diff --git a/DEPS b/DEPS
index 318700e..349f9af 100644
--- a/DEPS
+++ b/DEPS
@@ -92,11 +92,8 @@
   # as an expression.
   'cros_download_vm': '"{cros_board}" == "amd64-generic"',
 
-  # ANGLE's deps are relative to the angle_root variable, except for what's
-  # shared with chromium, such as build/, testing/, etc which are relative to
-  # src_root.
+  # ANGLE's deps are relative to the angle_root variable.
   'angle_root': 'src/third_party/angle',
-  'src_root': 'src',
 
   'android_git': 'https://android.googlesource.com',
   'aomedia_git': 'https://aomedia.googlesource.com',
@@ -113,11 +110,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '7bae65d0070c5923abe8d052688b86e41d872f33',
+  'skia_revision': 'e92aae6b3612298c5c9c537b57bf459ec799a8bc',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'db22e96fb4501f1da2415dac90d728cbfeb94981',
+  'v8_revision': 'bad9daf231f81a73da1b7b5a2a481892d92cc05c',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -125,7 +122,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling ANGLE
   # and whatever else without interference from each other.
-  'angle_revision': '1d8a783c9db2b7ab999933447f015d7acae42639',
+  'angle_revision': '78bcd2bec37187fd5d0e2ca69d1d583923e2f196',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling build tools
   # and whatever else without interference from each other.
@@ -137,7 +134,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling PDFium
   # and whatever else without interference from each other.
-  'pdfium_revision': 'b01628451a54d0f503d6e93d2322fd9e179d2532',
+  'pdfium_revision': '785a26dc649af80c593f899a606dff4dae7c48fd',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling openmax_dl
   # and whatever else without interference from each other.
@@ -173,7 +170,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling catapult
   # and whatever else without interference from each other.
-  'catapult_revision': 'b273e0cd217d87f33caacb8ed15d85801fcca9ea',
+  'catapult_revision': '519565187c85418c6d1443ec24bd1012afdfb247',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libFuzzer
   # and whatever else without interference from each other.
@@ -331,7 +328,7 @@
   },
 
   'src/ios/third_party/material_components_ios/src': {
-      'url': Var('chromium_git') + '/external/github.com/material-components/material-components-ios.git' + '@' + 'dcdd925166d5d8838c0b31721d00d5b250b444c4',
+      'url': Var('chromium_git') + '/external/github.com/material-components/material-components-ios.git' + '@' + 'f6c357a1718718a576e1b57ef97c8d165b728068',
       'condition': 'checkout_ios',
   },
 
@@ -381,7 +378,7 @@
   },
 
   'src/media/cdm/api':
-    Var('chromium_git') + '/chromium/cdm.git' + '@' + 'bf6d8e058121d690798366de678014e7d6f82b71',
+    Var('chromium_git') + '/chromium/cdm.git' + '@' + '817c8005a57ea3ca417f767b3b3679601329afd8',
 
   'src/native_client': {
       'url': Var('chromium_git') + '/native_client/src/native_client.git' + '@' + Var('nacl_revision'),
@@ -613,7 +610,7 @@
 
   # Build tools for Chrome OS. Note: This depends on third_party/pyelftools.
   'src/third_party/chromite': {
-      'url': Var('chromium_git') + '/chromiumos/chromite.git' + '@' + '2eee64982a09c8da44d3765313e3b42a39597c17',
+      'url': Var('chromium_git') + '/chromiumos/chromite.git' + '@' + '451dc721b571c5dfa791c593b1f46e85cf83f7b9',
       'condition': 'checkout_linux',
   },
 
@@ -967,7 +964,7 @@
   },
 
   'src/third_party/perfetto':
-    Var('android_git') + '/platform/external/perfetto.git' + '@' +  '383ad4fa29d62d9a53c05027e8a2f2b3e8e546ac',
+    Var('android_git') + '/platform/external/perfetto.git' + '@' +  '51b2312390d4a57f9685402797466a25f624f578',
 
   'src/third_party/perl': {
       'url': Var('chromium_git') + '/chromium/deps/perl.git' + '@' + 'ac0d98b5cee6c024b0cffeb4f8f45b6fc5ccdb78',
@@ -1119,7 +1116,7 @@
     Var('chromium_git') + '/external/khronosgroup/webgl.git' + '@' + '6d2f3f4cb8bac1f7c4a945c73d07a33df74f22f9',
 
   'src/third_party/webrtc':
-    Var('webrtc_git') + '/src.git' + '@' + '5a464d3ee56ac2acc1c08a351f68f78e51bac144',
+    Var('webrtc_git') + '/src.git' + '@' + '09beff2cfd84c3481b79a490414355fb1bf682e7',
 
   'src/third_party/xdg-utils': {
       'url': Var('chromium_git') + '/chromium/deps/xdg-utils.git' + '@' + 'd80274d5869b17b8c9067a1022e4416ee7ed5e0d',
@@ -1150,7 +1147,7 @@
     Var('chromium_git') + '/v8/v8.git' + '@' +  Var('v8_revision'),
 
   'src-internal': {
-    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@ce15ef5cc47b5e245ee8436114243d81c4bbe146',
+    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@cb047393e8c643fa4919818c278851834c538703',
     'condition': 'checkout_src_internal',
   },
 
diff --git a/android_webview/browser/hardware_renderer.cc b/android_webview/browser/hardware_renderer.cc
index f65fc30..467a5845 100644
--- a/android_webview/browser/hardware_renderer.cc
+++ b/android_webview/browser/hardware_renderer.cc
@@ -172,7 +172,7 @@
   DCHECK(child_id_.is_valid());
 
   surfaces_->RemoveChildId(viz::SurfaceId(frame_sink_id_, child_id_));
-  support_->EvictLastActivatedSurface();
+  support_->EvictSurface(child_id_);
   child_id_ = viz::LocalSurfaceId();
   surfaces_->GetFrameSinkManager()->surface_manager()->GarbageCollectSurfaces();
 }
diff --git a/ash/accelerators/accelerator_controller_unittest.cc b/ash/accelerators/accelerator_controller_unittest.cc
index 9cc533b..f3c4753a3 100644
--- a/ash/accelerators/accelerator_controller_unittest.cc
+++ b/ash/accelerators/accelerator_controller_unittest.cc
@@ -8,6 +8,7 @@
 
 #include "ash/accelerators/accelerator_confirmation_dialog.h"
 #include "ash/accelerators/accelerator_table.h"
+#include "ash/accelerators/pre_target_accelerator_handler.h"
 #include "ash/accessibility/accessibility_controller.h"
 #include "ash/accessibility/test_accessibility_controller_client.h"
 #include "ash/app_list/test/app_list_test_helper.h"
@@ -57,6 +58,7 @@
 #include "ui/message_center/message_center.h"
 #include "ui/views/widget/widget.h"
 #include "ui/views/window/dialog_client_view.h"
+#include "ui/wm/core/accelerator_filter.h"
 
 namespace ash {
 
@@ -1501,4 +1503,72 @@
   RemoveAllNotifications();
 }
 
+// MediaSessionAcceleratorTest tests media key handling with media session
+// service integration. The parameter is a boolean as to whether the feature is
+// enabled or disabled.
+class MediaSessionAcceleratorTest : public AcceleratorControllerTest,
+                                    public testing::WithParamInterface<bool> {
+ public:
+  MediaSessionAcceleratorTest() = default;
+  ~MediaSessionAcceleratorTest() override = default;
+
+  // AcceleratorControllerTest:
+  void SetUp() override {
+    if (service_enabled()) {
+      scoped_feature_list_.InitAndEnableFeature(
+          features::kMediaSessionAccelerators);
+    } else {
+      scoped_feature_list_.InitAndDisableFeature(
+          features::kMediaSessionAccelerators);
+    }
+
+    AcceleratorControllerTest::SetUp();
+  }
+
+  bool service_enabled() const { return GetParam(); }
+
+ private:
+  base::test::ScopedFeatureList scoped_feature_list_;
+
+  DISALLOW_COPY_AND_ASSIGN(MediaSessionAcceleratorTest);
+};
+
+INSTANTIATE_TEST_CASE_P(, MediaSessionAcceleratorTest, testing::Bool());
+
+TEST_P(MediaSessionAcceleratorTest, MediaPlaybackAcceleratorsBehavior) {
+  const ui::KeyboardCode media_keys[] = {ui::VKEY_MEDIA_NEXT_TRACK,
+                                         ui::VKEY_MEDIA_PLAY_PAUSE,
+                                         ui::VKEY_MEDIA_PREV_TRACK};
+
+  std::unique_ptr<ui::AcceleratorHistory> accelerator_history(
+      std::make_unique<ui::AcceleratorHistory>());
+  ::wm::AcceleratorFilter filter(
+      std::make_unique<PreTargetAcceleratorHandler>(),
+      accelerator_history.get());
+
+  for (ui::KeyboardCode key : media_keys) {
+    // If the media session service integration is enabled then media keys will
+    // be handled in ash.
+    std::unique_ptr<aura::Window> window(CreateTestWindowInShellWithId(1));
+    {
+      ui::KeyEvent press_key(ui::ET_KEY_PRESSED, key, ui::EF_NONE);
+      ui::Event::DispatcherApi dispatch_helper(&press_key);
+      dispatch_helper.set_target(window.get());
+      filter.OnKeyEvent(&press_key);
+      EXPECT_EQ(service_enabled(), press_key.stopped_propagation());
+    }
+
+    // Setting a window property on the target allows media keys to pass
+    // through.
+    wm::GetWindowState(window.get())->SetCanConsumeSystemKeys(true);
+    {
+      ui::KeyEvent press_key(ui::ET_KEY_PRESSED, key, ui::EF_NONE);
+      ui::Event::DispatcherApi dispatch_helper(&press_key);
+      dispatch_helper.set_target(window.get());
+      filter.OnKeyEvent(&press_key);
+      EXPECT_FALSE(press_key.stopped_propagation());
+    }
+  }
+}
+
 }  // namespace ash
diff --git a/ash/accelerators/pre_target_accelerator_handler.cc b/ash/accelerators/pre_target_accelerator_handler.cc
index 5551f15..f11fad1 100644
--- a/ash/accelerators/pre_target_accelerator_handler.cc
+++ b/ash/accelerators/pre_target_accelerator_handler.cc
@@ -6,8 +6,10 @@
 
 #include "ash/accelerators/accelerator_controller.h"
 #include "ash/app_list/app_list_controller_impl.h"
+#include "ash/public/cpp/ash_features.h"
 #include "ash/shell.h"
 #include "ash/wm/window_state.h"
+#include "base/feature_list.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/stl_util.h"
 #include "ui/aura/window.h"
@@ -34,6 +36,10 @@
     case ui::VKEY_VOLUME_UP:
     case ui::VKEY_POWER:
       return true;
+    case ui::VKEY_MEDIA_NEXT_TRACK:
+    case ui::VKEY_MEDIA_PLAY_PAUSE:
+    case ui::VKEY_MEDIA_PREV_TRACK:
+      return base::FeatureList::IsEnabled(features::kMediaSessionAccelerators);
     default:
       return false;
   }
diff --git a/ash/public/cpp/ash_features.cc b/ash/public/cpp/ash_features.cc
index e7a4f08..504b595 100644
--- a/ash/public/cpp/ash_features.cc
+++ b/ash/public/cpp/ash_features.cc
@@ -38,6 +38,9 @@
 const base::Feature kNewMessageListView{"NewMessageListView",
                                         base::FEATURE_ENABLED_BY_DEFAULT};
 
+const base::Feature kMediaSessionAccelerators{
+    "MediaSessionAccelerators", base::FEATURE_DISABLED_BY_DEFAULT};
+
 const base::Feature kNewWallpaperPicker{"NewWallpaperPicker",
                                         base::FEATURE_ENABLED_BY_DEFAULT};
 
diff --git a/ash/public/cpp/ash_features.h b/ash/public/cpp/ash_features.h
index 8d8891d..46a90bb 100644
--- a/ash/public/cpp/ash_features.h
+++ b/ash/public/cpp/ash_features.h
@@ -48,6 +48,12 @@
 ASH_PUBLIC_EXPORT extern const base::Feature
     kLockScreenHideSensitiveNotificationsSupport;
 
+// Enables media session service integration. If this is enabled, accelerators
+// that are associated with media playback will be handled by the media
+// session service.
+// TODO(beccahughes): Remove after launch. (https://crbug.com/894255)
+ASH_PUBLIC_EXPORT extern const base::Feature kMediaSessionAccelerators;
+
 // Enables new message list view. https://crbug.com/769219
 ASH_PUBLIC_EXPORT extern const base::Feature kNewMessageListView;
 
diff --git a/ash/public/cpp/ash_pref_names.cc b/ash/public/cpp/ash_pref_names.cc
index 11424563..59bca3ea 100644
--- a/ash/public/cpp/ash_pref_names.cc
+++ b/ash/public/cpp/ash_pref_names.cc
@@ -173,6 +173,11 @@
 // A boolean pref that turns on automatic screen locking.
 const char kEnableAutoScreenLock[] = "settings.enable_screen_lock";
 
+// Screen brightness percent values to be used when running on AC power.
+// Specified by the policy.
+const char kPowerAcScreenBrightnessPercent[] =
+    "power.ac_screen_brightness_percent";
+
 // Inactivity time in milliseconds while the system is on AC power before
 // the screen should be dimmed, turned off, or locked, before an
 // IdleActionImminent D-Bus signal should be sent, or before
@@ -183,6 +188,11 @@
 const char kPowerAcScreenLockDelayMs[] = "power.ac_screen_lock_delay_ms";
 const char kPowerAcIdleWarningDelayMs[] = "power.ac_idle_warning_delay_ms";
 
+// Screen brightness percent values to be used when running on battery power.
+// Specified by the policy.
+const char kPowerBatteryScreenBrightnessPercent[] =
+    "power.battery_screen_brightness_percent";
+
 // Similar delays while the system is on battery power.
 const char kPowerBatteryScreenDimDelayMs[] =
     "power.battery_screen_dim_delay_ms";
diff --git a/ash/public/cpp/ash_pref_names.h b/ash/public/cpp/ash_pref_names.h
index 43976d4..a971fb0 100644
--- a/ash/public/cpp/ash_pref_names.h
+++ b/ash/public/cpp/ash_pref_names.h
@@ -70,11 +70,13 @@
 
 ASH_PUBLIC_EXPORT extern const char kAllowScreenLock[];
 ASH_PUBLIC_EXPORT extern const char kEnableAutoScreenLock[];
+ASH_PUBLIC_EXPORT extern const char kPowerAcScreenBrightnessPercent[];
 ASH_PUBLIC_EXPORT extern const char kPowerAcScreenDimDelayMs[];
 ASH_PUBLIC_EXPORT extern const char kPowerAcScreenOffDelayMs[];
 ASH_PUBLIC_EXPORT extern const char kPowerAcScreenLockDelayMs[];
 ASH_PUBLIC_EXPORT extern const char kPowerAcIdleWarningDelayMs[];
 ASH_PUBLIC_EXPORT extern const char kPowerAcIdleDelayMs[];
+ASH_PUBLIC_EXPORT extern const char kPowerBatteryScreenBrightnessPercent[];
 ASH_PUBLIC_EXPORT extern const char kPowerBatteryScreenDimDelayMs[];
 ASH_PUBLIC_EXPORT extern const char kPowerBatteryScreenOffDelayMs[];
 ASH_PUBLIC_EXPORT extern const char kPowerBatteryScreenLockDelayMs[];
diff --git a/ash/system/power/power_prefs.cc b/ash/system/power/power_prefs.cc
index 54643286..0631b30 100644
--- a/ash/system/power/power_prefs.cc
+++ b/ash/system/power/power_prefs.cc
@@ -62,6 +62,8 @@
 // Registers power prefs whose default values are the same in user prefs and
 // signin prefs.
 void RegisterProfilePrefs(PrefRegistrySimple* registry, bool for_test) {
+  registry->RegisterIntegerPref(prefs::kPowerAcScreenBrightnessPercent, -1,
+                                PrefRegistry::PUBLIC);
   registry->RegisterIntegerPref(prefs::kPowerAcScreenDimDelayMs, 420000,
                                 PrefRegistry::PUBLIC);
   registry->RegisterIntegerPref(prefs::kPowerAcScreenOffDelayMs, 450000,
@@ -72,6 +74,8 @@
                                 PrefRegistry::PUBLIC);
   registry->RegisterIntegerPref(prefs::kPowerAcIdleDelayMs, 510000,
                                 PrefRegistry::PUBLIC);
+  registry->RegisterIntegerPref(prefs::kPowerBatteryScreenBrightnessPercent, -1,
+                                PrefRegistry::PUBLIC);
   registry->RegisterIntegerPref(prefs::kPowerBatteryScreenDimDelayMs, 300000,
                                 PrefRegistry::PUBLIC);
   registry->RegisterIntegerPref(prefs::kPowerBatteryScreenOffDelayMs, 330000,
@@ -215,6 +219,8 @@
                           screen_idle_off_time_ > screen_lock_time_);
 
   chromeos::PowerPolicyController::PrefValues values;
+  values.ac_brightness_percent =
+      prefs->GetInteger(prefs::kPowerAcScreenBrightnessPercent);
   values.ac_screen_dim_delay_ms =
       prefs->GetInteger(use_lock_delays ? prefs::kPowerLockScreenDimDelayMs
                                         : prefs::kPowerAcScreenDimDelayMs);
@@ -226,6 +232,8 @@
   values.ac_idle_warning_delay_ms =
       prefs->GetInteger(prefs::kPowerAcIdleWarningDelayMs);
   values.ac_idle_delay_ms = prefs->GetInteger(prefs::kPowerAcIdleDelayMs);
+  values.battery_brightness_percent =
+      prefs->GetInteger(prefs::kPowerBatteryScreenBrightnessPercent);
   values.battery_screen_dim_delay_ms =
       prefs->GetInteger(use_lock_delays ? prefs::kPowerLockScreenDimDelayMs
                                         : prefs::kPowerBatteryScreenDimDelayMs);
@@ -271,6 +279,8 @@
 
   pref_change_registrar_ = std::make_unique<PrefChangeRegistrar>();
   pref_change_registrar_->Init(prefs);
+  pref_change_registrar_->Add(prefs::kPowerAcScreenBrightnessPercent,
+                              update_callback);
   pref_change_registrar_->Add(prefs::kPowerAcScreenDimDelayMs, update_callback);
   pref_change_registrar_->Add(prefs::kPowerAcScreenOffDelayMs, update_callback);
   pref_change_registrar_->Add(prefs::kPowerAcScreenLockDelayMs,
@@ -278,6 +288,8 @@
   pref_change_registrar_->Add(prefs::kPowerAcIdleWarningDelayMs,
                               update_callback);
   pref_change_registrar_->Add(prefs::kPowerAcIdleDelayMs, update_callback);
+  pref_change_registrar_->Add(prefs::kPowerBatteryScreenBrightnessPercent,
+                              update_callback);
   pref_change_registrar_->Add(prefs::kPowerBatteryScreenDimDelayMs,
                               update_callback);
   pref_change_registrar_->Add(prefs::kPowerBatteryScreenOffDelayMs,
diff --git a/ash/wm/splitview/split_view_controller_unittest.cc b/ash/wm/splitview/split_view_controller_unittest.cc
index 82e9643..1fd54c58 100644
--- a/ash/wm/splitview/split_view_controller_unittest.cc
+++ b/ash/wm/splitview/split_view_controller_unittest.cc
@@ -7,6 +7,7 @@
 #include "ash/app_list/app_list_controller_impl.h"
 #include "ash/display/screen_orientation_controller.h"
 #include "ash/display/screen_orientation_controller_test_api.h"
+#include "ash/magnifier/docked_magnifier_controller.h"
 #include "ash/public/cpp/app_types.h"
 #include "ash/public/cpp/window_properties.h"
 #include "ash/screen_util.h"
@@ -2641,7 +2642,7 @@
   // Splitview should end now, but overview should still active.
   EXPECT_FALSE(split_view_controller()->IsSplitViewModeActive());
   EXPECT_TRUE(selector_controller->IsSelecting());
-  // The new selector item size should still not be the same as the dragged
+  // The size of drop target should still not be the same as the dragged
   // window's size.
   current_grid = selector_controller->window_selector()->GetGridWithRootWindow(
       window1->GetRootWindow());
@@ -2655,7 +2656,7 @@
 }
 
 // Tests that a dragged window's bounds should be updated before dropping onto
-// the new selector item to add into overview.
+// the drop target to add into overview.
 TEST_F(SplitViewTabDraggingTest, WindowBoundsUpdatedBeforeAddingToOverview) {
   const gfx::Rect bounds(0, 0, 400, 400);
   std::unique_ptr<aura::Window> window1(
@@ -2672,7 +2673,7 @@
   window1->SetBounds(bounds);
   EXPECT_EQ(bounds, window1->bounds());
 
-  // Drop |window1| to the new selector item in overview.
+  // Drop |window1| to the drop target in overview.
   WindowSelectorController* window_selector_controller =
       Shell::Get()->window_selector_controller();
   WindowSelector* window_selector =
@@ -2684,8 +2685,8 @@
 
   WindowSelectorItem* selector_item = current_grid->GetDropTarget();
   ASSERT_TRUE(selector_item);
-  gfx::Rect item_bounds_during_drag = selector_item->target_bounds();
-  DragWindowTo(resizer.get(), item_bounds_during_drag.CenterPoint());
+  gfx::Rect drop_target_bounds = selector_item->target_bounds();
+  DragWindowTo(resizer.get(), drop_target_bounds.CenterPoint());
 
   CompleteDrag(std::move(resizer));
   // |window1| should have been merged into overview.
@@ -2696,7 +2697,7 @@
   selector_item = current_grid->window_list().front().get();
   // The new window selector item's bounds should be the same during drag and
   // after drag.
-  EXPECT_EQ(item_bounds_during_drag, selector_item->target_bounds());
+  EXPECT_EQ(drop_target_bounds, selector_item->target_bounds());
   ToggleOverview();
   EXPECT_FALSE(window_selector_controller->IsSelecting());
 
@@ -2708,11 +2709,11 @@
   window1->SetBounds(bounds);
   EXPECT_EQ(bounds, window1->bounds());
 
-  // Drag the window to right bottom outside the new selector item, the
-  // window's bounds should also be updated before being dropped into overview.
-  item_bounds_during_drag = GetDropTargetBoundsDuringDrag(window1.get());
+  // Drag the window to right bottom outside the drop target, the window's
+  // bounds should also be updated before being dropped into overview.
+  drop_target_bounds = GetDropTargetBoundsDuringDrag(window1.get());
   DragWindowTo(resizer.get(),
-               item_bounds_during_drag.bottom_right() + gfx::Vector2d(10, 10));
+               drop_target_bounds.bottom_right() + gfx::Vector2d(10, 10));
   CompleteDrag(std::move(resizer));
   // |window1| should have been merged into overview.
   EXPECT_TRUE(window_selector_controller->window_selector()->IsWindowInOverview(
@@ -2722,72 +2723,99 @@
 }
 
 // Tests that window should be dropped into overview if has been dragged further
-// than half of the distance from top of display to the top of new selector item
-// in overview.
+// than half of the distance from top of display to the top of drop target.
 TEST_F(SplitViewTabDraggingTest, DropWindowIntoOverviewOnDragPositionTest) {
   const gfx::Rect bounds(0, 0, 400, 400);
-  std::unique_ptr<aura::Window> window1(
+  std::unique_ptr<aura::Window> browser_window1(
       CreateWindowWithType(bounds, AppType::BROWSER));
-  wm::GetWindowState(window1.get())->Maximize();
+  wm::GetWindowState(browser_window1.get())->Maximize();
+  gfx::Rect work_area_bounds =
+      display::Screen::GetScreen()
+          ->GetDisplayNearestWindow(browser_window1.get())
+          .work_area();
   std::unique_ptr<WindowResizer> resizer =
-      StartDrag(window1.get(), window1.get());
+      StartDrag(browser_window1.get(), browser_window1.get());
 
   // Restore window back to maximized if it has been dragged less than the
   // distance threshold.
-  gfx::Rect item_bounds_during_drag =
-      GetDropTargetBoundsDuringDrag(window1.get());
+  gfx::Rect drop_target_bounds =
+      GetDropTargetBoundsDuringDrag(browser_window1.get());
   DragWindowTo(
       resizer.get(),
-      gfx::Point(200,
-                 TabletModeWindowDragDelegate::kDragPositionToOverviewRatio *
-                         item_bounds_during_drag.y() -
-                     10));
+      gfx::Point(
+          200, work_area_bounds.y() +
+                   TabletModeWindowDragDelegate::kDragPositionToOverviewRatio *
+                       (drop_target_bounds.y() - work_area_bounds.y()) -
+                   10));
   CompleteDrag(std::move(resizer));
-  EXPECT_TRUE(wm::GetWindowState(window1.get())->IsMaximized());
+  EXPECT_TRUE(wm::GetWindowState(browser_window1.get())->IsMaximized());
+  EXPECT_FALSE(Shell::Get()->window_selector_controller()->IsSelecting());
 
   // Drop window into overview if it has beenn dragged further than the distance
   // threshold.
-  resizer = StartDrag(window1.get(), window1.get());
-  item_bounds_during_drag = GetDropTargetBoundsDuringDrag(window1.get());
+  resizer = StartDrag(browser_window1.get(), browser_window1.get());
+  drop_target_bounds = GetDropTargetBoundsDuringDrag(browser_window1.get());
   DragWindowTo(
       resizer.get(),
-      gfx::Point(200,
-                 TabletModeWindowDragDelegate::kDragPositionToOverviewRatio *
-                         item_bounds_during_drag.y() +
-                     10));
+      gfx::Point(
+          200, work_area_bounds.y() +
+                   TabletModeWindowDragDelegate::kDragPositionToOverviewRatio *
+                       (drop_target_bounds.y() - work_area_bounds.y()) +
+                   10));
   CompleteDrag(std::move(resizer));
   WindowSelector* window_selector =
       Shell::Get()->window_selector_controller()->window_selector();
-  EXPECT_TRUE(window_selector->IsWindowInOverview(window1.get()));
+  EXPECT_TRUE(window_selector->IsWindowInOverview(browser_window1.get()));
   ToggleOverview();
 
   // Do not consider the drag position if preview area is shown. Window should
   // to be snapped in this case.
-  resizer = StartDrag(window1.get(), window1.get());
-  item_bounds_during_drag = GetDropTargetBoundsDuringDrag(window1.get());
-  DragWindowTo(resizer.get(), gfx::Point(0, item_bounds_during_drag.y() + 10));
+  resizer = StartDrag(browser_window1.get(), browser_window1.get());
+  drop_target_bounds = GetDropTargetBoundsDuringDrag(browser_window1.get());
+  DragWindowTo(resizer.get(), gfx::Point(0, drop_target_bounds.y() + 10));
   EXPECT_EQ(IndicatorState::kPreviewAreaLeft, GetIndicatorState(resizer.get()));
   CompleteDrag(std::move(resizer));
-  EXPECT_TRUE(wm::GetWindowState(window1.get())->IsSnapped());
+  EXPECT_TRUE(wm::GetWindowState(browser_window1.get())->IsSnapped());
   EXPECT_EQ(SplitViewController::LEFT_SNAPPED,
             split_view_controller()->state());
 
   // Should not consider the drag position if splitview is active. Window should
   // still back to be snapped.
-  std::unique_ptr<aura::Window> window2(
+  std::unique_ptr<aura::Window> browser_window2(
       CreateWindowWithType(bounds, AppType::BROWSER));
-  split_view_controller()->SnapWindow(window2.get(),
+  split_view_controller()->SnapWindow(browser_window2.get(),
                                       SplitViewController::RIGHT);
   EXPECT_EQ(SplitViewController::BOTH_SNAPPED,
             split_view_controller()->state());
-  resizer = StartDrag(window1.get(), window1.get());
-  item_bounds_during_drag = GetDropTargetBoundsDuringDrag(window1.get());
-  DragWindowTo(resizer.get(), gfx::Point(0, item_bounds_during_drag.y() + 10));
+  resizer = StartDrag(browser_window1.get(), browser_window1.get());
+  drop_target_bounds = GetDropTargetBoundsDuringDrag(browser_window1.get());
+  DragWindowTo(resizer.get(), gfx::Point(0, drop_target_bounds.y() + 10));
   EXPECT_TRUE(split_view_controller()->IsSplitViewModeActive());
   CompleteDrag(std::move(resizer));
   EXPECT_EQ(SplitViewController::BOTH_SNAPPED,
             split_view_controller()->state());
   EXPECT_FALSE(Shell::Get()->window_selector_controller()->IsSelecting());
+  EndSplitView();
+  EXPECT_FALSE(split_view_controller()->IsSplitViewModeActive());
+
+  // Restore window back to maximized if it has been dragged less than the
+  // distance threshold when dock magnifier is enabled.
+  Shell::Get()->docked_magnifier_controller()->SetEnabled(true);
+  work_area_bounds = display::Screen::GetScreen()
+                         ->GetDisplayNearestWindow(browser_window1.get())
+                         .work_area();
+  resizer = StartDrag(browser_window1.get(), browser_window1.get());
+  drop_target_bounds = GetDropTargetBoundsDuringDrag(browser_window1.get());
+  DragWindowTo(
+      resizer.get(),
+      gfx::Point(
+          200, work_area_bounds.y() +
+                   TabletModeWindowDragDelegate::kDragPositionToOverviewRatio *
+                       (drop_target_bounds.y() - work_area_bounds.y()) -
+                   10));
+  CompleteDrag(std::move(resizer));
+  EXPECT_TRUE(wm::GetWindowState(browser_window1.get())->IsMaximized());
+  EXPECT_FALSE(Shell::Get()->window_selector_controller()->IsSelecting());
 }
 
 // Tests that a dragged window should have the active window shadow during
@@ -3054,10 +3082,11 @@
 
   std::unique_ptr<WindowResizer> resizer =
       StartDrag(browser_window.get(), browser_window.get());
-  gfx::Rect item_bounds = GetDropTargetBoundsDuringDrag(browser_window.get());
-  // Drag window to inside the new selector item.
-  DragWindowTo(resizer.get(),
-               gfx::Point(item_bounds.x() + 5, item_bounds.y() + 5));
+  gfx::Rect drop_target_bounds =
+      GetDropTargetBoundsDuringDrag(browser_window.get());
+  // Drag window to inside the drop target.
+  DragWindowTo(resizer.get(), gfx::Point(drop_target_bounds.x() + 5,
+                                         drop_target_bounds.y() + 5));
   EXPECT_EQ(GetIndicatorState(resizer.get()), IndicatorState::kPreviewAreaLeft);
   CompleteDrag(std::move(resizer));
   EXPECT_EQ(SplitViewController::LEFT_SNAPPED,
diff --git a/ash/wm/tablet_mode/tablet_mode_window_drag_delegate.cc b/ash/wm/tablet_mode/tablet_mode_window_drag_delegate.cc
index 8e2f68e..2be0303 100644
--- a/ash/wm/tablet_mode/tablet_mode_window_drag_delegate.cc
+++ b/ash/wm/tablet_mode/tablet_mode_window_drag_delegate.cc
@@ -379,9 +379,15 @@
   if (is_split_view_active)
     return is_drop_target_selected;
 
+  const gfx::Rect work_area_bounds =
+      display::Screen::GetScreen()
+          ->GetDisplayNearestWindow(dragged_window_)
+          .work_area();
   return is_drop_target_selected ||
-         location_in_screen.y() >= kDragPositionToOverviewRatio *
-                                       drop_target->GetTransformedBounds().y();
+         (location_in_screen.y() - work_area_bounds.y()) >=
+             kDragPositionToOverviewRatio *
+                 (drop_target->GetTransformedBounds().y() -
+                  work_area_bounds.y());
 }
 
 bool TabletModeWindowDragDelegate::ShouldFlingIntoOverview(
diff --git a/cc/base/switches.cc b/cc/base/switches.cc
index 8b70bc4..d363fe84b 100644
--- a/cc/base/switches.cc
+++ b/cc/base/switches.cc
@@ -84,8 +84,7 @@
 const char kShowScreenSpaceRects[] = "show-screenspace-rects";
 const char kUIShowScreenSpaceRects[] = "ui-show-screenspace-rects";
 
-// Switches cc machinery to use layer lists instead of layer trees
-const char kEnableLayerLists[] = "enable-layer-lists";
+// Switches the ui compositor to use layer lists instead of layer trees.
 const char kUIEnableLayerLists[] = "ui-enable-layer-lists";
 
 // Prevents the layer tree unit tests from timing out.
diff --git a/cc/base/switches.h b/cc/base/switches.h
index 7234ee4..fe8de281 100644
--- a/cc/base/switches.h
+++ b/cc/base/switches.h
@@ -44,7 +44,6 @@
 CC_BASE_EXPORT extern const char kUIShowSurfaceDamageRects[];
 CC_BASE_EXPORT extern const char kShowScreenSpaceRects[];
 CC_BASE_EXPORT extern const char kUIShowScreenSpaceRects[];
-CC_BASE_EXPORT extern const char kEnableLayerLists[];
 CC_BASE_EXPORT extern const char kUIEnableLayerLists[];
 CC_BASE_EXPORT extern const char kCompositedRenderPassBorders[];
 CC_BASE_EXPORT extern const char kCompositedSurfaceBorders[];
diff --git a/cc/paint/BUILD.gn b/cc/paint/BUILD.gn
index 6ea4596..64c109c 100644
--- a/cc/paint/BUILD.gn
+++ b/cc/paint/BUILD.gn
@@ -79,6 +79,8 @@
     "skia_paint_canvas.h",
     "skia_paint_image_generator.cc",
     "skia_paint_image_generator.h",
+    "skottie_wrapper.cc",
+    "skottie_wrapper.h",
     "solid_color_analyzer.cc",
     "solid_color_analyzer.h",
     "transfer_cache_deserialize_helper.h",
diff --git a/cc/paint/DEPS b/cc/paint/DEPS
index 78b223c0..6d60ad8 100644
--- a/cc/paint/DEPS
+++ b/cc/paint/DEPS
@@ -9,4 +9,7 @@
   "oop_pixeltest.cc": [
     "+gpu/command_buffer",
   ],
+  "skottie_wrapper.h": [
+    "+third_party/skia",
+  ],
 }
diff --git a/ui/gfx/skottie_wrapper.cc b/cc/paint/skottie_wrapper.cc
similarity index 60%
rename from ui/gfx/skottie_wrapper.cc
rename to cc/paint/skottie_wrapper.cc
index 1cba085f..45171360 100644
--- a/ui/gfx/skottie_wrapper.cc
+++ b/cc/paint/skottie_wrapper.cc
@@ -2,19 +2,17 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "ui/gfx/skottie_wrapper.h"
+#include "cc/paint/skottie_wrapper.h"
 
 #include "base/memory/ref_counted_memory.h"
 #include "base/trace_event/trace_event.h"
-#include "third_party/skia/include/core/SkRect.h"
 #include "third_party/skia/include/core/SkStream.h"
-#include "ui/gfx/geometry/size.h"
 
-namespace gfx {
+namespace cc {
 
 SkottieWrapper::SkottieWrapper(
     const scoped_refptr<base::RefCountedMemory>& data_stream) {
-  TRACE_EVENT0("ui", "SkottieWrapper Parse");
+  TRACE_EVENT0("cc", "SkottieWrapper Parse");
   SkMemoryStream sk_stream(data_stream->front(), data_stream->size());
   animation_ = skottie::Animation::Make(&sk_stream);
 }
@@ -24,13 +22,10 @@
 
 SkottieWrapper::~SkottieWrapper() {}
 
-void SkottieWrapper::Draw(SkCanvas* canvas, float t, const gfx::Size& size) {
-  SkRect dst = SkRect::MakeXYWH(0, 0, size.width(), size.height());
-  {
-    base::AutoLock lock(lock_);
-    animation_->seek(t);
-    animation_->render(canvas, &dst);
-  }
+void SkottieWrapper::Draw(SkCanvas* canvas, float t, const SkRect& rect) {
+  base::AutoLock lock(lock_);
+  animation_->seek(t);
+  animation_->render(canvas, &rect);
 }
 
-}  // namespace gfx
+}  // namespace cc
diff --git a/ui/gfx/skottie_wrapper.h b/cc/paint/skottie_wrapper.h
similarity index 71%
rename from ui/gfx/skottie_wrapper.h
rename to cc/paint/skottie_wrapper.h
index 006d0cd2..f4e312e 100644
--- a/ui/gfx/skottie_wrapper.h
+++ b/cc/paint/skottie_wrapper.h
@@ -2,16 +2,17 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef UI_GFX_SKOTTIE_WRAPPER_H_
-#define UI_GFX_SKOTTIE_WRAPPER_H_
+#ifndef CC_PAINT_SKOTTIE_WRAPPER_H_
+#define CC_PAINT_SKOTTIE_WRAPPER_H_
 
 #include <memory>
 
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/synchronization/lock.h"
+#include "cc/paint/paint_export.h"
+#include "third_party/skia/include/core/SkRect.h"
 #include "third_party/skia/modules/skottie/include/Skottie.h"
-#include "ui/gfx/gfx_export.h"
 
 class SkCanvas;
 class SkMemoryStream;
@@ -20,22 +21,21 @@
 class RefCountedMemory;
 }  // namespace base
 
-namespace gfx {
-class Size;
+namespace cc {
 
 // A wrapper over Skia's Skottie object that can be shared by multiple
 // SkiaVectorAnimation objects. This class is thread safe when performing a draw
 // on an SkCanvas.
-class GFX_EXPORT SkottieWrapper
+class CC_PAINT_EXPORT SkottieWrapper
     : public base::RefCountedThreadSafe<SkottieWrapper> {
  public:
   explicit SkottieWrapper(
       const scoped_refptr<base::RefCountedMemory>& data_stream);
   explicit SkottieWrapper(std::unique_ptr<SkMemoryStream> stream);
 
-  // A thread safe call that will draw an image of size |size| for the frame at
-  // normalized time instant |t| onto the |canvas|.
-  void Draw(SkCanvas* canvas, float t, const Size& size);
+  // A thread safe call that will draw an image with bounds |rect| for the
+  // frame at normalized time instant |t| onto the |canvas|.
+  void Draw(SkCanvas* canvas, float t, const SkRect& rect);
 
   float duration() const { return animation_->duration(); }
   SkSize size() const { return animation_->size(); }
@@ -50,6 +50,6 @@
   DISALLOW_COPY_AND_ASSIGN(SkottieWrapper);
 };
 
-}  // namespace gfx
+}  // namespace cc
 
-#endif  // UI_GFX_SKOTTIE_WRAPPER_H_
+#endif  // CC_PAINT_SKOTTIE_WRAPPER_H_
diff --git a/cc/raster/raster_buffer_provider_perftest.cc b/cc/raster/raster_buffer_provider_perftest.cc
index bbdd6f5..63dd9fd9 100644
--- a/cc/raster/raster_buffer_provider_perftest.cc
+++ b/cc/raster/raster_buffer_provider_perftest.cc
@@ -86,7 +86,7 @@
     capabilities_.sync_query = true;
 
     raster_context_ = std::make_unique<gpu::raster::RasterImplementationGLES>(
-        context_gl_.get(), nullptr, capabilities_);
+        context_gl_.get(), capabilities_);
   }
 
   // viz::ContextProvider implementation.
diff --git a/cc/test/test_in_process_context_provider.cc b/cc/test/test_in_process_context_provider.cc
index 8288b859..b1dcbfa1 100644
--- a/cc/test/test_in_process_context_provider.cc
+++ b/cc/test/test_in_process_context_provider.cc
@@ -115,7 +115,6 @@
     raster_implementation_gles2_ =
         std::make_unique<gpu::raster::RasterImplementationGLES>(
             gles2_context_->GetImplementation(),
-            gles2_context_->GetImplementation()->command_buffer(),
             gles2_context_->GetCapabilities());
   }
 
diff --git a/cc/trees/layer_tree_host_impl.cc b/cc/trees/layer_tree_host_impl.cc
index c4ae436..75844f69 100644
--- a/cc/trees/layer_tree_host_impl.cc
+++ b/cc/trees/layer_tree_host_impl.cc
@@ -2905,22 +2905,14 @@
   // Dump property trees and layers if run with:
   //   --vmodule=layer_tree_host_impl=3
   if (VLOG_IS_ON(3)) {
-    VLOG(3) << "After activating sync tree, the active tree:";
-    // Because the property tree and layer list output can be verbose, the VLOG
-    // output is split by line to avoid line buffer limits on android.
-    VLOG(3) << "property trees:";
     std::string property_trees;
     base::JSONWriter::WriteWithOptions(
         *active_tree_->property_trees()->AsTracedValue()->ToBaseValue(),
         base::JSONWriter::OPTIONS_PRETTY_PRINT, &property_trees);
-    std::stringstream property_trees_stream(property_trees);
-    for (std::string line; std::getline(property_trees_stream, line);)
-      VLOG(3) << line;
-
-    VLOG(3) << "layers:";
-    std::stringstream layers_stream(LayerListAsJson());
-    for (std::string line; std::getline(layers_stream, line);)
-      VLOG(3) << line;
+    VLOG(3) << "After activating sync tree, the active tree:"
+            << "\nproperty_trees:\n"
+            << property_trees << "\nlayers:\n"
+            << LayerListAsJson();
   }
 }
 
diff --git a/chrome/android/feed/core/java/src/org/chromium/chrome/browser/feed/FeedAppLifecycle.java b/chrome/android/feed/core/java/src/org/chromium/chrome/browser/feed/FeedAppLifecycle.java
index 0db2bab..8e3fbd6 100644
--- a/chrome/android/feed/core/java/src/org/chromium/chrome/browser/feed/FeedAppLifecycle.java
+++ b/chrome/android/feed/core/java/src/org/chromium/chrome/browser/feed/FeedAppLifecycle.java
@@ -86,8 +86,8 @@
             mFeedScheduler.onForegrounded();
         }
 
-        SigninManager.get().addSignInStateObserver(this);
         ApplicationStatus.registerStateListenerForAllActivities(this);
+        SigninManager.get().addSignInStateObserver(this);
     }
 
     /**
diff --git a/chrome/android/feed/core/java/src/org/chromium/chrome/browser/feed/FeedNewTabPage.java b/chrome/android/feed/core/java/src/org/chromium/chrome/browser/feed/FeedNewTabPage.java
index 5faf2c6..3a03b75f8 100644
--- a/chrome/android/feed/core/java/src/org/chromium/chrome/browser/feed/FeedNewTabPage.java
+++ b/chrome/android/feed/core/java/src/org/chromium/chrome/browser/feed/FeedNewTabPage.java
@@ -433,9 +433,10 @@
             Profile profile = Profile.getLastUsedProfile().getOriginalProfile();
             FeedAppLifecycle feedAppLifecycle = new FeedAppLifecycle(
                     lifecycleListener, new FeedLifecycleBridge(profile), feedScheduler);
+            FeedLoggingBridge loggingBridge = new FeedLoggingBridge(profile);
             FeedProcessScopeFactory.createFeedProcessScopeForTesting(feedScheduler,
                     new TestNetworkClient(), new TestFeedOfflineIndicator(), feedAppLifecycle,
-                    lifecycleListener);
+                    lifecycleListener, loggingBridge);
         } else {
             FeedProcessScopeFactory.clearFeedProcessScopeForTesting();
         }
diff --git a/chrome/android/feed/core/java/src/org/chromium/chrome/browser/feed/FeedProcessScopeFactory.java b/chrome/android/feed/core/java/src/org/chromium/chrome/browser/feed/FeedProcessScopeFactory.java
index cd843ce1..4e13c8b 100644
--- a/chrome/android/feed/core/java/src/org/chromium/chrome/browser/feed/FeedProcessScopeFactory.java
+++ b/chrome/android/feed/core/java/src/org/chromium/chrome/browser/feed/FeedProcessScopeFactory.java
@@ -26,8 +26,10 @@
 
 /** Holds singleton {@link FeedProcessScope} and some of the scope's host implementations. */
 public class FeedProcessScopeFactory {
-    private static boolean sIsDisableForPolicy =
-            !PrefServiceBridge.getInstance().getBoolean(Pref.NTP_ARTICLES_SECTION_ENABLED);
+    /** Lazily-initialized flag that tracks whether we've been disabled via enterprise policy. This
+     * is initialized in isFeedProcessScopeEnabled by checking the pref value directly, and updated
+     * via articlesEnabledPrefChange. */
+    private static Boolean sIsDisabledForPolicy;
     private static PrefChangeRegistrar sPrefChangeRegistrar;
     private static FeedAppLifecycle sFeedAppLifecycle;
     private static FeedProcessScope sFeedProcessScope;
@@ -88,8 +90,12 @@
      *         within the current session.
      */
     public static boolean isFeedProcessEnabled() {
-        return !sIsDisableForPolicy
-                && PrefServiceBridge.getInstance().getBoolean(Pref.NTP_ARTICLES_SECTION_ENABLED);
+        if (sIsDisabledForPolicy == null) {
+            sIsDisabledForPolicy =
+                    !PrefServiceBridge.getInstance().getBoolean(Pref.NTP_ARTICLES_SECTION_ENABLED);
+        }
+
+        return !sIsDisabledForPolicy;
     }
 
     private static void initialize() {
@@ -143,8 +149,12 @@
     @VisibleForTesting
     static void createFeedProcessScopeForTesting(FeedScheduler feedScheduler,
             NetworkClient networkClient, FeedOfflineIndicator feedOfflineIndicator,
-            FeedAppLifecycle feedAppLifecycle, FeedAppLifecycleListener lifecycleListener) {
+            FeedAppLifecycle feedAppLifecycle, FeedAppLifecycleListener lifecycleListener,
+            FeedLoggingBridge loggingBridge) {
         Configuration configHostApi = FeedConfiguration.createConfiguration();
+        // If you're using this, we presume that you want the Feed to be turned on.
+        sIsDisabledForPolicy = false;
+
         sFeedScheduler = feedScheduler;
         ApplicationInfo applicationInfo =
                 new ApplicationInfo.Builder(ContextUtils.getApplicationContext()).build();
@@ -157,6 +167,7 @@
                                     .build();
         sFeedOfflineIndicator = feedOfflineIndicator;
         sFeedAppLifecycle = feedAppLifecycle;
+        sFeedLoggingBridge = loggingBridge;
     }
 
     /** Use supplied NetworkClient instead of real one, for tests. */
@@ -182,7 +193,7 @@
         // Should only be subscribed while it was enabled. A change should mean articles are now
         // disabled.
         assert !PrefServiceBridge.getInstance().getBoolean(Pref.NTP_ARTICLES_SECTION_ENABLED);
-        sIsDisableForPolicy = true;
+        sIsDisabledForPolicy = true;
         destroy();
     }
 
diff --git a/chrome/android/java/AndroidManifest.xml b/chrome/android/java/AndroidManifest.xml
index c61da77..9d7cb69 100644
--- a/chrome/android/java/AndroidManifest.xml
+++ b/chrome/android/java/AndroidManifest.xml
@@ -1052,7 +1052,7 @@
             {% endif %} />
         {% endfor %}
 
-        {% set num_privileged_services = 3 %}
+        {% set num_privileged_services = 5 %}
         <meta-data android:name="org.chromium.content.browser.NUM_PRIVILEGED_SERVICES"
             android:value="{{ num_privileged_services }}"/>
 
diff --git a/chrome/android/java/res/drawable-hdpi/ic_error_grey800_24dp_filled.png b/chrome/android/java/res/drawable-hdpi/ic_error_grey800_24dp_filled.png
deleted file mode 100644
index bf2b62a8..0000000
--- a/chrome/android/java/res/drawable-hdpi/ic_error_grey800_24dp_filled.png
+++ /dev/null
Binary files differ
diff --git a/chrome/android/java/res/drawable-hdpi/ic_error_white_24dp_filled.png b/chrome/android/java/res/drawable-hdpi/ic_error_white_24dp_filled.png
deleted file mode 100644
index fa6ac05..0000000
--- a/chrome/android/java/res/drawable-hdpi/ic_error_white_24dp_filled.png
+++ /dev/null
Binary files differ
diff --git a/chrome/android/java/res/drawable-mdpi/ic_error_grey800_24dp_filled.png b/chrome/android/java/res/drawable-mdpi/ic_error_grey800_24dp_filled.png
deleted file mode 100644
index 37100ae..0000000
--- a/chrome/android/java/res/drawable-mdpi/ic_error_grey800_24dp_filled.png
+++ /dev/null
Binary files differ
diff --git a/chrome/android/java/res/drawable-mdpi/ic_error_white_24dp_filled.png b/chrome/android/java/res/drawable-mdpi/ic_error_white_24dp_filled.png
deleted file mode 100644
index d9506cb..0000000
--- a/chrome/android/java/res/drawable-mdpi/ic_error_white_24dp_filled.png
+++ /dev/null
Binary files differ
diff --git a/chrome/android/java/res/drawable-xhdpi/ic_error_grey800_24dp_filled.png b/chrome/android/java/res/drawable-xhdpi/ic_error_grey800_24dp_filled.png
deleted file mode 100644
index 9e085ed..0000000
--- a/chrome/android/java/res/drawable-xhdpi/ic_error_grey800_24dp_filled.png
+++ /dev/null
Binary files differ
diff --git a/chrome/android/java/res/drawable-xhdpi/ic_error_white_24dp_filled.png b/chrome/android/java/res/drawable-xhdpi/ic_error_white_24dp_filled.png
deleted file mode 100644
index a5826be7..0000000
--- a/chrome/android/java/res/drawable-xhdpi/ic_error_white_24dp_filled.png
+++ /dev/null
Binary files differ
diff --git a/chrome/android/java/res/drawable-xxhdpi/ic_error_grey800_24dp_filled.png b/chrome/android/java/res/drawable-xxhdpi/ic_error_grey800_24dp_filled.png
deleted file mode 100644
index 66c931f..0000000
--- a/chrome/android/java/res/drawable-xxhdpi/ic_error_grey800_24dp_filled.png
+++ /dev/null
Binary files differ
diff --git a/chrome/android/java/res/drawable-xxhdpi/ic_error_white_24dp_filled.png b/chrome/android/java/res/drawable-xxhdpi/ic_error_white_24dp_filled.png
deleted file mode 100644
index 99bfbe8..0000000
--- a/chrome/android/java/res/drawable-xxhdpi/ic_error_white_24dp_filled.png
+++ /dev/null
Binary files differ
diff --git a/chrome/android/java/res/drawable-xxxhdpi/ic_error_grey800_24dp_filled.png b/chrome/android/java/res/drawable-xxxhdpi/ic_error_grey800_24dp_filled.png
deleted file mode 100644
index 8acc442..0000000
--- a/chrome/android/java/res/drawable-xxxhdpi/ic_error_grey800_24dp_filled.png
+++ /dev/null
Binary files differ
diff --git a/chrome/android/java/res/drawable-xxxhdpi/ic_error_white_24dp_filled.png b/chrome/android/java/res/drawable-xxxhdpi/ic_error_white_24dp_filled.png
deleted file mode 100644
index b1aae4d4..0000000
--- a/chrome/android/java/res/drawable-xxxhdpi/ic_error_white_24dp_filled.png
+++ /dev/null
Binary files differ
diff --git a/chrome/android/java/res/layout/os_version_unsupported_preference.xml b/chrome/android/java/res/layout/os_version_unsupported_preference.xml
deleted file mode 100644
index da81d15..0000000
--- a/chrome/android/java/res/layout/os_version_unsupported_preference.xml
+++ /dev/null
@@ -1,39 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Copyright 2018 The Chromium Authors. All rights reserved.
-     Use of this source code is governed by a BSD-style license that can be
-     found in the LICENSE file. -->
-
-<!-- Layout for a preference with a title and a compound drawable below. -->
-<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
-    style="@style/PreferenceLayout"
-    android:layout_width="match_parent"
-    android:layout_height="wrap_content"
-    android:orientation="vertical">
-
-    <TextView
-        android:id="@android:id/title"
-        style="@style/PreferenceTitle"
-        android:layout_width="match_parent"
-        android:layout_height="wrap_content"
-        android:text="@string/os_version_title" />
-
-    <TextView
-        android:id="@android:id/summary"
-        style="@style/PreferenceSummary"
-        android:layout_width="match_parent"
-        android:layout_height="wrap_content" />
-
-    <TextView
-        android:id="@+id/os_deprecation_warning"
-        style="@style/PreferenceSummary"
-        android:layout_marginTop="7dp"
-        android:layout_width="match_parent"
-        android:layout_height="0dp"
-        android:layout_weight="1"
-        android:layout_gravity="center_vertical"
-        android:text="@string/deprecation_warning"
-        android:drawablePadding="30dp"
-        android:drawableEnd="@drawable/exclamation_triangle"
-        android:layout_marginEnd="17dp"
-        android:visibility="gone" />
-</LinearLayout>
diff --git a/chrome/android/java/res/layout/toolbar_tablet.xml b/chrome/android/java/res/layout/toolbar_tablet.xml
index e4aacfc..1ec3e2f 100644
--- a/chrome/android/java/res/layout/toolbar_tablet.xml
+++ b/chrome/android/java/res/layout/toolbar_tablet.xml
@@ -68,7 +68,7 @@
             android:contentDescription="@string/accessibility_toolbar_btn_tabswitcher_toggle_default"
             android:visibility="gone" />
 
-        <org.chromium.chrome.browser.toolbar.MenuButton
+        <FrameLayout
             android:layout_width="wrap_content"
             android:layout_height="wrap_content"
             android:id="@+id/menu_button_wrapper" >
@@ -78,7 +78,6 @@
                 style="@style/ToolbarMenuButtonTablet"
                 android:src="@drawable/ic_more_vert_black_24dp"
                 android:contentDescription="@string/accessibility_toolbar_btn_menu"
-                android:layout_gravity="center"
                 app:tint="@color/dark_mode_tint" />
 
             <ImageView
@@ -87,9 +86,8 @@
                 android:src="@drawable/badge_update_dark"
                 tools:ignore="ContentDescription"
                 android:importantForAccessibility="no"
-                android:layout_gravity="center"
                 android:visibility="invisible" />
 
-        </org.chromium.chrome.browser.toolbar.MenuButton>
+        </FrameLayout>
     </LinearLayout>
 </org.chromium.chrome.browser.toolbar.ToolbarTablet>
diff --git a/chrome/android/java/res/values-v17/styles.xml b/chrome/android/java/res/values-v17/styles.xml
index 077aeee..c7e7409 100644
--- a/chrome/android/java/res/values-v17/styles.xml
+++ b/chrome/android/java/res/values-v17/styles.xml
@@ -207,6 +207,9 @@
         <item name="android:paddingEnd">8dp</item>
     </style>
     <style name="PreferenceLayout" parent="PreferenceLayoutBase" />
+    <style name="DeprecationWarningPreferenceTheme" parent="PreferencesTheme">
+        <item name="android:textAppearance">@style/BlackBodyDefault</item>
+    </style>
     <style name="PreferenceSpinnerItem">
         <item name="android:textAppearance">@style/TextAppearance.PreferenceMediumText</item>
     </style>
diff --git a/chrome/android/java/res/values/dimens.xml b/chrome/android/java/res/values/dimens.xml
index 6ccf07d..16e47fab 100644
--- a/chrome/android/java/res/values/dimens.xml
+++ b/chrome/android/java/res/values/dimens.xml
@@ -544,6 +544,8 @@
 
     <!-- Download manager dimensions -->
     <dimen name="download_manager_ideal_image_width">150dp</dimen>
+    <dimen name="download_manager_max_image_item_width_wide_screen">300dp</dimen>
+    <dimen name="download_manager_wide_screen_threshold">600dp</dimen>
     <dimen name="download_manager_image_padding">2dp</dimen>
     <dimen name="download_manager_prefetch_horizontal_margin">16dp</dimen>
     <dimen name="download_manager_prefetch_vertical_margin">12dp</dimen>
diff --git a/chrome/android/java/res/xml/about_chrome_preferences.xml b/chrome/android/java/res/xml/about_chrome_preferences.xml
index e1ddc30..5b8de44f 100644
--- a/chrome/android/java/res/xml/about_chrome_preferences.xml
+++ b/chrome/android/java/res/xml/about_chrome_preferences.xml
@@ -7,7 +7,7 @@
     <Preference
         android:key="application_version"
         android:title="@string/application_version_title" />
-    <org.chromium.chrome.browser.preferences.AboutChromePreferenceOSVersion
+    <Preference
         android:key="os_version"
         android:title="@string/os_version_title" />
     <Preference
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeActivity.java
index ce7cca3..b74518f 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeActivity.java
@@ -2074,8 +2074,9 @@
 
     /**
      * Callback after UpdateMenuItemHelper#checkForUpdateOnBackgroundThread is complete.
+     * @param updateAvailable Whether an update is available.
      */
-    public void onCheckForUpdate() {
+    public void onCheckForUpdate(boolean updateAvailable) {
         if (UpdateMenuItemHelper.getInstance().shouldShowToolbarBadge(this)) {
             mToolbarManager.showAppMenuUpdateBadge();
             mCompositorViewHolder.requestRender();
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeFeatureList.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeFeatureList.java
index bef70fe1..72a447f 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeFeatureList.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeFeatureList.java
@@ -230,7 +230,6 @@
     public static final String INFLATE_TOOLBAR_ON_BACKGROUND_THREAD = "BackgroundToolbarInflation";
     public static final String INTEREST_FEED_CONTENT_SUGGESTIONS = "InterestFeedContentSuggestions";
     public static final String LANGUAGES_PREFERENCE = "LanguagesPreference";
-    public static final String JELLY_BEAN_SUPPORTED = "JellyBeanSupported";
     public static final String LONG_PRESS_BACK_FOR_HISTORY = "LongPressBackForHistory";
     public static final String SEARCH_ENGINE_PROMO_EXISTING_DEVICE =
             "SearchEnginePromo.ExistingDevice";
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeSwitches.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeSwitches.java
index 7542c321..4ed78b96 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeSwitches.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeSwitches.java
@@ -68,26 +68,17 @@
     public static final String DISABLE_LOFI_SNACKBAR = "disable-lo-fi-snackbar";
 
     /**
-     * Forces the update state to be set to the given state if the value is {@link
-     * org.chromium.chrome.browser.omaha.UpdateMenuItemHelper#NONE_SWITCH_VALUE}, {@link
-     * org.chromium.chrome.browser.omaha.UpdateMenuItemHelper#UPDATE_AVAILABLE_SWITCH_VALUE},
-     * {@link
-     * org.chromium.chrome.browser.omaha.UpdateMenuItemHelper#UNSUPPORTED_OS_VERSION_SWITCH_VALUE}.
+     * Forces the update menu item to show.
      */
-    public static final String FORCE_UPDATE_MENU_UPDATE_TYPE = "force-update-menu-type";
+    public static final String FORCE_SHOW_UPDATE_MENU_ITEM = "force-show-update-menu-item";
 
     /**
-     * Forces the update menu badge to show. This requires the update type to be valid as well.
-     *
-     * @see #FORCE_UPDATE_MENU_UPDATE_TYPE
+     * Forces the update menu badge to show.
      */
     public static final String FORCE_SHOW_UPDATE_MENU_BADGE = "force-show-update-menu-badge";
 
     /**
-     * Sets the market URL for Chrome for use in testing. This requires setting {@link
-     * #FORCE_UPDATE_MENU_UPDATE_TYPE} to {@link
-     * org.chromium.chrome.browser.omaha.UpdateMenuItemHelper#UPDATE_AVAILABLE_SWITCH_VALUE}.
-     * @see #FORCE_UPDATE_MENU_UPDATE_TYPE
+     * Sets the market URL for Chrome for use in testing.
      */
     public static final String MARKET_URL_FOR_TESTING = "market-url-for-testing";
 
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
index cf90a723..5ab0596 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
@@ -449,7 +449,7 @@
         }
 
         String referrerUrl = getReferrerUrlIncludingExtraHeaders(intent);
-        String extraHeaders = getExtraHeadersFromIntent(intent);
+        String extraHeaders = getExtraHeadersFromIntent(intent, true);
 
         if (isIntentForMhtmlFileOrContent(intent) && tabOpenType == TabOpenType.OPEN_NEW_TAB
                 && referrerUrl == null && extraHeaders == null) {
@@ -551,7 +551,7 @@
         if (referrer != null) {
             params.setReferrer(new Referrer(referrer, getReferrerPolicyFromIntent(intent)));
         }
-        String headers = getExtraHeadersFromIntent(intent);
+        String headers = getExtraHeadersFromIntent(intent, true);
         if (headers != null) params.setVerbatimHeaders(headers);
     }
 
@@ -727,22 +727,38 @@
     }
 
     /**
+     * Calls {@link #getExtraHeadersFromIntent(Intent, boolean)} with shouldLogHeaders as false.
+     */
+    public static String getExtraHeadersFromIntent(Intent intent) {
+        return getExtraHeadersFromIntent(intent, false);
+    }
+
+    /**
      * Returns a String (or null) containing the extra headers sent by the intent, if any.
      *
      * This methods skips the referrer header.
      *
      * @param intent The intent containing the bundle extra with the HTTP headers.
+     * @param shouldLogHeaders Whether we should perform logging on the types of headers that the
+     *                         Intent contains. This should only be done for Intents as they come
+     *                         in to Chrome.
      */
-    public static String getExtraHeadersFromIntent(Intent intent) {
+    public static String getExtraHeadersFromIntent(Intent intent, boolean shouldLogHeaders) {
         Bundle bundleExtraHeaders = IntentUtils.safeGetBundleExtra(intent, Browser.EXTRA_HEADERS);
         if (bundleExtraHeaders == null) return null;
         StringBuilder extraHeaders = new StringBuilder();
+
+        // We do some logging to determine what kinds of headers developers are inserting.
+        IntentHeadersRecorder recorder = shouldLogHeaders ? new IntentHeadersRecorder() : null;
+
         for (String key : bundleExtraHeaders.keySet()) {
             String value = bundleExtraHeaders.getString(key);
 
             // Strip the custom header that can only be added by ourselves.
             if ("x-chrome-intent-type".equals(key.toLowerCase(Locale.US))) continue;
 
+            if (shouldLogHeaders) recorder.recordHeader(key, value);
+
             if (!HttpUtil.isAllowedHeader(key, value)) continue;
 
             if (extraHeaders.length() != 0) extraHeaders.append("\n");
@@ -750,6 +766,10 @@
             extraHeaders.append(": ");
             extraHeaders.append(value);
         }
+
+        if (shouldLogHeaders) {
+            recorder.report(IntentHandler.notSecureIsIntentChromeOrFirstParty(intent));
+        }
         return extraHeaders.length() == 0 ? null : extraHeaders.toString();
     }
 
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/IntentHeadersRecorder.java b/chrome/android/java/src/org/chromium/chrome/browser/IntentHeadersRecorder.java
new file mode 100644
index 0000000..1b57405
--- /dev/null
+++ b/chrome/android/java/src/org/chromium/chrome/browser/IntentHeadersRecorder.java
@@ -0,0 +1,105 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.chrome.browser;
+
+import android.support.annotation.IntDef;
+
+import org.chromium.base.VisibleForTesting;
+import org.chromium.base.annotations.JNINamespace;
+import org.chromium.base.annotations.NativeCall;
+import org.chromium.base.metrics.RecordHistogram;
+
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+
+/**
+ * Collects information about the HTTP headers passed into an Intent as Browser.EXTRA_HEADERS and
+ * records UMA. Call {@link #recordHeader} for each header in the Intent and {@link #report}
+ * afterwards.
+ *
+ * Lifecycle: Create an instance of this class for each Intent whose Headers you want to record.
+ * Thread safety: All methods on this class should be called on the UI thread.
+ */
+public class IntentHeadersRecorder {
+    /** Determines whether a header is CORS Safelisted or not. */
+    @JNINamespace("chrome::android")
+    /* package */ static class HeaderClassifier {
+        /* package */ boolean isCorsSafelistedHeader(String name, String value) {
+            return nativeIsCorsSafelistedHeader(name, value);
+        }
+
+        @NativeCall("HeaderClassifier")
+        private static native boolean nativeIsCorsSafelistedHeader(String name, String value);
+    }
+
+    @Retention(RetentionPolicy.SOURCE)
+    @IntDef({IntentHeadersResult.FIRST_PARTY_NO_HEADERS,
+            IntentHeadersResult.FIRST_PARTY_ONLY_SAFE_HEADERS,
+            IntentHeadersResult.FIRST_PARTY_UNSAFE_HEADERS,
+            IntentHeadersResult.THIRD_PARTY_NO_HEADERS,
+            IntentHeadersResult.THIRD_PARTY_ONLY_SAFE_HEADERS,
+            IntentHeadersResult.THIRD_PARTY_UNSAFE_HEADERS})
+    @VisibleForTesting
+    @interface IntentHeadersResult {
+        // Don't reuse or reorder values. If you add something, update NUM_ENTRIES.
+        int FIRST_PARTY_NO_HEADERS = 0;
+        int FIRST_PARTY_ONLY_SAFE_HEADERS = 1;
+        int FIRST_PARTY_UNSAFE_HEADERS = 2;
+        int THIRD_PARTY_NO_HEADERS = 3;
+        int THIRD_PARTY_ONLY_SAFE_HEADERS = 4;
+        int THIRD_PARTY_UNSAFE_HEADERS = 5;
+        int NUM_ENTRIES = 6;
+    }
+
+    private final HeaderClassifier mClassifier;
+    private int mSafeHeaders;
+    private int mUnsafeHeaders;
+
+    /** Creates this class with a custom classifier (for testing). */
+    public IntentHeadersRecorder(HeaderClassifier classifier) {
+        mClassifier = classifier;
+    }
+
+    /** Creates this class with a classifier that checks Chrome native code. */
+    public IntentHeadersRecorder() {
+        this(new HeaderClassifier());
+    }
+
+    /* Records that a HTTP header has been used. */
+    public void recordHeader(String name, String value) {
+        if (mClassifier.isCorsSafelistedHeader(name, value)) mSafeHeaders++;
+        else mUnsafeHeaders++;
+    }
+
+    /**
+     * Logs the types of headers that have previously been {@link #recordHeader}ed.
+     * @param firstParty Whether the Intent is from a first or third party app. As it is just for
+     *                   logging, this is not security sensitive.
+     */
+    public void report(boolean firstParty) {
+        if (firstParty) {
+            if (mSafeHeaders == 0 && mUnsafeHeaders == 0) {
+                record(IntentHeadersResult.FIRST_PARTY_NO_HEADERS);
+            } else if (mUnsafeHeaders == 0) {
+                record(IntentHeadersResult.FIRST_PARTY_ONLY_SAFE_HEADERS);
+            } else {
+                record(IntentHeadersResult.FIRST_PARTY_UNSAFE_HEADERS);
+            }
+        } else {
+            if (mSafeHeaders == 0 && mUnsafeHeaders == 0) {
+                record(IntentHeadersResult.THIRD_PARTY_NO_HEADERS);
+            } else if (mUnsafeHeaders == 0) {
+                record(IntentHeadersResult.THIRD_PARTY_ONLY_SAFE_HEADERS);
+            } else {
+                record(IntentHeadersResult.THIRD_PARTY_UNSAFE_HEADERS);
+            }
+        }
+    }
+
+    private static void record(@IntentHeadersResult int result) {
+        RecordHistogram.recordEnumeratedHistogram("Android.IntentHeaders", result,
+                IntentHeadersResult.NUM_ENTRIES);
+    }
+}
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/SingleTabActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/SingleTabActivity.java
index 14c5fe6c..675910d 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/SingleTabActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/SingleTabActivity.java
@@ -136,5 +136,5 @@
     }
 
     @Override
-    public void onCheckForUpdate() {}
+    public void onCheckForUpdate(boolean updateAvailable) {}
 }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/appmenu/AppMenuAdapter.java b/chrome/android/java/src/org/chromium/chrome/browser/appmenu/AppMenuAdapter.java
index 4e1a3b5..d366028 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/appmenu/AppMenuAdapter.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/appmenu/AppMenuAdapter.java
@@ -197,8 +197,13 @@
                     holder = (CustomMenuItemViewHolder) convertView.getTag();
                 }
                 setupStandardMenuItemViewHolder(holder, convertView, item);
-                UpdateMenuItemHelper.getInstance().decorateMenuItemViews(
-                        mInflater.getContext(), holder.text, holder.image, holder.summary);
+                String summary = UpdateMenuItemHelper.getInstance().getMenuItemSummaryText(
+                        mInflater.getContext());
+                if (TextUtils.isEmpty(summary)) {
+                    holder.summary.setVisibility(View.GONE);
+                } else {
+                    holder.summary.setText(summary);
+                }
                 break;
             }
             case MenuItemType.THREE_BUTTON:
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabActivity.java
index 5249819b..681b9aaf 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabActivity.java
@@ -1359,7 +1359,8 @@
     }
 
     @Override
-    public void onCheckForUpdate() {}
+    public void onCheckForUpdate(boolean updateAvailable) {
+    }
 
     /**
      * @return The {@link CustomTabIntentDataProvider} for this {@link CustomTabActivity}. For test
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/download/home/DownloadManagerUiConfig.java b/chrome/android/java/src/org/chromium/chrome/browser/download/home/DownloadManagerUiConfig.java
index da10601..39fbcda8 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/download/home/DownloadManagerUiConfig.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/download/home/DownloadManagerUiConfig.java
@@ -22,6 +22,16 @@
 
     /** Whether showing full width images should be supported. */
     public final boolean supportFullWidthImages;
+
+    /** Whether or not to use the legacy download path or use the new OfflineContentProvider. */
+    public final boolean useNewDownloadPath;
+
+    /**
+     * Whether or not to use the legacy download thumbnail path or use the new
+     * OfflineContentProvider.
+     */
+    public final boolean useNewDownloadPathThumbnails;
+
     /**
      * The time interval during which a download update is considered recent enough to show
      * in Just Now section.
@@ -34,6 +44,8 @@
         isSeparateActivity = builder.mIsSeparateActivity;
         useGenericViewTypes = builder.mUseGenericViewTypes;
         supportFullWidthImages = builder.mSupportFullWidthImages;
+        useNewDownloadPath = builder.mUseNewDownloadPath;
+        useNewDownloadPathThumbnails = builder.mUseNewDownloadPathThumbnails;
         justNowThresholdSeconds = builder.mJustNowThresholdSeconds;
     }
 
@@ -48,6 +60,8 @@
         private boolean mIsSeparateActivity;
         private boolean mUseGenericViewTypes;
         private boolean mSupportFullWidthImages;
+        private boolean mUseNewDownloadPath;
+        private boolean mUseNewDownloadPathThumbnails;
         private long mJustNowThresholdSeconds;
 
         public Builder() {
@@ -77,6 +91,16 @@
             return this;
         }
 
+        public Builder setUseNewDownloadPath(boolean useNewDownloadPath) {
+            mUseNewDownloadPath = useNewDownloadPath;
+            return this;
+        }
+
+        public Builder setUseNewDownloadPathThumbnails(boolean useNewDownloadPathThumbnails) {
+            mUseNewDownloadPathThumbnails = useNewDownloadPathThumbnails;
+            return this;
+        }
+
         public DownloadManagerUiConfig build() {
             return new DownloadManagerUiConfig(this);
         }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/download/home/glue/OfflineContentProviderGlue.java b/chrome/android/java/src/org/chromium/chrome/browser/download/home/glue/OfflineContentProviderGlue.java
index 8de7434c..a4391ed2 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/download/home/glue/OfflineContentProviderGlue.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/download/home/glue/OfflineContentProviderGlue.java
@@ -6,6 +6,7 @@
 
 import org.chromium.base.Callback;
 import org.chromium.base.ObserverList;
+import org.chromium.chrome.browser.download.home.DownloadManagerUiConfig;
 import org.chromium.chrome.browser.widget.ThumbnailProvider;
 import org.chromium.components.offline_items_collection.ContentId;
 import org.chromium.components.offline_items_collection.LaunchLocation;
@@ -29,16 +30,19 @@
     private final OfflineContentProvider mProvider;
     private final boolean mIncludeOffTheRecord;
 
+    private final boolean mUseNewDownloadPathThumbnails;
+
     private final DownloadGlue mDownloadProvider;
 
     private Query mOutstandingQuery;
 
     /** Creates an {@link OfflineContentProviderGlue} instance. */
     public OfflineContentProviderGlue(
-            OfflineContentProvider provider, boolean includeOffTheRecord) {
+            OfflineContentProvider provider, DownloadManagerUiConfig config) {
         mProvider = provider;
-        mIncludeOffTheRecord = includeOffTheRecord;
-        mDownloadProvider = new DownloadGlue(this);
+        mIncludeOffTheRecord = config.isOffTheRecord;
+        mDownloadProvider = config.useNewDownloadPath ? null : new DownloadGlue(this);
+        mUseNewDownloadPathThumbnails = config.useNewDownloadPathThumbnails;
 
         mProvider.addObserver(this);
     }
@@ -48,7 +52,7 @@
      * is no longer in use.
      */
     public void destroy() {
-        mDownloadProvider.destroy();
+        if (mDownloadProvider != null) mDownloadProvider.destroy();
         mProvider.removeObserver(this);
     }
 
@@ -57,7 +61,7 @@
     // easy use without this layer (we would only pass ID through).
     /** @see OfflineContentProvider#openItem(ContentId) */
     public void openItem(OfflineItem item) {
-        if (LegacyHelpers.isLegacyDownload(item.id)) {
+        if (mDownloadProvider != null && LegacyHelpers.isLegacyDownload(item.id)) {
             mDownloadProvider.openItem(item);
         } else {
             mProvider.openItem(LaunchLocation.DOWNLOAD_HOME, item.id);
@@ -66,7 +70,7 @@
 
     /** @see OfflineContentProvider#removeItem(ContentId) */
     public void removeItem(OfflineItem item) {
-        if (LegacyHelpers.isLegacyDownload(item.id)) {
+        if (mDownloadProvider != null && LegacyHelpers.isLegacyDownload(item.id)) {
             mDownloadProvider.removeItem(item);
         } else {
             mProvider.removeItem(item.id);
@@ -75,7 +79,7 @@
 
     /** @see OfflineContentProvider#cancelDownload(ContentId) */
     public void cancelDownload(OfflineItem item) {
-        if (LegacyHelpers.isLegacyDownload(item.id)) {
+        if (mDownloadProvider != null && LegacyHelpers.isLegacyDownload(item.id)) {
             mDownloadProvider.cancelDownload(item);
         } else {
             mProvider.cancelDownload(item.id);
@@ -84,7 +88,7 @@
 
     /** @see OfflineContentProvider#pauseDownload(ContentId) */
     public void pauseDownload(OfflineItem item) {
-        if (LegacyHelpers.isLegacyDownload(item.id)) {
+        if (mDownloadProvider != null && LegacyHelpers.isLegacyDownload(item.id)) {
             mDownloadProvider.pauseDownload(item);
         } else {
             mProvider.pauseDownload(item.id);
@@ -93,7 +97,7 @@
 
     /** @see OfflineContentProvider#resumeDownload(ContentId) */
     public void resumeDownload(OfflineItem item, boolean hasUserGesture) {
-        if (LegacyHelpers.isLegacyDownload(item.id)) {
+        if (mDownloadProvider != null && LegacyHelpers.isLegacyDownload(item.id)) {
             mDownloadProvider.resumeDownload(item, hasUserGesture);
         } else {
             mProvider.resumeDownload(item.id, hasUserGesture);
@@ -102,7 +106,7 @@
 
     /** @see OfflineContentProvider#getItemById(ContentId, Callback) */
     public void getItemById(ContentId id, Callback<OfflineItem> callback) {
-        if (LegacyHelpers.isLegacyDownload(id)) {
+        if (mDownloadProvider != null && LegacyHelpers.isLegacyDownload(id)) {
             mDownloadProvider.getItemById(id, callback);
         } else {
             mProvider.getItemById(id, callback);
@@ -120,7 +124,7 @@
      * @see OfflineContentProvider#getVisualsForItem(ContentId, VisualsCallback)
      */
     public boolean getVisualsForItem(ContentId id, VisualsCallback callback) {
-        if (LegacyHelpers.isLegacyDownload(id)) return false;
+        if (!mUseNewDownloadPathThumbnails && LegacyHelpers.isLegacyDownload(id)) return false;
         mProvider.getVisualsForItem(id, callback);
         return true;
     }
@@ -131,13 +135,13 @@
      * layer needs to determine what to do with downloads that have externally managed thumbnails.
      */
     public void removeVisualsForItem(ThumbnailProvider provider, ContentId id) {
-        if (!LegacyHelpers.isLegacyDownload(id)) return;
+        if (mUseNewDownloadPathThumbnails || !LegacyHelpers.isLegacyDownload(id)) return;
         provider.removeThumbnailsFromDisk(id.id);
     }
 
     /** @see OfflineContentProvider#getShareInfoForItem(ContentId, ShareCallback) */
     public void getShareInfoForItem(OfflineItem item, ShareCallback callback) {
-        if (LegacyHelpers.isLegacyDownload(item.id)) {
+        if (mDownloadProvider != null && LegacyHelpers.isLegacyDownload(item.id)) {
             mDownloadProvider.getShareInfoForItem(item, callback);
         } else {
             mProvider.getShareInfoForItem(item.id, callback);
@@ -188,11 +192,17 @@
         public Query() {
             mDownloadProviderOffTheRecordResponded = !mIncludeOffTheRecord;
 
-            if (mIncludeOffTheRecord) {
+            if (mDownloadProvider == null) {
+                mDownloadProviderResponded = true;
+                mDownloadProviderOffTheRecordResponded = true;
+            } else {
+                if (mIncludeOffTheRecord) {
+                    mDownloadProvider.getAllItems(
+                            items -> addOffTheRecordDownloads(items), true /* offTheRecord */);
+                }
                 mDownloadProvider.getAllItems(
-                        items -> addOffTheRecordDownloads(items), true /* offTheRecord */);
+                        items -> addDownloads(items), false /* offTheRecord */);
             }
-            mDownloadProvider.getAllItems(items -> addDownloads(items), false /* offTheRecord */);
 
             mProvider.getAllItems(items -> addOfflineItems(items));
         }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/download/home/list/DateOrderedListMediator.java b/chrome/android/java/src/org/chromium/chrome/browser/download/home/list/DateOrderedListMediator.java
index c43ba04..fb95378 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/download/home/list/DateOrderedListMediator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/download/home/list/DateOrderedListMediator.java
@@ -132,7 +132,7 @@
         //                             [DateOrderedListMutator] ->
         //                                 [ListItemModel]
 
-        mProvider = new OfflineContentProviderGlue(provider, config.isOffTheRecord);
+        mProvider = new OfflineContentProviderGlue(provider, config);
         mShareController = shareController;
         mModel = model;
         mDeleteController = deleteController;
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/download/home/list/DateOrderedListView.java b/chrome/android/java/src/org/chromium/chrome/browser/download/home/list/DateOrderedListView.java
index 71fc3a5..76b652c3 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/download/home/list/DateOrderedListView.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/download/home/list/DateOrderedListView.java
@@ -5,6 +5,7 @@
 package org.chromium.chrome.browser.download.home.list;
 
 import android.content.Context;
+import android.content.res.Configuration;
 import android.graphics.Rect;
 import android.support.annotation.Nullable;
 import android.support.v7.widget.DefaultItemAnimator;
@@ -35,6 +36,8 @@
     private final int mImagePaddingPx;
     private final int mPrefetchVerticalPaddingPx;
     private final int mPrefetchHorizontalPaddingPx;
+    private final int mMaxWidthImageItemPx;
+    private final int mWideScreenThreshold;
 
     private final RecyclerView mView;
 
@@ -52,8 +55,23 @@
                 R.dimen.download_manager_prefetch_horizontal_margin);
         mPrefetchVerticalPaddingPx = context.getResources().getDimensionPixelSize(
                 R.dimen.download_manager_prefetch_vertical_margin);
+        mMaxWidthImageItemPx = context.getResources().getDimensionPixelSize(
+                R.dimen.download_manager_max_image_item_width_wide_screen);
+        mWideScreenThreshold = context.getResources().getDimensionPixelSize(
+                R.dimen.download_manager_wide_screen_threshold);
 
-        mView = new RecyclerView(context);
+        mView = new RecyclerView(context) {
+            private int mScreenOrientation = Configuration.ORIENTATION_UNDEFINED;
+
+            @Override
+            protected void onConfigurationChanged(Configuration newConfig) {
+                super.onConfigurationChanged(newConfig);
+                if (newConfig.orientation == mScreenOrientation) return;
+
+                mScreenOrientation = newConfig.orientation;
+                mView.invalidateItemDecorations();
+            }
+        };
         mView.setHasFixedSize(true);
         ((DefaultItemAnimator) mView.getItemAnimator()).setSupportsChangeAnimations(false);
         mView.getItemAnimator().setMoveDuration(0);
@@ -126,6 +144,8 @@
             int position = parent.getChildAdapterPosition(view);
             if (position < 0 || position >= mModel.size()) return;
 
+            ListItem item = mModel.get(position);
+            boolean isFullWidthMedia = false;
             switch (ListUtils.getViewTypeForItem(mModel.get(position), mConfig)) {
                 case ListUtils.ViewType.IMAGE:
                 case ListUtils.ViewType.IN_PROGRESS_IMAGE:
@@ -133,6 +153,7 @@
                     outRect.right = mImagePaddingPx;
                     outRect.top = mImagePaddingPx;
                     outRect.bottom = mImagePaddingPx;
+                    isFullWidthMedia = ((ListItem.OfflineItemListItem) item).spanFullWidth;
                     break;
                 case ListUtils.ViewType.VIDEO: // Intentional fallthrough.
                 case ListUtils.ViewType.IN_PROGRESS_VIDEO:
@@ -140,6 +161,7 @@
                     outRect.right = mPrefetchHorizontalPaddingPx;
                     outRect.top = mPrefetchVerticalPaddingPx / 2;
                     outRect.bottom = mPrefetchVerticalPaddingPx / 2;
+                    isFullWidthMedia = true;
                     break;
                 case ListUtils.ViewType.PREFETCH:
                     outRect.left = mPrefetchHorizontalPaddingPx;
@@ -148,6 +170,10 @@
                     outRect.bottom = mPrefetchVerticalPaddingPx / 2;
                     break;
             }
+
+            if (isFullWidthMedia) {
+                outRect.right += Math.max(mView.getWidth() - mMaxWidthImageItemPx, 0);
+            }
         }
     }
 
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/download/items/OfflineContentAggregatorFactory.java b/chrome/android/java/src/org/chromium/chrome/browser/download/items/OfflineContentAggregatorFactory.java
index 98c2b1f..81930c7b 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/download/items/OfflineContentAggregatorFactory.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/download/items/OfflineContentAggregatorFactory.java
@@ -4,6 +4,9 @@
 
 package org.chromium.chrome.browser.download.items;
 
+import android.support.annotation.Nullable;
+import android.support.annotation.VisibleForTesting;
+
 import org.chromium.chrome.browser.profiles.Profile;
 import org.chromium.components.offline_items_collection.OfflineContentProvider;
 
@@ -19,6 +22,23 @@
     private OfflineContentAggregatorFactory() {}
 
     /**
+     * Allows tests to push a custom {@link OfflineContentProvider} to be used instead of the one
+     * pulled from a {@link Profile}.
+     * @param provider The {@link OfflineContentProvider} to return.  If {@code null}, will revert
+     *                 to the non-overriding behavior and pull a {link OfflineContentProvider} from
+     *                 {@link Profile}.
+     */
+    @VisibleForTesting
+    public static void setOfflineContentProviderForTests(
+            @Nullable OfflineContentProvider provider) {
+        if (provider == null) {
+            sBlockedProvider = null;
+        } else {
+            sBlockedProvider = new DownloadBlockedOfflineContentProvider(provider);
+        }
+    }
+
+    /**
      * Used to get access to the {@link OfflineContentProvider} associated with {@code profile}.
      * The same {@link OfflineContentProvider} will be returned for the same {@link Profile}.
      * @param profile The {@link Profile} that owns the {@link OfflineContentProvider}.
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ntp/IncognitoNewTabPageViewMD.java b/chrome/android/java/src/org/chromium/chrome/browser/ntp/IncognitoNewTabPageViewMD.java
index e3675df..96bdc89 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ntp/IncognitoNewTabPageViewMD.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ntp/IncognitoNewTabPageViewMD.java
@@ -145,7 +145,7 @@
         if (mWidthDp <= WIDE_LAYOUT_THRESHOLD_DP) {
             // Small padding.
             paddingHorizontalDp = mWidthDp <= 240 ? 24 : 32;
-            paddingVerticalDp = (mHeightDp <= 600) ? 32 : 72;
+            paddingVerticalDp = 32;
 
             // Align left.
             mContainer.setGravity(Gravity.START);
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omaha/UpdateMenuItemHelper.java b/chrome/android/java/src/org/chromium/chrome/browser/omaha/UpdateMenuItemHelper.java
index 30824b39..ba10a86 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/omaha/UpdateMenuItemHelper.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/omaha/UpdateMenuItemHelper.java
@@ -13,24 +13,16 @@
 import android.content.Context;
 import android.content.Intent;
 import android.content.pm.PackageManager;
-import android.content.res.Resources;
-import android.graphics.Color;
-import android.graphics.drawable.Drawable;
 import android.net.Uri;
 import android.os.Build;
 import android.os.Environment;
 import android.os.StatFs;
-import android.support.annotation.IntDef;
-import android.support.annotation.Nullable;
 import android.text.TextUtils;
 import android.view.View;
 import android.view.animation.LinearInterpolator;
-import android.widget.TextView;
 
 import com.google.android.gms.common.GooglePlayServicesUtil;
 
-import org.chromium.base.ApiCompatibilityUtils;
-import org.chromium.base.BuildInfo;
 import org.chromium.base.CommandLine;
 import org.chromium.base.Log;
 import org.chromium.base.ThreadUtils;
@@ -40,75 +32,45 @@
 import org.chromium.chrome.browser.ChromeActivity;
 import org.chromium.chrome.browser.ChromeSwitches;
 import org.chromium.chrome.browser.appmenu.AppMenu;
-import org.chromium.chrome.browser.appmenu.AppMenuItemIcon;
-import org.chromium.chrome.browser.preferences.ChromePreferenceManager;
 import org.chromium.chrome.browser.preferences.PrefServiceBridge;
 import org.chromium.chrome.browser.util.ConversionUtils;
 import org.chromium.components.variations.VariationsAssociatedData;
 import org.chromium.ui.interpolators.BakedBezierInterpolator;
 
 import java.io.File;
-import java.lang.annotation.Retention;
-import java.lang.annotation.RetentionPolicy;
 
 /**
- * Contains logic related to displaying app menu badge and a special menu item for information
- * related to updates.
- *
- * It supports displaying a badge and item for whether an update is available, and a different
- * badge and menu item if the Android OS version Chrome is currently running on is unsupported.
- *
- * It also has logic for logging usage of the update menu item to UMA.
- *
- * For manually testing this functionality, use the following switches:
- * - {@link ChromeSwitches#FORCE_UPDATE_MENU_UPDATE_TYPE} (required)
- * - {@link ChromeSwitches#FORCE_SHOW_UPDATE_MENU_BADGE} (optional)
- * - {@link ChromeSwitches#MARKET_URL_FOR_TESTING} (optional)
+ * Contains logic for whether the update menu item should be shown, whether the update toolbar badge
+ * should be shown, and UMA logging for the update menu item.
  */
 public class UpdateMenuItemHelper {
-    @IntDef({UpdateMenuItemHelper.UpdateType.UNKNOWN, UpdateMenuItemHelper.UpdateType.NONE,
-            UpdateMenuItemHelper.UpdateType.UPDATE_AVAILABLE,
-            UpdateMenuItemHelper.UpdateType.UNSUPPORTED_OS_VERSION})
-    @Retention(RetentionPolicy.SOURCE)
-    public @interface UpdateType {
-        int UNKNOWN = 0;
-        int NONE = 1;
-        int UPDATE_AVAILABLE = 2;
-        int UNSUPPORTED_OS_VERSION = 3;
-    }
-
-    private static final String NONE_SWITCH_VALUE = "none";
-    private static final String UPDATE_AVAILABLE_SWITCH_VALUE = "update_available";
-    private static final String UNSUPPORTED_OS_VERSION_SWITCH_VALUE = "unsupported_os_version";
-
     private static final String TAG = "UpdateMenuItemHelper";
+
     // VariationsAssociatedData configs
     private static final String FIELD_TRIAL_NAME = "UpdateMenuItem";
     private static final String ENABLED_VALUE = "true";
     private static final String CUSTOM_SUMMARY = "custom_summary";
-
     private static final String MIN_REQUIRED_STORAGE_MB = "min_required_storage_for_update_mb";
+
     // UMA constants for logging whether the menu item was clicked.
     private static final int ITEM_NOT_CLICKED = 0;
     private static final int ITEM_CLICKED_INTENT_LAUNCHED = 1;
     private static final int ITEM_CLICKED_INTENT_FAILED = 2;
-
     private static final int ITEM_CLICKED_BOUNDARY = 3;
+
     // UMA constants for logging whether Chrome was updated after the menu item was clicked.
     private static final int UPDATED = 0;
     private static final int NOT_UPDATED = 1;
-
     private static final int UPDATED_BOUNDARY = 2;
-    private static UpdateMenuItemHelper sInstance;
 
+    private static UpdateMenuItemHelper sInstance;
     private static Object sGetInstanceLock = new Object();
 
     // Whether OmahaClient has already been checked for an update.
     private boolean mAlreadyCheckedForUpdates;
 
-    // The current state of whether an update is available or whether it ever will be
-    // (unsupported OS).
-    private @UpdateType int mUpdateType;
+    // Whether an update is available.
+    private boolean mUpdateAvailable;
 
     // URL to direct the user to when Omaha detects a newer version available.
     private String mUpdateUrl;
@@ -119,12 +81,6 @@
     // The latest Chrome version available if OmahaClient.isNewerVersionAvailable() returns true.
     private String mLatestVersion;
 
-    // If the current OS version is unsupported, and we show the menu badge, and then the user
-    // clicks the badge and sees the unsupported message, we store the current version to a
-    // preference and cache it here. This preference is read on startup to ensure we only show
-    // the unsupported message once per version.
-    private String mLatestUnsupportedVersionPreference;
-
     /**
      * @return The {@link UpdateMenuItemHelper} instance.
      */
@@ -132,97 +88,16 @@
         synchronized (UpdateMenuItemHelper.sGetInstanceLock) {
             if (sInstance == null) {
                 sInstance = new UpdateMenuItemHelper();
+                String testMarketUrl = getStringParamValue(ChromeSwitches.MARKET_URL_FOR_TESTING);
+                if (!TextUtils.isEmpty(testMarketUrl)) {
+                    sInstance.mUpdateUrl = testMarketUrl;
+                }
             }
             return sInstance;
         }
     }
 
     /**
-     * Decorates a menu item with the appropriate styling depending on the current update type.
-     *
-     * @param context The current context.
-     * @param title The title view.
-     * @param image The image view.
-     * @param summary The summary view.
-     */
-    public void decorateMenuItemViews(
-            Context context, TextView title, AppMenuItemIcon image, TextView summary) {
-        switch (getUpdateType()) {
-            case UpdateType.UPDATE_AVAILABLE:
-                title.setText(context.getString(R.string.menu_update));
-                title.setTextColor(Color.RED);
-
-                String customSummary = getStringParamValue(CUSTOM_SUMMARY);
-                if (TextUtils.isEmpty(customSummary)) {
-                    summary.setText(
-                            context.getResources().getString(R.string.menu_update_summary_default));
-                } else {
-                    summary.setText(customSummary);
-                }
-
-                image.setImageResource(R.drawable.badge_update_dark);
-                break;
-            case UpdateType.UNSUPPORTED_OS_VERSION:
-                title.setText(R.string.menu_update_unsupported);
-                title.setTextColor(ApiCompatibilityUtils.getColor(
-                        context.getResources(), R.color.default_text_color));
-
-                summary.setText(R.string.menu_update_unsupported_summary_default);
-
-                image.setImageResource(R.drawable.ic_error_grey800_24dp_filled);
-                break;
-            case UpdateType.NONE:
-            // Intentional fall through.
-            case UpdateType.UNKNOWN:
-            // Intentional fall through.
-            default:
-                break;
-        }
-    }
-
-    /**
-     * @param resources The resources to use for lookup.
-     * @return The dark drawable for the badge.
-     */
-    @Nullable
-    public Drawable getDarkBadgeDrawable(Resources resources) {
-        switch (getUpdateType()) {
-            case UpdateType.UPDATE_AVAILABLE:
-                return ApiCompatibilityUtils.getDrawable(resources, R.drawable.badge_update_dark);
-            case UpdateType.UNSUPPORTED_OS_VERSION:
-                return ApiCompatibilityUtils.getDrawable(
-                        resources, R.drawable.ic_error_grey800_24dp_filled);
-            case UpdateType.NONE:
-            // Intentional fall through.
-            case UpdateType.UNKNOWN:
-            // Intentional fall through.
-            default:
-                return null;
-        }
-    }
-
-    /**
-     * @param resources The resources to use for lookup.
-     * @return The light drawable for the badge.
-     */
-    @Nullable
-    public Drawable getLightBadgeDrawable(Resources resources) {
-        switch (getUpdateType()) {
-            case UpdateType.UPDATE_AVAILABLE:
-                return ApiCompatibilityUtils.getDrawable(resources, R.drawable.badge_update_light);
-            case UpdateType.UNSUPPORTED_OS_VERSION:
-                return ApiCompatibilityUtils.getDrawable(
-                        resources, R.drawable.ic_error_white_24dp_filled);
-            case UpdateType.NONE:
-            // Intentional fall through.
-            case UpdateType.UNKNOWN:
-            // Intentional fall through.
-            default:
-                return null;
-        }
-    }
-
-    /**
      * Checks if the {@link OmahaClient} knows about an update.
      * @param activity The current {@link ChromeActivity}.
      */
@@ -231,7 +106,7 @@
 
         if (mAlreadyCheckedForUpdates) {
             if (activity.isActivityDestroyed()) return;
-            activity.onCheckForUpdate();
+            activity.onCheckForUpdate(mUpdateAvailable);
             return;
         }
 
@@ -240,73 +115,21 @@
         new AsyncTask<Void>() {
             @Override
             protected Void doInBackground() {
-                if (setForcedUpdateData()) return null;
-
                 if (VersionNumberGetter.isNewerVersionAvailable(activity)) {
                     mUpdateUrl = MarketURLGetter.getMarketUrl(activity);
                     mLatestVersion =
                             VersionNumberGetter.getInstance().getLatestKnownVersion(activity);
-                    boolean hasSufficientStorage = checkForSufficientStorage();
-                    mUpdateType =
-                            hasSufficientStorage ? UpdateType.UPDATE_AVAILABLE : UpdateType.NONE;
-                    // If a new version is available, we should later possibly show the OS not
-                    // supported badge, so we need to clear the preference for now.
-                    ChromePreferenceManager.getInstance().removeKey(
-                            ChromePreferenceManager.LATEST_UNSUPPORTED_VERSION);
-                    return null;
+                    mUpdateAvailable = checkForSufficientStorage();
+                } else {
+                    mUpdateAvailable = false;
                 }
-
-                if (!VersionNumberGetter.isCurrentOsVersionSupported()) {
-                    mUpdateType = UpdateType.UNSUPPORTED_OS_VERSION;
-                    mLatestUnsupportedVersionPreference =
-                            ChromePreferenceManager.getInstance().readString(
-                                    ChromePreferenceManager.LATEST_UNSUPPORTED_VERSION, null);
-                    return null;
-                }
-
-                mUpdateType = UpdateType.NONE;
                 return null;
             }
 
-            /**
-             * @return true if all the update related data should be forced to specific values.
-             */
-            private boolean setForcedUpdateData() {
-                String forcedUpdateType =
-                        getStringParamValue(ChromeSwitches.FORCE_UPDATE_MENU_UPDATE_TYPE);
-                if (TextUtils.isEmpty(forcedUpdateType)) return false;
-
-                switch (forcedUpdateType) {
-                    case NONE_SWITCH_VALUE:
-                        mUpdateType = UpdateType.NONE;
-                        break;
-                    case UPDATE_AVAILABLE_SWITCH_VALUE:
-                        mUpdateType = UpdateType.UPDATE_AVAILABLE;
-                        String testMarketUrl =
-                                getStringParamValue(ChromeSwitches.MARKET_URL_FOR_TESTING);
-                        if (!TextUtils.isEmpty(testMarketUrl)) mUpdateUrl = testMarketUrl;
-                        break;
-                    case UNSUPPORTED_OS_VERSION_SWITCH_VALUE:
-                        mUpdateType = UpdateType.UNSUPPORTED_OS_VERSION;
-                        // Even in the forced case, ensure that it is possible to read and write
-                        // the pref, since the FORCE_SHOW_UPDATE_MENU_BADGE might not be set.
-                        mLatestUnsupportedVersionPreference =
-                                ChromePreferenceManager.getInstance().readString(
-                                        ChromePreferenceManager.LATEST_UNSUPPORTED_VERSION, null);
-                        break;
-                    default:
-                        // If the forced parameter or variation is set, but invalid, we should still
-                        // early out of the calculation. This enables testing of the no-op state.
-                        mUpdateType = UpdateType.UNKNOWN;
-                        break;
-                }
-                return true;
-            }
-
             @Override
             protected void onPostExecute(Void result) {
                 if (activity.isActivityDestroyed()) return;
-                activity.onCheckForUpdate();
+                activity.onCheckForUpdate(mUpdateAvailable);
                 recordUpdateHistogram();
             }
         }
@@ -324,22 +147,19 @@
     }
 
     /**
-     * @param context The current context.
+     * @param activity The current {@link ChromeActivity}.
      * @return Whether the update menu item should be shown.
      */
-    public boolean shouldShowMenuItem(Context context) {
-        switch (getUpdateType()) {
-            case UpdateType.UPDATE_AVAILABLE:
-                return isGooglePlayStoreAvailable(context);
-            case UpdateType.UNSUPPORTED_OS_VERSION:
-                return true;
-            case UpdateType.NONE:
-            // Intentional fall through.
-            case UpdateType.UNKNOWN:
-            // Intentional fall through.
-            default:
-                return false;
+    public boolean shouldShowMenuItem(ChromeActivity activity) {
+        if (getBooleanParam(ChromeSwitches.FORCE_SHOW_UPDATE_MENU_ITEM)) {
+            return true;
         }
+
+        if (!isGooglePlayStoreAvailable(activity)) {
+            return false;
+        }
+
+        return updateAvailable(activity);
     }
 
     private static boolean isGooglePlayStoreAvailable(Context context) {
@@ -353,33 +173,40 @@
     }
 
     /**
-     * @param context The current context.
+     * @param context The current {@link Context}.
+     * @return The string to use for summary text or the empty string if no summary should be shown.
+     */
+    public String getMenuItemSummaryText(Context context) {
+        String customSummary = getStringParamValue(CUSTOM_SUMMARY);
+        if (!TextUtils.isEmpty(customSummary)) {
+            return customSummary;
+        }
+
+        return context.getResources().getString(R.string.menu_update_summary_default);
+    }
+
+    /**
+     * @param activity The current {@link ChromeActivity}.
      * @return Whether the update badge should be shown in the toolbar.
      */
-    public boolean shouldShowToolbarBadge(Context context) {
-        if (getBooleanParam(ChromeSwitches.FORCE_SHOW_UPDATE_MENU_BADGE)) return true;
-
-        switch (getUpdateType()) {
-            case UpdateType.UPDATE_AVAILABLE:
-                if (!isGooglePlayStoreAvailable(context)) return false;
-                // The badge is hidden if the update menu item has been clicked until there is an
-                // even newer version of Chrome available.
-                String latestVersionWhenClicked =
-                        PrefServiceBridge.getInstance().getLatestVersionWhenClickedUpdateMenuItem();
-                return !TextUtils.equals(latestVersionWhenClicked, mLatestVersion);
-            case UpdateType.UNSUPPORTED_OS_VERSION:
-                // We should show the badge if the user has not opened the menu.
-                if (mLatestUnsupportedVersionPreference == null) return true;
-
-                // In case the user has been upgraded since last time they tapped the toolbar badge
-                // we should show the badge again.
-                String currentlyUsedVersion = BuildInfo.getInstance().versionName;
-                return !TextUtils.equals(mLatestUnsupportedVersionPreference, currentlyUsedVersion);
-            case UpdateType.NONE: // Intentional fall through.
-            case UpdateType.UNKNOWN: // Intentional fall through.
-            default:
-                return false;
+    public boolean shouldShowToolbarBadge(ChromeActivity activity) {
+        if (getBooleanParam(ChromeSwitches.FORCE_SHOW_UPDATE_MENU_BADGE)) {
+            return true;
         }
+
+        if (!isGooglePlayStoreAvailable(activity)) {
+            return false;
+        }
+
+        // The badge is hidden if the update menu item has been clicked until there is an
+        // even newer version of Chrome available.
+        String latestVersionWhenClicked =
+                PrefServiceBridge.getInstance().getLatestVersionWhenClickedUpdateMenuItem();
+        if (TextUtils.equals(latestVersionWhenClicked, mLatestVersion)) {
+            return false;
+        }
+
+        return updateAvailable(activity);
     }
 
     /**
@@ -387,7 +214,6 @@
      * @param activity The current {@link ChromeActivity}.
      */
     public void onMenuItemClicked(ChromeActivity activity) {
-        if (mUpdateType != UpdateType.UPDATE_AVAILABLE) return;
         if (mUpdateUrl == null) return;
 
         // If the update menu item is showing because it was forced on through about://flags
@@ -428,25 +254,6 @@
     }
 
     /**
-     * Called when the user clicks the app menu button while the unsupported OS badge is showing.
-     */
-    public void onMenuButtonClicked() {
-        if (mUpdateType != UpdateType.UNSUPPORTED_OS_VERSION) return;
-
-        // If we have already stored the current version to a preference, no need to store it again,
-        // unless their Chrome version has changed.
-        String currentlyUsedVersion = BuildInfo.getInstance().versionName;
-        if (mLatestUnsupportedVersionPreference != null
-                && mLatestUnsupportedVersionPreference.equals(currentlyUsedVersion)) {
-            return;
-        }
-
-        ChromePreferenceManager.getInstance().writeString(
-                ChromePreferenceManager.LATEST_UNSUPPORTED_VERSION, currentlyUsedVersion);
-        mLatestUnsupportedVersionPreference = currentlyUsedVersion;
-    }
-
-    /**
      * Creates an {@link AnimatorSet} for showing the update badge that is displayed on top
      * of the app menu button.
      *
@@ -532,12 +339,13 @@
         return set;
     }
 
-    /**
-     * @return The current {@link UpdateType}. Will be {@link UpdateType#UNKNOWN} until it has been
-     *         fetched on a background thread.
-     */
-    public @UpdateType int getUpdateType() {
-        return mUpdateType;
+    private boolean updateAvailable(ChromeActivity activity) {
+        if (!mAlreadyCheckedForUpdates) {
+            checkForUpdateOnBackgroundThread(activity);
+            return false;
+        }
+
+        return mUpdateAvailable;
     }
 
     private void recordItemClickedHistogram(int action) {
@@ -549,8 +357,7 @@
         if (PrefServiceBridge.getInstance().getClickedUpdateMenuItem()) {
             RecordHistogram.recordEnumeratedHistogram(
                     "GoogleUpdate.MenuItem.ActionTakenAfterItemClicked",
-                    mUpdateType == UpdateType.UPDATE_AVAILABLE ? NOT_UPDATED : UPDATED,
-                    UPDATED_BOUNDARY);
+                    mUpdateAvailable ? NOT_UPDATED : UPDATED, UPDATED_BOUNDARY);
             PrefServiceBridge.getInstance().setClickedUpdateMenuItem(false);
         }
     }
@@ -576,7 +383,6 @@
      * @param paramName The name of the parameter (or command-line switch) to get a value for.
      * @return The command-line flag value if present, or the param is value if present.
      */
-    @Nullable
     private static String getStringParamValue(String paramName) {
         String value = CommandLine.getInstance().getSwitchValue(paramName);
         if (TextUtils.isEmpty(value)) {
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omaha/VersionNumberGetter.java b/chrome/android/java/src/org/chromium/chrome/browser/omaha/VersionNumberGetter.java
index 0bcacf3f..f5431d56 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/omaha/VersionNumberGetter.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/omaha/VersionNumberGetter.java
@@ -6,12 +6,10 @@
 
 import android.content.Context;
 import android.content.SharedPreferences;
-import android.os.Build;
 
 import org.chromium.base.BuildInfo;
 import org.chromium.base.ThreadUtils;
 import org.chromium.base.VisibleForTesting;
-import org.chromium.chrome.browser.ChromeFeatureList;
 
 /**
  * Stubbed class for getting version numbers from the rest of Chrome.  Override the functions for
@@ -93,19 +91,6 @@
     }
 
