diff --git a/DEPS b/DEPS
index bdc6d38f..da30d83 100644
--- a/DEPS
+++ b/DEPS

@@ -178,11 +178,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': 'be72c44ec3d893b67a75c5d4ff3e1173d9844318',
+  'skia_revision': 'c1baf6e1c2a5454148adb516f0f833483b5a0353',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'e31b0cbef9d3c9a664c48cedac2a4db629dff529',
+  'v8_revision': '679989d42fcc8ac20e99b16c80f40227db259739',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -190,7 +190,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling ANGLE
   # and whatever else without interference from each other.
-  'angle_revision': 'fcfe7fad6f8039758f0e0b67d388f8e4fcfc5b53',
+  'angle_revision': '3a9098412b8cc9163d8b46c2861c59fce69d052b',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling SwiftShader
   # and whatever else without interference from each other.
@@ -225,7 +225,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling NaCl
   # and whatever else without interference from each other.
-  'nacl_revision': '98e6f0f2dc32172835122736bbc317335d8d20e4',
+  'nacl_revision': 'f45e60c61cc1ae967e6f5fefc8f3e560e3b3c501',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling freetype
   # and whatever else without interference from each other.
@@ -249,7 +249,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling devtools-frontend
   # and whatever else without interference from each other.
-  'devtools_frontend_revision': 'bf20468f57c10589abcb0df9dd397af1719e289b',
+  'devtools_frontend_revision': 'b8584478ddff43a6c260e267ccacc5e12188ab00',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libprotobuf-mutator
   # and whatever else without interference from each other.
@@ -301,11 +301,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
-  'dawn_revision': '20ed6f42b34f4989022a2a3c87f057d90a6618dd',
+  'dawn_revision': '75ef5963b477ceb3cfb8e4c6c666346dba6f08cd',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
-  'quiche_revision': '7ccff5893596bbe81c17e66b40753c6325082f96',
+  'quiche_revision': '7e51f6b2fe2808832ea822bdc73a600d1ada0de9',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling ios_webkit
   # and whatever else without interference from each other.
@@ -1298,7 +1298,7 @@
       'packages': [
           {
               'package': 'fuchsia/third_party/aemu/linux-amd64',
-              'version': 'LGuw6T69CkbKtj1l1zV1K4H1muHnwRXJ75r9usJ209UC'
+              'version': 'ntzwgRu0pCzIySFuWnU1_CGCKyN2QUoLS9KcuT34wgMC'
           },
       ],
       'condition': 'host_os == "linux" and checkout_fuchsia',
@@ -1453,7 +1453,7 @@
   },
 
   'src/third_party/webrtc':
-    Var('webrtc_git') + '/src.git' + '@' + 'da76ad3c490eed81ef5028252826ab2ab1e7402f',
+    Var('webrtc_git') + '/src.git' + '@' + 'b088a952ee9f4a5676bf54e41c1519f19c3d9d11',
 
   'src/third_party/libgifcodec':
      Var('skia_git') + '/libgifcodec' + '@'+  Var('libgifcodec_revision'),
@@ -1525,7 +1525,7 @@
     Var('chromium_git') + '/v8/v8.git' + '@' +  Var('v8_revision'),
 
   'src-internal': {
-    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@fcbb1943453fb6ee34d935df920397eb211e97e5',
+    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@c7d195b7c991483cfa6c9de9fed08b674330fe0a',
     'condition': 'checkout_src_internal',
   },
 
@@ -1533,7 +1533,7 @@
     'packages': [
       {
         'package': 'chromeos_internal/apps/help_app/app',
-        'version': '4LNO2QORJBlLuLF5s9dotu4sFJmSIF4tM_K_Xa7AxcIC',
+        'version': '2-qOcOasdsOBSeuuk0i7nSS6i3i8VeOt-lPAW8ZcGrwC',
       },
     ],
     'condition': 'checkout_chromeos and checkout_src_internal',

diff --git a/android_webview/browser/aw_browser_context.cc b/android_webview/browser/aw_browser_context.cc
index 89f1ad6..42807de5 100644
--- a/android_webview/browser/aw_browser_context.cc
+++ b/android_webview/browser/aw_browser_context.cc

@@ -456,14 +456,13 @@
       ::prefs::kSafeBrowsingExtendedReportingOptInAllowed, allowed);
 }
 
-// TODO(amalova): Make sure NetworkContext is configured correctly when
+// TODO(amalova): Make sure NetworkContextParams is configured correctly when
 // off-the-record
-network::mojom::NetworkContextParamsPtr
-AwBrowserContext::GetNetworkContextParams(
+void AwBrowserContext::ConfigureNetworkContextParams(
     bool in_memory,
-    const base::FilePath& relative_partition_path) {
-  network::mojom::NetworkContextParamsPtr context_params =
-      network::mojom::NetworkContextParams::New();
+    const base::FilePath& relative_partition_path,
+    network::mojom::NetworkContextParams* context_params,
+    network::mojom::CertVerifierCreationParams* cert_verifier_creation_params) {
   context_params->user_agent = android_webview::GetUserAgent();
 
   // TODO(ntfschr): set this value to a proper value based on the user's
@@ -515,14 +514,12 @@
 
   // Update the cors_exempt_header_list to include internally-added headers, to
   // avoid triggering CORS checks.
-  content::UpdateCorsExemptHeader(context_params.get());
-  variations::UpdateCorsExemptHeaderForVariations(context_params.get());
+  content::UpdateCorsExemptHeader(context_params);
+  variations::UpdateCorsExemptHeaderForVariations(context_params);
 
   // Add proxy settings
   AwProxyConfigMonitor::GetInstance()->AddProxyToNetworkContextParams(
       context_params);
-
-  return context_params;
 }
 
 base::android::ScopedJavaLocalRef<jobject> JNI_AwBrowserContext_GetDefaultJava(

diff --git a/android_webview/browser/aw_browser_context.h b/android_webview/browser/aw_browser_context.h
index 2efce28..916a1d1 100644
--- a/android_webview/browser/aw_browser_context.h
+++ b/android_webview/browser/aw_browser_context.h

@@ -112,9 +112,12 @@
 
   void SetExtendedReportingAllowed(bool allowed);
 
-  network::mojom::NetworkContextParamsPtr GetNetworkContextParams(
+  void ConfigureNetworkContextParams(
       bool in_memory,
-      const base::FilePath& relative_partition_path);
+      const base::FilePath& relative_partition_path,
+      network::mojom::NetworkContextParams* network_context_params,
+      network::mojom::CertVerifierCreationParams*
+          cert_verifier_creation_params);
 
   base::android::ScopedJavaLocalRef<jobject> GetJavaBrowserContext();
 

diff --git a/android_webview/browser/aw_browser_context_unittest.cc b/android_webview/browser/aw_browser_context_unittest.cc
index 802b2ff..3a5bb54 100644
--- a/android_webview/browser/aw_browser_context_unittest.cc
+++ b/android_webview/browser/aw_browser_context_unittest.cc

@@ -11,6 +11,7 @@
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_content_client_initializer.h"
 #include "mojo/core/embedder/embedder.h"
+#include "services/network/public/mojom/network_context.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace android_webview {
@@ -53,13 +54,14 @@
 // enforced for the NetworkContext, as it should behave like the Android system.
 TEST_F(AwBrowserContextTest, SymantecPoliciesExempted) {
   AwBrowserContext context;
-  network::mojom::NetworkContextParamsPtr network_context_params =
-      context.GetNetworkContextParams(false, base::FilePath());
+  network::mojom::NetworkContextParams network_context_params;
+  network::mojom::CertVerifierCreationParams cert_verifier_params;
+  context.ConfigureNetworkContextParams(
+      false, base::FilePath(), &network_context_params, &cert_verifier_params);
 
-  ASSERT_TRUE(network_context_params);
-  ASSERT_TRUE(network_context_params->initial_ssl_config);
-  ASSERT_TRUE(network_context_params->initial_ssl_config
-                  ->symantec_enforcement_disabled);
+  ASSERT_TRUE(network_context_params.initial_ssl_config);
+  ASSERT_TRUE(
+      network_context_params.initial_ssl_config->symantec_enforcement_disabled);
 }
 
 // Tests that SHA-1 is still allowed for locally-installed trust anchors,
@@ -67,13 +69,14 @@
 // the Android system.
 TEST_F(AwBrowserContextTest, SHA1LocalAnchorsAllowed) {
   AwBrowserContext context;
-  network::mojom::NetworkContextParamsPtr network_context_params =
-      context.GetNetworkContextParams(false, base::FilePath());
+  network::mojom::NetworkContextParams network_context_params;
+  network::mojom::CertVerifierCreationParams cert_verifier_params;
+  context.ConfigureNetworkContextParams(
+      false, base::FilePath(), &network_context_params, &cert_verifier_params);
 
-  ASSERT_TRUE(network_context_params);
-  ASSERT_TRUE(network_context_params->initial_ssl_config);
+  ASSERT_TRUE(network_context_params.initial_ssl_config);
   ASSERT_TRUE(
-      network_context_params->initial_ssl_config->sha1_local_anchors_enabled);
+      network_context_params.initial_ssl_config->sha1_local_anchors_enabled);
 }
 
 }  // namespace android_webview

diff --git a/android_webview/browser/aw_content_browser_client.cc b/android_webview/browser/aw_content_browser_client.cc
index 856b07f..3f24224 100644
--- a/android_webview/browser/aw_content_browser_client.cc
+++ b/android_webview/browser/aw_content_browser_client.cc

@@ -211,20 +211,6 @@
                                             child_render_frame_id);
 }
 
-void PassMojoCookieManagerToAwCookieManager(
-    CookieManager* cookie_manager,
-    const mojo::Remote<network::mojom::NetworkContext>& network_context) {
-  // Get the CookieManager from the NetworkContext.
-  mojo::PendingRemote<network::mojom::CookieManager> cookie_manager_remote;
-  network_context->GetCookieManager(
-      cookie_manager_remote.InitWithNewPipeAndPassReceiver());
-
-  // Pass the mojo::PendingRemote<network::mojom::CookieManager> to
-  // android_webview::CookieManager, so it can implement its APIs with this mojo
-  // CookieManager.
-  cookie_manager->SetMojoCookieManager(std::move(cookie_manager_remote));
-}
-
 // Helper method that checks the RenderProcessHost is still alive before hopping
 // over to the IO thread.
 void MaybeCreateSafeBrowsing(
@@ -311,32 +297,35 @@
   content::GetNetworkService()->SetUpHttpAuth(std::move(auth_static_params));
 }
 
-mojo::Remote<network::mojom::NetworkContext>
-AwContentBrowserClient::CreateNetworkContext(
+void AwContentBrowserClient::ConfigureNetworkContextParams(
     content::BrowserContext* context,
     bool in_memory,
-    const base::FilePath& relative_partition_path) {
+    const base::FilePath& relative_partition_path,
+    network::mojom::NetworkContextParams* network_context_params,
+    network::mojom::CertVerifierCreationParams* cert_verifier_creation_params) {
   DCHECK(context);
 
   content::GetNetworkService()->ConfigureHttpAuthPrefs(
       AwBrowserProcess::GetInstance()->CreateHttpAuthDynamicParams());
 
-  auto* aw_context = static_cast<AwBrowserContext*>(context);
-  mojo::Remote<network::mojom::NetworkContext> network_context;
-  network::mojom::NetworkContextParamsPtr context_params =
-      aw_context->GetNetworkContextParams(in_memory, relative_partition_path);
+  AwBrowserContext* aw_context = static_cast<AwBrowserContext*>(context);
+  aw_context->ConfigureNetworkContextParams(in_memory, relative_partition_path,
+                                            network_context_params,
+                                            cert_verifier_creation_params);
+
+  mojo::PendingRemote<network::mojom::CookieManager> cookie_manager_remote;
+  network_context_params->cookie_manager =
+      cookie_manager_remote.InitWithNewPipeAndPassReceiver();
+
 #if DCHECK_IS_ON()
   g_created_network_context_params = true;
 #endif
-  content::GetNetworkService()->CreateNetworkContext(
-      network_context.BindNewPipeAndPassReceiver(), std::move(context_params));
 
-  // Pass a CookieManager to the code supporting AwCookieManager.java (i.e., the
-  // Cookies APIs).
-  PassMojoCookieManagerToAwCookieManager(aw_context->GetCookieManager(),
-                                         network_context);
-
-  return network_context;
+  // Pass the mojo::PendingRemote<network::mojom::CookieManager> to
+  // android_webview::CookieManager, so it can implement its APIs with this mojo
+  // CookieManager.
+  aw_context->GetCookieManager()->SetMojoCookieManager(
+      std::move(cookie_manager_remote));
 }
 
 AwBrowserContext* AwContentBrowserClient::InitBrowserContext() {

diff --git a/android_webview/browser/aw_content_browser_client.h b/android_webview/browser/aw_content_browser_client.h
index fb6dc565..e07e14c 100644
--- a/android_webview/browser/aw_content_browser_client.h
+++ b/android_webview/browser/aw_content_browser_client.h

@@ -59,11 +59,13 @@
   // content::ContentBrowserClient:
   void OnNetworkServiceCreated(
       network::mojom::NetworkService* network_service) override;
-  mojo::Remote<network::mojom::NetworkContext> CreateNetworkContext(
+  void ConfigureNetworkContextParams(
       content::BrowserContext* context,
       bool in_memory,
-      const base::FilePath& relative_partition_path) override;
-
+      const base::FilePath& relative_partition_path,
+      network::mojom::NetworkContextParams* network_context_params,
+      network::mojom::CertVerifierCreationParams* cert_verifier_creation_params)
+      override;
   std::unique_ptr<content::BrowserMainParts> CreateBrowserMainParts(
       const content::MainFunctionParams& parameters) override;
   content::WebContentsViewDelegate* GetWebContentsViewDelegate(

diff --git a/android_webview/browser/network_service/aw_proxy_config_monitor.cc b/android_webview/browser/network_service/aw_proxy_config_monitor.cc
index 59774c0..561236a 100644
--- a/android_webview/browser/network_service/aw_proxy_config_monitor.cc
+++ b/android_webview/browser/network_service/aw_proxy_config_monitor.cc

@@ -42,7 +42,7 @@
 }
 
 void AwProxyConfigMonitor::AddProxyToNetworkContextParams(
-    network::mojom::NetworkContextParamsPtr& network_context_params) {
+    network::mojom::NetworkContextParams* network_context_params) {
   const base::CommandLine& command_line =
       *base::CommandLine::ForCurrentProcess();
   if (command_line.HasSwitch(kProxyServerSwitch)) {

diff --git a/android_webview/browser/network_service/aw_proxy_config_monitor.h b/android_webview/browser/network_service/aw_proxy_config_monitor.h
index 2f7d616..653c952 100644
--- a/android_webview/browser/network_service/aw_proxy_config_monitor.h
+++ b/android_webview/browser/network_service/aw_proxy_config_monitor.h

@@ -26,7 +26,7 @@
   static AwProxyConfigMonitor* GetInstance();
 
   void AddProxyToNetworkContextParams(
-      network::mojom::NetworkContextParamsPtr& network_context_params);
+      network::mojom::NetworkContextParams* network_context_params);
   std::string SetProxyOverride(
       const std::vector<net::ProxyConfigServiceAndroid::ProxyOverrideRule>&
           proxy_rules,

diff --git a/ash/wm/drag_window_resizer.cc b/ash/wm/drag_window_resizer.cc
index 53a97de..b6c1ef64 100644
--- a/ash/wm/drag_window_resizer.cc
+++ b/ash/wm/drag_window_resizer.cc

@@ -24,6 +24,7 @@
 #include "ui/gfx/geometry/point_conversions.h"
 #include "ui/wm/core/coordinate_conversion.h"
 #include "ui/wm/core/cursor_manager.h"
+#include "ui/wm/core/shadow_controller.h"
 #include "ui/wm/core/window_util.h"
 
 namespace ash {
@@ -40,16 +41,18 @@
 }  // namespace
 
 // static
-DragWindowResizer* DragWindowResizer::instance_ = NULL;
+DragWindowResizer* DragWindowResizer::instance_ = nullptr;
 
 DragWindowResizer::~DragWindowResizer() {
-  if (window_state_)
-    window_state_->DeleteDragDetails();
   Shell* shell = Shell::Get();
+  if (window_state_) {
+    window_state_->DeleteDragDetails();
+    shell->shadow_controller()->UpdateShadowForWindow(window_state_->window());
+  }
   shell->mouse_cursor_filter()->set_mouse_warp_enabled(true);
   shell->mouse_cursor_filter()->HideSharedEdgeIndicator();
   if (instance_ == this)
-    instance_ = NULL;
+    instance_ = nullptr;
 }
 
 void DragWindowResizer::Drag(const gfx::PointF& location, int event_flags) {
@@ -97,6 +100,8 @@
   mouse_cursor_filter->set_mouse_warp_enabled(ShouldAllowMouseWarp());
   if (ShouldAllowMouseWarp())
     mouse_cursor_filter->ShowSharedEdgeIndicator(GetTarget()->GetRootWindow());
+  Shell::Get()->shadow_controller()->UpdateShadowForWindow(
+      window_state->window());
   instance_ = this;
 }
 

diff --git a/ash/wm/workspace/workspace_window_resizer.cc b/ash/wm/workspace/workspace_window_resizer.cc
index 09a856920..d3e96f8 100644
--- a/ash/wm/workspace/workspace_window_resizer.cc
+++ b/ash/wm/workspace/workspace_window_resizer.cc

@@ -6,9 +6,7 @@
 
 #include <algorithm>
 #include <cmath>
-#include <memory>
 #include <utility>
-#include <vector>
 
 #include "ash/public/cpp/app_types.h"
 #include "ash/public/cpp/ash_features.h"
@@ -31,7 +29,6 @@
 #include "ash/wm/window_util.h"
 #include "ash/wm/wm_event.h"
 #include "ash/wm/workspace/phantom_window_controller.h"
-#include "base/memory/weak_ptr.h"
 #include "base/metrics/user_metrics.h"
 #include "ui/aura/client/aura_constants.h"
 #include "ui/aura/client/window_types.h"
@@ -40,7 +37,6 @@
 #include "ui/base/class_property.h"
 #include "ui/base/hit_test.h"
 #include "ui/compositor/layer.h"
-#include "ui/display/display.h"
 #include "ui/display/screen.h"
 #include "ui/gfx/transform.h"
 #include "ui/wm/core/coordinate_conversion.h"
@@ -306,6 +302,38 @@
     window->SetProperty(kFrameRestoreLookKey, false);
 }
 
+// Returns the snap type based on the |location_in_screen|.
+WorkspaceWindowResizer::SnapType GetSnapType(
+    const display::Display& display,
+    const gfx::PointF& location_in_screen) {
+  gfx::Rect area = display.work_area();
+  // Add tolerance for snapping near each display edge that is the same as the
+  // corresponding work area edge. For example, assuming the shelf is the only
+  // element that alters work area, dragging a window to the left edge when the
+  // shelf is aligned to the bottom will trigger a window snap if the location
+  // is between 0 and |kScreenEdgeInsetForSnapping|, but dragging a window to
+  // the left edge when the shelf is aligned to the left will trigger a window
+  // snap once it is past the shelf's right edge.
+  gfx::Insets insets;
+  if (area.x() == display.bounds().x())
+    insets.set_left(kScreenEdgeInsetForSnapping);
+  if (area.right() == display.bounds().right())
+    insets.set_right(kScreenEdgeInsetForSnapping);
+  if (area.y() == display.bounds().y())
+    insets.set_top(kScreenEdgeInsetForSnapping);
+  area.Inset(insets);
+
+  if (location_in_screen.x() <= area.x()) {
+    return WorkspaceWindowResizer::SnapType::kLeft;
+  } else if (location_in_screen.x() >= area.right() - 1) {
+    return WorkspaceWindowResizer::SnapType::kRight;
+  } else if (location_in_screen.y() <= area.y() &&
+             location_in_screen.y() >= display.bounds().y()) {
+    return WorkspaceWindowResizer::SnapType::kMaximize;
+  }
+  return WorkspaceWindowResizer::SnapType::kNone;
+}
+
 }  // namespace
 
 std::unique_ptr<WindowResizer> CreateWindowResizer(
@@ -509,8 +537,16 @@
     if (!resizer)
       return;
   }
+
   gfx::PointF location_in_screen = location_in_parent;
   ::wm::ConvertPointToScreen(GetTarget()->parent(), &location_in_screen);
+  if (!can_snap_to_maximize_) {
+    // Check if |location_in_screen| is outside the snap region. If it is,
+    // update |can_snap_to_maximize_| and skip this check on subsequent drags.
+    can_snap_to_maximize_ =
+        ::ash::GetSnapType(GetDisplay(), location_in_screen) !=
+        SnapType::kMaximize;
+  }
   UpdateSnapPhantomWindow(location_in_screen, bounds);
 }
 
