/core/html/parser/html_view_source_parser.h b/third_party/blink/renderer/core/html/parser/html_view_source_parser.h
index ba9cd536..d953379 100644
--- a/third_party/blink/renderer/core/html/parser/html_view_source_parser.h
+++ b/third_party/blink/renderer/core/html/parser/html_view_source_parser.h
@@ -40,11 +40,6 @@
 class CORE_EXPORT HTMLViewSourceParser final
     : public DecodedDataDocumentParser {
  public:
-  static HTMLViewSourceParser* Create(HTMLViewSourceDocument& document,
-                                      const String& mime_type) {
-    return MakeGarbageCollected<HTMLViewSourceParser>(document, mime_type);
-  }
-
   HTMLViewSourceParser(HTMLViewSourceDocument&, const String& mime_type);
   ~HTMLViewSourceParser() override = default;
 
diff --git a/third_party/blink/renderer/core/html/parser/text_document_parser.h b/third_party/blink/renderer/core/html/parser/text_document_parser.h
index 0fc7fbff0..1556fb0 100644
--- a/third_party/blink/renderer/core/html/parser/text_document_parser.h
+++ b/third_party/blink/renderer/core/html/parser/text_document_parser.h
@@ -31,11 +31,6 @@
 
 class TextDocumentParser final : public HTMLDocumentParser {
  public:
-  static TextDocumentParser* Create(HTMLDocument& document,
-                                    ParserSynchronizationPolicy sync_policy) {
-    return MakeGarbageCollected<TextDocumentParser>(document, sync_policy);
-  }
-
   explicit TextDocumentParser(HTMLDocument&, ParserSynchronizationPolicy);
   ~TextDocumentParser() override;
 
diff --git a/third_party/blink/renderer/core/html/plugin_document.cc b/third_party/blink/renderer/core/html/plugin_document.cc
index 4ba05f1..ab95ea8 100644
--- a/third_party/blink/renderer/core/html/plugin_document.cc
+++ b/third_party/blink/renderer/core/html/plugin_document.cc
@@ -54,12 +54,6 @@
 // FIXME: Share more code with MediaDocumentParser.
 class PluginDocumentParser : public RawDataDocumentParser {
  public:
-  static PluginDocumentParser* Create(PluginDocument* document,
-                                      Color background_color) {
-    return MakeGarbageCollected<PluginDocumentParser>(document,
-                                                      background_color);
-  }
-
   PluginDocumentParser(Document* document, Color background_color)
       : RawDataDocumentParser(document),
         embed_element_(nullptr),
@@ -201,7 +195,7 @@
 }
 
 DocumentParser* PluginDocument::CreateParser() {
-  return PluginDocumentParser::Create(this, background_color_);
+  return MakeGarbageCollected<PluginDocumentParser>(this, background_color_);
 }
 
 WebPluginContainerImpl* PluginDocument::GetPluginView() {
diff --git a/third_party/blink/renderer/core/html/portal/html_portal_element.cc b/third_party/blink/renderer/core/html/portal/html_portal_element.cc
index 8b56786..82a47d7 100644
--- a/third_party/blink/renderer/core/html/portal/html_portal_element.cc
+++ b/third_party/blink/renderer/core/html/portal/html_portal_element.cc
@@ -58,13 +58,6 @@
   visitor->Trace(portal_frame_);
 }
 
-HTMLElement* HTMLPortalElement::Create(Document& document) {
-  if (RuntimeEnabledFeatures::PortalsEnabled())
-    return MakeGarbageCollected<HTMLPortalElement>(document);
-  return MakeGarbageCollected<HTMLUnknownElement>(html_names::kPortalTag,
-                                                  document);
-}
-
 void HTMLPortalElement::Navigate() {
   KURL url = GetNonEmptyURLAttribute(html_names::kSrcAttr);
   if (!url.IsEmpty() && portal_ptr_) {
diff --git a/third_party/blink/renderer/core/html/portal/html_portal_element.h b/third_party/blink/renderer/core/html/portal/html_portal_element.h
index 1864855..296f1022 100644
--- a/third_party/blink/renderer/core/html/portal/html_portal_element.h
+++ b/third_party/blink/renderer/core/html/portal/html_portal_element.h
@@ -30,8 +30,6 @@
   DEFINE_WRAPPERTYPEINFO();
 
  public:
-  static HTMLElement* Create(Document&);
-
   explicit HTMLPortalElement(
       Document& document,
       const base::UnguessableToken& portal_token = base::UnguessableToken(),
diff --git a/third_party/blink/renderer/core/html/text_document.cc b/third_party/blink/renderer/core/html/text_document.cc
index 3802a6e..26cd7ce 100644
--- a/third_party/blink/renderer/core/html/text_document.cc
+++ b/third_party/blink/renderer/core/html/text_document.cc
@@ -26,6 +26,7 @@
 
 #include "third_party/blink/renderer/core/frame/use_counter.h"
 #include "third_party/blink/renderer/core/html/parser/text_document_parser.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -36,7 +37,8 @@
 }
 
 DocumentParser* TextDocument::CreateParser() {
-  return TextDocumentParser::Create(*this, GetParserSynchronizationPolicy());
+  return MakeGarbageCollected<TextDocumentParser>(
+      *this, GetParserSynchronizationPolicy());
 }
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/html/track/audio_track.cc b/third_party/blink/renderer/core/html/track/audio_track.cc
index c89577c..53484fa 100644
--- a/third_party/blink/renderer/core/html/track/audio_track.cc
+++ b/third_party/blink/renderer/core/html/track/audio_track.cc
@@ -13,7 +13,11 @@
                        const AtomicString& label,
                        const AtomicString& language,
                        bool enabled)
-    : TrackBase(WebMediaPlayer::kAudioTrack, kind, label, language, id),
+    : TrackBase(WebMediaPlayer::kAudioTrack,
+                IsValidKindKeyword(kind) ? kind : g_empty_atom,
+                label,
+                language,
+                id),
       enabled_(enabled) {}
 
 AudioTrack::~AudioTrack() = default;
diff --git a/third_party/blink/renderer/core/html/track/audio_track.h b/third_party/blink/renderer/core/html/track/audio_track.h
index db86e9f3..380c3b2 100644
--- a/third_party/blink/renderer/core/html/track/audio_track.h
+++ b/third_party/blink/renderer/core/html/track/audio_track.h
@@ -16,16 +16,6 @@
   USING_GARBAGE_COLLECTED_MIXIN(AudioTrack);
 
  public:
-  static AudioTrack* Create(const String& id,
-                            const AtomicString& kind,
-                            const AtomicString& label,
-                            const AtomicString& language,
-                            bool enabled) {
-    return MakeGarbageCollected<AudioTrack>(
-        id, IsValidKindKeyword(kind) ? kind : g_empty_atom, label, language,
-        enabled);
-  }
-
   AudioTrack(const String& id,
              const AtomicString& kind,
              const AtomicString& label,
diff --git a/third_party/blink/renderer/core/html/track/audio_track_list.h b/third_party/blink/renderer/core/html/track/audio_track_list.h
index 44d62fee..9e831d4 100644
--- a/third_party/blink/renderer/core/html/track/audio_track_list.h
+++ b/third_party/blink/renderer/core/html/track/audio_track_list.h
@@ -14,8 +14,6 @@
   DEFINE_WRAPPERTYPEINFO();
 
  public:
-  static AudioTrackList* Create(HTMLMediaElement&);
-
   explicit AudioTrackList(HTMLMediaElement&);
   ~AudioTrackList() override;
 
diff --git a/third_party/blink/renderer/core/html/track/text_track_container.cc b/third_party/blink/renderer/core/html/track/text_track_container.cc
index 85f8ab9d..872db89 100644
--- a/third_party/blink/renderer/core/html/track/text_track_container.cc
+++ b/third_party/blink/renderer/core/html/track/text_track_container.cc
@@ -69,22 +69,18 @@
 TextTrackContainer::TextTrackContainer(Document& document)
     : HTMLDivElement(document), default_font_size_(0) {}
 
+TextTrackContainer::TextTrackContainer(HTMLMediaElement& media_element)
+    : TextTrackContainer(media_element.GetDocument()) {
+  SetShadowPseudoId(AtomicString("-webkit-media-text-track-container"));
+  if (IsHTMLVideoElement(media_element))
+    ObserveSizeChanges(media_element);
+}
+
 void TextTrackContainer::Trace(Visitor* visitor) {
   visitor->Trace(video_size_observer_);
   HTMLDivElement::Trace(visitor);
 }
 
-TextTrackContainer* TextTrackContainer::Create(
-    HTMLMediaElement& media_element) {
-  TextTrackContainer* element =
-      MakeGarbageCollected<TextTrackContainer>(media_element.GetDocument());
-  element->SetShadowPseudoId(
-      AtomicString("-webkit-media-text-track-container"));
-  if (IsHTMLVideoElement(media_element))
-    element->ObserveSizeChanges(media_element);
-  return element;
-}
-
 LayoutObject* TextTrackContainer::CreateLayoutObject(const ComputedStyle&,
                                                      LegacyLayout) {
   // TODO(mstensho): Should use LayoutObjectFactory to create the right type of
diff --git a/third_party/blink/renderer/core/html/track/text_track_container.h b/third_party/blink/renderer/core/html/track/text_track_container.h
index 031549c..5735a05 100644
--- a/third_party/blink/renderer/core/html/track/text_track_container.h
+++ b/third_party/blink/renderer/core/html/track/text_track_container.h
@@ -39,9 +39,8 @@
 
 class TextTrackContainer final : public HTMLDivElement {
  public:
-  static TextTrackContainer* Create(HTMLMediaElement&);
-
   TextTrackContainer(Document&);
+  TextTrackContainer(HTMLMediaElement&);
 
   // Runs the "rules for updating the text track rendering". The
   // ExposingControls enum is used in the WebVTT processing model to reset the
diff --git a/third_party/blink/renderer/core/html/track/text_track_list_test.cc b/third_party/blink/renderer/core/html/track/text_track_list_test.cc
index e389d3b..cd4b260 100644
--- a/third_party/blink/renderer/core/html/track/text_track_list_test.cc
+++ b/third_party/blink/renderer/core/html/track/text_track_list_test.cc
@@ -8,13 +8,15 @@
 #include "third_party/blink/renderer/core/html/media/html_video_element.h"
 #include "third_party/blink/renderer/core/html/track/text_track.h"
 #include "third_party/blink/renderer/core/testing/dummy_page_holder.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
 TEST(TextTrackListTest, InvalidateTrackIndexes) {
   // Create and fill the list
-  auto* list = MakeGarbageCollected<TextTrackList>(HTMLVideoElement::Create(
-      std::make_unique<DummyPageHolder>()->GetDocument()));
+  auto* list = MakeGarbageCollected<TextTrackList>(
+      MakeGarbageCollected<HTMLVideoElement>(
+          std::make_unique<DummyPageHolder>()->GetDocument()));
   const size_t kNumTextTracks = 4;
   TextTrack* text_tracks[kNumTextTracks];
   for (size_t i = 0; i < kNumTextTracks; ++i) {
diff --git a/third_party/blink/renderer/core/html/track/video_track.h b/third_party/blink/renderer/core/html/track/video_track.h
index 5af8076..8869e97 100644
--- a/third_party/blink/renderer/core/html/track/video_track.h
+++ b/third_party/blink/renderer/core/html/track/video_track.h
@@ -16,16 +16,6 @@
   USING_GARBAGE_COLLECTED_MIXIN(VideoTrack);
 
  public:
-  static VideoTrack* Create(const String& id,
-                            const AtomicString& kind,
-                            const AtomicString& label,
-                            const AtomicString& language,
-                            bool selected) {
-    return MakeGarbageCollected<VideoTrack>(
-        id, IsValidKindKeyword(kind) ? kind : g_empty_atom, label, language,
-        selected);
-  }
-
   VideoTrack(const String& id,
              const AtomicString& kind,
              const AtomicString& label,
diff --git a/third_party/blink/renderer/core/input/mouse_event_manager.cc b/third_party/blink/renderer/core/input/mouse_event_manager.cc
index 61be9f5..38265676 100644
--- a/third_party/blink/renderer/core/input/mouse_event_manager.cc
+++ b/third_party/blink/renderer/core/input/mouse_event_manager.cc
@@ -474,7 +474,8 @@
 void MouseEventManager::NodeChildrenWillBeRemoved(ContainerNode& container) {
   if (container == click_element_)
     return;
-  if (!container.IsShadowIncludingInclusiveAncestorOf(click_element_.Get()))
+  if (!click_element_ ||
+      !container.IsShadowIncludingInclusiveAncestorOf(*click_element_))
     return;
   click_element_ = nullptr;
 
@@ -483,8 +484,8 @@
 }
 
 void MouseEventManager::NodeWillBeRemoved(Node& node_to_be_removed) {
-  if (node_to_be_removed.IsShadowIncludingInclusiveAncestorOf(
-          click_element_.Get())) {
+  if (click_element_ && node_to_be_removed.IsShadowIncludingInclusiveAncestorOf(
+                            *click_element_)) {
     // We don't dispatch click events if the mousedown node is removed
     // before a mouseup event. It is compatible with IE and Firefox.
     click_element_ = nullptr;
@@ -571,7 +572,9 @@
   if (element.AuthorShadowRoot() &&
       element.AuthorShadowRoot()->delegatesFocus()) {
     Document* doc = frame_->GetDocument();
-    if (element.IsShadowIncludingInclusiveAncestorOf(doc->FocusedElement())) {
+    Element* focused_element = doc->FocusedElement();
+    if (focused_element &&
+        element.IsShadowIncludingInclusiveAncestorOf(*focused_element)) {
       // If the inner element is already focused, do nothing.
       return true;
     }
@@ -582,7 +585,7 @@
     DCHECK(page);
     Element* found =
         page->GetFocusController().FindFocusableElementInShadowHost(element);
-    if (found && element.IsShadowIncludingInclusiveAncestorOf(found)) {
+    if (found && element.IsShadowIncludingInclusiveAncestorOf(*found)) {
       // Use WebFocusTypeForward instead of WebFocusTypeMouse here to mean the
       // focus has slided.
       found->focus(FocusParams(SelectionBehaviorOnFocus::kReset,
diff --git a/third_party/blink/renderer/core/inspector/inspector_animation_agent.cc b/third_party/blink/renderer/core/inspector/inspector_animation_agent.cc
index 4b33f1e..8eaf6a38 100644
--- a/third_party/blink/renderer/core/inspector/inspector_animation_agent.cc
+++ b/third_party/blink/renderer/core/inspector/inspector_animation_agent.cc
@@ -30,6 +30,7 @@
 #include "third_party/blink/renderer/core/inspector/inspector_style_sheet.h"
 #include "third_party/blink/renderer/core/inspector/v8_inspector_string.h"
 #include "third_party/blink/renderer/platform/animation/timing_function.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/wtf/text/base64.h"
 
 namespace blink {
@@ -273,7 +274,8 @@
       StringKeyframeVector new_keyframes;
       for (auto& old_keyframe : old_keyframes)
         new_keyframes.push_back(ToStringKeyframe(old_keyframe));
-      new_model = StringKeyframeEffectModel::Create(new_keyframes);
+      new_model =
+          MakeGarbageCollected<StringKeyframeEffectModel>(new_keyframes);
     } else if (old_model->IsTransitionKeyframeEffectModel()) {
       TransitionKeyframeEffectModel* old_transition_keyframe_model =
           ToTransitionKeyframeEffectModel(old_model);
@@ -281,10 +283,11 @@
       TransitionKeyframeVector new_keyframes;
       for (auto& old_keyframe : old_keyframes)
         new_keyframes.push_back(ToTransitionKeyframe(old_keyframe));
-      new_model = TransitionKeyframeEffectModel::Create(new_keyframes);
+      new_model =
+          MakeGarbageCollected<TransitionKeyframeEffectModel>(new_keyframes);
     }
 
-    KeyframeEffect* new_effect = KeyframeEffect::Create(
+    auto* new_effect = MakeGarbageCollected<KeyframeEffect>(
         old_effect->target(), new_model, old_effect->SpecifiedTiming());
     is_cloning_ = true;
     blink::Animation* clone =
diff --git a/third_party/blink/renderer/core/inspector/inspector_css_agent.cc b/third_party/blink/renderer/core/inspector/inspector_css_agent.cc
index 86b7c2f0..862d52b 100644
--- a/third_party/blink/renderer/core/inspector/inspector_css_agent.cc
+++ b/third_party/blink/renderer/core/inspector/inspector_css_agent.cc
@@ -91,6 +91,7 @@
 #include "third_party/blink/renderer/platform/fonts/font_custom_platform_data.h"
 #include "third_party/blink/renderer/platform/fonts/shaping/caching_word_shaper.h"
 #include "third_party/blink/renderer/platform/fonts/shaping/shape_result_view.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/text/text_run.h"
 #include "third_party/blink/renderer/platform/wtf/allocator.h"
 #include "third_party/blink/renderer/platform/wtf/text/cstring.h"
@@ -121,7 +122,7 @@
   StyleSheetContents* style_sheet_contents = StyleSheetContents::Create(
       StrictCSSParserContext(document->GetSecureContextMode()));
   String text = " div { " + shorthand + ": " + old_text + "; }";
-  CSSParser::ParseSheet(CSSParserContext::Create(*document),
+  CSSParser::ParseSheet(MakeGarbageCollected<CSSParserContext>(*document),
                         style_sheet_contents, text);
 
   CSSStyleSheet* style_sheet = CSSStyleSheet::Create(style_sheet_contents);
diff --git a/third_party/blink/renderer/core/inspector/inspector_overlay_agent.cc b/third_party/blink/renderer/core/inspector/inspector_overlay_agent.cc
index 4ae23fc..9f68b58 100644
--- a/third_party/blink/renderer/core/inspector/inspector_overlay_agent.cc
+++ b/third_party/blink/renderer/core/inspector/inspector_overlay_agent.cc
@@ -80,6 +80,7 @@
 #include "third_party/blink/renderer/platform/graphics/paint/drawing_recorder.h"
 #include "third_party/blink/renderer/platform/graphics/paint/foreign_layer_display_item.h"
 #include "third_party/blink/renderer/platform/graphics/paint/paint_record_builder.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/keyboard_codes.h"
 #include "v8/include/v8.h"
 
@@ -846,9 +847,9 @@
 
   DEFINE_STATIC_LOCAL(Persistent<LocalFrameClient>, dummy_local_frame_client,
                       (MakeGarbageCollected<EmptyLocalFrameClient>()));
-  LocalFrame* frame =
-      LocalFrame::Create(dummy_local_frame_client, *overlay_page_, nullptr);
-  frame->SetView(LocalFrameView::Create(*frame));
+  auto* frame = MakeGarbageCollected<LocalFrame>(dummy_local_frame_client,
+                                                 *overlay_page_, nullptr);
+  frame->SetView(MakeGarbageCollected<LocalFrameView>(*frame));
   frame->Init();
   frame->View()->SetCanHaveScrollbars(false);
   frame->View()->SetBaseBackgroundColor(Color::kTransparent);
@@ -862,9 +863,9 @@
 
   DEFINE_STATIC_LOCAL(Persistent<LocalFrameClient>, dummy_local_frame_client,
                       (MakeGarbageCollected<EmptyLocalFrameClient>()));
-  LocalFrame* frame =
-      LocalFrame::Create(dummy_local_frame_client, *overlay_page_, nullptr);
-  frame->SetView(LocalFrameView::Create(*frame));
+  auto* frame = MakeGarbageCollected<LocalFrame>(dummy_local_frame_client,
+                                                 *overlay_page_, nullptr);
+  frame->SetView(MakeGarbageCollected<LocalFrameView>(*frame));
   frame->Init();
   frame->View()->SetCanHaveScrollbars(false);
   frame->View()->SetBaseBackgroundColor(Color::kTransparent);
diff --git a/third_party/blink/renderer/core/inspector/inspector_style_sheet.cc b/third_party/blink/renderer/core/inspector/inspector_style_sheet.cc
index 2b21486..b040d3e5 100644
--- a/third_party/blink/renderer/core/inspector/inspector_style_sheet.cc
+++ b/third_party/blink/renderer/core/inspector/inspector_style_sheet.cc
@@ -54,6 +54,7 @@
 #include "third_party/blink/renderer/core/inspector/inspector_resource_container.h"
 #include "third_party/blink/renderer/core/svg/svg_style_element.h"
 #include "third_party/blink/renderer/platform/bindings/exception_state.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/wtf/allocator.h"
 #include "third_party/blink/renderer/platform/wtf/text/string_builder.h"
 #include "third_party/blink/renderer/platform/wtf/text/text_position.h"
@@ -66,7 +67,7 @@
 
 static const CSSParserContext* ParserContextForDocument(Document* document) {
   // Fallback to an insecure context parser if no document is present.
-  return document ? CSSParserContext::Create(*document)
+  return document ? MakeGarbageCollected<CSSParserContext>(*document)
                   : StrictCSSParserContext(SecureContextMode::kInsecureContext);
 }
 
diff --git a/third_party/blink/renderer/core/invisible_dom/BUILD.gn b/third_party/blink/renderer/core/invisible_dom/BUILD.gn
index 724181a..86acb9d7 100644
--- a/third_party/blink/renderer/core/invisible_dom/BUILD.gn
+++ b/third_party/blink/renderer/core/invisible_dom/BUILD.gn
@@ -8,7 +8,6 @@
   sources = [
     "activate_invisible_event.cc",
     "activate_invisible_event.h",
-    "activate_invisible_event.idl",
     "invisible_dom.cc",
     "invisible_dom.h",
   ]
diff --git a/third_party/blink/renderer/core/layout/custom/layout_worklet_global_scope.cc b/third_party/blink/renderer/core/layout/custom/layout_worklet_global_scope.cc
index 5920b3d..1eb519d 100644
--- a/third_party/blink/renderer/core/layout/custom/layout_worklet_global_scope.cc
+++ b/third_party/blink/renderer/core/layout/custom/layout_worklet_global_scope.cc
@@ -32,7 +32,6 @@
   auto* global_scope = MakeGarbageCollected<LayoutWorkletGlobalScope>(
       frame, std::move(creation_params), reporting_proxy,
       pending_layout_registry);
-  // TODO(bashi): Handle a case where the script controller fails to initialize.
   global_scope->ScriptController()->Initialize(NullURL());
   MainThreadDebugger::Instance()->ContextCreated(
       global_scope->ScriptController()->GetScriptState(),
diff --git a/third_party/blink/renderer/core/layout/layout_box.cc b/third_party/blink/renderer/core/layout/layout_box.cc
index 4d84368..6cc6d0c 100644
--- a/third_party/blink/renderer/core/layout/layout_box.cc
+++ b/third_party/blink/renderer/core/layout/layout_box.cc
@@ -814,16 +814,25 @@
 LayoutUnit LayoutBox::ConstrainLogicalHeightByMinMax(
     LayoutUnit logical_height,
     LayoutUnit intrinsic_content_height) const {
-  const ComputedStyle& style_to_use = StyleRef();
-  if (!style_to_use.LogicalMaxHeight().IsMaxSizeNone()) {
-    LayoutUnit max_h = ComputeLogicalHeightUsing(
-        kMaxSize, style_to_use.LogicalMaxHeight(), intrinsic_content_height);
+  // Note that the values 'min-content', 'max-content' and 'fit-content' should
+  // behave as the initial value if specified in the block direction.
+  const Length& logical_max_height = StyleRef().LogicalMaxHeight();
+  if (!logical_max_height.IsMaxSizeNone() &&
+      !logical_max_height.IsMinContent() &&
+      !logical_max_height.IsMaxContent() &&
+      !logical_max_height.IsFitContent()) {
+    LayoutUnit max_h = ComputeLogicalHeightUsing(kMaxSize, logical_max_height,
+                                                 intrinsic_content_height);
     if (max_h != -1)
       logical_height = std::min(logical_height, max_h);
   }
-  return std::max(logical_height, ComputeLogicalHeightUsing(
-                                      kMinSize, style_to_use.LogicalMinHeight(),
-                                      intrinsic_content_height));
+  Length logical_min_height = StyleRef().LogicalMinHeight();
+  if (logical_min_height.IsMinContent() || logical_min_height.IsMaxContent() ||
+      logical_min_height.IsFitContent())
+    logical_min_height = Length::Auto();
+  return std::max(logical_height,
+                  ComputeLogicalHeightUsing(kMinSize, logical_min_height,
+                                            intrinsic_content_height));
 }
 
 LayoutUnit LayoutBox::ConstrainContentBoxLogicalHeightByMinMax(
@@ -3903,6 +3912,13 @@
   const Length& logical_height = size_type == kMinSize
                                      ? StyleRef().LogicalMinHeight()
                                      : StyleRef().LogicalMaxHeight();
+
+  // Note that the values 'min-content', 'max-content' and 'fit-content' should
+  // behave as the initial value if specified in the block direction.
+  if (logical_height.IsMinContent() || logical_height.IsMaxContent() ||
+      logical_height.IsFitContent())
+    return true;
+
   Length initial_logical_height =
       size_type == kMinSize ? ComputedStyleInitialValues::InitialMinHeight()
                             : ComputedStyleInitialValues::InitialMaxHeight();
@@ -4880,14 +4896,17 @@
   // see FIXME 2
 
   // Calculate constraint equation values for 'max-height' case.
-  if (!style_to_use.LogicalMaxHeight().IsMaxSizeNone()) {
+  const Length& logical_max_height = style_to_use.LogicalMaxHeight();
+  if (!logical_max_height.IsMaxSizeNone() &&
+      !logical_max_height.IsMinContent() &&
+      !logical_max_height.IsMaxContent() &&
+      !logical_max_height.IsFitContent()) {
     LogicalExtentComputedValues max_values;
 
     ComputePositionedLogicalHeightUsing(
-        kMaxSize, style_to_use.LogicalMaxHeight(), container_block,
-        container_logical_height, borders_plus_padding, logical_height,
-        logical_top_length, logical_bottom_length, margin_before, margin_after,
-        max_values);
+        kMaxSize, logical_max_height, container_block, container_logical_height,
+        borders_plus_padding, logical_height, logical_top_length,
+        logical_bottom_length, margin_before, margin_after, max_values);
 
     if (computed_values.extent_ > max_values.extent_) {
       computed_values.extent_ = max_values.extent_;
@@ -4898,15 +4917,17 @@
   }
 
   // Calculate constraint equation values for 'min-height' case.
-  if (!style_to_use.LogicalMinHeight().IsZero() ||
-      style_to_use.LogicalMinHeight().IsIntrinsic()) {
+  Length logical_min_height = style_to_use.LogicalMinHeight();
+  if (logical_min_height.IsMinContent() || logical_min_height.IsMaxContent() ||
+      logical_min_height.IsFitContent())
+    logical_min_height = Length::Auto();
+  if (!logical_min_height.IsZero() || logical_min_height.IsFillAvailable()) {
     LogicalExtentComputedValues min_values;
 
     ComputePositionedLogicalHeightUsing(
-        kMinSize, style_to_use.LogicalMinHeight(), container_block,
-        container_logical_height, borders_plus_padding, logical_height,
-        logical_top_length, logical_bottom_length, margin_before, margin_after,
-        min_values);
+        kMinSize, logical_min_height, container_block, container_logical_height,
+        borders_plus_padding, logical_height, logical_top_length,
+        logical_bottom_length, margin_before, margin_after, min_values);
 
     if (computed_values.extent_ < min_values.extent_) {
       computed_values.extent_ = min_values.extent_;
diff --git a/third_party/blink/renderer/core/layout/layout_table.cc b/third_party/blink/renderer/core/layout/layout_table.cc
index 72102c9..8e732cb6 100644
--- a/third_party/blink/renderer/core/layout/layout_table.cc
+++ b/third_party/blink/renderer/core/layout/layout_table.cc
@@ -532,16 +532,24 @@
   }
 
   const Length& logical_max_height_length = StyleRef().LogicalMaxHeight();
-  if (logical_max_height_length.IsIntrinsic() ||
+  if (logical_max_height_length.IsFillAvailable() ||
       (logical_max_height_length.IsSpecified() &&
-       !logical_max_height_length.IsNegative())) {
+       !logical_max_height_length.IsNegative() &&
+       !logical_max_height_length.IsMinContent() &&
+       !logical_max_height_length.IsMaxContent() &&
+       !logical_max_height_length.IsFitContent())) {
     LayoutUnit computed_max_logical_height =
         ConvertStyleLogicalHeightToComputedHeight(logical_max_height_length);
     computed_logical_height =
         std::min(computed_logical_height, computed_max_logical_height);
   }
 
-  const Length& logical_min_height_length = StyleRef().LogicalMinHeight();
+  Length logical_min_height_length = StyleRef().LogicalMinHeight();
+  if (logical_min_height_length.IsMinContent() ||
+      logical_min_height_length.IsMaxContent() ||
+      logical_min_height_length.IsFitContent())
+    logical_min_height_length = Length::Auto();
+
   if (logical_min_height_length.IsIntrinsic() ||
       (logical_min_height_length.IsSpecified() &&
        !logical_min_height_length.IsNegative())) {
diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_items_builder.cc b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_items_builder.cc
index 11a45a0d0..3e02a22 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_items_builder.cc
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_items_builder.cc
@@ -349,6 +349,14 @@
       return false;
   }
 
+  if (UNLIKELY(old_item0.StartOffset() > 0 &&
+               ShouldInsertBreakOpportunityAfterLeadingPreservedSpaces(
+                   layout_text->GetText(), new_style))) {
+    // e.g. <p>abc xyz</p> => <p> xyz</p> where "abc" and " xyz" are different
+    // Text node. |text_| is " \u200Bxyz".
+    return false;
+  }
+
   for (const NGInlineItem& item : items) {
     // Collapsed space item at the start will not be restored, and that not
     // needed to add.
@@ -648,6 +656,18 @@
   is_empty_inline_ = false;  // text item is not empty.
 }
 
+template <typename OffsetMappingBuilder>
+bool NGInlineItemsBuilderTemplate<OffsetMappingBuilder>::
+    ShouldInsertBreakOpportunityAfterLeadingPreservedSpaces(
+        const String& string,
+        const ComputedStyle& style) const {
+  return text_.IsEmpty() && string.length() > 0 &&
+         string[0] == kSpaceCharacter && !style.CollapseWhiteSpace() &&
+         style.AutoWrap();
+}
+
+// TODO(yosin): We should remove |style| and |string| parameter because of
+// except for testing, we can get them from |LayoutText|.
 // Even when without whitespace collapsing, control characters (newlines and
 // tabs) are in their own control items to make the line breaker not special.
 template <typename OffsetMappingBuilder>
@@ -663,8 +683,8 @@
   // opportunity after leading preserved spaces needs a special code in the line
   // breaker. Generate an opportunity to make it easy.
   unsigned start = 0;
-  if (UNLIKELY(text_.IsEmpty() && string[start] == kSpaceCharacter &&
-               style->AutoWrap())) {
+  if (UNLIKELY(ShouldInsertBreakOpportunityAfterLeadingPreservedSpaces(
+          string, *style))) {
     do {
       ++start;
     } while (start < string.length() && string[start] == kSpaceCharacter);
diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_items_builder.h b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_items_builder.h
index 30ebd77..d0cb0015 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_items_builder.h
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_items_builder.h
@@ -214,6 +214,10 @@
   void AppendGeneratedBreakOpportunity(LayoutObject*);
 
   void Exit(LayoutObject*);
+
+  bool ShouldInsertBreakOpportunityAfterLeadingPreservedSpaces(
+      const String&,
+      const ComputedStyle&) const;
 };
 
 template <>
diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_line_breaker.cc b/third_party/blink/renderer/core/layout/ng/inline/ng_line_breaker.cc
index ef2507d..a3c7404 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_line_breaker.cc
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_line_breaker.cc
@@ -648,6 +648,9 @@
   }
   DCHECK_EQ(shape_result->NumCharacters(),
             result.break_offset - item_result->start_offset);
+  // It is critical to move the offset forward, or NGLineBreaker may keep adding
+  // NGInlineItemResult until all the memory is consumed.
+  CHECK_GT(result.break_offset, item_result->start_offset);
 
   LayoutUnit inline_size = shape_result->SnappedWidth().ClampNegativeToZero();
   item_result->inline_size = inline_size;
@@ -663,9 +666,6 @@
   item_result->inline_size = shape_result->SnappedWidth().ClampNegativeToZero();
   item_result->end_offset = result.break_offset;
   item_result->shape_result = std::move(shape_result);
-  // It is critical to move offset forward, or NGLineBreaker may keep adding
-  // NGInlineItemResult until all the memory is consumed.
-  CHECK_GT(item_result->end_offset, item_result->start_offset) << Text();
 
   // * If width <= available_width:
   //   * If offset < item.EndOffset(): the break opportunity to fit is found.
diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_offset_mapping_test.cc b/third_party/blink/renderer/core/layout/ng/inline/ng_offset_mapping_test.cc
index f41b357..4313efe 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_offset_mapping_test.cc
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_offset_mapping_test.cc
@@ -1225,6 +1225,33 @@
   TEST_RANGE(mapping.GetRanges(), text, 0u, 1u);
 }
 
+// For http://crbug.com/965353
+TEST_F(NGOffsetMappingTest, PreWrapAndReusing) {
+  // Note: "white-space: break-space" yields same result.
+  SetupHtml("t", "<p id='t' style='white-space: pre-wrap'>abc</p>");
+  Element& target = *GetDocument().getElementById("t");
+
+  // Change to <p id=t>abc xyz</p>
+  Text& text = *Text::Create(GetDocument(), " xyz");
+  target.appendChild(&text);
+  UpdateAllLifecyclePhasesForTest();
+
+  // Change to <p id=t> xyz</p>. We attempt to reuse " xyz".
+  target.firstChild()->remove();
+  UpdateAllLifecyclePhasesForTest();
+
+  const NGOffsetMapping& mapping = GetOffsetMapping();
+  EXPECT_EQ(String(u" \u200Bxyz"), mapping.GetText())
+      << "We have ZWS after leading preserved space.";
+  EXPECT_EQ((Vector<NGOffsetMappingUnit>{
+                NGOffsetMappingUnit(kIdentity, *text.GetLayoutObject(), 0u, 1u,
+                                    0u, 1u),
+                NGOffsetMappingUnit(kIdentity, *text.GetLayoutObject(), 1u, 4u,
+                                    2u, 5u),
+            }),
+            mapping.GetUnits());
+}
+
 TEST_F(NGOffsetMappingTest, TextOverflowEllipsis) {
   LoadAhem();
   SetupHtml("t",
diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_physical_line_box_fragment.cc b/third_party/blink/renderer/core/layout/ng/inline/ng_physical_line_box_fragment.cc
index 249da59..fb153f3 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_physical_line_box_fragment.cc
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_physical_line_box_fragment.cc
@@ -47,7 +47,7 @@
   // we pass the buffer as a constructor argument.
   void* data = ::WTF::Partitions::FastMalloc(
       sizeof(NGPhysicalLineBoxFragment) +
-          builder->children_.size() * sizeof(NGLinkStorage),
+          builder->children_.size() * sizeof(NGLink),
       ::WTF::GetStringWithTypeName<NGPhysicalLineBoxFragment>());
   new (data) NGPhysicalLineBoxFragment(builder);
   return base::AdoptRef(static_cast<NGPhysicalLineBoxFragment*>(data));
diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_physical_line_box_fragment.h b/third_party/blink/renderer/core/layout/ng/inline/ng_physical_line_box_fragment.h
index d12c481..7a453e3 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_physical_line_box_fragment.h
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_physical_line_box_fragment.h
@@ -32,7 +32,7 @@
       NGLineBoxFragmentBuilder* builder);
 
   ~NGPhysicalLineBoxFragment() {
-    for (const NGLinkStorage& child : Children())
+    for (const NGLink& child : Children())
       child.fragment->Release();
   }
 
@@ -84,7 +84,7 @@
   NGPhysicalLineBoxFragment(NGLineBoxFragmentBuilder* builder);
 
   NGLineHeightMetrics metrics_;
-  NGLinkStorage children_[];
+  NGLink children_[];
 };
 
 template <>
diff --git a/third_party/blink/renderer/core/layout/ng/ng_block_layout_algorithm.cc b/third_party/blink/renderer/core/layout/ng/ng_block_layout_algorithm.cc
index 5d8417640..96a7d2d 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_block_layout_algorithm.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_block_layout_algorithm.cc
@@ -2075,6 +2075,9 @@
         ConstraintSpace().IsFixedSizeBlock()
             ? NGTableCellChildLayoutPhase::kLayout
             : NGTableCellChildLayoutPhase::kMeasure);
+
+    if (Node().IsRestrictedBlockSizeTableCell())
+      builder.SetIsInRestrictedBlockSizeTableCell();
   }
 
   if (NGBaseline::ShouldPropagateBaselines(child))
diff --git a/third_party/blink/renderer/core/layout/ng/ng_block_node.cc b/third_party/blink/renderer/core/layout/ng/ng_block_node.cc
index d50f3fc..acaef3b 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_block_node.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_block_node.cc
@@ -14,6 +14,8 @@
 #include "third_party/blink/renderer/core/layout/layout_inline.h"
 #include "third_party/blink/renderer/core/layout/layout_multi_column_flow_thread.h"
 #include "third_party/blink/renderer/core/layout/layout_multi_column_set.h"
+#include "third_party/blink/renderer/core/layout/layout_table.h"
+#include "third_party/blink/renderer/core/layout/layout_table_cell.h"
 #include "third_party/blink/renderer/core/layout/min_max_size.h"
 #include "third_party/blink/renderer/core/layout/ng/geometry/ng_fragment_geometry.h"
 #include "third_party/blink/renderer/core/layout/ng/inline/ng_inline_node.h"
@@ -883,6 +885,13 @@
          layout_box->UseLogicalBottomMarginEdgeForInlineBlockBaseline();
 }
 
+bool NGBlockNode::IsRestrictedBlockSizeTableCell() const {
+  DCHECK(IsTableCell());
+  const LayoutTableCell* cell = ToLayoutTableCell(GetLayoutBox());
+  return !cell->StyleRef().LogicalHeight().IsAuto() ||
+         !cell->Table()->StyleRef().LogicalHeight().IsAuto();
+}
+
 scoped_refptr<const NGLayoutResult> NGBlockNode::LayoutAtomicInline(
     const NGConstraintSpace& parent_constraint_space,
     const ComputedStyle& parent_style,
diff --git a/third_party/blink/renderer/core/layout/ng/ng_block_node.h b/third_party/blink/renderer/core/layout/ng/ng_block_node.h
index 5517a7a4..e099162 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_block_node.h
+++ b/third_party/blink/renderer/core/layout/ng/ng_block_node.h
@@ -97,6 +97,10 @@
   // See comments in UseLogicalBottomMarginEdgeForInlineBlockBaseline().
   bool UseLogicalBottomMarginEdgeForInlineBlockBaseline() const;
 
+  // Return true if the block size of this table cell should be considered
+  // restricted (e.g. height of the cell or its table is non-auto).
+  bool IsRestrictedBlockSizeTableCell() const;
+
   // Layout an atomic inline; e.g., inline block.
   scoped_refptr<const NGLayoutResult> LayoutAtomicInline(
       const NGConstraintSpace& parent_constraint_space,
diff --git a/third_party/blink/renderer/core/layout/ng/ng_constraint_space.h b/third_party/blink/renderer/core/layout/ng/ng_constraint_space.h
index 7937d6e..5cc76b2 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_constraint_space.h
+++ b/third_party/blink/renderer/core/layout/ng/ng_constraint_space.h
@@ -67,9 +67,10 @@
     kAnonymous = 1 << 5,
     kUseFirstLineStyle = 1 << 6,
     kAncestorHasClearancePastAdjoiningFloats = 1 << 7,
+    kInRestrictedBlockSizeTableCell = 1 << 8,
 
     // Size of bitfield used to store the flags.
-    kNumberOfConstraintSpaceFlags = 8
+    kNumberOfConstraintSpaceFlags = 9
   };
 
   // To ensure that the bfc_offset_, rare_data_ union doesn't get polluted,
@@ -332,6 +333,10 @@
         bitfields_.table_cell_child_layout_phase);
   }
 
+  bool IsInRestrictedBlockSizeTableCell() const {
+    return HasFlag(kInRestrictedBlockSizeTableCell);
+  }
+
   NGMarginStrut MarginStrut() const {
     return HasRareData() ? rare_data_->margin_strut : NGMarginStrut();
   }
diff --git a/third_party/blink/renderer/core/layout/ng/ng_constraint_space_builder.h b/third_party/blink/renderer/core/layout/ng/ng_constraint_space_builder.h
index 919cc16..44840b2 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_constraint_space_builder.h
+++ b/third_party/blink/renderer/core/layout/ng/ng_constraint_space_builder.h
@@ -249,6 +249,11 @@
     return *this;
   }
 
+  NGConstraintSpaceBuilder& SetIsInRestrictedBlockSizeTableCell() {
+    SetFlag(NGConstraintSpace::kInRestrictedBlockSizeTableCell, true);
+    return *this;
+  }
+
   NGConstraintSpaceBuilder& SetExclusionSpace(
       const NGExclusionSpace& exclusion_space) {
     if (!is_new_fc_)
diff --git a/third_party/blink/renderer/core/layout/ng/ng_length_utils.cc b/third_party/blink/renderer/core/layout/ng/ng_length_utils.cc
index 91e1d24c..33231d2 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_length_utils.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_length_utils.cc
@@ -476,11 +476,20 @@
   // Scrollable percentage-sized children of table cells, in the table
   // "measure" phase contribute nothing to the row height measurement.
   // See: https://drafts.csswg.org/css-tables-3/#row-layout
+  // We only apply this rule if the block size of the containing table cell is
+  // considered to be restricted, though. Otherwise, especially if this is the
+  // only child of the cell, and that is the only cell in the row, we'd end up
+  // with zero block size. To match the legacy layout engine behavior in
+  // LayoutBox::ContainingBlockLogicalHeightForPercentageResolution(), we only
+  // check the block-size of the containing cell and its containing table. Other
+  // things to consider, would be checking the row and row-group, and also other
+  // properties, such as {min,max}-block-size.
   if (logical_height.IsPercentOrCalc() &&
       constraint_space.TableCellChildLayoutPhase() ==
           NGTableCellChildLayoutPhase::kMeasure &&
       (style.OverflowY() == EOverflow::kAuto ||
-       style.OverflowY() == EOverflow::kScroll))
+       style.OverflowY() == EOverflow::kScroll) &&
+      constraint_space.IsInRestrictedBlockSizeTableCell())
     return border_padding.BlockSum();
 
   LayoutUnit extent = ResolveMainBlockLength(
diff --git a/third_party/blink/renderer/core/layout/ng/ng_length_utils.h b/third_party/blink/renderer/core/layout/ng/ng_length_utils.h
index a354db09..a4d4614 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_length_utils.h
+++ b/third_party/blink/renderer/core/layout/ng/ng_length_utils.h
@@ -145,7 +145,8 @@
     LengthResolvePhase phase,
     const LayoutUnit* opt_percentage_resolution_block_size_for_min_max =
         nullptr) {
-  if (LIKELY(length.IsAuto() ||
+  if (LIKELY(length.IsAuto() || length.IsMinContent() ||
+             length.IsMaxContent() || length.IsFitContent() ||
              BlockLengthUnresolvable(
                  constraint_space, length, phase,
                  opt_percentage_resolution_block_size_for_min_max)))
@@ -166,7 +167,8 @@
     LengthResolvePhase phase,
     const LayoutUnit* opt_percentage_resolution_block_size_for_min_max =
         nullptr) {
-  if (LIKELY(length.IsMaxSizeNone() ||
+  if (LIKELY(length.IsMaxSizeNone() || length.IsMinContent() ||
+             length.IsMaxContent() || length.IsFitContent() ||
              BlockLengthUnresolvable(
                  constraint_space, length, phase,
                  opt_percentage_resolution_block_size_for_min_max)))
diff --git a/third_party/blink/renderer/core/layout/ng/ng_link.h b/third_party/blink/renderer/core/layout/ng/ng_link.h
index 3f3e51a4..b00d8aa 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_link.h
+++ b/third_party/blink/renderer/core/layout/ng/ng_link.h
@@ -8,14 +8,17 @@
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/layout/geometry/physical_offset.h"
 #include "third_party/blink/renderer/core/layout/ng/ng_physical_fragment.h"
-#include "third_party/blink/renderer/platform/wtf/vector_traits.h"
 
 namespace blink {
 
-// We use this struct to store NGLinks in a flexible array in fragments. We have
-// to use this struct instead of using NGLink because flexible array members
-// cannot have destructors, so we need to do manual refcounting.
-struct NGLinkStorage {
+// Class representing the offset of a child fragment relative to the
+// parent fragment. Fragments themselves have no position information
+// allowing entire fragment subtrees to be reused and cached regardless
+// of placement.
+// This class is stored in a C-style regular array on
+// NGPhysicalContainerFragment. It cannot have destructors. Fragment reference
+// counting is done manually.
+struct CORE_EXPORT NGLink {
   PhysicalOffset Offset() const { return offset; }
   const NGPhysicalFragment* get() const { return fragment; }
 