     /**
-     * @return Whether the current Android OS version is supported.
-     */
-    public static boolean isCurrentOsVersionSupported() {
-        // By default, only Android KitKat and above is supported.
-        int oldestSupportedVersion = Build.VERSION_CODES.KITKAT;
-
-        if (ChromeFeatureList.isEnabled(ChromeFeatureList.JELLY_BEAN_SUPPORTED)) {
-            oldestSupportedVersion = Build.VERSION_CODES.JELLY_BEAN;
-        }
-        return Build.VERSION.SDK_INT >= oldestSupportedVersion;
-    }
-
-    /**
      * Checks if we know about a newer version available than the one we're using.  This does not
      * actually fire any requests over to the server: it just checks the version we stored the last
      * time we talked to the Omaha server.
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/preferences/AboutChromePreferenceOSVersion.java b/chrome/android/java/src/org/chromium/chrome/browser/preferences/AboutChromePreferenceOSVersion.java
deleted file mode 100644
index ba5c625..0000000
--- a/chrome/android/java/src/org/chromium/chrome/browser/preferences/AboutChromePreferenceOSVersion.java
+++ /dev/null
@@ -1,36 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-package org.chromium.chrome.browser.preferences;
-
-import android.content.Context;
-import android.preference.Preference;
-import android.util.AttributeSet;
-import android.view.View;
-
-import org.chromium.chrome.R;
-import org.chromium.chrome.browser.omaha.VersionNumberGetter;
-
-/**
- * Preference specifically made for the Android OS version. It supports displaying a warning when
- * the current OS version is unsupported.
- */
-public class AboutChromePreferenceOSVersion extends Preference {
-    /**
-     * Constructor for inflating from XML.
-     */
-    public AboutChromePreferenceOSVersion(Context context, AttributeSet attrs) {
-        super(context, attrs);
-        setLayoutResource(R.layout.os_version_unsupported_preference);
-    }
-
-    @Override
-    protected void onBindView(View view) {
-        super.onBindView(view);
-        // Show additional information only if the OS version is not supported.
-        if (VersionNumberGetter.isCurrentOsVersionSupported()) return;
-
-        view.findViewById(R.id.os_deprecation_warning).setVisibility(View.VISIBLE);
-    }
-}
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/preferences/AboutChromePreferences.java b/chrome/android/java/src/org/chromium/chrome/browser/preferences/AboutChromePreferences.java
index 4fa81920..20b5935 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/preferences/AboutChromePreferences.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/preferences/AboutChromePreferences.java
@@ -4,13 +4,16 @@
 
 package org.chromium.chrome.browser.preferences;
 
+import android.annotation.SuppressLint;
 import android.content.Context;
 import android.content.pm.PackageInfo;
 import android.content.pm.PackageManager.NameNotFoundException;
+import android.os.Build;
 import android.os.Bundle;
 import android.preference.Preference;
 import android.preference.PreferenceFragment;
 import android.text.format.DateUtils;
+import android.view.ContextThemeWrapper;
 
 import org.chromium.chrome.R;
 import org.chromium.chrome.browser.ChromeVersionInfo;
@@ -27,12 +30,24 @@
     private static final String PREF_OS_VERSION = "os_version";
     private static final String PREF_LEGAL_INFORMATION = "legal_information";
 
+    @SuppressLint("ObsoleteSdkInt")
     @Override
     public void onCreate(Bundle savedInstanceState) {
         super.onCreate(savedInstanceState);
         getActivity().setTitle(R.string.prefs_about_chrome);
         PreferenceUtils.addPreferencesFromResource(this, R.xml.about_chrome_preferences);
 
+        // TODO(crbug.com/635567): Fix this properly.
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.JELLY_BEAN) {
+            ChromeBasePreference deprecationWarning = new ChromeBasePreference(
+                    new ContextThemeWrapper(getActivity(),
+                            R.style.DeprecationWarningPreferenceTheme));
+            deprecationWarning.setOrder(-1);
+            deprecationWarning.setTitle(R.string.deprecation_warning);
+            deprecationWarning.setIcon(R.drawable.exclamation_triangle);
+            getPreferenceScreen().addPreference(deprecationWarning);
+        }
+
         PrefServiceBridge prefServiceBridge = PrefServiceBridge.getInstance();
         AboutVersionStrings versionStrings = prefServiceBridge.getAboutVersionStrings();
         Preference p = findPreference(PREF_APPLICATION_VERSION);
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceManager.java b/chrome/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceManager.java
index d9ad21ac..69e4791 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceManager.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/preferences/ChromePreferenceManager.java
@@ -5,7 +5,6 @@
 package org.chromium.chrome.browser.preferences;
 
 import android.content.SharedPreferences;
-import android.support.annotation.Nullable;
 
 import org.chromium.base.ContextUtils;
 import org.chromium.chrome.browser.crash.MinidumpUploadService.ProcessType;
@@ -224,14 +223,6 @@
     public static final String ACCESSIBILITY_TAB_SWITCHER = "accessibility_tab_switcher";
 
     /**
-     * When the user is shown a badge that the current Android OS version is unsupported, and they
-     * tap it to display the menu (which has additional information), we store the current version
-     * of Chrome to this preference to ensure we only show the badge once. The value is cleared
-     * if the Chrome version later changes.
-     */
-    public static final String LATEST_UNSUPPORTED_VERSION = "android_os_unsupported_chrome_version";
-
-    /**
      * Deprecated keys for Chrome Home.
      */
     private static final String CHROME_HOME_USER_ENABLED_KEY = "chrome_home_user_enabled";
@@ -571,29 +562,18 @@
      * @param key The name of the preference to modify.
      * @param value The new value for the preference.
      */
-    public void writeString(String key, String value) {
+    private void writeString(String key, String value) {
         SharedPreferences.Editor ed = mSharedPreferences.edit();
         ed.putString(key, value);
         ed.apply();
     }
 
     /**
-     * Reads the given String value from the named shared preference.
-     *
-     * @param key The name of the preference to return.
-     * @param defaultValue The default value to return if there's no value stored.
-     * @return The value of the preference if stored; defaultValue otherwise.
-     */
-    public String readString(String key, @Nullable String defaultValue) {
-        return mSharedPreferences.getString(key, defaultValue);
-    }
-
-    /**
      * Removes the shared preference entry.
      *
      * @param key The key of the preference to remove.
      */
-    public void removeKey(String key) {
+    private void removeKey(String key) {
         SharedPreferences.Editor ed = mSharedPreferences.edit();
         ed.remove(key);
         ed.apply();
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/BottomToolbarCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/BottomToolbarCoordinator.java
index 37b2647..28efe5c1 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/BottomToolbarCoordinator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/BottomToolbarCoordinator.java
@@ -153,14 +153,14 @@
      * Show the update badge over the bottom toolbar's app menu.
      */
     public void showAppMenuUpdateBadge() {
-        mMenuButton.setUpdateBadgeVisibilityIfValidState(true);
+        mMenuButton.setUpdateBadgeVisibility(true);
     }
 
     /**
      * Remove the update badge.
      */
     public void removeAppMenuUpdateBadge() {
-        mMenuButton.setUpdateBadgeVisibilityIfValidState(false);
+        mMenuButton.setUpdateBadgeVisibility(false);
     }
 
     /**
@@ -179,11 +179,8 @@
         mMediator.setToolbarSwipeLayout(layout);
     }
 
-    /**
-     * @return The wrapper for the app menu button.
-     */
-    public MenuButton getMenuButtonWrapper() {
-        return mMenuButton;
+    public View getMenuButton() {
+        return mMenuButton.getMenuButton();
     }
 
     public void setIncognito(boolean isIncognito) {
@@ -192,7 +189,6 @@
         final ColorStateList tint = isIncognito ? mLightModeTint : mDarkModeTint;
         mTabSwitcherButtonCoordinator.setTint(tint);
         mMenuButton.setTint(tint);
-        mMenuButton.setUseLightDrawables(isIncognito);
     }
 
     /**
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/MenuButton.java b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/MenuButton.java
index 9ccbccf..628051c 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/MenuButton.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/MenuButton.java
@@ -6,16 +6,13 @@
 
 import android.content.Context;
 import android.content.res.ColorStateList;
-import android.graphics.drawable.Drawable;
 import android.support.v7.widget.AppCompatImageButton;
 import android.util.AttributeSet;
 import android.view.View;
 import android.widget.FrameLayout;
-import android.widget.ImageView;
 
 import org.chromium.base.ApiCompatibilityUtils;
 import org.chromium.chrome.R;
-import org.chromium.chrome.browser.omaha.UpdateMenuItemHelper;
 
 /**
  * The overflow menu button.
@@ -25,8 +22,7 @@
     private AppCompatImageButton mMenuImageButton;
 
     /** The view for the update badge. */
-    private ImageView mUpdateBadgeView;
-    private boolean mUseLightDrawables;
+    private View mUpdateBadgeView;
 
     public MenuButton(Context context, AttributeSet attrs) {
         super(context, attrs);
@@ -53,54 +49,10 @@
     }
 
     /**
-     * Sets the update badge to visible if the update state requires it.
-     *
-     * Also updates the visuals to the correct type for the case where {@link
-     * #setUseLightDrawables(boolean)} was invoked before the update state was known. This is the
-     * case on startup when the bottom toolbar is in use.
-     *
-     * @param visible Whether the update badge should be visible. Always sets visibility to GONE
-     *                if the update type does not require a badge.
-     * TODO(crbug.com/865801): Clean this up when MenuButton and UpdateMenuItemHelper is MVCed.
+     * @param visible Whether the update badge should be visible.
      */
-    void setUpdateBadgeVisibilityIfValidState(boolean visible) {
-        switch (UpdateMenuItemHelper.getInstance().getUpdateType()) {
-            case UpdateMenuItemHelper.UpdateType.UPDATE_AVAILABLE:
-            // Intentional fall through.
-            case UpdateMenuItemHelper.UpdateType.UNSUPPORTED_OS_VERSION:
-                mUpdateBadgeView.setVisibility(visible ? View.VISIBLE : View.GONE);
-                updateImageResources();
-                break;
-            case UpdateMenuItemHelper.UpdateType.NONE:
-            // Intentional fall through.
-            case UpdateMenuItemHelper.UpdateType.UNKNOWN:
-            // Intentional fall through.
-            default:
-                mUpdateBadgeView.setVisibility(View.GONE);
-                break;
-        }
-    }
-
-    /**
-     * Sets the visual type of update badge to use (if any).
-     * @param useLightDrawables Whether the light drawable should be used.
-     */
-    void setUseLightDrawables(boolean useLightDrawables) {
-        mUseLightDrawables = useLightDrawables;
-        updateImageResources();
-    }
-
-    void updateImageResources() {
-        Drawable drawable;
-        if (mUseLightDrawables) {
-            drawable = UpdateMenuItemHelper.getInstance().getLightBadgeDrawable(
-                    mUpdateBadgeView.getResources());
-        } else {
-            drawable = UpdateMenuItemHelper.getInstance().getDarkBadgeDrawable(
-                    mUpdateBadgeView.getResources());
-        }
-        if (drawable == null) return;
-        mUpdateBadgeView.setImageDrawable(drawable);
+    void setUpdateBadgeVisibility(boolean visible) {
+        mUpdateBadgeView.setVisibility(visible ? View.VISIBLE : View.GONE);
     }
 
     /**
@@ -110,38 +62,10 @@
         return mUpdateBadgeView.getVisibility() == View.VISIBLE;
     }
 
-    void updateContentDescription() {
-        if (isShowingAppMenuUpdateBadge()) {
-            switch (UpdateMenuItemHelper.getInstance().getUpdateType()) {
-                case UpdateMenuItemHelper.UpdateType.UPDATE_AVAILABLE:
-                    setContentDescription(getResources().getString(
-                            R.string.accessibility_toolbar_btn_menu_update));
-                    break;
-                case UpdateMenuItemHelper.UpdateType.UNSUPPORTED_OS_VERSION:
-                    setContentDescription(getResources().getString(
-                            R.string.accessibility_toolbar_btn_menu_os_version_unsupported));
-                    break;
-                case UpdateMenuItemHelper.UpdateType.NONE:
-                // Intentional fall through.
-                case UpdateMenuItemHelper.UpdateType.UNKNOWN:
-                // Intentional fall through.
-                default:
-                    break;
-            }
-        } else {
-            setContentDescription(
-                    getResources().getString(R.string.accessibility_toolbar_btn_menu));
-        }
-    }
-
-    AppCompatImageButton getImageButton() {
+    View getMenuButton() {
         return mMenuImageButton;
     }
 
-    View getUpdateBadge() {
-        return mUpdateBadgeView;
-    }
-
     /**
      * @param tintList The {@link ColorStateList} that will tint the menu button (the badge is not
      *                 tinted).
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarLayout.java b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarLayout.java
index 937c0ded..7250526 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarLayout.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarLayout.java
@@ -25,6 +25,7 @@
 import android.view.View;
 import android.view.ViewGroup;
 import android.widget.FrameLayout;
+import android.widget.ImageView;
 import android.widget.ProgressBar;
 
 import org.chromium.base.VisibleForTesting;
@@ -60,9 +61,11 @@
     private final int[] mTempPosition = new int[2];
 
     /**
-     * The app menu button.
+     * The ImageButton view that represents the menu button.
      */
-    protected MenuButton mMenuButton;
+    protected AppCompatImageButton mMenuButton;
+    private ImageView mMenuBadge;
+    private View mMenuButtonWrapper;
     private AppMenuButtonHelper mAppMenuButtonHelper;
 
     protected final ColorStateList mDarkModeTint;
@@ -143,16 +146,19 @@
      * instance vars.
      */
     public void disableMenuButton() {
-        View menuButtonWrapper = getMenuButtonWrapper();
-        if (menuButtonWrapper != null) UiUtils.removeViewFromParent(menuButtonWrapper);
+        UiUtils.removeViewFromParent(getMenuButtonWrapper());
+        mMenuButtonWrapper = null;
         mMenuButton = null;
+        mMenuBadge = null;
     }
 
     @Override
     protected void onFinishInflate() {
         super.onFinishInflate();
 
-        mMenuButton = (MenuButton) findViewById(R.id.menu_button_wrapper);
+        mMenuButton = (AppCompatImageButton) findViewById(R.id.menu_button);
+        mMenuBadge = (ImageView) findViewById(R.id.menu_badge);
+        mMenuButtonWrapper = findViewById(R.id.menu_button_wrapper);
 
         // Initialize the provider to an empty version to avoid null checking everywhere.
         mToolbarDataProvider = new ToolbarDataProvider() {
@@ -270,7 +276,7 @@
         mAppMenuButtonHelper = appMenuButtonHelper;
 
         if (mMenuButton != null) {
-            mMenuButton.setTouchListener(mAppMenuButtonHelper);
+            mMenuButton.setOnTouchListener(mAppMenuButtonHelper);
             mMenuButton.setAccessibilityDelegate(mAppMenuButtonHelper);
         }
     }
@@ -296,21 +302,21 @@
      * @return The view containing the menu button and menu button badge.
      */
     protected View getMenuButtonWrapper() {
-        return mMenuButton;
+        return mMenuButtonWrapper;
     }
 
     /**
      * @return The {@link AppCompatImageButton} containing the menu button.
      */
     protected AppCompatImageButton getMenuButton() {
-        return mMenuButton == null ? null : mMenuButton.getImageButton();
+        return mMenuButton;
     }
 
     /**
      * @return The view containing the menu badge.
      */
     protected View getMenuBadge() {
-        return mMenuButton == null ? null : mMenuButton.getUpdateBadge();
+        return mMenuBadge;
     }
 
     /**
@@ -808,7 +814,6 @@
     @Override
     public void showAppMenuUpdateBadge() {
         mShowMenuBadge = true;
-        mMenuButton.updateImageResources();
     }
 
     @Override
@@ -818,13 +823,13 @@
 
     @Override
     public void removeAppMenuUpdateBadge(boolean animate) {
-        if (mMenuButton == null) return;
+        if (mMenuBadge == null) return;
         boolean wasShowingMenuBadge = mShowMenuBadge;
         mShowMenuBadge = false;
-        setMenuButtonContentDescription();
+        setMenuButtonContentDescription(false);
 
         if (!animate || !wasShowingMenuBadge) {
-            mMenuButton.setUpdateBadgeVisibilityIfValidState(false);
+            mMenuBadge.setVisibility(View.GONE);
             return;
         }
 
@@ -836,7 +841,7 @@
         mMenuButton.setAlpha(0.f);
 
         mMenuBadgeAnimatorSet = UpdateMenuItemHelper.createHideUpdateBadgeAnimation(
-                mMenuButton, mMenuButton.getUpdateBadge());
+                mMenuButton, mMenuBadge);
 
         mMenuBadgeAnimatorSet.addListener(new AnimatorListenerAdapter() {
             @Override
@@ -884,19 +889,19 @@
      * bitmap.
      */
     protected void setAppMenuUpdateBadgeToVisible(boolean animate) {
-        if (mMenuButton == null) return;
-        setMenuButtonContentDescription();
+        if (mMenuBadge == null || mMenuButton == null) return;
+        setMenuButtonContentDescription(true);
         if (!animate || mIsMenuBadgeAnimationRunning) {
-            mMenuButton.setUpdateBadgeVisibilityIfValidState(true);
+            mMenuBadge.setVisibility(View.VISIBLE);
             return;
         }
 
         // Set initial states.
-        mMenuButton.getUpdateBadge().setAlpha(0.f);
-        mMenuButton.getUpdateBadge().setVisibility(View.VISIBLE);
+        mMenuBadge.setAlpha(0.f);
+        mMenuBadge.setVisibility(View.VISIBLE);
 
         mMenuBadgeAnimatorSet = UpdateMenuItemHelper.createShowUpdateBadgeAnimation(
-                mMenuButton, mMenuButton.getUpdateBadge());
+                mMenuButton, mMenuBadge);
 
         mMenuBadgeAnimatorSet.addListener(new AnimatorListenerAdapter() {
             @Override
@@ -926,12 +931,12 @@
 
     /**
      * Sets the update menu badge drawable to the light or dark asset.
-     *
-     * @param useLightDrawables Whether the light drawable should be used.
+     * @param useLightDrawable Whether the light drawable should be used.
      */
-    protected void setAppMenuUpdateBadgeDrawable(boolean useLightDrawables) {
-        if (mMenuButton == null) return;
-        mMenuButton.setUseLightDrawables(useLightDrawables);
+    protected void setAppMenuUpdateBadgeDrawable(boolean useLightDrawable) {
+        if (mMenuBadge == null) return;
+        mMenuBadge.setImageResource(useLightDrawable ? R.drawable.badge_update_light
+                : R.drawable.badge_update_dark);
     }
 
     /**
@@ -941,31 +946,36 @@
      */
     protected void setMenuButtonHighlightDrawable(boolean highlighting) {
         // Return if onFinishInflate didn't finish
-        if (mMenuButton == null) return;
+        if (mMenuButtonWrapper == null || mMenuButton == null) return;
 
         if (highlighting) {
             if (mHighlightDrawable == null) {
                 mHighlightDrawable = PulseDrawable.createCircle(getContext());
-                mHighlightDrawable.setInset(
-                        ViewCompat.getPaddingStart(mMenuButton.getImageButton()),
-                        mMenuButton.getImageButton().getPaddingTop(),
-                        ViewCompat.getPaddingEnd(mMenuButton.getImageButton()),
-                        mMenuButton.getImageButton().getPaddingBottom());
+                mHighlightDrawable.setInset(ViewCompat.getPaddingStart(mMenuButton),
+                        mMenuButton.getPaddingTop(), ViewCompat.getPaddingEnd(mMenuButton),
+                        mMenuButton.getPaddingBottom());
             }
             mHighlightDrawable.setUseLightPulseColor(useLightDrawables());
-            mMenuButton.setBackground(mHighlightDrawable);
+            mMenuButtonWrapper.setBackground(mHighlightDrawable);
             mHighlightDrawable.start();
         } else {
-            mMenuButton.setBackground(null);
+            mMenuButtonWrapper.setBackground(null);
         }
     }
 
     /**
      * Sets the content description for the menu button.
+     * @param isUpdateBadgeVisible Whether the update menu badge is visible.
      */
-    protected void setMenuButtonContentDescription() {
+    protected void setMenuButtonContentDescription(boolean isUpdateBadgeVisible) {
         if (mMenuButton == null) return;
-        mMenuButton.updateContentDescription();
+        if (isUpdateBadgeVisible) {
+            mMenuButton.setContentDescription(getResources().getString(
+                    R.string.accessibility_toolbar_btn_menu_update));
+        } else {
+            mMenuButton.setContentDescription(getResources().getString(
+                    R.string.accessibility_toolbar_btn_menu));
+        }
     }
 
     @Override
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarManager.java b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarManager.java
index df56d6d..7c8272f 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarManager.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarManager.java
@@ -63,7 +63,6 @@
 import org.chromium.chrome.browser.ntp.IncognitoNewTabPage;
 import org.chromium.chrome.browser.ntp.NewTabPage;
 import org.chromium.chrome.browser.offlinepages.OfflinePageBridge;
-import org.chromium.chrome.browser.omaha.UpdateMenuItemHelper;
 import org.chromium.chrome.browser.omnibox.LocationBar;
 import org.chromium.chrome.browser.omnibox.QueryInOmnibox;
 import org.chromium.chrome.browser.omnibox.UrlFocusChangeListener;
@@ -631,24 +630,12 @@
             public void onOverviewModeStartedShowing(boolean showToolbar) {
                 mToolbar.setTabSwitcherMode(true, showToolbar, false);
                 updateButtonStatus();
-
-                // For top toolbar we depend on animations instead.
-                if (mBottomToolbarCoordinator == null) return;
-                MenuButton menuButton = mBottomToolbarCoordinator.getMenuButtonWrapper();
-                if (menuButton == null) return;
-                menuButton.setUpdateBadgeVisibilityIfValidState(false);
             }
 
             @Override
             public void onOverviewModeStartedHiding(boolean showToolbar, boolean delayAnimation) {
                 mToolbar.setTabSwitcherMode(false, showToolbar, delayAnimation);
                 updateButtonStatus();
-
-                // For top toolbar we depend on animations instead.
-                if (mBottomToolbarCoordinator == null) return;
-                MenuButton menuButton = mBottomToolbarCoordinator.getMenuButtonWrapper();
-                if (menuButton == null) return;
-                menuButton.setUpdateBadgeVisibilityIfValidState(true);
             }
 
             @Override
@@ -1053,9 +1040,7 @@
      * @return The view containing the pop up menu button.
      */
     public View getMenuButton() {
-        if (mBottomToolbarCoordinator != null) {
-            return mBottomToolbarCoordinator.getMenuButtonWrapper().getImageButton();
-        }
+        if (mBottomToolbarCoordinator != null) return mBottomToolbarCoordinator.getMenuButton();
         if (mToolbar != null) return mToolbar.getMenuButton();
         return null;
     }
@@ -1247,11 +1232,6 @@
                 } else {
                     mControlsVisibilityDelegate.releasePersistentShowingToken(mFullscreenMenuToken);
                 }
-
-                MenuButton menuButton = getMenuButtonWrapper();
-                if (isVisible && menuButton != null && menuButton.isShowingAppMenuUpdateBadge()) {
-                    UpdateMenuItemHelper.getInstance().onMenuButtonClicked();
-                }
             }
 
             @Override
@@ -1283,18 +1263,6 @@
         });
     }
 
-    @Nullable
-    private MenuButton getMenuButtonWrapper() {
-        if (mBottomToolbarCoordinator != null) {
-            return mBottomToolbarCoordinator.getMenuButtonWrapper();
-        }
-
-        if (mToolbar == null) return null;
-        View menuButtonWrapper = mToolbar.getMenuButtonWrapper();
-        if (menuButtonWrapper instanceof MenuButton) return (MenuButton) menuButtonWrapper;
-        return null;
-    }
-
     /**
      * Set the delegate that will handle updates from toolbar driven state changes.
      * @param menuDelegatePhone The menu delegate to be updated (only applicable to phones).
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarPhone.java b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarPhone.java
index db98ce1..89904b3 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarPhone.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarPhone.java
@@ -64,7 +64,6 @@
 import org.chromium.chrome.browser.fullscreen.BrowserStateBrowserControlsVisibilityDelegate;
 import org.chromium.chrome.browser.fullscreen.FullscreenManager;
 import org.chromium.chrome.browser.ntp.NewTabPage;
-import org.chromium.chrome.browser.omaha.UpdateMenuItemHelper;
 import org.chromium.chrome.browser.omnibox.LocationBar;
 import org.chromium.chrome.browser.omnibox.LocationBarPhone;
 import org.chromium.chrome.browser.partnercustomizations.HomepageManager;
@@ -1840,7 +1839,7 @@
             view.setVisibility(browsingViewsVisibility);
         }
         if (mShowMenuBadge) {
-            setMenuButtonContentDescription();
+            setMenuButtonContentDescription(mTabSwitcherState == STATIC_TAB);
         }
 
         updateProgressBarVisibility();
@@ -2908,17 +2907,13 @@
     }
 
     private void setTabSwitcherAnimationMenuBadgeDrawable() {
-        Drawable darkDrawable =
-                UpdateMenuItemHelper.getInstance().getDarkBadgeDrawable(this.getResources());
-        Drawable lightDrawable =
-                UpdateMenuItemHelper.getInstance().getLightBadgeDrawable(this.getResources());
-        if (darkDrawable == null || lightDrawable == null) return;
-
-        mTabSwitcherAnimationMenuBadgeDarkDrawable = darkDrawable;
+        mTabSwitcherAnimationMenuBadgeDarkDrawable = ApiCompatibilityUtils.getDrawable(
+                getResources(), R.drawable.badge_update_dark);
         mTabSwitcherAnimationMenuBadgeDarkDrawable.mutate();
         ((BitmapDrawable) mTabSwitcherAnimationMenuBadgeDarkDrawable).setGravity(Gravity.CENTER);
 
-        mTabSwitcherAnimationMenuBadgeLightDrawable = lightDrawable;
+        mTabSwitcherAnimationMenuBadgeLightDrawable = ApiCompatibilityUtils.getDrawable(
+                getResources(), R.drawable.badge_update_light);
         mTabSwitcherAnimationMenuBadgeLightDrawable.mutate();
         ((BitmapDrawable) mTabSwitcherAnimationMenuBadgeLightDrawable).setGravity(Gravity.CENTER);
     }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarTablet.java b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarTablet.java
index 950692c..f3f5f24 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarTablet.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/toolbar/ToolbarTablet.java
@@ -517,7 +517,7 @@
             mLocationBar.getContainerView().setVisibility(View.INVISIBLE);
             if (mShowMenuBadge) {
                 getMenuBadge().setVisibility(View.GONE);
-                setMenuButtonContentDescription();
+                setMenuButtonContentDescription(false);
             }
         } else {
             mIsInTabSwitcherMode = false;
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/webapps/WebappActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/webapps/WebappActivity.java
index dc738667..85dca7b2 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/webapps/WebappActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/webapps/WebappActivity.java
@@ -134,7 +134,7 @@
     private static LoadUrlParams createLoadUrlParams(WebappInfo info, Intent intent) {
         LoadUrlParams params =
                 new LoadUrlParams(info.uri().toString(), PageTransition.AUTO_TOPLEVEL);
-        String headers = IntentHandler.getExtraHeadersFromIntent(intent);
+        String headers = IntentHandler.getExtraHeadersFromIntent(intent, true);
         if (headers != null) params.setVerbatimHeaders(headers);
 
         return params;
diff --git a/chrome/android/java/strings/android_chrome_strings.grd b/chrome/android/java/strings/android_chrome_strings.grd
index 1e72967b..4c7a5f70 100644
--- a/chrome/android/java/strings/android_chrome_strings.grd
+++ b/chrome/android/java/strings/android_chrome_strings.grd
@@ -1416,7 +1416,7 @@
         Operating system
       </message>
       <message name="IDS_DEPRECATION_WARNING" desc="Warning about Chrome updates no longer being supported">
-        Chrome updates are no longer supported for this version of Android
+        Chrome updates are no longer supported for this version of Android.
       </message>
 
       <!-- Account management UI strings. -->
@@ -2929,12 +2929,6 @@
       <message name="IDS_MENU_UPDATE_SUMMARY_DEFAULT" desc="Summary string for update menu item explaining that a newer version of Chrome is available. [CHAR-LIMIT=30]">
         Newer version is available
       </message>
-      <message name="IDS_MENU_UPDATE_UNSUPPORTED" desc="Menu item for when Chrome can not be updated. [CHAR-LIMIT=24]">
-        Chrome can’t update
-      </message>
-      <message name="IDS_MENU_UPDATE_UNSUPPORTED_SUMMARY_DEFAULT" desc="Summary string for update menu item explaining that the Android version on the device is unsupported. [CHAR-LIMIT=30]">
-        Android version is unsupported
-      </message>
       <message name="IDS_MENU_MOVE_TO_OTHER_WINDOW" desc="Menu item for moving the current tab into the other window. [CHAR-LIMIT=27]">
         Move to other window
       </message>
@@ -3187,9 +3181,6 @@
       <message name="IDS_ACCESSIBILITY_TOOLBAR_BTN_MENU_UPDATE" desc="Content description for the menu button when it is covered by the update icon that is displayed when a newer version of Chrome is available.">
         Update available. More options
       </message>
-      <message name="IDS_ACCESSIBILITY_TOOLBAR_BTN_MENU_OS_VERSION_UNSUPPORTED" desc="Content description for the menu button when it is covered by the warning icon that is displayed when the current Android OS version is unsupported.">
-        Chrome can’t update. More options
-      </message>
       <message name="IDS_ACCESSIBILITY_TOOLBAR_BTN_SEARCH_ACCELERATOR" desc="Content description for the search accelerator button">
         Search
       </message>
diff --git a/chrome/android/java_sources.gni b/chrome/android/java_sources.gni
index 3ea6a3e..12005eb 100644
--- a/chrome/android/java_sources.gni
+++ b/chrome/android/java_sources.gni
@@ -46,6 +46,7 @@
   "java/src/org/chromium/chrome/browser/InsetObserverView.java",
   "java/src/org/chromium/chrome/browser/IntentHandler.java",
   "java/src/org/chromium/chrome/browser/IntentHelper.java",
+  "java/src/org/chromium/chrome/browser/IntentHeadersRecorder.java",
   "java/src/org/chromium/chrome/browser/ItemChooserDialog.java",
   "java/src/org/chromium/chrome/browser/JavascriptAppModalDialog.java",
   "java/src/org/chromium/chrome/browser/KeyboardShortcuts.java",
@@ -1186,7 +1187,6 @@
   "java/src/org/chromium/chrome/browser/photo_picker/PickerCategoryView.java",
   "java/src/org/chromium/chrome/browser/policy/PolicyAuditor.java",
   "java/src/org/chromium/chrome/browser/preferences/AboutChromePreferences.java",
-  "java/src/org/chromium/chrome/browser/preferences/AboutChromePreferenceOSVersion.java",
   "java/src/org/chromium/chrome/browser/preferences/AccessibilityPreferences.java",
   "java/src/org/chromium/chrome/browser/preferences/ButtonPreference.java",
   "java/src/org/chromium/chrome/browser/preferences/ChromeBaseCheckBoxPreference.java",
@@ -2200,6 +2200,7 @@
   "junit/src/org/chromium/chrome/browser/ChromeActionModeCallbackTest.java",
   "junit/src/org/chromium/chrome/browser/ChromeBackupAgentTest.java",
   "junit/src/org/chromium/chrome/browser/DelayedScreenLockIntentHandlerTest.java",
+  "junit/src/org/chromium/chrome/browser/IntentHeadersRecorderTest.java",
   "junit/src/org/chromium/chrome/browser/InsetObserverViewTest.java",
   "junit/src/org/chromium/chrome/browser/ShortcutHelperTest.java",
   "junit/src/org/chromium/chrome/browser/SSLClientCertificateRequestTest.java",
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/IntentHandlerTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/IntentHandlerTest.java
index baade2a..0fdd910 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/IntentHandlerTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/IntentHandlerTest.java
@@ -25,6 +25,7 @@
 import org.junit.runner.RunWith;
 
 import org.chromium.base.CollectionUtil;
+import org.chromium.base.metrics.RecordHistogram;
 import org.chromium.base.test.BaseJUnit4ClassRunner;
 import org.chromium.base.test.util.Feature;
 import org.chromium.chrome.browser.test.ChromeBrowserTestRule;
@@ -395,6 +396,25 @@
 
     @Test
     @SmallTest
+    @UiThreadTest
+    @Feature({"Android-AppBase"})
+    public void testLogHeaders() {
+        Bundle bundle = new Bundle();
+        bundle.putString("Content-Length", "1234");
+        Intent headersIntent = new Intent(Intent.ACTION_VIEW);
+        headersIntent.putExtra(Browser.EXTRA_HEADERS, bundle);
+
+        IntentHandler.getExtraHeadersFromIntent(headersIntent);
+        Assert.assertEquals(0,
+                RecordHistogram.getHistogramTotalCountForTesting("Android.IntentHeaders"));
+
+        IntentHandler.getExtraHeadersFromIntent(headersIntent, true);
+        Assert.assertEquals(1,
+                RecordHistogram.getHistogramTotalCountForTesting("Android.IntentHeaders"));
+    }
+
+    @Test
+    @SmallTest
     @Feature({"Android-AppBase"})
     public void testMaybeAddAdditionalExtraHeaders() {
         String contentUrl = "content://com.example.org/document/1";
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/feed/FeedAppLifecycleTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/feed/FeedAppLifecycleTest.java
index 778b129..bcbc287 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/feed/FeedAppLifecycleTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/feed/FeedAppLifecycleTest.java
@@ -5,16 +5,20 @@
 package org.chromium.chrome.browser.feed;
 
 import static org.junit.Assert.assertEquals;
+import static org.mockito.Mockito.anyString;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
 
 import android.app.Activity;
+import android.support.test.InstrumentationRegistry;
 import android.support.test.filters.SmallTest;
 
 import com.google.android.libraries.feed.api.lifecycle.AppLifecycleListener;
 import com.google.android.libraries.feed.feedapplifecyclelistener.FeedAppLifecycleListener;
 import com.google.android.libraries.feed.host.network.NetworkClient;
 
+import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
@@ -25,24 +29,26 @@
 import org.chromium.base.ActivityState;
 import org.chromium.base.ApplicationStatus;
 import org.chromium.base.ThreadUtils;
+import org.chromium.base.library_loader.ProcessInitException;
 import org.chromium.base.metrics.RecordHistogram;
 import org.chromium.base.test.util.CallbackHelper;
 import org.chromium.base.test.util.CommandLineFlags;
 import org.chromium.base.test.util.Feature;
-import org.chromium.base.test.util.FlakyTest;
 import org.chromium.chrome.browser.ChromeFeatureList;
 import org.chromium.chrome.browser.ChromeSwitches;
 import org.chromium.chrome.browser.ChromeTabbedActivity;
 import org.chromium.chrome.browser.UrlConstants;
 import org.chromium.chrome.browser.feed.FeedAppLifecycle.AppLifecycleEvent;
+import org.chromium.chrome.browser.init.ChromeBrowserInitializer;
 import org.chromium.chrome.browser.multiwindow.MultiWindowTestHelper;
 import org.chromium.chrome.browser.multiwindow.MultiWindowUtils;
-import org.chromium.chrome.browser.test.ChromeBrowserTestRule;
+import org.chromium.chrome.browser.profiles.Profile;
 import org.chromium.chrome.test.ChromeJUnit4ClassRunner;
 import org.chromium.chrome.test.ChromeTabbedActivityTestRule;
 import org.chromium.chrome.test.util.browser.Features.EnableFeatures;
 import org.chromium.content_public.browser.LoadUrlParams;
 
+import java.util.Map;
 import java.util.concurrent.TimeoutException;
 
 /**
@@ -53,8 +59,6 @@
 @EnableFeatures({ChromeFeatureList.INTEREST_FEED_CONTENT_SUGGESTIONS})
 public class FeedAppLifecycleTest {
     @Rule
-    public final ChromeBrowserTestRule mBrowserTestRule = new ChromeBrowserTestRule();
-    @Rule
     public ChromeTabbedActivityTestRule mActivityTestRule = new ChromeTabbedActivityTestRule();
     @Mock
     private FeedLifecycleBridge mLifecycleBridge;
@@ -66,6 +70,8 @@
     private FeedOfflineIndicator mOfflineIndicator;
     @Mock
     private AppLifecycleListener mAppLifecycleListener;
+    @Mock
+    private Map<String, Boolean> mMockFeatureList;
     private ChromeTabbedActivity mActivity;
     private FeedAppLifecycle mAppLifecycle;
     private final String mHistogramAppLifecycleEvents =
@@ -74,13 +80,23 @@
     @Before
     public void setUp() throws InterruptedException, TimeoutException {
         MockitoAnnotations.initMocks(this);
+        when(mMockFeatureList.get(anyString())).thenReturn(true);
+        ChromeFeatureList.setTestFeatures(mMockFeatureList);
         ThreadUtils.runOnUiThreadBlocking(() -> {
+            try {
+                ChromeBrowserInitializer.getInstance(InstrumentationRegistry.getTargetContext())
+                        .handleSynchronousStartup();
+            } catch (ProcessInitException e) {
+                Assert.fail("Native initialization failed");
+            }
+
             mAppLifecycle =
                     new FeedAppLifecycle(mAppLifecycleListener, mLifecycleBridge, mFeedScheduler);
             FeedProcessScopeFactory.createFeedProcessScopeForTesting(mFeedScheduler, mNetworkClient,
                     mOfflineIndicator, mAppLifecycle,
                     new FeedAppLifecycleListener(
-                            new com.google.android.libraries.feed.api.common.ThreadUtils()));
+                            new com.google.android.libraries.feed.api.common.ThreadUtils()),
+                    new FeedLoggingBridge(Profile.getLastUsedProfile().getOriginalProfile()));
         });
 
         mActivityTestRule.startMainActivityOnBlankPage();
@@ -90,7 +106,6 @@
     @Test
     @SmallTest
     @Feature({"InterestFeedContentSuggestions"})
-    @FlakyTest(message = "http://crbug.com/891419")
     public void construction_checks_active_tabbed_activities() {
         verify(mAppLifecycleListener, times(1)).onEnterForeground();
     }
@@ -98,7 +113,6 @@
     @Test
     @SmallTest
     @Feature({"InterestFeedContentSuggestions"})
-    @FlakyTest(message = "http://crbug.com/891419")
     public void activity_state_changes_increment_state_counters()
             throws InterruptedException, TimeoutException {
         assertEquals(0,
@@ -121,7 +135,6 @@
     @Test
     @SmallTest
     @Feature({"InterestFeedContentSuggestions"})
-    @FlakyTest(message = "http://crbug.com/891419")
     public void ntp_opening_triggers_initialize_only_once() throws InterruptedException {
         // We open to about:blank initially so we shouldn't have called initialize() yet.
         verify(mAppLifecycleListener, times(0)).initialize();
@@ -139,7 +152,6 @@
     @Test
     @SmallTest
     @Feature({"InterestFeedContentSuggestions"})
-    @FlakyTest(message = "http://crbug.com/891419")
     public void history_deletion_triggers_clear_all() throws InterruptedException {
         verify(mAppLifecycleListener, times(0)).onClearAll();
         mAppLifecycle.onHistoryDeleted();
@@ -152,7 +164,6 @@
     @Test
     @SmallTest
     @Feature({"InterestFeedContentSuggestions"})
-    @FlakyTest(message = "http://crbug.com/891419")
     public void cached_data_removal_triggers_clear_all() throws InterruptedException {
         verify(mAppLifecycleListener, times(0)).onClearAll();
         mAppLifecycle.onCachedDataCleared();
@@ -165,7 +176,6 @@
     @Test
     @SmallTest
     @Feature({"InterestFeedContentSuggestions"})
-    @FlakyTest(message = "http://crbug.com/891419")
     public void signout_triggers_clear_all() throws InterruptedException {
         verify(mAppLifecycleListener, times(0)).onClearAll();
         mAppLifecycle.onSignedOut();
@@ -178,7 +188,6 @@
     @Test
     @SmallTest
     @Feature({"InterestFeedContentSuggestions"})
-    @FlakyTest(message = "http://crbug.com/891419")
     public void signin_triggers_clear_all() throws InterruptedException {
         verify(mAppLifecycleListener, times(0)).onClearAll();
         mAppLifecycle.onSignedIn();
@@ -191,7 +200,6 @@
     @Test
     @SmallTest
     @Feature({"InterestFeedContentSuggestions"})
-    @FlakyTest(message = "http://crbug.com/891419")
     public void second_window_does_not_trigger_foreground_or_background()
             throws InterruptedException, TimeoutException {
         verify(mAppLifecycleListener, times(1)).onEnterForeground();
@@ -217,7 +225,6 @@
     @Test
     @SmallTest
     @Feature({"InterestFeedContentSuggestions"})
-    @FlakyTest(message = "http://crbug.com/891419")
     public void multi_window_does_not_cause_multiple_initialize() throws InterruptedException {
         mActivityTestRule.loadUrl(UrlConstants.NTP_URL);
         verify(mAppLifecycleListener, times(1)).initialize();
@@ -232,10 +239,8 @@
     @Test
     @SmallTest
     @Feature({"InterestFeedContentSuggestions"})
-    @FlakyTest(message = "http://crbug.com/891419")
     public void resume_triggers_scheduler_foregrounded()
             throws InterruptedException, TimeoutException {
-        // Starting mActivity in setUp() triggers a resume.
         verify(mFeedScheduler, times(1)).onForegrounded();
         signalActivityResume(mActivity);
         verify(mFeedScheduler, times(2)).onForegrounded();
diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/IntentHeadersRecorderTest.java b/chrome/android/junit/src/org/chromium/chrome/browser/IntentHeadersRecorderTest.java
new file mode 100644
index 0000000..e6486ae9
--- /dev/null
+++ b/chrome/android/junit/src/org/chromium/chrome/browser/IntentHeadersRecorderTest.java
@@ -0,0 +1,129 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.chrome.browser;
+
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doReturn;
+
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+import org.robolectric.annotation.Config;
+
+import org.chromium.base.metrics.RecordHistogram;
+import org.chromium.base.metrics.test.ShadowRecordHistogram;
+import org.chromium.base.test.BaseRobolectricTestRunner;
+
+/**
+ * Tests for {@link IntentHeadersRecorder}.
+ */
+@RunWith(BaseRobolectricTestRunner.class)
+@Config(manifest = Config.NONE,
+        shadows = {ShadowRecordHistogram.class})
+public class IntentHeadersRecorderTest {
+    private static final String SAFE_HEADER = "Safe-Header";
+    private static final String UNSAFE_HEADER = "Unsafe-Header";
+
+    @Mock public IntentHeadersRecorder.HeaderClassifier mClassifier;
+    private IntentHeadersRecorder mRecorder;
+
+    @Before
+    public void setUp() {
+        ShadowRecordHistogram.reset();
+        MockitoAnnotations.initMocks(this);
+
+        doReturn(true).when(mClassifier).isCorsSafelistedHeader(eq(SAFE_HEADER), anyString());
+        doReturn(false).when(mClassifier).isCorsSafelistedHeader(eq(UNSAFE_HEADER), anyString());
+
+        mRecorder = new IntentHeadersRecorder(mClassifier);
+    }
+
+    @Test
+    public void noHeaders_firstParty() {
+        mRecorder.report(true);
+        assertUma(1, 0, 0, 0, 0, 0);
+    }
+
+    @Test
+    public void noHeaders_thirdParty() {
+        mRecorder.report(false);
+        assertUma(0, 0, 0, 1, 0, 0);
+    }
+
+    @Test
+    public void safeHeaders_firstParty() {
+        mRecorder.recordHeader(SAFE_HEADER, "");
+        mRecorder.report(true);
+        assertUma(0, 1, 0, 0, 0, 0);
+    }
+
+    @Test
+    public void safeHeaders_thirdParty() {
+        mRecorder.recordHeader(SAFE_HEADER, "");
+        mRecorder.report(false);
+        assertUma(0, 0, 0, 0, 1, 0);
+    }
+
+    @Test
+    public void unsafeHeaders_firstParty() {
+        mRecorder.recordHeader(UNSAFE_HEADER, "");
+        mRecorder.report(true);
+        assertUma(0, 0, 1, 0, 0, 0);
+    }
+
+    @Test
+    public void unsafeHeaders_thirdParty() {
+        mRecorder.recordHeader(UNSAFE_HEADER, "");
+        mRecorder.report(false);
+        assertUma(0, 0, 0, 0, 0, 1);
+    }
+
+    @Test
+    public void mixedHeaders_firstParty() {
+        mRecorder.recordHeader(SAFE_HEADER, "");
+        mRecorder.recordHeader(UNSAFE_HEADER, "");
+        mRecorder.report(true);
+        assertUma(0, 0, 1, 0, 0, 0);
+    }
+
+    @Test
+    public void mixedHeaders_thirdParty() {
+        mRecorder.recordHeader(SAFE_HEADER, "");
+        mRecorder.recordHeader(UNSAFE_HEADER, "");
+        mRecorder.report(false);
+        assertUma(0, 0, 0, 0, 0, 1);
+    }
+
+    private void assertUma(int fpNoHeaders, int fpSafeHeaders, int fpUnsafeHeaders,
+                           int tpNoHeaders, int tpSafeHeaders, int tpUnsafeHeaders) {
+        Assert.assertEquals("first party no headers", fpNoHeaders,
+                RecordHistogram.getHistogramValueCountForTesting("Android.IntentHeaders",
+                        IntentHeadersRecorder.IntentHeadersResult.FIRST_PARTY_NO_HEADERS));
+
+        Assert.assertEquals("first party safe headers", fpSafeHeaders,
+                RecordHistogram.getHistogramValueCountForTesting("Android.IntentHeaders",
+                        IntentHeadersRecorder.IntentHeadersResult.FIRST_PARTY_ONLY_SAFE_HEADERS));
+
+        Assert.assertEquals("first party unsafe headers", fpUnsafeHeaders,
+                RecordHistogram.getHistogramValueCountForTesting("Android.IntentHeaders",
+                        IntentHeadersRecorder.IntentHeadersResult.FIRST_PARTY_UNSAFE_HEADERS));
+
+        Assert.assertEquals("third party no headers", tpNoHeaders,
+                RecordHistogram.getHistogramValueCountForTesting("Android.IntentHeaders",
+                        IntentHeadersRecorder.IntentHeadersResult.THIRD_PARTY_NO_HEADERS));
+
+        Assert.assertEquals("third party safe headers", tpSafeHeaders,
+                RecordHistogram.getHistogramValueCountForTesting("Android.IntentHeaders",
+                        IntentHeadersRecorder.IntentHeadersResult.THIRD_PARTY_ONLY_SAFE_HEADERS));
+
+        Assert.assertEquals("third party unsafe headers", tpUnsafeHeaders,
+                RecordHistogram.getHistogramValueCountForTesting("Android.IntentHeaders",
+                        IntentHeadersRecorder.IntentHeadersResult.THIRD_PARTY_UNSAFE_HEADERS));
+    }
+}
diff --git a/chrome/app/OWNERS b/chrome/app/OWNERS
index 940323c..a0f89f7 100644
--- a/chrome/app/OWNERS
+++ b/chrome/app/OWNERS
@@ -7,7 +7,7 @@
 cpu@chromium.org
 grt@chromium.org
 jcivelli@chromium.org
-rockot@chromium.org
+rockot@google.com
 
 per-file bookmarks_strings.grdp=*
 per-file chromeos_strings.grdp=*
diff --git a/chrome/app_shim/BUILD.gn b/chrome/app_shim/BUILD.gn
index 177d3450..754f97a 100644
--- a/chrome/app_shim/BUILD.gn
+++ b/chrome/app_shim/BUILD.gn
@@ -20,6 +20,7 @@
 
   deps = [
     "//chrome:strings",
+    "//chrome/browser/ui:ui",
     "//chrome/common",
     "//chrome/common:mojo_bindings",
     "//content/public/browser",
diff --git a/chrome/app_shim/DEPS b/chrome/app_shim/DEPS
index 7bca52a8..e8cc0435 100644
--- a/chrome/app_shim/DEPS
+++ b/chrome/app_shim/DEPS
@@ -1,5 +1,5 @@
 include_rules = [
-  "+chrome/grit/generated_resources.h",
+  "+chrome/browser/ui/cocoa",
   "+chrome/installer/launcher_support",
   "+content/public/browser",
   "+mojo/core/embedder",
diff --git a/chrome/app_shim/app_shim_controller.mm b/chrome/app_shim/app_shim_controller.mm
index 4966033..e9d8ecf 100644
--- a/chrome/app_shim/app_shim_controller.mm
+++ b/chrome/app_shim/app_shim_controller.mm
@@ -10,7 +10,7 @@
 #include "base/files/file_util.h"
 #include "base/strings/sys_string_conversions.h"
 #include "chrome/app_shim/app_shim_delegate.h"
-#include "chrome/grit/generated_resources.h"
+#include "chrome/browser/ui/cocoa/main_menu_builder.h"
 #include "content/public/browser/ns_view_bridge_factory_impl.h"
 #include "content/public/common/ns_view_bridge_factory.mojom.h"
 #include "mojo/public/cpp/platform/named_platform_channel.h"
@@ -110,48 +110,7 @@
 }
 
 void AppShimController::SetUpMenu() {
-  NSString* title = base::SysUTF16ToNSString(app_mode_info_->app_mode_name);
-
-  // Create a main menu since [NSApp mainMenu] is nil.
-  base::scoped_nsobject<NSMenu> main_menu([[NSMenu alloc] initWithTitle:title]);
-
-  // The title of the first item is replaced by OSX with the name of the app and
-  // bold styling. Create a dummy item for this and make it hidden.
-  NSMenuItem* dummy_item =
-      [main_menu addItemWithTitle:title action:nil keyEquivalent:@""];
-  base::scoped_nsobject<NSMenu> dummy_submenu(
-      [[NSMenu alloc] initWithTitle:title]);
-  [dummy_item setSubmenu:dummy_submenu];
-  [dummy_item setHidden:YES];
-
-  // Construct an unbolded app menu, to match how it appears in the Chrome menu
-  // bar when the app is focused.
-  NSMenuItem* item =
-      [main_menu addItemWithTitle:title action:nil keyEquivalent:@""];
-  base::scoped_nsobject<NSMenu> submenu([[NSMenu alloc] initWithTitle:title]);
-  [item setSubmenu:submenu];
-
-  // Add a quit entry.
-  NSString* quit_localized_string =
-      l10n_util::GetNSStringF(IDS_EXIT_MAC, app_mode_info_->app_mode_name);
-  [submenu addItemWithTitle:quit_localized_string
-                     action:@selector(terminate:)
-              keyEquivalent:@"q"];
-
-  // Add File, Edit, and Window menus. These are just here to make the
-  // transition smoother, i.e. from another application to the shim then to
-  // Chrome.
-  [main_menu addItemWithTitle:l10n_util::GetNSString(IDS_FILE_MENU_MAC)
-                       action:nil
-                keyEquivalent:@""];
-  [main_menu addItemWithTitle:l10n_util::GetNSString(IDS_EDIT_MENU_MAC)
-                       action:nil
-                keyEquivalent:@""];
-  [main_menu addItemWithTitle:l10n_util::GetNSString(IDS_WINDOW_MENU_MAC)
-                       action:nil
-                keyEquivalent:@""];
-
-  [NSApp setMainMenu:main_menu];
+  chrome::BuildMainMenu(NSApp, delegate_, app_mode_info_->app_mode_name, true);
 }
 
 void AppShimController::ChannelError(uint32_t custom_reason,
diff --git a/chrome/app_shim/app_shim_delegate.h b/chrome/app_shim/app_shim_delegate.h
index 46bff46..235e7c3 100644
--- a/chrome/app_shim/app_shim_delegate.h
+++ b/chrome/app_shim/app_shim_delegate.h
@@ -14,7 +14,8 @@
 
 // An application delegate to catch user interactions and send the appropriate
 // IPC messages to Chrome.
-@interface AppShimDelegate : NSObject<NSApplicationDelegate> {
+@interface AppShimDelegate
+    : NSObject<NSApplicationDelegate, NSUserInterfaceValidations> {
  @private
   AppShimController* appShimController_;  // Weak, initially NULL.
   BOOL terminateNow_;
diff --git a/chrome/app_shim/app_shim_delegate.mm b/chrome/app_shim/app_shim_delegate.mm
index e4caba4..fb3d80e 100644
--- a/chrome/app_shim/app_shim_delegate.mm
+++ b/chrome/app_shim/app_shim_delegate.mm
@@ -96,4 +96,8 @@
   [NSApp terminate:nil];
 }
 
+- (BOOL)validateUserInterfaceItem:(id<NSValidatedUserInterfaceItem>)item {
+  return NO;
+}
+
 @end
diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
index ab0b63da..a3d3249 100644
--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn
@@ -2202,6 +2202,7 @@
       "android/find_in_page/find_in_page_bridge.h",
       "android/foreign_session_helper.cc",
       "android/foreign_session_helper.h",
+      "android/headers_classifier.cc",
       "android/history/browsing_history_bridge.cc",
       "android/history/browsing_history_bridge.h",
       "android/history_report/data_observer.cc",
@@ -2939,8 +2940,6 @@
       "search/one_google_bar/one_google_bar_service_observer.h",
       "search/search_engine_base_url_tracker.cc",
       "search/search_engine_base_url_tracker.h",
-      "search/url_validity_checker_factory.cc",
-      "search/url_validity_checker_factory.h",
       "signin/mutable_profile_oauth2_token_service_delegate.cc",
       "signin/mutable_profile_oauth2_token_service_delegate.h",
       "signin/signin_promo.cc",
@@ -4586,6 +4585,7 @@
       "../android/java/src/org/chromium/chrome/browser/ChromeHttpAuthHandler.java",
       "../android/java/src/org/chromium/chrome/browser/ChromeVersionInfo.java",
       "../android/java/src/org/chromium/chrome/browser/DevToolsServer.java",
+      "../android/java/src/org/chromium/chrome/browser/IntentHeadersRecorder.java",
       "../android/java/src/org/chromium/chrome/browser/IntentHelper.java",
       "../android/java/src/org/chromium/chrome/browser/JavascriptAppModalDialog.java",
       "../android/java/src/org/chromium/chrome/browser/NearOomMonitor.java",
diff --git a/chrome/browser/OWNERS b/chrome/browser/OWNERS
index a6a29083..f91673e 100644
--- a/chrome/browser/OWNERS
+++ b/chrome/browser/OWNERS
@@ -50,7 +50,7 @@
 per-file chrome_browser_field_trials*=file://components/variations/OWNERS
 
 per-file chrome_device_client*=reillyg@chromium.org
-per-file chrome_device_client*=rockot@chromium.org
+per-file chrome_device_client*=rockot@google.com
 
 per-file chrome_navigation_browsertest.cc=alexmos@chromium.org
 per-file chrome_navigation_browsertest.cc=file://content/OWNERS
@@ -65,7 +65,7 @@
 
 per-file chrome_webusb_browser_client*=juncai@chromium.org
 per-file chrome_webusb_browser_client*=reillyg@chromium.org
-per-file chrome_webusb_browser_client*=rockot@chromium.org
+per-file chrome_webusb_browser_client*=rockot@google.com
 
 per-file exo_parts.*=reveman@chromium.org
 
diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
index 12cda67..6a7020ce1 100644
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc
@@ -433,16 +433,6 @@
      switches::kChromeHomeSwipeLogicType, "velocity"},
 };
 
-const FeatureEntry::Choice kForceUpdateMenuTypeChoices[] = {
-    {flags_ui::kGenericExperimentChoiceDefault, "", ""},
-    {flag_descriptions::kUpdateMenuTypeNone, switches::kForceUpdateMenuType,
-     "none"},
-    {flag_descriptions::kUpdateMenuTypeUpdateAvailable,
-     switches::kForceUpdateMenuType, "update_available"},
-    {flag_descriptions::kUpdateMenuTypeUnsupportedOSVersion,
-     switches::kForceUpdateMenuType, "unsupported_os_version"},
-};
-
 const FeatureEntry::FeatureParam kCCTModuleCache_ZeroMinutes[] = {
     {"cct_module_cache_time_limit_ms", "0"}};
 const FeatureEntry::FeatureParam kCCTModuleCache_OneMinute[] = {
@@ -2628,9 +2618,9 @@
      flag_descriptions::kEnableImageCaptureAPIDescription, kOsAll,
      FEATURE_VALUE_TYPE(features::kImageCaptureAPI)},
 #if defined(OS_ANDROID)
-    {"force-update-menu-type", flag_descriptions::kUpdateMenuTypeName,
-     flag_descriptions::kUpdateMenuTypeDescription, kOsAndroid,
-     MULTI_VALUE_TYPE(kForceUpdateMenuTypeChoices)},
+    {"force-show-update-menu-item", flag_descriptions::kUpdateMenuItemName,
+     flag_descriptions::kUpdateMenuItemDescription, kOsAndroid,
+     SINGLE_VALUE_TYPE(switches::kForceShowUpdateMenuItem)},
     {"update-menu-item-custom-summary",
      flag_descriptions::kUpdateMenuItemCustomSummaryName,
      flag_descriptions::kUpdateMenuItemCustomSummaryDescription, kOsAndroid,
@@ -3410,6 +3400,12 @@
      FEATURE_VALUE_TYPE(
          toolbar::features::kHideSteadyStateUrlTrivialSubdomains)},
 
+    {"omnibox-ui-hide-steady-state-url-path-query-and-ref",
+     flag_descriptions::kOmniboxUIHideSteadyStateUrlPathQueryAndRefName,
+     flag_descriptions::kOmniboxUIHideSteadyStateUrlPathQueryAndRefDescription,
+     kOsAll,
+     FEATURE_VALUE_TYPE(toolbar::features::kHideSteadyStateUrlPathQueryAndRef)},
+
     {"omnibox-ui-jog-textfield-on-popup",
      flag_descriptions::kOmniboxUIJogTextfieldOnPopupName,
      flag_descriptions::kOmniboxUIJogTextfieldOnPopupDescription, kOsDesktop,
@@ -4471,7 +4467,12 @@
      flag_descriptions::kEnableGoogleAssistantName,
      flag_descriptions::kEnableGoogleAssistantDescription, kOsCrOS,
      FEATURE_VALUE_TYPE(chromeos::switches::kAssistantFeature)},
-#endif  // defined(OS_ANDROID)
+
+    {"enable-media-session-ash-media-keys",
+     flag_descriptions::kEnableMediaSessionAshMediaKeysName,
+     flag_descriptions::kEnableMediaSessionAshMediaKeysDescription, kOsCrOS,
+     FEATURE_VALUE_TYPE(ash::features::kMediaSessionAccelerators)},
+#endif  // defined(OS_CHROMEOS)
 };
 
 class FlagsStateSingleton {
diff --git a/chrome/browser/android/chrome_feature_list.cc b/chrome/browser/android/chrome_feature_list.cc
index 2f31c8c..9fb2244b 100644
--- a/chrome/browser/android/chrome_feature_list.cc
+++ b/chrome/browser/android/chrome_feature_list.cc
@@ -117,7 +117,6 @@
     &kHorizontalTabSwitcherAndroid,
     &kImprovedA2HS,
     &kInflateToolbarOnBackgroundThread,
-    &kJellyBeanSupported,
     &kLanguagesPreference,
     &kLongPressBackForHistory,
     &kModalPermissionDialogView,
@@ -332,9 +331,6 @@
 const base::Feature kInflateToolbarOnBackgroundThread{
     "BackgroundToolbarInflation", base::FEATURE_DISABLED_BY_DEFAULT};
 
-const base::Feature kJellyBeanSupported{"JellyBeanSupported",
-                                        base::FEATURE_DISABLED_BY_DEFAULT};
-
 const base::Feature kLanguagesPreference{"LanguagesPreference",
                                          base::FEATURE_ENABLED_BY_DEFAULT};
 
diff --git a/chrome/browser/android/chrome_feature_list.h b/chrome/browser/android/chrome_feature_list.h
index f9104a963..12b0171 100644
--- a/chrome/browser/android/chrome_feature_list.h
+++ b/chrome/browser/android/chrome_feature_list.h
@@ -58,7 +58,6 @@
 extern const base::Feature kHorizontalTabSwitcherAndroid;
 extern const base::Feature kImprovedA2HS;
 extern const base::Feature kInflateToolbarOnBackgroundThread;
-extern const base::Feature kJellyBeanSupported;
 extern const base::Feature kLanguagesPreference;
 extern const base::Feature kLongPressBackForHistory;
 extern const base::Feature kModalPermissionDialogView;
diff --git a/chrome/browser/android/headers_classifier.cc b/chrome/browser/android/headers_classifier.cc
new file mode 100644
index 0000000..46f5fdd
--- /dev/null
+++ b/chrome/browser/android/headers_classifier.cc
@@ -0,0 +1,26 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/android/jni_string.h"
+#include "jni/IntentHeadersRecorder_jni.h"
+#include "services/network/public/cpp/cors/cors.h"
+
+using base::android::JavaParamRef;
+
+namespace chrome {
+namespace android {
+
+jboolean JNI_HeaderClassifier_IsCorsSafelistedHeader(
+    JNIEnv* env,
+    const JavaParamRef<jclass>& clazz,
+    const JavaParamRef<jstring>& j_header_name,
+    const JavaParamRef<jstring>& j_header_value) {
+  std::string header_name(ConvertJavaStringToUTF8(env, j_header_name));
+  std::string header_value(ConvertJavaStringToUTF8(env, j_header_value));
+
+  return network::cors::IsCORSSafelistedHeader(header_name, header_value);
+}
+
+}  // namespace android
+}  // namespace chrome
diff --git a/chrome/browser/autofill/autofill_save_card_infobar_delegate_mobile_unittest.cc b/chrome/browser/autofill/autofill_save_card_infobar_delegate_mobile_unittest.cc
index f5ed43b..23d11d05 100644
--- a/chrome/browser/autofill/autofill_save_card_infobar_delegate_mobile_unittest.cc
+++ b/chrome/browser/autofill/autofill_save_card_infobar_delegate_mobile_unittest.cc
@@ -118,6 +118,7 @@
     std::unique_ptr<ConfirmInfoBarDelegate> delegate(
         new AutofillSaveCardInfoBarDelegateMobile(
             is_uploading, credit_card, std::move(legal_message),
+            /*strike_database=*/nullptr,
             /*upload_save_card_callback=*/
             base::BindOnce(&AutofillSaveCardInfoBarDelegateMobileTest::
                                UploadSaveCardCallback,
@@ -130,6 +131,7 @@
   std::unique_ptr<ConfirmInfoBarDelegate> delegate(
       new AutofillSaveCardInfoBarDelegateMobile(
           is_uploading, credit_card, std::move(legal_message),
+          /*strike_database=*/nullptr,
           /*upload_save_card_callback=*/
           base::OnceCallback<void(const base::string16&)>(),
           /*local_save_card_callback=*/
diff --git a/chrome/browser/chrome_browser_main_mac.mm b/chrome/browser/chrome_browser_main_mac.mm
index 1835aa3..61163c8 100644
--- a/chrome/browser/chrome_browser_main_mac.mm
+++ b/chrome/browser/chrome_browser_main_mac.mm
@@ -30,11 +30,13 @@
 #include "chrome/browser/ui/cocoa/main_menu_builder.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
+#include "chrome/grit/chromium_strings.h"
 #include "components/crash/content/app/crashpad.h"
 #include "components/metrics/metrics_service.h"
 #include "components/os_crypt/os_crypt.h"
 #include "content/public/common/main_function_params.h"
 #include "content/public/common/result_codes.h"
+#include "ui/base/l10n/l10n_util.h"
 #include "ui/base/resource/resource_bundle.h"
 #include "ui/base/resource/resource_handle.h"
 
@@ -129,7 +131,8 @@
   AppController* app_controller = [[AppController alloc] init];
   [NSApp setDelegate:app_controller];
 
-  chrome::BuildMainMenu(NSApp, app_controller);
+  chrome::BuildMainMenu(NSApp, app_controller,
+                        l10n_util::GetStringUTF16(IDS_PRODUCT_NAME), false);
   [app_controller mainMenuCreated];
 
   // Do Keychain reauthorization. This gets two chances to run. If the first
diff --git a/chrome/browser/chromeos/arc/bluetooth/arc_bluetooth_bridge.cc b/chrome/browser/chromeos/arc/bluetooth/arc_bluetooth_bridge.cc
index 2a24b63..65059a4 100644
--- a/chrome/browser/chromeos/arc/bluetooth/arc_bluetooth_bridge.cc
+++ b/chrome/browser/chromeos/arc/bluetooth/arc_bluetooth_bridge.cc
@@ -1444,72 +1444,6 @@
   device->GetGattServices();
 }
 
-void ArcBluetoothBridge::OnStartLEListenDone(
-    ArcBluetoothBridge::GattStatusCallback callback,
-    scoped_refptr<BluetoothAdvertisement> advertisement) {
-  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
-  advertisment_ = advertisement;
-  std::move(callback).Run(mojom::BluetoothGattStatus::GATT_SUCCESS);
-}
-
-void ArcBluetoothBridge::OnStartLEListenError(
-    ArcBluetoothBridge::GattStatusCallback callback,
-    BluetoothAdvertisement::ErrorCode error_code) {
-  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
-  advertisment_ = nullptr;
-  std::move(callback).Run(mojom::BluetoothGattStatus::GATT_FAILURE);
-}
-
-void ArcBluetoothBridge::StartLEListen(StartLEListenCallback callback) {
-  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
-  std::unique_ptr<BluetoothAdvertisement::Data> adv_data =
-      std::make_unique<BluetoothAdvertisement::Data>(
-          BluetoothAdvertisement::ADVERTISEMENT_TYPE_BROADCAST);
-  // TODO(crbug.com/730593): Remove AdaptCallbackForRepeating() by updating
-  // the callee interface.
-  auto repeating_callback =
-      base::AdaptCallbackForRepeating(std::move(callback));
-  bluetooth_adapter_->RegisterAdvertisement(
-      std::move(adv_data),
-      base::Bind(&ArcBluetoothBridge::OnStartLEListenDone,
-                 weak_factory_.GetWeakPtr(), repeating_callback),
-      base::Bind(&ArcBluetoothBridge::OnStartLEListenError,
-                 weak_factory_.GetWeakPtr(), repeating_callback));
-}
-
-void ArcBluetoothBridge::OnStopLEListenDone(
-    ArcBluetoothBridge::GattStatusCallback callback) {
-  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
-  advertisment_ = nullptr;
-  std::move(callback).Run(mojom::BluetoothGattStatus::GATT_SUCCESS);
-}
-
-void ArcBluetoothBridge::OnStopLEListenError(
-    ArcBluetoothBridge::GattStatusCallback callback,
-    BluetoothAdvertisement::ErrorCode error_code) {
-  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
-  advertisment_ = nullptr;
-  std::move(callback).Run(mojom::BluetoothGattStatus::GATT_FAILURE);
-}
-
-void ArcBluetoothBridge::StopLEListen(StopLEListenCallback callback) {
-  if (!advertisment_) {
-    OnStopLEListenError(
-        std::move(callback),
-        BluetoothAdvertisement::ErrorCode::ERROR_ADVERTISEMENT_DOES_NOT_EXIST);
-    return;
-  }
-  // TODO(crbug.com/730593): Remove AdaptCallbackForRepeating() by updating
-  // the callee interface.
-  auto repeating_callback =
-      base::AdaptCallbackForRepeating(std::move(callback));
-  advertisment_->Unregister(
-      base::Bind(&ArcBluetoothBridge::OnStopLEListenDone,
-                 weak_factory_.GetWeakPtr(), repeating_callback),
-      base::Bind(&ArcBluetoothBridge::OnStopLEListenError,
-                 weak_factory_.GetWeakPtr(), repeating_callback));
-}
-
 void ArcBluetoothBridge::GetGattDB(mojom::BluetoothAddressPtr remote_addr) {
   auto* bluetooth_instance = ARC_GET_INSTANCE_FOR_METHOD(
       arc_bridge_service_->bluetooth(), OnGetGattDB);
diff --git a/chrome/browser/chromeos/arc/bluetooth/arc_bluetooth_bridge.h b/chrome/browser/chromeos/arc/bluetooth/arc_bluetooth_bridge.h
index fc1ba68b..fe1d21a 100644
--- a/chrome/browser/chromeos/arc/bluetooth/arc_bluetooth_bridge.h
+++ b/chrome/browser/chromeos/arc/bluetooth/arc_bluetooth_bridge.h
@@ -221,8 +221,6 @@
   void StopLEScan() override;
   void ConnectLEDevice(mojom::BluetoothAddressPtr remote_addr) override;
   void DisconnectLEDevice(mojom::BluetoothAddressPtr remote_addr) override;
-  void StartLEListen(StartLEListenCallback callback) override;
-  void StopLEListen(StopLEListenCallback callback) override;
   void SearchService(mojom::BluetoothAddressPtr remote_addr) override;
 
   void GetGattDB(mojom::BluetoothAddressPtr remote_addr) override;
@@ -368,17 +366,6 @@
                           device::BluetoothDevice::ConnectErrorCode error_code);
   void OnGattDisconnected(mojom::BluetoothAddressPtr addr);
 
-  void OnStartLEListenDone(GattStatusCallback callback,
-                           scoped_refptr<device::BluetoothAdvertisement> adv);
-  void OnStartLEListenError(
-      GattStatusCallback callback,
-      device::BluetoothAdvertisement::ErrorCode error_code);
-
-  void OnStopLEListenDone(GattStatusCallback callback);
-  void OnStopLEListenError(
-      GattStatusCallback callback,
-      device::BluetoothAdvertisement::ErrorCode error_code);
-
   void OnGattNotifyStartDone(
       GattStatusCallback callback,
       const std::string char_string_id,
diff --git a/chrome/browser/chromeos/login/chrome_restart_request.cc b/chrome/browser/chromeos/login/chrome_restart_request.cc
index 96a4d9c..126d7e93 100644
--- a/chrome/browser/chromeos/login/chrome_restart_request.cc
+++ b/chrome/browser/chromeos/login/chrome_restart_request.cc
@@ -185,7 +185,6 @@
     cc::switches::kDisableMainFrameBeforeActivation,
     cc::switches::kDisableThreadedAnimation,
     cc::switches::kEnableGpuBenchmarking,
-    cc::switches::kEnableLayerLists,
     cc::switches::kEnableMainFrameBeforeActivation,
     cc::switches::kShowCompositedLayerBorders,
     cc::switches::kShowFPSCounter,
diff --git a/chrome/browser/chromeos/policy/configuration_policy_handler_chromeos.cc b/chrome/browser/chromeos/policy/configuration_policy_handler_chromeos.cc
index 4781e178..be5b6ba 100644
--- a/chrome/browser/chromeos/policy/configuration_policy_handler_chromeos.cc
+++ b/chrome/browser/chromeos/policy/configuration_policy_handler_chromeos.cc
@@ -88,6 +88,9 @@
 const char kActionShutdown[]  = "Shutdown";
 const char kActionDoNothing[] = "DoNothing";
 
+constexpr char kScreenBrightnessPercentAC[] = "BrightnessAC";
+constexpr char kScreenBrightnessPercentBattery[] = "BrightnessBattery";
+
 std::unique_ptr<base::Value> GetValue(const base::DictionaryValue* dict,
                                       const char* key) {
   const base::Value* value = NULL;
@@ -517,6 +520,41 @@
                     std::move(value));
 }
 
+ScreenBrightnessPercentPolicyHandler::ScreenBrightnessPercentPolicyHandler(
+    const Schema& chrome_schema)
+    : SchemaValidatingPolicyHandler(
+          key::kScreenBrightnessPercent,
+          chrome_schema.GetKnownProperty(key::kScreenBrightnessPercent),
+          SCHEMA_ALLOW_UNKNOWN) {}
+
+ScreenBrightnessPercentPolicyHandler::~ScreenBrightnessPercentPolicyHandler() =
+    default;
+
+void ScreenBrightnessPercentPolicyHandler::ApplyPolicySettings(
+    const PolicyMap& policies,
+    PrefValueMap* prefs) {
+  std::unique_ptr<base::Value> policy_value;
+  if (!CheckAndGetValue(policies, nullptr, &policy_value))
+    return;
+
+  if (!policy_value)
+    return;
+
+  base::DictionaryValue* dict = nullptr;
+  if (!policy_value->GetAsDictionary(&dict))
+    return;
+
+  std::unique_ptr<base::Value> value;
+  value = GetValue(dict, kScreenBrightnessPercentAC);
+  if (value)
+    prefs->SetValue(ash::prefs::kPowerAcScreenBrightnessPercent,
+                    std::move(value));
+  value = GetValue(dict, kScreenBrightnessPercentBattery);
+  if (value)
+    prefs->SetValue(ash::prefs::kPowerBatteryScreenBrightnessPercent,
+                    std::move(value));
+}
+
 ArcServicePolicyHandler::ArcServicePolicyHandler(const char* policy,
                                                  const char* pref)
     : IntRangePolicyHandlerBase(
diff --git a/chrome/browser/chromeos/policy/configuration_policy_handler_chromeos.h b/chrome/browser/chromeos/policy/configuration_policy_handler_chromeos.h
index a0290f2..0842903 100644
--- a/chrome/browser/chromeos/policy/configuration_policy_handler_chromeos.h
+++ b/chrome/browser/chromeos/policy/configuration_policy_handler_chromeos.h
@@ -175,6 +175,20 @@
   DISALLOW_COPY_AND_ASSIGN(ScreenLockDelayPolicyHandler);
 };
 
+class ScreenBrightnessPercentPolicyHandler
+    : public SchemaValidatingPolicyHandler {
+ public:
+  explicit ScreenBrightnessPercentPolicyHandler(const Schema& chrome_schema);
+  ~ScreenBrightnessPercentPolicyHandler() override;
+
+  // SchemaValidatingPolicyHandler:
+  void ApplyPolicySettings(const PolicyMap& policies,
+                           PrefValueMap* prefs) override;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(ScreenBrightnessPercentPolicyHandler);
+};
+
 // Supported values for the |ArcBackupRestoreServiceEnabled| and
 // |ArcGoogleLocationServicesEnabled| policies.
 enum class ArcServicePolicyValue { kDisabled = 0, kUnderUserControl = 1 };
diff --git a/chrome/browser/extensions/BUILD.gn b/chrome/browser/extensions/BUILD.gn
index e8ababa5..6c928ec 100644
--- a/chrome/browser/extensions/BUILD.gn
+++ b/chrome/browser/extensions/BUILD.gn
@@ -863,6 +863,7 @@
     "//services/audio/public/cpp",
     "//services/data_decoder/public/cpp",
     "//services/device/public/mojom",
+    "//services/identity/public/cpp",
     "//services/identity/public/mojom",
     "//services/network/public/mojom",
     "//services/service_manager/public/cpp",
diff --git a/chrome/browser/extensions/api/feedback_private/chrome_feedback_private_delegate.cc b/chrome/browser/extensions/api/feedback_private/chrome_feedback_private_delegate.cc
index 746440e..086796d4 100644
--- a/chrome/browser/extensions/api/feedback_private/chrome_feedback_private_delegate.cc
+++ b/chrome/browser/extensions/api/feedback_private/chrome_feedback_private_delegate.cc
@@ -13,13 +13,13 @@
 #include "chrome/browser/feedback/feedback_uploader_factory_chrome.h"
 #include "chrome/browser/feedback/system_logs/chrome_system_logs_fetcher.h"
 #include "chrome/browser/profiles/profile.h"
-#include "chrome/browser/signin/signin_manager_factory.h"
+#include "chrome/browser/signin/identity_manager_factory.h"
 #include "chrome/browser/ui/simple_message_box.h"
 #include "chrome/grit/generated_resources.h"
 #include "components/feedback/system_logs/system_logs_fetcher.h"
-#include "components/signin/core/browser/signin_manager.h"
 #include "components/strings/grit/components_strings.h"
 #include "content/public/browser/browser_context.h"
+#include "services/identity/public/cpp/identity_manager.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/webui/web_ui_util.h"
 
@@ -187,10 +187,10 @@
 
 std::string ChromeFeedbackPrivateDelegate::GetSignedInUserEmail(
     content::BrowserContext* context) const {
-  SigninManagerBase* signin_manager =
-      SigninManagerFactory::GetForProfile(Profile::FromBrowserContext(context));
-  return signin_manager ? signin_manager->GetAuthenticatedAccountInfo().email
-                        : std::string();
+  auto* identity_manager = IdentityManagerFactory::GetForProfile(
+      Profile::FromBrowserContext(context));
+  return identity_manager ? identity_manager->GetPrimaryAccountInfo().email
+                          : std::string();
 }
 
 void ChromeFeedbackPrivateDelegate::NotifyFeedbackDelayed() const {
diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc
index 68d28a49..5c6213dc 100644
--- a/chrome/browser/flag_descriptions.cc
+++ b/chrome/browser/flag_descriptions.cc
@@ -1303,15 +1303,19 @@
     "Omnibox UI Hide Steady-State URL Scheme";
 const char kOmniboxUIHideSteadyStateUrlSchemeDescription[] =
     "In the omnibox, hide the scheme from steady state displayed URLs. It is "
-    "restored during editing. For Mac, this flag will have no effect unless "
-    "MacViews is enabled.";
+    "restored during editing.";
 
 const char kOmniboxUIHideSteadyStateUrlTrivialSubdomainsName[] =
     "Omnibox UI Hide Steady-State URL Trivial Subdomains";
 const char kOmniboxUIHideSteadyStateUrlTrivialSubdomainsDescription[] =
     "In the omnibox, hide trivial subdomains from steady state displayed URLs. "
-    "Hidden portions are restored during editing. For Mac, this flag will have "
-    "no effect unless MacViews is enabled.";
+    "Hidden portions are restored during editing.";
+
+const char kOmniboxUIHideSteadyStateUrlPathQueryAndRefName[] =
+    "Omnibox UI Hide Steady-State URL Path, Query, and Ref";
+const char kOmniboxUIHideSteadyStateUrlPathQueryAndRefDescription[] =
+    "In the omnibox, hide the path, query and ref from steady state displayed "
+    "URLs. Hidden portions are restored during editing.";
 
 const char kOmniboxUIJogTextfieldOnPopupName[] =
     "Omnibox UI Jog Textfield on Popup";
@@ -2692,8 +2696,7 @@
 
 const char kUpdateMenuBadgeName[] = "Force show update menu badge";
 const char kUpdateMenuBadgeDescription[] =
-    "When enabled, a badge will be shown on the app menu button if the update "
-    "type is Update Available or Unsupported OS Version.";
+    "When enabled, an update badge will be shown on the app menu button.";
 
 const char kUpdateMenuItemCustomSummaryDescription[] =
     "When this flag and the force show update menu item flag are enabled, a "
@@ -2701,14 +2704,10 @@
 const char kUpdateMenuItemCustomSummaryName[] =
     "Update menu item custom summary";
 
-const char kUpdateMenuTypeName[] =
-    "Forces the update menu type to a specific type";
-const char kUpdateMenuTypeDescription[] =
-    "When set, forces the update type to be a specific one, which impacts "
-    "the app menu badge and menu item for updates.";
-const char kUpdateMenuTypeNone[] = "None";
-const char kUpdateMenuTypeUpdateAvailable[] = "Update Available";
-const char kUpdateMenuTypeUnsupportedOSVersion[] = "Unsupported OS Version";
+const char kUpdateMenuItemName[] = "Force show update menu item";
+const char kUpdateMenuItemDescription[] =
+    R"*(When enabled, an "Update Chrome" item will be shown in the app )*"
+    R"*(menu.)*";
 
 const char kVrBrowsingTabsViewName[] = "VR browsing tabs view";
 const char kVrBrowsingTabsViewDescription[] =
@@ -3262,6 +3261,12 @@
 const char kEnableImeMenuDescription[] =
     "Enable access to the new IME menu in the Language Settings page.";
 
+const char kEnableMediaSessionAshMediaKeysName[] =
+    "Enable media session media key handling";
+const char kEnableMediaSessionAshMediaKeysDescription[] =
+    "Enable the media session service to handle media keys. This requires "
+    "the audio focus flag to be enabled too.";
+
 const char kEnableNewStyleLauncherName[] = "Enable new style launcher.";
 const char kEnableNewStyleLauncherDescription[] =
     "Enables new style UI such as suggestion chips, resizable apps grid, etc. "
diff --git a/chrome/browser/flag_descriptions.h b/chrome/browser/flag_descriptions.h
index 656d5eb9..5a63118 100644
--- a/chrome/browser/flag_descriptions.h
+++ b/chrome/browser/flag_descriptions.h
@@ -812,6 +812,9 @@
 extern const char kOmniboxUIHideSteadyStateUrlTrivialSubdomainsName[];
 extern const char kOmniboxUIHideSteadyStateUrlTrivialSubdomainsDescription[];
 
+extern const char kOmniboxUIHideSteadyStateUrlPathQueryAndRefName[];
+extern const char kOmniboxUIHideSteadyStateUrlPathQueryAndRefDescription[];
+
 extern const char kOmniboxUIJogTextfieldOnPopupName[];
 extern const char kOmniboxUIJogTextfieldOnPopupDescription[];
 
@@ -1631,11 +1634,8 @@
 extern const char kUpdateMenuItemCustomSummaryDescription[];
 extern const char kUpdateMenuItemCustomSummaryName[];
 
-extern const char kUpdateMenuTypeName[];
-extern const char kUpdateMenuTypeDescription[];
-extern const char kUpdateMenuTypeNone[];
-extern const char kUpdateMenuTypeUpdateAvailable[];
-extern const char kUpdateMenuTypeUnsupportedOSVersion[];
+extern const char kUpdateMenuItemName[];
+extern const char kUpdateMenuItemDescription[];
 
 extern const char kVrBrowsingTabsViewName[];
 extern const char kVrBrowsingTabsViewDescription[];
@@ -1990,6 +1990,9 @@
 extern const char kEnableImeMenuName[];
 extern const char kEnableImeMenuDescription[];
 
+extern const char kEnableMediaSessionAshMediaKeysName[];
+extern const char kEnableMediaSessionAshMediaKeysDescription[];
+
 extern const char kEnableNewStyleLauncherName[];
 extern const char kEnableNewStyleLauncherDescription[];
 
diff --git a/chrome/browser/pdf/pdf_extension_test.cc b/chrome/browser/pdf/pdf_extension_test.cc
index fd197e3..abf943bb 100644
--- a/chrome/browser/pdf/pdf_extension_test.cc
+++ b/chrome/browser/pdf/pdf_extension_test.cc
@@ -1772,10 +1772,8 @@
   zoom_watcher.Wait();
 }
 
-#if defined(OS_MACOSX)
-
-// Ensure that Mac trackpad pinch events are handled by the PDF viewer.
-IN_PROC_BROWSER_TEST_F(PDFExtensionTest, TrackpadPinchInvokesCustomZoom) {
+// Ensure that touchpad pinch events are handled by the PDF viewer.
+IN_PROC_BROWSER_TEST_F(PDFExtensionTest, TouchpadPinchInvokesCustomZoom) {
   GURL test_pdf_url(embedded_test_server()->GetURL("/pdf/test.pdf"));
   WebContents* guest_contents = LoadPdfGetGuestContents(test_pdf_url);
   ASSERT_TRUE(guest_contents);
@@ -1795,8 +1793,7 @@
                                std::move(send_pinch));
 }
 
-#else  // !defined(OS_MACOSX)
-
+#if !defined(OS_MACOSX)
 // Ensure that ctrl-wheel events are handled by the PDF viewer.
 IN_PROC_BROWSER_TEST_F(PDFExtensionTest, CtrlWheelInvokesCustomZoom) {
   GURL test_pdf_url(embedded_test_server()->GetURL("/pdf/test.pdf"));
@@ -1817,8 +1814,7 @@
   EnsureCustomPinchZoomInvoked(guest_contents, GetActiveWebContents(),
                                std::move(send_ctrl_wheel));
 }
-
-#endif  // defined(OS_MACOSX)
+#endif  // !defined(OS_MACOSX)
 
 #if (defined(OS_WIN) && defined(ADDRESS_SANITIZER)) || \
     (defined(OS_CHROME) && defined(MEMORY_SANITIZER))
diff --git a/chrome/browser/policy/configuration_policy_handler_list_factory.cc b/chrome/browser/policy/configuration_policy_handler_list_factory.cc
index bbcfdc2..0fc98646 100644
--- a/chrome/browser/policy/configuration_policy_handler_list_factory.cc
+++ b/chrome/browser/policy/configuration_policy_handler_list_factory.cc
@@ -1252,6 +1252,8 @@
       std::move(screen_lock_legacy_policies),
       base::WrapUnique(new ScreenLockDelayPolicyHandler(chrome_schema))));
   handlers->AddHandler(
+      std::make_unique<ScreenBrightnessPercentPolicyHandler>(chrome_schema));
+  handlers->AddHandler(
       std::make_unique<ExternalDataPolicyHandler>(key::kUserAvatarImage));
   handlers->AddHandler(
       std::make_unique<ExternalDataPolicyHandler>(key::kDeviceWallpaperImage));
diff --git a/chrome/browser/resources/chromeos/chromevox/cvox2/background/command_handler.js b/chrome/browser/resources/chromeos/chromevox/cvox2/background/command_handler.js
index 2c04b5b..acaa2ab 100644
--- a/chrome/browser/resources/chromeos/chromevox/cvox2/background/command_handler.js
+++ b/chrome/browser/resources/chromeos/chromevox/cvox2/background/command_handler.js
@@ -543,7 +543,17 @@
 
         if (EventSourceState.get() == EventSourceType.TOUCH_GESTURE &&
             AutomationPredicate.editText(actionNode)) {
-          actionNode.focus();
+          // Dispatch a click to ensure the VK gets shown.
+          var location = actionNode.location;
+          var event = {
+            type: chrome.accessibilityPrivate.SyntheticMouseEventType.PRESS,
+            x: location.left + Math.round(location.width / 2),
+            y: location.top + Math.round(location.height / 2)
+          };
+          chrome.accessibilityPrivate.sendSyntheticMouseEvent(event);
+          event.type =
+              chrome.accessibilityPrivate.SyntheticMouseEventType.RELEASE;
+          chrome.accessibilityPrivate.sendSyntheticMouseEvent(event);
           return false;
         }
 
diff --git a/chrome/browser/resources/chromeos/chromevox/host/chrome/tts_background.js b/chrome/browser/resources/chromeos/chromevox/host/chrome/tts_background.js
index cb9c9cb0..a2efd06 100644
--- a/chrome/browser/resources/chromeos/chromevox/host/chrome/tts_background.js
+++ b/chrome/browser/resources/chromeos/chromevox/host/chrome/tts_background.js
@@ -42,12 +42,6 @@
 cvox.TtsBackground = function() {
   goog.base(this);
 
-  // Use the current locale as the speech language if not otherwise
-  // specified.
-  if (this.ttsProperties['lang'] == undefined) {
-    this.ttsProperties['lang'] = chrome.i18n.getUILanguage();
-  }
-
   this.lastEventType = 'end';
 
   /** @private {number} */
diff --git a/chrome/browser/search/instant_service.cc b/chrome/browser/search/instant_service.cc
index 8358e1d..c12934f4 100644
--- a/chrome/browser/search/instant_service.cc
+++ b/chrome/browser/search/instant_service.cc
@@ -8,13 +8,17 @@
 
 #include "base/bind.h"
 #include "base/files/file_util.h"
+#include "base/no_destructor.h"
 #include "base/path_service.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/task/post_task.h"
+#include "base/time/default_tick_clock.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
+#include "chrome/browser/browser_process.h"
 #include "chrome/browser/chrome_notification_types.h"
+#include "chrome/browser/net/system_network_context_manager.h"
 #include "chrome/browser/ntp_tiles/chrome_most_visited_sites_factory.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/search/instant_io_context.h"
@@ -25,7 +29,6 @@
 #include "chrome/browser/search/ntp_icon_source.h"
 #include "chrome/browser/search/search.h"
 #include "chrome/browser/search/thumbnail_source.h"
-#include "chrome/browser/search/url_validity_checker_factory.h"
 #include "chrome/browser/search_engines/template_url_service_factory.h"
 #include "chrome/browser/themes/theme_properties.h"
 #include "chrome/browser/themes/theme_service.h"
@@ -41,6 +44,7 @@
 #include "components/prefs/pref_registry_simple.h"
 #include "components/prefs/pref_service.h"
 #include "components/search/search.h"
+#include "components/search/url_validity_checker_impl.h"
 #include "components/search_engines/template_url_service.h"
 #include "components/search_engines/template_url_service_observer.h"
 #include "components/sync_preferences/pref_service_syncable.h"
@@ -50,6 +54,7 @@
 #include "content/public/browser/notification_types.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/url_data_source.h"
+#include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "ui/gfx/color_utils.h"
 
 namespace {
@@ -809,9 +814,14 @@
 }
 
 UrlValidityChecker* InstantService::GetUrlValidityChecker() {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
   if (url_checker_for_testing_ != nullptr)
     return url_checker_for_testing_;
-  return UrlValidityCheckerFactory::GetUrlValidityChecker();
+  static base::NoDestructor<UrlValidityCheckerImpl> checker(
+      g_browser_process->system_network_context_manager()
+          ->GetSharedURLLoaderFactory(),
+      base::DefaultTickClock::GetInstance());
+  return checker.get();
 }
 
 // static
diff --git a/chrome/browser/search/instant_service.h b/chrome/browser/search/instant_service.h
index a033e79f..395ba95 100644
--- a/chrome/browser/search/instant_service.h
+++ b/chrome/browser/search/instant_service.h
@@ -203,8 +203,9 @@
   // chrome-search://local-ntp/background.jpg
   void SetBackgroundToLocalResource();
 
-  // Returns UrlValidityCheckerFactory::GetInstance() or
-  // |url_checker_for_testing_| if not null.
+  // Returns the owned instance of UrlValidityChecker or
+  // |url_checker_for_testing_| if not null. Should only be called from the UI
+  // thread.
   UrlValidityChecker* GetUrlValidityChecker();
 
   Profile* const profile_;
diff --git a/chrome/browser/search/url_validity_checker_factory.cc b/chrome/browser/search/url_validity_checker_factory.cc
deleted file mode 100644
index 51f818e..0000000
--- a/chrome/browser/search/url_validity_checker_factory.cc
+++ /dev/null
@@ -1,27 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/browser/search/url_validity_checker_factory.h"
-
-#include <memory>
-
-#include "base/time/default_tick_clock.h"
-#include "chrome/browser/browser_process.h"
-#include "chrome/browser/net/system_network_context_manager.h"
-#include "content/public/browser/browser_thread.h"
-#include "services/network/public/cpp/shared_url_loader_factory.h"
-
-// static
-UrlValidityChecker* UrlValidityCheckerFactory::GetUrlValidityChecker() {
-  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
-  static base::NoDestructor<UrlValidityCheckerImpl> checker(
-      g_browser_process->system_network_context_manager()
-          ->GetSharedURLLoaderFactory(),
-      base::DefaultTickClock::GetInstance());
-  return checker.get();
-}
-
-UrlValidityCheckerFactory::UrlValidityCheckerFactory() = default;
-
-UrlValidityCheckerFactory::~UrlValidityCheckerFactory() = default;
diff --git a/chrome/browser/search/url_validity_checker_factory.h b/chrome/browser/search/url_validity_checker_factory.h
deleted file mode 100644
index 0606a0b..0000000
--- a/chrome/browser/search/url_validity_checker_factory.h
+++ /dev/null
@@ -1,27 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_BROWSER_SEARCH_URL_VALIDITY_CHECKER_FACTORY_H_
-#define CHROME_BROWSER_SEARCH_URL_VALIDITY_CHECKER_FACTORY_H_
-
-#include "base/macros.h"
-#include "base/no_destructor.h"
-#include "components/search/url_validity_checker_impl.h"
-
-// Singleton that owns a single UrlValidityCheckerImpl instance. Should only be
-// called from the UI thread.
-class UrlValidityCheckerFactory {
- public:
-  static UrlValidityChecker* GetUrlValidityChecker();
-
- private:
-  friend class base::NoDestructor<UrlValidityCheckerFactory>;
-
-  UrlValidityCheckerFactory();
-  ~UrlValidityCheckerFactory();
-
-  DISALLOW_COPY_AND_ASSIGN(UrlValidityCheckerFactory);
-};
-
-#endif  // CHROME_BROWSER_SEARCH_URL_VALIDITY_CHECKER_FACTORY_H_
diff --git a/chrome/browser/ui/app_list/internal_app/internal_app_metadata.cc b/chrome/browser/ui/app_list/internal_app/internal_app_metadata.cc
index 4d54ff3..a36c3a4 100644
--- a/chrome/browser/ui/app_list/internal_app/internal_app_metadata.cc
+++ b/chrome/browser/ui/app_list/internal_app/internal_app_metadata.cc
@@ -26,6 +26,7 @@
 #include "chrome/common/pref_names.h"
 #include "chrome/grit/chrome_unscaled_resources.h"
 #include "chrome/grit/generated_resources.h"
+#include "chromeos/chromeos_switches.h"
 #include "components/arc/metrics/arc_metrics_constants.h"
 #include "components/arc/property/arc_property_bridge.h"
 #include "components/crx_file/id_util.h"
@@ -107,7 +108,9 @@
 
   const bool add_discover_app =
       get_all || !chromeos::ProfileHelper::IsEphemeralUserProfile(profile);
-  if (add_discover_app) {
+  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
+          chromeos::switches::kEnableDiscoverApp) &&
+      add_discover_app) {
     internal_app_list->push_back(
         {kInternalAppIdDiscover, IDS_INTERNAL_APP_DISCOVER,
          IDR_DISCOVER_APP_192,
diff --git a/chrome/browser/ui/autofill/chrome_autofill_client.cc b/chrome/browser/ui/autofill/chrome_autofill_client.cc
index c202f8f..2dab217 100644
--- a/chrome/browser/ui/autofill/chrome_autofill_client.cc
+++ b/chrome/browser/ui/autofill/chrome_autofill_client.cc
@@ -263,6 +263,7 @@
       ->AddInfoBar(CreateSaveCardInfoBarMobile(
           std::make_unique<AutofillSaveCardInfoBarDelegateMobile>(
               false, card, std::unique_ptr<base::DictionaryValue>(nullptr),
+              GetStrikeDatabase(),
               /*upload_save_card_callback=*/
               base::OnceCallback<void(const base::string16&)>(),
               /*local_save_card_callback=*/std::move(callback), GetPrefs())));
@@ -287,7 +288,7 @@
   std::unique_ptr<AutofillSaveCardInfoBarDelegateMobile>
       save_card_info_bar_delegate_mobile =
           std::make_unique<AutofillSaveCardInfoBarDelegateMobile>(
-              true, card, std::move(legal_message),
+              true, card, std::move(legal_message), GetStrikeDatabase(),
               /*upload_save_card_callback=*/std::move(callback),
               /*local_save_card_callback=*/base::Closure(), GetPrefs());
   if (save_card_info_bar_delegate_mobile->LegalMessagesParsedSuccessfully()) {
diff --git a/chrome/browser/ui/autofill/save_card_bubble_controller_impl.cc b/chrome/browser/ui/autofill/save_card_bubble_controller_impl.cc
index 69e36fef..29190944 100644
--- a/chrome/browser/ui/autofill/save_card_bubble_controller_impl.cc
+++ b/chrome/browser/ui/autofill/save_card_bubble_controller_impl.cc
@@ -8,6 +8,7 @@
 #include <utility>
 
 #include "base/strings/utf_string_conversions.h"
+#include "chrome/browser/autofill/strike_database_factory.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/signin/account_consistency_mode_manager.h"
 #include "chrome/browser/signin/account_tracker_service_factory.h"
@@ -27,6 +28,7 @@
 #include "chrome/common/url_constants.h"
 #include "components/autofill/core/browser/autofill_experiments.h"
 #include "components/autofill/core/browser/autofill_metrics.h"
+#include "components/autofill/core/browser/strike_database.h"
 #include "components/autofill/core/common/autofill_clock.h"
 #include "components/autofill/core/common/autofill_constants.h"
 #include "components/autofill/core/common/autofill_features.h"
@@ -48,7 +50,8 @@
     : content::WebContentsObserver(web_contents),
       web_contents_(web_contents),
       pref_service_(
-          user_prefs::UserPrefs::Get(web_contents->GetBrowserContext())) {
+          user_prefs::UserPrefs::Get(web_contents->GetBrowserContext())),
+      weak_ptr_factory_(this) {
   security_state::SecurityInfo security_info;
   SecurityStateTabHelper::FromWebContents(web_contents)
       ->GetSecurityInfo(&security_info);
@@ -71,12 +74,13 @@
   is_upload_save_ = false;
   is_reshow_ = false;
   should_request_name_from_user_ = false;
+  show_bubble_ = show_bubble;
   legal_message_lines_.clear();
 
   card_ = card;
   local_save_card_callback_ = std::move(save_card_callback);
   current_bubble_type_ = BubbleType::LOCAL_SAVE;
-  if (show_bubble) {
+  if (show_bubble_) {
     ShowBubble();
     AutofillMetrics::LogSaveCardPromptMetric(
         AutofillMetrics::SAVE_CARD_PROMPT_SHOW_REQUESTED, is_upload_save_,
@@ -106,8 +110,9 @@
   is_upload_save_ = true;
   is_reshow_ = false;
   should_request_name_from_user_ = should_request_name_from_user;
-  if (show_bubble) {
-    // Can't move this into the other "if (show_bubble)" below because an
+  show_bubble_ = show_bubble;
+  if (show_bubble_) {
+    // Can't move this into the other "if (show_bubble_)" below because an
     // invalid legal message would skip it.
     AutofillMetrics::LogSaveCardPromptMetric(
         AutofillMetrics::SAVE_CARD_PROMPT_SHOW_REQUESTED, is_upload_save_,
@@ -132,7 +137,7 @@
   upload_save_card_callback_ = std::move(save_card_callback);
   current_bubble_type_ = BubbleType::UPLOAD_SAVE;
 
-  if (show_bubble)
+  if (show_bubble_)
     ShowBubble();
   else
     ShowIconOnly();
@@ -374,6 +379,19 @@
     pref_service_->SetInteger(
         prefs::kAutofillAcceptSaveCreditCardPromptState,
         prefs::PREVIOUS_SAVE_CREDIT_CARD_PROMPT_USER_DECISION_DENIED);
+    if (show_bubble_ &&
+        base::FeatureList::IsEnabled(
+            features::kAutofillSaveCreditCardUsesStrikeSystem)) {
+      // If save was cancelled and the bubble was actually shown (NOT just the
+      // icon), count that as a strike against offering save in the future.
+      StrikeDatabase* strike_database = GetStrikeDatabase();
+      strike_database->AddStrike(
+          strike_database->GetKeyForCreditCardSave(
+              base::UTF16ToUTF8(card_.LastFourDigits())),
+          base::BindRepeating(
+              &SaveCardBubbleControllerImpl::OnStrikeChangeComplete,
+              weak_ptr_factory_.GetWeakPtr()));
+    }
   }
 }
 
@@ -409,6 +427,8 @@
   if (current_bubble_type_ == BubbleType::SIGN_IN_PROMO)
     current_bubble_type_ = BubbleType::MANAGE_CARDS;
   UpdateIcon();
+  if (observer_for_testing_)
+    observer_for_testing_->OnBubbleClosed();
 }
 
 void SaveCardBubbleControllerImpl::OnAnimationEnded() {
@@ -479,6 +499,20 @@
         pref_service_->GetInteger(
             prefs::kAutofillAcceptSaveCreditCardPromptState),
         GetSecurityLevel());
+    if (base::FeatureList::IsEnabled(
+            features::kAutofillSaveCreditCardUsesStrikeSystem) &&
+        show_bubble_) {
+      // If the save offer was ignored and the bubble was actually shown (NOT
+      // just the icon), count that as a strike against offering save in the
+      // future.
+      StrikeDatabase* strike_database = GetStrikeDatabase();
+      strike_database->AddStrike(
+          strike_database->GetKeyForCreditCardSave(
+              base::UTF16ToUTF8(card_.LastFourDigits())),
+          base::BindRepeating(
+              &SaveCardBubbleControllerImpl::OnStrikeChangeComplete,
+              weak_ptr_factory_.GetWeakPtr()));
+    }
   }
 }
 
@@ -506,6 +540,15 @@
       signin_manager->GetAuthenticatedAccountId());
 }
 
+StrikeDatabase* SaveCardBubbleControllerImpl::GetStrikeDatabase() {
+  Profile* profile = GetProfile();
+  // No need to return a StrikeDatabase in incognito mode. We don't allow saving
+  // of Autofill data while in incognito, so an incognito code path should never
+  // get this far.
+  DCHECK(profile && !profile->IsOffTheRecord());
+  return StrikeDatabaseFactory::GetForProfile(profile);
+}
+
 void SaveCardBubbleControllerImpl::ShowBubble() {
   DCHECK(current_bubble_type_ != BubbleType::INACTIVE);
   // Upload save callback should not be null for UPLOAD_SAVE state.
@@ -598,6 +641,12 @@
       ui::PAGE_TRANSITION_LINK, false));
 }
 
+void SaveCardBubbleControllerImpl::OnStrikeChangeComplete(
+    const int num_strikes) {
+  if (observer_for_testing_)
+    observer_for_testing_->OnSCBCStrikeChangeComplete();
+}
+
 security_state::SecurityLevel SaveCardBubbleControllerImpl::GetSecurityLevel()
     const {
   return security_level_;
diff --git a/chrome/browser/ui/autofill/save_card_bubble_controller_impl.h b/chrome/browser/ui/autofill/save_card_bubble_controller_impl.h
index 2e5b892c..e0bbc08 100644
--- a/chrome/browser/ui/autofill/save_card_bubble_controller_impl.h
+++ b/chrome/browser/ui/autofill/save_card_bubble_controller_impl.h
@@ -21,6 +21,7 @@
 namespace autofill {
 
 enum class BubbleType;
+class StrikeDatabase;
 
 // Implementation of per-tab class to control the save credit card bubble and
 // Omnibox icon.
@@ -34,6 +35,8 @@
   class ObserverForTest {
    public:
     virtual void OnBubbleShown() = 0;
+    virtual void OnBubbleClosed() = 0;
+    virtual void OnSCBCStrikeChangeComplete() = 0;
   };
 
   ~SaveCardBubbleControllerImpl() override;
@@ -131,6 +134,9 @@
 
   void FetchAccountInfo();
 
+  // Fetches the Autofill StrikeDatabase for the current profile.
+  StrikeDatabase* GetStrikeDatabase();
+
   // Displays both the offer-to-save bubble and is associated omnibox icon.
   void ShowBubble();
 
@@ -140,6 +146,10 @@
   // Update the visibility and toggled state of the Omnibox save card icon.
   void UpdateIcon();
 
+  // Used for browsertests. Gives the |observer_for_testing_| a notification
+  // a strike change has been made.
+  void OnStrikeChangeComplete(const int num_strikes);
+
   void OpenUrl(const GURL& url);
 
   // For testing.
@@ -184,6 +194,11 @@
   // requesting the cardholder name.
   bool should_request_name_from_user_ = false;
 
+  // Whether the offer-to-save bubble should be shown or not. If true, behaves
+  // normally. If false, the omnibox icon will be displayed when offering credit
+  // card save, but the bubble itself will not pop up.
+  bool show_bubble_ = true;
+
   // The account info of the signed-in user.
   AccountInfo account_info_;
 
@@ -203,6 +218,8 @@
   // Observer for when a bubble is created. Initialized only during tests.
   ObserverForTest* observer_for_testing_ = nullptr;
 
+  base::WeakPtrFactory<SaveCardBubbleControllerImpl> weak_ptr_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(SaveCardBubbleControllerImpl);
 };
 
diff --git a/chrome/browser/ui/cocoa/main_menu_builder.h b/chrome/browser/ui/cocoa/main_menu_builder.h
index 03a1837..6522798 100644
--- a/chrome/browser/ui/cocoa/main_menu_builder.h
+++ b/chrome/browser/ui/cocoa/main_menu_builder.h
@@ -12,19 +12,21 @@
 #include "base/mac/scoped_nsobject.h"
 #include "base/optional.h"
 
-@class AppController;
-
 namespace chrome {
 
-// Creates the main menu bar for and registers it as such on |nsapp|. The
-// NSApplicationDelegate |app_controller| is the target for specific,
-// special menu items.
+// Creates the main menu bar using the name specified in |product_name|, and
+// registers it as such on |nsapp|. The NSApplicationDelegate |app_delegate|
+// is the target for specific, special menu items.
+//
 //
 // Normally the main menu is built in a MainMenu.nib file, but NIB files files
 // are hard to edit (especially cross-platform) and bring in a compile
 // dependency on ibtool. Building the menu in code has a lower maintenance
 // burden.
-void BuildMainMenu(NSApplication* nsapp, AppController* app_controller);
+void BuildMainMenu(NSApplication* nsapp,
+                   id<NSApplicationDelegate> app_delegate,
+                   const base::string16& product_name,
+                   bool is_pwa);
 
 // Internal ////////////////////////////////////////////////////////////////////
 
@@ -77,9 +79,10 @@
     return tag(command_id).action(@selector(commandDispatch:));
   }
 
-  // Specifies a format string argument for the constructor's |string_id|.
-  MenuItemBuilder& string_format_1(int arg1) {
-    string_arg1_ = arg1;
+  // Specifies the string to substitute for the $1 found in the string for
+  // |string_id_|.
+  MenuItemBuilder& string_format_1(const base::string16& arg) {
+    string_arg1_ = arg;
     return *this;
   }
 
@@ -107,6 +110,12 @@
     return *this;
   }
 
+  // Excludes this item from the menu if |condition| is true.
+  MenuItemBuilder& remove_if(bool condition) {
+    is_removed_ |= condition;
+    return *this;
+  }
+
   // Builds a NSMenuItem instance from the properties set on the Builder.
   base::scoped_nsobject<NSMenuItem> Build() const;
 
@@ -114,7 +123,7 @@
   bool is_separator_ = false;
 
   int string_id_ = 0;
-  int string_arg1_ = 0;
+  base::string16 string_arg1_;
 
   int tag_ = 0;
 
@@ -126,6 +135,8 @@
 
   bool is_alternate_ = false;
 
+  bool is_removed_ = false;
+
   base::Optional<std::vector<MenuItemBuilder>> submenu_;
 
   // Copy and assign allowed.
diff --git a/chrome/browser/ui/cocoa/main_menu_builder.mm b/chrome/browser/ui/cocoa/main_menu_builder.mm
index 740e15d4..5e129e8 100644
--- a/chrome/browser/ui/cocoa/main_menu_builder.mm
+++ b/chrome/browser/ui/cocoa/main_menu_builder.mm
@@ -20,46 +20,55 @@
 
 using Item = internal::MenuItemBuilder;
 