@@ -1114,19 +1150,8 @@
   if (!did_move_or_resize_ || details().window_component != HTCAPTION)
     return;
 
-  display::Screen* screen = display::Screen::GetScreen();
-  display::Display display;
-  if (details().source == ::wm::WINDOW_MOVE_SOURCE_TOUCH) {
-    display = screen->GetDisplayNearestWindow(GetTarget());
-  } else {
-    // The |Display| object returned by |CursorManager::GetDisplay| may be
-    // stale, but will have the correct id.
-    // TODO(oshima): Change the API so |GetDisplay| just returns a display id.
-    screen->GetDisplayWithDisplayId(
-        Shell::Get()->cursor_manager()->GetDisplay().id(), &display);
-  }
+  display::Display display = GetDisplay();
   SnapType last_type = snap_type_;
-  DCHECK(display.is_valid());
   snap_type_ = GetSnapType(display, location_in_screen);
 
   // Reset the controller if no snap or switching snap types. The latter is so
@@ -1196,32 +1221,7 @@
 WorkspaceWindowResizer::SnapType WorkspaceWindowResizer::GetSnapType(
     const display::Display& display,
     const gfx::PointF& location_in_screen) const {
-  gfx::Rect area = display.work_area();
-  // Add tolerance for snapping near each display edge that is the same as the
-  // corresponding work area edge. For example, assuming the shelf is the only
-  // element that alters work area, dragging a window to the left edge when the
-  // shelf is aligned to the bottom will trigger a window snap if the location
-  // is between 0 and |kScreenEdgeInsetForSnapping|, but dragging a window to
-  // the left edge when the shelf is aligned to the left will trigger a window
-  // snap once it is past the shelf's right edge.
-  gfx::Insets insets;
-  if (area.x() == display.bounds().x())
-    insets.set_left(kScreenEdgeInsetForSnapping);
-  if (area.right() == display.bounds().right())
-    insets.set_right(kScreenEdgeInsetForSnapping);
-  if (area.y() == display.bounds().y())
-    insets.set_top(kScreenEdgeInsetForSnapping);
-  area.Inset(insets);
-
-  SnapType snap_type = SnapType::kNone;
-  if (location_in_screen.x() <= area.x()) {
-    snap_type = SnapType::kLeft;
-  } else if (location_in_screen.x() >= area.right() - 1) {
-    snap_type = SnapType::kRight;
-  } else if (location_in_screen.y() <= area.y() &&
-             location_in_screen.y() >= display.bounds().y()) {
-    snap_type = SnapType::kMaximize;
-  }
+  SnapType snap_type = ::ash::GetSnapType(display, location_in_screen);
 
   // Change |snap_type| to none if the requested snap type is not compatible
   // with the window.
@@ -1232,7 +1232,7 @@
         snap_type = SnapType::kNone;
       break;
     case SnapType::kMaximize:
-      if (!window_state()->CanMaximize())
+      if (!window_state()->CanMaximize() || !can_snap_to_maximize_)
         snap_type = SnapType::kNone;
       break;
     case SnapType::kNone:
@@ -1333,4 +1333,20 @@
   }
 }
 
+display::Display WorkspaceWindowResizer::GetDisplay() const {
+  display::Screen* screen = display::Screen::GetScreen();
+  display::Display display;
+  if (details().source == ::wm::WINDOW_MOVE_SOURCE_TOUCH) {
+    display = screen->GetDisplayNearestWindow(GetTarget());
+  } else {
+    // The |Display| object returned by |CursorManager::GetDisplay| may be
+    // stale, but will have the correct id.
+    // TODO(oshima): Change the API so |GetDisplay| just returns a display id.
+    screen->GetDisplayWithDisplayId(
+        Shell::Get()->cursor_manager()->GetDisplay().id(), &display);
+  }
+  DCHECK(display.is_valid());
+  return display;
+}
+
 }  // namespace ash

diff --git a/ash/wm/workspace/workspace_window_resizer.h b/ash/wm/workspace/workspace_window_resizer.h
index a53c76d..c28d46c 100644
--- a/ash/wm/workspace/workspace_window_resizer.h
+++ b/ash/wm/workspace/workspace_window_resizer.h

@@ -12,16 +12,12 @@
 
 #include "ash/wm/window_resizer.h"
 #include "ash/wm/workspace/magnetism_matcher.h"
-#include "base/compiler_specific.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "ui/aura/window_tracker.h"
+#include "ui/display/display.h"
 #include "ui/gfx/geometry/point_f.h"
 
-namespace display {
-class Display;
-}  // namespace display
-
 namespace ash {
 class PhantomWindowController;
 class WindowSize;
@@ -34,6 +30,9 @@
 // attempt to restore the old height.
 class ASH_EXPORT WorkspaceWindowResizer : public WindowResizer {
  public:
+  // Possible states the window can end up in after a drag is complete.
+  enum class SnapType { kLeft, kRight, kMaximize, kNone };
+
   // Min height we'll force on screen when dragging the caption.
   // TODO: this should come from a property on the window.
   static constexpr int kMinOnscreenHeight = 32;
@@ -53,9 +52,6 @@
  private:
   friend class WorkspaceWindowResizerTest;
 
-  // Possible states the window can end up in after a drag is complete.
-  enum class SnapType { kLeft, kRight, kMaximize, kNone };
-
   WorkspaceWindowResizer(WindowState* window_state,
                          const std::vector<aura::Window*>& attached_windows);
 
@@ -160,6 +156,10 @@
   void StartDragForAttachedWindows();
   void EndDragForAttachedWindows(bool revert_drag);
 
+  // Gets the display associated with GetTarget() if touch dragging. Gets the
+  // display associated with the cursor if mouse dragging.
+  display::Display GetDisplay() const;
+
   WindowState* window_state() { return window_state_; }
   const WindowState* window_state() const { return window_state_; }
 
@@ -193,6 +193,12 @@
   // The edge to which the window should be snapped to at the end of the drag.
   SnapType snap_type_ = SnapType::kNone;
 
+  // Tracks whether a window can be maximized depending on distance dragged.
+  // This is false when a window's initial drag location is within the drag to
+  // snap region - it will become true once the window has been dragged out
+  // of the snap region once. Used to reduce accidental snaps.
+  bool can_snap_to_maximize_ = false;
+
   // The mouse location passed to Drag().
   gfx::PointF last_mouse_location_;
 

diff --git a/ash/wm/workspace/workspace_window_resizer_unittest.cc b/ash/wm/workspace/workspace_window_resizer_unittest.cc
index f0ca1c7..d1a9a83 100644
--- a/ash/wm/workspace/workspace_window_resizer_unittest.cc
+++ b/ash/wm/workspace/workspace_window_resizer_unittest.cc

@@ -196,10 +196,6 @@
     return workspace_resizer_->snap_phantom_window_controller_.get();
   }
 
-  std::vector<aura::Window*> empty_windows() const {
-    return std::vector<aura::Window*>();
-  }
-
   void InitTouchResizeWindow(const gfx::Rect& bounds, int window_component) {
     touch_resize_delegate_.set_window_component(window_component);
     touch_resize_window_.reset(CreateTestWindowInShellWithDelegate(
@@ -2014,29 +2010,33 @@
   EXPECT_EQ(gfx::Rect(800, 600), window_->bounds());
 }
 
-using MultiDisplayWorkspaceWindowResizerTest = AshTestBase;
+TEST_F(WorkspaceWindowResizerTest, DragToMaximizeStartingInSnapRegion) {
+  UpdateDisplay("800x648");
 
-// Makes sure that window drag magnetism still works when a window is dragged
-// between different displays.
-TEST_F(MultiDisplayWorkspaceWindowResizerTest, Magnetism) {
-  UpdateDisplay("800x600,500x500");
-  auto roots = Shell::GetAllRootWindows();
-  ASSERT_EQ(2u, roots.size());
+  // Drag starting in the snap to maximize region. If we do not leave it, on
+  // drag release the window will not get maximized.
+  window_->SetBounds(gfx::Rect(200, 200));
+  window_->SetProperty(aura::client::kResizeBehaviorKey,
+                       aura::client::kResizeBehaviorCanResize |
+                           aura::client::kResizeBehaviorCanMaximize);
+  WindowState::Get(window_.get())->Maximize();
 
-  // Create two windows one on the first display, and the other on the second.
-  auto win1 = CreateToplevelTestWindow(gfx::Rect(10, 10, 100, 100), /*id=*/1);
-  auto win2 = CreateToplevelTestWindow(gfx::Rect(1250, 100, 50, 50), /*id=*/2);
-  EXPECT_EQ(win1->GetRootWindow(), roots[0]);
-  EXPECT_EQ(win2->GetRootWindow(), roots[1]);
+  std::unique_ptr<WindowResizer> resizer(
+      CreateResizerForTest(window_.get(), gfx::Point(400.f, 1.f), HTCAPTION));
+  resizer->Drag(gfx::PointF(400.f, 25.f), 0);
+  resizer->CompleteDrag();
+  ASSERT_FALSE(WindowState::Get(window_.get())->IsMaximized());
 
-  std::unique_ptr<WindowResizer> resizer = CreateWindowResizer(
-      win1.get(), gfx::PointF(), HTCAPTION, ::wm::WINDOW_MOVE_SOURCE_MOUSE);
-  ASSERT_TRUE(resizer.get());
-
-  // Drag `win1` such that its right edge is 5 pixels from the left edge of
-  // `win2`. Expect that `win1` will snap to `win2` on its left edge.
-  resizer->Drag(CalculateDragPoint(*resizer, 1135, 0), /*event_flags=*/0);
-  EXPECT_EQ(gfx::Rect(1150, 10, 100, 100), win1->GetBoundsInScreen());
+  // This time exit the snap region. On returning and completing the drag, the
+  // window should be maximized.
+  WindowState::Get(window_.get())->Maximize();
+  resizer.reset();
+  resizer.reset(
+      CreateResizerForTest(window_.get(), gfx::Point(400.f, 1.f), HTCAPTION));
+  resizer->Drag(gfx::PointF(400.f, 400.f), 0);
+  resizer->Drag(gfx::PointF(400.f, 25.f), 0);
+  resizer->CompleteDrag();
+  EXPECT_TRUE(WindowState::Get(window_.get())->IsMaximized());
 }
 
 // Makes sure that we are not creating any resizer in kiosk mode.
@@ -2063,4 +2063,29 @@
   EXPECT_TRUE(CreateResizerForTest(window_.get(), gfx::Point(), HTCAPTION));
 }
 
+using MultiDisplayWorkspaceWindowResizerTest = AshTestBase;
+
+// Makes sure that window drag magnetism still works when a window is dragged
+// between different displays.
+TEST_F(MultiDisplayWorkspaceWindowResizerTest, Magnetism) {
+  UpdateDisplay("800x600,500x500");
+  auto roots = Shell::GetAllRootWindows();
+  ASSERT_EQ(2u, roots.size());
+
+  // Create two windows one on the first display, and the other on the second.
+  auto win1 = CreateToplevelTestWindow(gfx::Rect(10, 10, 100, 100), /*id=*/1);
+  auto win2 = CreateToplevelTestWindow(gfx::Rect(1250, 100, 50, 50), /*id=*/2);
+  EXPECT_EQ(win1->GetRootWindow(), roots[0]);
+  EXPECT_EQ(win2->GetRootWindow(), roots[1]);
+
+  std::unique_ptr<WindowResizer> resizer = CreateWindowResizer(
+      win1.get(), gfx::PointF(), HTCAPTION, ::wm::WINDOW_MOVE_SOURCE_MOUSE);
+  ASSERT_TRUE(resizer.get());
+
+  // Drag `win1` such that its right edge is 5 pixels from the left edge of
+  // `win2`. Expect that `win1` will snap to `win2` on its left edge.
+  resizer->Drag(CalculateDragPoint(*resizer, 1135, 0), /*event_flags=*/0);
+  EXPECT_EQ(gfx::Rect(1150, 10, 100, 100), win1->GetBoundsInScreen());
+}
+
 }  // namespace ash

diff --git a/base/memory/checked_ptr.h b/base/memory/checked_ptr.h
index 261c6b4c..dc81e98 100644
--- a/base/memory/checked_ptr.h
+++ b/base/memory/checked_ptr.h

@@ -59,6 +59,9 @@
   static ALWAYS_INLINE uintptr_t Advance(uintptr_t wrapped_ptr, size_t delta) {
     return wrapped_ptr + delta;
   }
+
+  // This is for accounting only, used by unit tests.
+  static ALWAYS_INLINE void IncrementSwapCountForTest() {}
 };
 
 template <typename T>
@@ -206,6 +209,7 @@
   }
 
   ALWAYS_INLINE void swap(CheckedPtr& other) noexcept {
+    Impl::IncrementSwapCountForTest();
     std::swap(wrapped_ptr_, other.wrapped_ptr_);
   }
 
@@ -258,8 +262,8 @@
   return !operator==(lhs, rhs);
 }
 
-template <typename T>
-ALWAYS_INLINE void swap(CheckedPtr<T>& lhs, CheckedPtr<T>& rhs) noexcept {
+template <typename T, typename I>
+ALWAYS_INLINE void swap(CheckedPtr<T, I>& lhs, CheckedPtr<T, I>& rhs) noexcept {
   lhs.swap(rhs);
 }
 

diff --git a/base/memory/checked_ptr_unittest.cc b/base/memory/checked_ptr_unittest.cc
index 185f557..32fa639 100644
--- a/base/memory/checked_ptr_unittest.cc
+++ b/base/memory/checked_ptr_unittest.cc

@@ -5,9 +5,9 @@
 #include "base/memory/checked_ptr.h"
 
 #include <string>
-#include <tuple>        // for std::ignore
-#include <type_traits>  // for std::is_trivially_copyable
-#include <utility>      // for std::swap
+#include <tuple>
+#include <type_traits>
+#include <utility>
 
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -52,11 +52,13 @@
 static int g_get_for_dereference_cnt = INT_MIN;
 static int g_get_for_extraction_cnt = INT_MIN;
 static int g_get_for_comparison_cnt = INT_MIN;
+static int g_checked_ptr_swap_cnt = INT_MIN;
 
 static void ClearCounters() {
   g_get_for_dereference_cnt = 0;
   g_get_for_extraction_cnt = 0;
   g_get_for_comparison_cnt = 0;
+  g_checked_ptr_swap_cnt = 0;
 }
 
 struct CheckedPtrCountingNoOpImpl : base::internal::CheckedPtrNoOpImpl {
@@ -79,6 +81,10 @@
     ++g_get_for_comparison_cnt;
     return Super::UnsafelyUnwrapPtrForComparison(wrapped_ptr);
   }
+
+  static ALWAYS_INLINE void IncrementSwapCountForTest() {
+    ++g_checked_ptr_swap_cnt;
+  }
 };
 
 template <typename T>
@@ -368,22 +374,27 @@
 }
 
 TEST(CheckedPtr, CustomSwap) {
+  ClearCounters();
   int foo1, foo2;
-  CheckedPtr<int> ptr1(&foo1);
-  CheckedPtr<int> ptr2(&foo2);
+  CountingCheckedPtr<int> ptr1(&foo1);
+  CountingCheckedPtr<int> ptr2(&foo2);
+  // Recommended use pattern.
   using std::swap;
   swap(ptr1, ptr2);
   EXPECT_EQ(ptr1.get(), &foo2);
   EXPECT_EQ(ptr2.get(), &foo1);
+  EXPECT_EQ(g_checked_ptr_swap_cnt, 1);
 }
 
 TEST(CheckedPtr, StdSwap) {
+  ClearCounters();
   int foo1, foo2;
-  CheckedPtr<int> ptr1(&foo1);
-  CheckedPtr<int> ptr2(&foo2);
+  CountingCheckedPtr<int> ptr1(&foo1);
+  CountingCheckedPtr<int> ptr2(&foo2);
   std::swap(ptr1, ptr2);
   EXPECT_EQ(ptr1.get(), &foo2);
   EXPECT_EQ(ptr2.get(), &foo1);
+  EXPECT_EQ(g_checked_ptr_swap_cnt, 0);
 }
 
 TEST(CheckedPtr, AdvanceIntArray) {

diff --git a/base/threading/platform_thread_mac.mm b/base/threading/platform_thread_mac.mm
index 296b5992..00f2f976 100644
--- a/base/threading/platform_thread_mac.mm
+++ b/base/threading/platform_thread_mac.mm

@@ -163,9 +163,23 @@
       [[NSThread currentThread] setThreadPriority:0];
       break;
     case ThreadPriority::NORMAL:
-    case ThreadPriority::DISPLAY:
       [[NSThread currentThread] setThreadPriority:0.5];
       break;
+    case ThreadPriority::DISPLAY: {
+      // Apple has suggested that insufficient priority may be the reason for
+      // Metal shader compilation hangs. A priority of 50 is higher than user
+      // input.
+      // https://crbug.com/974219.
+      [[NSThread currentThread] setThreadPriority:1.0];
+      sched_param param;
+      int policy;
+      pthread_t thread = pthread_self();
+      if (!pthread_getschedparam(thread, &policy, &param)) {
+        param.sched_priority = 50;
+        pthread_setschedparam(thread, policy, &param);
+      }
+      break;
+    }
     case ThreadPriority::REALTIME_AUDIO:
       SetPriorityRealtimeAudio();
       DCHECK_EQ([[NSThread currentThread] threadPriority], 1.0);

diff --git a/build/fuchsia/linux.sdk.sha1 b/build/fuchsia/linux.sdk.sha1
index 9f026579..1ac0ce5 100644
--- a/build/fuchsia/linux.sdk.sha1
+++ b/build/fuchsia/linux.sdk.sha1

@@ -1 +1 @@
-0.20200513.3.1
\ No newline at end of file
+0.20200514.0.1
\ No newline at end of file

diff --git a/build/fuchsia/mac.sdk.sha1 b/build/fuchsia/mac.sdk.sha1
index c3380636..1ac0ce5 100644
--- a/build/fuchsia/mac.sdk.sha1
+++ b/build/fuchsia/mac.sdk.sha1

@@ -1 +1 @@
-0.20200513.2.1
\ No newline at end of file
+0.20200514.0.1
\ No newline at end of file

diff --git a/cc/paint/display_item_list.h b/cc/paint/display_item_list.h
index 12e91531..6881ea3 100644
--- a/cc/paint/display_item_list.h
+++ b/cc/paint/display_item_list.h

@@ -181,6 +181,9 @@
   std::string ToString() const;
   bool has_draw_ops() const { return paint_op_buffer_.has_draw_ops(); }
 
+  // Ops with nested paint ops are considered as a single op.
+  size_t num_paint_ops() const { return paint_op_buffer_.size(); }
+
  private:
   friend class DisplayItemListTest;
   friend gpu::raster::RasterImplementation;

diff --git a/cc/paint/paint_recorder.cc b/cc/paint/paint_recorder.cc
index 1fb9514..cded3e2 100644
--- a/cc/paint/paint_recorder.cc
+++ b/cc/paint/paint_recorder.cc

@@ -51,4 +51,8 @@
   return display_item_list_->has_draw_ops();
 }
 
+size_t PaintRecorder::num_paint_ops() const {
+  return display_item_list_->num_paint_ops();
+}
+
 }  // namespace cc

diff --git a/cc/paint/paint_recorder.h b/cc/paint/paint_recorder.h
index 6beb024..51958353 100644
--- a/cc/paint/paint_recorder.h
+++ b/cc/paint/paint_recorder.h

@@ -39,6 +39,9 @@
 
   bool ListHasDrawOps() const;
 
+  // Ops with nested paint ops are considered as a single op.
+  size_t num_paint_ops() const;
+
  protected:
   virtual std::unique_ptr<RecordPaintCanvas> CreateCanvas(DisplayItemList* list,
                                                           const SkRect& bounds);

diff --git a/chrome/VERSION b/chrome/VERSION
index 9aba79e2..c1329a67 100644
--- a/chrome/VERSION
+++ b/chrome/VERSION

@@ -1,4 +1,4 @@
 MAJOR=84
 MINOR=0
-BUILD=4146
+BUILD=4147
 PATCH=0

diff --git a/chrome/android/chrome_junit_test_java_sources.gni b/chrome/android/chrome_junit_test_java_sources.gni
index 36e9c90..8405e77 100644
--- a/chrome/android/chrome_junit_test_java_sources.gni
+++ b/chrome/android/chrome_junit_test_java_sources.gni