@@ -27,47 +30,6 @@
   PhysicalOffset offset;
 };
 
-// Class representing the offset of a child fragment relative to the
-// parent fragment. Fragments themselves have no position information
-// allowing entire fragment subtrees to be reused and cached regardless
-// of placement.
-class CORE_EXPORT NGLink {
-  DISALLOW_NEW();
-
- public:
-  NGLink() = default;
-  NGLink(scoped_refptr<const NGPhysicalFragment> fragment,
-         PhysicalOffset offset)
-      : fragment_(std::move(fragment)), offset_(offset) {}
-  NGLink(NGLink&& o) noexcept
-      : fragment_(std::move(o.fragment_)), offset_(o.offset_) {}
-  NGLink(const NGLinkStorage& storage)
-      : fragment_(storage.fragment), offset_(storage.offset) {}
-  ~NGLink() = default;
-  NGLink(const NGLink&) = default;
-  NGLink& operator=(const NGLink&) = default;
-  NGLink& operator=(NGLink&&) = default;
-
-  // Returns the offset relative to the parent fragment's content-box.
-  PhysicalOffset Offset() const { return offset_; }
-
-  operator bool() const { return fragment_.get(); }
-  const NGPhysicalFragment& operator*() const { return *fragment_.get(); }
-  const NGPhysicalFragment* operator->() const { return fragment_.get(); }
-  const NGPhysicalFragment* get() const { return fragment_.get(); }
-
- private:
-  scoped_refptr<const NGPhysicalFragment> fragment_;
-  PhysicalOffset offset_;
-
-  // The builder classes needs to set the offset_ field during
-  // fragment construciton to allow the child vector to be moved
-  // instead of reconstructed during fragment construction.
-  friend class NGLayoutResult;
-};
-
 }  // namespace blink
 
-WTF_ALLOW_MOVE_INIT_AND_COMPARE_WITH_MEM_FUNCTIONS(blink::NGLink)
-
 #endif  // THIRD_PARTY_BLINK_RENDERER_CORE_LAYOUT_NG_NG_LINK_H_
diff --git a/third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.cc b/third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.cc
index 2fe1fcb..6c033fc 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.cc
@@ -50,7 +50,7 @@
   // we pass the buffer as a constructor argument.
   void* data = ::WTF::Partitions::FastMalloc(
       sizeof(NGPhysicalBoxFragment) +
-          builder->children_.size() * sizeof(NGLinkStorage),
+          builder->children_.size() * sizeof(NGLink),
       ::WTF::GetStringWithTypeName<NGPhysicalBoxFragment>());
   new (data) NGPhysicalBoxFragment(builder, block_or_line_writing_mode);
   return base::AdoptRef(static_cast<NGPhysicalBoxFragment*>(data));
diff --git a/third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.h b/third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.h
index 7451bba..ab1747ef7 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.h
+++ b/third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.h
@@ -25,7 +25,7 @@
       WritingMode block_or_line_writing_mode);
 
   ~NGPhysicalBoxFragment() {
-    for (const NGLinkStorage& child : Children())
+    for (const NGLink& child : Children())
       child.fragment->Release();
   }
 
@@ -82,7 +82,7 @@
   NGBaselineList baselines_;
   NGPhysicalBoxStrut borders_;
   NGPhysicalBoxStrut padding_;
-  NGLinkStorage children_[];
+  NGLink children_[];
 };
 
 template <>
diff --git a/third_party/blink/renderer/core/layout/ng/ng_physical_container_fragment.cc b/third_party/blink/renderer/core/layout/ng/ng_physical_container_fragment.cc
index 2009cba4..79cc220 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_physical_container_fragment.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_physical_container_fragment.cc
@@ -31,7 +31,7 @@
 NGPhysicalContainerFragment::NGPhysicalContainerFragment(
     NGContainerFragmentBuilder* builder,
     WritingMode block_or_line_writing_mode,
-    NGLinkStorage* buffer,
+    NGLink* buffer,
     NGFragmentType type,
     unsigned sub_type)
     : NGPhysicalFragment(builder, type, sub_type),
diff --git a/third_party/blink/renderer/core/layout/ng/ng_physical_container_fragment.h b/third_party/blink/renderer/core/layout/ng/ng_physical_container_fragment.h
index 97a9611..a450ba7 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_physical_container_fragment.h
+++ b/third_party/blink/renderer/core/layout/ng/ng_physical_container_fragment.h
@@ -22,24 +22,22 @@
  public:
   class ChildLinkList {
    public:
-    ChildLinkList(wtf_size_t count, const NGLinkStorage* buffer)
+    ChildLinkList(wtf_size_t count, const NGLink* buffer)
         : count_(count), buffer_(buffer) {}
 
     wtf_size_t size() const { return count_; }
-    const NGLinkStorage& operator[](wtf_size_t idx) const {
-      return buffer_[idx];
-    }
-    const NGLinkStorage& front() const { return buffer_[0]; }
-    const NGLinkStorage& back() const { return buffer_[count_ - 1]; }
+    const NGLink& operator[](wtf_size_t idx) const { return buffer_[idx]; }
+    const NGLink& front() const { return buffer_[0]; }
+    const NGLink& back() const { return buffer_[count_ - 1]; }
 
-    const NGLinkStorage* begin() const { return buffer_; }
-    const NGLinkStorage* end() const { return begin() + count_; }
+    const NGLink* begin() const { return buffer_; }
+    const NGLink* end() const { return begin() + count_; }
 
     bool IsEmpty() const { return count_ == 0; }
 
    private:
     wtf_size_t count_;
-    const NGLinkStorage* buffer_;
+    const NGLink* buffer_;
   };
 
   ~NGPhysicalContainerFragment();
@@ -73,7 +71,7 @@
   // block_or_line_writing_mode is used for converting the child offsets.
   NGPhysicalContainerFragment(NGContainerFragmentBuilder*,
                               WritingMode block_or_line_writing_mode,
-                              NGLinkStorage* buffer,
+                              NGLink* buffer,
                               NGFragmentType,
                               unsigned sub_type);
 
@@ -95,7 +93,7 @@
 
   // Because flexible arrays need to be the last member in a class, the actual
   // storage is in the subclass and we just keep a pointer to it here.
-  const NGLinkStorage* buffer_;
+  const NGLink* buffer_;
   wtf_size_t num_children_;
 };
 
diff --git a/third_party/blink/renderer/core/layout/ng/ng_simplified_layout_algorithm.cc b/third_party/blink/renderer/core/layout/ng/ng_simplified_layout_algorithm.cc
index 4cb444c..77476af 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_simplified_layout_algorithm.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_simplified_layout_algorithm.cc
@@ -191,7 +191,7 @@
 }
 
 void NGSimplifiedLayoutAlgorithm::AddChildFragment(
-    const NGLinkStorage& old_fragment,
+    const NGLink& old_fragment,
     const NGPhysicalContainerFragment& new_fragment) {
   DCHECK_EQ(old_fragment->Size(), new_fragment.Size());
 
diff --git a/third_party/blink/renderer/core/layout/ng/ng_simplified_layout_algorithm.h b/third_party/blink/renderer/core/layout/ng/ng_simplified_layout_algorithm.h
index 463bfcf..29dc6351 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_simplified_layout_algorithm.h
+++ b/third_party/blink/renderer/core/layout/ng/ng_simplified_layout_algorithm.h
@@ -13,7 +13,7 @@
 namespace blink {
 
 class NGBlockBreakToken;
-struct NGLinkStorage;
+struct NGLink;
 class NGPhysicalContainerFragment;
 
 // The "simplified" layout algorithm will run in the following circumstances:
@@ -47,7 +47,7 @@
  private:
   void HandleOutOfFlowPositioned(const NGBlockNode&);
 
-  void AddChildFragment(const NGLinkStorage& old_fragment,
+  void AddChildFragment(const NGLink& old_fragment,
                         const NGPhysicalContainerFragment& new_fragment);
 
   const NGLayoutResult& previous_result_;
diff --git a/third_party/blink/renderer/core/loader/history_item.cc b/third_party/blink/renderer/core/loader/history_item.cc
index 974a37c6..2897841 100644
--- a/third_party/blink/renderer/core/loader/history_item.cc
+++ b/third_party/blink/renderer/core/loader/history_item.cc
@@ -152,9 +152,8 @@
 ResourceRequest HistoryItem::GenerateResourceRequest(
     mojom::FetchCacheMode cache_mode) {
   ResourceRequest request(url_string_);
-  // TODO(domfarolino): Stop storing ResourceRequest's generated referrer as a
-  // header and instead use a separate member. See https://crbug.com/850813.
-  request.SetHttpReferrer(referrer_);
+  request.SetReferrerString(referrer_.referrer);
+  request.SetReferrerPolicy(referrer_.referrer_policy);
   request.SetCacheMode(cache_mode);
   if (form_data_) {
     request.SetHttpMethod(http_names::kPOST);
diff --git a/third_party/blink/renderer/core/loader/modulescript/module_script_loader.cc b/third_party/blink/renderer/core/loader/modulescript/module_script_loader.cc
index c4fecee..edfa179 100644
--- a/third_party/blink/renderer/core/loader/modulescript/module_script_loader.cc
+++ b/third_party/blink/renderer/core/loader/modulescript/module_script_loader.cc
@@ -159,11 +159,8 @@
   fetch_params.SetContentSecurityPolicyNonce(options_.Nonce());
 
   // [SMSR] "... its referrer policy to options's referrer policy." [spec text]
-  // Note: For now this is done below with SetHttpReferrer()
-  network::mojom::ReferrerPolicy referrer_policy =
-      module_request.Options().GetReferrerPolicy();
-  if (referrer_policy == network::mojom::ReferrerPolicy::kDefault)
-    referrer_policy = fetch_client_settings_object.GetReferrerPolicy();
+  fetch_params.MutableResourceRequest().SetReferrerPolicy(
+      module_request.Options().GetReferrerPolicy());
 
   // Step 5. "... mode is "cors", ..."
   // [SMSR] "... and its credentials mode to options's credentials mode."
@@ -173,17 +170,8 @@
       options_.CredentialsMode());
 
   // Step 5. "... referrer is referrer, ..." [spec text]
-  // Note: For now this is done below with SetHttpReferrer()
-  String referrer_string = module_request.ReferrerString();
-  if (referrer_string == Referrer::ClientReferrerString())
-    referrer_string = fetch_client_settings_object.GetOutgoingReferrer();
-
-  // TODO(domfarolino): Stop storing ResourceRequest's referrer as a
-  // blink::Referrer (https://crbug.com/850813).
-  fetch_params.MutableResourceRequest().SetHttpReferrer(
-      SecurityPolicy::GenerateReferrer(referrer_policy,
-                                       fetch_params.GetResourceRequest().Url(),
-                                       referrer_string));
+  fetch_params.MutableResourceRequest().SetReferrerString(
+      module_request.ReferrerString());
 
   // Priority Hints and a request's "importance" are currently non-standard, but
   // we can assume the following (see https://crbug.com/821464):
diff --git a/third_party/blink/renderer/core/loader/modulescript/module_script_loader_test.cc b/third_party/blink/renderer/core/loader/modulescript/module_script_loader_test.cc
index f8e6a18d..9e3ca31 100644
--- a/third_party/blink/renderer/core/loader/modulescript/module_script_loader_test.cc
+++ b/third_party/blink/renderer/core/loader/modulescript/module_script_loader_test.cc
@@ -194,7 +194,7 @@
       MakeGarbageCollected<WorkletModuleResponsesMap>());
   global_scope_ = MakeGarbageCollected<WorkletGlobalScope>(
       std::move(creation_params), *reporting_proxy_, &GetFrame());
-  ASSERT_TRUE(global_scope_->ScriptController()->Initialize(NullURL()));
+  global_scope_->ScriptController()->Initialize(NullURL());
   modulator_ = MakeGarbageCollected<ModuleScriptLoaderTestModulator>(
       global_scope_->ScriptController()->GetScriptState());
 }
diff --git a/third_party/blink/renderer/core/loader/ping_loader.cc b/third_party/blink/renderer/core/loader/ping_loader.cc
index 611b58e..3ca8a1c 100644
--- a/third_party/blink/renderer/core/loader/ping_loader.cc
+++ b/third_party/blink/renderer/core/loader/ping_loader.cc
@@ -172,9 +172,9 @@
   if (!frame->GetDocument())
     return false;
 
-  if (!ContentSecurityPolicy::ShouldBypassMainWorld(frame->GetDocument()) &&
-      !frame->GetDocument()->GetContentSecurityPolicy()->AllowConnectToSource(
-          url)) {
+  if (!frame->GetDocument()
+           ->GetContentSecurityPolicyForWorld()
+           ->AllowConnectToSource(url)) {
     // We're simulating a network failure here, so we return 'true'.
     return true;
   }
diff --git a/third_party/blink/renderer/core/loader/ping_loader.h b/third_party/blink/renderer/core/loader/ping_loader.h
index 17dd322..50ed1c3 100644
--- a/third_party/blink/renderer/core/loader/ping_loader.h
+++ b/third_party/blink/renderer/core/loader/ping_loader.h
@@ -54,7 +54,7 @@
 // any response. The request is made independent of any LocalFrame staying
 // alive, and must only stay alive until the transmission has completed
 // successfully (or not -- errors are not propagated back either.) Upon
-// transmission, the the load is cancelled and the loader cancels itself.
+// transmission, the load is cancelled and the loader cancels itself.
 //
 // The ping loader is used by audit pings, beacon transmissions and image loads
 // during page unloading.
@@ -78,6 +78,9 @@
   // The last argument is guaranteed to be set to the size of payload if
   // these method return true. If these method returns false, the value
   // shouldn't be used.
+  // Note: To ensure the correct Javascript world is used for CSP checks, these
+  // should be called synchronously from the point navigator.sendBeacon is
+  // called.
   static bool SendBeacon(LocalFrame*, const KURL&, const String&);
   static bool SendBeacon(LocalFrame*, const KURL&, DOMArrayBufferView*);
   static bool SendBeacon(LocalFrame*, const KURL&, Blob*);
diff --git a/third_party/blink/renderer/core/loader/resource/css_style_sheet_resource_test.cc b/third_party/blink/renderer/core/loader/resource/css_style_sheet_resource_test.cc
index 954e820..8e790da 100644
--- a/third_party/blink/renderer/core/loader/resource/css_style_sheet_resource_test.cc
+++ b/third_party/blink/renderer/core/loader/resource/css_style_sheet_resource_test.cc
@@ -4,7 +4,6 @@
 
 #include "third_party/blink/renderer/core/loader/resource/css_style_sheet_resource.h"
 
-#include <memory>
 #include "base/memory/scoped_refptr.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/platform/platform.h"
@@ -96,7 +95,7 @@
   css_resource->ResponseReceived(response);
   css_resource->FinishForTest();
 
-  CSSParserContext* parser_context = CSSParserContext::Create(
+  auto* parser_context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kInsecureContext);
   StyleSheetContents* contents = StyleSheetContents::Create(parser_context);
   CSSStyleSheet* sheet = CSSStyleSheet::Create(contents, GetDocument());
@@ -117,7 +116,7 @@
 TEST_F(CSSStyleSheetResourceTest, CreateFromCacheRestoresOriginalSheet) {
   CSSStyleSheetResource* css_resource = CreateAndSaveTestStyleSheetResource();
 
-  CSSParserContext* parser_context = CSSParserContext::Create(
+  auto* parser_context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kInsecureContext);
   StyleSheetContents* contents = StyleSheetContents::Create(parser_context);
   CSSStyleSheet* sheet = CSSStyleSheet::Create(contents, GetDocument());
@@ -141,7 +140,7 @@
        CreateFromCacheWithMediaQueriesCopiesOriginalSheet) {
   CSSStyleSheetResource* css_resource = CreateAndSaveTestStyleSheetResource();
 
-  CSSParserContext* parser_context = CSSParserContext::Create(
+  auto* parser_context = MakeGarbageCollected<CSSParserContext>(
       kHTMLStandardMode, SecureContextMode::kInsecureContext);
   StyleSheetContents* contents = StyleSheetContents::Create(parser_context);
   CSSStyleSheet* sheet = CSSStyleSheet::Create(contents, GetDocument());
diff --git a/third_party/blink/renderer/core/loader/threadable_loader.cc b/third_party/blink/renderer/core/loader/threadable_loader.cc
index 24596cc..74da9aff 100644
--- a/third_party/blink/renderer/core/loader/threadable_loader.cc
+++ b/third_party/blink/renderer/core/loader/threadable_loader.cc
@@ -344,10 +344,10 @@
   if (GetSecurityOrigin())
     request.SetHTTPOrigin(GetSecurityOrigin());
 
-  // TODO(domfarolino): Stop setting the HTTPReferrer header, and instead use
-  // ResourceRequest::referrer_. See https://crbug.com/850813.
-  if (override_referrer_)
-    request.SetHttpReferrer(referrer_after_redirect_);
+  if (override_referrer_) {
+    request.SetReferrerString(referrer_after_redirect_.referrer);
+    request.SetReferrerPolicy(referrer_after_redirect_.referrer_policy);
+  }
 }
 
 void ThreadableLoader::LoadPreflightRequest(
diff --git a/third_party/blink/renderer/core/page/context_menu_controller_test.cc b/third_party/blink/renderer/core/page/context_menu_controller_test.cc
index 4090b43..49a2c8d 100644
--- a/third_party/blink/renderer/core/page/context_menu_controller_test.cc
+++ b/third_party/blink/renderer/core/page/context_menu_controller_test.cc
@@ -15,6 +15,7 @@
 #include "third_party/blink/renderer/core/html/media/html_video_element.h"
 #include "third_party/blink/renderer/core/input/context_menu_allowed_scope.h"
 #include "third_party/blink/renderer/core/page/context_menu_controller.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/testing/empty_web_media_player.h"
 #include "third_party/blink/renderer/platform/testing/unit_test_helpers.h"
 
@@ -110,7 +111,8 @@
   GetDocument()->GetSettings()->SetPictureInPictureEnabled(true);
 
   // Setup video element.
-  Persistent<HTMLVideoElement> video = HTMLVideoElement::Create(*GetDocument());
+  Persistent<HTMLVideoElement> video =
+      MakeGarbageCollected<HTMLVideoElement>(*GetDocument());
   video->SetSrc(video_url);
   GetDocument()->body()->AppendChild(video);
   test::RunPendingTasks();
@@ -166,7 +168,8 @@
   GetDocument()->GetSettings()->SetPictureInPictureEnabled(true);
 
   // Setup video element.
-  Persistent<HTMLVideoElement> video = HTMLVideoElement::Create(*GetDocument());
+  Persistent<HTMLVideoElement> video =
+      MakeGarbageCollected<HTMLVideoElement>(*GetDocument());
   video->SetSrc(video_url);
   GetDocument()->body()->AppendChild(video);
   test::RunPendingTasks();
@@ -226,7 +229,8 @@
   const char video_url[] = "https://example.com/foo.webm";
 
   // Setup video element.
-  Persistent<HTMLVideoElement> video = HTMLVideoElement::Create(*GetDocument());
+  Persistent<HTMLVideoElement> video =
+      MakeGarbageCollected<HTMLVideoElement>(*GetDocument());
   video->SetSrc(video_url);
   GetDocument()->body()->AppendChild(video);
   test::RunPendingTasks();
@@ -282,7 +286,8 @@
   const char video_url[] = "https://example.com/foo.webm";
 
   // Setup video element.
-  Persistent<HTMLVideoElement> video = HTMLVideoElement::Create(*GetDocument());
+  Persistent<HTMLVideoElement> video =
+      MakeGarbageCollected<HTMLVideoElement>(*GetDocument());
   video->SetSrc(video_url);
   GetDocument()->body()->AppendChild(video);
   test::RunPendingTasks();
@@ -337,7 +342,8 @@
   HitTestResult hit_test_result;
 
   // Setup video element.
-  Persistent<HTMLVideoElement> video = HTMLVideoElement::Create(*GetDocument());
+  Persistent<HTMLVideoElement> video =
+      MakeGarbageCollected<HTMLVideoElement>(*GetDocument());
   blink::WebMediaStream web_media_stream;
   blink::WebVector<blink::WebMediaStreamTrack> dummy_tracks;
   web_media_stream.Initialize(dummy_tracks, dummy_tracks);
@@ -395,7 +401,8 @@
   const char video_url[] = "https://example.com/foo.webm";
 
   // Setup video element.
-  Persistent<HTMLVideoElement> video = HTMLVideoElement::Create(*GetDocument());
+  Persistent<HTMLVideoElement> video =
+      MakeGarbageCollected<HTMLVideoElement>(*GetDocument());
   video->SetSrc(video_url);
   GetDocument()->body()->AppendChild(video);
   test::RunPendingTasks();
diff --git a/third_party/blink/renderer/core/page/drag_controller.cc b/third_party/blink/renderer/core/page/drag_controller.cc
index 5f2097a..c3ffeee 100644
--- a/third_party/blink/renderer/core/page/drag_controller.cc
+++ b/third_party/blink/renderer/core/page/drag_controller.cc
@@ -941,8 +941,9 @@
       src->GetEventHandler().HitTestResultAtLocation(location);
   // FIXME: Can this even happen? I guess it's possible, but should verify
   // with a web test.
-  if (!state.drag_src_->IsShadowIncludingInclusiveAncestorOf(
-          hit_test_result.InnerNode())) {
+  Node* hit_inner_node = hit_test_result.InnerNode();
+  if (!hit_inner_node ||
+      !state.drag_src_->IsShadowIncludingInclusiveAncestorOf(*hit_inner_node)) {
     // The original node being dragged isn't under the drag origin anymore...
     // maybe it was hidden or moved out from under the cursor. Regardless, we
     // don't want to start a drag on something that's not actually under the
@@ -1183,8 +1184,9 @@
   HitTestLocation location(drag_origin);
   HitTestResult hit_test_result =
       src->GetEventHandler().HitTestResultAtLocation(location);
-  if (!state.drag_src_->IsShadowIncludingInclusiveAncestorOf(
-          hit_test_result.InnerNode())) {
+  Node* hit_inner_node = hit_test_result.InnerNode();
+  if (!hit_inner_node ||
+      !state.drag_src_->IsShadowIncludingInclusiveAncestorOf(*hit_inner_node)) {
     // The original node being dragged isn't under the drag origin anymore...
     // maybe it was hidden or moved out from under the cursor. Regardless, we
     // don't want to start a drag on something that's not actually under the
diff --git a/third_party/blink/renderer/core/page/validation_message_overlay_delegate.cc b/third_party/blink/renderer/core/page/validation_message_overlay_delegate.cc
index 9bd16ea..a3696f2 100644
--- a/third_party/blink/renderer/core/page/validation_message_overlay_delegate.cc
+++ b/third_party/blink/renderer/core/page/validation_message_overlay_delegate.cc
@@ -19,6 +19,7 @@
 #include "third_party/blink/renderer/platform/graphics/paint/cull_rect.h"
 #include "third_party/blink/renderer/platform/graphics/paint/drawing_recorder.h"
 #include "third_party/blink/renderer/platform/graphics/paint/paint_record_builder.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/text/platform_locale.h"
 #include "third_party/blink/renderer/platform/web_test_support.h"
 
@@ -147,9 +148,9 @@
   page_->GetSettings().SetMinimumLogicalFontSize(
       main_settings.GetMinimumLogicalFontSize());
 
-  auto* frame = LocalFrame::Create(
+  auto* frame = MakeGarbageCollected<LocalFrame>(
       MakeGarbageCollected<EmptyLocalFrameClient>(), *page_, nullptr);
-  frame->SetView(LocalFrameView::Create(*frame, view_size));
+  frame->SetView(MakeGarbageCollected<LocalFrameView>(*frame, view_size));
   frame->Init();
   frame->View()->SetCanHaveScrollbars(false);
   frame->View()->SetBaseBackgroundColor(Color::kTransparent);
diff --git a/third_party/blink/renderer/core/svg/graphics/svg_image.cc b/third_party/blink/renderer/core/svg/graphics/svg_image.cc
index 036caf7..93ee30d4 100644
--- a/third_party/blink/renderer/core/svg/graphics/svg_image.cc
+++ b/third_party/blink/renderer/core/svg/graphics/svg_image.cc
@@ -63,6 +63,7 @@
 #include "third_party/blink/renderer/platform/graphics/paint/paint_canvas.h"
 #include "third_party/blink/renderer/platform/graphics/paint/paint_record.h"
 #include "third_party/blink/renderer/platform/graphics/paint/paint_record_builder.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/instrumentation/tracing/trace_event.h"
 
 namespace blink {
@@ -789,8 +790,8 @@
     TRACE_EVENT0("blink", "SVGImage::dataChanged::createFrame");
     DCHECK(!frame_client_);
     frame_client_ = MakeGarbageCollected<SVGImageLocalFrameClient>(this);
-    frame = LocalFrame::Create(frame_client_, *page, nullptr);
-    frame->SetView(LocalFrameView::Create(*frame));
+    frame = MakeGarbageCollected<LocalFrame>(frame_client_, *page, nullptr);
+    frame->SetView(MakeGarbageCollected<LocalFrameView>(*frame));
     frame->Init();
   }
 
diff --git a/third_party/blink/renderer/core/svg/svg_length.cc b/third_party/blink/renderer/core/svg/svg_length.cc
index f89bea96..6271a18 100644
--- a/third_party/blink/renderer/core/svg/svg_length.cc
+++ b/third_party/blink/renderer/core/svg/svg_length.cc
@@ -192,7 +192,7 @@
   // NOTE(ikilpatrick): We will always parse svg lengths in the insecure
   // context mode. If a function/unit/etc will require a secure context check
   // in the future, plumbing will need to be added.
-  CSSParserContext* svg_parser_context = CSSParserContext::Create(
+  auto* svg_parser_context = MakeGarbageCollected<CSSParserContext>(
       kSVGAttributeMode, SecureContextMode::kInsecureContext);
   const CSSValue* parsed = CSSParser::ParseSingleValue(
       CSSPropertyID::kX, string, svg_parser_context);
diff --git a/third_party/blink/renderer/core/testing/core_unit_test_helper.cc b/third_party/blink/renderer/core/testing/core_unit_test_helper.cc
index ba7ea89..fdd1ccd 100644
--- a/third_party/blink/renderer/core/testing/core_unit_test_helper.cc
+++ b/third_party/blink/renderer/core/testing/core_unit_test_helper.cc
@@ -9,6 +9,7 @@
 #include "third_party/blink/renderer/core/page/page.h"
 #include "third_party/blink/renderer/core/scroll/scrollbar_theme.h"
 #include "third_party/blink/renderer/core/typed_arrays/dom_array_buffer.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/loader/fetch/memory_cache.h"
 
 namespace blink {
@@ -21,8 +22,8 @@
   LocalFrame* parent_frame = owner_element->GetDocument().GetFrame();
   auto* child_client =
       MakeGarbageCollected<LocalFrameClientWithParent>(parent_frame);
-  child_ =
-      LocalFrame::Create(child_client, *parent_frame->GetPage(), owner_element);
+  child_ = MakeGarbageCollected<LocalFrame>(
+      child_client, *parent_frame->GetPage(), owner_element);
   child_->CreateView(IntSize(500, 500), Color::kTransparent);
   child_->Init();
 
diff --git a/third_party/blink/renderer/core/testing/dummy_page_holder.cc b/third_party/blink/renderer/core/testing/dummy_page_holder.cc
index 59b521d..879592b3 100644
--- a/third_party/blink/renderer/core/testing/dummy_page_holder.cc
+++ b/third_party/blink/renderer/core/testing/dummy_page_holder.cc
@@ -40,6 +40,7 @@
 #include "third_party/blink/renderer/core/frame/settings.h"
 #include "third_party/blink/renderer/core/frame/visual_viewport.h"
 #include "third_party/blink/renderer/core/loader/empty_clients.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/wtf/assertions.h"
 
 namespace blink {
@@ -77,8 +78,10 @@
   if (!local_frame_client_)
     local_frame_client_ = MakeGarbageCollected<DummyLocalFrameClient>();
 
-  frame_ = LocalFrame::Create(local_frame_client_.Get(), *page_, nullptr);
-  frame_->SetView(LocalFrameView::Create(*frame_, initial_view_size));
+  frame_ = MakeGarbageCollected<LocalFrame>(local_frame_client_.Get(), *page_,
+                                            nullptr);
+  frame_->SetView(
+      MakeGarbageCollected<LocalFrameView>(*frame_, initial_view_size));
   frame_->View()->GetPage()->GetVisualViewport().SetSize(initial_view_size);
   frame_->Init();
 
diff --git a/third_party/blink/renderer/core/testing/origin_trials_test.h b/third_party/blink/renderer/core/testing/origin_trials_test.h
index 0420b2e4..0d23accc 100644
--- a/third_party/blink/renderer/core/testing/origin_trials_test.h
+++ b/third_party/blink/renderer/core/testing/origin_trials_test.h
@@ -57,6 +57,8 @@
   bool impliedAttribute() { return true; }
 
   bool invalidOSAttribute() { return true; }
+
+  bool navigationMethod() { return true; }
 };
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/testing/origin_trials_test.idl b/third_party/blink/renderer/core/testing/origin_trials_test.idl
index 0efc139..ea25cb3 100644
--- a/third_party/blink/renderer/core/testing/origin_trials_test.idl
+++ b/third_party/blink/renderer/core/testing/origin_trials_test.idl
@@ -51,4 +51,7 @@
 
     // These are not available even with the token present.
     [RuntimeEnabled=OriginTrialsSampleAPIInvalidOS] readonly attribute boolean invalidOSAttribute;
+
+    // These are available if the associated navigation trial is available.
+    [RuntimeEnabled=OriginTrialsSampleAPINavigation] boolean navigationMethod();
 };
diff --git a/third_party/blink/renderer/core/testing/v8/web_core_test_support.cc b/third_party/blink/renderer/core/testing/v8/web_core_test_support.cc
index 131625d..2fd489b6 100644
--- a/third_party/blink/renderer/core/testing/v8/web_core_test_support.cc
+++ b/third_party/blink/renderer/core/testing/v8/web_core_test_support.cc
@@ -106,6 +106,12 @@
           script_state->GetIsolate(), script_state->World(),
           v8::Local<v8::Object>(), prototype_object, interface_object);
     }
+    if (RuntimeEnabledFeatures::OriginTrialsSampleAPINavigationEnabled(
+            execution_context)) {
+      V8OriginTrialsTest::InstallOriginTrialsSampleAPINavigation(
+          script_state->GetIsolate(), script_state->World(),
+          v8::Local<v8::Object>(), prototype_object, interface_object);
+    }
   }
 }
 
@@ -159,6 +165,17 @@
       }
       break;
     }
+    case OriginTrialFeature::kOriginTrialsSampleAPINavigation: {
+      if (script_state->PerContextData()
+              ->GetExistingConstructorAndPrototypeForType(
+                  V8OriginTrialsTest::GetWrapperTypeInfo(), &prototype_object,
+                  &interface_object)) {
+        V8OriginTrialsTest::InstallOriginTrialsSampleAPINavigation(
+            script_state->GetIsolate(), script_state->World(),
+            v8::Local<v8::Object>(), prototype_object, interface_object);
+      }
+      break;
+    }
     default:
       break;
   }
diff --git a/third_party/blink/renderer/core/workers/worker_global_scope.cc b/third_party/blink/renderer/core/workers/worker_global_scope.cc
index ea2197e..9608aa16 100644
--- a/third_party/blink/renderer/core/workers/worker_global_scope.cc
+++ b/third_party/blink/renderer/core/workers/worker_global_scope.cc
@@ -113,6 +113,11 @@
   return Url();
 }
 
+scheduler::WorkerScheduler* WorkerGlobalScope::GetScheduler() {
+  DCHECK(IsContextThread());
+  return GetThread()->GetScheduler();
+}
+
 void WorkerGlobalScope::Dispose() {
   DCHECK(IsContextThread());
   closing_ = true;
diff --git a/third_party/blink/renderer/core/workers/worker_global_scope.h b/third_party/blink/renderer/core/workers/worker_global_scope.h
index 3a2df46..81648b3 100644
--- a/third_party/blink/renderer/core/workers/worker_global_scope.h
+++ b/third_party/blink/renderer/core/workers/worker_global_scope.h
@@ -123,6 +123,7 @@
   const base::UnguessableToken& GetAgentClusterID() const final {
     return agent_cluster_id_;
   }
+  scheduler::WorkerScheduler* GetScheduler() final;
 
   DOMTimerCoordinator* Timers() final { return &timers_; }
   SecurityContext& GetSecurityContext() final { return *this; }
diff --git a/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.cc b/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.cc
index b5c7400b..54bebc0 100644
--- a/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.cc
+++ b/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.cc
@@ -386,11 +386,6 @@
   modulator_ = modulator;
 }
 
-scheduler::WorkerScheduler* WorkerOrWorkletGlobalScope::GetScheduler() {
-  DCHECK(IsContextThread());
-  return GetThread()->GetScheduler();
-}
-
 scoped_refptr<base::SingleThreadTaskRunner>
 WorkerOrWorkletGlobalScope::GetTaskRunner(TaskType type) {
   DCHECK(IsContextThread());
diff --git a/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.h b/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.h
index f401caf7..3f5399a 100644
--- a/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.h
+++ b/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.h
@@ -134,7 +134,6 @@
 
   void Trace(blink::Visitor*) override;
 
-  scheduler::WorkerScheduler* GetScheduler() override;
   scoped_refptr<base::SingleThreadTaskRunner> GetTaskRunner(TaskType) override;
 
   OffMainThreadWorkerScriptFetchOption GetOffMainThreadWorkerScriptFetchOption()
diff --git a/third_party/blink/renderer/core/workers/worker_reporting_proxy.h b/third_party/blink/renderer/core/workers/worker_reporting_proxy.h
index dffa510..1fb08610 100644
--- a/third_party/blink/renderer/core/workers/worker_reporting_proxy.h
+++ b/third_party/blink/renderer/core/workers/worker_reporting_proxy.h
@@ -69,13 +69,10 @@
   virtual void DidCreateWorkerGlobalScope(WorkerOrWorkletGlobalScope*) {}
 
   // Invoked when the WorkerGlobalScope is initialized on
-  // WorkerThread::InitializeOnWorkerThread.
+  // WorkerThread::InitializeOnWorkerThread. This is synchronously called after
+  // WillInitializeWorkerContext().
   virtual void DidInitializeWorkerContext() {}
 
-  // Invoked when the WorkerGlobalScope initialization failed on
-  // WorkerThread::InitializeOnWorkerThread.
-  virtual void DidFailToInitializeWorkerContext() {}
-
   // Invoked when the worker's main script is loaded on
   // WorkerThread::InitializeOnWorkerThread(). Only invoked when the script was
   // loaded on the worker thread, i.e., via InstalledScriptsManager rather than
diff --git a/third_party/blink/renderer/core/workers/worker_thread.cc b/third_party/blink/renderer/core/workers/worker_thread.cc
index 6a2463a..0da8aa29d 100644
--- a/third_party/blink/renderer/core/workers/worker_thread.cc
+++ b/third_party/blink/renderer/core/workers/worker_thread.cc
@@ -543,18 +543,11 @@
             WorkerThreadDebugger::From(GetIsolate()))
       debugger->WorkerThreadCreated(this);
 
-    if (GlobalScope()->ScriptController()->Initialize(url_for_debugger)) {
-      worker_reporting_proxy_.DidInitializeWorkerContext();
-      v8::HandleScope handle_scope(GetIsolate());
-      Platform::Current()->WorkerContextCreated(
-          GlobalScope()->ScriptController()->GetContext());
-    } else {
-      // TODO(nhiroki): Handle a case where the script controller fails to
-      // initialize the context. Specifically, we need to terminate this worker
-      // thread from the the parent thread. Currently we only record trace
-      // event.
-      worker_reporting_proxy_.DidFailToInitializeWorkerContext();
-    }
+    GlobalScope()->ScriptController()->Initialize(url_for_debugger);
+    worker_reporting_proxy_.DidInitializeWorkerContext();
+    v8::HandleScope handle_scope(GetIsolate());
+    Platform::Current()->WorkerContextCreated(
+        GlobalScope()->ScriptController()->GetContext());
 
     inspector_task_runner_->InitIsolate(GetIsolate());
     SetThreadState(ThreadState::kRunning);
diff --git a/third_party/blink/renderer/core/workers/worklet_global_scope.cc b/third_party/blink/renderer/core/workers/worklet_global_scope.cc
index 9ce4921..e2442bb 100644
--- a/third_party/blink/renderer/core/workers/worklet_global_scope.cc
+++ b/third_party/blink/renderer/core/workers/worklet_global_scope.cc
@@ -185,6 +185,13 @@
   return worker_thread_->GetTaskRunner(task_type);
 }
 
+FrameOrWorkerScheduler* WorkletGlobalScope::GetScheduler() {
+  DCHECK(IsContextThread());
+  if (IsMainThreadWorkletGlobalScope())
+    return frame_->GetFrameScheduler();
+  return worker_thread_->GetScheduler();
+}
+
 LocalFrame* WorkletGlobalScope::GetFrame() const {
   DCHECK(IsMainThreadWorkletGlobalScope());
   return frame_;
diff --git a/third_party/blink/renderer/core/workers/worklet_global_scope.h b/third_party/blink/renderer/core/workers/worklet_global_scope.h
index bcdb51e0..b7ed559 100644
--- a/third_party/blink/renderer/core/workers/worklet_global_scope.h
+++ b/third_party/blink/renderer/core/workers/worklet_global_scope.h
@@ -65,6 +65,7 @@
   void ExceptionThrown(ErrorEvent*) final;
   CoreProbeSink* GetProbeSink() final;
   scoped_refptr<base::SingleThreadTaskRunner> GetTaskRunner(TaskType) final;
+  FrameOrWorkerScheduler* GetScheduler() final;
 
   // WorkerOrWorkletGlobalScope
   void Dispose() override;
diff --git a/third_party/blink/renderer/devtools/BUILD.gn b/third_party/blink/renderer/devtools/BUILD.gn
index 2fdcf9b..a4c42c0 100644
--- a/third_party/blink/renderer/devtools/BUILD.gn
+++ b/third_party/blink/renderer/devtools/BUILD.gn
@@ -698,13 +698,11 @@
   "front_end/sources/NavigatorView.js",
   "front_end/sources/OpenFileQuickOpen.js",
   "front_end/sources/OutlineQuickOpen.js",
-  "front_end/sources/revisionHistory.css",
   "front_end/sources/scopeChainSidebarPane.css",
   "front_end/sources/ScopeChainSidebarPane.js",
   "front_end/sources/ScriptFormatterEditorAction.js",
   "front_end/sources/ScriptOriginPlugin.js",
   "front_end/sources/SearchSourcesView.js",
-  "front_end/sources/serviceWorkersSidebar.css",
   "front_end/sources/SimpleHistoryManager.js",
   "front_end/sources/SnippetsPlugin.js",
   "front_end/sources/SourceFormatter.js",
diff --git a/third_party/blink/renderer/devtools/front_end/accessibility/accessibilityNode.css b/third_party/blink/renderer/devtools/front_end/accessibility/accessibilityNode.css
index 7b624a9e..bcb8f75 100644
--- a/third_party/blink/renderer/devtools/front_end/accessibility/accessibilityNode.css
+++ b/third_party/blink/renderer/devtools/front_end/accessibility/accessibilityNode.css
@@ -4,20 +4,11 @@
  * found in the LICENSE file.
  */
 
-.sidebar-pane.accessibility-computed {
-    background-color: rgba(0, 0, 0, 0.03);
-}
-
 .widget.ax-subpane {
     overflow-x: hidden;
     -webkit-user-select: text;
 }
 
-div.ax-text-alternatives {
-    margin-bottom: 3px;
-    border-bottom: 1px solid #BFBFBF;
-}
-
 .ax-ignored-info {
     padding: 6px;
 }
@@ -43,10 +34,6 @@
     text-decoration: line-through;
 }
 
-.sidebar-pane-stack .sidebar-pane {
-    padding-left: 4px;
-}
-
 .tree-outline span[is=dt-icon-label] {
     position: relative;
     left: -11px;
diff --git a/third_party/blink/renderer/devtools/front_end/animation/animationTimeline.css b/third_party/blink/renderer/devtools/front_end/animation/animationTimeline.css
index 37f109c..8155fb4 100644
--- a/third_party/blink/renderer/devtools/front_end/animation/animationTimeline.css
+++ b/third_party/blink/renderer/devtools/front_end/animation/animationTimeline.css
@@ -289,19 +289,6 @@
     background-color: #EFF4FD;
 }
 
-.animation-timeline-empty-message {
-    padding-left: 230px;
-    padding-right: 30px;
-    text-align: center;
-    position: absolute;
-    font-size: 20px;
-    line-height: 32px;
-    align-items: center;   justify-content: center;
-    width: 100%;
-    height: calc(100% - 44px);
-    display: flex;
-}
-
 .animation-buffer-preview {
     height: 40px;
     margin: 4px 2px;
diff --git a/third_party/blink/renderer/devtools/front_end/audits2/audits2Dialog.css b/third_party/blink/renderer/devtools/front_end/audits2/audits2Dialog.css
index 60a4b74..0ab6127 100644
--- a/third_party/blink/renderer/devtools/front_end/audits2/audits2Dialog.css
+++ b/third_party/blink/renderer/devtools/front_end/audits2/audits2Dialog.css
@@ -108,8 +108,3 @@
   0% { width: var(--progress-bar-auditing-percent); }
   100% { width: 99%; }
 }
-
-.audits2-report-error {
-    display: block;
-    margin-top: 5px;
-}
diff --git a/third_party/blink/renderer/devtools/front_end/color_picker/spectrum.css b/third_party/blink/renderer/devtools/front_end/color_picker/spectrum.css
index 17ca57e..7dc2a4a 100644
--- a/third_party/blink/renderer/devtools/front_end/color_picker/spectrum.css
+++ b/third_party/blink/renderer/devtools/front_end/color_picker/spectrum.css
@@ -27,12 +27,6 @@
     flex: none;
 }
 
-.spectrum-display-value {
-    -webkit-user-select: text;
-    display: inline-block;
-    padding-left: 2px;
-}
-
 .spectrum-hue {
     top: 16px;
 }
@@ -186,14 +180,6 @@
     left: auto;
 }
 
-.contrast-threshold-value {
-    font-weight: bold;
-}
-
-.contrast-link {
-    margin-left: 0.5em;
-}
-
 .contrast-details-value {
     color: #333;
     margin: 1px 5px;
@@ -324,16 +310,6 @@
     text-align: center;
 }
 
-.spectrum-palette-value {
-    background-color: rgb(65, 75, 217);
-    border-radius: 2px;
-    margin-top: 12px;
-    margin-left: 12px;
-    width: 12px;
-    height: 12px;
-    display: inline-block;
-}
-
 .spectrum-switcher {
     border-radius: 2px;
     height: 20px;
@@ -607,19 +583,3 @@
 .swatch.contrast [is=ui-icon] {
     margin: -2px;
 }
-
-button.background-color-picker {
-    border: 0;
-    padding:  0;
-    background: none;
-    position: relative;
-    margin: 0;
-}
-
-button.background-color-picker.active [is=ui-icon].largeicon-eyedropper.icon-mask {
-    background-color: hsl(218, 81%, 59%);
-}
-
-button.background-color-picker:hover [is=ui-icon].largeicon-eyedropper.icon-mask {
-    background-color: #333;
-}
diff --git a/third_party/blink/renderer/devtools/front_end/console/consoleSidebar.css b/third_party/blink/renderer/devtools/front_end/console/consoleSidebar.css
index 63cfa80..2ea4647 100644
--- a/third_party/blink/renderer/devtools/front_end/console/consoleSidebar.css
+++ b/third_party/blink/renderer/devtools/front_end/console/consoleSidebar.css
@@ -27,10 +27,6 @@
     background-color: #555;
 }
 
-[is=ui-icon].icon-warning {
-    background: linear-gradient(45deg, hsla(48, 100%, 50%, 1), hsla(48, 70%, 50%, 1));
-}
-
 li {
     height: 24px;
 }
diff --git a/third_party/blink/renderer/devtools/front_end/devices/devicesView.css b/third_party/blink/renderer/devtools/front_end/devices/devicesView.css
index 60421188..6252ebe 100644
--- a/third_party/blink/renderer/devtools/front_end/devices/devicesView.css
+++ b/third_party/blink/renderer/devtools/front_end/devices/devicesView.css
@@ -195,13 +195,6 @@
     white-space: pre-wrap;
 }
 