-base::scoped_nsobject<NSMenuItem> BuildAppMenu(NSApplication* nsapp,
-                                               AppController* app_controller) {
+base::scoped_nsobject<NSMenuItem> BuildAppMenu(
+    NSApplication* nsapp,
+    id app_delegate,
+    const base::string16& product_name,
+    bool is_pwa) {
   base::scoped_nsobject<NSMenuItem> item =
       Item(IDS_APP_MENU_PRODUCT_NAME)
           .tag(IDC_CHROME_MENU)
           .submenu({
             Item(IDS_ABOUT_MAC)
-                .string_format_1(IDS_PRODUCT_NAME)
+                .string_format_1(product_name)
                 .tag(IDC_ABOUT)
-                .target(app_controller)
+                .target(app_delegate)
                 .action(@selector(orderFrontStandardAboutPanel:)),
                 Item().is_separator(),
                 Item(IDS_PREFERENCES)
                     .tag(IDC_OPTIONS)
-                    .target(app_controller)
-                    .action(@selector(showPreferences:)),
-                Item().is_separator(),
+                    .target(app_delegate)
+                    .action(@selector(showPreferences:))
+                    .remove_if(is_pwa),
+                Item().is_separator().remove_if(is_pwa),
                 Item(IDS_CLEAR_BROWSING_DATA)
-                    .command_id(IDC_CLEAR_BROWSING_DATA),
+                    .command_id(IDC_CLEAR_BROWSING_DATA)
+                    .remove_if(is_pwa),
                 Item(IDS_IMPORT_SETTINGS_MENU_MAC)
-                    .command_id(IDC_IMPORT_SETTINGS),
+                    .command_id(IDC_IMPORT_SETTINGS)
+                    .remove_if(is_pwa),
                 Item().is_separator(),
                 Item(IDS_SERVICES_MAC).tag(-1).submenu({}),
                 Item(IDS_HIDE_APP_MAC)
-                    .string_format_1(IDS_PRODUCT_NAME)
+                    .string_format_1(product_name)
                     .tag(IDC_HIDE_APP)
                     .action(@selector(hide:)),
                 Item(IDS_HIDE_OTHERS_MAC)
-                    .action(@selector(hideOtherApplications:)),
+                    .action(@selector(hideOtherApplications:))
+                    .remove_if(is_pwa),
                 Item(IDS_SHOW_ALL_MAC)
-                    .action(@selector(unhideAllApplications:)),
+                    .action(@selector(unhideAllApplications:))
+                    .remove_if(is_pwa),
                 Item().is_separator(),
                 Item(IDS_CONFIRM_TO_QUIT_OPTION)
-                    .target(app_controller)
-                    .action(@selector(toggleConfirmToQuit:)),
+                    .target(app_delegate)
+                    .action(@selector(toggleConfirmToQuit:))
+                    .remove_if(is_pwa),
                 Item().is_separator(),
                 // AppKit inserts "Quit and Keep Windows" as an alternate item
                 // automatically by using the -terminate: action.
                 Item(IDS_EXIT_MAC)
-                    .string_format_1(IDS_PRODUCT_NAME)
+                    .string_format_1(product_name)
                     .tag(IDC_EXIT)
                     .target(nsapp)
                     .action(@selector(terminate:)),
@@ -74,47 +83,65 @@
   return item;
 }
 
-base::scoped_nsobject<NSMenuItem> BuildFileMenu(NSApplication* nsapp,
-                                                AppController* app_controller) {
+base::scoped_nsobject<NSMenuItem> BuildFileMenu(
+    NSApplication* nsapp,
+    id app_delegate,
+    const base::string16& product_name,
+    bool is_pwa) {
   base::scoped_nsobject<NSMenuItem> item =
       Item(IDS_FILE_MENU_MAC)
           .tag(IDC_FILE_MENU)
           .submenu({
-            Item(IDS_NEW_TAB_MAC).command_id(IDC_NEW_TAB),
+            Item(IDS_NEW_TAB_MAC).command_id(IDC_NEW_TAB).remove_if(is_pwa),
                 Item(IDS_NEW_WINDOW_MAC).command_id(IDC_NEW_WINDOW),
                 Item(IDS_NEW_INCOGNITO_WINDOW_MAC)
-                    .command_id(IDC_NEW_INCOGNITO_WINDOW),
-                Item(IDS_REOPEN_CLOSED_TABS_MAC).command_id(IDC_RESTORE_TAB),
+                    .command_id(IDC_NEW_INCOGNITO_WINDOW)
+                    .remove_if(is_pwa),
+                Item(IDS_REOPEN_CLOSED_TABS_MAC)
+                    .command_id(IDC_RESTORE_TAB)
+                    .remove_if(is_pwa),
                 Item(IDS_OPEN_FILE_MAC).command_id(IDC_OPEN_FILE),
-                Item(IDS_OPEN_LOCATION_MAC).command_id(IDC_FOCUS_LOCATION),
+                Item(IDS_OPEN_LOCATION_MAC)
+                    .command_id(IDC_FOCUS_LOCATION)
+                    .remove_if(is_pwa),
                 Item().is_separator(),
                 // AppKit inserts "Close All" as an alternate item automatically
                 // by using the -performClose: action.
                 Item(IDS_CLOSE_WINDOW_MAC)
                     .tag(IDC_CLOSE_WINDOW)
                     .action(@selector(performClose:)),
-                Item(IDS_CLOSE_TAB_MAC).command_id(IDC_CLOSE_TAB),
-                Item(IDS_SAVE_PAGE_MAC).command_id(IDC_SAVE_PAGE),
-                Item().is_separator(),
-                Item(IDS_SHARE_MAC),
-                Item().is_separator(), Item(IDS_PRINT).command_id(IDC_PRINT),
+                Item(IDS_CLOSE_TAB_MAC)
+                    .command_id(IDC_CLOSE_TAB)
+                    .remove_if(is_pwa),
+                Item(IDS_SAVE_PAGE_MAC)
+                    .command_id(IDC_SAVE_PAGE)
+                    .remove_if(is_pwa),
+                Item().is_separator().remove_if(is_pwa),
+                Item(IDS_SHARE_MAC).remove_if(is_pwa), Item().is_separator(),
+                Item(IDS_PRINT).command_id(IDC_PRINT).remove_if(is_pwa),
                 Item(IDS_PRINT_USING_SYSTEM_DIALOG_MAC)
                     .command_id(IDC_BASIC_PRINT)
-                    .is_alternate(),
+                    .is_alternate()
+                    .remove_if(is_pwa),
           })
           .Build();
 
   // Wire up some legacy IBOutlets.
-  [app_controller setValue:[[item submenu] itemWithTag:IDC_CLOSE_TAB]
+  if (!is_pwa) {
+    [app_delegate setValue:[[item submenu] itemWithTag:IDC_CLOSE_TAB]
                     forKey:@"closeTabMenuItem_"];
-  [app_controller setValue:[[item submenu] itemWithTag:IDC_CLOSE_WINDOW]
+    [app_delegate setValue:[[item submenu] itemWithTag:IDC_CLOSE_WINDOW]
                     forKey:@"closeWindowMenuItem_"];
+  }
 
   return item;
 }
 
-base::scoped_nsobject<NSMenuItem> BuildEditMenu(NSApplication* nsapp,
-                                                AppController* app_controller) {
+base::scoped_nsobject<NSMenuItem> BuildEditMenu(
+    NSApplication* nsapp,
+    id app_delegate,
+    const base::string16& product_name,
+    bool is_pwa) {
   base::scoped_nsobject<NSMenuItem> item =
       Item(IDS_EDIT_MENU_MAC)
           .tag(IDC_EDIT_MENU)
@@ -192,19 +219,24 @@
   return item;
 }
 
-base::scoped_nsobject<NSMenuItem> BuildViewMenu(NSApplication* nsapp,
-                                                AppController* app_controller) {
+base::scoped_nsobject<NSMenuItem> BuildViewMenu(
+    NSApplication* nsapp,
+    id app_delegate,
+    const base::string16& product_name,
+    bool is_pwa) {
   base::scoped_nsobject<NSMenuItem> item =
       Item(IDS_VIEW_MENU_MAC)
           .tag(IDC_VIEW_MENU)
           .submenu({
             Item(IDS_BOOKMARK_BAR_ALWAYS_SHOW_MAC)
-                .command_id(IDC_SHOW_BOOKMARK_BAR),
+                .command_id(IDC_SHOW_BOOKMARK_BAR)
+                .remove_if(is_pwa),
                 Item(IDS_TOGGLE_FULLSCREEN_TOOLBAR_MAC)
                     .command_id(IDC_TOGGLE_FULLSCREEN_TOOLBAR),
                 Item(IDS_CUSTOMIZE_TOUCH_BAR)
                     .tag(IDC_CUSTOMIZE_TOUCH_BAR)
-                    .action(@selector(toggleTouchBarCustomizationPalette:)),
+                    .action(@selector(toggleTouchBarCustomizationPalette:))
+                    .remove_if(is_pwa),
                 Item().is_separator(),
                 Item(IDS_STOP_MENU_MAC).command_id(IDC_STOP),
                 Item(IDS_RELOAD_MENU_MAC).command_id(IDC_RELOAD),
@@ -239,25 +271,37 @@
 
 base::scoped_nsobject<NSMenuItem> BuildHistoryMenu(
     NSApplication* nsapp,
-    AppController* app_controller) {
+    id app_delegate,
+    const base::string16& product_name,
+    bool is_pwa) {
   base::scoped_nsobject<NSMenuItem> item =
       Item(IDS_HISTORY_MENU_MAC)
           .tag(IDC_HISTORY_MENU)
           .submenu({
-              Item(IDS_HISTORY_HOME_MAC).command_id(IDC_HOME),
+              Item(IDS_HISTORY_HOME_MAC).command_id(IDC_HOME).remove_if(is_pwa),
               Item(IDS_HISTORY_BACK_MAC).command_id(IDC_BACK),
               Item(IDS_HISTORY_FORWARD_MAC).command_id(IDC_FORWARD),
               Item()
                   .tag(HistoryMenuBridge::kRecentlyClosedSeparator)
-                  .is_separator(),
+                  .is_separator()
+                  .remove_if(is_pwa),
               Item(IDS_HISTORY_CLOSED_MAC)
-                  .tag(HistoryMenuBridge::kRecentlyClosedTitle),
-              Item().tag(HistoryMenuBridge::kVisitedSeparator).is_separator(),
+                  .tag(HistoryMenuBridge::kRecentlyClosedTitle)
+                  .remove_if(is_pwa),
+              Item()
+                  .tag(HistoryMenuBridge::kVisitedSeparator)
+                  .is_separator()
+                  .remove_if(is_pwa),
               Item(IDS_HISTORY_VISITED_MAC)
-                  .tag(HistoryMenuBridge::kVisitedTitle),
-              Item().tag(HistoryMenuBridge::kShowFullSeparator).is_separator(),
+                  .tag(HistoryMenuBridge::kVisitedTitle)
+                  .remove_if(is_pwa),
+              Item()
+                  .tag(HistoryMenuBridge::kShowFullSeparator)
+                  .is_separator()
+                  .remove_if(is_pwa),
               Item(IDS_HISTORY_SHOWFULLHISTORY_LINK)
-                  .command_id(IDC_SHOW_HISTORY),
+                  .command_id(IDC_SHOW_HISTORY)
+                  .remove_if(is_pwa),
           })
           .Build();
   return item;
@@ -265,7 +309,12 @@
 
 base::scoped_nsobject<NSMenuItem> BuildBookmarksMenu(
     NSApplication* nsapp,
-    AppController* app_controller) {
+    id app_delegate,
+    const base::string16& product_name,
+    bool is_pwa) {
+  if (is_pwa)
+    return base::scoped_nsobject<NSMenuItem>();
+
   base::scoped_nsobject<NSMenuItem> item =
       Item(IDS_BOOKMARKS_MENU)
           .tag(IDC_BOOKMARKS_MENU)
@@ -282,7 +331,12 @@
 
 base::scoped_nsobject<NSMenuItem> BuildPeopleMenu(
     NSApplication* nsapp,
-    AppController* app_controller) {
+    id app_delegate,
+    const base::string16& product_name,
+    bool is_pwa) {
+  if (is_pwa)
+    return base::scoped_nsobject<NSMenuItem>();
+
   base::scoped_nsobject<NSMenuItem> item = Item(IDS_PROFILES_OPTIONS_GROUP_NAME)
                                                .tag(IDC_PROFILE_MAIN_MENU)
                                                .submenu({})
@@ -292,7 +346,9 @@
 
 base::scoped_nsobject<NSMenuItem> BuildWindowMenu(
     NSApplication* nsapp,
-    AppController* app_controller) {
+    id app_delegate,
+    const base::string16& product_name,
+    bool is_pwa) {
   base::scoped_nsobject<NSMenuItem> item =
       Item(IDS_WINDOW_MENU_MAC)
           .tag(IDC_WINDOW_MENU)
@@ -304,17 +360,35 @@
                     .tag(IDC_MAXIMIZE_WINDOW)
                     .action(@selector(performZoom:)),
                 Item().is_separator(),
-                Item(IDS_NEXT_TAB_MAC).command_id(IDC_SELECT_NEXT_TAB),
-                Item(IDS_PREV_TAB_MAC).command_id(IDC_SELECT_PREVIOUS_TAB),
-                Item(IDS_SHOW_AS_TAB).command_id(IDC_SHOW_AS_TAB),
-                Item(IDS_DUPLICATE_TAB_MAC).command_id(IDC_DUPLICATE_TAB),
-                Item(IDS_MUTE_SITE_MAC).command_id(IDC_WINDOW_MUTE_SITE),
-                Item(IDS_PIN_TAB_MAC).command_id(IDC_WINDOW_PIN_TAB),
-                Item().is_separator(),
-                Item(IDS_SHOW_DOWNLOADS_MAC).command_id(IDC_SHOW_DOWNLOADS),
-                Item(IDS_SHOW_EXTENSIONS_MAC).command_id(IDC_MANAGE_EXTENSIONS),
-                Item(IDS_TASK_MANAGER_MAC).command_id(IDC_TASK_MANAGER),
-                Item().is_separator(),
+                Item(IDS_NEXT_TAB_MAC)
+                    .command_id(IDC_SELECT_NEXT_TAB)
+                    .remove_if(is_pwa),
+                Item(IDS_PREV_TAB_MAC)
+                    .command_id(IDC_SELECT_PREVIOUS_TAB)
+                    .remove_if(is_pwa),
+                Item(IDS_SHOW_AS_TAB)
+                    .command_id(IDC_SHOW_AS_TAB)
+                    .remove_if(is_pwa),
+                Item(IDS_DUPLICATE_TAB_MAC)
+                    .command_id(IDC_DUPLICATE_TAB)
+                    .remove_if(is_pwa),
+                Item(IDS_MUTE_SITE_MAC)
+                    .command_id(IDC_WINDOW_MUTE_SITE)
+                    .remove_if(is_pwa),
+                Item(IDS_PIN_TAB_MAC)
+                    .command_id(IDC_WINDOW_PIN_TAB)
+                    .remove_if(is_pwa),
+                Item().is_separator().remove_if(is_pwa),
+                Item(IDS_SHOW_DOWNLOADS_MAC)
+                    .command_id(IDC_SHOW_DOWNLOADS)
+                    .remove_if(is_pwa),
+                Item(IDS_SHOW_EXTENSIONS_MAC)
+                    .command_id(IDC_MANAGE_EXTENSIONS)
+                    .remove_if(is_pwa),
+                Item(IDS_TASK_MANAGER_MAC)
+                    .command_id(IDC_TASK_MANAGER)
+                    .remove_if(is_pwa),
+                Item().is_separator().remove_if(is_pwa),
                 Item(IDS_ALL_WINDOWS_FRONT_MAC)
                     .tag(IDC_ALL_WINDOWS_FRONT)
                     .action(@selector(arrangeInFront:)),
@@ -325,8 +399,14 @@
   return item;
 }
 
-base::scoped_nsobject<NSMenuItem> BuildHelpMenu(NSApplication* nsapp,
-                                                AppController* app_controller) {
+base::scoped_nsobject<NSMenuItem> BuildHelpMenu(
+    NSApplication* nsapp,
+    id app_delegate,
+    const base::string16& product_name,
+    bool is_pwa) {
+  if (is_pwa)
+    return base::scoped_nsobject<NSMenuItem>();
+
   base::scoped_nsobject<NSMenuItem> item =
       Item(IDS_HELP_MENU_MAC)
           .submenu({
@@ -334,7 +414,7 @@
             Item(IDS_FEEDBACK_MAC).command_id(IDC_FEEDBACK),
 #endif
                 Item(IDS_HELP_MAC)
-                    .string_format_1(IDS_PRODUCT_NAME)
+                    .string_format_1(product_name)
                     .command_id(IDC_HELP_PAGE_VIA_MENU),
           })
           .Build();
@@ -344,18 +424,23 @@
 
 }  // namespace
 
-void BuildMainMenu(NSApplication* nsapp, AppController* app_controller) {
+void BuildMainMenu(NSApplication* nsapp,
+                   id<NSApplicationDelegate> app_delegate,
+                   const base::string16& product_name,
+                   bool is_pwa) {
   base::scoped_nsobject<NSMenu> main_menu([[NSMenu alloc] initWithTitle:@""]);
 
-  using Builder =
-      base::scoped_nsobject<NSMenuItem> (*)(NSApplication*, AppController*);
+  using Builder = base::scoped_nsobject<NSMenuItem> (*)(
+      NSApplication*, id, const base::string16&, bool);
   static const Builder kBuilderFuncs[] = {
       &BuildAppMenu,    &BuildFileMenu,    &BuildEditMenu,
       &BuildViewMenu,   &BuildHistoryMenu, &BuildBookmarksMenu,
       &BuildPeopleMenu, &BuildWindowMenu,  &BuildHelpMenu,
   };
   for (auto* builder : kBuilderFuncs) {
-    [main_menu addItem:builder(nsapp, app_controller)];
+    auto item = builder(nsapp, app_delegate, product_name, is_pwa);
+    if (item)
+      [main_menu addItem:item];
   }
 
   [nsapp setMainMenu:main_menu];
@@ -372,6 +457,9 @@
 MenuItemBuilder::~MenuItemBuilder() = default;
 
 base::scoped_nsobject<NSMenuItem> MenuItemBuilder::Build() const {
+  if (is_removed_)
+    return base::scoped_nsobject<NSMenuItem>();
+
   if (is_separator_) {
     base::scoped_nsobject<NSMenuItem> item([[NSMenuItem separatorItem] retain]);
     if (tag_) {
@@ -394,12 +482,10 @@
   }
 
   NSString* title;
-  if (string_arg1_ != 0) {
-    base::string16 arg1 = l10n_util::GetStringUTF16(string_arg1_);
-    title = l10n_util::GetNSStringFWithFixup(string_id_, arg1);
-  } else {
+  if (!string_arg1_.empty())
+    title = l10n_util::GetNSStringFWithFixup(string_id_, string_arg1_);
+  else
     title = l10n_util::GetNSStringWithFixup(string_id_);
-  }
 
   SEL action = !submenu_.has_value() ? action_ : nil;
 
@@ -415,7 +501,9 @@
   if (submenu_.has_value()) {
     base::scoped_nsobject<NSMenu> menu([[NSMenu alloc] initWithTitle:title]);
     for (const auto& subitem : submenu_.value()) {
-      [menu addItem:subitem.Build()];
+      base::scoped_nsobject<NSMenuItem> ns_subitem = subitem.Build();
+      if (ns_subitem)
+        [menu addItem:ns_subitem];
     }
     [item setSubmenu:menu];
   }
diff --git a/chrome/browser/ui/cocoa/main_menu_builder_unittest.mm b/chrome/browser/ui/cocoa/main_menu_builder_unittest.mm
index 74cd545..9355b39e9 100644
--- a/chrome/browser/ui/cocoa/main_menu_builder_unittest.mm
+++ b/chrome/browser/ui/cocoa/main_menu_builder_unittest.mm
@@ -4,6 +4,7 @@
 
 #import "chrome/browser/ui/cocoa/main_menu_builder.h"
 
+#include "base/strings/utf_string_conversions.h"
 #include "chrome/app/chrome_command_ids.h"
 #include "chrome/grit/chromium_strings.h"
 #include "chrome/grit/generated_resources.h"
@@ -94,12 +95,21 @@
 }
 
 TEST(MainMenuBuilderTest, StringIdWithArg) {
+  base::string16 product_name(base::ASCIIToUTF16("MyAppIsTotallyAwesome"));
   base::scoped_nsobject<NSMenuItem> item =
-      MenuItemBuilder(IDS_ABOUT_MAC).string_format_1(IDS_PRODUCT_NAME).Build();
+      MenuItemBuilder(IDS_ABOUT_MAC).string_format_1(product_name).Build();
 
-  base::string16 product_name = l10n_util::GetStringUTF16(IDS_PRODUCT_NAME);
   EXPECT_NSEQ(l10n_util::GetNSStringF(IDS_ABOUT_MAC, product_name),
               [item title]);
 }
 
+TEST(MainMenuBuilderTest, Disabled) {
+  base::scoped_nsobject<NSMenuItem> item =
+      MenuItemBuilder(IDS_NEW_TAB_MAC).remove_if(true).Build();
+  EXPECT_EQ(nil, item.get());
+
+  item = MenuItemBuilder(IDS_NEW_TAB_MAC).remove_if(false).Build();
+  EXPECT_NSEQ(l10n_util::GetNSStringWithFixup(IDS_NEW_TAB_MAC), [item title]);
+}
+
 }  // namespace
diff --git a/chrome/browser/ui/omnibox/chrome_omnibox_client.cc b/chrome/browser/ui/omnibox/chrome_omnibox_client.cc
index c0c47c5..d89fb48 100644
--- a/chrome/browser/ui/omnibox/chrome_omnibox_client.cc
+++ b/chrome/browser/ui/omnibox/chrome_omnibox_client.cc
@@ -14,6 +14,8 @@
 #include "base/callback.h"
 #include "base/macros.h"
 #include "base/metrics/histogram_macros.h"
+#include "base/metrics/user_metrics.h"
+#include "base/metrics/user_metrics_action.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
@@ -23,6 +25,7 @@
 #include "chrome/browser/bitmap_fetcher/bitmap_fetcher_service_factory.h"
 #include "chrome/browser/bookmarks/bookmark_model_factory.h"
 #include "chrome/browser/bookmarks/bookmark_stats.h"
+#include "chrome/browser/browser_about_handler.h"
 #include "chrome/browser/command_updater.h"
 #include "chrome/browser/extensions/api/omnibox/omnibox_api.h"
 #include "chrome/browser/favicon/favicon_service_factory.h"
@@ -39,6 +42,8 @@
 #include "chrome/browser/translate/chrome_translate_client.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_commands.h"
+#include "chrome/browser/ui/browser_finder.h"
+#include "chrome/browser/ui/browser_window.h"
 #include "chrome/browser/ui/layout_constants.h"
 #include "chrome/browser/ui/omnibox/chrome_omnibox_edit_controller.h"
 #include "chrome/browser/ui/omnibox/chrome_omnibox_navigation_observer.h"
@@ -507,6 +512,24 @@
   }
 }
 
+void ChromeOmniboxClient::OpenUpdateChromeDialog() {
+  const content::WebContents* contents = controller_->GetWebContents();
+  if (contents) {
+    Browser* browser = chrome::FindBrowserWithWebContents(contents);
+    if (browser) {
+      // Here we record and take action more directly than
+      // chrome::OpenUpdateChromeDialog because that call is intended for use
+      // by the delayed-update/auto-nag system, possibly presenting dialogs
+      // that don't apply when the goal is immediate relaunch & update.
+      // TODO(orinj): Ensure that this is the correct way to handle
+      // explicitly requested update regardless of the kind of update ready.
+      // See comments at https://crrev.com/c/1281162 for context.
+      base::RecordAction(base::UserMetricsAction("UpdateChrome"));
+      browser->window()->ShowUpdateChromeDialog();
+    }
+  }
+}
+
 void ChromeOmniboxClient::DoPrerender(
     const AutocompleteMatch& match) {
   content::WebContents* web_contents = controller_->GetWebContents();
diff --git a/chrome/browser/ui/omnibox/chrome_omnibox_client.h b/chrome/browser/ui/omnibox/chrome_omnibox_client.h
index 8372fac..726bdfef 100644
--- a/chrome/browser/ui/omnibox/chrome_omnibox_client.h
+++ b/chrome/browser/ui/omnibox/chrome_omnibox_client.h
@@ -82,6 +82,7 @@
   void DiscardNonCommittedNavigations() override;
   void NewIncognitoWindow() override;
   void PromptPageTranslation() override;
+  void OpenUpdateChromeDialog() override;
 
  private:
   // Performs prerendering for |match|.
diff --git a/chrome/browser/ui/views/autofill/save_card_bubble_views_browsertest.cc b/chrome/browser/ui/views/autofill/save_card_bubble_views_browsertest.cc
index 21d9b8c..3614f5f6 100644
--- a/chrome/browser/ui/views/autofill/save_card_bubble_views_browsertest.cc
+++ b/chrome/browser/ui/views/autofill/save_card_bubble_views_browsertest.cc
@@ -8,12 +8,15 @@
 #include "base/strings/utf_string_conversions.h"
 #include "base/test/metrics/histogram_tester.h"
 #include "base/test/metrics/user_action_tester.h"
+#include "chrome/browser/ui/autofill/popup_constants.h"
 #include "chrome/browser/ui/autofill/save_card_bubble_controller_impl.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/browser/ui/views/autofill/save_card_bubble_views.h"
 #include "chrome/browser/ui/views/autofill/save_card_bubble_views_browsertest_base.h"
 #include "components/autofill/core/browser/autofill_experiments.h"
+#include "components/autofill/core/browser/test_autofill_clock.h"
+#include "components/autofill/core/common/autofill_constants.h"
 #include "components/autofill/core/common/autofill_features.h"
 #include "components/signin/core/browser/signin_buildflags.h"
 #include "content/public/test/browser_test_utils.h"
@@ -148,7 +151,8 @@
   // show.
   AddEventObserverToController();
   ReduceAnimationTime();
-  ResetEventWaiterForSequence({DialogEvent::BUBBLE_SHOWN});
+  ResetEventWaiterForSequence(
+      {DialogEvent::BUBBLE_CLOSED, DialogEvent::BUBBLE_SHOWN});
 
   // Click [Save] should close the offer-to-save bubble
   // and pop up the sign-in promo.
@@ -228,7 +232,8 @@
   // show.
   AddEventObserverToController();
   ReduceAnimationTime();
-  ResetEventWaiterForSequence({DialogEvent::BUBBLE_SHOWN});
+  ResetEventWaiterForSequence(
+      {DialogEvent::BUBBLE_CLOSED, DialogEvent::BUBBLE_SHOWN});
 
   // Click [Save] should close the offer-to-save bubble
   // and pop up the sign-in promo.
@@ -268,7 +273,8 @@
   // show.
   AddEventObserverToController();
   ReduceAnimationTime();
-  ResetEventWaiterForSequence({DialogEvent::BUBBLE_SHOWN});
+  ResetEventWaiterForSequence(
+      {DialogEvent::BUBBLE_CLOSED, DialogEvent::BUBBLE_SHOWN});
 
   // Click [Save] should close the offer-to-save bubble
   // and pop up the sign-in promo.
@@ -316,7 +322,8 @@
   ReduceAnimationTime();
 
 #if !defined(OS_CHROMEOS)
-  ResetEventWaiterForSequence({DialogEvent::BUBBLE_SHOWN});
+  ResetEventWaiterForSequence(
+      {DialogEvent::BUBBLE_CLOSED, DialogEvent::BUBBLE_SHOWN});
 #endif
 
   // Click [Save] should close the offer-to-save bubble and show "Card saved"
@@ -368,7 +375,8 @@
   ReduceAnimationTime();
 
 #if !defined(OS_CHROMEOS)
-  ResetEventWaiterForSequence({DialogEvent::BUBBLE_SHOWN});
+  ResetEventWaiterForSequence(
+      {DialogEvent::BUBBLE_CLOSED, DialogEvent::BUBBLE_SHOWN});
 #endif
 
   // Click [Save] should close the offer-to-save bubble and show "Card saved"
@@ -434,7 +442,8 @@
   ReduceAnimationTime();
 
 #if !defined(OS_CHROMEOS)
-  ResetEventWaiterForSequence({DialogEvent::BUBBLE_SHOWN});
+  ResetEventWaiterForSequence(
+      {DialogEvent::BUBBLE_CLOSED, DialogEvent::BUBBLE_SHOWN});
 #endif
 
   // Click [Save] should close the offer-to-save bubble and show "Card saved"
@@ -490,7 +499,8 @@
   // show.
   AddEventObserverToController();
   ReduceAnimationTime();
-  ResetEventWaiterForSequence({DialogEvent::BUBBLE_SHOWN});
+  ResetEventWaiterForSequence(
+      {DialogEvent::BUBBLE_CLOSED, DialogEvent::BUBBLE_SHOWN});
 
   // Click [Save] should close the offer-to-save bubble
   // and pop up the sign-in promo.
@@ -538,7 +548,8 @@
   // show.
   AddEventObserverToController();
   ReduceAnimationTime();
-  ResetEventWaiterForSequence({DialogEvent::BUBBLE_SHOWN});
+  ResetEventWaiterForSequence(
+      {DialogEvent::BUBBLE_CLOSED, DialogEvent::BUBBLE_SHOWN});
 
   // Click [Save] should close the offer-to-save bubble
   // and pop up the sign-in promo.
@@ -700,7 +711,6 @@
   EXPECT_TRUE(FindViewInBubbleById(DialogViewId::FOOTNOTE_VIEW)->visible());
 
   // Clicking the [X] close button should dismiss the bubble.
-  base::HistogramTester histogram_tester;
   ClickOnCloseButton();
 }
 
@@ -1223,4 +1233,397 @@
   histogram_tester.ExpectTotalCount("Autofill.UploadAcceptedCardOrigin", 0);
 }
 
+// Tests StrikeDatabase interaction with the local save bubble. Ensures that no
+// strikes are added if the feature flag is disabled.
+IN_PROC_BROWSER_TEST_F(SaveCardBubbleViewsFullFormBrowserTest,
+                       StrikeDatabase_Local_StrikeNotAddedIfExperimentFlagOff) {
+  scoped_feature_list_.InitAndDisableFeature(
+      features::kAutofillSaveCreditCardUsesStrikeSystem);
+
+  TestAutofillClock test_clock;
+  test_clock.SetNow(base::Time::Now());
+
+  // Set up the Payments RPC.
+  SetUploadDetailsRpcPaymentsDeclines();
+
+  // Submitting the form and having Payments decline offering to save should
+  // show the local save bubble.
+  // (Must wait for response from Payments before accessing the controller.)
+  ResetEventWaiterForSequence(
+      {DialogEvent::REQUESTED_UPLOAD_SAVE,
+       DialogEvent::RECEIVED_GET_UPLOAD_DETAILS_RESPONSE,
+       DialogEvent::OFFERED_LOCAL_SAVE});
+  FillAndSubmitForm();
+  WaitForObservedEvent();
+  EXPECT_TRUE(
+      FindViewInBubbleById(DialogViewId::MAIN_CONTENT_VIEW_LOCAL)->visible());
+
+  // Clicking the [X] close button should dismiss the bubble.
+  ClickOnCloseButton();
+
+  base::HistogramTester histogram_tester;
+
+  // Wait long enough to avoid bubble stickiness, then navigate away from the
+  // page.
+  test_clock.Advance(kCardBubbleSurviveNavigationTime);
+  ReturnToInitialPage();
+
+  // Ensure that no strike was added because the feature is disabled.
+  histogram_tester.ExpectTotalCount(
+      "Autofill.StrikeDatabase.NthStrikeAdded.CreditCardSave", 0);
+}
+
+// Tests StrikeDatabase interaction with the upload save bubble. Ensures that no
+// strikes are added if the feature flag is disabled.
+IN_PROC_BROWSER_TEST_F(
+    SaveCardBubbleViewsFullFormBrowserTest,
+    StrikeDatabase_Upload_StrikeNotAddedIfExperimentFlagOff) {
+  scoped_feature_list_.InitAndDisableFeature(
+      features::kAutofillSaveCreditCardUsesStrikeSystem);
+
+  TestAutofillClock test_clock;
+  test_clock.SetNow(base::Time::Now());
+
+  // Set up the Payments RPC.
+  SetUploadDetailsRpcPaymentsAccepts();
+
+  // Submitting the form should show the upload save bubble and legal footer.
+  // (Must wait for response from Payments before accessing the controller.)
+  ResetEventWaiterForSequence(
+      {DialogEvent::REQUESTED_UPLOAD_SAVE,
+       DialogEvent::RECEIVED_GET_UPLOAD_DETAILS_RESPONSE});
+  FillAndSubmitForm();
+  WaitForObservedEvent();
+  EXPECT_TRUE(
+      FindViewInBubbleById(DialogViewId::MAIN_CONTENT_VIEW_UPLOAD)->visible());
+  EXPECT_TRUE(FindViewInBubbleById(DialogViewId::FOOTNOTE_VIEW)->visible());
+
+  // Clicking the [X] close button should dismiss the bubble.
+  ClickOnCloseButton();
+
+  base::HistogramTester histogram_tester;
+
+  // Wait long enough to avoid bubble stickiness, then navigate away from the
+  // page.
+  test_clock.Advance(kCardBubbleSurviveNavigationTime);
+  ReturnToInitialPage();
+
+  // Ensure that no strike was added because the feature is disabled.
+  histogram_tester.ExpectTotalCount(
+      "Autofill.StrikeDatabase.NthStrikeAdded.CreditCardSave", 0);
+}
+
+// TODO(jsaul): With the fate of the [No thanks] button currently non-existent,
+//              there's no way to test that bubble dismissal will add a strike.
+//              If the [No thanks] button makes a return (seems possible), add a
+//              matching test for that scenario.
+
+// Tests StrikeDatabase interaction with the local save bubble. Ensures that a
+// strike is added if the bubble is ignored.
+IN_PROC_BROWSER_TEST_F(SaveCardBubbleViewsFullFormBrowserTest,
+                       StrikeDatabase_Local_AddStrikeIfBubbleIgnored) {
+  scoped_feature_list_.InitAndEnableFeature(
+      features::kAutofillSaveCreditCardUsesStrikeSystem);
+
+  TestAutofillClock test_clock;
+  test_clock.SetNow(base::Time::Now());
+
+  // Set up the Payments RPC.
+  SetUploadDetailsRpcPaymentsDeclines();
+
+  // Submitting the form and having Payments decline offering to save should
+  // show the local save bubble.
+  // (Must wait for response from Payments before accessing the controller.)
+  ResetEventWaiterForSequence(
+      {DialogEvent::REQUESTED_UPLOAD_SAVE,
+       DialogEvent::RECEIVED_GET_UPLOAD_DETAILS_RESPONSE,
+       DialogEvent::OFFERED_LOCAL_SAVE});
+  FillAndSubmitForm();
+  WaitForObservedEvent();
+  EXPECT_TRUE(
+      FindViewInBubbleById(DialogViewId::MAIN_CONTENT_VIEW_LOCAL)->visible());
+
+  // Clicking the [X] close button should dismiss the bubble.
+  ClickOnCloseButton();
+
+  base::HistogramTester histogram_tester;
+
+  // Wait long enough to avoid bubble stickiness, then navigate away from the
+  // page.
+  test_clock.Advance(kCardBubbleSurviveNavigationTime);
+  ReturnToInitialPage();
+
+  // Ensure that a strike was added due to the bubble being ignored.
+  histogram_tester.ExpectUniqueSample(
+      "Autofill.StrikeDatabase.NthStrikeAdded.CreditCardSave",
+      /*sample=*/1, /*count=*/1);
+}
+
+// Tests StrikeDatabase interaction with the upload save bubble. Ensures that a
+// strike is added if the bubble is ignored.
+IN_PROC_BROWSER_TEST_F(SaveCardBubbleViewsFullFormBrowserTest,
+                       StrikeDatabase_Upload_AddStrikeIfBubbleIgnored) {
+  scoped_feature_list_.InitAndEnableFeature(
+      features::kAutofillSaveCreditCardUsesStrikeSystem);
+
+  TestAutofillClock test_clock;
+  test_clock.SetNow(base::Time::Now());
+
+  // Set up the Payments RPC.
+  SetUploadDetailsRpcPaymentsAccepts();
+
+  // Submitting the form should show the upload save bubble and legal footer.
+  // (Must wait for response from Payments before accessing the controller.)
+  ResetEventWaiterForSequence(
+      {DialogEvent::REQUESTED_UPLOAD_SAVE,
+       DialogEvent::RECEIVED_GET_UPLOAD_DETAILS_RESPONSE});
+  FillAndSubmitForm();
+  WaitForObservedEvent();
+  EXPECT_TRUE(
+      FindViewInBubbleById(DialogViewId::MAIN_CONTENT_VIEW_UPLOAD)->visible());
+  EXPECT_TRUE(FindViewInBubbleById(DialogViewId::FOOTNOTE_VIEW)->visible());
+
+  // Clicking the [X] close button should dismiss the bubble.
+  ClickOnCloseButton();
+
+  base::HistogramTester histogram_tester;
+
+  // Wait long enough to avoid bubble stickiness, then navigate away from the
+  // page.
+  test_clock.Advance(kCardBubbleSurviveNavigationTime);
+  ReturnToInitialPage();
+
+  // Ensure that a strike was added due to the bubble being ignored.
+  histogram_tester.ExpectUniqueSample(
+      "Autofill.StrikeDatabase.NthStrikeAdded.CreditCardSave",
+      /*sample=*/1, /*count=*/1);
+}
+
+// Tests StrikeDatabase interaction with the upload save bubble. Ensures that a
+// strike is added if card upload to Google Payments fails.
+IN_PROC_BROWSER_TEST_F(SaveCardBubbleViewsFullFormBrowserTest,
+                       StrikeDatabase_Upload_AddStrikeIfSaveFails) {
+  scoped_feature_list_.InitAndEnableFeature(
+      features::kAutofillSaveCreditCardUsesStrikeSystem);
+
+  TestAutofillClock test_clock;
+  test_clock.SetNow(base::Time::Now());
+
+  // Set up the Payments RPCs.
+  SetUploadDetailsRpcPaymentsAccepts();
+  SetUploadCardRpcPaymentsFails();
+
+  // Submitting the form should show the upload save bubble and legal footer.
+  // (Must wait for response from Payments before accessing the controller.)
+  ResetEventWaiterForSequence(
+      {DialogEvent::REQUESTED_UPLOAD_SAVE,
+       DialogEvent::RECEIVED_GET_UPLOAD_DETAILS_RESPONSE});
+  FillAndSubmitForm();
+  WaitForObservedEvent();
+  EXPECT_TRUE(
+      FindViewInBubbleById(DialogViewId::MAIN_CONTENT_VIEW_UPLOAD)->visible());
+  EXPECT_TRUE(FindViewInBubbleById(DialogViewId::FOOTNOTE_VIEW)->visible());
+
+  // Clicking [Save] should accept and close it, then send an UploadCardRequest
+  // to Google Payments.
+  ResetEventWaiterForSequence({DialogEvent::SENT_UPLOAD_CARD_REQUEST,
+                               DialogEvent::RECEIVED_UPLOAD_CARD_RESPONSE,
+                               DialogEvent::STRIKE_CHANGE_COMPLETE});
+  base::HistogramTester histogram_tester;
+  ClickOnDialogViewWithIdAndWait(DialogViewId::OK_BUTTON);
+
+  // Wait long enough to avoid bubble stickiness, then navigate away from the
+  // page. Ensures that navigation does not create an additional strike.
+  test_clock.Advance(kCardBubbleSurviveNavigationTime);
+  ReturnToInitialPage();
+
+  // Ensure that a strike was added due to the upload card request failing.
+  histogram_tester.ExpectUniqueSample(
+      "Autofill.StrikeDatabase.NthStrikeAdded.CreditCardSave",
+      /*sample=*/1, /*count=*/1);
+}
+
+// TODO(crbug.com/884817): There's a lot of duplicate code in the tests that
+//                         follow. Investigate refactoring; perhaps these could
+//                         all be reduced to single tests with a local vs.
+//                         upload boolean for branching logic.
+// Tests overall StrikeDatabase interaction with the local save bubble. Runs an
+// example of ignoring the prompt three times and ensuring that the
+// offer-to-save bubble does not appear on the fourth try. Then, ensures that no
+// strikes are added if the card already has max strikes.
+IN_PROC_BROWSER_TEST_F(SaveCardBubbleViewsFullFormBrowserTest,
+                       StrikeDatabase_Local_FullFlowTest) {
+  scoped_feature_list_.InitAndEnableFeature(
+      features::kAutofillSaveCreditCardUsesStrikeSystem);
+
+  TestAutofillClock test_clock;
+  test_clock.SetNow(base::Time::Now());
+  bool controller_observer_set = false;
+
+  // Set up the Payments RPC.
+  SetUploadDetailsRpcPaymentsDeclines();
+
+  // Show and ignore the bubble kMaxStrikesToPreventPoppingUpOfferToSavePrompt
+  // times in order to accrue maximum strikes.
+  for (int i = 0; i < kMaxStrikesToPreventPoppingUpOfferToSavePrompt; i++) {
+    // Submitting the form and having Payments decline offering to save should
+    // show the local save bubble.
+    // (Must wait for response from Payments before accessing the controller.)
+    ResetEventWaiterForSequence(
+        {DialogEvent::REQUESTED_UPLOAD_SAVE,
+         DialogEvent::RECEIVED_GET_UPLOAD_DETAILS_RESPONSE,
+         DialogEvent::OFFERED_LOCAL_SAVE});
+    FillAndSubmitForm();
+    WaitForObservedEvent();
+    EXPECT_TRUE(
+        FindViewInBubbleById(DialogViewId::MAIN_CONTENT_VIEW_LOCAL)->visible());
+
+    if (!controller_observer_set) {
+      // Add an event observer to the controller.
+      AddEventObserverToController();
+      ReduceAnimationTime();
+      controller_observer_set = true;
+    }
+
+    // Clicking the [X] close button should dismiss the bubble.
+    ClickOnCloseButton();
+
+    base::HistogramTester histogram_tester;
+
+    // Wait long enough to avoid bubble stickiness, then navigate away from the
+    // page.
+    test_clock.Advance(kCardBubbleSurviveNavigationTime);
+    ResetEventWaiterForSequence({DialogEvent::STRIKE_CHANGE_COMPLETE});
+    ReturnToInitialPage();
+    WaitForObservedEvent();
+
+    // Ensure that a strike was added due to the bubble being ignored.
+    // The sample logged is the Nth strike added, or (i+1).
+    histogram_tester.ExpectUniqueSample(
+        "Autofill.StrikeDatabase.NthStrikeAdded.CreditCardSave",
+        /*sample=*/(i + 1), /*count=*/1);
+  }
+
+  // Submit the form a fourth time. Since the card now has maximum strikes (3),
+  // the icon should be shown but the bubble should not.
+  ResetEventWaiterForSequence(
+      {DialogEvent::REQUESTED_UPLOAD_SAVE,
+       DialogEvent::RECEIVED_GET_UPLOAD_DETAILS_RESPONSE,
+       DialogEvent::OFFERED_LOCAL_SAVE});
+  FillAndSubmitForm();
+  WaitForObservedEvent();
+  EXPECT_TRUE(GetSaveCardIconView()->visible());
+  EXPECT_FALSE(GetSaveCardBubbleViews());
+
+  // Click the icon to show the bubble.
+  ResetEventWaiterForSequence({DialogEvent::BUBBLE_SHOWN});
+  ClickOnView(GetSaveCardIconView());
+  WaitForObservedEvent();
+  EXPECT_TRUE(
+      FindViewInBubbleById(DialogViewId::MAIN_CONTENT_VIEW_LOCAL)->visible());
+
+  // Clicking the [X] close button should dismiss the bubble.
+  ClickOnCloseButton();
+
+  base::HistogramTester histogram_tester;
+
+  // Wait long enough to avoid bubble stickiness, then navigate away from the
+  // page.
+  test_clock.Advance(kCardBubbleSurviveNavigationTime);
+  ReturnToInitialPage();
+
+  // Ensure that no strike was added because the card already had max strikes.
+  histogram_tester.ExpectTotalCount(
+      "Autofill.StrikeDatabase.NthStrikeAdded.CreditCardSave", 0);
+}
+
+// Tests overall StrikeDatabase interaction with the upload save bubble. Runs an
+// example of ignoring the prompt three times and ensuring that the
+// offer-to-save bubble does not appear on the fourth try. Then, ensures that no
+// strikes are added if the card already has max strikes.
+IN_PROC_BROWSER_TEST_F(SaveCardBubbleViewsFullFormBrowserTest,
+                       StrikeDatabase_Upload_FullFlowTest) {
+  scoped_feature_list_.InitAndEnableFeature(
+      features::kAutofillSaveCreditCardUsesStrikeSystem);
+
+  TestAutofillClock test_clock;
+  test_clock.SetNow(base::Time::Now());
+  bool controller_observer_set = false;
+
+  // Set up the Payments RPC.
+  SetUploadDetailsRpcPaymentsAccepts();
+
+  // Show and ignore the bubble kMaxStrikesToPreventPoppingUpOfferToSavePrompt
+  // times in order to accrue maximum strikes.
+  for (int i = 0; i < kMaxStrikesToPreventPoppingUpOfferToSavePrompt; i++) {
+    // Submitting the form should show the upload save bubble and legal footer.
+    // (Must wait for response from Payments before accessing the controller.)
+    ResetEventWaiterForSequence(
+        {DialogEvent::REQUESTED_UPLOAD_SAVE,
+         DialogEvent::RECEIVED_GET_UPLOAD_DETAILS_RESPONSE});
+    FillAndSubmitForm();
+    WaitForObservedEvent();
+    EXPECT_TRUE(FindViewInBubbleById(DialogViewId::MAIN_CONTENT_VIEW_UPLOAD)
+                    ->visible());
+    EXPECT_TRUE(FindViewInBubbleById(DialogViewId::FOOTNOTE_VIEW)->visible());
+
+    if (!controller_observer_set) {
+      // Add an event observer to the controller.
+      AddEventObserverToController();
+      ReduceAnimationTime();
+      controller_observer_set = true;
+    }
+
+    // Clicking the [X] close button should dismiss the bubble.
+    ClickOnCloseButton();
+
+    base::HistogramTester histogram_tester;
+
+    // Wait long enough to avoid bubble stickiness, then navigate away from the
+    // page.
+    test_clock.Advance(kCardBubbleSurviveNavigationTime);
+    ResetEventWaiterForSequence({DialogEvent::STRIKE_CHANGE_COMPLETE});
+    ReturnToInitialPage();
+    WaitForObservedEvent();
+
+    // Ensure that a strike was added due to the bubble being ignored.
+    // The sample logged is the Nth strike added, or (i+1).
+    histogram_tester.ExpectUniqueSample(
+        "Autofill.StrikeDatabase.NthStrikeAdded.CreditCardSave",
+        /*sample=*/(i + 1), /*count=*/1);
+  }
+
+  // Submit the form a fourth time. Since the card now has maximum strikes (3),
+  // the icon should be shown but the bubble should not.
+  ResetEventWaiterForSequence(
+      {DialogEvent::REQUESTED_UPLOAD_SAVE,
+       DialogEvent::RECEIVED_GET_UPLOAD_DETAILS_RESPONSE});
+  FillAndSubmitForm();
+  WaitForObservedEvent();
+  EXPECT_TRUE(GetSaveCardIconView()->visible());
+  EXPECT_FALSE(GetSaveCardBubbleViews());
+
+  // Click the icon to show the bubble.
+  ResetEventWaiterForSequence({DialogEvent::BUBBLE_SHOWN});
+  ClickOnView(GetSaveCardIconView());
+  WaitForObservedEvent();
+  EXPECT_TRUE(
+      FindViewInBubbleById(DialogViewId::MAIN_CONTENT_VIEW_UPLOAD)->visible());
+  EXPECT_TRUE(FindViewInBubbleById(DialogViewId::FOOTNOTE_VIEW)->visible());
+
+  // Clicking the [X] close button should dismiss the bubble.
+  ClickOnCloseButton();
+
+  base::HistogramTester histogram_tester;
+
+  // Wait long enough to avoid bubble stickiness, then navigate away from the
+  // page.
+  test_clock.Advance(kCardBubbleSurviveNavigationTime);
+  ReturnToInitialPage();
+
+  // Ensure that no strike was added because the card already had max strikes.
+  histogram_tester.ExpectTotalCount(
+      "Autofill.StrikeDatabase.NthStrikeAdded.CreditCardSave", 0);
+}
+
 }  // namespace autofill
diff --git a/chrome/browser/ui/views/autofill/save_card_bubble_views_browsertest_base.cc b/chrome/browser/ui/views/autofill/save_card_bubble_views_browsertest_base.cc
index 151b4bb..44055dce 100644
--- a/chrome/browser/ui/views/autofill/save_card_bubble_views_browsertest_base.cc
+++ b/chrome/browser/ui/views/autofill/save_card_bubble_views_browsertest_base.cc
@@ -59,6 +59,8 @@
 const char kResponseGetUploadDetailsFailure[] =
     "{\"error\":{\"code\":\"FAILED_PRECONDITION\",\"user_error_message\":\"An "
     "unexpected error has occurred. Please try again later.\"}}";
+const char kURLUploadCardRequest[] =
+    "https://payments.google.com/payments/apis/chromepaymentsservice/savecard";
 
 const double kFakeGeolocationLatitude = 1.23;
 const double kFakeGeolocationLongitude = 4.56;
@@ -140,11 +142,31 @@
     event_waiter_->OnEvent(DialogEvent::SENT_UPLOAD_CARD_REQUEST);
 }
 
+void SaveCardBubbleViewsBrowserTestBase::OnReceivedUploadCardResponse() {
+  if (event_waiter_)
+    event_waiter_->OnEvent(DialogEvent::RECEIVED_UPLOAD_CARD_RESPONSE);
+}
+
+void SaveCardBubbleViewsBrowserTestBase::OnCCSMStrikeChangeComplete() {
+  if (event_waiter_)
+    event_waiter_->OnEvent(DialogEvent::STRIKE_CHANGE_COMPLETE);
+}
+
 void SaveCardBubbleViewsBrowserTestBase::OnBubbleShown() {
   if (event_waiter_)
     event_waiter_->OnEvent(DialogEvent::BUBBLE_SHOWN);
 }
 
+void SaveCardBubbleViewsBrowserTestBase::OnBubbleClosed() {
+  if (event_waiter_)
+    event_waiter_->OnEvent(DialogEvent::BUBBLE_CLOSED);
+}
+
+void SaveCardBubbleViewsBrowserTestBase::OnSCBCStrikeChangeComplete() {
+  if (event_waiter_)
+    event_waiter_->OnEvent(DialogEvent::STRIKE_CHANGE_COMPLETE);
+}
+
 void SaveCardBubbleViewsBrowserTestBase::SetUpInProcessBrowserTestFixture() {
   will_create_browser_context_services_subscription_ =
       BrowserContextDependencyManager::GetInstance()
@@ -348,6 +370,11 @@
                                          net::HTTP_INTERNAL_SERVER_ERROR);
 }
 
+void SaveCardBubbleViewsBrowserTestBase::SetUploadCardRpcPaymentsFails() {
+  test_url_loader_factory()->AddResponse(kURLUploadCardRequest,
+                                         kResponseGetUploadDetailsFailure);
+}
+
 void SaveCardBubbleViewsBrowserTestBase::ClickOnView(views::View* view) {
   DCHECK(view);
   ui::MouseEvent pressed(ui::ET_MOUSE_PRESSED, gfx::Point(), gfx::Point(),
@@ -425,8 +452,10 @@
 void SaveCardBubbleViewsBrowserTestBase::ClickOnCloseButton() {
   SaveCardBubbleViews* save_card_bubble_views = GetSaveCardBubbleViews();
   DCHECK(save_card_bubble_views);
+  ResetEventWaiterForSequence({DialogEvent::BUBBLE_CLOSED});
   ClickOnDialogViewAndWait(
       save_card_bubble_views->GetBubbleFrameView()->GetCloseButtonForTest());
+  DCHECK(!GetSaveCardBubbleViews());
 }
 
 SaveCardBubbleViews*
@@ -477,6 +506,10 @@
   event_waiter_->Wait();
 }
 
+void SaveCardBubbleViewsBrowserTestBase::ReturnToInitialPage() {
+  NavigateTo(test_file_path_);
+}
+
 network::TestURLLoaderFactory*
 SaveCardBubbleViewsBrowserTestBase::test_url_loader_factory() {
   return &test_url_loader_factory_;
diff --git a/chrome/browser/ui/views/autofill/save_card_bubble_views_browsertest_base.h b/chrome/browser/ui/views/autofill/save_card_bubble_views_browsertest_base.h
index 481d931..625456bd 100644
--- a/chrome/browser/ui/views/autofill/save_card_bubble_views_browsertest_base.h
+++ b/chrome/browser/ui/views/autofill/save_card_bubble_views_browsertest_base.h
@@ -47,7 +47,10 @@
     REQUESTED_UPLOAD_SAVE,
     RECEIVED_GET_UPLOAD_DETAILS_RESPONSE,
     SENT_UPLOAD_CARD_REQUEST,
-    BUBBLE_SHOWN
+    RECEIVED_UPLOAD_CARD_RESPONSE,
+    STRIKE_CHANGE_COMPLETE,
+    BUBBLE_SHOWN,
+    BUBBLE_CLOSED
   };
 
  protected:
@@ -66,9 +69,13 @@
   void OnDecideToRequestUploadSave() override;
   void OnReceivedGetUploadDetailsResponse() override;
   void OnSentUploadCardRequest() override;
+  void OnReceivedUploadCardResponse() override;
+  void OnCCSMStrikeChangeComplete() override;
 
   // SaveCardBubbleControllerImpl::ObserverForTest:
   void OnBubbleShown() override;
+  void OnBubbleClosed() override;
+  void OnSCBCStrikeChangeComplete() override;
 
   // BrowserTestBase:
   void SetUpInProcessBrowserTestFixture() override;
@@ -95,6 +102,7 @@
   void SetUploadDetailsRpcPaymentsAccepts();
   void SetUploadDetailsRpcPaymentsDeclines();
   void SetUploadDetailsRpcServerError();
+  void SetUploadCardRpcPaymentsFails();
 
   // Clicks on the given views::View*.
   void ClickOnView(views::View* view);
@@ -139,6 +147,8 @@
   // Wait for the event(s) passed to ResetEventWaiter*() to occur.
   void WaitForObservedEvent();
 
+  void ReturnToInitialPage();
+
   network::TestURLLoaderFactory* test_url_loader_factory();
 
   std::unique_ptr<
diff --git a/chrome/browser/ui/views/profiles/user_manager_view.cc b/chrome/browser/ui/views/profiles/user_manager_view.cc
index 5f4acf47..1b7300b 100644
--- a/chrome/browser/ui/views/profiles/user_manager_view.cc
+++ b/chrome/browser/ui/views/profiles/user_manager_view.cc
@@ -15,7 +15,6 @@
 #include "chrome/browser/profiles/profile_window.h"
 #include "chrome/browser/profiles/profiles_state.h"
 #include "chrome/browser/signin/signin_promo.h"
-#include "chrome/browser/signin/signin_util.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_dialogs.h"
 #include "chrome/browser/ui/browser_finder.h"
@@ -245,9 +244,6 @@
     const std::string& email,
     const base::FilePath& profile_path,
     signin_metrics::Reason reason) {
-  CHECK(signin_util::IsForceSigninEnabled() ||
-        reason != signin_metrics::Reason::REASON_UNLOCK)
-      << "Legacy supervised users are no longer supported.";
   // This method should only be called if the user manager is already showing.
   if (!UserManager::IsShowing())
     return;
diff --git a/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc b/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
index 70895249..ea4accbe0 100644
--- a/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
+++ b/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
@@ -1554,9 +1554,6 @@
                             sync_service->IsUsingSecondaryPassphrase());
     html_source->AddBoolean(
         "uploadToGoogleActive",
-        base::FeatureList::IsEnabled(
-            autofill::features::
-                kAutofillEnablePaymentsInteractionsOnAuthError) ||
             syncer::GetUploadToGoogleState(
                 sync_service, syncer::ModelType::AUTOFILL_WALLET_DATA) ==
                 syncer::UploadState::ACTIVE);
diff --git a/chrome/browser/ui/webui/signin/user_manager_ui_browsertest.cc b/chrome/browser/ui/webui/signin/user_manager_ui_browsertest.cc
index 2af1ae5..3f32dcc 100644
--- a/chrome/browser/ui/webui/signin/user_manager_ui_browsertest.cc
+++ b/chrome/browser/ui/webui/signin/user_manager_ui_browsertest.cc
@@ -143,7 +143,6 @@
 
 IN_PROC_BROWSER_TEST_F(UserManagerUIAuthenticatedUserBrowserTest, Reauth) {
   Init();
-  signin_util::SetForceSigninForTesting(true);
   entry_->SetLocalAuthCredentials("1mock_credentials");
 
   LaunchAuthenticatedUser("email@mock.com");
diff --git a/chrome/browser/usb/OWNERS b/chrome/browser/usb/OWNERS
index 712df36dd..0b2d5cb 100644
--- a/chrome/browser/usb/OWNERS
+++ b/chrome/browser/usb/OWNERS
@@ -1,5 +1,5 @@
 juncai@chromium.org
 reillyg@chromium.org
-rockot@chromium.org
+rockot@google.com
 
 # COMPONENT: Blink>USB
\ No newline at end of file
diff --git a/chrome/chrome_cleaner/constants/chrome_cleaner_switches.cc b/chrome/chrome_cleaner/constants/chrome_cleaner_switches.cc
index d9d5b19..c61c91d 100644
--- a/chrome/chrome_cleaner/constants/chrome_cleaner_switches.cc
+++ b/chrome/chrome_cleaner/constants/chrome_cleaner_switches.cc
@@ -10,6 +10,8 @@
 
 // Set the timeout for the cleaning phase, in minutes. 0 disables the timeout
 // entirely.
+// WARNING: this switch is used by internal test systems. Be careful when making
+// changes.
 const char kCleaningTimeoutMinutesSwitch[] = "cleaning-timeout";
 
 // Identifier used to group all reports generated during the same run of the
@@ -130,6 +132,8 @@
 
 // Set the timeout for the scanning phase, in minutes. 0 disables the timeout
 // entirely.
+// WARNING: this switch is used by internal test systems. Be careful when making
+// changes.
 const char kScanningTimeoutMinutesSwitch[] = "scanning-timeout";
 
 // Set a test logging URL, where logs will be uploaded.
diff --git a/chrome/common/chrome_switches.cc b/chrome/common/chrome_switches.cc
index 8a4b4b4..7c22b38 100644
--- a/chrome/common/chrome_switches.cc
+++ b/chrome/common/chrome_switches.cc
@@ -783,8 +783,8 @@
 // Forces the update menu badge to show.
 const char kForceShowUpdateMenuBadge[] = "force-show-update-menu-badge";
 
-// Forces the update menu type to a specific type.
-const char kForceUpdateMenuType[] = "force-update-menu-type";
+// Forces the update menu item to show.
+const char kForceShowUpdateMenuItem[] = "force-show-update-menu-item";
 
 // Forces a custom summary to be displayed below the update menu item.
 const char kForceShowUpdateMenuItemCustomSummary[] = "custom_summary";
diff --git a/chrome/common/chrome_switches.h b/chrome/common/chrome_switches.h
index f724e53..77929830 100644
--- a/chrome/common/chrome_switches.h
+++ b/chrome/common/chrome_switches.h
@@ -231,8 +231,8 @@
 extern const char kEnableContextualSearch[];
 extern const char kEnableHungRendererInfoBar[];
 extern const char kForceShowUpdateMenuBadge[];
+extern const char kForceShowUpdateMenuItem[];
 extern const char kForceShowUpdateMenuItemCustomSummary[];
-extern const char kForceUpdateMenuType[];
 extern const char kMarketUrlForTesting[];
 extern const char kProgressBarAnimation[];
 extern const char kTrustedCDNBaseURLForTests[];
diff --git a/chrome/common/extensions/docs/OWNERS b/chrome/common/extensions/docs/OWNERS
index c51025e..4687f8e8d 100644
--- a/chrome/common/extensions/docs/OWNERS
+++ b/chrome/common/extensions/docs/OWNERS
@@ -9,4 +9,4 @@
 pbakaus@chromium.org
 
 # For server related things (Python, JavaScript, templates, etc).
-rockot@chromium.org
+rockot@google.com
diff --git a/chrome/common/extensions/docs/server2/OWNERS b/chrome/common/extensions/docs/server2/OWNERS
index e601596d..4d70ad9 100644
--- a/chrome/common/extensions/docs/server2/OWNERS
+++ b/chrome/common/extensions/docs/server2/OWNERS
@@ -1,6 +1,6 @@
 lazyboy@chromium.org
 rdevlin.cronin@chromium.org
-rockot@chromium.org
+rockot@google.com
 
 # Modifying app.yaml needs a corresponding push of the new version to AppEngine.
 per-file app.yaml=set noparent
diff --git a/chrome/common/extensions/manifest_tests/permissions_parser_unittest.cc b/chrome/common/extensions/manifest_tests/permissions_parser_unittest.cc
index d2ba1f8..ef3a58a 100644
--- a/chrome/common/extensions/manifest_tests/permissions_parser_unittest.cc
+++ b/chrome/common/extensions/manifest_tests/permissions_parser_unittest.cc
@@ -15,7 +15,7 @@
 
 TEST_F(PermissionsParserTest, RemoveOverlappingAPIPermissions) {
   scoped_refptr<Extension> extension(LoadAndExpectWarning(
-      "permissions_parser_overlapping_permissions.json",
+      "permissions_overlapping_api_permissions.json",
       ErrorUtils::FormatErrorMessage(
           manifest_errors::kPermissionMarkedOptionalAndRequired, "tabs")));
 
@@ -34,4 +34,67 @@
   EXPECT_THAT(optional_api_names, testing::UnorderedElementsAre("geolocation"));
 }
 
+TEST_F(PermissionsParserTest, RemoveOverlappingHostPermissions) {
+  scoped_refptr<Extension> extension(LoadAndExpectWarning(
+      "permissions_overlapping_host_permissions.json",
+      ErrorUtils::FormatErrorMessage(
+          manifest_errors::kPermissionMarkedOptionalAndRequired,
+          "https://google.com/*")));
+
+  const URLPatternSet& required_hosts =
+      PermissionsParser::GetRequiredPermissions(extension.get())
+          .explicit_hosts();
+
+  const URLPatternSet& optional_hosts =
+      PermissionsParser::GetOptionalPermissions(extension.get())
+          .explicit_hosts();
+
+  // Check that required hosts have not changed at all while
+  // "https://google.com/maps" is removed from optional hosts as it is a strict
+  // subset of hosts specified as required.
+  EXPECT_THAT(*required_hosts.ToStringVector(),
+              testing::UnorderedElementsAre("https://example.com/*",
+                                            "https://*.google.com/*"));
+  EXPECT_THAT(*optional_hosts.ToStringVector(),
+              testing::UnorderedElementsAre("*://chromium.org/*"));
+}
+
+TEST_F(PermissionsParserTest, RequiredHostPermissionsAllURLs) {
+  scoped_refptr<Extension> extension(LoadAndExpectWarning(
+      "permissions_all_urls_host_permissions.json",
+      ErrorUtils::FormatErrorMessage(
+          manifest_errors::kPermissionMarkedOptionalAndRequired,
+          "http://*/*")));
+
+  const URLPatternSet& optional_hosts =
+      PermissionsParser::GetOptionalPermissions(extension.get())
+          .explicit_hosts();
+
+  // Since we specified <all_urls> as a required host permission,
+  // there should be no optional host permissions.
+  EXPECT_THAT(*optional_hosts.ToStringVector(), testing::IsEmpty());
+}
+
+TEST_F(PermissionsParserTest, OptionalHostPermissionsAllURLs) {
+  scoped_refptr<Extension> extension(
+      LoadAndExpectSuccess("permissions_optional_all_urls_permissions.json"));
+
+  const URLPatternSet& required_hosts =
+      PermissionsParser::GetRequiredPermissions(extension.get())
+          .explicit_hosts();
+
+  const URLPatternSet& optional_hosts =
+      PermissionsParser::GetOptionalPermissions(extension.get())
+          .explicit_hosts();
+
+  // This time, required permissions are a subset of optional permissions
+  // so we make sure that permissions remain the same
+  // as what's specified in the manifest.
+  EXPECT_THAT(*required_hosts.ToStringVector(),
+              testing::UnorderedElementsAre("https://*.google.com/*"));
+
+  EXPECT_THAT(*optional_hosts.ToStringVector(),
+              testing::UnorderedElementsAre("*://*/*"));
+}
+
 }  // namespace extensions
diff --git a/chrome/docs/OWNERS b/chrome/docs/OWNERS
index d87e1f00..b1804300 100644
--- a/chrome/docs/OWNERS
+++ b/chrome/docs/OWNERS
@@ -7,4 +7,4 @@
 
 # For server related things (Python, JavaScript, templates, etc).
 mangini@chromium.org
-rockot@chromium.org
+rockot@google.com
diff --git a/chrome/services/OWNERS b/chrome/services/OWNERS
index 92c84d9e..16d9656f 100644
--- a/chrome/services/OWNERS
+++ b/chrome/services/OWNERS
@@ -1,2 +1,2 @@
 jcivelli@chromium.org
-rockot@chromium.org
+rockot@google.com
diff --git a/chrome/test/base/in_process_browser_test.h b/chrome/test/base/in_process_browser_test.h
index e7464399..bb17390 100644
--- a/chrome/test/base/in_process_browser_test.h
+++ b/chrome/test/base/in_process_browser_test.h
@@ -97,8 +97,6 @@
 // By default a single Browser is created in BrowserMain(). You can obviously
 // create more as needed.
 
-// InProcessBrowserTest disables the sandbox when running.
-//
 // See ui_test_utils for a handful of methods designed for use with this class.
 //
 // It's possible to write browser tests that span a restart by splitting each
diff --git a/chrome/test/data/extensions/manifest_tests/permissions_all_urls_host_permissions.json b/chrome/test/data/extensions/manifest_tests/permissions_all_urls_host_permissions.json
new file mode 100644
index 0000000..f7e6a98
--- /dev/null
+++ b/chrome/test/data/extensions/manifest_tests/permissions_all_urls_host_permissions.json
@@ -0,0 +1,12 @@
+{
+  "name": "All urls required in permissions",
+  "version": "0.0.1.33",
+  "manifest_version": 2,
+  "description": "Extension with <all_urls> defined as a required permission",
+  "permissions": [
+    "<all_urls>"
+  ],
+  "optional_permissions": [
+    "http://*/*"
+  ]
+}
diff --git a/chrome/test/data/extensions/manifest_tests/permissions_optional_all_urls_permissions.json b/chrome/test/data/extensions/manifest_tests/permissions_optional_all_urls_permissions.json
new file mode 100644
index 0000000..5da60d9d
--- /dev/null
+++ b/chrome/test/data/extensions/manifest_tests/permissions_optional_all_urls_permissions.json
@@ -0,0 +1,12 @@
+{
+  "name": "All urls required in permissions",
+  "version": "0.0.1.33",
+  "manifest_version": 2,
+  "description": "Extension with <all_urls> defined as an optional permission",
+  "permissions": [
+    "https://*.google.com/*"
+  ],
+  "optional_permissions": [
+    "*://*/*"
+  ]
+}
diff --git a/chrome/test/data/extensions/manifest_tests/permissions_parser_overlapping_permissions.json b/chrome/test/data/extensions/manifest_tests/permissions_overlapping_api_permissions.json
similarity index 92%
rename from chrome/test/data/extensions/manifest_tests/permissions_parser_overlapping_permissions.json
rename to chrome/test/data/extensions/manifest_tests/permissions_overlapping_api_permissions.json
index 65c4fd7..ce474a75 100644
--- a/chrome/test/data/extensions/manifest_tests/permissions_parser_overlapping_permissions.json
+++ b/chrome/test/data/extensions/manifest_tests/permissions_overlapping_api_permissions.json
@@ -2,7 +2,7 @@
   "name": "Tabs both required and optional",
   "version": "0.0.1.33",
   "manifest_version": 2,
-  "description": "Extension with overlapping required and optional permissions",
+  "description": "Extension with overlapping required and optional API permissions",
   "permissions": [
     "tabs",
     "storage"
diff --git a/chrome/test/data/extensions/manifest_tests/permissions_overlapping_host_permissions.json b/chrome/test/data/extensions/manifest_tests/permissions_overlapping_host_permissions.json
new file mode 100644
index 0000000..7ba6a205e
--- /dev/null
+++ b/chrome/test/data/extensions/manifest_tests/permissions_overlapping_host_permissions.json
@@ -0,0 +1,14 @@
+{
+  "name": "Redundant extension with optional google maps host permission",
+  "version": "0.0.1.33",
+  "manifest_version": 2,
+  "description": "Extension with overlapping required and optional host permissions",
+  "permissions": [
+    "https://example.com/*",
+    "https://*.google.com/*"
+  ],
+  "optional_permissions": [
+    "https://google.com/maps",
+    "*://chromium.org/*"
+  ]
+}
diff --git a/chrome/test/data/policy/policy_test_cases.json b/chrome/test/data/policy/policy_test_cases.json
index 30876a0..57120bb 100644
--- a/chrome/test/data/policy/policy_test_cases.json
+++ b/chrome/test/data/policy/policy_test_cases.json
@@ -3402,6 +3402,19 @@
       { "pref": "network_file_shares.preconfigured_shares" }
     ]
   },
+  "ScreenBrightnessPercent": {
+    "os": ["chromeos"],
+    "test_policy": {
+      "ScreenBrightnessPercent": {
+        "BrightnessAC": 100,
+        "BrightnessBattery": 90
+      }
+    },
+    "pref_mappings": [
+      { "pref": "power.ac_screen_brightness_percent" },
+      { "pref": "power.battery_screen_brightness_percent" }
+    ]
+  },
 
   "----- Chrome OS device policies ---------------------------------------": {},
 
diff --git a/chromecast/browser/android/apk/AndroidManifest.xml.jinja2 b/chromecast/browser/android/apk/AndroidManifest.xml.jinja2
index 696ece1..ab9cce1 100644
--- a/chromecast/browser/android/apk/AndroidManifest.xml.jinja2
+++ b/chromecast/browser/android/apk/AndroidManifest.xml.jinja2
@@ -46,7 +46,7 @@
                  android:exported="false" />
         {% endfor %}
 
-        {% set num_privileged_services = 3 %}
+        {% set num_privileged_services = 5 %}
         <meta-data android:name="org.chromium.content.browser.NUM_PRIVILEGED_SERVICES"
                    android:value="{{ num_privileged_services }}"/>
 
diff --git a/chromeos/chromeos_switches.cc b/chromeos/chromeos_switches.cc
index 2602fac1..1b2f4fc 100644
--- a/chromeos/chromeos_switches.cc
+++ b/chromeos/chromeos_switches.cc
@@ -326,6 +326,9 @@
 // Touchscreen-specific interactions of the Files app.
 const char kEnableFileManagerTouchMode[] = "enable-file-manager-touch-mode";
 
+// Enabled Discover app.
+const char kEnableDiscoverApp[] = "enable-discover-app";
+
 // Enables animated transitions during first-run tutorial.
 const char kEnableFirstRunUITransitions[] = "enable-first-run-ui-transitions";
 
diff --git a/chromeos/chromeos_switches.h b/chromeos/chromeos_switches.h
index 72d39c20..f809825 100644
--- a/chromeos/chromeos_switches.h
+++ b/chromeos/chromeos_switches.h
@@ -92,6 +92,7 @@
 CHROMEOS_EXPORT extern const char kEnableChromevoxDeveloperOption[];
 CHROMEOS_EXPORT extern const char kEnableConsumerKiosk[];
 CHROMEOS_EXPORT extern const char kEnableDataSaverPrompt[];
+CHROMEOS_EXPORT extern const char kEnableDiscoverApp[];
 CHROMEOS_EXPORT extern const char kEnableEncryptionMigration[];
 CHROMEOS_EXPORT extern const char kEnableExperimentalAccessibilityFeatures[];
 CHROMEOS_EXPORT extern const char kEnableExtensionAssetsSharing[];
diff --git a/chromeos/dbus/fake_shill_manager_client.cc b/chromeos/dbus/fake_shill_manager_client.cc
index 53ba421..6a62dcf 100644
--- a/chromeos/dbus/fake_shill_manager_client.cc
+++ b/chromeos/dbus/fake_shill_manager_client.cc
@@ -353,32 +353,6 @@
       FROM_HERE, base::BindOnce(callback, dbus::ObjectPath()));
 }
 
-void FakeShillManagerClient::VerifyDestination(
-    const VerificationProperties& properties,
-    const BooleanCallback& callback,
-    const ErrorCallback& error_callback) {
-  base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE,
-                                                base::BindOnce(callback, true));
-}
-
-void FakeShillManagerClient::VerifyAndEncryptCredentials(
-    const VerificationProperties& properties,
-    const std::string& service_path,
-    const StringCallback& callback,
-    const ErrorCallback& error_callback) {
-  base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, base::BindOnce(callback, "encrypted_credentials"));
-}
-
-void FakeShillManagerClient::VerifyAndEncryptData(
-    const VerificationProperties& properties,
-    const std::string& data,
-    const StringCallback& callback,
-    const ErrorCallback& error_callback) {
-  base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, base::BindOnce(callback, "encrypted_data"));
-}
-
 void FakeShillManagerClient::ConnectToBestServices(
     const base::Closure& callback,
     const ErrorCallback& error_callback) {
diff --git a/chromeos/dbus/fake_shill_manager_client.h b/chromeos/dbus/fake_shill_manager_client.h
index 3647fb8..62f94cc 100644
--- a/chromeos/dbus/fake_shill_manager_client.h
+++ b/chromeos/dbus/fake_shill_manager_client.h
@@ -59,18 +59,6 @@
   void GetService(const base::DictionaryValue& properties,
                   const ObjectPathCallback& callback,
                   const ErrorCallback& error_callback) override;
-  void VerifyDestination(const VerificationProperties& properties,
-                         const BooleanCallback& callback,
-                         const ErrorCallback& error_callback) override;
-  void VerifyAndEncryptCredentials(
-      const VerificationProperties& properties,
-      const std::string& service_path,
-      const StringCallback& callback,
-      const ErrorCallback& error_callback) override;
-  void VerifyAndEncryptData(const VerificationProperties& properties,
-                            const std::string& data,
-                            const StringCallback& callback,
-                            const ErrorCallback& error_callback) override;
   void ConnectToBestServices(const base::Closure& callback,
                              const ErrorCallback& error_callback) override;
   void SetNetworkThrottlingStatus(const NetworkThrottlingStatus& status,
diff --git a/chromeos/dbus/shill_manager_client.cc b/chromeos/dbus/shill_manager_client.cc
index 05c58c6..518bfc8 100644
--- a/chromeos/dbus/shill_manager_client.cc
+++ b/chromeos/dbus/shill_manager_client.cc
@@ -156,62 +156,6 @@
                                                   error_callback);
   }
 
-  void VerifyDestination(const VerificationProperties& properties,
-                         const BooleanCallback& callback,
-                         const ErrorCallback& error_callback) override {
-    dbus::MethodCall method_call(shill::kFlimflamManagerInterface,
-                                 shill::kVerifyDestinationFunction);
-    dbus::MessageWriter writer(&method_call);
-    writer.AppendString(properties.certificate);
-    writer.AppendString(properties.public_key);
-    writer.AppendString(properties.nonce);
-    writer.AppendString(properties.signed_data);
-    writer.AppendString(properties.device_serial);
-    writer.AppendString(properties.device_ssid);
-    writer.AppendString(properties.device_bssid);
-    helper_->CallBooleanMethodWithErrorCallback(
-        &method_call, callback, error_callback);
-  }
-
-  void VerifyAndEncryptCredentials(
-      const VerificationProperties& properties,
-      const std::string& service_path,
-      const StringCallback& callback,
-      const ErrorCallback& error_callback) override {
-    dbus::MethodCall method_call(shill::kFlimflamManagerInterface,
-                                 shill::kVerifyAndEncryptCredentialsFunction);
-    dbus::MessageWriter writer(&method_call);
-    writer.AppendString(properties.certificate);
-    writer.AppendString(properties.public_key);
-    writer.AppendString(properties.nonce);
-    writer.AppendString(properties.signed_data);
-    writer.AppendString(properties.device_serial);
-    writer.AppendString(properties.device_ssid);
-    writer.AppendString(properties.device_bssid);
-    writer.AppendObjectPath(dbus::ObjectPath(service_path));
-    helper_->CallStringMethodWithErrorCallback(
-        &method_call, callback, error_callback);
-  }
-
-  void VerifyAndEncryptData(const VerificationProperties& properties,
-                            const std::string& data,
-                            const StringCallback& callback,
-                            const ErrorCallback& error_callback) override {
-    dbus::MethodCall method_call(shill::kFlimflamManagerInterface,
-                                 shill::kVerifyAndEncryptDataFunction);
-    dbus::MessageWriter writer(&method_call);
-    writer.AppendString(properties.certificate);
-    writer.AppendString(properties.public_key);
-    writer.AppendString(properties.nonce);
-    writer.AppendString(properties.signed_data);
-    writer.AppendString(properties.device_serial);
-    writer.AppendString(properties.device_ssid);
-    writer.AppendString(properties.device_bssid);
-    writer.AppendString(data);
-    helper_->CallStringMethodWithErrorCallback(
-        &method_call, callback, error_callback);
-  }
-
   void ConnectToBestServices(const base::Closure& callback,
                              const ErrorCallback& error_callback) override {
     dbus::MethodCall method_call(shill::kFlimflamManagerInterface,
@@ -249,9 +193,4 @@
   return new ShillManagerClientImpl();
 }
 
-// ShillManagerClient::VerificationProperties implementation.
-ShillManagerClient::VerificationProperties::VerificationProperties() = default;
-
-ShillManagerClient::VerificationProperties::~VerificationProperties() = default;
-
 }  // namespace chromeos
diff --git a/chromeos/dbus/shill_manager_client.h b/chromeos/dbus/shill_manager_client.h
index b133838..8f0bddc 100644
--- a/chromeos/dbus/shill_manager_client.h
+++ b/chromeos/dbus/shill_manager_client.h
@@ -29,8 +29,6 @@
   typedef ShillClientHelper::PropertyChangedHandler PropertyChangedHandler;
   typedef ShillClientHelper::DictionaryValueCallback DictionaryValueCallback;
   typedef ShillClientHelper::ErrorCallback ErrorCallback;
-  typedef ShillClientHelper::StringCallback StringCallback;
-  typedef ShillClientHelper::BooleanCallback BooleanCallback;
 
   struct NetworkThrottlingStatus {
     // Enable or disable network bandwidth throttling.
@@ -106,38 +104,6 @@
     virtual ~TestInterface() {}
   };
 
-  // Properties used to verify the origin device.
-  struct VerificationProperties {
-    VerificationProperties();
-    ~VerificationProperties();
-
-    // A string containing a PEM-encoded X.509 certificate for use in verifying
-    // the signed data.
-    std::string certificate;
-
-    // A string containing a PEM-encoded RSA public key to be used to compare
-    // with the one in signedData
-    std::string public_key;
-
-    // A string containing a base64-encoded random binary data for use in
-    // verifying the signed data.
-    std::string nonce;
-
-    // A string containing the identifying data string signed by the device.
-    std::string signed_data;
-
-    // A string containing the serial number of the device.
-    std::string device_serial;
-
-    // A string containing the SSID of the device. Only set if the device has
-    // already been setup once.
-    std::string device_ssid;
-
-    // A string containing the BSSID of the device. Only set if the device has
-    // already been setup.
-    std::string device_bssid;
-  };
-
   ~ShillManagerClient() override;
 
   // Factory function, creates a new instance which is owned by the caller.
@@ -206,30 +172,6 @@
                           const ObjectPathCallback& callback,
                           const ErrorCallback& error_callback) = 0;
 
-  // Verifies that the given data corresponds to a trusted device, and returns
-  // true to the callback if it is.
-  virtual void VerifyDestination(const VerificationProperties& properties,
-                                 const BooleanCallback& callback,
-                                 const ErrorCallback& error_callback) = 0;
-
-  // Verifies that the given data corresponds to a trusted device, and if it is,
-  // returns the encrypted credentials for connecting to the network represented
-  // by the given |service_path|, encrypted using the |public_key| for the
-  // trusted device. If the device is not trusted, returns the empty string.
-  virtual void VerifyAndEncryptCredentials(
-      const VerificationProperties& properties,
-      const std::string& service_path,
-      const StringCallback& callback,
-      const ErrorCallback& error_callback) = 0;
-
-  // Verifies that the given data corresponds to a trusted device, and returns
-  // the |data| encrypted using the |public_key| for the trusted device. If the
-  // device is not trusted, returns the empty string.
-  virtual void VerifyAndEncryptData(const VerificationProperties& properties,
-                                    const std::string& data,
-                                    const StringCallback& callback,
-                                    const ErrorCallback& error_callback) = 0;
-
   // For each technology present, connects to the "best" service available.
   // Called once the user is logged in and certificates are loaded.
   virtual void ConnectToBestServices(const base::Closure& callback,
diff --git a/chromeos/dbus/shill_manager_client_unittest.cc b/chromeos/dbus/shill_manager_client_unittest.cc
index b709d28..38fd5f1 100644
--- a/chromeos/dbus/shill_manager_client_unittest.cc
+++ b/chromeos/dbus/shill_manager_client_unittest.cc
@@ -26,33 +26,6 @@
 
 namespace {
 
-void ExpectStringArguments(const std::vector<std::string>& arguments,
-                           dbus::MessageReader* reader) {
-  for (std::vector<std::string>::const_iterator iter = arguments.begin();
-       iter != arguments.end(); ++iter) {
-    std::string arg_string;
-    ASSERT_TRUE(reader->PopString(&arg_string));
-    EXPECT_EQ(*iter, arg_string);
-  }
-  EXPECT_FALSE(reader->HasMoreData());
-}
-
-void ExpectStringArgumentsFollowedByObjectPath(
-      const std::vector<std::string>& arguments,
-      const dbus::ObjectPath& object_path,
-      dbus::MessageReader* reader) {
-  for (std::vector<std::string>::const_iterator iter = arguments.begin();
-       iter != arguments.end(); ++iter) {
-    std::string arg_string;
-    ASSERT_TRUE(reader->PopString(&arg_string));
-    EXPECT_EQ(*iter, arg_string);
-  }
-  dbus::ObjectPath path;
-  ASSERT_TRUE(reader->PopObjectPath(&path));
-  EXPECT_EQ(object_path, path);
-  EXPECT_FALSE(reader->HasMoreData());
-}
-
 void ExpectThrottlingArguments(bool throttling_enabled_expected,
                                uint32_t upload_rate_kbits_expected,
                                uint32_t download_rate_kbits_expected,
@@ -354,125 +327,4 @@
   base::RunLoop().RunUntilIdle();
 }
 
-TEST_F(ShillManagerClientTest, VerifyDestination) {
-  // Create response.
-  std::unique_ptr<dbus::Response> response(dbus::Response::CreateEmpty());
-  dbus::MessageWriter writer(response.get());
-  bool expected = true;
-  writer.AppendBool(expected);
-  // Set expectations.
-  std::vector<std::string> arguments;
-  arguments.push_back("certificate");
-  arguments.push_back("public_key");
-  arguments.push_back("nonce");
-  arguments.push_back("signed_data");
-  arguments.push_back("device_serial");
-  arguments.push_back("device_ssid");
-  arguments.push_back("device_bssid");
-  PrepareForMethodCall(shill::kVerifyDestinationFunction,
-                       base::Bind(&ExpectStringArguments, arguments),
-                       response.get());
-
-  // Call method.
-  base::MockCallback<ShillManagerClient::ErrorCallback> mock_error_callback;
-  ShillManagerClient::VerificationProperties properties;
-  properties.certificate = arguments[0];
-  properties.public_key = arguments[1];
-  properties.nonce = arguments[2];
-  properties.signed_data = arguments[3];
-  properties.device_serial = arguments[4];
-  properties.device_ssid = arguments[5];
-  properties.device_bssid = arguments[6];
-  client_->VerifyDestination(
-      properties, base::Bind(&ExpectBoolResultWithoutStatus, expected),
-      mock_error_callback.Get());
-  EXPECT_CALL(mock_error_callback, Run(_, _)).Times(0);
-
-  // Run the message loop.
-  base::RunLoop().RunUntilIdle();
-}
-
-TEST_F(ShillManagerClientTest, VerifyAndEncryptCredentials) {
-  // Create response.
-  std::unique_ptr<dbus::Response> response(dbus::Response::CreateEmpty());
-  dbus::MessageWriter writer(response.get());
-  std::string expected = "encrypted_credentials";
-  writer.AppendString(expected);
-  // Set expectations.
-  std::vector<std::string> arguments;
-  arguments.push_back("certificate");
-  arguments.push_back("public_key");
-  arguments.push_back("nonce");
-  arguments.push_back("signed_data");
-  arguments.push_back("device_serial");
-  arguments.push_back("device_ssid");
-  arguments.push_back("device_bssid");
-  std::string service_path = "/";
-  dbus::ObjectPath service_path_obj(service_path);
-  PrepareForMethodCall(shill::kVerifyAndEncryptCredentialsFunction,
-                       base::Bind(&ExpectStringArgumentsFollowedByObjectPath,
-                                  arguments,
-                                  service_path_obj),
-                       response.get());
-
-  // Call method.
-  base::MockCallback<ShillManagerClient::ErrorCallback> mock_error_callback;
-  ShillManagerClient::VerificationProperties properties;
-  properties.certificate = arguments[0];
-  properties.public_key = arguments[1];
-  properties.nonce = arguments[2];
-  properties.signed_data = arguments[3];
-  properties.device_serial = arguments[4];
-  properties.device_ssid = arguments[5];
-  properties.device_bssid = arguments[6];
-  client_->VerifyAndEncryptCredentials(
-      properties, service_path,
-      base::Bind(&ExpectStringResultWithoutStatus, expected),
-      mock_error_callback.Get());
-  EXPECT_CALL(mock_error_callback, Run(_, _)).Times(0);
-
-  // Run the message loop.
-  base::RunLoop().RunUntilIdle();
-}
-
-TEST_F(ShillManagerClientTest, VerifyAndEncryptData) {
-  // Create response.
-  std::unique_ptr<dbus::Response> response(dbus::Response::CreateEmpty());
-  dbus::MessageWriter writer(response.get());
-  std::string expected = "encrypted_data";
-  writer.AppendString(expected);
-  // Set expectations.
-  std::vector<std::string> arguments;
-  arguments.push_back("certificate");
-  arguments.push_back("public_key");
-  arguments.push_back("nonce");
-  arguments.push_back("signed_data");
-  arguments.push_back("device_serial");
-  arguments.push_back("device_ssid");
-  arguments.push_back("device_bssid");
-  arguments.push_back("data");
-  PrepareForMethodCall(shill::kVerifyAndEncryptDataFunction,
-                       base::Bind(&ExpectStringArguments, arguments),
-                       response.get());
-
-  // Call method.
-  base::MockCallback<ShillManagerClient::ErrorCallback> mock_error_callback;
-  ShillManagerClient::VerificationProperties properties;
-  properties.certificate = arguments[0];
-  properties.public_key = arguments[1];
-  properties.nonce = arguments[2];
-  properties.signed_data = arguments[3];
-  properties.device_serial = arguments[4];
-  properties.device_ssid = arguments[5];
-  properties.device_bssid = arguments[6];
-  client_->VerifyAndEncryptData(
-      properties, arguments[7],
-      base::Bind(&ExpectStringResultWithoutStatus, expected),
-      mock_error_callback.Get());
-  EXPECT_CALL(mock_error_callback, Run(_, _)).Times(0);
-
-  // Run the message loop.
-  base::RunLoop().RunUntilIdle();
-}
-
 }  // namespace chromeos
diff --git a/components/arc/common/bluetooth.mojom b/components/arc/common/bluetooth.mojom
index df853231..4a9250e 100644
--- a/components/arc/common/bluetooth.mojom
+++ b/components/arc/common/bluetooth.mojom
@@ -293,6 +293,7 @@
 };
 
 // Next Method ID: 45
+// Deprecated method ID: 20, 21
 interface BluetoothHost {
   EnableAdapter@0() => (BluetoothAdapterState state);
   DisableAdapter@1() => (BluetoothAdapterState state);
@@ -320,8 +321,6 @@
   [MinVersion=1] DisconnectLEDevice@17(BluetoothAddress remote_addr);
   [MinVersion=1] SearchService@18(BluetoothAddress remote_addr);
   [MinVersion=1] GetGattDB@19(BluetoothAddress remote_addr);
-  [MinVersion=1] StartLEListen@20() => (BluetoothGattStatus status);
-  [MinVersion=1] StopLEListen@21() => (BluetoothGattStatus status);
   [MinVersion=1] ReadGattCharacteristic@22(BluetoothAddress remote_addr,
                                            BluetoothGattServiceID service_id,
                                            BluetoothGattID char_id)
diff --git a/components/autofill/core/browser/BUILD.gn b/components/autofill/core/browser/BUILD.gn
index 5359fc93..207127f 100644
--- a/components/autofill/core/browser/BUILD.gn
+++ b/components/autofill/core/browser/BUILD.gn
@@ -577,6 +577,7 @@
     "form_structure_fuzzer.cc",
   ]
   deps = [
+    # TODO(crbug.com/896313): Reduce the dependency on "browser".
     ":browser",
     "//base:base",
     "//components/autofill/core/common:common",
@@ -600,6 +601,7 @@
       "form_structure_process_query_response_fuzzer.cc",
     ]
     deps = [
+      # TODO(crbug.com/896313): Reduce the dependency on "browser".
       ":browser",
       "//base:base",
       "//components/autofill/core/browser/proto",
@@ -619,3 +621,19 @@
     ]
   }
 }
+
+fuzzer_test("autofill_phone_number_i18n_fuzzer") {
+  sources = [
+    "phone_number_i18n_fuzzer.cc",
+  ]
+
+  deps = [
+    # TODO(crbug.com/896313): Reduce the dependency on "browser".
+    ":browser",
+    "//base",
+    "//base:i18n",
+    "//third_party/libphonenumber",
+  ]
+
+  dict = "phone_number_i18n_fuzzer.dict"
+}
diff --git a/components/autofill/core/browser/autofill_experiments.cc b/components/autofill/core/browser/autofill_experiments.cc
index 4ca0292a..3d93a20 100644
--- a/components/autofill/core/browser/autofill_experiments.cc
+++ b/components/autofill/core/browser/autofill_experiments.cc
@@ -75,11 +75,9 @@
   }
 
   // Check if the upload to Google state is active.
-  if (!base::FeatureList::IsEnabled(
-          features::kAutofillEnablePaymentsInteractionsOnAuthError) &&
-      syncer::GetUploadToGoogleState(sync_service,
+  if (syncer::GetUploadToGoogleState(sync_service,
                                      syncer::ModelType::AUTOFILL_WALLET_DATA) !=
-          syncer::UploadState::ACTIVE) {
+      syncer::UploadState::ACTIVE) {
     return false;
   }
 
diff --git a/components/autofill/core/browser/autofill_save_card_infobar_delegate_mobile.cc b/components/autofill/core/browser/autofill_save_card_infobar_delegate_mobile.cc
index 63510585..dc67ab8 100644
--- a/components/autofill/core/browser/autofill_save_card_infobar_delegate_mobile.cc
+++ b/components/autofill/core/browser/autofill_save_card_infobar_delegate_mobile.cc
@@ -12,6 +12,7 @@
 #include "components/autofill/core/browser/autofill_experiments.h"
 #include "components/autofill/core/browser/credit_card.h"
 #include "components/autofill/core/browser/legal_message_line.h"
+#include "components/autofill/core/browser/strike_database.h"
 #include "components/autofill/core/common/autofill_constants.h"
 #include "components/autofill/core/common/autofill_features.h"
 #include "components/autofill/core/common/autofill_prefs.h"
@@ -30,6 +31,7 @@
     bool upload,
     const CreditCard& card,
     std::unique_ptr<base::DictionaryValue> legal_message,
+    StrikeDatabase* strike_database,
     base::OnceCallback<void(const base::string16&)> upload_save_card_callback,
     base::OnceClosure local_save_card_callback,
     PrefService* pref_service)
@@ -38,12 +40,13 @@
       upload_save_card_callback_(std::move(upload_save_card_callback)),
       local_save_card_callback_(std::move(local_save_card_callback)),
       pref_service_(pref_service),
+      strike_database_(strike_database),
       had_user_interaction_(false),
       issuer_icon_id_(CreditCard::IconResourceId(card.network())),
       card_label_(card.NetworkAndLastFourDigits()),
       card_sub_label_(card.AbbreviatedExpirationDateForDisplay(
-          !features::
-              IsAutofillSaveCardDialogUnlabeledExpirationDateEnabled())) {
+          !features::IsAutofillSaveCardDialogUnlabeledExpirationDateEnabled())),
+      card_last_four_digits_(card.LastFourDigits()) {
   if (upload) {
     DCHECK(!upload_save_card_callback_.is_null());
     DCHECK(local_save_card_callback_.is_null());
@@ -70,8 +73,18 @@
 
 AutofillSaveCardInfoBarDelegateMobile::
     ~AutofillSaveCardInfoBarDelegateMobile() {
-  if (!had_user_interaction_)
+  if (!had_user_interaction_) {
     LogUserAction(AutofillMetrics::INFOBAR_IGNORED);
+    if (base::FeatureList::IsEnabled(
+            features::kAutofillSaveCreditCardUsesStrikeSystem)) {
+      // If the infobar was ignored, count that as a strike against offering
+      // save in the future.
+      strike_database_->AddStrike(
+          strike_database_->GetKeyForCreditCardSave(
+              base::UTF16ToUTF8(card_last_four_digits_)),
+          base::DoNothing());
+    }
+  }
 }
 
 void AutofillSaveCardInfoBarDelegateMobile::OnLegalMessageLinkClicked(
@@ -135,6 +148,14 @@
 
 void AutofillSaveCardInfoBarDelegateMobile::InfoBarDismissed() {
   LogUserAction(AutofillMetrics::INFOBAR_DENIED);
+  if (base::FeatureList::IsEnabled(
+          features::kAutofillSaveCreditCardUsesStrikeSystem)) {
+    // If the infobar was explicitly denied, count that as a strike against
+    // offering save in the future.
+    strike_database_->AddStrike(strike_database_->GetKeyForCreditCardSave(
+                                    base::UTF16ToUTF8(card_last_four_digits_)),
+                                base::DoNothing());
+  }
 }
 
 int AutofillSaveCardInfoBarDelegateMobile::GetButtons() const {
diff --git a/components/autofill/core/browser/autofill_save_card_infobar_delegate_mobile.h b/components/autofill/core/browser/autofill_save_card_infobar_delegate_mobile.h
index 0b61d2df..27d7e01 100644
--- a/components/autofill/core/browser/autofill_save_card_infobar_delegate_mobile.h
+++ b/components/autofill/core/browser/autofill_save_card_infobar_delegate_mobile.h
@@ -23,6 +23,7 @@
 namespace autofill {
 
 class CreditCard;
+class StrikeDatabase;
 
 // An InfoBarDelegate that enables the user to allow or deny storing credit
 // card information gathered from a form submission. Only used on mobile.
@@ -32,6 +33,7 @@
       bool upload,
       const CreditCard& card,
       std::unique_ptr<base::DictionaryValue> legal_message,
+      StrikeDatabase* strike_database,
       base::OnceCallback<void(const base::string16&)> upload_save_card_callback,
       base::OnceClosure local_save_card_callback,
       PrefService* pref_service);
@@ -85,6 +87,9 @@
   // Weak reference to read & write |kAutofillAcceptSaveCreditCardPromptState|,
   PrefService* pref_service_;
 
+  // Weak reference to the Autofill StrikeDatabase.
+  StrikeDatabase* strike_database_;
+
   // Did the user ever explicitly accept or dismiss this infobar?
   bool had_user_interaction_;
 
@@ -97,6 +102,9 @@
   // The sub-label for the card to show in the content of the infobar.
   base::string16 card_sub_label_;
 
+  // The last four digits of the card for which save is being offered.
+  base::string16 card_last_four_digits_;
+
   // The legal messages to show in the content of the infobar.
   LegalMessageLines legal_messages_;
 
diff --git a/components/autofill/core/browser/credit_card_save_manager.cc b/components/autofill/core/browser/credit_card_save_manager.cc
index 6bd4a2d..f586a2f 100644
--- a/components/autofill/core/browser/credit_card_save_manager.cc
+++ b/components/autofill/core/browser/credit_card_save_manager.cc
@@ -37,6 +37,7 @@
 #include "components/autofill/core/browser/strike_database.h"
 #include "components/autofill/core/browser/validation.h"
 #include "components/autofill/core/common/autofill_clock.h"
+#include "components/autofill/core/common/autofill_constants.h"
 #include "components/autofill/core/common/autofill_features.h"
 #include "components/autofill/core/common/autofill_util.h"
 #include "services/identity/public/cpp/identity_manager.h"
@@ -46,11 +47,6 @@
 
 namespace {
 
-// If the Autofill StrikeDatabase returns this many strikes for a given card, it
-// will not show the offer-to-save bubble on Desktop or infobar on Android.
-// On Desktop, however, the omnibox icon will still be available.
-const int kMaxStrikesToPreventPoppingUpOfferToSavePrompt = 3;
-
 // If |name| consists of three whitespace-separated parts and the second of the
 // three parts is a single character or a single character followed by a period,
 // returns the result of joining the first and third parts with a space.
@@ -92,6 +88,7 @@
 void CreditCardSaveManager::AttemptToOfferCardLocalSave(
     const CreditCard& card) {
   local_card_save_candidate_ = card;
+  show_save_prompt_ = base::nullopt;
 
   // Query the Autofill StrikeDatabase on if we should pop up the offer-to-save
   // prompt for this card.
@@ -119,6 +116,7 @@
   upload_request_ = payments::PaymentsClient::UploadRequestDetails();
   upload_request_.card = card;
   uploading_local_card_ = uploading_local_card;
+  show_save_prompt_ = base::nullopt;
 
   // In an ideal scenario, when uploading a card, we would have:
   //  1) Card number and expiration
@@ -252,6 +250,9 @@
 void CreditCardSaveManager::OnDidUploadCard(
     AutofillClient::PaymentsRpcResult result,
     const std::string& server_id) {
+  if (observer_for_testing_)
+    observer_for_testing_->OnReceivedUploadCardResponse();
+
   if (result == AutofillClient::SUCCESS &&
       upload_request_.card.HasFirstAndLastName()) {
     AutofillMetrics::LogSaveCardWithFirstAndLastNameComplete(
@@ -287,6 +288,19 @@
               base::UTF16ToUTF8(upload_request_.card.LastFourDigits())),
           base::DoNothing());
     }
+  } else {
+    if (base::FeatureList::IsEnabled(
+            features::kAutofillSaveCreditCardUsesStrikeSystem) &&
+        show_save_prompt_.value()) {
+      // If the upload failed and the bubble was actually shown (NOT just the
+      // icon), count that as a strike against offering upload in the future.
+      StrikeDatabase* strike_database = client_->GetStrikeDatabase();
+      strike_database->AddStrike(
+          strike_database->GetKeyForCreditCardSave(
+              base::UTF16ToUTF8(upload_request_.card.LastFourDigits())),
+          base::BindRepeating(&CreditCardSaveManager::OnStrikeChangeComplete,
+                              weak_ptr_factory_.GetWeakPtr()));
+    }
   }
 }
 
@@ -699,6 +713,11 @@
                                       weak_ptr_factory_.GetWeakPtr()));
 }
 
+void CreditCardSaveManager::OnStrikeChangeComplete(const int num_strikes) {
+  if (observer_for_testing_)
+    observer_for_testing_->OnCCSMStrikeChangeComplete();
+}
+
 AutofillMetrics::CardUploadDecisionMetric
 CreditCardSaveManager::GetCVCCardUploadDecisionMetric() const {
   // This function assumes a valid CVC was not found.
diff --git a/components/autofill/core/browser/credit_card_save_manager.h b/components/autofill/core/browser/credit_card_save_manager.h
index f38b6e35..6b83ed6 100644
--- a/components/autofill/core/browser/credit_card_save_manager.h
+++ b/components/autofill/core/browser/credit_card_save_manager.h
@@ -76,6 +76,8 @@
     virtual void OnDecideToRequestUploadSave() = 0;
     virtual void OnReceivedGetUploadDetailsResponse() = 0;
     virtual void OnSentUploadCardRequest() = 0;
+    virtual void OnReceivedUploadCardResponse() = 0;
+    virtual void OnCCSMStrikeChangeComplete() = 0;
   };
 
   // The parameters should outlive the CreditCardSaveManager.
@@ -179,6 +181,10 @@
   // Finalizes the upload request and calls PaymentsClient::UploadCard().
   void SendUploadCardRequest();
 
+  // Used for browsertests. Gives the |observer_for_testing_| a notification
+  // a strike change has been made.
+  void OnStrikeChangeComplete(const int num_strikes);
+
   // Returns metric relevant to the CVC field based on values in
   // |found_cvc_field_|, |found_value_in_cvc_field_| and
   // |found_cvc_value_in_non_cvc_field_|. Only called when a valid CVC was NOT
diff --git a/components/autofill/core/browser/personal_data_manager.cc b/components/autofill/core/browser/personal_data_manager.cc
index 9632ea0..283b1c6 100644
--- a/components/autofill/core/browser/personal_data_manager.cc
+++ b/components/autofill/core/browser/personal_data_manager.cc
@@ -1561,12 +1561,6 @@
   if (is_syncing_for_test_)
     return true;
 
-  // Check if the feature to offer server cards on auth error is enabled.
-  if (base::FeatureList::IsEnabled(
-          features::kAutofillEnablePaymentsInteractionsOnAuthError)) {
-    return true;
-  }
-
   // Server cards should be suggested if the sync service active.
   return syncer::GetUploadToGoogleState(
              sync_service_, syncer::ModelType::AUTOFILL_WALLET_DATA) ==
diff --git a/components/autofill/core/browser/phone_number_i18n_fuzzer.cc b/components/autofill/core/browser/phone_number_i18n_fuzzer.cc
new file mode 100644
index 0000000..0a3fabf
--- /dev/null
+++ b/components/autofill/core/browser/phone_number_i18n_fuzzer.cc
@@ -0,0 +1,49 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stddef.h>
+#include <stdint.h>
+
+#include <string>
+
+#include "base/at_exit.h"
+#include "base/i18n/icu_util.h"
+#include "base/strings/string16.h"
+#include "components/autofill/core/browser/phone_number_i18n.h"
+#include "third_party/libphonenumber/phonenumber_api.h"
+
+namespace autofill {
+
+struct IcuEnvironment {
+  IcuEnvironment() { CHECK(base::i18n::InitializeICU()); }
+  // Used by ICU integration.
+  base::AtExitManager at_exit_manager;
+};
+
+IcuEnvironment* env = new IcuEnvironment();
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  // At least 2 bytes are needed for |default_region|, due to the
+  // ParsePhoneNumber contract.
+  if (size < 2)
+    return 0;
+
+  std::string default_region(reinterpret_cast<const char*>(data), 2);
+  base::string16 value(reinterpret_cast<const base::char16*>(data + 2),
+                       (size - 2) / 2);
+  base::string16 dummy_country_code;
+  base::string16 dummy_city_code;
+  base::string16 dummy_number;
+  std::string dummy_inferred_region;
+  ::i18n::phonenumbers::PhoneNumber dummy_i18n_number;
+
+  bool dummy_result = i18n::ParsePhoneNumber(
+      value, default_region, &dummy_country_code, &dummy_city_code,
+      &dummy_number, &dummy_inferred_region, &dummy_i18n_number);
+  if (dummy_result)
+    return 0;
+  return 0;
+}
+
+}  // namespace autofill
diff --git a/components/autofill/core/browser/phone_number_i18n_fuzzer.dict b/components/autofill/core/browser/phone_number_i18n_fuzzer.dict
new file mode 100644
index 0000000..2c4d4de9
--- /dev/null
+++ b/components/autofill/core/browser/phone_number_i18n_fuzzer.dict
@@ -0,0 +1,3 @@
+"-"
+"0"
+"1"
diff --git a/components/autofill/core/browser/strike_database.h b/components/autofill/core/browser/strike_database.h
index c1c1df7..2ff78b2 100644
--- a/components/autofill/core/browser/strike_database.h
+++ b/components/autofill/core/browser/strike_database.h
@@ -67,7 +67,9 @@
       const ClearStrikesCallback& outer_callback);
 
   // Returns concatenation of prefix + |card_last_four_digits| to be used as key
-  // for credit card save.
+  // for credit card save. Expiration date is not included for privacy reasons,
+  // as conflicting last-four should be a rare event, and it's not a huge issue
+  // if we stop showing save bubbles a little earlier than usual in rare cases.
   std::string GetKeyForCreditCardSave(const std::string& card_last_four_digits);
 
  protected:
diff --git a/components/autofill/core/common/autofill_constants.h b/components/autofill/core/common/autofill_constants.h
index c3d5135a..ddc3cda 100644
--- a/components/autofill/core/common/autofill_constants.h
+++ b/components/autofill/core/common/autofill_constants.h
@@ -37,6 +37,12 @@
   IS_PASSWORD_FIELD = 1 << 1 /* input field is a password field */
 };
 
+// Autofill StrikeDatabase: Maximum strikes allowed for the credit card save
+// project. If the StrikeDatabase returns this many strikes for a given card, it
+// will not show the offer-to-save bubble on Desktop or infobar on Android.
+// On Desktop, however, the omnibox icon will still be available.
+const int kMaxStrikesToPreventPoppingUpOfferToSavePrompt = 3;
+
 }  // namespace autofill
 