@@ -1,6 +1,6 @@
 chrome_junit_test_java_sources = [
   "junit/src/org/chromium/chrome/browser/AppIndexingUtilTest.java",
-  "junit/src/org/chromium/chrome/browser/ChromeActionModeHandlerTest.java",
+  "junit/src/org/chromium/chrome/browser/ChromeActionModeHandlerUnitTest.java",
   "junit/src/org/chromium/chrome/browser/ChromeBackupAgentTest.java",
   "junit/src/org/chromium/chrome/browser/DeferredStartupHandlerTest.java",
   "junit/src/org/chromium/chrome/browser/DelayedScreenLockIntentHandlerTest.java",
@@ -170,6 +170,7 @@
   "junit/src/org/chromium/chrome/browser/omnibox/suggestions/base/BaseSuggestionViewTest.java",
   "junit/src/org/chromium/chrome/browser/omnibox/suggestions/base/SimpleHorizontalLayoutViewTest.java",
   "junit/src/org/chromium/chrome/browser/omnibox/suggestions/base/SuggestionSpannableUnitTest.java",
+  "junit/src/org/chromium/chrome/browser/omnibox/suggestions/header/HeaderViewBinderUnitTest.java",
   "junit/src/org/chromium/chrome/browser/omnibox/suggestions/tail/AlignmentManagerUnitTest.java",
   "junit/src/org/chromium/chrome/browser/omnibox/voice/AssistantVoiceSearchServiceUnitTest.java",
   "junit/src/org/chromium/chrome/browser/page_info/PermissionParamsListBuilderUnitTest.java",

diff --git a/chrome/android/chrome_test_java_sources.gni b/chrome/android/chrome_test_java_sources.gni
index 1d6d36b4..84acdebb 100644
--- a/chrome/android/chrome_test_java_sources.gni
+++ b/chrome/android/chrome_test_java_sources.gni

@@ -502,6 +502,7 @@
   "javatests/src/org/chromium/chrome/browser/tabmodel/IncognitoTabModelTest.java",
   "javatests/src/org/chromium/chrome/browser/tabmodel/MultiInstanceMigrationTest.java",
   "javatests/src/org/chromium/chrome/browser/tabmodel/RestoreMigrateTest.java",
+  "javatests/src/org/chromium/chrome/browser/tabmodel/TabModelImplTest.java",
   "javatests/src/org/chromium/chrome/browser/tabmodel/TabModelMergingTest.java",
   "javatests/src/org/chromium/chrome/browser/tabmodel/TabModelSelectorObserverTestRule.java",
   "javatests/src/org/chromium/chrome/browser/tabmodel/TabModelSelectorTabModelObserverTest.java",

diff --git a/chrome/android/features/start_surface/internal/javatests/src/org/chromium/chrome/features/start_surface/StartSurfaceLayoutTest.java b/chrome/android/features/start_surface/internal/javatests/src/org/chromium/chrome/features/start_surface/StartSurfaceLayoutTest.java
index e1b7909..6c48f5ac 100644
--- a/chrome/android/features/start_surface/internal/javatests/src/org/chromium/chrome/features/start_surface/StartSurfaceLayoutTest.java
+++ b/chrome/android/features/start_surface/internal/javatests/src/org/chromium/chrome/features/start_surface/StartSurfaceLayoutTest.java

@@ -83,13 +83,19 @@
 import org.chromium.base.test.util.MinAndroidSdkLevel;
 import org.chromium.base.test.util.Restriction;
 import org.chromium.chrome.browser.ChromeTabbedActivity;
+import org.chromium.chrome.browser.DeferredStartupHandler;
 import org.chromium.chrome.browser.compositor.layouts.Layout;
+import org.chromium.chrome.browser.compositor.layouts.StaticLayout;
 import org.chromium.chrome.browser.compositor.layouts.content.TabContentManager;
 import org.chromium.chrome.browser.flags.ChromeFeatureList;
 import org.chromium.chrome.browser.flags.ChromeSwitches;
+import org.chromium.chrome.browser.incognito.IncognitoUtils;
 import org.chromium.chrome.browser.search_engines.TemplateUrlServiceFactory;
 import org.chromium.chrome.browser.tab.Tab;
+import org.chromium.chrome.browser.tab.TabState;
 import org.chromium.chrome.browser.tabmodel.TabModel;
+import org.chromium.chrome.browser.tabmodel.TabModelSelectorTabModelObserver;
+import org.chromium.chrome.browser.tasks.pseudotab.PseudoTab;
 import org.chromium.chrome.browser.tasks.pseudotab.TabAttributeCache;
 import org.chromium.chrome.browser.tasks.tab_management.TabProperties;
 import org.chromium.chrome.browser.tasks.tab_management.TabSelectionEditorTestingRobot;
@@ -130,6 +136,7 @@
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Locale;
+import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicReference;
 
 // clang-format off
@@ -1705,6 +1712,101 @@
         assertTrue(GarbageCollectionTestUtils.canBeGarbageCollected(activityRef));
     }
 
+    /**
+     * This test is to simulate closing all incognito tabs during the activity recreation stage.
+     * This is a regression test for crbug.com/1044557. The test ensures all incognito tabs closed,
+     * which leads to a TabModel switching event, before the first normal tab is restored.
+     */
+    @Test
+    @MediumTest
+    @DisableFeatures(ChromeFeatureList.TAB_TO_GTS_ANIMATION + "<Study")
+    // clang-format off
+    @DisabledTest(message = "crbug.com/1044557 This regression test fails deterministically with" +
+            " the bot, but passes with local emulator. Disable the test for now.")
+    public void
+    closeAllIncognitoTabsBeforeRestoreCompleted() {
+        // clang-format on
+        prepareTabs(3, 1, "about:blank");
+
+        assertTrue(mActivityTestRule.getActivity().getCurrentTabModel().isIncognito());
+
+        // Need to wait for contentsState to be initialized for the tab to restore correctly.
+        CriteriaHelper.pollUiThread(
+                ()
+                        -> TabState.from(mActivityTestRule.getActivity().getActivityTab())
+                                   .contentsState
+                        != null,
+                "Incognito tab contentsState is null");
+
+        ChromeTabUtils.newTabFromMenu(InstrumentationRegistry.getInstrumentation(),
+                mActivityTestRule.getActivity(), true, false);
+
+        mActivityTestRule.loadUrl("about:blank");
+
+        // Need to wait for contentsState to be initialized for the tab to restore correctly.
+        CriteriaHelper.pollUiThread(
+                ()
+                        -> TabState.from(mActivityTestRule.getActivity().getActivityTab())
+                                   .contentsState
+                        != null,
+                "Incognito tab contentsState is null");
+
+        PseudoTab.clearForTesting();
+
+        AtomicBoolean tabModelRestoreCompleted = new AtomicBoolean(false);
+        AtomicBoolean normalModelIsEmpty = new AtomicBoolean(true);
+
+        ChromeTabbedActivity newActivity =
+                ApplicationTestUtils.recreateActivity(mActivityTestRule.getActivity());
+
+        new TabModelSelectorTabModelObserver(newActivity.getTabModelSelector()) {
+            @Override
+            public void restoreCompleted() {
+                tabModelRestoreCompleted.set(true);
+            }
+
+            @Override
+            public void willAddTab(Tab tab, int type) {
+                if (tab.isIncognito() || !normalModelIsEmpty.get()) return;
+
+                // Ensure normal tab model is active before its first tab restores.
+                CriteriaHelper.pollUiThread(
+                        ()
+                                -> !newActivity.getCurrentTabModel().isIncognito(),
+                        "Had not switched to Normal TabModel before the first normal Tab restored");
+            }
+
+            @Override
+            public void didAddTab(Tab tab, int type, int creationState) {
+                if (tab.isIncognito()) return;
+                normalModelIsEmpty.set(false);
+            }
+        };
+
+        CriteriaHelper.pollUiThread(()
+                                            -> newActivity.didFinishNativeInitialization(),
+                "New Activity has not finished initialized yet");
+        CriteriaHelper.pollUiThread(()
+                                            -> newActivity.getCurrentTabModel().isIncognito(),
+                "New Activity current TabModel is not incognito");
+        TestThreadUtils.runOnUiThreadBlocking(IncognitoUtils::closeAllIncognitoTabs);
+
+        CriteriaHelper.pollUiThread(
+                ()
+                        -> DeferredStartupHandler.getInstance().isDeferredStartupCompleteForApp(),
+                "Deferred startup never completed");
+
+        CriteriaHelper.pollUiThread(()
+                                            -> tabModelRestoreCompleted.get(),
+                "New Activity normal TabModel has never restored");
+
+        assertFalse(newActivity.getCurrentTabModel().isIncognito());
+        assertNotNull(newActivity.getTabModelSelector().getCurrentTab());
+        // With the fix, StaticLayout guarantees to be shown. Otherwise, StartSurfaceLayout could be
+        // shown, not guaranteed.
+        assertTrue(newActivity.getLayoutManager().getActiveLayout() instanceof StaticLayout);
+    }
+
     private void enterTabGroupManualSelection(ChromeTabbedActivity cta) {
         MenuUtils.invokeCustomMenuActionSync(
                 InstrumentationRegistry.getInstrumentation(), cta, R.id.menu_group_tabs);

diff --git a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_groups/TabGroupModelFilter.java b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_groups/TabGroupModelFilter.java
index 3d18ecd..675e73a 100644
--- a/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_groups/TabGroupModelFilter.java
+++ b/chrome/android/features/tab_ui/java/src/org/chromium/chrome/browser/tasks/tab_groups/TabGroupModelFilter.java

@@ -686,8 +686,7 @@
 
     @Override
     public void didMoveTab(Tab tab, int newIndex, int curIndex) {
-        // Ignore didMoveTab calls in tab restoring stage. For incognito mode, bypass this check
-        // since there is no restoring stage.
+        // Ignore didMoveTab calls in tab restoring stage.
         if (!isTabModelRestored()) return;
         // Need to cache the flags before resetting the internal data map.
         boolean isMergeTabToGroup = isMergeTabToGroup(tab);

diff --git a/chrome/android/features/tab_ui/junit/src/org/chromium/chrome/browser/tasks/tab_groups/TabGroupModelFilterUnitTest.java b/chrome/android/features/tab_ui/junit/src/org/chromium/chrome/browser/tasks/tab_groups/TabGroupModelFilterUnitTest.java
index 4125d06..bc3108c 100644
--- a/chrome/android/features/tab_ui/junit/src/org/chromium/chrome/browser/tasks/tab_groups/TabGroupModelFilterUnitTest.java
+++ b/chrome/android/features/tab_ui/junit/src/org/chromium/chrome/browser/tasks/tab_groups/TabGroupModelFilterUnitTest.java

@@ -4,6 +4,8 @@
 
 package org.chromium.chrome.browser.tasks.tab_groups;
 
+import static junit.framework.Assert.assertTrue;
+
 import static org.hamcrest.CoreMatchers.equalTo;
 import static org.junit.Assert.assertArrayEquals;
 import static org.junit.Assert.assertFalse;
@@ -230,6 +232,7 @@
 
         if (isTabRestoreCompleted) {
             mTabGroupModelFilter.restoreCompleted();
+            assertTrue(mTabGroupModelFilter.isTabModelRestored());
         }
     }
 
@@ -255,23 +258,6 @@
     }
 
     @Test
-    // TODO(mattsimmons): This is actually testing behavior of the superclass but there's no unit
-    //  tests for the superclass today. If one ever exists, this should move to that test.
-    public void isTabModelRestored() {
-        setupTabGroupModelFilter(false, false);
-        assertThat(mTabGroupModelFilter.isTabModelRestored(), equalTo(false));
-
-        setupTabGroupModelFilter(true, false);
-        assertThat(mTabGroupModelFilter.isTabModelRestored(), equalTo(true));
-
-        setupTabGroupModelFilter(false, true);
-        assertThat(mTabGroupModelFilter.isTabModelRestored(), equalTo(true));
-
-        setupTabGroupModelFilter(true, true);
-        assertThat(mTabGroupModelFilter.isTabModelRestored(), equalTo(true));
-    }
-
-    @Test
     public void addTab_ToExistingGroup() {
         TabImpl newTab = prepareTab(NEW_TAB_ID, NEW_TAB_ID, TAB1_ID);
         doReturn(TabLaunchType.FROM_CHROME_UI).when(newTab).getLaunchType();
@@ -780,6 +766,7 @@
     public void ignoreUnrelatedMoveTab() {
         // Simulate that the tab restoring is not yet finished.
         setupTabGroupModelFilter(false, false);
+        assertFalse(mTabGroupModelFilter.isTabModelRestored());
 
         mTabModelObserverCaptor.getValue().didMoveTab(mTab1, POSITION1, POSITION6);
         mTabModelObserverCaptor.getValue().didMoveTab(mTab1, POSITION6, POSITION1);
@@ -794,6 +781,21 @@
                 .didMoveWithinGroup(any(Tab.class), anyInt(), anyInt());
         verify(mTabGroupModelFilterObserver, never())
                 .didMoveTabGroup(any(Tab.class), anyInt(), anyInt());
+
+        // Ignore any move incognito tabs before TabModel restored.
+        setupTabGroupModelFilter(false, true);
+        assertFalse(mTabGroupModelFilter.isTabModelRestored());
+
+        mTabModelObserverCaptor.getValue().didMoveTab(mTab1, POSITION1, POSITION6);
+
+        // No call should be made here.
+        verify(mTabGroupModelFilterObserver, never())
+                .didMoveTabOutOfGroup(any(Tab.class), anyInt());
+        verify(mTabGroupModelFilterObserver, never()).didMergeTabToGroup(any(Tab.class), anyInt());
+        verify(mTabGroupModelFilterObserver, never())
+                .didMoveWithinGroup(any(Tab.class), anyInt(), anyInt());
+        verify(mTabGroupModelFilterObserver, never())
+                .didMoveTabGroup(any(Tab.class), anyInt(), anyInt());
     }
 
     @Test
@@ -867,11 +869,12 @@
     }
 
     @Test
-    public void skipRestoringStageMoveTab_Incognito() {
-        // Simulate tab model is in incognito mode, and thus tab restoring will not happen.
-        // Therefore, we should not ignore didMoveTab calls because we have already skipped the
-        // didMoveTab calls from restoring stage.
+    public void moveTab_Incognito() {
         setupTabGroupModelFilter(false, true);
+        assertFalse(mTabGroupModelFilter.isTabModelRestored());
+
+        mTabGroupModelFilter.markTabStateInitialized();
+        assertTrue(mTabGroupModelFilter.isTabModelRestored());
 
         // Simulate that tab3 is going to be moved out of group.
         mTab3.setRootId(TAB3_ID);

diff --git a/chrome/android/feed/core/java/src/org/chromium/chrome/browser/feed/FeedSurfaceMediator.java b/chrome/android/feed/core/java/src/org/chromium/chrome/browser/feed/FeedSurfaceMediator.java
index 2d4c3cd..6df7bfee 100644
--- a/chrome/android/feed/core/java/src/org/chromium/chrome/browser/feed/FeedSurfaceMediator.java
+++ b/chrome/android/feed/core/java/src/org/chromium/chrome/browser/feed/FeedSurfaceMediator.java

@@ -228,6 +228,10 @@
                     public int getRootViewHeight() {
                         return mCoordinator.getView().getHeight();
                     }
+                    @Override
+                    public boolean isSignedIn() {
+                        return mSigninManager.getIdentityManager().hasPrimaryAccount();
+                    }
                 };
                 mCoordinator.getStream().addScrollListener(new HeaderIphScrollListener(delegate));
                 mSigninManager.getIdentityManager().addObserver(this);

diff --git a/chrome/android/feed/core/java/src/org/chromium/chrome/browser/feed/HeaderIphScrollListener.java b/chrome/android/feed/core/java/src/org/chromium/chrome/browser/feed/HeaderIphScrollListener.java
index 41c365b..00815097 100644
--- a/chrome/android/feed/core/java/src/org/chromium/chrome/browser/feed/HeaderIphScrollListener.java
+++ b/chrome/android/feed/core/java/src/org/chromium/chrome/browser/feed/HeaderIphScrollListener.java

@@ -40,6 +40,7 @@
         int getVerticalScrollOffset();
         boolean isFeedExpanded();
         int getRootViewHeight();
+        boolean isSignedIn();
     }
 
     private Delegate mDelegate;
@@ -78,6 +79,9 @@
         // Check whether the feed is expanded.
         if (!mDelegate.isFeedExpanded()) return;
 
+        // Check whether the user is signed in.
+        if (!mDelegate.isSignedIn()) return;
+
         // Check that enough scrolling was done proportionally to the stream height.
         if ((float) mDelegate.getVerticalScrollOffset()
                 < (float) mDelegate.getRootViewHeight() * mMinScrollFraction) {

diff --git a/chrome/android/feed/core/javatests/src/org/chromium/chrome/browser/feed/HeaderIphScrollListenerTest.java b/chrome/android/feed/core/javatests/src/org/chromium/chrome/browser/feed/HeaderIphScrollListenerTest.java
index 5aebd4f..cb4f4e0 100644
--- a/chrome/android/feed/core/javatests/src/org/chromium/chrome/browser/feed/HeaderIphScrollListenerTest.java
+++ b/chrome/android/feed/core/javatests/src/org/chromium/chrome/browser/feed/HeaderIphScrollListenerTest.java

@@ -49,25 +49,28 @@
             List<ParameterSet> parameters = new ArrayList<>();
             // Trigger IPH.
             parameters.add(new ParameterSet().value(true, ScrollState.IDLE,
-                    TriggerState.HAS_NOT_BEEN_DISPLAYED, true, 10, true, true));
+                    TriggerState.HAS_NOT_BEEN_DISPLAYED, true, 10, true, true, true));
             // Don't trigger the IPH because the scroll state not iDLE.
             parameters.add(new ParameterSet().value(false, ScrollState.DRAGGING,
-                    TriggerState.HAS_NOT_BEEN_DISPLAYED, true, 10, true, true));
+                    TriggerState.HAS_NOT_BEEN_DISPLAYED, true, 10, true, true, true));
             // Don't trigger the IPH because the state is not set to has been displayed.
             parameters.add(new ParameterSet().value(false, ScrollState.IDLE,
-                    TriggerState.HAS_BEEN_DISPLAYED, true, 10, true, true));
+                    TriggerState.HAS_BEEN_DISPLAYED, true, 10, true, true, true));
             // Don't trigger the IPH because because the tracker would not trigger.
             parameters.add(new ParameterSet().value(false, ScrollState.IDLE,
-                    TriggerState.HAS_NOT_BEEN_DISPLAYED, false, 10, true, true));
+                    TriggerState.HAS_NOT_BEEN_DISPLAYED, false, 10, true, true, true));
             // Don't trigger the IPH because there was not enough scroll done.
             parameters.add(new ParameterSet().value(false, ScrollState.IDLE,
-                    TriggerState.HAS_NOT_BEEN_DISPLAYED, true, 1, true, true));
+                    TriggerState.HAS_NOT_BEEN_DISPLAYED, true, 1, true, true, true));
             // Don't trigger the IPH because the position in the stream is not suitable for the IPH.
             parameters.add(new ParameterSet().value(false, ScrollState.IDLE,
-                    TriggerState.HAS_NOT_BEEN_DISPLAYED, true, 10, false, true));
+                    TriggerState.HAS_NOT_BEEN_DISPLAYED, true, 10, false, true, true));
             // Don't trigger the IPH because the feed is not expanded.
             parameters.add(new ParameterSet().value(false, ScrollState.IDLE,
-                    TriggerState.HAS_NOT_BEEN_DISPLAYED, true, 10, false, false));
+                    TriggerState.HAS_NOT_BEEN_DISPLAYED, true, 10, false, false, true));
+            // Don't trigger the IPH because the user is not signed in.
+            parameters.add(new ParameterSet().value(false, ScrollState.IDLE,
+                    TriggerState.HAS_NOT_BEEN_DISPLAYED, true, 10, false, true, false));
             return parameters;
         }
     }
@@ -110,8 +113,8 @@
     @ParameterAnnotations.UseMethodParameter(TestParams.class)
     public void onScrollStateChanged_triggerIph(boolean expectEnabled, int scrollState,
             int triggerState, boolean wouldTriggerHelpUI, int verticallScrollOffset,
-            boolean isFeedHeaderPositionInRecyclerViewSuitableForIPH, boolean isFeedExpanded)
-            throws Exception {
+            boolean isFeedHeaderPositionInRecyclerViewSuitableForIPH, boolean isFeedExpanded,
+            boolean isSignedIn) throws Exception {
         // Set Tracker mock.
         when(mTracker.getTriggerState(FeatureConstants.FEED_HEADER_MENU_FEATURE))
                 .thenReturn(triggerState);
@@ -148,6 +151,10 @@
             public int getRootViewHeight() {
                 return FEED_VIEW_HEIGHT;
             }
+            @Override
+            public boolean isSignedIn() {
+                return isSignedIn;
+            }
         };
 
         // Trigger IPH through the scroll listener.