-.network-discovery-header {
-    display: flex;
-    align-items: center;
-    flex-direction: row;
-    margin-top: 5px;
-}
-
 .add-network-target-button {
     margin: 10px 25px;
     align-self: flex-start;
diff --git a/third_party/blink/renderer/devtools/front_end/elements/StylePropertyTreeElement.js b/third_party/blink/renderer/devtools/front_end/elements/StylePropertyTreeElement.js
index 5f186a1..ddc40b2 100644
--- a/third_party/blink/renderer/devtools/front_end/elements/StylePropertyTreeElement.js
+++ b/third_party/blink/renderer/devtools/front_end/elements/StylePropertyTreeElement.js
@@ -33,8 +33,9 @@
     this._expandElement = null;
     this._originalPropertyText = '';
     this._prompt = null;
-    this._propertyHasBeenEditedIncrementally = false;
     this._lastComputedValue = null;
+    /** @type {(!Elements.StylePropertyTreeElement.Context|undefined)} */
+    this._contextForTest;
   }
 
   /**
@@ -548,8 +549,10 @@
       expanded: this.expanded,
       hasChildren: this.isExpandable(),
       isEditingName: isEditingName,
+      originalProperty: this.property,
       previousContent: selectElement.textContent
     };
+    this._contextForTest = context;
 
     // Lie about our children to prevent expanding on double click and to collapse shorthands.
     this.setExpandable(false);
@@ -610,9 +613,8 @@
     this._prompt = new Elements.StylesSidebarPane.CSSPropertyPrompt(this, isEditingName);
     this._prompt.setAutocompletionTimeout(0);
 
-    // Do not live-edit "content" property of pseudo elements. crbug.com/433889
-    if (!isEditingName && (!this._parentPane.node().pseudoType() || this.name !== 'content'))
-      this._prompt.addEventListener(UI.TextPrompt.Events.TextChanged, this._applyFreeFlowStyleTextEdit.bind(this));
+    this._prompt.addEventListener(
+        UI.TextPrompt.Events.TextChanged, this._applyFreeFlowStyleTextEdit.bind(this, context));
 
     const proxyElement = this._prompt.attachAndStartEditing(selectElement, blurListener.bind(this, context));
     this._navigateToSource(selectElement, true);
@@ -707,19 +709,29 @@
   }
 
   /**
+   * @param {!Elements.StylePropertyTreeElement.Context} context
    * @return {!Promise}
    */
-  async _applyFreeFlowStyleTextEdit() {
+  async _applyFreeFlowStyleTextEdit(context) {
+    if (!this._prompt || !this._parentPane.node())
+      return;
     const valueText = this._prompt.textWithCurrentSuggestion();
-    if (valueText.indexOf(';') === -1)
-      await this.applyStyleText(this.nameElement.textContent + ': ' + valueText, false);
+    if (context.isEditingName || valueText.includes(';'))
+      return;
+    // Do not live-edit "content" property of pseudo elements. crbug.com/433889
+    const isPseudo = !!this._parentPane.node().pseudoType();
+    if (isPseudo && this.name === 'content')
+      return;
+
+    await this.applyStyleText(this.nameElement.textContent + ': ' + valueText, false);
   }
 
   /**
    * @return {!Promise}
    */
   kickFreeFlowStyleEditForTest() {
-    return this._applyFreeFlowStyleTextEdit();
+    const context = this._contextForTest;
+    return this._applyFreeFlowStyleTextEdit(/** @type {!Elements.StylePropertyTreeElement.Context} */ (context));
   }
 
   /**
@@ -738,25 +750,34 @@
   }
 
   /**
+   * @return {boolean}
+   */
+  _hasBeenEditedIncrementally() {
+    return this.property.propertyText !== this._originalPropertyText;
+  }
+
+  /**
    * @param {?Element} element
    * @param {!Elements.StylePropertyTreeElement.Context} context
    */
   editingCancelled(element, context) {
     this._removePrompt();
-    this._revertStyleUponEditingCanceled();
+
+    if (this._hasBeenEditedIncrementally())
+      this._applyOriginalStyle(context);
+    else if (this._newProperty)
+      this.treeOutline.removeChild(this);
+    this.updateTitle();
+
     // This should happen last, as it clears the info necessary to restore the property value after [Page]Up/Down changes.
     this.editingEnded(context);
   }
 
-  _revertStyleUponEditingCanceled() {
-    if (this._propertyHasBeenEditedIncrementally) {
-      this.applyStyleText(this._originalPropertyText, false);
-      this._originalPropertyText = '';
-    } else if (this._newProperty) {
-      this.treeOutline.removeChild(this);
-    } else {
-      this.updateTitle();
-    }
+  /**
+   * @param {!Elements.StylePropertyTreeElement.Context} context
+   */
+  async _applyOriginalStyle(context) {
+    await this.applyStyleText(this._originalPropertyText, false, context.originalProperty);
   }
 
   /**
@@ -916,18 +937,20 @@
   /**
    * @param {string} styleText
    * @param {boolean} majorChange
+   * @param {?SDK.CSSProperty=} property
    * @return {!Promise}
    */
-  applyStyleText(styleText, majorChange) {
-    return this._applyStyleThrottler.schedule(this._innerApplyStyleText.bind(this, styleText, majorChange));
+  applyStyleText(styleText, majorChange, property) {
+    return this._applyStyleThrottler.schedule(this._innerApplyStyleText.bind(this, styleText, majorChange, property));
   }
 
   /**
    * @param {string} styleText
    * @param {boolean} majorChange
+   * @param {?SDK.CSSProperty=} property
    * @return {!Promise}
    */
-  async _innerApplyStyleText(styleText, majorChange) {
+  async _innerApplyStyleText(styleText, majorChange, property) {
     if (!this.treeOutline)
       return;
 
@@ -935,8 +958,9 @@
     if (!oldStyleRange)
       return;
 
+    const hasBeenEditedIncrementally = this._hasBeenEditedIncrementally();
     styleText = styleText.replace(/\s/g, ' ').trim();  // Replace &nbsp; with whitespace.
-    if (!styleText.length && majorChange && this._newProperty && !this._propertyHasBeenEditedIncrementally) {
+    if (!styleText.length && majorChange && this._newProperty && !hasBeenEditedIncrementally) {
       // The user deleted everything and never applied a new property value via Up/Down scrolling/live editing, so remove the tree element and update.
       this.parent.removeChild(this);
       return;
@@ -949,10 +973,10 @@
     // FIXME: this does not handle trailing comments.
     if (styleText.length && !/;\s*$/.test(styleText))
       styleText += ';';
-    const overwriteProperty = !this._newProperty || this._propertyHasBeenEditedIncrementally;
+    const overwriteProperty = !this._newProperty || hasBeenEditedIncrementally;
     let success = await this.property.setText(styleText, majorChange, overwriteProperty);
     // Revert to the original text if applying the new text failed
-    if (this._propertyHasBeenEditedIncrementally && majorChange && !success) {
+    if (hasBeenEditedIncrementally && majorChange && !success) {
       majorChange = false;
       success = await this.property.setText(this._originalPropertyText, majorChange, overwriteProperty);
     }
@@ -971,8 +995,7 @@
     }
 
     this._matchedStyles.resetActiveProperties();
-    this._propertyHasBeenEditedIncrementally = true;
-    this.property = this._style.propertyAt(this.property.index);
+    this.property = property || this._style.propertyAt(this.property.index);
 
     if (currentNode === this.node())
       this._updatePane();
diff --git a/third_party/blink/renderer/devtools/front_end/elements_test_runner/ElementsTestRunner.js b/third_party/blink/renderer/devtools/front_end/elements_test_runner/ElementsTestRunner.js
index 019455d..177d9f4f 100644
--- a/third_party/blink/renderer/devtools/front_end/elements_test_runner/ElementsTestRunner.js
+++ b/third_party/blink/renderer/devtools/front_end/elements_test_runner/ElementsTestRunner.js
@@ -525,6 +525,14 @@
   return UI.viewManager.showView('elements.eventListeners');
 };
 
+/**
+ * @return {Promise}
+ */
+ElementsTestRunner.showComputedStyles = function() {
+  UI.panels.elements.sidebarPaneView.tabbedPane().selectTab('Computed', true);
+  return ElementsTestRunner.computedStyleWidget().doUpdate();
+};
+
 ElementsTestRunner.expandAndDumpSelectedElementEventListeners = function(callback, force) {
   ElementsTestRunner.expandAndDumpEventListeners(
       ElementsTestRunner.eventListenersWidget()._eventListenersView, callback, force);
diff --git a/third_party/blink/renderer/devtools/front_end/emulation/devicesSettingsTab.css b/third_party/blink/renderer/devtools/front_end/emulation/devicesSettingsTab.css
index 68d2e3f..0ea2b61 100644
--- a/third_party/blink/renderer/devtools/front_end/emulation/devicesSettingsTab.css
+++ b/third_party/blink/renderer/devtools/front_end/emulation/devicesSettingsTab.css
@@ -12,12 +12,6 @@
     margin: 0;
 }
 
-.devices-settings-tab .devices-title {
-    font-size: 120%;
-    color: #222;
-    flex: none;
-}
-
 .devices-settings-tab .devices-button-row {
     flex: none;
     display: flex;
diff --git a/third_party/blink/renderer/devtools/front_end/emulation/geolocationsSettingsTab.css b/third_party/blink/renderer/devtools/front_end/emulation/geolocationsSettingsTab.css
index 53c1f185e..f6a0a37 100644
--- a/third_party/blink/renderer/devtools/front_end/emulation/geolocationsSettingsTab.css
+++ b/third_party/blink/renderer/devtools/front_end/emulation/geolocationsSettingsTab.css
@@ -86,9 +86,3 @@
     text-align: inherit;
 }
 
-.geolocations-edit-optional {
-    position: absolute;
-    bottom: -20px;
-    right: 0;
-    color: rgb(128, 128, 128);
-}
diff --git a/third_party/blink/renderer/devtools/front_end/emulation/sensors.css b/third_party/blink/renderer/devtools/front_end/emulation/sensors.css
index acac8d9f..f89c59e 100644
--- a/third_party/blink/renderer/devtools/front_end/emulation/sensors.css
+++ b/third_party/blink/renderer/devtools/front_end/emulation/sensors.css
@@ -32,10 +32,6 @@
     opacity: 0.5;
 }
 
-.sensors-view .field-error-message {
-    display: none;
-}
-
 .sensors-view input:focus::-webkit-input-placeholder {
     color: transparent !important;
 }
@@ -287,14 +283,6 @@
     display: flex;
 }
 
-.touch-label {
-    margin-top: 10px;
-}
-
-.touch-label select {
-    margin-left: 10px;
-}
-
 .panel-section-separator {
     height: 2px;
     margin-bottom: 8px;
diff --git a/third_party/blink/renderer/devtools/front_end/inline_editor/bezierEditor.css b/third_party/blink/renderer/devtools/front_end/inline_editor/bezierEditor.css
index 6da7ab04..dc0d556a 100644
--- a/third_party/blink/renderer/devtools/front_end/inline_editor/bezierEditor.css
+++ b/third_party/blink/renderer/devtools/front_end/inline_editor/bezierEditor.css
@@ -16,10 +16,6 @@
     background-color: var(--selection-bg-color);
 }
 
-.bezier-preset-label {
-    font-size: 10px;
-}
-
 .bezier-preset {
     width: 50px;
     height: 50px;
diff --git a/third_party/blink/renderer/devtools/front_end/layer_viewer/paintProfiler.css b/third_party/blink/renderer/devtools/front_end/layer_viewer/paintProfiler.css
index 48a06b3..167456e7 100644
--- a/third_party/blink/renderer/devtools/front_end/layer_viewer/paintProfiler.css
+++ b/third_party/blink/renderer/devtools/front_end/layer_viewer/paintProfiler.css
@@ -29,12 +29,6 @@
     width: 100%;
 }
 
-.paint-profiler-canvas-container .overview-grid-dividers-background,
-.paint-profiler-canvas-container .overview-grid-window {
-    bottom: 0;
-    height: auto;
-}
-
 .paint-profiler-canvas-container .overview-grid-window-resizer {
     z-index: 2000;
 }
diff --git a/third_party/blink/renderer/devtools/front_end/network/networkConfigView.css b/third_party/blink/renderer/devtools/front_end/network/networkConfigView.css
index df86aa2..6cb6445 100644
--- a/third_party/blink/renderer/devtools/front_end/network/networkConfigView.css
+++ b/third_party/blink/renderer/devtools/front_end/network/networkConfigView.css
@@ -83,10 +83,10 @@
     display: block;
 }
 
-.network-config-ua-auto, .network-config-ua-custom {
+.network-config-ua-custom {
     opacity: 0.5;
 }
 
-.network-config-ua-auto.checked, .network-config-ua-custom.checked {
+.network-config-ua-custom.checked {
     opacity: 1;
 }
diff --git a/third_party/blink/renderer/devtools/front_end/network/networkPanel.css b/third_party/blink/renderer/devtools/front_end/network/networkPanel.css
index 6d3a652..3bc69da 100644
--- a/third_party/blink/renderer/devtools/front_end/network/networkPanel.css
+++ b/third_party/blink/renderer/devtools/front_end/network/networkPanel.css
@@ -87,11 +87,6 @@
     flex: 0 0 60px;
 }
 
-.network-overview .overview-grid-window,
-.network-overview .overview-grid-dividers-background {
-    height: 100%;
-}
-
 .network-overview .resources-dividers-label-bar {
     background-color: rgba(255, 255, 255, 0.95);
 }
@@ -119,30 +114,6 @@
     flex-shrink: 0;
 }
 
-.network-blocked-urls {
-    border-top: var(--divider-border);
-    flex: 104px 0 0;
-}
-
-.open-search-view {
-    align-items: center;
-    background-color: hsl(50, 100%, 88%);
-    border-bottom: var(--divider-border);
-    cursor: pointer;
-    flex-grow: 0;
-    padding: 4px;
-}
-
-.open-search-view > * {
-    margin: 0 4px;
-}
-
-.open-search-view .search-suggestion {
-    overflow: hidden;
-    text-overflow: ellipsis;
-    white-space: nowrap;
-}
-
 .network-tabbed-pane {
     background-color: var(--toolbar-bg-color);
 }
diff --git a/third_party/blink/renderer/devtools/front_end/network/requestHeadersView.css b/third_party/blink/renderer/devtools/front_end/network/requestHeadersView.css
index f864987..ba79444 100644
--- a/third_party/blink/renderer/devtools/front_end/network/requestHeadersView.css
+++ b/third_party/blink/renderer/devtools/front_end/network/requestHeadersView.css
@@ -14,14 +14,6 @@
     margin-right: 3px;
 }
 
-.request-headers-view .filter-input {
-    outline: none !important;
-    border: none;
-    border-bottom: solid 1px #ccc;
-    flex: 0 0 19px;
-    padding: 0 4px;
-}
-
 .request-headers-tree {
     flex-grow: 1;
     overflow-y: auto;
diff --git a/third_party/blink/renderer/devtools/front_end/node_main/nodeConnectionsPanel.css b/third_party/blink/renderer/devtools/front_end/node_main/nodeConnectionsPanel.css
index 5f4e875..3e7b5883 100644
--- a/third_party/blink/renderer/devtools/front_end/node_main/nodeConnectionsPanel.css
+++ b/third_party/blink/renderer/devtools/front_end/node_main/nodeConnectionsPanel.css
@@ -4,13 +4,6 @@
  * found in the LICENSE file.
  */
 
-.network-discovery-header {
-    display: flex;
-    align-items: center;
-    flex-direction: row;
-    margin-top: 5px;
-}
-
 .add-network-target-button {
     margin: 10px 25px;
     align-self: flex-start;
@@ -74,10 +67,6 @@
     white-space: pre-wrap;
 }
 
-.network-discovery-header {
-    display: none;
-}
-
 .node-panel {
     align-items: center;
     justify-content: flex-start;
diff --git a/third_party/blink/renderer/devtools/front_end/object_ui/objectPopover.css b/third_party/blink/renderer/devtools/front_end/object_ui/objectPopover.css
index c04f202..59e332c 100644
--- a/third_party/blink/renderer/devtools/front_end/object_ui/objectPopover.css
+++ b/third_party/blink/renderer/devtools/front_end/object_ui/objectPopover.css
@@ -55,9 +55,3 @@
     white-space: nowrap;
     overflow: hidden;
 }
-
-.function-location-step-into {
-    position: relative;
-    height: 14px;
-    transform: rotate(-90deg);
-}
diff --git a/third_party/blink/renderer/devtools/front_end/object_ui/objectValue.css b/third_party/blink/renderer/devtools/front_end/object_ui/objectValue.css
index 6d75996..afbc104 100644
--- a/third_party/blink/renderer/devtools/front_end/object_ui/objectValue.css
+++ b/third_party/blink/renderer/devtools/front_end/object_ui/objectValue.css
@@ -69,12 +69,6 @@
     color: rgb(128, 128, 128);
 }
 
-.object-value {
-    text-overflow: ellipsis;
-    overflow: hidden;
-    -webkit-user-select: text;
-}
-
 .object-value-calculate-value-button:hover {
     text-decoration: underline;
 }
diff --git a/third_party/blink/renderer/devtools/front_end/perf_ui/filmStripView.css b/third_party/blink/renderer/devtools/front_end/perf_ui/filmStripView.css
index 34143c6..ab3ed838 100644
--- a/third_party/blink/renderer/devtools/front_end/perf_ui/filmStripView.css
+++ b/third_party/blink/renderer/devtools/front_end/perf_ui/filmStripView.css
@@ -30,15 +30,6 @@
     cursor: pointer;
 }
 
-.film-strip-view .frame-limit-reached {
-    font-size: 24px;
-    color: #888;
-    justify-content: center;
-    display: inline-flex;
-    flex-direction: column;
-    flex: none;
-}
-
 .film-strip-view .frame .thumbnail {
     min-width: 24px;
     display: flex;
diff --git a/third_party/blink/renderer/devtools/front_end/performance_monitor/performanceMonitor.css b/third_party/blink/renderer/devtools/front_end/performance_monitor/performanceMonitor.css
index 2629067..05f87be 100644
--- a/third_party/blink/renderer/devtools/front_end/performance_monitor/performanceMonitor.css
+++ b/third_party/blink/renderer/devtools/front_end/performance_monitor/performanceMonitor.css
@@ -84,15 +84,3 @@
 .perfmon-indicator:not(.active) .perfmon-indicator-value {
   opacity: 0;
 }
-
-.perfmon-indicator-close {
-  padding-left: 4px;
-}
-
-.perfmon-indicator:not(:hover) .perfmon-indicator-close {
-  opacity: 0;
-}
-
-.perfmon-add-button:not(:hover) {
-  color: #bbb;
-}
diff --git a/third_party/blink/renderer/devtools/front_end/profiler/profilesPanel.css b/third_party/blink/renderer/devtools/front_end/profiler/profilesPanel.css
index 4fcbd334..9c96795 100644
--- a/third_party/blink/renderer/devtools/front_end/profiler/profilesPanel.css
+++ b/third_party/blink/renderer/devtools/front_end/profiler/profilesPanel.css
@@ -121,20 +121,6 @@
     to { background-color: rgba(255, 255, 120, 0); }
 }
 
-.profile-canvas-decoration span[is=dt-icon-label] {
-    margin-right: 4px;
-}
-
-.profile-canvas-decoration {
-    color: red;
-    margin: -14px 0 13px 22px;
-    padding-left: 14px;
-}
-
-.profile-canvas-decoration button {
-    margin: 0 0 0 10px !important;
-}
-
 .cpu-profile-flame-chart-overview-container {
     overflow: hidden;
     position: absolute;
diff --git a/third_party/blink/renderer/devtools/front_end/resources/indexedDBViews.css b/third_party/blink/renderer/devtools/front_end/resources/indexedDBViews.css
index d19972c..c1749e9a 100644
--- a/third_party/blink/renderer/devtools/front_end/resources/indexedDBViews.css
+++ b/third_party/blink/renderer/devtools/front_end/resources/indexedDBViews.css
@@ -28,11 +28,6 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-.indexed-db-database-view {
-    -webkit-user-select: text;
-    margin-top: 5px;
-}
-
 .indexed-db-data-view .data-view-toolbar {
     position: relative;
     background-color: #eee;
@@ -68,10 +63,6 @@
     line-height: inherit;
 }
 
-.indexed-db-data-view .primitive-value {
-    padding-top: 1px;
-}
-
 .indexed-db-data-view .data-grid .data-container td .section .header .title {
     white-space: nowrap;
     text-overflow: ellipsis;
diff --git a/third_party/blink/renderer/devtools/front_end/resources/resourcesPanel.css b/third_party/blink/renderer/devtools/front_end/resources/resourcesPanel.css
index 6349e00..ac97a87 100644
--- a/third_party/blink/renderer/devtools/front_end/resources/resourcesPanel.css
+++ b/third_party/blink/renderer/devtools/front_end/resources/resourcesPanel.css
@@ -37,16 +37,6 @@
     background-color: var(--toolbar-bg-color);
 }
 
-li.selected .base-storage-tree-element-subtitle {
-    color: white;
-}
-
-.base-storage-tree-element-subtitle {
-    padding-left: 2px;
-    color: rgb(80, 80, 80);
-    text-shadow: none;
-}
-
 .resources.panel .status {
     float: right;
     height: 16px;
@@ -139,31 +129,6 @@
     -webkit-user-select: text;
 }
 
-.resource-sidebar-tree-item .icon {
-    content: url(Images/resourcePlainIconSmall.png);
-}
-
-.resource-sidebar-tree-item.resources-type-image .icon {
-    position: relative;
-    background-image: url(Images/resourcePlainIcon.png);
-    background-repeat: no-repeat;
-    content: "";
-}
-
-.resources-type-image .image-resource-icon-preview {
-    position: absolute;
-    margin: auto;
-    min-width: 1px;
-    min-height: 1px;
-    top: 2px;
-    bottom: 1px;
-    left: 3px;
-    right: 3px;
-    max-width: 8px;
-    max-height: 11px;
-    overflow: hidden;
-}
-
 .resources-sidebar {
     padding: 0;
 }
diff --git a/third_party/blink/renderer/devtools/front_end/resources/serviceWorkerCacheViews.css b/third_party/blink/renderer/devtools/front_end/resources/serviceWorkerCacheViews.css
index 1b3ad5a..45325a1 100644
--- a/third_party/blink/renderer/devtools/front_end/resources/serviceWorkerCacheViews.css
+++ b/third_party/blink/renderer/devtools/front_end/resources/serviceWorkerCacheViews.css
@@ -11,11 +11,6 @@
     padding-right: 10px;
 }
 
-.service-worker-cache-data-view .data-view-toolbar .key-input {
-    margin: auto 0;
-    width: 200px;
-}
-
 .service-worker-cache-data-view .data-grid {
     flex: auto;
 }
@@ -46,10 +41,6 @@
     line-height: inherit;
 }
 
-.service-worker-cache-data-view .primitive-value {
-    padding-top: 1px;
-}
-
 .service-worker-cache-data-view .data-grid .data-container td .section .header .title {
     white-space: nowrap;
     text-overflow: ellipsis;
diff --git a/third_party/blink/renderer/devtools/front_end/resources/serviceWorkersView.css b/third_party/blink/renderer/devtools/front_end/resources/serviceWorkersView.css
index 53085337..544bd027 100644
--- a/third_party/blink/renderer/devtools/front_end/resources/serviceWorkersView.css
+++ b/third_party/blink/renderer/devtools/front_end/resources/serviceWorkersView.css
@@ -4,38 +4,6 @@
  * found in the LICENSE file.
  */
 
-.service-worker-error-stack {
-    max-height: 200px;
-    overflow: auto;
-    display: flex;
-    flex-direction: column;
-    border: 1px solid #ccc;
-    background-color: #fff0f0;
-    color: red;
-    line-height: 18px;
-    margin: 10px 2px 0 -14px;
-    white-space: initial;
-}
-
-.service-worker-error-stack > div {
-    flex: none;
-    padding: 3px 4px;
-}
-
-.service-worker-error-stack > div:not(:last-child) {
-    border-bottom: 1px solid #ffd7d7;
-}
-
-.service-worker-error-stack label {
-    flex: auto;
-}
-
-.service-worker-error-stack .devtools-link {
-    float: right;
-    color: rgb(33%, 33%, 33%);
-    cursor: pointer;
-}
-
 .service-worker-version-stack {
     position: relative;
 }
diff --git a/third_party/blink/renderer/devtools/front_end/sdk/NetworkManager.js b/third_party/blink/renderer/devtools/front_end/sdk/NetworkManager.js
index 8c828ef..093c5b1a 100644
--- a/third_party/blink/renderer/devtools/front_end/sdk/NetworkManager.js
+++ b/third_party/blink/renderer/devtools/front_end/sdk/NetworkManager.js
@@ -519,11 +519,16 @@
 
     // net::ParsedCookie::kMaxCookieSize = 4096 (net/cookies/parsed_cookie.h)
     if ('set-cookie' in lowercaseHeaders && lowercaseHeaders['set-cookie'].length > 4096) {
-      const message = Common.UIString(
-          'Set-Cookie header is ignored in response from url: %s. Cookie length should be less than or equal to 4096 characters.',
-          response.url);
-      this._manager.dispatchEventToListeners(
-          SDK.NetworkManager.Events.MessageGenerated, {message: message, requestId: requestId, warning: true});
+      const values = lowercaseHeaders['set-cookie'].split('\n');
+      for (let i = 0; i < values.length; ++i) {
+        if (values[i].length <= 4096)
+          continue;
+        const message = Common.UIString(
+            'Set-Cookie header is ignored in response from url: %s. Cookie length should be less than or equal to 4096 characters.',
+            response.url);
+        this._manager.dispatchEventToListeners(
+            SDK.NetworkManager.Events.MessageGenerated, {message: message, requestId: requestId, warning: true});
+      }
     }
 
     if ('public-key-pins' in lowercaseHeaders || 'public-key-pins-report-only' in lowercaseHeaders) {
diff --git a/third_party/blink/renderer/devtools/front_end/security/mainView.css b/third_party/blink/renderer/devtools/front_end/security/mainView.css
index 4979fb3..f06c287 100644
--- a/third_party/blink/renderer/devtools/front_end/security/mainView.css
+++ b/third_party/blink/renderer/devtools/front_end/security/mainView.css
@@ -152,18 +152,6 @@
     margin-bottom: 8px;
 }
 
-.security-explanation-neutral .security-section-title,
-.security-explanation-warning .security-section-title
-{
-    color: #cb3626;
-    font-weight: bold;
-}
-.security-explanation-insecure .security-section-title
-{
-    color: rgb(216, 71, 60);
-    font-weight: bold;
-}
-
 .security-mixed-content {
     margin-top: 8px;
 }
diff --git a/third_party/blink/renderer/devtools/front_end/settings/settingsScreen.css b/third_party/blink/renderer/devtools/front_end/settings/settingsScreen.css
index 9989041..181dc27 100644
--- a/third_party/blink/renderer/devtools/front_end/settings/settingsScreen.css
+++ b/third_party/blink/renderer/devtools/front_end/settings/settingsScreen.css
@@ -44,11 +44,6 @@
     margin-left: 20px;
 }
 
-.settings-tab .field-error-message {
-    color: DarkRed;
-    height: 0; /* Avoid changing element height when content is set. */
-}
-
 .settings-line {
     padding-bottom: 5px;
     margin-bottom: 5px;
@@ -115,18 +110,10 @@
     flex-shrink: 0;
 }
 
-#general-tab-content .settings-block fieldset legend {
-    font-size: 14px;
-}
-
 .settings-block p p {
     padding-left: 30px;
 }
 
-.settings-content p.settings-section {
-    margin: 0 0 15px 0;
-}
-
 .settings-experiments-warning-subsection-warning {
     color: rgb(200, 0, 0);
 }
@@ -160,10 +147,6 @@
     padding: 0;
 }
 
-.settings-tab input.numeric {
-    text-align: right;
-}
-
 .settings-tab-container {
     flex: auto;
     overflow: hidden;
diff --git a/third_party/blink/renderer/devtools/front_end/sources/breakpointEditDialog.css b/third_party/blink/renderer/devtools/front_end/sources/breakpointEditDialog.css
index b1099670..39009ebb 100644
--- a/third_party/blink/renderer/devtools/front_end/sources/breakpointEditDialog.css
+++ b/third_party/blink/renderer/devtools/front_end/sources/breakpointEditDialog.css
@@ -35,8 +35,3 @@
   font-family: sans-serif;
   font-size: 12px;
 }
-
-:host-context(.sources-edit-breakpoint-dialog) .source-frame-breakpoint-editor:hover,
-:host-context(.sources-edit-breakpoint-dialog) .source-frame-breakpoint-editor:focus-within {
-  box-shadow: var(--focus-ring-inactive-shadow);
-}
diff --git a/third_party/blink/renderer/devtools/front_end/sources/module.json b/third_party/blink/renderer/devtools/front_end/sources/module.json
index cbe6029..f3e264a 100644
--- a/third_party/blink/renderer/devtools/front_end/sources/module.json
+++ b/third_party/blink/renderer/devtools/front_end/sources/module.json
@@ -933,9 +933,7 @@
         "javaScriptBreakpointsSidebarPane.css",
         "navigatorTree.css",
         "navigatorView.css",
-        "revisionHistory.css",
         "scopeChainSidebarPane.css",
-        "serviceWorkersSidebar.css",
         "sourcesPanel.css",
         "sourcesView.css",
         "threadsSidebarPane.css",
diff --git a/third_party/blink/renderer/devtools/front_end/sources/revisionHistory.css b/third_party/blink/renderer/devtools/front_end/sources/revisionHistory.css
deleted file mode 100644
index e8144aa..0000000
--- a/third_party/blink/renderer/devtools/front_end/sources/revisionHistory.css
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-.revision-history-link {
-    text-decoration: underline;
-    cursor: pointer;
-    color: #00e;
-    padding: 0 4px;
-}
-
-.revision-history-link-row {
-    padding-left: 16px;
-}
-
-li.revision-history-line {
-    padding-left: 6px;
-    -webkit-user-select: text;
-}
-
-.webkit-line-number {
-    border-right: 1px solid #BBB;
-    background-color: #F0F0F0;
-}
-
-li.revision-history-revision {
-    padding-left: 16px;
-}
-
-.revision-history-line-added {
-    background-color: rgb(153, 238, 153);
-}
-
-.revision-history-line-removed {
-    background-color: rgb(255, 221, 221);
-}
-
-.revision-history-line-separator .webkit-line-number {
-    color: transparent;
-}
-
-.revision-history-line {
-    white-space: nowrap;
-}
diff --git a/third_party/blink/renderer/devtools/front_end/sources/serviceWorkersSidebar.css b/third_party/blink/renderer/devtools/front_end/sources/serviceWorkersSidebar.css
index dc867f3..0df08cc 100644
--- a/third_party/blink/renderer/devtools/front_end/sources/serviceWorkersSidebar.css
+++ b/third_party/blink/renderer/devtools/front_end/sources/serviceWorkersSidebar.css
@@ -14,12 +14,3 @@
 .service-worker:last-child {
     border-bottom: none;
 }
-
-.service-worker-scope {
-    color: #777;
-    flex: auto;
-    margin: 5px 5px 0 0;
-    white-space: nowrap;
-    overflow: hidden;
-    text-overflow: ellipsis;
-}
diff --git a/third_party/blink/renderer/devtools/front_end/sources/sourcesPanel.css b/third_party/blink/renderer/devtools/front_end/sources/sourcesPanel.css
index 17d4d4a..05c22cd 100644
--- a/third_party/blink/renderer/devtools/front_end/sources/sourcesPanel.css
+++ b/third_party/blink/renderer/devtools/front_end/sources/sourcesPanel.css
@@ -56,14 +56,6 @@
     height: 28px;
 }
 
-.panel.sources .sidebar-pane-stack {
-    overflow: auto;
-}
-
-.cursor-pointer {
-    cursor: pointer;
-}
-
 .cursor-auto {
     cursor: auto;
 }
diff --git a/third_party/blink/renderer/devtools/front_end/sources/sourcesView.css b/third_party/blink/renderer/devtools/front_end/sources/sourcesView.css
index 8fe79b5..d28dab8 100644
--- a/third_party/blink/renderer/devtools/front_end/sources/sourcesView.css
+++ b/third_party/blink/renderer/devtools/front_end/sources/sourcesView.css
@@ -46,11 +46,6 @@
     cursor: default;
 }
 
-.sources-toolbar-spacer {
-    flex: auto;
-    pointer-events: none;
-}
-
 .source-frame-debugger-script {
     background-color: rgba(255, 255, 194, 0.5);
 }
diff --git a/third_party/blink/renderer/devtools/front_end/test_runner/TestRunner.js b/third_party/blink/renderer/devtools/front_end/test_runner/TestRunner.js
index d997b50..abb4457f 100644
--- a/third_party/blink/renderer/devtools/front_end/test_runner/TestRunner.js
+++ b/third_party/blink/renderer/devtools/front_end/test_runner/TestRunner.js
@@ -242,6 +242,8 @@
 };
 
 /**
+ * Wraps a test function with an exception filter. Does not work
+ * correctly for async functions; use safeAsyncWrap instead.
  * @param {!Function|undefined} func
  * @param {!Function=} onexception
  * @return {!Function}
@@ -268,6 +270,31 @@
 };
 
 /**
+ * Wraps a test function that returns a Promise with an exception
+ * filter. Does not work correctly for functions which don't return
+ * a Promise; use safeWrap instead.
+ * @param {function(...):Promise<*>} func
+ * @return {function(...):Promise<*>}
+ */
+TestRunner.safeAsyncWrap = function(func) {
+  /**
+   * @this {*}
+   */
+  async function result() {
+    if (!func)
+      return;
+    const wrapThis = this;
+    try {
+      return await func.apply(wrapThis, arguments);
+    } catch (e) {
+      TestRunner.addResult('Exception while running: ' + func + '\n' + (e.stack || e));
+      TestRunner.completeTest();
+    }
+  }
+  return result;
+};
+
+/**
  * @param {!Node} node
  * @return {string}
  */
@@ -1076,6 +1103,21 @@
 };
 
 /**
+ * @param {!Array<function():Promise<*>>} testSuite
+ */
+TestRunner.runAsyncTestSuite = async function(testSuite) {
+  for (const nextTest of testSuite) {
+    TestRunner.addResult('');
+    TestRunner.addResult(
+        'Running: ' +
+        /function\s([^(]*)/.exec(nextTest)[1]);
+    await TestRunner.safeAsyncWrap(nextTest)();
+  }
+
+  TestRunner.completeTest();
+};
+
+/**
  * @param {*} expected
  * @param {*} found
  * @param {string} message
diff --git a/third_party/blink/renderer/devtools/front_end/timeline/timelinePanel.css b/third_party/blink/renderer/devtools/front_end/timeline/timelinePanel.css
index 7ee4ac9..f54a86c 100644
--- a/third_party/blink/renderer/devtools/front_end/timeline/timelinePanel.css
+++ b/third_party/blink/renderer/devtools/front_end/timeline/timelinePanel.css
@@ -53,10 +53,6 @@
     border-bottom: 1px solid #bbb;
 }
 
-#timeline-overview-panel .timeline-graph-bar {
-    pointer-events: none;
-}
-
 #timeline-overview-grid {
     background-color: rgb(255, 255, 255);
 }
@@ -78,19 +74,6 @@
     flex: auto;
 }
 
-.timeline-view-stack {
-    flex: auto;
-    display: flex;
-}
-
-#timeline-container .devtools-link {
-    color: inherit;
-}
-
-.timeline-graph-side.hovered {
-    background-color: rgba(0, 0, 0, 0.05) !important;
-}
-
 .timeline.panel .status-pane-container {
     z-index: 1000;
     display: flex;
@@ -189,14 +172,6 @@
     height: 100%;
 }
 
-#timeline-graphs {
-    position: absolute;
-    left: 0;
-    right: 0;
-    max-height: 100%;
-    top: 20px;
-}
-
 .timeline-aggregated-legend-title {
     display: inline-block;
 }
@@ -223,11 +198,6 @@
     list-style-type: none;
 }
 
-#resources-container-content {
-    overflow: hidden;
-    min-height: 100%;
-}
-
 .memory-graph-label {
     position: absolute;
     right: 0;
@@ -278,18 +248,6 @@
     flex-shrink: 1;
 }
 
-.memory-counter-selector-info {
-    flex: 0 0 auto;
-    margin-left: 5px;
-    white-space: nowrap;
-}
-
-.memory-counter-selector-info .range {
-    margin: 0 4px;
-    align-items: center;
-    display: inline-flex;
-}
-
 .memory-counter-value {
     margin: 8px;
 }
@@ -302,11 +260,6 @@
     line-height: 18px;
 }
 
-.timeline-filters-header {
-    overflow: hidden;
-    flex: none;
-}
-
 .timeline-details {
     vertical-align: top;
 }
@@ -413,12 +366,6 @@
     line-height: 11px;
 }
 
-.timeline-details-view-row-value .timeline-details-warning-marker {
-    white-space: nowrap;
-    text-overflow: ellipsis;
-    overflow: hidden;
-}
-
 .timeline-details-view-pie-chart-wrapper {
     margin: 4px 0;
 }
@@ -469,10 +416,6 @@
     margin-bottom: -1px;
 }
 
-.timeline-status-pane.full-widget-dimmed-banner {
-    text-align: left !important;
-}
-
 .timeline-layers-view > div:last-child,
 .timeline-layers-view-properties > div:last-child {
     background-color: #eee;
@@ -493,10 +436,6 @@
     z-index: 0;
 }
 
-.timeline-gap {
-    flex: none;
-}
-
 .timeline-filmstrip-preview > img {
     margin-top: 5px;
     max-width: 500px;
diff --git a/third_party/blink/renderer/devtools/front_end/ui/filter.css b/third_party/blink/renderer/devtools/front_end/ui/filter.css
index b09df818..eb39ece 100644
--- a/third_party/blink/renderer/devtools/front_end/ui/filter.css
+++ b/third_party/blink/renderer/devtools/front_end/ui/filter.css
@@ -93,13 +93,6 @@
     background: rgba(0, 0, 0, 0.5);
 }
 
-.filter-combobox-filter {
-    margin-left: 5px;
-    margin-right: 2px;
-    flex: 0 0 auto;
-    display: inline-block;
-}
-
 .filter-checkbox-filter {
     padding-left: 4px;
     padding-right: 2px;
@@ -117,19 +110,6 @@
     margin: auto 0;
 }
 
-.filter-checkbox-filter .checkbox-filter-checkbox {
-    width: 10px;
-    height: 10px;
-    margin: auto 3px;
-    padding: 0;
-    border-radius: 2px;
-    border: solid 1px;
-    display: inline-block;
-    overflow: visible;
-    opacity: 0.8;
-    flex-shrink: 0;
-}
-
 .filter-input-field {
     margin: 0 3px;
     padding-left: 3px;
diff --git a/third_party/blink/renderer/devtools/front_end/ui/inspectorCommon.css b/third_party/blink/renderer/devtools/front_end/ui/inspectorCommon.css
index 548085bc..525ae586 100644
--- a/third_party/blink/renderer/devtools/front_end/ui/inspectorCommon.css
+++ b/third_party/blink/renderer/devtools/front_end/ui/inspectorCommon.css
@@ -102,10 +102,6 @@
     flex: auto;
 }
 
-.flex-auto-important {
-    flex: auto !important;
-}
-
 .flex-none {
     flex: none;
 }
diff --git a/third_party/blink/renderer/devtools/front_end/ui/inspectorSyntaxHighlight.css b/third_party/blink/renderer/devtools/front_end/ui/inspectorSyntaxHighlight.css
index 1ea9518..0a49a00 100644
--- a/third_party/blink/renderer/devtools/front_end/ui/inspectorSyntaxHighlight.css
+++ b/third_party/blink/renderer/devtools/front_end/ui/inspectorSyntaxHighlight.css
@@ -134,12 +134,6 @@
     color: hsl(0, 0%, 67%);
 }
 
-.webkit-html-end-of-file {
-    /* Keep this in sync with view-source.css (.webkit-html-end-of-file) */
-    color: rgb(255, 0, 0);
-    font-weight: bold;
-}
-
 /* Default CodeMirror Theme */
 .cm-negative {color: #d44;}
 .cm-positive {color: #292;}
diff --git a/third_party/blink/renderer/devtools/front_end/ui/inspectorSyntaxHighlightDark.css b/third_party/blink/renderer/devtools/front_end/ui/inspectorSyntaxHighlightDark.css
index 03463733..011ca04f 100644
--- a/third_party/blink/renderer/devtools/front_end/ui/inspectorSyntaxHighlightDark.css
+++ b/third_party/blink/renderer/devtools/front_end/ui/inspectorSyntaxHighlightDark.css
@@ -59,16 +59,7 @@
 .webkit-html-css-node{color:rgb(207, 208, 208);}
 .webkit-html-js-node{color:rgb(207, 208, 208);}
 .webkit-html-pseudo-element{color:rgb(93, 175, 215);}
-.webkit-css-selector{color:rgb(255, 163, 79);}
-.webkit-css-at-rule{color:rgb(188, 164, 197);}
-.webkit-css-color{color:rgb(255, 163, 79);}
-.webkit-css-comment{color:rgb(116, 116, 116);}
-.webkit-css-important{color:rgb(255, 26, 26);}
-.webkit-css-keyword{color:rgb(255, 163, 79);}
-.webkit-css-number{color:rgb(217, 217, 217);}
 .webkit-css-property{color: rgb(53, 212, 199);}
-.webkit-css-string{color:rgb(231, 194, 111);}
-.webkit-css-url{color:rgb(231, 194, 111);}
 
 .cm-def{color:var(--dom-tag-name-color);}
 .cm-header{color:var(--dom-tag-name-color);}
diff --git a/third_party/blink/renderer/devtools/front_end/ui/splitWidget.css b/third_party/blink/renderer/devtools/front_end/ui/splitWidget.css
index 58edda6c4..b4f60ae 100644
--- a/third_party/blink/renderer/devtools/front_end/ui/splitWidget.css
+++ b/third_party/blink/renderer/devtools/front_end/ui/splitWidget.css
@@ -66,10 +66,6 @@
     z-index: 500;
 }
 
-.shadow-split-widget-resizer-border {
-    pointer-events: none;
-}
-
 .shadow-split-widget.vbox > .shadow-split-widget-sidebar.no-default-splitter {
     border: 0 !important;
 }
diff --git a/third_party/blink/renderer/devtools/front_end/ui/treeoutline.css b/third_party/blink/renderer/devtools/front_end/ui/treeoutline.css
index 3664057..baae378 100644
--- a/third_party/blink/renderer/devtools/front_end/ui/treeoutline.css
+++ b/third_party/blink/renderer/devtools/front_end/ui/treeoutline.css
@@ -68,10 +68,6 @@
     list-style-type: none;
 }
 
-.tree-outline-no-padding {
-    padding: 0;
-}
-
 .tree-outline ol {
     padding-left: 12px;
 }
diff --git a/third_party/blink/renderer/devtools/front_end/ui/viewContainers.css b/third_party/blink/renderer/devtools/front_end/ui/viewContainers.css
index 5b720a7..3a73ed0 100644
--- a/third_party/blink/renderer/devtools/front_end/ui/viewContainers.css
+++ b/third_party/blink/renderer/devtools/front_end/ui/viewContainers.css
@@ -27,10 +27,6 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-.sidebar-hidden-override {
-    display: none !important;
-}
-
 .expandable-view-title {
     display: flex;
     align-items: center;
@@ -72,10 +68,3 @@
     top: 0;
 }
 