 #endif  // COMPONENTS_AUTOFILL_CORE_COMMON_AUTOFILL_CONSTANTS_H_
diff --git a/components/autofill/core/common/autofill_features.cc b/components/autofill/core/common/autofill_features.cc
index e60eb62a6..5ca8377 100644
--- a/components/autofill/core/common/autofill_features.cc
+++ b/components/autofill/core/common/autofill_features.cc
@@ -82,12 +82,6 @@
 const base::Feature kAutofillEnableIFrameSupportOniOS{
     "AutofillEnableIFrameSupportOniOS", base::FEATURE_ENABLED_BY_DEFAULT};
 
-// Controls whether the server credit cards are offered to be filled and
-// uploaded to Google Pay if the sync service is in auth error.
-const base::Feature kAutofillEnablePaymentsInteractionsOnAuthError{
-    "AutofillDontOfferServerCardsOnAuthError",
-    base::FEATURE_DISABLED_BY_DEFAULT};
-
 // When enabled, no local copy of server card will be saved when upload
 // succeeds.
 const base::Feature kAutofillNoLocalSaveOnUploadSuccess{
diff --git a/components/autofill/core/common/autofill_features.h b/components/autofill/core/common/autofill_features.h
index c556dbcd..e93f29da 100644
--- a/components/autofill/core/common/autofill_features.h
+++ b/components/autofill/core/common/autofill_features.h
@@ -36,7 +36,6 @@
 extern const base::Feature kAutofillEnableAccountWalletStorage;
 extern const base::Feature kAutofillEnableCompanyName;
 extern const base::Feature kAutofillEnableIFrameSupportOniOS;
-extern const base::Feature kAutofillEnablePaymentsInteractionsOnAuthError;
 extern const base::Feature kAutofillEnforceMinRequiredFieldsForHeuristics;
 extern const base::Feature kAutofillEnforceMinRequiredFieldsForQuery;
 extern const base::Feature kAutofillEnforceMinRequiredFieldsForUpload;
diff --git a/components/autofill/ios/browser/credit_card_save_manager_test_observer_bridge.h b/components/autofill/ios/browser/credit_card_save_manager_test_observer_bridge.h
index 85b804d..cb879636 100644
--- a/components/autofill/ios/browser/credit_card_save_manager_test_observer_bridge.h
+++ b/components/autofill/ios/browser/credit_card_save_manager_test_observer_bridge.h
@@ -22,6 +22,10 @@
 
 - (void)sentUploadCardRequest;
 
+- (void)receivedUploadCardResponse;
+
+- (void)ccsmStrikeChangeComplete;
+
 @end
 
 namespace autofill {
@@ -41,6 +45,8 @@
   void OnDecideToRequestUploadSave() override;
   void OnReceivedGetUploadDetailsResponse() override;
   void OnSentUploadCardRequest() override;
+  void OnReceivedUploadCardResponse() override;
+  void OnCCSMStrikeChangeComplete() override;
 
  private:
   __weak id<CreditCardSaveManagerTestObserver> observer_ = nil;
diff --git a/components/autofill/ios/browser/credit_card_save_manager_test_observer_bridge.mm b/components/autofill/ios/browser/credit_card_save_manager_test_observer_bridge.mm
index c85b844..f615e04 100644
--- a/components/autofill/ios/browser/credit_card_save_manager_test_observer_bridge.mm
+++ b/components/autofill/ios/browser/credit_card_save_manager_test_observer_bridge.mm
@@ -39,4 +39,12 @@
   [observer_ sentUploadCardRequest];
 }
 
+void CreditCardSaveManagerTestObserverBridge::OnReceivedUploadCardResponse() {
+  [observer_ receivedUploadCardResponse];
+}
+
+void CreditCardSaveManagerTestObserverBridge::OnCCSMStrikeChangeComplete() {
+  [observer_ ccsmStrikeChangeComplete];
+}
+
 }  // namespace autofill
diff --git a/components/cronet/android/cronet_library_loader.cc b/components/cronet/android/cronet_library_loader.cc
index 105e7d38..06655d5 100644
--- a/components/cronet/android/cronet_library_loader.cc
+++ b/components/cronet/android/cronet_library_loader.cc
@@ -62,6 +62,14 @@
     base::WaitableEvent::InitialState::NOT_SIGNALED);
 
 void NativeInit() {
+// In integrated mode, ICU and FeatureList has been initialized by the host.
+#if !BUILDFLAG(INTEGRATED_MODE)
+#if !BUILDFLAG(USE_PLATFORM_ICU_ALTERNATIVES)
+  base::i18n::InitializeICU();
+#endif
+  base::FeatureList::InitializeInstance(std::string(), std::string());
+#endif
+
   if (!base::TaskScheduler::GetInstance())
     base::TaskScheduler::CreateAndStartWithDefaultParams("Cronet");
   url::Initialize();
@@ -101,14 +109,6 @@
 void JNI_CronetLibraryLoader_CronetInitOnInitThread(
     JNIEnv* env,
     const JavaParamRef<jclass>& jcaller) {
-// In integrated mode, ICU and FeatureList has been initialized by the host.
-#if !BUILDFLAG(INTEGRATED_MODE)
-#if !BUILDFLAG(USE_PLATFORM_ICU_ALTERNATIVES)
-  base::i18n::InitializeICU();
-#endif
-  base::FeatureList::InitializeInstance(std::string(), std::string());
-#endif
-
   // Initialize message loop for init thread.
   DCHECK(!base::MessageLoop::current());
   DCHECK(!g_init_message_loop);
diff --git a/components/cronet/tools/cr_cronet.py b/components/cronet/tools/cr_cronet.py
index 3d9d822..a43b696 100755
--- a/components/cronet/tools/cr_cronet.py
+++ b/components/cronet/tools/cr_cronet.py
@@ -61,14 +61,14 @@
           ' third_party/android_platform/development/scripts/stack')
 
 
-def use_goma:
+def use_goma():
   home_goma = os.path.expanduser("~/goma")
   if os.path.exists(home_goma) or os.environ.get("GOMA_DIR") or \
      os.environ.get("GOMADIR"):
     return 'use_goma=true '
   return ''
 
-def gn_args(target_os, is_release):
+def gn_args_default(target_os, is_release):
   gn_args = 'target_os="' + target_os + '" enable_websockets=false '+ \
       'disable_file_support=true disable_ftp_support=true '+ \
       'disable_brotli_filter=false ' + \
@@ -82,7 +82,7 @@
 
 
 def gn_args_mac(is_release):
-  return gn_args('mac', is_release) + \
+  return gn_args_default('mac', is_release) + \
       'disable_histogram_support=true ' + \
       'use_platform_icu_alternatives=false ' + \
       'enable_dsyms=true '
@@ -153,7 +153,7 @@
       gn_args += 'is_asan=true is_clang=true is_debug=false '
       out_dir_suffix += '-asan'
 
-  gn_args += gn_args(target_os, options.release) + \
+  gn_args += gn_args_default(target_os, options.release) + \
       'use_platform_icu_alternatives=true '
 
   extra_options = ' '.join(extra_options_list)
diff --git a/components/omnibox/browser/omnibox_client.h b/components/omnibox/browser/omnibox_client.h
index 50e7f6a..d95ed12 100644
--- a/components/omnibox/browser/omnibox_client.h
+++ b/components/omnibox/browser/omnibox_client.h
@@ -175,6 +175,9 @@
 
   // Presents translation prompt for current tab web contents.
   virtual void PromptPageTranslation() {}
+
+  // Presents prompt to update Chrome.
+  virtual void OpenUpdateChromeDialog() {}
 };
 
 #endif  // COMPONENTS_OMNIBOX_BROWSER_OMNIBOX_CLIENT_H_
diff --git a/components/omnibox/browser/omnibox_pedal_implementations.cc b/components/omnibox/browser/omnibox_pedal_implementations.cc
index a650fc6c..9cc70602 100644
--- a/components/omnibox/browser/omnibox_pedal_implementations.cc
+++ b/components/omnibox/browser/omnibox_pedal_implementations.cc
@@ -192,6 +192,28 @@
 
 // =============================================================================
 
+class OmniboxPedalUpdateChrome : public OmniboxPedalCommon {
+ public:
+  OmniboxPedalUpdateChrome()
+      : OmniboxPedalCommon(
+            LabelStrings(IDS_OMNIBOX_PEDAL_UPDATE_CHROME_HINT,
+                         IDS_OMNIBOX_PEDAL_UPDATE_CHROME_HINT_SHORT,
+                         IDS_OMNIBOX_PEDAL_UPDATE_CHROME_SUGGESTION_CONTENTS),
+            GURL(),
+            {
+                "how to update google chrome", "how to update chrome",
+                "how do i update google chrome", "how to update chrome browser",
+                "update google chrome", "update chrome",
+                "update chrome browser",
+            }) {}
+
+  void Execute(ExecutionContext& context) const override {
+    context.client_.OpenUpdateChromeDialog();
+  }
+};
+
+// =============================================================================
+
 std::vector<std::unique_ptr<OmniboxPedal>> GetPedalImplementations() {
   std::vector<std::unique_ptr<OmniboxPedal>> pedals;
   const auto add = [&](OmniboxPedal* pedal) {
@@ -204,5 +226,6 @@
   add(new OmniboxPedalUpdateCreditCard());
   add(new OmniboxPedalLaunchIncognito());
   add(new OmniboxPedalTranslate());
+  add(new OmniboxPedalUpdateChrome());
   return pedals;
 }
diff --git a/components/omnibox_strings.grdp b/components/omnibox_strings.grdp
index 42bd0a13..dd9cbde 100644
--- a/components/omnibox_strings.grdp
+++ b/components/omnibox_strings.grdp
@@ -148,6 +148,16 @@
     Translate this page
   </message>
 
+  <message name="IDS_OMNIBOX_PEDAL_UPDATE_CHROME_HINT" desc="The button text contents to suggest pedal action, update chrome.">
+    Relaunch to Update
+  </message>
+  <message name="IDS_OMNIBOX_PEDAL_UPDATE_CHROME_HINT_SHORT" desc="The short one-word button text contents to suggest pedal action, update chrome.">
+    Relaunch
+  </message>
+  <message name="IDS_OMNIBOX_PEDAL_UPDATE_CHROME_SUGGESTION_CONTENTS" desc="The suggestion content text to suggest pedal action, update chrome.">
+    Relaunch
+  </message>
+
   <!-- Accessibility labels for autocomplete match types.
        These are parameterized on the text being completed into the omnibox.
   -->
diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index 10d29f2..823f0f1f 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json
@@ -567,6 +567,7 @@
         'PowerManagementIdleSettings',
         'ScreenLockDelays',
         'PowerSmartDimEnabled',
+        'ScreenBrightnessPercent',
       ],
     },
     {
@@ -13525,6 +13526,43 @@
 
       Each list item of the policy is an object with two members: "share_url" and "mode". "share_url" should be the URL of the share and "mode" should be "drop_down" which indicates that "share_url" will be added to the share discovery drop down.''',
     },
+    {
+      'name': 'ScreenBrightnessPercent',
+      'type': 'dict',
+      'schema': {
+        'type': 'object',
+        'properties': {
+          'BrightnessAC': {
+            'description': 'Screen brightness percent when running on AC power',
+            'type': 'integer',
+            'minimum': 0,
+            'maximum': 100
+          },
+          'BrightnessBattery': {
+            'description': 'Screen brightness percent when running on battery power',
+            'type': 'integer',
+            'minimum': 0,
+            'maximum': 100
+          }
+        }
+      },
+      'supported_on': ['chrome_os:72-'],
+      'features': {
+        'dynamic_refresh': True,
+        'per_profile': False,
+      },
+      'example_value': {
+        'BrightnessAC': 90,
+        'BrightnessBattery': 75
+      },
+      'id': 492,
+      'caption': '''Screen brightness percent''',
+      'tags': [],
+      'desc': '''Specifies screen brightness percent.
+          When this policy is set initial screen brightness is adjusted to the policy value, but the user can change it later on. Auto-brightness features are disabled.
+          When this policy is unset user screen controls and auto-brightness features are not affected.
+          The policy values should be specified in percents in range 0-100.''',
+    },
   ],
 
   'messages': {
@@ -13666,5 +13704,5 @@
   },
   'placeholders': [],
   'deleted_policy_ids': [412],
-  'highest_id_currently_used': 491
+  'highest_id_currently_used': 492
 }
diff --git a/components/test/android/browsertests_apk/AndroidManifest.xml.jinja2 b/components/test/android/browsertests_apk/AndroidManifest.xml.jinja2
index 49c50321..5d416cd 100644
--- a/components/test/android/browsertests_apk/AndroidManifest.xml.jinja2
+++ b/components/test/android/browsertests_apk/AndroidManifest.xml.jinja2
@@ -49,7 +49,7 @@
                  android:exported="false" />
         {% endfor %}
 
-        {% set num_privileged_services = 3 %}
+        {% set num_privileged_services = 5 %}
         <meta-data android:name="org.chromium.content.browser.NUM_PRIVILEGED_SERVICES"
                    android:value="{{ num_privileged_services }}"/>
 
diff --git a/components/toolbar/toolbar_field_trial.cc b/components/toolbar/toolbar_field_trial.cc
index a8c412a..ef8948d8 100644
--- a/components/toolbar/toolbar_field_trial.cc
+++ b/components/toolbar/toolbar_field_trial.cc
@@ -29,6 +29,15 @@
 #endif
 };
 
+const base::Feature kHideSteadyStateUrlPathQueryAndRef {
+  "OmniboxUIExperimentHideSteadyStateUrlPathQueryAndRef",
+#if defined(OS_IOS)
+      base::FEATURE_ENABLED_BY_DEFAULT
+#else
+      base::FEATURE_DISABLED_BY_DEFAULT
+#endif
+};
+
 bool IsHideSteadyStateUrlSchemeEnabled() {
   return base::FeatureList::IsEnabled(kHideSteadyStateUrlScheme) ||
          base::FeatureList::IsEnabled(::features::kExperimentalUi);
diff --git a/components/toolbar/toolbar_field_trial.h b/components/toolbar/toolbar_field_trial.h
index f0dbf55b..04603e67 100644
--- a/components/toolbar/toolbar_field_trial.h
+++ b/components/toolbar/toolbar_field_trial.h
@@ -18,6 +18,10 @@
 // the toolbar. It is restored during editing.
 extern const base::Feature kHideSteadyStateUrlTrivialSubdomains;
 
+// Feature used to hide the path, query and ref from steady state URLs
+// displayed in the toolbar. It is restored during editing.
+extern const base::Feature kHideSteadyStateUrlPathQueryAndRef;
+
 // Returns true if either the steady-state elision flag for scheme or the
 // #upcoming-ui-features flag is enabled.
 bool IsHideSteadyStateUrlSchemeEnabled();
diff --git a/components/toolbar/toolbar_model_impl.cc b/components/toolbar/toolbar_model_impl.cc
index 4211322..80b5971 100644
--- a/components/toolbar/toolbar_model_impl.cc
+++ b/components/toolbar/toolbar_model_impl.cc
@@ -48,6 +48,11 @@
 
 #if defined(OS_IOS)
   format_types |= url_formatter::kFormatUrlTrimAfterHost;
+#else
+  if (base::FeatureList::IsEnabled(
+          toolbar::features::kHideSteadyStateUrlPathQueryAndRef)) {
+    format_types |= url_formatter::kFormatUrlTrimAfterHost;
+  }
 #endif
 
   if (toolbar::features::IsHideSteadyStateUrlSchemeEnabled())
diff --git a/components/url_formatter/idn_spoof_checker.cc b/components/url_formatter/idn_spoof_checker.cc
index 5bdc6f5..213caaf 100644
--- a/components/url_formatter/idn_spoof_checker.cc
+++ b/components/url_formatter/idn_spoof_checker.cc
@@ -88,7 +88,8 @@
 
 std::string LookupMatchInTopDomains(const std::string& skeleton) {
   DCHECK(!skeleton.empty());
-  DCHECK_NE(skeleton.back(), '.');
+  // There are no other guarantees about a skeleton string such as not including
+  // a dot. Skeleton of certain characters are dots (e.g. "۰" (U+06F0)).
   TopDomainPreloadDecoder preload_decoder(
       g_trie_params.huffman_tree, g_trie_params.huffman_tree_size,
       g_trie_params.trie, g_trie_params.trie_bits,
@@ -236,8 +237,8 @@
   //   - {U+050D (ԍ), U+100c (ဌ)} => g
   //   - {U+0D1F (ട), U+0E23 (ร), U+0EA3 (ຣ), U+0EAE (ຮ)} => s
   //   - U+1042 (၂) => j
-  //   - {U+0437 (з), U+0499 (ҙ), U+04E1 (ӡ), U+1012 (ဒ), U+10D5 (ვ),
-  //      U+10DE (პ)} => 3
+  //   - {U+0437 (з), U+0499 (ҙ), U+04E1 (ӡ), U+0909 (उ), U+0993 (ও),
+  //      U+1012 (ဒ), U+10D5 (ვ), U+10DE (პ)} => 3
   //   - {U+0E1A (บ), U+0E9A (ບ)} => u
   extra_confusable_mapper_.reset(icu::Transliterator::createFromRules(
       UNICODE_STRING_SIMPLE("ExtraConf"),
@@ -248,7 +249,7 @@
           "[мӎ] > m; [єҽҿၔ] > e; ґ > r; [ғӻ] > f;"
           "[ҫင] > c; ұ > y; [χҳӽӿ] > x;"
           "ԃ  > d; [ԍဌ] > g; [ടรຣຮ] > s; ၂ > j;"
-          "[зҙӡဒვპ] > 3; [บບ] > u"),
+          "[зҙӡउওဒვპ] > 3; [บບ] > u"),
       UTRANS_FORWARD, parse_error, status));
   DCHECK(U_SUCCESS(status))
       << "Spoofchecker initalization failed due to an error: "
@@ -366,6 +367,7 @@
 }
 
 std::string IDNSpoofChecker::GetSimilarTopDomain(base::StringPiece16 hostname) {
+  DCHECK(!hostname.empty());
   for (const std::string& skeleton : GetSkeletons(hostname)) {
     DCHECK(!skeleton.empty());
     std::string matching_top_domain = LookupMatchInTopDomains(skeleton);
diff --git a/components/url_formatter/url_formatter_unittest.cc b/components/url_formatter/url_formatter_unittest.cc
index 361eb3ec..124930523 100644
--- a/components/url_formatter/url_formatter_unittest.cc
+++ b/components/url_formatter/url_formatter_unittest.cc
@@ -552,6 +552,16 @@
      L"12\x04e1"
      L"4567890.com",
      false},
+    // 12उ4567890.com
+    {"xn--124567890-m3r.com",
+     L"12\u0909"
+     L"4567890.com",
+     false},
+    // 12ও4567890.com
+    {"xn--124567890-17s.com",
+     L"12\u0993"
+     L"4567890.com",
+     false},
     // 12ဒ4567890.com
     {"xn--124567890-6s6a.com",
      L"12\x1012"
@@ -956,6 +966,10 @@
     {"xn--kx8a.com", L"\xa661.com", false},
     // Cyrillic Ext C: ᲂ.com (Narrow o)
     {"xn--43f.com", L"\x1c82.com", false},
+
+    // The skeleton of Extended Arabic-Indic Digit Zero (۰) is a dot. Check that
+    // this is handled correctly (crbug/877045).
+    {"xn--dmb", L"\x06f0", true},
 };
 
 struct AdjustOffsetCase {
diff --git a/components/viz/common/features.cc b/components/viz/common/features.cc
index f9c2876..c6cc4e0 100644
--- a/components/viz/common/features.cc
+++ b/components/viz/common/features.cc
@@ -30,8 +30,13 @@
                                           base::FEATURE_DISABLED_BY_DEFAULT};
 
 // Enables running the Viz-assisted hit-test logic.
+#if defined(OS_CHROMEOS)
 const base::Feature kEnableVizHitTestDrawQuad{
     "VizHitTestDrawQuad", base::FEATURE_DISABLED_BY_DEFAULT};
+#else
+const base::Feature kEnableVizHitTestDrawQuad{"VizHitTestDrawQuad",
+                                              base::FEATURE_ENABLED_BY_DEFAULT};
+#endif
 
 const base::Feature kEnableVizHitTestSurfaceLayer{
     "VizHitTestSurfaceLayer", base::FEATURE_DISABLED_BY_DEFAULT};
diff --git a/components/viz/service/frame_sinks/compositor_frame_sink_support.cc b/components/viz/service/frame_sinks/compositor_frame_sink_support.cc
index 62d1f140..771c8d5 100644
--- a/components/viz/service/frame_sinks/compositor_frame_sink_support.cc
+++ b/components/viz/service/frame_sinks/compositor_frame_sink_support.cc
@@ -56,7 +56,8 @@
     surface_manager_->RemoveSurfaceReferences({reference});
   }
 
-  EvictLastActivatedSurface();
+  if (last_activated_surface_id_.is_valid())
+    EvictLastActiveSurface();
   if (last_created_surface_id_.is_valid())
     surface_manager_->DestroySurface(last_created_surface_id_);
   frame_sink_manager_->UnregisterCompositorFrameSinkSupport(frame_sink_id_);
@@ -135,6 +136,8 @@
                        last_activated_surface_id_.local_surface_id())) {
     UpdateDisplayRootReference(surface);
   }
+
+  MaybeEvictSurfaces();
 }
 
 void CompositorFrameSinkSupport::OnFrameTokenChanged(uint32_t frame_token) {
@@ -219,10 +222,27 @@
   return results;
 }
 
-void CompositorFrameSinkSupport::EvictLastActivatedSurface() {
-  if (!last_activated_surface_id_.is_valid())
-    return;
+void CompositorFrameSinkSupport::EvictSurface(const LocalSurfaceId& id) {
+  DCHECK_GE(id.parent_sequence_number(), last_evicted_parent_sequence_number_);
+  last_evicted_parent_sequence_number_ = id.parent_sequence_number();
+  MaybeEvictSurfaces();
+}
 
+void CompositorFrameSinkSupport::MaybeEvictSurfaces() {
+  if (last_activated_surface_id_.is_valid() &&
+      last_activated_surface_id_.local_surface_id().parent_sequence_number() <=
+          last_evicted_parent_sequence_number_) {
+    EvictLastActiveSurface();
+  }
+  if (last_created_surface_id_.is_valid() &&
+      last_created_surface_id_.local_surface_id().parent_sequence_number() <=
+          last_evicted_parent_sequence_number_) {
+    surface_manager_->DestroySurface(last_created_surface_id_);
+    last_created_surface_id_ = SurfaceId();
+  }
+}
+
+void CompositorFrameSinkSupport::EvictLastActiveSurface() {
   SurfaceId to_destroy_surface_id = last_activated_surface_id_;
   if (last_created_surface_id_ == last_activated_surface_id_)
     last_created_surface_id_ = SurfaceId();
@@ -433,6 +453,13 @@
 
     current_surface = CreateSurface(surface_info, block_activation_on_parent);
     last_created_surface_id_ = SurfaceId(frame_sink_id_, local_surface_id);
+    MaybeEvictSurfaces();
+    // If the surface was immediately evicted, don't accept the CompositorFrame.
+    if (!last_created_surface_id_.is_valid()) {
+      TRACE_EVENT_INSTANT0("viz", "Submit rejected to evicted surface",
+                           TRACE_EVENT_SCOPE_THREAD);
+      return SubmitResult::ACCEPTED;
+    }
     surface_manager_->SurfaceDamageExpected(current_surface->surface_id(),
                                             last_begin_frame_args_);
   }
diff --git a/components/viz/service/frame_sinks/compositor_frame_sink_support.h b/components/viz/service/frame_sinks/compositor_frame_sink_support.h
index cd7f6ea..923eb24 100644
--- a/components/viz/service/frame_sinks/compositor_frame_sink_support.h
+++ b/components/viz/service/frame_sinks/compositor_frame_sink_support.h
@@ -127,7 +127,9 @@
                                const SharedBitmapId& id);
   void DidDeleteSharedBitmap(const SharedBitmapId& id);
 
-  void EvictLastActivatedSurface();
+  // Mark |id| and all surfaces with smaller ids for destruction. Note that |id|
+  // doesn't have to exist at the time of calling.
+  void EvictSurface(const LocalSurfaceId& id);
 
   // Attempts to submit a new CompositorFrame to |local_surface_id| and returns
   // whether the frame was accepted or the reason why it was rejected. If
@@ -206,6 +208,9 @@
 
   int64_t ComputeTraceId();
 
+  void MaybeEvictSurfaces();
+  void EvictLastActiveSurface();
+
   mojom::CompositorFrameSinkClient* const client_;
 
   FrameSinkManagerImpl* const frame_sink_manager_;
@@ -285,6 +290,8 @@
   bool callback_received_receive_ack_ = true;
   uint32_t trace_sequence_ = 0;
 
+  uint32_t last_evicted_parent_sequence_number_ = 0;
+
   base::WeakPtrFactory<CompositorFrameSinkSupport> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(CompositorFrameSinkSupport);
diff --git a/components/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc b/components/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc
index fd982572..bf42e48 100644
--- a/components/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc
+++ b/components/viz/service/frame_sinks/compositor_frame_sink_support_unittest.cc
@@ -541,7 +541,7 @@
         surface_manager->GarbageCollectSurfaces();
       }))
       .WillRepeatedly(testing::Return());
-  support->EvictLastActivatedSurface();
+  support->EvictSurface(local_surface_id);
   ExpireAllTemporaryReferences();
   manager_.InvalidateFrameSinkId(kAnotherArbitraryFrameSinkId);
 }
@@ -689,7 +689,7 @@
   EXPECT_TRUE(GetSurfaceForId(id));
   EXPECT_CALL(mock_client, DidReceiveCompositorFrameAck(returned_resources))
       .Times(1);
-  support->EvictLastActivatedSurface();
+  support->EvictSurface(local_surface_id);
   ExpireAllTemporaryReferences();
   manager_.surface_manager()->GarbageCollectSurfaces();
   EXPECT_FALSE(GetSurfaceForId(id));
@@ -697,9 +697,8 @@
 }
 
 // This test checks the case where a client submits a CompositorFrame for a
-// SurfaceId that has been evicted. The CompositorFrame resurrects the evicted
-// Surface and notifies the browser which immediately evicts the Surface again
-// because it's not needed.
+// SurfaceId that has been evicted. The CompositorFrame must be immediately
+// evicted.
 TEST_F(CompositorFrameSinkSupportTest, ResurectAndImmediatelyEvict) {
   LocalSurfaceId local_surface_id(1, kArbitraryToken);
   SurfaceId surface_id(kArbitraryFrameSinkId, local_surface_id);
@@ -717,15 +716,6 @@
   // We don't garbage collect the evicted surface yet because either garbage
   // collection hasn't run or something still has a reference to it.
 
-  // Call FrameSinkManagerImpl::EvictSurfaces() for |surface_id| in the same
-  // callstack as OnFirstSurfaceActivation() as that's what DelegatedFrameHost
-  // will do.
-  EXPECT_CALL(frame_sink_manager_client_,
-              OnFirstSurfaceActivation(SurfaceInfoWithId(surface_id)))
-      .WillOnce(Invoke([this](const SurfaceInfo& surface_info) {
-        manager_.EvictSurfaces({surface_info.id()});
-      }));
-
   // Submit the late CompositorFrame which will resurrect the Surface and
   // trigger another eviction.
   frame = CompositorFrameBuilder().AddDefaultRenderPass().Build();
@@ -753,7 +743,7 @@
 
   // Verify the temporary reference has prevented the surface from getting
   // destroyed.
-  support_->EvictLastActivatedSurface();
+  support_->EvictSurface(local_surface_id);
   EXPECT_TRUE(GetSurfaceForId(surface_id));
 
   // Verify the temporary reference is removed when expired.
@@ -815,7 +805,7 @@
   EXPECT_FALSE(called2);
   EXPECT_FALSE(called3);
 
-  support_->EvictLastActivatedSurface();
+  support_->EvictSurface(local_surface_id_);
   ExpireAllTemporaryReferences();
   local_surface_id_ = LocalSurfaceId();
   manager_.surface_manager()->GarbageCollectSurfaces();
diff --git a/components/viz/service/frame_sinks/frame_sink_manager_impl.cc b/components/viz/service/frame_sinks/frame_sink_manager_impl.cc
index 1aa96bab2..25e8ee1 100644
--- a/components/viz/service/frame_sinks/frame_sink_manager_impl.cc
+++ b/components/viz/service/frame_sinks/frame_sink_manager_impl.cc
@@ -264,8 +264,7 @@
     auto it = support_map_.find(surface_id.frame_sink_id());
     if (it == support_map_.end())
       continue;
-    if (it->second->last_activated_surface_id() == surface_id)
-      it->second->EvictLastActivatedSurface();
+    it->second->EvictSurface(surface_id.local_surface_id());
   }
 }
 
diff --git a/components/viz/service/frame_sinks/surface_references_unittest.cc b/components/viz/service/frame_sinks/surface_references_unittest.cc
index ea12015..ba9fb7b1 100644
--- a/components/viz/service/frame_sinks/surface_references_unittest.cc
+++ b/components/viz/service/frame_sinks/surface_references_unittest.cc
@@ -57,7 +57,7 @@
   // Destroy Surface with |surface_id|.
   void DestroySurface(const SurfaceId& surface_id) {
     GetCompositorFrameSinkSupport(surface_id.frame_sink_id())
-        .EvictLastActivatedSurface();
+        .EvictSurface(surface_id.local_surface_id());
   }
 
   CompositorFrameSinkSupport& GetCompositorFrameSinkSupport(
diff --git a/components/viz/service/frame_sinks/surface_synchronization_unittest.cc b/components/viz/service/frame_sinks/surface_synchronization_unittest.cc
index 28f2d7e..21cc8fa6 100644
--- a/components/viz/service/frame_sinks/surface_synchronization_unittest.cc
+++ b/components/viz/service/frame_sinks/surface_synchronization_unittest.cc
@@ -1133,9 +1133,9 @@
                                          MakeDefaultCompositorFrame());
 }
 
-// Verifies that if a surface is marked destroyed and a new frame arrives for
-// it, it will be recovered.
-TEST_F(SurfaceSynchronizationTest, SurfaceResurrection) {
+// Verifies that arrival of a new CompositorFrame doesn't change the fact that a
+// surface is marked for destruction.
+TEST_F(SurfaceSynchronizationTest, SubmitToDestroyedSurface) {
   const SurfaceId parent_id = MakeSurfaceId(kParentFrameSink, 1);
   const SurfaceId child_id = MakeSurfaceId(kChildFrameSink1, 3);
 
@@ -1159,7 +1159,7 @@
 
   // Attempt to destroy the child surface. The surface must still exist since
   // the parent needs it but it will be marked as destroyed.
-  child_support1().EvictLastActivatedSurface();
+  child_support1().EvictSurface(child_id.local_surface_id());
   surface = GetSurfaceForId(child_id);
   EXPECT_NE(nullptr, surface);
   EXPECT_TRUE(IsMarkedForDestruction(child_id));
@@ -1178,12 +1178,15 @@
     testing::Mock::VerifyAndClearExpectations(&support_client_);
   }
 
-  // Verify that the surface that was marked destroyed is recovered and is being
-  // used again.
+  // Verify that the surface that was marked destroyed is still marked as
+  // destroyed.
   Surface* surface2 = GetSurfaceForId(child_id);
   EXPECT_EQ(surface, surface2);
-  EXPECT_FALSE(IsMarkedForDestruction(child_id));
-  EXPECT_EQ(child_id, surface_observer().last_created_surface_id());
+  EXPECT_TRUE(IsMarkedForDestruction(child_id));
+
+  // We shouldn't observe an OnFirstSurfaceActivation because we reject the
+  // CompositorFrame to the evicted surface.
+  EXPECT_EQ(SurfaceId(), surface_observer().last_created_surface_id());
 }
 
 // Verifies that if a surface is marked destroyed and a new frame arrives after
@@ -1209,7 +1212,7 @@
 
   // Attempt to destroy the child surface. The surface must still exist since
   // the parent needs it but it will be marked as destroyed.
-  child_support1().EvictLastActivatedSurface();
+  child_support1().EvictSurface(child_id.local_surface_id());
   surface = GetSurfaceForId(child_id);
   EXPECT_NE(nullptr, surface);
   EXPECT_TRUE(IsMarkedForDestruction(child_id));
@@ -1252,7 +1255,7 @@
                                          MakeDefaultCompositorFrame());
 
   // Destroy the surface.
-  child_support1().EvictLastActivatedSurface();
+  child_support1().EvictSurface(child_id.local_surface_id());
   frame_sink_manager().surface_manager()->GarbageCollectSurfaces();
 
   EXPECT_EQ(nullptr, GetSurfaceForId(child_id));
@@ -1571,7 +1574,7 @@
   EXPECT_FALSE(display_surface()->HasPendingFrame());
   EXPECT_TRUE(display_surface()->HasActiveFrame());
 
-  display_support().EvictLastActivatedSurface();
+  display_support().EvictSurface(display_id.local_surface_id());
   display_support().SubmitCompositorFrame(
       display_id.local_surface_id(),
       MakeCompositorFrame({parent_id2}, empty_surface_ranges(),
@@ -2639,7 +2642,8 @@
 
   // Evict the activated surface in the parent_support.
   EXPECT_TRUE(parent_support().last_activated_surface_id().is_valid());
-  parent_support().EvictLastActivatedSurface();
+  parent_support().EvictSurface(
+      parent_support().last_activated_surface_id().local_surface_id());
   EXPECT_FALSE(parent_support().last_activated_surface_id().is_valid());
 
   // The CompositorFrame in the evicted |parent_id| activates here because it
@@ -2648,8 +2652,9 @@
                                          MakeDefaultCompositorFrame());
 
   // parent_support will be informed of the activation of a CompositorFrame
-  // associated with |parent_id|.
-  EXPECT_TRUE(parent_support().last_activated_surface_id().is_valid());
+  // associated with |parent_id|, but we clear |last_active_surface_id_| because
+  // it was evicted before.
+  EXPECT_FALSE(parent_support().last_activated_surface_id().is_valid());
 
   // Perform a garbage collection. |parent_id| should no longer exist.
   EXPECT_NE(nullptr, GetSurfaceForId(parent_id));
@@ -3029,4 +3034,33 @@
   EXPECT_TRUE(IsMarkedForDestruction(child_id2));
 }
 
+TEST_F(SurfaceSynchronizationTest, EvictSurface) {
+  const SurfaceId child_id1 = MakeSurfaceId(kChildFrameSink1, 1, 1);
+  // Child-initiated synchronization event:
+  const SurfaceId child_id2 = MakeSurfaceId(kChildFrameSink1, 1, 2);
+  // Parent-initiated synchronizaton event:
+  const SurfaceId child_id3 = MakeSurfaceId(kChildFrameSink1, 2, 2);
+
+  // Evict |child_id1|.
+  child_support1().EvictSurface(child_id1.local_surface_id());
+
+  // Submit a CompositorFrame to |child_id1|. It should get marked for
+  // destruction immediately.
+  child_support1().SubmitCompositorFrame(child_id1.local_surface_id(),
+                                         MakeDefaultCompositorFrame());
+  EXPECT_TRUE(IsMarkedForDestruction(child_id1));
+
+  // Submit a CompositorFrame to |child_id2|. It should also get marked for
+  // destruction because it has the same parent sequence number as |child_id1|.
+  child_support1().SubmitCompositorFrame(child_id2.local_surface_id(),
+                                         MakeDefaultCompositorFrame());
+  EXPECT_TRUE(IsMarkedForDestruction(child_id2));
+
+  // Submit a CompositorFrame to |child_id3|. It should not be marked for
+  // destruction.
+  child_support1().SubmitCompositorFrame(child_id3.local_surface_id(),
+                                         MakeDefaultCompositorFrame());
+  EXPECT_FALSE(IsMarkedForDestruction(child_id3));
+}
+
 }  // namespace viz
diff --git a/components/viz/service/hit_test/hit_test_aggregator_unittest.cc b/components/viz/service/hit_test/hit_test_aggregator_unittest.cc
index 514552a..207c245a 100644
--- a/components/viz/service/hit_test/hit_test_aggregator_unittest.cc
+++ b/components/viz/service/hit_test/hit_test_aggregator_unittest.cc
@@ -997,14 +997,14 @@
       local_surface_id_lookup_delegate(), c_surface_id.frame_sink_id()));
 
   // Discard Surface and ensure active count goes down.
-  support2->EvictLastActivatedSurface();
+  support2->EvictSurface(c_surface_id.local_surface_id());
   ExpireAllTemporaryReferencesAndGarbageCollect();
   EXPECT_TRUE(hit_test_manager()->GetActiveHitTestRegionList(
       local_surface_id_lookup_delegate(), e_surface_id.frame_sink_id()));
   EXPECT_FALSE(hit_test_manager()->GetActiveHitTestRegionList(
       local_surface_id_lookup_delegate(), c_surface_id.frame_sink_id()));
 
-  support()->EvictLastActivatedSurface();
+  support()->EvictSurface(e_surface_id.local_surface_id());
   ExpireAllTemporaryReferencesAndGarbageCollect();
   EXPECT_FALSE(hit_test_manager()->GetActiveHitTestRegionList(
       local_surface_id_lookup_delegate(), e_surface_id.frame_sink_id()));
diff --git a/components/viz/service/surfaces/surface_dependency_deadline.cc b/components/viz/service/surfaces/surface_dependency_deadline.cc
index 65d8abe..67097d6 100644
--- a/components/viz/service/surfaces/surface_dependency_deadline.cc
+++ b/components/viz/service/surfaces/surface_dependency_deadline.cc
@@ -29,7 +29,7 @@
 }
 
 bool SurfaceDependencyDeadline::Set(const FrameDeadline& frame_deadline) {
-  CancelInternal(false);
+  Cancel();
   start_time_ = frame_deadline.frame_start_time();
   deadline_ = frame_deadline.ToWallTime();
   begin_frame_source_->AddObserver(this);
@@ -37,7 +37,18 @@
 }
 
 base::Optional<base::TimeDelta> SurfaceDependencyDeadline::Cancel() {
-  return CancelInternal(false);
+  if (!deadline_)
+    return base::nullopt;
+
+  begin_frame_source_->RemoveObserver(this);
+  deadline_.reset();
+
+  base::TimeDelta duration = tick_clock_->NowTicks() - start_time_;
+
+  UMA_HISTOGRAM_TIMES("Compositing.SurfaceDependencyDeadline.Duration",
+                      duration);
+
+  return duration;
 }
 
 void SurfaceDependencyDeadline::InheritFrom(
@@ -45,7 +56,7 @@
   if (*this == other)
     return;
 
-  base::Optional<base::TimeDelta> duration = CancelInternal(false);
+  base::Optional<base::TimeDelta> duration = Cancel();
   last_begin_frame_args_ = other.last_begin_frame_args_;
   begin_frame_source_ = other.begin_frame_source_;
   deadline_ = other.deadline_;
@@ -73,7 +84,7 @@
   if (deadline_ > tick_clock_->NowTicks())
     return;
 
-  base::Optional<base::TimeDelta> duration = CancelInternal(true);
+  base::Optional<base::TimeDelta> duration = Cancel();
   DCHECK(duration);
 
   client_->OnDeadline(*duration);
@@ -90,23 +101,4 @@
 
 void SurfaceDependencyDeadline::OnBeginFrameSourcePausedChanged(bool paused) {}
 
-base::Optional<base::TimeDelta> SurfaceDependencyDeadline::CancelInternal(
-    bool deadline) {
-  if (!deadline_)
-    return base::nullopt;
-
-  begin_frame_source_->RemoveObserver(this);
-  deadline_.reset();
-
-  base::TimeDelta duration = tick_clock_->NowTicks() - start_time_;
-
-  UMA_HISTOGRAM_TIMES("Compositing.SurfaceDependencyDeadline.Duration",
-                      duration);
-
-  UMA_HISTOGRAM_BOOLEAN("Compositing.SurfaceDependencyDeadline.DeadlineHit",
-                        deadline);
-
-  return duration;
-}
-
 }  // namespace viz
diff --git a/components/viz/service/surfaces/surface_dependency_deadline.h b/components/viz/service/surfaces/surface_dependency_deadline.h
index 9c0349df..61ce0c0 100644
--- a/components/viz/service/surfaces/surface_dependency_deadline.h
+++ b/components/viz/service/surfaces/surface_dependency_deadline.h
@@ -57,8 +57,6 @@
   bool WantsAnimateOnlyBeginFrames() const override;
 
  private:
-  base::Optional<base::TimeDelta> CancelInternal(bool deadline);
-
   SurfaceDeadlineClient* const client_;
   BeginFrameSource* begin_frame_source_ = nullptr;
   const base::TickClock* tick_clock_;
diff --git a/components/viz/test/test_context_provider.cc b/components/viz/test/test_context_provider.cc
index 6536ef0b..9edb2b0c 100644
--- a/components/viz/test/test_context_provider.cc
+++ b/components/viz/test/test_context_provider.cc
@@ -211,7 +211,7 @@
   context_thread_checker_.DetachFromThread();
   context_gl_->set_test_support(support_.get());
   raster_context_ = std::make_unique<gpu::raster::RasterImplementationGLES>(
-      context_gl_.get(), nullptr, context_gl_->test_capabilities());
+      context_gl_.get(), context_gl_->test_capabilities());
   // Just pass nullptr to the ContextCacheController for its task runner.
   // Idle handling is tested directly in ContextCacheController's
   // unittests, and isn't needed here.
diff --git a/content/app/OWNERS b/content/app/OWNERS
index 66daea88..27c4a80 100644
--- a/content/app/OWNERS
+++ b/content/app/OWNERS
@@ -1,3 +1,3 @@
 jcivelli@chromium.org
-rockot@chromium.org
+rockot@google.com
 per-file sandbox_helper_win.cc=file://sandbox/win/OWNERS
diff --git a/content/browser/browsing_data/clear_site_data_handler_browsertest.cc b/content/browser/browsing_data/clear_site_data_handler_browsertest.cc
index e13947c..2e2c709d 100644
--- a/content/browser/browsing_data/clear_site_data_handler_browsertest.cc
+++ b/content/browser/browsing_data/clear_site_data_handler_browsertest.cc
@@ -933,8 +933,10 @@
 // TODO(msramek): Add integration tests for other storage data types, such as
 // local storage, indexed DB, etc.
 
+// Disabled due to flakiness. See https://crbug.com/894572.
 // Integration test for the deletion of cache entries.
-IN_PROC_BROWSER_TEST_F(ClearSiteDataHandlerBrowserTest, CacheIntegrationTest) {
+IN_PROC_BROWSER_TEST_F(ClearSiteDataHandlerBrowserTest,
+                       Disabled_CacheIntegrationTest) {
   GURL url1 = GetURLForHTTPSHost1("/cachetime/foo");
   GURL url2 = GetURLForHTTPSHost1("/cachetime/bar");
   GURL url3 = GetURLForHTTPSHost2("/cachetime/foo");
diff --git a/content/browser/gpu/gpu_internals_ui.cc b/content/browser/gpu/gpu_internals_ui.cc
index abfcc0c3..65cb7cb 100644
--- a/content/browser/gpu/gpu_internals_ui.cc
+++ b/content/browser/gpu/gpu_internals_ui.cc
@@ -181,11 +181,8 @@
       NewDescriptionValuePair("Desktop compositing", compositor));
 
   basic_info->Append(NewDescriptionValuePair(
-      "Direct Composition",
-      std::make_unique<base::Value>(gpu_info.direct_composition)));
-  basic_info->Append(NewDescriptionValuePair(
-      "Supports overlays",
-      std::make_unique<base::Value>(gpu_info.supports_overlays)));
+      "Direct composition overlays",
+      std::make_unique<base::Value>(gpu_info.direct_composition_overlays)));
 
   auto overlay_capabilities = std::make_unique<base::ListValue>();
   for (const auto& cap : gpu_info.overlay_capabilities) {
diff --git a/content/browser/renderer_host/browser_compositor_view_mac.h b/content/browser/renderer_host/browser_compositor_view_mac.h
index 71a9e102..f9fc06f 100644
--- a/content/browser/renderer_host/browser_compositor_view_mac.h
+++ b/content/browser/renderer_host/browser_compositor_view_mac.h
@@ -138,6 +138,7 @@
   void OnBeginFrame(base::TimeTicks frame_time) override;
   void OnFrameTokenChanged(uint32_t frame_token) override;
   float GetDeviceScaleFactor() const override;
+  void WasEvicted() override;
 
   base::WeakPtr<BrowserCompositorMac> GetWeakPtr() {
     return weak_factory_.GetWeakPtr();
diff --git a/content/browser/renderer_host/browser_compositor_view_mac.mm b/content/browser/renderer_host/browser_compositor_view_mac.mm
index 65670cccb..c50a365 100644
--- a/content/browser/renderer_host/browser_compositor_view_mac.mm
+++ b/content/browser/renderer_host/browser_compositor_view_mac.mm
@@ -289,11 +289,10 @@
         recyclable_compositor_->compositor());
     delegated_frame_host_->WasShown(GetRendererLocalSurfaceId(), dfh_size_dip_,
                                     false /* record_presentation_time */);
-
     // If there exists a saved frame ready to display, unsuspend the compositor
     // now (if one is not ready, the compositor will unsuspend on first surface
     // activation).
-    if (delegated_frame_host_->HasSavedFrame())
+    if (delegated_frame_host_->HasActiveSurface())
       recyclable_compositor_->Unsuspend();
 
     state_ = HasAttachedCompositor;
@@ -405,6 +404,10 @@
   return dfh_display_.device_scale_factor();
 }
 
+void BrowserCompositorMac::WasEvicted() {
+  dfh_local_surface_id_allocator_.GenerateId();
+}
+
 void BrowserCompositorMac::DidNavigate() {
   // The first navigation does not need a new LocalSurfaceID. The renderer can
   // use the ID that was already provided.
diff --git a/content/browser/renderer_host/clipboard_host_impl_unittest.cc b/content/browser/renderer_host/clipboard_host_impl_unittest.cc
index 50b866d..16556e4 100644
--- a/content/browser/renderer_host/clipboard_host_impl_unittest.cc
+++ b/content/browser/renderer_host/clipboard_host_impl_unittest.cc
@@ -73,18 +73,16 @@
 
   // ReadText() is a sync method, so normally, one wouldn't call this method
   // directly. These are not normal times though...
-  base::RunLoop run_loop;
-  mojo_clipboard()->ReadText(
-      ui::CLIPBOARD_TYPE_COPY_PASTE,
-      base::BindLambdaForTesting(
-          [&run_loop](const base::string16& ignored) { run_loop.Quit(); }));
+  mojo_clipboard()->ReadText(ui::CLIPBOARD_TYPE_COPY_PASTE, base::DoNothing());
 
   // Now purposely write a raw message which (hopefully) won't deserialize to
   // anything valid. The receiver side should still be in the midst of
   // dispatching ReadText() when Mojo attempts to deserialize this message,
   // which should cause a validation failure that signals a connection error.
+  base::RunLoop run_loop;
   mojo::WriteMessageRaw(mojo_clipboard().internal_state()->handle(), "moo", 3,
                         nullptr, 0, MOJO_WRITE_MESSAGE_FLAG_NONE);
+  mojo_clipboard().set_connection_error_handler(run_loop.QuitClosure());
   run_loop.Run();
 
   EXPECT_TRUE(mojo_clipboard().encountered_error());
diff --git a/content/browser/renderer_host/delegated_frame_host.cc b/content/browser/renderer_host/delegated_frame_host.cc
index 3bf32f6d..801538e 100644
--- a/content/browser/renderer_host/delegated_frame_host.cc
+++ b/content/browser/renderer_host/delegated_frame_host.cc
@@ -208,9 +208,16 @@
   const viz::SurfaceId* primary_surface_id =
       client_->DelegatedFrameHostGetLayer()->GetPrimarySurfaceId();
 
+  bool id_changed = pending_local_surface_id_ != new_pending_local_surface_id;
+
   pending_local_surface_id_ = new_pending_local_surface_id;
   pending_surface_dip_size_ = new_pending_dip_size;
 
+  if (id_changed) {
+    frame_evictor_->SwappedFrame(client_->DelegatedFrameHostIsVisible());
+    // Note: the frame may have been evicted immediately.
+  }
+
   viz::SurfaceId new_primary_surface_id(frame_sink_id_,
                                         pending_local_surface_id_);
 
@@ -219,8 +226,7 @@
     // time user switches back to it the page is blank. This is preferred to
     // showing contents of old size. Don't call EvictDelegatedFrame to avoid
     // races when dragging tabs across displays. See https://crbug.com/813157.
-    if (pending_surface_dip_size_ != current_frame_size_in_dip_ &&
-        HasPrimarySurface()) {
+    if (pending_surface_dip_size_ != current_frame_size_in_dip_) {
       client_->DelegatedFrameHostGetLayer()->SetFallbackSurfaceId(
           new_primary_surface_id);
     }
@@ -317,9 +323,6 @@
 
   // This is used by macOS' unique resize path.
   client_->OnFirstSurfaceActivation(surface_info);
-
-  frame_evictor_->SwappedFrame(client_->DelegatedFrameHostIsVisible());
-  // Note: the frame may have been evicted immediately.
 }
 
 void DelegatedFrameHost::OnFrameTokenChanged(uint32_t frame_token) {
@@ -333,9 +336,6 @@
 }
 
 void DelegatedFrameHost::ResetFallbackToFirstNavigationSurface() {
-  if (!HasPrimarySurface())
-    return;
-
   const viz::SurfaceId* fallback_surface_id =
       client_->DelegatedFrameHostGetLayer()->GetFallbackSurfaceId();
 
@@ -362,10 +362,14 @@
 
   if (!HasSavedFrame())
     return;
-  std::vector<viz::SurfaceId> surface_ids = {GetCurrentSurfaceId()};
+
+  std::vector<viz::SurfaceId> surface_ids = {
+      viz::SurfaceId(frame_sink_id_, pending_local_surface_id_)};
   DCHECK(host_frame_sink_manager_);
   host_frame_sink_manager_->EvictSurfaces(surface_ids);
   frame_evictor_->DiscardedFrame();
+  active_local_surface_id_ = viz::LocalSurfaceId();
+  client_->WasEvicted();
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -459,11 +463,6 @@
   first_local_surface_id_after_navigation_ = pending_local_surface_id_;
 }
 
-bool DelegatedFrameHost::IsPrimarySurfaceEvicted() const {
-  return active_local_surface_id_ == pending_local_surface_id_ &&
-         !HasSavedFrame();
-}
-
 void DelegatedFrameHost::WindowTitleChanged(const std::string& title) {
   if (host_frame_sink_manager_)
     host_frame_sink_manager_->SetFrameSinkDebugLabel(frame_sink_id_, title);
@@ -511,4 +510,8 @@
   client_->DelegatedFrameHostGetLayer()->SetFallbackSurfaceId(desired_fallback);
 }
 
+bool DelegatedFrameHost::HasActiveSurface() const {
+  return active_local_surface_id_.is_valid();
+}
+
 }  // namespace content
diff --git a/content/browser/renderer_host/delegated_frame_host.h b/content/browser/renderer_host/delegated_frame_host.h
index b5492e0..cdaa720 100644
--- a/content/browser/renderer_host/delegated_frame_host.h
+++ b/content/browser/renderer_host/delegated_frame_host.h
@@ -51,6 +51,7 @@
   virtual void OnBeginFrame(base::TimeTicks frame_time) = 0;
   virtual void OnFrameTokenChanged(uint32_t frame_token) = 0;
   virtual float GetDeviceScaleFactor() const = 0;
+  virtual void WasEvicted() = 0;
 };
 
 // The DelegatedFrameHost is used to host all of the RenderWidgetHostView state
@@ -171,8 +172,6 @@
 
   void DidNavigate();
 
-  bool IsPrimarySurfaceEvicted() const;
-
   void WindowTitleChanged(const std::string& title);
 
   // If our SurfaceLayer doesn't have a fallback, use the fallback info of
@@ -183,6 +182,8 @@
     return weak_factory_.GetWeakPtr();
   }
 
+  bool HasActiveSurface() const;
+
  private:
   friend class DelegatedFrameHostClient;
   FRIEND_TEST_ALL_PREFIXES(RenderWidgetHostViewAuraTest,
diff --git a/content/browser/renderer_host/delegated_frame_host_client_aura.cc b/content/browser/renderer_host/delegated_frame_host_client_aura.cc
index f1714b9..3af5c6f 100644
--- a/content/browser/renderer_host/delegated_frame_host_client_aura.cc
+++ b/content/browser/renderer_host/delegated_frame_host_client_aura.cc
@@ -58,4 +58,8 @@
   return render_widget_host_view_->device_scale_factor_;
 }
 
+void DelegatedFrameHostClientAura::WasEvicted() {
+  render_widget_host_view_->WasEvicted();
+}
+
 }  // namespace content
diff --git a/content/browser/renderer_host/delegated_frame_host_client_aura.h b/content/browser/renderer_host/delegated_frame_host_client_aura.h
index 3085885..930056b1 100644
--- a/content/browser/renderer_host/delegated_frame_host_client_aura.h
+++ b/content/browser/renderer_host/delegated_frame_host_client_aura.h
@@ -34,6 +34,7 @@
   void OnBeginFrame(base::TimeTicks frame_time) override;
   void OnFrameTokenChanged(uint32_t frame_token) override;
   float GetDeviceScaleFactor() const override;
+  void WasEvicted() override;
 
  private:
   RenderWidgetHostViewAura* render_widget_host_view_;
diff --git a/content/browser/renderer_host/input/fling_browsertest.cc b/content/browser/renderer_host/input/fling_browsertest.cc
index 14afc422..945f8ec7 100644
--- a/content/browser/renderer_host/input/fling_browsertest.cc
+++ b/content/browser/renderer_host/input/fling_browsertest.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "build/build_config.h"
 #include "content/browser/renderer_host/input/synthetic_smooth_scroll_gesture.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/test/browser_test_utils.h"
@@ -74,6 +75,11 @@
         shell()->web_contents()->GetRenderViewHost()->GetWidget());
   }
 
+  void SynchronizeThreads() {
+    MainThreadFrameObserver observer(GetWidgetHost());
+    observer.Wait();
+  }
+
   void LoadURL(const std::string& page_data) {
     const GURL data_url("data:text/html," + page_data);
     NavigateToURL(shell(), data_url);
@@ -84,15 +90,13 @@
     base::string16 ready_title(base::ASCIIToUTF16("ready"));
     TitleWatcher watcher(shell()->web_contents(), ready_title);
     ignore_result(watcher.WaitAndGetTitle());
-
-    MainThreadFrameObserver main_thread_sync(host);
-    main_thread_sync.Wait();
+    SynchronizeThreads();
   }
 
   void LoadPageWithOOPIF() {
     // navigate main frame to URL.
     GURL main_url(embedded_test_server()->GetURL(
-        "a.com", "/frame_tree/page_with_positioned_frame.html"));
+        "a.com", "/frame_tree/scrollable_page_with_positioned_frame.html"));
     EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
     // Navigate oopif to URL.
@@ -119,17 +123,29 @@
         iframe_node->current_frame_host()->GetRenderWidgetHost()->GetView());
   }
 
-  void SimulateTouchscreenFling(RenderWidgetHostImpl* render_widget_host) {
+  void SimulateTouchscreenFling(
+      RenderWidgetHostImpl* render_widget_host,
+      RenderWidgetHostImpl* parent_render_widget_host = nullptr,
+      const gfx::Vector2dF& fling_velocity = gfx::Vector2dF(0.f, -2000.f)) {
     DCHECK(render_widget_host);
-    // Send a GSB to start scrolling sequence.
+    // Send a GSB to start scrolling sequence. In case of scroll bubbling wait
+    // for the parent to receive the GSB before sending the GFS.
+    auto input_msg_watcher =
+        parent_render_widget_host
+            ? std::make_unique<InputMsgWatcher>(
+                  parent_render_widget_host,
+                  blink::WebInputEvent::kGestureScrollBegin)
+            : std::make_unique<InputMsgWatcher>(
+                  render_widget_host,
+                  blink::WebInputEvent::kGestureScrollBegin);
     blink::WebGestureEvent gesture_scroll_begin(
         blink::WebGestureEvent::kGestureScrollBegin,
         blink::WebInputEvent::kNoModifiers, ui::EventTimeForNow());
     gesture_scroll_begin.SetSourceDevice(blink::kWebGestureDeviceTouchscreen);
     gesture_scroll_begin.data.scroll_begin.delta_hint_units =
         blink::WebGestureEvent::ScrollUnits::kPrecisePixels;
-    gesture_scroll_begin.data.scroll_begin.delta_x_hint = 0.f;
-    gesture_scroll_begin.data.scroll_begin.delta_y_hint = -5.f;
+    gesture_scroll_begin.data.scroll_begin.delta_x_hint = fling_velocity.x();
+    gesture_scroll_begin.data.scroll_begin.delta_y_hint = fling_velocity.y();
     const gfx::PointF scroll_location_in_widget(1, 1);
     const gfx::PointF scroll_location_in_root =
         child_view_ ? child_view_->TransformPointToRootCoordSpaceF(
@@ -142,26 +158,39 @@
     gesture_scroll_begin.SetPositionInWidget(scroll_location_in_widget);
     gesture_scroll_begin.SetPositionInScreen(scroll_location_in_screen);
     render_widget_host->ForwardGestureEvent(gesture_scroll_begin);
+    input_msg_watcher->GetAckStateWaitIfNecessary();
 
     //  Send a GFS.
     blink::WebGestureEvent gesture_fling_start(
         blink::WebGestureEvent::kGestureFlingStart,
         blink::WebInputEvent::kNoModifiers, ui::EventTimeForNow());
     gesture_fling_start.SetSourceDevice(blink::kWebGestureDeviceTouchscreen);
-    gesture_fling_start.data.fling_start.velocity_x = 0.f;
-    gesture_fling_start.data.fling_start.velocity_y = -2000.f;
+    gesture_fling_start.data.fling_start.velocity_x = fling_velocity.x();
+    gesture_fling_start.data.fling_start.velocity_y = fling_velocity.y();
     gesture_fling_start.SetPositionInWidget(scroll_location_in_widget);
     gesture_fling_start.SetPositionInScreen(scroll_location_in_screen);
     render_widget_host->ForwardGestureEvent(gesture_fling_start);
   }
 
-  void SimulateTouchpadFling(RenderWidgetHostImpl* render_widget_host) {
+  void SimulateTouchpadFling(
+      RenderWidgetHostImpl* render_widget_host,
+      RenderWidgetHostImpl* parent_render_widget_host = nullptr,
+      const gfx::Vector2dF& fling_velocity = gfx::Vector2dF(0.f, -2000.f)) {
     DCHECK(render_widget_host);
-    // Send a wheel event to start scrolling sequence.
-    auto input_msg_watcher = std::make_unique<InputMsgWatcher>(
-        GetWidgetHost(), blink::WebInputEvent::kMouseWheel);
+    // Send a wheel event to start scrolling sequence. In case of scroll
+    // bubbling wait for the parent to receive the GSB before sending the GFS.
+    auto input_msg_watcher =
+        parent_render_widget_host
+            ? std::make_unique<InputMsgWatcher>(
+                  parent_render_widget_host,
+                  blink::WebInputEvent::kGestureScrollBegin)
+            : std::make_unique<InputMsgWatcher>(
+                  render_widget_host,
+                  blink::WebInputEvent::kGestureScrollBegin);
     blink::WebMouseWheelEvent wheel_event =
-        SyntheticWebMouseWheelEventBuilder::Build(10, 10, 0, -53, 0, true);
+        SyntheticWebMouseWheelEventBuilder::Build(
+            10, 10, fling_velocity.x() / 1000, fling_velocity.y() / 1000, 0,
+            true);
     wheel_event.phase = blink::WebMouseWheelEvent::kPhaseBegan;
     const gfx::PointF position_in_widget(1, 1);
     const gfx::PointF position_in_root =
@@ -175,15 +204,15 @@
     wheel_event.SetPositionInWidget(position_in_widget);
     wheel_event.SetPositionInScreen(position_in_screen);
     render_widget_host->ForwardWheelEvent(wheel_event);
-    input_msg_watcher->WaitForAck();
+    input_msg_watcher->GetAckStateWaitIfNecessary();
 
     //  Send a GFS.
     blink::WebGestureEvent gesture_fling_start(
         blink::WebGestureEvent::kGestureFlingStart,
         blink::WebInputEvent::kNoModifiers, ui::EventTimeForNow());
     gesture_fling_start.SetSourceDevice(blink::kWebGestureDeviceTouchpad);
-    gesture_fling_start.data.fling_start.velocity_x = 0.f;
-    gesture_fling_start.data.fling_start.velocity_y = -2000.f;
+    gesture_fling_start.data.fling_start.velocity_x = fling_velocity.x();
+    gesture_fling_start.data.fling_start.velocity_y = fling_velocity.y();
     gesture_fling_start.SetPositionInWidget(position_in_widget);
     gesture_fling_start.SetPositionInScreen(position_in_screen);
     render_widget_host->ForwardGestureEvent(gesture_fling_start);
@@ -212,25 +241,36 @@
     run_loop.Run();
   }
 
-  void WaitForChildScroll() {
-    FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                              ->GetFrameTree()
-                              ->root();
-    ASSERT_EQ(1U, root->child_count());
-    FrameTreeNode* iframe_node = root->child_at(0);
-    int scroll_top = EvalJs(iframe_node->current_frame_host(), "window.scrollY")
-                         .ExtractDouble();
+  void WaitForFrameScroll(FrameTreeNode* frame_node,
+                          int target_scroll_offset = 100,
+                          bool upward = false) {
+    DCHECK(frame_node);
+    double scroll_top =
+        EvalJs(frame_node->current_frame_host(), "window.scrollY")
+            .ExtractDouble();
     // scrollTop > 0 is not enough since the first progressFling is called from
-    // FlingController::ProcessGestureFlingStart. Wait for scrollTop to exceed
-    // 100 pixels to make sure that ProgressFling has been called through
-    // FlingScheduler at least once.
-    while (scroll_top < 100) {
+    // FlingController::ProcessGestureFlingStart. Wait for scrollTop to reach
+    // target_scroll_offset to make sure that ProgressFling has been called
+    // through FlingScheduler at least once.
+    while ((upward && scroll_top > target_scroll_offset) ||
+           (!upward && scroll_top < target_scroll_offset)) {
       GiveItSomeTime();
-      scroll_top = EvalJs(iframe_node->current_frame_host(), "window.scrollY")
+      scroll_top = EvalJs(frame_node->current_frame_host(), "window.scrollY")
                        .ExtractDouble();
     }
   }
 
+  FrameTreeNode* GetRootNode() {
+    return static_cast<WebContentsImpl*>(shell()->web_contents())
+        ->GetFrameTree()
+        ->root();
+  }
+
+  FrameTreeNode* GetChildNode() {
+    FrameTreeNode* root = GetRootNode();
+    return root->child_at(0);
+  }
+
   std::unique_ptr<base::RunLoop> run_loop_;
   RenderWidgetHostViewBase* child_view_ = nullptr;
   RenderWidgetHostViewBase* root_view_ = nullptr;
@@ -239,6 +279,10 @@
   DISALLOW_COPY_AND_ASSIGN(BrowserSideFlingBrowserTest);
 };
 
+// On Mac we don't have any touchscreen/touchpad fling events (GFS/GFC).
+// Instead, the OS keeps sending wheel events when the user lifts their fingers
+// from touchpad.
+#if !defined(OS_MACOSX)
 IN_PROC_BROWSER_TEST_F(BrowserSideFlingBrowserTest, TouchscreenFling) {
   LoadURL(kBrowserFlingDataURL);
   SimulateTouchscreenFling(GetWidgetHost());
@@ -257,8 +301,7 @@
   GURL first_url(embedded_test_server()->GetURL(
       "b.a.com", "/scrollable_page_with_iframe.html"));
   EXPECT_TRUE(NavigateToURL(shell(), first_url));
-  MainThreadFrameObserver main_thread_sync1(GetWidgetHost());
-  main_thread_sync1.Wait();
+  SynchronizeThreads();
   SimulateTouchscreenFling(GetWidgetHost());
   WaitForScroll();
 
@@ -266,8 +309,7 @@
   GURL second_url(
       embedded_test_server()->GetURL("a.com", "/scrollable_page.html"));
   NavigateToURL(shell(), second_url);
-  MainThreadFrameObserver main_thread_sync2(GetWidgetHost());
-  main_thread_sync2.Wait();
+  SynchronizeThreads();
 
   // Wait for 100ms. Then check that the second page has not scrolled.
   GiveItSomeTime(100);
@@ -281,23 +323,89 @@
 IN_PROC_BROWSER_TEST_F(BrowserSideFlingBrowserTest, TouchscreenFlingInOOPIF) {
   LoadPageWithOOPIF();
   SimulateTouchscreenFling(child_view_->host());
-  WaitForChildScroll();
+  WaitForFrameScroll(GetChildNode());
 }
 IN_PROC_BROWSER_TEST_F(BrowserSideFlingBrowserTest, TouchpadFlingInOOPIF) {
   LoadPageWithOOPIF();
-  SimulateTouchscreenFling(child_view_->host());
-  WaitForChildScroll();
+  SimulateTouchpadFling(child_view_->host());
+  WaitForFrameScroll(GetChildNode());
+}
+IN_PROC_BROWSER_TEST_F(BrowserSideFlingBrowserTest,
+                       TouchscreenFlingBubblesFromOOPIF) {
+  LoadPageWithOOPIF();
+  // Scroll the parent down so that it is scrollable upward.
+  EXPECT_TRUE(
+      ExecJs(GetRootNode()->current_frame_host(), "window.scrollTo(0, 20)"));
+  // We expect to have window.scrollY == 20 after scrolling but with zoom for
+  // dsf enabled on android we get window.scrollY == 19 (see
+  // https://crbug.com/891860).
+  WaitForFrameScroll(GetRootNode(), 19);
+  SynchronizeThreads();
+
+  // Fling and wait for the parent to scroll upward.
+  gfx::Vector2d fling_velocity(0, 2000);
+  SimulateTouchscreenFling(child_view_->host(), GetWidgetHost(),
+                           fling_velocity);
+  WaitForFrameScroll(GetRootNode(), 15, true /* upward */);
 }
 
-// Disabled on MacOS because it doesn't support touchscreen scroll.
-#if defined(OS_MACOSX)
-#define MAYBE_ScrollEndGeneratedForFilteredFling \
-  DISABLED_ScrollEndGeneratedForFilteredFling
-#else
+// Flaky, probably because of https://crbug.com/892656
+IN_PROC_BROWSER_TEST_F(BrowserSideFlingBrowserTest,
+                       DISABLED_TouchpadFlingBubblesFromOOPIF) {
+  LoadPageWithOOPIF();
+  // Scroll the parent down so that it is scrollable upward.
+  EXPECT_TRUE(
+      ExecJs(GetRootNode()->current_frame_host(), "window.scrollTo(0, 20)"));
+  // We expect to have window.scrollY == 20 after scrolling but with zoom for
+  // dsf enabled on android we get window.scrollY == 19 (see
+  // https://crbug.com/891860).
+  WaitForFrameScroll(GetRootNode(), 19);
+  SynchronizeThreads();
+
+  // Fling and wait for the parent to scroll upward.
+  gfx::Vector2d fling_velocity(0, 2000);
+  SimulateTouchpadFling(child_view_->host(), GetWidgetHost(), fling_velocity);
+  WaitForFrameScroll(GetRootNode(), 15, true /* upward */);
+}
+IN_PROC_BROWSER_TEST_F(BrowserSideFlingBrowserTest, GFCGetsBubbledFromOOPIF) {
+  LoadPageWithOOPIF();
+  // Scroll the parent down so that it is scrollable upward.
+  EXPECT_TRUE(
+      ExecJs(GetRootNode()->current_frame_host(), "window.scrollTo(0, 20)"));
+  // We expect to have window.scrollY == 20 after scrolling but with zoom for
+  // dsf enabled on android we get window.scrollY == 19 (see
+  // https://crbug.com/891860).
+  WaitForFrameScroll(GetRootNode(), 19);
+  SynchronizeThreads();
+
+  // Fling and wait for the parent to scroll upward.
+  gfx::Vector2d fling_velocity(0, 2000);
+  SimulateTouchscreenFling(child_view_->host(), GetWidgetHost(),
+                           fling_velocity);
+  WaitForFrameScroll(GetRootNode(), 15, true /* upward */);
+
+  // Send a GFC to the child and wait for it to get bubbled.
+  auto input_msg_watcher = std::make_unique<InputMsgWatcher>(
+      GetWidgetHost(), blink::WebInputEvent::kGestureFlingCancel);
+  blink::WebGestureEvent gesture_fling_cancel(
+      blink::WebGestureEvent::kGestureFlingCancel,
+      blink::WebInputEvent::kNoModifiers, ui::EventTimeForNow());
+  gesture_fling_cancel.SetSourceDevice(blink::kWebGestureDeviceTouchscreen);
+
+  const gfx::PointF location_in_widget(1, 1);
+  const gfx::PointF location_in_root =
+      child_view_->TransformPointToRootCoordSpaceF(location_in_widget);
+  const gfx::PointF location_in_screen =
+      location_in_root + root_view_->GetViewBounds().OffsetFromOrigin();
+  gesture_fling_cancel.SetPositionInWidget(location_in_widget);
+  gesture_fling_cancel.SetPositionInScreen(location_in_screen);
+  child_view_->host()->ForwardGestureEvent(gesture_fling_cancel);
+  input_msg_watcher->GetAckStateWaitIfNecessary();
+}
+
 // Flaky, see https://crbug.com/850455
 #define MAYBE_ScrollEndGeneratedForFilteredFling \
   DISABLED_ScrollEndGeneratedForFilteredFling
-#endif
 IN_PROC_BROWSER_TEST_F(BrowserSideFlingBrowserTest,
                        MAYBE_ScrollEndGeneratedForFilteredFling) {
   LoadURL(kTouchActionFilterDataURL);
@@ -348,5 +456,6 @@
   EXPECT_EQ(InputEventAckSource::BROWSER,
             scroll_end_watcher->last_event_ack_source());
 }
+#endif  // !defined(OS_MACOSX)
 
 }  // namespace content
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index 0a20b9c..89297c79 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc
@@ -2889,14 +2889,6 @@
 
   if (IsMainFrameBeforeActivationEnabled())
     command_line->AppendSwitch(cc::switches::kEnableMainFrameBeforeActivation);
-
-  // Slimming Paint v2 implies layer lists in the renderer.
-  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
-          switches::kEnableSlimmingPaintV2) ||
-      base::CommandLine::ForCurrentProcess()->HasSwitch(
-          switches::kEnableBlinkGenPropertyTrees)) {
-    command_line->AppendSwitch(cc::switches::kEnableLayerLists);
-  }
 }
 
 void RenderProcessHostImpl::AppendRendererCommandLine(
@@ -3091,7 +3083,6 @@
     cc::switches::kDisableCompositedAntialiasing,
     cc::switches::kDisableThreadedAnimation,
     cc::switches::kEnableGpuBenchmarking,
-    cc::switches::kEnableLayerLists,
     cc::switches::kShowCompositedLayerBorders,
     cc::switches::kShowFPSCounter,
     cc::switches::kShowLayerAnimationBounds,
diff --git a/content/browser/renderer_host/render_widget_host_view_aura.cc b/content/browser/renderer_host/render_widget_host_view_aura.cc
index 930b778c..ea95194 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura.cc
+++ b/content/browser/renderer_host/render_widget_host_view_aura.cc
@@ -665,13 +665,6 @@
   bool has_saved_frame =
       delegated_frame_host_ ? delegated_frame_host_->HasSavedFrame() : false;
 
-  // If the primary surface was evicted, we should create a new primary.
-  if (delegated_frame_host_ &&
-      delegated_frame_host_->IsPrimarySurfaceEvicted()) {
-    SynchronizeVisualProperties(cc::DeadlinePolicy::UseDefaultDeadline(),
-                                base::nullopt);
-  }
-
   const bool renderer_should_record_presentation_time = !has_saved_frame;
   host()->WasShown(renderer_should_record_presentation_time);
 
@@ -2588,4 +2581,8 @@
   host()->GetContentRenderingTimeoutFrom(view_aura->host());
 }
 
+void RenderWidgetHostViewAura::WasEvicted() {
+  window_->UpdateLocalSurfaceIdFromEmbeddedClient(base::nullopt);
+}
+
 }  // namespace content
diff --git a/content/browser/renderer_host/render_widget_host_view_aura.h b/content/browser/renderer_host/render_widget_host_view_aura.h
index cfb4918a..bb7dd0c 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura.h
+++ b/content/browser/renderer_host/render_widget_host_view_aura.h
@@ -555,6 +555,8 @@
   // Called when the window title is changed.
   void WindowTitleChanged();
 
+  void WasEvicted();
+
   const bool is_mus_browser_plugin_guest_;
 
   // NOTE: this is null if |is_mus_browser_plugin_guest_| is true.
diff --git a/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc b/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc
index 7b1c39a..55946bf 100644
--- a/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc
+++ b/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc
@@ -3404,35 +3404,6 @@
   view_->RunOnCompositingDidCommit();
 }
 
-// This test verifies that if a fallback surface activates on a hidden view
-// then the fallback is dropped.
-TEST_F(RenderWidgetHostViewAuraSurfaceSynchronizationTest,
-       DropFallbackWhenHidden) {
-  // Early out because DelegatedFrameHost is not used in mash.
-  if (features::IsMultiProcessMash())
-    return;
-
-  view_->InitAsChild(nullptr);
-  aura::client::ParentWindowWithContext(
-      view_->GetNativeView(), parent_view_->GetNativeView()->GetRootWindow(),
-      gfx::Rect());
-
-  view_->window_->layer()->SetShowSolidColorContent();
-  EXPECT_FALSE(view_->HasPrimarySurface());
-  ASSERT_TRUE(view_->delegated_frame_host_);
-
-  view_->Hide();
-  view_->SetSize(gfx::Size(300, 300));
-  EXPECT_FALSE(view_->HasPrimarySurface());
-
-  // Submitting a CompositorFrame should not update the fallback SurfaceId
-  viz::SurfaceId surface_id(view_->GetFrameSinkId(), kArbitraryLocalSurfaceId);
-  view_->delegated_frame_host_->OnFirstSurfaceActivation(
-      viz::SurfaceInfo(surface_id, 1.f, gfx::Size(400, 400)));
-  EXPECT_FALSE(view_->HasPrimarySurface());
-  EXPECT_FALSE(view_->HasFallbackSurface());
-}
-
 // This test verifies that the primary SurfaceId is populated on resize.
 TEST_F(RenderWidgetHostViewAuraSurfaceSynchronizationTest, SurfaceChanges) {
   // Early out because DelegatedFrameHost is not used in mash.
@@ -3526,14 +3497,15 @@
   if (features::IsMultiProcessMash())
     return;
 
-  view_->InitAsChild(nullptr);
+  // Make sure |parent_view_| is evicted to avoid interfering with the code
+  // below.
+  parent_view_->delegated_frame_host_->EvictDelegatedFrame();
 
   size_t max_renderer_frames =
       FrameEvictionManager::GetInstance()->GetMaxNumberOfSavedFrames();
   ASSERT_LE(2u, max_renderer_frames);
   size_t renderer_count = max_renderer_frames + 1;
   gfx::Rect view_rect(100, 100);
-  gfx::Size frame_size = view_rect.size();
 
   std::unique_ptr<RenderWidgetHostImpl* []> hosts(
       new RenderWidgetHostImpl*[renderer_count]);
@@ -3558,19 +3530,12 @@
         views[i]->GetNativeView(),
         parent_view_->GetNativeView()->GetRootWindow(), gfx::Rect());
     views[i]->SetSize(view_rect.size());
-    ASSERT_TRUE(views[i]->HasPrimarySurface());
-    ASSERT_FALSE(views[i]->HasSavedFrame());
+    EXPECT_HAS_FRAME(views[i]);
   }
 
   // Make each renderer visible, and swap a frame on it, then make it invisible.
   for (size_t i = 0; i < renderer_count; ++i) {
     views[i]->Show();
-    ASSERT_TRUE(views[i]->HasPrimarySurface());
-    ASSERT_FALSE(views[i]->HasSavedFrame());
-    viz::SurfaceId surface_id(views[i]->GetFrameSinkId(),
-                              views[i]->GetLocalSurfaceId());
-    views[i]->delegated_frame_host_->OnFirstSurfaceActivation(
-        viz::SurfaceInfo(surface_id, 1.f, frame_size));
     EXPECT_HAS_FRAME(views[i]);
     views[i]->Hide();
   }
@@ -3581,17 +3546,8 @@
   for (size_t i = 1; i < renderer_count; ++i)
     EXPECT_HAS_FRAME(views[i]);
 
-  // LRU renderer is [0], make it visible, it shouldn't evict anything yet.
+  // LRU renderer is [0], make it visible, it should evict the next LRU [1].
   views[0]->Show();
-  EXPECT_TRUE(views[0]->HasPrimarySurface());
-  EXPECT_FALSE(views[0]->HasSavedFrame());
-  EXPECT_HAS_FRAME(views[1]);
-
-  // Swap a frame on it, it should evict the next LRU [1].
-  viz::SurfaceId surface_id0(views[0]->GetFrameSinkId(),
-                             views[0]->GetLocalSurfaceId());
-  views[0]->delegated_frame_host_->OnFirstSurfaceActivation(
-      viz::SurfaceInfo(surface_id0, 1.f, frame_size));
   EXPECT_HAS_FRAME(views[0]);
   EXPECT_EVICTED(views[1]);
   views[0]->Hide();
@@ -3599,10 +3555,6 @@
   // LRU renderer is [1], which is still hidden. Showing it and submitting a
   // CompositorFrame to it should evict the next LRU [2].
   views[1]->Show();
-  viz::SurfaceId surface_id1(views[1]->GetFrameSinkId(),
-                             views[1]->GetLocalSurfaceId());
-  views[1]->delegated_frame_host_->OnFirstSurfaceActivation(
-      viz::SurfaceInfo(surface_id1, 1.f, frame_size));
   EXPECT_HAS_FRAME(views[0]);
   EXPECT_HAS_FRAME(views[1]);
   EXPECT_EVICTED(views[2]);
@@ -3613,26 +3565,13 @@
   // hidden, it becomes the LRU.
   for (size_t i = 1; i < renderer_count; ++i) {
     views[i]->Show();
-    // The renderers who don't have a frame should be waiting. The ones that
-    // have a frame should not.
-    viz::SurfaceId surface_id(views[i]->GetFrameSinkId(),
-                              views[i]->GetLocalSurfaceId());
-    views[i]->delegated_frame_host_->OnFirstSurfaceActivation(
-        viz::SurfaceInfo(surface_id, 1.f, frame_size));
     EXPECT_HAS_FRAME(views[i]);
   }
   EXPECT_EVICTED(views[0]);
 
-  // Swap a frame on [0], it should be evicted immediately.
-  views[0]->delegated_frame_host_->OnFirstSurfaceActivation(
-      viz::SurfaceInfo(surface_id0, 1.f, frame_size));
-  EXPECT_EVICTED(views[0]);
-
   // Make [0] visible, and swap a frame on it. Nothing should be evicted
   // although we're above the limit.
   views[0]->Show();
-  views[0]->delegated_frame_host_->OnFirstSurfaceActivation(
-      viz::SurfaceInfo(surface_id0, 1.f, frame_size));
   for (size_t i = 0; i < renderer_count; ++i)
     EXPECT_HAS_FRAME(views[i]);
 
@@ -3654,8 +3593,6 @@
   ASSERT_TRUE(views[1]->window_->layer()->GetFallbackSurfaceId());
   EXPECT_EQ(*views[1]->window_->layer()->GetFallbackSurfaceId(),
             *views[1]->window_->layer()->GetPrimarySurfaceId());
-  views[1]->delegated_frame_host_->OnFirstSurfaceActivation(
-      viz::SurfaceInfo(surface_id1, 1.f, frame_size));
 
   for (size_t i = 0; i < renderer_count; ++i) {
     views[i]->Destroy();
@@ -3742,7 +3679,9 @@
   if (features::IsMultiProcessMash())
     return;
 
-  view_->InitAsChild(nullptr);
+  // Make sure |parent_view_| is evicted to avoid interfering with the code
+  // below.
+  parent_view_->delegated_frame_host_->EvictDelegatedFrame();
 
   // The test logic below relies on having max_renderer_frames > 2.  By default,
   // this value is calculated from total physical memory and causes the test to
@@ -3753,7 +3692,6 @@
 
   size_t renderer_count = kMaxRendererFrames;
   gfx::Rect view_rect(100, 100);
-  gfx::Size frame_size = view_rect.size();
 
   std::unique_ptr<RenderWidgetHostImpl* []> hosts(
       new RenderWidgetHostImpl*[renderer_count]);
@@ -3776,16 +3714,7 @@
         parent_view_->GetNativeView()->GetRootWindow(),
         gfx::Rect());
     views[i]->SetSize(view_rect.size());
-  }
-
-  // Make each renderer visible and swap a frame on it. No eviction should
-  // occur because all frames are visible.
-  for (size_t i = 0; i < renderer_count; ++i) {
     views[i]->Show();
-    viz::SurfaceId surface_id(views[i]->GetFrameSinkId(),
-                              kArbitraryLocalSurfaceId);
-    views[i]->delegated_frame_host_->OnFirstSurfaceActivation(
-        viz::SurfaceInfo(surface_id, 1.f, frame_size));
     EXPECT_HAS_FRAME(views[i]);
   }
 
diff --git a/content/browser/renderer_host/render_widget_host_view_mac.mm b/content/browser/renderer_host/render_widget_host_view_mac.mm
index 42b0f9d..8a0f424 100644
--- a/content/browser/renderer_host/render_widget_host_view_mac.mm
+++ b/content/browser/renderer_host/render_widget_host_view_mac.mm
@@ -439,10 +439,6 @@
   bool has_saved_frame =
       delegated_frame_host ? delegated_frame_host->HasSavedFrame() : false;
 
-  // If the primary surface was evicted, we should create a new primary.
-  if (delegated_frame_host && delegated_frame_host->IsPrimarySurfaceEvicted())
-    SynchronizeVisualProperties(base::nullopt);
-
   const bool renderer_should_record_presentation_time = !has_saved_frame;
   host()->WasShown(renderer_should_record_presentation_time);
 
diff --git a/content/browser/service_manager/OWNERS b/content/browser/service_manager/OWNERS
index 04185281..87df16da 100644
--- a/content/browser/service_manager/OWNERS
+++ b/content/browser/service_manager/OWNERS
@@ -1,2 +1,2 @@
 ben@chromium.org
-rockot@chromium.org
+rockot@google.com
diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.cc
index 91f5b69..6d2d84b 100644
--- a/content/child/runtime_features.cc
+++ b/content/child/runtime_features.cc
@@ -255,8 +255,9 @@
       "BlinkGenPropertyTrees",
       command_line.HasSwitch(switches::kEnableBlinkGenPropertyTrees));
 
-  if (command_line.HasSwitch(switches::kEnableSlimmingPaintV2))
-    WebRuntimeFeatures::EnableSlimmingPaintV2(true);
+  WebRuntimeFeatures::EnableFeatureFromString(
+      "SlimmingPaintV2",
+      command_line.HasSwitch(switches::kEnableSlimmingPaintV2));
 
   WebRuntimeFeatures::EnablePassiveDocumentEventListeners(
       base::FeatureList::IsEnabled(features::kPassiveDocumentEventListeners));
diff --git a/content/common/service_manager/OWNERS b/content/common/service_manager/OWNERS
index 3f76ba38..361b230 100644
--- a/content/common/service_manager/OWNERS
+++ b/content/common/service_manager/OWNERS
@@ -1,5 +1,5 @@
 ben@chromium.org
-rockot@chromium.org
+rockot@google.com
 
 per-file *_messages*.h=set noparent
 per-file *_messages*.h=file://ipc/SECURITY_OWNERS
diff --git a/content/public/android/BUILD.gn b/content/public/android/BUILD.gn
index 0420191..04b83261 100644
--- a/content/public/android/BUILD.gn
+++ b/content/public/android/BUILD.gn
@@ -103,6 +103,8 @@
     "java/src/org/chromium/content/app/PrivilegedProcessService0.java",
     "java/src/org/chromium/content/app/PrivilegedProcessService1.java",
     "java/src/org/chromium/content/app/PrivilegedProcessService2.java",
+    "java/src/org/chromium/content/app/PrivilegedProcessService3.java",
+    "java/src/org/chromium/content/app/PrivilegedProcessService4.java",
     "java/src/org/chromium/content/app/SandboxedProcessService.java",
     "java/src/org/chromium/content/browser/AppWebMessagePort.java",
     "java/src/org/chromium/content/browser/AudioFocusDelegate.java",
diff --git a/content/public/android/java/src/org/chromium/content/app/PrivilegedProcessService0.java b/content/public/android/java/src/org/chromium/content/app/PrivilegedProcessService0.java
index a3c9c5b8..8c54a6b 100644
--- a/content/public/android/java/src/org/chromium/content/app/PrivilegedProcessService0.java
+++ b/content/public/android/java/src/org/chromium/content/app/PrivilegedProcessService0.java
@@ -6,7 +6,7 @@
 
 /**
  * This is needed to register multiple PrivilegedProcess services so that we can have
- * more than one sandboxed process.
+ * more than one unsandboxed process.
  */
 public class PrivilegedProcessService0 extends PrivilegedProcessService {
 
diff --git a/content/public/android/java/src/org/chromium/content/app/PrivilegedProcessService1.java b/content/public/android/java/src/org/chromium/content/app/PrivilegedProcessService1.java
index bd16f07..95239a2c 100644
--- a/content/public/android/java/src/org/chromium/content/app/PrivilegedProcessService1.java
+++ b/content/public/android/java/src/org/chromium/content/app/PrivilegedProcessService1.java
@@ -6,7 +6,7 @@
 
 /**
  * This is needed to register multiple PrivilegedProcess services so that we can have
- * more than one sandboxed process.
+ * more than one unsandboxed process.
  */
 public class PrivilegedProcessService1 extends PrivilegedProcessService {
 
diff --git a/content/public/android/java/src/org/chromium/content/app/PrivilegedProcessService2.java b/content/public/android/java/src/org/chromium/content/app/PrivilegedProcessService2.java
index 3f40406..dadfb1c 100644
--- a/content/public/android/java/src/org/chromium/content/app/PrivilegedProcessService2.java
+++ b/content/public/android/java/src/org/chromium/content/app/PrivilegedProcessService2.java
@@ -6,7 +6,7 @@
 
 /**
  * This is needed to register multiple PrivilegedProcess services so that we can have
- * more than one sandboxed process.
+ * more than one unsandboxed process.
  */
 public class PrivilegedProcessService2 extends PrivilegedProcessService {
 
diff --git a/content/public/android/java/src/org/chromium/content/app/PrivilegedProcessService3.java b/content/public/android/java/src/org/chromium/content/app/PrivilegedProcessService3.java
new file mode 100644
index 0000000..1105301
--- /dev/null
+++ b/content/public/android/java/src/org/chromium/content/app/PrivilegedProcessService3.java
@@ -0,0 +1,11 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.content.app;
+
+/**
+ * This is needed to register multiple PrivilegedProcess services so that we can have
+ * more than one unsandboxed process.
+ */
+public class PrivilegedProcessService3 extends PrivilegedProcessService {}
diff --git a/content/public/android/java/src/org/chromium/content/app/PrivilegedProcessService4.java b/content/public/android/java/src/org/chromium/content/app/PrivilegedProcessService4.java
new file mode 100644
index 0000000..28b09eb8
--- /dev/null
+++ b/content/public/android/java/src/org/chromium/content/app/PrivilegedProcessService4.java
@@ -0,0 +1,11 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.content.app;
+
+/**
+ * This is needed to register multiple PrivilegedProcess services so that we can have
+ * more than one unsandboxed process.
+ */
+public class PrivilegedProcessService4 extends PrivilegedProcessService {}
diff --git a/content/public/app/OWNERS b/content/public/app/OWNERS
index 92c84d9e..16d9656f 100644
--- a/content/public/app/OWNERS
+++ b/content/public/app/OWNERS
@@ -1,2 +1,2 @@
 jcivelli@chromium.org
-rockot@chromium.org
+rockot@google.com
diff --git a/content/public/common/content_switches.cc b/content/public/common/content_switches.cc
index 5b08a5e..57c7561 100644
--- a/content/public/common/content_switches.cc
+++ b/content/public/common/content_switches.cc
@@ -324,8 +324,8 @@
 // features.
 const char kEnableBlinkFeatures[]           = "enable-blink-features";
 
-// A shorthand for adding both "--enable-blink-features=BlinkGenPropertyTrees"
-// and "--enable-layer-lists".
+// This is now an alias of "--enable-blink-features=BlinkGenPropertyTrees".
+// TODO(pdr): This flag is redundant and should be removed.
 const char kEnableBlinkGenPropertyTrees[] = "enable-blink-gen-property-trees";
 
 // Enables Web Platform features that are in development.
@@ -392,6 +392,8 @@
 const char kEnableSkiaBenchmarking[]        = "enable-skia-benchmarking";
 
 // Enables slimming paint phase 2: https://www.chromium.org/blink/slimming-paint
+// This is now an alias of "--enable-blink-features=SlimmingPaintV2".
+// TODO(pdr): This flag is redundant should be removed.
 const char kEnableSlimmingPaintV2[]         = "enable-slimming-paint-v2";
 
 // On platforms that support it, enables smooth scroll animation.
diff --git a/content/public/common/url_utils.cc b/content/public/common/url_utils.cc
index b0a993802..ef98675 100644
--- a/content/public/common/url_utils.cc
+++ b/content/public/common/url_utils.cc
@@ -115,7 +115,7 @@
   static base::NoDestructor<std::set<std::string>> kUnsafeSchemes(
       std::set<std::string>({
         url::kAboutScheme, url::kDataScheme, url::kFileScheme,
-            url::kFileSystemScheme,
+            url::kFileSystemScheme, url::kBlobScheme,
 #if defined(OS_ANDROID)
             url::kContentScheme,
 #endif
diff --git a/content/public/common/url_utils_unittest.cc b/content/public/common/url_utils_unittest.cc
index 30d08f0..cadd6f2 100644
--- a/content/public/common/url_utils_unittest.cc
+++ b/content/public/common/url_utils_unittest.cc
@@ -43,6 +43,8 @@
       GURL(), CreateValidURL("filesystem:http://foo.com/bar")));
   EXPECT_FALSE(
       IsSafeRedirectTarget(GURL(), CreateValidURL("data:text/plain,foo")));
+  EXPECT_FALSE(
+      IsSafeRedirectTarget(GURL(), CreateValidURL("blob:https://foo.com/bar")));
 #if defined(OS_ANDROID)
   EXPECT_FALSE(
       IsSafeRedirectTarget(GURL(), CreateValidURL("content://foo.bar")));
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 08cf1c5a..c54c3a7 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -6070,42 +6070,6 @@
   // See http://crbug.com/93517.
   GURL old_url(frame_->GetDocumentLoader()->GetRequest().Url());
 
-  // Detect when a page is "forking" a new tab that can be safely rendered in
-  // its own process.  This is done by sites like Gmail that try to open links
-  // in new windows without script connections back to the original page.  We
-  // treat such cases as browser navigations (in which we will create a new
-  // renderer for a cross-site navigation), rather than WebKit navigations.
-  //
-  // We use the following heuristic to decide whether to fork a new page in its
-  // own process:
-  // The parent page must open a new tab to about:blank, set the new tab's
-  // window.opener to null, and then redirect the tab to a cross-site URL using
-  // JavaScript.
-  //
-  // TODO(creis): Deprecate this logic once we can rely on rel=noreferrer
-  // (see below).
-  bool is_fork =
-      // Must start from a tab showing about:blank, which is later redirected.
-      old_url == url::kAboutBlankURL &&
-      // Must be the first real navigation of the tab.
-      render_view_->HistoryBackListCount() < 1 &&
-      render_view_->HistoryForwardListCount() < 1 &&
-      // The parent page must have set the child's window.opener to null before
-      // redirecting to the desired URL.
-      frame_->Opener() == nullptr &&
-      // Must be a top-level frame.
-      frame_->Parent() == nullptr &&
-      // Must be targeted at the current tab.
-      info.default_policy == blink::kWebNavigationPolicyCurrentTab &&
-      // Must be a JavaScript navigation, which appears as "other".
-      info.navigation_type == blink::kWebNavigationTypeOther;
-
-  if (is_fork) {
-    // Open the URL via the browser, not via WebKit.
-    OpenURL(info, /*is_history_navigation_in_new_child=*/false);
-    return blink::kWebNavigationPolicyIgnore;
-  }
-
   // Detect when we're crossing a permission-based boundary (e.g. into or out of
   // an extension or app origin, leaving a WebUI page, etc). We only care about
   // top-level navigations (not iframes). But we sometimes navigate to
diff --git a/content/renderer/render_thread_impl.cc b/content/renderer/render_thread_impl.cc
index de0776e0..ef73edd 100644
--- a/content/renderer/render_thread_impl.cc
+++ b/content/renderer/render_thread_impl.cc
@@ -1346,7 +1346,7 @@
   enable_video_gpu_memory_buffers =
       enable_video_gpu_memory_buffers &&
       (cmd_line->HasSwitch(switches::kEnableGpuMemoryBufferVideoFrames) ||
-       gpu_channel_host->gpu_info().supports_overlays);
+       gpu_channel_host->gpu_info().direct_composition_overlays);
 #endif  // defined(OS_WIN)
 
   media::mojom::InterfaceFactoryPtr interface_factory;
diff --git a/content/renderer/render_widget.cc b/content/renderer/render_widget.cc
index 9351c2c..5e436ad 100644
--- a/content/renderer/render_widget.cc
+++ b/content/renderer/render_widget.cc
@@ -2621,7 +2621,11 @@
       settings.top_controls_hide_threshold = hide_threshold;
   }
 
-  settings.use_layer_lists = cmd.HasSwitch(cc::switches::kEnableLayerLists);
+  // Blink sends cc a layer list and property trees when either Blink Gen
+  // Property Trees or Slimming Paint V2 are enabled.
+  settings.use_layer_lists =
+      blink::WebRuntimeFeatures::IsBlinkGenPropertyTreesEnabled() ||
+      blink::WebRuntimeFeatures::IsSlimmingPaintV2Enabled();
 
   // The means the renderer compositor has 2 possible modes:
   // - Threaded compositing with a scheduler.
diff --git a/content/shell/android/browsertests_apk/AndroidManifest.xml.jinja2 b/content/shell/android/browsertests_apk/AndroidManifest.xml.jinja2
index 03ae460c3..6d0a041 100644
--- a/content/shell/android/browsertests_apk/AndroidManifest.xml.jinja2
+++ b/content/shell/android/browsertests_apk/AndroidManifest.xml.jinja2
@@ -48,7 +48,7 @@
                  android:exported="false" />
         {% endfor %}
 
-        {% set num_privileged_services = 3 %}
+        {% set num_privileged_services = 5 %}
         <meta-data android:name="org.chromium.content.browser.NUM_PRIVILEGED_SERVICES"
                    android:value="{{ num_privileged_services }}"/>
         {% for i in range(num_privileged_services) %}
diff --git a/content/shell/android/linker_test_apk/AndroidManifest.xml.jinja2 b/content/shell/android/linker_test_apk/AndroidManifest.xml.jinja2
index ff62248..cbb809b 100644
--- a/content/shell/android/linker_test_apk/AndroidManifest.xml.jinja2
+++ b/content/shell/android/linker_test_apk/AndroidManifest.xml.jinja2
@@ -47,7 +47,7 @@
                  android:exported="false" />
         {% endfor %}
 
-        {% set num_privileged_services = 3 %}
+        {% set num_privileged_services = 5 %}
         <meta-data android:name="org.chromium.content.browser.NUM_PRIVILEGED_SERVICES"
                    android:value="{{ num_privileged_services }}"/>
         {% for i in range(num_privileged_services) %}
diff --git a/content/shell/android/shell_apk/AndroidManifest.xml.jinja2 b/content/shell/android/shell_apk/AndroidManifest.xml.jinja2
index 9921a77..e7fc25d8 100644
--- a/content/shell/android/shell_apk/AndroidManifest.xml.jinja2
+++ b/content/shell/android/shell_apk/AndroidManifest.xml.jinja2
@@ -56,7 +56,7 @@
                  android:exported="false" />
         {% endfor %}
 
-        {% set num_privileged_services = 3 %}
+        {% set num_privileged_services = 5 %}
         <meta-data android:name="org.chromium.content.browser.NUM_PRIVILEGED_SERVICES"
                    android:value="{{ num_privileged_services }}"/>
         {% for i in range(num_privileged_services) %}
diff --git a/content/test/data/fork-popup.html b/content/test/data/fork-popup.html
deleted file mode 100644
index ccc9268..0000000
--- a/content/test/data/fork-popup.html
+++ /dev/null
@@ -1,8 +0,0 @@
-<!doctype html>
-<script>
-let win = window.open('', '_blank', '');
-win.opener = null;
-win.document.write('<META HTTP-EQUIV="refresh" content="0; url=' + location.origin + '/echo-referrer.html">')
-win.document.close();
-</script>
-
diff --git a/content/test/gpu/gpu_tests/context_lost_expectations.py b/content/test/gpu/gpu_tests/context_lost_expectations.py
index cbcf163..988dfc33 100644
--- a/content/test/gpu/gpu_tests/context_lost_expectations.py
+++ b/content/test/gpu/gpu_tests/context_lost_expectations.py
@@ -69,6 +69,6 @@
     self.Fail('ContextLost_WebGLContextLostFromQuantity',
               ['android', ('qualcomm', 'Adreno (TM) 420')], bug=611906)
 
-    # Temporary until Ganesh fix is made.
-    self.Flaky('GpuCrash_GPUProcessCrashesExactlyOncePerVisitToAboutGpuCrash',
-               ['win', 'nvidia'], bug=878258)
+    # Temporary until Ganesh fix is made. Too flaky to mark as flaky.
+    self.Fail('GpuCrash_GPUProcessCrashesExactlyOncePerVisitToAboutGpuCrash',
+               ['win'], bug=878258)
diff --git a/device/OWNERS b/device/OWNERS
index 2d21256..a0f1773 100644
--- a/device/OWNERS
+++ b/device/OWNERS
@@ -1,5 +1,5 @@
 reillyg@chromium.org
-rockot@chromium.org
+rockot@google.com
 
 per-file BUILD.gn=*
 
diff --git a/device/usb/OWNERS b/device/usb/OWNERS
index b78b7788..a855859 100644
--- a/device/usb/OWNERS
+++ b/device/usb/OWNERS
@@ -1,5 +1,5 @@
 pfeldman@chromium.org
 reillyg@chromium.org
-rockot@chromium.org
+rockot@google.com
 
 # COMPONENT: IO>USB
diff --git a/docs/android_build_instructions.md b/docs/android_build_instructions.md
index b08cdcc..88ba48c4 100644
--- a/docs/android_build_instructions.md
+++ b/docs/android_build_instructions.md
@@ -326,11 +326,23 @@
 
 ### Faster Edit/Deploy
 
+#### GN Args
+Args that affect build speed:
+ * `is_component_build = true` *(default=`is_debug`)*
+   * What it does: Uses multiple `.so` files instead of just one (faster links)
+ * `is_java_debug = true` *(default=`is_debug`)*
+   * What it does: Disables ProGuard (slow build step)
+ * `enable_incremental_javac = true` *(default=`false`)*
+   * What it does: Tries to compile only a subset of `.java` files within an
+     `android_library` for subsequent builds.
+   * Can cause infrequent (once a month-ish) failures due to not recompiling a
+     class that should be recompiled.
+
+#### Incremental Install
 "Incremental install" uses reflection and side-loading to speed up the edit
 & deploy cycle (normally < 10 seconds). The initial launch of the apk will be
 a little slower since updated dex files are installed manually.
 