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeActionModeHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeActionModeHandler.java
index a875e67..c8a6da9 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeActionModeHandler.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeActionModeHandler.java

@@ -5,7 +5,6 @@
 package org.chromium.chrome.browser;
 
 import android.content.pm.ResolveInfo;
-import android.text.TextUtils;
 import android.view.ActionMode;
 import android.view.Menu;
 import android.view.MenuItem;
@@ -17,24 +16,15 @@
 import org.chromium.base.Consumer;
 import org.chromium.base.PackageManagerUtils;
 import org.chromium.base.metrics.RecordUserAction;
-import org.chromium.chrome.browser.feature_engagement.TrackerFactory;
 import org.chromium.chrome.browser.firstrun.FirstRunStatus;
 import org.chromium.chrome.browser.locale.LocaleManager;
-import org.chromium.chrome.browser.omnibox.geo.GeolocationHeader;
-import org.chromium.chrome.browser.profiles.Profile;
-import org.chromium.chrome.browser.search_engines.TemplateUrlServiceFactory;
 import org.chromium.chrome.browser.tab.Tab;
-import org.chromium.chrome.browser.tab.TabLaunchType;
 import org.chromium.chrome.browser.tab.TabUtils;
 import org.chromium.chrome.browser.tab.TabWebContentsObserver;
-import org.chromium.chrome.browser.tabmodel.TabModelSelector;
-import org.chromium.components.feature_engagement.EventConstants;
 import org.chromium.content.R;
 import org.chromium.content_public.browser.ActionModeCallbackHelper;
-import org.chromium.content_public.browser.LoadUrlParams;
 import org.chromium.content_public.browser.SelectionPopupController;
 import org.chromium.content_public.browser.WebContents;
-import org.chromium.ui.base.PageTransition;
 
 import java.util.HashSet;
 import java.util.List;
@@ -55,13 +45,14 @@
      * @param activityTabProvider {@link ActivityTabProvider} instance.
      * @param actionBarObserver observer called when the contextual action bar's visibility
      *        has changed.
+     * @param searchCallback Callback to run when search action is selected in the action mode.
      */
-    public ChromeActionModeHandler(
-            ActivityTabProvider activityTabProvider, Consumer<Boolean> actionBarObserver) {
+    public ChromeActionModeHandler(ActivityTabProvider activityTabProvider,
+            Consumer<Boolean> actionBarObserver, Callback<String> searchCallback) {
         mInitWebContentsObserver = (webContents) -> {
             SelectionPopupController.fromWebContents(webContents)
-                    .setActionModeCallback(
-                            new ActionModeCallback(mActiveTab, webContents, actionBarObserver));
+                    .setActionModeCallback(new ActionModeCallback(
+                            mActiveTab, webContents, actionBarObserver, searchCallback));
         };
 
         mActivityTabTabObserver =
@@ -90,11 +81,14 @@
         private final Tab mTab;
         private final ActionModeCallbackHelper mHelper;
         private final Consumer<Boolean> mActionBarObserver;
+        private final Callback<String> mSearchCallback;
 
-        protected ActionModeCallback(Tab tab, WebContents webContents, Consumer<Boolean> observer) {
+        protected ActionModeCallback(Tab tab, WebContents webContents, Consumer<Boolean> observer,
+                Callback<String> searchCallback) {
             mTab = tab;
             mHelper = getActionModeCallbackHelper(webContents);
             mActionBarObserver = observer;
+            mSearchCallback = searchCallback;
         }
 
         @VisibleForTesting
@@ -176,33 +170,9 @@
             return set;
         }
 
-        /**
-         * Generate the LoadUrlParams necessary to load the specified search query.
-         */
-        @VisibleForTesting
-        protected LoadUrlParams generateUrlParamsForSearch(String query) {
-            String url = TemplateUrlServiceFactory.get().getUrlForSearchQuery(query);
-            String headers = GeolocationHeader.getGeoHeader(url, mTab);
-
-            LoadUrlParams loadUrlParams = new LoadUrlParams(url);
-            loadUrlParams.setVerbatimHeaders(headers);
-            loadUrlParams.setTransitionType(PageTransition.GENERATED);
-            return loadUrlParams;
-        }
-
         private void search(String searchText) {
             RecordUserAction.record("MobileActionMode.WebSearch");
-            TabModelSelector selector = TabModelSelector.from(mTab);
-            if (selector == null) return;
-
-            String query = ActionModeCallbackHelper.sanitizeQuery(
-                    searchText, ActionModeCallbackHelper.MAX_SEARCH_QUERY_LENGTH);
-            if (TextUtils.isEmpty(query)) return;
-
-            TrackerFactory.getTrackerForProfile(Profile.fromWebContents(mTab.getWebContents()))
-                    .notifyEvent(EventConstants.WEB_SEARCH_PERFORMED);
-            selector.openNewTab(generateUrlParamsForSearch(query),
-                    TabLaunchType.FROM_LONGPRESS_FOREGROUND, mTab, mTab.isIncognito());
+            mSearchCallback.onResult(searchText);
         }
 
         private void recordUserAction() {

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/TabbedModeTabDelegateFactory.java b/chrome/android/java/src/org/chromium/chrome/browser/TabbedModeTabDelegateFactory.java
index 853d0ca..b3e8aa6f 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/TabbedModeTabDelegateFactory.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/TabbedModeTabDelegateFactory.java

@@ -57,7 +57,8 @@
     @Override
     public ContextMenuPopulator createContextMenuPopulator(Tab tab) {
         return new ChromeContextMenuPopulator(
-                new TabContextMenuItemDelegate(tab, mEphemeralTabCoordinatorSupplier),
+                new TabContextMenuItemDelegate(
+                        tab, mActivity.getTabModelSelector(), mEphemeralTabCoordinatorSupplier),
                 mShareDelegateSupplier, ChromeContextMenuPopulator.ContextMenuMode.NORMAL,
                 ExternalAuthUtils.getInstance());
     }

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulator.java b/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulator.java
index 563371b..270094b 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulator.java

@@ -6,6 +6,7 @@
 
 import android.content.Context;
 import android.net.MailTo;
+import android.os.Build;
 import android.text.TextUtils;
 import android.util.Pair;
 import android.view.ContextMenu;
@@ -419,7 +420,7 @@
                     if (mShowEphemeralTabNewLabel) item.setShowInProductHelp();
                     imageTab.add(item);
                 }
-                if (ChromeFeatureList.isEnabled(ChromeFeatureList.CONTEXT_MENU_COPY_IMAGE)) {
+                if (isCopyImageEnabled()) {
                     imageTab.add(new ChromeContextMenuItem(Item.COPY_IMAGE));
                 }
                 if (isSrcDownloadableScheme) {
@@ -797,4 +798,18 @@
                     webContents, eventName, "Action", actionId);
         }
     }
+
+    /**
+     * Whether copy image should enabled.
+     * @return Whether to show the copy image menu item.
+     **/
+    @VisibleForTesting
+    public static boolean isCopyImageEnabled() {
+        // TODO(crbug.com/1081987): Find a way to make copying image works on Android O.
+        if (Build.VERSION.SDK_INT == Build.VERSION_CODES.O
+                || Build.VERSION.SDK_INT == Build.VERSION_CODES.O_MR1) {
+            return false;
+        }
+        return ChromeFeatureList.isEnabled(ChromeFeatureList.CONTEXT_MENU_COPY_IMAGE);
+    }
 }

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabDelegateFactory.java b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabDelegateFactory.java
index 6e441c2..0d312df7 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabDelegateFactory.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/customtabs/CustomTabDelegateFactory.java

@@ -43,6 +43,7 @@
 import org.chromium.chrome.browser.tab.TabWebContentsDelegateAndroid;
 import org.chromium.chrome.browser.tab_activity_glue.ActivityTabWebContentsDelegateAndroid;
 import org.chromium.chrome.browser.tabmodel.TabModel;
+import org.chromium.chrome.browser.tabmodel.TabModelSelector;
 import org.chromium.chrome.browser.tabmodel.document.AsyncTabCreationParams;
 import org.chromium.chrome.browser.tabmodel.document.TabDelegate;
 import org.chromium.chrome.browser.ui.native_page.NativePage;
@@ -456,8 +457,10 @@
                     mActivity.getActivityTabProvider(), mActivity::getCurrentTabCreator,
                     mActivity::getBottomSheetController, () -> false);
         }
-        return new ChromeContextMenuPopulator(
-                new TabContextMenuItemDelegate(tab, () -> mEphemeralTabCoordinator),
+        TabModelSelector tabModelSelector =
+                mActivity != null ? mActivity.getTabModelSelector() : null;
+        return new ChromeContextMenuPopulator(new TabContextMenuItemDelegate(tab, tabModelSelector,
+                                                      () -> mEphemeralTabCoordinator),
                 shareDelegateSupplier, contextMenuMode, ExternalAuthUtils.getInstance());
     }
 

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/download/DownloadController.java b/chrome/android/java/src/org/chromium/chrome/browser/download/DownloadController.java
index 237e6fa..5fe7a871 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/download/DownloadController.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/download/DownloadController.java

@@ -18,6 +18,7 @@
 import org.chromium.chrome.browser.ChromeActivity;
 import org.chromium.chrome.browser.flags.ChromeFeatureList;
 import org.chromium.chrome.browser.tab.Tab;
+import org.chromium.chrome.browser.tab.TabUtils;
 import org.chromium.chrome.browser.tabmodel.TabModelSelector;
 import org.chromium.components.download.DownloadCollectionBridge;
 import org.chromium.components.permissions.AndroidPermissionRequester;
@@ -253,6 +254,14 @@
         DownloadUtils.showDownloadStartToast(ContextUtils.getApplicationContext());
     }
 
+    private static TabModelSelector getTabModelSelector(Tab tab) {
+        Activity activity = TabUtils.getActivity(tab);
+        if (activity instanceof ChromeActivity) {
+            return ((ChromeActivity) activity).getTabModelSelector();
+        }
+        return null;
+    }
+
     /**
      * Close a tab if it is blank. Returns true if it is or already closed.
      * @param Tab Tab to close.
@@ -266,7 +275,7 @@
                 || contents.getNavigationController().isInitialNavigation();
         if (isInitialNavigation) {
             // Tab is created just for download, close it.
-            TabModelSelector selector = TabModelSelector.from(tab);
+            TabModelSelector selector = getTabModelSelector(tab);
             if (selector == null) return true;
             if (selector.getModel(tab.isIncognito()).getCount() == 1) return false;
             boolean closed = selector.closeTab(tab);

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/homepage/settings/HomepageSettings.java b/chrome/android/java/src/org/chromium/chrome/browser/homepage/settings/HomepageSettings.java
index b540093..4e2976d 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/homepage/settings/HomepageSettings.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/homepage/settings/HomepageSettings.java

@@ -5,6 +5,7 @@
 package org.chromium.chrome.browser.homepage.settings;
 
 import android.os.Bundle;
+import android.text.TextUtils;
 
 import androidx.annotation.VisibleForTesting;
 import androidx.preference.Preference;
@@ -189,11 +190,18 @@
         if (HomepagePolicyManager.isHomepageManagedByPolicy()) {
             return HomepagePolicyManager.getHomepageUrl();
         }
+
+        String defaultUrl = HomepageManager.getDefaultHomepageUri();
+        String customUrl = mHomepageManager.getPrefHomepageCustomUri();
         if (mHomepageManager.getPrefHomepageUseDefaultUri()) {
-            String defaultUrl = HomepageManager.getDefaultHomepageUri();
             return NewTabPage.isNTPUrl(defaultUrl) ? "" : defaultUrl;
         }
-        return mHomepageManager.getPrefHomepageCustomUri();
+
+        if (TextUtils.isEmpty(customUrl) && !NewTabPage.isNTPUrl(defaultUrl)) {
+            return defaultUrl;
+        }
+
+        return customUrl;
     }
 
     private PreferenceValues createPreferenceValuesForRadioGroup() {

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/media/PictureInPictureController.java b/chrome/android/java/src/org/chromium/chrome/browser/media/PictureInPictureController.java
index 33ae0637..e4b9d4c 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/media/PictureInPictureController.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/media/PictureInPictureController.java

@@ -216,7 +216,7 @@
                 new DismissActivityOnTabModelSelectorEventObserver(activity);
         final WebContentsObserver webContentsObserver =
                 new DismissActivityOnWebContentsObserver(activity);
-        final TabModelSelector tabModelSelector = TabModelSelector.from(activityTab);
+        final TabModelSelector tabModelSelector = activity.getTabModelSelector();
         final FullscreenListener fullscreenListener = new FullscreenListener() {
             @Override
             public void onExitFullscreen(Tab tab) {

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/native_page/NativePageFactory.java b/chrome/android/java/src/org/chromium/chrome/browser/native_page/NativePageFactory.java
index 82e8bf5f..065e2a0 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/native_page/NativePageFactory.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/native_page/NativePageFactory.java

@@ -78,7 +78,7 @@
         }
 
         protected NativePage buildNewTabPage(Tab tab) {
-            NativePageHost nativePageHost = new TabShim(tab, mActivity.getFullscreenManager());
+            NativePageHost nativePageHost = new TabShim(tab, mActivity);
             if (tab.isIncognito()) return new IncognitoNewTabPage(mActivity, nativePageHost);
 
             return new NewTabPage(mActivity, mActivity.getFullscreenManager(),
@@ -89,28 +89,26 @@
         }
 
         protected NativePage buildBookmarksPage(Tab tab) {
-            return new BookmarkPage(mActivity, new TabShim(tab, mActivity.getFullscreenManager()));
+            return new BookmarkPage(mActivity, new TabShim(tab, mActivity));
         }
 
         protected NativePage buildDownloadsPage(Tab tab) {
-            return new DownloadPage(mActivity, new TabShim(tab, mActivity.getFullscreenManager()));
+            return new DownloadPage(mActivity, new TabShim(tab, mActivity));
         }
 
         protected NativePage buildExploreSitesPage(Tab tab) {
-            return new ExploreSitesPage(
-                    mActivity, new TabShim(tab, mActivity.getFullscreenManager()), tab);
+            return new ExploreSitesPage(mActivity, new TabShim(tab, mActivity), tab);
         }
 
         protected NativePage buildHistoryPage(Tab tab) {
-            return new HistoryPage(mActivity, new TabShim(tab, mActivity.getFullscreenManager()));
+            return new HistoryPage(mActivity, new TabShim(tab, mActivity));
         }
 
         protected NativePage buildRecentTabsPage(Tab tab) {
             RecentTabsManager recentTabsManager = new RecentTabsManager(tab,
                     Profile.fromWebContents(tab.getWebContents()), mActivity,
                     () -> HistoryManagerUtils.showHistoryManager(mActivity, tab));
-            return new RecentTabsPage(mActivity, recentTabsManager,
-                    new TabShim(tab, mActivity.getFullscreenManager()));
+            return new RecentTabsPage(mActivity, recentTabsManager, new TabShim(tab, mActivity));
         }
     }
 
@@ -232,10 +230,12 @@
     private static class TabShim implements NativePageHost {
         private final Tab mTab;
         private final ChromeFullscreenManager mFullscreenManager;
+        private final TabModelSelector mTabModelSelector;
 
-        public TabShim(Tab tab, ChromeFullscreenManager fullscreenManager) {
+        public TabShim(Tab tab, ChromeActivity activity) {
             mTab = tab;
-            mFullscreenManager = fullscreenManager;
+            mFullscreenManager = activity.getFullscreenManager();
+            mTabModelSelector = activity.getTabModelSelector();
         }
 
         @Override
@@ -246,9 +246,8 @@
         @Override
         public void loadUrl(LoadUrlParams urlParams, boolean incognito) {
             if (incognito && !mTab.isIncognito()) {
-                TabModelSelector.from(mTab).openNewTab(urlParams,
-                        TabLaunchType.FROM_LONGPRESS_FOREGROUND, mTab,
-                        /* incognito = */ true);
+                mTabModelSelector.openNewTab(urlParams, TabLaunchType.FROM_LONGPRESS_FOREGROUND,
+                        mTab, /* incognito = */ true);
                 return;
             }
 
@@ -262,7 +261,7 @@
 
         @Override
         public boolean isVisible() {
-            return mTab == TabModelSelector.from(mTab).getCurrentTab();
+            return mTab == mTabModelSelector.getCurrentTab();
         }
 
         @Override

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/indicator/OfflineIndicatorControllerV2.java b/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/indicator/OfflineIndicatorControllerV2.java
index f106225..40f6d236 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/indicator/OfflineIndicatorControllerV2.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/offlinepages/indicator/OfflineIndicatorControllerV2.java

@@ -9,20 +9,43 @@
 import android.os.Handler;
 import android.os.SystemClock;
 
+import androidx.annotation.IntDef;
 import androidx.vectordrawable.graphics.drawable.VectorDrawableCompat;
 
 import org.chromium.base.ApiCompatibilityUtils;
 import org.chromium.base.Callback;
+import org.chromium.base.TimeUtilsJni;
+import org.chromium.base.metrics.RecordHistogram;
+import org.chromium.base.metrics.RecordUserAction;
 import org.chromium.base.supplier.ObservableSupplier;
+import org.chromium.base.supplier.Supplier;
 import org.chromium.chrome.R;
 import org.chromium.chrome.browser.offlinepages.indicator.ConnectivityDetector.ConnectionState;
 import org.chromium.chrome.browser.status_indicator.StatusIndicatorCoordinator;
 
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.util.concurrent.TimeUnit;
+
 /**
  * Class that controls visibility and content of {@link StatusIndicatorCoordinator} to relay
  * connectivity information.
  */
 public class OfflineIndicatorControllerV2 implements ConnectivityDetector.Observer {
+    @IntDef({UmaEnum.CAN_ANIMATE_NATIVE_CONTROLS,
+            UmaEnum.CAN_ANIMATE_NATIVE_CONTROLS_OMNIBOX_FOCUSED,
+            UmaEnum.CANNOT_ANIMATE_NATIVE_CONTROLS,
+            UmaEnum.CANNOT_ANIMATE_NATIVE_CONTROLS_OMNIBOX_FOCUSED})
+    @Retention(RetentionPolicy.SOURCE)
+    public @interface UmaEnum {
+        int CAN_ANIMATE_NATIVE_CONTROLS = 0;
+        int CAN_ANIMATE_NATIVE_CONTROLS_OMNIBOX_FOCUSED = 1;
+        int CANNOT_ANIMATE_NATIVE_CONTROLS = 2;
+        int CANNOT_ANIMATE_NATIVE_CONTROLS_OMNIBOX_FOCUSED = 3;
+
+        int NUM_ENTRIES = 4;
+    }
+
     private static final int STATUS_INDICATOR_WAIT_BEFORE_HIDE_DURATION_MS = 2000;
     private static final int STATUS_INDICATOR_COOLDOWN_BEFORE_NEXT_ACTION_MS = 5000;
 
@@ -30,6 +53,7 @@
     private StatusIndicatorCoordinator mStatusIndicator;
     private ConnectivityDetector mConnectivityDetector;
     private ObservableSupplier<Boolean> mIsUrlBarFocusedSupplier;
+    private Supplier<Boolean> mCanAnimateBrowserControlsSupplier;
     private Callback<Boolean> mOnUrlBarFocusChanged;
     private Runnable mShowRunnable;
     private Runnable mHideRunnable;
@@ -37,6 +61,7 @@
     private Runnable mUpdateStatusIndicatorDelayedRunnable;
     private long mLastActionTime;
     private boolean mIsOffline;
+    private long mTimeShownMs;
 
     /**
      * Constructs the offline indicator.
@@ -45,9 +70,15 @@
      *                        control based on the connectivity.
      * @param isUrlBarFocusedSupplier The {@link ObservableSupplier} that will supply the UrlBar's
      *                                focus state and notify a listener when it changes.
+     * @param canAnimateNativeBrowserControls Will supply a boolean meaning whether the native
+     *                                        browser controls can be animated. This is used for
+     *                                        collecting metrics.
+     * TODO(sinansahin): We can remove canAnimateNativeBrowserControls once we're done with metrics
+     *                   collection.
      */
     public OfflineIndicatorControllerV2(Context context, StatusIndicatorCoordinator statusIndicator,
-            ObservableSupplier<Boolean> isUrlBarFocusedSupplier) {
+            ObservableSupplier<Boolean> isUrlBarFocusedSupplier,
+            Supplier<Boolean> canAnimateNativeBrowserControls) {
         mContext = context;
         mStatusIndicator = statusIndicator;
 