-.sidebar-pane-container .toolbar {
-    border-bottom: 1px solid #eee;
-}
-
-.sidebar-pane-container .toolbar > * {
-    pointer-events: auto;
-}
diff --git a/third_party/blink/renderer/devtools/scripts/unused_css/index.js b/third_party/blink/renderer/devtools/scripts/unused_css/index.js
new file mode 100644
index 0000000..98f2fdf1
--- /dev/null
+++ b/third_party/blink/renderer/devtools/scripts/unused_css/index.js
@@ -0,0 +1,149 @@
+const fs = require('fs');
+const path = require('path');
+const css = require('css');
+const cssWhat = require('css-what');
+const acorn = require('acorn');
+
+const utils = require('../utils');
+const promisify = require('util').promisify;
+const readFile = promisify(fs.readFile);
+const FRONTEND_PATH = path.join(__dirname, '..', '..', 'front_end');
+
+const classes = new Set();
+const strings = new Set();
+const trickyStrings = new Set([
+  'crc-node__tree-hostname',
+  'tooltip-boundary',
+  'terminal',
+  'terminal-cursor',
+  'composition-view'
+]);
+(async function() {
+  await Promise.all(fs.readdirSync(FRONTEND_PATH).map(dir => processFolder(dir)));
+  const unused = [];
+  for (const className of classes) {
+    if (strings.has(className) || trickyStrings.has(className))
+      continue;
+    if (className.startsWith('CodeMirror'))
+      continue;
+    if (className.startsWith('xterm-'))
+      continue;
+    if (className.startsWith('lh-'))
+      continue;
+    if (className.startsWith('cm-'))
+      continue;
+    if (className.startsWith('navigator-'))
+      continue;
+    if (className.startsWith('object-value-'))
+      continue;
+    if (className.startsWith('security-summary-'))
+      continue;
+    if (className.startsWith('security-explanation-title-'))
+      continue;
+    if (className.startsWith('security-explanation-'))
+      continue;
+    if (className.startsWith('lock-icon-'))
+      continue;
+    if (className.startsWith('security-property-'))
+      continue;
+    if (className.startsWith('url-scheme-'))
+      continue;
+    if (className.startsWith('infobar-'))
+      continue;
+    if (className.startsWith('shadow-root-depth-'))
+      continue;
+    if (className.startsWith('timeline-overview-'))
+      continue;
+    if (className.startsWith('spritesheet-'))
+      continue;
+    if (className.startsWith('report-icon--'))
+      continue;
+
+    if (checkSuffix('-start'))
+      continue;
+    if (checkSuffix('-end'))
+      continue;
+    if (checkSuffix('-column'))
+      continue;
+    if (checkSuffix('-overview-grid'))
+      continue;
+    if (checkSuffix('-overview-container'))
+      continue;
+    if (checkSuffix('-icon'))
+      continue;
+    unused.push(className);
+
+    function checkSuffix(suffix) {
+      return className.endsWith(suffix) && strings.has(className.substring(0, className.length - suffix.length));
+    }
+  }
+  console.log(unused);
+  console.log(unused.length);
+})();
+
+
+async function processFolder(dir) {
+  if (!utils.isDir(path.join(FRONTEND_PATH, dir)))
+    return;
+  const modulePath = path.join(FRONTEND_PATH, dir, 'module.json');
+  if (!utils.isFile(modulePath))
+    return;
+  const content = JSON.parse(await readFile(modulePath, 'utf8'));
+  const promises = [];
+  for (const resource of content.resources || []) {
+    if (!resource.endsWith('.css'))
+      continue;
+    promises.push(processCSSFile(path.join(FRONTEND_PATH, dir, resource)));
+  }
+  const skips = new Set(content.skip_compilation || []);
+  for (const script of content.scripts || []) {
+    if (skips.has(script))
+      continue;
+    promises.push(processScriptFile(path.join(FRONTEND_PATH, dir, script)));
+  }
+  await Promise.all(promises);
+}
+
+async function processCSSFile(cssFile) {
+  const content = await readFile(cssFile, 'utf8');
+  try {
+    const ast = css.parse(content);
+    for (const rule of ast.stylesheet.rules) {
+      for (const selector of rule.selectors || []) {
+        for (const token of parseSimpleSelector(selector)) {
+          if (token.name === 'class' || token.name === 'id')
+            classes.add(token.value);
+        }
+      }
+    }
+  } catch(e) {
+    console.log(cssFile, e)
+  }
+}
+
+function parseSimpleSelector(selector) {
+  // css-what isn't the best. Try catch.
+  try {
+    const parsed = cssWhat(selector)
+    return parsed[0] || [];
+  } catch(e) {
+    return [];
+  }
+}
+
+async function processScriptFile(scriptFile) {
+  const content = await readFile(scriptFile, 'utf8');
+  const tokens = acorn.tokenizer(content);
+  for (const token of tokens) {
+    if(token.type.label === 'string' || token.type.label === 'template') {
+      for (const word of token.value.split(' '))
+        strings.add(word);
+      const regex = /class\s*=\s*['"]?([\w\-_ ]*)/ig;
+      let result;
+      while ((result = regex.exec(token.value))) {
+        for (const word of result[1].split(' '))
+          strings.add(word);
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/third_party/blink/renderer/devtools/scripts/unused_css/package.json b/third_party/blink/renderer/devtools/scripts/unused_css/package.json
new file mode 100644
index 0000000..108e0bb
--- /dev/null
+++ b/third_party/blink/renderer/devtools/scripts/unused_css/package.json
@@ -0,0 +1,11 @@
+{
+  "name": "unused_css",
+  "scripts": {
+    "start": "node index.js"
+  },
+  "dependencies": {
+    "acorn": "^6.1.1",
+    "css": "^2.2.4",
+    "css-what": "^2.1.3"
+  }
+}
diff --git a/third_party/blink/renderer/modules/animationworklet/worklet_animation_test.cc b/third_party/blink/renderer/modules/animationworklet/worklet_animation_test.cc
index d0a6432..ee33416 100644
--- a/third_party/blink/renderer/modules/animationworklet/worklet_animation_test.cc
+++ b/third_party/blink/renderer/modules/animationworklet/worklet_animation_test.cc
@@ -5,6 +5,8 @@
 #include "third_party/blink/renderer/modules/animationworklet/worklet_animation.h"
 
 #include <memory>
+#include <utility>
+
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/renderer/bindings/core/v8/serialization/serialized_script_value.h"
 #include "third_party/blink/renderer/bindings/modules/v8/animation_effect_or_animation_effect_sequence.h"
@@ -17,6 +19,7 @@
 #include "third_party/blink/renderer/core/paint/paint_layer_scrollable_area.h"
 #include "third_party/blink/renderer/core/testing/core_unit_test_helper.h"
 #include "third_party/blink/renderer/core/testing/dummy_page_holder.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -32,23 +35,25 @@
 
 KeyframeEffectModelBase* CreateEffectModel() {
   StringKeyframeVector frames_mixed_properties;
-  Persistent<StringKeyframe> keyframe = StringKeyframe::Create();
+  Persistent<StringKeyframe> keyframe = MakeGarbageCollected<StringKeyframe>();
   keyframe->SetOffset(0);
   keyframe->SetCSSPropertyValue(CSSPropertyID::kOpacity, "0",
                                 SecureContextMode::kInsecureContext, nullptr);
   frames_mixed_properties.push_back(keyframe);
-  keyframe = StringKeyframe::Create();
+  keyframe = MakeGarbageCollected<StringKeyframe>();
   keyframe->SetOffset(1);
   keyframe->SetCSSPropertyValue(CSSPropertyID::kOpacity, "1",
                                 SecureContextMode::kInsecureContext, nullptr);
   frames_mixed_properties.push_back(keyframe);
-  return StringKeyframeEffectModel::Create(frames_mixed_properties);
+  return MakeGarbageCollected<StringKeyframeEffectModel>(
+      frames_mixed_properties);
 }
 
 KeyframeEffect* CreateKeyframeEffect(Element* element) {
   Timing timing;
   timing.iteration_duration = AnimationTimeDelta::FromSecondsD(30);
-  return KeyframeEffect::Create(element, CreateEffectModel(), timing);
+  return MakeGarbageCollected<KeyframeEffect>(element, CreateEffectModel(),
+                                              timing);
 }
 
 WorkletAnimation* CreateWorkletAnimation(
diff --git a/third_party/blink/renderer/modules/canvas/canvas2d/base_rendering_context_2d.cc b/third_party/blink/renderer/modules/canvas/canvas2d/base_rendering_context_2d.cc
index b4576d5f..e4eddf3 100644
--- a/third_party/blink/renderer/modules/canvas/canvas2d/base_rendering_context_2d.cc
+++ b/third_party/blink/renderer/modules/canvas/canvas2d/base_rendering_context_2d.cc
@@ -412,8 +412,8 @@
 
   const CSSValue* filter_value = CSSParser::ParseSingleValue(
       CSSPropertyID::kFilter, filter_string,
-      CSSParserContext::Create(kHTMLStandardMode,
-                               execution_context->GetSecureContextMode()));
+      MakeGarbageCollected<CSSParserContext>(
+          kHTMLStandardMode, execution_context->GetSecureContextMode()));
 
   if (!filter_value || filter_value->IsCSSWideKeyword())
     return;
diff --git a/third_party/blink/renderer/modules/csspaint/paint_worklet_global_scope.cc b/third_party/blink/renderer/modules/csspaint/paint_worklet_global_scope.cc
index 065a744..347872f 100644
--- a/third_party/blink/renderer/modules/csspaint/paint_worklet_global_scope.cc
+++ b/third_party/blink/renderer/modules/csspaint/paint_worklet_global_scope.cc
@@ -103,7 +103,6 @@
   auto* global_scope = MakeGarbageCollected<PaintWorkletGlobalScope>(
       frame, std::move(creation_params), reporting_proxy,
       pending_generator_registry);
-  // TODO(bashi): Handle a case where the script controller fails to initialize.
   global_scope->ScriptController()->Initialize(NullURL());
   MainThreadDebugger::Instance()->ContextCreated(
       global_scope->ScriptController()->GetScriptState(),
diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_display_cutout_fullscreen_button_element_test.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_display_cutout_fullscreen_button_element_test.cc
index fc203ad..b9fed8f 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_display_cutout_fullscreen_button_element_test.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_display_cutout_fullscreen_button_element_test.cc
@@ -13,6 +13,7 @@
 #include "third_party/blink/renderer/core/loader/empty_clients.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
 #include "third_party/blink/renderer/modules/media_controls/media_controls_impl.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 #include "third_party/blink/renderer/platform/testing/unit_test_helpers.h"
 #include "third_party/blink/renderer/platform/text/platform_locale.h"
@@ -52,7 +53,7 @@
 
     RuntimeEnabledFeatures::SetDisplayCutoutAPIEnabled(true);
 
-    video_ = HTMLVideoElement::Create(GetDocument());
+    video_ = MakeGarbageCollected<HTMLVideoElement>(GetDocument());
     GetDocument().body()->AppendChild(video_);
     controls_ = MakeGarbageCollected<MediaControlsImpl>(*video_);
     controls_->InitializeControls();
diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_input_element_test.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_input_element_test.cc
index ed3ae84..20ae4a423 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_input_element_test.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_input_element_test.cc
@@ -12,6 +12,7 @@
 #include "third_party/blink/renderer/core/input_type_names.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
 #include "third_party/blink/renderer/modules/media_controls/media_controls_impl.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/testing/histogram_tester.h"
 
 namespace blink {
@@ -55,7 +56,7 @@
   void SetUp() final {
     // Create page and add a video element with controls.
     PageTestBase::SetUp();
-    media_element_ = HTMLVideoElement::Create(GetDocument());
+    media_element_ = MakeGarbageCollected<HTMLVideoElement>(GetDocument());
     media_element_->SetBooleanAttribute(html_names::kControlsAttr, true);
     GetDocument().body()->AppendChild(media_element_);
 
diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_loading_panel_element_test.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_loading_panel_element_test.cc
index 36dc379..c9d21b5 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_loading_panel_element_test.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_loading_panel_element_test.cc
@@ -15,6 +15,7 @@
 #include "third_party/blink/renderer/core/input_type_names.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
 #include "third_party/blink/renderer/modules/media_controls/media_controls_impl.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -23,7 +24,7 @@
   void SetUp() final {
     // Create page and add a video element with controls.
     PageTestBase::SetUp();
-    media_element_ = HTMLVideoElement::Create(GetDocument());
+    media_element_ = MakeGarbageCollected<HTMLVideoElement>(GetDocument());
     media_element_->SetBooleanAttribute(html_names::kControlsAttr, true);
     GetDocument().body()->AppendChild(media_element_);
 
diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_panel_element_test.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_panel_element_test.cc
index 526b7ec..97f5c5c 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_panel_element_test.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_panel_element_test.cc
@@ -21,7 +21,7 @@
   void SetUp() final {
     // Create page and add a video element with controls.
     PageTestBase::SetUp();
-    media_element_ = HTMLVideoElement::Create(GetDocument());
+    media_element_ = MakeGarbageCollected<HTMLVideoElement>(GetDocument());
     media_element_->SetBooleanAttribute(html_names::kControlsAttr, true);
     GetDocument().body()->AppendChild(media_element_);
 
diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_scrubbing_message_element_test.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_scrubbing_message_element_test.cc
index b2a1718..448180c 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_scrubbing_message_element_test.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_scrubbing_message_element_test.cc
@@ -10,6 +10,7 @@
 #include "third_party/blink/renderer/core/html/media/html_video_element.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
 #include "third_party/blink/renderer/modules/media_controls/media_controls_impl.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -25,7 +26,7 @@
   void SetUp() final {
     // Create page and add a video element with controls.
     PageTestBase::SetUp();
-    media_element_ = HTMLVideoElement::Create(GetDocument());
+    media_element_ = MakeGarbageCollected<HTMLVideoElement>(GetDocument());
     media_element_->SetBooleanAttribute(html_names::kControlsAttr, true);
     GetDocument().body()->AppendChild(media_element_);
 
diff --git a/third_party/blink/renderer/modules/media_controls/elements/media_control_timeline_element_test.cc b/third_party/blink/renderer/modules/media_controls/elements/media_control_timeline_element_test.cc
index 9e1eb2d..5b3122d 100644
--- a/third_party/blink/renderer/modules/media_controls/elements/media_control_timeline_element_test.cc
+++ b/third_party/blink/renderer/modules/media_controls/elements/media_control_timeline_element_test.cc
@@ -12,6 +12,7 @@
 #include "third_party/blink/renderer/core/html/media/html_video_element.h"
 #include "third_party/blink/renderer/core/testing/page_test_base.h"
 #include "third_party/blink/renderer/modules/media_controls/media_controls_impl.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 
 namespace blink {
 
@@ -31,7 +32,7 @@
   void SetUp() override {
     PageTestBase::SetUp(IntSize(100, 100));
 
-    video_ = HTMLVideoElement::Create(GetDocument());
+    video_ = MakeGarbageCollected<HTMLVideoElement>(GetDocument());
     controls_ = MakeGarbageCollected<MediaControlsImpl>(*video_);
     timeline_ = MakeGarbageCollected<MediaControlTimelineElement>(*controls_);
 
diff --git a/third_party/blink/renderer/modules/media_controls/media_controls_impl_test.cc b/third_party/blink/renderer/modules/media_controls/media_controls_impl_test.cc
index c1290fc..30ba888 100644
--- a/third_party/blink/renderer/modules/media_controls/media_controls_impl_test.cc
+++ b/third_party/blink/renderer/modules/media_controls/media_controls_impl_test.cc
@@ -42,6 +42,7 @@
 #include "third_party/blink/renderer/modules/media_controls/elements/media_control_volume_slider_element.h"
 #include "third_party/blink/renderer/modules/remoteplayback/remote_playback.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/testing/empty_web_media_player.h"
 #include "third_party/blink/renderer/platform/testing/histogram_tester.h"
 #include "third_party/blink/renderer/platform/testing/runtime_enabled_features_test_helpers.h"
@@ -1083,8 +1084,8 @@
        RemovingFromDocumentRemovesListenersAndCallbacks) {
   auto page_holder = std::make_unique<DummyPageHolder>();
 
-  HTMLMediaElement* element =
-      HTMLVideoElement::Create(page_holder->GetDocument());
+  auto* element =
+      MakeGarbageCollected<HTMLVideoElement>(page_holder->GetDocument());
   page_holder->GetDocument().body()->AppendChild(element);
 
   RemotePlayback& remote_playback = RemotePlayback::From(*element);
@@ -1115,8 +1116,8 @@
        ReInsertingInDocumentRestoresListenersAndCallbacks) {
   auto page_holder = std::make_unique<DummyPageHolder>();
 
-  HTMLMediaElement* element =
-      HTMLVideoElement::Create(page_holder->GetDocument());
+  auto* element =
+      MakeGarbageCollected<HTMLVideoElement>(page_holder->GetDocument());
   page_holder->GetDocument().body()->AppendChild(element);
 
   RemotePlayback& remote_playback = RemotePlayback::From(*element);
diff --git a/third_party/blink/renderer/modules/media_controls/media_controls_orientation_lock_delegate_test.cc b/third_party/blink/renderer/modules/media_controls/media_controls_orientation_lock_delegate_test.cc
index af928e1..bd5534ad 100644
--- a/third_party/blink/renderer/modules/media_controls/media_controls_orientation_lock_delegate_test.cc
+++ b/third_party/blink/renderer/modules/media_controls/media_controls_orientation_lock_delegate_test.cc
@@ -304,7 +304,7 @@
 
     // Reset the <video> element now we've enabled the runtime feature.
     video_->parentElement()->RemoveChild(video_);
-    video_ = HTMLVideoElement::Create(GetDocument());
+    video_ = MakeGarbageCollected<HTMLVideoElement>(GetDocument());
     video_->setAttribute(html_names::kControlsAttr, g_empty_atom);
     // Most tests should call GetDocument().body()->AppendChild(&Video());
     // This is not done automatically, so that tests control timing of `Attach`,
@@ -434,7 +434,7 @@
   // Same with flag off.
   ScopedVideoFullscreenOrientationLockForTest video_fullscreen_orientation_lock(
       false);
-  HTMLVideoElement* video = HTMLVideoElement::Create(GetDocument());
+  auto* video = MakeGarbageCollected<HTMLVideoElement>(GetDocument());
   GetDocument().body()->AppendChild(video);
   EXPECT_FALSE(HasDelegate(*video->GetMediaControls()));
 }
diff --git a/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate_test.cc b/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate_test.cc
index 677d266..0b438f9 100644
--- a/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate_test.cc
+++ b/third_party/blink/renderer/modules/media_controls/media_controls_rotate_to_fullscreen_delegate_test.cc
@@ -108,7 +108,7 @@
 
     SetupPageWithClients(&clients,
                          MakeGarbageCollected<StubLocalFrameClient>());
-    video_ = HTMLVideoElement::Create(GetDocument());
+    video_ = MakeGarbageCollected<HTMLVideoElement>(GetDocument());
     GetVideo().setAttribute(kControlsAttr, g_empty_atom);
     // Most tests should call GetDocument().body()->AppendChild(&GetVideo());
     // This is not done automatically, so that tests control timing of `Attach`.
@@ -245,7 +245,7 @@
 
   // No delegate when flag is off.
   ScopedVideoRotateToFullscreenForTest video_rotate_to_fullscreen(false);
-  HTMLVideoElement* video = HTMLVideoElement::Create(GetDocument());
+  auto* video = MakeGarbageCollected<HTMLVideoElement>(GetDocument());
   GetDocument().body()->AppendChild(video);
   EXPECT_FALSE(HasDelegate(*video->GetMediaControls()));
 }
diff --git a/third_party/blink/renderer/modules/mediasource/source_buffer.cc b/third_party/blink/renderer/modules/mediasource/source_buffer.cc
index 4d0e011..757e3fd 100644
--- a/third_party/blink/renderer/modules/mediasource/source_buffer.cc
+++ b/third_party/blink/renderer/modules/mediasource/source_buffer.cc
@@ -1014,8 +1014,8 @@
       const auto& kind = track_info.kind;
       // 5.2.7 TODO(servolk): Implement track kind processing.
       // 5.2.8.2 Let new audio track be a new AudioTrack object.
-      AudioTrack* audio_track =
-          AudioTrack::Create(track_info.id, kind, label, language, false);
+      auto* audio_track = MakeGarbageCollected<AudioTrack>(
+          track_info.id, kind, label, language, false);
       SourceBufferTrackBaseSupplement::SetSourceBuffer(*audio_track, this);
       // 5.2.8.7 If audioTracks.length equals 0, then run the following steps:
       if (audioTracks().length() == 0) {
diff --git a/third_party/blink/renderer/modules/remoteplayback/remote_playback_test.cc b/third_party/blink/renderer/modules/remoteplayback/remote_playback_test.cc
index 671b1f0..262bc11e 100644
--- a/third_party/blink/renderer/modules/remoteplayback/remote_playback_test.cc
+++ b/third_party/blink/renderer/modules/remoteplayback/remote_playback_test.cc
@@ -18,6 +18,7 @@
 #include "third_party/blink/renderer/modules/presentation/presentation_controller.h"
 #include "third_party/blink/renderer/modules/remoteplayback/html_media_element_remote_playback.h"
 #include "third_party/blink/renderer/platform/bindings/exception_state.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
 #include "third_party/blink/renderer/platform/testing/runtime_enabled_features_test_helpers.h"
 #include "third_party/blink/renderer/platform/testing/unit_test_helpers.h"
 
@@ -81,8 +82,8 @@
 
   auto page_holder = std::make_unique<DummyPageHolder>();
 
-  HTMLMediaElement* element =
-      HTMLVideoElement::Create(page_holder->GetDocument());
+  auto* element =
+      MakeGarbageCollected<HTMLVideoElement>(page_holder->GetDocument());
   RemotePlayback& remote_playback = RemotePlayback::From(*element);
 
   auto* resolve = MockFunction::Create(scope.GetScriptState());
@@ -112,8 +113,8 @@
 
   auto page_holder = std::make_unique<DummyPageHolder>();
 
-  HTMLMediaElement* element =
-      HTMLVideoElement::Create(page_holder->GetDocument());
+  auto* element =
+      MakeGarbageCollected<HTMLVideoElement>(page_holder->GetDocument());
   RemotePlayback& remote_playback = RemotePlayback::From(*element);
 
   auto* resolve = MockFunction::Create(scope.GetScriptState());
@@ -146,8 +147,8 @@
 
   auto page_holder = std::make_unique<DummyPageHolder>();
 
-  HTMLMediaElement* element =
-      HTMLVideoElement::Create(page_holder->GetDocument());
+  auto* element =
+      MakeGarbageCollected<HTMLVideoElement>(page_holder->GetDocument());
   RemotePlayback& remote_playback = RemotePlayback::From(*element);
 
   auto* resolve = MockFunction::Create(scope.GetScriptState());
@@ -181,8 +182,8 @@
 
   auto page_holder = std::make_unique<DummyPageHolder>();
 
-  HTMLMediaElement* element =
-      HTMLVideoElement::Create(page_holder->GetDocument());
+  auto* element =
+      MakeGarbageCollected<HTMLVideoElement>(page_holder->GetDocument());
   RemotePlayback& remote_playback = RemotePlayback::From(*element);
 
   auto* connecting_handler = MakeGarbageCollected<
@@ -226,8 +227,8 @@
 
   auto page_holder = std::make_unique<DummyPageHolder>();
 
-  HTMLMediaElement* element =
-      HTMLVideoElement::Create(page_holder->GetDocument());
+  auto* element =
+      MakeGarbageCollected<HTMLVideoElement>(page_holder->GetDocument());
   RemotePlayback& remote_playback = RemotePlayback::From(*element);
 
   MockFunction* resolve = MockFunction::Create(scope.GetScriptState());
@@ -258,8 +259,8 @@
 
   auto page_holder = std::make_unique<DummyPageHolder>();
 
-  HTMLMediaElement* element =
-      HTMLVideoElement::Create(page_holder->GetDocument());
+  auto* element =
+      MakeGarbageCollected<HTMLVideoElement>(page_holder->GetDocument());
   RemotePlayback& remote_playback = RemotePlayback::From(*element);
 
   MockFunction* callback_function =
@@ -300,8 +301,8 @@
 
   auto page_holder = std::make_unique<DummyPageHolder>();
 
-  HTMLMediaElement* element =
-      HTMLVideoElement::Create(page_holder->GetDocument());
+  auto* element =
+      MakeGarbageCollected<HTMLVideoElement>(page_holder->GetDocument());
   RemotePlayback& remote_playback = RemotePlayback::From(*element);
 
   auto* resolve = MockFunction::Create(scope.GetScriptState());
@@ -331,8 +332,8 @@
 
   auto page_holder = std::make_unique<DummyPageHolder>();
 
-  HTMLMediaElement* element =
-      HTMLVideoElement::Create(page_holder->GetDocument());
+  auto* element =
+      MakeGarbageCollected<HTMLVideoElement>(page_holder->GetDocument());
   RemotePlayback& remote_playback = RemotePlayback::From(*element);
 
   MockFunction* callback_function =
@@ -369,8 +370,8 @@
 
   auto page_holder = std::make_unique<DummyPageHolder>();
 
-  HTMLMediaElement* element =
-      HTMLVideoElement::Create(page_holder->GetDocument());
+  auto* element =
+      MakeGarbageCollected<HTMLVideoElement>(page_holder->GetDocument());
   RemotePlayback& remote_playback = RemotePlayback::From(*element);
 
   LocalFrame& frame = page_holder->GetFrame();
diff --git a/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.cc b/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.cc
index c71a6691..384323d 100644
--- a/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.cc
+++ b/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.cc
@@ -647,9 +647,8 @@
 
 void ServiceWorkerGlobalScopeProxy::WillInitializeWorkerContext() {
   DCHECK_CALLED_ON_VALID_THREAD(worker_thread_checker_);
-  TRACE_EVENT_ASYNC_BEGIN0(
-      "ServiceWorker", "ServiceWorkerGlobalScopeProxy::InitializeWorkerContext",
-      this);
+  TRACE_EVENT_BEGIN0("ServiceWorker",
+                     "ServiceWorkerGlobalScopeProxy::InitializeWorkerContext");
 }
 
 void ServiceWorkerGlobalScopeProxy::DidCreateWorkerGlobalScope(
@@ -674,16 +673,8 @@
       WorkerGlobalScope()->ScriptController()->GetScriptState());
   Client().DidInitializeWorkerContext(
       WorkerGlobalScope()->ScriptController()->GetContext());
-  TRACE_EVENT_ASYNC_END1(
-      "ServiceWorker", "ServiceWorkerGlobalScopeProxy::InitializeWorkerContext",
-      this, "success", true);
-}
-
-void ServiceWorkerGlobalScopeProxy::DidFailToInitializeWorkerContext() {
-  DCHECK_CALLED_ON_VALID_THREAD(worker_thread_checker_);
-  TRACE_EVENT_ASYNC_END1(
-      "ServiceWorker", "ServiceWorkerGlobalScopeProxy::InitializeWorkerContext",
-      this, "success", false);
+  TRACE_EVENT_END0("ServiceWorker",
+                   "ServiceWorkerGlobalScopeProxy::InitializeWorkerContext");
 }
 
 void ServiceWorkerGlobalScopeProxy::DidLoadClassicScript() {
diff --git a/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.h b/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.h
index fa37add7..8079939 100644
--- a/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.h
+++ b/third_party/blink/renderer/modules/service_worker/service_worker_global_scope_proxy.h
@@ -165,7 +165,6 @@
   void WillInitializeWorkerContext() override;
   void DidCreateWorkerGlobalScope(WorkerOrWorkletGlobalScope*) override;
   void DidInitializeWorkerContext() override;
-  void DidFailToInitializeWorkerContext() override;
   void DidLoadClassicScript() override;
   void DidFailToLoadClassicScript() override;
   void DidFetchScript() override;
diff --git a/third_party/blink/renderer/platform/BUILD.gn b/third_party/blink/renderer/platform/BUILD.gn
index aa6110b..5a0c974 100644
--- a/third_party/blink/renderer/platform/BUILD.gn
+++ b/third_party/blink/renderer/platform/BUILD.gn
@@ -1407,8 +1407,10 @@
   sources += get_target_outputs(":character_data") +
              get_target_outputs(":color_data") +
              get_target_outputs(":font_family_names") +
-             get_target_outputs(":instrumentation_probes") +
-             get_target_outputs(":runtime_enabled_features")
+             get_target_outputs(":instrumentation_probes")
+  set_sources_assignment_filter([ "*.pickle" ])
+  sources += get_target_outputs(":runtime_enabled_features")
+  set_sources_assignment_filter(sources_assignment_filter)
 
   if (is_win) {
     jumbo_excluded_sources = [
diff --git a/third_party/blink/renderer/platform/exported/web_runtime_features.cc b/third_party/blink/renderer/platform/exported/web_runtime_features.cc
index 44ace22..7710e99 100644
--- a/third_party/blink/renderer/platform/exported/web_runtime_features.cc
+++ b/third_party/blink/renderer/platform/exported/web_runtime_features.cc
@@ -39,6 +39,10 @@
   RuntimeEnabledFeatures::SetHeapIncrementalMarkingEnabled(enable);
 }
 
+void WebRuntimeFeatures::EnableBlinkHeapUnifiedGCScheduling(bool enable) {
+  RuntimeEnabledFeatures::SetHeapUnifiedGCSchedulingEnabled(enable);
+}
+
 void WebRuntimeFeatures::EnableBloatedRendererDetection(bool enable) {
   RuntimeEnabledFeatures::SetBloatedRendererDetectionEnabled(enable);
 }
diff --git a/third_party/blink/renderer/platform/fonts/shaping/shaping_line_breaker.cc b/third_party/blink/renderer/platform/fonts/shaping/shaping_line_breaker.cc
index ce9f48ae..8ce59ef 100644
--- a/third_party/blink/renderer/platform/fonts/shaping/shaping_line_breaker.cc
+++ b/third_party/blink/renderer/platform/fonts/shaping/shaping_line_breaker.cc
@@ -65,6 +65,15 @@
   return true;
 }
 
+inline void CheckBreakOffset(unsigned offset, unsigned start, unsigned end) {
+  // It is critical to move the offset forward, or NGLineBreaker may keep adding
+  // NGInlineItemResult until all the memory is consumed.
+  CHECK_GT(offset, start);
+  // The offset must be within the given range, or NGLineBreaker will fail to
+  // sync item with offset.
+  CHECK_LE(offset, end);
+}
+
 }  // namespace
 
 inline const String& ShapingLineBreaker::GetText() const {
@@ -259,9 +268,7 @@
       return ShapeToEnd(start, first_safe, range_start, range_end);
     }
   }
-  // It is critical to move forward, or callers may end up in an infinite loop.
-  CHECK_GT(break_opportunity.offset, start);
-  DCHECK_LE(break_opportunity.offset, range_end);
+  CheckBreakOffset(break_opportunity.offset, start, range_end);
 
   // If the start offset is not at a safe-to-break boundary the content between
   // the start and the next safe-to-break boundary needs to be reshaped and the
@@ -271,6 +278,7 @@
     if (first_safe >= break_opportunity.offset) {
       // There is no safe-to-break, reshape the whole range.
       result_out->break_offset = break_opportunity.offset;
+      CheckBreakOffset(result_out->break_offset, start, range_end);
       return ShapeResultView::Create(
           Shape(start, break_opportunity.offset).get());
     }
@@ -345,7 +353,7 @@
     }
   }
   // It is critical to move forward, or callers may end up in an infinite loop.
-  CHECK_GT(break_opportunity.offset, start);
+  CheckBreakOffset(break_opportunity.offset, start, range_end);
   DCHECK_GE(break_opportunity.offset, last_safe);
   DCHECK_EQ(break_opportunity.offset - start,
             (line_start_result ? line_start_result->NumCharacters() : 0) +
@@ -364,8 +372,6 @@
   if (line_end_result)
     segments[count++] = {line_end_result.get(), last_safe, max_length};
   auto line_result = ShapeResultView::Create(&segments[0], count);
-
-  DCHECK_LE(break_opportunity.offset, range_end);
   DCHECK_EQ(break_opportunity.offset - start, line_result->NumCharacters());
 
   result_out->break_offset = break_opportunity.offset;
diff --git a/third_party/blink/renderer/platform/loader/fetch/resource_fetcher.cc b/third_party/blink/renderer/platform/loader/fetch/resource_fetcher.cc
index 9066957..ff806ab0 100644
--- a/third_party/blink/renderer/platform/loader/fetch/resource_fetcher.cc
+++ b/third_party/blink/renderer/platform/loader/fetch/resource_fetcher.cc
@@ -248,11 +248,11 @@
   return value;
 }
 
+// This function corresponds with step 2 substep 7 of
+// https://fetch.spec.whatwg.org/#main-fetch.
 void SetReferrer(
     ResourceRequest& request,
     const FetchClientSettingsObject& fetch_client_settings_object) {
-  // TODO(domfarolino): we can probably *just set* the HTTP `Referer` here
-  // no matter what now.
   if (!request.DidSetHttpReferrer()) {
     String referrer_to_use = request.ReferrerString();
     network::mojom::ReferrerPolicy referrer_policy_to_use =
@@ -261,20 +261,24 @@
     if (referrer_to_use == Referrer::ClientReferrerString())
       referrer_to_use = fetch_client_settings_object.GetOutgoingReferrer();
 
-    if (referrer_policy_to_use == network::mojom::ReferrerPolicy::kDefault) {
+    if (referrer_policy_to_use == network::mojom::ReferrerPolicy::kDefault)
       referrer_policy_to_use = fetch_client_settings_object.GetReferrerPolicy();
-    }
 
+    request.SetReferrerString(referrer_to_use);
+    request.SetReferrerPolicy(referrer_policy_to_use);
     // TODO(domfarolino): Stop storing ResourceRequest's referrer as a header
     // and store it elsewhere. See https://crbug.com/850813.
     request.SetHttpReferrer(SecurityPolicy::GenerateReferrer(
         referrer_policy_to_use, request.Url(), referrer_to_use));
   } else {
-    CHECK_EQ(
-        SecurityPolicy::GenerateReferrer(request.GetReferrerPolicy(),
-                                         request.Url(), request.HttpReferrer())
-            .referrer,
-        request.HttpReferrer());
+    // In the case of stale requests that are being revalidated, these requests
+    // will already have their HttpReferrer set, and we will end up here. We
+    // won't regenerate the referrer, but instead check that it's still correct.
+    CHECK_EQ(SecurityPolicy::GenerateReferrer(request.GetReferrerPolicy(),
+                                              request.Url(),
+                                              request.ReferrerString())
+                 .referrer,
+             request.HttpReferrer());
   }
 }
 
diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
index 336e10bf..af6f1e6 100644
--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
@@ -199,10 +199,6 @@
       status: "experimental",
     },
     {
-      name: "BlockMetaSetCookie",
-      status: "stable"
-    },
-    {
       name: "BuiltInModuleAll",
       implied_by: ["ExperimentalProductivityFeatures"],
     },
@@ -226,10 +222,6 @@
       status: "stable",
     },
     {
-      name: "CallCaptureListenersAtCapturePhaseAtShadowHosts",
-      status: "stable",
-    },
-    {
       name: "Canvas2dContextLostRestored",
       status: "experimental",
     },
@@ -647,6 +639,9 @@
       name: "HeapIncrementalMarkingStress"
     },
     {
+      name: "HeapUnifiedGCScheduling"
+    },
+    {
       name: "HrefTranslate",
       depends_on: ["TranslateService"],
       origin_trial_feature_name: "HrefTranslate",
@@ -1267,7 +1262,7 @@
     // Enables the use of the RTCSctpTransport object.
     {
       name: "RTCSctpTransport",
-      status: "experimental",
+      status: "stable",
     },
     {
       name: "RTCStatsRelativePacketArrivalDelay",
diff --git a/third_party/blink/renderer/platform/scheduler/common/metrics_helper.cc b/third_party/blink/renderer/platform/scheduler/common/metrics_helper.cc
index 5803d07..41925e2 100644
--- a/third_party/blink/renderer/platform/scheduler/common/metrics_helper.cc
+++ b/third_party/blink/renderer/platform/scheduler/common/metrics_helper.cc
@@ -37,7 +37,6 @@
     case WebThreadType::kReverbConvolutionBackgroundThread:
     case WebThreadType::kSharedWorkerThread:
     case WebThreadType::kUnspecifiedWorkerThread:
-    case WebThreadType::kWebAudioThread:
     case WebThreadType::kTestThread:
       return scheduling_metrics::ThreadType::kRendererOtherBlinkThread;
     case WebThreadType::kCount:
diff --git a/third_party/blink/renderer/platform/scheduler/common/web_thread_scheduler.cc b/third_party/blink/renderer/platform/scheduler/common/web_thread_scheduler.cc
index 62b4182..3b18e49d 100644
--- a/third_party/blink/renderer/platform/scheduler/common/web_thread_scheduler.cc
+++ b/third_party/blink/renderer/platform/scheduler/common/web_thread_scheduler.cc
@@ -23,6 +23,7 @@
   auto settings = base::sequence_manager::SequenceManager::Settings::Builder()
                       .SetMessageLoopType(base::MessageLoop::TYPE_DEFAULT)
                       .SetRandomisedSamplingEnabled(true)
+                      .SetAddQueueTimeToTasks(true)
                       .Build();
   auto sequence_manager =
       message_pump
diff --git a/third_party/blink/renderer/platform/scheduler/main_thread/main_thread_metrics_helper.cc b/third_party/blink/renderer/platform/scheduler/main_thread/main_thread_metrics_helper.cc
index d604573..5568d16 100644
--- a/third_party/blink/renderer/platform/scheduler/main_thread/main_thread_metrics_helper.cc
+++ b/third_party/blink/renderer/platform/scheduler/main_thread/main_thread_metrics_helper.cc
@@ -32,6 +32,15 @@
   "RendererScheduler.TaskCountPerFrameType.HasSafePoint"
 #define DURATION_PER_TASK_USE_CASE_NAME \
   "RendererScheduler.TaskDurationPerUseCase2"
+#define QUEUEING_TIME_PER_QUEUE_TYPE_METRIC_NAME \
+  "RendererScheduler.QueueingDurationPerQueueType"
+
+// Same as UMA_HISTOGRAM_TIMES but for a broader view of this metric we end
+// at 1 minute instead of 10 seconds.
+#define QUEUEING_TIME_HISTOGRAM(name, sample)                               \
+  UMA_HISTOGRAM_CUSTOM_TIMES(QUEUEING_TIME_PER_QUEUE_TYPE_METRIC_NAME name, \
+                             sample, base::TimeDelta::FromMilliseconds(1),  \
+                             base::TimeDelta::FromMinutes(1), 50)
 
 enum class MainThreadTaskLoadState { kLow, kHigh, kUnknown };
 
@@ -400,6 +409,31 @@
                      task_timing.end_time())));
 
     foreground_per_task_type_duration_reporter_.RecordTask(task_type, duration);
+
+    if (!task.queue_time.is_null()) {
+      switch (queue_type) {
+        case MainThreadTaskQueue::QueueType::kCompositor: {
+          QUEUEING_TIME_HISTOGRAM(".Compositor",
+                                  task_timing.start_time() - task.queue_time);
+          break;
+        }
+        case MainThreadTaskQueue::QueueType::kInput: {
+          QUEUEING_TIME_HISTOGRAM(".Input",
+                                  task_timing.start_time() - task.queue_time);
+          break;
+        }
+        case MainThreadTaskQueue::QueueType::kFrameLoading:
+        case MainThreadTaskQueue::QueueType::kFrameLoadingControl: {
+          QUEUEING_TIME_HISTOGRAM(".Loading",
+                                  task_timing.start_time() - task.queue_time);
+          break;
+        }
+        default: {
+          QUEUEING_TIME_HISTOGRAM(".Other",
+                                  task_timing.start_time() - task.queue_time);
+        }
+      }
+    }
   }
 
   if (main_thread_scheduler_->main_thread_only().renderer_hidden) {
diff --git a/third_party/blink/renderer/platform/web_thread_type.cc b/third_party/blink/renderer/platform/web_thread_type.cc
index 2c17a78..0d2a7d68 100644
--- a/third_party/blink/renderer/platform/web_thread_type.cc
+++ b/third_party/blink/renderer/platform/web_thread_type.cc
@@ -31,8 +31,6 @@
       return "File thread";
     case WebThreadType::kDatabaseThread:
       return "Database thread";
-    case WebThreadType::kWebAudioThread:
-      return "WebAudio thread";
     case WebThreadType::kOfflineAudioRenderThread:
       return "OfflineAudioRender thread";
     case WebThreadType::kReverbConvolutionBackgroundThread:
diff --git a/third_party/blink/renderer/platform/weborigin/security_policy.cc b/third_party/blink/renderer/platform/weborigin/security_policy.cc
index 21e259d..7032403 100644
--- a/third_party/blink/renderer/platform/weborigin/security_policy.cc
+++ b/third_party/blink/renderer/platform/weborigin/security_policy.cc
@@ -68,6 +68,20 @@
   return safelist;
 }
 
+network::mojom::ReferrerPolicy ReferrerPolicyResolveDefault(
+    network::mojom::ReferrerPolicy referrer_policy) {
+  if (referrer_policy == network::mojom::ReferrerPolicy::kDefault) {
+    if (RuntimeEnabledFeatures::ReducedReferrerGranularityEnabled()) {
+      return network::mojom::ReferrerPolicy::
+          kNoReferrerWhenDowngradeOriginWhenCrossOrigin;
+    } else {
+      return network::mojom::ReferrerPolicy::kNoReferrerWhenDowngrade;
+    }
+  }
+
+  return referrer_policy;
+}
+
 void SecurityPolicy::Init() {
   TrustworthyOriginSafelist();
 }
@@ -93,16 +107,8 @@
     network::mojom::ReferrerPolicy referrer_policy,
     const KURL& url,
     const String& referrer) {
-  network::mojom::ReferrerPolicy referrer_policy_no_default = referrer_policy;
-  if (referrer_policy_no_default == network::mojom::ReferrerPolicy::kDefault) {
-    if (RuntimeEnabledFeatures::ReducedReferrerGranularityEnabled()) {
-      referrer_policy_no_default = network::mojom::ReferrerPolicy::
-          kNoReferrerWhenDowngradeOriginWhenCrossOrigin;
-    } else {
-      referrer_policy_no_default =
-          network::mojom::ReferrerPolicy::kNoReferrerWhenDowngrade;
-    }
-  }
+  network::mojom::ReferrerPolicy referrer_policy_no_default =
+      ReferrerPolicyResolveDefault(referrer_policy);
   if (referrer == Referrer::NoReferrer())
     return Referrer(Referrer::NoReferrer(), referrer_policy_no_default);
   DCHECK(!referrer.IsEmpty());
diff --git a/third_party/blink/renderer/platform/weborigin/security_policy.h b/third_party/blink/renderer/platform/weborigin/security_policy.h
index 4790fef..f06e9f7 100644
--- a/third_party/blink/renderer/platform/weborigin/security_policy.h
+++ b/third_party/blink/renderer/platform/weborigin/security_policy.h
@@ -46,6 +46,14 @@
   kDoNotSupportReferrerPolicyLegacyKeywords,
 };
 
+// The ReferrerPolicy enum contains a member kDefault, which not a real referrer
+// policy, but instead a value Blink uses to fallback to
+// kNoReferrerWhenDowngrade at certain times. The function below is provided so
+// that a referrer policy which may be kDefault can be resolved to a valid
+// value.
+PLATFORM_EXPORT network::mojom::ReferrerPolicy ReferrerPolicyResolveDefault(
+    network::mojom::ReferrerPolicy);
+
 class PLATFORM_EXPORT SecurityPolicy {
   STATIC_ONLY(SecurityPolicy);
 
diff --git a/third_party/blink/renderer/platform/wtf/dynamic_annotations.cc b/third_party/blink/renderer/platform/wtf/dynamic_annotations.cc
index 2571f9c..20f8fbe 100644
--- a/third_party/blink/renderer/platform/wtf/dynamic_annotations.cc
+++ b/third_party/blink/renderer/platform/wtf/dynamic_annotations.cc
@@ -28,8 +28,8 @@
 
 #include "third_party/blink/renderer/platform/wtf/dynamic_annotations.h"
 
-#if defined(WTF_USE_DYNAMIC_ANNOTATIONS) && \
-    !defined(WTF_USE_DYNAMIC_ANNOTATIONS_NOIMPL)
+#if defined(DYNAMIC_ANNOTATIONS_ENABLED) && \
+    !defined(DYNAMIC_ANNOTATIONS_EXTERNAL_IMPL)
 
 // Identical code folding(-Wl,--icf=all) countermeasures.
 // This makes all Annotate* functions different, which prevents the linker from
@@ -49,16 +49,10 @@
                                 const volatile void*,
                                 size_t,
                                 const char*) {
+  // The TSan runtime hardcodes the function namem "WTFAnnotateBenignRaceSized",
+  // that's how it knows this function is magic.
   DYNAMIC_ANNOTATIONS_IMPL
 }
 
-void WTFAnnotateHappensBefore(const char*, int, const volatile void*) {
-  DYNAMIC_ANNOTATIONS_IMPL
-}
-
-void WTFAnnotateHappensAfter(const char*, int, const volatile void*) {
-  DYNAMIC_ANNOTATIONS_IMPL
-}
-
-#endif  // defined(WTF_USE_DYNAMIC_ANNOTATIONS) &&
-        // !defined(WTF_USE_DYNAMIC_ANNOTATIONS_NOIMPL)
+#endif  // defined(DYNAMIC_ANNOTATIONS_ENABLED) &&
+        // !defined(DYNAMIC_ANNOTATIONS_EXTERNAL_IMPL)
diff --git a/third_party/blink/renderer/platform/wtf/dynamic_annotations.h b/third_party/blink/renderer/platform/wtf/dynamic_annotations.h
index fd969e13..d8c89ab 100644
--- a/third_party/blink/renderer/platform/wtf/dynamic_annotations.h
+++ b/third_party/blink/renderer/platform/wtf/dynamic_annotations.h
@@ -52,37 +52,13 @@
 