-*   Make sure to set` is_component_build = true `in your GN args
 *   All apk targets have \*`_incremental` targets defined (e.g.
     `chrome_public_apk_incremental`) except for Webview and Monochrome
 
diff --git a/extensions/OWNERS b/extensions/OWNERS
index 37b23d25c..cd397e63 100644
--- a/extensions/OWNERS
+++ b/extensions/OWNERS
@@ -13,7 +13,7 @@
 lazyboy@chromium.org
 karandeepb@chromium.org
 benwells@chromium.org
-rockot@chromium.org
+rockot@google.com
 finnur@chromium.org
 reillyg@chromium.org
 
diff --git a/extensions/browser/OWNERS b/extensions/browser/OWNERS
index 92497eb..c21998b 100644
--- a/extensions/browser/OWNERS
+++ b/extensions/browser/OWNERS
@@ -2,7 +2,7 @@
 per-file DEPS=set noparent
 per-file DEPS=benwells@chromium.org
 per-file DEPS=derat@chromium.org
-per-file DEPS=rockot@chromium.org
+per-file DEPS=rockot@google.com
 per-file DEPS=rdevlin.cronin@chromium.org
 
 per-file extension_event_histogram_value.h=set noparent
diff --git a/extensions/browser/api/hid/OWNERS b/extensions/browser/api/hid/OWNERS
index 7127185..6279377 100644
--- a/extensions/browser/api/hid/OWNERS
+++ b/extensions/browser/api/hid/OWNERS
@@ -1,4 +1,4 @@
 reillyg@chromium.org
-rockot@chromium.org
+rockot@google.com
 
 # COMPONENT: Platform>Extensions>API
\ No newline at end of file
diff --git a/extensions/browser/api/serial/OWNERS b/extensions/browser/api/serial/OWNERS
index 7127185..6279377 100644
--- a/extensions/browser/api/serial/OWNERS
+++ b/extensions/browser/api/serial/OWNERS
@@ -1,4 +1,4 @@
 reillyg@chromium.org
-rockot@chromium.org
+rockot@google.com
 
 # COMPONENT: Platform>Extensions>API
\ No newline at end of file
diff --git a/extensions/browser/api/socket/OWNERS b/extensions/browser/api/socket/OWNERS
index 449b4e4..1308dff 100644
--- a/extensions/browser/api/socket/OWNERS
+++ b/extensions/browser/api/socket/OWNERS
@@ -1,5 +1,5 @@
 # Username must start with r
 reillyg@chromium.org
-rockot@chromium.org
+rockot@google.com
 
 # COMPONENT: Platform>Extensions>API
\ No newline at end of file
diff --git a/extensions/browser/api/usb/OWNERS b/extensions/browser/api/usb/OWNERS
index da5eeae7..ea94ee08 100644
--- a/extensions/browser/api/usb/OWNERS
+++ b/extensions/browser/api/usb/OWNERS
@@ -1,6 +1,6 @@
 # USB API members. For core API change, check with owners in
 # chrome/browser/extensions/OWNERS
 reillyg@chromium.org
-rockot@chromium.org
+rockot@google.com
 
 # COMPONENT: Platform>Extensions>API
\ No newline at end of file
diff --git a/extensions/browser/guest_view/web_view/web_view_guest.cc b/extensions/browser/guest_view/web_view/web_view_guest.cc
index 3f156db5..b5b600c6 100644
--- a/extensions/browser/guest_view/web_view/web_view_guest.cc
+++ b/extensions/browser/guest_view/web_view/web_view_guest.cc
@@ -868,6 +868,15 @@
 
 void WebViewGuest::DidStartNavigation(
     content::NavigationHandle* navigation_handle) {
+  WebViewGuest* opener = GetOpener();
+  if (opener && navigation_handle->IsInMainFrame()) {
+    auto it = opener->pending_new_windows_.find(this);
+    if (it != opener->pending_new_windows_.end()) {
+      NewWindowInfo& info = it->second;
+      info.did_start_navigating_away_from_initial_url = true;
+    }
+  }
+
   // loadStart shouldn't be sent for same document navigations.
   if (navigation_handle->IsSameDocument())
     return;
@@ -1147,8 +1156,11 @@
     auto it = opener->pending_new_windows_.find(this);
     if (it != opener->pending_new_windows_.end()) {
       const NewWindowInfo& new_window_info = it->second;
-      if (new_window_info.changed || !web_contents()->HasOpener())
+      if (!new_window_info.did_start_navigating_away_from_initial_url &&
+          (new_window_info.url_changed_via_open_url ||
+           !web_contents()->HasOpener())) {
         NavigateGuest(new_window_info.url.spec(), false /* force_navigation */);
+      }
 
       // Once a new guest is attached to the DOM of the embedder page, then the
       // lifetime of the new guest is no longer managed by the opener guest.
@@ -1324,7 +1336,8 @@
         return nullptr;
       const NewWindowInfo& info = it->second;
       NewWindowInfo new_window_info(params.url, info.name);
-      new_window_info.changed = new_window_info.url != info.url;
+      new_window_info.url_changed_via_open_url =
+          new_window_info.url != info.url;
       it->second = new_window_info;
       return nullptr;
     }
diff --git a/extensions/browser/guest_view/web_view/web_view_guest.h b/extensions/browser/guest_view/web_view/web_view_guest.h
index 343f162..ec746a4 100644
--- a/extensions/browser/guest_view/web_view/web_view_guest.h
+++ b/extensions/browser/guest_view/web_view/web_view_guest.h
@@ -345,13 +345,27 @@
   // Tracks the name, and target URL of the new window. Once the first
   // navigation commits, we no longer track this information.
   struct NewWindowInfo {
-    GURL url;
+    // Name of the new window.
     std::string name;
-    bool changed;
-    NewWindowInfo(const GURL& url, const std::string& name) :
-        url(url),
-        name(name),
-        changed(false) {}
+
+    // Expected initial URL of the new window.
+    GURL url;
+
+    // Whether OpenURL navigation from the newly created GuestView has changed
+    // |url|. The pending OpenURL navigation needs to be applied after attaching
+    // the GuestView.
+    bool url_changed_via_open_url;
+
+    // Whether the newly created GuestView begun navigating away from the
+    // initial URL.  Used to suppress the initial navigation when attaching the
+    // GuestView and applying its attributes.
+    bool did_start_navigating_away_from_initial_url;
+
+    NewWindowInfo(const GURL& url, const std::string& name)
+        : name(name),
+          url(url),
+          url_changed_via_open_url(false),
+          did_start_navigating_away_from_initial_url(false) {}
   };
 
   using PendingWindowMap = std::map<WebViewGuest*, NewWindowInfo>;
diff --git a/extensions/common/manifest_constants.cc b/extensions/common/manifest_constants.cc
index 03f95a5..96e17e58 100644
--- a/extensions/common/manifest_constants.cc
+++ b/extensions/common/manifest_constants.cc
@@ -720,8 +720,8 @@
 const char kOneUISurfaceOnly[] =
     "Only one of 'browser_action', 'page_action', and 'app' can be specified.";
 const char kPermissionMarkedOptionalAndRequired[] =
-    "Permission '*' cannot be specified as both required and optional in the "
-    "manifest; this permission will be treated as required.";
+    "Optional permission '*' is redundant with the required permissions;"
+    "this permission will be omitted.";
 const char kPermissionMustBeOptional[] =
     "Permission '*' must be specified in the optional section of the manifest.";
 const char kPermissionNotAllowed[] =
diff --git a/extensions/common/manifest_handlers/permissions_parser.cc b/extensions/common/manifest_handlers/permissions_parser.cc
index 69c71c7..047d7ee 100644
--- a/extensions/common/manifest_handlers/permissions_parser.cc
+++ b/extensions/common/manifest_handlers/permissions_parser.cc
@@ -243,6 +243,67 @@
   return true;
 }
 
+void RemoveOverlappingAPIPermissions(
+    Extension* extension,
+    const APIPermissionSet& required_api_permissions,
+    APIPermissionSet* optional_api_permissions) {
+  APIPermissionSet overlapping_api_permissions;
+  APIPermissionSet::Intersection(required_api_permissions,
+                                 *optional_api_permissions,
+                                 &overlapping_api_permissions);
+
+  if (overlapping_api_permissions.empty())
+    return;
+
+  std::vector<InstallWarning> install_warnings;
+  install_warnings.reserve(overlapping_api_permissions.size());
+
+  for (const auto* api_permission : overlapping_api_permissions) {
+    install_warnings.emplace_back(
+        ErrorUtils::FormatErrorMessage(
+            manifest_errors::kPermissionMarkedOptionalAndRequired,
+            api_permission->name()),
+        keys::kOptionalPermissions, api_permission->name());
+  }
+
+  extension->AddInstallWarnings(std::move(install_warnings));
+
+  APIPermissionSet new_optional_api_permissions;
+  APIPermissionSet::Difference(*optional_api_permissions,
+                               required_api_permissions,
+                               &new_optional_api_permissions);
+
+  *optional_api_permissions = new_optional_api_permissions;
+}
+
+void RemoveOverlappingHostPermissions(
+    Extension* extension,
+    const URLPatternSet& required_host_permissions,
+    URLPatternSet* optional_host_permissions) {
+  URLPatternSet new_optional_host_permissions;
+  std::vector<InstallWarning> install_warnings;
+
+  for (const URLPattern& host_permission : *optional_host_permissions) {
+    if (required_host_permissions.ContainsPattern(host_permission)) {
+      // We have detected a URLPattern in the optional hosts permission set that
+      // is a strict subset of at least one URLPattern in the required hosts
+      // permission set so we add an install warning.
+      install_warnings.emplace_back(
+          ErrorUtils::FormatErrorMessage(
+              manifest_errors::kPermissionMarkedOptionalAndRequired,
+              host_permission.GetAsString()),
+          keys::kOptionalPermissions);
+    } else {
+      new_optional_host_permissions.AddPattern(host_permission);
+    }
+  }
+
+  if (!install_warnings.empty())
+    extension->AddInstallWarnings(std::move(install_warnings));
+
+  *optional_host_permissions = new_optional_host_permissions;
+}
+
 }  // namespace
 
 struct PermissionsParser::InitialPermissions {
@@ -280,36 +341,14 @@
   // If permissions are specified as both required and optional
   // add an install warning for each permission and remove them from the
   // optional set while keeping them in the required set.
-  APIPermissionSet overlap_permissions;
-  APIPermissionSet::Intersection(initial_required_permissions_->api_permissions,
-                                 initial_optional_permissions_->api_permissions,
-                                 &overlap_permissions);
+  RemoveOverlappingAPIPermissions(
+      extension, initial_required_permissions_->api_permissions,
+      &initial_optional_permissions_->api_permissions);
 
-  if (!overlap_permissions.empty()) {
-    std::vector<InstallWarning> install_warnings;
-    install_warnings.reserve(overlap_permissions.size());
+  RemoveOverlappingHostPermissions(
+      extension, initial_required_permissions_->host_permissions,
+      &initial_optional_permissions_->host_permissions);
 
-    for (const auto* api_permission : overlap_permissions) {
-      install_warnings.emplace_back(
-          ErrorUtils::FormatErrorMessage(
-              manifest_errors::kPermissionMarkedOptionalAndRequired,
-              api_permission->name()),
-          keys::kOptionalPermissions, api_permission->name());
-    }
-
-    extension->AddInstallWarnings(std::move(install_warnings));
-
-    APIPermissionSet new_optional_api_permissions;
-    APIPermissionSet::Difference(initial_optional_permissions_->api_permissions,
-                                 initial_required_permissions_->api_permissions,
-                                 &new_optional_api_permissions);
-
-    initial_optional_permissions_->api_permissions =
-        new_optional_api_permissions;
-  }
-
-  // TODO(kelvinjiang): Use URLPatternSet to check for cases where a url pattern
-  // in required permissions contains another pattern in optional permissions.
   return true;
 }
 
diff --git a/gpu/command_buffer/build_cmd_buffer_lib.py b/gpu/command_buffer/build_cmd_buffer_lib.py
index 2d96f810..8a6bd26 100644
--- a/gpu/command_buffer/build_cmd_buffer_lib.py
+++ b/gpu/command_buffer/build_cmd_buffer_lib.py
@@ -2627,7 +2627,7 @@
     for arg in func.GetOriginalArgs():
       arg.WriteClientSideValidationCode(f, func)
     f.write(
-        "  GPU_CLIENT_DCHECK(%s != 0);\n" % func.GetOriginalArgs()[-1].name)
+        "  if (%s == 0)\n    return;" % func.GetOriginalArgs()[-1].name);
     f.write("  %sHelper(%s);\n" %
                (func.original_name, func.GetOriginalArgs()[-1].name))
     f.write("  CheckGLError();\n")
diff --git a/gpu/command_buffer/client/gles2_implementation_impl_autogen.h b/gpu/command_buffer/client/gles2_implementation_impl_autogen.h
index 68b2e03..50c53a67 100644
--- a/gpu/command_buffer/client/gles2_implementation_impl_autogen.h
+++ b/gpu/command_buffer/client/gles2_implementation_impl_autogen.h
@@ -496,7 +496,8 @@
   GPU_CLIENT_SINGLE_THREAD_CHECK();
   GPU_CLIENT_LOG("[" << GetLogPrefix() << "] glDeleteProgram(" << program
                      << ")");
-  GPU_CLIENT_DCHECK(program != 0);
+  if (program == 0)
+    return;
   DeleteProgramHelper(program);
   CheckGLError();
 }
@@ -549,7 +550,8 @@
 void GLES2Implementation::DeleteSync(GLsync sync) {
   GPU_CLIENT_SINGLE_THREAD_CHECK();
   GPU_CLIENT_LOG("[" << GetLogPrefix() << "] glDeleteSync(" << sync << ")");
-  GPU_CLIENT_DCHECK(sync != 0);
+  if (sync == 0)
+    return;
   DeleteSyncHelper(sync);
   CheckGLError();
 }
@@ -557,7 +559,8 @@
 void GLES2Implementation::DeleteShader(GLuint shader) {
   GPU_CLIENT_SINGLE_THREAD_CHECK();
   GPU_CLIENT_LOG("[" << GetLogPrefix() << "] glDeleteShader(" << shader << ")");
-  GPU_CLIENT_DCHECK(shader != 0);
+  if (shader == 0)
+    return;
   DeleteShaderHelper(shader);
   CheckGLError();
 }
diff --git a/gpu/command_buffer/client/gles2_implementation_unittest.cc b/gpu/command_buffer/client/gles2_implementation_unittest.cc
index 01b38c421..304ac8f 100644
--- a/gpu/command_buffer/client/gles2_implementation_unittest.cc
+++ b/gpu/command_buffer/client/gles2_implementation_unittest.cc
@@ -4455,6 +4455,15 @@
   ResetErrorMessageCallback();
 }
 
+TEST_F(GLES2ImplementationTest, DeleteZero) {
+  gl_->DeleteProgram(0);
+  EXPECT_EQ(GL_NO_ERROR, CheckError());
+  gl_->DeleteShader(0);
+  EXPECT_EQ(GL_NO_ERROR, CheckError());
+  gl_->DeleteSync(0);
+  EXPECT_EQ(GL_NO_ERROR, CheckError());
+}
+
 #include "base/macros.h"
 #include "gpu/command_buffer/client/gles2_implementation_unittest_autogen.h"
 
diff --git a/gpu/command_buffer/client/raster_implementation_gles.cc b/gpu/command_buffer/client/raster_implementation_gles.cc
index c60123d..c8713c9d 100644
--- a/gpu/command_buffer/client/raster_implementation_gles.cc
+++ b/gpu/command_buffer/client/raster_implementation_gles.cc
@@ -66,7 +66,6 @@
 
 RasterImplementationGLES::RasterImplementationGLES(
     gles2::GLES2Interface* gl,
-    CommandBuffer* command_buffer,
     const gpu::Capabilities& caps)
     : gl_(gl),
       caps_(caps),
diff --git a/gpu/command_buffer/client/raster_implementation_gles.h b/gpu/command_buffer/client/raster_implementation_gles.h
index 37de0eb..6faf6ff 100644
--- a/gpu/command_buffer/client/raster_implementation_gles.h
+++ b/gpu/command_buffer/client/raster_implementation_gles.h
@@ -19,8 +19,6 @@
 #include "third_party/skia/include/core/SkColorSpace.h"
 
 namespace gpu {
-class CommandBuffer;
-
 namespace raster {
 
 struct Capabilities;
@@ -29,7 +27,6 @@
 class RASTER_EXPORT RasterImplementationGLES : public RasterInterface {
  public:
   RasterImplementationGLES(gles2::GLES2Interface* gl,
-                           CommandBuffer* command_buffer,
                            const gpu::Capabilities& caps);
   ~RasterImplementationGLES() override;
 
diff --git a/gpu/command_buffer/client/raster_implementation_gles_unittest.cc b/gpu/command_buffer/client/raster_implementation_gles_unittest.cc
index 69dee09e..21a24613 100644
--- a/gpu/command_buffer/client/raster_implementation_gles_unittest.cc
+++ b/gpu/command_buffer/client/raster_implementation_gles_unittest.cc
@@ -243,17 +243,15 @@
   RasterImplementationGLESTest() {}
 
   void SetUp() override {
-    gl_.reset(new RasterMockGLES2Interface());
-
-    ri_.reset(new RasterImplementationGLES(gl_.get(), &command_buffer_,
-                                           gpu::Capabilities()));
+    gl_ = std::make_unique<RasterMockGLES2Interface>();
+    ri_ = std::make_unique<RasterImplementationGLES>(gl_.get(),
+                                                     gpu::Capabilities());
   }
 
   void TearDown() override {}
 
   void SetUpWithCapabilities(const gpu::Capabilities& capabilities) {
-    ri_.reset(new RasterImplementationGLES(gl_.get(), &command_buffer_,
-                                           capabilities));
+    ri_.reset(new RasterImplementationGLES(gl_.get(), capabilities));
   }
 
   void ExpectBindTexture(GLenum target, GLuint texture_id) {
@@ -275,7 +273,6 @@
   }
 
   ContextSupportStub support_;
-  MockClientCommandBuffer command_buffer_;
   std::unique_ptr<RasterMockGLES2Interface> gl_;
   std::unique_ptr<RasterImplementationGLES> ri_;
 
diff --git a/gpu/config/gpu_driver_bug_list.json b/gpu/config/gpu_driver_bug_list.json
index 9e4d98f1..436f2e7 100644
--- a/gpu/config/gpu_driver_bug_list.json
+++ b/gpu/config/gpu_driver_bug_list.json
@@ -1400,21 +1400,6 @@
       ]
     },
     {
-      "id": 149,
-      "description": "Direct composition flashes black initially on Win <10",
-      "cr_bugs": [588588],
-      "os": {
-        "type": "win",
-        "version": {
-          "op": "<",
-          "value": "10.0"
-        }
-      },
-      "features": [
-        "disable_direct_composition"
-      ]
-    },
-    {
       "id": 150,
       "cr_bugs": [563714],
       "description": "Alignment works incorrectly with unpack buffer bound",
@@ -2602,32 +2587,6 @@
       ]
     },
     {
-      "id": 248,
-      "description": "Direct composition causes slow presents on Intel Sandybridge",
-      "cr_bugs": [775898, 785648],
-      "os": {
-        "type": "win"
-      },
-      "vendor_id": "0x8086",
-      "device_id": ["0x0116"],
-      "features": [
-        "disable_direct_composition"
-      ]
-    },
-    {
-      "id": 249,
-      "description": "Direct composition causes slow presents on old Nvidia GPUs",
-      "cr_bugs": [775898],
-      "os": {
-        "type": "win"
-      },
-      "vendor_id": "0x10de",
-      "device_id": ["0x10d8"],
-      "features": [
-        "disable_direct_composition"
-      ]
-    },
-    {
       "id": 250,
       "description": "Depth/stencil renderbuffers can't be resized on NVIDIA on early macOS 10.13",
       "cr_bugs": [775202],
@@ -2979,35 +2938,6 @@
       ]
     },
     {
-      "id": 277,
-      "description": "Direct composition path is buggy on certain AMD devices/drivers",
-      "cr_bugs": [800950],
-      "os": {
-        "type": "win"
-      },
-      "vendor_id": "0x1002",
-      "driver_version": {
-        "op": "=",
-        "value": "8.970.100.9001"
-      },
-      "features": [
-        "disable_direct_composition"
-      ]
-    },
-    {
-      "id": 278,
-      "description": "Direct composition path is buggy on certain AMD devices/drivers",
-      "cr_bugs": [800950],
-      "os": {
-        "type": "win"
-      },
-      "vendor_id": "0x1002",
-      "device_id": ["0x6900"],
-      "features": [
-        "disable_direct_composition"
-      ]
-    },
-    {
       "id": 279,
       "description": "WindowServer crashes on VMWare bots using CA renderer",
       "cr_bugs": [828031],
diff --git a/gpu/config/gpu_finch_features.cc b/gpu/config/gpu_finch_features.cc
index 768ad238..8ed91b0 100644
--- a/gpu/config/gpu_finch_features.cc
+++ b/gpu/config/gpu_finch_features.cc
@@ -28,11 +28,6 @@
 const base::Feature kDefaultPassthroughCommandDecoder{
     "DefaultPassthroughCommandDecoder", base::FEATURE_DISABLED_BY_DEFAULT};
 
-// Use DirectComposition layers (overlays) for video if supported. Overridden by
-// --enable-direct-composition-layers and --disable-direct-composition-layers.
-const base::Feature kDirectCompositionOverlays{
-    "DirectCompositionOverlays", base::FEATURE_ENABLED_BY_DEFAULT};
-
 #if defined(OS_ANDROID)
 // Use android AImageReader when playing videos with MediaPlayer.
 const base::Feature kAImageReaderMediaPlayer{"AImageReaderMediaPlayer",
diff --git a/gpu/config/gpu_finch_features.h b/gpu/config/gpu_finch_features.h
index 0049b78..7198fa4 100644
--- a/gpu/config/gpu_finch_features.h
+++ b/gpu/config/gpu_finch_features.h
@@ -22,8 +22,6 @@
 
 GPU_EXPORT extern const base::Feature kDefaultPassthroughCommandDecoder;
 
-GPU_EXPORT extern const base::Feature kDirectCompositionOverlays;
-
 #if defined(OS_ANDROID)
 GPU_EXPORT extern const base::Feature kAImageReaderMediaPlayer;
 GPU_EXPORT extern const base::Feature kAndroidSurfaceControl;
diff --git a/gpu/config/gpu_info.cc b/gpu/config/gpu_info.cc
index 9c44106..82b849e 100644
--- a/gpu/config/gpu_info.cc
+++ b/gpu/config/gpu_info.cc
@@ -75,6 +75,7 @@
 
 namespace gpu {
 
+#if defined(OS_WIN)
 const char* OverlayFormatToString(OverlayFormat format) {
   switch (format) {
     case OverlayFormat::kBGRA:
@@ -90,6 +91,7 @@
   return format == other.format &&
          is_scaling_supported == other.is_scaling_supported;
 }
+#endif
 
 VideoDecodeAcceleratorCapabilities::VideoDecodeAcceleratorCapabilities()
     : flags(0) {}
@@ -186,8 +188,7 @@
     bool passthrough_cmd_decoder;
     bool can_support_threaded_texture_mailbox;
 #if defined(OS_WIN)
-    bool direct_composition;
-    bool supports_overlays;
+    bool direct_composition_overlays;
     OverlayCapabilities overlay_capabilities;
     DxDiagNode dx_diagnostics;
     Dx12VulkanVersionInfo dx12_vulkan_version_info;
@@ -246,8 +247,7 @@
                       can_support_threaded_texture_mailbox);
   // TODO(kbr): add dx_diagnostics on Windows.
 #if defined(OS_WIN)
-  enumerator->AddBool("directComposition", direct_composition);
-  enumerator->AddBool("supportsOverlays", supports_overlays);
+  enumerator->AddBool("directCompositionOverlays", direct_composition_overlays);
   for (const auto& cap : overlay_capabilities)
     EnumerateOverlayCapability(cap, enumerator);
   EnumerateDx12VulkanVersionInfo(dx12_vulkan_version_info, enumerator);
diff --git a/gpu/config/gpu_info.h b/gpu/config/gpu_info.h
index 8457870..0976dd24 100644
--- a/gpu/config/gpu_info.h
+++ b/gpu/config/gpu_info.h
@@ -90,6 +90,7 @@
 using VideoEncodeAcceleratorSupportedProfiles =
     std::vector<VideoEncodeAcceleratorSupportedProfile>;
 
+#if defined(OS_WIN)
 // Common overlay formats that we're interested in. Must match the OverlayFormat
 // enum in //tools/metrics/histograms/enums.xml. Mapped to corresponding DXGI
 // formats in DirectCompositionSurfaceWin.
@@ -119,6 +120,7 @@
   // The support Vulkan API version in the gpu driver;
   uint32_t vulkan_version = 0;
 };
+#endif
 
 struct GPU_EXPORT GPUInfo {
   struct GPU_EXPORT GPUDevice {
@@ -250,11 +252,8 @@
   bool can_support_threaded_texture_mailbox = false;
 
 #if defined(OS_WIN)
-  // True if we use direct composition surfaces on Windows.
-  bool direct_composition = false;
-
-  // True if the current set of outputs supports overlays.
-  bool supports_overlays = false;
+  // True if we use direct composition surface overlays on Windows.
+  bool direct_composition_overlays = false;
 
   OverlayCapabilities overlay_capabilities;
 
diff --git a/gpu/config/gpu_util.cc b/gpu/config/gpu_util.cc
index d3760c9..33989d2 100644
--- a/gpu/config/gpu_util.cc
+++ b/gpu/config/gpu_util.cc
@@ -228,7 +228,7 @@
     command_line->AppendSwitch(switches::kDisableES3GLContext);
   }
   if (gpu_feature_info.IsWorkaroundEnabled(DISABLE_DIRECT_COMPOSITION)) {
-    command_line->AppendSwitch(switches::kDisableDirectComposition);
+    command_line->AppendSwitch(switches::kDisableDirectCompositionLayers);
   }
 }
 
diff --git a/gpu/ipc/common/gpu_info.mojom b/gpu/ipc/common/gpu_info.mojom
index d29b09c0..aafc3deb 100644
--- a/gpu/ipc/common/gpu_info.mojom
+++ b/gpu/ipc/common/gpu_info.mojom
@@ -77,6 +77,7 @@
 };
 
 // gpu::OverlayFormat
+[EnableIf=is_win]
 enum OverlayFormat {
   BGRA,
   YUY2,
@@ -84,12 +85,14 @@
 };
 
 // gpu::OverlayCapability
+[EnableIf=is_win]
 struct OverlayCapability {
   OverlayFormat format;
   bool is_scaling_supported;
 };
 
 // gpu::Dx12VulkanVersionInfo
+[EnableIf=is_win]
 struct Dx12VulkanVersionInfo {
   bool supports_dx12;
   bool supports_vulkan;
@@ -123,16 +126,16 @@
   bool in_process_gpu;
   bool passthrough_cmd_decoder;
   bool can_support_threaded_texture_mailbox;
+
   [EnableIf=is_win]
-  bool direct_composition;
-  [EnableIf=is_win]
-  bool supports_overlays;
+  bool direct_composition_overlays;
   [EnableIf=is_win]
   array<OverlayCapability> overlay_capabilities;
   [EnableIf=is_win]
   DxDiagNode dx_diagnostics;
   [EnableIf=is_win]
   Dx12VulkanVersionInfo dx12_vulkan_version_info;
+
   VideoDecodeAcceleratorCapabilities video_decode_accelerator_capabilities;
   array<VideoEncodeAcceleratorSupportedProfile>
     video_encode_accelerator_supported_profiles;
diff --git a/gpu/ipc/common/gpu_info_struct_traits.cc b/gpu/ipc/common/gpu_info_struct_traits.cc
index 117dd3e7..29fdbb8 100644
--- a/gpu/ipc/common/gpu_info_struct_traits.cc
+++ b/gpu/ipc/common/gpu_info_struct_traits.cc
@@ -295,8 +295,7 @@
   out->oop_rasterization_supported = data.oop_rasterization_supported();
 
 #if defined(OS_WIN)
-  out->direct_composition = data.direct_composition();
-  out->supports_overlays = data.supports_overlays();
+  out->direct_composition_overlays = data.direct_composition_overlays();
 #endif
 
   return data.ReadInitializationTime(&out->initialization_time) &&
diff --git a/gpu/ipc/common/gpu_info_struct_traits.h b/gpu/ipc/common/gpu_info_struct_traits.h
index 2fd7bc9..a7b573c 100644
--- a/gpu/ipc/common/gpu_info_struct_traits.h
+++ b/gpu/ipc/common/gpu_info_struct_traits.h
@@ -141,6 +141,7 @@
   }
 };
 
+#if defined(OS_WIN)
 template <>
 struct EnumTraits<gpu::mojom::OverlayFormat, gpu::OverlayFormat> {
   static gpu::mojom::OverlayFormat ToMojom(gpu::OverlayFormat format);
@@ -185,6 +186,7 @@
     return input.vulkan_version;
   }
 };
+#endif
 
 template <>
 struct StructTraits<gpu::mojom::GpuInfoDataView, gpu::GPUInfo> {
@@ -284,12 +286,8 @@
   }
 
 #if defined(OS_WIN)
-  static bool direct_composition(const gpu::GPUInfo& input) {
-    return input.direct_composition;
-  }
-
-  static bool supports_overlays(const gpu::GPUInfo& input) {
-    return input.supports_overlays;
+  static bool direct_composition_overlays(const gpu::GPUInfo& input) {
+    return input.direct_composition_overlays;
   }
 
   static const gpu::OverlayCapabilities& overlay_capabilities(
diff --git a/gpu/ipc/common/struct_traits_unittest.cc b/gpu/ipc/common/struct_traits_unittest.cc
index 95e18dc3..a05e951 100644
--- a/gpu/ipc/common/struct_traits_unittest.cc
+++ b/gpu/ipc/common/struct_traits_unittest.cc
@@ -154,8 +154,7 @@
   const bool in_process_gpu = true;
   const bool passthrough_cmd_decoder = true;
 #if defined(OS_WIN)
-  const bool direct_composition = true;
-  const bool supports_overlays = true;
+  const bool direct_composition_overlays = true;
   const gpu::OverlayCapabilities overlay_capabilities = {
       {OverlayFormat::kBGRA, false}, {OverlayFormat::kNV12, true}};
   const DxDiagNode dx_diagnostics;
@@ -198,8 +197,7 @@
   input.in_process_gpu = in_process_gpu;
   input.passthrough_cmd_decoder = passthrough_cmd_decoder;
 #if defined(OS_WIN)
-  input.direct_composition = direct_composition;
-  input.supports_overlays = supports_overlays;
+  input.direct_composition_overlays = direct_composition_overlays;
   input.overlay_capabilities = overlay_capabilities;
   input.dx_diagnostics = dx_diagnostics;
 #endif
@@ -257,8 +255,7 @@
   EXPECT_EQ(in_process_gpu, output.in_process_gpu);
   EXPECT_EQ(passthrough_cmd_decoder, output.passthrough_cmd_decoder);
 #if defined(OS_WIN)
-  EXPECT_EQ(direct_composition, output.direct_composition);
-  EXPECT_EQ(supports_overlays, output.supports_overlays);
+  EXPECT_EQ(direct_composition_overlays, output.direct_composition_overlays);
   EXPECT_EQ(overlay_capabilities, output.overlay_capabilities);
   EXPECT_EQ(dx_diagnostics.values, output.dx_diagnostics.values);
 #endif
diff --git a/gpu/ipc/service/direct_composition_child_surface_win.h b/gpu/ipc/service/direct_composition_child_surface_win.h
index 29af065..2184604 100644
--- a/gpu/ipc/service/direct_composition_child_surface_win.h
+++ b/gpu/ipc/service/direct_composition_child_surface_win.h
@@ -25,7 +25,7 @@
                                    bool allow_tearing);
 
   // GLSurfaceEGL implementation.
-  using GLSurfaceEGL::Initialize;
+  using GLSurface::Initialize;
   bool Initialize(gl::GLSurfaceFormat format) override;
   void Destroy() override;
   gfx::Size GetSize() override;
diff --git a/gpu/ipc/service/direct_composition_surface_win.cc b/gpu/ipc/service/direct_composition_surface_win.cc
index 8e06d52..a4a4a56 100644
--- a/gpu/ipc/service/direct_composition_surface_win.cc
+++ b/gpu/ipc/service/direct_composition_surface_win.cc
@@ -140,37 +140,58 @@
 
   g_overlay_support_initialized = true;
 
-  if (!gl::GLSurfaceEGL::IsDirectCompositionSupported())
-    return;
-
   // Before Windows 10 Anniversary Update (Redstone 1), overlay planes wouldn't
   // be assigned to non-UWP apps.
   if (base::win::GetVersion() < base::win::VERSION_WIN10_RS1)
     return;
 
+  // Blacklist direct composition if MCTU.dll or MCTUX.dll are injected. These
+  // are user mode drivers for display adapters from Magic Control Technology
+  // Corporation.
+  if (GetModuleHandle(TEXT("MCTU.dll")) || GetModuleHandle(TEXT("MCTUX.dll"))) {
+    DLOG(ERROR) << "Blacklisted due to third party modules";
+    return;
+  }
+
+  // Flexible surface compatibility is required to be able to MakeCurrent with
+  // the default pbuffer surface.
+  if (!gl::GLSurfaceEGL::IsEGLFlexibleSurfaceCompatibilitySupported()) {
+    DLOG(ERROR) << "EGL_ANGLE_flexible_surface_compatibility not supported";
+    return;
+  }
+
   Microsoft::WRL::ComPtr<ID3D11Device> d3d11_device =
       gl::QueryD3D11DeviceObjectFromANGLE();
   if (!d3d11_device) {
-    DLOG(ERROR) << "Not using overlays because failed to retrieve D3D11 device "
-                   "from ANGLE";
+    DLOG(ERROR) << "Failed to retrieve D3D11 device";
+    return;
+  }
+
+  Microsoft::WRL::ComPtr<IDCompositionDevice2> dcomp_device =
+      gl::QueryDirectCompositionDevice(d3d11_device);
+  if (!dcomp_device) {
+    DLOG(ERROR) << "Failed to retrieve direct composition device";
     return;
   }
 
   // This can fail if the D3D device is "Microsoft Basic Display Adapter".
   Microsoft::WRL::ComPtr<ID3D11VideoDevice> video_device;
   if (FAILED(d3d11_device.CopyTo(video_device.GetAddressOf()))) {
-    DLOG(ERROR) << "Not using overlays because failed to retrieve video device "
-                   "from D3D11 device";
+    DLOG(ERROR) << "Failed to retrieve video device";
     return;
   }
-  DCHECK(video_device);
 
   Microsoft::WRL::ComPtr<IDXGIDevice> dxgi_device;
-  d3d11_device.CopyTo(dxgi_device.GetAddressOf());
-  DCHECK(dxgi_device);
+  if (FAILED(d3d11_device.CopyTo(dxgi_device.GetAddressOf()))) {
+    DLOG(ERROR) << "Failed to retrieve DXGI device";
+    return;
+  }
+
   Microsoft::WRL::ComPtr<IDXGIAdapter> dxgi_adapter;
-  dxgi_device->GetAdapter(dxgi_adapter.GetAddressOf());
-  DCHECK(dxgi_adapter);
+  if (FAILED(dxgi_device->GetAdapter(dxgi_adapter.GetAddressOf()))) {
+    DLOG(ERROR) << "Failed to retrieve DXGI adapter";
+    return;
+  }
 
   bool supports_nv12_rec709 = false;
   unsigned int i = 0;
@@ -1463,8 +1484,7 @@
   if (command_line->HasSwitch(switches::kEnableDirectCompositionLayers))
     return true;
 
-  return base::FeatureList::IsEnabled(features::kDirectCompositionOverlays) &&
-         g_supports_overlays;
+  return g_supports_overlays;
 }
 
 // static
@@ -1684,8 +1704,10 @@
     }
     default_surface_ = nullptr;
   }
-  if (root_surface_)
+  if (root_surface_) {
     root_surface_->Destroy();
+    root_surface_ = nullptr;
+  }
 }
 
 gfx::Size DirectCompositionSurfaceWin::GetSize() {
@@ -1809,13 +1831,9 @@
 }
 
 bool DirectCompositionSurfaceWin::SupportsProtectedVideo() const {
-  if (!AreOverlaysSupported())
-    return false;
-
-  // TODO: Check the gpu driver date (or a function) which we know this new
-  // support is enabled.
-
-  return true;
+  // TODO(magchen): Check the gpu driver date (or a function) which we know this
+  // new support is enabled.
+  return AreOverlaysSupported();
 }
 
 bool DirectCompositionSurfaceWin::SetDrawRectangle(const gfx::Rect& rectangle) {
diff --git a/gpu/ipc/service/direct_composition_surface_win.h b/gpu/ipc/service/direct_composition_surface_win.h
index 5424974..fc8ad14 100644
--- a/gpu/ipc/service/direct_composition_surface_win.h
+++ b/gpu/ipc/service/direct_composition_surface_win.h
@@ -36,11 +36,13 @@
       base::WeakPtr<ImageTransportSurfaceDelegate> delegate,
       HWND parent_window);
 
-  // Returns true if there's an output on the current adapter that can
-  // use overlays.
+  // Returns true if hardware overlays are supported, and DirectComposition
+  // surface and layers should be used.  Overridden with
+  // --enable-direct-composition-layers and --disable-direct-composition-layers.
   static bool AreOverlaysSupported();
 
-  // Returns a list of supported overlay formats for GPUInfo.
+  // Returns a list of supported overlay formats for GPUInfo.  This does not
+  // depend on finch features or command line flags.
   static OverlayCapabilities GetOverlayCapabilities();
 
   // Returns true if there is an HDR capable display connected.
@@ -57,7 +59,7 @@
   bool InitializeNativeWindow();
 
   // GLSurfaceEGL implementation.
-  using GLSurfaceEGL::Initialize;
+  using GLSurface::Initialize;
   bool Initialize(gl::GLSurfaceFormat format) override;
   void Destroy() override;
   gfx::Size GetSize() override;
diff --git a/gpu/ipc/service/gpu_init.cc b/gpu/ipc/service/gpu_init.cc
index bee52c6..fd6cb5ea 100644
--- a/gpu/ipc/service/gpu_init.cc
+++ b/gpu/ipc/service/gpu_init.cc
@@ -61,10 +61,8 @@
     LOG(ERROR) << "gpu::CollectGraphicsInfo failed.";
 
 #if defined(OS_WIN)
-  if (gl::GetGLImplementation() == gl::kGLImplementationEGLGLES2 &&
-      gl::GLSurfaceEGL::IsDirectCompositionSupported()) {
-    gpu_info->direct_composition = true;
-    gpu_info->supports_overlays =
+  if (gl::GetGLImplementation() == gl::kGLImplementationEGLGLES2) {
+    gpu_info->direct_composition_overlays =
         DirectCompositionSurfaceWin::AreOverlaysSupported();
     gpu_info->overlay_capabilities =
         DirectCompositionSurfaceWin::GetOverlayCapabilities();
diff --git a/gpu/ipc/service/image_transport_surface_win.cc b/gpu/ipc/service/image_transport_surface_win.cc
index b50283b..cd9394c6 100644
--- a/gpu/ipc/service/image_transport_surface_win.cc
+++ b/gpu/ipc/service/image_transport_surface_win.cc
@@ -29,16 +29,16 @@
 
   scoped_refptr<gl::GLSurface> surface;
   bool override_vsync_for_multi_window_swap = false;
+
   if (gl::GetGLImplementation() == gl::kGLImplementationEGLGLES2) {
     auto vsync_provider =
         std::make_unique<gl::VSyncProviderWin>(surface_handle);
-    if (gl::GLSurfaceEGL::IsDirectCompositionSupported()) {
-      scoped_refptr<DirectCompositionSurfaceWin> egl_surface =
-          base::MakeRefCounted<DirectCompositionSurfaceWin>(
-              std::move(vsync_provider), delegate, surface_handle);
-      if (!egl_surface->Initialize())
+
+    if (DirectCompositionSurfaceWin::AreOverlaysSupported()) {
+      surface = base::MakeRefCounted<DirectCompositionSurfaceWin>(
+          std::move(vsync_provider), delegate, surface_handle);
+      if (!surface->Initialize())
         return nullptr;
-      surface = egl_surface;
     } else {
       surface = gl::InitializeGLSurface(
           base::MakeRefCounted<gl::NativeViewGLSurfaceEGL>(
diff --git a/gpu/skia_bindings/gl_bindings_skia_cmd_buffer.cc b/gpu/skia_bindings/gl_bindings_skia_cmd_buffer.cc
index 3eb0b18e..de7ad59 100644
--- a/gpu/skia_bindings/gl_bindings_skia_cmd_buffer.cc
+++ b/gpu/skia_bindings/gl_bindings_skia_cmd_buffer.cc
@@ -79,6 +79,8 @@
       gles_bind(&GLES2Interface::BindBuffer, impl, context_support);
   functions->fBindTexture =
       gles_bind(&GLES2Interface::BindTexture, impl, context_support);
+  functions->fBindSampler =
+      gles_bind(&GLES2Interface::BindSampler, impl, context_support);
   functions->fBindVertexArray =
       gles_bind(&GLES2Interface::BindVertexArrayOES, impl, context_support);
   functions->fBlendBarrier =
@@ -120,6 +122,8 @@
       gles_bind(&GLES2Interface::DeleteBuffers, impl, context_support);
   functions->fDeleteProgram =
       gles_bind(&GLES2Interface::DeleteProgram, impl, context_support);
+  functions->fDeleteSamplers =
+      gles_bind(&GLES2Interface::DeleteSamplers, impl, context_support);
   functions->fDeleteShader =
       gles_bind(&GLES2Interface::DeleteShader, impl, context_support);
   functions->fDeleteSync =
@@ -165,6 +169,8 @@
       gles_bind(&GLES2Interface::FrontFace, impl, context_support);
   functions->fGenBuffers =
       gles_bind(&GLES2Interface::GenBuffers, impl, context_support);
+  functions->fGenSamplers =
+      gles_bind(&GLES2Interface::GenSamplers, impl, context_support);
   functions->fGenTextures =
       gles_bind(&GLES2Interface::GenTextures, impl, context_support);
   functions->fGenVertexArrays =
@@ -224,6 +230,10 @@
       gles_bind(&GLES2Interface::ReadBuffer, impl, context_support);
   functions->fReadPixels =
       gles_bind(&GLES2Interface::ReadPixels, impl, context_support);
+  functions->fSamplerParameteri =
+      gles_bind(&GLES2Interface::SamplerParameteri, impl, context_support);
+  functions->fSamplerParameteriv =
+      gles_bind(&GLES2Interface::SamplerParameteriv, impl, context_support);
   functions->fScissor =
       gles_bind(&GLES2Interface::Scissor, impl, context_support);
   functions->fShaderSource =
diff --git a/headless/lib/browser/devtools_api/client_api_generator.py b/headless/lib/browser/devtools_api/client_api_generator.py
index eb74c6a..59a8510c 100644
--- a/headless/lib/browser/devtools_api/client_api_generator.py
+++ b/headless/lib/browser/devtools_api/client_api_generator.py
@@ -230,6 +230,21 @@
   }
 
 
+def CreateBinaryTypeDefinition():
+  return {
+      'js_type': 'string',
+      'return_type': 'protocol::Binary',
+      'pass_type': 'const protocol::Binary&',
+      'to_pass_type': '%s',
+      'to_raw_type': '%s',
+      'to_raw_return_type': '%s',
+      'type': 'protocol::Binary',
+      'raw_type': 'protocol::Binary',
+      'raw_pass_type': 'const protocol::Binary&',
+      'raw_return_type': 'protocol::Binary',
+  }
+
+
 def CreatePrimitiveTypeDefinition(type):
   typedefs = {
       'number': 'double',
@@ -260,6 +275,7 @@
 type_definitions['integer'] = CreatePrimitiveTypeDefinition('integer')
 type_definitions['boolean'] = CreatePrimitiveTypeDefinition('boolean')
 type_definitions['string'] = CreateStringTypeDefinition()
+type_definitions['binary'] = CreateBinaryTypeDefinition()
 type_definitions['object'] = CreateObjectTypeDefinition()
 type_definitions['any'] = CreateAnyTypeDefinition()
 
@@ -304,6 +320,9 @@
       elif type['type'] == 'string':
         type_definitions[domain['domain'] + '.' + type['id']] = (
             CreateStringTypeDefinition())
+      elif type['type'] == 'binary':
+        type_definitions[domain['domain'] + '.' + type['id']] = (
+            CreateBinaryTypeDefinition())
       else:
         type_definitions[domain['domain'] + '.' + type['id']] = (
             CreatePrimitiveTypeDefinition(type['type']))
diff --git a/headless/lib/browser/devtools_api/domain_h.template b/headless/lib/browser/devtools_api/domain_h.template
index 28f6110..a113383 100644
--- a/headless/lib/browser/devtools_api/domain_h.template
+++ b/headless/lib/browser/devtools_api/domain_h.template
@@ -10,6 +10,7 @@
 #include "base/callback.h"
 #include "base/observer_list.h"
 #include "base/values.h"
+#include "headless/lib/browser/protocol/protocol_string.h"
 {% for domain_name in domain.dependencies %}
 #include "headless/public/devtools/domains/types_{{domain_name | camelcase_to_hacker_style}}.h"
 {% endfor %}
diff --git a/headless/lib/browser/devtools_api/domain_types_h.template b/headless/lib/browser/devtools_api/domain_types_h.template
index bb6d9868..1ad4813 100644
--- a/headless/lib/browser/devtools_api/domain_types_h.template
+++ b/headless/lib/browser/devtools_api/domain_types_h.template
@@ -9,6 +9,7 @@
 
 #include "base/optional.h"
 #include "base/values.h"
+#include "headless/lib/browser/protocol/protocol_string.h"
 {% for domain_name in domain.dependencies %}
 #include "headless/public/devtools/internal/types_forward_declarations_{{domain_name | camelcase_to_hacker_style}}.h"
 {% endfor %}
diff --git a/headless/public/internal/value_conversions.h b/headless/public/internal/value_conversions.h
index fb82d9a..9f18f32 100644
--- a/headless/public/internal/value_conversions.h
+++ b/headless/public/internal/value_conversions.h
@@ -7,6 +7,7 @@
 
 #include <memory>
 
+#include "headless/lib/browser/protocol/protocol_string.h"
 #include "headless/public/util/error_reporter.h"
 
 namespace headless {
@@ -72,6 +73,11 @@
   return std::move(result);
 }
 
+template <>
+inline std::unique_ptr<base::Value> ToValue(const protocol::Binary& value) {
+  return ToValue(value.toBase64());
+}
+
 // FromValue specializations for basic types.
 template <>
 struct FromValue<bool> {
@@ -146,6 +152,23 @@
   }
 };
 
+template <>
+struct FromValue<protocol::Binary> {
+  static protocol::Binary Parse(const base::Value& value,
+                                ErrorReporter* errors) {
+    if (!value.is_string()) {
+      errors->AddError("string value expected");
+      return protocol::Binary();
+    }
+    bool success = false;
+    protocol::Binary out =
+        protocol::Binary::fromBase64(value.GetString(), &success);
+    if (!success)
+      errors->AddError("base64 decoding error");
+    return out;
+  }
+};
+
 template <typename T>
 struct FromValue<std::vector<T>> {
   static std::vector<T> Parse(const base::Value& value, ErrorReporter* errors) {
diff --git a/ios/chrome/browser/ui/autofill/chrome_autofill_client_ios.mm b/ios/chrome/browser/ui/autofill/chrome_autofill_client_ios.mm
index bf77ff82..a837ae7 100644
--- a/ios/chrome/browser/ui/autofill/chrome_autofill_client_ios.mm
+++ b/ios/chrome/browser/ui/autofill/chrome_autofill_client_ios.mm
@@ -174,6 +174,7 @@
   infobar_manager_->AddInfoBar(CreateSaveCardInfoBarMobile(
       std::make_unique<AutofillSaveCardInfoBarDelegateMobile>(
           false, card, std::unique_ptr<base::DictionaryValue>(nullptr),
+          GetStrikeDatabase(),
           /*upload_save_card_callback=*/
           base::OnceCallback<void(const base::string16&)>(),
           /*local_save_card_callback=*/std::move(callback), GetPrefs())));
@@ -200,7 +201,7 @@
   DCHECK(show_prompt);
   auto save_card_info_bar_delegate_mobile =
       std::make_unique<AutofillSaveCardInfoBarDelegateMobile>(
-          true, card, std::move(legal_message),
+          true, card, std::move(legal_message), GetStrikeDatabase(),
           /*upload_save_card_callback=*/std::move(callback),
           /*local_save_card_callback=*/base::Closure(), GetPrefs());
   // Allow user to save card only if legal messages are successfully parsed.
diff --git a/ios/chrome/browser/ui/autofill/save_card_infobar_egtest.mm b/ios/chrome/browser/ui/autofill/save_card_infobar_egtest.mm
index af1f525..5755f7b1 100644
--- a/ios/chrome/browser/ui/autofill/save_card_infobar_egtest.mm
+++ b/ios/chrome/browser/ui/autofill/save_card_infobar_egtest.mm
@@ -65,6 +65,8 @@
   REQUESTED_UPLOAD_SAVE,
   RECEIVED_GET_UPLOAD_DETAILS_RESPONSE,
   SENT_UPLOAD_CARD_REQUEST,
+  RECEIVED_UPLOAD_CARD_RESPONSE,
+  STRIKE_CHANGE_COMPLETE
 };
 
 id<GREYMatcher> closeButtonMatcher() {
@@ -201,6 +203,14 @@
   [self onEvent:InfobarEvent::SENT_UPLOAD_CARD_REQUEST];
 }
 
+- (void)receivedUploadCardResponse {
+  [self onEvent:InfobarEvent::RECEIVED_UPLOAD_CARD_RESPONSE];
+}
+
+- (void)ccsmStrikeChangeComplete {
+  [self onEvent:InfobarEvent::STRIKE_CHANGE_COMPLETE];
+}
+
 #pragma mark - Page interaction helper methods
 
 - (void)fillAndSubmitFormWithCardDetailsOnly {
diff --git a/ios/chrome/browser/ui/omnibox/omnibox_container_view.h b/ios/chrome/browser/ui/omnibox/omnibox_container_view.h
index 85d4a2c..98724cb 100644
--- a/ios/chrome/browser/ui/omnibox/omnibox_container_view.h
+++ b/ios/chrome/browser/ui/omnibox/omnibox_container_view.h
@@ -14,11 +14,9 @@
 // right of it.
 @interface OmniboxContainerView : UIView
 
-// Initialize the container view with the given frame, font, Regular x Regular
-// size class font, text color, and tint color for omnibox.
+// Initialize the container view with the given frame, text color, and tint
+// color for omnibox.
 - (instancetype)initWithFrame:(CGRect)frame
-                         font:(UIFont*)font
-                   largerFont:(UIFont*)largerFont
                     textColor:(UIColor*)textColor
                 textFieldTint:(UIColor*)textFieldTint
                      iconTint:(UIColor*)iconTint NS_DESIGNATED_INITIALIZER;
diff --git a/ios/chrome/browser/ui/omnibox/omnibox_container_view.mm b/ios/chrome/browser/ui/omnibox/omnibox_container_view.mm
index 9b2fc52..6cc5c6b 100644
--- a/ios/chrome/browser/ui/omnibox/omnibox_container_view.mm
+++ b/ios/chrome/browser/ui/omnibox/omnibox_container_view.mm
@@ -59,16 +59,12 @@
 #pragma mark - Public methods
 
 - (instancetype)initWithFrame:(CGRect)frame
-                         font:(UIFont*)font
-                   largerFont:(UIFont*)largerFont
                     textColor:(UIColor*)textColor
                 textFieldTint:(UIColor*)textFieldTint
                      iconTint:(UIColor*)iconTint {
   self = [super initWithFrame:frame];
   if (self) {
     _textField = [[OmniboxTextFieldIOS alloc] initWithFrame:frame
-                                                       font:font
-                                                 largerFont:largerFont
                                                   textColor:textColor
                                                   tintColor:textFieldTint];
     [self addSubview:_textField];
diff --git a/ios/chrome/browser/ui/omnibox/omnibox_text_field_ios.h b/ios/chrome/browser/ui/omnibox/omnibox_text_field_ios.h
index bf52172a..b56883d 100644
--- a/ios/chrome/browser/ui/omnibox/omnibox_text_field_ios.h
+++ b/ios/chrome/browser/ui/omnibox/omnibox_text_field_ios.h
@@ -20,21 +20,11 @@
 // UITextField subclass to allow for adjusting borders.
 @interface OmniboxTextFieldIOS : UITextField
 
-// Initialize the omnibox with the given frame, font, text color, and tint
-// color.
+// Initialize the omnibox with the given frame, text color, and tint color.
 - (instancetype)initWithFrame:(CGRect)frame
-                         font:(UIFont*)font
                     textColor:(UIColor*)textColor
                     tintColor:(UIColor*)tintColor NS_DESIGNATED_INITIALIZER;
 
-// Initializer that allows specifying a larger font to use in Regular x Regular
-// size class.
-- (instancetype)initWithFrame:(CGRect)frame
-                         font:(UIFont*)font
-                   largerFont:(UIFont*)largerFont
-                    textColor:(UIColor*)textColor
-                    tintColor:(UIColor*)tintColor;
-
 - (instancetype)initWithCoder:(NSCoder*)aDecoder NS_UNAVAILABLE;
 
 
diff --git a/ios/chrome/browser/ui/omnibox/omnibox_text_field_ios.mm b/ios/chrome/browser/ui/omnibox/omnibox_text_field_ios.mm
index 10ecb3dd..5c6cd7c 100644
--- a/ios/chrome/browser/ui/omnibox/omnibox_text_field_ios.mm
+++ b/ios/chrome/browser/ui/omnibox/omnibox_text_field_ios.mm
@@ -42,7 +42,6 @@
 
 namespace {
 
-const CGFloat kFontSize = 16;
 const CGFloat kEditingRectWidthInset = 12;
 const CGFloat kClearButtonRightMarginIphone = 7;
 
@@ -66,9 +65,9 @@
 
 // Font to use in regular x regular size class. If not set, the regular font is
 // used instead.
-@property(nonatomic, strong) UIFont* largerFont;
+@property(nonatomic, strong, readonly) UIFont* largerFont;
 // Font to use in Compact x Any and Any x Compact size class.
-@property(nonatomic, strong) UIFont* normalFont;
+@property(nonatomic, strong, readonly) UIFont* normalFont;
 
 // Gets the bounds of the rect covering the URL.
 - (CGRect)preEditLabelRectForBounds:(CGRect)bounds;
@@ -105,39 +104,21 @@
 @synthesize selectedTextBackgroundColor = _selectedTextBackgroundColor;
 @synthesize placeholderTextColor = _placeholderTextColor;
 @synthesize incognito = _incognito;
-@synthesize largerFont = _largerFont;
-@synthesize normalFont = _normalFont;
 @synthesize suggestionCommandsEndpoint = _suggestionCommandsEndpoint;
 
 #pragma mark - Public methods
 // Overload to allow for code-based initialization.
 - (instancetype)initWithFrame:(CGRect)frame {
   return [self initWithFrame:frame
-                        font:[UIFont systemFontOfSize:kFontSize]
                    textColor:TextColor()
                    tintColor:nil];
 }
 
 - (instancetype)initWithFrame:(CGRect)frame
-                         font:(UIFont*)font
-                   largerFont:(UIFont*)largerFont
-                    textColor:(UIColor*)textColor
-                    tintColor:(UIColor*)tintColor {
-  self = [self initWithFrame:frame
-                        font:font
-                   textColor:textColor
-                   tintColor:tintColor];
-  _largerFont = largerFont;
-  return self;
-}
-
-- (instancetype)initWithFrame:(CGRect)frame
-                         font:(UIFont*)font
                     textColor:(UIColor*)textColor
                     tintColor:(UIColor*)tintColor {
   self = [super initWithFrame:frame];
   if (self) {
-    _normalFont = font;
     _displayedTextColor = textColor;
     if (tintColor) {
       [self setTintColor:tintColor];
@@ -457,11 +438,15 @@
   [super setDelegate:delegate];
 }
 
-- (UIFont*)currentFont {
-  if (!self.largerFont) {
-    return self.normalFont;
-  }
+- (UIFont*)largerFont {
+  return [UIFont systemFontOfSize:kLocationBarRegularRegularFontSize];
+}
 
+- (UIFont*)normalFont {
+  return [UIFont systemFontOfSize:kLocationBarSteadyFontSize];
+}
+
+- (UIFont*)currentFont {
   return IsCompactWidth() ? self.normalFont : self.largerFont;
 }
 
diff --git a/ios/chrome/browser/ui/omnibox/omnibox_view_controller.mm b/ios/chrome/browser/ui/omnibox/omnibox_view_controller.mm
index d4bbd729..b752c8e 100644
--- a/ios/chrome/browser/ui/omnibox/omnibox_view_controller.mm
+++ b/ios/chrome/browser/ui/omnibox/omnibox_view_controller.mm
@@ -63,8 +63,6 @@
 
   self.view = [[OmniboxContainerView alloc]
       initWithFrame:CGRectZero
-               font:[UIFont systemFontOfSize:kLocationBarFontSize]
-         largerFont:[UIFont systemFontOfSize:kLocationBarRegularRegularFontSize]
           textColor:textColor
       textFieldTint:textFieldTintColor
            iconTint:iconTintColor];
diff --git a/ios/chrome/browser/ui/payments/payment_request_journey_logger_egtest.mm b/ios/chrome/browser/ui/payments/payment_request_journey_logger_egtest.mm
index 8316784..f74c22a 100644
--- a/ios/chrome/browser/ui/payments/payment_request_journey_logger_egtest.mm
+++ b/ios/chrome/browser/ui/payments/payment_request_journey_logger_egtest.mm
@@ -11,7 +11,6 @@
 #import "ios/chrome/test/app/histogram_test_util.h"
 #import "ios/chrome/test/earl_grey/chrome_earl_grey.h"
 #import "ios/chrome/test/earl_grey/chrome_matchers.h"
-#import "ios/web/public/web_client.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
 #error "This file requires ARC support."
@@ -778,19 +777,8 @@
       buckets[0].min & JourneyLogger::EVENT_RECEIVED_INSTRUMENT_DETAILS, @"");
   GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_SKIPPED_SHOW, @"");
   GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_COMPLETED, @"");
-
-  // TODO(crbug.com/676129): LegacyNavigationManager has a bug that doesn't
-  // create a pending item when reloading the page. This is incorrectly causing
-  // the second navigation above to be considered a renderer-initiated
-  // navigation, and the abort reason is incorrectly logged as
-  // EVENT_OTHER_ABORTED.
-  if (!web::GetWebClient()->IsSlimNavigationManagerEnabled()) {
-    GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_USER_ABORTED, @"");
-    GREYAssertTrue(buckets[0].min & JourneyLogger::EVENT_OTHER_ABORTED, @"");
-  } else {
-    GREYAssertTrue(buckets[0].min & JourneyLogger::EVENT_USER_ABORTED, @"");
-    GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_OTHER_ABORTED, @"");
-  }
+  GREYAssertTrue(buckets[0].min & JourneyLogger::EVENT_USER_ABORTED, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_OTHER_ABORTED, @"");
   GREYAssertTrue(
       buckets[0].min & JourneyLogger::EVENT_HAD_INITIAL_FORM_OF_PAYMENT, @"");
   GREYAssertTrue(
@@ -840,18 +828,8 @@
       buckets[0].min & JourneyLogger::EVENT_RECEIVED_INSTRUMENT_DETAILS, @"");
   GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_SKIPPED_SHOW, @"");
   GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_COMPLETED, @"");
-  // TODO(crbug.com/676129): LegacyNavigationManager has a bug that doesn't
-  // create a pending item when reloading the page. This is incorrectly causing
-  // the second navigation above to be considered a renderer-initiated
-  // navigation, and the abort reason is incorrectly logged as
-  // EVENT_OTHER_ABORTED.
-  if (!web::GetWebClient()->IsSlimNavigationManagerEnabled()) {
-    GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_USER_ABORTED, @"");
-    GREYAssertTrue(buckets[0].min & JourneyLogger::EVENT_OTHER_ABORTED, @"");
-  } else {
-    GREYAssertTrue(buckets[0].min & JourneyLogger::EVENT_USER_ABORTED, @"");
-    GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_OTHER_ABORTED, @"");
-  }
+  GREYAssertTrue(buckets[0].min & JourneyLogger::EVENT_USER_ABORTED, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_OTHER_ABORTED, @"");
   GREYAssertFalse(
       buckets[0].min & JourneyLogger::EVENT_HAD_INITIAL_FORM_OF_PAYMENT, @"");
   GREYAssertFalse(
@@ -902,18 +880,8 @@
       buckets[0].min & JourneyLogger::EVENT_RECEIVED_INSTRUMENT_DETAILS, @"");
   GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_SKIPPED_SHOW, @"");
   GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_COMPLETED, @"");
-  // TODO(crbug.com/676129): LegacyNavigationManager has a bug that doesn't
-  // create a pending item when reloading the page. This is incorrectly causing
-  // the second navigation above to be considered a renderer-initiated
-  // navigation, and the abort reason is incorrectly logged as
-  // EVENT_OTHER_ABORTED.
-  if (!web::GetWebClient()->IsSlimNavigationManagerEnabled()) {
-    GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_USER_ABORTED, @"");
-    GREYAssertTrue(buckets[0].min & JourneyLogger::EVENT_OTHER_ABORTED, @"");
-  } else {
-    GREYAssertTrue(buckets[0].min & JourneyLogger::EVENT_USER_ABORTED, @"");
-    GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_OTHER_ABORTED, @"");
-  }
+  GREYAssertTrue(buckets[0].min & JourneyLogger::EVENT_USER_ABORTED, @"");
+  GREYAssertFalse(buckets[0].min & JourneyLogger::EVENT_OTHER_ABORTED, @"");
   GREYAssertFalse(
       buckets[0].min & JourneyLogger::EVENT_HAD_INITIAL_FORM_OF_PAYMENT, @"");
   GREYAssertFalse(
diff --git a/ios/third_party/material_components_ios/README.chromium b/ios/third_party/material_components_ios/README.chromium
index 2abdc6468..c395239 100644
--- a/ios/third_party/material_components_ios/README.chromium
+++ b/ios/third_party/material_components_ios/README.chromium
@@ -1,7 +1,7 @@
 Name: Material Components for iOS
 URL: https://github.com/material-components/material-components-ios
 Version: 0
-Revision: dcdd925166d5d8838c0b31721d00d5b250b444c4
+Revision: f6c357a1718718a576e1b57ef97c8d165b728068
 License: Apache 2.0
 License File: LICENSE
 Security Critical: yes
diff --git a/ios/web/web_state/ui/crw_web_controller.h b/ios/web/web_state/ui/crw_web_controller.h
index 8c43a40..ddbc091b 100644
--- a/ios/web/web_state/ui/crw_web_controller.h
+++ b/ios/web/web_state/ui/crw_web_controller.h
@@ -153,8 +153,11 @@
 // appropriate, as this method won't display any error to the user.
 - (GURL)currentURLWithTrustLevel:(web::URLVerificationTrustLevel*)trustLevel;
 
-// Methods for navigation and properties to interrogate state.
-- (void)reload;
+// Reloads web view. |isRendererInitiated| is YES for renderer-initiated
+// navigation. |isRendererInitiated| is NO for browser-initiated navigation.
+- (void)reloadWithRendererInitiatedNavigation:(BOOL)isRendererInitiated;
+
+// Stops web view loading.
 - (void)stopLoading;
 
 // Loads the URL indicated by current session state.
diff --git a/ios/web/web_state/ui/crw_web_controller.mm b/ios/web/web_state/ui/crw_web_controller.mm
index 7290011..1749c6063 100644
--- a/ios/web/web_state/ui/crw_web_controller.mm
+++ b/ios/web/web_state/ui/crw_web_controller.mm
@@ -2032,7 +2032,7 @@
          !_webStateImpl->HasWebUI();
 }
 
-- (void)reload {
+- (void)reloadWithRendererInitiatedNavigation:(BOOL)isRendererInitiated {
   // Clear last user interaction.
   // TODO(crbug.com/546337): Move to after the load commits, in the subclass
   // implementation. This will be inaccurate if the reload fails or is
@@ -2047,6 +2047,7 @@
                        transition:ui::PageTransition::PAGE_TRANSITION_RELOAD
            sameDocumentNavigation:NO
                    hasUserGesture:YES];
+    navigationContext->SetIsRendererInitiated(isRendererInitiated);
     _webStateImpl->OnNavigationStarted(navigationContext.get());
     [self didStartLoading];
     self.navigationManagerImpl->CommitPendingItem();
@@ -2221,7 +2222,7 @@
     return;
 
   if (delta == 0) {
-    [self reload];
+    [self reloadWithRendererInitiatedNavigation:YES];
     return;
   }
 
@@ -4191,6 +4192,7 @@
                        sameDocumentNavigation:NO
                                hasUserGesture:true];
   }
+  context->SetIsRendererInitiated(false);
   context->SetLoadingHtmlString(true);
   [_navigationStates setContext:std::move(context) forNavigation:navigation];
 }
@@ -4405,15 +4407,23 @@
     }
   }
 
+  ui::PageTransition transition =
+      [self pageTransitionFromNavigationType:action.navigationType];
   BOOL isMainFrameNavigationAction = [self isMainFrameNavigationAction:action];
-  if (base::FeatureList::IsEnabled(web::features::kWebErrorPages) &&
-      isMainFrameNavigationAction) {
+  if (isMainFrameNavigationAction) {
     web::NavigationContextImpl* context =
         [self contextForPendingMainFrameNavigationWithURL:requestURL];
-    if (context && context->IsLoadingErrorPage()) {
-      // loadHTMLString: navigation which loads error page into WKWebView.
-      decisionHandler(WKNavigationActionPolicyAllow);
-      return;
+    if (context) {
+      DCHECK(!context->IsRendererInitiated());
+      transition = context->GetPageTransition();
+
+      if (base::FeatureList::IsEnabled(web::features::kWebErrorPages)) {
+        if (context->IsLoadingErrorPage()) {
+          // loadHTMLString: navigation which loads error page into WKWebView.
+          decisionHandler(WKNavigationActionPolicyAllow);
+          return;
+        }
+      }
     }
   }
 
@@ -4457,8 +4467,6 @@
     return;
   }
 
-  ui::PageTransition transition =
-      [self pageTransitionFromNavigationType:action.navigationType];
   BOOL userInteractedWithRequestMainFrame =
       [self userClickedRecently] &&
       net::GURLWithNSURL(action.request.mainDocumentURL) ==
@@ -4975,7 +4983,11 @@
 
     web::NavigationItemImpl* item = web::GetItemWithUniqueID(
         self.navigationManagerImpl, context->GetNavigationItemUniqueID());
-    if (!IsWKInternalUrl(currentWKItemURL) && currentWKItemURL == webViewURL &&
+    // For reasons not fully understood, |item| may be nullptr. Only apply the
+    // location.replace heuristic if this is not the case.
+    // TODO(crbug.com/864769): Figure out the cause.
+    if (item && !IsWKInternalUrl(currentWKItemURL) &&
+        currentWKItemURL == webViewURL &&
         currentWKItemURL != context->GetUrl()) {
       // WKWebView sometimes changes URL on the same navigation, likely due to
       // location.replace() in onload handler that only changes page fragment.
@@ -5622,6 +5634,8 @@
       WKNavigation* navigation = [self loadPOSTRequest:request];
       [_navigationStates setContext:std::move(navigationContext)
                       forNavigation:navigation];
+      [_navigationStates setState:web::WKNavigationState::REQUESTED
+                    forNavigation:navigation];
       return;
     }
   }
@@ -5635,6 +5649,7 @@
                              transition:self.currentTransition
                  sameDocumentNavigation:sameDocumentNavigation
                          hasUserGesture:YES];
+    navigationContext->SetIsRendererInitiated(false);
     WKNavigation* navigation = [self loadRequest:request];
     [_navigationStates setContext:std::move(navigationContext)
                     forNavigation:navigation];
@@ -5677,6 +5692,7 @@
                              transition:self.currentTransition
                  sameDocumentNavigation:sameDocumentNavigation
                          hasUserGesture:YES];
+    navigationContext->SetIsRendererInitiated(false);
     WKNavigation* navigation = nil;
     if (navigationURL == net::GURLWithNSURL([_webView URL])) {
       navigation = [_webView reload];
diff --git a/ios/web/web_state/web_state_impl.mm b/ios/web/web_state/web_state_impl.mm
index 1795bc52..6b242e1 100644
--- a/ios/web/web_state/web_state_impl.mm
+++ b/ios/web/web_state/web_state_impl.mm
@@ -825,7 +825,7 @@
 }
 
 void WebStateImpl::Reload() {
-  [web_controller_ reload];
+  [web_controller_ reloadWithRendererInitiatedNavigation:NO];
 }
 
 void WebStateImpl::OnNavigationItemsPruned(size_t pruned_item_count) {
diff --git a/ios/web/web_state/web_state_observer_inttest.mm b/ios/web/web_state/web_state_observer_inttest.mm
index 4607db5..d06cf1b 100644
--- a/ios/web/web_state/web_state_observer_inttest.mm
+++ b/ios/web/web_state/web_state_observer_inttest.mm
@@ -403,11 +403,7 @@
   EXPECT_FALSE((*context)->HasCommitted());
   EXPECT_FALSE((*context)->IsDownload());
   EXPECT_FALSE((*context)->GetError());
-  // TODO(crbug.com/676129): Reload should not be renderer-initiated, but only
-  // marked so because LegacyNavigationManager doesn't create a pending item.
-  // WKBasedNavigationManager fixes this problem.
-  EXPECT_EQ(!GetWebClient()->IsSlimNavigationManagerEnabled(),
-            (*context)->IsRendererInitiated());
+  EXPECT_FALSE((*context)->IsRendererInitiated());
   EXPECT_FALSE((*context)->GetResponseHeaders());
   // TODO(crbug.com/676129): Reload does not create a pending item. Check
   // pending item once the bug is fixed. The slim navigation manager fixes this
@@ -444,11 +440,7 @@
   EXPECT_TRUE((*context)->HasCommitted());
   EXPECT_FALSE((*context)->IsDownload());
   EXPECT_FALSE((*context)->GetError());
-  // TODO(crbug.com/676129): Reload should not be renderer-initiated, but only
-  // marked so because LegacyNavigationManager doesn't create a pending item.
-  // WKBasedNavigationManager fixes this problem.
-  EXPECT_EQ(!GetWebClient()->IsSlimNavigationManagerEnabled(),
-            (*context)->IsRendererInitiated());
+  EXPECT_FALSE((*context)->IsRendererInitiated());
   if (is_web_page) {
     ASSERT_TRUE((*context)->GetResponseHeaders());
     std::string mime_type;
@@ -690,7 +682,7 @@
   int32_t nav_id = 0;
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
   WebStatePolicyDecider::RequestInfo expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_TYPED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   EXPECT_CALL(*decider_,
               ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
@@ -727,7 +719,7 @@
   int32_t nav_id = 0;
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
   WebStatePolicyDecider::RequestInfo expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_TYPED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   EXPECT_CALL(*decider_,
               ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
@@ -766,7 +758,7 @@
   int32_t nav_id = 0;
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
   WebStatePolicyDecider::RequestInfo expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_TYPED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   EXPECT_CALL(*decider_,
               ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
@@ -802,7 +794,7 @@
   // Perform new page navigation.
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
   WebStatePolicyDecider::RequestInfo expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_TYPED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   EXPECT_CALL(*decider_,
               ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
@@ -863,7 +855,7 @@
   // Perform new page navigation.
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
   WebStatePolicyDecider::RequestInfo expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_TYPED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   EXPECT_CALL(*decider_,
               ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
@@ -883,8 +875,11 @@
   NavigationContext* context = nullptr;
   int32_t nav_id = 0;
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
-  EXPECT_CALL(*decider_,
-              ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
+  WebStatePolicyDecider::RequestInfo expected_reload_request_info(
+      ui::PageTransition::PAGE_TRANSITION_RELOAD,
+      /*target_main_frame=*/true, /*has_user_gesture=*/false);
+  EXPECT_CALL(*decider_, ShouldAllowRequest(
+                             _, RequestInfoMatch(expected_reload_request_info)))
       .WillOnce(Return(true));
   EXPECT_CALL(observer_, DidStartNavigation(web_state(), _))
       .WillOnce(VerifyPageStartedContext(
@@ -918,7 +913,7 @@
   int32_t nav_id = 0;
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
   WebStatePolicyDecider::RequestInfo expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_TYPED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   EXPECT_CALL(*decider_,
               ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
@@ -944,7 +939,7 @@
   // Perform same-document navigation.
   const GURL hash_url = test_server_->GetURL("/echoall#1");
   WebStatePolicyDecider::RequestInfo hash_url_expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_TYPED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
 
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
@@ -1000,7 +995,7 @@
   int32_t nav_id = 0;
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
   WebStatePolicyDecider::RequestInfo expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_TYPED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   EXPECT_CALL(*decider_,
               ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
@@ -1025,8 +1020,11 @@
 
   // Perform same-page navigation using JavaScript.
   const GURL hash_url = test_server_->GetURL("/echoall#1");
-  EXPECT_CALL(*decider_,
-              ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
+  WebStatePolicyDecider::RequestInfo expected_hash_request_info(
+      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      /*target_main_frame=*/true, /*has_user_gesture=*/false);
+  EXPECT_CALL(*decider_, ShouldAllowRequest(
+                             _, RequestInfoMatch(expected_hash_request_info)))
       .WillOnce(Return(true));
   if (GetWebClient()->IsSlimNavigationManagerEnabled()) {
     EXPECT_CALL(observer_, DidChangeBackForwardState(web_state()));
@@ -1058,7 +1056,7 @@
   int32_t nav_id = 0;
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
   WebStatePolicyDecider::RequestInfo expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_TYPED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   EXPECT_CALL(*decider_,
               ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
@@ -1201,7 +1199,7 @@
   int32_t nav_id = 0;
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
   WebStatePolicyDecider::RequestInfo expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_TYPED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   EXPECT_CALL(*decider_,
               ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
@@ -1273,7 +1271,7 @@
     int32_t nav_id = 0;
     EXPECT_CALL(observer_, DidStartLoading(web_state()));
     WebStatePolicyDecider::RequestInfo expected_request_info(
-        ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+        ui::PageTransition::PAGE_TRANSITION_TYPED,
         /*target_main_frame=*/true, /*has_user_gesture=*/false);
     EXPECT_CALL(*decider_,
                 ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
@@ -1291,7 +1289,6 @@
         .WillOnce(VerifyTitle(url.GetContent()));
     EXPECT_CALL(observer_, TitleWasSet(web_state()))
         .WillOnce(VerifyTitle("EmbeddedTestServer - EchoAll"));
-    ;
     EXPECT_CALL(observer_, DidStopLoading(web_state()));
     EXPECT_CALL(observer_,
                 PageLoaded(web_state(), PageLoadCompletionStatus::SUCCESS));
@@ -1306,7 +1303,7 @@
   int32_t nav_id = 0;
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
   WebStatePolicyDecider::RequestInfo expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_GENERATED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   EXPECT_CALL(*decider_,
               ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
@@ -1325,7 +1322,6 @@
           /*renderer_initiated=*/false));
   EXPECT_CALL(observer_, TitleWasSet(web_state()))
       .WillOnce(VerifyTitle(url.GetContent()));
-  ;
   EXPECT_CALL(observer_, DidStopLoading(web_state()));
   EXPECT_CALL(observer_,
               PageLoaded(web_state(), PageLoadCompletionStatus::SUCCESS));
@@ -1334,6 +1330,7 @@
   NavigationManager::WebLoadParams params(url);
   params.post_data = [@"foo" dataUsingEncoding:NSUTF8StringEncoding];
   params.extra_headers = @{@"Content-Type" : @"text/html"};
+  params.transition_type = ui::PageTransition::PAGE_TRANSITION_GENERATED;
   ASSERT_TRUE(LoadWithParams(params));
   ASSERT_TRUE(WaitForWebViewContainingText(web_state(), "foo"));
 }
@@ -1346,7 +1343,7 @@
   // Perform new page navigation.
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
   WebStatePolicyDecider::RequestInfo expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_TYPED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   EXPECT_CALL(*decider_,
               ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
@@ -1408,7 +1405,7 @@
   // Perform new page navigation.
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
   WebStatePolicyDecider::RequestInfo expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_TYPED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   EXPECT_CALL(*decider_,
               ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
@@ -1461,7 +1458,7 @@
     // repost before calling policy decider.
   } else {
     WebStatePolicyDecider::RequestInfo form_reload_request_info(
-        ui::PageTransition::PAGE_TRANSITION_FORM_SUBMIT,
+        ui::PageTransition::PAGE_TRANSITION_RELOAD,
         /*target_main_frame=*/true, /*has_user_gesture=*/false);
 
     EXPECT_CALL(*decider_, ShouldAllowRequest(
@@ -1469,23 +1466,16 @@
         .WillOnce(Return(true));
   }
 
-  bool reload_is_renderer_initiated = false;
-  if (!GetWebClient()->IsSlimNavigationManagerEnabled()) {
-    // TODO(crbug.com/676129) LegacyNavigationManager doesn't create a pending
-    // item on reload. This causes the navigation context to be incorrectly
-    // marked renderer-initiated. Remove this workaround.
-    reload_is_renderer_initiated = true;
-  }
   EXPECT_CALL(observer_, DidStartNavigation(web_state(), _))
       .WillOnce(VerifyPostStartedContext(
           web_state(), action, /*has_user_gesture=*/true, &context, &nav_id,
-          reload_is_renderer_initiated));
+          /*reload_is_renderer_initiated=*/false));
   EXPECT_CALL(*decider_, ShouldAllowResponse(_, /*for_main_frame=*/true))
       .WillOnce(Return(true));
   EXPECT_CALL(observer_, DidFinishNavigation(web_state(), _))
       .WillOnce(VerifyPostFinishedContext(
           web_state(), action, /*has_user_gesture=*/true, &context, &nav_id,
-          reload_is_renderer_initiated));
+          /*reload_is_renderer_initiated=*/false));
   EXPECT_CALL(observer_, TitleWasSet(web_state()))
       .WillOnce(VerifyTitle(action.GetContent()));
   EXPECT_CALL(observer_, TitleWasSet(web_state()))
@@ -1516,7 +1506,7 @@
   // Perform new page navigation.
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
   WebStatePolicyDecider::RequestInfo expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_TYPED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   EXPECT_CALL(*decider_,
               ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
@@ -1560,7 +1550,9 @@
 
   // Go Back.
   WebStatePolicyDecider::RequestInfo back_request_info(
-      ui::PageTransition::PAGE_TRANSITION_FORWARD_BACK,
+      static_cast<ui::PageTransition>(
+          ui::PageTransition::PAGE_TRANSITION_FORWARD_BACK |
+          ui::PageTransition::PAGE_TRANSITION_TYPED),
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   if (GetWebClient()->IsSlimNavigationManagerEnabled()) {
     EXPECT_CALL(observer_, DidChangeBackForwardState(web_state())).Times(2);
@@ -1594,7 +1586,9 @@
 
   // Go forward.
   WebStatePolicyDecider::RequestInfo forward_request_info(
-      ui::PageTransition::PAGE_TRANSITION_FORWARD_BACK,
+      static_cast<ui::PageTransition>(
+          ui::PageTransition::PAGE_TRANSITION_FORM_SUBMIT |
+          ui::PageTransition::PAGE_TRANSITION_FORWARD_BACK),
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   NavigationContext* context = nullptr;
   int32_t nav_id = 0;
@@ -1641,7 +1635,7 @@
   int32_t nav_id = 0;
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
   WebStatePolicyDecider::RequestInfo expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_TYPED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   EXPECT_CALL(*decider_,
               ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
@@ -1651,8 +1645,12 @@
           web_state(), url, ui::PageTransition::PAGE_TRANSITION_TYPED, &context,
           &nav_id));
   // Second ShouldAllowRequest call is for redirect_url.
-  EXPECT_CALL(*decider_,
-              ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
+  WebStatePolicyDecider::RequestInfo expected_redirect_request_info(
+      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      /*target_main_frame=*/true, /*has_user_gesture=*/false);
+  EXPECT_CALL(
+      *decider_,
+      ShouldAllowRequest(_, RequestInfoMatch(expected_redirect_request_info)))
       .WillOnce(Return(true));
   EXPECT_CALL(*decider_, ShouldAllowResponse(_, /*for_main_frame=*/true))
       .WillOnce(Return(true));
@@ -1678,7 +1676,7 @@
   int32_t nav_id = 0;
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
   WebStatePolicyDecider::RequestInfo expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_TYPED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   EXPECT_CALL(*decider_,
               ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
@@ -1712,7 +1710,7 @@
   int32_t nav_id = 0;
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
   WebStatePolicyDecider::RequestInfo expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_TYPED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   EXPECT_CALL(*decider_,
               ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
@@ -1749,7 +1747,7 @@
 TEST_P(WebStateObserverTest, DisallowRequest) {
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
   WebStatePolicyDecider::RequestInfo expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_TYPED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   EXPECT_CALL(*decider_,
               ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
@@ -1769,7 +1767,7 @@
   int32_t nav_id = 0;
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
   WebStatePolicyDecider::RequestInfo expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_TYPED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   EXPECT_CALL(*decider_,
               ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
@@ -1794,7 +1792,7 @@
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
   EXPECT_CALL(observer_, DidStopLoading(web_state()));
   WebStatePolicyDecider::RequestInfo expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_TYPED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   EXPECT_CALL(*decider_,
               ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
@@ -1812,7 +1810,7 @@
   int32_t nav_id = 0;
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
   WebStatePolicyDecider::RequestInfo expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_TYPED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   EXPECT_CALL(*decider_,
               ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
@@ -1858,7 +1856,7 @@
   // Callbacks due to loading of the main frame.
   EXPECT_CALL(observer_, DidStartLoading(web_state()));
   WebStatePolicyDecider::RequestInfo expected_request_info(
-      ui::PageTransition::PAGE_TRANSITION_CLIENT_REDIRECT,
+      ui::PageTransition::PAGE_TRANSITION_TYPED,
       /*target_main_frame=*/true, /*has_user_gesture=*/false);
   EXPECT_CALL(*decider_,
               ShouldAllowRequest(_, RequestInfoMatch(expected_request_info)))
diff --git a/ios/web_view/internal/autofill/cwv_autofill_profile_unittest.mm b/ios/web_view/internal/autofill/cwv_autofill_profile_unittest.mm
index ee23735d..d7fcaab2 100644
--- a/ios/web_view/internal/autofill/cwv_autofill_profile_unittest.mm
+++ b/ios/web_view/internal/autofill/cwv_autofill_profile_unittest.mm
@@ -11,6 +11,7 @@
 #include "components/autofill/core/browser/autofill_profile.h"
 #include "components/autofill/core/browser/autofill_test_utils.h"
 #include "components/autofill/core/browser/autofill_type.h"
+#include "components/autofill/core/browser/country_names.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #import "testing/gtest_mac.h"
 #include "testing/platform_test.h"
@@ -30,6 +31,7 @@
     ui::ResourceBundle::InitSharedInstanceWithLocale(
         l10n_util::GetLocaleOverride(), /*delegate=*/nullptr,
         ui::ResourceBundle::DO_NOT_LOAD_COMMON_RESOURCES);
+    autofill::CountryNames::SetLocaleString(l10n_util::GetLocaleOverride());
   }
 
   ~CWVAutofillProfileTest() override {
diff --git a/ios/web_view/test/navigation_delegate_inttest.mm b/ios/web_view/test/navigation_delegate_inttest.mm
index 215100e..44160c6 100644
--- a/ios/web_view/test/navigation_delegate_inttest.mm
+++ b/ios/web_view/test/navigation_delegate_inttest.mm
@@ -53,10 +53,10 @@
 
 // Tests that expected delegate methods are called for a successful request.
 TEST_F(NavigationDelegateTest, RequestSucceeds) {
-  // A request made with -loadRequest: has type CWVNavigationTypeClientRedirect.
+  // A request made with -loadRequest: has type CWVNavigationTypeTyped.
   OCMExpect([mock_delegate_ webView:web_view_
                 shouldStartLoadWithRequest:ArgWithURL(GetEchoURL())
-                            navigationType:CWVNavigationTypeClientRedirect])
+                            navigationType:CWVNavigationTypeTyped])
       .andReturn(YES);
   OCMExpect([mock_delegate_ webViewDidStartProvisionalNavigation:web_view_]);
   OCMExpect([mock_delegate_ webView:web_view_
@@ -74,7 +74,7 @@
 TEST_F(NavigationDelegateTest, RequestFails) {
   OCMExpect([mock_delegate_ webView:web_view_
                 shouldStartLoadWithRequest:ArgWithURL(GetCloseSocketURL())
-                            navigationType:CWVNavigationTypeClientRedirect])
+                            navigationType:CWVNavigationTypeTyped])
       .andReturn(YES);
   OCMExpect([mock_delegate_ webViewDidStartProvisionalNavigation:web_view_]);
   OCMExpect([mock_delegate_ webViewDidCommitNavigation:web_view_]);
@@ -92,7 +92,7 @@
 TEST_F(NavigationDelegateTest, CancelRequest) {
   OCMExpect([mock_delegate_ webView:web_view_
                 shouldStartLoadWithRequest:ArgWithURL(GetEchoURL())
-                            navigationType:CWVNavigationTypeClientRedirect])
+                            navigationType:CWVNavigationTypeTyped])
       .andReturn(NO);
 
   ASSERT_TRUE(test::LoadUrl(web_view_, GetEchoURL()));
@@ -104,7 +104,7 @@
 TEST_F(NavigationDelegateTest, CancelResponse) {
   OCMExpect([mock_delegate_ webView:web_view_
                 shouldStartLoadWithRequest:ArgWithURL(GetEchoURL())
-                            navigationType:CWVNavigationTypeClientRedirect])
+                            navigationType:CWVNavigationTypeTyped])
       .andReturn(YES);
   OCMExpect([mock_delegate_ webViewDidStartProvisionalNavigation:web_view_]);
   OCMExpect([mock_delegate_ webView:web_view_
diff --git a/ipc/OWNERS b/ipc/OWNERS
index da4755ba..22e14d2 100644
--- a/ipc/OWNERS
+++ b/ipc/OWNERS
@@ -1,5 +1,5 @@
 jam@chromium.org
-rockot@chromium.org
+rockot@google.com
 tsepez@chromium.org
 
 # New IPC message files require a security review to avoid introducing
diff --git a/media/blink/resource_multibuffer_data_provider.cc b/media/blink/resource_multibuffer_data_provider.cc
index 89f1c9e..8363162e 100644
--- a/media/blink/resource_multibuffer_data_provider.cc
+++ b/media/blink/resource_multibuffer_data_provider.cc
@@ -124,16 +124,16 @@
     }
   }
 
-  active_loader_ =
-      url_data_->url_index()->fetch_context()->CreateUrlLoader(options);
-
   url_data_->WaitToLoad(
       base::BindOnce(&ResourceMultiBufferDataProvider::StartLoading,
-                     weak_factory_.GetWeakPtr(), std::move(request)));
+                     weak_factory_.GetWeakPtr(), std::move(request), options));
 }
 
 void ResourceMultiBufferDataProvider::StartLoading(
-    std::unique_ptr<WebURLRequest> request) {
+    std::unique_ptr<WebURLRequest> request,
+    const blink::WebAssociatedURLLoaderOptions& options) {
+  active_loader_ =
+      url_data_->url_index()->fetch_context()->CreateUrlLoader(options);
   active_loader_->LoadAsynchronously(*request, this);
 }
 
diff --git a/media/blink/resource_multibuffer_data_provider.h b/media/blink/resource_multibuffer_data_provider.h
index 68f360a..5c24d194 100644
--- a/media/blink/resource_multibuffer_data_provider.h
+++ b/media/blink/resource_multibuffer_data_provider.h
@@ -22,6 +22,7 @@
 
 namespace blink {
 class WebAssociatedURLLoader;
+struct WebAssociatedURLLoaderOptions;
 }  // namespace blink
 
 namespace media {
@@ -72,7 +73,8 @@
 
   // At the end of Start(), we potentially wait for other loaders to
   // finish, when they do a callback calls this function.
-  void StartLoading(std::unique_ptr<blink::WebURLRequest> request);
+  void StartLoading(std::unique_ptr<blink::WebURLRequest> request,
+                    const blink::WebAssociatedURLLoaderOptions& options);
 
   // Parse a Content-Range header into its component pieces and return true if
   // each of the expected elements was found & parsed correctly.
diff --git a/media/cdm/library_cdm/clear_key_cdm/cdm_file_adapter.cc b/media/cdm/library_cdm/clear_key_cdm/cdm_file_adapter.cc
index d5e4f02..f5d28505 100644
--- a/media/cdm/library_cdm/clear_key_cdm/cdm_file_adapter.cc
+++ b/media/cdm/library_cdm/clear_key_cdm/cdm_file_adapter.cc
@@ -16,11 +16,11 @@
 
 CdmFileAdapter::Status ConvertStatus(cdm::FileIOClient::Status status) {
   switch (status) {
-    case cdm::FileIOClient::kSuccess:
+    case cdm::FileIOClient::Status::kSuccess:
       return CdmFileAdapter::Status::kSuccess;
-    case cdm::FileIOClient::kInUse:
+    case cdm::FileIOClient::Status::kInUse:
       return CdmFileAdapter::Status::kInUse;
-    case cdm::FileIOClient::kError:
+    case cdm::FileIOClient::Status::kError:
       return CdmFileAdapter::Status::kError;
   }
 
@@ -66,12 +66,13 @@
 void CdmFileAdapter::OnReadComplete(cdm::FileIOClient::Status status,
                                     const uint8_t* data,
                                     uint32_t data_size) {
-  std::move(read_cb_).Run(status == kSuccess && data_size > 0,
-                          std::vector<uint8_t>(data, data + data_size));
+  std::move(read_cb_).Run(
+      status == FileIOClient::Status::kSuccess && data_size > 0,
+      std::vector<uint8_t>(data, data + data_size));
 }
 
 void CdmFileAdapter::OnWriteComplete(cdm::FileIOClient::Status status) {
-  std::move(write_cb_).Run(status == kSuccess);
+  std::move(write_cb_).Run(status == FileIOClient::Status::kSuccess);
 }
 
 }  // namespace media
diff --git a/media/cdm/library_cdm/clear_key_cdm/cdm_file_io_test.cc b/media/cdm/library_cdm/clear_key_cdm/cdm_file_io_test.cc
index df13c7d..75d4c46a 100644
--- a/media/cdm/library_cdm/clear_key_cdm/cdm_file_io_test.cc
+++ b/media/cdm/library_cdm/clear_key_cdm/cdm_file_io_test.cc
@@ -38,9 +38,9 @@
         new FileIOTest(create_file_io_cb_, test_name)); \
     CREATE_FILE_IO  // Create FileIO for each test case.
 
-#define ADD_TEST_STEP(type, status, data, data_size)                    \
-    test_case->AddTestStep(FileIOTest::type, cdm::FileIOClient::status, \
-                          (data), (data_size));
+#define ADD_TEST_STEP(type, status, data, data_size)                          \
+  test_case->AddTestStep(FileIOTest::type, cdm::FileIOClient::Status::status, \
+                         (data), (data_size));
 
 #define END_TEST_CASE                                 \
     remaining_tests_.push_back(std::move(test_case)); \
@@ -573,7 +573,7 @@
   if (a.type != b.type || a.status != b.status)
     return false;
 
-  if (a.type != RESULT_READ || a.status != cdm::FileIOClient::kSuccess)
+  if (a.type != RESULT_READ || a.status != cdm::FileIOClient::Status::kSuccess)
     return true;
 
   return (a.data_size == b.data_size &&
diff --git a/mojo/OWNERS b/mojo/OWNERS
index 1462224..783cf55 100644
--- a/mojo/OWNERS
+++ b/mojo/OWNERS
@@ -1,6 +1,6 @@
 ben@chromium.org
 jam@chromium.org
-rockot@chromium.org
+rockot@google.com
 sky@chromium.org
 
 # For Fuchsia-specific changes:
diff --git a/net/nqe/network_quality_estimator.cc b/net/nqe/network_quality_estimator.cc
index e32c6f4d..59d7450 100644
--- a/net/nqe/network_quality_estimator.cc
+++ b/net/nqe/network_quality_estimator.cc
@@ -891,43 +891,6 @@
                             EFFECTIVE_CONNECTION_TYPE_LAST);
 }
 
-void NetworkQualityEstimator::ComputeBandwidthDelayProduct() {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-
-  // Reset the bandwidth delay product to prevent stale values being returned.
-  bandwidth_delay_product_kbits_.reset();
-
-  // Record the bandwidth delay product (BDP) from the 80 percentile throughput
-  // and the 20 percentile transport RTT. Percentiles are reversed for
-  // throughput. The reason for using the 20 percentile transport RTT is to get
-  // an estimate of the true RTT sans the queueing delay. The minimum value of
-  // transport RTT was not used because it is likely to be noisy. For
-  // throughput, the 80 percentile value is considered to get an estimate of the
-  // maximum bandwidth when there is no congestion. The maximum value of
-  // observed throughput was not used because it is likely to be noisy.
-  base::TimeDelta transport_rtt = GetRTTEstimateInternal(
-      base::TimeTicks(), nqe::internal::OBSERVATION_CATEGORY_TRANSPORT, 20,
-      nullptr);
-  if (transport_rtt == nqe::internal::InvalidRTT())
-    return;
-
-  int32_t downlink_throughput_kbps =
-      GetDownlinkThroughputKbpsEstimateInternal(base::TimeTicks(), 20);
-  if (downlink_throughput_kbps == nqe::internal::INVALID_RTT_THROUGHPUT)
-    return;
-
-  bandwidth_delay_product_kbits_ =
-      (downlink_throughput_kbps * transport_rtt.InMilliseconds()) / 1000;
-
-  // Record UMA histograms.
-  UMA_HISTOGRAM_TIMES("NQE.BDPComputationTransportRTT.OnECTComputation",
-                      transport_rtt);
-  UMA_HISTOGRAM_COUNTS_1M("NQE.BDPComputationKbps.OnECTComputation",
-                          downlink_throughput_kbps);
-  UMA_HISTOGRAM_COUNTS_1M("NQE.BDPKbits.OnECTComputation",
-                          bandwidth_delay_product_kbits_.value());
-}
-
 void NetworkQualityEstimator::ComputeEffectiveConnectionType() {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
@@ -952,8 +915,6 @@
 
   network_quality_ = nqe::internal::NetworkQuality(http_rtt, transport_rtt,
                                                    downstream_throughput_kbps);
-  ComputeBandwidthDelayProduct();
-
   UMA_HISTOGRAM_ENUMERATION("NQE.EffectiveConnectionType.OnECTComputation",
                             effective_connection_type_,
                             EFFECTIVE_CONNECTION_TYPE_LAST);
@@ -1680,12 +1641,6 @@
   return network_quality_.downstream_throughput_kbps();
 }
 
-base::Optional<int32_t> NetworkQualityEstimator::GetBandwidthDelayProductKbits()
-    const {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  return bandwidth_delay_product_kbits_;
-}
-
 void NetworkQualityEstimator::MaybeUpdateCachedEstimateApplied(
     const Observation& observation,
     ObservationBuffer* buffer) {
diff --git a/net/nqe/network_quality_estimator.h b/net/nqe/network_quality_estimator.h
index a3dbd14..4a32d96 100644
--- a/net/nqe/network_quality_estimator.h
+++ b/net/nqe/network_quality_estimator.h
@@ -153,12 +153,6 @@
   // null.
   base::Optional<int32_t> GetDownstreamThroughputKbps() const;
 
-  // Returns the current bandwidth delay product estimate (in kilobits). If the
-  // estimate is not available, the returned optional value is null. The
-  // bandwidth delay product is calculated from the transport RTT and the
-  // downlink bandwidth estimates. Virtualized for testing.
-  virtual base::Optional<int32_t> GetBandwidthDelayProductKbits() const;
-
   // Adds |observer| to the list of RTT and throughput estimate observers.
   // The observer must register and unregister itself on the same thread.
   // |observer| would be notified on the thread on which it registered.
@@ -416,7 +410,6 @@
                            OnPrefsReadWithReadingDisabled);
   FRIEND_TEST_ALL_PREFIXES(NetworkQualityEstimatorTest,
                            ForceEffectiveConnectionTypeThroughFieldTrial);
-  FRIEND_TEST_ALL_PREFIXES(NetworkQualityEstimatorTest, TestBDPComputation);
   FRIEND_TEST_ALL_PREFIXES(NetworkQualityEstimatorTest,
                            ObservationDiscardedIfCachedEstimateAvailable);
   FRIEND_TEST_ALL_PREFIXES(NetworkQualityEstimatorTest,
@@ -514,11 +507,6 @@
   // Returns true if the cached network quality estimate was successfully read.
   bool ReadCachedNetworkQualityEstimate();
 
-  // Computes the bandwidth delay product in kilobits. The computed value is
-  // stored in |bandwidth_delay_product_kbits_| and can be accessed using
-  // |GetBandwidthDelayProductKbits|.
-  void ComputeBandwidthDelayProduct();
-
   // Gathers metrics for the next connection type. Called when there is a change
   // in the connection type.
   void GatherEstimatesForNextConnectionType();
@@ -625,9 +613,6 @@
   nqe::internal::NetworkQuality network_quality_;
   base::Optional<base::TimeDelta> end_to_end_rtt_;
 
-  // Current estimate of the bandwidth delay product (BDP) in kilobits.
-  base::Optional<int32_t> bandwidth_delay_product_kbits_;
-
   // Current effective connection type. It is updated on connection change
   // events. It is also updated every time there is network traffic (provided
   // the last computation was more than
diff --git a/net/nqe/network_quality_estimator_test_util.cc b/net/nqe/network_quality_estimator_test_util.cc
index dc3f79df..63a6be5f 100644
--- a/net/nqe/network_quality_estimator_test_util.cc
+++ b/net/nqe/network_quality_estimator_test_util.cc
@@ -262,13 +262,6 @@
   return NetworkQualityEstimator::GetAccuracyRecordingIntervals();
 }
 
-base::Optional<int32_t>
-TestNetworkQualityEstimator::GetBandwidthDelayProductKbits() const {
-  if (bandwidth_delay_product_kbits_.has_value())
-    return bandwidth_delay_product_kbits_.value();
-  return NetworkQualityEstimator::GetBandwidthDelayProductKbits();
-}
-
 int TestNetworkQualityEstimator::GetEntriesCount(NetLogEventType type) const {
   TestNetLogEntry::List entries;
   net_log_->GetEntries(&entries);
diff --git a/net/nqe/network_quality_estimator_test_util.h b/net/nqe/network_quality_estimator_test_util.h
index 21ec983..ee90d80 100644
--- a/net/nqe/network_quality_estimator_test_util.h
+++ b/net/nqe/network_quality_estimator_test_util.h
@@ -193,12 +193,6 @@
   const std::vector<base::TimeDelta>& GetAccuracyRecordingIntervals()
       const override;
 
-  void set_bandwidth_delay_product_kbits(int32_t value) {
-    bandwidth_delay_product_kbits_ = value;
-  }
-
-  base::Optional<int32_t> GetBandwidthDelayProductKbits() const override;
-
   // Returns the number of entries in |net_log_| that have type set to |type|.
   int GetEntriesCount(NetLogEventType type) const;
 
@@ -286,10 +280,6 @@
   // If set, GetRTTEstimateInternal() would return the set value.
   base::Optional<base::TimeDelta> start_time_null_end_to_end_rtt_;
 
-  // If set, GetBandwidthDelayProductKbits() would return its set value.
-  // Otherwise, the base implementation is called.
-  base::Optional<int32_t> bandwidth_delay_product_kbits_;
-
   LocalHttpTestServer embedded_test_server_;
 
   // If true, notifications are not sent to any of the observers.
diff --git a/net/nqe/network_quality_estimator_unittest.cc b/net/nqe/network_quality_estimator_unittest.cc
index 1bb16ee..ec0d7a1 100644
--- a/net/nqe/network_quality_estimator_unittest.cc
+++ b/net/nqe/network_quality_estimator_unittest.cc
@@ -2680,42 +2680,6 @@
       &effective_connection_type_observer);
 }
 
-// Tests that |ComputeBandwidthDelayProduct| calculates the
-// BDP correctly and records histogram data.
-TEST_F(NetworkQualityEstimatorTest, TestBDPComputation) {
-  TestNetworkQualityEstimator estimator;
-  base::HistogramTester histogram_tester;
-  base::TimeTicks now = base::TimeTicks::Now();
-  for (int i = 1; i <= std::pow(2, 10); i *= 2) {
-    estimator
-        .rtt_ms_observations_[nqe::internal::OBSERVATION_CATEGORY_TRANSPORT]
-        .AddObservation(NetworkQualityEstimator::Observation(
-            i, now, INT32_MIN, NETWORK_QUALITY_OBSERVATION_SOURCE_TCP));
-  }
-  for (int i = 1; i <= std::pow(3, 10); i *= 3) {
-    estimator.http_downstream_throughput_kbps_observations_.AddObservation(
-        NetworkQualityEstimator::Observation(
-            i, now, INT32_MIN, NETWORK_QUALITY_OBSERVATION_SOURCE_HTTP));
-  }
-  estimator.RunOneRequest();
-
-  // Histograms must contain at least one entry each.
-  EXPECT_GE(
-      1u, histogram_tester
-              .GetAllSamples("NQE.BDPComputationTransportRTT.OnECTComputation")
-              .size());
-  EXPECT_GE(1u, histogram_tester
-                    .GetAllSamples("NQE.BDPComputationKbps.OnECTComputation")
-                    .size());
-  EXPECT_GE(
-      1u,
-      histogram_tester.GetAllSamples("NQE.BDPKbits.OnECTComputation").size());
-
-  EXPECT_TRUE(estimator.GetBandwidthDelayProductKbits().has_value());
-  EXPECT_EQ(estimator.GetBandwidthDelayProductKbits().value(),
-            (int32_t)(std::pow(2, 2) * std::pow(3, 8) / 1000));
-}
-
 // Verifies that when the cached network qualities from the prefs are available,
 // then estimates from the platform or the external estimate provider are not
 // used.
diff --git a/pdf/pdfium/fuzzers/BUILD.gn b/pdf/pdfium/fuzzers/BUILD.gn
index 4aa6514..a44c928 100644
--- a/pdf/pdfium/fuzzers/BUILD.gn
+++ b/pdf/pdfium/fuzzers/BUILD.gn
@@ -27,6 +27,7 @@
     ":pdf_jpx_fuzzer",
     ":pdf_psengine_fuzzer",
     ":pdf_streamparser_fuzzer",
+    ":pdf_xml_fuzzer",
     ":pdfium_fuzzer",
   ]
   if (pdf_enable_xfa) {
@@ -37,7 +38,6 @@
       ":pdf_css_fuzzer",
       ":pdf_fm2js_fuzzer",
       ":pdf_formcalc_fuzzer",
-      ":pdf_xml_fuzzer",
       ":pdfium_xfa_fuzzer",
     ]
     if (pdf_enable_xfa_bmp) {
@@ -146,6 +146,14 @@
   ]
 }
 
+fuzzer_test("pdf_xml_fuzzer") {
+  sources = []
+  deps = [
+    "//third_party/pdfium/testing/fuzzers:pdf_xml_fuzzer_src",
+  ]
+  dict = "dicts/pdf_xml.dict"
+}
+
 if (pdf_enable_xfa) {
   if (pdf_enable_xfa_bmp) {
     fuzzer_test("pdf_codec_bmp_fuzzer") {
@@ -237,14 +245,6 @@
     }
   }
 
-  fuzzer_test("pdf_xml_fuzzer") {
-    sources = []
-    deps = [
-      "//third_party/pdfium/testing/fuzzers:pdf_xml_fuzzer_src",
-    ]
-    dict = "dicts/pdf_xml.dict"
-  }
-
   fuzzer_test("pdf_bidi_fuzzer") {
     sources = []
     deps = [
diff --git a/remoting/host/BUILD.gn b/remoting/host/BUILD.gn
index 563d831..ab8ccd9a 100644
--- a/remoting/host/BUILD.gn
+++ b/remoting/host/BUILD.gn
@@ -54,6 +54,8 @@
 # stripping code.
 static_library("host") {
   sources = [
+    "action_executor.cc",
+    "action_executor.h",
     "audio_capturer.cc",
     "audio_capturer.h",
     "audio_capturer_chromeos.cc",
@@ -189,6 +191,8 @@
     "input_injector_mac.cc",
     "input_injector_win.cc",
     "input_injector_x11.cc",
+    "ipc_action_executor.cc",
+    "ipc_action_executor.h",
     "ipc_audio_capturer.cc",
     "ipc_audio_capturer.h",
     "ipc_constants.cc",
diff --git a/remoting/host/action_executor.cc b/remoting/host/action_executor.cc
new file mode 100644
index 0000000..1362776
--- /dev/null
+++ b/remoting/host/action_executor.cc
@@ -0,0 +1,18 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "remoting/host/action_executor.h"
+
+namespace remoting {
+
+// static
+std::unique_ptr<ActionExecutor> ActionExecutor::Create() {
+  return nullptr;
+}
+
+ActionExecutor::ActionExecutor() = default;
+
+ActionExecutor::~ActionExecutor() = default;
+
+}  // namespace remoting
diff --git a/remoting/host/action_executor.h b/remoting/host/action_executor.h
new file mode 100644
index 0000000..0b738f8
--- /dev/null
+++ b/remoting/host/action_executor.h
@@ -0,0 +1,38 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef REMOTING_HOST_ACTION_EXECUTOR_H_
+#define REMOTING_HOST_ACTION_EXECUTOR_H_
+
+#include <memory>
+
+#include "base/macros.h"
+
+namespace remoting {
+
+namespace protocol {
+class ActionRequest;
+}  // namespace protocol
+
+class ActionExecutor {
+ public:
+  virtual ~ActionExecutor();
+
+  // Creates an action executor for the current platform / host architecture.
+  static std::unique_ptr<ActionExecutor> Create();
+
+  // Implementations must never assume the presence of any |request| fields,
+  // nor assume that their contents are valid.
+  virtual void ExecuteAction(const protocol::ActionRequest& request) = 0;
+
+ protected:
+  ActionExecutor();
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(ActionExecutor);
+};
+
+}  // namespace remoting
+
+#endif  // REMOTING_HOST_ACTION_EXECUTOR_H_
diff --git a/remoting/host/basic_desktop_environment.cc b/remoting/host/basic_desktop_environment.cc
index b4ab9fd..3c9ee36 100644
--- a/remoting/host/basic_desktop_environment.cc
+++ b/remoting/host/basic_desktop_environment.cc
@@ -8,6 +8,7 @@
 #include "base/logging.h"
 #include "base/single_thread_task_runner.h"
 #include "build/build_config.h"
+#include "remoting/host/action_executor.h"
 #include "remoting/host/audio_capturer.h"
 #include "remoting/host/client_session_control.h"
 #include "remoting/host/desktop_capturer_proxy.h"
@@ -34,6 +35,15 @@
   DCHECK(caller_task_runner_->BelongsToCurrentThread());
 }
 
+std::unique_ptr<ActionExecutor>
+BasicDesktopEnvironment::CreateActionExecutor() {
+  DCHECK(caller_task_runner_->BelongsToCurrentThread());
+
+  // Connection mode derivations (It2Me/Me2Me) should override this method and
+  // return an executor instance if applicable.
+  return nullptr;
+}
+
 std::unique_ptr<AudioCapturer> BasicDesktopEnvironment::CreateAudioCapturer() {
   DCHECK(caller_task_runner_->BelongsToCurrentThread());
 
diff --git a/remoting/host/basic_desktop_environment.h b/remoting/host/basic_desktop_environment.h
index 554489c..f59e0079 100644
--- a/remoting/host/basic_desktop_environment.h
+++ b/remoting/host/basic_desktop_environment.h
@@ -37,6 +37,7 @@
   ~BasicDesktopEnvironment() override;
 
   // DesktopEnvironment implementation.
+  std::unique_ptr<ActionExecutor> CreateActionExecutor() override;
   std::unique_ptr<AudioCapturer> CreateAudioCapturer() override;
   std::unique_ptr<InputInjector> CreateInputInjector() override;
   std::unique_ptr<ScreenControls> CreateScreenControls() override;
diff --git a/remoting/host/chromoting_messages.h b/remoting/host/chromoting_messages.h
index 465ff5a..d994e9a 100644
--- a/remoting/host/chromoting_messages.h
+++ b/remoting/host/chromoting_messages.h
@@ -14,6 +14,7 @@
 #include "remoting/host/chromoting_param_traits.h"
 #include "remoting/host/desktop_environment_options.h"
 #include "remoting/host/screen_resolution.h"
+#include "remoting/proto/action.pb.h"
 #include "remoting/proto/process_stats.pb.h"
 #include "remoting/protocol/errors.h"
 #include "remoting/protocol/transport.h"
@@ -244,6 +245,10 @@
 IPC_MESSAGE_CONTROL1(ChromotingNetworkDesktopMsg_SetScreenResolution,
                      remoting::ScreenResolution /* resolution */)
 
+// Carries an action request event from the client to the desktop session agent.
+IPC_MESSAGE_CONTROL1(ChromotingNetworkDesktopMsg_ExecuteActionRequest,
+                     remoting::protocol::ActionRequest /* request */)
+
 //---------------------------------------------------------------------
 // Chromoting messages sent from the remote_security_key process to the
 // network process.
diff --git a/remoting/host/chromoting_param_traits.cc b/remoting/host/chromoting_param_traits.cc
index 10d759e..b4522b4 100644
--- a/remoting/host/chromoting_param_traits.cc
+++ b/remoting/host/chromoting_param_traits.cc
@@ -322,5 +322,34 @@
   l->append(")");
 }
 
+// static
+void ParamTraits<remoting::protocol::ActionRequest>::Write(
+    base::Pickle* m,
+    const param_type& p) {
+  std::string serialized_action_request;
+  bool result = p.SerializeToString(&serialized_action_request);
+  DCHECK(result);
+  m->WriteString(serialized_action_request);
+}
+
+// static
+bool ParamTraits<remoting::protocol::ActionRequest>::Read(
+    const base::Pickle* m,
+    base::PickleIterator* iter,
+    param_type* p) {
+  std::string serialized_action_request;
+  if (!iter->ReadString(&serialized_action_request))
+    return false;
+
+  return p->ParseFromString(serialized_action_request);
+}
+
+// static
+void ParamTraits<remoting::protocol::ActionRequest>::Log(const param_type& p,
+                                                         std::string* l) {
+  l->append(base::StringPrintf("ActionRequest action: %d, id: %u", p.action(),
+                               p.request_id()));
+}
+
 }  // namespace IPC
 
diff --git a/remoting/host/chromoting_param_traits.h b/remoting/host/chromoting_param_traits.h
index 9000505e..73fd18a 100644
--- a/remoting/host/chromoting_param_traits.h
+++ b/remoting/host/chromoting_param_traits.h
@@ -11,6 +11,7 @@
 #include "net/base/ip_endpoint.h"
 #include "remoting/host/desktop_environment_options.h"
 #include "remoting/host/screen_resolution.h"
+#include "remoting/proto/action.pb.h"
 #include "remoting/proto/process_stats.pb.h"
 #include "third_party/webrtc/modules/desktop_capture/desktop_frame.h"
 #include "third_party/webrtc/modules/desktop_capture/desktop_geometry.h"
@@ -98,6 +99,16 @@
   static void Log(const param_type& p, std::string* l);
 };
 
+template <>
+struct ParamTraits<remoting::protocol::ActionRequest> {
+  typedef remoting::protocol::ActionRequest param_type;
+  static void Write(base::Pickle* m, const param_type& p);
+  static bool Read(const base::Pickle* m,
+                   base::PickleIterator* iter,
+                   param_type* p);
+  static void Log(const param_type& p, std::string* l);
+};
+
 }  // namespace IPC
 