@@ -57,7 +88,11 @@
                 SystemClock.elapsedRealtime() - STATUS_INDICATOR_COOLDOWN_BEFORE_NEXT_ACTION_MS;
 
         mShowRunnable = () -> {
+            RecordUserAction.record("OfflineIndicator.Shown");
+            mTimeShownMs = TimeUnit.MICROSECONDS.toMillis(TimeUtilsJni.get().getTimeTicksNowUs());
+
             setLastActionTime();
+
             final int backgroundColor = ApiCompatibilityUtils.getColor(
                     mContext.getResources(), R.color.offline_indicator_offline_color);
             final int textColor = ApiCompatibilityUtils.getColor(
@@ -71,7 +106,15 @@
         };
 
         mHideRunnable = () -> {
+            RecordUserAction.record("OfflineIndicator.Hidden");
+            final long shownDuration =
+                    TimeUnit.MICROSECONDS.toMillis(TimeUtilsJni.get().getTimeTicksNowUs())
+                    - mTimeShownMs;
+            RecordHistogram.recordMediumTimesHistogram(
+                    "OfflineIndicator.ShownDuration", shownDuration);
+
             setLastActionTime();
+
             final int backgroundColor = ApiCompatibilityUtils.getColor(
                     mContext.getResources(), R.color.offline_indicator_back_online_color);
             final int textColor = ApiCompatibilityUtils.getColor(
@@ -91,6 +134,7 @@
         };
 
         mIsUrlBarFocusedSupplier = isUrlBarFocusedSupplier;
+        mCanAnimateBrowserControlsSupplier = canAnimateNativeBrowserControls;
         // TODO(crbug.com/1075793): Move the UrlBar focus related code to the widget or glue code.
         mOnUrlBarFocusChanged = (hasFocus) -> {
             if (!hasFocus && mOnUrlBarUnfocusedRunnable != null) {
@@ -148,6 +192,7 @@
 
     private void updateStatusIndicator(boolean offline) {
         mIsOffline = offline;
+        int surfaceState;
         if (mIsUrlBarFocusedSupplier.get()) {
             // We should clear the runnable if we would be assigning an unnecessary show or hide
             // runnable. E.g, without this condition, we would be trying to hide the indicator when
@@ -158,10 +203,21 @@
                 return;
             }
             mOnUrlBarUnfocusedRunnable = offline ? mShowRunnable : mHideRunnable;
+            surfaceState = mCanAnimateBrowserControlsSupplier.get()
+                    ? UmaEnum.CAN_ANIMATE_NATIVE_CONTROLS_OMNIBOX_FOCUSED
+                    : UmaEnum.CANNOT_ANIMATE_NATIVE_CONTROLS_OMNIBOX_FOCUSED;
         } else {
-            (offline ? mShowRunnable : mHideRunnable).run();
             assert mOnUrlBarUnfocusedRunnable == null;
+            (offline ? mShowRunnable : mHideRunnable).run();
+            surfaceState = mCanAnimateBrowserControlsSupplier.get()
+                    ? UmaEnum.CAN_ANIMATE_NATIVE_CONTROLS
+                    : UmaEnum.CANNOT_ANIMATE_NATIVE_CONTROLS;
+            ;
         }
+        RecordHistogram.recordEnumeratedHistogram(
+                "OfflineIndicator.ConnectivityChanged.DeviceState."
+                        + (offline ? "Offline" : "Online"),
+                surfaceState, UmaEnum.NUM_ENTRIES);
     }
 
     private void setLastActionTime() {

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omnibox/suggestions/header/HeaderProcessor.java b/chrome/android/java/src/org/chromium/chrome/browser/omnibox/suggestions/header/HeaderProcessor.java
index d1d8f0c..816d69b 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/omnibox/suggestions/header/HeaderProcessor.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/omnibox/suggestions/header/HeaderProcessor.java

@@ -55,7 +55,12 @@
      * @param model The model to populate.
      * @param headerText Text to be displayed for this group header.
      */
-    public void populateModel(PropertyModel model, String headerText) {
-        model.set(HeaderViewProperties.TITLE, headerText.toUpperCase());
+    public void populateModel(final PropertyModel model, final String headerText) {
+        model.set(HeaderViewProperties.TITLE, headerText);
+        model.set(HeaderViewProperties.IS_EXPANDED, true);
+        model.set(HeaderViewProperties.DELEGATE, () -> {
+            boolean state = model.get(HeaderViewProperties.IS_EXPANDED);
+            model.set(HeaderViewProperties.IS_EXPANDED, !state);
+        });
     }
 }

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omnibox/suggestions/header/HeaderView.java b/chrome/android/java/src/org/chromium/chrome/browser/omnibox/suggestions/header/HeaderView.java
index 770d7cb..1c789cc 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/omnibox/suggestions/header/HeaderView.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/omnibox/suggestions/header/HeaderView.java

@@ -5,9 +5,12 @@
 package org.chromium.chrome.browser.omnibox.suggestions.header;
 
 import android.content.Context;
+import android.os.Bundle;
 import android.text.TextUtils.TruncateAt;
 import android.util.TypedValue;
 import android.view.Gravity;
+import android.view.accessibility.AccessibilityNodeInfo;
+import android.view.accessibility.AccessibilityNodeInfo.AccessibilityAction;
 import android.widget.ImageView;
 import android.widget.TextView;
 
@@ -23,6 +26,7 @@
 public class HeaderView extends SimpleHorizontalLayoutView {
     private final TextView mHeaderText;
     private final ImageView mHeaderIcon;
+    private boolean mIsExpanded;
 
     /**
      * Constructs a new header view.
@@ -42,6 +46,7 @@
         mHeaderText.setLayoutParams(LayoutParams.forDynamicView());
         mHeaderText.setMaxLines(1);
         mHeaderText.setEllipsize(TruncateAt.END);
+        mHeaderText.setAllCaps(true);
         mHeaderText.setTextAppearance(ChromeColors.getMediumTextSecondaryStyle(false));
         mHeaderText.setMinHeight(context.getResources().getDimensionPixelSize(
                 R.dimen.omnibox_suggestion_header_height));
@@ -69,4 +74,35 @@
     TextView getTextView() {
         return mHeaderText;
     }
+
+    /**
+     * Specifies whether view should be announced as expanded or collapsed.
+     *
+     * @param isExpanded true, if view should be announced as expanded.
+     */
+    void setExpandedStateForAccessibility(boolean isExpanded) {
+        mIsExpanded = isExpanded;
+    }
+
+    @Override
+    public boolean isFocused() {
+        return super.isFocused() || (isSelected() && !isInTouchMode());
+    }
+
+    @Override
+    public void onInitializeAccessibilityNodeInfo(AccessibilityNodeInfo info) {
+        super.onInitializeAccessibilityNodeInfo(info);
+        info.getActionList().add(mIsExpanded ? AccessibilityAction.ACTION_COLLAPSE
+                                             : AccessibilityAction.ACTION_EXPAND);
+    }
+
+    @Override
+    public boolean performAccessibilityAction(int action, Bundle arguments) {
+        if (action == AccessibilityNodeInfo.ACTION_EXPAND
+                || action == AccessibilityNodeInfo.ACTION_COLLAPSE) {
+            performClick();
+            return true;
+        }
+        return super.performAccessibilityAction(action, arguments);
+    }
 }

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omnibox/suggestions/header/HeaderViewBinder.java b/chrome/android/java/src/org/chromium/chrome/browser/omnibox/suggestions/header/HeaderViewBinder.java
index 2c72683b..670e700 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/omnibox/suggestions/header/HeaderViewBinder.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/omnibox/suggestions/header/HeaderViewBinder.java

@@ -7,6 +7,7 @@
 import androidx.core.view.ViewCompat;
 
 import org.chromium.base.ApiCompatibilityUtils;
+import org.chromium.chrome.R;
 import org.chromium.chrome.browser.omnibox.suggestions.SuggestionCommonProperties;
 import org.chromium.components.browser_ui.styles.ChromeColors;
 import org.chromium.ui.modelutil.PropertyKey;
@@ -27,6 +28,18 @@
         } else if (propertyKey == SuggestionCommonProperties.LAYOUT_DIRECTION) {
             ViewCompat.setLayoutDirection(
                     view, model.get(SuggestionCommonProperties.LAYOUT_DIRECTION));
+        } else if (propertyKey == HeaderViewProperties.IS_EXPANDED) {
+            boolean isExpanded = model.get(HeaderViewProperties.IS_EXPANDED);
+            view.getIconView().setImageResource(isExpanded ? R.drawable.ic_expand_less_black_24dp
+                                                           : R.drawable.ic_expand_more_black_24dp);
+            view.setExpandedStateForAccessibility(isExpanded);
+        } else if (propertyKey == HeaderViewProperties.DELEGATE) {
+            Runnable delegate = model.get(HeaderViewProperties.DELEGATE);
+            if (delegate != null) {
+                view.setOnClickListener(v -> delegate.run());
+            } else {
+                view.setOnClickListener(null);
+            }
         }
     }
 }

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/omnibox/suggestions/header/HeaderViewProperties.java b/chrome/android/java/src/org/chromium/chrome/browser/omnibox/suggestions/header/HeaderViewProperties.java
index 9e8086f..40317c8 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/omnibox/suggestions/header/HeaderViewProperties.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/omnibox/suggestions/header/HeaderViewProperties.java

@@ -7,14 +7,21 @@
 import org.chromium.chrome.browser.omnibox.suggestions.SuggestionCommonProperties;
 import org.chromium.ui.modelutil.PropertyKey;
 import org.chromium.ui.modelutil.PropertyModel;
+import org.chromium.ui.modelutil.PropertyModel.WritableBooleanPropertyKey;
 import org.chromium.ui.modelutil.PropertyModel.WritableObjectPropertyKey;
 
 /** The properties associated with the header suggestions. */
 public class HeaderViewProperties {
+    /** The runnable object that is executed whenever user taps the header suggestion. */
+    public static final WritableObjectPropertyKey<Runnable> DELEGATE =
+            new WritableObjectPropertyKey<>();
+    /** The expanded state of the header suggestion. */
+    public static final WritableBooleanPropertyKey IS_EXPANDED = new WritableBooleanPropertyKey();
     /** The text content to be displayed as a header text. */
     public static final WritableObjectPropertyKey<String> TITLE = new WritableObjectPropertyKey<>();
 
-    public static final PropertyKey[] ALL_UNIQUE_KEYS = new PropertyKey[] {TITLE};
+    public static final PropertyKey[] ALL_UNIQUE_KEYS =
+            new PropertyKey[] {DELEGATE, IS_EXPANDED, TITLE};
 
     public static final PropertyKey[] ALL_KEYS =
             PropertyModel.concatKeys(ALL_UNIQUE_KEYS, SuggestionCommonProperties.ALL_KEYS);

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/share/LensUtils.java b/chrome/android/java/src/org/chromium/chrome/browser/share/LensUtils.java
index fae5a35b..38b18ec3 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/share/LensUtils.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/share/LensUtils.java

@@ -13,6 +13,8 @@
 import android.os.Build;
 import android.text.TextUtils;
 
+import androidx.annotation.VisibleForTesting;
+
 import org.chromium.base.ContextUtils;
 import org.chromium.chrome.browser.IntentHandler;
 import org.chromium.chrome.browser.externalauth.ExternalAuthUtils;
@@ -20,6 +22,7 @@
 import org.chromium.chrome.browser.signin.IdentityServicesProvider;
 import org.chromium.components.signin.base.CoreAccountInfo;
 import org.chromium.components.signin.identitymanager.ConsentLevel;
+import org.chromium.components.variations.VariationsAssociatedData;
 
 /**
  * This class provides utilities for intenting into Google Lens.
@@ -32,6 +35,7 @@
     private static final String LAUNCH_TIMESTAMP_URI_KEY = "ActivityLaunchTimestampNanos";
     private static final String IMAGE_SRC_URI_KEY = "ImageSrc";
     private static final String ALT_URI_KEY = "ImageAlt";
+    private static final String VARIATION_ID_URI_KEY = "Gid";
 
     private static final String MIN_AGSA_VERSION_FEATURE_PARAM_NAME = "minAgsaVersionName";
     private static final String USE_SEARCH_BY_IMAGE_TEXT_FEATURE_PARAM_NAME =
@@ -45,6 +49,7 @@
      * See function for details.
      */
     private static boolean sFakePassableLensEnvironmentForTesting;
+    private static String sFakeVariationsForTesting;
 
     /*
      * If true, short-circuit the version name intent check to always return a high enough version.
@@ -56,6 +61,16 @@
         sFakePassableLensEnvironmentForTesting = shouldFake;
     }
 
+    /*
+     * If set, short-circuit the JNI call to retrieve the variation IDs.
+     * Used by test cases.
+     * @param fakeIdString Whether to fake the version check.
+     */
+    @VisibleForTesting
+    static void setFakeVariationsForTesting(String fakeVariations) {
+        sFakeVariationsForTesting = fakeVariations;
+    }
+
     /**
      * Resolve the activity to verify that lens is ready to accept an intent and also
      * retrieve the version name.
@@ -180,19 +195,28 @@
                                 SEND_SRC_PARAM_NAME, false)) {
                     lensUriBuilder.appendQueryParameter(IMAGE_SRC_URI_KEY, srcUrl);
                 }
-
                 if ((titleOrAltText != null)
                         && ChromeFeatureList.getFieldTrialParamByFeatureAsBoolean(
                                 ChromeFeatureList.CONTEXT_MENU_SEARCH_WITH_GOOGLE_LENS,
                                 SEND_ALT_PARAM_NAME, false)) {
                     lensUriBuilder.appendQueryParameter(ALT_URI_KEY, titleOrAltText);
                 }
+                String variations = sFakeVariationsForTesting == null
+                        ? VariationsAssociatedData.getGoogleAppVariations()
+                        : sFakeVariationsForTesting;
+                variations = variations.trim();
+                if (!variations.isEmpty()) {
+                    lensUriBuilder.appendQueryParameter(VARIATION_ID_URI_KEY, variations);
+                }
+                lensUri = lensUriBuilder.build();
             }
 
             lensUri = lensUriBuilder.build();
             ContextUtils.getApplicationContext().grantUriPermission(
                     IntentHandler.PACKAGE_GSA, imageUri, Intent.FLAG_GRANT_READ_URI_PERMISSION);
         }
+        ContextUtils.getApplicationContext().grantUriPermission(
+                IntentHandler.PACKAGE_GSA, imageUri, Intent.FLAG_GRANT_READ_URI_PERMISSION);
 
         Intent intent = new Intent(Intent.ACTION_VIEW).setData(lensUri);
         intent.setPackage(IntentHandler.PACKAGE_GSA);

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateClientImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateClientImpl.java
index aae4c4d..41124de0 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateClientImpl.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateClientImpl.java

@@ -10,7 +10,6 @@
 
 import org.chromium.chrome.browser.AppHooks;
 import org.chromium.chrome.browser.ChromeActivity;
-import org.chromium.chrome.browser.tabmodel.TabModelSelector;
 import org.chromium.components.external_intents.AuthenticatorNavigationInterceptor;
 import org.chromium.components.external_intents.ExternalNavigationHandler;
 import org.chromium.components.external_intents.InterceptNavigationDelegateClient;
@@ -111,7 +110,7 @@
 
     @Override
     public void closeTab() {
-        TabModelSelector.from(mTab).closeTab(mTab);
+        mTab.getActivity().getTabModelSelector().closeTab(mTab);
     }
 
     @Override

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
index fe8e9e7..5f3b3be9 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabContextMenuItemDelegate.java

@@ -45,6 +45,7 @@
  */
 public class TabContextMenuItemDelegate implements ContextMenuItemDelegate {
     private final TabImpl mTab;
+    private final TabModelSelector mTabModelSelector;
     private boolean mLoadOriginalImageRequestedForPageLoad;
     private EmptyTabObserver mDataReductionProxyContextMenuTabObserver;
     private final Supplier<EphemeralTabCoordinator> mEphemeralTabCoordinatorSupplier;
@@ -52,9 +53,10 @@
     /**
      * Builds a {@link TabContextMenuItemDelegate} instance.
      */
-    public TabContextMenuItemDelegate(
-            Tab tab, Supplier<EphemeralTabCoordinator> ephemeralTabCoordinatorSupplier) {
+    public TabContextMenuItemDelegate(Tab tab, TabModelSelector tabModelSelector,
+            Supplier<EphemeralTabCoordinator> ephemeralTabCoordinatorSupplier) {
         mTab = (TabImpl) tab;
+        mTabModelSelector = tabModelSelector;
         mEphemeralTabCoordinatorSupplier = ephemeralTabCoordinatorSupplier;
 
         mDataReductionProxyContextMenuTabObserver = new EmptyTabObserver() {
@@ -88,7 +90,8 @@
 
     @Override
     public boolean isOpenInOtherWindowSupported() {
-        return MultiWindowUtils.getInstance().isOpenInOtherWindowSupported(mTab.getActivity());
+        return MultiWindowUtils.getInstance().isOpenInOtherWindowSupported(
+                TabUtils.getActivity(mTab));
     }
 
     @Override
@@ -124,7 +127,7 @@
         Intent intent = new Intent(Intent.ACTION_VIEW);
         intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
         intent.setData(Uri.parse(uri));
-        IntentUtils.safeStartActivity(mTab.getActivity(), intent);
+        IntentUtils.safeStartActivity(mTab.getContext(), intent);
     }
 
     @Override
@@ -139,7 +142,7 @@
         Intent intent = new Intent(Intent.ACTION_VIEW);
         intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
         intent.setData(Uri.parse(url));
-        IntentUtils.safeStartActivity(mTab.getActivity(), intent);
+        IntentUtils.safeStartActivity(mTab.getContext(), intent);
     }
 
     @Override
@@ -153,7 +156,7 @@
     public void onSendTextMessage(String url) {
         Intent intent = new Intent(Intent.ACTION_VIEW);
         intent.setData(Uri.parse("sms:" + UrlUtilities.getTelNumber(url)));
-        IntentUtils.safeStartActivity(mTab.getActivity(), intent);
+        IntentUtils.safeStartActivity(mTab.getContext(), intent);
     }
 
     @Override
@@ -174,7 +177,7 @@
         } else if (UrlUtilities.isTelScheme(url)) {
             intent.putExtra(ContactsContract.Intents.Insert.PHONE, UrlUtilities.getTelNumber(url));
         }
-        IntentUtils.safeStartActivity(mTab.getActivity(), intent);
+        IntentUtils.safeStartActivity(mTab.getContext(), intent);
     }
 
     @Override
@@ -182,7 +185,8 @@
         TabDelegate tabDelegate = new TabDelegate(mTab.isIncognito());
         LoadUrlParams loadUrlParams = new LoadUrlParams(url);
         loadUrlParams.setReferrer(referrer);
-        tabDelegate.createTabInOtherWindow(loadUrlParams, mTab.getActivity(), mTab.getParentId());
+        tabDelegate.createTabInOtherWindow(
+                loadUrlParams, TabUtils.getActivity(mTab), mTab.getParentId());
     }
 
     @Override
@@ -191,7 +195,7 @@
         RecordUserAction.record("LinkOpenedInNewTab");
         LoadUrlParams loadUrlParams = new LoadUrlParams(url);
         loadUrlParams.setReferrer(referrer);
-        TabModelSelector.from(mTab).openNewTab(
+        mTabModelSelector.openNewTab(
                 loadUrlParams, TabLaunchType.FROM_LONGPRESS_BACKGROUND, mTab, isIncognito());
     }
 
@@ -209,7 +213,7 @@
     @Override
     public void onOpenInNewIncognitoTab(String url) {
         RecordUserAction.record("MobileNewTabOpened");
-        TabModelSelector.from(mTab).openNewTab(
+        mTabModelSelector.openNewTab(
                 new LoadUrlParams(url), TabLaunchType.FROM_LONGPRESS_FOREGROUND, mTab, true);
     }
 
@@ -230,7 +234,7 @@
     public void onOpenImageInNewTab(String url, Referrer referrer) {
         LoadUrlParams loadUrlParams = new LoadUrlParams(url);
         loadUrlParams.setReferrer(referrer);
-        mTab.getActivity().getTabModelSelector().openNewTab(
+        mTabModelSelector.openNewTab(
                 loadUrlParams, TabLaunchType.FROM_LONGPRESS_BACKGROUND, mTab, isIncognito());
     }
 
@@ -274,9 +278,7 @@
         }
 
         if (!activityStarted) {
-            Context context = mTab.getActivity();
-            if (context == null) context = applicationContext;
-            context.startActivity(chromeIntent);
+            mTab.getContext().startActivity(chromeIntent);
             activityStarted = true;
         }
     }
@@ -293,7 +295,7 @@
             IntentHandler.addTrustedIntentExtras(intent);
             IntentHandler.setTabLaunchType(intent, TabLaunchType.FROM_EXTERNAL_APP);
         }
-        IntentUtils.safeStartActivity(mTab.getActivity(), intent);
+        IntentUtils.safeStartActivity(mTab.getContext(), intent);
     }
 
     @Override
@@ -305,7 +307,7 @@
     public void onOpenInDefaultBrowser(String url) {
         Intent intent = new Intent(Intent.ACTION_VIEW, Uri.parse(url));
         CustomTabsIntent.setAlwaysUseBrowserUI(intent);
-        IntentUtils.safeStartActivity(mTab.getActivity(), intent);
+        IntentUtils.safeStartActivity(mTab.getContext(), intent);
     }
 
     /**

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabParentIntent.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabParentIntent.java
index dc4d214a..cc20b707 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabParentIntent.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabParentIntent.java

@@ -8,7 +8,7 @@
 
 import org.chromium.base.UserData;
 import org.chromium.base.UserDataHost;
-import org.chromium.chrome.browser.tabmodel.TabModelSelector;
+import org.chromium.base.supplier.Supplier;
 