 #include "third_party/blink/renderer/platform/wtf/wtf_export.h"
 
-#if defined(WTF_USE_DYNAMIC_ANNOTATIONS)
+#if defined(DYNAMIC_ANNOTATIONS_ENABLED)
 /* Tell data race detector that we're not interested in reports on the given
  * address range. */
-#define WTF_ANNOTATE_BENIGN_RACE_SIZED(address, size, description) \
-  WTFAnnotateBenignRaceSized(__FILE__, __LINE__, address, size, description)
 #define WTF_ANNOTATE_BENIGN_RACE(pointer, description)                        \
   WTFAnnotateBenignRaceSized(__FILE__, __LINE__, pointer, sizeof(*(pointer)), \
                              description)
 
-/* Annotations for user-defined synchronization mechanisms.
- * These annotations can be used to define happens-before arcs in user-defined
- * synchronization mechanisms: the race detector will infer an arc from
- * the former to the latter when they share the same argument pointer.
- *
- * The most common case requiring annotations is atomic reference counting:
- * bool deref() {
- *     ANNOTATE_HAPPENS_BEFORE(&ref_count_);
- *     if (!atomicDecrement(&ref_count_)) {
- *         // ref_count_ is now 0
- *         ANNOTATE_HAPPENS_AFTER(&ref_count_);
- *         // "return true; happens-after each atomicDecrement of ref_count_"
- *         return true;
- *     }
- *     return false;
- * }
- */
-#define WTF_ANNOTATE_HAPPENS_BEFORE(address) \
-  WTFAnnotateHappensBefore(__FILE__, __LINE__, address)
-#define WTF_ANNOTATE_HAPPENS_AFTER(address) \
-  WTFAnnotateHappensAfter(__FILE__, __LINE__, address)
-
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -92,23 +68,14 @@
                                            const volatile void* memory,
                                            size_t size,
                                            const char* description);
-WTF_EXPORT void WTFAnnotateHappensBefore(const char* file,
-                                         int line,
-                                         const volatile void* address);
-WTF_EXPORT void WTFAnnotateHappensAfter(const char* file,
-                                        int line,
-                                        const volatile void* address);
 #ifdef __cplusplus
 }  // extern "C"
 #endif
 
-#else  // defined(WTF_USE_DYNAMIC_ANNOTATIONS)
+#else  // defined(DYNAMIC_ANNOTATIONS_ENABLED)
 /* These macros are empty when dynamic annotations are not enabled so you can
  * use them without affecting the performance of release binaries. */
-#define WTF_ANNOTATE_BENIGN_RACE_SIZED(address, size, description)
 #define WTF_ANNOTATE_BENIGN_RACE(pointer, description)
-#define WTF_ANNOTATE_HAPPENS_BEFORE(address)
-#define WTF_ANNOTATE_HAPPENS_AFTER(address)
-#endif  // defined(WTF_USE_DYNAMIC_ANNOTATIONS)
+#endif  // defined(DYNAMIC_ANNOTATIONS_ENABLED)
 
 #endif  // THIRD_PARTY_BLINK_RENDERER_PLATFORM_WTF_DYNAMIC_ANNOTATIONS_H_
diff --git a/third_party/blink/web_tests/FlagExpectations/enable-blink-features=LayoutNG b/third_party/blink/web_tests/FlagExpectations/enable-blink-features=LayoutNG
index f0da84e96..10f8970 100644
--- a/third_party/blink/web_tests/FlagExpectations/enable-blink-features=LayoutNG
+++ b/third_party/blink/web_tests/FlagExpectations/enable-blink-features=LayoutNG
@@ -299,8 +299,6 @@
 crbug.com/591099 fast/block/float/4145535Crash.html [ Pass ]
 crbug.com/591099 fast/borders/inline-mask-overlay-image-outset-vertical-rl.html [ Failure ]
 crbug.com/591099 fast/canvas/OffscreenCanvas-copyImage.html [ Failure Pass ]
-crbug.com/591099 fast/css-intrinsic-dimensions/height-positioned.html [ Pass ]
-crbug.com/591099 fast/css-intrinsic-dimensions/height-tables.html [ Failure Pass ]
 crbug.com/591099 fast/css/absolute-inline-alignment-2.html [ Pass ]
 crbug.com/835484 fast/css/outline-narrowLine.html [ Failure ]
 crbug.com/591099 fast/css/outline-offset-large.html [ Failure ]
diff --git a/third_party/blink/web_tests/MSANExpectations b/third_party/blink/web_tests/MSANExpectations
index 71a86f2..f4fe671 100644
--- a/third_party/blink/web_tests/MSANExpectations
+++ b/third_party/blink/web_tests/MSANExpectations
@@ -240,3 +240,8 @@
 
 # Sheriff 2019-02-22
 crbug.com/929122 [ Linux ] external/wpt/html/dom/interfaces.worker.html [ Timeout ]
+
+# Sheriff 2019-05-21
+crbug.com/856601 [ Linux ] external/wpt/notifications/idlharness.https.window.html [ Pass Timeout ]
+crbug.com/856601 [ Linux ] external/wpt/fetch/cors-rfc1918/idlharness.tentative.any.serviceworker.html [ Pass Timeout ]
+crbug.com/856601 [ Linux ] external/wpt/notifications/idlharness.https.any.sharedworker.html [ Pass Timeout ]
\ No newline at end of file
diff --git a/third_party/blink/web_tests/TestExpectations b/third_party/blink/web_tests/TestExpectations
index 00350ea..57be1d9 100644
--- a/third_party/blink/web_tests/TestExpectations
+++ b/third_party/blink/web_tests/TestExpectations
@@ -562,6 +562,32 @@
 crbug.com/880802 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/contain/contain-paint-ignored-cases-ruby-stacking-and-clipping-001.html [ Failure ]
 crbug.com/881057 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/contain/contain-paint-stacking-context-001b.html [ Failure ]
 
+crbug.com/880802 virtual/layout_ng_experimental/external/wpt/css/css-contain/contain-layout-017.html [ Failure ]
+crbug.com/671132 virtual/layout_ng_experimental/external/wpt/css/css-contain/contain-layout-baseline-005.html [ Failure ]
+crbug.com/626703 virtual/layout_ng_experimental/external/wpt/css/css-contain/contain-layout-breaks-002.html [ Failure ]
+crbug.com/847274 virtual/layout_ng_experimental/external/wpt/css/css-contain/contain-paint-005.html [ Failure ]
+crbug.com/847274 virtual/layout_ng_experimental/external/wpt/css/css-contain/contain-paint-006.html [ Failure ]
+crbug.com/880802 virtual/layout_ng_experimental/external/wpt/css/css-contain/contain-paint-021.html [ Failure ]
+crbug.com/882367 virtual/layout_ng_experimental/external/wpt/css/css-contain/contain-paint-clip-015.html [ Failure ]
+crbug.com/882367 virtual/layout_ng_experimental/external/wpt/css/css-contain/contain-paint-clip-016.html [ Failure ]
+crbug.com/955170 virtual/layout_ng_experimental/external/wpt/css/css-contain/contain-size-replaced-003a.html [ Failure ]
+crbug.com/955163 virtual/layout_ng_experimental/external/wpt/css/css-contain/contain-size-replaced-003b.html [ Failure ]
+crbug.com/955163 virtual/layout_ng_experimental/external/wpt/css/css-contain/contain-size-replaced-003c.html [ Failure ]
+crbug.com/869296 virtual/layout_ng_experimental/external/wpt/css/css-contain/contain-style-counters-004.html [ Failure ]
+crbug.com/882383 virtual/layout_ng_experimental/external/wpt/css/css-contain/counter-scoping-001.html [ Failure ]
+crbug.com/882383 virtual/layout_ng_experimental/external/wpt/css/css-contain/counter-scoping-002.html [ Failure ]
+crbug.com/882383 virtual/layout_ng_experimental/external/wpt/css/css-contain/counter-scoping-003.html [ Failure ]
+crbug.com/882385 virtual/layout_ng_experimental/external/wpt/css/css-contain/quote-scoping-001.html [ Failure ]
+crbug.com/882385 virtual/layout_ng_experimental/external/wpt/css/css-contain/quote-scoping-002.html [ Failure ]
+crbug.com/882385 virtual/layout_ng_experimental/external/wpt/css/css-contain/quote-scoping-003.html [ Failure ]
+crbug.com/882385 virtual/layout_ng_experimental/external/wpt/css/css-contain/quote-scoping-004.html [ Failure ]
+crbug.com/881057 [ Mac ] virtual/layout_ng_experimental/external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/contain/contain-paint-clip-003.html [ Failure ]
+crbug.com/881057 [ Mac ] virtual/layout_ng_experimental/external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/contain/contain-paint-clip-004.html [ Failure ]
+crbug.com/881057 [ Mac ] virtual/layout_ng_experimental/external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/contain/contain-paint-clip-005.html [ Failure ]
+crbug.com/880802 virtual/layout_ng_experimental/external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/contain/contain-paint-ignored-cases-ruby-stacking-and-clipping-001.html [ Failure ]
+crbug.com/881057 virtual/layout_ng_experimental/external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/contain/contain-paint-stacking-context-001b.html [ Failure ]
+crbug.com/965491 virtual/layout_ng_experimental/external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/contain/contain-size-fieldset-002.html [ Failure ]
+
 # [css-align]
 
 crbug.com/599828 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/align3/flex-abspos-staticpos-align-content-001.html [ Failure ]
@@ -636,8 +662,6 @@
 # Layout team disagrees with the spec for this particular test.
 crbug.com/591099 external/wpt/css/css-ui/text-overflow-015.html [ Failure ]
 
-crbug.com/940963 external/wpt/css/css-sizing/range-percent-intrinsic-size-2a.html [ Failure ]
-
 # ====== Layout team owned tests to here ======
 
 # ====== LayoutNG-only failures from here ======
@@ -647,7 +671,6 @@
 crbug.com/774229 editing/pasteboard/copy-paste-white-space.html [ Failure ]
 crbug.com/899868 editing/selection/mouse/drag_over_text_transform.html [ Crash Failure ]
 crbug.com/855279 fast/css/text-overflow-ellipsis-vertical-hittest.html [ Failure ]
-crbug.com/591099 fast/css-intrinsic-dimensions/height-positioned.html [ Failure ]
 crbug.com/899902 fast/text/ellipsis-with-self-painting-layer.html [ Failure ]
 crbug.com/796943 fast/text/international/shape-across-elements-simple.html [ Failure ]
 crbug.com/877946 external/wpt/css/CSS2/linebox/anonymous-inline-inherit-001.html [ Failure ]
@@ -835,6 +858,8 @@
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-width-001.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-width-002.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-width-003.xht [ Crash ]
+crbug.com/829028 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-width-004.html [ Failure ]
+crbug.com/829028 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-width-005.html [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-width-ch-001.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-width-count-001.xht [ Failure ]
 crbug.com/591099 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-width-count-002.xht [ Failure ]
@@ -2729,17 +2754,16 @@
 crbug.com/939181 external/wpt/html/browsers/origin/cross-origin-objects/cross-origin-objects.html [ Failure Crash ]
 crbug.com/939181 virtual/not-site-per-process/external/wpt/html/browsers/origin/cross-origin-objects/cross-origin-objects.html [ Failure Timeout ]
 
+# FontFace object failures detected by WPT test
+crbug.com/965409 external/wpt/css/css-font-loading/fontface-descriptor-updates.html [ Failure ]
+
 # ====== New tests from wpt-importer added here ======
 crbug.com/626703 external/wpt/css/css-overflow/webkit-line-clamp-018.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-overflow/webkit-line-clamp-009.html [ Failure ]
-crbug.com/626703 external/wpt/css/css-font-loading/fontface-descriptor-updates.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-overflow/webkit-line-clamp-024.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-overflow/webkit-line-clamp-010.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-overflow/webkit-line-clamp-012.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-overflow/webkit-line-clamp-033.html [ Failure ]
-crbug.com/626703 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-width-005.html [ Failure ]
-crbug.com/626703 external/wpt/css/css-multicol/multicol-width-005.html [ Failure ]
-crbug.com/626703 virtual/layout_ng_experimental/external/wpt/css/css-multicol/multicol-width-004.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-overflow/webkit-line-clamp-027.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-overflow/webkit-line-clamp-011.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-overflow/webkit-line-clamp-013.html [ Failure ]
@@ -2752,19 +2776,15 @@
 crbug.com/626703 external/wpt/css/css-flexbox/flexbox_stf-fixpos.html [ Failure ]
 crbug.com/626703 virtual/layout_ng_experimental/external/wpt/css/css-flexbox/flex-direction-row-vertical.html [ Failure ]
 crbug.com/626703 virtual/layout_ng_experimental/external/wpt/css/css-flexbox/flexbox_stf-fixpos.html [ Failure ]
-crbug.com/626703 external/wpt/css/css-pseudo/marker-content-006.html [ Failure ]
 crbug.com/626703 external/wpt/html/rendering/widgets/button-layout/anonymous-button-content-box.html [ Failure ]
 crbug.com/626703 external/wpt/html/rendering/widgets/button-layout/inline-level.html [ Failure ]
-crbug.com/626703 external/wpt/css/css-pseudo/marker-list-style-position.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-values/ch-unit-015.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-values/ch-unit-013.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-values/ch-unit-018.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-values/ch-unit-014.html [ Failure ]
-crbug.com/626703 external/wpt/css/css-pseudo/marker-content-007.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-values/ch-unit-017.html [ Failure ]
 crbug.com/626703 external/wpt/infrastructure/reftest/reftest_fuzzy_ini_ref_only.html [ Failure ]
 crbug.com/626703 [ Mac ] external/wpt/html/rendering/widgets/button-layout/propagate-text-decoration.html [ Failure ]
-crbug.com/626703 external/wpt/css/css-pseudo/marker-content-008.html [ Failure ]
 crbug.com/626703 external/wpt/infrastructure/reftest/reftest_fuzzy_ini_short.html [ Failure ]
 crbug.com/626703 virtual/omt-worker-fetch/external/wpt/xhr/abort-after-stop.any.worker.html [ Timeout ]
 crbug.com/626703 external/wpt/xhr/abort-after-stop.any.worker.html [ Timeout ]
@@ -2847,7 +2867,6 @@
 crbug.com/626703 external/wpt/css/css-sizing/image-min-max-content-intrinsic-size-change-006.html [ Failure ]
 crbug.com/626703 virtual/omt-worker-fetch/external/wpt/xhr/event-readystatechange-loaded.any.html [ Timeout Failure ]
 crbug.com/626703 virtual/threaded/external/wpt/css/css-scroll-snap/scroll-target-margin-003.html [ Failure ]
-crbug.com/626703 external/wpt/css/css-pseudo/marker-content-011.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-scroll-snap/scroll-target-align-003.html [ Failure ]
 crbug.com/626703 virtual/threaded/external/wpt/css/css-scroll-snap/scroll-target-align-002.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-sizing/image-min-max-content-intrinsic-size-change-004.html [ Failure ]
@@ -2855,7 +2874,6 @@
 crbug.com/626703 external/wpt/css/css-text/line-breaking/line-breaking-015.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-sizing/image-min-max-content-intrinsic-size-change-007.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-lists/counter-set-001.html [ Failure ]
-crbug.com/626703 external/wpt/css/css-pseudo/marker-content-009.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-scroll-snap/scroll-target-align-002.html [ Failure ]
 crbug.com/626703 virtual/threaded/external/wpt/css/css-scroll-snap/scroll-target-margin-001.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-text/text-transform/text-transform-multiple-001.html [ Failure ]
@@ -2878,7 +2896,6 @@
 crbug.com/626703 external/wpt/css/css-sizing/image-min-max-content-intrinsic-size-change-008.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-animations/animationevent-marker-pseudoelement.html [ Timeout ]
 crbug.com/626703 external/wpt/css/css-text/line-breaking/line-breaking-016.html [ Failure ]
-crbug.com/626703 external/wpt/css/css-pseudo/marker-content-010.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-scroll-snap/scroll-target-padding-002.html [ Failure ]
 crbug.com/626703 [ Win7 ] external/wpt/upgrade-insecure-requests/image-redirect-upgrade.https.html [ Timeout ]
 crbug.com/626703 external/wpt/css/css-text/line-breaking/line-breaking-atomic-005.html [ Failure ]
@@ -3004,8 +3021,6 @@
 crbug.com/626703 [ Win7 ] external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/sizing/hori-block-size-small-or-larger-than-container-with-min-or-max-content-2a.html [ Failure Crash ]
 crbug.com/626703 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/sizing/block-size-with-min-or-max-content-1b.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-text/text-indent/text-indent-percentage-004.html [ Failure ]
-crbug.com/626703 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/sizing/vert-block-size-small-or-larger-than-container-with-min-or-max-content-1.html [ Failure ]
-crbug.com/626703 external/wpt/css/css-sizing/range-percent-intrinsic-size-2.html [ Failure ]
 crbug.com/626703 external/wpt/css/filter-effects/filter-subregion-01.html [ Failure ]
 crbug.com/626703 [ Android ] external/wpt/css/css-layout-api/auto-block-size-absolute.https.html [ Failure ]
 crbug.com/626703 [ Mac10.10 ] external/wpt/css/css-layout-api/auto-block-size-absolute.https.html [ Failure ]
@@ -3105,10 +3120,6 @@
 crbug.com/626703 virtual/omt-worker-fetch/external/wpt/referrer-policy/css-integration/svg/presentation-attribute.html [ Timeout Failure ]
 crbug.com/626703 virtual/omt-worker-fetch/external/wpt/referrer-policy/css-integration/svg/processing-instruction.html [ Timeout Failure ]
 
-crbug.com/906959 external/wpt/referrer-policy/no-referrer/http-rp/same-origin/http-http/shared-worker/keep-origin-redirect/generic.http.html [ Failure ]
-crbug.com/906959 external/wpt/referrer-policy/no-referrer/http-rp/same-origin/http-http/shared-worker/no-redirect/generic.http.html [ Failure ]
-crbug.com/906959 external/wpt/referrer-policy/no-referrer/meta-referrer/same-origin/http-http/shared-worker/keep-origin-redirect/generic.http.html [ Failure ]
-crbug.com/906959 external/wpt/referrer-policy/no-referrer/meta-referrer/same-origin/http-http/shared-worker/no-redirect/generic.http.html [ Failure ]
 crbug.com/906959 external/wpt/referrer-policy/no-referrer-when-downgrade/http-rp/same-origin/http-http/shared-worker/keep-origin-redirect/insecure-protocol.http.html [ Failure ]
 crbug.com/906959 external/wpt/referrer-policy/no-referrer-when-downgrade/http-rp/same-origin/http-http/shared-worker/no-redirect/insecure-protocol.http.html [ Failure ]
 crbug.com/906959 external/wpt/referrer-policy/no-referrer-when-downgrade/meta-referrer/same-origin/http-http/shared-worker/keep-origin-redirect/insecure-protocol.http.html [ Failure ]
@@ -3870,7 +3881,7 @@
 crbug.com/957459 virtual/threaded/external/wpt/css/css-paint-api/paint-arguments.https.html [ Failure ]
 crbug.com/957459 virtual/threaded/external/wpt/css/css-paint-api/paint-function-arguments.https.html [ Failure ]
 crbug.com/957457 virtual/threaded/external/wpt/css/css-paint-api/paint2d-image.https.html [ Failure Timeout ]
-crbug.com/957459 virtual/threaded/external/wpt/css/css-paint-api/parse-input-arguments-018.https.html [ Failure ]
+crbug.com/957459 virtual/threaded/external/wpt/css/css-paint-api/parse-input-arguments-018.https.html [ Crash Failure ]
 crbug.com/957459 virtual/threaded/external/wpt/css/css-paint-api/registered-property-interpolation-004.https.html [ Failure ]
 crbug.com/957459 virtual/threaded/external/wpt/css/css-paint-api/registered-property-interpolation-010.https.html [ Failure ]
 crbug.com/957459 virtual/threaded/external/wpt/css/css-paint-api/registered-property-stylemap.https.html [ Failure ]
@@ -3905,6 +3916,15 @@
 crbug.com/892817 external/wpt/css/css-multicol/multicol-span-all-margin-bottom-001.xht [ Failure ]
 crbug.com/636055 external/wpt/css/css-multicol/multicol-span-all-margin-nested-002.xht [ Failure ]
 crbug.com/792446 external/wpt/css/css-multicol/multicol-span-float-001.xht [ Failure ]
+crbug.com/964183 external/wpt/css/css-multicol/multicol-width-005.html [ Failure ]
+
+crbug.com/457718 external/wpt/css/css-pseudo/marker-content-006.html [ Failure ]
+crbug.com/457718 external/wpt/css/css-pseudo/marker-content-007.html [ Failure ]
+crbug.com/457718 external/wpt/css/css-pseudo/marker-content-008.html [ Failure ]
+crbug.com/457718 external/wpt/css/css-pseudo/marker-content-009.html [ Failure ]
+crbug.com/457718 external/wpt/css/css-pseudo/marker-content-010.html [ Failure ]
+crbug.com/457718 external/wpt/css/css-pseudo/marker-content-011.html [ Failure ]
+crbug.com/457718 external/wpt/css/css-pseudo/marker-list-style-position.html [ Failure ]
 
 crbug.com/917554 external/wpt/upgrade-insecure-requests/worker-subresource-fetch-upgrade.https.html [ Crash ]
 crbug.com/917554 virtual/omt-worker-fetch/external/wpt/upgrade-insecure-requests/worker-subresource-fetch-upgrade.https.html [ Crash ]
@@ -4012,10 +4032,6 @@
 crbug.com/707359 [ Mac ] fast/css-grid-layout/grid-self-baseline-03.html [ Failure ]
 crbug.com/707359 [ Mac ] fast/css-grid-layout/grid-self-baseline-04.html [ Failure ]
 crbug.com/707359 [ Mac ] fast/css-grid-layout/grid-self-baseline-horiz-04.html [ Failure ]
-crbug.com/926253 [ Linux Debug ] fast/css-intrinsic-dimensions/height-css-tables.html [ Failure ]
-### Flakes found on all platforms. See crbug.com/936095
-### crbug.com/926253 [ Linux Debug ] fast/css-intrinsic-dimensions/height-tables-collapsed.html [ Failure ]
-crbug.com/926253 [ Linux Debug ] fast/css-intrinsic-dimensions/height-tables.html [ Failure ]
 
 # [css-logical]
 crbug.com/913458 external/wpt/css/css-logical/animation-001.html [ Failure Pass ]
@@ -5372,7 +5388,6 @@
 
 # Sheriff 2019-02-26
 crbug.com/936083 external/wpt/import-maps/builtin-import-scheme.tentative.html [ Failure Pass ]
-crbug.com/936095 fast/css-intrinsic-dimensions/height-tables-collapsed.html [ Failure Pass ]
 crbug.com/936165 media/autoplay-muted.html [ Timeout Pass ]
 crbug.com/936108 virtual/streams-native/http/tests/streams/transferable/readable-stream.html [ Failure Pass ]
 
@@ -5630,9 +5645,11 @@
 crbug.com/964158 [ Linux ] external/wpt/payment-handler/change-payment-method.https.html [ Pass Crash ]
 crbug.com/899710 [ Linux ] virtual/threaded/http/tests/devtools/tracing/timeline-paint/timeline-paint-with-layout-invalidations.js [ Pass Timeout ]
 crbug.com/964239 external/wpt/css/css-scroll-snap/scroll-margin.html [ Pass Failure ]
-crbug.com/965137 [ Linux ] external/wpt/css/css-overflow/webkit-line-clamp-026.html [ Failure ]
+crbug.com/965137 [ Linux Win ] external/wpt/css/css-overflow/webkit-line-clamp-026.html [ Failure ]
 crbug.com/965134 [ Linux ] fast/events/pointerevents/multi-touch-events.html [ Failure ]
 crbug.com/965134 [ Linux ] virtual/mouseevent_fractional/fast/events/pointerevents/pointer-event-in-slop-region.html [ Failure ]
-crbug.com/965356 [ Mac ] inspector-protocol/heap-profiler/heap-snapshot-merged-nodes.js [ Pass Failure ]
-crbug.com/965356 [ Mac ] inspector-protocol/heap-profiler/heap-snapshot-with-event-listener.js [ Pass Failure ]
 crbug.com/965134 [ Linux ] fast/events/pointerevents/pointer-event-in-slop-region.html [ Pass Failure ]
+crbug.com/965389 [ Mac ] media/track/track-cue-rendering-position-auto.html [ Pass Failure ]
+
+# Sheriff 2019-05-21
+crbug.com/965134 [ Linux ] virtual/mouseevent_fractional/fast/events/pointerevents/multi-touch-events.html [ Failure ]
\ No newline at end of file
diff --git a/third_party/blink/web_tests/VirtualTestSuites b/third_party/blink/web_tests/VirtualTestSuites
index 5e874395..ee6ea5c 100644
--- a/third_party/blink/web_tests/VirtualTestSuites
+++ b/third_party/blink/web_tests/VirtualTestSuites
@@ -388,6 +388,16 @@
     "args": ["--enable-blink-features=LayoutNGFieldset"]
   },
   {
+    "prefix": "layout_ng_experimental",
+    "base": "external/wpt/css/css-contain",
+    "args": ["--enable-blink-features=LayoutNGFieldset"]
+  },
+  {
+    "prefix": "layout_ng_experimental",
+    "base": "external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/contain",
+    "args": ["--enable-blink-features=LayoutNGFieldset"]
+  },
+  {
     "prefix": "print_browser",
     "base": "print_testharness",
     "args": ["--enable-print-browser"]
diff --git a/third_party/blink/web_tests/css3/flexbox/flexitem.html b/third_party/blink/web_tests/css3/flexbox/flexitem.html
index cfc63e0..14bc2552 100644
--- a/third_party/blink/web_tests/css3/flexbox/flexitem.html
+++ b/third_party/blink/web_tests/css3/flexbox/flexitem.html
@@ -115,10 +115,7 @@
     <img data-expected-height="60" style="min-height:60px" src="../../images/resources/green-10.png">
     <img data-expected-height="75" style="min-height:150%" src="../../images/resources/blue-100.png">
     <img data-expected-height="75" style="min-height:150%" src="../../images/resources/green-10.png">
-    <img data-expected-height="10" style="min-height:-webkit-min-content;height:1px" src="../../images/resources/blue-10.png">
-    <img data-expected-height="100" style="min-height:-webkit-max-content;height:1px" src="../../images/resources/green-100.png">
     <img data-expected-height="50" style="min-height:-webkit-fill-available" src="../../images/resources/blue-10.png">
-    <img data-expected-height="10" style="min-height:-webkit-fit-content;height:1px" src="../../images/resources/green-10.png">
 </div>
 
 <!-- tests that max-height shrinks the height of flex items less than the height of the flexbox -->
@@ -127,23 +124,7 @@
     <img data-expected-height="40" style="max-height:40px" src="../../images/resources/green-10.png">
     <img data-expected-height="25" style="max-height:50%" src="../../images/resources/blue-100.png">
     <img data-expected-height="25" style="max-height:50%" src="../../images/resources/green-10.png">
-    <img data-expected-height="10" style="max-height:-webkit-min-content;height:1000px;" src="../../images/resources/blue-10.png">
-    <img data-expected-height="100" style="max-height:-webkit-max-content;height:1000px;" src="../../images/resources/green-100.png">
     <img data-expected-height="50" style="max-height:-webkit-fill-available" src="../../images/resources/blue-100.png">
-    <img data-expected-height="10" style="max-height:-webkit-fit-content;height:1000px" src="../../images/resources/green-10.png">
-</div>
-
-<!-- tests that images can shrink below their CSS height with min-height: min-content -->
-<div class="flexbox column" style="height:50px">
-    <img data-expected-height="50" style="flex-shrink:1;height:1000px;min-height:-webkit-min-content;" src="../../images/resources/blue-10.png">
-</div>
-
-<!-- tests that text can shrink below its CSS height with min-height: min-content -->
-<div class="flexbox column" style="height:50px">
-    <div data-expected-height="50" style="flex-shrink:1;height:1000px;min-height:-webkit-min-content;" src="../../images/resources/blue-10.png">
-      Some text<br>
-      Some more text
-    </div>
 </div>
 
 <!-- tests that images can shrink below their CSS width with min-width: min-content -->
diff --git a/third_party/blink/web_tests/external/wpt/css/css-tables/percent-height-overflow-auto-in-restricted-block-size-cell.html b/third_party/blink/web_tests/external/wpt/css/css-tables/percent-height-overflow-auto-in-restricted-block-size-cell.html
new file mode 100644
index 0000000..f532308
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/css-tables/percent-height-overflow-auto-in-restricted-block-size-cell.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://drafts.csswg.org/css-tables-3/#row-layout">
+<link rel="match" href="../reference/ref-filled-green-100px-square-only.html">
+<style>
+  .table { display:table; height:100px; background:pink; }
+  .cell { overflow:auto; width:100px; height:100%; background:blue; }
+</style>
+<p>There should be a 100px tall pink block below, with a scrollable box inside.</p>
+<div id="container" class="table" data-expected-height="100">
+  <div class="cell" data-expected-height="100" data-expected-scroll-height="500">
+    <div style="width:100px; height:500px;"></div>
+  </div>
+</div>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/check-layout-th.js"></script>
+<script>
+  checkLayout("#container");
+</script>
diff --git a/third_party/blink/web_tests/external/wpt/css/css-tables/percent-height-overflow-auto-in-unrestricted-block-size-cell.tentative.html b/third_party/blink/web_tests/external/wpt/css/css-tables/percent-height-overflow-auto-in-unrestricted-block-size-cell.tentative.html
new file mode 100644
index 0000000..ffbb796
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/css-tables/percent-height-overflow-auto-in-unrestricted-block-size-cell.tentative.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://drafts.csswg.org/css-tables-3/#row-layout">
+<link rel="help" href="http://crbug.com/964282">
+<link rel="match" href="../reference/ref-filled-green-100px-square-only.html">
+<p>Test passes if there is a filled green square.</p>
+<div style="display:table;">
+  <div style="overflow:auto; height:100%; background:green;">
+    <div style="width:100px; height:100px;"></div>
+  </div>
+</div>
diff --git a/third_party/blink/web_tests/external/wpt/css/css-transitions/non-rendered-element-001-expected.txt b/third_party/blink/web_tests/external/wpt/css/css-transitions/non-rendered-element-001-expected.txt
deleted file mode 100644
index 81c73cb..0000000
--- a/third_party/blink/web_tests/external/wpt/css/css-transitions/non-rendered-element-001-expected.txt
+++ /dev/null
@@ -1,7 +0,0 @@
-This is a testharness.js-based test.
-PASS Transitions do not run on an element not being rendered
-FAIL Transitions do not run for an element newly rendered assert_equals: No transition should run expected "rgb(0, 128, 0)" but got "rgb(255, 0, 0)"
-PASS Transitions do not run for an element newly made not rendered
-PASS Transitions are canceled when an element is no longer rendered
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/fetch/api/redirect/redirect-origin.any.js b/third_party/blink/web_tests/external/wpt/fetch/api/redirect/redirect-origin.any.js
index 3edb1bd..b81b9160 100644
--- a/third_party/blink/web_tests/external/wpt/fetch/api/redirect/redirect-origin.any.js
+++ b/third_party/blink/web_tests/external/wpt/fetch/api/redirect/redirect-origin.any.js
@@ -2,7 +2,7 @@
 // META: script=../resources/utils.js
 // META: script=/common/get-host-info.sub.js
 
-function testOriginAfterRedirection(desc, redirectUrl, redirectLocation, redirectStatus, expectedOrigin) {
+function testOriginAfterRedirection(desc, method, redirectUrl, redirectLocation, redirectStatus, expectedOrigin) {
     var uuid_token = token();
     var url = redirectUrl;
     var urlParameters = "?token=" + uuid_token + "&max_age=0";
@@ -28,10 +28,15 @@
 var corsLocationUrl =  get_host_info().HTTP_REMOTE_ORIGIN + dirname(location.pathname) + RESOURCES_DIR + "inspect-headers.py?cors&headers=origin";
 
 for (var code of [301, 302, 303, 307, 308]) {
-    testOriginAfterRedirection("Same origin to same origin redirection " + code, redirectUrl, locationUrl, code, null);
-    testOriginAfterRedirection("Same origin to other origin redirection " + code, redirectUrl, corsLocationUrl, code, get_host_info().HTTP_ORIGIN);
-    testOriginAfterRedirection("Other origin to other origin redirection " + code, corsRedirectUrl, corsLocationUrl, code, get_host_info().HTTP_ORIGIN);
-    testOriginAfterRedirection("Other origin to same origin redirection " + code, corsRedirectUrl, locationUrl + "&cors", code, "null");
+    testOriginAfterRedirection("Same origin to same origin redirection " + code, 'GET', redirectUrl, locationUrl, code, null);
+    testOriginAfterRedirection("Same origin to other origin redirection " + code, 'GET', redirectUrl, corsLocationUrl, code, get_host_info().HTTP_ORIGIN);
+    testOriginAfterRedirection("Other origin to other origin redirection " + code, 'GET', corsRedirectUrl, corsLocationUrl, code, get_host_info().HTTP_ORIGIN);
+    testOriginAfterRedirection("Other origin to same origin redirection " + code, 'GET', corsRedirectUrl, locationUrl + "&cors", code, "null");
+
+    testOriginAfterRedirection("Same origin to same origin redirection[POST] " + code, 'POST', redirectUrl, locationUrl, code, null);
+    testOriginAfterRedirection("Same origin to other origin redirection[POST] " + code, 'POST', redirectUrl, corsLocationUrl, code, get_host_info().HTTP_ORIGIN);
+    testOriginAfterRedirection("Other origin to other origin redirection[POST] " + code, 'POST', corsRedirectUrl, corsLocationUrl, code, get_host_info().HTTP_ORIGIN);
+    testOriginAfterRedirection("Other origin to same origin redirection[POST] " + code, 'POST', corsRedirectUrl, locationUrl + "&cors", code, "null");
 }
 
 done();
diff --git a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/border-box-sizing.html b/third_party/blink/web_tests/fast/css-intrinsic-dimensions/border-box-sizing.html
index ceeb2dc..c624ce6 100644
--- a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/border-box-sizing.html
+++ b/third_party/blink/web_tests/fast/css-intrinsic-dimensions/border-box-sizing.html
@@ -13,10 +13,6 @@
 <body onload="checkLayout('.container')">
 <div id=log></div>
 