 #endif  // REMOTING_HOST_CHROMOTING_PARAM_TRAITS_H_
diff --git a/remoting/host/desktop_environment.h b/remoting/host/desktop_environment.h
index 895bd077..512e123 100644
--- a/remoting/host/desktop_environment.h
+++ b/remoting/host/desktop_environment.h
@@ -21,6 +21,7 @@
 
 namespace remoting {
 
+class ActionExecutor;
 class AudioCapturer;
 class ClientSessionControl;
 class FileProxyWrapper;
@@ -35,6 +36,7 @@
 
   // Factory methods used to create audio/video capturers, event executor, and
   // screen controls object for a particular desktop environment.
+  virtual std::unique_ptr<ActionExecutor> CreateActionExecutor() = 0;
   virtual std::unique_ptr<AudioCapturer> CreateAudioCapturer() = 0;
   virtual std::unique_ptr<InputInjector> CreateInputInjector() = 0;
   virtual std::unique_ptr<ScreenControls> CreateScreenControls() = 0;
diff --git a/remoting/host/desktop_session_agent.cc b/remoting/host/desktop_session_agent.cc
index 64c95d5..2a23b71 100644
--- a/remoting/host/desktop_session_agent.cc
+++ b/remoting/host/desktop_session_agent.cc
@@ -19,6 +19,7 @@
 #include "ipc/ipc_message_macros.h"
 #include "remoting/base/auto_thread_task_runner.h"
 #include "remoting/base/constants.h"
+#include "remoting/host/action_executor.h"
 #include "remoting/host/audio_capturer.h"
 #include "remoting/host/chromoting_messages.h"
 #include "remoting/host/desktop_environment.h"
@@ -27,6 +28,7 @@
 #include "remoting/host/remote_input_filter.h"
 #include "remoting/host/screen_controls.h"
 #include "remoting/host/screen_resolution.h"
+#include "remoting/proto/action.pb.h"
 #include "remoting/proto/audio.pb.h"
 #include "remoting/proto/control.pb.h"
 #include "remoting/proto/event.pb.h"
@@ -188,6 +190,8 @@
                           OnInjectMouseEvent)
       IPC_MESSAGE_HANDLER(ChromotingNetworkDesktopMsg_InjectTouchEvent,
                           OnInjectTouchEvent)
+      IPC_MESSAGE_HANDLER(ChromotingNetworkDesktopMsg_ExecuteActionRequest,
+                          OnExecuteActionRequestEvent)
       IPC_MESSAGE_HANDLER(ChromotingNetworkDesktopMsg_SetScreenResolution,
                           SetScreenResolution)
       IPC_MESSAGE_HANDLER(ChromotingNetworkToAnyMsg_StartProcessStatsReport,
@@ -289,6 +293,8 @@
   // Create the input injector.
   input_injector_ = desktop_environment_->CreateInputInjector();
 
+  action_executor_ = desktop_environment_->CreateActionExecutor();
+
   // Hook up the input filter.
   input_tracker_.reset(new protocol::InputEventTracker(input_injector_.get()));
   remote_input_filter_.reset(new RemoteInputFilter(input_tracker_.get()));
@@ -431,6 +437,7 @@
     input_tracker_.reset();
 
     desktop_environment_.reset();
+    action_executor_.reset();
     input_injector_.reset();
     screen_controls_.reset();
 
@@ -541,6 +548,13 @@
   remote_input_filter_->InjectTouchEvent(event);
 }
 
+void DesktopSessionAgent::OnExecuteActionRequestEvent(
+    const protocol::ActionRequest& request) {
+  DCHECK(caller_task_runner_->BelongsToCurrentThread());
+
+  action_executor_->ExecuteAction(request);
+}
+
 void DesktopSessionAgent::SetScreenResolution(
     const ScreenResolution& resolution) {
   DCHECK(caller_task_runner_->BelongsToCurrentThread());
diff --git a/remoting/host/desktop_session_agent.h b/remoting/host/desktop_session_agent.h
index f961cff..00cb0c7 100644
--- a/remoting/host/desktop_session_agent.h
+++ b/remoting/host/desktop_session_agent.h
@@ -35,6 +35,7 @@
 
 namespace remoting {
 
+class ActionExecutor;
 class AudioCapturer;
 class AudioPacket;
 class AutoThreadTaskRunner;
@@ -47,6 +48,7 @@
 class ScreenResolution;
 
 namespace protocol {
+class ActionRequest;
 class InputEventTracker;
 }  // namespace protocol
 
@@ -135,6 +137,7 @@
   void OnInjectTextEvent(const std::string& serialized_event);
   void OnInjectMouseEvent(const std::string& serialized_event);
   void OnInjectTouchEvent(const std::string& serialized_event);
+  void OnExecuteActionRequestEvent(const protocol::ActionRequest& request);
 
   // Handles ChromotingNetworkDesktopMsg_SetScreenResolution request from
   // the client.
@@ -180,6 +183,9 @@
   // The DesktopEnvironment instance used by this agent.
   std::unique_ptr<DesktopEnvironment> desktop_environment_;
 
+  // Executes action request events.
+  std::unique_ptr<ActionExecutor> action_executor_;
+
   // Executes keyboard, mouse and clipboard events.
   std::unique_ptr<InputInjector> input_injector_;
 
diff --git a/remoting/host/desktop_session_proxy.cc b/remoting/host/desktop_session_proxy.cc
index 527e7cc5..27abc67 100644
--- a/remoting/host/desktop_session_proxy.cc
+++ b/remoting/host/desktop_session_proxy.cc
@@ -23,6 +23,7 @@
 #include "remoting/host/client_session.h"
 #include "remoting/host/client_session_control.h"
 #include "remoting/host/desktop_session_connector.h"
+#include "remoting/host/ipc_action_executor.h"
 #include "remoting/host/ipc_audio_capturer.h"
 #include "remoting/host/ipc_input_injector.h"
 #include "remoting/host/ipc_mouse_cursor_monitor.h"
@@ -105,6 +106,12 @@
   DCHECK(caller_task_runner_->BelongsToCurrentThread());
 }
 
+std::unique_ptr<ActionExecutor> DesktopSessionProxy::CreateActionExecutor() {
+  DCHECK(caller_task_runner_->BelongsToCurrentThread());
+
+  return std::make_unique<IpcActionExecutor>(this);
+}
+
 std::unique_ptr<AudioCapturer> DesktopSessionProxy::CreateAudioCapturer() {
   DCHECK(caller_task_runner_->BelongsToCurrentThread());
 
@@ -398,6 +405,13 @@
       new ChromotingNetworkDesktopMsg_SetScreenResolution(screen_resolution_));
 }
 
+void DesktopSessionProxy::ExecuteAction(
+    const protocol::ActionRequest& request) {
+  DCHECK(caller_task_runner_->BelongsToCurrentThread());
+
+  SendToDesktop(new ChromotingNetworkDesktopMsg_ExecuteActionRequest(request));
+}
+
 DesktopSessionProxy::~DesktopSessionProxy() {
   DCHECK(caller_task_runner_->BelongsToCurrentThread());
 
diff --git a/remoting/host/desktop_session_proxy.h b/remoting/host/desktop_session_proxy.h
index cfae9541..5dee1e7a 100644
--- a/remoting/host/desktop_session_proxy.h
+++ b/remoting/host/desktop_session_proxy.h
@@ -17,6 +17,7 @@
 #include "base/sequenced_task_runner_helpers.h"
 #include "ipc/ipc_channel_handle.h"
 #include "ipc/ipc_listener.h"
+#include "remoting/host/action_executor.h"
 #include "remoting/host/audio_capturer.h"
 #include "remoting/host/desktop_environment.h"
 #include "remoting/host/screen_resolution.h"
@@ -79,6 +80,7 @@
       const DesktopEnvironmentOptions& options);
 
   // Mirrors DesktopEnvironment.
+  std::unique_ptr<ActionExecutor> CreateActionExecutor();
   std::unique_ptr<AudioCapturer> CreateAudioCapturer();
   std::unique_ptr<InputInjector> CreateInputInjector();
   std::unique_ptr<ScreenControls> CreateScreenControls();
@@ -132,6 +134,9 @@
   // API used to implement the SessionController interface.
   void SetScreenResolution(const ScreenResolution& resolution);
 
+  // API used to implement the ActionExecutor interface.
+  void ExecuteAction(const protocol::ActionRequest& request);
+
   uint32_t desktop_session_id() const { return desktop_session_id_; }
 
  private:
diff --git a/remoting/host/fake_desktop_environment.cc b/remoting/host/fake_desktop_environment.cc
index 758add4..08f4eea 100644
--- a/remoting/host/fake_desktop_environment.cc
+++ b/remoting/host/fake_desktop_environment.cc
@@ -64,6 +64,10 @@
 FakeDesktopEnvironment::~FakeDesktopEnvironment() = default;
 
 // DesktopEnvironment implementation.
+std::unique_ptr<ActionExecutor> FakeDesktopEnvironment::CreateActionExecutor() {
+  return nullptr;
+}
+
 std::unique_ptr<AudioCapturer> FakeDesktopEnvironment::CreateAudioCapturer() {
   return nullptr;
 }
diff --git a/remoting/host/fake_desktop_environment.h b/remoting/host/fake_desktop_environment.h
index f45f4a0..740f6b5 100644
--- a/remoting/host/fake_desktop_environment.h
+++ b/remoting/host/fake_desktop_environment.h
@@ -12,6 +12,7 @@
 
 #include "base/macros.h"
 #include "base/single_thread_task_runner.h"
+#include "remoting/host/action_executor.h"
 #include "remoting/host/desktop_environment.h"
 #include "remoting/host/desktop_environment_options.h"
 #include "remoting/host/fake_mouse_cursor_monitor.h"
@@ -91,6 +92,7 @@
   const DesktopEnvironmentOptions& options() const;
 
   // DesktopEnvironment implementation.
+  std::unique_ptr<ActionExecutor> CreateActionExecutor() override;
   std::unique_ptr<AudioCapturer> CreateAudioCapturer() override;
   std::unique_ptr<InputInjector> CreateInputInjector() override;
   std::unique_ptr<ScreenControls> CreateScreenControls() override;
diff --git a/remoting/host/host_mock_objects.cc b/remoting/host/host_mock_objects.cc
index 6a26623..8cda071 100644
--- a/remoting/host/host_mock_objects.cc
+++ b/remoting/host/host_mock_objects.cc
@@ -25,6 +25,10 @@
 
 MockDesktopEnvironment::~MockDesktopEnvironment() = default;
 
+std::unique_ptr<ActionExecutor> MockDesktopEnvironment::CreateActionExecutor() {
+  return base::WrapUnique(CreateActionExecutorPtr());
+}
+
 std::unique_ptr<AudioCapturer> MockDesktopEnvironment::CreateAudioCapturer() {
   return base::WrapUnique(CreateAudioCapturerPtr());
 }
diff --git a/remoting/host/host_mock_objects.h b/remoting/host/host_mock_objects.h
index 268defb..194a351 100644
--- a/remoting/host/host_mock_objects.h
+++ b/remoting/host/host_mock_objects.h
@@ -11,6 +11,7 @@
 
 #include "base/macros.h"
 #include "net/base/ip_endpoint.h"
+#include "remoting/host/action_executor.h"
 #include "remoting/host/chromoting_host_context.h"
 #include "remoting/host/client_session.h"
 #include "remoting/host/client_session_control.h"
@@ -38,6 +39,7 @@
   MockDesktopEnvironment();
   ~MockDesktopEnvironment() override;
 
+  MOCK_METHOD0(CreateActionExecutorPtr, ActionExecutor*());
   MOCK_METHOD0(CreateAudioCapturerPtr, AudioCapturer*());
   MOCK_METHOD0(CreateInputInjectorPtr, InputInjector*());
   MOCK_METHOD0(CreateScreenControlsPtr, ScreenControls*());
@@ -49,6 +51,7 @@
   MOCK_CONST_METHOD0(GetDesktopSessionId, uint32_t());
 
   // DesktopEnvironment implementation.
+  std::unique_ptr<ActionExecutor> CreateActionExecutor() override;
   std::unique_ptr<AudioCapturer> CreateAudioCapturer() override;
   std::unique_ptr<InputInjector> CreateInputInjector() override;
   std::unique_ptr<ScreenControls> CreateScreenControls() override;
diff --git a/remoting/host/ipc_action_executor.cc b/remoting/host/ipc_action_executor.cc
new file mode 100644
index 0000000..4f47887c
--- /dev/null
+++ b/remoting/host/ipc_action_executor.cc
@@ -0,0 +1,23 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "remoting/host/ipc_action_executor.h"
+
+#include <utility>
+
+#include "remoting/host/desktop_session_proxy.h"
+
+namespace remoting {
+
+IpcActionExecutor::IpcActionExecutor(
+    scoped_refptr<DesktopSessionProxy> desktop_session_proxy)
+    : desktop_session_proxy_(desktop_session_proxy) {}
+
+IpcActionExecutor::~IpcActionExecutor() = default;
+
+void IpcActionExecutor::ExecuteAction(const protocol::ActionRequest& request) {
+  desktop_session_proxy_->ExecuteAction(request);
+}
+
+}  // namespace remoting
diff --git a/remoting/host/ipc_action_executor.h b/remoting/host/ipc_action_executor.h
new file mode 100644
index 0000000..11cd8de
--- /dev/null
+++ b/remoting/host/ipc_action_executor.h
@@ -0,0 +1,37 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef REMOTING_HOST_IPC_ACTION_EXECUTOR_H_
+#define REMOTING_HOST_IPC_ACTION_EXECUTOR_H_
+
+#include "base/macros.h"
+#include "base/memory/ref_counted.h"
+#include "remoting/host/action_executor.h"
+#include "remoting/proto/action.pb.h"
+
+namespace remoting {
+
+class DesktopSessionProxy;
+
+// Routes ActionExecutor calls though the IPC channel to the desktop session
+// agent running in the desktop integration process.
+class IpcActionExecutor : public ActionExecutor {
+ public:
+  explicit IpcActionExecutor(
+      scoped_refptr<DesktopSessionProxy> desktop_session_proxy);
+  ~IpcActionExecutor() override;
+
+  // ActionStub interface.
+  void ExecuteAction(const protocol::ActionRequest& request) override;
+
+ private:
+  // Wraps the IPC channel to the desktop process.
+  scoped_refptr<DesktopSessionProxy> desktop_session_proxy_;
+
+  DISALLOW_COPY_AND_ASSIGN(IpcActionExecutor);
+};
+
+}  // namespace remoting
+
+#endif  // REMOTING_HOST_IPC_ACTION_EXECUTOR_H_
diff --git a/remoting/host/ipc_desktop_environment.cc b/remoting/host/ipc_desktop_environment.cc
index 4a452b7..874cd02 100644
--- a/remoting/host/ipc_desktop_environment.cc
+++ b/remoting/host/ipc_desktop_environment.cc
@@ -13,6 +13,7 @@
 #include "build/build_config.h"
 #include "ipc/ipc_channel_handle.h"
 #include "ipc/ipc_sender.h"
+#include "remoting/host/action_executor.h"
 #include "remoting/host/audio_capturer.h"
 #include "remoting/host/chromoting_messages.h"
 #include "remoting/host/client_session_control.h"
@@ -42,6 +43,10 @@
 
 IpcDesktopEnvironment::~IpcDesktopEnvironment() = default;
 
+std::unique_ptr<ActionExecutor> IpcDesktopEnvironment::CreateActionExecutor() {
+  return desktop_session_proxy_->CreateActionExecutor();
+}
+
 std::unique_ptr<AudioCapturer> IpcDesktopEnvironment::CreateAudioCapturer() {
   return desktop_session_proxy_->CreateAudioCapturer();
 }
diff --git a/remoting/host/ipc_desktop_environment.h b/remoting/host/ipc_desktop_environment.h
index b9f22f6..9d87469d 100644
--- a/remoting/host/ipc_desktop_environment.h
+++ b/remoting/host/ipc_desktop_environment.h
@@ -49,6 +49,7 @@
   ~IpcDesktopEnvironment() override;
 
   // DesktopEnvironment implementation.
+  std::unique_ptr<ActionExecutor> CreateActionExecutor() override;
   std::unique_ptr<AudioCapturer> CreateAudioCapturer() override;
   std::unique_ptr<InputInjector> CreateInputInjector() override;
   std::unique_ptr<ScreenControls> CreateScreenControls() override;
diff --git a/remoting/host/me2me_desktop_environment.cc b/remoting/host/me2me_desktop_environment.cc
index 011f34f..feab9832 100644
--- a/remoting/host/me2me_desktop_environment.cc
+++ b/remoting/host/me2me_desktop_environment.cc
@@ -11,6 +11,7 @@
 #include "base/single_thread_task_runner.h"
 #include "build/build_config.h"
 #include "remoting/base/logging.h"
+#include "remoting/host/action_executor.h"
 #include "remoting/host/client_session_control.h"
 #include "remoting/host/curtain_mode.h"
 #include "remoting/host/desktop_resizer.h"
@@ -35,6 +36,13 @@
   DCHECK(caller_task_runner()->BelongsToCurrentThread());
 }
 
+std::unique_ptr<ActionExecutor>
+Me2MeDesktopEnvironment::CreateActionExecutor() {
+  DCHECK(caller_task_runner()->BelongsToCurrentThread());
+
+  return ActionExecutor::Create();
+}
+
 std::unique_ptr<ScreenControls>
 Me2MeDesktopEnvironment::CreateScreenControls() {
   DCHECK(caller_task_runner()->BelongsToCurrentThread());
diff --git a/remoting/host/me2me_desktop_environment.h b/remoting/host/me2me_desktop_environment.h
index d55d1c3a..fffd28e 100644
--- a/remoting/host/me2me_desktop_environment.h
+++ b/remoting/host/me2me_desktop_environment.h
@@ -22,6 +22,7 @@
   ~Me2MeDesktopEnvironment() override;
 
   // DesktopEnvironment interface.
+  std::unique_ptr<ActionExecutor> CreateActionExecutor() override;
   std::unique_ptr<ScreenControls> CreateScreenControls() override;
   std::string GetCapabilities() const override;
 
diff --git a/remoting/host/win/BUILD.gn b/remoting/host/win/BUILD.gn
index 3e7054e4..79dabc14 100644
--- a/remoting/host/win/BUILD.gn
+++ b/remoting/host/win/BUILD.gn
@@ -96,6 +96,8 @@
     "rdp_client_window.h",
     "security_descriptor.cc",
     "security_descriptor.h",
+    "session_action_executor.cc",
+    "session_action_executor.h",
     "session_desktop_environment.cc",
     "session_desktop_environment.h",
     "session_input_injector.cc",
diff --git a/remoting/host/win/session_action_executor.cc b/remoting/host/win/session_action_executor.cc
new file mode 100644
index 0000000..437c4229
--- /dev/null
+++ b/remoting/host/win/session_action_executor.cc
@@ -0,0 +1,45 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "remoting/host/win/session_action_executor.h"
+
+#include "base/bind.h"
+#include "base/callback.h"
+#include "base/location.h"
+#include "base/macros.h"
+#include "base/single_thread_task_runner.h"
+#include "remoting/proto/action.pb.h"
+
+namespace remoting {
+
+using protocol::ActionRequest;
+
+SessionActionExecutor::SessionActionExecutor(
+    scoped_refptr<base::SingleThreadTaskRunner> execute_action_task_runner,
+    const base::RepeatingClosure& inject_sas,
+    const base::RepeatingClosure& lock_workstation)
+    : execute_action_task_runner_(execute_action_task_runner),
+      inject_sas_(inject_sas),
+      lock_workstation_(lock_workstation) {}
+
+SessionActionExecutor::~SessionActionExecutor() = default;
+
+void SessionActionExecutor::ExecuteAction(const ActionRequest& request) {
+  DCHECK(request.has_action());
+
+  switch (request.action()) {
+    case protocol::ActionRequest::SEND_ATTENTION_SEQUENCE:
+      execute_action_task_runner_->PostTask(FROM_HERE, inject_sas_);
+      break;
+
+    case protocol::ActionRequest::LOCK_WORKSTATION:
+      execute_action_task_runner_->PostTask(FROM_HERE, lock_workstation_);
+      break;
+
+    default:
+      NOTREACHED() << "Unknown action type: " << request.action();
+  }
+}
+
+}  // namespace remoting
diff --git a/remoting/host/win/session_action_executor.h b/remoting/host/win/session_action_executor.h
new file mode 100644
index 0000000..265e0490
--- /dev/null
+++ b/remoting/host/win/session_action_executor.h
@@ -0,0 +1,48 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef REMOTING_HOST_WIN_SESSION_ACTION_EXECUTOR_H_
+#define REMOTING_HOST_WIN_SESSION_ACTION_EXECUTOR_H_
+
+#include <memory>
+
+#include "base/callback.h"
+#include "base/macros.h"
+#include "base/memory/ref_counted.h"
+#include "remoting/host/action_executor.h"
+
+namespace base {
+class SingleThreadTaskRunner;
+}  // namespace base
+
+namespace remoting {
+
+class SessionActionExecutor : public ActionExecutor {
+ public:
+  // |inject_sas| and |lock_workstation| are invoked on
+  // |execute_action_task_runner|.
+  SessionActionExecutor(
+      scoped_refptr<base::SingleThreadTaskRunner> execute_action_task_runner,
+      const base::RepeatingClosure& inject_sas,
+      const base::RepeatingClosure& lock_workstation);
+  ~SessionActionExecutor() override;
+
+  // ActionExecutor implementation.
+  void ExecuteAction(const protocol::ActionRequest& request) override;
+
+ private:
+  scoped_refptr<base::SingleThreadTaskRunner> execute_action_task_runner_;
+
+  // Injects the Secure Attention Sequence.
+  base::RepeatingClosure inject_sas_;
+
+  // Locks the current session.
+  base::RepeatingClosure lock_workstation_;
+
+  DISALLOW_COPY_AND_ASSIGN(SessionActionExecutor);
+};
+
+}  // namespace remoting
+
+#endif  // REMOTING_HOST_WIN_SESSION_ACTION_EXECUTOR_H_
diff --git a/remoting/host/win/session_desktop_environment.cc b/remoting/host/win/session_desktop_environment.cc
index fbbad7de..1828409 100644
--- a/remoting/host/win/session_desktop_environment.cc
+++ b/remoting/host/win/session_desktop_environment.cc
@@ -9,15 +9,25 @@
 
 #include "base/logging.h"
 #include "base/single_thread_task_runner.h"
+#include "remoting/host/action_executor.h"
 #include "remoting/host/audio_capturer.h"
 #include "remoting/host/input_injector.h"
 #include "remoting/host/screen_controls.h"
+#include "remoting/host/win/session_action_executor.h"
 #include "remoting/host/win/session_input_injector.h"
 #include "third_party/webrtc/modules/desktop_capture/desktop_capturer.h"
 
 namespace remoting {
 
-SessionDesktopEnvironment::~SessionDesktopEnvironment() {}
+SessionDesktopEnvironment::~SessionDesktopEnvironment() = default;
+
+std::unique_ptr<ActionExecutor>
+SessionDesktopEnvironment::CreateActionExecutor() {
+  DCHECK(caller_task_runner()->BelongsToCurrentThread());
+
+  return std::make_unique<SessionActionExecutor>(
+      caller_task_runner(), inject_sas_, lock_workstation_);
+}
 
 std::unique_ptr<InputInjector>
 SessionDesktopEnvironment::CreateInputInjector() {
@@ -36,8 +46,8 @@
     scoped_refptr<base::SingleThreadTaskRunner> input_task_runner,
     scoped_refptr<base::SingleThreadTaskRunner> ui_task_runner,
     ui::SystemInputInjectorFactory* system_input_injector_factory,
-    const base::Closure& inject_sas,
-    const base::Closure& lock_workstation,
+    const base::RepeatingClosure& inject_sas,
+    const base::RepeatingClosure& lock_workstation,
     const DesktopEnvironmentOptions& options)
     : Me2MeDesktopEnvironment(caller_task_runner,
                               video_capture_task_runner,
@@ -54,8 +64,8 @@
     scoped_refptr<base::SingleThreadTaskRunner> input_task_runner,
     scoped_refptr<base::SingleThreadTaskRunner> ui_task_runner,
     ui::SystemInputInjectorFactory* system_input_injector_factory,
-    const base::Closure& inject_sas,
-    const base::Closure& lock_workstation)
+    const base::RepeatingClosure& inject_sas,
+    const base::RepeatingClosure& lock_workstation)
     : Me2MeDesktopEnvironmentFactory(caller_task_runner,
                                      video_capture_task_runner,
                                      input_task_runner,
@@ -66,7 +76,7 @@
   DCHECK(caller_task_runner->BelongsToCurrentThread());
 }
 
-SessionDesktopEnvironmentFactory::~SessionDesktopEnvironmentFactory() {}
+SessionDesktopEnvironmentFactory::~SessionDesktopEnvironmentFactory() = default;
 
 std::unique_ptr<DesktopEnvironment> SessionDesktopEnvironmentFactory::Create(
     base::WeakPtr<ClientSessionControl> client_session_control,
diff --git a/remoting/host/win/session_desktop_environment.h b/remoting/host/win/session_desktop_environment.h
index 9c783abf..aa0fcf9 100644
--- a/remoting/host/win/session_desktop_environment.h
+++ b/remoting/host/win/session_desktop_environment.h
@@ -21,6 +21,7 @@
   ~SessionDesktopEnvironment() override;
 
   // DesktopEnvironment implementation.
+  std::unique_ptr<ActionExecutor> CreateActionExecutor() override;
   std::unique_ptr<InputInjector> CreateInputInjector() override;
 
  private:
@@ -31,15 +32,15 @@
       scoped_refptr<base::SingleThreadTaskRunner> input_task_runner,
       scoped_refptr<base::SingleThreadTaskRunner> ui_task_runner,
       ui::SystemInputInjectorFactory* system_input_injector_factory,
-      const base::Closure& inject_sas,
-      const base::Closure& lock_workstation,
+      const base::RepeatingClosure& inject_sas,
+      const base::RepeatingClosure& lock_workstation,
       const DesktopEnvironmentOptions& options);
 
   // Used to ask the daemon to inject Secure Attention Sequence.
-  base::Closure inject_sas_;
+  base::RepeatingClosure inject_sas_;
 
   // Used to lock the workstation for the current session.
-  base::Closure lock_workstation_;
+  base::RepeatingClosure lock_workstation_;
 
   DISALLOW_COPY_AND_ASSIGN(SessionDesktopEnvironment);
 };
@@ -53,8 +54,8 @@
       scoped_refptr<base::SingleThreadTaskRunner> input_task_runner,
       scoped_refptr<base::SingleThreadTaskRunner> ui_task_runner,
       ui::SystemInputInjectorFactory* system_input_injector_factory,
-      const base::Closure& inject_sas,
-      const base::Closure& lock_workstation);
+      const base::RepeatingClosure& inject_sas,
+      const base::RepeatingClosure& lock_workstation);
   ~SessionDesktopEnvironmentFactory() override;
 
   // DesktopEnvironmentFactory implementation.
@@ -64,10 +65,10 @@
 
  private:
   // Used to ask the daemon to inject Secure Attention Sequence.
-  base::Closure inject_sas_;
+  base::RepeatingClosure inject_sas_;
 
   // Used to lock the workstation for the current session.
-  base::Closure lock_workstation_;
+  base::RepeatingClosure lock_workstation_;
 
   DISALLOW_COPY_AND_ASSIGN(SessionDesktopEnvironmentFactory);
 };
diff --git a/remoting/proto/BUILD.gn b/remoting/proto/BUILD.gn
index e579b41..07891d1 100644
--- a/remoting/proto/BUILD.gn
+++ b/remoting/proto/BUILD.gn
@@ -13,6 +13,7 @@
 
 proto_library("proto") {
   sources = [
+    "action.proto",
     "audio.proto",
     "control.proto",
     "event.proto",
diff --git a/remoting/proto/action.proto b/remoting/proto/action.proto
new file mode 100644
index 0000000..434a29c1
--- /dev/null
+++ b/remoting/proto/action.proto
@@ -0,0 +1,40 @@
+syntax = "proto2";
+
+option optimize_for = LITE_RUNTIME;
+
+package remoting.protocol;
+
+// Next Id: 3
+message ActionRequest {
+  enum Action {
+    SEND_ATTENTION_SEQUENCE = 1;
+    LOCK_WORKSTATION = 2;
+  }
+  optional Action action = 1;
+
+  // Identifies an individual request so a response can be sent at a later time
+  // to indicate whether the action succeeded.
+  optional uint32 request_id = 2;
+}
+
+// Next Id: 4
+message ActionResponse {
+  // The ID of the action request this response was generated for.
+  optional uint32 request_id = 1;
+
+  enum ReturnCode {
+    ACTION_SUCCESS = 1;
+    ACTION_ERROR = 2;
+  }
+  optional ReturnCode code = 2;
+
+  // ErrorCode field is populated if |code()| indicates an error occurred.
+  enum ErrorCode {
+    // The action supplied is not known.
+    UNKNOWN_ACTION_ERROR = 1;
+
+    // The action supplied is not supported by the platform or connection mode.
+    UNSUPPORTED_ACTION_ERROR = 2;
+  }
+  optional ErrorCode error = 3;
+}
diff --git a/services/OWNERS b/services/OWNERS
index 28e613e9..a703c63 100644
--- a/services/OWNERS
+++ b/services/OWNERS
@@ -1,5 +1,5 @@
 ben@chromium.org
 blundell@chromium.org
 jam@chromium.org
-rockot@chromium.org
+rockot@google.com
 sky@chromium.org
diff --git a/services/catalog/OWNERS b/services/catalog/OWNERS
index 0ae94853..d2a928b7 100644
--- a/services/catalog/OWNERS
+++ b/services/catalog/OWNERS
@@ -1,5 +1,5 @@
 ben@chromium.org
-rockot@chromium.org
+rockot@google.com
 
 per-file manifest.json=set noparent
 per-file manifest.json=file://ipc/SECURITY_OWNERS
diff --git a/services/content/OWNERS b/services/content/OWNERS
index df9a505..300133b 100644
--- a/services/content/OWNERS
+++ b/services/content/OWNERS
@@ -1,7 +1,7 @@
 alexmos@chromium.org
 clamy@chromium.org
 jam@chromium.org
-rockot@chromium.org
+rockot@google.com
 
 per-file manifest.json=set noparent
 per-file manifest.json=file://ipc/SECURITY_OWNERS
diff --git a/services/device/OWNERS b/services/device/OWNERS
index 4768ab3..597d1d3 100644
--- a/services/device/OWNERS
+++ b/services/device/OWNERS
@@ -2,7 +2,7 @@
 
 blundell@chromium.org
 reillyg@chromium.org
-rockot@chromium.org
+rockot@google.com
 
 per-file manifest.json=set noparent
 per-file manifest.json=file://ipc/SECURITY_OWNERS
diff --git a/services/file/OWNERS b/services/file/OWNERS
index 09e4f21..6bff3ba 100644
--- a/services/file/OWNERS
+++ b/services/file/OWNERS
@@ -1,4 +1,4 @@
-rockot@chromium.org
+rockot@google.com
 
 per-file manifest.json=set noparent
 per-file manifest.json=file://ipc/SECURITY_OWNERS
diff --git a/services/network/resource_scheduler.cc b/services/network/resource_scheduler.cc
index 65fd1535..bf92db77 100644
--- a/services/network/resource_scheduler.cc
+++ b/services/network/resource_scheduler.cc
@@ -13,6 +13,7 @@
 #include "base/macros.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/field_trial_params.h"
+#include "base/metrics/histogram_functions.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/optional.h"
 #include "base/sequenced_task_runner.h"
@@ -718,6 +719,15 @@
           "ResourceScheduler.NumDelayableRequestsInFlightAtStart.NonDelayable",
           in_flight_delayable_count_);
     }
+
+    DCHECK(!request->url_request()->creation_time().is_null());
+    base::TimeDelta queuing_duration =
+        base::TimeTicks::Now() - request->url_request()->creation_time();
+    base::UmaHistogramMediumTimes(
+        "ResourceScheduler.RequestQueuingDuration.Priority" +
+            base::IntToString(request->get_request_priority_params().priority),
+        queuing_duration);
+
     InsertInFlightRequest(request);
     request->Start(start_mode);
   }
diff --git a/services/network/resource_scheduler_unittest.cc b/services/network/resource_scheduler_unittest.cc
index bf1d9263..15ea7c1 100644
--- a/services/network/resource_scheduler_unittest.cc
+++ b/services/network/resource_scheduler_unittest.cc
@@ -447,6 +447,8 @@
 }
 
 TEST_F(ResourceSchedulerTest, OneLowLoadsUntilCriticalComplete) {
+  base::HistogramTester histogram_tester;
+
   SetMaxDelayableRequests(1);
   std::unique_ptr<TestRequest> high(
       NewRequest("http://host/high", net::HIGHEST));
@@ -463,6 +465,15 @@
   high.reset();
   base::RunLoop().RunUntilIdle();
   EXPECT_TRUE(low2->started());
+
+  histogram_tester.ExpectTotalCount(
+      "ResourceScheduler.RequestQueuingDuration.Priority" +
+          base::IntToString(net::HIGHEST),
+      1);
+  histogram_tester.ExpectTotalCount(
+      "ResourceScheduler.RequestQueuingDuration.Priority" +
+          base::IntToString(net::LOWEST),
+      2);
 }
 
 TEST_F(ResourceSchedulerTest, SchedulerYieldsOnSpdy) {
diff --git a/services/service_manager/OWNERS b/services/service_manager/OWNERS
index 2d0f536f7..48d8bc6 100644
--- a/services/service_manager/OWNERS
+++ b/services/service_manager/OWNERS
@@ -1,6 +1,6 @@
 ben@chromium.org
 jam@chromium.org
-rockot@chromium.org
+rockot@google.com
 sky@chromium.org
 
 per-file manifest.json=set noparent
diff --git a/services/ws/public/cpp/gpu/context_provider_command_buffer.cc b/services/ws/public/cpp/gpu/context_provider_command_buffer.cc
index 37d68cf..eabb93a 100644
--- a/services/ws/public/cpp/gpu/context_provider_command_buffer.cc
+++ b/services/ws/public/cpp/gpu/context_provider_command_buffer.cc
@@ -348,7 +348,7 @@
     return nullptr;
 
   raster_interface_ = std::make_unique<gpu::raster::RasterImplementationGLES>(
-      gles2_impl_.get(), command_buffer_.get(), ContextCapabilities());
+      gles2_impl_.get(), ContextCapabilities());
   return raster_interface_.get();
 }
 
diff --git a/skia/config/SkUserConfig.h b/skia/config/SkUserConfig.h
index 0a86a30..3004114 100644
--- a/skia/config/SkUserConfig.h
+++ b/skia/config/SkUserConfig.h
@@ -151,10 +151,6 @@
 #define SK_DISABLE_EXPLICIT_GPU_RESOURCE_ALLOCATION
 #endif
 
-#ifndef SK_SUPPORT_LEGACY_TILED_BITMAPS
-#define SK_SUPPORT_LEGACY_TILED_BITMAPS
-#endif
-
 // Max. verb count for paths rendered by the edge-AA tessellating path renderer.
 #define GR_AA_TESSELLATOR_MAX_VERB_COUNT 100
 
diff --git a/storage/browser/blob/blob_url_request_job_factory.cc b/storage/browser/blob/blob_url_request_job_factory.cc
index 270cc8f..bef6ce2 100644
--- a/storage/browser/blob/blob_url_request_job_factory.cc
+++ b/storage/browser/blob/blob_url_request_job_factory.cc
@@ -89,6 +89,10 @@
                                         LookupBlobHandle(request));
 }
 
+bool BlobProtocolHandler::IsSafeRedirectTarget(const GURL& location) const {
+  return false;
+}
+
 BlobDataHandle* BlobProtocolHandler::LookupBlobHandle(
     net::URLRequest* request) const {
   BlobDataHandle* blob_data_handle = GetRequestBlobDataHandle(request);
diff --git a/storage/browser/blob/blob_url_request_job_factory.h b/storage/browser/blob/blob_url_request_job_factory.h
index f3fa3f83..d2d189d 100644
--- a/storage/browser/blob/blob_url_request_job_factory.h
+++ b/storage/browser/blob/blob_url_request_job_factory.h
@@ -44,9 +44,11 @@
   explicit BlobProtocolHandler(BlobStorageContext* context);
   ~BlobProtocolHandler() override;
 
+  // net::URLRequestJobFactory::ProtocolHandler implementation:
   net::URLRequestJob* MaybeCreateJob(
       net::URLRequest* request,
       net::NetworkDelegate* network_delegate) const override;
+  bool IsSafeRedirectTarget(const GURL& location) const override;
 
  private:
   BlobDataHandle* LookupBlobHandle(net::URLRequest* request) const;
diff --git a/testing/buildbot/chromium.chromiumos.json b/testing/buildbot/chromium.chromiumos.json
index 1f86db3..9417cf9 100644
--- a/testing/buildbot/chromium.chromiumos.json
+++ b/testing/buildbot/chromium.chromiumos.json
@@ -385,6 +385,30 @@
           "idempotent": false,
           "shards": 6
         }
+      },
+      {
+        "args": [
+          "--jobs=1",
+          "--browser=cros-chrome",
+          "--remote=127.0.0.1",
+          "--remote-ssh-port=9222"
+        ],
+        "experiment_percentage": 50,
+        "isolate_name": "telemetry_unittests",
+        "name": "telemetry_unittests",
+        "swarming": {
+          "can_use_on_swarming_builders": true,
+          "dimension_sets": [
+            {
+              "kvm": "1",
+              "os": "Ubuntu-14.04",
+              "pool": "Chrome-CrOS-VM"
+            }
+          ],
+          "hard_timeout": 1200,
+          "idempotent": false,
+          "shards": 12
+        }
       }
     ]
   },
@@ -798,6 +822,17 @@
       },
       {
         "args": [
+          "--enable-features=SingleProcessMash",
+          "--test-launcher-filter-file=../../testing/buildbot/filters/chromeos.single_process_mash.interactive_ui_tests.filter"
+        ],
+        "name": "single_process_mash_interactive_ui_tests",
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "interactive_ui_tests"
+      },
+      {
+        "args": [
           "--enable-features=WebUIPolymer2",
           "--test-launcher-filter-file=../../testing/buildbot/filters/webui_polymer2_interactive_ui_tests.filter"
         ],
@@ -1503,6 +1538,17 @@
       },
       {
         "args": [
+          "--enable-features=SingleProcessMash",
+          "--test-launcher-filter-file=../../testing/buildbot/filters/chromeos.single_process_mash.interactive_ui_tests.filter"
+        ],
+        "name": "single_process_mash_interactive_ui_tests",
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "interactive_ui_tests"
+      },
+      {
+        "args": [
           "--enable-features=WebUIPolymer2",
           "--test-launcher-filter-file=../../testing/buildbot/filters/webui_polymer2_interactive_ui_tests.filter"
         ],
diff --git a/testing/buildbot/chromium.fyi.json b/testing/buildbot/chromium.fyi.json
index 1b13f76..68a7252f 100644
--- a/testing/buildbot/chromium.fyi.json
+++ b/testing/buildbot/chromium.fyi.json
@@ -1617,17 +1617,6 @@
       },
       {
         "args": [
-          "--enable-features=SingleProcessMash",
-          "--test-launcher-filter-file=../../testing/buildbot/filters/chromeos.single_process_mash.interactive_ui_tests.filter"
-        ],
-        "name": "single_process_mash_interactive_ui_tests",
-        "swarming": {
-          "can_use_on_swarming_builders": true
-        },
-        "test": "interactive_ui_tests"
-      },
-      {
-        "args": [
           "--enable-features=VizDisplayCompositor"
         ],
         "name": "viz_interactive_ui_tests",
@@ -3184,34 +3173,6 @@
         },
         "test": "services_unittests"
       }
-    ],
-    "isolated_scripts": [
-      {
-        "args": [
-          "--jobs=1",
-          "--browser=cros-chrome",
-          "--remote=127.0.0.1",
-          "--remote-ssh-port=9222",
-          "--skip=telemetry.internal.app.android_app_unittest.AndroidAppTest.testWebView",
-          "--skip=telemetry.internal.backends.browser_backend_unittest.BrowserBackendIntegrationTest.testSmokeIsBrowserRunningReturnFalse"
-        ],
-        "isolate_name": "telemetry_unittests",
-        "name": "telemetry_unittests",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "kvm": "1",
-              "os": "Ubuntu-14.04",
-              "pool": "Chrome-CrOS-VM"
-            }
-          ],
-          "hard_timeout": 3600,
-          "idempotent": false,
-          "io_timeout": 3600,
-          "shards": 12
-        }
-      }
     ]
   },
   "chromeos-kevin-rel-hw-tests": {
diff --git a/testing/buildbot/chromium.memory.json b/testing/buildbot/chromium.memory.json
index 1cf2d74..d29220b 100644
--- a/testing/buildbot/chromium.memory.json
+++ b/testing/buildbot/chromium.memory.json
@@ -4641,6 +4641,18 @@
       },
       {
         "args": [
+          "--enable-features=SingleProcessMash",
+          "--test-launcher-filter-file=../../testing/buildbot/filters/chromeos.single_process_mash.interactive_ui_tests.filter",
+          "--test-launcher-print-test-stdio=always"
+        ],
+        "name": "single_process_mash_interactive_ui_tests",
+        "swarming": {
+          "can_use_on_swarming_builders": true
+        },
+        "test": "interactive_ui_tests"
+      },
+      {
+        "args": [
           "--enable-features=WebUIPolymer2",
           "--test-launcher-filter-file=../../testing/buildbot/filters/webui_polymer2_interactive_ui_tests.filter",
           "--test-launcher-print-test-stdio=always"
@@ -5959,6 +5971,24 @@
       },
       {
         "args": [
+          "--enable-features=SingleProcessMash",
+          "--test-launcher-filter-file=../../testing/buildbot/filters/chromeos.single_process_mash.interactive_ui_tests.filter",
+          "--test-launcher-print-test-stdio=always"
+        ],
+        "name": "single_process_mash_interactive_ui_tests",
+        "swarming": {
+          "can_use_on_swarming_builders": true,
+          "dimension_sets": [
+            {
+              "cpu": "x86-64",
+              "os": "Ubuntu-14.04"
+            }
+          ]
+        },
+        "test": "interactive_ui_tests"
+      },
+      {
+        "args": [
           "--enable-features=WebUIPolymer2",
           "--test-launcher-filter-file=../../testing/buildbot/filters/webui_polymer2_interactive_ui_tests.filter",
           "--test-launcher-print-test-stdio=always"
diff --git a/testing/buildbot/chromium.perf.json b/testing/buildbot/chromium.perf.json
index 45bcaad..5294055b 100644
--- a/testing/buildbot/chromium.perf.json
+++ b/testing/buildbot/chromium.perf.json
@@ -715,7 +715,8 @@
   "android-builder-perf": {
     "additional_compile_targets": [
       "microdump_stackwalk",
-      "angle_perftests"
+      "angle_perftests",
+      "chrome_apk"
     ]
   },
   "android-go-perf": {
@@ -1020,7 +1021,8 @@
   "android_arm64-builder-perf": {
     "additional_compile_targets": [
       "microdump_stackwalk",
-      "angle_perftests"
+      "angle_perftests",
+      "chrome_apk"
     ]
   },
   "linux-builder-perf": {
diff --git a/testing/buildbot/filters/mojo.fyi.network_webview_instrumentation_test_apk.filter b/testing/buildbot/filters/mojo.fyi.network_webview_instrumentation_test_apk.filter
index 41890b4..b4b2348 100644
--- a/testing/buildbot/filters/mojo.fyi.network_webview_instrumentation_test_apk.filter
+++ b/testing/buildbot/filters/mojo.fyi.network_webview_instrumentation_test_apk.filter
@@ -91,11 +91,19 @@
 -org.chromium.android_webview.test.AwSettingsTest.testCacheModeWithBlockedNetworkLoads
 -org.chromium.android_webview.test.AwSettingsTest.testContentUrlAccessWithTwoViews
 -org.chromium.android_webview.test.AwSettingsTest.testContentUrlFromFileWithTwoViews
+-org.chromium.android_webview.test.AwSettingsTest.testDatabaseDisabled
+-org.chromium.android_webview.test.AwSettingsTest.testDatabaseEnabled
+-org.chromium.android_webview.test.AwSettingsTest.testDatabaseInitialValue
 -org.chromium.android_webview.test.AwSettingsTest.testDefaultVideoPosterURL
+-org.chromium.android_webview.test.AwSettingsTest.testDomStorageEnabledWithTwoViews
+-org.chromium.android_webview.test.AwSettingsTest.testFileAccessFromFilesIframeWithTwoViews
+-org.chromium.android_webview.test.AwSettingsTest.testFileAccessFromFilesImage
+-org.chromium.android_webview.test.AwSettingsTest.testFileAccessFromFilesXhrWithTwoViews
 -org.chromium.android_webview.test.AwSettingsTest.testFileUrlAccessToggleDoesNotBlockAssetUrls
 -org.chromium.android_webview.test.AwSettingsTest.testFileUrlAccessToggleDoesNotBlockResourceUrls
 -org.chromium.android_webview.test.AwSettingsTest.testFileUrlAccessWithTwoViews
 -org.chromium.android_webview.test.AwSettingsTest.testResourceUrl
+-org.chromium.android_webview.test.AwSettingsTest.testUniversalAccessFromFilesWithTwoViews
 
 # https://crbug.com/893572
 -org.chromium.android_webview.test.ClientOnPageStartedTest.testOnPageStartedCalledOnceOnError
diff --git a/testing/buildbot/manage.py b/testing/buildbot/manage.py
index 09133545..d0f9293 100755
--- a/testing/buildbot/manage.py
+++ b/testing/buildbot/manage.py
@@ -174,6 +174,9 @@
 
   # These are only for developer convenience and not on any bots.
   'telemetry_gpu_integration_test_scripts_only',
+
+  # These are defined by an android internal gn_isolate_map.pyl file.
+  'chrome_apk',
 }
 
 
diff --git a/testing/buildbot/test_suites.pyl b/testing/buildbot/test_suites.pyl
index a3328cf..b8b0a909 100644
--- a/testing/buildbot/test_suites.pyl
+++ b/testing/buildbot/test_suites.pyl
@@ -473,9 +473,6 @@
           'shards': 6,
         },
       },
-    },
-
-    'chromeos_isolated_scripts_experimental': {
       'telemetry_unittests': {
         'args': [
           '--jobs=1',
@@ -483,10 +480,9 @@
           # By default, CrOS VMs' ssh servers listen on local port 9222.
           '--remote=127.0.0.1',
           '--remote-ssh-port=9222',
-          # Always fails.
-          '--skip=telemetry.internal.app.android_app_unittest.AndroidAppTest.testWebView',
-          '--skip=telemetry.internal.backends.browser_backend_unittest.BrowserBackendIntegrationTest.testSmokeIsBrowserRunningReturnFalse',
         ],
+        # TODO(crbug.com/876494): Move this out of experimental.
+        'experiment_percentage': 50,
         'swarming': {
           'hard_timeout': 1200,
           'idempotent': False,  # https://crbug.com/549140
@@ -1760,6 +1756,13 @@
           '--enable-features=SingleProcessMash',
         ],
       },
+      'single_process_mash_interactive_ui_tests': {
+        'test': 'interactive_ui_tests',
+        'args': [
+          '--enable-features=SingleProcessMash',
+          '--test-launcher-filter-file=../../testing/buildbot/filters/chromeos.single_process_mash.interactive_ui_tests.filter',
+        ],
+      },
       'ui_chromeos_unittests': {},
       'views_mus_unittests': {},
       'views_mus_interactive_ui_tests': {},
@@ -1832,13 +1835,6 @@
           '--enable-features=Mash',
         ],
       },
-      'single_process_mash_interactive_ui_tests': {
-        'test': 'interactive_ui_tests',
-        'args': [
-          '--enable-features=SingleProcessMash',
-          '--test-launcher-filter-file=../../testing/buildbot/filters/chromeos.single_process_mash.interactive_ui_tests.filter',
-        ],
-      },
     },
 
     'memory_infra_isolated_scripts': {
diff --git a/testing/buildbot/waterfalls.pyl b/testing/buildbot/waterfalls.pyl
index f58a0c4..1650310 100644
--- a/testing/buildbot/waterfalls.pyl
+++ b/testing/buildbot/waterfalls.pyl
@@ -1247,7 +1247,6 @@
         ],
         'test_suites': {
           'gtest_tests': 'chromeos_gtests_experimental',
-          'isolated_scripts': 'chromeos_isolated_scripts_experimental',
         },
         'swarming': {
           'dimension_sets': [
diff --git a/testing/libfuzzer/gen_fuzzer_owners.py b/testing/libfuzzer/gen_fuzzer_owners.py
index 7b8fd2f5..f3f6fcad 100755
--- a/testing/libfuzzer/gen_fuzzer_owners.py
+++ b/testing/libfuzzer/gen_fuzzer_owners.py
@@ -104,7 +104,8 @@
   groups = []
   deps_for_groups = {}
   for deps in deps_list:
-    output = subprocess.check_output([GNPath(), 'desc', build_dir, deps])
+    output = subprocess.check_output(
+        [GNPath(), 'desc', '--fail-on-unused-args', build_dir, deps])
     needle = 'Type: '
     for line in output.splitlines():
       if needle and not line.startswith(needle):
@@ -164,7 +165,7 @@
   all_sources = []
   for deps in full_deps_list:
     output = subprocess.check_output(
-        [GNPath(), 'desc', build_dir, deps, 'sources'])
+        [GNPath(), 'desc', '--fail-on-unused-args', build_dir, deps, 'sources'])
     for source in output.splitlines():
       if source.startswith('//'):
         source = source[2:]
diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index 9b27b8d9..41a1f166 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations
@@ -4015,7 +4015,8 @@
 crbug.com/673539 [ Linux Win ] css3/filters/effect-contrast-hw.html [ Pass Failure ]
 
 
-crbug.com/765738 [ Linux Win Mac ] http/tests/wasm/wasm_remote_postMessage_test.https.html [ Pass Timeout ]
+#crbug.com/765738 [ Linux Win Mac ] http/tests/wasm/wasm_remote_postMessage_test.https.html [ Pass Timeout ]
+crbug.com/892212 http/tests/wasm/wasm_remote_postMessage_test.https.html [ Pass Failure Timeout ]
 
 # ====== Random order flaky tests from here ======
 # These tests are flaky when run in random order, which is the default on Linux & Mac since since 2016-12-16.
diff --git a/third_party/WebKit/LayoutTests/external/wpt/screen-capture/getdisplaymedia.https-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/screen-capture/getdisplaymedia.https-expected.txt
index 01f1f4f9..0f2d8d8 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/screen-capture/getdisplaymedia.https-expected.txt
+++ b/third_party/WebKit/LayoutTests/external/wpt/screen-capture/getdisplaymedia.https-expected.txt
@@ -1,10 +1,13 @@
 This is a testharness.js-based test.
-PASS getDisplayMedia() with no constraints
 PASS getDisplayMedia() with video true
+PASS getDisplayMedia() with no constraints
 PASS getDisplayMedia() with video false
-FAIL getDisplayMedia() with audio true promise_test: Unhandled rejection with value: object "TypeError: Failed to execute 'getDisplayMedia' on 'Navigator': Audio is not supported"
 PASS getDisplayMedia() with audio false
-PASS getDisplayMedia() call with non-bool constraint
+FAIL getDisplayMedia() with audio true promise_test: Unhandled rejection with value: object "TypeError: Failed to execute 'getDisplayMedia' on 'Navigator': Audio capture is not supported"
+PASS getDisplayMedia() call with advanced constraint
+PASS getDisplayMedia() call with min constraint
+PASS getDisplayMedia() call with exact constraint
+PASS getDisplayMedia() call with max constraint
 PASS getDisplayMedia() with getSettings
 Harness: the test ran to completion.
 
diff --git a/third_party/WebKit/LayoutTests/external/wpt/screen-capture/getdisplaymedia.https.html b/third_party/WebKit/LayoutTests/external/wpt/screen-capture/getdisplaymedia.https.html
index 9b66419c..f5edab5b 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/screen-capture/getdisplaymedia.https.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/screen-capture/getdisplaymedia.https.html
@@ -6,19 +6,6 @@
 <script>
   'use strict';
 
-// Constraint parameter has a default value of {audio:false, video: false}.
-promise_test(function() {
-  assert_idl_attribute(navigator, 'getDisplayMedia');
-
-  return navigator.getDisplayMedia()
-      .then(function(s) {
-        fail('getDisplayMedia should have failed');
-      })
-      .catch(function(e) {
-        assert_equals(e.name, 'TypeError');
-      });
-}, 'getDisplayMedia() with no constraints');
-
 promise_test(function() {
   assert_idl_attribute(navigator, 'getDisplayMedia');
 
@@ -28,21 +15,38 @@
   });
 }, 'getDisplayMedia() with video true');
 
+// Empty constraint parameter and boolean values of false defaults to
+// {video: true}.
 promise_test(function() {
   assert_idl_attribute(navigator, 'getDisplayMedia');
 
-  return navigator.getDisplayMedia({video: false})
-      .then(function(s) {
-        fail('getDisplayMedia should have failed');
-      })
-      .catch(function(e) {
-        assert_equals(e.name, 'TypeError');
-      });
+  return navigator.getDisplayMedia().then(function(s) {
+    assert_equals(s.getVideoTracks().length, 1);
+    assert_equals(s.getAudioTracks().length, 0);
+  });
+}, 'getDisplayMedia() with no constraints');
+
+promise_test(function() {
+  assert_idl_attribute(navigator, 'getDisplayMedia');
+
+  return navigator.getDisplayMedia({video: false}).then(function(s) {
+    assert_equals(s.getVideoTracks().length, 1);
+    assert_equals(s.getAudioTracks().length, 0);
+  });
 }, 'getDisplayMedia() with video false');
 
 promise_test(function() {
   assert_idl_attribute(navigator, 'getDisplayMedia');
 
+  return navigator.getDisplayMedia({audio: false}).then(function(s) {
+    assert_equals(s.getVideoTracks().length, 1);
+    assert_equals(s.getAudioTracks().length, 0);
+  });
+}, 'getDisplayMedia() with audio false');
+
+promise_test(function() {
+  assert_idl_attribute(navigator, 'getDisplayMedia');
+
   return navigator.getDisplayMedia({audio: true}).then(function(s) {
     assert_equals(s.getVideoTracks().length, 0);
     assert_equals(s.getAudioTracks().length, 1);
@@ -52,27 +56,52 @@
 promise_test(function() {
   assert_idl_attribute(navigator, 'getDisplayMedia');
 
-  return navigator.getDisplayMedia({audio: false})
+  return navigator
+      .getDisplayMedia({video: {advanced: [{zoom: 1}]}})
       .then(function(s) {
         fail('getDisplayMedia should have failed');
       })
       .catch(function(e) {
         assert_equals(e.name, 'TypeError');
       });
-}, 'getDisplayMedia() with audio false');
+}, 'getDisplayMedia() call with advanced constraint');
 
 promise_test(function() {
   assert_idl_attribute(navigator, 'getDisplayMedia');
 
   return navigator
-      .getDisplayMedia({audio: false, video: {width: 1280, height: 720}})
+      .getDisplayMedia({video: {width: {min: 360}}})
       .then(function(s) {
         fail('getDisplayMedia should have failed');
       })
       .catch(function(e) {
-        assert_equals(e.name, 'InvalidAccessError');
+        assert_equals(e.name, 'TypeError');
       });
-}, 'getDisplayMedia() call with non-bool constraint');
+}, 'getDisplayMedia() call with min constraint');
+
+promise_test(function() {
+  assert_idl_attribute(navigator, 'getDisplayMedia');
+
+  return navigator
+      .getDisplayMedia({video: {width: {exact: 360}}})
+      .then(function(s) {
+        fail('getDisplayMedia should have failed');
+      })
+      .catch(function(e) {
+        assert_equals(e.name, 'TypeError');
+      });
+}, 'getDisplayMedia() call with exact constraint');
+
+promise_test(function() {
+  assert_idl_attribute(navigator, 'getDisplayMedia');
+
+  return navigator
+      .getDisplayMedia({video: {width: {max: 360}}})
+      .then(function(s) {
+        assert_equals(s.getVideoTracks().length, 1);
+        assert_equals(s.getAudioTracks().length, 0);
+      });
+}, 'getDisplayMedia() call with max constraint');
 
 // Content shell picks a fake desktop device by default.
 promise_test(function() {
diff --git a/third_party/WebKit/LayoutTests/fast/backgrounds/size/backgroundSize07-expected.png b/third_party/WebKit/LayoutTests/fast/backgrounds/size/backgroundSize07-expected.png
index e717aab56c..6f486dd 100644
--- a/third_party/WebKit/LayoutTests/fast/backgrounds/size/backgroundSize07-expected.png
+++ b/third_party/WebKit/LayoutTests/fast/backgrounds/size/backgroundSize07-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/fast/backgrounds/size/backgroundSize08-expected.png b/third_party/WebKit/LayoutTests/fast/backgrounds/size/backgroundSize08-expected.png
index 7054ea5..50fe372 100644
--- a/third_party/WebKit/LayoutTests/fast/backgrounds/size/backgroundSize08-expected.png
+++ b/third_party/WebKit/LayoutTests/fast/backgrounds/size/backgroundSize08-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/fast/borders/border-image-slice-constrained-expected.png b/third_party/WebKit/LayoutTests/fast/borders/border-image-slice-constrained-expected.png
index eea3a1d4..52a99644 100644
--- a/third_party/WebKit/LayoutTests/fast/borders/border-image-slice-constrained-expected.png
+++ b/third_party/WebKit/LayoutTests/fast/borders/border-image-slice-constrained-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/images/color-profile-border-image-expected.png b/third_party/WebKit/LayoutTests/images/color-profile-border-image-expected.png
index ea0e5da..e428de01 100644
--- a/third_party/WebKit/LayoutTests/images/color-profile-border-image-expected.png
+++ b/third_party/WebKit/LayoutTests/images/color-profile-border-image-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/backgrounds/repeat/mask-negative-offset-repeat-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/backgrounds/repeat/mask-negative-offset-repeat-expected.png
index 9077abb5..87ad6a78 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/backgrounds/repeat/mask-negative-offset-repeat-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/backgrounds/repeat/mask-negative-offset-repeat-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/backgrounds/size/backgroundSize16-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/backgrounds/size/backgroundSize16-expected.png
index beefae54..f0e8a7a 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/backgrounds/size/backgroundSize16-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/backgrounds/size/backgroundSize16-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/borders/border-image-border-radius-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/borders/border-image-border-radius-expected.png
index 71b017cc..0bf3585d 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/borders/border-image-border-radius-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/borders/border-image-border-radius-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/borders/border-image-scaled-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/borders/border-image-scaled-expected.png
index 8e11a49..52fafa5f 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/borders/border-image-scaled-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/borders/border-image-scaled-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/borders/scaled-border-image-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/borders/scaled-border-image-expected.png
index b6a0c98..852cc23 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/borders/scaled-border-image-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/borders/scaled-border-image-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/ietestcenter/css3/bordersbackgrounds/background-size-aspect-ratio-expected.png b/third_party/WebKit/LayoutTests/platform/linux/ietestcenter/css3/bordersbackgrounds/background-size-aspect-ratio-expected.png
index 21d6d314..0489a25 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/ietestcenter/css3/bordersbackgrounds/background-size-aspect-ratio-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/ietestcenter/css3/bordersbackgrounds/background-size-aspect-ratio-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-expected.png b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-expected.png
index 4aaeb6d..fc3be89 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-zoom-125-expected.png b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-zoom-125-expected.png
index 540058b..bef2ecf 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-zoom-125-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-zoom-125-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-zoom-150-expected.png b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-zoom-150-expected.png
index a10b14f..2039dee0 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-zoom-150-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-zoom-150-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-zoom-175-expected.png b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-zoom-175-expected.png
index d84ba1e..9446371 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-zoom-175-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-zoom-175-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-zoom-200-expected.png b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-zoom-200-expected.png
index be8d0cf1..9da3a756f 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-zoom-200-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-zoom-200-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-zoom-250-expected.png b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-zoom-250-expected.png
index 66dc4c8d..25ca3ed8 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-zoom-250-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/document-markers-zoom-250-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/ellipsis-ltr-text-in-ltr-flow-with-markers-expected.png b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/ellipsis-ltr-text-in-ltr-flow-with-markers-expected.png
index 42ac9be..bb3f652 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/ellipsis-ltr-text-in-ltr-flow-with-markers-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/ellipsis-ltr-text-in-ltr-flow-with-markers-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/ellipsis-ltr-text-in-rtl-flow-with-markers-expected.png b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/ellipsis-ltr-text-in-rtl-flow-with-markers-expected.png
index fdc9138f..bb5b762 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/ellipsis-ltr-text-in-rtl-flow-with-markers-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/ellipsis-ltr-text-in-rtl-flow-with-markers-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/ellipsis-rtl-text-in-rtl-flow-with-markers-expected.png b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/ellipsis-rtl-text-in-rtl-flow-with-markers-expected.png
index 7255314..5b8adf5 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/ellipsis-rtl-text-in-rtl-flow-with-markers-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/ellipsis-rtl-text-in-rtl-flow-with-markers-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/first-letter-expected.png b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/first-letter-expected.png
index e86f926d..6b32984 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/first-letter-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/first-letter-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/inline-spelling-markers-hidpi-composited-expected.png b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/inline-spelling-markers-hidpi-composited-expected.png
index e1aafca..0d17045f 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/inline-spelling-markers-hidpi-composited-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/inline-spelling-markers-hidpi-composited-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/inline-spelling-markers-hidpi-expected.png b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/inline-spelling-markers-hidpi-expected.png
index 7b06ec6..0d17045f 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/inline-spelling-markers-hidpi-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/inline-spelling-markers-hidpi-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/markers-zoomed-expected.png b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/markers-zoomed-expected.png
index 755d2915..8b261ad6 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/paint/markers/markers-zoomed-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/paint/markers/markers-zoomed-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/svg/as-border-image/svg-as-border-image-expected.png b/third_party/WebKit/LayoutTests/platform/linux/svg/as-border-image/svg-as-border-image-expected.png
index 6b74f52..278fb4e3 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/svg/as-border-image/svg-as-border-image-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/svg/as-border-image/svg-as-border-image-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/css3/masking/mask-luminance-svg-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/css3/masking/mask-luminance-svg-expected.png
deleted file mode 100644
index 6bb1aa9a..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/css3/masking/mask-luminance-svg-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/select/select-style-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/select/select-style-expected.png
index 455afed..70cba9f 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/select/select-style-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/fast/forms/select/select-style-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/paint/markers/document-markers-zoom-250-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/paint/markers/document-markers-zoom-250-expected.png
deleted file mode 100644
index 3e7399e..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/paint/markers/document-markers-zoom-250-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/paint/markers/inline-spelling-markers-hidpi-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/paint/markers/inline-spelling-markers-hidpi-expected.png
deleted file mode 100644
index d821438..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/paint/markers/inline-spelling-markers-hidpi-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/paint/markers/markers-zoomed-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/paint/markers/markers-zoomed-expected.png
deleted file mode 100644
index f3e446a..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/paint/markers/markers-zoomed-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/svg/as-background-image/same-image-two-instances-background-image-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/svg/as-background-image/same-image-two-instances-background-image-expected.png
deleted file mode 100644
index ccda916..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/svg/as-background-image/same-image-two-instances-background-image-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/svg/zoom/page/zoom-background-image-tiled-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.10/svg/zoom/page/zoom-background-image-tiled-expected.png
deleted file mode 100644
index 289e5099..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.10/svg/zoom/page/zoom-background-image-tiled-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/css3/masking/mask-luminance-svg-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/css3/masking/mask-luminance-svg-expected.png
deleted file mode 100644
index 1b9a5dd8..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/css3/masking/mask-luminance-svg-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/fast/forms/calendar-picker/calendar-picker-appearance-required-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/fast/forms/calendar-picker/calendar-picker-appearance-required-expected.png
index eef503a..c6e3e7f7 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/fast/forms/calendar-picker/calendar-picker-appearance-required-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/fast/forms/calendar-picker/calendar-picker-appearance-required-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/fast/forms/select/select-style-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/fast/forms/select/select-style-expected.png
index 5fa4bcc6..1744eac 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/fast/forms/select/select-style-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/fast/forms/select/select-style-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/paint/markers/document-markers-zoom-250-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/paint/markers/document-markers-zoom-250-expected.png
deleted file mode 100644
index bd7e98d..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/paint/markers/document-markers-zoom-250-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/paint/markers/inline-spelling-markers-hidpi-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/paint/markers/inline-spelling-markers-hidpi-expected.png
deleted file mode 100644
index d1cd7456..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/paint/markers/inline-spelling-markers-hidpi-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/paint/markers/markers-zoomed-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/paint/markers/markers-zoomed-expected.png
deleted file mode 100644
index a424d76..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/paint/markers/markers-zoomed-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/svg/as-background-image/same-image-two-instances-background-image-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/svg/as-background-image/same-image-two-instances-background-image-expected.png
deleted file mode 100644
index 9210f9d..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/svg/as-background-image/same-image-two-instances-background-image-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/svg/zoom/page/zoom-background-image-tiled-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.11/svg/zoom/page/zoom-background-image-tiled-expected.png
deleted file mode 100644
index 0ab39c1..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.11/svg/zoom/page/zoom-background-image-tiled-expected.png
+++ /dev/null
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.12/fast/inline/inline-box-background-repeat-x-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.12/fast/inline/inline-box-background-repeat-x-expected.png
index 3d3fa3a..42eaf7f1 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.12/fast/inline/inline-box-background-repeat-x-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.12/fast/inline/inline-box-background-repeat-x-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.12/paint/markers/document-markers-zoom-150-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.12/paint/markers/document-markers-zoom-150-expected.png
index 20c4a40..4ae1c9a3 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.12/paint/markers/document-markers-zoom-150-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.12/paint/markers/document-markers-zoom-150-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.12/svg/as-border-image/svg-as-border-image-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.12/svg/as-border-image/svg-as-border-image-expected.png
index 03ee60c7..f36a978 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.12/svg/as-border-image/svg-as-border-image-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.12/svg/as-border-image/svg-as-border-image-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/backgrounds/repeat/mask-negative-offset-repeat-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/backgrounds/repeat/mask-negative-offset-repeat-expected.png
index bb2d74c..ef1e009 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/backgrounds/repeat/mask-negative-offset-repeat-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/backgrounds/repeat/mask-negative-offset-repeat-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/backgrounds/size/backgroundSize16-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/backgrounds/size/backgroundSize16-expected.png
index 922ece18..51394d0 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/backgrounds/size/backgroundSize16-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/backgrounds/size/backgroundSize16-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-01-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-01-expected.png
index 28442280..a6c45793 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-01-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-01-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-border-radius-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-border-radius-expected.png
index 92a5ffa..49483ea 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-border-radius-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-border-radius-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-longhand-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-longhand-expected.png
index 28442280..a6c45793 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-longhand-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-longhand-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-outset-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-outset-expected.png
index 793deb4..27575973 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-outset-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-outset-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-outset-in-shorthand-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-outset-in-shorthand-expected.png
index 793deb4..27575973 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-outset-in-shorthand-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-outset-in-shorthand-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-outset-split-inline-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-outset-split-inline-expected.png
index 4a8cfb23..389e2dc 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-outset-split-inline-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-outset-split-inline-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-repeat-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-repeat-expected.png
index 28442280..a6c45793 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-repeat-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-repeat-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-repeat-round-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-repeat-round-expected.png
index 8102267..0e832bb 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-repeat-round-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-repeat-round-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-scale-transform-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-scale-transform-expected.png
index 9ba5be3e..9ca18003 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-scale-transform-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-scale-transform-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-scaled-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-scaled-expected.png
index 391f008..9be3477 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-scaled-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-scaled-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-scrambled-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-scrambled-expected.png
index 28442280..a6c45793 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-scrambled-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-scrambled-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-slices-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-slices-expected.png
index 849500b..893d5845 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-slices-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-slices-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-source-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-source-expected.png
index 28442280..a6c45793 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-source-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/border-image-source-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/scaled-border-image-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/scaled-border-image-expected.png
index 7bc1bf66..eaf065e 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/borders/scaled-border-image-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/borders/scaled-border-image-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/select/select-style-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/select/select-style-expected.png
index d19bd15..4e49caa 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/select/select-style-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/select/select-style-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/inline/inline-box-background-repeat-x-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/inline/inline-box-background-repeat-x-expected.png
index 60f42a0..355437c 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/inline/inline-box-background-repeat-x-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/inline/inline-box-background-repeat-x-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/writing-mode/border-image-vertical-lr-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/writing-mode/border-image-vertical-lr-expected.png
index 25defa7..f67cf93 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/writing-mode/border-image-vertical-lr-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/writing-mode/border-image-vertical-lr-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/writing-mode/border-image-vertical-rl-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/writing-mode/border-image-vertical-rl-expected.png
index d1e62720..3ae48c0 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/writing-mode/border-image-vertical-rl-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/writing-mode/border-image-vertical-rl-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/ietestcenter/css3/bordersbackgrounds/background-size-aspect-ratio-expected.png b/third_party/WebKit/LayoutTests/platform/mac/ietestcenter/css3/bordersbackgrounds/background-size-aspect-ratio-expected.png
index 4792f31d..2d3dca2 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/ietestcenter/css3/bordersbackgrounds/background-size-aspect-ratio-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/ietestcenter/css3/bordersbackgrounds/background-size-aspect-ratio-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/images/color-profile-border-image-source-expected.png b/third_party/WebKit/LayoutTests/platform/mac/images/color-profile-border-image-source-expected.png
index 28442280..a6c45793 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/images/color-profile-border-image-source-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/images/color-profile-border-image-source-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/images/color-profile-group-expected.png b/third_party/WebKit/LayoutTests/platform/mac/images/color-profile-group-expected.png
index 0db9f79..cbf44a0 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/images/color-profile-group-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/images/color-profile-group-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/images/sprite-no-bleed-expected.png b/third_party/WebKit/LayoutTests/platform/mac/images/sprite-no-bleed-expected.png
index 92d345a3..9550518 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/images/sprite-no-bleed-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/images/sprite-no-bleed-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-expected.png b/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-expected.png
index c2baa75..1621ecd4 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-zoom-125-expected.png b/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-zoom-125-expected.png
index d30b282d..73f9e8b4 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-zoom-125-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-zoom-125-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-zoom-150-expected.png b/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-zoom-150-expected.png
index ad879bab..4f48401 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-zoom-150-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-zoom-150-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-zoom-175-expected.png b/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-zoom-175-expected.png
index b317207..f514452 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-zoom-175-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-zoom-175-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-zoom-200-expected.png b/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-zoom-200-expected.png
index 3443984..fc0f844 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-zoom-200-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-zoom-200-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-zoom-250-expected.png b/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-zoom-250-expected.png
index 3e7399e..d09e5f4 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-zoom-250-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/paint/markers/document-markers-zoom-250-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/svg/as-border-image/svg-as-border-image-expected.png b/third_party/WebKit/LayoutTests/platform/mac/svg/as-border-image/svg-as-border-image-expected.png
index e999a0a..3034f9db 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/svg/as-border-image/svg-as-border-image-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/svg/as-border-image/svg-as-border-image-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/color-profile-border-image-source-expected.png b/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/color-profile-border-image-source-expected.png
index 4329f0e..04df92e 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/color-profile-border-image-source-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/color-profile-border-image-source-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/color-profile-group-expected.png b/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/color-profile-group-expected.png
index d780dcb9..71a6b894 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/color-profile-group-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/color-profile-group-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/sprite-no-bleed-expected.png b/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/sprite-no-bleed-expected.png
index c29bf6d..1923fb2 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/sprite-no-bleed-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/exotic-color-space/images/sprite-no-bleed-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/backgrounds/repeat/mask-negative-offset-repeat-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/backgrounds/repeat/mask-negative-offset-repeat-expected.png
index ada6fc6..9a63cab 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/backgrounds/repeat/mask-negative-offset-repeat-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/backgrounds/repeat/mask-negative-offset-repeat-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/backgrounds/size/backgroundSize16-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/backgrounds/size/backgroundSize16-expected.png
index 6946a59..4209f86 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/backgrounds/size/backgroundSize16-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/backgrounds/size/backgroundSize16-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-01-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-01-expected.png
index 5f65986..7b16843 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-01-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-01-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-border-radius-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-border-radius-expected.png
index 4b75a428..a892b42 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-border-radius-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-border-radius-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-longhand-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-longhand-expected.png
index 5f65986..7b16843 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-longhand-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-longhand-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-outset-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-outset-expected.png
index fd4cda8e..c36c000 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-outset-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-outset-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-outset-in-shorthand-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-outset-in-shorthand-expected.png
index fd4cda8e..c36c000 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-outset-in-shorthand-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-outset-in-shorthand-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-outset-split-inline-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-outset-split-inline-expected.png
index 3733ea0..718b486 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-outset-split-inline-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-outset-split-inline-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-repeat-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-repeat-expected.png
index 5f65986..7b16843 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-repeat-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-repeat-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-repeat-round-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-repeat-round-expected.png
index 659541e..890dd912 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-repeat-round-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-repeat-round-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-scale-transform-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-scale-transform-expected.png
index 1fbeaa2..a19703f 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-scale-transform-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-scale-transform-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-scaled-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-scaled-expected.png
index 780121d..79ed5d46 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-scaled-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-scaled-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-scrambled-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-scrambled-expected.png
index 5f65986..7b16843 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-scrambled-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-scrambled-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-slices-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-slices-expected.png
index 5b4456b1..22e1ebd 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-slices-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-slices-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-source-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-source-expected.png
index 5f65986..7b16843 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-source-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/borders/border-image-source-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/borders/scaled-border-image-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/borders/scaled-border-image-expected.png
index b80f326e..39088de 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/borders/scaled-border-image-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/borders/scaled-border-image-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/writing-mode/border-image-vertical-lr-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/writing-mode/border-image-vertical-lr-expected.png
index 5a7f73b..a447982 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/writing-mode/border-image-vertical-lr-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/writing-mode/border-image-vertical-lr-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/writing-mode/border-image-vertical-rl-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/writing-mode/border-image-vertical-rl-expected.png
index 0fa253e..89af464 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/writing-mode/border-image-vertical-rl-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/writing-mode/border-image-vertical-rl-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/ietestcenter/css3/bordersbackgrounds/background-size-aspect-ratio-expected.png b/third_party/WebKit/LayoutTests/platform/win/ietestcenter/css3/bordersbackgrounds/background-size-aspect-ratio-expected.png
index 3b3a4e7..a445605f 100644
--- a/third_party/WebKit/LayoutTests/platform/win/ietestcenter/css3/bordersbackgrounds/background-size-aspect-ratio-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/ietestcenter/css3/bordersbackgrounds/background-size-aspect-ratio-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/images/color-profile-border-image-source-expected.png b/third_party/WebKit/LayoutTests/platform/win/images/color-profile-border-image-source-expected.png
index 5f65986..7b16843 100644
--- a/third_party/WebKit/LayoutTests/platform/win/images/color-profile-border-image-source-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/images/color-profile-border-image-source-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/images/color-profile-group-expected.png b/third_party/WebKit/LayoutTests/platform/win/images/color-profile-group-expected.png
index b3e46bb..bdb1267 100644
--- a/third_party/WebKit/LayoutTests/platform/win/images/color-profile-group-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/images/color-profile-group-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/images/sprite-no-bleed-expected.png b/third_party/WebKit/LayoutTests/platform/win/images/sprite-no-bleed-expected.png
index bdff74a4..6ad738e 100644
--- a/third_party/WebKit/LayoutTests/platform/win/images/sprite-no-bleed-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/images/sprite-no-bleed-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-expected.png b/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-expected.png
index f193707..f7940e2 100644
--- a/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-zoom-125-expected.png b/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-zoom-125-expected.png
index 92600e6..d7e701d 100644
--- a/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-zoom-125-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-zoom-125-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-zoom-150-expected.png b/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-zoom-150-expected.png
index da54e0e9..36cea61 100644
--- a/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-zoom-150-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-zoom-150-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-zoom-175-expected.png b/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-zoom-175-expected.png
index d6589d9..5c4ca5d 100644
--- a/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-zoom-175-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-zoom-175-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-zoom-200-expected.png b/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-zoom-200-expected.png
index 52a059a..ed03f14 100644
--- a/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-zoom-200-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-zoom-200-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-zoom-250-expected.png b/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-zoom-250-expected.png
index 3963e75..1efba95 100644
--- a/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-zoom-250-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/paint/markers/document-markers-zoom-250-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/svg/as-border-image/svg-as-border-image-expected.png b/third_party/WebKit/LayoutTests/platform/win/svg/as-border-image/svg-as-border-image-expected.png
index 309faa6..8aae30d 100644
--- a/third_party/WebKit/LayoutTests/platform/win/svg/as-border-image/svg-as-border-image-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/svg/as-border-image/svg-as-border-image-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/color-profile-border-image-source-expected.png b/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/color-profile-border-image-source-expected.png
index 81b749c..1488d5ec 100644
--- a/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/color-profile-border-image-source-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/color-profile-border-image-source-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/color-profile-group-expected.png b/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/color-profile-group-expected.png
index d099cc4..a4a17a6 100644
--- a/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/color-profile-group-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/color-profile-group-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/sprite-no-bleed-expected.png b/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/sprite-no-bleed-expected.png
index a6300e4..58a2187 100644
--- a/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/sprite-no-bleed-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/virtual/exotic-color-space/images/sprite-no-bleed-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/virtual/exotic-color-space/images/color-profile-border-image-expected.png b/third_party/WebKit/LayoutTests/virtual/exotic-color-space/images/color-profile-border-image-expected.png
index d31a0d1..d304813 100644
--- a/third_party/WebKit/LayoutTests/virtual/exotic-color-space/images/color-profile-border-image-expected.png
+++ b/third_party/WebKit/LayoutTests/virtual/exotic-color-space/images/color-profile-border-image-expected.png
Binary files differ
diff --git a/third_party/blink/perf_tests/bindings/resources/worker-text-encoded-transferable-perf-test.js b/third_party/blink/perf_tests/bindings/resources/worker-text-encoded-transferable-perf-test.js
new file mode 100644
index 0000000..fb77577c
--- /dev/null
+++ b/third_party/blink/perf_tests/bindings/resources/worker-text-encoded-transferable-perf-test.js
@@ -0,0 +1,54 @@
+const WorkerTextEncodedTransferablePerfTestRunner = (function() {
+  function pingPong(data) {
+    return new Promise((resolve, reject) => {
+      let sendData, textEncoder, textDecoder, mainThreadBeginEncode, mainThreadEndDecode, toWorkerTime, fromWorkerTime, totalTime;
+      textEncoder = new TextEncoder('utf-8');
+      textDecoder  = new TextDecoder('utf-8');
+      worker.addEventListener('message', function listener(e) {
+        try {
+          textDecoder.decode(e.data.data);
+          mainThreadEndDecode = performance.now();
+          worker.removeEventListener('message', listener);
+          // toWorkerTime: time to encode the data, send it to the worker, and decode it on the worker
+          toWorkerTime = (e.data.workerDecode + (e.data.workerTimeOrigin - performance.timeOrigin)) - mainThreadBeginEncode;
+          // fromWorkerTime: time to encode the data on the worker, send it back to the main thread, and deocde it
+          fromWorkerTime = mainThreadEndDecode - (e.data.workerDecode + (e.data.workerTimeOrigin - performance.timeOrigin));
+          // totalTime: time to do the whole roundtrip
+          totalTime = mainThreadEndDecode - mainThreadBeginEncode
+          resolve([toWorkerTime, fromWorkerTime, totalTime]);
+        } catch (err) { reject(err); }
+      });
+      mainThreadBeginEncode = performance.now();
+      sendData = textEncoder.encode(data).buffer;
+      worker.postMessage({"data" : sendData}, [sendData]);
+    });
+  }
+
+  return {
+    measureTimeAsync(test) {
+      let isDone = false;
+      worker = new Worker('resources/worker-text-encoded-transferable.js');
+      PerfTestRunner.startMeasureValuesAsync({
+        description: test.description,
+        unit: 'ms',
+        warmUpCount: test.warmUpCount || 10,
+        iterationCount: test.iterationCount || 250,
+        done() { isDone = true; },
+        run: pingPongUntilDone,
+      });
+
+      function pingPongUntilDone() {
+        pingPong(test.data).then(([toWorkerTime, fromWorkerTime, totalTime]) => {
+          console.log([toWorkerTime, fromWorkerTime, totalTime]);
+          if (test.measure == 'toWorker')
+            PerfTestRunner.measureValueAsync(toWorkerTime);
+          else if (test.measure === 'fromWorker')
+            PerfTestRunner.measureValueAsync(fromWorkerTime);
+          else if (test.measure == 'roundtrip')
+            PerfTestRunner.measureValueAsync(totalTime);
+          if (!isDone) pingPongUntilDone();
+        });
+      }
+    },
+  };
+})();
diff --git a/third_party/blink/perf_tests/bindings/resources/worker-text-encoded-transferable.js b/third_party/blink/perf_tests/bindings/resources/worker-text-encoded-transferable.js
new file mode 100644
index 0000000..cba2f1d
--- /dev/null
+++ b/third_party/blink/perf_tests/bindings/resources/worker-text-encoded-transferable.js
@@ -0,0 +1,11 @@
+var textDecoder = new TextDecoder('utf-8');
+var textEncoder = new TextEncoder('utf-8');
+self.onmessage = function(e) {
+  var data = textDecoder.decode(e.data.data);
+  var workerDecode = performance.now();
+  var sendData = textEncoder.encode(data).buffer;
+  self.postMessage({'data' : sendData,
+                    'workerTimeOrigin' : performance.timeOrigin,
+                    'workerDecode' : workerDecode},
+                   [sendData]);
+};
diff --git a/third_party/blink/perf_tests/bindings/worker-text-encoded-transferable-from-worker.html b/third_party/blink/perf_tests/bindings/worker-text-encoded-transferable-from-worker.html
new file mode 100644
index 0000000..7e1f0b3c
--- /dev/null
+++ b/third_party/blink/perf_tests/bindings/worker-text-encoded-transferable-from-worker.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<body>
+<script src="../resources/runner.js"></script>
+<script src="resources/worker-text-encoded-transferable-perf-test.js"></script>
+<script>
+WorkerTextEncodedTransferablePerfTestRunner.measureTimeAsync({
+  description: "Measures performance of sending text encoded JSON data back to the main thread from a worker",
+  data: PerfTestRunner.loadFile("resources/blink-dev.json"),
+  measure: "fromWorker",
+});
+</script>
+</body>
diff --git a/third_party/blink/perf_tests/bindings/worker-text-encoded-transferable-roundtrip.html b/third_party/blink/perf_tests/bindings/worker-text-encoded-transferable-roundtrip.html
new file mode 100644
index 0000000..3d0de86
--- /dev/null
+++ b/third_party/blink/perf_tests/bindings/worker-text-encoded-transferable-roundtrip.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<body>
+<script src="../resources/runner.js"></script>
+<script src="resources/worker-text-encoded-transferable-perf-test.js"></script>
+<script>
+WorkerTextEncodedTransferablePerfTestRunner.measureTimeAsync({
+  description: "Measures performance of worker round-trip with text-encoded data sent as a transferable.",
+  data: PerfTestRunner.loadFile("resources/blink-dev.json"),
+  measure: "roundtrip",
+});
+</script>
+</body>
diff --git a/third_party/blink/perf_tests/bindings/worker-text-encoded-transferable-to-worker.html b/third_party/blink/perf_tests/bindings/worker-text-encoded-transferable-to-worker.html
new file mode 100644
index 0000000..70a0c43
--- /dev/null
+++ b/third_party/blink/perf_tests/bindings/worker-text-encoded-transferable-to-worker.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<body>
+<script src="../resources/runner.js"></script>
+<script src="resources/worker-text-encoded-transferable-perf-test.js"></script>
+<script>
+WorkerTextEncodedTransferablePerfTestRunner.measureTimeAsync({
+  description: "Measures performance of encoding JSON data to send to worker thread as a transferable",
+  data: PerfTestRunner.loadFile("resources/blink-dev.json"),
+  measure: "toWorker",
+});
+</script>
+</body>
diff --git a/third_party/blink/public/platform/web_media_constraints.h b/third_party/blink/public/platform/web_media_constraints.h
index 1edd3e10..15a82e7 100644
--- a/third_party/blink/public/platform/web_media_constraints.h
+++ b/third_party/blink/public/platform/web_media_constraints.h
@@ -53,7 +53,10 @@
   explicit BaseConstraint(const char* name);
   virtual ~BaseConstraint();
   virtual bool IsEmpty() const = 0;
-  virtual bool HasMandatory() const = 0;
+  bool HasMandatory() const;
+  virtual bool HasMin() const { return false; }
+  virtual bool HasMax() const { return false; }
+  virtual bool HasExact() const = 0;
   const char* GetName() const { return name_; }
   virtual WebString ToString() const = 0;
 
@@ -89,13 +92,12 @@
 
   bool Matches(int32_t value) const;
   bool IsEmpty() const override;
-  bool HasMandatory() const override;
+  bool HasMin() const override { return has_min_; }
+  bool HasMax() const override { return has_max_; }
+  bool HasExact() const override { return has_exact_; }
   WebString ToString() const override;
-  bool HasMin() const { return has_min_; }
   int32_t Min() const { return min_; }
-  bool HasMax() const { return has_max_; }
   int32_t Max() const { return max_; }
-  bool HasExact() const { return has_exact_; }
   int32_t Exact() const { return exact_; }
   bool HasIdeal() const { return has_ideal_; }
   int32_t Ideal() const { return ideal_; }
@@ -142,13 +144,12 @@
 
   bool Matches(double value) const;
   bool IsEmpty() const override;
-  bool HasMandatory() const override;
+  bool HasMin() const override { return has_min_; }
+  bool HasMax() const override { return has_max_; }
+  bool HasExact() const override { return has_exact_; }
   WebString ToString() const override;
-  bool HasMin() const { return has_min_; }
   double Min() const { return min_; }
-  bool HasMax() const { return has_max_; }
   double Max() const { return max_; }
-  bool HasExact() const { return has_exact_; }
   double Exact() const { return exact_; }
   bool HasIdeal() const { return has_ideal_; }
   double Ideal() const { return ideal_; }
@@ -180,9 +181,8 @@
 
   bool Matches(WebString value) const;
   bool IsEmpty() const override;
-  bool HasMandatory() const override;
+  bool HasExact() const override { return !exact_.empty(); }
   WebString ToString() const override;
-  bool HasExact() const { return !exact_.empty(); }
   bool HasIdeal() const { return !ideal_.empty(); }
   const WebVector<WebString>& Exact() const;
   const WebVector<WebString>& Ideal() const;
@@ -210,9 +210,8 @@
 
   bool Matches(bool value) const;
   bool IsEmpty() const override;
-  bool HasMandatory() const override;
+  bool HasExact() const override { return has_exact_; }
   WebString ToString() const override;
-  bool HasExact() const { return has_exact_; }
   bool HasIdeal() const { return has_ideal_; }
 
  private:
@@ -291,6 +290,8 @@
   BLINK_PLATFORM_EXPORT bool HasMandatoryOutsideSet(
       const std::vector<std::string>&,
       std::string&) const;
+  BLINK_PLATFORM_EXPORT bool HasMin() const;
+  BLINK_PLATFORM_EXPORT bool HasExact() const;
   BLINK_PLATFORM_EXPORT WebString ToString() const;
 
  private:
diff --git a/third_party/blink/public/platform/web_mouse_wheel_event.h b/third_party/blink/public/platform/web_mouse_wheel_event.h
index 9744639..d2de0952 100644
--- a/third_party/blink/public/platform/web_mouse_wheel_event.h
+++ b/third_party/blink/public/platform/web_mouse_wheel_event.h
@@ -70,10 +70,10 @@
 
   // True when phase information is added in mouse_wheel_phase_handler based
   // on its timer.
-  bool has_synthetic_phase;
+  bool has_synthetic_phase = false;
 
-  bool scroll_by_page;
-  bool has_precise_scrolling_deltas;
+  bool scroll_by_page = false;
+  bool has_precise_scrolling_deltas = false;
 
   RailsMode rails_mode;
 
@@ -99,8 +99,6 @@
         resending_plugin_id(-1),
         phase(kPhaseNone),
         momentum_phase(kPhaseNone),
-        scroll_by_page(false),
-        has_precise_scrolling_deltas(false),
         rails_mode(kRailsModeFree),
         dispatch_type(kBlocking) {}
 
diff --git a/third_party/blink/public/platform/web_runtime_features.h b/third_party/blink/public/platform/web_runtime_features.h
index 189961d..0cfb2fc 100644
--- a/third_party/blink/public/platform/web_runtime_features.h
+++ b/third_party/blink/public/platform/web_runtime_features.h
@@ -62,6 +62,8 @@
       const std::string& name,
       bool enable);
 
+  BLINK_PLATFORM_EXPORT static bool IsBlinkGenPropertyTreesEnabled();
+
   BLINK_PLATFORM_EXPORT static void EnableCompositedSelectionUpdate(bool);
   BLINK_PLATFORM_EXPORT static bool IsCompositedSelectionUpdateEnabled();
 
@@ -70,6 +72,8 @@
   BLINK_PLATFORM_EXPORT static void EnableOriginTrials(bool);
   BLINK_PLATFORM_EXPORT static bool IsOriginTrialsEnabled();
 
+  BLINK_PLATFORM_EXPORT static bool IsSlimmingPaintV2Enabled();
+
   BLINK_PLATFORM_EXPORT static void EnableAccelerated2dCanvas(bool);
   BLINK_PLATFORM_EXPORT static void EnableAccessibilityObjectModel(bool);
   BLINK_PLATFORM_EXPORT static void EnableAdTagging(bool);
@@ -150,7 +154,6 @@
   BLINK_PLATFORM_EXPORT static void EnableSharedArrayBuffer(bool);
   BLINK_PLATFORM_EXPORT static void EnableSharedWorker(bool);
   BLINK_PLATFORM_EXPORT static void EnableSignedHTTPExchange(bool);
-  BLINK_PLATFORM_EXPORT static void EnableSlimmingPaintV2(bool);
   BLINK_PLATFORM_EXPORT static void EnableTouchEventFeatureDetection(bool);
   BLINK_PLATFORM_EXPORT static void EnableUserActivationV2(bool);
   BLINK_PLATFORM_EXPORT static void EnableV8IdleTasks(bool);
diff --git a/third_party/blink/public/web/web_settings.h b/third_party/blink/public/web/web_settings.h
index c4ebed3..49a16f83 100644
--- a/third_party/blink/public/web/web_settings.h
+++ b/third_party/blink/public/web/web_settings.h
@@ -126,7 +126,6 @@
   virtual bool ShrinksViewportContentToFit() const = 0;
   virtual bool ViewportEnabled() const = 0;
   virtual void SetAccelerated2dCanvasMSAASampleCount(int) = 0;
-  virtual void SetAcceleratedCompositingEnabled(bool) = 0;
   virtual void SetPreferCompositingToLCDTextEnabled(bool) = 0;
   // Not implemented yet, see http://crbug.com/178119
   virtual void SetAcceleratedCompositingForTransitionEnabled(bool) {}
diff --git a/third_party/blink/renderer/core/animation/css_font_size_interpolation_type.cc b/third_party/blink/renderer/core/animation/css_font_size_interpolation_type.cc
index 981eff3..0bd5d9c 100644
--- a/third_party/blink/renderer/core/animation/css_font_size_interpolation_type.cc
+++ b/third_party/blink/renderer/core/animation/css_font_size_interpolation_type.cc
@@ -13,7 +13,7 @@
 #include "third_party/blink/renderer/core/css/resolver/style_resolver_state.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
 #include "third_party/blink/renderer/platform/fonts/font_description.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/animation/css_length_interpolation_type.cc b/third_party/blink/renderer/core/animation/css_length_interpolation_type.cc
index 87b110f..c64acaf2 100644
--- a/third_party/blink/renderer/core/animation/css_length_interpolation_type.cc
+++ b/third_party/blink/renderer/core/animation/css_length_interpolation_type.cc
@@ -16,7 +16,7 @@
 #include "third_party/blink/renderer/core/css/resolver/style_builder.h"
 #include "third_party/blink/renderer/core/css/resolver/style_resolver_state.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/animation/css_length_list_interpolation_type.h b/third_party/blink/renderer/core/animation/css_length_list_interpolation_type.h
index b000e5e..f844ab40 100644
--- a/third_party/blink/renderer/core/animation/css_length_list_interpolation_type.h
+++ b/third_party/blink/renderer/core/animation/css_length_list_interpolation_type.h
@@ -7,7 +7,7 @@
 
 #include "third_party/blink/renderer/core/animation/css_interpolation_type.h"
 #include "third_party/blink/renderer/core/animation/css_length_interpolation_type.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/animation/length_interpolation_functions.cc b/third_party/blink/renderer/core/animation/length_interpolation_functions.cc
index 0f53dc8..b1cd14d 100644
--- a/third_party/blink/renderer/core/animation/length_interpolation_functions.cc
+++ b/third_party/blink/renderer/core/animation/length_interpolation_functions.cc
@@ -7,7 +7,7 @@
 #include "third_party/blink/renderer/core/css/css_calculation_value.h"
 #include "third_party/blink/renderer/core/css/css_primitive_value.h"
 #include "third_party/blink/renderer/core/css/css_to_length_conversion_data.h"
-#include "third_party/blink/renderer/platform/calculation_value.h"
+#include "third_party/blink/renderer/platform/geometry/calculation_value.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/animation/length_interpolation_functions.h b/third_party/blink/renderer/core/animation/length_interpolation_functions.h
index 1a87760..a75221a 100644
--- a/third_party/blink/renderer/core/animation/length_interpolation_functions.h
+++ b/third_party/blink/renderer/core/animation/length_interpolation_functions.h
@@ -8,7 +8,7 @@
 #include <memory>
 #include "third_party/blink/renderer/core/animation/interpolation_value.h"
 #include "third_party/blink/renderer/core/animation/pairwise_interpolation_value.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/animation/length_list_property_functions.h b/third_party/blink/renderer/core/animation/length_list_property_functions.h
index bf5f15d..a8a75f9 100644
--- a/third_party/blink/renderer/core/animation/length_list_property_functions.h
+++ b/third_party/blink/renderer/core/animation/length_list_property_functions.h
@@ -6,7 +6,7 @@
 #define THIRD_PARTY_BLINK_RENDERER_CORE_ANIMATION_LENGTH_LIST_PROPERTY_FUNCTIONS_H_
 
 #include "third_party/blink/renderer/core/css_property_names.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/wtf/vector.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/animation/length_property_functions.h b/third_party/blink/renderer/core/animation/length_property_functions.h
index 9138744..ae634f2 100644
--- a/third_party/blink/renderer/core/animation/length_property_functions.h
+++ b/third_party/blink/renderer/core/animation/length_property_functions.h
@@ -7,7 +7,7 @@
 
 #include "third_party/blink/renderer/core/css_property_names.h"
 #include "third_party/blink/renderer/core/css_value_keywords.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/wtf/allocator.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/animation/scroll_timeline.cc b/third_party/blink/renderer/core/animation/scroll_timeline.cc
index 04e2128f..2f136202 100644
--- a/third_party/blink/renderer/core/animation/scroll_timeline.cc
+++ b/third_party/blink/renderer/core/animation/scroll_timeline.cc
@@ -14,7 +14,7 @@
 #include "third_party/blink/renderer/core/paint/compositing/paint_layer_compositor.h"
 #include "third_party/blink/renderer/core/paint/paint_layer.h"
 #include "third_party/blink/renderer/core/paint/paint_layer_scrollable_area.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/css/computed_style_extra_fields.json5 b/third_party/blink/renderer/core/css/computed_style_extra_fields.json5
index 343ffb99..96b002d 100644
--- a/third_party/blink/renderer/core/css/computed_style_extra_fields.json5
+++ b/third_party/blink/renderer/core/css/computed_style_extra_fields.json5
@@ -227,7 +227,7 @@
       name: "VerticalAlignLength",
       field_template: "external",
       default_value: "Length()",
-      include_paths: ["third_party/blink/renderer/platform/length.h"],
+      include_paths: ["third_party/blink/renderer/platform/geometry/length.h"],
       type_name: "Length",
       field_group: "box",
       getter: "GetVerticalAlignLength",
diff --git a/third_party/blink/renderer/core/css/computed_style_field_aliases.json5 b/third_party/blink/renderer/core/css/computed_style_field_aliases.json5
index cce3321d..cef592a 100644
--- a/third_party/blink/renderer/core/css/computed_style_field_aliases.json5
+++ b/third_party/blink/renderer/core/css/computed_style_field_aliases.json5
@@ -8,7 +8,7 @@
             "name": "<length>",
             "field_template": "external",
             "type_name": "Length",
-            "include_paths": ["third_party/blink/renderer/platform/length.h"]
+            "include_paths": ["third_party/blink/renderer/platform/geometry/length.h"]
         },
         {
             "name": "<color>",
diff --git a/third_party/blink/renderer/core/css/css_basic_shape_values.cc b/third_party/blink/renderer/core/css/css_basic_shape_values.cc
index 28776fe..289cd8db 100644
--- a/third_party/blink/renderer/core/css/css_basic_shape_values.cc
+++ b/third_party/blink/renderer/core/css/css_basic_shape_values.cc
@@ -32,7 +32,7 @@
 #include "third_party/blink/renderer/core/css/css_identifier_value.h"
 #include "third_party/blink/renderer/core/css/css_primitive_value.h"
 #include "third_party/blink/renderer/core/css/css_value_pair.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/wtf/text/string_builder.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/css/css_calculation_value.h b/third_party/blink/renderer/core/css/css_calculation_value.h
index 3f53cb6..da67fb8b 100644
--- a/third_party/blink/renderer/core/css/css_calculation_value.h
+++ b/third_party/blink/renderer/core/css/css_calculation_value.h
@@ -35,7 +35,7 @@
 #include "third_party/blink/renderer/core/css/css_primitive_value.h"
 #include "third_party/blink/renderer/core/css/css_value.h"
 #include "third_party/blink/renderer/core/css/parser/css_parser_token_range.h"
-#include "third_party/blink/renderer/platform/calculation_value.h"
+#include "third_party/blink/renderer/platform/geometry/calculation_value.h"
 #include "third_party/blink/renderer/platform/wtf/forward.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/css/css_identifier_value.cc b/third_party/blink/renderer/core/css/css_identifier_value.cc
index b8e722f..aa4a8e8 100644
--- a/third_party/blink/renderer/core/css/css_identifier_value.cc
+++ b/third_party/blink/renderer/core/css/css_identifier_value.cc
@@ -6,7 +6,7 @@
 
 #include "third_party/blink/renderer/core/css/css_markup.h"
 #include "third_party/blink/renderer/core/css/css_value_pool.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/wtf/text/string_builder.h"
 #include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
 
diff --git a/third_party/blink/renderer/core/css/css_primitive_value_mappings.h b/third_party/blink/renderer/core/css/css_primitive_value_mappings.h
index fd8d8b9..54196e8 100644
--- a/third_party/blink/renderer/core/css/css_primitive_value_mappings.h
+++ b/third_party/blink/renderer/core/css/css_primitive_value_mappings.h
@@ -44,9 +44,9 @@
 #include "third_party/blink/renderer/platform/fonts/font_description.h"
 #include "third_party/blink/renderer/platform/fonts/font_smoothing_mode.h"
 #include "third_party/blink/renderer/platform/fonts/text_rendering_mode.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/graphics/graphics_types.h"
 #include "third_party/blink/renderer/platform/graphics/touch_action.h"
-#include "third_party/blink/renderer/platform/length.h"
 #include "third_party/blink/renderer/platform/text/text_run.h"
 #include "third_party/blink/renderer/platform/text/writing_mode.h"
 #include "third_party/blink/renderer/platform/theme_types.h"
diff --git a/third_party/blink/renderer/core/css/css_properties.json5 b/third_party/blink/renderer/core/css/css_properties.json5
index cee6cb0..8a6ca92b 100644
--- a/third_party/blink/renderer/core/css/css_properties.json5
+++ b/third_party/blink/renderer/core/css/css_properties.json5
@@ -1025,7 +1025,7 @@
       interpolable: true,
       field_group: "surround",
       field_template: "external",
-      include_paths: ["third_party/blink/renderer/platform/length_size.h"],
+      include_paths: ["third_party/blink/renderer/platform/geometry/length_size.h"],
       default_value: "LengthSize(Length(0, kFixed), Length(0, kFixed))",
       type_name: "LengthSize",
       converter: "ConvertRadius",
@@ -1037,7 +1037,7 @@
       interpolable: true,
       field_group: "surround",
       field_template: "external",
-      include_paths: ["third_party/blink/renderer/platform/length_size.h"],
+      include_paths: ["third_party/blink/renderer/platform/geometry/length_size.h"],
       default_value: "LengthSize(Length(0, kFixed), Length(0, kFixed))",
       type_name: "LengthSize",
       converter: "ConvertRadius",
@@ -1237,7 +1237,7 @@
       interpolable: true,
       field_group: "surround",
       field_template: "external",
-      include_paths: ["third_party/blink/renderer/platform/length_size.h"],
+      include_paths: ["third_party/blink/renderer/platform/geometry/length_size.h"],
       default_value: "LengthSize(Length(0, kFixed), Length(0, kFixed))",
       type_name: "LengthSize",
       converter: "ConvertRadius",
@@ -1249,7 +1249,7 @@
       interpolable: true,
       field_group: "surround",
       field_template: "external",
-      include_paths: ["third_party/blink/renderer/platform/length_size.h"],
+      include_paths: ["third_party/blink/renderer/platform/geometry/length_size.h"],
       default_value: "LengthSize(Length(0, kFixed), Length(0, kFixed))",
       type_name: "LengthSize",
       converter: "ConvertRadius",
@@ -1401,7 +1401,7 @@
       interpolable: true,
       field_group: "visual",
       field_template: "external",
-      include_paths: ["third_party/blink/renderer/platform/length_box.h"],
+      include_paths: ["third_party/blink/renderer/platform/geometry/length_box.h"],
       default_value: "LengthBox()",
       type_name: "LengthBox",
       computed_style_custom_functions: ["setter"],
@@ -2212,7 +2212,7 @@
       interpolable: true,
       field_group: "*",
       field_template: "external",
-      include_paths: ["third_party/blink/renderer/platform/length_point.h"],
+      include_paths: ["third_party/blink/renderer/platform/geometry/length_point.h"],
       default_value: "LengthPoint(Length(50.0, kPercent), Length(50.0, kPercent))",
       type_name: "LengthPoint",
       converter: "ConvertPosition",
@@ -2225,7 +2225,7 @@
       runtime_flag: "CSSOffsetPositionAnchor",
       field_group: "*",
       field_template: "external",
-      include_paths: ["third_party/blink/renderer/platform/length_point.h"],
+      include_paths: ["third_party/blink/renderer/platform/geometry/length_point.h"],
       default_value: "LengthPoint(Length(kAuto), Length(kAuto))",
       type_name: "LengthPoint",
       converter: "ConvertPositionOrAuto",
@@ -2263,7 +2263,7 @@
       runtime_flag: "CSSOffsetPositionAnchor",
       field_group: "*",
       field_template: "external",
-      include_paths: ["third_party/blink/renderer/platform/length_point.h"],
+      include_paths: ["third_party/blink/renderer/platform/geometry/length_point.h"],
       default_value: "LengthPoint(Length(kAuto), Length(kAuto))",
       type_name: "LengthPoint",
       converter: "ConvertPositionOrAuto",
@@ -2509,7 +2509,7 @@
       layout_dependent: true,
       field_group: "*",
       field_template: "external",
-      include_paths: ["third_party/blink/renderer/platform/length_point.h"],
+      include_paths: ["third_party/blink/renderer/platform/geometry/length_point.h"],
       default_value: "LengthPoint(Length(50.0, kPercent), Length(50.0, kPercent))",
       type_name: "LengthPoint",
       converter: "ConvertPosition",
@@ -2714,7 +2714,7 @@
       name: "scroll-padding-block-end",
       property_methods: ["ParseSingleValue"],
       runtime_flag: "CSSScrollSnapPoints",
-      include_paths: ["third_party/blink/renderer/platform/length.h"],
+      include_paths: ["third_party/blink/renderer/platform/geometry/length.h"],
       typedom_types: ["Keyword", "Length", "Percentage"],
       type_name: "Length",
       converter: "ConvertLength",
@@ -2727,7 +2727,7 @@
       name: "scroll-padding-block-start",
       property_methods: ["ParseSingleValue"],
       runtime_flag: "CSSScrollSnapPoints",
-      include_paths: ["third_party/blink/renderer/platform/length.h"],
+      include_paths: ["third_party/blink/renderer/platform/geometry/length.h"],
       typedom_types: ["Keyword", "Length", "Percentage"],
       type_name: "Length",
       converter: "ConvertLength",
@@ -2750,7 +2750,7 @@
       name: "scroll-padding-inline-end",
       property_methods: ["ParseSingleValue"],
       runtime_flag: "CSSScrollSnapPoints",
-      include_paths: ["third_party/blink/renderer/platform/length.h"],
+      include_paths: ["third_party/blink/renderer/platform/geometry/length.h"],
       typedom_types: ["Keyword", "Length", "Percentage"],
       type_name: "Length",
       converter: "ConvertLength",
@@ -2763,7 +2763,7 @@
       name: "scroll-padding-inline-start",
       property_methods: ["ParseSingleValue"],
       runtime_flag: "CSSScrollSnapPoints",
-      include_paths: ["third_party/blink/renderer/platform/length.h"],
+      include_paths: ["third_party/blink/renderer/platform/geometry/length.h"],
       typedom_types: ["Keyword", "Length", "Percentage"],
       type_name: "Length",
       converter: "ConvertLength",
diff --git a/third_party/blink/renderer/core/css/css_value.cc b/third_party/blink/renderer/core/css/css_value.cc
index d7a9cc8b2..565e099 100644
--- a/third_party/blink/renderer/core/css/css_value.cc
+++ b/third_party/blink/renderer/core/css/css_value.cc
@@ -67,7 +67,7 @@
 #include "third_party/blink/renderer/core/css/css_value_list.h"
 #include "third_party/blink/renderer/core/css/css_value_pair.h"
 #include "third_party/blink/renderer/core/css/css_variable_reference_value.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/wtf/size_assertions.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/css/html.css b/third_party/blink/renderer/core/css/html.css
index 9ad329b..9b45e55 100644
--- a/third_party/blink/renderer/core/css/html.css
+++ b/third_party/blink/renderer/core/css/html.css
@@ -65,10 +65,10 @@
 
 p {
     display: block;
-    -webkit-margin-before: 1__qem;
-    -webkit-margin-after: 1__qem;
-    -webkit-margin-start: 0;
-    -webkit-margin-end: 0;
+    margin-block-start: 1__qem;
+    margin-block-end: 1__qem;
+    margin-inline-start: 0;
+    margin-inline-end: 0;
 }
 
 div {
@@ -94,10 +94,10 @@
 
 blockquote {
     display: block;
-    -webkit-margin-before: 1__qem;
-    -webkit-margin-after: 1em;
-    -webkit-margin-start: 40px;
-    -webkit-margin-end: 40px;
+    margin-block-start: 1__qem;
+    margin-block-end: 1em;
+    margin-inline-start: 40px;
+    margin-inline-end: 40px;
 }
 
 figcaption {
@@ -106,10 +106,10 @@
 
 figure {
     display: block;
-    -webkit-margin-before: 1em;
-    -webkit-margin-after: 1em;
-    -webkit-margin-start: 40px;
-    -webkit-margin-end: 40px;
+    margin-block-start: 1em;
+    margin-block-end: 1em;
+    margin-inline-start: 40px;
+    margin-inline-end: 40px;
 }
 
 q {
@@ -134,10 +134,10 @@
     display: block;
     overflow: hidden;
     unicode-bidi: isolate;
-    -webkit-margin-before: 0.5em;
-    -webkit-margin-after: 0.5em;
-    -webkit-margin-start: auto;
-    -webkit-margin-end: auto;
+    margin-block-start: 0.5em;
+    margin-block-end: 0.5em;
+    margin-inline-start: auto;
+    margin-inline-end: auto;
     border-style: inset;
     border-width: 1px
 }
@@ -155,89 +155,89 @@
 h1 {
     display: block;
     font-size: 2em;
-    -webkit-margin-before: 0.67__qem;
-    -webkit-margin-after: 0.67em;
-    -webkit-margin-start: 0;
-    -webkit-margin-end: 0;
+    margin-block-start: 0.67__qem;
+    margin-block-end: 0.67em;
+    margin-inline-start: 0;
+    margin-inline-end: 0;
     font-weight: bold
 }
 