 /**
  * A holder of {@link Intent} object to be used to bring back the parent {@link Activity}
@@ -19,6 +19,8 @@
 
     private final Tab mTab;
 
+    private Supplier<Tab> mCurrentTab;
+
     /**
      * If the associated tab was opened from another tab in another Activity, this is the Intent
      * that can be fired to bring the parent Activity back.
@@ -41,7 +43,7 @@
 
     @Override
     public void onCloseContents(Tab tab) {
-        boolean isSelected = TabModelSelector.from(mTab).getCurrentTab() == tab;
+        boolean isSelected = mCurrentTab.get() == tab;
 
         // If the parent Tab belongs to another Activity, fire the Intent to bring it back.
         if (isSelected && mParentIntent != null
@@ -50,8 +52,16 @@
         }
     }
 
-    public void set(Intent intent) {
+    public TabParentIntent set(Intent intent) {
         mParentIntent = intent;
+        return this;
+    }
+
+    /**
+     * Set the supplier of the current Tab.
+     */
+    public void setCurrentTab(Supplier<Tab> currentTab) {
+        mCurrentTab = currentTab;
     }
 
     @Override

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabUma.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabUma.java
index 30d4947..2b88a5a 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabUma.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabUma.java

@@ -240,7 +240,7 @@
                     }
                 }
             };
-            TabModelSelector.from(tab).addObserver(mNewTabObserver);
+            getTabModelSelector(tab).addObserver(mNewTabObserver);
         }
 
         // Record "tab age upon first display" metrics. previousTimestampMillis is persisted through
@@ -266,6 +266,11 @@
         updateTabState(TAB_STATE_ACTIVE);
     }
 
+    private static TabModelSelector getTabModelSelector(Tab tab) {
+        TabImpl tabImpl = (TabImpl) tab;
+        return tabImpl.getActivity().getTabModelSelector();
+    }
+
     @Override
     public void onHidden(Tab tab, @TabHidingType int type) {
         if (type == TabHidingType.ACTIVITY_HIDDEN) {
@@ -287,7 +292,7 @@
 
         recordNumBackgroundTabsOpened();
         if (mNewTabObserver != null) {
-            TabModelSelector.from(tab).removeObserver(mNewTabObserver);
+            getTabModelSelector(tab).removeObserver(mNewTabObserver);
             mNewTabObserver = null;
         }
         tab.removeObserver(this);

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java b/chrome/android/java/src/org/chromium/chrome/browser/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java
index a3cd12b..fe2b8f1 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab_activity_glue/ActivityTabWebContentsDelegateAndroid.java

@@ -40,7 +40,6 @@
 import org.chromium.chrome.browser.tab.TabWebContentsDelegateAndroid;
 import org.chromium.chrome.browser.tabmodel.TabCreatorManager.TabCreator;
 import org.chromium.chrome.browser.tabmodel.TabModel;
-import org.chromium.chrome.browser.tabmodel.TabModelSelector;
 import org.chromium.chrome.browser.tabmodel.TabModelUtils;
 import org.chromium.content_public.browser.WebContents;
 import org.chromium.ui.base.WindowAndroid;
@@ -157,7 +156,7 @@
 
         if (success) {
             if (disposition == WindowOpenDisposition.NEW_FOREGROUND_TAB) {
-                if (TabModelSelector.from(mTab)
+                if (mActivity.getTabModelSelector()
                                 .getTabModelFilterProvider()
                                 .getCurrentTabModelFilter()
                                 .getRelatedTabList(mTab.getId())

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
index 480cde32..83970fe 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabbed_mode/TabbedRootUiCoordinator.java

@@ -265,8 +265,8 @@
                 }
             }
         };
-        mOfflineIndicatorController = new OfflineIndicatorControllerV2(
-                mActivity, mStatusIndicatorCoordinator, isUrlBarFocusedSupplier);
+        mOfflineIndicatorController = new OfflineIndicatorControllerV2(mActivity,
+                mStatusIndicatorCoordinator, isUrlBarFocusedSupplier, mCanAnimateBrowserControls);
         mToolbarManager.getFakeboxDelegate().addUrlFocusChangeListener(mUrlFocusChangeListener);
     }
 

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/ChromeTabCreator.java b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/ChromeTabCreator.java
index b69cd64..5ecc2e6 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/ChromeTabCreator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/ChromeTabCreator.java

@@ -180,7 +180,7 @@
                               .setDelegateFactory(delegateFactory)
                               .setInitiallyHidden(!openInForeground)
                               .build();
-                TabParentIntent.from(tab).set(parentIntent);
+                TabParentIntent.from(tab).set(parentIntent).setCurrentTab(selector::getCurrentTab);
                 webContents.resumeLoadingCreatedWebContents();
             } else if (!openInForeground && SysUtils.isLowEndDevice()) {
                 // On low memory devices the tabs opened in background are not loaded automatically

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelFilter.java b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelFilter.java
index 348e890..5247cd99 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelFilter.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelFilter.java

@@ -30,6 +30,7 @@
     private TabModel mTabModel;
     protected ObserverList<TabModelObserver> mFilteredObservers = new ObserverList<>();
     private boolean mTabRestoreCompleted;
+    private boolean mTabStateInitialized;
 
     public TabModelFilter(TabModel tabModel) {
         mTabModel = tabModel;
@@ -57,6 +58,16 @@
     }
 
     /**
+     * Mark TabState initialized, and TabModelFilter ready to use. This should only be called once,
+     * and should only be called by {@link TabModelFilterProvider}.
+     */
+    @VisibleForTesting(otherwise = VisibleForTesting.PACKAGE_PRIVATE)
+    public void markTabStateInitialized() {
+        assert !mTabStateInitialized;
+        mTabStateInitialized = true;
+    }
+
+    /**
      * To be called when this filter should be destroyed. This filter should no longer be used after
      * this.
      */
@@ -150,7 +161,11 @@
      * @return Whether the tab model is fully restored.
      */
     public boolean isTabModelRestored() {
-        return mTabRestoreCompleted || isIncognito();
+        // TODO(crbug.com/1081339): Remove |mTabRestoreCompleted|. |mTabRestoreCompleted| is always
+        // false for incognito, while |mTabStateInitialized| is not. |mTabStateInitialized| is
+        // marked after the TabModelSelector is initialized, therefore it is the true state of the
+        // TabModel.
+        return mTabRestoreCompleted || mTabStateInitialized;
     }
 
     /**

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelFilterProvider.java b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelFilterProvider.java
index 772984a..8eb9cbd 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelFilterProvider.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelFilterProvider.java

@@ -17,7 +17,7 @@
  * {@link TabModel}s. It always owns two {@link TabModelFilter}s, one for normal {@link TabModel}
  * and one for incognito {@link TabModel}.
  */
-public class TabModelFilterProvider {
+public class TabModelFilterProvider extends EmptyTabModelSelectorObserver {
     private List<TabModelFilter> mTabModelFilterList = Collections.emptyList();
 
     TabModelFilterProvider() {}
@@ -103,4 +103,16 @@
         }
         return new EmptyTabModelFilter(model);
     }
+
+    private void markTabStateInitialized() {
+        for (TabModelFilter filter : mTabModelFilterList) {
+            filter.markTabStateInitialized();
+        }
+    }
+
+    // Override EmptyTabModelSelectorObserver.
+    @Override
+    public void onTabStateInitialized() {
+        markTabStateInitialized();
+    }
 }

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelImpl.java
index 49be7b56..fc8af904 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelImpl.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelImpl.java

@@ -128,6 +128,19 @@
     @Override
     public void broadcastSessionRestoreComplete() {
         super.broadcastSessionRestoreComplete();
+
+        // This is to make sure TabModel has a valid index when it has at least one valid Tab after
+        // TabState is initialized. Otherwise, TabModel can have an invalid index even though it has
+        // valid tabs, if the TabModel becomes active before any Tab is restored to that model.
+        if (hasValidTab() && mIndex == INVALID_TAB_INDEX) {
+            // Actually select the first tab if it is the active model, otherwise just set mIndex.
+            if (isCurrentModel()) {
+                TabModelUtils.setIndex(this, 0);
+            } else {
+                mIndex = 0;
+            }
+        }
+
         for (TabModelObserver observer : mObservers) observer.restoreCompleted();
     }
 

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelector.java b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelector.java
index ba2e541..6808e56 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelector.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelector.java

@@ -4,15 +4,11 @@
 
 package org.chromium.chrome.browser.tabmodel;
 
-import android.app.Activity;
-
 import androidx.annotation.Nullable;
 
-import org.chromium.chrome.browser.ChromeActivity;
 import org.chromium.chrome.browser.compositor.layouts.OverviewModeBehavior;
 import org.chromium.chrome.browser.tab.Tab;
 import org.chromium.chrome.browser.tab.TabLaunchType;
-import org.chromium.chrome.browser.tab.TabUtils;
 import org.chromium.content_public.browser.LoadUrlParams;
 
 import java.util.List;
@@ -24,20 +20,6 @@
  */
 public interface TabModelSelector {
     /**
-     * @param tab The Tab to get its {@link TabModelSelector} from.
-     * @return {@link TabModelSelector} that currently hosts the {@link TabModel} for this
-     *         {@link Tab}.
-     */
-    public static TabModelSelector from(Tab tab) {
-        // TODO(jinsukkim): Remove this method.
-        Activity activity = TabUtils.getActivity(tab);
-        if (activity instanceof ChromeActivity) {
-            return ((ChromeActivity) activity).getTabModelSelector();
-        }
-        return null;
-    }
-
-    /**
      * A delegate interface to push close all tabs requests.
      */
     public interface CloseAllTabsDelegate {

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelectorBase.java b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelectorBase.java
index 1a6fc00..371c36b 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelectorBase.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tabmodel/TabModelSelectorBase.java

@@ -54,6 +54,7 @@
         mActiveModelIndex = getModelIndex(mStartIncognito);
         assert mActiveModelIndex != MODEL_NOT_FOUND;
         mTabModelFilterProvider = new TabModelFilterProvider(mTabModels);
+        addObserver(mTabModelFilterProvider);
 
         TabModelObserver tabModelObserver = new TabModelObserver() {
             @Override
@@ -260,6 +261,7 @@
 
     @Override
     public void destroy() {
+        removeObserver(mTabModelFilterProvider);
         mTabModelFilterProvider.destroy();
         for (int i = 0; i < getModels().size(); i++) mTabModels.get(i).destroy();
         mTabModels.clear();

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordinator.java
index f1e00b57..f0c3df47 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordinator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ui/RootUiCoordinator.java

@@ -6,6 +6,7 @@
 
 import android.os.Bundle;
 import android.os.CancellationSignal;
+import android.text.TextUtils;
 import android.view.View;
 import android.view.ViewGroup;
 
@@ -31,6 +32,7 @@
 import org.chromium.chrome.browser.compositor.layouts.LayoutManager;
 import org.chromium.chrome.browser.compositor.layouts.OverviewModeBehavior;
 import org.chromium.chrome.browser.directactions.DirectActionInitializer;
+import org.chromium.chrome.browser.feature_engagement.TrackerFactory;
 import org.chromium.chrome.browser.findinpage.FindToolbarManager;
 import org.chromium.chrome.browser.findinpage.FindToolbarObserver;
 import org.chromium.chrome.browser.flags.ActivityType;
@@ -38,13 +40,16 @@
 import org.chromium.chrome.browser.lifecycle.Destroyable;
 import org.chromium.chrome.browser.lifecycle.InflationObserver;
 import org.chromium.chrome.browser.metrics.UkmRecorder;
+import org.chromium.chrome.browser.omnibox.geo.GeolocationHeader;
 import org.chromium.chrome.browser.paint_preview.PaintPreviewTabHelper;
 import org.chromium.chrome.browser.profiles.Profile;
+import org.chromium.chrome.browser.search_engines.TemplateUrlServiceFactory;
 import org.chromium.chrome.browser.share.ShareButtonController;
 import org.chromium.chrome.browser.share.ShareDelegate;
 import org.chromium.chrome.browser.share.ShareUtils;
 import org.chromium.chrome.browser.tab.AccessibilityVisibilityHandler;
 import org.chromium.chrome.browser.tab.Tab;
+import org.chromium.chrome.browser.tab.TabLaunchType;
 import org.chromium.chrome.browser.tabmodel.TabModelSelector;
 import org.chromium.chrome.browser.toolbar.ButtonDataProvider;
 import org.chromium.chrome.browser.toolbar.ToolbarManager;
@@ -60,7 +65,11 @@
 import org.chromium.chrome.browser.widget.bottomsheet.BottomSheetController;
 import org.chromium.components.browser_ui.widget.MenuOrKeyboardActionController;
 import org.chromium.components.browser_ui.widget.scrim.ScrimCoordinator;
+import org.chromium.components.feature_engagement.EventConstants;
+import org.chromium.content_public.browser.ActionModeCallbackHelper;
+import org.chromium.content_public.browser.LoadUrlParams;
 import org.chromium.ui.base.DeviceFormFactor;
+import org.chromium.ui.base.PageTransition;
 import org.chromium.ui.modaldialog.ModalDialogManager.ModalDialogManagerObserver;
 import org.chromium.ui.modelutil.PropertyModel;
 import org.chromium.ui.vr.VrModeObserver;
@@ -264,8 +273,23 @@
             };
             mActivity.getModalDialogManager().addObserver(mModalDialogManagerObserver);
         }
-        mChromeActionModeHandler = new ChromeActionModeHandler(
-                mActivity.getActivityTabProvider(), mToolbarManager::onActionBarVisibilityChanged);
+        mChromeActionModeHandler = new ChromeActionModeHandler(mActivity.getActivityTabProvider(),
+                mToolbarManager::onActionBarVisibilityChanged, (searchText) -> {
+                    TabModelSelector selector = mActivity.getTabModelSelector();
+                    if (selector == null) return;
+
+                    String query = ActionModeCallbackHelper.sanitizeQuery(
+                            searchText, ActionModeCallbackHelper.MAX_SEARCH_QUERY_LENGTH);
+                    if (TextUtils.isEmpty(query)) return;
+
+                    Tab tab = mActivity.getActivityTabProvider().get();
+                    TrackerFactory
+                            .getTrackerForProfile(Profile.fromWebContents(tab.getWebContents()))
+                            .notifyEvent(EventConstants.WEB_SEARCH_PERFORMED);
+
+                    selector.openNewTab(generateUrlParamsForSearch(tab, query),
+                            TabLaunchType.FROM_LONGPRESS_FOREGROUND, tab, tab.isIncognito());
+                });
         mVrModeObserver = new VrModeObserver() {
             @Override
             public void onEnterVr() {
@@ -279,6 +303,19 @@
     }
 
     /**
+     * Generate the LoadUrlParams necessary to load the specified search query.
+     */
+    private static LoadUrlParams generateUrlParamsForSearch(Tab tab, String query) {
+        String url = TemplateUrlServiceFactory.get().getUrlForSearchQuery(query);
+        String headers = GeolocationHeader.getGeoHeader(url, tab);
+
+        LoadUrlParams loadUrlParams = new LoadUrlParams(url);
+        loadUrlParams.setVerbatimHeaders(headers);
+        loadUrlParams.setTransitionType(PageTransition.GENERATED);
+        return loadUrlParams;
+    }
+
+    /**
      * Triggered when the share menu item is selected.
      * This creates and shows a share intent picker dialog or starts a share intent directly.
      * @param shareDirectly Whether it should share directly with the activity that was most

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/contextmenu/ContextMenuTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/contextmenu/ContextMenuTest.java
index 8a0a3fe..ddac656 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/contextmenu/ContextMenuTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/contextmenu/ContextMenuTest.java

@@ -626,6 +626,10 @@
     @Feature({"Browser", "ContextMenu"})
     @EnableFeatures({ChromeFeatureList.CONTEXT_MENU_COPY_IMAGE})
     public void testCopyImage() throws Throwable {
+        if (!ChromeContextMenuPopulator.isCopyImageEnabled()) {
+            return;
+        }
+
         hardcodeTestImageForSharing(TEST_GIF_IMAGE_FILE_EXTENSION);
         Tab tab = mDownloadTestRule.getActivity().getActivityTab();
         // Allow all thread policies temporarily in main thread to avoid

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/homepage/settings/HomepageSettingsFragmentTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/homepage/settings/HomepageSettingsFragmentTest.java
index 467f5922..d751de16 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/homepage/settings/HomepageSettingsFragmentTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/homepage/settings/HomepageSettingsFragmentTest.java

@@ -173,6 +173,35 @@
     @Test
     @SmallTest
     @Feature({"Homepage"})
+    public void testStartUp_ChromeNTP_WithPartner() {
+        PartnerBrowserCustomizations.getInstance().setHomepageForTests(TEST_URL_FOO);
+        mHomepageTestRule.useChromeNTPForTest();
+
+        launchSettingsActivity();
+
+        Assert.assertTrue(ASSERT_MESSAGE_SWITCH_ENABLE, mSwitch.isEnabled());
+        Assert.assertTrue(ASSERT_MESSAGE_RADIO_BUTTON_ENABLED, mChromeNtpRadioButton.isEnabled());
+        Assert.assertTrue(ASSERT_MESSAGE_RADIO_BUTTON_ENABLED, mCustomUriRadioButton.isEnabled());
+        Assert.assertTrue(ASSERT_MESSAGE_TITLE_ENABLED, mTitleTextView.isEnabled());
+
+        Assert.assertTrue(ASSERT_MESSAGE_SWITCH_CHECK, mSwitch.isChecked());
+        Assert.assertTrue(ASSERT_MESSAGE_RADIO_BUTTON_NTP_CHECK, mChromeNtpRadioButton.isChecked());
+        Assert.assertFalse(
+                ASSERT_MESSAGE_RADIO_BUTTON_CUSTOMIZED_CHECK, mCustomUriRadioButton.isChecked());
+        Assert.assertEquals(ASSERT_MESSAGE_EDIT_TEXT, TEST_URL_FOO,
+                mCustomUriRadioButton.getPrimaryText().toString());
+
+        Assert.assertEquals(ASSERT_HOMEPAGE_LOCATION_TYPE_MISMATCH,
+                HomepageLocationType.USER_CUSTOMIZED_NTP,
+                HomepageManager.getInstance().getHomepageLocationType());
+
+        // Reset partner provided information
+        PartnerBrowserCustomizations.destroy();
+    }
+
+    @Test
+    @SmallTest
+    @Feature({"Homepage"})
     @Restriction(UiRestriction.RESTRICTION_TYPE_PHONE)
     public void testStartUp_ChromeNTP_BottomToolbar() {
         mHomepageTestRule.useCustomizedHomepageForTest(TEST_URL_BAR);

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/offlinepages/RecentTabsTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/offlinepages/RecentTabsTest.java
index 9c4bc6ed..43c0381 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/offlinepages/RecentTabsTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/offlinepages/RecentTabsTest.java

@@ -103,7 +103,7 @@
                 new ClientId(OfflinePageBridge.LAST_N_NAMESPACE, Integer.toString(tab.getId()));
 
         // The tab should be foreground and so no snapshot should exist.
-        TabModelSelector tabModelSelector = TabModelSelector.from(tab);
+        TabModelSelector tabModelSelector = mActivityTestRule.getActivity().getTabModelSelector();
         Assert.assertEquals(tabModelSelector.getCurrentTab(), tab);
         Assert.assertFalse(tab.isHidden());
         Assert.assertNull(OfflineTestUtil.getPageByClientId(firstTabClientId));

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/share/LensUtilsTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/share/LensUtilsTest.java
index faa4391b..57127cd 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/share/LensUtilsTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/share/LensUtilsTest.java