-<div class="container" style="height: 20px; min-height: min-content; padding-top: 30px;" data-expected-height="80">
-   <div style="height: 50px; width: 50px;"></div>
-</div>
-
 <div style="display: flex; flex-direction: column; height: 20px;">
   <!-- uses the implied min-height: auto; should not flex-shrink below 80 -->
   <div class="container" style="padding-top: 30px;" data-expected-height="80">
diff --git a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-css-tables-collapsed-expected.html b/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-css-tables-collapsed-expected.html
deleted file mode 100644
index d584a6046..0000000
--- a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-css-tables-collapsed-expected.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-
-<style>
-  .item { height: 50px; width: 50px; border: 1px solid blue; }
-
-  .container { height: 100px; border: 5px solid pink; }
-  .table { border: 2px solid red; display: table; border-collapse: collapse; border-spacing: 2px; }
-  .td { border: 2px solid green; display: table-cell; }
-</style>
-
-<div class="table">
-  <div class="td">
-    <div class="item"></div>
-  </div>
-</div>
-
-<table>
-  <div class="td">
-    <div class="item"></div>
-  </div>
-</div>
-
-<div class="container">
-  <div class="table" style="height: 100%; box-sizing: border-box;">
-    <div class="td">
-      <div class="item"></div>
-    </div>
-  </div>
-</div>
-
-
-<div class="table container" style="display: block; float: left; height: 98px; border: 2px solid green;">
-  <div class="item"></div>
-</div>
diff --git a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-css-tables-collapsed.html b/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-css-tables-collapsed.html
deleted file mode 100644
index 72ab8f2..0000000
--- a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-css-tables-collapsed.html
+++ /dev/null
@@ -1,40 +0,0 @@
-<!DOCTYPE html>
-
-<style>
-  @import "resources/height-keyword-classes.css";
-
-  .small { height: 1px; }
-  .big { height: 300px; }
-  .item { height: 50px; width: 50px; border: 1px solid blue; }
-
-  .container { height: 100px; border: 5px solid pink; }
-  .table { border: 2px solid red; display: table; border-collapse: collapse; border-spacing: 2px; }
-  .td { border: 2px solid green; display: table-cell; }
-</style>
-
-<div class="table big max-height-min-content">
-  <div class="td">
-    <div class="item"></div>
-  </div>
-</div>
-
-<table>
-  <div class="td small min-height-min-content">
-    <div class="item"></div>
-  </div>
-</div>
-
-<div class="container">
-  <div class="table small min-height-fill-available">
-    <div class="td">
-      <div class="item"></div>
-    </div>
-  </div>
-</div>
-
-
-<div class="table container">
-  <div class="td small min-height-fill-available">
-    <div class="item"></div>
-  </div>
-</div>
diff --git a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-css-tables-expected.html b/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-css-tables-expected.html
deleted file mode 100644
index a1088ef..0000000
--- a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-css-tables-expected.html
+++ /dev/null
@@ -1,35 +0,0 @@
-<!DOCTYPE html>
-
-<style>
-  .item { height: 50px; width: 50px; border: 1px solid blue; }
-
-  .container { height: 100px; border: 5px solid pink; }
-  .table { border: 2px solid red; display: table; border-spacing: 2px; }
-  .td { border: 2px solid green; display: table-cell; }
-</style>
-
-<div class="table">
-  <div class="td">
-    <div class="item"></div>
-  </div>
-</div>
-
-<table>
-  <div class="td">
-    <div class="item"></div>
-  </div>
-</div>
-
-<div class="container">
-  <div class="table" style="height: 100%; box-sizing: border-box;">
-    <div class="td">
-      <div class="item"></div>
-    </div>
-  </div>
-</div>
-
-<div class="table container" style="display: block; float: left; height: 100px;">
-  <div class="td" style="height: 92px;" style="display: block;">
-    <div class="item"></div>
-  </div>
-</div>
diff --git a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-css-tables.html b/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-css-tables.html
deleted file mode 100644
index a37d074..0000000
--- a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-css-tables.html
+++ /dev/null
@@ -1,40 +0,0 @@
-<!DOCTYPE html>
-
-<style>
-  @import "resources/height-keyword-classes.css";
-
-  .small { height: 1px; }
-  .big { height: 300px; }
-  .item { height: 50px; width: 50px; border: 1px solid blue; }
-
-  .container { height: 100px; border: 5px solid pink; }
-  .table { border: 2px solid red; display: table; border-spacing: 2px; }
-  .td { border: 2px solid green; display: table-cell; }
-</style>
-
-<div class="table big max-height-min-content">
-  <div class="td">
-    <div class="item"></div>
-  </div>
-</div>
-
-<table>
-  <div class="td small min-height-min-content">
-    <div class="item"></div>
-  </div>
-</div>
-
-<div class="container">
-  <div class="table small min-height-fill-available">
-    <div class="td">
-      <div class="item"></div>
-    </div>
-  </div>
-</div>
-
-
-<div class="table container">
-  <div class="td small min-height-fill-available">
-    <div class="item"></div>
-  </div>
-</div>
diff --git a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-expected.html b/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-expected.html
deleted file mode 100644
index ad7a977..0000000
--- a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-expected.html
+++ /dev/null
@@ -1,80 +0,0 @@
-<!DOCTYPE html>
-<style>
-    body * {
-        border: 2px solid red;
-        padding: 5px;
-        clear: both;
-    }
-
-    .container {
-        height: 300px;
-        border-color: blue;
-
-        display: inline-block;
-        width: 100px;
-    }
-
-    .fill-available {
-      height: 100%;
-      box-sizing: border-box;
-    }
-</style>
-<div class="container">
-  <div>
-    height: min-content<br>on this box.
-  </div>
-
-  <div>
-    height: max-content<br>on this box.
-  </div>
-
-  <div>
-    height: fit-content<br>on this box.
-  </div>
-</div>
-
-<div class="container">
-  <div class="fill-available">
-    height: fill-available<br> on this box.
-  </div>
-</div>
-
-<div class="container">
-  <div>
-    min-height: min-content<br>on this box.
-  </div>
-
-  <div>
-    min-height: max-content<br>on this box.
-  </div>
-
-  <div>
-    min-height: fit-content<br>on this box.
-  </div>
-</div>
-
-<div class="container">
-  <div class="fill-available">
-    min-height: fill-available<br> on this box.
-  </div>
-</div>
-
-<div class="container">
-  <div>
-    max-height: min-content<br>on this box.
-  </div>
-
-  <div>
-    max-height: max-content<br>on this box.
-  </div>
-
-  <div>
-    max-height: fit-content<br>on this box.
-  </div>
-</div>
-
-<div class="container">
-  <div class="fill-available">
-    max-height: fill-available<br> on this box.
-  </div>
-</div>
diff --git a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-flexbox-expected.html b/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-flexbox-expected.html
deleted file mode 100644
index 384e1a1..0000000
--- a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-flexbox-expected.html
+++ /dev/null
@@ -1,27 +0,0 @@
-<!DOCTYPE html>
-<style>
-  .container {
-    border: 2px solid blue;
-  }
-
-  .item {
-    border: 2px solid red;
-  }
-</style>
-
-<div class="container">
-  <div class="item">
-    Line 1<br>
-    Line 2
-  </div>
-</div>
-
-<div class="container">
-  <div class="item">
-    Line 1
-  </div>
-  <div class="item">
-    Line 1<br>
-    Line 2
-  </div>
-</div>
diff --git a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-flexbox.html b/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-flexbox.html
deleted file mode 100644
index 2d4675c1..0000000
--- a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-flexbox.html
+++ /dev/null
@@ -1,37 +0,0 @@
-<!DOCTYPE html>
-<style>
-  @import "resources/height-keyword-classes.css";
-
-  .container {
-    display: -webkit-flex;
-    display: flex;
-    -webkit-flex-direction: column;
-    flex-direction: column;
-
-    border: 2px solid blue;
-  }
-
-  .item {
-    height: 1px;
-    border: 2px solid red;
-    -webkit-flex: 1;
-    flex: 1;
-  }
-</style>
-
-<div class="container">
-  <div class="item min-height-min-content">
-    Line 1<br>
-    Line 2
-  </div>
-</div>
-
-<div class="container">
-  <div class="item min-height-min-content">
-    Line 1
-  </div>
-  <div class="item min-height-min-content">
-    Line 1<br>
-    Line 2
-  </div>
-</div>
diff --git a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-positioned-expected.html b/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-positioned-expected.html
deleted file mode 100644
index 5b397ba..0000000
--- a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-positioned-expected.html
+++ /dev/null
@@ -1,121 +0,0 @@
-<!DOCTYPE html>
-<!--
-All divs here should shrinkwrap to fit their content, except for fill-available
--->
-<style>
-    body * {
-      border: 2px solid red;
-      padding: 5px;
-      clear: both;
-    }
-
-    .container {
-      height: 400px;
-      border-color: blue;
-
-      display: inline-block;
-      width: 100px;
-    }
-
-    .position-container {
-      border-color: green;
-      position: relative;
-      height: 100px;
-    }
-
-    .position-container > * {
-      position: absolute;
-      top: 0;
-    }
-
-    .f-a-container {
-      height: 100%;
-      box-sizing: border-box;
-    }
-
-    .fill-available {
-      height: 396px;
-      box-sizing: border-box;
-    }
-</style>
-<div class="container">
-  <div class="position-container">
-    <div>
-      height: min-content<br>on this box.
-    </div>
-  </div>
-  <div class="position-container">
-    <div>
-      height: max-content<br>on this box.
-    </div>
-  </div>
-  <div class="position-container">
-    <div>
-      height: fit-content<br>on this box.
-    </div>
-  </div>
-</div>
-
-<div class="container">
-  <div class="position-container f-a-container">
-    <div class="fill-available">
-      height: fill-available<br> on this box.
-    </div>
-  </div>
-</div>
-
-<div class="container">
-  <div class="position-container">
-    <div>
-      min-height: min-content<br>on this box.
-    </div>
-
-  </div>
-  <div class="position-container">
-    <div>
-      min-height: max-content<br>on this box.
-    </div>
-
-  </div>
-  <div class="position-container">
-    <div>
-      min-height: fit-content<br>on this box.
-    </div>
-  </div>
-</div>
-
-<div class="container">
-  <div class="position-container f-a-container">
-    <div class="fill-available">
-      min-height: fill-available<br> on this box.
-    </div>
-  </div>
-</div>
-
-<div class="container">
-  <div class="position-container">
-    <div>
-      max-height: min-content<br>on this box.
-    </div>
-
-  </div>
-  <div class="position-container">
-    <div>
-      max-height: max-content<br>on this box.
-    </div>
-
-  </div>
-  <div class="position-container">
-    <div>
-      max-height: fit-content<br>on this box.
-    </div>
-  </div>
-</div>
-
-<div class="container">
-  <div class="position-container f-a-container">
-    <div class="fill-available">
-      max-height: fill-available<br> on this box.
-    </div>
-  </div>
-</div>
diff --git a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-positioned-replaced-expected.html b/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-positioned-replaced-expected.html
deleted file mode 100644
index b3481800..0000000
--- a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-positioned-replaced-expected.html
+++ /dev/null
@@ -1,111 +0,0 @@
-<!DOCTYPE html>
-<!--
-iframes have an intrinsic size of 300x150
--->
-<style>
-    body * {
-      border: 2px solid red;
-      padding: 5px;
-      clear: both;
-    }
-
-    .container {
-      height: 600px;
-      border-color: blue;
-
-      display: inline-block;
-      width: 100px;
-    }
-
-    .position-container {
-      border-color: green;
-      position: relative;
-      height: 180px;
-    }
-
-    .position-container > * {
-      position: absolute;
-      border: 5px solid pink;
-      width: 50px;
-    }
-
-    .f-a-container {
-      height: 100%;
-      box-sizing: border-box;
-    }
-
-    .fill-available {
-      height: 586px;
-      width: 70px;
-      box-sizing: border-box;
-    }
-</style>
-<div class="container">
-  <div class="position-container">
-    <iframe>
-    </iframe>
-  </div>
-  <div class="position-container">
-    <iframe>
-    </iframe>
-  </div>
-  <div class="position-container">
-    <iframe>
-    </iframe>
-  </div>
-</div>
-
-<div class="container">
-  <div class="position-container f-a-container">
-    <iframe class="fill-available">
-    </iframe>
-  </div>
-</div>
-
-<div class="container">
-  <div class="position-container">
-    <iframe>
-    </iframe>
-
-  </div>
-  <div class="position-container">
-    <iframe>
-    </iframe>
-
-  </div>
-  <div class="position-container">
-    <iframe>
-    </iframe>
-  </div>
-</div>
-
-<div class="container">
-  <div class="position-container f-a-container">
-    <iframe class="fill-available">
-    </iframe>
-  </div>
-</div>
-
-<div class="container">
-  <div class="position-container">
-    <iframe>
-    </iframe>
-
-  </div>
-  <div class="position-container">
-    <iframe>
-    </iframe>
-
-  </div>
-  <div class="position-container">
-    <iframe>
-    </iframe>
-  </div>
-</div>
-
-<div class="container">
-  <div class="position-container f-a-container">
-    <iframe class="fill-available">
-    </iframe>
-  </div>
-</div>
diff --git a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-positioned-replaced.html b/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-positioned-replaced.html
deleted file mode 100644
index e4bca13..0000000
--- a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-positioned-replaced.html
+++ /dev/null
@@ -1,119 +0,0 @@
-<!DOCTYPE html>
-<!--
-iframes have an intrinsic size of 300x150
--->
-<style>
-    @import "resources/height-keyword-classes.css";
-
-    body * {
-      border: 2px solid red;
-      padding: 5px;
-      clear: both;
-    }
-
-    .container {
-      height: 600px;
-      border-color: blue;
-
-      display: inline-block;
-      width: 100px;
-    }
-
-    .position-container {
-      border-color: green;
-      position: relative;
-      height: 180px;
-    }
-
-    .position-container > * {
-      position: absolute;
-      border: 5px solid pink;
-      width: 50px;
-    }
-
-    .f-a-container {
-      height: 100%;
-      box-sizing: border-box;
-    }
-
-    .small {
-      height: 1px;
-    }
-
-    .big {
-      height: 300px;
-    }
-
-    .really-big {
-      height: 1000px;
-    }
-</style>
-<div class="container">
-  <div class="position-container">
-    <iframe class="min-content">
-    </iframe>
-  </div>
-  <div class="position-container">
-    <iframe class="max-content">
-    </iframe>
-  </div>
-  <div class="position-container">
-    <iframe class="fit-content">
-    </iframe>
-  </div>
-</div>
-
-<div class="container">
-  <div class="position-container f-a-container">
-    <iframe class="fill-available">
-    </iframe>
-  </div>
-</div>
-
-<div class="container">
-  <div class="position-container">
-    <iframe class="small min-height-min-content">
-    </iframe>
-
-  </div>
-  <div class="position-container">
-    <iframe class="small min-height-max-content">
-    </iframe>
-
-  </div>
-  <div class="position-container">
-    <iframe class="small min-height-fit-content">
-    </iframe>
-  </div>
-</div>
-
-<div class="container">
-  <div class="position-container f-a-container">
-    <iframe class="small min-height-fill-available">
-    </iframe>
-  </div>
-</div>
-
-<div class="container">
-  <div class="position-container">
-    <iframe class="big max-height-min-content">
-    </iframe>
-
-  </div>
-  <div class="position-container">
-    <iframe class="big max-height-max-content">
-    </iframe>
-
-  </div>
-  <div class="position-container">
-    <iframe class="big max-height-fit-content">
-    </iframe>
-  </div>
-</div>
-
-<div class="container">
-  <div class="position-container f-a-container">
-    <iframe class="really-big max-height-fill-available">
-    </iframe>
-  </div>
-</div>
diff --git a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-positioned.html b/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-positioned.html
deleted file mode 100644
index 8d5ee1bb..0000000
--- a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-positioned.html
+++ /dev/null
@@ -1,130 +0,0 @@
-<!DOCTYPE html>
-<!--
-All divs here should shrinkwrap to fit their content, except for fill-available
--->
-<style>
-    @import "resources/height-keyword-classes.css";
-
-    body * {
-      border: 2px solid red;
-      padding: 5px;
-      clear: both;
-    }
-
-    .container {
-      height: 400px;
-      border-color: blue;
-
-      display: inline-block;
-      width: 100px;
-    }
-
-    .position-container {
-      border-color: green;
-      position: relative;
-      height: 100px;
-    }
-
-    .position-container > * {
-      position: absolute;
-      top: 0;
-    }
-
-    .f-a-container {
-      height: 100%;
-      box-sizing: border-box;
-    }
-
-    .small {
-      height: 1px;
-    }
-
-    .big {
-      height: 200px;
-    }
-
-    .really-big {
-      height: 1000px;
-    }
-</style>
-<div class="container">
-  <div class="position-container">
-    <div class="min-content">
-      height: min-content<br>on this box.
-    </div>
-  </div>
-  <div class="position-container">
-    <div class="max-content">
-      height: max-content<br>on this box.
-    </div>
-  </div>
-  <div class="position-container">
-    <div class="fit-content">
-      height: fit-content<br>on this box.
-    </div>
-  </div>
-</div>
-
-<div class="container">
-  <div class="position-container f-a-container">
-    <div class="fill-available">
-      height: fill-available<br> on this box.
-    </div>
-  </div>
-</div>
-
-<div class="container">
-  <div class="position-container">
-    <div class="small min-height-min-content">
-      min-height: min-content<br>on this box.
-    </div>
-
-  </div>
-  <div class="position-container">
-    <div class="small min-height-max-content">
-      min-height: max-content<br>on this box.
-    </div>
-
-  </div>
-  <div class="position-container">
-    <div class="small min-height-fit-content">
-      min-height: fit-content<br>on this box.
-    </div>
-  </div>
-</div>
-
-<div class="container">
-  <div class="position-container f-a-container">
-    <div class="small min-height-fill-available">
-      min-height: fill-available<br> on this box.
-    </div>
-  </div>
-</div>
-
-<div class="container">
-  <div class="position-container">
-    <div class="big max-height-min-content">
-      max-height: min-content<br>on this box.
-    </div>
-
-  </div>
-  <div class="position-container">
-    <div class="big max-height-max-content">
-      max-height: max-content<br>on this box.
-    </div>
-
-  </div>
-  <div class="position-container">
-    <div class="big max-height-fit-content">
-      max-height: fit-content<br>on this box.
-    </div>
-  </div>
-</div>
-
-<div class="container">
-  <div class="position-container f-a-container">
-    <div class="really-big max-height-fill-available">
-      max-height: fill-available<br> on this box.
-    </div>
-  </div>
-</div>
diff --git a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-replaced-expected.html b/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-replaced-expected.html
deleted file mode 100644
index ea6fb393..0000000
--- a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-replaced-expected.html
+++ /dev/null
@@ -1,85 +0,0 @@
-<!DOCTYPE html>
-<style>
-    body * {
-        border: 2px solid red;
-        padding: 5px;
-        clear: both;
-    }
-
-    .container {
-        height: 500px;
-        border-color: blue;
-
-        display: inline-block;
-        width: 100px;
-    }
-
-    iframe {
-      width: 50px;
-    }
-
-    .fill-available {
-      height: 100%;
-      width: 64px;
-      box-sizing: border-box;
-    }
-</style>
-<div class="container">
-  <iframe>
-    height: min-content<br>on this box.
-  </iframe>
-
-  <iframe>
-    height: max-content<br>on this box.
-  </iframe>
-
-  <iframe>
-    height: fit-content<br>on this box.
-  </iframe>
-</div>
-
-<div class="container">
-  <iframe class="fill-available">
-    height: fill-available<br> on this box.
-  </iframe>
-</div>
-
-<div class="container">
-  <iframe>
-    min-height: min-content<br>on this box.
-  </iframe>
-
-  <iframe>
-    min-height: max-content<br>on this box.
-  </iframe>
-
-  <iframe>
-    min-height: fit-content<br>on this box.
-  </iframe>
-</div>
-
-<div class="container">
-  <iframe class="fill-available">
-    min-height: fill-available<br> on this box.
-  </iframe>
-</div>
-
-<div class="container">
-  <iframe>
-    max-height: min-content<br>on this box.
-  </iframe>
-
-  <iframe>
-    max-height: max-content<br>on this box.
-  </iframe>
-
-  <iframe>
-    max-height: fit-content<br>on this box.
-  </iframe>
-</div>
-
-<div class="container">
-  <iframe class="fill-available">
-    max-height: fill-available<br> on this box.
-  </iframe>
-</div>
diff --git a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-replaced.html b/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-replaced.html
deleted file mode 100644
index 596407a..0000000
--- a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-replaced.html
+++ /dev/null
@@ -1,84 +0,0 @@
-<!DOCTYPE html>
-<!--
-All divs here should shrinkwrap to fit their content, except for fill-available
--->
-<style>
-    @import "resources/height-keyword-classes.css";
-
-    body * {
-        border: 2px solid red;
-        padding: 5px;
-        clear: both;
-    }
-
-    .container {
-        height: 500px;
-        border-color: blue;
-
-        display: inline-block;
-        width: 100px;
-    }
-
-    iframe {
-      width: 50px;
-    }
-
-    .small {
-      height: 1px;
-    }
-
-    .big {
-      height: 300px;
-    }
-
-    .really-big {
-      height: 1000px;
-    }
-</style>
-<div class="container">
-  <iframe class="min-content">
-  </iframe>
-
-  <iframe class="max-content">
-  </iframe>
-
-  <iframe class="fit-content">
-  </iframe>
-</div>
-
-<div class="container">
-  <iframe class="fill-available">
-  </iframe>
-</div>
-
-<div class="container">
-  <iframe class="small min-height-min-content">
-  </iframe>
-
-  <iframe class="small min-height-max-content">
-  </iframe>
-
-  <iframe class="small min-height-fit-content">
-  </iframe>
-</div>
-
-<div class="container">
-  <iframe class="small min-height-fill-available">
-  </iframe>
-</div>
-
-<div class="container">
-  <iframe class="big max-height-min-content">
-  </iframe>
-
-  <iframe class="big max-height-max-content">
-  </iframe>
-
-  <iframe class="big max-height-fit-content">
-  </iframe>
-</div>
-
-<div class="container">
-  <iframe class="really-big max-height-fill-available">
-  </iframe>
-</div>
diff --git a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-tables-collapsed-expected.html b/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-tables-collapsed-expected.html
deleted file mode 100644
index 5ebfbc5dd..0000000
--- a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-tables-collapsed-expected.html
+++ /dev/null
@@ -1,36 +0,0 @@
-<!DOCTYPE html>
-
-<style>
-  .item { height: 50px; width: 50px; border: 1px solid blue; }
-
-  .container { height: 100px; border: 5px solid pink; }
-  table { border: 2px solid red; border-collapse: collapse; }
-  td { border: 2px solid green; }
-</style>
-
-<table>
-  <td>
-    <div class="item"></div>
-  </td>
-</table>
-
-<table>
-  <td>
-    <div class="item"></div>
-  </td>
-</table>
-
-<div class="container">
-  <table style="height: 100%; box-sizing: border-box;">
-    <td>
-      <div class="item"></div>
-    </td>
-  </table>
-</div>
-
-
-<table class="container">
-  <td style="height: 79px;">
-    <div class="item"></div>
-  </td>
-</table>
diff --git a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-tables-collapsed.html b/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-tables-collapsed.html
deleted file mode 100644
index 596a5d3..0000000
--- a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-tables-collapsed.html
+++ /dev/null
@@ -1,40 +0,0 @@
-<!DOCTYPE html>
-
-<style>
-  @import "resources/height-keyword-classes.css";
-
-  .small { height: 1px; }
-  .big { height: 300px; }
-  .item { height: 50px; width: 50px; border: 1px solid blue; }
-
-  .container { height: 100px; border: 5px solid pink; }
-  table { border: 2px solid red; border-collapse: collapse; }
-  td { border: 2px solid green; }
-</style>
-
-<table class="big max-height-min-content">
-  <td>
-    <div class="item"></div>
-  </td>
-</table>
-
-<table>
-  <td class="small min-height-min-content">
-    <div class="item"></div>
-  </td>
-</table>
-
-<div class="container">
-  <table class="small min-height-fill-available">
-    <td>
-      <div class="item"></div>
-    </td>
-  </table>
-</div>
-
-
-<table class="container">
-  <td class="small min-height-fill-available">
-    <div class="item"></div>
-  </td>
-</table>
diff --git a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-tables-expected.html b/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-tables-expected.html
deleted file mode 100644
index fa27589e..0000000
--- a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-tables-expected.html
+++ /dev/null
@@ -1,36 +0,0 @@
-<!DOCTYPE html>
-
-<style>
-  .item { height: 50px; width: 50px; border: 1px solid blue; }
-
-  .container { height: 100px; border: 5px solid pink; }
-  table { border: 2px solid red; }
-  td { border: 2px solid green; }
-</style>
-
-<table>
-  <td>
-    <div class="item"></div>
-  </td>
-</table>
-
-<table>
-  <td>
-    <div class="item"></div>
-  </td>
-</table>
-
-<div class="container">
-  <table style="height: 100%; box-sizing: border-box;">
-    <td>
-      <div class="item"></div>
-    </td>
-  </table>
-</div>
-
-
-<table class="container">
-  <td style="height: 79px;">
-    <div class="item"></div>
-  </td>
-</table>
diff --git a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-tables.html b/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-tables.html
deleted file mode 100644
index 99c922e..0000000
--- a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height-tables.html
+++ /dev/null
@@ -1,40 +0,0 @@
-<!DOCTYPE html>
-
-<style>
-  @import "resources/height-keyword-classes.css";
-
-  .small { height: 1px; }
-  .big { height: 300px; }
-  .item { height: 50px; width: 50px; border: 1px solid blue; }
-
-  .container { height: 100px; border: 5px solid pink; }
-  table { border: 2px solid red; }
-  td { border: 2px solid green; }
-</style>
-
-<table class="big max-height-min-content">
-  <td>
-    <div class="item"></div>
-  </td>
-</table>
-
-<table>
-  <td class="small min-height-min-content">
-    <div class="item"></div>
-  </td>
-</table>
-
-<div class="container">
-  <table class="small min-height-fill-available">
-    <td>
-      <div class="item"></div>
-    </td>
-  </table>
-</div>
-
-
-<table class="container">
-  <td class="small min-height-fill-available">
-    <div class="item"></div>
-  </td>
-</table>
diff --git a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height.html b/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height.html
deleted file mode 100644
index 35ff3b6..0000000
--- a/third_party/blink/web_tests/fast/css-intrinsic-dimensions/height.html
+++ /dev/null
@@ -1,92 +0,0 @@
-<!DOCTYPE html>
-<!--
-All divs here should shrinkwrap to fit their content, except for fill-available
--->
-<style>
-    @import "resources/height-keyword-classes.css";
-
-    body * {
-        border: 2px solid red;
-        padding: 5px;
-        clear: both;
-    }
-
-    .container {
-        height: 300px;
-        border-color: blue;
-
-        display: inline-block;
-        width: 100px;
-    }
-
-    .small {
-      height: 1px;
-    }
-
-    .big {
-      height: 100px;
-    }
-
-    .really-big {
-      height: 1000px;
-    }
-</style>
-<div class="container">
-  <div class="min-content">
-    height: min-content<br>on this box.
-  </div>
-
-  <div class="max-content">
-    height: max-content<br>on this box.
-  </div>
-
-  <div class="fit-content">
-    height: fit-content<br>on this box.
-  </div>
-</div>
-
-<div class="container">
-  <div class="fill-available">
-    height: fill-available<br> on this box.
-  </div>
-</div>
-
-<div class="container">
-  <div class="small min-height-min-content">
-    min-height: min-content<br>on this box.
-  </div>
-
-  <div class="small min-height-max-content">
-    min-height: max-content<br>on this box.
-  </div>
-
-  <div class="small min-height-fit-content">
-    min-height: fit-content<br>on this box.
-  </div>
-</div>
-
-<div class="container">
-  <div class="small min-height-fill-available">
-    min-height: fill-available<br> on this box.
-  </div>
-</div>
-
-<div class="container">
-  <div class="big max-height-min-content">
-    max-height: min-content<br>on this box.
-  </div>
-
-  <div class="big max-height-max-content">
-    max-height: max-content<br>on this box.
-  </div>
-
-  <div class="big max-height-fit-content">
-    max-height: fit-content<br>on this box.
-  </div>
-</div>
-
-<div class="container">
-  <div class="really-big max-height-fill-available">
-    max-height: fill-available<br> on this box.
-  </div>
-</div>
diff --git a/third_party/blink/web_tests/http/tests/credentialmanager/credentialscontainer-get-from-nested-frame.html b/third_party/blink/web_tests/http/tests/credentialmanager/credentialscontainer-get-from-nested-frame.html
index 8ba92395..541fbfe7 100644
--- a/third_party/blink/web_tests/http/tests/credentialmanager/credentialscontainer-get-from-nested-frame.html
+++ b/third_party/blink/web_tests/http/tests/credentialmanager/credentialscontainer-get-from-nested-frame.html
@@ -112,9 +112,9 @@
   someOtherCredential.id = new TextEncoder().encode("someOtherCredential");
   customGetAssertionOptions.allowCredentials = [someOtherCredential];
 
-  return promise_rejects(t, "InvalidStateError",
+  return promise_rejects(t, "NotAllowedError",
     navigator.credentials.get({ publicKey : customGetAssertionOptions}));
-}, "navigator.credentials.get() for unregistered device returns InvalidStateError");
+}, "navigator.credentials.get() for unregistered device returns NotAllowedError");
 
 promise_test(async t => {
   var customGetAssertionOptions = deepCopy(GET_CREDENTIAL_OPTIONS);
diff --git a/third_party/blink/web_tests/http/tests/credentialmanager/credentialscontainer-get-with-virtual-authenticator.html b/third_party/blink/web_tests/http/tests/credentialmanager/credentialscontainer-get-with-virtual-authenticator.html
index de227a6..aef39e1 100644
--- a/third_party/blink/web_tests/http/tests/credentialmanager/credentialscontainer-get-with-virtual-authenticator.html
+++ b/third_party/blink/web_tests/http/tests/credentialmanager/credentialscontainer-get-with-virtual-authenticator.html
@@ -35,9 +35,9 @@
   someOtherCredential.id = new TextEncoder().encode("someOtherCredential");
   customGetAssertionOptions.allowCredentials = [someOtherCredential];
 
-  return promise_rejects(t, "InvalidStateError",
+  return promise_rejects(t, "NotAllowedError",
     navigator.credentials.get({ publicKey : customGetAssertionOptions}));
-}, "navigator.credentials.get() for unregistered device returns InvalidStateError");
+}, "navigator.credentials.get() for unregistered device returns NotAllowedError");
 
 promise_test(async t => {
   var customGetAssertionOptions = deepCopy(GET_CREDENTIAL_OPTIONS);
diff --git a/third_party/blink/web_tests/http/tests/devtools/a11y-axe-core/elements/main-tool-test-expected.txt b/third_party/blink/web_tests/http/tests/devtools/a11y-axe-core/elements/main-tool-test-expected.txt
new file mode 100644
index 0000000..ef007ce
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/devtools/a11y-axe-core/elements/main-tool-test-expected.txt
@@ -0,0 +1,21 @@
+
+Running: testElementsDomTree
+Tests accessibility in the DOM tree using the axe-core linter
+aXe violations: []
+
+
+Running: testElementsDomBreadcrumbs
+Tests accessibility in the DOM breadcrumbs using the axe-core linter
+aXe violations: []
+
+
+Running: testElementsStylesPane
+Tests accessibility of the Styles pane using the axe-core linter
+aXe violations: []
+
+
+Running: testElementsComputedStylesPane
+Tests accessibility in the Computed Styles pane using the axe-core linter
+aXe violations: []
+
+
diff --git a/third_party/blink/web_tests/http/tests/devtools/a11y-axe-core/elements/main-tool-test.js b/third_party/blink/web_tests/http/tests/devtools/a11y-axe-core/elements/main-tool-test.js
new file mode 100644
index 0000000..10da2f1b
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/devtools/a11y-axe-core/elements/main-tool-test.js
@@ -0,0 +1,63 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(async function () {
+    // axe-core issue #1444 -- role="tree" requires children with role="treeitem",
+    // but it is reasonable to have trees with no leaves.
+    const NO_REQUIRED_CHILDREN_RULESET = {
+      'aria-required-children': {
+        enabled: false,
+      },
+    };
+    const DEFAULT_RULESET = { };
+    await TestRunner.loadModule('axe_core_test_runner');
+    await TestRunner.loadModule('elements_test_runner');
+    const tests = [
+      testElementsDomTree,
+      testElementsDomBreadcrumbs,
+      testElementsStylesPane,
+      testElementsComputedStylesPane,
+    ];
+
+    async function testElementsDomTree() {
+      TestRunner.addResult('Tests accessibility in the DOM tree using the axe-core linter');
+      const view = 'elements';
+      await UI.viewManager.showView(view);
+      const widget = await UI.viewManager.view(view).widget();
+      const element = widget.element.querySelector('#elements-content');
+
+      await AxeCoreTestRunner.runValidation(element, NO_REQUIRED_CHILDREN_RULESET);
+    }
+
+    async function testElementsDomBreadcrumbs() {
+      TestRunner.addResult('Tests accessibility in the DOM breadcrumbs using the axe-core linter');
+      const view = 'elements';
+      await UI.viewManager.showView(view);
+      const widget = await UI.viewManager.view(view).widget();
+      const element = widget.element.querySelector('#elements-crumbs');
+
+      await AxeCoreTestRunner.runValidation(element, DEFAULT_RULESET);
+    }
+
+    async function testElementsStylesPane() {
+      TestRunner.addResult('Tests accessibility of the Styles pane using the axe-core linter');
+      await UI.viewManager.showView('elements');
+      const panel = self.runtime.sharedInstance(Elements.ElementsPanel);
+      const element = panel._stylesWidget.element;
+
+      await AxeCoreTestRunner.runValidation(element, NO_REQUIRED_CHILDREN_RULESET);
+    }
+
+    async function testElementsComputedStylesPane() {
+      TestRunner.addResult('Tests accessibility in the Computed Styles pane using the axe-core linter');
+      await UI.viewManager.showView('elements');
+      await ElementsTestRunner.showComputedStyles();
+      const panel = self.runtime.sharedInstance(Elements.ElementsPanel);
+      const element = panel._computedStyleWidget.element;
+
+      await AxeCoreTestRunner.runValidation(element, DEFAULT_RULESET);
+    }
+
+    TestRunner.runAsyncTestSuite(tests);
+  })();
\ No newline at end of file
diff --git a/third_party/blink/web_tests/http/tests/devtools/network/network-log-service-worker-navigate.js b/third_party/blink/web_tests/http/tests/devtools/network/network-log-service-worker-navigate.js
index 8491077..f8b0291 100644
--- a/third_party/blink/web_tests/http/tests/devtools/network/network-log-service-worker-navigate.js
+++ b/third_party/blink/web_tests/http/tests/devtools/network/network-log-service-worker-navigate.js
@@ -9,9 +9,9 @@
 
   await TestRunner.navigatePromise(
       'resources/service-worker-repeat-fetch.html');
+  await TestRunner.evaluateInPageAsync('installSWAndWaitForActivated()');
   await new Promise(
       resolve => ApplicationTestRunner.waitForServiceWorker(resolve));
-
   await TestRunner.reloadPagePromise();
   TestRunner.addResult('');
 
diff --git a/third_party/blink/web_tests/http/tests/devtools/network/resources/service-worker-repeat-fetch.html b/third_party/blink/web_tests/http/tests/devtools/network/resources/service-worker-repeat-fetch.html
index 8a2f990..4541e78 100644
--- a/third_party/blink/web_tests/http/tests/devtools/network/resources/service-worker-repeat-fetch.html
+++ b/third_party/blink/web_tests/http/tests/devtools/network/resources/service-worker-repeat-fetch.html
@@ -2,11 +2,20 @@
 <html>
   <head>
     <title>webpage for service-worker-repeat-fetch</title>
-<script>
-function installSW() {
-  navigator.serviceWorker.register('service-worker-repeat-fetch.js');
-}
-</script>
+    <script>
+    async function installSWAndWaitForActivated() {
+        const reg = await navigator.serviceWorker.register(
+            'service-worker-repeat-fetch.js');
+        const worker = reg.installing || reg.waiting || reg.active;
+        if (worker.state === 'activated')
+            return;
+        return new Promise(resolve => {
+            worker.addEventListener('statechange', () => {
+                if (worker.state === 'activated')
+                    resolve();
+            });
+        });
+    }
+    </script>
   </head>
-  <body onload="installSW()"></body>
 </html>
diff --git a/third_party/blink/web_tests/http/tests/devtools/network/resources/set-two-cookies.php b/third_party/blink/web_tests/http/tests/devtools/network/resources/set-two-cookies.php
new file mode 100644
index 0000000..c9f38a4d
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/devtools/network/resources/set-two-cookies.php
@@ -0,0 +1,24 @@
+<?php
+    header("Expires: Thu, 01 Dec 2003 16:00:00 GMT");
+    header("Cache-Control: no-store, no-cache, must-revalidate");
+    header("Pragma: no-cache");
+    header("Content-Type: text/plain");
+    header("Access-Control-Allow-Origin: http://127.0.0.1:8000");
+    $length = isset($_GET["length"]) ? (int) $_GET["length"] : 0;
+    if (!$length) {
+      setcookie("TestCookie", "TestCookieValue");
+      setcookie("TestCookie2", "TestCookieValue2");
+    } else {
+      $data = "";
+      for ($i = 0; $i < $length; $i++) {
+        $data .= "a";
+      }
+      header("Set-Cookie: $data");
+      $data = "";
+      for ($i = 0; $i < $length; $i++) {
+        $data .= "b";
+      }
+      header("Set-Cookie: $data");
+    }
+    echo("Cookie set.");
+?>
diff --git a/third_party/blink/web_tests/http/tests/devtools/network/warning-for-long-cookie-expected.txt b/third_party/blink/web_tests/http/tests/devtools/network/warning-for-long-cookie-expected.txt
index 45bb45ab..931e252 100644
--- a/third_party/blink/web_tests/http/tests/devtools/network/warning-for-long-cookie-expected.txt
+++ b/third_party/blink/web_tests/http/tests/devtools/network/warning-for-long-cookie-expected.txt
@@ -1,7 +1,10 @@
 Checks that we show warning message for long cookie.
 
-Message count: 1
+Message count: 2
 VM:62 Set-Cookie header is ignored in response from url: http://127.0.0.1:8000/devtools/network/resources/set-cookie.php?length=4097. Cookie length should be less than or equal to 4096 characters.
 makeFetch @ VM:62
 (anonymous) @ VM:1
+VM:62 Set-Cookie header is ignored in response from url: http://127.0.0.1:8000/devtools/network/resources/set-two-cookies.php?length=4097. Cookie length should be less than or equal to 4096 characters.
+makeFetch @ VM:62
+(anonymous) @ VM:1
 
diff --git a/third_party/blink/web_tests/http/tests/devtools/network/warning-for-long-cookie.js b/third_party/blink/web_tests/http/tests/devtools/network/warning-for-long-cookie.js
index f9772c83..ad98cc0 100644
--- a/third_party/blink/web_tests/http/tests/devtools/network/warning-for-long-cookie.js
+++ b/third_party/blink/web_tests/http/tests/devtools/network/warning-for-long-cookie.js
@@ -13,10 +13,20 @@
 
   function step1() {
     NetworkTestRunner.makeFetch(
-        'http://127.0.0.1:8000/devtools/network/resources/set-cookie.php?length=4097', {});
+        'http://127.0.0.1:8000/devtools/network/resources/set-cookie.php?length=4097', {}, step2);
   }
 
-  await ConsoleTestRunner.waitForConsoleMessagesPromise(1);
+  function step2() {
+    NetworkTestRunner.makeFetch(
+        'http://127.0.0.1:8000/devtools/network/resources/set-two-cookies.php?length=4097', {}, step3);
+  }
+
+  function step3() {
+    NetworkTestRunner.makeFetch(
+        'http://127.0.0.1:8000/devtools/network/resources/set-two-cookies.php?length=3072', {});
+  }
+
+  await ConsoleTestRunner.waitForConsoleMessagesPromise(2);
 
   ConsoleTestRunner.dumpConsoleMessages();
   TestRunner.completeTest();
diff --git a/third_party/blink/web_tests/http/tests/security/isolatedWorld/isolated-world-send-beacon-csp-expected.txt b/third_party/blink/web_tests/http/tests/security/isolatedWorld/isolated-world-send-beacon-csp-expected.txt
new file mode 100644
index 0000000..558a157
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/security/isolatedWorld/isolated-world-send-beacon-csp-expected.txt
@@ -0,0 +1,11 @@
+CONSOLE MESSAGE: line 13: Testing main world. Request should be blocked by main world CSP.
+CONSOLE ERROR: line 2: Refused to connect to 'http://localhost:8000/security/isolatedWorld/resources/empty.html' because it violates the following Content Security Policy directive: "connect-src 'none'".
+
+CONSOLE MESSAGE: line 18: Testing isolated world with no csp. Request should be blocked by main world CSP.
+CONSOLE ERROR: Refused to connect to 'http://localhost:8000/security/isolatedWorld/resources/empty.html' because it violates the following Content Security Policy directive: "connect-src 'none'".
+
+CONSOLE MESSAGE: line 26: Testing isolated world with permissive csp.
+PingLoader dispatched to 'http://localhost:8000/security/isolatedWorld/resources/empty.html'.
+CONSOLE MESSAGE: line 34: Testing isolated world with strict csp.
+PingLoader dispatched to 'http://localhost:8000/security/isolatedWorld/resources/empty.html'.
+This tests the interaction of sendBeacon command run in the isolated world with the isolated world CSP.
diff --git a/third_party/blink/web_tests/http/tests/security/isolatedWorld/isolated-world-send-beacon-csp.html b/third_party/blink/web_tests/http/tests/security/isolatedWorld/isolated-world-send-beacon-csp.html
new file mode 100644
index 0000000..71f8c22
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/security/isolatedWorld/isolated-world-send-beacon-csp.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta http-equiv="Content-Security-Policy" content="connect-src 'none'">
+<script src="resources/isolated-world-send-beacon-csp.js"></script>
+</head>
+<body id="body">
+    <p>
+        This tests the interaction of sendBeacon command run in the isolated
+        world with the isolated world CSP.
+    </p>
+</body>
+</html>
diff --git a/third_party/blink/web_tests/http/tests/security/isolatedWorld/resources/empty.html b/third_party/blink/web_tests/http/tests/security/isolatedWorld/resources/empty.html
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/security/isolatedWorld/resources/empty.html
diff --git a/third_party/blink/web_tests/http/tests/security/isolatedWorld/resources/isolated-world-send-beacon-csp.js b/third_party/blink/web_tests/http/tests/security/isolatedWorld/resources/isolated-world-send-beacon-csp.js
new file mode 100644
index 0000000..4b451b4
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/security/isolatedWorld/resources/isolated-world-send-beacon-csp.js
@@ -0,0 +1,68 @@
+function testSendBeacon() {
+  navigator.sendBeacon(
+      'http://localhost:8000/security/isolatedWorld/resources/empty.html',
+      'data');
+  window.postMessage('next', '*');
+}
+
+const isolatedWorldId = 1;
+const isolatedWorldSecurityOrigin = 'chrome-extensions://123';
+
+const tests = [
+  function() {
+    console.log(
+        'Testing main world. Request should be blocked by main world CSP.');
+    testSendBeacon();
+  },
+  function() {
+    console.log(
+        'Testing isolated world with no csp. Request should be blocked by main world CSP.');
+    testRunner.setIsolatedWorldInfo(isolatedWorldId, null, null);
+    testRunner.evaluateScriptInIsolatedWorld(
+        isolatedWorldId,
+        String(eval('testSendBeacon')) + '\ntestSendBeacon();');
+  },
+  function() {
+    console.log('Testing isolated world with permissive csp.');
+    testRunner.setIsolatedWorldInfo(
+        isolatedWorldId, isolatedWorldSecurityOrigin, 'connect-src *');
+    testRunner.evaluateScriptInIsolatedWorld(
+        isolatedWorldId,
+        String(eval('testSendBeacon')) + '\ntestSendBeacon();');
+  },
+  function() {
+    console.log('Testing isolated world with strict csp.');
+    testRunner.setIsolatedWorldInfo(
+        isolatedWorldId, isolatedWorldSecurityOrigin, 'connect-src \'self\'');
+    testRunner.evaluateScriptInIsolatedWorld(
+        isolatedWorldId,
+        String(eval('testSendBeacon')) + '\ntestSendBeacon();');
+
+    // Clear the isolated world data.
+    testRunner.setIsolatedWorldInfo(1, null, null);
+  },
+];
+
+// This test is meaningless without testRunner.
+if (window.testRunner) {
+  testRunner.dumpAsText();
+  testRunner.waitUntilDone();
+  testRunner.dumpPingLoaderCallbacks();
+
+  let currentTest = 0;
+  window.addEventListener('message', function(e) {
+    if (e.data == 'next') {
+      // Move to the next test.
+      currentTest++;
+      if (currentTest == tests.length) {
+        testRunner.notifyDone();
+        return;
+      }
+
+      // Move to the next sub-test.
+      tests[currentTest]();
+    }
+  }, false);
+
+  tests[0]();
+}
diff --git a/third_party/blink/web_tests/http/tests/security/referrer-policy-conflicting-policies-font-face-expected.html b/third_party/blink/web_tests/http/tests/security/referrer-policy-conflicting-policies-font-face-expected.html
new file mode 100644
index 0000000..5c68ea1
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/security/referrer-policy-conflicting-policies-font-face-expected.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<style>
+@font-face {
+  font-family: 'Test Font';
+  src: url(http://127.0.0.1:8000/security/resources/opensans.woff2) format('woff2');
+}
+
+body {
+  font-family: 'Test Font';
+}
+</style>
+<body>
+<p>
+Checks that a font face that was created before a referrer policy was set is
+loaded with the correct referrer, in this case, without a referrer.
+</p>
+<p>
+The test passes, a normal font will be loaded.
+</p>
+</body>
diff --git a/third_party/blink/web_tests/http/tests/security/referrer-policy-conflicting-policies-font-face.html b/third_party/blink/web_tests/http/tests/security/referrer-policy-conflicting-policies-font-face.html
new file mode 100644
index 0000000..47ef8b1
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/security/referrer-policy-conflicting-policies-font-face.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<script>
+if (window.testRunner)
+    testRunner.waitUntilDone();
+
+// For documentation on this test, see
+// referrer-policy-conflicting-policies.html.
+document.location = "https://127.0.0.1:8443/security/resources/referrer-policy-conflicting-policies-font-face.html";
+</script>
diff --git a/third_party/blink/web_tests/http/tests/security/referrer-policy-conflicting-policies-image-set-expected.html b/third_party/blink/web_tests/http/tests/security/referrer-policy-conflicting-policies-image-set-expected.html
new file mode 100644
index 0000000..c42f349
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/security/referrer-policy-conflicting-policies-image-set-expected.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<style>
+div {
+    content: -webkit-image-set(url("http://127.0.0.1:8080/security/resources/green250x50.png") 1x);
+}
+</style>
+<body>
+<p>
+Checks that a CSS image that was created from an image-set before a referrer
+policy was set is loaded with the correct referrer, in this case, without a
+referrer.
+</p>
+<p>
+The test passes, if a green rectangle is displayed below.
+</p>
+<div></div>
+</body>
diff --git a/third_party/blink/web_tests/http/tests/security/referrer-policy-conflicting-policies-image-set.html b/third_party/blink/web_tests/http/tests/security/referrer-policy-conflicting-policies-image-set.html
new file mode 100644
index 0000000..e0a896a
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/security/referrer-policy-conflicting-policies-image-set.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<script>
+if (window.testRunner)
+    testRunner.waitUntilDone();
+
+// For documentation on this test, see
+// referrer-policy-conflicting-policies.html.
+document.location = "https://127.0.0.1:8443/security/resources/referrer-policy-conflicting-policies-image-set.html";
+</script>
diff --git a/third_party/blink/web_tests/http/tests/security/referrer-policy-conflicting-policies.html b/third_party/blink/web_tests/http/tests/security/referrer-policy-conflicting-policies.html
index 380d564..25407a3d 100644
--- a/third_party/blink/web_tests/http/tests/security/referrer-policy-conflicting-policies.html
+++ b/third_party/blink/web_tests/http/tests/security/referrer-policy-conflicting-policies.html
@@ -2,5 +2,14 @@
 <script>
 if (window.testRunner)
     testRunner.waitUntilDone();
+
+// The following test works by loading a page over HTTPS, which requests a
+// resource over HTTP when the document has the default referrer policy
+// (interpreted as no-referrer-when-downgrade). After the request is
+// prepared/made, the document's referrer policy is set to 'origin'. The test
+// asserts that the referrer associated with the request when the document's
+// referrer policy was no-referrer-when-downgrade is empty, and not the origin.
+// This test is similar to
+// referrer-policy-conflicting-policies-{font-face,image-set}.html
 document.location = "https://127.0.0.1:8443/security/resources/referrer-policy-conflicting-policies.html";
 </script>
diff --git a/third_party/blink/web_tests/http/tests/security/resources/montez.woff2 b/third_party/blink/web_tests/http/tests/security/resources/montez.woff2
new file mode 100644
index 0000000..8d36846
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/security/resources/montez.woff2
Binary files differ
diff --git a/third_party/blink/web_tests/http/tests/security/resources/normal-font-if-no-referrer.php b/third_party/blink/web_tests/http/tests/security/resources/normal-font-if-no-referrer.php
new file mode 100644
index 0000000..9461235
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/security/resources/normal-font-if-no-referrer.php
@@ -0,0 +1,10 @@
+<?php
+header("Content-Type: font/woff2");
+header("Access-Control-Allow-Origin: *");
+if ($_SERVER['HTTP_REFERER'] != '') {
+    $font = 'montez.woff2';
+} else {
+    $font = 'opensans.woff2';
+}
+echo file_get_contents($font);
+?>
diff --git a/third_party/blink/web_tests/http/tests/security/resources/opensans.woff2 b/third_party/blink/web_tests/http/tests/security/resources/opensans.woff2
new file mode 100644
index 0000000..458c98d
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/security/resources/opensans.woff2
Binary files differ
diff --git a/third_party/blink/web_tests/http/tests/security/resources/referrer-policy-conflicting-policies-font-face.html b/third_party/blink/web_tests/http/tests/security/resources/referrer-policy-conflicting-policies-font-face.html
new file mode 100644
index 0000000..551dcd3
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/security/resources/referrer-policy-conflicting-policies-font-face.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<script>
+function done()
+{
+    if (window.testRunner)
+        testRunner.notifyDone();
+}
+</script>
+<style>
+@font-face {
+  font-family: 'Test Font';
+  src: url("http://127.0.0.1:8080/security/resources/normal-font-if-no-referrer.php") format('woff2');
+}
+
+body {
+  font-family: 'Test Font';
+}
+</style>
+<meta name="referrer" content="origin">
+<body onload="done();">
+<p>
+Checks that a font face that was created before a referrer policy was set is
+loaded with the correct referrer, in this case, without a referrer.
+</p>
+<p>
+The test passes, a normal font will be loaded.
+</p>
+</body>
diff --git a/third_party/blink/web_tests/http/tests/security/resources/referrer-policy-conflicting-policies-image-set.html b/third_party/blink/web_tests/http/tests/security/resources/referrer-policy-conflicting-policies-image-set.html
new file mode 100644
index 0000000..1750b22
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/security/resources/referrer-policy-conflicting-policies-image-set.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<script>
+function done()
+{
+    if (window.testRunner)
+        testRunner.notifyDone();
+}
+</script>
+<style>
+div {
+    content: -webkit-image-set(url("http://127.0.0.1:8080/security/resources/green-if-no-referrer.php") 1x);
+}
+</style>
+<meta name="referrer" content="origin">
+<body onload="done();">
+<p>
+Checks that a CSS image that was created from an image-set before a referrer
+policy was set is loaded with the correct referrer, in this case, without a
+referrer.
+</p>
+<p>
+The test passes, if a green rectangle is displayed below.
+</p>
+<div></div>
+</body>
diff --git a/third_party/blink/web_tests/http/tests/security/resources/referrer-policy-conflicting-policies.html b/third_party/blink/web_tests/http/tests/security/resources/referrer-policy-conflicting-policies.html
index 535cd46..3a38380 100644
--- a/third_party/blink/web_tests/http/tests/security/resources/referrer-policy-conflicting-policies.html
+++ b/third_party/blink/web_tests/http/tests/security/resources/referrer-policy-conflicting-policies.html
@@ -11,7 +11,7 @@
     content: url("http://127.0.0.1:8080/security/resources/green-if-no-referrer.php");
 }
 </style>
-<meta name="referrer" content="origin" />
+<meta name="referrer" content="origin">
 <body onload="done();">
 <p>
 Checks that an CSS image that was created before a referrer policy was set is
diff --git a/third_party/blink/web_tests/images/huge-image-viewport-scale-expected.txt b/third_party/blink/web_tests/images/huge-image-viewport-scale-expected.txt
index c88c52e..e1dd50a 100644
--- a/third_party/blink/web_tests/images/huge-image-viewport-scale-expected.txt
+++ b/third_party/blink/web_tests/images/huge-image-viewport-scale-expected.txt
@@ -4,5 +4,5 @@
 
 
 viewport meta: <meta name="viewport" content="width=device-width, minimum-scale=0.1">
-image style: -webkit-user-select: none;cursor: zoom-in;
+image style: -webkit-user-select: none;margin: auto;cursor: zoom-in;
 image actual width: 100
diff --git a/third_party/blink/web_tests/inspector-protocol/heap-profiler/heap-snapshot-merged-nodes-expected.txt b/third_party/blink/web_tests/inspector-protocol/heap-profiler/heap-snapshot-merged-nodes-expected.txt
index 6f9667f..9440ed04 100644
--- a/third_party/blink/web_tests/inspector-protocol/heap-profiler/heap-snapshot-merged-nodes-expected.txt
+++ b/third_party/blink/web_tests/inspector-protocol/heap-profiler/heap-snapshot-merged-nodes-expected.txt
@@ -2,5 +2,5 @@
 Took heap snapshot
 Parsed snapshot
 SUCCESS: found leaking
-SUCCESS: retaining path = [Detached V8EventListener, Detached EventListener, Detached InternalNode, Detached InternalNode, Detached HTMLDivElement, Window / file://]
+SUCCESS: retaining path = [Detached V8EventListener, Detached EventListener, Detached InternalNode, Detached InternalNode, Detached HTMLDivElement, Window]
 
diff --git a/third_party/blink/web_tests/inspector-protocol/heap-profiler/heap-snapshot-merged-nodes.js b/third_party/blink/web_tests/inspector-protocol/heap-profiler/heap-snapshot-merged-nodes.js
index efbe73c9..2273089 100644
--- a/third_party/blink/web_tests/inspector-protocol/heap-profiler/heap-snapshot-merged-nodes.js
+++ b/third_party/blink/web_tests/inspector-protocol/heap-profiler/heap-snapshot-merged-nodes.js
@@ -1,4 +1,11 @@
 (async function(testRunner) {
+  function normalizedName(node) {
+    if (node.name().includes("::"))
+      return "Detached InternalNode";
+    if (node.name().startsWith("Window /"))
+      return "Window";
+    return node.name();
+  }
   var {page, session, dp} = await testRunner.startBlank(
       `Test that DOM node and its JS wrapper appear as a single node.`);
 