 :-webkit-any(article,aside,nav,section) h1 {
     font-size: 1.5em;
-    -webkit-margin-before: 0.83__qem;
-    -webkit-margin-after: 0.83em;
+    margin-block-start: 0.83__qem;
+    margin-block-end: 0.83em;
 }
 
 :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) h1 {
     font-size: 1.17em;
-    -webkit-margin-before: 1__qem;
-    -webkit-margin-after: 1em;
+    margin-block-start: 1__qem;
+    margin-block-end: 1em;
 }
 
 :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) h1 {
     font-size: 1.00em;
-    -webkit-margin-before: 1.33__qem;
-    -webkit-margin-after: 1.33em;
+    margin-block-start: 1.33__qem;
+    margin-block-end: 1.33em;
 }
 
 :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) h1 {
     font-size: .83em;
-    -webkit-margin-before: 1.67__qem;
-    -webkit-margin-after: 1.67em;
+    margin-block-start: 1.67__qem;
+    margin-block-end: 1.67em;
 }
 
 :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) :-webkit-any(article,aside,nav,section) h1 {
     font-size: .67em;
-    -webkit-margin-before: 2.33__qem;
-    -webkit-margin-after: 2.33em;
+    margin-block-start: 2.33__qem;
+    margin-block-end: 2.33em;
 }
 
 h2 {
     display: block;
     font-size: 1.5em;
-    -webkit-margin-before: 0.83__qem;
-    -webkit-margin-after: 0.83em;
-    -webkit-margin-start: 0;
-    -webkit-margin-end: 0;
+    margin-block-start: 0.83__qem;
+    margin-block-end: 0.83em;
+    margin-inline-start: 0;
+    margin-inline-end: 0;
     font-weight: bold
 }
 
 h3 {
     display: block;
     font-size: 1.17em;
-    -webkit-margin-before: 1__qem;
-    -webkit-margin-after: 1em;
-    -webkit-margin-start: 0;
-    -webkit-margin-end: 0;
+    margin-block-start: 1__qem;
+    margin-block-end: 1em;
+    margin-inline-start: 0;
+    margin-inline-end: 0;
     font-weight: bold
 }
 
 h4 {
     display: block;
-    -webkit-margin-before: 1.33__qem;
-    -webkit-margin-after: 1.33em;
-    -webkit-margin-start: 0;
-    -webkit-margin-end: 0;
+    margin-block-start: 1.33__qem;
+    margin-block-end: 1.33em;
+    margin-inline-start: 0;
+    margin-inline-end: 0;
     font-weight: bold
 }
 
 h5 {
     display: block;
     font-size: .83em;
-    -webkit-margin-before: 1.67__qem;
-    -webkit-margin-after: 1.67em;
-    -webkit-margin-start: 0;
-    -webkit-margin-end: 0;
+    margin-block-start: 1.67__qem;
+    margin-block-end: 1.67em;
+    margin-inline-start: 0;
+    margin-inline-end: 0;
     font-weight: bold
 }
 
 h6 {
     display: block;
     font-size: .67em;
-    -webkit-margin-before: 2.33__qem;
-    -webkit-margin-after: 2.33em;
-    -webkit-margin-start: 0;
-    -webkit-margin-end: 0;
+    margin-block-start: 2.33__qem;
+    margin-block-end: 2.33em;
+    margin-inline-start: 0;
+    margin-inline-end: 0;
     font-weight: bold
 }
 
@@ -307,21 +307,21 @@
 ul, menu, dir {
     display: block;
     list-style-type: disc;
-    -webkit-margin-before: 1__qem;
-    -webkit-margin-after: 1em;
-    -webkit-margin-start: 0;
-    -webkit-margin-end: 0;
-    -webkit-padding-start: 40px
+    margin-block-start: 1__qem;
+    margin-block-end: 1em;
+    margin-inline-start: 0;
+    margin-inline-end: 0;
+    padding-inline-start: 40px
 }
 
 ol {
     display: block;
     list-style-type: decimal;
-    -webkit-margin-before: 1__qem;
-    -webkit-margin-after: 1em;
-    -webkit-margin-start: 0;
-    -webkit-margin-end: 0;
-    -webkit-padding-start: 40px
+    margin-block-start: 1__qem;
+    margin-block-end: 1em;
+    margin-inline-start: 0;
+    margin-inline-end: 0;
+    padding-inline-start: 40px
 }
 
 li {
@@ -339,15 +339,15 @@
 
 dd {
     display: block;
-    -webkit-margin-start: 40px
+    margin-inline-start: 40px
 }
 
 dl {
     display: block;
-    -webkit-margin-before: 1__qem;
-    -webkit-margin-after: 1em;
-    -webkit-margin-start: 0;
-    -webkit-margin-end: 0;
+    margin-block-start: 1__qem;
+    margin-block-end: 1em;
+    margin-inline-start: 0;
+    margin-inline-end: 0;
 }
 
 dt {
@@ -355,8 +355,8 @@
 }
 
 ol ul, ul ol, ul ul, ol ol {
-    -webkit-margin-before: 0;
-    -webkit-margin-after: 0
+    margin-block-start: 0;
+    margin-block-end: 0
 }
 
 /* form elements */
@@ -376,19 +376,19 @@
 
 legend {
     display: block;
-    -webkit-padding-start: 2px;
-    -webkit-padding-end: 2px;
+    padding-inline-start: 2px;
+    padding-inline-end: 2px;
     border: none
 }
 
 fieldset {
     display: block;
-    -webkit-margin-start: 2px;
-    -webkit-margin-end: 2px;
-    -webkit-padding-before: 0.35em;
-    -webkit-padding-start: 0.75em;
-    -webkit-padding-end: 0.75em;
-    -webkit-padding-after: 0.625em;
+    margin-inline-start: 2px;
+    margin-inline-end: 2px;
+    padding-block-start: 0.35em;
+    padding-inline-start: 0.75em;
+    padding-inline-end: 0.75em;
+    padding-block-end: 0.625em;
     border: 2px groove ThreeDFace;
     min-inline-size: min-content;
 }
@@ -448,7 +448,7 @@
     cursor: default;
     flex: none;
     -webkit-user-modify: read-only !important;
-    -webkit-margin-start: 2px;
+    margin-inline-start: 2px;
     opacity: 0;
     pointer-events: none;
 }
@@ -464,7 +464,7 @@
     cursor: default;
     flex: none;
     -webkit-user-modify: read-only !important;
-    -webkit-margin-start: 1px;
+    margin-inline-start: 1px;
     opacity: 0;
     pointer-events: none;
     user-select: none !important;
@@ -706,8 +706,8 @@
 }
 
 input[type="color" i][list]::-webkit-color-swatch-wrapper {
-    -webkit-padding-start: 8px;
-    -webkit-padding-end: 24px;
+    padding-inline-start: 8px;
+    padding-inline-end: 24px;
 }
 
 input[type="color" i][list]::-webkit-color-swatch {
@@ -826,8 +826,8 @@
 
 select:-internal-list-box hr {
     border-style: none;
-    -webkit-margin-before: 0.5em;
-    -webkit-margin-after: 0;
+    margin-block-start: 0.5em;
+    margin-block-end: 0;
 }
 
 output {
@@ -1081,7 +1081,7 @@
     display: inline-block;
     width: 0.66em;
     height: 0.66em;
-    -webkit-margin-end: 0.4em;
+    margin-inline-end: 0.4em;
 }
 
 template {
diff --git a/third_party/blink/renderer/core/css/parser/css_property_parser_helpers.h b/third_party/blink/renderer/core/css/parser/css_property_parser_helpers.h
index c8cc685..f80d769 100644
--- a/third_party/blink/renderer/core/css/parser/css_property_parser_helpers.h
+++ b/third_party/blink/renderer/core/css/parser/css_property_parser_helpers.h
@@ -14,8 +14,8 @@
 #include "third_party/blink/renderer/core/css/parser/css_parser_mode.h"
 #include "third_party/blink/renderer/core/css/parser/css_parser_token_range.h"
 #include "third_party/blink/renderer/core/frame/web_feature_forward.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"  // For ValueRange
 #include "third_party/blink/renderer/platform/heap/handle.h"
-#include "third_party/blink/renderer/platform/length.h"  // For ValueRange
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/css/properties/css_parsing_utils.cc b/third_party/blink/renderer/core/css/properties/css_parsing_utils.cc
index b686b57..9ca942d1 100644
--- a/third_party/blink/renderer/core/css/properties/css_parsing_utils.cc
+++ b/third_party/blink/renderer/core/css/properties/css_parsing_utils.cc
@@ -42,7 +42,7 @@
 #include "third_party/blink/renderer/core/svg/svg_parsing_error.h"
 #include "third_party/blink/renderer/core/svg/svg_path_utilities.h"
 #include "third_party/blink/renderer/platform/animation/timing_function.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 #include "third_party/blink/renderer/platform/wtf/text/string_builder.h"
 
diff --git a/third_party/blink/renderer/core/css/properties/longhands/animation_delay_custom.cc b/third_party/blink/renderer/core/css/properties/longhands/animation_delay_custom.cc
index 3bfcd9ac..8ea26bc 100644
--- a/third_party/blink/renderer/core/css/properties/longhands/animation_delay_custom.cc
+++ b/third_party/blink/renderer/core/css/properties/longhands/animation_delay_custom.cc
@@ -7,7 +7,7 @@
 #include "third_party/blink/renderer/core/css/parser/css_property_parser_helpers.h"
 #include "third_party/blink/renderer/core/css/properties/computed_style_utils.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 
 namespace blink {
 namespace CSSLonghand {
diff --git a/third_party/blink/renderer/core/css/properties/longhands/animation_duration_custom.cc b/third_party/blink/renderer/core/css/properties/longhands/animation_duration_custom.cc
index b4fba58..ef76690 100644
--- a/third_party/blink/renderer/core/css/properties/longhands/animation_duration_custom.cc
+++ b/third_party/blink/renderer/core/css/properties/longhands/animation_duration_custom.cc
@@ -7,7 +7,7 @@
 #include "third_party/blink/renderer/core/css/parser/css_property_parser_helpers.h"
 #include "third_party/blink/renderer/core/css/properties/computed_style_utils.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 
 namespace blink {
 namespace CSSLonghand {
diff --git a/third_party/blink/renderer/core/css/properties/longhands/flex_grow_custom.cc b/third_party/blink/renderer/core/css/properties/longhands/flex_grow_custom.cc
index 144a0ec1b..8fad1bb94 100644
--- a/third_party/blink/renderer/core/css/properties/longhands/flex_grow_custom.cc
+++ b/third_party/blink/renderer/core/css/properties/longhands/flex_grow_custom.cc
@@ -6,7 +6,7 @@
 
 #include "third_party/blink/renderer/core/css/parser/css_property_parser_helpers.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 
 namespace blink {
 namespace CSSLonghand {
diff --git a/third_party/blink/renderer/core/css/properties/longhands/flex_shrink_custom.cc b/third_party/blink/renderer/core/css/properties/longhands/flex_shrink_custom.cc
index f98dba4a..1b2a8ed 100644
--- a/third_party/blink/renderer/core/css/properties/longhands/flex_shrink_custom.cc
+++ b/third_party/blink/renderer/core/css/properties/longhands/flex_shrink_custom.cc
@@ -6,7 +6,7 @@
 
 #include "third_party/blink/renderer/core/css/parser/css_property_parser_helpers.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 
 namespace blink {
 namespace CSSLonghand {
diff --git a/third_party/blink/renderer/core/css/properties/longhands/offset_distance_custom.cc b/third_party/blink/renderer/core/css/properties/longhands/offset_distance_custom.cc
index a68f4e1..6fb19b5 100644
--- a/third_party/blink/renderer/core/css/properties/longhands/offset_distance_custom.cc
+++ b/third_party/blink/renderer/core/css/properties/longhands/offset_distance_custom.cc
@@ -7,7 +7,7 @@
 #include "third_party/blink/renderer/core/css/parser/css_parser_context.h"
 #include "third_party/blink/renderer/core/css/parser/css_property_parser_helpers.h"
 #include "third_party/blink/renderer/core/css/properties/computed_style_utils.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 
 namespace blink {
 namespace CSSLonghand {
diff --git a/third_party/blink/renderer/core/css/properties/longhands/transition_delay_custom.cc b/third_party/blink/renderer/core/css/properties/longhands/transition_delay_custom.cc
index 5fb5fc3..61cf162b 100644
--- a/third_party/blink/renderer/core/css/properties/longhands/transition_delay_custom.cc
+++ b/third_party/blink/renderer/core/css/properties/longhands/transition_delay_custom.cc
@@ -7,7 +7,7 @@
 #include "third_party/blink/renderer/core/css/parser/css_property_parser_helpers.h"
 #include "third_party/blink/renderer/core/css/properties/computed_style_utils.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 
 namespace blink {
 namespace CSSLonghand {
diff --git a/third_party/blink/renderer/core/css/properties/longhands/transition_duration_custom.cc b/third_party/blink/renderer/core/css/properties/longhands/transition_duration_custom.cc
index 4055c98..002b290 100644
--- a/third_party/blink/renderer/core/css/properties/longhands/transition_duration_custom.cc
+++ b/third_party/blink/renderer/core/css/properties/longhands/transition_duration_custom.cc
@@ -7,7 +7,7 @@
 #include "third_party/blink/renderer/core/css/parser/css_property_parser_helpers.h"
 #include "third_party/blink/renderer/core/css/properties/computed_style_utils.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 
 namespace blink {
 namespace CSSLonghand {
diff --git a/third_party/blink/renderer/core/css/properties/style_building_utils.h b/third_party/blink/renderer/core/css/properties/style_building_utils.h
index 1fba8a59..744eef1f 100644
--- a/third_party/blink/renderer/core/css/properties/style_building_utils.h
+++ b/third_party/blink/renderer/core/css/properties/style_building_utils.h
@@ -7,8 +7,8 @@
 
 #include "third_party/blink/renderer/core/style/border_image_length.h"
 #include "third_party/blink/renderer/core/style/border_image_length_box.h"
-#include "third_party/blink/renderer/platform/length.h"
-#include "third_party/blink/renderer/platform/length_box.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
+#include "third_party/blink/renderer/platform/geometry/length_box.h"
 
 namespace blink {
 namespace StyleBuildingUtils {
diff --git a/third_party/blink/renderer/core/css/resolver/element_style_resources.cc b/third_party/blink/renderer/core/css/resolver/element_style_resources.cc
index c1ea3013..6923834 100644
--- a/third_party/blink/renderer/core/css/resolver/element_style_resources.cc
+++ b/third_party/blink/renderer/core/css/resolver/element_style_resources.cc
@@ -44,7 +44,7 @@
 #include "third_party/blink/renderer/core/style/style_pending_image.h"
 #include "third_party/blink/renderer/core/svg/svg_resource.h"
 #include "third_party/blink/renderer/core/svg/svg_tree_scope_resources.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/loader/fetch/fetch_parameters.h"
 #include "third_party/blink/renderer/platform/loader/fetch/resource_fetcher.h"
 
diff --git a/third_party/blink/renderer/core/css/resolver/style_adjuster.cc b/third_party/blink/renderer/core/css/resolver/style_adjuster.cc
index 530c91882c..e415942 100644
--- a/third_party/blink/renderer/core/css/resolver/style_adjuster.cc
+++ b/third_party/blink/renderer/core/css/resolver/style_adjuster.cc
@@ -56,7 +56,7 @@
 #include "third_party/blink/renderer/core/style/computed_style_constants.h"
 #include "third_party/blink/renderer/core/svg/svg_svg_element.h"
 #include "third_party/blink/renderer/core/svg_names.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 #include "third_party/blink/renderer/platform/transforms/transform_operations.h"
 #include "third_party/blink/renderer/platform/wtf/assertions.h"
diff --git a/third_party/blink/renderer/core/css/resolver/style_builder_converter.h b/third_party/blink/renderer/core/css/resolver/style_builder_converter.h
index 90e6340..5e15ea4 100644
--- a/third_party/blink/renderer/core/css/resolver/style_builder_converter.h
+++ b/third_party/blink/renderer/core/css/resolver/style_builder_converter.h
@@ -45,8 +45,8 @@
 #include "third_party/blink/renderer/core/style/svg_computed_style_defs.h"
 #include "third_party/blink/renderer/core/style/transform_origin.h"
 #include "third_party/blink/renderer/platform/fonts/font_description.h"
+#include "third_party/blink/renderer/platform/geometry/length_size.h"
 #include "third_party/blink/renderer/platform/graphics/image_orientation.h"
-#include "third_party/blink/renderer/platform/length_size.h"
 #include "third_party/blink/renderer/platform/text/tab_size.h"
 #include "third_party/blink/renderer/platform/transforms/rotation.h"
 #include "third_party/blink/renderer/platform/wtf/allocator.h"
diff --git a/third_party/blink/renderer/core/css/resolver/viewport_style_resolver.h b/third_party/blink/renderer/core/css/resolver/viewport_style_resolver.h
index 541f3b6a..88ad5c4 100644
--- a/third_party/blink/renderer/core/css/resolver/viewport_style_resolver.h
+++ b/third_party/blink/renderer/core/css/resolver/viewport_style_resolver.h
@@ -34,7 +34,7 @@
 #include "third_party/blink/renderer/core/css/rule_set.h"
 #include "third_party/blink/renderer/core/css_property_names.h"
 #include "third_party/blink/renderer/core/page/viewport_description.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/css/themeInputMultipleFields.css b/third_party/blink/renderer/core/css/themeInputMultipleFields.css
index e0ff0efb..db849b0 100644
--- a/third_party/blink/renderer/core/css/themeInputMultipleFields.css
+++ b/third_party/blink/renderer/core/css/themeInputMultipleFields.css
@@ -13,7 +13,7 @@
     font-family: monospace;
     overflow: hidden;
     padding: 0;
-    -webkit-padding-start: 1px;
+    padding-inline-start: 1px;
     cursor: default;
 }
 
@@ -93,5 +93,5 @@
 input[type="week" i]::-webkit-inner-spin-button {
     /* FIXME: Remove height. */
     height: 1.5em;
-    -webkit-margin-start: 2px;
+    margin-inline-start: 2px;
 }
diff --git a/third_party/blink/renderer/core/css/threaded/css_to_length_conversion_data_threaded_test.cc b/third_party/blink/renderer/core/css/threaded/css_to_length_conversion_data_threaded_test.cc
index 916e7e79..afa544e 100644
--- a/third_party/blink/renderer/core/css/threaded/css_to_length_conversion_data_threaded_test.cc
+++ b/third_party/blink/renderer/core/css/threaded/css_to_length_conversion_data_threaded_test.cc
@@ -8,7 +8,7 @@
 #include "third_party/blink/renderer/core/css/threaded/multi_threaded_test_util.h"
 #include "third_party/blink/renderer/platform/fonts/font.h"
 #include "third_party/blink/renderer/platform/fonts/font_description.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/dom/document.cc b/third_party/blink/renderer/core/dom/document.cc
index fc6b7382..7133530 100644
--- a/third_party/blink/renderer/core/dom/document.cc
+++ b/third_party/blink/renderer/core/dom/document.cc
@@ -265,11 +265,11 @@
 #include "third_party/blink/renderer/platform/bindings/v8_per_isolate_data.h"
 #include "third_party/blink/renderer/platform/cross_thread_functional.h"
 #include "third_party/blink/renderer/platform/date_components.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/histogram.h"
 #include "third_party/blink/renderer/platform/instance_counters.h"
 #include "third_party/blink/renderer/platform/instrumentation/tracing/trace_event.h"
 #include "third_party/blink/renderer/platform/language.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
 #include "third_party/blink/renderer/platform/loader/fetch/resource_fetcher.h"
 #include "third_party/blink/renderer/platform/network/content_security_policy_parsers.h"
 #include "third_party/blink/renderer/platform/network/http_parsers.h"
diff --git a/third_party/blink/renderer/core/editing/compute_layer_selection_test.cc b/third_party/blink/renderer/core/editing/compute_layer_selection_test.cc
index 59bc1a1f..e2ede351 100644
--- a/third_party/blink/renderer/core/editing/compute_layer_selection_test.cc
+++ b/third_party/blink/renderer/core/editing/compute_layer_selection_test.cc
@@ -22,6 +22,8 @@
  public:
   void SetUp() override {
     EditingTestBase::SetUp();
+    // This Page is not actually being shown by a compositor, but we act like it
+    // will in order to test behaviour.
     GetPage().GetSettings().SetAcceleratedCompositingEnabled(true);
     GetDocument().View()->SetParentVisible(true);
     GetDocument().View()->SetSelfVisible(true);
diff --git a/third_party/blink/renderer/core/exported/local_frame_client_impl_test.cc b/third_party/blink/renderer/core/exported/local_frame_client_impl_test.cc
index a7f5fdf..9d34742 100644
--- a/third_party/blink/renderer/core/exported/local_frame_client_impl_test.cc
+++ b/third_party/blink/renderer/core/exported/local_frame_client_impl_test.cc
@@ -63,10 +63,6 @@
         .WillByDefault(Return(WebString()));
 
     helper_.Initialize(&web_frame_client_);
-    // FIXME: http://crbug.com/363843. This needs to find a better way to
-    // not create graphics layers.
-    helper_.GetWebView()->GetSettings()->SetAcceleratedCompositingEnabled(
-        false);
   }
 
   void TearDown() override {
diff --git a/third_party/blink/renderer/core/exported/web_page_popup_impl.cc b/third_party/blink/renderer/core/exported/web_page_popup_impl.cc
index 8bd506f..dc9b98aa 100644
--- a/third_party/blink/renderer/core/exported/web_page_popup_impl.cc
+++ b/third_party/blink/renderer/core/exported/web_page_popup_impl.cc
@@ -280,6 +280,7 @@
 
   Settings& main_settings = web_view_->GetPage()->GetSettings();
   page_ = Page::Create(page_clients);
+  page_->GetSettings().SetAcceleratedCompositingEnabled(true);
   page_->GetSettings().SetScriptEnabled(true);
   page_->GetSettings().SetAllowScriptsToCloseWindows(true);
   page_->GetSettings().SetDeviceSupportsTouch(
diff --git a/third_party/blink/renderer/core/exported/web_settings_impl.cc b/third_party/blink/renderer/core/exported/web_settings_impl.cc
index 95ddf71..696ba4e 100644
--- a/third_party/blink/renderer/core/exported/web_settings_impl.cc
+++ b/third_party/blink/renderer/core/exported/web_settings_impl.cc
@@ -473,10 +473,6 @@
   settings_->SetEditingBehaviorType(static_cast<EditingBehaviorType>(behavior));
 }
 
-void WebSettingsImpl::SetAcceleratedCompositingEnabled(bool enabled) {
-  settings_->SetAcceleratedCompositingEnabled(enabled);
-}
-
 void WebSettingsImpl::SetMockScrollbarsEnabled(bool enabled) {
   settings_->SetMockScrollbarsEnabled(enabled);
 }
diff --git a/third_party/blink/renderer/core/exported/web_settings_impl.h b/third_party/blink/renderer/core/exported/web_settings_impl.h
index 36c9adb..9f7b10cf 100644
--- a/third_party/blink/renderer/core/exported/web_settings_impl.h
+++ b/third_party/blink/renderer/core/exported/web_settings_impl.h
@@ -51,7 +51,6 @@
   bool ShrinksViewportContentToFit() const override;
   bool ViewportEnabled() const override;
   void SetAccelerated2dCanvasMSAASampleCount(int) override;
-  void SetAcceleratedCompositingEnabled(bool) override;
   void SetAutoplayPolicy(AutoplayPolicy) override;
   void SetPreferCompositingToLCDTextEnabled(bool) override;
   void SetAccessibilityPasswordValuesEnabled(bool) override;
diff --git a/third_party/blink/renderer/core/exported/web_view_impl.cc b/third_party/blink/renderer/core/exported/web_view_impl.cc
index 7e12b958..66d29211 100644
--- a/third_party/blink/renderer/core/exported/web_view_impl.cc
+++ b/third_party/blink/renderer/core/exported/web_view_impl.cc
@@ -343,16 +343,22 @@
   CoreInitializer::GetInstance().ProvideModulesToPage(*page_, client_);
   SetVisibilityState(visibility_state, true);
 
+  // WebViews, and WebWidgets, are used to host a Page and present it via a
+  // WebLayerTreeView compositor. The WidgetClient() provides compositing
+  // support for the WebView.
+  // In some cases, a WidgetClient() is not provided, or it informs us that
+  // it won't be presenting content via a compositor. In that case we keep the
+  // Page in the loop so that it will paint all content into the root layer
+  // as multiple layers can only be used when compositing them together later.
+  //
   // TODO(dcheng): All WebViewImpls should have an associated LayerTreeView,
   // but for various reasons, that's not the case... WebView plugin, printing,
   // workers, and tests don't use a compositor in their WebViews. Sometimes
   // they avoid the compositor by using a null client, and sometimes by having
   // the client return a null compositor. We should make things more consistent
   // and clear.
-  // For some reason this was not set when WidgetClient() is not provided,
-  // even though there will be no LayerTreeView in that case either.
-  if (WidgetClient() && WidgetClient()->AllowsBrokenNullLayerTreeView())
-    page_->GetSettings().SetAcceleratedCompositingEnabled(false);
+  if (WidgetClient() && !WidgetClient()->AllowsBrokenNullLayerTreeView())
+    page_->GetSettings().SetAcceleratedCompositingEnabled(true);
 
   dev_tools_emulator_ = DevToolsEmulator::Create(this);
 
diff --git a/third_party/blink/renderer/core/exported/worker_shadow_page.cc b/third_party/blink/renderer/core/exported/worker_shadow_page.cc
index b5af600..36969e78 100644
--- a/third_party/blink/renderer/core/exported/worker_shadow_page.cc
+++ b/third_party/blink/renderer/core/exported/worker_shadow_page.cc
@@ -41,9 +41,6 @@
       preferences_(std::move(preferences)) {
   DCHECK(IsMainThread());
 
-  // TODO(http://crbug.com/363843): This needs to find a better way to
-  // not create graphics layers.
-  web_view_->GetSettings()->SetAcceleratedCompositingEnabled(false);
   // TODO(lunalu): Service worker and shared worker count feature usage on the
   // blink side use counter. Once the blink side use counter is removed
   // (crbug.com/811948), remove this instant from Settings.
diff --git a/third_party/blink/renderer/core/frame/ad_tracker.cc b/third_party/blink/renderer/core/frame/ad_tracker.cc
index 89f672f..76191a5 100644
--- a/third_party/blink/renderer/core/frame/ad_tracker.cc
+++ b/third_party/blink/renderer/core/frame/ad_tracker.cc
@@ -66,12 +66,11 @@
   bool is_ad = script_url.IsEmpty()
                    ? false
                    : IsKnownAdScript(execution_context, script_url);
-  ExecutingScript script(script_url, is_ad);
-  executing_scripts_.push_back(script);
+  stack_frame_is_ad_.push_back(is_ad);
 }
 
 void AdTracker::DidExecuteScript() {
-  executing_scripts_.pop_back();
+  stack_frame_is_ad_.pop_back();
 }
 
 void AdTracker::Will(const probe::ExecuteScript& probe) {
@@ -140,8 +139,8 @@
     return true;
 
   // Scan the pseudo-stack for ad scripts.
-  for (const auto& executing_script : executing_scripts_) {
-    if (executing_script.is_ad)
+  for (bool is_ad : stack_frame_is_ad_) {
+    if (is_ad)
       return true;
   }
   return false;
@@ -153,7 +152,7 @@
     return false;
 
   // TODO(jkarlin): Minor memory optimization, stop tracking known ad scripts in
-  // ad contexts. This will reduce the size of executing_scripts_. Note that
+  // ad contexts. This will reduce the size of known_ad_scripts_. Note that
   // this is a minor win, as the strings are already ref-counted.
   if (IsKnownAdExecutionContext(execution_context))
     return true;
diff --git a/third_party/blink/renderer/core/frame/ad_tracker.h b/third_party/blink/renderer/core/frame/ad_tracker.h
index 287ac14..92bb465 100644
--- a/third_party/blink/renderer/core/frame/ad_tracker.h
+++ b/third_party/blink/renderer/core/frame/ad_tracker.h
@@ -81,18 +81,10 @@
 
   Member<LocalFrame> local_root_;
 
-  // Since the script URLs should be external strings in v8 (allocated in Blink)
-  // getting it as String should end up with the same StringImpl. Thus storing a
-  // vector of Strings here should not be expensive.
-  // TODO(jkarlin): We don't need this struct. A Vector<bool> would suffice.
-  struct ExecutingScript {
-    String url;
-    bool is_ad;
-    ExecutingScript(String script_url, bool is_ad_script)
-        : url(script_url), is_ad(is_ad_script) {}
-  };
+  // Each time v8 is started to run a script or function, this records if it was
+  // an ad script. Each time the script or function finishes, it pops the stack.
+  Vector<bool> stack_frame_is_ad_;
 
-  Vector<ExecutingScript> executing_scripts_;
   HeapHashMap<WeakMember<ExecutionContext>, HashSet<String>> known_ad_scripts_;
 
   DISALLOW_COPY_AND_ASSIGN(AdTracker);
diff --git a/third_party/blink/renderer/core/frame/ad_tracker_test.cc b/third_party/blink/renderer/core/frame/ad_tracker_test.cc
index c253444f..0bf2d21 100644
--- a/third_party/blink/renderer/core/frame/ad_tracker_test.cc
+++ b/third_party/blink/renderer/core/frame/ad_tracker_test.cc
@@ -421,15 +421,9 @@
   std::unique_ptr<SimRequest> main_resource_;
 };
 
-TEST_F(AdTrackerDisabledSimTest, ResourceLoadedWhenAdTaggingDisabled) {
-  SimRequest iframe_resource("https://example.com/iframe.html", "text/html");
-
-  main_resource_->Complete(R"HTML(
-    <iframe src=https://example.com/iframe.html></iframe>
-    )HTML");
-
-  iframe_resource.Complete("<body></body>");
-
+TEST_F(AdTrackerDisabledSimTest, VerifyAdTrackingDisabled) {
+  main_resource_->Complete("<body></body>");
+  EXPECT_FALSE(GetDocument().GetFrame()->GetAdTracker());
   EXPECT_FALSE(GetDocument().GetFrame()->IsAdSubframe());
 }
 
diff --git a/third_party/blink/renderer/core/frame/browser_controls_test.cc b/third_party/blink/renderer/core/frame/browser_controls_test.cc
index 6656970..1019a97f 100644
--- a/third_party/blink/renderer/core/frame/browser_controls_test.cc
+++ b/third_party/blink/renderer/core/frame/browser_controls_test.cc
@@ -156,7 +156,6 @@
 
     // Use settings that resemble the Android configuration.
     WebView().GetSettings()->SetViewportEnabled(true);
-    WebView().GetSettings()->SetAcceleratedCompositingEnabled(true);
     WebView().GetSettings()->SetPreferCompositingToLCDTextEnabled(true);
     WebView().GetSettings()->SetViewportMetaEnabled(true);
     WebView().GetSettings()->SetViewportEnabled(true);
diff --git a/third_party/blink/renderer/core/frame/local_frame_ukm_aggregator.cc b/third_party/blink/renderer/core/frame/local_frame_ukm_aggregator.cc
index 388b5db..99c33487 100644
--- a/third_party/blink/renderer/core/frame/local_frame_ukm_aggregator.cc
+++ b/third_party/blink/renderer/core/frame/local_frame_ukm_aggregator.cc
@@ -166,7 +166,15 @@
   primary_metric_.total_duration += duration;
   ++primary_metric_.sample_count;
 
-  // Compute all the dependent metrics
+  // Compute all the dependent metrics, after finding which bucket we're in
+  // for UMA data.
+  size_t bucket_index = bucket_thresholds().size();
+  for (size_t i = 0; i < bucket_index; ++i) {
+    if (duration < bucket_thresholds()[i]) {
+      bucket_index = i;
+    }
+  }
+
   for (auto& record : ratio_metric_records_) {
     double ratio =
         record.interval_duration.InMicrosecondsF() / duration.InMicrosecondsF();
@@ -174,6 +182,7 @@
       record.worst_case_ratio = ratio;
     record.total_ratio += ratio;
     ++record.sample_count;
+    record.uma_counters_per_bucket[bucket_index]->Count(floor(ratio * 100.0));
     record.interval_duration = TimeDelta();
   }
 
@@ -194,11 +203,9 @@
   ukm::UkmEntryBuilder builder(source_id_, event_name_.Utf8().data());
   builder.SetMetric(primary_metric_.worst_case_metric_name.Utf8().data(),
                     primary_metric_.worst_case_duration.InMicroseconds());
-  double average_frame_duration =
-      primary_metric_.total_duration.InMicroseconds() /
-      static_cast<int64_t>(primary_metric_.sample_count);
   builder.SetMetric(primary_metric_.average_metric_name.Utf8().data(),
-                    average_frame_duration);
+                    primary_metric_.total_duration.InMicroseconds() /
+                        static_cast<int64_t>(primary_metric_.sample_count));
   for (auto& record : absolute_metric_records_) {
     if (record.sample_count == 0)
       continue;
@@ -208,29 +215,15 @@
                       record.total_duration.InMicroseconds() /
                           static_cast<int64_t>(record.sample_count));
   }
-
   for (auto& record : ratio_metric_records_) {
     if (record.sample_count == 0)
       continue;
     builder.SetMetric(record.worst_case_metric_name.Utf8().data(),
                       record.worst_case_ratio);
-    double average_ratio =
-        record.total_ratio / static_cast<float>(record.sample_count);
-    builder.SetMetric(record.average_metric_name.Utf8().data(), average_ratio);
+    builder.SetMetric(
+        record.average_metric_name.Utf8().data(),
+        record.total_ratio / static_cast<float>(record.sample_count));
     record.reset();
-
-    // Send ratio UMA data only when flushed to reduce overhead from metrics.
-    // Find which bucket we're in for UMA data. We need to do this separately
-    // for each metric because not every metric records on every frame.
-    size_t bucket_index = bucket_thresholds().size();
-    for (size_t i = 0; i < bucket_index; ++i) {
-      if (average_frame_duration < bucket_thresholds()[i].InMicroseconds()) {
-        bucket_index = i;
-      }
-    }
-
-    record.uma_counters_per_bucket[bucket_index]->Count(
-        floor(average_ratio * 100.0));
   }
   builder.Record(recorder_);
   has_data_ = false;
diff --git a/third_party/blink/renderer/core/frame/local_frame_ukm_aggregator.h b/third_party/blink/renderer/core/frame/local_frame_ukm_aggregator.h
index 9f532bcc..df035c1e 100644
--- a/third_party/blink/renderer/core/frame/local_frame_ukm_aggregator.h
+++ b/third_party/blink/renderer/core/frame/local_frame_ukm_aggregator.h
@@ -16,7 +16,7 @@
 namespace blink {
 class CustomCountHistogram;
 
-// This class aggregates and records time based UKM and UMA metrics
+// This class aggregaties and records time based UKM and UMA metrics
 // for LocalFrameView. The simplest way to use it is via the
 // SCOPED_UMA_AND_UKM_HIERARCHICAL_TIMER macro in LocalFrameView combined
 // with LocalFrameView::RecordEndOfFrameMetrics.
@@ -42,14 +42,12 @@
 //
 // When the primary timed execution completes, this aggregator stores the
 // primary time and computes metrics that depend on it. The results are
-// aggregated. A UKM event is
+// aggregated.  UMA metrics are updated at this time. A UKM event is
 // generated in one of two situations:
 //  - If a sample is added that lies in the next event frequency interval (this
 //    will generate an event for the previous interval)
 //  - If the aggregator is destroyed (this will generate an event for any
 //    remaining samples in the aggregator)
-// UMA ratio-related metrics are only reported when an event is generated to
-// reduce the overhead of metric gathering.
 //
 // Note that no event is generated if there were no primary samples in an
 // interval.
diff --git a/third_party/blink/renderer/core/frame/page_scale_constraints_set.cc b/third_party/blink/renderer/core/frame/page_scale_constraints_set.cc
index d483fca..9911e24 100644
--- a/third_party/blink/renderer/core/frame/page_scale_constraints_set.cc
+++ b/third_party/blink/renderer/core/frame/page_scale_constraints_set.cc
@@ -33,7 +33,7 @@
 #include <algorithm>
 #include "third_party/blink/renderer/core/frame/settings.h"
 #include "third_party/blink/renderer/core/page/page.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/wtf/assertions.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/frame/page_scale_constraints_set.h b/third_party/blink/renderer/core/frame/page_scale_constraints_set.h
index 57c85d2b..3571f7b 100644
--- a/third_party/blink/renderer/core/frame/page_scale_constraints_set.h
+++ b/third_party/blink/renderer/core/frame/page_scale_constraints_set.h
@@ -38,8 +38,8 @@
 #include "third_party/blink/renderer/core/frame/page_scale_constraints.h"
 #include "third_party/blink/renderer/core/page/viewport_description.h"
 #include "third_party/blink/renderer/platform/geometry/int_size.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
-#include "third_party/blink/renderer/platform/length.h"
 #include "third_party/blink/renderer/platform/wtf/allocator.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/frame/settings.json5 b/third_party/blink/renderer/core/frame/settings.json5
index db9341b93..c3441c2 100644
--- a/third_party/blink/renderer/core/frame/settings.json5
+++ b/third_party/blink/renderer/core/frame/settings.json5
@@ -146,7 +146,7 @@
     },
     {
       name: "acceleratedCompositingEnabled",
-      initial: true,
+      initial: false,
       invalidate: "AcceleratedCompositing",
     },
 
diff --git a/third_party/blink/renderer/core/frame/visual_viewport_test.cc b/third_party/blink/renderer/core/frame/visual_viewport_test.cc
index e41d44d5b..c877005 100644
--- a/third_party/blink/renderer/core/frame/visual_viewport_test.cc
+++ b/third_party/blink/renderer/core/frame/visual_viewport_test.cc
@@ -70,8 +70,7 @@
 
 namespace {
 
-void configureAndroidCompositing(WebSettings* settings) {
-  settings->SetAcceleratedCompositingEnabled(true);
+void ConfigureAndroidCompositing(WebSettings* settings) {
   settings->SetPreferCompositingToLCDTextEnabled(true);
   settings->SetViewportMetaEnabled(true);
   settings->SetViewportEnabled(true);
@@ -1687,7 +1686,7 @@
 TEST_P(VisualViewportTest, visualViewportIsInert) {
   FrameTestHelpers::WebViewHelper web_view_helper;
   WebViewImpl* web_view_impl = web_view_helper.Initialize(
-      nullptr, nullptr, nullptr, &configureAndroidCompositing);
+      nullptr, nullptr, nullptr, &ConfigureAndroidCompositing);
 
   web_view_impl->Resize(IntSize(200, 300));
 
@@ -2042,7 +2041,7 @@
 
   FrameTestHelpers::WebViewHelper web_view_helper;
   WebViewImpl* web_view_impl = web_view_helper.Initialize(
-      nullptr, nullptr, nullptr, &configureAndroidCompositing);
+      nullptr, nullptr, nullptr, &ConfigureAndroidCompositing);
 
   int page_width = 640;
   int page_height = 480;
@@ -2101,8 +2100,7 @@
   EXPECT_EQ(page_height, backgroundLayer->Size().height());
 }
 
-static void configureAndroidNonCompositing(WebSettings* settings) {
-  settings->SetAcceleratedCompositingEnabled(true);
+static void ConfigureAndroidNonCompositing(WebSettings* settings) {
   settings->SetPreferCompositingToLCDTextEnabled(false);
   settings->SetViewportMetaEnabled(true);
   settings->SetViewportEnabled(true);
@@ -2118,7 +2116,7 @@
 
   FrameTestHelpers::WebViewHelper web_view_helper;
   WebViewImpl* web_view_impl = web_view_helper.Initialize(
-      nullptr, nullptr, nullptr, &configureAndroidNonCompositing);
+      nullptr, nullptr, nullptr, &ConfigureAndroidNonCompositing);
 
   int page_width = 640;
   int page_height = 480;
@@ -2200,7 +2198,7 @@
 TEST_P(VisualViewportTest, ResizeNonFixedBackgroundNoLayoutOrInvalidation) {
   FrameTestHelpers::WebViewHelper web_view_helper;
   WebViewImpl* web_view_impl = web_view_helper.Initialize(
-      nullptr, nullptr, nullptr, &configureAndroidCompositing);
+      nullptr, nullptr, nullptr, &ConfigureAndroidCompositing);
 
   int page_width = 640;
   int page_height = 480;
@@ -2270,7 +2268,7 @@
 TEST_P(VisualViewportTest, InvalidateLayoutViewWhenDocumentSmallerThanView) {
   FrameTestHelpers::WebViewHelper web_view_helper;
   WebViewImpl* web_view_impl = web_view_helper.Initialize(
-      nullptr, nullptr, nullptr, &configureAndroidCompositing);
+      nullptr, nullptr, nullptr, &ConfigureAndroidCompositing);
 
   int page_width = 320;
   int page_height = 590;
@@ -2401,7 +2399,6 @@
 
     // Use settings that resemble the Android configuration.
     WebView().GetSettings()->SetViewportEnabled(true);
-    WebView().GetSettings()->SetAcceleratedCompositingEnabled(true);
     WebView().GetSettings()->SetPreferCompositingToLCDTextEnabled(true);
     WebView().GetSettings()->SetViewportMetaEnabled(true);
     WebView().GetSettings()->SetViewportEnabled(true);
diff --git a/third_party/blink/renderer/core/html/forms/resources/calendarPicker.css b/third_party/blink/renderer/core/html/forms/resources/calendarPicker.css
index e5cbb72..f05e3a9 100644
--- a/third_party/blink/renderer/core/html/forms/resources/calendarPicker.css
+++ b/third_party/blink/renderer/core/html/forms/resources/calendarPicker.css
@@ -209,7 +209,7 @@
     min-width: 0 !important;
     padding-left: 0 !important;
     padding-right: 0 !important;
-    -webkit-margin-start: 4px !important;
+    margin-inline-start: 4px !important;
 }
 
 .year-list-view {
@@ -228,7 +228,7 @@
 .year-list-cell .label {
     height: 24px;
     line-height: 24px;
-    -webkit-padding-start: 8px;
+    padding-inline-start: 8px;
     background-color: #f5f5f5;
     border-bottom: 1px solid #bfbfbf;
 }
diff --git a/third_party/blink/renderer/core/html/forms/resources/listPicker.css b/third_party/blink/renderer/core/html/forms/resources/listPicker.css
index 5cce9ac3..d190f9d 100644
--- a/third_party/blink/renderer/core/html/forms/resources/listPicker.css
+++ b/third_party/blink/renderer/core/html/forms/resources/listPicker.css
@@ -10,7 +10,7 @@
 }
 
 option, optgroup {
-    -webkit-padding-end: 2px;
+    padding-inline-end: 2px;
 }
 
 .wrap option {
diff --git a/third_party/blink/renderer/core/html/forms/resources/listPicker.js b/third_party/blink/renderer/core/html/forms/resources/listPicker.js
index 6ed61189..2ed7603e 100644
--- a/third_party/blink/renderer/core/html/forms/resources/listPicker.js
+++ b/third_party/blink/renderer/core/html/forms/resources/listPicker.js
@@ -426,11 +426,11 @@
     if (config.ariaLabel)
     element.setAttribute('aria-label', config.ariaLabel);
     else element.removeAttribute('aria-label');
-    element.style.webkitPaddingStart = this._config.paddingStart + 'px';
+    element.style.paddingInlineStart = this._config.paddingStart + 'px';
     if (inGroup) {
-      element.style.webkitMarginStart = (-this._config.paddingStart) + 'px';
+      element.style.marginInlineStart = (-this._config.paddingStart) + 'px';
       // Should be synchronized with padding-end in listPicker.css.
-      element.style.webkitMarginEnd = '-2px';
+      element.style.marginInlineEnd = '-2px';
     }
   } else if (config.type === 'optgroup') {
     element.label = config.label;
@@ -438,15 +438,15 @@
     element.disabled = config.disabled;
     element.setAttribute('aria-label', config.ariaLabel);
     this._updateChildren(element, config);
-    element.style.webkitPaddingStart = this._config.paddingStart + 'px';
+    element.style.paddingInlineStart = this._config.paddingStart + 'px';
   } else if (config.type === 'separator') {
     element.title = config.title;
     element.disabled = config.disabled;
     element.setAttribute('aria-label', config.ariaLabel);
     if (inGroup) {
-      element.style.webkitMarginStart = (-this._config.paddingStart) + 'px';
+      element.style.marginInlineStart = (-this._config.paddingStart) + 'px';
       // Should be synchronized with padding-end in listPicker.css.
-      element.style.webkitMarginEnd = '-2px';
+      element.style.marginInlineEnd = '-2px';
     }
   }
   this._applyItemStyle(element, config.style);
diff --git a/third_party/blink/renderer/core/html/forms/resources/pickerButton.css b/third_party/blink/renderer/core/html/forms/resources/pickerButton.css
index c0c6ff1..396d278 100644
--- a/third_party/blink/renderer/core/html/forms/resources/pickerButton.css
+++ b/third_party/blink/renderer/core/html/forms/resources/pickerButton.css
@@ -37,8 +37,8 @@
     text-shadow: 0 1px 0 rgb(240, 240, 240);
     min-height: 2em;
     min-width: 4em;
-    -webkit-padding-end: 10px;
-    -webkit-padding-start: 10px;
+    padding-inline-end: 10px;
+    padding-inline-start: 10px;
     margin: 0;
 }
 
diff --git a/third_party/blink/renderer/core/html/forms/resources/validation_bubble.css b/third_party/blink/renderer/core/html/forms/resources/validation_bubble.css
index a8e2df9..2e99f77 100644
--- a/third_party/blink/renderer/core/html/forms/resources/validation_bubble.css
+++ b/third_party/blink/renderer/core/html/forms/resources/validation_bubble.css
@@ -124,7 +124,7 @@
 #icon {
   grid-row: 1 / 3;
   grid-column: 1;
-  -webkit-margin-end: 8px;
+  margin-inline-end: 8px;
 }
 
 #main-message {
diff --git a/third_party/blink/renderer/core/html/lazy_load_frame_observer.cc b/third_party/blink/renderer/core/html/lazy_load_frame_observer.cc
index 4da61acd..225b335 100644
--- a/third_party/blink/renderer/core/html/lazy_load_frame_observer.cc
+++ b/third_party/blink/renderer/core/html/lazy_load_frame_observer.cc
@@ -21,8 +21,8 @@
 #include "third_party/blink/renderer/core/loader/frame_load_request.h"
 #include "third_party/blink/renderer/core/loader/frame_loader.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/heap/visitor.h"
-#include "third_party/blink/renderer/platform/length.h"
 #include "third_party/blink/renderer/platform/loader/fetch/resource_request.h"
 #include "third_party/blink/renderer/platform/weborigin/security_origin.h"
 #include "third_party/blink/renderer/platform/wtf/assertions.h"
diff --git a/third_party/blink/renderer/core/inspector/inspector_overlay_agent.cc b/third_party/blink/renderer/core/inspector/inspector_overlay_agent.cc
index 8d3f2a1b..48f7bb9 100644
--- a/third_party/blink/renderer/core/inspector/inspector_overlay_agent.cc
+++ b/third_party/blink/renderer/core/inspector/inspector_overlay_agent.cc
@@ -796,10 +796,6 @@
   overlay_settings.SetScriptEnabled(true);
   overlay_settings.SetPluginsEnabled(false);
   overlay_settings.SetLoadsImagesAutomatically(true);
-  // FIXME: http://crbug.com/363843. Inspector should probably create its
-  // own graphics layers and attach them to the tree rather than going
-  // through some non-composited paint function.
-  overlay_settings.SetAcceleratedCompositingEnabled(false);
 
   LocalFrame* frame =
       LocalFrame::Create(dummy_local_frame_client, *overlay_page_, nullptr);
diff --git a/third_party/blink/renderer/core/intersection_observer/intersection_observer.h b/third_party/blink/renderer/core/intersection_observer/intersection_observer.h
index 877510a..18a63c7 100644
--- a/third_party/blink/renderer/core/intersection_observer/intersection_observer.h
+++ b/third_party/blink/renderer/core/intersection_observer/intersection_observer.h
@@ -13,8 +13,8 @@
 #include "third_party/blink/renderer/platform/bindings/exception_state.h"
 #include "third_party/blink/renderer/platform/bindings/script_wrappable.h"
 #include "third_party/blink/renderer/platform/bindings/trace_wrapper_member.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
-#include "third_party/blink/renderer/platform/length.h"
 #include "third_party/blink/renderer/platform/wtf/hash_set.h"
 #include "third_party/blink/renderer/platform/wtf/vector.h"
 
diff --git a/third_party/blink/renderer/core/layout/grid_track_sizing_algorithm.cc b/third_party/blink/renderer/core/layout/grid_track_sizing_algorithm.cc
index 2b74ea7..6b0bb5c 100644
--- a/third_party/blink/renderer/core/layout/grid_track_sizing_algorithm.cc
+++ b/third_party/blink/renderer/core/layout/grid_track_sizing_algorithm.cc
@@ -8,7 +8,7 @@
 #include "third_party/blink/renderer/core/layout/grid.h"
 #include "third_party/blink/renderer/core/layout/grid_layout_utils.h"
 #include "third_party/blink/renderer/core/layout/layout_grid.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/layout/intersection_geometry.h b/third_party/blink/renderer/core/layout/intersection_geometry.h
index f08cfdb..3a625f9 100644
--- a/third_party/blink/renderer/core/layout/intersection_geometry.h
+++ b/third_party/blink/renderer/core/layout/intersection_geometry.h
@@ -6,8 +6,8 @@
 #define THIRD_PARTY_BLINK_RENDERER_CORE_LAYOUT_INTERSECTION_GEOMETRY_H_
 
 #include "third_party/blink/renderer/platform/geometry/layout_rect.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
-#include "third_party/blink/renderer/platform/length.h"
 #include "third_party/blink/renderer/platform/wtf/vector.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/layout/layout_box.cc b/third_party/blink/renderer/core/layout/layout_box.cc
index 6ac0179..3b6f6657 100644
--- a/third_party/blink/renderer/core/layout/layout_box.cc
+++ b/third_party/blink/renderer/core/layout/layout_box.cc
@@ -77,7 +77,7 @@
 #include "third_party/blink/renderer/platform/geometry/double_rect.h"
 #include "third_party/blink/renderer/platform/geometry/float_quad.h"
 #include "third_party/blink/renderer/platform/geometry/float_rounded_rect.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/layout/layout_box_model_object.cc b/third_party/blink/renderer/core/layout/layout_box_model_object.cc
index cc861156..c8fd09d 100644
--- a/third_party/blink/renderer/core/layout/layout_box_model_object.cc
+++ b/third_party/blink/renderer/core/layout/layout_box_model_object.cc
@@ -40,7 +40,7 @@
 #include "third_party/blink/renderer/core/paint/paint_layer.h"
 #include "third_party/blink/renderer/core/paint/paint_layer_scrollable_area.h"
 #include "third_party/blink/renderer/core/style/shadow_list.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/scroll/main_thread_scrolling_reason.h"
 #include "third_party/blink/renderer/platform/transforms/transform_state.h"
 
diff --git a/third_party/blink/renderer/core/layout/layout_flexible_box.cc b/third_party/blink/renderer/core/layout/layout_flexible_box.cc
index d001903..6c95f21 100644
--- a/third_party/blink/renderer/core/layout/layout_flexible_box.cc
+++ b/third_party/blink/renderer/core/layout/layout_flexible_box.cc
@@ -44,7 +44,7 @@
 #include "third_party/blink/renderer/core/paint/paint_layer.h"
 #include "third_party/blink/renderer/core/paint/paint_layer_scrollable_area.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/wtf/math_extras.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/layout/layout_grid.cc b/third_party/blink/renderer/core/layout/layout_grid.cc
index 5b944636..e8882aa 100644
--- a/third_party/blink/renderer/core/layout/layout_grid.cc
+++ b/third_party/blink/renderer/core/layout/layout_grid.cc
@@ -39,7 +39,7 @@
 #include "third_party/blink/renderer/core/paint/paint_layer_scrollable_area.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
 #include "third_party/blink/renderer/core/style/grid_area.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/text/writing_mode.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/layout/layout_replaced.cc b/third_party/blink/renderer/core/layout/layout_replaced.cc
index 7169488..1eae86b 100644
--- a/third_party/blink/renderer/core/layout/layout_replaced.cc
+++ b/third_party/blink/renderer/core/layout/layout_replaced.cc
@@ -38,7 +38,7 @@
 #include "third_party/blink/renderer/core/paint/paint_info.h"
 #include "third_party/blink/renderer/core/paint/paint_layer.h"
 #include "third_party/blink/renderer/core/paint/replaced_painter.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/layout/layout_scrollbar_part.cc b/third_party/blink/renderer/core/layout/layout_scrollbar_part.cc
index d026087..7a6de8c 100644
--- a/third_party/blink/renderer/core/layout/layout_scrollbar_part.cc
+++ b/third_party/blink/renderer/core/layout/layout_scrollbar_part.cc
@@ -30,7 +30,7 @@
 #include "third_party/blink/renderer/core/layout/layout_scrollbar.h"
 #include "third_party/blink/renderer/core/layout/layout_scrollbar_theme.h"
 #include "third_party/blink/renderer/core/layout/layout_view.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/layout/layout_table_cell.h b/third_party/blink/renderer/core/layout/layout_table_cell.h
index cd8500c..52baeef 100644
--- a/third_party/blink/renderer/core/layout/layout_table_cell.h
+++ b/third_party/blink/renderer/core/layout/layout_table_cell.h
@@ -32,7 +32,7 @@
 #include "third_party/blink/renderer/core/layout/layout_block_flow.h"
 #include "third_party/blink/renderer/core/layout/layout_table_row.h"
 #include "third_party/blink/renderer/core/layout/layout_table_section.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/text/writing_mode_utils.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/layout/layout_text.h b/third_party/blink/renderer/core/layout/layout_text.h
index a60e125..1a10fd7 100644
--- a/third_party/blink/renderer/core/layout/layout_text.h
+++ b/third_party/blink/renderer/core/layout/layout_text.h
@@ -30,7 +30,7 @@
 #include "third_party/blink/renderer/core/layout/layout_object.h"
 #include "third_party/blink/renderer/core/layout/line/line_box_list.h"
 #include "third_party/blink/renderer/core/layout/text_run_constructor.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/wtf/forward.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/layout/map_coordinates_test.cc b/third_party/blink/renderer/core/layout/map_coordinates_test.cc
index c6bca021..6a2141e 100644
--- a/third_party/blink/renderer/core/layout/map_coordinates_test.cc
+++ b/third_party/blink/renderer/core/layout/map_coordinates_test.cc
@@ -1633,8 +1633,9 @@
 }
 
 TEST_F(MapCoordinatesTest, LocalToAbsoluteTransformFlattens) {
-  GetDocument().GetFrame()->GetSettings()->SetAcceleratedCompositingEnabled(
-      true);
+  // This Page is not actually being shown by a compositor, but we act like it
+  // will in order to test behaviour.
+  GetPage().GetSettings().SetAcceleratedCompositingEnabled(true);
   SetBodyInnerHTML(R"HTML(
     <div style='position: absolute; left: 0; top: 0;'>
       <div style='transform: rotateY(45deg);
diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_layout_algorithm.cc b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_layout_algorithm.cc
index 813b7b0..0d9575ff 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_layout_algorithm.cc
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_layout_algorithm.cc
@@ -206,7 +206,7 @@
                                          NGExclusionSpace* exclusion_space) {
   // Needs MutableResults to move ShapeResult out of the NGLineInfo.
   NGInlineItemResults* line_items = line_info->MutableResults();
-  line_box_.clear();
+  line_box_.resize(0);
 
   // Apply justification before placing items, because it affects size/position
   // of items, which are needed to compute inline static positions.
@@ -725,8 +725,8 @@
 #endif
 
     // Reset any state that may have been modified in a previous pass.
-    positioned_floats.clear();
-    unpositioned_floats_.clear();
+    positioned_floats.resize(0);
+    unpositioned_floats_.resize(0);
     container_builder_.Reset();
     exclusion_space = initial_exclusion_space;
 
@@ -876,7 +876,7 @@
       << "The floats BFC block offset should be known here";
 
   if (BreakToken() && BreakToken()->IgnoreFloats()) {
-    unpositioned_floats_.clear();
+    unpositioned_floats_.resize(0);
     return;
   }
 
@@ -896,7 +896,7 @@
                  ConstraintSpace(), exclusion_space, &positioned_floats);
 
   positioned_floats_.AppendVector(positioned_floats);
-  unpositioned_floats_.clear();
+  unpositioned_floats_.resize(0);
 }
 
 void NGInlineLayoutAlgorithm::BidiReorder() {
diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_node.cc b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_node.cc
index 24322a1..8d9b0ff4 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_node.cc
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_node.cc
@@ -733,7 +733,7 @@
       nullptr /* container_builder */, &empty_exclusion_space, 0u,
       line_opportunity, nullptr /* break_token */);
   do {
-    unpositioned_floats.clear();
+    unpositioned_floats.resize(0);
 
     NGLineInfo line_info;
     line_breaker.NextLine(&line_info);
diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_line_box_fragment_builder.cc b/third_party/blink/renderer/core/layout/ng/inline/ng_line_box_fragment_builder.cc
index 333013e..8ac5b57b 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_line_box_fragment_builder.cc
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_line_box_fragment_builder.cc
@@ -26,8 +26,8 @@
 NGLineBoxFragmentBuilder::~NGLineBoxFragmentBuilder() = default;
 
 void NGLineBoxFragmentBuilder::Reset() {
-  children_.clear();
-  offsets_.clear();
+  children_.resize(0);
+  offsets_.resize(0);
   metrics_ = NGLineHeightMetrics();
   size_.inline_size = LayoutUnit();
 }
diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_line_box_fragment_builder.h b/third_party/blink/renderer/core/layout/ng/inline/ng_line_box_fragment_builder.h
index 67f3c435..4ff2065 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_line_box_fragment_builder.h
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_line_box_fragment_builder.h
@@ -130,7 +130,7 @@
     void ReserveInitialCapacity(unsigned capacity) {
       children_.ReserveInitialCapacity(capacity);
     }
-    void clear() { children_.clear(); }
+    void clear() { children_.resize(0); }
     void resize(wtf_size_t size) { children_.resize(size); }
 
     using iterator = Vector<Child, 16>::iterator;
diff --git a/third_party/blink/renderer/core/layout/ng/ng_absolute_utils.cc b/third_party/blink/renderer/core/layout/ng/ng_absolute_utils.cc
index 976ee25..21e5a36b 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_absolute_utils.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_absolute_utils.cc
@@ -12,7 +12,7 @@
 #include "third_party/blink/renderer/core/layout/ng/ng_length_utils.h"
 #include "third_party/blink/renderer/core/paint/paint_layer_scrollable_area.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/layout/ng/ng_block_layout_algorithm.cc b/third_party/blink/renderer/core/layout/ng/ng_block_layout_algorithm.cc
index feac6a1..ddbfb81 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_block_layout_algorithm.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_block_layout_algorithm.cc
@@ -2089,7 +2089,7 @@
 
   AddPositionedFloats(positioned_floats);
 
-  unpositioned_floats_.clear();
+  unpositioned_floats_.resize(0);
 }
 
 template <class Vec>
diff --git a/third_party/blink/renderer/core/layout/ng/ng_container_fragment_builder.cc b/third_party/blink/renderer/core/layout/ng/ng_container_fragment_builder.cc
index eddb206..ae74ca3 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_container_fragment_builder.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_container_fragment_builder.cc
@@ -171,7 +171,7 @@
   // The descendant may be a "position: absolute" which contains a "position:
   // fixed" for example. (This fragment isn't the containing block for the
   // fixed descendant).
-  oof_positioned_candidates_.clear();
+  oof_positioned_candidates_.resize(0);
 }
 
 void NGContainerFragmentBuilder::MoveOutOfFlowDescendantCandidatesToDescendants(
diff --git a/third_party/blink/renderer/core/layout/ng/ng_container_fragment_builder.h b/third_party/blink/renderer/core/layout/ng/ng_container_fragment_builder.h
index 163f62d..b6c8dcf 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_container_fragment_builder.h
+++ b/third_party/blink/renderer/core/layout/ng/ng_container_fragment_builder.h
@@ -206,6 +206,10 @@
           child_offset(child_offset_arg),
           is_line_relative(true),
           line_direction(line_direction_arg) {}
+
+    // This constructor is not meant to be called, but required so we can use
+    // Vector::resize(0).
+    NGOutOfFlowPositionedCandidate() {}
   };
 
   NGContainerFragmentBuilder(scoped_refptr<const ComputedStyle>,
diff --git a/third_party/blink/renderer/core/layout/ng/ng_fragment_builder.cc b/third_party/blink/renderer/core/layout/ng/ng_fragment_builder.cc
index bb83fabd..a8955a5 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_fragment_builder.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_fragment_builder.cc
@@ -94,10 +94,10 @@
 }
 
 void NGFragmentBuilder::RemoveChildren() {
-  child_break_tokens_.clear();
-  inline_break_tokens_.clear();
-  children_.clear();
-  offsets_.clear();
+  child_break_tokens_.resize(0);
+  inline_break_tokens_.resize(0);
+  children_.resize(0);
+  offsets_.resize(0);
 }
 
 NGFragmentBuilder& NGFragmentBuilder::AddBreakBeforeChild(
diff --git a/third_party/blink/renderer/core/layout/ng/ng_length_utils.cc b/third_party/blink/renderer/core/layout/ng/ng_length_utils.cc
index b5894e61..c8305c58 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_length_utils.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_length_utils.cc
@@ -13,8 +13,8 @@
 #include "third_party/blink/renderer/core/layout/ng/ng_constraint_space_builder.h"
 #include "third_party/blink/renderer/core/layout/ng/ng_space_utils.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/layout_unit.h"
-#include "third_party/blink/renderer/platform/length.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/layout/ng/ng_length_utils_test.cc b/third_party/blink/renderer/core/layout/ng/ng_length_utils_test.cc
index cdcc443..b3ceaf3 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_length_utils_test.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_length_utils_test.cc
@@ -11,9 +11,9 @@
 #include "third_party/blink/renderer/core/layout/ng/ng_constraint_space_builder.h"
 #include "third_party/blink/renderer/core/layout/ng/ng_layout_test.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
-#include "third_party/blink/renderer/platform/calculation_value.h"
+#include "third_party/blink/renderer/platform/geometry/calculation_value.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/layout_unit.h"
-#include "third_party/blink/renderer/platform/length.h"
 
 namespace blink {
 namespace {
diff --git a/third_party/blink/renderer/core/layout/ng/ng_out_of_flow_layout_part.cc b/third_party/blink/renderer/core/layout/ng/ng_out_of_flow_layout_part.cc
index 20fd62a5..6e3b88fd 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_out_of_flow_layout_part.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_out_of_flow_layout_part.cc
@@ -74,7 +74,7 @@
     }
     // Sweep any descendants that might have been added.
     // This happens when an absolute container has a fixed child.
-    descendant_candidates.clear();
+    descendant_candidates.resize(0);
     container_builder_->GetAndClearOutOfFlowDescendantCandidates(
         &descendant_candidates, container_builder_->GetLayoutObject());
   }
diff --git a/third_party/blink/renderer/core/layout/ng/ng_out_of_flow_positioned_descendant.h b/third_party/blink/renderer/core/layout/ng/ng_out_of_flow_positioned_descendant.h
index 2f38cb50..989825d 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_out_of_flow_positioned_descendant.h
+++ b/third_party/blink/renderer/core/layout/ng/ng_out_of_flow_positioned_descendant.h
@@ -33,6 +33,10 @@
       : node(node_param),
         static_position(static_position_param),
         inline_container(inline_container_param) {}
+
+  // This constructor is not meant to be called, but required so we can use
+  // Vector::resize(0).
+  NGOutOfFlowPositionedDescendant() : node(nullptr) {}
 };
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/layout/ng/ng_positioned_float.h b/third_party/blink/renderer/core/layout/ng/ng_positioned_float.h
index 99d31649..c319680 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_positioned_float.h
+++ b/third_party/blink/renderer/core/layout/ng/ng_positioned_float.h
@@ -15,6 +15,10 @@
 
 // Contains the information necessary for copying back data to a FloatingObject.
 struct CORE_EXPORT NGPositionedFloat {
+  // This constructor is not meant to be called, but required so we can use
+  // Vector::resize(0).
+  NGPositionedFloat() {}
+
   NGPositionedFloat(scoped_refptr<NGLayoutResult> layout_result,
                     const NGBfcOffset& bfc_offset);
   ~NGPositionedFloat();
diff --git a/third_party/blink/renderer/core/layout/ng/ng_relative_utils.cc b/third_party/blink/renderer/core/layout/ng/ng_relative_utils.cc
index 9a48401..d7b970f 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_relative_utils.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_relative_utils.cc
@@ -8,7 +8,7 @@
 #include "third_party/blink/renderer/core/layout/ng/geometry/ng_physical_offset.h"
 #include "third_party/blink/renderer/core/layout/ng/geometry/ng_physical_size.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/layout/ng/ng_unpositioned_float.h b/third_party/blink/renderer/core/layout/ng/ng_unpositioned_float.h
index c12ecdc..8af38a8 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_unpositioned_float.h
+++ b/third_party/blink/renderer/core/layout/ng/ng_unpositioned_float.h
@@ -20,6 +20,10 @@
   DISALLOW_NEW();
 
  public:
+  // This constructor is not meant to be called, but required so we can use
+  // Vector::resize(0).
+  NGUnpositionedFloat() : node(nullptr) {}
+
   NGUnpositionedFloat(NGBlockNode node, const NGBlockBreakToken* token)
       : node(node), token(token) {}
 
diff --git a/third_party/blink/renderer/core/layout/shapes/shape.cc b/third_party/blink/renderer/core/layout/shapes/shape.cc
index 0741bb9..8509e4a 100644
--- a/third_party/blink/renderer/core/layout/shapes/shape.cc
+++ b/third_party/blink/renderer/core/layout/shapes/shape.cc
@@ -44,11 +44,11 @@
 #include "third_party/blink/renderer/core/typed_arrays/dom_typed_array.h"
 #include "third_party/blink/renderer/platform/geometry/float_rounded_rect.h"
 #include "third_party/blink/renderer/platform/geometry/float_size.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/graphics/graphics_types.h"
 #include "third_party/blink/renderer/platform/graphics/paint/paint_canvas.h"
 #include "third_party/blink/renderer/platform/graphics/paint/paint_flags.h"
 #include "third_party/blink/renderer/platform/graphics/static_bitmap_image.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
 #include "third_party/blink/renderer/platform/wtf/math_extras.h"
 #include "third_party/blink/renderer/platform/wtf/typed_arrays/array_buffer_contents.h"
 #include "third_party/skia/include/core/SkSurface.h"
diff --git a/third_party/blink/renderer/core/layout/shapes/shape_outside_info.cc b/third_party/blink/renderer/core/layout/shapes/shape_outside_info.cc
index 2042a8b..5648f5f 100644
--- a/third_party/blink/renderer/core/layout/shapes/shape_outside_info.cc
+++ b/third_party/blink/renderer/core/layout/shapes/shape_outside_info.cc
@@ -38,7 +38,7 @@
 #include "third_party/blink/renderer/core/layout/layout_block_flow.h"
 #include "third_party/blink/renderer/core/layout/layout_box.h"
 #include "third_party/blink/renderer/core/layout/layout_image.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/layout/svg/layout_svg_image.cc b/third_party/blink/renderer/core/layout/svg/layout_svg_image.cc
index 8b169e2..1db7446 100644
--- a/third_party/blink/renderer/core/layout/svg/layout_svg_image.cc
+++ b/third_party/blink/renderer/core/layout/svg/layout_svg_image.cc
@@ -36,8 +36,8 @@
 #include "third_party/blink/renderer/core/layout/svg/svg_resources_cache.h"
 #include "third_party/blink/renderer/core/paint/svg_image_painter.h"
 #include "third_party/blink/renderer/core/svg/svg_image_element.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/graphics/paint/paint_record.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/layout/svg/layout_svg_root.cc b/third_party/blink/renderer/core/layout/svg/layout_svg_root.cc
index 5e5394d..b016e40 100644
--- a/third_party/blink/renderer/core/layout/svg/layout_svg_root.cc
+++ b/third_party/blink/renderer/core/layout/svg/layout_svg_root.cc
@@ -40,7 +40,7 @@
 #include "third_party/blink/renderer/core/svg/graphics/svg_image.h"
 #include "third_party/blink/renderer/core/svg/svg_element.h"
 #include "third_party/blink/renderer/core/svg/svg_svg_element.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/layout/svg/line/svg_inline_text_box.cc b/third_party/blink/renderer/core/layout/svg/line/svg_inline_text_box.cc
index 0c9e8cf..44562a16 100644
--- a/third_party/blink/renderer/core/layout/svg/line/svg_inline_text_box.cc
+++ b/third_party/blink/renderer/core/layout/svg/line/svg_inline_text_box.cc
@@ -276,6 +276,25 @@
   return text_bounding_rect;
 }
 
+bool SVGInlineTextBox::HitTestFragments(
+    const HitTestLocation& location_in_container) const {
+  auto line_layout_item = LineLayoutSVGInlineText(GetLineLayoutItem());
+  const SimpleFontData* font_data = line_layout_item.ScaledFont().PrimaryFont();
+  DCHECK(font_data);
+  if (!font_data)
+    return false;
+
+  DCHECK(line_layout_item.ScalingFactor());
+  float baseline = font_data->GetFontMetrics().FloatAscent() /
+                   line_layout_item.ScalingFactor();
+  for (const SVGTextFragment& fragment : text_fragments_) {
+    FloatQuad fragment_quad = fragment.BoundingQuad(baseline);
+    if (location_in_container.Intersects(fragment_quad))
+      return true;
+  }
+  return false;
+}
+
 bool SVGInlineTextBox::NodeAtPoint(HitTestResult& result,
                                    const HitTestLocation& location_in_container,
                                    const LayoutPoint& accumulated_offset,
@@ -299,26 +318,14 @@
     LayoutRect rect(Location(), Size());
     rect.MoveBy(accumulated_offset);
     if (location_in_container.Intersects(rect)) {
-      const SimpleFontData* font_data =
-          line_layout_item.ScaledFont().PrimaryFont();
-      DCHECK(font_data);
-      if (!font_data)
-        return false;
-
-      DCHECK(line_layout_item.ScalingFactor());
-      float baseline = font_data->GetFontMetrics().FloatAscent() /
-                       line_layout_item.ScalingFactor();
-      for (const SVGTextFragment& fragment : text_fragments_) {
-        FloatQuad fragment_quad = fragment.BoundingQuad(baseline);
-        if (location_in_container.Intersects(fragment_quad)) {
-          line_layout_item.UpdateHitTestResult(
-              result,
-              location_in_container.Point() - ToLayoutSize(accumulated_offset));
-          if (result.AddNodeToListBasedTestResult(line_layout_item.GetNode(),
-                                                  location_in_container,
-                                                  rect) == kStopHitTesting)
-            return true;
-        }
+      if (HitTestFragments(location_in_container)) {
+        line_layout_item.UpdateHitTestResult(
+            result,
+            location_in_container.Point() - ToLayoutSize(accumulated_offset));
+        if (result.AddNodeToListBasedTestResult(line_layout_item.GetNode(),
+                                                location_in_container,
+                                                rect) == kStopHitTesting)
+          return true;
       }
     }
   }
diff --git a/third_party/blink/renderer/core/layout/svg/line/svg_inline_text_box.h b/third_party/blink/renderer/core/layout/svg/line/svg_inline_text_box.h
index 00cbed81..efaa8c5 100644
--- a/third_party/blink/renderer/core/layout/svg/line/svg_inline_text_box.h
+++ b/third_party/blink/renderer/core/layout/svg/line/svg_inline_text_box.h
@@ -97,6 +97,7 @@
                                       const ComputedStyle&,
                                       const Font&) const final;
 
+  bool HitTestFragments(const HitTestLocation& location_in_container) const;
   bool NodeAtPoint(HitTestResult&,
                    const HitTestLocation& location_in_container,
                    const LayoutPoint& accumulated_offset,
diff --git a/third_party/blink/renderer/core/layout/table_layout_algorithm_auto.h b/third_party/blink/renderer/core/layout/table_layout_algorithm_auto.h
index 7aca833..a55f6e32 100644
--- a/third_party/blink/renderer/core/layout/table_layout_algorithm_auto.h
+++ b/third_party/blink/renderer/core/layout/table_layout_algorithm_auto.h
@@ -22,8 +22,8 @@
 #define THIRD_PARTY_BLINK_RENDERER_CORE_LAYOUT_TABLE_LAYOUT_ALGORITHM_AUTO_H_
 
 #include "third_party/blink/renderer/core/layout/table_layout_algorithm.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/layout_unit.h"
-#include "third_party/blink/renderer/platform/length.h"
 #include "third_party/blink/renderer/platform/wtf/vector.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/layout/table_layout_algorithm_fixed.h b/third_party/blink/renderer/core/layout/table_layout_algorithm_fixed.h
index 56660f8..d929c02 100644
--- a/third_party/blink/renderer/core/layout/table_layout_algorithm_fixed.h
+++ b/third_party/blink/renderer/core/layout/table_layout_algorithm_fixed.h
@@ -22,7 +22,7 @@
 #define THIRD_PARTY_BLINK_RENDERER_CORE_LAYOUT_TABLE_LAYOUT_ALGORITHM_FIXED_H_
 
 #include "third_party/blink/renderer/core/layout/table_layout_algorithm.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/wtf/vector.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/loader/resource/image_resource_content.cc b/third_party/blink/renderer/core/loader/resource/image_resource_content.cc
index f769791..b959277 100644
--- a/third_party/blink/renderer/core/loader/resource/image_resource_content.cc
+++ b/third_party/blink/renderer/core/loader/resource/image_resource_content.cc
@@ -541,12 +541,6 @@
   return true;
 }
 
-void ImageResourceContent::AnimationAdvanced(const blink::Image* image) {
-  if (!image || image != image_)
-    return;
-  NotifyObservers(kDoNotNotifyFinish, CanDeferInvalidation::kYes);
-}
-
 void ImageResourceContent::UpdateImageAnimationPolicy() {
   if (!image_)
     return;
diff --git a/third_party/blink/renderer/core/loader/resource/image_resource_content.h b/third_party/blink/renderer/core/loader/resource/image_resource_content.h
index 0deab06..e9fcd66 100644
--- a/third_party/blink/renderer/core/loader/resource/image_resource_content.h
+++ b/third_party/blink/renderer/core/loader/resource/image_resource_content.h
@@ -188,7 +188,6 @@
   // ImageObserver
   void DecodedSizeChangedTo(const blink::Image*, size_t new_size) override;
   bool ShouldPauseAnimation(const blink::Image*) override;
-  void AnimationAdvanced(const blink::Image*) override;
   void Changed(const blink::Image*) override;
   void AsyncLoadCompleted(const blink::Image*) override;
 
diff --git a/third_party/blink/renderer/core/loader/resource/image_resource_test.cc b/third_party/blink/renderer/core/loader/resource/image_resource_test.cc
index d2b51d1f..78bb9a0c 100644
--- a/third_party/blink/renderer/core/loader/resource/image_resource_test.cc
+++ b/third_party/blink/renderer/core/loader/resource/image_resource_test.cc
@@ -1963,7 +1963,7 @@
 
   // Image animated.
   static_cast<ImageObserver*>(image_resource->GetContent())
-      ->AnimationAdvanced(image_resource->GetContent()->GetImage());
+      ->Changed(image_resource->GetContent()->GetImage());
   EXPECT_EQ(obs->ImageChangedCount(), 3);
   EXPECT_EQ(obs->Defer(), ImageResourceObserver::CanDeferInvalidation::kYes);
 }
diff --git a/third_party/blink/renderer/core/page/page_overlay_test.cc b/third_party/blink/renderer/core/page/page_overlay_test.cc
index 56b0ec22..50ef73a 100644
--- a/third_party/blink/renderer/core/page/page_overlay_test.cc
+++ b/third_party/blink/renderer/core/page/page_overlay_test.cc
@@ -38,14 +38,6 @@
 
 // These unit tests cover both PageOverlay and PageOverlayList.
 
-void EnableAcceleratedCompositing(WebSettings* settings) {
-  settings->SetAcceleratedCompositingEnabled(true);
-}
-
-void DisableAcceleratedCompositing(WebSettings* settings) {
-  settings->SetAcceleratedCompositingEnabled(false);
-}
-
 // PageOverlay that paints a solid color.
 class SolidColorOverlay : public PageOverlay::Delegate {
  public:
@@ -69,19 +61,12 @@
 
 class PageOverlayTest : public testing::Test {
  protected:
-  enum CompositingMode { kAcceleratedCompositing, kUnacceleratedCompositing };
-
-  void Initialize(CompositingMode compositing_mode) {
+  PageOverlayTest() {
     helper_.Initialize(nullptr /* web_frame_client */,
                        nullptr /* web_view_client */,
-                       nullptr /* web_widget_client */,
-                       compositing_mode == kAcceleratedCompositing
-                           ? EnableAcceleratedCompositing
-                           : DisableAcceleratedCompositing);
+                       nullptr /* web_widget_client */);
     GetWebView()->Resize(WebSize(kViewportWidth, kViewportHeight));
     GetWebView()->UpdateAllLifecyclePhases();
-    ASSERT_EQ(compositing_mode == kAcceleratedCompositing,
-              GetWebView()->IsAcceleratedCompositingActive());
   }
 
   WebViewImpl* GetWebView() const { return helper_.GetWebView(); }
@@ -125,36 +110,31 @@
 };
 
 TEST_F(PageOverlayTest, PageOverlay_AcceleratedCompositing) {
-  Initialize(kAcceleratedCompositing);
   SetViewportSize(WebSize(kViewportWidth, kViewportHeight));
 
   std::unique_ptr<PageOverlay> page_overlay = CreateSolidYellowOverlay();
   page_overlay->Update();
   GetWebView()->UpdateAllLifecyclePhases();
 
+  GraphicsLayer* graphics_layer = page_overlay->GetGraphicsLayer();
+  WebRect rect(0, 0, kViewportWidth, kViewportHeight);
+
+  IntRect int_rect = rect;
+  graphics_layer->Paint(&int_rect);
+
   // Ideally, we would get results from the compositor that showed that this
   // page overlay actually winds up getting drawn on top of the rest.
   // For now, we just check that the GraphicsLayer will draw the right thing.
-
   MockPageOverlayCanvas canvas(kViewportWidth, kViewportHeight);
   EXPECT_CALL(canvas, onDrawRect(_, _)).Times(AtLeast(0));
   EXPECT_CALL(canvas,
               onDrawRect(SkRect::MakeWH(kViewportWidth, kViewportHeight),
                          Property(&SkPaint::getColor, SK_ColorYELLOW)));
-
-  GraphicsLayer* graphics_layer = page_overlay->GetGraphicsLayer();
-  WebRect rect(0, 0, kViewportWidth, kViewportHeight);
-
-  // Paint the layer with a null canvas to get a display list, and then
-  // replay that onto the mock canvas for examination.
-  IntRect int_rect = rect;
-  graphics_layer->Paint(&int_rect);
   canvas.drawPicture(
       ToSkPicture(graphics_layer->CapturePaintRecord(), int_rect));
 }
 
 TEST_F(PageOverlayTest, PageOverlay_VisualRect) {
-  Initialize(kAcceleratedCompositing);
   std::unique_ptr<PageOverlay> page_overlay = CreateSolidYellowOverlay();
   page_overlay->Update();
   GetWebView()->UpdateAllLifecyclePhases();
diff --git a/third_party/blink/renderer/core/page/scrolling/snap_coordinator.cc b/third_party/blink/renderer/core/page/scrolling/snap_coordinator.cc
index 939f7eb..b2197103 100644
--- a/third_party/blink/renderer/core/page/scrolling/snap_coordinator.cc
+++ b/third_party/blink/renderer/core/page/scrolling/snap_coordinator.cc
@@ -11,7 +11,7 @@
 #include "third_party/blink/renderer/core/layout/layout_box.h"
 #include "third_party/blink/renderer/core/layout/layout_view.h"
 #include "third_party/blink/renderer/core/paint/paint_layer_scrollable_area.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/scroll/scroll_snap_data.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/page/validation_message_overlay_delegate.cc b/third_party/blink/renderer/core/page/validation_message_overlay_delegate.cc
index a013c09..a55fa788 100644
--- a/third_party/blink/renderer/core/page/validation_message_overlay_delegate.cc
+++ b/third_party/blink/renderer/core/page/validation_message_overlay_delegate.cc
@@ -140,7 +140,6 @@
   page_->GetSettings().SetMinimumFontSize(main_settings.GetMinimumFontSize());
   page_->GetSettings().SetMinimumLogicalFontSize(
       main_settings.GetMinimumLogicalFontSize());
-  page_->GetSettings().SetAcceleratedCompositingEnabled(false);
 
   LocalFrame* frame =
       LocalFrame::Create(EmptyLocalFrameClient::Create(), *page_, nullptr);
diff --git a/third_party/blink/renderer/core/page/viewport_description.h b/third_party/blink/renderer/core/page/viewport_description.h
index a0ed23a..05d1aa0 100644
--- a/third_party/blink/renderer/core/page/viewport_description.h
+++ b/third_party/blink/renderer/core/page/viewport_description.h
@@ -34,7 +34,7 @@
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/frame/page_scale_constraints.h"
 #include "third_party/blink/renderer/platform/geometry/float_size.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/wtf/allocator.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/page/viewport_test.cc b/third_party/blink/renderer/core/page/viewport_test.cc
index 8451db59..a1065c17 100644
--- a/third_party/blink/renderer/core/page/viewport_test.cc
+++ b/third_party/blink/renderer/core/page/viewport_test.cc
@@ -51,7 +51,7 @@
 #include "third_party/blink/renderer/platform/geometry/int_point.h"
 #include "third_party/blink/renderer/platform/geometry/int_rect.h"
 #include "third_party/blink/renderer/platform/geometry/int_size.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/testing/histogram_tester.h"
 #include "third_party/blink/renderer/platform/testing/unit_test_helpers.h"
 #include "third_party/blink/renderer/platform/testing/url_test_helpers.h"
diff --git a/third_party/blink/renderer/core/paint/box_painter.cc b/third_party/blink/renderer/core/paint/box_painter.cc
index 8b2dced..43ab586 100644
--- a/third_party/blink/renderer/core/paint/box_painter.cc
+++ b/third_party/blink/renderer/core/paint/box_painter.cc
@@ -23,11 +23,11 @@
 #include "third_party/blink/renderer/core/paint/svg_foreign_object_painter.h"
 #include "third_party/blink/renderer/core/paint/theme_painter.h"
 #include "third_party/blink/renderer/platform/geometry/layout_point.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/graphics/graphics_context_state_saver.h"
 #include "third_party/blink/renderer/platform/graphics/paint/display_item_cache_skipper.h"
 #include "third_party/blink/renderer/platform/graphics/paint/drawing_recorder.h"
 #include "third_party/blink/renderer/platform/graphics/paint/scoped_paint_chunk_properties.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/paint/box_reflection_utils.cc b/third_party/blink/renderer/core/paint/box_reflection_utils.cc
index 218e92a8..520c388 100644
--- a/third_party/blink/renderer/core/paint/box_reflection_utils.cc
+++ b/third_party/blink/renderer/core/paint/box_reflection_utils.cc
@@ -10,10 +10,10 @@
 #include "third_party/blink/renderer/platform/geometry/float_rect.h"
 #include "third_party/blink/renderer/platform/geometry/layout_point.h"
 #include "third_party/blink/renderer/platform/geometry/layout_rect.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/graphics/box_reflection.h"
 #include "third_party/blink/renderer/platform/graphics/paint/drawing_recorder.h"
 #include "third_party/blink/renderer/platform/graphics/paint/paint_record_builder.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/paint/compositing/composited_layer_mapping.cc b/third_party/blink/renderer/core/paint/compositing/composited_layer_mapping.cc
index 35a6efa..ccdfb3c1 100644
--- a/third_party/blink/renderer/core/paint/compositing/composited_layer_mapping.cc
+++ b/third_party/blink/renderer/core/paint/compositing/composited_layer_mapping.cc
@@ -68,13 +68,13 @@
 #include "third_party/blink/renderer/core/paint/scrollable_area_painter.h"
 #include "third_party/blink/renderer/core/probe/core_probes.h"
 #include "third_party/blink/renderer/platform/fonts/font_cache.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/graphics/bitmap_image.h"
 #include "third_party/blink/renderer/platform/graphics/compositor_filter_operations.h"
 #include "third_party/blink/renderer/platform/graphics/graphics_context.h"
 #include "third_party/blink/renderer/platform/graphics/paint/cull_rect.h"
 #include "third_party/blink/renderer/platform/graphics/paint/drawing_recorder.h"
 #include "third_party/blink/renderer/platform/graphics/paint/paint_controller.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 #include "third_party/blink/renderer/platform/transforms/transform_state.h"
 #include "third_party/blink/renderer/platform/wtf/text/string_builder.h"
diff --git a/third_party/blink/renderer/core/paint/filter_effect_builder.cc b/third_party/blink/renderer/core/paint/filter_effect_builder.cc
index e8d7fb75..a924299 100644
--- a/third_party/blink/renderer/core/paint/filter_effect_builder.cc
+++ b/third_party/blink/renderer/core/paint/filter_effect_builder.cc
@@ -33,6 +33,7 @@
 #include "third_party/blink/renderer/core/svg/svg_filter_element.h"
 #include "third_party/blink/renderer/core/svg/svg_length_context.h"
 #include "third_party/blink/renderer/core/svg/svg_resource.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/graphics/compositor_filter_operations.h"
 #include "third_party/blink/renderer/platform/graphics/filters/fe_box_reflect.h"
 #include "third_party/blink/renderer/platform/graphics/filters/fe_color_matrix.h"
@@ -44,7 +45,6 @@
 #include "third_party/blink/renderer/platform/graphics/filters/paint_filter_builder.h"
 #include "third_party/blink/renderer/platform/graphics/filters/source_graphic.h"
 #include "third_party/blink/renderer/platform/graphics/interpolation_space.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
 #include "third_party/blink/renderer/platform/wtf/math_extras.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/paint/nine_piece_image_grid.cc b/third_party/blink/renderer/core/paint/nine_piece_image_grid.cc
index 3cf8407a..5544a45b 100644
--- a/third_party/blink/renderer/core/paint/nine_piece_image_grid.cc
+++ b/third_party/blink/renderer/core/paint/nine_piece_image_grid.cc
@@ -7,7 +7,7 @@
 #include "third_party/blink/renderer/core/style/nine_piece_image.h"
 #include "third_party/blink/renderer/platform/geometry/float_size.h"
 #include "third_party/blink/renderer/platform/geometry/int_size.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/paint/paint_layer.cc b/third_party/blink/renderer/core/paint/paint_layer.cc
index 9c854357..d7b3d2a 100644
--- a/third_party/blink/renderer/core/paint/paint_layer.cc
+++ b/third_party/blink/renderer/core/paint/paint_layer.cc
@@ -85,11 +85,11 @@
 #include "third_party/blink/renderer/platform/bindings/v8_per_isolate_data.h"
 #include "third_party/blink/renderer/platform/geometry/float_point_3d.h"
 #include "third_party/blink/renderer/platform/geometry/float_rect.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/graphics/compositor_filter_operations.h"
 #include "third_party/blink/renderer/platform/graphics/filters/filter.h"
 #include "third_party/blink/renderer/platform/graphics/paint/geometry_mapper.h"
 #include "third_party/blink/renderer/platform/instrumentation/tracing/trace_event.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 #include "third_party/blink/renderer/platform/transforms/transform_state.h"
 #include "third_party/blink/renderer/platform/transforms/transformation_matrix.h"
diff --git a/third_party/blink/renderer/core/style/basic_shapes.cc b/third_party/blink/renderer/core/style/basic_shapes.cc
index a0fc5c7..15053f54 100644
--- a/third_party/blink/renderer/core/style/basic_shapes.cc
+++ b/third_party/blink/renderer/core/style/basic_shapes.cc
@@ -31,8 +31,8 @@
 
 #include "third_party/blink/renderer/core/css/basic_shape_functions.h"
 #include "third_party/blink/renderer/platform/geometry/float_rect.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/graphics/path.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/style/basic_shapes.h b/third_party/blink/renderer/core/style/basic_shapes.h
index ce888bf..8fceef9 100644
--- a/third_party/blink/renderer/core/style/basic_shapes.h
+++ b/third_party/blink/renderer/core/style/basic_shapes.h
@@ -32,9 +32,9 @@
 
 #include "base/memory/scoped_refptr.h"
 #include "third_party/blink/renderer/core/core_export.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
+#include "third_party/blink/renderer/platform/geometry/length_size.h"
 #include "third_party/blink/renderer/platform/graphics/graphics_types.h"
-#include "third_party/blink/renderer/platform/length.h"
-#include "third_party/blink/renderer/platform/length_size.h"
 #include "third_party/blink/renderer/platform/wtf/allocator.h"
 #include "third_party/blink/renderer/platform/wtf/ref_counted.h"
 #include "third_party/blink/renderer/platform/wtf/vector.h"
diff --git a/third_party/blink/renderer/core/style/border_image_length.h b/third_party/blink/renderer/core/style/border_image_length.h
index 25a4918..12ec360 100644
--- a/third_party/blink/renderer/core/style/border_image_length.h
+++ b/third_party/blink/renderer/core/style/border_image_length.h
@@ -31,7 +31,7 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_STYLE_BORDER_IMAGE_LENGTH_H_
 #define THIRD_PARTY_BLINK_RENDERER_CORE_STYLE_BORDER_IMAGE_LENGTH_H_
 
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/wtf/allocator.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/style/cached_ua_style.h b/third_party/blink/renderer/core/style/cached_ua_style.h
index d9a10878..8d1ff0bb 100644
--- a/third_party/blink/renderer/core/style/cached_ua_style.h
+++ b/third_party/blink/renderer/core/style/cached_ua_style.h
@@ -30,8 +30,8 @@
 #include "third_party/blink/renderer/core/css/style_color.h"
 #include "third_party/blink/renderer/core/style/fill_layer.h"
 #include "third_party/blink/renderer/core/style/nine_piece_image.h"
+#include "third_party/blink/renderer/platform/geometry/length_size.h"
 #include "third_party/blink/renderer/platform/graphics/color.h"
-#include "third_party/blink/renderer/platform/length_size.h"
 #include "third_party/blink/renderer/platform/wtf/allocator.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/style/computed_style.cc b/third_party/blink/renderer/core/style/computed_style.cc
index bc497a3c..4e3bf36 100644
--- a/third_party/blink/renderer/core/style/computed_style.cc
+++ b/third_party/blink/renderer/core/style/computed_style.cc
@@ -60,9 +60,9 @@
 #include "third_party/blink/renderer/platform/fonts/font.h"
 #include "third_party/blink/renderer/platform/fonts/font_selector.h"
 #include "third_party/blink/renderer/platform/geometry/float_rounded_rect.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/graphics/graphics_context.h"
 #include "third_party/blink/renderer/platform/graphics/path.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
 #include "third_party/blink/renderer/platform/text/capitalize.h"
 #include "third_party/blink/renderer/platform/text/character.h"
 #include "third_party/blink/renderer/platform/transforms/rotate_transform_operation.h"
diff --git a/third_party/blink/renderer/core/style/computed_style.h b/third_party/blink/renderer/core/style/computed_style.h
index f76bd21..63626bd7 100644
--- a/third_party/blink/renderer/core/style/computed_style.h
+++ b/third_party/blink/renderer/core/style/computed_style.h
@@ -41,12 +41,12 @@
 #include "third_party/blink/renderer/core/style/svg_computed_style.h"
 #include "third_party/blink/renderer/core/style/transform_origin.h"
 #include "third_party/blink/renderer/platform/geometry/layout_rect_outsets.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
+#include "third_party/blink/renderer/platform/geometry/length_box.h"
+#include "third_party/blink/renderer/platform/geometry/length_point.h"
+#include "third_party/blink/renderer/platform/geometry/length_size.h"
 #include "third_party/blink/renderer/platform/graphics/color.h"
 #include "third_party/blink/renderer/platform/graphics/touch_action.h"
-#include "third_party/blink/renderer/platform/length.h"
-#include "third_party/blink/renderer/platform/length_box.h"
-#include "third_party/blink/renderer/platform/length_point.h"
-#include "third_party/blink/renderer/platform/length_size.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 #include "third_party/blink/renderer/platform/scroll/scroll_types.h"
 #include "third_party/blink/renderer/platform/text/text_direction.h"
diff --git a/third_party/blink/renderer/core/style/fill_layer.h b/third_party/blink/renderer/core/style/fill_layer.h
index 27fc9a52..ff2f5d9 100644
--- a/third_party/blink/renderer/core/style/fill_layer.h
+++ b/third_party/blink/renderer/core/style/fill_layer.h
@@ -29,10 +29,10 @@
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/style/computed_style_constants.h"
 #include "third_party/blink/renderer/core/style/style_image.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
+#include "third_party/blink/renderer/platform/geometry/length_size.h"
 #include "third_party/blink/renderer/platform/graphics/graphics_types.h"
 #include "third_party/blink/renderer/platform/heap/persistent.h"
-#include "third_party/blink/renderer/platform/length.h"
-#include "third_party/blink/renderer/platform/length_size.h"
 #include "third_party/blink/renderer/platform/wtf/allocator.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/style/filter_operation.cc b/third_party/blink/renderer/core/style/filter_operation.cc
index fda7fde..7c077b20 100644
--- a/third_party/blink/renderer/core/style/filter_operation.cc
+++ b/third_party/blink/renderer/core/style/filter_operation.cc
@@ -27,11 +27,11 @@
 
 #include "third_party/blink/renderer/core/svg/svg_resource.h"
 #include "third_party/blink/renderer/platform/animation/animation_utilities.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/graphics/filters/fe_drop_shadow.h"
 #include "third_party/blink/renderer/platform/graphics/filters/fe_gaussian_blur.h"
 #include "third_party/blink/renderer/platform/graphics/filters/filter.h"
 #include "third_party/blink/renderer/platform/graphics/filters/filter_effect.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/style/filter_operation.h b/third_party/blink/renderer/core/style/filter_operation.h
index 93a4fb6..9e0dc81 100644
--- a/third_party/blink/renderer/core/style/filter_operation.h
+++ b/third_party/blink/renderer/core/style/filter_operation.h
@@ -30,10 +30,10 @@
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/style/shadow_data.h"
 #include "third_party/blink/renderer/platform/geometry/float_rect.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/graphics/box_reflection.h"
 #include "third_party/blink/renderer/platform/graphics/color.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
-#include "third_party/blink/renderer/platform/length.h"
 #include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/style/gap_length.h b/third_party/blink/renderer/core/style/gap_length.h
index b2a704c7..a70a322 100644
--- a/third_party/blink/renderer/core/style/gap_length.h
+++ b/third_party/blink/renderer/core/style/gap_length.h
@@ -5,7 +5,7 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_STYLE_GAP_LENGTH_H_
 #define THIRD_PARTY_BLINK_RENDERER_CORE_STYLE_GAP_LENGTH_H_
 
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/wtf/allocator.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/style/grid_length.h b/third_party/blink/renderer/core/style/grid_length.h
index 69ce48f9..0e6d874f 100644
--- a/third_party/blink/renderer/core/style/grid_length.h
+++ b/third_party/blink/renderer/core/style/grid_length.h
@@ -31,7 +31,7 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_STYLE_GRID_LENGTH_H_
 #define THIRD_PARTY_BLINK_RENDERER_CORE_STYLE_GRID_LENGTH_H_
 
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/wtf/allocator.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/style/nine_piece_image.h b/third_party/blink/renderer/core/style/nine_piece_image.h
index 69655a1..9de65875 100644
--- a/third_party/blink/renderer/core/style/nine_piece_image.h
+++ b/third_party/blink/renderer/core/style/nine_piece_image.h
@@ -29,9 +29,9 @@
 #include "third_party/blink/renderer/core/style/border_image_length_box.h"
 #include "third_party/blink/renderer/core/style/data_ref.h"
 #include "third_party/blink/renderer/core/style/style_image.h"
+#include "third_party/blink/renderer/platform/geometry/length_box.h"
 #include "third_party/blink/renderer/platform/heap/persistent.h"
 #include "third_party/blink/renderer/platform/layout_unit.h"
-#include "third_party/blink/renderer/platform/length_box.h"
 #include "third_party/blink/renderer/platform/wtf/allocator.h"
 #include "third_party/blink/renderer/platform/wtf/ref_counted.h"
 
diff --git a/third_party/blink/renderer/core/style/quad_length_value.h b/third_party/blink/renderer/core/style/quad_length_value.h
index 34b8911f..53211ccf 100644
--- a/third_party/blink/renderer/core/style/quad_length_value.h
+++ b/third_party/blink/renderer/core/style/quad_length_value.h
@@ -6,7 +6,7 @@
 #define THIRD_PARTY_BLINK_RENDERER_CORE_STYLE_QUAD_LENGTH_VALUE_H_
 
 #include <memory>
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/style/style_reflection.h b/third_party/blink/renderer/core/style/style_reflection.h
index b720299..cb2de278 100644
--- a/third_party/blink/renderer/core/style/style_reflection.h
+++ b/third_party/blink/renderer/core/style/style_reflection.h
@@ -27,7 +27,7 @@
 
 #include "third_party/blink/renderer/core/css/css_reflection_direction.h"
 #include "third_party/blink/renderer/core/style/nine_piece_image.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/wtf/ref_counted.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/style/svg_computed_style.h b/third_party/blink/renderer/core/style/svg_computed_style.h
index 29f9d0c1..3eb4bc6a 100644
--- a/third_party/blink/renderer/core/style/svg_computed_style.h
+++ b/third_party/blink/renderer/core/style/svg_computed_style.h
@@ -28,8 +28,8 @@
 #include "third_party/blink/renderer/core/style/computed_style_constants.h"
 #include "third_party/blink/renderer/core/style/data_ref.h"
 #include "third_party/blink/renderer/core/style/svg_computed_style_defs.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/graphics/graphics_types.h"
-#include "third_party/blink/renderer/platform/length.h"
 #include "third_party/blink/renderer/platform/wtf/forward.h"
 #include "third_party/blink/renderer/platform/wtf/ref_counted.h"
 
diff --git a/third_party/blink/renderer/core/style/svg_computed_style_defs.h b/third_party/blink/renderer/core/style/svg_computed_style_defs.h
index 9c510af..5920c75 100644
--- a/third_party/blink/renderer/core/style/svg_computed_style_defs.h
+++ b/third_party/blink/renderer/core/style/svg_computed_style_defs.h
@@ -31,8 +31,8 @@
 #include "base/memory/scoped_refptr.h"
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/style/style_path.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/graphics/color.h"
-#include "third_party/blink/renderer/platform/length.h"
 #include "third_party/blink/renderer/platform/wtf/allocator.h"
 #include "third_party/blink/renderer/platform/wtf/ref_counted.h"
 #include "third_party/blink/renderer/platform/wtf/ref_vector.h"
diff --git a/third_party/blink/renderer/core/style/transform_origin.h b/third_party/blink/renderer/core/style/transform_origin.h
index 923f9c97..db1ac80 100644
--- a/third_party/blink/renderer/core/style/transform_origin.h
+++ b/third_party/blink/renderer/core/style/transform_origin.h
@@ -5,7 +5,7 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_STYLE_TRANSFORM_ORIGIN_H_
 #define THIRD_PARTY_BLINK_RENDERER_CORE_STYLE_TRANSFORM_ORIGIN_H_
 
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/wtf/allocator.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/core/svg/graphics/svg_image.cc b/third_party/blink/renderer/core/svg/graphics/svg_image.cc
index 2ed010aa..b89ceb4 100644
--- a/third_party/blink/renderer/core/svg/graphics/svg_image.cc
+++ b/third_party/blink/renderer/core/svg/graphics/svg_image.cc
@@ -53,6 +53,7 @@
 #include "third_party/blink/renderer/core/svg/svg_svg_element.h"
 #include "third_party/blink/renderer/platform/bindings/script_forbidden_scope.h"
 #include "third_party/blink/renderer/platform/geometry/int_rect.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/graphics/color.h"
 #include "third_party/blink/renderer/platform/graphics/graphics_context.h"
 #include "third_party/blink/renderer/platform/graphics/image_observer.h"
@@ -62,7 +63,6 @@
 #include "third_party/blink/renderer/platform/graphics/paint/paint_record.h"
 #include "third_party/blink/renderer/platform/graphics/paint/paint_record_builder.h"
 #include "third_party/blink/renderer/platform/instrumentation/tracing/trace_event.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
 
 namespace blink {
 
@@ -680,7 +680,7 @@
     page_->Animator().ServiceScriptedAnimations(
         base::TimeTicks() +
         base::TimeDelta::FromSecondsD(root_element->getCurrentTime()));
-    GetImageObserver()->AnimationAdvanced(this);
+    GetImageObserver()->Changed(this);
   }
 }
 
@@ -766,7 +766,6 @@
     page = Page::Create(page_clients);
     page->GetSettings().SetScriptEnabled(false);
     page->GetSettings().SetPluginsEnabled(false);
-    page->GetSettings().SetAcceleratedCompositingEnabled(false);
 
     // Because this page is detached, it can't get default font settings
     // from the embedder. Copy over font settings so we have sensible
diff --git a/third_party/blink/renderer/core/svg/graphics/svg_image_test.cc b/third_party/blink/renderer/core/svg/graphics/svg_image_test.cc
index 629d8d3..429bbf6 100644
--- a/third_party/blink/renderer/core/svg/graphics/svg_image_test.cc
+++ b/third_party/blink/renderer/core/svg/graphics/svg_image_test.cc
@@ -62,7 +62,6 @@
     void DecodedSizeChangedTo(const Image*, size_t new_size) override {}
 
     bool ShouldPauseAnimation(const Image*) override { return should_pause_; }
-    void AnimationAdvanced(const Image*) override {}
 
     void Changed(const Image*) override {}
 
diff --git a/third_party/blink/renderer/core/svg/svg_length_context.cc b/third_party/blink/renderer/core/svg/svg_length_context.cc
index ae0f267..06d9526 100644
--- a/third_party/blink/renderer/core/svg/svg_length_context.cc
+++ b/third_party/blink/renderer/core/svg/svg_length_context.cc
@@ -31,7 +31,7 @@
 #include "third_party/blink/renderer/core/style/computed_style.h"
 #include "third_party/blink/renderer/core/svg/svg_svg_element.h"
 #include "third_party/blink/renderer/platform/fonts/font_metrics.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/svg/svg_length_context.h b/third_party/blink/renderer/core/svg/svg_length_context.h
index 920e842..ba97426d 100644
--- a/third_party/blink/renderer/core/svg/svg_length_context.h
+++ b/third_party/blink/renderer/core/svg/svg_length_context.h
@@ -23,7 +23,7 @@
 #include "third_party/blink/renderer/core/css/css_primitive_value.h"
 #include "third_party/blink/renderer/core/svg/svg_unit_types.h"
 #include "third_party/blink/renderer/platform/geometry/float_rect.h"
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/svg/svg_svg_element.cc b/third_party/blink/renderer/core/svg/svg_svg_element.cc
index e80aac4..ff10645 100644
--- a/third_party/blink/renderer/core/svg/svg_svg_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_svg_element.cc
@@ -54,7 +54,7 @@
 #include "third_party/blink/renderer/core/svg/svg_view_spec.h"
 #include "third_party/blink/renderer/core/svg_names.h"
 #include "third_party/blink/renderer/platform/geometry/float_rect.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/transforms/affine_transform.h"
 #include "third_party/blink/renderer/platform/wtf/math_extras.h"
 #include "third_party/blink/renderer/platform/wtf/std_lib_extras.h"
diff --git a/third_party/blink/renderer/core/testing/core_unit_test_helper.h b/third_party/blink/renderer/core/testing/core_unit_test_helper.h
index 2f2c44d..8a021ab 100644
--- a/third_party/blink/renderer/core/testing/core_unit_test_helper.h
+++ b/third_party/blink/renderer/core/testing/core_unit_test_helper.h
@@ -98,6 +98,8 @@
 