@@ -86,6 +86,53 @@
     }
 
     /**
+     * Test {@link LensUtils#getShareWithGoogleLensIntent()} method and that variations
+     * are added to the URI.
+     */
+    @Test
+    @SmallTest
+    public void getShareWithGoogleLensIntentWithVariationsTest() {
+        LensUtils.setFakeVariationsForTesting(" 123 456 ");
+        SigninTestUtil.signIn(SigninTestUtil.addTestAccount("test@gmail.com"));
+
+        final String contentUrl = "content://image-url";
+        Intent intentWithContentUri = getShareWithGoogleLensIntentOnUiThread(Uri.parse(contentUrl),
+                /* isIncognito= */ false, 1234L, /* srcUrl */ "",
+                /* titleOrAltText */ "");
+        // The account name should not be included in the intent because the uesr is incognito.
+        Assert.assertEquals("Intent with image has incorrect URI",
+                "googleapp://lens?LensBitmapUriKey=content%3A%2F%2Fimage-url&AccountNameUriKey="
+                        + "test%40gmail.com&IncognitoUriKey=false&ActivityLaunchTimestampNanos="
+                        + "1234&Gid=123%20456",
+                intentWithContentUri.getData().toString());
+        Assert.assertEquals("Intent with image has incorrect action", Intent.ACTION_VIEW,
+                intentWithContentUri.getAction());
+    }
+
+    /**
+     * Test {@link LensUtils#getShareWithGoogleLensIntent()} method and that variations
+     * are not sent when the user is incognito.
+     */
+    @Test
+    @SmallTest
+    public void getShareWithGoogleLensIntentWithVariationsIncognitoTest() {
+        LensUtils.setFakeVariationsForTesting(" 123 456 ");
+        SigninTestUtil.signIn(SigninTestUtil.addTestAccount("test@gmail.com"));
+
+        final String contentUrl = "content://image-url";
+        Intent intentWithContentUri = getShareWithGoogleLensIntentOnUiThread(Uri.parse(contentUrl),
+                /* isIncognito= */ true, 1234L, /* srcUrl */ "",
+                /* titleOrAltText */ "");
+        // The account name should not be included in the intent because the uesr is incognito.
+        Assert.assertEquals("Intent with image has incorrect URI",
+                "googleapp://lens?LensBitmapUriKey=content%3A%2F%2Fimage-url&AccountNameUriKey="
+                        + "&IncognitoUriKey=true&ActivityLaunchTimestampNanos=1234",
+                intentWithContentUri.getData().toString());
+        Assert.assertEquals("Intent with image has incorrect action", Intent.ACTION_VIEW,
+                intentWithContentUri.getAction());
+    }
+
+    /**
      * Test {@link LensUtils#getShareWithGoogleLensIntent()} method when user is not
      * signed in.
      */

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/tabmodel/TabModelImplTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/tabmodel/TabModelImplTest.java
new file mode 100644
index 0000000..3990ed7
--- /dev/null
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/tabmodel/TabModelImplTest.java

@@ -0,0 +1,166 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.chrome.browser.tabmodel;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotEquals;
+
+import android.support.test.InstrumentationRegistry;
+
+import androidx.test.filters.SmallTest;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import org.chromium.base.test.util.CommandLineFlags;
+import org.chromium.chrome.browser.ChromeTabbedActivity;
+import org.chromium.chrome.browser.flags.ChromeSwitches;
+import org.chromium.chrome.browser.tab.TabState;
+import org.chromium.chrome.test.ChromeJUnit4ClassRunner;
+import org.chromium.chrome.test.ChromeTabbedActivityTestRule;
+import org.chromium.chrome.test.util.ApplicationTestUtils;
+import org.chromium.chrome.test.util.ChromeTabUtils;
+import org.chromium.content_public.browser.test.util.Criteria;
+import org.chromium.content_public.browser.test.util.CriteriaHelper;
+
+import java.util.concurrent.atomic.AtomicBoolean;
+
+/**
+ * Tests for {@link TabModelImpl}.
+ */
+@RunWith(ChromeJUnit4ClassRunner.class)
+@CommandLineFlags.Add({ChromeSwitches.DISABLE_FIRST_RUN_EXPERIENCE})
+public class TabModelImplTest {
+    @Rule
+    public ChromeTabbedActivityTestRule mActivityTestRule = new ChromeTabbedActivityTestRule();
+
+    @Before
+    public void setUp() {
+        mActivityTestRule.startMainActivityOnBlankPage();
+    }
+
+    @After
+    public void tearDown() {
+        mTabModelRestoreCompleted.set(false);
+    }
+
+    private AtomicBoolean mTabModelRestoreCompleted = new AtomicBoolean(false);
+
+    private TabModelSelectorTabModelObserver createTabModelSelectorTabModelObserver(
+            TabModelSelector tabModelSelector) {
+        return new TabModelSelectorTabModelObserver(tabModelSelector) {
+            @Override
+            public void restoreCompleted() {
+                mTabModelRestoreCompleted.set(true);
+            }
+        };
+    }
+
+    private void createTabs(int tabsCount, boolean isIncognito, String url) {
+        TabModel tabModel =
+                mActivityTestRule.getActivity().getTabModelSelector().getModel(isIncognito);
+        int oldTabsCount = tabModel.getCount();
+
+        for (int i = 0; i < tabsCount; i++) {
+            ChromeTabUtils.newTabFromMenu(InstrumentationRegistry.getInstrumentation(),
+                    mActivityTestRule.getActivity(), isIncognito, url == null);
+
+            if (url != null) mActivityTestRule.loadUrl(url);
+        }
+
+        CriteriaHelper.pollUiThread(
+                Criteria.equals(tabsCount, () -> tabModel.getCount() - oldTabsCount));
+    }
+
+    @Test
+    @SmallTest
+    public void validIndexAfterRestored_FromColdStart() {
+        TabModel normalTabModel =
+                mActivityTestRule.getActivity().getTabModelSelector().getModel(false);
+        assertEquals(1, normalTabModel.getCount());
+        assertNotEquals(TabModel.INVALID_TAB_INDEX, normalTabModel.index());
+
+        TabModel incognitoTabModel =
+                mActivityTestRule.getActivity().getTabModelSelector().getModel(true);
+        assertEquals(0, incognitoTabModel.getCount());
+        assertEquals(TabModel.INVALID_TAB_INDEX, incognitoTabModel.index());
+    }
+
+    @Test
+    @SmallTest
+    public void validIndexAfterRestored_FromColdStart_WithIncognitoTabs() throws Exception {
+        createTabs(1, true, "about:blank");
+        // Need to wait for contentsState to be initialized for the tab to restore correctly.
+        CriteriaHelper.pollUiThread(
+                ()
+                        -> TabState.from(mActivityTestRule.getActivity().getActivityTab())
+                                   .contentsState
+                        != null);
+
+        ApplicationTestUtils.finishActivity(mActivityTestRule.getActivity());
+
+        mActivityTestRule.startMainActivityOnBlankPage();
+
+        TabModel normalTabModel =
+                mActivityTestRule.getActivity().getTabModelSelector().getModel(false);
+        // Tab count is 2, because startMainActivityOnBlankPage() is called twice.
+        assertEquals(2, normalTabModel.getCount());
+        assertNotEquals(TabModel.INVALID_TAB_INDEX, normalTabModel.index());
+
+        // No incognito tabs are restored from a cold start.
+        TabModel incognitoTabModel =
+                mActivityTestRule.getActivity().getTabModelSelector().getModel(true);
+        assertEquals(0, incognitoTabModel.getCount());
+        assertEquals(TabModel.INVALID_TAB_INDEX, incognitoTabModel.index());
+    }
+
+    @Test
+    @SmallTest
+    public void validIndexAfterRestored_FromPreviousActivity() {
+        ChromeTabbedActivity newActivity =
+                ApplicationTestUtils.recreateActivity(mActivityTestRule.getActivity());
+        createTabModelSelectorTabModelObserver(newActivity.getTabModelSelector());
+
+        CriteriaHelper.pollUiThread(() -> mTabModelRestoreCompleted.get());
+
+        TabModel normalTabModel = newActivity.getTabModelSelector().getModel(false);
+        assertEquals(1, normalTabModel.getCount());
+        assertNotEquals(TabModel.INVALID_TAB_INDEX, normalTabModel.index());
+
+        TabModel incognitoTabModel = newActivity.getTabModelSelector().getModel(true);
+        assertEquals(0, incognitoTabModel.getCount());
+        assertEquals(TabModel.INVALID_TAB_INDEX, incognitoTabModel.index());
+    }
+
+    @Test
+    @SmallTest
+    public void validIndexAfterRestored_FromPreviousActivity_WithIncognitoTabs() {
+        createTabs(1, true, "about:blank");
+
+        // Need to wait for contentsState to be initialized for the tab to restore correctly.
+        CriteriaHelper.pollUiThread(
+                ()
+                        -> TabState.from(mActivityTestRule.getActivity().getActivityTab())
+                                   .contentsState
+                        != null);
+
+        ChromeTabbedActivity newActivity =
+                ApplicationTestUtils.recreateActivity(mActivityTestRule.getActivity());
+        createTabModelSelectorTabModelObserver(newActivity.getTabModelSelector());
+
+        CriteriaHelper.pollUiThread(() -> mTabModelRestoreCompleted.get());
+
+        TabModel normalTabModel = newActivity.getTabModelSelector().getModel(false);
+        assertEquals(1, normalTabModel.getCount());
+        assertNotEquals(TabModel.INVALID_TAB_INDEX, normalTabModel.index());
+
+        TabModel incognitoTabModel = newActivity.getTabModelSelector().getModel(true);
+        assertEquals(1, incognitoTabModel.getCount());
+        assertNotEquals(TabModel.INVALID_TAB_INDEX, incognitoTabModel.index());
+    }
+}

diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/vr/VrBrowserNavigationTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/vr/VrBrowserNavigationTest.java
index da3204d..fe7f3dd 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/vr/VrBrowserNavigationTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/vr/VrBrowserNavigationTest.java

@@ -33,7 +33,6 @@
 import org.chromium.chrome.browser.ntp.NewTabPage;
 import org.chromium.chrome.browser.tab.Tab;
 import org.chromium.chrome.browser.tab.TabLaunchType;
-import org.chromium.chrome.browser.tabmodel.TabModelSelector;
 import org.chromium.chrome.browser.vr.rules.ChromeTabbedActivityVrTestRule;
 import org.chromium.chrome.browser.vr.util.NativeUiUtils;
 import org.chromium.chrome.browser.vr.util.RenderTestUtils;
@@ -618,7 +617,7 @@
         VrBrowserTransitionUtils.forceExitVr();
         TestThreadUtils.runOnUiThreadBlocking(() -> {
             // Close the tab that's automatically open at test start.
-            TabModelSelector.from(mTestRule.getActivity().getActivityTab()).closeAllTabs();
+            mTestRule.getActivity().getTabModelSelector().closeAllTabs();
             // Create an Incognito tab. Closing all tabs automatically goes to overview mode, but
             // appears to take some amount of time to do so. Instead of waiting until then and
             // creating through the menu item, just create an Incognito tab directly.

diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/ChromeActionModeHandlerTest.java b/chrome/android/junit/src/org/chromium/chrome/browser/ChromeActionModeHandlerUnitTest.java
similarity index 98%
rename from chrome/android/junit/src/org/chromium/chrome/browser/ChromeActionModeHandlerTest.java
rename to chrome/android/junit/src/org/chromium/chrome/browser/ChromeActionModeHandlerUnitTest.java
index cb88cc9..15666cf8 100644
--- a/chrome/android/junit/src/org/chromium/chrome/browser/ChromeActionModeHandlerTest.java
+++ b/chrome/android/junit/src/org/chromium/chrome/browser/ChromeActionModeHandlerUnitTest.java

@@ -48,7 +48,7 @@
  */
 @RunWith(BaseRobolectricTestRunner.class)
 @Config(manifest = Config.NONE)
-public class ChromeActionModeHandlerTest {
+public class ChromeActionModeHandlerUnitTest {
     @Mock
     private TabImpl mTab;
     @Mock
@@ -60,7 +60,7 @@
 
     private class TestChromeActionModeCallback extends ChromeActionModeHandler.ActionModeCallback {
         public TestChromeActionModeCallback(Tab tab, ActionModeCallbackHelper helper) {
-            super(tab, null, visible -> {});
+            super(tab, null, visible -> {}, urlParams -> {});
         }
 
         @Override

diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/omnibox/suggestions/header/HeaderViewBinderUnitTest.java b/chrome/android/junit/src/org/chromium/chrome/browser/omnibox/suggestions/header/HeaderViewBinderUnitTest.java
new file mode 100644
index 0000000..52e24753
--- /dev/null
+++ b/chrome/android/junit/src/org/chromium/chrome/browser/omnibox/suggestions/header/HeaderViewBinderUnitTest.java

@@ -0,0 +1,99 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.chrome.browser.omnibox.suggestions.header;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import android.app.Activity;
+import android.view.View;
+import android.widget.ImageView;
+import android.widget.TextView;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+import org.robolectric.Robolectric;
+
+import org.chromium.chrome.R;
+import org.chromium.testing.local.LocalRobolectricTestRunner;
+import org.chromium.ui.modelutil.PropertyModel;
+import org.chromium.ui.modelutil.PropertyModelChangeProcessor;
+
+/**
+ * Tests for {@link BaseSuggestionViewProcessor}.
+ */
+@RunWith(LocalRobolectricTestRunner.class)
+public class HeaderViewBinderUnitTest {
+    Activity mActivity;
+    PropertyModel mModel;
+
+    @Mock
+    HeaderView mHeaderView;
+    @Mock
+    TextView mHeaderText;
+    @Mock
+    ImageView mHeaderIcon;
+
+    @Before
+    public void setUp() {
+        MockitoAnnotations.initMocks(this);
+        mActivity = Robolectric.buildActivity(Activity.class).setup().get();
+        mActivity.setTheme(R.style.Light);
+
+        when(mHeaderView.getContext()).thenReturn(mActivity);
+        when(mHeaderView.getResources()).thenReturn(mActivity.getResources());
+        when(mHeaderView.getTextView()).thenReturn(mHeaderText);
+        when(mHeaderView.getIconView()).thenReturn(mHeaderIcon);
+
+        mModel = new PropertyModel(HeaderViewProperties.ALL_KEYS);
+        PropertyModelChangeProcessor.create(mModel, mHeaderView, HeaderViewBinder::bind);
+    }
+
+    @Test
+    public void actionIcon_iconReflectsExpandedState() {
+        // Expand.
+        mModel.set(HeaderViewProperties.IS_EXPANDED, true);
+        verify(mHeaderIcon, times(1)).setImageResource(R.drawable.ic_expand_less_black_24dp);
+
+        // Collapse.
+        mModel.set(HeaderViewProperties.IS_EXPANDED, false);
+        verify(mHeaderIcon, times(1)).setImageResource(R.drawable.ic_expand_more_black_24dp);
+    }
+
+    @Test
+    public void headerView_accessibilityStringReflectsExpandedState() {
+        // Expand without title.
+        mModel.set(HeaderViewProperties.IS_EXPANDED, true);
+        verify(mHeaderView, times(1)).setExpandedStateForAccessibility(true);
+
+        mModel.set(HeaderViewProperties.IS_EXPANDED, false);
+        verify(mHeaderView, times(1)).setExpandedStateForAccessibility(false);
+    }
+
+    @Test
+    public void headerView_listenerInstalledWhenDelegateIsSet() {
+        final Runnable callback = mock(Runnable.class);
+        final ArgumentCaptor<View.OnClickListener> captor =
+                ArgumentCaptor.forClass(View.OnClickListener.class);
+
+        // Install.
+        mModel.set(HeaderViewProperties.DELEGATE, callback);
+        verify(mHeaderView, times(1)).setOnClickListener(captor.capture());
+
+        // Call.
+        captor.getValue().onClick(null);
+        verify(callback, times(1)).run();
+
+        // Remove.
+        mModel.set(HeaderViewProperties.DELEGATE, null);
+        verify(mHeaderView, times(1)).setOnClickListener(null);
+    }
+}

diff --git a/chrome/android/native_java_unittests/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulatorTest.java b/chrome/android/native_java_unittests/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulatorTest.java
index 22826eb..f86ded2 100644
--- a/chrome/android/native_java_unittests/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulatorTest.java
+++ b/chrome/android/native_java_unittests/src/org/chromium/chrome/browser/contextmenu/ChromeContextMenuPopulatorTest.java

@@ -319,17 +319,29 @@
         initializePopulator(ChromeContextMenuPopulator.ContextMenuMode.NORMAL);
         int[] expected2 = {R.id.contextmenu_open_image_in_new_tab, R.id.contextmenu_copy_image,
                 R.id.contextmenu_save_image, R.id.contextmenu_share_image};
+        if (!ChromeContextMenuPopulator.isCopyImageEnabled()) {
+            expected2 = new int[] {R.id.contextmenu_open_image_in_new_tab,
+                    R.id.contextmenu_save_image, R.id.contextmenu_share_image};
+        }
         checkMenuOptions(contextMenuParams, expected2);
 
         initializePopulator(ChromeContextMenuPopulator.ContextMenuMode.CUSTOM_TAB);
         int[] expected3 = {R.id.contextmenu_open_in_browser_id, R.id.contextmenu_open_image,
                 R.id.contextmenu_copy_image, R.id.contextmenu_save_image,
                 R.id.contextmenu_share_image};
+        if (!ChromeContextMenuPopulator.isCopyImageEnabled()) {
+            expected3 = new int[] {R.id.contextmenu_open_in_browser_id, R.id.contextmenu_open_image,
+                    R.id.contextmenu_save_image, R.id.contextmenu_share_image};
+        }
         checkMenuOptions(contextMenuParams, expected3);
 
         initializePopulator(ChromeContextMenuPopulator.ContextMenuMode.WEB_APP);
         int[] expected4 = {R.id.contextmenu_copy_image, R.id.contextmenu_save_image,
                 R.id.contextmenu_share_image, R.id.contextmenu_open_in_chrome};
+        if (!ChromeContextMenuPopulator.isCopyImageEnabled()) {
+            expected4 = new int[] {R.id.contextmenu_save_image, R.id.contextmenu_share_image,
+                    R.id.contextmenu_open_in_chrome};
+        }
         checkMenuOptions(contextMenuParams, expected4);
     }
 
@@ -358,6 +370,10 @@
                 R.id.contextmenu_share_link};
         int[] expected2Tab2 = {R.id.contextmenu_open_image_in_new_tab, R.id.contextmenu_copy_image,
                 R.id.contextmenu_save_image, R.id.contextmenu_share_image};
+        if (!ChromeContextMenuPopulator.isCopyImageEnabled()) {
+            expected2Tab2 = new int[] {R.id.contextmenu_open_image_in_new_tab,
+                    R.id.contextmenu_save_image, R.id.contextmenu_share_image};
+        }
         checkMenuOptions(contextMenuParams, expected2Tab1, expected2Tab2);
 
         initializePopulator(ChromeContextMenuPopulator.ContextMenuMode.CUSTOM_TAB);
@@ -366,6 +382,11 @@
                 R.id.contextmenu_share_link};
         int[] expected3Tab2 = {R.id.contextmenu_open_image, R.id.contextmenu_copy_image,
                 R.id.contextmenu_save_image, R.id.contextmenu_share_image};
+        if (!ChromeContextMenuPopulator.isCopyImageEnabled()) {
+            expected3Tab2 = new int[] {R.id.contextmenu_open_image, R.id.contextmenu_save_image,
+                    R.id.contextmenu_share_image};
+            ;
+        }
         checkMenuOptions(contextMenuParams, expected3Tab1, expected3Tab2);
 
         initializePopulator(ChromeContextMenuPopulator.ContextMenuMode.WEB_APP);
@@ -373,6 +394,10 @@
                 R.id.contextmenu_share_link};
         int[] expected4Tab2 = {R.id.contextmenu_copy_image, R.id.contextmenu_save_image,
                 R.id.contextmenu_share_image, R.id.contextmenu_open_in_chrome};
+        if (!ChromeContextMenuPopulator.isCopyImageEnabled()) {
+            expected4Tab2 = new int[] {R.id.contextmenu_save_image, R.id.contextmenu_share_image,
+                    R.id.contextmenu_open_in_chrome};
+        }
         checkMenuOptions(contextMenuParams, expected4Tab1, expected4Tab2);
     }
 }

diff --git a/chrome/android/native_java_unittests/src/org/chromium/chrome/browser/omnibox/suggestions/AutocompleteMediatorUnitTest.java b/chrome/android/native_java_unittests/src/org/chromium/chrome/browser/omnibox/suggestions/AutocompleteMediatorUnitTest.java
index 72cf068..9997f06 100644
--- a/chrome/android/native_java_unittests/src/org/chromium/chrome/browser/omnibox/suggestions/AutocompleteMediatorUnitTest.java
+++ b/chrome/android/native_java_unittests/src/org/chromium/chrome/browser/omnibox/suggestions/AutocompleteMediatorUnitTest.java

@@ -423,8 +423,7 @@
                 ((DropdownItemViewInfo) model.get(2)).type, OmniboxSuggestionUiType.DEFAULT);
 
         DropdownItemViewInfo header = (DropdownItemViewInfo) model.get(0);
-        Assert.assertEquals(
-                header.model.get(HeaderViewProperties.TITLE), headers.get(1).toUpperCase());
+        Assert.assertEquals(header.model.get(HeaderViewProperties.TITLE), headers.get(1));
     }
 
     @CalledByNativeJavaTest
@@ -478,10 +477,8 @@
         DropdownItemViewInfo header1 = (DropdownItemViewInfo) model.get(1);
         DropdownItemViewInfo header2 = (DropdownItemViewInfo) model.get(4);
 
-        Assert.assertEquals(
-                header1.model.get(HeaderViewProperties.TITLE), headers.get(1).toUpperCase());
-        Assert.assertEquals(
-                header2.model.get(HeaderViewProperties.TITLE), headers.get(2).toUpperCase());
+        Assert.assertEquals(header1.model.get(HeaderViewProperties.TITLE), headers.get(1));
+        Assert.assertEquals(header2.model.get(HeaderViewProperties.TITLE), headers.get(2));
     }
 