@@ -31,9 +38,7 @@
   else
     return testRunner.fail('cannot find leaking node');
 
-  var retainers = helper.firstRetainingPath(node).map(
-      node => (node.name().includes("::"))
-          ? "Detached InternalNode" : node.name());
+  var retainers = helper.firstRetainingPath(node).map(normalizedName);
   var actual = retainers.join(', ');
   testRunner.log(`SUCCESS: retaining path = [${actual}]`);
   testRunner.completeTest();
diff --git a/third_party/blink/web_tests/inspector-protocol/heap-profiler/heap-snapshot-with-event-listener-expected.txt b/third_party/blink/web_tests/inspector-protocol/heap-profiler/heap-snapshot-with-event-listener-expected.txt
index 6df8e02..a9c20e49 100644
--- a/third_party/blink/web_tests/inspector-protocol/heap-profiler/heap-snapshot-with-event-listener-expected.txt
+++ b/third_party/blink/web_tests/inspector-protocol/heap-profiler/heap-snapshot-with-event-listener-expected.txt
@@ -2,5 +2,5 @@
 Took heap snapshot
 Parsed snapshot
 SUCCESS: found myEventListener
-SUCCESS: retaining path = [V8EventListener, EventListener, InternalNode, InternalNode, HTMLBodyElement, HTMLHtmlElement, HTMLDocument, Window / file://]
+SUCCESS: retaining path = [V8EventListener, EventListener, InternalNode, InternalNode, HTMLBodyElement, HTMLHtmlElement, HTMLDocument, Window]
 
diff --git a/third_party/blink/web_tests/inspector-protocol/heap-profiler/heap-snapshot-with-event-listener.js b/third_party/blink/web_tests/inspector-protocol/heap-profiler/heap-snapshot-with-event-listener.js
index fe52bd97..d3fbb0b6 100644
--- a/third_party/blink/web_tests/inspector-protocol/heap-profiler/heap-snapshot-with-event-listener.js
+++ b/third_party/blink/web_tests/inspector-protocol/heap-profiler/heap-snapshot-with-event-listener.js
@@ -1,4 +1,11 @@
 (async function(testRunner) {
+  function normalizedName(node) {
+    if (node.name().includes("::"))
+      return "Detached InternalNode";
+    if (node.name().startsWith("Window /"))
+      return "Window";
+    return node.name();
+  }
   var {page, session, dp} = await testRunner.startBlank(
       `Test retaining path for an event listener.`);
 
@@ -28,8 +35,7 @@
   else
     return testRunner.fail('cannot find myEventListener node');
 
-  var retainers = helper.firstRetainingPath(node).map(
-      node => (node.name().includes("::")) ? "InternalNode" : node.name());
+  var retainers = helper.firstRetainingPath(node).map(normalizedName);
   var actual = retainers.join(', ');
   testRunner.log(`SUCCESS: retaining path = [${actual}]`);
   testRunner.completeTest();
diff --git a/third_party/blink/web_tests/virtual/isolated_world_csp/http/tests/security/isolatedWorld/isolated-world-send-beacon-csp-expected.txt b/third_party/blink/web_tests/virtual/isolated_world_csp/http/tests/security/isolatedWorld/isolated-world-send-beacon-csp-expected.txt
new file mode 100644
index 0000000..03e20ee
--- /dev/null
+++ b/third_party/blink/web_tests/virtual/isolated_world_csp/http/tests/security/isolatedWorld/isolated-world-send-beacon-csp-expected.txt
@@ -0,0 +1,12 @@
+CONSOLE MESSAGE: line 13: Testing main world. Request should be blocked by main world CSP.
+CONSOLE ERROR: line 2: Refused to connect to 'http://localhost:8000/security/isolatedWorld/resources/empty.html' because it violates the following Content Security Policy directive: "connect-src 'none'".
+
+CONSOLE MESSAGE: line 18: Testing isolated world with no csp. Request should be blocked by main world CSP.
+CONSOLE ERROR: Refused to connect to 'http://localhost:8000/security/isolatedWorld/resources/empty.html' because it violates the following Content Security Policy directive: "connect-src 'none'".
+
+CONSOLE MESSAGE: line 26: Testing isolated world with permissive csp.
+PingLoader dispatched to 'http://localhost:8000/security/isolatedWorld/resources/empty.html'.
+CONSOLE MESSAGE: line 34: Testing isolated world with strict csp.
+CONSOLE ERROR: Refused to connect to 'http://localhost:8000/security/isolatedWorld/resources/empty.html' because it violates the following Content Security Policy directive: "connect-src 'self'".
+
+This tests the interaction of sendBeacon command run in the isolated world with the isolated world CSP.
diff --git a/third_party/blink/web_tests/virtual/layout_ng_experimental/external/wpt/css/css-contain/README.txt b/third_party/blink/web_tests/virtual/layout_ng_experimental/external/wpt/css/css-contain/README.txt
new file mode 100644
index 0000000..18ec75c
--- /dev/null
+++ b/third_party/blink/web_tests/virtual/layout_ng_experimental/external/wpt/css/css-contain/README.txt
@@ -0,0 +1 @@
+LayoutNG experimental css-contain tests.
diff --git a/third_party/blink/web_tests/virtual/layout_ng_experimental/external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/contain/README.txt b/third_party/blink/web_tests/virtual/layout_ng_experimental/external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/contain/README.txt
new file mode 100644
index 0000000..4d933be
--- /dev/null
+++ b/third_party/blink/web_tests/virtual/layout_ng_experimental/external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/contain/README.txt
@@ -0,0 +1,2 @@
+LayoutNG experimental css-contain tests.
+
diff --git a/third_party/blink/web_tests/virtual/stable/webexposed/global-interface-listing-expected.txt b/third_party/blink/web_tests/virtual/stable/webexposed/global-interface-listing-expected.txt
index 91b720791..e69f600 100644
--- a/third_party/blink/web_tests/virtual/stable/webexposed/global-interface-listing-expected.txt
+++ b/third_party/blink/web_tests/virtual/stable/webexposed/global-interface-listing-expected.txt
@@ -5028,6 +5028,7 @@
     getter pendingLocalDescription
     getter pendingRemoteDescription
     getter remoteDescription
+    getter sctp
     getter signalingState
     method addIceCandidate
     method addStream
@@ -5099,6 +5100,15 @@
     method constructor
     method setCodecPreferences
     setter direction
+interface RTCSctpTransport : EventTarget
+    attribute @@toStringTag
+    getter maxChannels
+    getter maxMessageSize
+    getter onstatechange
+    getter state
+    getter transport
+    method constructor
+    setter onstatechange
 interface RTCSessionDescription
     attribute @@toStringTag
     getter sdp
@@ -8614,6 +8624,7 @@
     getter pendingLocalDescription
     getter pendingRemoteDescription
     getter remoteDescription
+    getter sctp
     getter signalingState
     method addIceCandidate
     method addStream
diff --git a/third_party/crashpad/crashpad/snapshot/BUILD.gn b/third_party/crashpad/crashpad/snapshot/BUILD.gn
index 17488a0..0d362c55 100644
--- a/third_party/crashpad/crashpad/snapshot/BUILD.gn
+++ b/third_party/crashpad/crashpad/snapshot/BUILD.gn
@@ -350,7 +350,6 @@
       "crashpad_types/image_annotation_reader_test.cc",
       "elf/elf_image_reader_test.cc",
       "elf/elf_image_reader_test_note.S",
-      "elf/test_exported_symbols.sym",
     ]
   }
 
diff --git a/third_party/libxslt/BUILD.gn b/third_party/libxslt/BUILD.gn
index 5490b18..3850c3c 100644
--- a/third_party/libxslt/BUILD.gn
+++ b/third_party/libxslt/BUILD.gn
@@ -68,7 +68,6 @@
     "src/libxslt/xsltlocale.h",
     "src/libxslt/xsltutils.c",
     "src/libxslt/xsltutils.h",
-    "src/libxslt/xsltwin32config.h.in",
     "win32/config.h",
   ]
 
diff --git a/tools/clang/scripts/update.py b/tools/clang/scripts/update.py
index 073ea24..9d45020 100755
--- a/tools/clang/scripts/update.py
+++ b/tools/clang/scripts/update.py
@@ -36,8 +36,8 @@
 # Do NOT CHANGE this if you don't know what you're doing -- see
 # https://chromium.googlesource.com/chromium/src/+/master/docs/updating_clang.md
 # Reverting problematic clang rolls is safe, though.
-CLANG_REVISION = '361104'
-CLANG_SUB_REVISION = 2
+CLANG_REVISION = '361212'
+CLANG_SUB_REVISION = 1
 
 PACKAGE_VERSION = '%s-%s' % (CLANG_REVISION, CLANG_SUB_REVISION)
 RELEASE_VERSION = '9.0.0'
diff --git a/tools/cygprofile/cluster.py b/tools/cygprofile/cluster.py
index b20372ae..226c334 100644
--- a/tools/cygprofile/cluster.py
+++ b/tools/cygprofile/cluster.py
@@ -11,8 +11,11 @@
 import itertools
 import logging
 
-
 Neighbor = collections.namedtuple('Neighbor', ('src', 'dst', 'dist'))
+CalleeInfo = collections.namedtuple('CalleeInfo',
+                                    ('index', 'callee_symbol',
+                                     'misses', 'caller_and_count'))
+CallerInfo = collections.namedtuple('CallerInfo', ('caller_symbol', 'count'))
 
 
 class Clustering(object):
@@ -86,6 +89,12 @@
     c.AddSymbolLists(sym_lists)
     return c.ClusterToList(size_map)
 
+  @classmethod
+  def ClusterSymbolCallGraph(cls, call_graph, whitelist):
+    c = cls()
+    c.AddSymbolCallGraph(call_graph, whitelist)
+    return c.ClusterToList()
+
   def __init__(self):
     self._num_lists = None
     self._neighbors = None
@@ -127,6 +136,39 @@
     self._neighbors = self._CoalesceNeighbors(
         self._ConstructNeighbors(sym_lists))
 
+  def AddSymbolCallGraph(self, call_graph, whitelist):
+    self._num_lists = len(call_graph)
+    self._neighbors = self._ConstructNeighborsFromGraph(call_graph, whitelist)
+
+  def _ConstructNeighborsFromGraph(self, call_graph, whitelist):
+    neighbors = []
+    pairs = collections.defaultdict()
+    # Each list item is a list of dict.
+    for process_items in call_graph:
+      for callee_info in process_items:
+        callee = callee_info.callee_symbol
+        for caller_info in callee_info.caller_and_count:
+          caller = caller_info.caller_symbol
+          if caller in whitelist or callee == caller:
+            continue
+
+          # Multiply by -1, the biggest the count the smaller the distance
+          # should be.
+          dist = caller_info.count * -1
+          if (caller, callee) in pairs:
+            pairs[(caller, callee)] += dist
+          elif (callee, caller) in pairs:
+            pairs[(callee, caller)] += dist
+          else:
+            pairs[(caller, callee)] = dist
+
+    for (s, t) in pairs:
+      assert s != t and (t, s) not in pairs, ('Unexpected shuffled pair:'
+                                              ' ({}, {})'.format(s, t))
+      neighbors.append(Neighbor(s, t, pairs[(s, t)]))
+
+    return neighbors
+
   def _ConstructNeighbors(self, sym_lists):
     neighbors = []
     for sym_list in sym_lists:
@@ -219,17 +261,99 @@
     assert len(ordered_syms) == len(set(ordered_syms)), 'Duplicated symbols!'
     return ordered_syms
 
+def _GetOffsetSymbolName(processor, dump_offset):
+  dump_offset_to_symbol_info = \
+    processor.GetDumpOffsetToSymboInfolIncludingWhitelist()
+  offset_to_primary = processor.OffsetToPrimaryMap()
+  idx = dump_offset / 2
+  assert dump_offset >= 0 and idx < len(dump_offset_to_symbol_info), (
+      'Dump offset out of binary range')
+  symbol_info = dump_offset_to_symbol_info[idx]
+  assert symbol_info, ('A return address (offset = 0x{:08x}) does not map '
+                       'to any symbol'.format(dump_offset))
+  assert symbol_info.offset in offset_to_primary, (
+      'Offset not found in primary map!')
+  return offset_to_primary[symbol_info.offset].name
 
-def ClusterOffsets(profiles, processor, limit_cluster_size=False):
-  """Cluster profile offsets.
+def _GetSymbolsCallGraph(profiles, processor):
+  """Maps each offset in the call graph to the corresponding symbol name.
 
   Args:
     profiles (ProfileManager) Manager of the profile dump files.
     processor (SymbolOffsetProcessor) Symbol table processor for the dumps.
 
   Returns:
-    A list of clustered symbol offsets.
+    A dict that maps each process type (ex: browser, renderer, etc.) to a list
+    of processes of that type. Each process is a list that contains the
+    call graph information. The call graph is represented by a list where each
+    item is a dict that contains: callee, 3 caller-count pairs, misses.
   """
+  offsets_graph = profiles.GetProcessOffsetGraph();
+  process_symbols_graph = collections.defaultdict(list)
+
+  # |process_type| can be : browser, renderer...etc.
+  for process_type in offsets_graph:
+    for process in offsets_graph[process_type]:
+      process = sorted(process, key=lambda k: long(k['index']))
+      graph_list = []
+      for el in process:
+        index = long(el['index'])
+        callee_symbol = _GetOffsetSymbolName(processor,
+                                             long(el['callee_offset']))
+        misses = 0
+        caller_and_count = []
+        for bucket in el['caller_and_count']:
+          caller_offset = long(bucket['caller_offset'])
+          count = long(bucket['count'])
+          if caller_offset == 0:
+            misses = count
+            continue
+
+          caller_symbol_name = _GetOffsetSymbolName(processor, caller_offset)
+          caller_info = CallerInfo(caller_symbol=caller_symbol_name,
+                                   count=count)
+          caller_and_count.append(caller_info)
+
+        callee_info = CalleeInfo(index=index,
+                                 callee_symbol=callee_symbol,
+                                 misses=misses,
+                                 caller_and_count=caller_and_count)
+        graph_list.append(callee_info)
+      process_symbols_graph[process_type].append(graph_list)
+  return process_symbols_graph
+
+def _ClusterOffsetsFromCallGraph(profiles, processor):
+  symbols_call_graph = _GetSymbolsCallGraph(profiles, processor)
+  # Process names from the profile dumps that are treated specially.
+  _RENDERER = 'renderer'
+  _BROWSER = 'browser'
+
+  assert _RENDERER in symbols_call_graph
+  assert _BROWSER in symbols_call_graph
+  whitelist = processor.GetWhitelistSymbols()
+  renderer_clustering = Clustering.ClusterSymbolCallGraph(
+      symbols_call_graph[_RENDERER], whitelist)
+  browser_clustering = Clustering.ClusterSymbolCallGraph(
+      symbols_call_graph[_BROWSER], whitelist)
+  other_lists = []
+  for process in symbols_call_graph:
+    if process not in (_RENDERER, _BROWSER):
+      other_lists.extend(symbols_call_graph[process])
+  if other_lists:
+    other_clustering = Clustering.ClusterSymbolCallGraph(other_lists, whitelist)
+  else:
+    other_clustering = []
+
+  # Start with the renderer cluster to favor rendering performance.
+  final_ordering = [s for s in renderer_clustering]
+  seen = set(final_ordering)
+  final_ordering.extend(s for s in browser_clustering if s not in seen)
+  seen |= set(browser_clustering)
+  final_ordering.extend(s for s in other_clustering if s not in seen)
+
+  return final_ordering
+
+def _ClusterOffsetsLists(profiles, processor, limit_cluster_size=False):
   raw_offsets = profiles.GetProcessOffsetLists()
   process_symbols = collections.defaultdict(list)
   seen_symbols = set()
@@ -273,3 +397,20 @@
   final_ordering.extend(s for s in other_clustering if s not in seen)
 
   return final_ordering
+
+def ClusterOffsets(profiles, processor, limit_cluster_size=False,
+                   call_graph=False):
+  """Cluster profile offsets.
+
+  Args:
+    profiles (ProfileManager) Manager of the profile dump files.
+    processor (SymbolOffsetProcessor) Symbol table processor for the dumps.
+    call_graph (bool) whether the call graph instrumentation was used.
+
+  Returns:
+    A list of clustered symbol offsets.
+"""
+  if not call_graph:
+    return _ClusterOffsetsLists(profiles, processor, limit_cluster_size)
+  else:
+    return _ClusterOffsetsFromCallGraph(profiles, processor)
diff --git a/tools/cygprofile/cluster_unittest.py b/tools/cygprofile/cluster_unittest.py
index 249811c..6b7813d 100755
--- a/tools/cygprofile/cluster_unittest.py
+++ b/tools/cygprofile/cluster_unittest.py
@@ -6,6 +6,7 @@
 """Tests for cluster.py."""
 
 import unittest
+import json
 
 import cluster
 import process_profiles
@@ -103,7 +104,6 @@
                       list('badf'), list('baef')])
     self.assertEqual(list('fedcba'), c.ClusterToList(size_map))
 
-
   def testClusterOffsets(self):
     processor = TestSymbolOffsetProcessor([
         SimpleTestSymbol('linker_script_start_of_text', 0, 0),
@@ -124,12 +124,239 @@
         ProfileFile(51, 1, 'gpu-process'): [6000, 7000],
         ProfileFile(70, 0, ''): [1000, 2000, 6000, 8000, 9000],
         ProfileFile(70, 1, ''): [9000, 5000, 3000]})
-    syms = cluster.ClusterOffsets(mgr, processor, False)
+    syms = cluster.ClusterOffsets(mgr, processor, limit_cluster_size=False)
     self.assertListEqual(list('236148957'), syms)
 
-    syms = cluster.ClusterOffsets(mgr, processor, True)
+    syms = cluster.ClusterOffsets(mgr, processor, limit_cluster_size=True)
     self.assertListEqual(list('236489517'), syms)
 
+  def testClusteringDistancesForCallGraph(self):
+    c = cluster.Clustering()
+    callerA = cluster.CallerInfo(caller_symbol='a', count=1)
+    callerB = cluster.CallerInfo(caller_symbol='b', count=2)
+    callerC = cluster.CallerInfo(caller_symbol='c', count=3)
+    callerD = cluster.CallerInfo(caller_symbol='d', count=100)
+    callerE = cluster.CallerInfo(caller_symbol='e', count=200)
+
+    calleeA = cluster.CalleeInfo(index=4, callee_symbol='a', misses=0,
+                                 caller_and_count=[])
+    calleeB = cluster.CalleeInfo(index=8, callee_symbol='b', misses=1,
+                                 caller_and_count=[callerA])
+    calleeC = cluster.CalleeInfo(index=12, callee_symbol='c', misses=1,
+                                 caller_and_count=[callerA, callerE])
+    calleeD = cluster.CalleeInfo(index=20, callee_symbol='d', misses=1,
+                                 caller_and_count=[callerB, callerC, callerE])
+    calleeF = cluster.CalleeInfo(index=28, callee_symbol='f', misses=10,
+                                 caller_and_count=[callerD])
+    process1 = [calleeA, calleeB, calleeC, calleeD]
+    process2 = [calleeA, calleeB, calleeC, calleeD, calleeF]
+    call_graph = [process1, process2]
+    whitelist = ['e', 'g', 'h', 'k', 'l']
+    c.AddSymbolCallGraph(call_graph, whitelist)
+    distances = {}
+    for n in c._neighbors:
+      self.assertFalse((n.src, n.dst) in distances)
+      distances[(n.src, n.dst)] = n.dist
+    self.assertEqual(5, len(distances))
+    self.assertEquals(-2, distances[('a', 'b')])
+    self.assertEquals(-2, distances[('a', 'c')])
+    self.assertEquals(-4, distances[('b', 'd')])
+    self.assertEquals(-6, distances[('c', 'd')])
+    self.assertEquals(-100, distances[('d', 'f')])
+    self.assertEquals(list('abcdf'), c.ClusterToList())
+
+  def testClusterOffsetsFromCallGraph(self):
+    process1 = ('{"call_graph": [ {'
+                  '"callee_offset": "1000",'
+                  '"caller_and_count": [ {'
+                    '"caller_offset": "0",'
+                    '"count": "2"'
+                  '} ],'
+                  '"index": "61496"'
+                '}, {'
+                  '"callee_offset": "7000",'
+                  '"caller_and_count": [ {'
+                    '"caller_offset": "1000",'
+                    '"count": "2"'
+                  '}, {'
+                    '"caller_offset": "7500",'
+                    '"count": "100"'
+                  '} ],'
+                  '"index": "61500"'
+                '}, {'
+                  '"callee_offset": "6000",'
+                  '"caller_and_count": [ {'
+                    '"caller_offset": "1000",'
+                    '"count": "4"'
+                  '}, {'
+                    '"caller_offset": "7000",'
+                    '"count": "3"'
+                  '}, {'
+                    '"caller_offset": "7500",'
+                    '"count": "2"'
+                  '}, {'
+                    '"caller_offset": "0",'
+                    '"count": "3"'
+                  '} ],'
+                  '"index": "47860"'
+                '}, {'
+                  '"callee_offset": "3000",'
+                  '"caller_and_count": [ {'
+                    '"caller_offset": "6000",'
+                    '"count": "11"'
+                  '} ],'
+                  '"index": "47900"'
+                '} ],'
+                '"total_calls_count": "127"'
+                '}')
+
+    process2 = ('{"call_graph": [ {'
+                  '"callee_offset": "1000",'
+                  '"caller_and_count": [ {'
+                    '"caller_offset": "0",'
+                    '"count": "2"'
+                  '} ],'
+                  '"index": "61496"'
+                  '}, {'
+                  '"callee_offset": "5000",'
+                  '"caller_and_count": [ {'
+                    '"caller_offset": "1000",'
+                    '"count": "20"'
+                  '}, {'
+                    '"caller_offset": "5000",'
+                    '"count": "100"'
+                  '}, {'
+                    '"caller_offset": "3000",'
+                    '"count": "40"'
+                  '} ],'
+                  '"index": "61500"'
+                '}, {'
+                  '"callee_offset": "3000",'
+                  '"caller_and_count": [ {'
+                    '"caller_offset": "5000",'
+                    '"count": "10"'
+                  '}, {'
+                    '"caller_offset": "0",'
+                    '"count": "10"'
+                  '} ],'
+                  '"index": "47860"'
+                '} ],'
+                '"total_calls_count": "182"'
+                '}')
+
+    process3 = ('{"call_graph": [ {'
+                  '"callee_offset": "8000",'
+                  '"caller_and_count": [ {'
+                    '"caller_offset": "0",'
+                    '"count": "5"'
+                  '} ],'
+                  '"index": "61496"'
+                  '}, {'
+                  '"callee_offset": "2000",'
+                  '"caller_and_count": [ {'
+                    '"caller_offset": "8000",'
+                    '"count": "100"'
+                  '} ],'
+                  '"index": "61500"'
+                  '}, {'
+                  '"callee_offset": "4000",'
+                  '"caller_and_count": [ {'
+                    '"caller_offset": "8000",'
+                    '"count": "20"'
+                  '} ],'
+                  '"index": "61504"'
+                  '}, {'
+                  '"callee_offset": "9000",'
+                  '"caller_and_count": [ {'
+                    '"caller_offset": "8000",'
+                    '"count": "50"'
+                  '} ],'
+                  '"index": "61512"'
+                  '}, {'
+                  '"callee_offset": "7000",'
+                  '"caller_and_count": [ {'
+                    '"caller_offset": "2000",'
+                    '"count": "15"'
+                  '}, {'
+                    '"caller_offset": "4000",'
+                    '"count": "20"'
+                  '}, {'
+                    '"caller_offset": "9000",'
+                    '"count": "80"'
+                  '}, {'
+                    '"caller_offset": "0",'
+                    '"count": "400"'
+                  '} ],'
+                  '"index": "61516"'
+                  '} ],'
+                  '"total_calls_count": "690"'
+                  '}')
+
+    process4 = ('{"call_graph": [ {'
+                '"callee_offset": "8000",'
+                '"caller_and_count": [ {'
+                  '"caller_offset": "0",'
+                  '"count": "10"'
+                '} ],'
+                '"index": "61496"'
+                '}, {'
+                '"callee_offset": "2000",'
+                '"caller_and_count": [ {'
+                  '"caller_offset": "8000",'
+                  '"count": "100"'
+                '} ],'
+                '"index": "61500"'
+                '}, {'
+                '"callee_offset": "6000",'
+                '"caller_and_count": [ {'
+                  '"caller_offset": "7000",'
+                  '"count": "10"'
+                '} , {'
+                  '"caller_offset": "7500",'
+                  '"count": "2"'
+                '} ],'
+                '"index": "61504"'
+                '}, {'
+                '"callee_offset": "7000",'
+                '"caller_and_count": [ {'
+                  '"caller_offset": "8000",'
+                  '"count": "300"'
+                '}, {'
+                  '"caller_offset": "7500",'
+                  '"count": "100"'
+                '}, {'
+                  '"caller_offset": "2000",'
+                  '"count": "15"'
+                '}, {'
+                  '"caller_offset": "0",'
+                  '"count": "50"'
+                '} ],'
+                '"index": "61516"'
+                '} ],'
+                '"total_calls_count": "587"'
+                '}')
+
+    processor = TestSymbolOffsetProcessor([
+        SimpleTestSymbol('linker_script_start_of_text', 0, 0),
+        SimpleTestSymbol('1', 1000, 999),
+        SimpleTestSymbol('2', 2000, 999),
+        SimpleTestSymbol('3', 3000, 999),
+        SimpleTestSymbol('4', 4000, 16),
+        SimpleTestSymbol('5', 5000, 16),
+        SimpleTestSymbol('6', 6000, 999),
+        SimpleTestSymbol('7', 7000, 16),
+        SimpleTestSymbol('8', 7100, 0),  # whitelist
+        SimpleTestSymbol('9', 8000, 999),
+        SimpleTestSymbol('10', 9000, 16)])
+    mgr = TestProfileManager({
+        ProfileFile(40, 0, 'renderer'): json.loads(process1),
+        ProfileFile(50, 1, 'renderer'): json.loads(process2),
+        ProfileFile(51, 0, 'browser'): json.loads(process3),
+        ProfileFile(51, 1, 'gpu-process'): json.loads(process4)})
+    syms = cluster.ClusterOffsets(mgr, processor, limit_cluster_size=False,
+                                  call_graph=True)
+    self.assertListEqual(['7', '6', '1', '5', '3', '9', '2', '10', '4'], syms)
+
 
 
 if __name__ == "__main__":
diff --git a/tools/cygprofile/orderfile_generator_backend.py b/tools/cygprofile/orderfile_generator_backend.py
index 3a137584..2c791b5 100755
--- a/tools/cygprofile/orderfile_generator_backend.py
+++ b/tools/cygprofile/orderfile_generator_backend.py
@@ -273,14 +273,17 @@
         '{}.so'.format(self._libname))
     self.chrome_apk = os.path.join(self._out_dir, 'Release', 'apks', self._apk)
 
-  def Build(self, instrumented, target):
+  def Build(self, instrumented, use_call_graph, target):
     """Builds the provided ninja target with or without order_profiling on.
 
     Args:
       instrumented: (bool) Whether we want to build an instrumented binary.
+      use_call_graph: (bool) Whether to use the call graph instrumentation.
       target: (str) The name of the ninja target to build.
     """
     self._step_recorder.BeginStep('Compile %s' % target)
+    assert not use_call_graph or instrumented, ('You can not enable call graph '
+                                                'without instrumentation!')
 
     # Set the "Release Official" flavor, the parts affecting performance.
     args = [
@@ -291,6 +294,7 @@
         'target_os="android"',
         'use_goma=' + str(self._use_goma).lower(),
         'use_order_profiling=' + str(instrumented).lower(),
+        'use_call_graph=' + str(use_call_graph).lower(),
     ]
     args += _ARCH_GN_ARGS[self._arch]
     if self._goma_dir:
@@ -313,27 +317,29 @@
         ['ninja', '-C', os.path.join(self._out_dir, 'Release'),
          '-j' + str(self._jobs), '-l' + str(self._max_load), target])
 
-  def CompileChromeApk(self, instrumented, force_relink=False):
+  def CompileChromeApk(self, instrumented, use_call_graph, force_relink=False):
     """Builds a Chrome.apk either with or without order_profiling on.
 
     Args:
       instrumented: (bool) Whether to build an instrumented apk.
+      use_call_graph: (bool) Whether to use the call graph instrumentation.
       force_relink: Whether libchromeview.so should be re-created.
     """
     if force_relink:
       self._step_recorder.RunCommand(['rm', '-rf', self.lib_chrome_so])
-    self.Build(instrumented, self._apk_target)
+    self.Build(instrumented, use_call_graph, self._apk_target)
 
-  def CompileLibchrome(self, instrumented, force_relink=False):
+  def CompileLibchrome(self, instrumented, use_call_graph, force_relink=False):
     """Builds a libchrome.so either with or without order_profiling on.
 
     Args:
       instrumented: (bool) Whether to build an instrumented apk.
+      use_call_graph: (bool) Whether to use the call graph instrumentation.
       force_relink: (bool) Whether libchrome.so should be re-created.
     """
     if force_relink:
       self._step_recorder.RunCommand(['rm', '-rf', self.lib_chrome_so])
-    self.Build(instrumented, self._libchrome_target)
+    self.Build(instrumented, use_call_graph, self._libchrome_target)
 
 
 class OrderfileUpdater(object):
@@ -567,9 +573,11 @@
 
   def __init__(self, options, orderfile_updater_class):
     self._options = options
-
     self._instrumented_out_dir = os.path.join(
         self._BUILD_ROOT, self._options.arch + '_instrumented_out')
+    if self._options.use_call_graph:
+        self._instrumented_out_dir += '_call_graph'
+
     self._uninstrumented_out_dir = os.path.join(
         self._BUILD_ROOT, self._options.arch + '_uninstrumented_out')
     self._no_orderfile_out_dir = os.path.join(
@@ -677,7 +685,8 @@
     profiles = process_profiles.ProfileManager(files)
     processor = process_profiles.SymbolOffsetProcessor(
         self._compiler.lib_chrome_so)
-    ordered_symbols = cluster.ClusterOffsets(profiles, processor)
+    ordered_symbols = cluster.ClusterOffsets(profiles, processor,
+        call_graph=self._options.use_call_graph)
     if not ordered_symbols:
       raise Exception('Failed to get ordered symbols')
     for sym in ordered_symbols:
@@ -945,7 +954,9 @@
         open(orderfile_path, 'w').close()
 
       # Build APK to be installed on the device.
-      self._compiler.CompileChromeApk(False, force_relink=True)
+      self._compiler.CompileChromeApk(instrumented=False,
+                                      use_call_graph=False,
+                                      force_relink=True)
       benchmark_results = dict()
       benchmark_results['Speedometer2.0'] = self._PerformanceBenchmark(
           self._compiler.chrome_apk)
@@ -991,7 +1002,9 @@
           # If there are pregenerated profiles, the instrumented build should
           # not be changed to avoid invalidating the pregenerated profile
           # offsets.
-          self._compiler.CompileChromeApk(True)
+          self._compiler.CompileChromeApk(instrumented=True,
+                                          use_call_graph=
+                                          self._options.use_call_graph)
         self._GenerateAndProcessProfile()
         self._MaybeArchiveOrderfile(self._GetUnpatchedOrderfileFilename())
         profile_uploaded = True
@@ -1026,14 +1039,17 @@
             self._options.system_health_orderfile, self._monochrome,
             self._options.public, self._GetPathToOrderfile())
 
-        self._compiler.CompileLibchrome(False)
+        self._compiler.CompileLibchrome(instrumented=False,
+                                        use_call_graph=False)
         self._PatchOrderfile()
         # Because identical code folding is a bit different with and without
         # the orderfile build, we need to re-patch the orderfile with code
         # folding as close to the final version as possible.
-        self._compiler.CompileLibchrome(False, force_relink=True)
+        self._compiler.CompileLibchrome(instrumented=False,
+                                        use_call_graph=False, force_relink=True)
         self._PatchOrderfile()
-        self._compiler.CompileLibchrome(False, force_relink=True)
+        self._compiler.CompileLibchrome(instrumented=False,
+                                        use_call_graph=False, force_relink=True)
         self._VerifySymbolOrder()
         self._MaybeArchiveOrderfile(self._GetPathToOrderfile())
       finally:
@@ -1175,7 +1191,8 @@
                             'checkout; performs no other action'))
   parser.add_argument('--new-commit-flow', action='store_true',
                       help='Use the new two-step commit flow.')
-
+  parser.add_argument('--use-call-graph', action='store_true', default=False,
+                      help='Use call graph instrumentation.')
   profile_android_startup.AddProfileCollectionArguments(parser)
   return parser
 
diff --git a/tools/cygprofile/process_profiles.py b/tools/cygprofile/process_profiles.py
index 368ea72..45e0f0d 100755
--- a/tools/cygprofile/process_profiles.py
+++ b/tools/cygprofile/process_profiles.py
@@ -11,6 +11,7 @@
 import operator
 import os
 import sys
+import json
 
 _SRC_PATH = os.path.abspath(os.path.join(
     os.path.dirname(__file__), os.pardir, os.pardir))
@@ -59,6 +60,8 @@
     self._offset_to_primary = None
     self._offset_to_symbols = None
     self._offset_to_symbol_info = None
+    # |_whitelist| will contain symbols whose size is 0.
+    self._whitelist = None
 
   def SymbolInfos(self):
     """The symbols associated with this processor's binary.
@@ -243,6 +246,45 @@
           'to any symbol'.format(dump_offset))
       update(i, symbol_info.offset)
 
+  def GetWhitelistSymbols(self):
+    """Returns list(string) containing names of the symbols whose size is zero.
+    """
+    if self._whitelist is None:
+      self.GetDumpOffsetToSymboInfolIncludingWhitelist()
+    return self._whitelist
+
+  def GetDumpOffsetToSymboInfolIncludingWhitelist(self):
+    """Computes an array mapping each word in .text to a symbol.
+
+    This list includes symbols with size 0. It considers all offsets till the
+    next symbol to map to the symbol of size 0.
+
+    Returns:
+      [symbol_extractor.SymbolInfo or None] For every 4 bytes of the .text
+        section, maps it to a symbol, or None.
+    """
+    if self._whitelist is None:
+      self._whitelist = set()
+      symbols = self.SymbolInfos()
+      start_syms = [s for s in symbols
+                    if s.name == cygprofile_utils.START_OF_TEXT_SYMBOL]
+      assert len(start_syms) == 1, 'Can\'t find unique start of text symbol'
+      start_of_text = start_syms[0].offset
+      self.GetDumpOffsetToSymbolInfo()
+      max_idx = len(self._offset_to_symbol_info)
+      for sym in symbols:
+        if sym.size != 0 or sym.offset == start_of_text:
+          continue
+        self._whitelist.add(sym.name)
+        idx = (sym.offset - start_of_text)/ 2
+        assert self._offset_to_symbol_info[idx] == sym, (
+            'Unexpected unset offset')
+        idx += 1
+        while idx < max_idx and self._offset_to_symbol_info[idx] is None:
+          self._offset_to_symbol_info[idx] = sym
+          idx += 1
+    return self._offset_to_symbol_info
+
   def GetDumpOffsetToSymbolInfo(self):
     """Computes an array mapping each word in .text to a symbol.
 
@@ -273,6 +315,13 @@
           # code). In this case, keep the one that started first.
           if other_symbol is None or other_symbol.offset > sym.offset:
             self._offset_to_symbol_info[i] = sym
+
+        if sym.name != cygprofile_utils.START_OF_TEXT_SYMBOL and sym.size == 0:
+          idx = offset / 2
+          assert (self._offset_to_symbol_info[idx] is None or
+                  self._offset_to_symbol_info[idx].size == 0), (
+              'Unexpected symbols overlapping')
+          self._offset_to_symbol_info[idx] = sym
     return self._offset_to_symbol_info
 
 
@@ -429,6 +478,32 @@
       offsets_by_process[self._ProcessName(f)].append(self._ReadOffsets(f))
     return offsets_by_process
 
+  def _SanityCheckAllCallsCapturedByTheInstrumentation(self, process_info):
+    total_calls_count = long(process_info['total_calls_count'])
+    call_graph = process_info['call_graph']
+    count = 0
+    for el in call_graph:
+      for bucket in el['caller_and_count']:
+        count += long(bucket['count'])
+
+    assert total_calls_count == count, ('Instrumentation missed calls!. '
+                                        '{} != {}').format(total_calls_count,
+                                                           count)
+
+  def GetProcessOffsetGraph(self):
+    """Returns a dict that maps each process type to a list of processes's
+       call graph data.
+    """
+    graph_by_process = collections.defaultdict(list)
+    for f in self._filenames:
+      process_info = self._ReadJSON(f)
+      assert ('total_calls_count' in process_info
+              and 'call_graph' in process_info), ('Unexpected JSON format for '
+                                                  '%s.' % f)
+      self._SanityCheckAllCallsCapturedByTheInstrumentation(process_info)
+      graph_by_process[self._ProcessName(f)].append(process_info['call_graph'])
+    return graph_by_process
+
   def GetRunGroupOffsets(self, phase=None):
     """Merges files from each run group and returns offset list for each.
 
@@ -479,6 +554,11 @@
   def _ReadOffsets(self, filename):
     return [int(x.strip()) for x in open(filename)]
 
+  def _ReadJSON(self, filename):
+    with open(filename) as f:
+      file_content = json.load(f)
+    return file_content
+
   def _ComputeRunGroups(self):
     self._run_groups = []
     for f in self._filenames:
diff --git a/tools/cygprofile/test_utils.py b/tools/cygprofile/test_utils.py
index 6aacbc9..a9451a4 100644
--- a/tools/cygprofile/test_utils.py
+++ b/tools/cygprofile/test_utils.py
@@ -29,6 +29,9 @@
   def _ReadOffsets(self, filename):
     return self._filecontents_mapping[filename]
 
+  def _ReadJSON(self, filename):
+    return self._filecontents_mapping[filename]
+
 
 def ProfileFile(timestamp_sec, phase, process_name=None):
   global _FILE_COUNTER
diff --git a/tools/grit/grit_rule.gni b/tools/grit/grit_rule.gni
index 0e1dc9f..00918121 100644
--- a/tools/grit/grit_rule.gni
+++ b/tools/grit/grit_rule.gni
@@ -460,7 +460,12 @@
 
     # Since we generate a file, we need to be run before the targets that
     # depend on us.
+    set_sources_assignment_filter([
+                                    "*.json",
+                                    "*.pak",
+                                  ])
     sources = grit_outputs
+    set_sources_assignment_filter(sources_assignment_filter)
 
     # Deps set on the template invocation will go on the action that runs
     # grit above rather than this library. This target needs to depend on the
diff --git a/tools/json_schema_compiler/feature_compiler.py b/tools/json_schema_compiler/feature_compiler.py
index 1ee0478..5ab30e9dd 100644
--- a/tools/json_schema_compiler/feature_compiler.py
+++ b/tools/json_schema_compiler/feature_compiler.py
@@ -179,6 +179,7 @@
           'platform_app': 'Manifest::TYPE_PLATFORM_APP',
           'shared_module': 'Manifest::TYPE_SHARED_MODULE',
           'theme': 'Manifest::TYPE_THEME',
+          'login_screen_extension': 'Manifest::TYPE_LOGIN_SCREEN_EXTENSION',
         },
         'allow_all': True
       },
diff --git a/tools/json_schema_compiler/test/features_generation_unittest.cc b/tools/json_schema_compiler/test/features_generation_unittest.cc
index 32dfaad..64e363e 100644
--- a/tools/json_schema_compiler/test/features_generation_unittest.cc
+++ b/tools/json_schema_compiler/test/features_generation_unittest.cc
@@ -195,10 +195,13 @@
                            Feature::WEB_PAGE_CONTEXT,
                            Feature::WEBUI_CONTEXT,
                            Feature::UNBLESSED_EXTENSION_CONTEXT};
-    comparator.extension_types = {
-        Manifest::TYPE_EXTENSION,           Manifest::TYPE_HOSTED_APP,
-        Manifest::TYPE_LEGACY_PACKAGED_APP, Manifest::TYPE_PLATFORM_APP,
-        Manifest::TYPE_SHARED_MODULE,       Manifest::TYPE_THEME};
+    comparator.extension_types = {Manifest::TYPE_EXTENSION,
+                                  Manifest::TYPE_HOSTED_APP,
+                                  Manifest::TYPE_LEGACY_PACKAGED_APP,
+                                  Manifest::TYPE_PLATFORM_APP,
+                                  Manifest::TYPE_SHARED_MODULE,
+                                  Manifest::TYPE_THEME,
+                                  Manifest::TYPE_LOGIN_SCREEN_EXTENSION};
     comparator.channel = version_info::Channel::BETA;
     comparator.CompareFeature(feature);
   }
diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index 2e908fbe..a02fb6b 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml
@@ -29506,6 +29506,7 @@
   <int value="90" label="INLINE_UPDATE_FAILED_INFOBAR_ANDROID"/>
   <int value="91" label="FLASH_DEPRECATION_INFOBAR_DELEGATE"/>
   <int value="92" label="SEND_TAB_TO_SELF_INFOBAR_DELEGATE"/>
+  <int value="93" label="TAB_SHARING_INFOBAR_DELEGATE"/>
 </enum>
 
 <enum name="InfoBarResponse">
@@ -57109,6 +57110,7 @@
 <enum name="UsbPrinterSetupSource">
   <int value="0" label="Settings"/>
   <int value="1" label="Print Preview"/>
+  <int value="2" label="Automatic"/>
 </enum>
 
 <enum name="UsedInDraw">
@@ -58727,6 +58729,7 @@
   <int value="7" label="UserInstallDeclined"/>
   <int value="8" label="InstallManagerDestroyed"/>
   <int value="9" label="WindowOpened"/>
+  <int value="10" label="NotValidManifestForWebApp"/>
 </enum>
 
 <enum name="WebAppInstallSource">
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 37f19bd..556d795 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -2565,6 +2565,31 @@
   </summary>
 </histogram>
 
+<histogram name="Android.NativeBackgroundTask.TaskFinished.FullBrowser"
+    enum="BackgroundTaskId" expires_after="2020-05-14">
+  <owner>mheikal@chromium.org</owner>
+  <owner>hanxi@chromium.org</owner>
+  <owner>hnakashima@chromium.org</owner>
+  <summary>
+    Records that a specific native background task started in Full Browser Mode
+    has finished cleanly. See Android.NativeBackgroundTask.TaskFinished for more
+    details.
+  </summary>
+</histogram>
+
+<histogram name="Android.NativeBackgroundTask.TaskFinished.ReducedMode"
+    enum="BackgroundTaskId" expires_after="2020-05-14">
+  <owner>mheikal@chromium.org</owner>
+  <owner>hanxi@chromium.org</owner>
+  <owner>hnakashima@chromium.org</owner>
+  <summary>
+    Records that a specific native background task started in Reduced Mode has
+    finished cleanly. It is possible that Full Browser has launched while the
+    task was running. See Android.NativeBackgroundTask.TaskFinished for more
+    details.
+  </summary>
+</histogram>
+
 <histogram name="Android.NativeBackgroundTask.TaskStarted"
     enum="BackgroundTaskId" expires_after="2019-08-01">
   <owner>mheikal@chromium.org</owner>
@@ -2578,6 +2603,28 @@
   </summary>
 </histogram>
 
+<histogram name="Android.NativeBackgroundTask.TaskStarted.FullBrowser"
+    enum="BackgroundTaskId" expires_after="2020-05-14">
+  <owner>mheikal@chromium.org</owner>
+  <owner>hanxi@chromium.org</owner>
+  <owner>hnakashima@chromium.org</owner>
+  <summary>
+    Records that a specific native background task has been started in Full
+    Browser Mode. See Android.NativeBackgroundTask.TaskStarted for more details.
+  </summary>
+</histogram>
+
+<histogram name="Android.NativeBackgroundTask.TaskStarted.ReducedMode"
+    enum="BackgroundTaskId" expires_after="2020-05-14">
+  <owner>mheikal@chromium.org</owner>
+  <owner>hanxi@chromium.org</owner>
+  <owner>hnakashima@chromium.org</owner>
+  <summary>
+    Records that a specific native background task has been started in Reduced
+    Mode. See Android.NativeBackgroundTask.TaskStarted for more details.
+  </summary>
+</histogram>
+
 <histogram name="Android.NativeLibraryPreloader.Result.Browser"
     enum="NativeLibraryPreloaderResult" expires_after="M77">
   <owner>michaelbai@chromium.org</owner>
@@ -5424,7 +5471,7 @@
 </histogram>
 