   // Both enables compositing and runs the document lifecycle.
   void EnableCompositing() {
+    // This Page is not actually being shown by a compositor, but we act like it
+    // will in order to test behaviour.
     GetPage().GetSettings().SetAcceleratedCompositingEnabled(true);
     GetDocument().View()->SetParentVisible(true);
     GetDocument().View()->SetSelfVisible(true);
diff --git a/third_party/blink/renderer/core/testing/data/longpress_image_contenteditable.html b/third_party/blink/renderer/core/testing/data/longpress_image_contenteditable.html
index b8d3622..371b400 100644
--- a/third_party/blink/renderer/core/testing/data/longpress_image_contenteditable.html
+++ b/third_party/blink/renderer/core/testing/data/longpress_image_contenteditable.html
@@ -9,7 +9,7 @@
 </head>
 <body>
 <div id="textbox" contenteditable="true">
-<img id="purpleimage" style="-webkit-logical-width:20px;-webkit-logical-height:100px;background-color:purple">
+<img id="purpleimage" style="inline-size:20px;block-size:100px;background-color:purple">
 </div>
 
 </body>
diff --git a/third_party/blink/renderer/core/testing/dummy_page_holder.cc b/third_party/blink/renderer/core/testing/dummy_page_holder.cc
index 86938f5..8c9bfdb 100644
--- a/third_party/blink/renderer/core/testing/dummy_page_holder.cc
+++ b/third_party/blink/renderer/core/testing/dummy_page_holder.cc
@@ -64,9 +64,6 @@
     page_clients.chrome_client = page_clients_argument->chrome_client;
   page_ = Page::Create(page_clients);
   Settings& settings = page_->GetSettings();
-  // FIXME: http://crbug.com/363843. This needs to find a better way to
-  // not create graphics layers.
-  settings.SetAcceleratedCompositingEnabled(false);
   if (setting_overrider)
     (*setting_overrider)(settings);
 
diff --git a/third_party/blink/renderer/devtools/front_end/elements/elementsTreeOutline.css b/third_party/blink/renderer/devtools/front_end/elements/elementsTreeOutline.css
index 6e254e76..c876f11 100644
--- a/third_party/blink/renderer/devtools/front_end/elements/elementsTreeOutline.css
+++ b/third_party/blink/renderer/devtools/front_end/elements/elementsTreeOutline.css
@@ -97,7 +97,7 @@
 .elements-disclosure ol {
     list-style-type: none;
     /** Keep it in sync with ElementsTreeElements.updateDecorators **/
-    -webkit-padding-start: 12px;
+    padding-inline-start: 12px;
     margin: 0;
 }
 
@@ -339,7 +339,7 @@
 
 li.hovered:not(.always-parent) + ol.children, .elements-tree-outline ol.shadow-root, li.selected:not(.always-parent) + ol.children {
     margin-left: 5px;
-    -webkit-padding-start: 6px;
+    padding-inline-start: 6px;
     border-width: 1px;
     border-left-style: solid;
 }
diff --git a/third_party/blink/renderer/devtools/front_end/elements/stylesSectionTree.css b/third_party/blink/renderer/devtools/front_end/elements/stylesSectionTree.css
index 43bd7e0..b80c7fe 100644
--- a/third_party/blink/renderer/devtools/front_end/elements/stylesSectionTree.css
+++ b/third_party/blink/renderer/devtools/front_end/elements/stylesSectionTree.css
@@ -89,7 +89,7 @@
 ol:not(.tree-outline) {
     display: none;
     margin: 0;
-    -webkit-padding-start: 12px;
+    padding-inline-start: 12px;
     list-style: none;
 }
 
diff --git a/third_party/blink/renderer/devtools/front_end/layer_viewer/layerDetailsView.css b/third_party/blink/renderer/devtools/front_end/layer_viewer/layerDetailsView.css
index a36c0e4..2e620dd 100644
--- a/third_party/blink/renderer/devtools/front_end/layer_viewer/layerDetailsView.css
+++ b/third_party/blink/renderer/devtools/front_end/layer_viewer/layerDetailsView.css
@@ -18,9 +18,9 @@
 
 ul {
     list-style: none;
-    -webkit-padding-start: 0;
-    -webkit-margin-before: 0;
-    -webkit-margin-after: 0;
+    padding-inline-start: 0;
+    margin-block-start: 0;
+    margin-block-end: 0;
 }
 
 a {
diff --git a/third_party/blink/renderer/devtools/front_end/persistence/PersistenceActions.js b/third_party/blink/renderer/devtools/front_end/persistence/PersistenceActions.js
index 8307698..53ebe75 100644
--- a/third_party/blink/renderer/devtools/front_end/persistence/PersistenceActions.js
+++ b/third_party/blink/renderer/devtools/front_end/persistence/PersistenceActions.js
@@ -20,7 +20,9 @@
     async function saveAs() {
       if (contentProvider instanceof Workspace.UISourceCode)
         /** @type {!Workspace.UISourceCode} */ (contentProvider).commitWorkingCopy();
-      const content = await contentProvider.requestContent();
+      let content = await contentProvider.requestContent();
+      if (await contentProvider.contentEncoded())
+        content = window.atob(content);
       const url = contentProvider.contentURL();
       Workspace.fileManager.save(url, /** @type {string} */ (content), true);
       Workspace.fileManager.close(url);
diff --git a/third_party/blink/renderer/devtools/front_end/source_frame/xmlTree.css b/third_party/blink/renderer/devtools/front_end/source_frame/xmlTree.css
index cd810c2..e6578676 100644
--- a/third_party/blink/renderer/devtools/front_end/source_frame/xmlTree.css
+++ b/third_party/blink/renderer/devtools/front_end/source_frame/xmlTree.css
@@ -8,11 +8,11 @@
     list-style: none;
     padding: 0;
     margin: 0;
-    -webkit-padding-start: 16px;
+    padding-inline-start: 16px;
 }
 
 ol.tree-outline {
-    -webkit-padding-start: 0;
+    padding-inline-start: 0;
 }
 
 .tree-outline li {
diff --git a/third_party/blink/renderer/modules/canvas/canvas2d/canvas_rendering_context_2d_test.cc b/third_party/blink/renderer/modules/canvas/canvas2d/canvas_rendering_context_2d_test.cc
index a1cb3e7..ed88c2b 100644
--- a/third_party/blink/renderer/modules/canvas/canvas2d/canvas_rendering_context_2d_test.cc
+++ b/third_party/blink/renderer/modules/canvas/canvas2d/canvas_rendering_context_2d_test.cc
@@ -666,6 +666,8 @@
 TEST_F(CanvasRenderingContext2DTest, MAYBE_GetImageDataDisablesAcceleration) {
   ScopedCanvas2dFixedRenderingModeForTest canvas_2d_fixed_rendering_mode(false);
 
+  // This Page is not actually being shown by a compositor, but we act like it
+  // will in order to test behaviour.
   GetPage().GetSettings().SetAcceleratedCompositingEnabled(true);
   CreateContext(kNonOpaque);
   IntSize size(300, 300);
@@ -1163,6 +1165,8 @@
 // In these cases, the element should request a compositing update.
 TEST_F(CanvasRenderingContext2DTestWithTestingPlatform,
        ElementRequestsCompositingUpdateOnHibernateAndWakeUp) {
+  // This Page is not actually being shown by a compositor, but we act like it
+  // will in order to test behaviour.
   GetPage().GetSettings().SetAcceleratedCompositingEnabled(true);
   CreateContext(kNonOpaque);
   IntSize size(300, 300);
diff --git a/third_party/blink/renderer/modules/mediastream/user_media_request.cc b/third_party/blink/renderer/modules/mediastream/user_media_request.cc
index 06e0ae7..f34c6c3f 100644
--- a/third_party/blink/renderer/modules/mediastream/user_media_request.cc
+++ b/third_party/blink/renderer/modules/mediastream/user_media_request.cc
@@ -372,25 +372,47 @@
     return nullptr;
 
   if (media_type == WebUserMediaRequest::MediaType::kDisplayMedia) {
-    // TODO(emircan): Support constraints after the spec change.
-    // https://w3c.github.io/mediacapture-screen-share/#constraints
-    // 5.2 Constraining Display Surface Selection
-    // The getDisplayMedia function does not permit the use of constraints for
-    // selection of a source as described in the getUserMedia() algorithm.
-    // Prior to invoking the getUserMedia() algorithm, if either of the video
-    // and audio attributes are set to a MediaTrackConstraints value (as
-    // opposed to being absent or set to a Boolean value), reject the promise
-    // with a InvalidAccessError and abort.
-    if (options.audio().IsMediaTrackConstraints() ||
-        options.video().IsMediaTrackConstraints()) {
-      error_state.ThrowDOMException(
-          DOMExceptionCode::kInvalidAccessError,
-          "getDisplayMedia() does not permit the use of constraints.");
+    // https://w3c.github.io/mediacapture-screen-share/#navigator-additions
+    // 5.1 Navigator Additions
+    // 1. Let constraints be the method's first argument.
+    // 2. For each member present in constraints whose value, value, is a
+    // dictionary, run the following steps:
+    //   1. If value contains a member named advanced, return a promise rejected
+    //   with a newly created TypeError.
+    //   2. If value contains a member which in turn is a dictionary containing
+    //   a member named either min or exact, return a promise rejected with a
+    //   newly created TypeError.
+    // 3. Let requestedMediaTypes be the set of media types in constraints with
+    // either a dictionary value or a value of true.
+    // 4. If requestedMediaTypes is the empty set, set requestedMediaTypes to a
+    // set containing "video".
+    if ((!audio.IsNull() && !audio.Advanced().empty()) ||
+        (!video.IsNull() && !video.Advanced().empty())) {
+      error_state.ThrowTypeError("Advanced constraints are not supported");
       return nullptr;
     }
-    // TODO(emircan): Enable when audio capture is supported.
+    if ((!audio.IsNull() && audio.Basic().HasMin()) ||
+        (!video.IsNull() && video.Basic().HasMin())) {
+      error_state.ThrowTypeError("min constraints are not supported");
+      return nullptr;
+    }
+    if ((!audio.IsNull() && audio.Basic().HasExact()) ||
+        (!video.IsNull() && video.Basic().HasExact())) {
+      error_state.ThrowTypeError("exact constraints are not supported");
+      return nullptr;
+    }
+    if (audio.IsNull() && video.IsNull()) {
+      video = ParseOptions(context,
+                           BooleanOrMediaTrackConstraints::FromBoolean(true),
+                           error_state);
+      if (error_state.HadException())
+        return nullptr;
+    }
+
+    // TODO(emircan): Enable when audio capture is actually supported, see
+    // https://crbug.com/896333.
     if (!options.audio().IsNull() && options.audio().GetAsBoolean()) {
-      error_state.ThrowTypeError("Audio is not supported");
+      error_state.ThrowTypeError("Audio capture is not supported");
       return nullptr;
     }
   }
diff --git a/third_party/blink/renderer/modules/speech/BUILD.gn b/third_party/blink/renderer/modules/speech/BUILD.gn
index 5597ba5fa..7a45f96 100644
--- a/third_party/blink/renderer/modules/speech/BUILD.gn
+++ b/third_party/blink/renderer/modules/speech/BUILD.gn
@@ -17,7 +17,6 @@
     "speech_recognition.h",
     "speech_recognition_alternative.cc",
     "speech_recognition_alternative.h",
-    "speech_recognition_client.h",
     "speech_recognition_controller.cc",
     "speech_recognition_controller.h",
     "speech_recognition_error.cc",
diff --git a/third_party/blink/renderer/modules/webdatabase/BUILD.gn b/third_party/blink/renderer/modules/webdatabase/BUILD.gn
index 1fff5b9..2f66e4c 100644
--- a/third_party/blink/renderer/modules/webdatabase/BUILD.gn
+++ b/third_party/blink/renderer/modules/webdatabase/BUILD.gn
@@ -45,18 +45,14 @@
     "sql_statement.h",
     "sql_statement_backend.cc",
     "sql_statement_backend.h",
-    "sql_statement_callback.h",
-    "sql_statement_error_callback.h",
     "sql_transaction.cc",
     "sql_transaction.h",
     "sql_transaction_backend.cc",
     "sql_transaction_backend.h",
-    "sql_transaction_callback.h",
     "sql_transaction_client.cc",
     "sql_transaction_client.h",
     "sql_transaction_coordinator.cc",
     "sql_transaction_coordinator.h",
-    "sql_transaction_error_callback.h",
     "sql_transaction_state.h",
     "sql_transaction_state_machine.cc",
     "sql_transaction_state_machine.h",
diff --git a/third_party/blink/renderer/modules/webusb/OWNERS b/third_party/blink/renderer/modules/webusb/OWNERS
index 3525a5f..2caff2f 100644
--- a/third_party/blink/renderer/modules/webusb/OWNERS
+++ b/third_party/blink/renderer/modules/webusb/OWNERS
@@ -1,4 +1,4 @@
 reillyg@chromium.org
-rockot@chromium.org
+rockot@google.com
 
 # COMPONENT: Blink>USB
\ No newline at end of file
diff --git a/third_party/blink/renderer/platform/BUILD.gn b/third_party/blink/renderer/platform/BUILD.gn
index 221ac9e..7bc85372 100644
--- a/third_party/blink/renderer/platform/BUILD.gn
+++ b/third_party/blink/renderer/platform/BUILD.gn
@@ -482,7 +482,6 @@
     "bindings/wrapper_creation_security_check.h",
     "bindings/wrapper_type_info.cc",
     "bindings/wrapper_type_info.h",
-    "calculation_value.h",
     "content_decryption_module_result.h",
     "content_setting_callbacks.cc",
     "content_setting_callbacks.h",
@@ -747,6 +746,7 @@
     "fonts/win/font_fallback_win.h",
     "fonts/win/font_platform_data_win.cc",
     "geometry/blend.h",
+    "geometry/calculation_value.h",
     "geometry/cg/float_point_cg.cc",
     "geometry/cg/float_rect_cg.cc",
     "geometry/cg/float_size_cg.cc",
@@ -793,6 +793,13 @@
     "geometry/layout_rect_outsets.h",
     "geometry/layout_size.cc",
     "geometry/layout_size.h",
+    "geometry/length.cc",
+    "geometry/length.h",
+    "geometry/length_box.h",
+    "geometry/length_functions.cc",
+    "geometry/length_functions.h",
+    "geometry/length_point.h",
+    "geometry/length_size.h",
     "geometry/region.cc",
     "geometry/region.h",
     "graphics/accelerated_static_bitmap_image.cc",
@@ -1162,13 +1169,6 @@
     "layout_test_support.h",
     "layout_unit.cc",
     "layout_unit.h",
-    "length.cc",
-    "length.h",
-    "length_box.h",
-    "length_functions.cc",
-    "length_functions.h",
-    "length_point.h",
-    "length_size.h",
     "lifecycle_notifier.h",
     "lifecycle_observer.h",
     "link_hash.cc",
diff --git a/third_party/blink/renderer/platform/exported/web_media_constraints.cc b/third_party/blink/renderer/platform/exported/web_media_constraints.cc
index a97a407..d3add3af 100644
--- a/third_party/blink/renderer/platform/exported/web_media_constraints.cc
+++ b/third_party/blink/renderer/platform/exported/web_media_constraints.cc
@@ -161,6 +161,10 @@
 
 BaseConstraint::~BaseConstraint() = default;
 
+bool BaseConstraint::HasMandatory() const {
+  return HasMin() || HasMax() || HasExact();
+}
+
 LongConstraint::LongConstraint(const char* name)
     : BaseConstraint(name),
       min_(),
@@ -189,10 +193,6 @@
   return !has_min_ && !has_max_ && !has_exact_ && !has_ideal_;
 }
 
-bool LongConstraint::HasMandatory() const {
-  return has_min_ || has_max_ || has_exact_;
-}
-
 WebString LongConstraint::ToString() const {
   StringBuilder builder;
   builder.Append('{');
@@ -235,10 +235,6 @@
   return !has_min_ && !has_max_ && !has_exact_ && !has_ideal_;
 }
 
-bool DoubleConstraint::HasMandatory() const {
-  return has_min_ || has_max_ || has_exact_;
-}
-
 WebString DoubleConstraint::ToString() const {
   StringBuilder builder;
   builder.Append('{');
@@ -269,10 +265,6 @@
   return exact_.empty() && ideal_.empty();
 }
 
-bool StringConstraint::HasMandatory() const {
-  return !exact_.empty();
-}
-
 const WebVector<WebString>& StringConstraint::Exact() const {
   return exact_;
 }
@@ -333,10 +325,6 @@
   return !has_ideal_ && !has_exact_;
 }
 
-bool BooleanConstraint::HasMandatory() const {
-  return has_exact_;
-}
-
 WebString BooleanConstraint::ToString() const {
   StringBuilder builder;
   builder.Append('{');
@@ -496,6 +484,22 @@
   return HasMandatoryOutsideSet(std::vector<std::string>(), dummy_string);
 }
 
+bool WebMediaTrackConstraintSet::HasMin() const {
+  for (auto* const constraint : AllConstraints()) {
+    if (constraint->HasMin())
+      return true;
+  }
+  return false;
+}
+
+bool WebMediaTrackConstraintSet::HasExact() const {
+  for (auto* const constraint : AllConstraints()) {
+    if (constraint->HasExact())
+      return true;
+  }
+  return false;
+}
+
 WebString WebMediaTrackConstraintSet::ToString() const {
   StringBuilder builder;
   bool first = true;
diff --git a/third_party/blink/renderer/platform/exported/web_runtime_features.cc b/third_party/blink/renderer/platform/exported/web_runtime_features.cc
index 384d527..7a062a2 100644
--- a/third_party/blink/renderer/platform/exported/web_runtime_features.cc
+++ b/third_party/blink/renderer/platform/exported/web_runtime_features.cc
@@ -64,6 +64,10 @@
   RuntimeEnabledFeatures::SetFeatureEnabledFromString(name, enable);
 }
 
+bool WebRuntimeFeatures::IsBlinkGenPropertyTreesEnabled() {
+  return RuntimeEnabledFeatures::BlinkGenPropertyTreesEnabled();
+}
+
 void WebRuntimeFeatures::EnableTestOnlyFeatures(bool enable) {
   RuntimeEnabledFeatures::SetTestFeaturesEnabled(enable);
 }
@@ -332,8 +336,8 @@
   RuntimeEnabledFeatures::SetScriptedSpeechEnabled(enable);
 }
 
-void WebRuntimeFeatures::EnableSlimmingPaintV2(bool enable) {
-  RuntimeEnabledFeatures::SetSlimmingPaintV2Enabled(enable);
+bool WebRuntimeFeatures::IsSlimmingPaintV2Enabled() {
+  return RuntimeEnabledFeatures::SlimmingPaintV2Enabled();
 }
 
 void WebRuntimeFeatures::EnableUserActivationV2(bool enable) {
diff --git a/third_party/blink/renderer/platform/calculation_value.h b/third_party/blink/renderer/platform/geometry/calculation_value.h
similarity index 88%
rename from third_party/blink/renderer/platform/calculation_value.h
rename to third_party/blink/renderer/platform/geometry/calculation_value.h
index 060dfe716..24c7ae0 100644
--- a/third_party/blink/renderer/platform/calculation_value.h
+++ b/third_party/blink/renderer/platform/geometry/calculation_value.h
@@ -28,12 +28,12 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef THIRD_PARTY_BLINK_RENDERER_PLATFORM_CALCULATION_VALUE_H_
-#define THIRD_PARTY_BLINK_RENDERER_PLATFORM_CALCULATION_VALUE_H_
+#ifndef THIRD_PARTY_BLINK_RENDERER_PLATFORM_GEOMETRY_CALCULATION_VALUE_H_
+#define THIRD_PARTY_BLINK_RENDERER_PLATFORM_GEOMETRY_CALCULATION_VALUE_H_
 
 #include "base/memory/scoped_refptr.h"
-#include "third_party/blink/renderer/platform/length.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/wtf/ref_counted.h"
 
 namespace blink {
@@ -70,4 +70,4 @@
 
 }  // namespace blink
 
-#endif  // THIRD_PARTY_BLINK_RENDERER_PLATFORM_CALCULATION_VALUE_H_
+#endif  // THIRD_PARTY_BLINK_RENDERER_PLATFORM_GEOMETRY_CALCULATION_VALUE_H_
diff --git a/third_party/blink/renderer/platform/length.cc b/third_party/blink/renderer/platform/geometry/length.cc
similarity index 96%
rename from third_party/blink/renderer/platform/length.cc
rename to third_party/blink/renderer/platform/geometry/length.cc
index 6ddb1526..da185538 100644
--- a/third_party/blink/renderer/platform/length.cc
+++ b/third_party/blink/renderer/platform/geometry/length.cc
@@ -23,11 +23,11 @@
  *
  */
 
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 
 #include "base/macros.h"
-#include "third_party/blink/renderer/platform/animation/animation_utilities.h"
-#include "third_party/blink/renderer/platform/calculation_value.h"
+#include "third_party/blink/renderer/platform/geometry/blend.h"
+#include "third_party/blink/renderer/platform/geometry/calculation_value.h"
 #include "third_party/blink/renderer/platform/wtf/hash_map.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/platform/length.h b/third_party/blink/renderer/platform/geometry/length.h
similarity index 97%
rename from third_party/blink/renderer/platform/length.h
rename to third_party/blink/renderer/platform/geometry/length.h
index 081a103..5be6397 100644
--- a/third_party/blink/renderer/platform/length.h
+++ b/third_party/blink/renderer/platform/geometry/length.h
@@ -20,8 +20,8 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef THIRD_PARTY_BLINK_RENDERER_PLATFORM_LENGTH_H_
-#define THIRD_PARTY_BLINK_RENDERER_PLATFORM_LENGTH_H_
+#ifndef THIRD_PARTY_BLINK_RENDERER_PLATFORM_GEOMETRY_LENGTH_H_
+#define THIRD_PARTY_BLINK_RENDERER_PLATFORM_GEOMETRY_LENGTH_H_
 
 #include "third_party/blink/renderer/platform/layout_unit.h"
 #include "third_party/blink/renderer/platform/platform_export.h"
@@ -305,4 +305,4 @@
 
 }  // namespace blink
 
-#endif  // THIRD_PARTY_BLINK_RENDERER_PLATFORM_LENGTH_H_
+#endif  // THIRD_PARTY_BLINK_RENDERER_PLATFORM_GEOMETRY_LENGTH_H_
diff --git a/third_party/blink/renderer/platform/length_box.h b/third_party/blink/renderer/platform/geometry/length_box.h
similarity index 86%
rename from third_party/blink/renderer/platform/length_box.h
rename to third_party/blink/renderer/platform/geometry/length_box.h
index 62e23d47..f8008943 100644
--- a/third_party/blink/renderer/platform/length_box.h
+++ b/third_party/blink/renderer/platform/geometry/length_box.h
@@ -19,13 +19,11 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef THIRD_PARTY_BLINK_RENDERER_PLATFORM_LENGTH_BOX_H_
-#define THIRD_PARTY_BLINK_RENDERER_PLATFORM_LENGTH_BOX_H_
+#ifndef THIRD_PARTY_BLINK_RENDERER_PLATFORM_GEOMETRY_LENGTH_BOX_H_
+#define THIRD_PARTY_BLINK_RENDERER_PLATFORM_GEOMETRY_LENGTH_BOX_H_
 
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/platform_export.h"
-#include "third_party/blink/renderer/platform/text/text_direction.h"
-#include "third_party/blink/renderer/platform/text/writing_mode.h"
 #include "third_party/blink/renderer/platform/wtf/allocator.h"
 
 namespace blink {
@@ -79,4 +77,4 @@
 
 }  // namespace blink
 
-#endif  // THIRD_PARTY_BLINK_RENDERER_PLATFORM_LENGTH_BOX_H_
+#endif  // THIRD_PARTY_BLINK_RENDERER_PLATFORM_GEOMETRY_LENGTH_BOX_H_
diff --git a/third_party/blink/renderer/platform/length_functions.cc b/third_party/blink/renderer/platform/geometry/length_functions.cc
similarity index 95%
rename from third_party/blink/renderer/platform/length_functions.cc
rename to third_party/blink/renderer/platform/geometry/length_functions.cc
index 0fa4f38b..75b5c16 100644
--- a/third_party/blink/renderer/platform/length_functions.cc
+++ b/third_party/blink/renderer/platform/geometry/length_functions.cc
@@ -21,13 +21,13 @@
     Boston, MA 02110-1301, USA.
 */
 
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 
 #include "third_party/blink/renderer/platform/geometry/float_point.h"
 #include "third_party/blink/renderer/platform/geometry/float_size.h"
+#include "third_party/blink/renderer/platform/geometry/length_point.h"
+#include "third_party/blink/renderer/platform/geometry/length_size.h"
 #include "third_party/blink/renderer/platform/layout_unit.h"
-#include "third_party/blink/renderer/platform/length_point.h"
-#include "third_party/blink/renderer/platform/length_size.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/platform/length_functions.h b/third_party/blink/renderer/platform/geometry/length_functions.h
similarity index 90%
rename from third_party/blink/renderer/platform/length_functions.h
rename to third_party/blink/renderer/platform/geometry/length_functions.h
index 8d1626f..13219213 100644
--- a/third_party/blink/renderer/platform/length_functions.h
+++ b/third_party/blink/renderer/platform/geometry/length_functions.h
@@ -21,8 +21,8 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef THIRD_PARTY_BLINK_RENDERER_PLATFORM_LENGTH_FUNCTIONS_H_
-#define THIRD_PARTY_BLINK_RENDERER_PLATFORM_LENGTH_FUNCTIONS_H_
+#ifndef THIRD_PARTY_BLINK_RENDERER_PLATFORM_GEOMETRY_LENGTH_FUNCTIONS_H_
+#define THIRD_PARTY_BLINK_RENDERER_PLATFORM_GEOMETRY_LENGTH_FUNCTIONS_H_
 
 #include "third_party/blink/renderer/platform/platform_export.h"
 
@@ -51,4 +51,4 @@
 
 }  // namespace blink
 
-#endif  // THIRD_PARTY_BLINK_RENDERER_PLATFORM_LENGTH_FUNCTIONS_H_
+#endif  // THIRD_PARTY_BLINK_RENDERER_PLATFORM_GEOMETRY_LENGTH_FUNCTIONS_H_
diff --git a/third_party/blink/renderer/platform/length_point.h b/third_party/blink/renderer/platform/geometry/length_point.h
similarity index 88%
rename from third_party/blink/renderer/platform/length_point.h
rename to third_party/blink/renderer/platform/geometry/length_point.h
index 3d9eb5b5..8826ec3 100644
--- a/third_party/blink/renderer/platform/length_point.h
+++ b/third_party/blink/renderer/platform/geometry/length_point.h
@@ -27,10 +27,10 @@
  * OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef THIRD_PARTY_BLINK_RENDERER_PLATFORM_LENGTH_POINT_H_
-#define THIRD_PARTY_BLINK_RENDERER_PLATFORM_LENGTH_POINT_H_
+#ifndef THIRD_PARTY_BLINK_RENDERER_PLATFORM_GEOMETRY_LENGTH_POINT_H_
+#define THIRD_PARTY_BLINK_RENDERER_PLATFORM_GEOMETRY_LENGTH_POINT_H_
 
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/wtf/allocator.h"
 
 namespace blink {
@@ -63,4 +63,4 @@
 
 }  // namespace blink
 
-#endif  // THIRD_PARTY_BLINK_RENDERER_PLATFORM_LENGTH_POINT_H_
+#endif  // THIRD_PARTY_BLINK_RENDERER_PLATFORM_GEOMETRY_LENGTH_POINT_H_
diff --git a/third_party/blink/renderer/platform/length_size.h b/third_party/blink/renderer/platform/geometry/length_size.h
similarity index 84%
rename from third_party/blink/renderer/platform/length_size.h
rename to third_party/blink/renderer/platform/geometry/length_size.h
index 5e7eef21..a0e2ea1 100644
--- a/third_party/blink/renderer/platform/length_size.h
+++ b/third_party/blink/renderer/platform/geometry/length_size.h
@@ -18,10 +18,10 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef THIRD_PARTY_BLINK_RENDERER_PLATFORM_LENGTH_SIZE_H_
-#define THIRD_PARTY_BLINK_RENDERER_PLATFORM_LENGTH_SIZE_H_
+#ifndef THIRD_PARTY_BLINK_RENDERER_PLATFORM_GEOMETRY_LENGTH_SIZE_H_
+#define THIRD_PARTY_BLINK_RENDERER_PLATFORM_GEOMETRY_LENGTH_SIZE_H_
 
-#include "third_party/blink/renderer/platform/length.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/wtf/allocator.h"
 
 namespace blink {
@@ -52,4 +52,4 @@
 
 }  // namespace blink
 
-#endif  // THIRD_PARTY_BLINK_RENDERER_PLATFORM_LENGTH_SIZE_H_
+#endif  // THIRD_PARTY_BLINK_RENDERER_PLATFORM_GEOMETRY_LENGTH_SIZE_H_
diff --git a/third_party/blink/renderer/platform/graphics/DEPS b/third_party/blink/renderer/platform/graphics/DEPS
index 11fa8ee..4a56a8d8 100644
--- a/third_party/blink/renderer/platform/graphics/DEPS
+++ b/third_party/blink/renderer/platform/graphics/DEPS
@@ -35,7 +35,6 @@
     "+third_party/blink/renderer/platform/image-encoders",
     "+third_party/blink/renderer/platform/instrumentation",
     "+third_party/blink/renderer/platform/json",
-    "+third_party/blink/renderer/platform/length.h",
     "+third_party/blink/renderer/platform/mojo/mojo_helper.h",
     "+third_party/blink/renderer/platform/platform_export.h",
     "+third_party/blink/renderer/platform/runtime_enabled_features.h",
diff --git a/third_party/blink/renderer/platform/graphics/bitmap_image_test.cc b/third_party/blink/renderer/platform/graphics/bitmap_image_test.cc
index 42e7b288..3674ed90 100644
--- a/third_party/blink/renderer/platform/graphics/bitmap_image_test.cc
+++ b/third_party/blink/renderer/platform/graphics/bitmap_image_test.cc
@@ -107,16 +107,12 @@
       last_decoded_size_ = new_size;
     }
     bool ShouldPauseAnimation(const Image*) override { return false; }
-    void AnimationAdvanced(const Image*) override {
-      animation_advanced_ = true;
-    }
     void AsyncLoadCompleted(const Image*) override { NOTREACHED(); }
 
     void Changed(const Image*) override {}
 
     size_t last_decoded_size_;
     int last_decoded_size_changed_delta_;
-    bool animation_advanced_ = false;
   };
 
   static scoped_refptr<SharedBuffer> ReadFile(const char* file_name) {
diff --git a/third_party/blink/renderer/platform/graphics/image.cc b/third_party/blink/renderer/platform/graphics/image.cc
index 0bbc9c4..ce81ad4a 100644
--- a/third_party/blink/renderer/platform/graphics/image.cc
+++ b/third_party/blink/renderer/platform/graphics/image.cc
@@ -35,6 +35,7 @@
 #include "third_party/blink/renderer/platform/geometry/float_point.h"
 #include "third_party/blink/renderer/platform/geometry/float_rect.h"
 #include "third_party/blink/renderer/platform/geometry/float_size.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/graphics/bitmap_image.h"
 #include "third_party/blink/renderer/platform/graphics/deferred_image_decoder.h"
 #include "third_party/blink/renderer/platform/graphics/graphics_context.h"
@@ -44,7 +45,6 @@
 #include "third_party/blink/renderer/platform/graphics/scoped_interpolation_quality.h"
 #include "third_party/blink/renderer/platform/histogram.h"
 #include "third_party/blink/renderer/platform/instrumentation/tracing/trace_event.h"
-#include "third_party/blink/renderer/platform/length.h"
 #include "third_party/blink/renderer/platform/shared_buffer.h"
 #include "third_party/blink/renderer/platform/wtf/std_lib_extras.h"
 #include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
diff --git a/third_party/blink/renderer/platform/graphics/image_observer.h b/third_party/blink/renderer/platform/graphics/image_observer.h
index 38db5dcd..db0a5275 100644
--- a/third_party/blink/renderer/platform/graphics/image_observer.h
+++ b/third_party/blink/renderer/platform/graphics/image_observer.h
@@ -43,7 +43,6 @@
   virtual void DecodedSizeChangedTo(const Image*, size_t new_size) = 0;
 
   virtual bool ShouldPauseAnimation(const Image*) = 0;
-  virtual void AnimationAdvanced(const Image*) = 0;
 
   // Notification for when the image's contents have changed such as when an
   // SVG image animates.
diff --git a/third_party/blink/renderer/platform/scheduler/BUILD.gn b/third_party/blink/renderer/platform/scheduler/BUILD.gn
index 0988dd1..390f55f 100644
--- a/third_party/blink/renderer/platform/scheduler/BUILD.gn
+++ b/third_party/blink/renderer/platform/scheduler/BUILD.gn
@@ -111,7 +111,6 @@
     "util/thread_cpu_throttler.h",
     "util/thread_load_tracker.cc",
     "util/thread_load_tracker.h",
-    "util/thread_type.h",
     "util/tracing_helper.cc",
     "util/tracing_helper.h",
     "worker/compositor_metrics_helper.cc",
diff --git a/third_party/blink/renderer/platform/theme.h b/third_party/blink/renderer/platform/theme.h
index fb4f97d..9b017dc 100644
--- a/third_party/blink/renderer/platform/theme.h
+++ b/third_party/blink/renderer/platform/theme.h
@@ -28,9 +28,9 @@
 
 #include "third_party/blink/renderer/platform/fonts/font_description.h"
 #include "third_party/blink/renderer/platform/geometry/int_rect.h"
+#include "third_party/blink/renderer/platform/geometry/length_box.h"
+#include "third_party/blink/renderer/platform/geometry/length_size.h"
 #include "third_party/blink/renderer/platform/graphics/color.h"
-#include "third_party/blink/renderer/platform/length_box.h"
-#include "third_party/blink/renderer/platform/length_size.h"
 #include "third_party/blink/renderer/platform/platform_export.h"
 #include "third_party/blink/renderer/platform/theme_types.h"
 #include "third_party/blink/renderer/platform/wtf/allocator.h"
diff --git a/third_party/blink/renderer/platform/transforms/DEPS b/third_party/blink/renderer/platform/transforms/DEPS
index ab6d0043..4058e92 100644
--- a/third_party/blink/renderer/platform/transforms/DEPS
+++ b/third_party/blink/renderer/platform/transforms/DEPS
@@ -9,7 +9,5 @@
     "+third_party/blink/renderer/platform/cpu/mips/common_macros_msa.h",
     "+third_party/blink/renderer/platform/geometry",
     "+third_party/blink/renderer/platform/json",
-    "+third_party/blink/renderer/platform/length_functions.h",
-    "+third_party/blink/renderer/platform/length.h",
     "+third_party/blink/renderer/platform/wtf",
 ]
diff --git a/third_party/blink/renderer/platform/transforms/translate_transform_operation.h b/third_party/blink/renderer/platform/transforms/translate_transform_operation.h
index 3657ccb2..ebb90a23 100644
--- a/third_party/blink/renderer/platform/transforms/translate_transform_operation.h
+++ b/third_party/blink/renderer/platform/transforms/translate_transform_operation.h
@@ -25,8 +25,8 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_PLATFORM_TRANSFORMS_TRANSLATE_TRANSFORM_OPERATION_H_
 #define THIRD_PARTY_BLINK_RENDERER_PLATFORM_TRANSFORMS_TRANSLATE_TRANSFORM_OPERATION_H_
 
-#include "third_party/blink/renderer/platform/length.h"
-#include "third_party/blink/renderer/platform/length_functions.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
+#include "third_party/blink/renderer/platform/geometry/length_functions.h"
 #include "third_party/blink/renderer/platform/transforms/transform_operation.h"
 
 namespace blink {
diff --git a/third_party/blink/renderer/platform/wtf/text/wtf_string.h b/third_party/blink/renderer/platform/wtf/text/wtf_string.h
index f1755fb..ec1f22ad 100644
--- a/third_party/blink/renderer/platform/wtf/text/wtf_string.h
+++ b/third_party/blink/renderer/platform/wtf/text/wtf_string.h
@@ -30,8 +30,6 @@
 #include "build/build_config.h"
 #include "third_party/blink/renderer/platform/wtf/allocator.h"
 #include "third_party/blink/renderer/platform/wtf/compiler.h"
-#include "third_party/blink/renderer/platform/wtf/hash_table_deleted_value_type.h"
-#include "third_party/blink/renderer/platform/wtf/text/ascii_fast_path.h"
 #include "third_party/blink/renderer/platform/wtf/text/string_impl.h"
 #include "third_party/blink/renderer/platform/wtf/text/string_view.h"
 #include "third_party/blink/renderer/platform/wtf/wtf_export.h"
@@ -677,7 +675,6 @@
 using WTF::String;
 using WTF::g_empty_string;
 using WTF::g_empty_string16_bit;
-using WTF::CharactersAreAllASCII;
 using WTF::Equal;
 using WTF::Find;
 using WTF::IsSpaceOrNewline;
diff --git a/third_party/google_appengine_cloudstorage/OWNERS b/third_party/google_appengine_cloudstorage/OWNERS
index afedaca..0ec9365 100644
--- a/third_party/google_appengine_cloudstorage/OWNERS
+++ b/third_party/google_appengine_cloudstorage/OWNERS
@@ -1,3 +1,3 @@
 jyasskin@chromium.org
 mangini@chromium.org
-rockot@chromium.org
+rockot@google.com
diff --git a/third_party/markdown/OWNERS b/third_party/markdown/OWNERS
index 8d3df35..3977817 100644
--- a/third_party/markdown/OWNERS
+++ b/third_party/markdown/OWNERS
@@ -1,2 +1,2 @@
 hukun@chromium.org
-rockot@chromium.org
+rockot@google.com
diff --git a/third_party/motemplate/OWNERS b/third_party/motemplate/OWNERS
index 25fd31a..e06924a 100644
--- a/third_party/motemplate/OWNERS
+++ b/third_party/motemplate/OWNERS
@@ -1 +1 @@
-rockot@chromium.org
+rockot@google.com
diff --git a/third_party/simplejson/OWNERS b/third_party/simplejson/OWNERS
index 5a014d1..c0f9d6f 100644
--- a/third_party/simplejson/OWNERS
+++ b/third_party/simplejson/OWNERS
@@ -1,2 +1,2 @@
 asargent@chromium.org
-rockot@chromium.org
+rockot@google.com
diff --git a/third_party/wayland-protocols/BUILD.gn b/third_party/wayland-protocols/BUILD.gn
index d79374e..3a931ce 100644
--- a/third_party/wayland-protocols/BUILD.gn
+++ b/third_party/wayland-protocols/BUILD.gn
@@ -385,3 +385,24 @@
 
   public_configs = [ ":notification_shell_protocol_config" ]
 }
+
+config("fullscreen_shell_protocol_config") {
+  include_dirs = [ "include/protocol" ]
+}
+
+source_set("fullscreen_shell_protocol") {
+  sources = [
+    "include/protocol/fullscreen-shell-unstable-v1-client-protocol.h",
+    "include/protocol/fullscreen-shell-unstable-v1-server-protocol.h",
+    "protocol/fullscreen-shell-v1-protocol.c",
+  ]
+
+  deps = [
+    "//third_party/wayland:wayland_util",
+  ]
+
+  configs -= [ "//build/config/compiler:chromium_code" ]
+  configs += [ "//build/config/compiler:no_chromium_code" ]
+
+  public_configs = [ ":fullscreen_shell_protocol_config" ]
+}
diff --git a/tools/binary_size/libsupersize/static/viewer.html b/tools/binary_size/libsupersize/static/viewer.html
index 0b24204d..47b05cb 100644
--- a/tools/binary_size/libsupersize/static/viewer.html
+++ b/tools/binary_size/libsupersize/static/viewer.html
@@ -95,7 +95,7 @@
         <label class="checkbox-label" for="methodcount">Method Count Mode</label>
       </div>
       <p class="select-wrapper">
-        <select id="byteunit" name="byteunit" data-dynamic>
+        <select id="byteunit" class="sel-big" name="byteunit" data-dynamic>
           <option value="B">B - bytes</option>
           <option value="KiB" selected>KiB - kibibytes</option>
           <option value="MiB">MiB - mebibytes</option>
diff --git a/tools/fuchsia/fidlgen_js/gen.py b/tools/fuchsia/fidlgen_js/gen.py
index c90f74b..9a16cba 100755
--- a/tools/fuchsia/fidlgen_js/gen.py
+++ b/tools/fuchsia/fidlgen_js/gen.py
@@ -104,6 +104,8 @@
   def __init__(self, fidl, output_file):
     self.fidl = fidl
     self.f = output_file
+    self.output_deferred_to_eof = ''
+    self.type_table_defined = set()
 
   def Compile(self):
     self._EmitHeader()
@@ -113,11 +115,13 @@
       self._CompileEnum(e)
     if self.fidl.union_declarations:
       raise NotImplementedError()
-    if self.fidl.struct_declarations:
-      raise NotImplementedError()
+    for s in self.fidl.struct_declarations:
+      self._CompileStruct(s)
     for i in self.fidl.interface_declarations:
       self._CompileInterface(i)
 
+    self.f.write(self.output_deferred_to_eof)
+
   def _EmitHeader(self):
     self.f.write('''// Copyright 2018 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
@@ -150,6 +154,64 @@
     self.f.write('};\n')
     self.f.write('const _kTT_%(name)s = _kTT_%(type)s;\n\n' % data)
 
+  def _CompileStruct(self, struct):
+    compound = _ParseCompoundIdentifier(struct.name)
+    name = _CompileCompoundIdentifier(compound)
+    param_names = [_ChangeIfReserved(x.name) for x in struct.members]
+    # TODO(crbug.com/883496): @param and types.
+    self.f.write('''/**
+ * @constructor
+ * @struct
+ */
+function %(name)s(%(param_names)s) {
+''' % { 'name': name,
+        'param_names': ', '.join(param_names) })
+    for member in struct.members:
+      member_name = _ChangeIfReserved(member.name)
+      value = '%(member_name)s'
+      if member.maybe_default_value:
+        value = ('(%(member_name)s !== undefined) ? %(member_name)s : ' +
+                 _CompileConstant(member.maybe_default_value))
+      self.f.write(('  this.%(member_name)s = ' + value + ';\n') %
+                   { 'member_name': member_name })
+    self.f.write('}\n\n')
+
+    self.f.write(
+'''const _kTT_%(name)s = {
+  enc: function(e, o, v) {
+''' % { 'name': name })
+
+    for member in struct.members:
+      element_ttname = self._CompileType(member.type)
+      self.f.write(
+          '    _kTT_%(element_ttname)s.enc('
+          'e, o + %(offset)s, v.%(member_name)s);\n' % {
+            'element_ttname': element_ttname,
+            'offset': member.offset,
+            'member_name': _ChangeIfReserved(member.name)
+          })
+
+    self.f.write(
+'''  },
+  dec: function(d, o) {
+''')
+
+    for member in struct.members:
+      element_ttname = self._CompileType(member.type)
+      self.f.write(
+          '    var $temp_%(member_name)s = _kTT_%(element_ttname)s.dec('
+          'd, o + %(offset)s);\n' % {
+            'element_ttname': element_ttname,
+            'offset': member.offset,
+            'member_name': _ChangeIfReserved(member.name)
+          })
+    self.f.write('''    return new %(name)s(%(temp_names)s);
+  }
+};
+
+''' % { 'name': name,
+        'temp_names': ', '.join(['$temp_' + x for x in param_names]) })
+
 
   def _CompileType(self, t):
     if t.kind == TypeKind.PRIMITIVE:
@@ -173,15 +235,19 @@
       e.data.setUint32(o + 12, 0xffffffff, $fidl__kLE);
     }'''
       if not t.nullable:
-        throw_if_null = ('if (v === null || v === undefined) '
-                         'throw "non-null vector required";')
+        throw_if_null_enc = ('if (v === null || v === undefined) '
+                             'throw "non-null vector required";')
+        throw_if_null_dec = ('if (pointer === 0) '
+                             'throw "non-null vector required";')
         pointer_set = '''    e.data.setUint32(o + 8, 0xffffffff, $fidl__kLE);
     e.data.setUint32(o + 12, 0xffffffff, $fidl__kLE);'''
 
-      self.f.write(
+      if ttname not in self.type_table_defined:
+        self.type_table_defined.add(ttname)
+        self.output_deferred_to_eof += (
 '''const _kTT_%(ttname)s = {
   enc: function(e, o, v) {
-    %(throw_if_null)s
+    %(throw_if_null_enc)s
     e.data.setUint32(o, v.length, $fidl__kLE);
     e.data.setUint32(o + 4, 0, $fidl__kLE);
 %(pointer_set)s
@@ -193,13 +259,26 @@
       },
       v]);
   },
+  dec: function(d, o) {
+    var len = d.data.getUint32(o, $fidl__kLE);
+    var pointer = d.data.getUint32(o + 8, $fidl__kLE);
+    %(throw_if_null_dec)s
+    var dataOffset = d.claimMemory(len * %(element_size)s);
+    var result = [];
+    for (var i = 0; i < len; i++) {
+      result.push(_kTT_%(element_ttname)s.dec(
+          d, dataOffset + (i * %(element_size)s)));
+    }
+    return result;
+  }
 };
 
 ''' % { 'ttname': ttname,
         'element_ttname': element_ttname,
         'element_size': _InlineSizeOfType(t.element_type),
         'pointer_set': pointer_set,
-        'throw_if_null': throw_if_null })
+        'throw_if_null_enc': throw_if_null_enc,
+        'throw_if_null_dec': throw_if_null_dec })
       return ttname
     else:
       raise NotImplementedError()
@@ -296,6 +375,9 @@
 ''')
 
       if method.has_response:
+        type_tables = []
+        for param in method.maybe_response:
+          type_tables.append(self._CompileType(param.type))
         self.f.write('''
   return zx
       .objectWaitOne(this.channel, zx.ZX_CHANNEL_READABLE, zx.ZX_TIME_INFINITE)
diff --git a/tools/fuchsia/fidlgen_js/runtime/fidl.mjs b/tools/fuchsia/fidlgen_js/runtime/fidl.mjs
index 54e4558..6145229e 100644
--- a/tools/fuchsia/fidlgen_js/runtime/fidl.mjs
+++ b/tools/fuchsia/fidlgen_js/runtime/fidl.mjs
@@ -104,6 +104,7 @@
   this.handles = handles;
   this.nextOffset = 0;
   this.nextHandle = 0;
+  this.claimMemory($fidl_kMessageHeaderSize);
 }
 
 /**
@@ -111,7 +112,7 @@
  */
 $fidl_Decoder.prototype.claimMemory = function(size) {
   var result = this.nextOffset;
-  this.nextOffset = $fidl__align(size);
+  this.nextOffset = $fidl__align(this.nextOffset + size);
   return result;
 }
 
@@ -121,6 +122,11 @@
 
 
 // Type tables and encoding helpers for generated Proxy code.
+const _kTT_bool = {
+  enc: function(e, o, v) { e.data.setInt8(o, v ? 1 : 0); },
+  dec: function(d, o) { return d.data.getInt8(o) != 0; },
+};
+
 const _kTT_int8 = {
   enc: function(e, o, v) { e.data.setInt8(o, v); },
   dec: function(d, o) { return d.data.getInt8(o); },
@@ -163,6 +169,13 @@
     e.data.setUint32(o + 12, 0xffffffff, $fidl__kLE);
     e.outOfLine.push([$fidl_OutOfLineStringEnc, asUtf8]);
   },
+  dec: function(d, o) {
+    var len = d.data.getUint32(o, $fidl__kLE);
+    var pointer = d.data.getUint32(o + 8, $fidl__kLE);
+    if (pointer === 0) throw "non-null string required";
+    var dataOffset = d.claimMemory(len);
+    return zx.utf8ArrayToStr(new DataView(d.data.buffer, dataOffset, len));
+  }
 };
 
 function $fidl_OutOfLineStringEnc(e, strAsUtf8Array) {
diff --git a/tools/fuchsia/fidlgen_js/runtime/zircon.cc b/tools/fuchsia/fidlgen_js/runtime/zircon.cc
index a2678584..127d9ed 100644
--- a/tools/fuchsia/fidlgen_js/runtime/zircon.cc
+++ b/tools/fuchsia/fidlgen_js/runtime/zircon.cc
@@ -281,6 +281,20 @@
   return gin::ConvertToV8(args->isolate(), data);
 }
 
+v8::Local<v8::Value> Utf8ArrayToStr(gin::Arguments* args) {
+  gin::ArrayBufferView data;
+  if (!args->GetNext(&data)) {
+    args->ThrowError();
+    return v8::Local<v8::Value>();
+  }
+
+  // Get the UTF-8 out into a string, and then rely on ConvertToV8 to convert
+  // that to a UCS-2 string.
+  return gin::StringToV8(
+      args->isolate(), base::StringPiece(static_cast<const char*>(data.bytes()),
+                                         data.num_bytes()));
+}
+
 v8::Local<v8::Object> GetOrCreateZxObject(v8::Isolate* isolate,
                                           v8::Local<v8::Object> global) {
   v8::Local<v8::Object> zx;
@@ -389,14 +403,18 @@
   SET_CONSTANT(ZX_CHANNEL_MAX_MSG_BYTES);
   SET_CONSTANT(ZX_CHANNEL_MAX_MSG_HANDLES);
 
-  // Utility to make string handling easier to convert from a UCS2 JS string to
-  // an array of UTF-8 (which is how strings are represented in FIDL).
+  // Utilities to make string handling easier to convert to/from UCS-2 (JS) <->
+  // UTF-8 (FIDL).
   // TODO(crbug.com/883496): This is not really zx, should move to a generic
   // runtime helper file if there are more similar C++ helpers required.
   zx->Set(
       gin::StringToSymbol(isolate, "strToUtf8Array"),
       gin::CreateFunctionTemplate(isolate, base::BindRepeating(&StrToUtf8Array))
           ->GetFunction());
+  zx->Set(
+      gin::StringToSymbol(isolate, "utf8ArrayToStr"),
+      gin::CreateFunctionTemplate(isolate, base::BindRepeating(&Utf8ArrayToStr))
+          ->GetFunction());
 
 #undef SET_CONSTANT
 }
diff --git a/tools/fuchsia/fidlgen_js/test/fidlgen_js_unittest.cc b/tools/fuchsia/fidlgen_js/test/fidlgen_js_unittest.cc
index baeb61a3..fffde93c 100644
--- a/tools/fuchsia/fidlgen_js/test/fidlgen_js_unittest.cc
+++ b/tools/fuchsia/fidlgen_js/test/fidlgen_js_unittest.cc
@@ -156,7 +156,10 @@
 
 class TestolaImpl : public fidljstest::Testola {
  public:
-  TestolaImpl() = default;
+  TestolaImpl() {
+    // Don't want the default values from the C++ side.
+    memset(&basic_struct_, -1, sizeof(basic_struct_));
+  }
   ~TestolaImpl() override {}
 
   void DoSomething() override { was_do_something_called_ = true; }
@@ -182,6 +185,34 @@
     sum(a + b);
   }
 
+  void SendAStruct(fidljstest::BasicStruct basic_struct) override {
+    basic_struct_ = basic_struct;
+  }
+
+  void NestedStructsWithResponse(
+      fidljstest::BasicStruct basic_struct,
+      NestedStructsWithResponseCallback resp) override {
+    // Construct a response, echoing the passed in structure with some
+    // modifications, as well as additional data.
+    fidljstest::StuffAndThings sat;
+    sat.count = 123;
+    sat.id = "here is my id";
+    sat.a_vector.push_back(1);
+    sat.a_vector.push_back(-2);
+    sat.a_vector.push_back(4);
+    sat.a_vector.push_back(-8);
+    sat.basic.b = !basic_struct.b;
+    sat.basic.i8 = basic_struct.i8 * 2;
+    sat.basic.i16 = basic_struct.i16 * 2;
+    sat.basic.i32 = basic_struct.i32 * 2;
+    sat.basic.u8 = basic_struct.u8 * 2;
+    sat.basic.u16 = basic_struct.u16 * 2;
+    sat.basic.u32 = basic_struct.u32 * 2;
+    sat.later_string = "ⓣⓔⓡⓜⓘⓝⓐⓣⓞⓡ";
+
+    resp(std::move(sat));
+  }
+
   bool was_do_something_called() const { return was_do_something_called_; }
   int32_t received_int() const { return received_int_; }
   const std::string& received_msg() const { return received_msg_; }
@@ -190,6 +221,8 @@
   const std::string& various_msg() const { return various_msg_; }
   const std::vector<uint32_t>& various_stuff() const { return various_stuff_; }
 
+  fidljstest::BasicStruct GetReceivedStruct() const { return basic_struct_; }
+
  private:
   bool was_do_something_called_ = false;
   int32_t received_int_ = -1;
@@ -197,6 +230,7 @@
   fidljstest::Blorp various_blorp_;
   std::string various_msg_;
   std::vector<uint32_t> various_stuff_;
+  fidljstest::BasicStruct basic_struct_;
 
   DISALLOW_COPY_AND_ASSIGN(TestolaImpl);
 };
@@ -410,6 +444,99 @@
   EXPECT_FALSE(helper.Get<bool>("excepted"));
 }
 
+TEST_F(FidlGenJsTest, RawReceiveFidlStructMessage) {
+  base::AsyncDispatcher dispatcher;
+
+  v8::Isolate* isolate = instance_->isolate();
+  BindingsSetupHelper helper(isolate);
+
+  TestolaImpl testola_impl;
+  fidl::Binding<fidljstest::Testola> binding(&testola_impl);
+  binding.Bind(std::move(helper.server()), &dispatcher);
+
+  // Send the data from the JS side into the channel.
+  std::string source = R"(
+    var proxy = new TestolaProxy();
+    proxy.$bind(testHandle);
+    var basicStruct = new BasicStruct(
+        true, -30, undefined, -789, 200, 65000, 0);
+    proxy.SendAStruct(basicStruct);
+  )";
+  helper.runner().Run(source, "test.js");
+
+  // Run the dispatcher to read and dispatch the response.
+  ASSERT_EQ(dispatcher.DispatchOrWaitUntil(zx_deadline_after(
+                ZX_MSEC(TestTimeouts::action_timeout().InMilliseconds()))),
+            ZX_OK);
+
+  fidljstest::BasicStruct received_struct = testola_impl.GetReceivedStruct();
+  EXPECT_EQ(received_struct.b, true);
+  EXPECT_EQ(received_struct.i8, -30);
+  EXPECT_EQ(received_struct.i16, 18);  // From defaults.
+  EXPECT_EQ(received_struct.i32, -789);
+  EXPECT_EQ(received_struct.u8, 200);
+  EXPECT_EQ(received_struct.u16, 65000);
+  // Make sure this didn't get defaulted, even though it has a false-ish value.
+  EXPECT_EQ(received_struct.u32, 0u);
+}
+
+TEST_F(FidlGenJsTest, RawReceiveFidlNestedStructsAndRespond) {
+  base::AsyncDispatcher dispatcher;
+
+  v8::Isolate* isolate = instance_->isolate();
+  BindingsSetupHelper helper(isolate);
+
+  TestolaImpl testola_impl;
+  fidl::Binding<fidljstest::Testola> binding(&testola_impl);
+  binding.Bind(std::move(helper.server()), &dispatcher);
+
+  // Send the data from the JS side into the channel.
+  std::string source = R"(
+      var proxy = new TestolaProxy();
+      proxy.$bind(testHandle);
+      var toSend = new BasicStruct(false, -5, -6, -7, 8, 32000, 2000000000);
+      proxy.NestedStructsWithResponse(toSend)
+           .then(sat => {
+             this.result_count = sat.count;
+             this.result_id = sat.id;
+             this.result_vector = sat.a_vector;
+             this.result_basic_b = sat.basic.b;
+             this.result_basic_i8 = sat.basic.i8;
+             this.result_basic_i16 = sat.basic.i16;
+             this.result_basic_i32 = sat.basic.i32;
+             this.result_basic_u8 = sat.basic.u8;
+             this.result_basic_u16 = sat.basic.u16;
+             this.result_basic_u32 = sat.basic.u32;
+             this.result_later_string = sat.later_string;
+           })
+           .catch((e) => log('HOT GARBAGE: ' + e));
+    )";
+  helper.runner().Run(source, "test.js");
+
+  // Run the dispatcher to read the request.
+  EXPECT_EQ(dispatcher.DispatchOrWaitUntil(ZX_TIME_INFINITE), ZX_OK);
+
+  // Run the dispatcher again to write the response.
+  EXPECT_EQ(dispatcher.DispatchOrWaitUntil(ZX_TIME_INFINITE), ZX_OK);
+
+  EXPECT_EQ(helper.Get<int>("result_count"), 123);
+  EXPECT_EQ(helper.Get<std::string>("result_id"), "here is my id");
+  auto result_vector = helper.Get<std::vector<int>>("result_vector");
+  ASSERT_EQ(result_vector.size(), 4u);
+  EXPECT_EQ(result_vector[0], 1);
+  EXPECT_EQ(result_vector[1], -2);
+  EXPECT_EQ(result_vector[2], 4);
+  EXPECT_EQ(result_vector[3], -8);
+  EXPECT_EQ(helper.Get<bool>("result_basic_b"), true);
+  EXPECT_EQ(helper.Get<int>("result_basic_i8"), -10);
+  EXPECT_EQ(helper.Get<int>("result_basic_i16"), -12);
+  EXPECT_EQ(helper.Get<int>("result_basic_i32"), -14);
+  EXPECT_EQ(helper.Get<unsigned int>("result_basic_u8"), 16u);
+  EXPECT_EQ(helper.Get<unsigned int>("result_basic_u16"), 64000u);
+  EXPECT_EQ(helper.Get<unsigned int>("result_basic_u32"), 4000000000u);
+  EXPECT_EQ(helper.Get<std::string>("result_later_string"), "ⓣⓔⓡⓜⓘⓝⓐⓣⓞⓡ");
+}
+
 int main(int argc, char** argv) {
   base::TestSuite test_suite(argc, argv);
 
diff --git a/tools/fuchsia/fidlgen_js/test/simple.fidl b/tools/fuchsia/fidlgen_js/test/simple.fidl
index 07771aea..01bab14 100644
--- a/tools/fuchsia/fidlgen_js/test/simple.fidl
+++ b/tools/fuchsia/fidlgen_js/test/simple.fidl
@@ -10,6 +10,26 @@
   GAMMA = 0x48;
 };
 
+// A struct of basic types, some with defaults and some without to test various
+// paths of the generator.
+struct BasicStruct {
+  bool b;
+  int8 i8;
+  int16 i16 = 18;
+  int32 i32;
+  uint8 u8;
+  uint16 u16;
+  uint32 u32 = 4000000000;
+};
+
+struct StuffAndThings {
+  int32 count;
+  string id;
+  vector<int32> a_vector;
+  BasicStruct basic;
+  string later_string;
+};
+
 interface Testola {
   1: DoSomething();
 
@@ -20,4 +40,8 @@
   4: VariousArgs(Blorp blorp, string:32 msg, vector<uint32> stuff);
 
   5: WithResponse(int32 a, int32 b) -> (int32 sum);
+
+  6: SendAStruct(BasicStruct basic);
+
+  7: NestedStructsWithResponse(BasicStruct basic) -> (StuffAndThings resp);
 };
diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index ed6edaba..4dc24552 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml
@@ -14707,6 +14707,7 @@
   <int value="489" label="NTLMShareAuthenticationEnabled"/>
   <int value="490" label="NetworkFileSharesPreconfiguredShares"/>
   <int value="491" label="AllowWakeLocks"/>
+  <int value="492" label="ScreenBrightnessPercent"/>
 </enum>
 
 <enum name="EnterprisePolicyInvalidations">
@@ -26577,6 +26578,15 @@
   <int value="8" label="AVX2"/>
 </enum>
 
+<enum name="IntentHeadersResult">
+  <int value="0" label="First Party No Headers"/>
+  <int value="1" label="First Party Only Safe Headers"/>
+  <int value="2" label="First Party Unsafe Headers"/>
+  <int value="3" label="Third Party No Headers"/>
+  <int value="4" label="Third Party Only Safe Headers"/>
+  <int value="5" label="Third Party Unsafe Headers"/>
+</enum>
+
 <enum name="InternalErrorLoadEvent">
   <summary>Internal Errors in the page_load_metrics system</summary>
   <int value="0" label="Invalid timing IPC sent from renderer (deprecated)"/>
@@ -29056,7 +29066,6 @@
   <int value="-1532014193" label="disable-encryption-migration"/>
   <int value="-1528455406" label="OmniboxPedalSuggestions:enabled"/>
   <int value="-1520855274" label="PWAFullCodeCache:disabled"/>
-  <int value="-1517518406" label="force-update-menu-type"/>
   <int value="-1515415104" label="top-document-isolation:disabled"/>
   <int value="-1514943439" label="ash-enable-swipe-to-close-in-overview-mode"/>
   <int value="-1514611301" label="enable-data-reduction-proxy-bypass-warnings"/>
@@ -29793,6 +29802,8 @@
   <int value="-138773929" label="PassiveDocumentEventListeners:enabled"/>
   <int value="-137303226" label="enable-chromevox-developer-option"/>
   <int value="-135223364" label="AutofillShowTypePredictions:disabled"/>
+  <int value="-128687277"
+      label="OmniboxUIExperimentHideSteadyStateUrlPathQueryAndRef:disabled"/>
   <int value="-127231994" label="VrBrowsingNativeAndroidUi:disabled"/>
   <int value="-122492389" label="enable-browser-task-scheduler"/>
   <int value="-120521482" label="DirectManipulationStylus:enabled"/>
@@ -29928,6 +29939,8 @@
   <int value="105046382" label="ParallelDownloading:disabled"/>
   <int value="106840653" label="mus"/>
   <int value="107900612" label="ChromeHomePersistentIph:disabled"/>
+  <int value="115915570"
+      label="OmniboxUIExperimentHideSteadyStateUrlPathQueryAndRef:enabled"/>
   <int value="118991027" label="enable-accelerated-fixed-root-background"/>
   <int value="119185738"
       label="OmniboxUIExperimentMaxAutocompleteMatches:disabled"/>
@@ -30559,6 +30572,7 @@
   <int value="1344833841" label="ImeThread:enabled"/>
   <int value="1351830811" label="do-not-ignore-autocomplete-off"/>
   <int value="1352447982" label="enable-lcd-text"/>
+  <int value="1353629763" label="MediaSessionAccelerators:enabled"/>
   <int value="1355923367" label="CrOSContainer:disabled"/>
   <int value="1359972809" label="enable-gesture-deletion"/>
   <int value="1361047396" label="disable-click-delay"/>
@@ -30970,6 +30984,7 @@
   <int value="2129184006" label="NTPOfflinePageDownloadSuggestions:enabled"/>
   <int value="2129251171" label="memlog-sampling"/>
   <int value="2129929643" label="enable-use-zoom-for-dsf"/>
+  <int value="2134480727" label="MediaSessionAccelerators:disabled"/>
   <int value="2137347307" label="enable-drive-apps-in-app-list"/>
   <int value="2137599770" label="enable-win32k-renderer-lockdown"/>
   <int value="2138146331" label="OmniboxVoiceSearchAlwaysVisible:enabled"/>
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 244bde0..33b0abf 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -1881,6 +1881,15 @@
   </summary>
 </histogram>
 
+<histogram name="Android.IntentHeaders" enum="IntentHeadersResult">
+  <owner>peconn@chromium.org</owner>
+  <summary>
+    Records the usage of the Browser.EXTRA_HEADERS field for Intents that Chrome
+    receives, breaking down by type of header and by whether the launching app
+    was first or third party.
+  </summary>
+</histogram>
+
 <histogram name="Android.IsLastSharedAppInfoRetrieved"
     enum="BooleanIsLastSharedAppInfoRetrieved">
   <owner>jaekyun@chromium.org</owner>
@@ -9301,9 +9310,7 @@
 
   <summary>
     The percentage of time between a BeginMainFrame and paint results commit in
-    Blink that is used for committing paint results to the compositor. The
-    reported value is an average over the time since the previous record: 30
-    seconds unless the frame is disposed of.
+    Blink that is used for committing paint results to the compositor.
   </summary>
 </histogram>
 
@@ -9313,9 +9320,7 @@
 
   <summary>
     The percentage of time between a BeginMainFrame and paint results commit in
-    Blink that is used for computing Compositing. The reported value is an
-    average over the time since the previous record: 30 seconds unless the frame
-    is disposed of.
+    Blink that is used for computing Compositing.
   </summary>
 </histogram>
 
@@ -9327,9 +9332,7 @@
   <summary>
     The time between each paint results commit used in computing forced style
     recalc and layouts for this document and ancestors as a percentage of the
-    Blink local frame lifecycle update time. The reported value is an average
-    over the time since the previous record: 30 seconds unless the frame is
-    disposed of.
+    Blink local frame lifecycle update time.
   </summary>
 </histogram>
 
@@ -9339,9 +9342,7 @@
 
   <summary>
     The percentage of time between a BeginMainFrame and paint results commit in
-    Blink that is used for computing Intersection Observations. The reported
-    value is an average over the time since the previous record: 30 seconds
-    unless the frame is disposed of.
+    Blink that is used for computing Intersection Observations.
   </summary>
 </histogram>
 
@@ -9351,9 +9352,7 @@
 
   <summary>
     The percentage of time between a BeginMainFrame and paint results commit in
-    Blink that is used for computing Paint. The reported value is an average
-    over the time since the previous record: 30 seconds unless the frame is
-    disposed of.
+    Blink that is used for computing Paint.
   </summary>
 </histogram>
 
@@ -9363,9 +9362,7 @@
 
   <summary>
     The percentage of time between a BeginMainFrame and paint results commit in
-    Blink that is used for computing PrePaint. The reported value is an average
-    over the time since the previous record: 30 seconds unless the frame is
-    disposed of.
+    Blink that is used for computing PrePaint.
   </summary>
 </histogram>
 
@@ -9375,9 +9372,7 @@
 
   <summary>
     The percentage of time between a BeginMainFrame and paint results commit in
-    Blink that is used for computing Style and Layout. The reported value is an
-    average over the time since the previous record: 30 seconds unless the frame
-    is disposed of.
+    Blink that is used for computing Style and Layout.
   </summary>
 </histogram>
 
@@ -14421,6 +14416,9 @@
 
 <histogram name="Compositing.SurfaceDependencyDeadline.DeadlineHit"
     units="Boolean">
+  <obsolete>
+    Deprecated as of 10/2018. This metric didn't end up being useful.
+  </obsolete>
   <owner>fsamuel@chromium.org</owner>
   <summary>
     Tracks whether an activation of a surface was due to due to a deadline or
@@ -42452,7 +42450,8 @@
   </summary>
 </histogram>
 
-<histogram name="Media.Audio.Processing.CaptureDelayVarianceMs" units="ms">
+<histogram name="Media.Audio.Processing.CaptureDelayVarianceMs"
+    units="ms squared">
   <owner>ossu@chromium.org, grunell@chromium.org</owner>
   <summary>
     The variance of the capture delay in milliseconds (see
@@ -42470,7 +42469,8 @@
   </summary>
 </histogram>
 
-<histogram name="Media.Audio.Processing.RenderDelayVarianceMs" units="ms">
+<histogram name="Media.Audio.Processing.RenderDelayVarianceMs"
+    units="ms squared">
   <owner>ossu@chromium.org, grunell@chromium.org</owner>
   <summary>
     The variance of the render delay in milliseconds (see
@@ -42487,7 +42487,8 @@
   </summary>
 </histogram>
 
-<histogram name="Media.Audio.Processing.TotalDelayVarianceMs" units="ms">
+<histogram name="Media.Audio.Processing.TotalDelayVarianceMs"
+    units="ms squared">
   <owner>ossu@chromium.org, grunell@chromium.org</owner>
   <summary>
     The variance of the total delay in milliseconds (see
@@ -66428,6 +66429,9 @@
 </histogram>
 
 <histogram name="NQE.BDPComputationKbps.OnECTComputation" units="Kbps">
+  <obsolete>
+    Obsoleted in October 2018
+  </obsolete>
   <owner>devdeepray@chromium.org</owner>
   <owner>tbansal@chromium.org</owner>
   <summary>
@@ -66438,6 +66442,9 @@
 </histogram>
 
 <histogram name="NQE.BDPComputationTransportRTT.OnECTComputation" units="ms">
+  <obsolete>
+    Obsoleted in October 2018
+  </obsolete>
   <owner>devdeepray@chromium.org</owner>
   <owner>tbansal@chromium.org</owner>
   <summary>
@@ -66448,6 +66455,9 @@
 </histogram>
 
 <histogram name="NQE.BDPKbits.OnECTComputation" units="kbits">
+  <obsolete>
+    Obsoleted in October 2018
+  </obsolete>
   <owner>devdeepray@chromium.org</owner>
   <owner>tbansal@chromium.org</owner>
   <summary>
@@ -88355,6 +88365,15 @@
   </summary>
 </histogram>
 
+<histogram name="ResourceScheduler.RequestQueuingDuration" units="ms">
+  <owner>tbansal@chromium.org</owner>
+  <summary>
+    The amount of time the ResourceScheduler queued a request. Recorded in
+    separate histograms based on the request loading priority at the time the
+    request was dequeued.
+  </summary>
+</histogram>
+
 <histogram name="ResourceScheduler.RequestsCount" units="requests count">
   <owner>tbansal@chromium.org</owner>
   <summary>
@@ -127626,6 +127645,7 @@
   <suffix name="Priority4" label="MEDIUM"/>
   <suffix name="Priority5" label="HIGHEST or MAXIMUM_PRIORITY"/>
   <affected-histogram name="Net.HttpJob.TotalTimeSuccess"/>
+  <affected-histogram name="ResourceScheduler.RequestQueuingDuration"/>
 </histogram_suffixes>
 
 <histogram_suffixes name="Net.QuicClientHelloRejectReasons.QuicIsSecureOrNot"
diff --git a/tools/perf/core/perf_data_generator.py b/tools/perf/core/perf_data_generator.py
index 8ef34149..539a1fd3 100755
--- a/tools/perf/core/perf_data_generator.py
+++ b/tools/perf/core/perf_data_generator.py
@@ -42,8 +42,12 @@
 # bisecting Chrome builds with their web tests. For questions or to report
 # issues, please contact johnchen@chromium.org.
 BUILDER_ADDITIONAL_COMPILE_TARGETS = {
-    'android-builder-perf': ['microdump_stackwalk', 'angle_perftests'],
-    'android_arm64-builder-perf': ['microdump_stackwalk', 'angle_perftests'],
+    'android-builder-perf': [
+        'microdump_stackwalk', 'angle_perftests', 'chrome_apk'
+    ],
+    'android_arm64-builder-perf': [
+        'microdump_stackwalk', 'angle_perftests', 'chrome_apk'
+    ],
     'linux-builder-perf': ['chromedriver'],
     'mac-builder-perf': ['chromedriver'],
     'win32-builder-perf': ['chromedriver'],
diff --git a/tools/strict_enum_value_checker/OWNERS b/tools/strict_enum_value_checker/OWNERS
index 0d6b206..f0569ba 100644
--- a/tools/strict_enum_value_checker/OWNERS
+++ b/tools/strict_enum_value_checker/OWNERS
@@ -1,3 +1,3 @@
 rdevlin.cronin@chromium.org
-rockot@chromium.org
+rockot@google.com
 
diff --git a/ui/android/delegated_frame_host_android.cc b/ui/android/delegated_frame_host_android.cc
index 44e5695..8e8655a 100644
--- a/ui/android/delegated_frame_host_android.cc
+++ b/ui/android/delegated_frame_host_android.cc
@@ -205,7 +205,7 @@
   if (!HasSavedFrame())
     return;
   std::vector<viz::SurfaceId> surface_ids = {
-      viz::SurfaceId(frame_sink_id_, active_local_surface_id_)};
+      viz::SurfaceId(frame_sink_id_, pending_local_surface_id_)};
   // Reset information about the active surface because it will get destroyed.
   active_local_surface_id_ = viz::LocalSurfaceId();
   host_frame_sink_manager_->EvictSurfaces(surface_ids);
@@ -309,9 +309,19 @@
   if (!enable_surface_synchronization_)
     return;
 
+  bool id_changed = pending_local_surface_id_ != new_pending_local_surface_id;
+
   pending_local_surface_id_ = new_pending_local_surface_id;
   pending_surface_size_in_pixels_ = new_pending_size_in_pixels;
 
+  if (id_changed) {
+    // TODO(fsamuel): "SwappedFrame" is a bad name. Also, this method doesn't
+    // really need to take in visibility. FrameEvictor already has the latest
+    // visibility state.
+    frame_evictor_->SwappedFrame(frame_evictor_->visible());
+    // Note: the frame may have been evicted immediately.
+  }
+
   viz::SurfaceId current_primary_surface_id =
       content_layer_->primary_surface_id();
   viz::SurfaceId new_primary_surface_id(frame_sink_id_,
@@ -417,12 +427,6 @@
     return;
 
   active_local_surface_id_ = surface_info.id().local_surface_id();
-
-  // TODO(fsamuel): "SwappedFrame" is a bad name. Also, this method doesn't
-  // really need to take in visiblity. FrameEvictor already has the latest
-  // visibility state.
-  frame_evictor_->SwappedFrame(frame_evictor_->visible());
-  // Note: the frame may have been evicted immediately.
 }
 
 void DelegatedFrameHostAndroid::OnFrameTokenChanged(uint32_t frame_token) {
diff --git a/ui/android/resources/resource_manager_impl_unittest.cc b/ui/android/resources/resource_manager_impl_unittest.cc
index e9850b5..0d3a3f7 100644
--- a/ui/android/resources/resource_manager_impl_unittest.cc
+++ b/ui/android/resources/resource_manager_impl_unittest.cc
@@ -48,9 +48,9 @@
 
   void SetResourceAsLoaded(AndroidResourceType res_type, int res_id) {
     SkBitmap small_bitmap;
-    SkCanvas canvas(small_bitmap);
     small_bitmap.allocPixels(
         SkImageInfo::Make(1, 1, kRGBA_8888_SkColorType, kOpaque_SkAlphaType));
+    SkCanvas canvas(small_bitmap);
     canvas.drawColor(SK_ColorWHITE);
     small_bitmap.setImmutable();
 
diff --git a/ui/compositor/layer.cc b/ui/compositor/layer.cc
index f85469f6..34f73f6 100644
--- a/ui/compositor/layer.cc
+++ b/ui/compositor/layer.cc
@@ -776,12 +776,7 @@
                                   bool stretch_content_to_fill_bounds) {
   DCHECK(type_ == LAYER_TEXTURED || type_ == LAYER_SOLID_COLOR);
 
-  if (!surface_layer_) {
-    scoped_refptr<cc::SurfaceLayer> new_layer = cc::SurfaceLayer::Create();
-    new_layer->SetSurfaceHitTestable(true);
-    SwitchToLayer(new_layer);
-    surface_layer_ = new_layer;
-  }
+  CreateSurfaceLayerIfNecessary();
 
   surface_layer_->SetPrimarySurfaceId(surface_id, deadline_policy);
   surface_layer_->SetBackgroundColor(default_background_color);
@@ -799,7 +794,8 @@
 
 void Layer::SetFallbackSurfaceId(const viz::SurfaceId& surface_id) {
   DCHECK(type_ == LAYER_TEXTURED || type_ == LAYER_SOLID_COLOR);
-  DCHECK(surface_layer_);
+
+  CreateSurfaceLayerIfNecessary();
 
   surface_layer_->SetFallbackSurfaceId(surface_id);
 
@@ -1326,4 +1322,13 @@
   mirrors_.erase(it);
 }
 
+void Layer::CreateSurfaceLayerIfNecessary() {
+  if (surface_layer_)
+    return;
+  scoped_refptr<cc::SurfaceLayer> new_layer = cc::SurfaceLayer::Create();
+  new_layer->SetSurfaceHitTestable(true);
+  SwitchToLayer(new_layer);
+  surface_layer_ = new_layer;
+}
+
 }  // namespace ui
diff --git a/ui/compositor/layer.h b/ui/compositor/layer.h
index 47c36b6..539ab8d 100644
--- a/ui/compositor/layer.h
+++ b/ui/compositor/layer.h
@@ -514,6 +514,8 @@
 
   void OnMirrorDestroyed(LayerMirror* mirror);
 
+  void CreateSurfaceLayerIfNecessary();
+
   const LayerType type_;
 
   Compositor* compositor_;
diff --git a/ui/compositor/test/in_process_context_provider.cc b/ui/compositor/test/in_process_context_provider.cc
index 3c63120..0cd4452 100644
--- a/ui/compositor/test/in_process_context_provider.cc
+++ b/ui/compositor/test/in_process_context_provider.cc
@@ -119,7 +119,6 @@
 
   raster_context_ = std::make_unique<gpu::raster::RasterImplementationGLES>(
       context_->GetImplementation(),
-      context_->GetImplementation()->command_buffer(),
       context_->GetImplementation()->capabilities());
 
   return bind_result_;
diff --git a/ui/gfx/BUILD.gn b/ui/gfx/BUILD.gn
index 319ff84e..f355581 100644
--- a/ui/gfx/BUILD.gn
+++ b/ui/gfx/BUILD.gn
@@ -223,8 +223,6 @@
       "skia_vector_animation.cc",
       "skia_vector_animation.h",
       "skia_vector_animation_observer.h",
-      "skottie_wrapper.cc",
-      "skottie_wrapper.h",
     ]
   } else {
     sources += [
diff --git a/ui/gfx/skia_vector_animation.cc b/ui/gfx/skia_vector_animation.cc
index 8e16dc9..6ea30bad 100644
--- a/ui/gfx/skia_vector_animation.cc
+++ b/ui/gfx/skia_vector_animation.cc
@@ -5,6 +5,7 @@
 #include "ui/gfx/skia_vector_animation.h"
 
 #include "base/trace_event/trace_event.h"
+#include "cc/paint/skottie_wrapper.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "third_party/skia/include/core/SkCanvas.h"
 #include "third_party/skia/include/core/SkImage.h"
@@ -13,7 +14,6 @@
 #include "ui/gfx/image/image_skia.h"
 #include "ui/gfx/skia_util.h"
 #include "ui/gfx/skia_vector_animation_observer.h"
-#include "ui/gfx/skottie_wrapper.h"
 
 namespace gfx {
 
@@ -69,7 +69,8 @@
   return end_offset_.InMillisecondsF() * progress_per_millisecond_;
 }
 
-SkiaVectorAnimation::SkiaVectorAnimation(scoped_refptr<SkottieWrapper> skottie)
+SkiaVectorAnimation::SkiaVectorAnimation(
+    scoped_refptr<cc::SkottieWrapper> skottie)
     : skottie_(skottie) {}
 
 SkiaVectorAnimation::~SkiaVectorAnimation() {}
@@ -216,7 +217,8 @@
   SkCanvas skcanvas(bitmap);
   skcanvas.clear(SK_ColorTRANSPARENT);
 
-  skottie_->Draw(&skcanvas, t, pixel_size);
+  skottie_->Draw(&skcanvas, t,
+                 SkRect::MakeWH(pixel_size.width(), pixel_size.height()));
 
   canvas->DrawImageInt(gfx::ImageSkia::CreateFrom1xBitmap(bitmap), 0, 0);
 }
diff --git a/ui/gfx/skia_vector_animation.h b/ui/gfx/skia_vector_animation.h
index 14081bfd..9a0f6cc 100644
--- a/ui/gfx/skia_vector_animation.h
+++ b/ui/gfx/skia_vector_animation.h
@@ -16,11 +16,14 @@
 #include "ui/gfx/geometry/size.h"
 #include "ui/gfx/gfx_export.h"
 
+namespace cc {
+class SkottieWrapper;
+}  // namespace cc
+
 namespace gfx {
 class Canvas;
 class SkiaVectorAnimationTest;
 class SkiaVectorAnimationObserver;
-class SkottieWrapper;
 
 // This class is a wrapper over the Skia object for lottie vector graphic
 // animations. It has its own timeline manager for the animation controls. The
@@ -81,7 +84,7 @@
     kLoop         // Same as LINEAR, except the animation repeats after it ends.
   };
 
-  explicit SkiaVectorAnimation(scoped_refptr<SkottieWrapper> skottie);
+  explicit SkiaVectorAnimation(scoped_refptr<cc::SkottieWrapper> skottie);
   ~SkiaVectorAnimation();
 
   void SetAnimationObserver(SkiaVectorAnimationObserver* Observer);
@@ -138,7 +141,7 @@
   void PaintFrame(gfx::Canvas* canvas, float t, const gfx::Size& size);
 
   // Returns the skottie object that contins the animation data.
-  scoped_refptr<SkottieWrapper> skottie() const { return skottie_; }
+  scoped_refptr<cc::SkottieWrapper> skottie() const { return skottie_; }
 
  private:
   friend class SkiaVectorAnimationTest;
@@ -231,7 +234,7 @@
 
   SkiaVectorAnimationObserver* observer_ = nullptr;
 
-  scoped_refptr<SkottieWrapper> skottie_;
+  scoped_refptr<cc::SkottieWrapper> skottie_;
 
   DISALLOW_COPY_AND_ASSIGN(SkiaVectorAnimation);
 };
diff --git a/ui/gfx/skia_vector_animation_unittest.cc b/ui/gfx/skia_vector_animation_unittest.cc
index e7394e2..75b6a67 100644
--- a/ui/gfx/skia_vector_animation_unittest.cc
+++ b/ui/gfx/skia_vector_animation_unittest.cc
@@ -10,12 +10,12 @@
 #include "base/memory/ref_counted_memory.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/test/simple_test_tick_clock.h"
+#include "cc/paint/skottie_wrapper.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "third_party/skia/include/core/SkStream.h"
 #include "ui/gfx/canvas.h"
 #include "ui/gfx/skia_vector_animation_observer.h"
-#include "ui/gfx/skottie_wrapper.h"
 
 namespace gfx {
 namespace {
@@ -102,7 +102,7 @@
   void SetUp() override {
     canvas_.reset(new gfx::Canvas(gfx::Size(kAnimationWidth, kAnimationHeight),
                                   1.f, false));
-    skottie_ = base::MakeRefCounted<SkottieWrapper>(
+    skottie_ = base::MakeRefCounted<cc::SkottieWrapper>(
         std::make_unique<SkMemoryStream>(kData, std::strlen(kData)));
     animation_ = std::make_unique<SkiaVectorAnimation>(skottie_);
   }
@@ -190,7 +190,7 @@
 
  protected:
   std::unique_ptr<SkiaVectorAnimation> animation_;
-  scoped_refptr<SkottieWrapper> skottie_;
+  scoped_refptr<cc::SkottieWrapper> skottie_;
 
  private:
   std::unique_ptr<gfx::Canvas> canvas_;
@@ -202,7 +202,7 @@
 TEST_F(SkiaVectorAnimationTest, InitializationAndLoadingData) {
   auto bytes = base::MakeRefCounted<base::RefCountedBytes>(
       std::vector<unsigned char>(kData, kData + std::strlen(kData)));
-  skottie_ = base::MakeRefCounted<SkottieWrapper>(bytes.get());
+  skottie_ = base::MakeRefCounted<cc::SkottieWrapper>(bytes.get());
   animation_ = std::make_unique<SkiaVectorAnimation>(skottie_);
   EXPECT_FLOAT_EQ(animation_->GetOriginalSize().width(), kAnimationWidth);
   EXPECT_FLOAT_EQ(animation_->GetOriginalSize().height(), kAnimationHeight);
@@ -210,7 +210,7 @@
                   kAnimationDuration);
   EXPECT_TRUE(IsStopped());
 
-  skottie_ = base::MakeRefCounted<SkottieWrapper>(
+  skottie_ = base::MakeRefCounted<cc::SkottieWrapper>(
       std::make_unique<SkMemoryStream>(kData, std::strlen(kData)));
   animation_ = std::make_unique<SkiaVectorAnimation>(skottie_);
   EXPECT_FLOAT_EQ(animation_->GetOriginalSize().width(), kAnimationWidth);
diff --git a/ui/gl/BUILD.gn b/ui/gl/BUILD.gn
index 67cedb57..c8c23ae 100644
--- a/ui/gl/BUILD.gn
+++ b/ui/gl/BUILD.gn
@@ -14,7 +14,8 @@
 declare_args() {
   enable_swiftshader = (is_win || is_linux || (is_mac && use_egl) ||
                         is_chromeos || is_fuchsia) &&
-                       (target_cpu == "x86" || target_cpu == "x64")
+                       (target_cpu == "x86" || target_cpu == "x64" ||
+                        target_cpu == "arm64")
 }
 
 use_glx = use_x11 || ozone_platform_x11
diff --git a/ui/gl/gl_surface_egl.cc b/ui/gl/gl_surface_egl.cc
index bb5e68b..0cfef2f 100644
--- a/ui/gl/gl_surface_egl.cc
+++ b/ui/gl/gl_surface_egl.cc
@@ -150,7 +150,7 @@
 bool g_egl_context_priority_supported = false;
 bool g_egl_khr_colorspace = false;
 bool g_egl_ext_colorspace_display_p3 = false;
-bool g_use_direct_composition = false;
+bool g_egl_flexible_surface_compatibility_supported = false;
 bool g_egl_robust_resource_init_supported = false;
 bool g_egl_display_texture_share_group_supported = false;
 bool g_egl_create_context_client_arrays_supported = false;
@@ -681,8 +681,7 @@
       HasEGLExtension("EGL_CHROMIUM_create_context_bind_generates_resource");
   g_egl_create_context_webgl_compatability_supported =
       HasEGLExtension("EGL_ANGLE_create_context_webgl_compatibility");
-  g_egl_sync_control_supported =
-      HasEGLExtension("EGL_CHROMIUM_sync_control");
+  g_egl_sync_control_supported = HasEGLExtension("EGL_CHROMIUM_sync_control");
   g_egl_window_fixed_size_supported =
       HasEGLExtension("EGL_ANGLE_window_fixed_size");
   g_egl_surface_orientation_supported =
@@ -704,15 +703,9 @@
 
 #if defined(OS_WIN)
   // Need EGL_ANGLE_flexible_surface_compatibility to allow surfaces with and
-  // without alpha to be bound to the same context. Blacklist direct composition
-  // if MCTU.dll or MCTUX.dll are injected. These are user mode drivers for
-  // display adapters from Magic Control Technology Corporation.
-  g_use_direct_composition =
-      HasEGLExtension("EGL_ANGLE_direct_composition") &&
-      HasEGLExtension("EGL_ANGLE_flexible_surface_compatibility") &&
-      !base::CommandLine::ForCurrentProcess()->HasSwitch(
-          switches::kDisableDirectComposition) &&
-      !GetModuleHandle(TEXT("MCTU.dll")) && !GetModuleHandle(TEXT("MCTUX.dll"));
+  // without alpha to be bound to the same context.
+  g_egl_flexible_surface_compatibility_supported =
+      HasEGLExtension("EGL_ANGLE_flexible_surface_compatibility");
 #endif
 
   g_egl_display_texture_share_group_supported =
@@ -798,7 +791,6 @@
   g_egl_sync_control_supported = false;
   g_egl_window_fixed_size_supported = false;
   g_egl_surface_orientation_supported = false;
-  g_use_direct_composition = false;
   g_egl_surfaceless_context_supported = false;
   g_egl_robust_resource_init_supported = false;
   g_egl_display_texture_share_group_supported = false;
@@ -851,8 +843,8 @@
 }
 
 // static
-bool GLSurfaceEGL::IsDirectCompositionSupported() {
-  return g_use_direct_composition;
+bool GLSurfaceEGL::IsEGLFlexibleSurfaceCompatibilitySupported() {
+  return g_egl_flexible_surface_compatibility_supported;
 }
 
 bool GLSurfaceEGL::IsRobustResourceInitSupported() {
@@ -1023,14 +1015,6 @@
     egl_window_attributes.push_back(EGL_SURFACE_ORIENTATION_INVERT_Y_ANGLE);
   }
 
-  if (g_use_direct_composition) {
-    egl_window_attributes.push_back(
-        EGL_FLEXIBLE_SURFACE_COMPATIBILITY_SUPPORTED_ANGLE);
-    egl_window_attributes.push_back(EGL_TRUE);
-    egl_window_attributes.push_back(EGL_DIRECT_COMPOSITION_ANGLE);
-    egl_window_attributes.push_back(EGL_TRUE);
-  }
-
   switch (format_.GetColorSpace()) {
     case GLSurfaceFormat::COLOR_SPACE_UNSPECIFIED:
       break;
@@ -1407,10 +1391,6 @@
   return flips_vertically_;
 }
 
-bool NativeViewGLSurfaceEGL::BuffersFlipped() const {
-  return g_use_direct_composition;
-}
-
 EGLTimestampClient* NativeViewGLSurfaceEGL::GetEGLTimestampClient() {
   // This api call is used by GLSurfacePresentationHelper class which is member
   // of this class NativeViewGLSurfaceEGL. Hence its guaranteed "this" pointer
@@ -1659,22 +1639,12 @@
   // they have different addresses. If they have the same address then a
   // future call to MakeCurrent might early out because it appears the current
   // context and surface have not changed.
-  std::vector<EGLint> pbuffer_attribs;
-  pbuffer_attribs.push_back(EGL_WIDTH);
-  pbuffer_attribs.push_back(size_.width());
-  pbuffer_attribs.push_back(EGL_HEIGHT);
-  pbuffer_attribs.push_back(size_.height());
-
-  if (g_use_direct_composition) {
-    pbuffer_attribs.push_back(
-        EGL_FLEXIBLE_SURFACE_COMPATIBILITY_SUPPORTED_ANGLE);
-    pbuffer_attribs.push_back(EGL_TRUE);
-  }
-
-  pbuffer_attribs.push_back(EGL_NONE);
+  EGLint pbuffer_attribs[] = {
+      EGL_WIDTH, size_.width(), EGL_HEIGHT, size_.height(), EGL_NONE,
+  };
 
   EGLSurface new_surface =
-      eglCreatePbufferSurface(display, GetConfig(), &pbuffer_attribs[0]);
+      eglCreatePbufferSurface(display, GetConfig(), pbuffer_attribs);
   if (!new_surface) {
     LOG(ERROR) << "eglCreatePbufferSurface failed with error "
                << GetLastEGLErrorString();
diff --git a/ui/gl/gl_surface_egl.h b/ui/gl/gl_surface_egl.h
index 3d44351..5f740e3 100644
--- a/ui/gl/gl_surface_egl.h
+++ b/ui/gl/gl_surface_egl.h
@@ -85,7 +85,7 @@
   static bool IsCreateContextWebGLCompatabilitySupported();
   static bool IsEGLSurfacelessContextSupported();
   static bool IsEGLContextPrioritySupported();
-  static bool IsDirectCompositionSupported();
+  static bool IsEGLFlexibleSurfaceCompatibilitySupported();
   static bool IsRobustResourceInitSupported();
   static bool IsDisplayTextureShareGroupSupported();
   static bool IsCreateContextClientArraysSupported();
@@ -145,7 +145,6 @@
                             bool enable_blend,
                             std::unique_ptr<gfx::GpuFence> gpu_fence) override;
   bool FlipsVertically() const override;
-  bool BuffersFlipped() const override;
   EGLTimestampClient* GetEGLTimestampClient() override;
 
   // EGLTimestampClient implementation.
diff --git a/ui/gl/gl_switches.cc b/ui/gl/gl_switches.cc
index b45bb333..67c0c5fd 100644
--- a/ui/gl/gl_switches.cc
+++ b/ui/gl/gl_switches.cc
@@ -73,9 +73,6 @@
 // context will never be lost in any situations, say, a GPU reset.
 const char kGpuNoContextLost[]              = "gpu-no-context-lost";
 
-// Disables the use of DirectComposition to draw to the screen.
-const char kDisableDirectComposition[] = "disable-direct-composition";
-
 // Flag used for Linux tests: for desktop GL bindings, try to load this GL
 // library first, but fall back to regular library if loading fails.
 const char kTestGLLib[]                     = "test-gl-lib";
@@ -114,7 +111,6 @@
 // GpuProcessHost to the GPU Process. Add your switch to this list if you need
 // to read it in the GPU process, else don't add it.
 const char* const kGLSwitchesCopiedFromGpuProcessHost[] = {
-    kDisableDirectComposition,
     kDisableGpuVsync,
     kDisableD3D11,
     kDisableES3GLContext,
diff --git a/ui/gl/gl_switches.h b/ui/gl/gl_switches.h
index 3dab7a1..fcc1410 100644
--- a/ui/gl/gl_switches.h
+++ b/ui/gl/gl_switches.h
@@ -46,7 +46,6 @@
 GL_EXPORT extern const char kEnableGPUServiceLogging[];
 GL_EXPORT extern const char kEnableGPUServiceTracing[];
 GL_EXPORT extern const char kGpuNoContextLost[];
-GL_EXPORT extern const char kDisableDirectComposition[];
 
 GL_EXPORT extern const char kUseANGLE[];
 GL_EXPORT extern const char kUseGL[];
diff --git a/ui/gl/init/create_gr_gl_interface.cc b/ui/gl/init/create_gr_gl_interface.cc
index 598b98cdf..69512fb 100644
--- a/ui/gl/init/create_gr_gl_interface.cc
+++ b/ui/gl/init/create_gr_gl_interface.cc
@@ -125,6 +125,7 @@
   functions->fBindFragDataLocation = gl->glBindFragDataLocationFn;
   functions->fBindUniformLocation = gl->glBindUniformLocationCHROMIUMFn;
   functions->fBeginQuery = gl->glBeginQueryFn;
+  functions->fBindSampler = gl->glBindSamplerFn;
   functions->fBindTexture = gl->glBindTextureFn;
 
   functions->fBlendBarrier = gl->glBlendBarrierKHRFn;
@@ -159,6 +160,7 @@
   functions->fDeleteProgram =
       bind_slow(gl->glDeleteProgramFn, progress_reporter);
   functions->fDeleteQueries = gl->glDeleteQueriesFn;
+  functions->fDeleteSamplers = gl->glDeleteSamplersFn;
   functions->fDeleteShader = bind_slow(gl->glDeleteShaderFn, progress_reporter);
   functions->fDeleteTextures = gl->glDeleteTexturesFn;
   functions->fDepthMask = gl->glDepthMaskFn;
@@ -205,6 +207,7 @@
   functions->fGetShaderPrecisionFormat = gl->glGetShaderPrecisionFormatFn;
   functions->fGetTexLevelParameteriv = gl->glGetTexLevelParameterivFn;
   functions->fGenQueries = gl->glGenQueriesFn;
+  functions->fGenSamplers = gl->glGenSamplersFn;
   functions->fGenTextures = gl->glGenTexturesFn;
   functions->fGetUniformLocation = gl->glGetUniformLocationFn;
   functions->fIsTexture = gl->glIsTextureFn;
@@ -226,6 +229,8 @@
 
   functions->fReadBuffer = gl->glReadBufferFn;
   functions->fReadPixels = gl->glReadPixelsFn;
+  functions->fSamplerParameteri = gl->glSamplerParameteriFn;
+  functions->fSamplerParameteriv = gl->glSamplerParameterivFn;
   functions->fScissor = gl->glScissorFn;
   functions->fShaderSource = gl->glShaderSourceFn;
   functions->fStencilFunc = gl->glStencilFuncFn;
diff --git a/ui/views/controls/animated_image_view.cc b/ui/views/controls/animated_image_view.cc
index 2d56a88..61fb79a 100644
--- a/ui/views/controls/animated_image_view.cc
+++ b/ui/views/controls/animated_image_view.cc
@@ -7,8 +7,8 @@
 #include <utility>
 
 #include "base/logging.h"
+#include "cc/paint/skottie_wrapper.h"
 #include "ui/gfx/canvas.h"
-#include "ui/gfx/skottie_wrapper.h"
 #include "ui/views/widget/widget.h"
 
 namespace views {
diff --git a/ui/views/controls/button/button.cc b/ui/views/controls/button/button.cc
index ebf0864..cf8f365 100644
--- a/ui/views/controls/button/button.cc
+++ b/ui/views/controls/button/button.cc
@@ -44,6 +44,30 @@
 }  // namespace
 
 ////////////////////////////////////////////////////////////////////////////////
+// WidgetObserverButtonBridge:
+Button::WidgetObserverButtonBridge::WidgetObserverButtonBridge(Button* button)
+    : owner_(button) {
+  DCHECK(button->GetWidget());
+  button->GetWidget()->AddObserver(this);
+}
+
+Button::WidgetObserverButtonBridge::~WidgetObserverButtonBridge() {
+  if (owner_)
+    owner_->GetWidget()->RemoveObserver(this);
+}
+
+void Button::WidgetObserverButtonBridge::OnWidgetActivationChanged(
+    Widget* widget,
+    bool active) {
+  owner_->WidgetActivationChanged(widget, active);
+}
+
+void Button::WidgetObserverButtonBridge::OnWidgetDestroying(Widget* widget) {
+  widget->RemoveObserver(this);
+  owner_ = nullptr;
+}
+
+////////////////////////////////////////////////////////////////////////////////
 // Button, static public:
 
 // static
@@ -129,6 +153,14 @@
   SchedulePaint();
 }
 
+Button::ButtonState Button::GetVisualState() const {
+  if (PlatformStyle::kInactiveWidgetControlsAppearDisabled && GetWidget() &&
+      !GetWidget()->IsActive()) {
+    return STATE_DISABLED;
+  }
+  return state();
+}
+
 void Button::StartThrobbing(int cycles_til_stop) {
   if (!animate_on_state_change_)
     return;
@@ -456,6 +488,15 @@
     SchedulePaint();
 }
 
+void Button::AddedToWidget() {
+  if (PlatformStyle::kInactiveWidgetControlsAppearDisabled)
+    widget_observer_ = std::make_unique<WidgetObserverButtonBridge>(this);
+}
+
+void Button::RemovedFromWidget() {
+  widget_observer_.reset();
+}
+
 std::unique_ptr<InkDrop> Button::CreateInkDrop() {
   std::unique_ptr<views::InkDropImpl> ink_drop = CreateDefaultInkDropImpl();
   ink_drop->SetShowHighlightOnFocus(!focus_ring_);
@@ -568,4 +609,8 @@
   return check_mouse_position && IsMouseHovered();
 }
 
+void Button::WidgetActivationChanged(Widget* widget, bool active) {
+  StateChanged(state());
+}
+
 }  // namespace views
diff --git a/ui/views/controls/button/button.h b/ui/views/controls/button/button.h
index 050512f..a9070b1 100644
--- a/ui/views/controls/button/button.h
+++ b/ui/views/controls/button/button.h
@@ -15,6 +15,7 @@
 #include "ui/views/animation/ink_drop_state.h"
 #include "ui/views/controls/focus_ring.h"
 #include "ui/views/painter.h"
+#include "ui/views/widget/widget_observer.h"
 
 namespace views {
 
@@ -96,6 +97,9 @@
   // like event dispatching, focus traversals, etc. Calling SetEnabled(false)
   // will also set the state of |this| to STATE_DISABLED.
   void SetState(ButtonState state);
+  // Returns the visual appearance state of the button. This takes into account
+  // both the button's display state and the state of the containing widget.
+  ButtonState GetVisualState() const;
 
   // Starts throbbing. See HoverAnimation for a description of cycles_til_stop.
   // This method does nothing if |animate_on_state_change_| is false.
@@ -183,6 +187,8 @@
       const ViewHierarchyChangedDetails& details) override;
   void OnFocus() override;
   void OnBlur() override;
+  void AddedToWidget() override;
+  void RemovedFromWidget() override;
 
   // Overridden from InkDropHostView:
   std::unique_ptr<InkDrop> CreateInkDrop() override;
@@ -261,6 +267,28 @@
  private:
   FRIEND_TEST_ALL_PREFIXES(BlueButtonTest, Border);
 
+  // Bridge class to allow Button to observe a Widget without being a
+  // WidgetObserver. This is desirable because many Button subclasses are
+  // themselves WidgetObservers, and if Button is a WidgetObserver, any change
+  // to its WidgetObserver overrides requires updating all the subclasses as
+  // well.
+  class WidgetObserverButtonBridge : public WidgetObserver {
+   public:
+    WidgetObserverButtonBridge(Button* owner);
+    ~WidgetObserverButtonBridge() override;
+
+    // WidgetObserver:
+    void OnWidgetActivationChanged(Widget* widget, bool active) override;
+    void OnWidgetDestroying(Widget* widget) override;
+
+   private:
+    Button* owner_;
+
+    DISALLOW_COPY_AND_ASSIGN(WidgetObserverButtonBridge);
+  };
+
+  void WidgetActivationChanged(Widget* widget, bool active);
+
   // The text shown in a tooltip.
   base::string16 tooltip_text_;
 
@@ -306,6 +334,8 @@
 
   std::unique_ptr<Painter> focus_painter_;
 
+  std::unique_ptr<WidgetObserverButtonBridge> widget_observer_;
+
   DISALLOW_COPY_AND_ASSIGN(Button);
 };
 
diff --git a/ui/views/controls/button/label_button.cc b/ui/views/controls/button/label_button.cc
index 3bc3d35..0ed719ea 100644
--- a/ui/views/controls/button/label_button.cc
+++ b/ui/views/controls/button/label_button.cc
@@ -493,7 +493,7 @@
 }
 
 void LabelButton::UpdateImage() {
-  image_->SetImage(GetImage(state()));
+  image_->SetImage(GetImage(GetVisualState()));
   ResetCachedPreferredSize();
 }
 
diff --git a/ui/views/examples/animated_image_view_example.cc b/ui/views/examples/animated_image_view_example.cc
index 4e52a95..095403a 100644
--- a/ui/views/examples/animated_image_view_example.cc
+++ b/ui/views/examples/animated_image_view_example.cc
@@ -14,8 +14,8 @@
 #include "base/strings/utf_string_conversions.h"
 #include "base/threading/thread_restrictions.h"
 #include "build/build_config.h"
+#include "cc/paint/skottie_wrapper.h"
 #include "ui/gfx/geometry/insets.h"
-#include "ui/gfx/skottie_wrapper.h"
 #include "ui/views/border.h"
 #include "ui/views/controls/animated_image_view.h"
 #include "ui/views/controls/button/button.h"
@@ -99,7 +99,7 @@
 #endif  // defined(OS_POSIX)
     base::ReadFileToString(path, &json);
 
-    auto skottie = base::MakeRefCounted<gfx::SkottieWrapper>(
+    auto skottie = base::MakeRefCounted<cc::SkottieWrapper>(
         base::RefCountedString::TakeString(&json));
     animated_image_view_->SetAnimatedImage(
         std::make_unique<gfx::SkiaVectorAnimation>(skottie));
diff --git a/ui/views/style/platform_style.cc b/ui/views/style/platform_style.cc
index 564d6e6..cd11ab2b8 100644
--- a/ui/views/style/platform_style.cc
+++ b/ui/views/style/platform_style.cc
@@ -63,6 +63,7 @@
 const bool PlatformStyle::kTextfieldUsesDragCursorWhenDraggable = true;
 const bool PlatformStyle::kShouldElideBookmarksInBookmarksBar = false;
 const bool PlatformStyle::kPreferFocusRings = false;
+const bool PlatformStyle::kInactiveWidgetControlsAppearDisabled = false;
 
 // static
 std::unique_ptr<ScrollBar> PlatformStyle::CreateScrollBar(bool is_horizontal) {
diff --git a/ui/views/style/platform_style.h b/ui/views/style/platform_style.h
index b8e74bed..35b2c575 100644
--- a/ui/views/style/platform_style.h
+++ b/ui/views/style/platform_style.h
@@ -83,6 +83,9 @@
   // hover state on focus.
   static const bool kPreferFocusRings;
 
+  // Whether controls in inactive widgets appear disabled.
+  static const bool kInactiveWidgetControlsAppearDisabled;
+
   // Creates the default scrollbar for the given orientation.
   static std::unique_ptr<ScrollBar> CreateScrollBar(bool is_horizontal);
 
diff --git a/ui/views/style/platform_style_mac.mm b/ui/views/style/platform_style_mac.mm
index 945f4b2e..78403d7 100644
--- a/ui/views/style/platform_style_mac.mm
+++ b/ui/views/style/platform_style_mac.mm
@@ -43,6 +43,7 @@
 const bool PlatformStyle::kShouldElideBookmarksInBookmarksBar = true;
 const bool PlatformStyle::kUseRipples = false;
 const bool PlatformStyle::kPreferFocusRings = true;
+const bool PlatformStyle::kInactiveWidgetControlsAppearDisabled = true;
 
 const Button::NotifyAction PlatformStyle::kMenuNotifyActivationAction =
     Button::NOTIFY_ON_PRESS;