 <histogram name="Arc.Supervision.Transition.Result"
-    enum="ArcSupervisionTransitionResult" expires_after="M76">
+    enum="ArcSupervisionTransitionResult" expires_after="M85">
   <owner>menegola@google.com</owner>
   <owner>escordeiro@google.com</owner>
   <owner>unichromeos-eng@google.com</owner>
@@ -5435,7 +5482,7 @@
 </histogram>
 
 <histogram name="Arc.Supervision.Transition.Screen.Success.TimeDelta"
-    units="ms" expires_after="M76">
+    units="ms" expires_after="M85">
   <owner>brunoad@google.com</owner>
   <owner>menegola@google.com</owner>
   <owner>escordeiro@google.com</owner>
@@ -5447,7 +5494,7 @@
 </histogram>
 
 <histogram name="Arc.Supervision.Transition.Screen.Successful"
-    enum="BooleanSuccess" expires_after="M76">
+    enum="BooleanSuccess" expires_after="M85">
   <owner>brunoad@google.com</owner>
   <owner>menegola@google.com</owner>
   <owner>escordeiro@google.com</owner>
@@ -49892,6 +49939,22 @@
   </summary>
 </histogram>
 
+<histogram name="KioskNextShell.EnabledState" enum="BooleanEnabled"
+    expires_after="2019-12-31">
+  <owner>brunoad@chromium.org</owner>
+  <owner>maroun@chromium.org</owner>
+  <owner>michaelpg@chromium.org</owner>
+  <summary>Records when KioskNextShell becomes enabled or disabled.</summary>
+</histogram>
+
+<histogram name="KioskNextShell.Launched" enum="Boolean"
+    expires_after="2019-12-31">
+  <owner>brunoad@chromium.org</owner>
+  <owner>maroun@chromium.org</owner>
+  <owner>michaelpg@chromium.org</owner>
+  <summary>Records launches of KioskNextShell. Only true is recorded.</summary>
+</histogram>
+
 <histogram name="LanguageSettings.Actions" enum="LanguageSettingsActionType">
   <owner>googleo@chromium.org</owner>
   <summary>
@@ -89385,7 +89448,7 @@
 </histogram>
 
 <histogram name="PasswordManager.FirstRendererFillingResult"
-    enum="PasswordManagerFirstRendererFillingResult" expires_after="M76">
+    enum="PasswordManagerFirstRendererFillingResult" expires_after="M86">
   <owner>battre@chromium.org</owner>
   <owner>dvadym@chromium.org</owner>
   <summary>
@@ -89398,7 +89461,7 @@
 </histogram>
 
 <histogram name="PasswordManager.FirstWaitForUsernameReason"
-    enum="PasswordManagerFirstWaitForUsernameReason" expires_after="M76">
+    enum="PasswordManagerFirstWaitForUsernameReason" expires_after="M86">
   <owner>battre@chromium.org</owner>
   <owner>dvadym@chromium.org</owner>
   <summary>
@@ -103060,6 +103123,20 @@
   </summary>
 </histogram>
 
+<histogram base="true" name="RendererScheduler.QueueingDurationPerQueueType"
+    units="ms" expires_after="2020-06-01">
+<!-- Name completed by histogram_suffixes name="RendererScheduler.QueueType" -->
+
+  <owner>kdillon@chromium.org</owner>
+  <owner>shaseley@chromium.org</owner>
+  <summary>
+    Tracks the queueing time of tasks on the main thread of the renderer broken
+    down by queue type. Reported when the task is completed.
+
+    Note that this metric is only recorded when a renderer is not backgrounded.
+  </summary>
+</histogram>
+
 <histogram name="RendererScheduler.QueueingDurationWhenExpectedQueueingTime"
     units="ms" expires_after="2017-08-03">
   <obsolete>
@@ -145232,9 +145309,13 @@
 </histogram_suffixes>
 
 <histogram_suffixes name="AdsPageLoadMetricsCpu" separator=".">
+  <suffix base="true" name="AdFrames.PerFrame.PeakWindowedPercent"
+      label="The peak load over all 30 second windows while the page is
+             unactivated of an ad creative. This is measured as percentage of
+             a cpu core used and capped at 100% for multicore systems."/>
   <suffix base="true" name="AdFrames.PerFrame.PercentUsage"
       label="The average load of an ad creative across the life of the page.
-             This is measured at percentage of a cpu core used and capped at
+             This is measured as percentage of a cpu core used and capped at
              100% for multicore systems."/>
   <suffix base="true" name="AdFrames.PerFrame.TotalUsage"
       label="The total load of an ad creative across the life of the page.
@@ -145264,9 +145345,13 @@
 </histogram_suffixes>
 
 <histogram_suffixes name="AdsPageLoadMetricsCpuFullPage" separator=".">
+  <suffix base="true" name="FullPage.PeakWindowedPercent"
+      label="The peak load over all 30 second windows during the lifetime of
+             the page. This is measured as percentage of a cpu core used and
+             capped at 100% for multicore systems."/>
   <suffix base="true" name="FullPage.PercentUsage"
       label="The average load of the page across its lifetime. This is
-             measured at percentage of a cpu core used and capped at 100% for
+             measured as percentage of a cpu core used and capped at 100% for
              multicore systems."/>
   <suffix base="true" name="FullPage.TotalUsage"
       label="The total load of the page across its lifetime. This is measured
@@ -156344,6 +156429,14 @@
   <affected-histogram name="RendererScheduler.TaskDurationPerThreadType2"/>
 </histogram_suffixes>
 
+<histogram_suffixes name="RendererScheduler.QueueType" separator=".">
+  <suffix name="Compositor"/>
+  <suffix name="Input"/>
+  <suffix name="Loading"/>
+  <suffix name="Other"/>
+  <affected-histogram name="RendererScheduler.QueueingDurationPerQueueType"/>
+</histogram_suffixes>
+
 <histogram_suffixes name="RendererScheduler.TaskCountPerTaskLength"
     separator=".">
   <suffix name="LongerThan1s"/>
diff --git a/tools/metrics/ukm/ukm.xml b/tools/metrics/ukm/ukm.xml
index 584ee15..d6a06a9 100644
--- a/tools/metrics/ukm/ukm.xml
+++ b/tools/metrics/ukm/ukm.xml
@@ -4542,6 +4542,26 @@
   </metric>
 </event>
 
+<event name="OptimizationGuide">
+  <owner>sophiechang@chromium.org</owner>
+  <summary>
+    Optimization guide metrics associated with a page load. See
+    //components/optimization_guide/.
+  </summary>
+  <metric name="HintGenerationTimestamp">
+    <summary>
+      The timestamp, in seconds from epoch, that the server generated the hint
+      for the optimization applied on the page load.
+    </summary>
+  </metric>
+  <metric name="HintSource">
+    <summary>
+      The |optimization_guide::proto::HintSource| for the optimization that was
+      applied on the page load.
+    </summary>
+  </metric>
+</event>
+
 <event name="PageDomainInfo">
   <owner>uthakore@chromium.org</owner>
   <owner>invernizzi@chromium.org</owner>
diff --git a/tools/perf/contrib/leak_detection/page_sets.py b/tools/perf/contrib/leak_detection/page_sets.py
index c5037c1e..a50bb7d 100644
--- a/tools/perf/contrib/leak_detection/page_sets.py
+++ b/tools/perf/contrib/leak_detection/page_sets.py
@@ -77,10 +77,12 @@
       'https://www.csdn.net/',
       'https://www.alipay.com/',
       'https://www.twitch.tv/',
-      'https://www.ebay.com/',
+      # TODO(keishi): Memory dump fails flakily crbug.com/963273
+      #'https://www.ebay.com/',
       # TODO(keishi): Memory dump fails flakily crbug.com/963273
       #'https://www.microsoft.com/',
-      'https://www.xvideos.com/',
+      # TODO(keishi): Memory dump fails flakily crbug.com/963273
+      #'https://www.xvideos.com/',
       'https://mail.ru/',
       'https://www.bing.com/',
       'http://www.wikia.com/',
@@ -259,7 +261,8 @@
     resource_loading_urls_list = [
       'https://www.hotels.com/',
       'https://www.livejournal.com/',
-      'https://www.yahoo.com',
+      # TODO(keishi): Memory dump fails flakily crbug.com/963273
+      #'https://www.yahoo.com',
       'http://www.quora.com',
       'https://www.macys.com',
       'http://infomoney.com.br',
diff --git a/ui/gfx/color_utils.cc b/ui/gfx/color_utils.cc
index 92ba1407..c058749 100644
--- a/ui/gfx/color_utils.cc
+++ b/ui/gfx/color_utils.cc
@@ -324,61 +324,40 @@
       foreground1 : foreground2;
 }
 
-SkColor GetColorWithMinimumContrast(SkColor default_foreground,
-                                    SkColor background) {
-  const SkColor contrasting_color = GetColorWithMaxContrast(background);
-  const SkAlpha alpha = GetBlendValueWithMinimumContrast(
-      default_foreground, contrasting_color, background,
-      kMinimumReadableContrastRatio);
-  return AlphaBlend(contrasting_color, default_foreground, alpha);
-}
+BlendResult BlendForMinContrast(
+    SkColor default_foreground,
+    SkColor background,
+    base::Optional<SkColor> high_contrast_foreground,
+    float contrast_ratio) {
+  DCHECK_EQ(SkColorGetA(background), SK_AlphaOPAQUE);
+  default_foreground = GetResultingPaintColor(default_foreground, background);
+  if (GetContrastRatio(default_foreground, background) >= contrast_ratio)
+    return {SK_AlphaTRANSPARENT, default_foreground};
+  const SkColor target_foreground = GetResultingPaintColor(
+      high_contrast_foreground.value_or(GetColorWithMaxContrast(background)),
+      background);
 
-SkAlpha GetBlendValueWithMinimumContrast(SkColor source,
-                                         SkColor target,
-                                         SkColor base,
-                                         float contrast_ratio) {
-  DCHECK_EQ(SkColorGetA(base), SK_AlphaOPAQUE);
+  const float background_luminance = GetRelativeLuminance(background);
 
-  source = GetResultingPaintColor(source, base);
-  if (GetContrastRatio(source, base) >= contrast_ratio)
-    return 0;
-  target = GetResultingPaintColor(target, base);
-
-  constexpr int kCloseEnoughAlphaDelta = 0x04;
-  return FindBlendValueForContrastRatio(source, target, base, contrast_ratio,
-                                        kCloseEnoughAlphaDelta);
-}
-
-SkAlpha FindBlendValueForContrastRatio(SkColor source,
-                                       SkColor target,
-                                       SkColor base,
-                                       float contrast_ratio,
-                                       int alpha_error_tolerance) {
-  DCHECK_EQ(SkColorGetA(source), SK_AlphaOPAQUE);
-  DCHECK_EQ(SkColorGetA(target), SK_AlphaOPAQUE);
-  DCHECK_EQ(SkColorGetA(base), SK_AlphaOPAQUE);
-  DCHECK_GE(alpha_error_tolerance, 0);
-
-  const float base_luminance = GetRelativeLuminance(base);
-
+  SkAlpha best_alpha = SK_AlphaOPAQUE;
+  SkColor best_color = target_foreground;
   // Use int for inclusive lower bound and exclusive upper bound, reserving
   // conversion to SkAlpha for the end (reduces casts).
-  int low = SK_AlphaTRANSPARENT;
-  int high = SK_AlphaOPAQUE + 1;
-  SkAlpha best = SK_AlphaOPAQUE;
-  while (low + alpha_error_tolerance < high) {
+  for (int low = SK_AlphaTRANSPARENT, high = SK_AlphaOPAQUE + 1; low < high;) {
     const SkAlpha alpha = (low + high) / 2;
-    const SkColor blended = AlphaBlend(target, source, alpha);
-    const float luminance = GetRelativeLuminance(blended);
-    const float contrast = GetContrastRatio(luminance, base_luminance);
+    const SkColor color =
+        AlphaBlend(target_foreground, default_foreground, alpha);
+    const float luminance = GetRelativeLuminance(color);
+    const float contrast = GetContrastRatio(luminance, background_luminance);
     if (contrast >= contrast_ratio) {
-      best = alpha;
+      best_alpha = alpha;
+      best_color = color;
       high = alpha;
     } else {
       low = alpha + 1;
     }
   }
-  return best;
+  return {best_alpha, best_color};
 }
 
 SkColor InvertColor(SkColor color) {
diff --git a/ui/gfx/color_utils.h b/ui/gfx/color_utils.h
index c443749..a0853455 100644
--- a/ui/gfx/color_utils.h
+++ b/ui/gfx/color_utils.h
@@ -8,6 +8,7 @@
 #include <string>
 #include <tuple>
 
+#include "base/optional.h"
 #include "third_party/skia/include/core/SkColor.h"
 #include "ui/gfx/gfx_export.h"
 
@@ -22,6 +23,13 @@
   double l;
 };
 
+// The blend alpha and resulting color when blending to achieve a desired
+// contrast raio.
+struct BlendResult {
+  SkAlpha alpha;
+  SkColor color;
+};
+
 // The minimum contrast between text and background that is still readable.
 // This value is taken from w3c accessibility guidelines.
 constexpr float kMinimumReadableContrastRatio = 4.5f;
@@ -129,37 +137,18 @@
                                         SkColor foreground2,
                                         SkColor background);
 
-// This function attempts to select a color based on |default_foreground| that
-// will meet the minimum contrast ratio when used as a text color on top of
-// |background|. If |default_foreground| already meets the minimum contrast
-// ratio, this function will simply return it. Otherwise it will blend the color
-// darker/lighter until either the contrast ratio is acceptable or the color
-// cannot become any more extreme. Only use with opaque background.
-GFX_EXPORT SkColor GetColorWithMinimumContrast(SkColor default_foreground,
-                                               SkColor background);
-
-// Attempts to select an alpha value such that blending |target| onto |source|
-// with that alpha produces a color of at least |contrast_ratio| against |base|.
-// If |source| already meets the minimum contrast ratio, this function will
-// simply return 0. Otherwise it will blend the |target| onto |source| until
-// either the contrast ratio is acceptable or the color cannot become any more
-// extreme. |base| must be opaque.
-GFX_EXPORT SkAlpha GetBlendValueWithMinimumContrast(SkColor source,
-                                                    SkColor target,
-                                                    SkColor base,
-                                                    float contrast_ratio);
-
-// Returns the minimum alpha value such that blending |target| onto |source|
-// produces a color that contrasts against |base| with at least |contrast_ratio|
-// unless this is impossible, in which case SK_AlphaOPAQUE is returned.
-// Use only with opaque colors. |alpha_error_tolerance| should normally be 0 for
-// best accuracy, but if performance is critical then it can be a positive value
-// (4 is recommended) to save a few cycles and give "close enough" alpha.
-GFX_EXPORT SkAlpha FindBlendValueForContrastRatio(SkColor source,
-                                                  SkColor target,
-                                                  SkColor base,
-                                                  float contrast_ratio,
-                                                  int alpha_error_tolerance);
+// Alpha-blends |default_foreground| toward either |high_contrast_foreground|
+// (if specified) or the color with max contrast with |background| until either
+// the result has a contrast ratio against |background| of at least
+// |contrast_ratio| or the blend can go no further.  Returns the blended color
+// and the alpha used to achieve that blend.  If |default_foreground| already
+// has sufficient contrast, returns an alpha of 0 and color of
+// |default_foreground|.
+GFX_EXPORT BlendResult BlendForMinContrast(
+    SkColor default_foreground,
+    SkColor background,
+    base::Optional<SkColor> high_contrast_foreground = base::nullopt,
+    float contrast_ratio = kMinimumReadableContrastRatio);
 
 // Invert a color.
 GFX_EXPORT SkColor InvertColor(SkColor color);
diff --git a/ui/gfx/color_utils_unittest.cc b/ui/gfx/color_utils_unittest.cc
index 9fcedd3..68c14dd 100644
--- a/ui/gfx/color_utils_unittest.cc
+++ b/ui/gfx/color_utils_unittest.cc
@@ -239,46 +239,49 @@
   EXPECT_EQ(old_darkest_color, GetColorWithMaxContrast(SK_ColorWHITE));
 }
 
-TEST(ColorUtils, GetColorWithMinimumContrast_ForegroundAlreadyMeetsMinimum) {
-  EXPECT_EQ(SK_ColorBLACK,
-            GetColorWithMinimumContrast(SK_ColorBLACK, SK_ColorWHITE));
+TEST(ColorUtils, BlendForMinContrast_ForegroundAlreadyMeetsMinimum) {
+  const auto result = BlendForMinContrast(SK_ColorBLACK, SK_ColorWHITE);
+  EXPECT_EQ(SK_AlphaTRANSPARENT, result.alpha);
+  EXPECT_EQ(SK_ColorBLACK, result.color);
 }
 
-TEST(ColorUtils, GetColorWithMinimumContrast_BlendDarker) {
+TEST(ColorUtils, BlendForMinContrast_BlendDarker) {
   const SkColor foreground = SkColorSetRGB(0xAA, 0xAA, 0xAA);
-  const SkColor result = GetColorWithMinimumContrast(foreground, SK_ColorWHITE);
-  EXPECT_NE(foreground, result);
-  EXPECT_GE(GetContrastRatio(result, SK_ColorWHITE),
+  const auto result = BlendForMinContrast(foreground, SK_ColorWHITE);
+  EXPECT_NE(SK_AlphaTRANSPARENT, result.alpha);
+  EXPECT_NE(foreground, result.color);
+  EXPECT_GE(GetContrastRatio(result.color, SK_ColorWHITE),
             kMinimumReadableContrastRatio);
 }
 
-TEST(ColorUtils, GetColorWithMinimumContrast_BlendLighter) {
+TEST(ColorUtils, BlendForMinContrast_BlendLighter) {
   const SkColor foreground = SkColorSetRGB(0x33, 0x33, 0x33);
-  const SkColor result = GetColorWithMinimumContrast(foreground, SK_ColorBLACK);
-  EXPECT_NE(foreground, result);
-  EXPECT_GE(GetContrastRatio(result, SK_ColorBLACK),
+  const auto result = BlendForMinContrast(foreground, SK_ColorBLACK);
+  EXPECT_NE(SK_AlphaTRANSPARENT, result.alpha);
+  EXPECT_NE(foreground, result.color);
+  EXPECT_GE(GetContrastRatio(result.color, SK_ColorBLACK),
             kMinimumReadableContrastRatio);
 }
 
-TEST(ColorUtils, GetColorWithMinimumContrast_StopsAtDarkestColor) {
+TEST(ColorUtils, BlendForMinContrast_StopsAtDarkestColor) {
   const SkColor darkest_color = SkColorSetRGB(0x44, 0x44, 0x44);
   const SkColor old_darkest_color = SetDarkestColorForTesting(darkest_color);
-  EXPECT_EQ(darkest_color,
-            GetColorWithMinimumContrast(SkColorSetRGB(0x55, 0x55, 0x55),
-                                        SkColorSetRGB(0xAA, 0xAA, 0xAA)));
+  EXPECT_EQ(darkest_color, BlendForMinContrast(SkColorSetRGB(0x55, 0x55, 0x55),
+                                               SkColorSetRGB(0xAA, 0xAA, 0xAA))
+                               .color);
 
   SetDarkestColorForTesting(old_darkest_color);
 }
 
-TEST(ColorUtils, GetBlendValueWithMinimumContrast_ComputesExpectedOpacities) {
+TEST(ColorUtils, BlendForMinContrast_ComputesExpectedOpacities) {
   const SkColor source = SkColorSetRGB(0xDE, 0xE1, 0xE6);
   const SkColor target = SkColorSetRGB(0xFF, 0xFF, 0xFF);
   const SkColor base = source;
-  SkAlpha alpha = GetBlendValueWithMinimumContrast(source, target, base, 1.11f);
+  SkAlpha alpha = BlendForMinContrast(source, base, target, 1.11f).alpha;
   EXPECT_NEAR(alpha / 255.0f, 0.4f, 0.03f);
-  alpha = GetBlendValueWithMinimumContrast(source, target, base, 1.19f);
+  alpha = BlendForMinContrast(source, base, target, 1.19f).alpha;
   EXPECT_NEAR(alpha / 255.0f, 0.65f, 0.03f);
-  alpha = GetBlendValueWithMinimumContrast(source, target, base, 1.13728f);
+  alpha = BlendForMinContrast(source, base, target, 1.13728f).alpha;
   EXPECT_NEAR(alpha / 255.0f, 0.45f, 0.03f);
 }
 
@@ -304,25 +307,26 @@
   }
 }
 
-TEST(ColorUtils, FindBlendValueForContrastRatio_MatchesNaiveImplementation) {
-  const SkColor source = SkColorSetRGB(0xDE, 0xE1, 0xE6);
-  const SkColor target = SkColorSetRGB(0xFF, 0xFF, 0xFF);
-  const SkColor base = source;
-  const float contrast_ratio = 1.11f;
-  const SkAlpha alpha =
-      FindBlendValueForContrastRatio(source, target, base, contrast_ratio, 0);
+TEST(ColorUtils, BlendForMinContrast_MatchesNaiveImplementation) {
+  constexpr SkColor default_foreground = SkColorSetRGB(0xDE, 0xE1, 0xE6);
+  constexpr SkColor high_contrast_foreground = SK_ColorWHITE;
+  constexpr SkColor background = default_foreground;
+  constexpr float kContrastRatio = 1.11f;
+  const auto result = BlendForMinContrast(
+      default_foreground, background, high_contrast_foreground, kContrastRatio);
 
   // Naive implementation is direct translation of function description.
-  SkAlpha check = SK_AlphaTRANSPARENT;
-  for (SkAlpha alpha = SK_AlphaTRANSPARENT; alpha <= SK_AlphaOPAQUE; ++alpha) {
-    const SkColor blended = AlphaBlend(target, source, alpha);
-    const float contrast = GetContrastRatio(blended, base);
-    check = alpha;
-    if (contrast >= contrast_ratio)
+  SkAlpha alpha = SK_AlphaTRANSPARENT;
+  SkColor color = default_foreground;
+  for (int i = SK_AlphaTRANSPARENT; i <= SK_AlphaOPAQUE; ++i) {
+    alpha = SkAlpha{i};
+    color = AlphaBlend(high_contrast_foreground, default_foreground, alpha);
+    if (GetContrastRatio(color, background) >= kContrastRatio)
       break;
   }
 
-  EXPECT_EQ(check, alpha);
+  EXPECT_EQ(alpha, result.alpha);
+  EXPECT_EQ(color, result.color);
 }
 
 }  // namespace color_utils
diff --git a/ui/views/controls/label.cc b/ui/views/controls/label.cc
index de56de6..8b42eab 100644
--- a/ui/views/controls/label.cc
+++ b/ui/views/controls/label.cc
@@ -873,7 +873,7 @@
 SkColor Label::GetForegroundColor(SkColor foreground,
                                   SkColor background) const {
   return (auto_color_readability_ && IsOpaque(background))
-             ? color_utils::GetColorWithMinimumContrast(foreground, background)
+             ? color_utils::BlendForMinContrast(foreground, background).color
              : foreground;
 }
 
diff --git a/ui/views/controls/label.h b/ui/views/controls/label.h
index f07f285..f21722f 100644
--- a/ui/views/controls/label.h
+++ b/ui/views/controls/label.h
@@ -86,9 +86,9 @@
 
   // Enables or disables auto-color-readability (enabled by default).  If this
   // is enabled, then calls to set any foreground or background color will
-  // trigger an automatic mapper that uses
-  // color_utils::GetColorWithMinimumContrast() to ensure that the foreground
-  // colors are readable over the background color.
+  // trigger an automatic mapper that uses color_utils::BlendForMinContrast()
+  // to ensure that the foreground colors are readable over the background
+  // color.
   void SetAutoColorReadabilityEnabled(bool enabled);
 
   // Sets the color.  This will automatically force the color to be readable
diff --git a/ui/views/window/frame_caption_button.cc b/ui/views/window/frame_caption_button.cc
index 25fcf50a..2d0e9acb 100644
--- a/ui/views/window/frame_caption_button.cc
+++ b/ui/views/window/frame_caption_button.cc
@@ -75,16 +75,17 @@
   // colors) can change between light/dark targets at the same time.  It looks
   // bad when the title and caption buttons disagree about whether to be light
   // or dark.
-  const SkColor source = color_utils::IsDark(background_color)
-                             ? gfx::kGoogleGrey200
-                             : gfx::kGoogleGrey700;
-  const SkColor target = color_utils::GetColorWithMaxContrast(background_color);
+  const SkColor default_foreground = color_utils::IsDark(background_color)
+                                         ? gfx::kGoogleGrey200
+                                         : gfx::kGoogleGrey700;
+  const SkColor high_contrast_foreground =
+      color_utils::GetColorWithMaxContrast(background_color);
   // Guarantee the caption buttons reach at least contrast ratio 3; this ratio
   // matches that used for focus indicators, large text, and other "have to see
   // it but perhaps don't have to read fine detail" cases.
-  const SkAlpha alpha = color_utils::GetBlendValueWithMinimumContrast(
-      source, target, background_color, 3.0f);
-  return color_utils::AlphaBlend(target, source, alpha);
+  return color_utils::BlendForMinContrast(default_foreground, background_color,
+                                          high_contrast_foreground, 3.0f)
+      .color;
 }
 
 // static
diff --git a/ui/webui/resources/cr_components/chromeos/BUILD.gn b/ui/webui/resources/cr_components/chromeos/BUILD.gn
index 895487a..2ec0ddce 100644
--- a/ui/webui/resources/cr_components/chromeos/BUILD.gn
+++ b/ui/webui/resources/cr_components/chromeos/BUILD.gn
@@ -13,6 +13,7 @@
     "multidevice_setup:closure_compile",
     "network:closure_compile",
     "quick_unlock:closure_compile",
+    "smb_shares:closure_compile",
   ]
 }
 
diff --git a/url/url_util.cc b/url/url_util.cc
index d56d041..63613aa 100644
--- a/url/url_util.cc
+++ b/url/url_util.cc
@@ -9,6 +9,7 @@
 
 #include "base/debug/leak_annotations.h"
 #include "base/logging.h"
+#include "base/no_destructor.h"
 #include "base/stl_util.h"
 #include "base/strings/string_util.h"
 #include "url/url_canon_internal.h"
@@ -20,7 +21,82 @@
 
 namespace {
 
-bool g_allow_non_standard_schemes = false;
+// List of currently registered schemes and associated properties.
+struct SchemeRegistry {
+  // Standard format schemes (see header for details).
+  std::vector<SchemeWithType> standard_schemes = {
+      {kHttpsScheme, SCHEME_WITH_HOST_PORT_AND_USER_INFORMATION},
+      {kHttpScheme, SCHEME_WITH_HOST_PORT_AND_USER_INFORMATION},
+      // Yes, file URLs can have a hostname, so file URLs should be handled as
+      // "standard". File URLs never have a port as specified by the SchemeType
+      // field.  Unlike other SCHEME_WITH_HOST schemes, the 'host' in a file
+      // URL may be empty, a behavior which is special-cased during
+      // canonicalization.
+      {kFileScheme, SCHEME_WITH_HOST},
+      {kFtpScheme, SCHEME_WITH_HOST_PORT_AND_USER_INFORMATION},
+      {kGopherScheme, SCHEME_WITH_HOST_PORT_AND_USER_INFORMATION},
+      {kWssScheme,
+       SCHEME_WITH_HOST_PORT_AND_USER_INFORMATION},  // WebSocket secure.
+      {kWsScheme, SCHEME_WITH_HOST_PORT_AND_USER_INFORMATION},  // WebSocket.
+      {kFileSystemScheme, SCHEME_WITHOUT_AUTHORITY},
+  };
+
+  // Schemes that are allowed for referrers.
+  std::vector<SchemeWithType> referrer_schemes = {
+      {kHttpsScheme, SCHEME_WITH_HOST_PORT_AND_USER_INFORMATION},
+      {kHttpScheme, SCHEME_WITH_HOST_PORT_AND_USER_INFORMATION},
+  };
+
+  // Schemes that do not trigger mixed content warning.
+  std::vector<std::string> secure_schemes = {
+      kHttpsScheme,
+      kAboutScheme,
+      kDataScheme,
+      kWssScheme,
+  };
+
+  // Schemes that normal pages cannot link to or access (i.e., with the same
+  // security rules as those applied to "file" URLs).
+  std::vector<std::string> local_schemes = {
+      kFileScheme,
+  };
+
+  // Schemes that cause pages loaded with them to not have access to pages
+  // loaded with any other URL scheme.
+  std::vector<std::string> no_access_schemes = {
+      kAboutScheme,
+      kJavaScriptScheme,
+      kDataScheme,
+  };
+
+  // Schemes that can be sent CORS requests.
+  std::vector<std::string> cors_enabled_schemes = {
+      kHttpsScheme,
+      kHttpScheme,
+      kDataScheme,
+  };
+
+  // Schemes that can be used by web to store data (local storage, etc).
+  std::vector<std::string> web_storage_schemes = {
+      kHttpsScheme, kHttpScheme, kFileScheme, kFtpScheme, kWssScheme, kWsScheme,
+  };
+
+  // Schemes that can bypass the Content-Security-Policy (CSP) checks.
+  std::vector<std::string> csp_bypassing_schemes = {};
+
+  // Schemes that are strictly empty documents, allowing them to commit
+  // synchronously.
+  std::vector<std::string> empty_document_schemes = {
+      kAboutScheme,
+  };
+
+  bool allow_non_standard_schemes = false;
+};
+
+SchemeRegistry* GetSchemeRegistry() {
+  static base::NoDestructor<SchemeRegistry> registry;
+  return registry.get();
+}
 
 // Pass this enum through for methods which would like to know if whitespace
 // removal is necessary.
@@ -29,79 +105,6 @@
   DO_NOT_REMOVE_WHITESPACE,
 };
 
-const SchemeWithType kStandardURLSchemes[] = {
-    {kHttpsScheme, SCHEME_WITH_HOST_PORT_AND_USER_INFORMATION},
-    {kHttpScheme, SCHEME_WITH_HOST_PORT_AND_USER_INFORMATION},
-    // Yes, file URLs can have a hostname, so file URLs should be handled as
-    // "standard". File URLs never have a port as specified by the SchemeType
-    // field.  Unlike other SCHEME_WITH_HOST schemes, the 'host' in a file
-    // URL may be empty, a behavior which is special-cased during
-    // canonicalization.
-    {kFileScheme, SCHEME_WITH_HOST},
-    {kFtpScheme, SCHEME_WITH_HOST_PORT_AND_USER_INFORMATION},
-    {kGopherScheme, SCHEME_WITH_HOST_PORT_AND_USER_INFORMATION},
-    {kWssScheme,
-     SCHEME_WITH_HOST_PORT_AND_USER_INFORMATION},  // WebSocket secure.
-    {kWsScheme, SCHEME_WITH_HOST_PORT_AND_USER_INFORMATION},  // WebSocket.
-    {kFileSystemScheme, SCHEME_WITHOUT_AUTHORITY},
-};
-
-const SchemeWithType kReferrerURLSchemes[] = {
-    {kHttpsScheme, SCHEME_WITH_HOST_PORT_AND_USER_INFORMATION},
-    {kHttpScheme, SCHEME_WITH_HOST_PORT_AND_USER_INFORMATION},
-};
-
-const char* kSecureSchemes[] = {
-  kHttpsScheme,
-  kAboutScheme,
-  kDataScheme,
-  kWssScheme,
-};
-
-const char* kLocalSchemes[] = {
-  kFileScheme,
-};
-
-const char* kNoAccessSchemes[] = {
-  kAboutScheme,
-  kJavaScriptScheme,
-  kDataScheme,
-};
-
-const char* kCorsEnabledSchemes[] = {
-    kHttpsScheme, kHttpScheme, kDataScheme,
-};
-
-const char* kWebStorageSchemes[] = {
-  kHttpsScheme,
-  kHttpScheme,
-  kFileScheme,
-  kFtpScheme,
-  kWssScheme,
-  kWsScheme,
-};
-
-const char* kEmptyDocumentSchemes[] = {
-    kAboutScheme,
-};
-
-bool initialized = false;
-
-// Lists of the currently installed standard and referrer schemes. These lists
-// are lazily initialized by Initialize and are leaked on shutdown to prevent
-// any destructors from being called that will slow us down or cause problems.
-std::vector<SchemeWithType>* standard_schemes = nullptr;
-std::vector<SchemeWithType>* referrer_schemes = nullptr;
-
-// Similar to above, initialized by the Init*Schemes methods.
-std::vector<std::string>* secure_schemes = nullptr;
-std::vector<std::string>* local_schemes = nullptr;
-std::vector<std::string>* no_access_schemes = nullptr;
-std::vector<std::string>* cors_enabled_schemes = nullptr;
-std::vector<std::string>* web_storage_schemes = nullptr;
-std::vector<std::string>* csp_bypassing_schemes = nullptr;
-std::vector<std::string>* empty_document_schemes = nullptr;
-
 // See the LockSchemeRegistries declaration in the header.
 bool scheme_registries_locked = false;
 
@@ -116,24 +119,6 @@
   typedef base::StringPiece16 Piece;
 };
 
-void InitSchemes(std::vector<std::string>** schemes,
-                 const char** initial_schemes,
-                 size_t size) {
-  *schemes = new std::vector<std::string>(size);
-  for (size_t i = 0; i < size; i++) {
-    (*(*schemes))[i] = initial_schemes[i];
-  }
-}
-
-void InitSchemesWithType(std::vector<SchemeWithType>** schemes,
-                         const SchemeWithType* initial_schemes,
-                         size_t size) {
-  *schemes = new std::vector<SchemeWithType>(size);
-  for (size_t i = 0; i < size; i++) {
-    (*(*schemes))[i] = initial_schemes[i];
-  }
-}
-
 // Given a string and a range inside the string, compares it to the given
 // lower-case |compare_to| buffer.
 template<typename CHAR>
@@ -171,8 +156,8 @@
 
 template<typename CHAR>
 bool DoIsStandard(const CHAR* spec, const Component& scheme, SchemeType* type) {
-  Initialize();
-  return DoIsInSchemes(spec, scheme, type, *standard_schemes);
+  return DoIsInSchemes(spec, scheme, type,
+                       GetSchemeRegistry()->standard_schemes);
 }
 
 
@@ -510,135 +495,83 @@
 }  // namespace
 
 void Initialize() {
-  if (initialized)
-    return;
-  InitSchemesWithType(&standard_schemes, kStandardURLSchemes,
-                      base::size(kStandardURLSchemes));
-  InitSchemesWithType(&referrer_schemes, kReferrerURLSchemes,
-                      base::size(kReferrerURLSchemes));
-  InitSchemes(&secure_schemes, kSecureSchemes, base::size(kSecureSchemes));
-  InitSchemes(&local_schemes, kLocalSchemes, base::size(kLocalSchemes));
-  InitSchemes(&no_access_schemes, kNoAccessSchemes,
-              base::size(kNoAccessSchemes));
-  InitSchemes(&cors_enabled_schemes, kCorsEnabledSchemes,
-              base::size(kCorsEnabledSchemes));
-  InitSchemes(&web_storage_schemes, kWebStorageSchemes,
-              base::size(kWebStorageSchemes));
-  InitSchemes(&csp_bypassing_schemes, nullptr, 0);
-  InitSchemes(&empty_document_schemes, kEmptyDocumentSchemes,
-              base::size(kEmptyDocumentSchemes));
-  initialized = true;
+  // Deprecated.
 }
 
 void Shutdown() {
-  initialized = false;
-  g_allow_non_standard_schemes = false;
-  delete standard_schemes;
-  standard_schemes = nullptr;
-  delete referrer_schemes;
-  referrer_schemes = nullptr;
-  delete secure_schemes;
-  secure_schemes = nullptr;
-  delete local_schemes;
-  local_schemes = nullptr;
-  delete no_access_schemes;
-  no_access_schemes = nullptr;
-  delete cors_enabled_schemes;
-  cors_enabled_schemes = nullptr;
-  delete web_storage_schemes;
-  web_storage_schemes = nullptr;
-  delete csp_bypassing_schemes;
-  csp_bypassing_schemes = nullptr;
-  delete empty_document_schemes;
-  empty_document_schemes = nullptr;
+  *GetSchemeRegistry() = SchemeRegistry();
 }
 
 void EnableNonStandardSchemesForAndroidWebView() {
-  g_allow_non_standard_schemes = true;
+  GetSchemeRegistry()->allow_non_standard_schemes = true;
 }
 
 bool AllowNonStandardSchemesForAndroidWebView() {
-  return g_allow_non_standard_schemes;
+  return GetSchemeRegistry()->allow_non_standard_schemes;
 }
 
 void AddStandardScheme(const char* new_scheme, SchemeType type) {
-  Initialize();
-  DoAddSchemeWithType(new_scheme, type, standard_schemes);
+  DoAddSchemeWithType(new_scheme, type, &GetSchemeRegistry()->standard_schemes);
 }
 
 void AddReferrerScheme(const char* new_scheme, SchemeType type) {
-  Initialize();
-  DoAddSchemeWithType(new_scheme, type, referrer_schemes);
+  DoAddSchemeWithType(new_scheme, type, &GetSchemeRegistry()->referrer_schemes);
 }
 
 void AddSecureScheme(const char* new_scheme) {
-  Initialize();
-  DoAddScheme(new_scheme, secure_schemes);
+  DoAddScheme(new_scheme, &GetSchemeRegistry()->secure_schemes);
 }
 
 const std::vector<std::string>& GetSecureSchemes() {
-  Initialize();
-  return *secure_schemes;
+  return GetSchemeRegistry()->secure_schemes;
 }
 
 void AddLocalScheme(const char* new_scheme) {
-  Initialize();
-  DoAddScheme(new_scheme, local_schemes);
+  DoAddScheme(new_scheme, &GetSchemeRegistry()->local_schemes);
 }
 
 const std::vector<std::string>& GetLocalSchemes() {
-  Initialize();
-  return *local_schemes;
+  return GetSchemeRegistry()->local_schemes;
 }
 
 void AddNoAccessScheme(const char* new_scheme) {
-  Initialize();
-  DoAddScheme(new_scheme, no_access_schemes);
+  DoAddScheme(new_scheme, &GetSchemeRegistry()->no_access_schemes);
 }
 
 const std::vector<std::string>& GetNoAccessSchemes() {
-  Initialize();
-  return *no_access_schemes;
+  return GetSchemeRegistry()->no_access_schemes;
 }
 
 void AddCorsEnabledScheme(const char* new_scheme) {
-  Initialize();
-  DoAddScheme(new_scheme, cors_enabled_schemes);
+  DoAddScheme(new_scheme, &GetSchemeRegistry()->cors_enabled_schemes);
 }
 
 const std::vector<std::string>& GetCorsEnabledSchemes() {
-  Initialize();
-  return *cors_enabled_schemes;
+  return GetSchemeRegistry()->cors_enabled_schemes;
 }
 
 void AddWebStorageScheme(const char* new_scheme) {
-  Initialize();
-  DoAddScheme(new_scheme, web_storage_schemes);
+  DoAddScheme(new_scheme, &GetSchemeRegistry()->web_storage_schemes);
 }
 
 const std::vector<std::string>& GetWebStorageSchemes() {
-  Initialize();
-  return *web_storage_schemes;
+  return GetSchemeRegistry()->web_storage_schemes;
 }
 
 void AddCSPBypassingScheme(const char* new_scheme) {
-  Initialize();
-  DoAddScheme(new_scheme, csp_bypassing_schemes);
+  DoAddScheme(new_scheme, &GetSchemeRegistry()->csp_bypassing_schemes);
 }
 
 const std::vector<std::string>& GetCSPBypassingSchemes() {
-  Initialize();
-  return *csp_bypassing_schemes;
+  return GetSchemeRegistry()->csp_bypassing_schemes;
 }
 
 void AddEmptyDocumentScheme(const char* new_scheme) {
-  Initialize();
-  DoAddScheme(new_scheme, empty_document_schemes);
+  DoAddScheme(new_scheme, &GetSchemeRegistry()->empty_document_schemes);
 }
 
 const std::vector<std::string>& GetEmptyDocumentSchemes() {
-  Initialize();
-  return *empty_document_schemes;
+  return GetSchemeRegistry()->empty_document_schemes;
 }
 
 void LockSchemeRegistries() {
@@ -668,9 +601,9 @@
 }
 
 bool IsReferrerScheme(const char* spec, const Component& scheme) {
-  Initialize();
   SchemeType unused_scheme_type;
-  return DoIsInSchemes(spec, scheme, &unused_scheme_type, *referrer_schemes);
+  return DoIsInSchemes(spec, scheme, &unused_scheme_type,
+                       GetSchemeRegistry()->referrer_schemes);
 }
 
 bool FindAndCompareScheme(const char* str,
diff --git a/url/url_util.h b/url/url_util.h
index 0bd9f40..b618999d 100644
--- a/url/url_util.h
+++ b/url/url_util.h
@@ -19,22 +19,10 @@
 
 // Init ------------------------------------------------------------------------
 
-// Initialization is NOT required, it will be implicitly initialized when first
-// used. However, this implicit initialization is NOT threadsafe. If you are
-// using this library in a threaded environment and don't have a consistent
-// "first call" (an example might be calling Add*Scheme with your special
-// application-specific schemes) then you will want to call initialize before
-// spawning any threads.
-//
-// It is OK to call this function more than once, subsequent calls will be
-// no-ops, unless Shutdown was called in the mean time. This will also be a
-// no-op if other calls to the library have forced an initialization beforehand.
+// Deprecated.  Does not do anything.
 COMPONENT_EXPORT(URL) void Initialize();
 
-// Cleanup is not required, except some strings may leak. For most user
-// applications, this is fine. If you're using it in a library that may get
-// loaded and unloaded, you'll want to unload to properly clean up your
-// library.
+// Resets all custom schemes to the default values.  Not thread-safe.
 COMPONENT_EXPORT(URL) void Shutdown();
 
 // Schemes ---------------------------------------------------------------------
@@ -45,6 +33,8 @@
 // compatibility, which allows the use of custom schemes: content hosted in
 // Android WebView assumes that one URL with a non-standard scheme will be
 // same-origin to another URL with the same non-standard scheme.
+//
+// Not thread-safe.
 COMPONENT_EXPORT(URL) void EnableNonStandardSchemesForAndroidWebView();
 
 // Whether or not SchemeHostPort and Origin allow non-standard schemes.
@@ -103,7 +93,7 @@
 COMPONENT_EXPORT(URL) const std::vector<std::string>& GetWebStorageSchemes();
 
 // Adds an application-defined scheme to the list of schemes that can bypass the
-// Content-Security-Policy(CSP) checks.
+// Content-Security-Policy (CSP) checks.
 COMPONENT_EXPORT(URL) void AddCSPBypassingScheme(const char* new_scheme);
 COMPONENT_EXPORT(URL) const std::vector<std::string>& GetCSPBypassingSchemes();
 
diff --git a/url/url_util_unittest.cc b/url/url_util_unittest.cc
index 13036af8..da578e81 100644
--- a/url/url_util_unittest.cc
+++ b/url/url_util_unittest.cc
@@ -94,10 +94,22 @@
 TEST_F(URLUtilTest, AddReferrerScheme) {
   const char kFooScheme[] = "foo";
   EXPECT_FALSE(IsReferrerScheme(kFooScheme, Component(0, strlen(kFooScheme))));
+
   AddReferrerScheme(kFooScheme, url::SCHEME_WITH_HOST);
   EXPECT_TRUE(IsReferrerScheme(kFooScheme, Component(0, strlen(kFooScheme))));
 }
 
+TEST_F(URLUtilTest, ShutdownCleansUpSchemes) {
+  const char kFooScheme[] = "foo";
+  EXPECT_FALSE(IsReferrerScheme(kFooScheme, Component(0, strlen(kFooScheme))));
+
+  AddReferrerScheme(kFooScheme, url::SCHEME_WITH_HOST);
+  EXPECT_TRUE(IsReferrerScheme(kFooScheme, Component(0, strlen(kFooScheme))));
+
+  Shutdown();
+  EXPECT_FALSE(IsReferrerScheme(kFooScheme, Component(0, strlen(kFooScheme))));
+}
+
 TEST_F(URLUtilTest, GetStandardSchemeType) {
   url::SchemeType scheme_type;