     @CalledByNativeJavaTest

diff --git a/chrome/android/profiles/newest.txt b/chrome/android/profiles/newest.txt
index a854a03..f784936 100644
--- a/chrome/android/profiles/newest.txt
+++ b/chrome/android/profiles/newest.txt

@@ -1 +1 @@
-chromeos-chrome-amd64-84.0.4140.0_rc-r1-merged.afdo.bz2
\ No newline at end of file
+chromeos-chrome-amd64-84.0.4142.0_rc-r2-merged.afdo.bz2
\ No newline at end of file

diff --git a/chrome/app/chromeos_strings.grdp b/chrome/app/chromeos_strings.grdp
index 7f1a45fb8..9760eda 100644
--- a/chrome/app/chromeos_strings.grdp
+++ b/chrome/app/chromeos_strings.grdp

@@ -5087,9 +5087,18 @@
   <message name="IDS_EDU_LOGIN_WELCOME_TITLE" desc="Title for the welcome screen in EDU account addition flow.">
     Get started with a school account
   </message>
+  <message name="IDS_EDU_LOGIN_WELCOME_TITLE_2" desc="Title for the welcome screen in EDU account addition flow.">
+    Ask a parent for permission
+  </message>
   <message name="IDS_EDU_LOGIN_WELCOME_BODY" desc="Text on the welcome screen in EDU account addition flow informing user to ask their parent for permission to add the account.">
     To add an account for access to educational resources, ask a parent to give you permission
   </message>
+  <message name="IDS_EDU_LOGIN_WELCOME_BODY_2" desc="Text on the welcome screen in EDU account addition flow informing user to ask their parent for permission to add the account.">
+    Select the parent who is granting permission to add a school account.
+  </message>
+  <message name="IDS_EDU_LOGIN_WELCOME_PARENT_ACCOUNT_LIST" desc="Text on the welcome screen in EDU account addition flow above the list of parent accounts.">
+    Parent account list
+  </message>
   <message name="IDS_EDU_LOGIN_WELCOME_REAUTH_TITLE" desc="Title for the reauthentication screen in EDU account addition flow.">
     Sign in again with a school account
   </message>
@@ -5123,6 +5132,14 @@
   <message name="IDS_EDU_LOGIN_PARENT_SIGNIN_PASSWORD_HIDE" desc="A tool tip on a button that hides the saved password that is being shown.">
     Hide password
   </message>
+  <message name="IDS_EDU_LOGIN_COEXISTENCE_TITLE" desc="Title for the screen explaining co-existence to a parent.">
+    School account information for parents
+  </message>
+  <message name="IDS_EDU_LOGIN_COEXISTENCE_BODY" desc="Text on the screen explaining co-existence to a parent.">
+    Adding a school account to a profile enables easy sign-in to websites and extensions as a student while operating under parental controls. It does not give a child access to bookmarks, passwords, or other browser data synced with the school account.&lt;br&gt;&lt;br&gt;
+    If your child uses a Chromebook in school and you wish to mirror the school experience at home to ensure your child has access to all necessary schoolwork, please sign out of this Family Link account and sign in to the school account from the Chrome OS accounts page (note: Family Link parental controls will not apply).&lt;br&gt;&lt;br&gt;
+    If your child does not use a Chromebook in school or if you prefer to manage your child’s experience at home using Family Link, please click the Next button below to add a school account to this profile.
+  </message>
 
   <!--
     ==================================================================================
@@ -5133,9 +5150,15 @@
   <message name="IDS_EDU_LOGIN_INFO_TITLE" desc="Title for the parent information screen in EDU account addition flow.">
     School account info for parents
   </message>
+  <message name="IDS_EDU_LOGIN_INFO_TITLE_2" desc="Title for the parent information screen in EDU account addition flow.">
+    G Suite for Education accounts
+  </message>
   <message name="IDS_EDU_LOGIN_INFO_BODY" desc="Text informing parent that only EDU account may be added to the device.">
     Your child wants to add a G Suite for Education Google Account to this device. The <ph name="LINK_BEGIN">&lt;a target="_blank" href="$1<ex>https://gsuite.google.com/terms/education_privacy.html</ex>"&gt;</ph>G Suite for Education Privacy Notice<ph name="LINK_END">&lt;/a&gt;</ph> is meant to help G Suite for Education users and parents understand what data the product collects, why it is collected, and what is done with it.
   </message>
+  <message name="IDS_EDU_LOGIN_INFO_BODY_2" desc="Text informing parent that only EDU account may be added to the device.">
+    The <ph name="LINK_BEGIN">&lt;a target="_blank" href="$1<ex>https://gsuite.google.com/terms/education_privacy.html</ex>"&gt;</ph>G Suite for Education Privacy Notice<ph name="LINK_END">&lt;/a&gt;</ph> is meant to help G Suite for Education users and parents understand what data the product collects, why it is collected, and what is done with it.
+  </message>
   <message name="IDS_EDU_LOGIN_INFO_PARENT_SETTINGS" desc="Text informing parent about Google services that users can access, browsing data storage and Family Link parent settings.">
     G Suite for Education administrators determine which Google services their users can access while signed into a G Suite for Education account. School administrators are required to provide or obtain consent for the use of the services by their minor users.
 

diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index 4e4f134..389326d 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd

@@ -2301,9 +2301,15 @@
       <message name="IDS_BOOKMARK_APP_AX_BUBBLE_NAME_LABEL" desc="Text preceding the name of a bookmark app, read by spoken feedback.">
         Shortcut name
       </message>
+      <message name="IDS_BOOKMARK_APP_BUBBLE_OPEN_AS_TAB" desc="Checkbox text for opening the bookmark app as a browser tab.">
+        Open as tab
+      </message>
       <message name="IDS_BOOKMARK_APP_BUBBLE_OPEN_AS_WINDOW" desc="Checkbox text for opening the bookmark app as a window.">
         Open as window
       </message>
+      <message name="IDS_BOOKMARK_APP_BUBBLE_OPEN_AS_TABBED_WINDOW" desc="Checkbox text for opening the bookmark app as a tabbed window.">
+        Open as tabbed window
+      </message>
 
       <!-- Finish policy app installation dialog -->
       <message name="IDS_FINISH_POLICY_WEB_APP_INSTALLATION" desc="Main text for the Finish Policy Web App Installation dialog. This is a dialog message that appears on the first launch of an app after it was remotely installed by an enterprise administrator. The app has some cosmetic factors (like the app icon) that can only be fixed if the user launches and then restarts the app. After the initial launch, this dialog encourages users to restart the app to complete the installation.">
@@ -3748,12 +3754,12 @@
 
       <!-- Extension alerts. -->
       <message name="IDS_EXTENSION_ALERT_TITLE" desc="Titlebar of the extension notification alert">
-        {NUM_EXTENSIONS, plural, 
+        {NUM_EXTENSIONS, plural,
         =1 {This extension may be dangerous}
         other {These extensions may be dangerous}}
       </message>
       <message name="IDS_APP_ALERT_TITLE" desc="Titlebar of the app notification alert">
-       {NUM_APPS, plural, 
+       {NUM_APPS, plural,
         =1 {This app may be dangerous}
         other {These apps may be dangerous}}
       </message>

diff --git a/chrome/app/generated_resources_grd/IDS_BOOKMARK_APP_BUBBLE_OPEN_AS_TAB.png.sha1 b/chrome/app/generated_resources_grd/IDS_BOOKMARK_APP_BUBBLE_OPEN_AS_TAB.png.sha1
new file mode 100644
index 0000000..dc8611c
--- /dev/null
+++ b/chrome/app/generated_resources_grd/IDS_BOOKMARK_APP_BUBBLE_OPEN_AS_TAB.png.sha1

@@ -0,0 +1 @@
+3912ed7958bc7e808bd82624a08754f4e8761643
\ No newline at end of file

diff --git a/chrome/app/generated_resources_grd/IDS_BOOKMARK_APP_BUBBLE_OPEN_AS_TABBED_WINDOW.png.sha1 b/chrome/app/generated_resources_grd/IDS_BOOKMARK_APP_BUBBLE_OPEN_AS_TABBED_WINDOW.png.sha1
new file mode 100644
index 0000000..dc8611c
--- /dev/null
+++ b/chrome/app/generated_resources_grd/IDS_BOOKMARK_APP_BUBBLE_OPEN_AS_TABBED_WINDOW.png.sha1

@@ -0,0 +1 @@
+3912ed7958bc7e808bd82624a08754f4e8761643
\ No newline at end of file

diff --git a/chrome/app/os_settings_strings.grdp b/chrome/app/os_settings_strings.grdp
index 72e515af..cc647ea 100644
--- a/chrome/app/os_settings_strings.grdp
+++ b/chrome/app/os_settings_strings.grdp

@@ -795,6 +795,11 @@
   <message name="IDS_SETTINGS_ACCOUNT_MANAGER_CHILD_DESCRIPTION" desc="Description of the Account Manager Settings page for child users. Shown just below the title of the page.">
     Add a school account or manage child accounts here. <ph name="LINK_BEGIN">&lt;a&gt;</ph>Learn more<ph name="LINK_END">&lt;/a&gt;</ph>
   </message>
+  <message name="IDS_SETTINGS_ACCOUNT_MANAGER_CHILD_DESCRIPTION_2" desc="Description of the Account Manager Settings page for child users. Shown just below the title of the page.">
+    Manage your accounts here. <ph name="LINK_BEGIN">&lt;a&gt;</ph>Learn more<ph name="LINK_END">&lt;/a&gt;</ph>&lt;br&gt;&lt;br&gt;
+    Bookmarks, passwords, and other browser data are synced with the primary account.&lt;br&gt;&lt;br&gt;
+    Adding a school account enables easy sign-in to websites and extensions as a student while still operating under parental controls.
+  </message>
   <message name="IDS_SETTINGS_ACCOUNT_MANAGER_LIST_HEADER" desc="List header for Account List in Account Manager Settings page.">
     Accounts
   </message>
@@ -816,6 +821,9 @@
   <message name="IDS_SETTINGS_ACCOUNT_MANAGER_ADD_SCHOOL_ACCOUNT_LABEL" desc="Label of the button to add a school/EDU account in Account Manager.">
     Add school account
   </message>
+  <message name="IDS_SETTINGS_ACCOUNT_MANAGER_ADD_SCHOOL_ACCOUNT_LABEL_2" desc="Label of the button to add a school/EDU account in Account Manager.">
+    School Account
+  </message>
   <message name="IDS_SETTINGS_ACCOUNT_MANAGER_SECONDARY_ACCOUNTS_DISABLED_TEXT" desc="Text for 'secondary accounts disabled' message in Settings page.">
     Your administrator has disabled the addition of more Google Accounts
   </message>
@@ -846,6 +854,12 @@
   <message name="IDS_SETTINGS_ACCOUNT_MANAGER_MANAGEMENT_STATUS_MANAGED_ACCOUNT" desc="Management status label for managed accounts. This will be e.g. 'Managed by google.com' for Enterprise accounts and 'Managed by Family Link' for child accounts.">
     Managed by <ph name="DOMAIN">$1<ex>google.com</ex></ph>
   </message>
+  <message name="IDS_SETTINGS_ACCOUNT_MANAGER_MANAGEMENT_PRIMARY_ACCOUNT" desc="Indicates this account is the primary account, when the primary account is a child account.">
+    Primary Account
+  </message>
+  <message name="IDS_SETTINGS_ACCOUNT_MANAGER_MANAGEMENT_SCHOOL_ACCOUNT" desc="Indicates this account is the school account, when the primary account is a child account.">
+    School Account
+  </message>
   <message name="IDS_SETTINGS_ACCOUNT_MANAGER_MANAGEMENT_STATUS_UNMANAGED_ACCOUNT" desc="Management status label for unmanaged accounts.">
     Primary account
   </message>

diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
index fc037e7..4dcafc65 100644
--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn

@@ -900,8 +900,6 @@
     "net/dns_probe_service.h",
     "net/dns_probe_service_factory.cc",
     "net/dns_probe_service_factory.h",
-    "net/dns_util.cc",
-    "net/dns_util.h",
     "net/file_downloader.cc",
     "net/file_downloader.h",
     "net/net_error_diagnostics_dialog.h",
@@ -930,6 +928,8 @@
     "net/secure_dns_config.h",
     "net/secure_dns_policy_handler.cc",
     "net/secure_dns_policy_handler.h",
+    "net/secure_dns_util.cc",
+    "net/secure_dns_util.h",
     "net/service_providers_win.cc",
     "net/service_providers_win.h",
     "net/stub_resolver_config_reader.cc",

diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
index 02361b3..add5afdb 100644
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc

@@ -3035,6 +3035,10 @@
      flag_descriptions::kImeInputLogicHmmName,
      flag_descriptions::kImeInputLogicHmmDescription, kOsCrOS,
      FEATURE_VALUE_TYPE(chromeos::features::kImeInputLogicHmm)},
+    {"enable-cros-ime-input-logic-mozc",
+     flag_descriptions::kImeInputLogicMozcName,
+     flag_descriptions::kImeInputLogicMozcDescription, kOsCrOS,
+     FEATURE_VALUE_TYPE(chromeos::features::kImeInputLogicMozc)},
     {"enable-cros-ime-mozc-proto", flag_descriptions::kImeMozcProtoName,
      flag_descriptions::kImeMozcProtoDescription, kOsCrOS,
      FEATURE_VALUE_TYPE(chromeos::features::kImeMozcProto)},
@@ -3819,6 +3823,11 @@
 #endif  // defined(OS_MACOSX)
 
 #if defined(OS_WIN)
+    {"print-with-reduced-rasterization",
+     flag_descriptions::kPrintWithReducedRasterizationName,
+     flag_descriptions::kPrintWithReducedRasterizationDescription, kOsWin,
+     FEATURE_VALUE_TYPE(printing::features::kPrintWithReducedRasterization)},
+
     {"use-xps-for-printing", flag_descriptions::kUseXpsForPrintingName,
      flag_descriptions::kUseXpsForPrintingDescription, kOsWin,
      FEATURE_VALUE_TYPE(printing::features::kUseXpsForPrinting)},
@@ -3860,6 +3869,10 @@
                                     kStartSurfaceAndroidVariations,
                                     "ChromeStart")},
 
+    {"enable-instant-start", flag_descriptions::kInstantStartName,
+     flag_descriptions::kInstantStartDescription, kOsAndroid,
+     FEATURE_VALUE_TYPE(chrome::android::kInstantStart)},
+
     {"enable-close-tab-suggestions",
      flag_descriptions::kCloseTabSuggestionsName,
      flag_descriptions::kCloseTabSuggestionsDescription, kOsAndroid,

diff --git a/chrome/browser/apps/app_service/app_service_proxy.cc b/chrome/browser/apps/app_service/app_service_proxy.cc
index 5012459..1f3f501 100644
--- a/chrome/browser/apps/app_service/app_service_proxy.cc
+++ b/chrome/browser/apps/app_service/app_service_proxy.cc

@@ -699,7 +699,16 @@
 
 void AppServiceProxy::OnPauseDialogClosed(apps::mojom::AppType app_type,
                                           const std::string& app_id) {
-  if (pending_pause_requests_.IsPaused(app_id)) {
+  bool should_pause_app = pending_pause_requests_.IsPaused(app_id);
+  if (!should_pause_app) {
+    cache_.ForOneApp(
+        app_id, [&should_pause_app](const apps::AppUpdate& update) {
+          if (update.Paused() == apps::mojom::OptionalBool::kTrue) {
+            should_pause_app = true;
+          }
+        });
+  }
+  if (should_pause_app) {
     app_service_->PauseApp(app_type, app_id);
   }
 }

diff --git a/chrome/browser/apps/app_service/arc_apps.cc b/chrome/browser/apps/app_service/arc_apps.cc
index 48d79aa..a16dc9c4 100644
--- a/chrome/browser/apps/app_service/arc_apps.cc
+++ b/chrome/browser/apps/app_service/arc_apps.cc

@@ -610,23 +610,27 @@
 }
 
 void ArcApps::PauseApp(const std::string& app_id) {
-  paused_apps_.MaybeAddApp(app_id);
+  if (paused_apps_.MaybeAddApp(app_id)) {
+    SetIconEffect(app_id);
+  }
+
   constexpr bool kPaused = true;
   Publish(paused_apps_.GetAppWithPauseStatus(apps::mojom::AppType::kArc, app_id,
                                              kPaused),
           subscribers_);
 
-  SetIconEffect(app_id);
   CloseTasks(app_id);
 }
 
 void ArcApps::UnpauseApps(const std::string& app_id) {
-  paused_apps_.MaybeRemoveApp(app_id);
+  if (paused_apps_.MaybeRemoveApp(app_id)) {
+    SetIconEffect(app_id);
+  }
+
   constexpr bool kPaused = false;
   Publish(paused_apps_.GetAppWithPauseStatus(apps::mojom::AppType::kArc, app_id,
                                              kPaused),
           subscribers_);
-  SetIconEffect(app_id);
 }
 
 void ArcApps::GetMenuModel(const std::string& app_id,

diff --git a/chrome/browser/apps/app_service/extension_apps_chromeos.cc b/chrome/browser/apps/app_service/extension_apps_chromeos.cc
index 0512bcd..2e70dfc 100644
--- a/chrome/browser/apps/app_service/extension_apps_chromeos.cc
+++ b/chrome/browser/apps/app_service/extension_apps_chromeos.cc

@@ -278,13 +278,14 @@
 }
 
 void ExtensionAppsChromeOs::PauseApp(const std::string& app_id) {
-  paused_apps_.MaybeAddApp(app_id);
+  if (paused_apps_.MaybeAddApp(app_id)) {
+    SetIconEffect(app_id);
+  }
+
   constexpr bool kPaused = true;
   Publish(paused_apps_.GetAppWithPauseStatus(app_type(), app_id, kPaused),
           subscribers());
 
-  SetIconEffect(app_id);
-
   if (instance_registry_->GetWindows(app_id).empty()) {
     return;
   }
@@ -316,13 +317,14 @@
 }
 
 void ExtensionAppsChromeOs::UnpauseApps(const std::string& app_id) {
-  paused_apps_.MaybeRemoveApp(app_id);
+  if (paused_apps_.MaybeRemoveApp(app_id)) {
+    SetIconEffect(app_id);
+  }
+
   constexpr bool kPaused = false;
   Publish(paused_apps_.GetAppWithPauseStatus(app_type(), app_id, kPaused),
           subscribers());
 
-  SetIconEffect(app_id);
-
   for (auto* browser : *BrowserList::GetInstance()) {
     if (!browser->is_type_app()) {
       continue;

diff --git a/chrome/browser/apps/app_service/web_apps_chromeos.cc b/chrome/browser/apps/app_service/web_apps_chromeos.cc
index 2511901..f0fa92e 100644
--- a/chrome/browser/apps/app_service/web_apps_chromeos.cc
+++ b/chrome/browser/apps/app_service/web_apps_chromeos.cc

@@ -158,13 +158,15 @@
 }
 
 void WebAppsChromeOs::PauseApp(const std::string& app_id) {
-  paused_apps_.MaybeAddApp(app_id);
+  if (paused_apps_.MaybeAddApp(app_id)) {
+    SetIconEffect(app_id);
+  }
+
   constexpr bool kPaused = true;
   Publish(paused_apps_.GetAppWithPauseStatus(apps::mojom::AppType::kWeb, app_id,
                                              kPaused),
           subscribers());
 
-  SetIconEffect(app_id);
   for (auto* browser : *BrowserList::GetInstance()) {
     if (!browser->is_type_app()) {
       continue;
@@ -176,13 +178,14 @@
 }
 
 void WebAppsChromeOs::UnpauseApps(const std::string& app_id) {
-  paused_apps_.MaybeRemoveApp(app_id);
+  if (paused_apps_.MaybeRemoveApp(app_id)) {
+    SetIconEffect(app_id);
+  }
+
   constexpr bool kPaused = false;
   Publish(paused_apps_.GetAppWithPauseStatus(apps::mojom::AppType::kWeb, app_id,
                                              kPaused),
           subscribers());
-
-  SetIconEffect(app_id);
 }
 
 void WebAppsChromeOs::GetMenuModel(const std::string& app_id,

diff --git a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate_unittest.cc b/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate_unittest.cc
index 3a9c9709..a7e3bc4d 100644
--- a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate_unittest.cc
+++ b/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate_unittest.cc

@@ -93,10 +93,12 @@
 #include "components/prefs/testing_pref_service.h"
 #include "components/safe_browsing/core/verdict_cache_manager.h"
 #include "components/security_interstitials/content/stateful_ssl_host_state_delegate.h"
+#include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browsing_data_filter_builder.h"
 #include "content/public/browser/browsing_data_remover.h"
 #include "content/public/browser/network_service_instance.h"
+#include "content/public/browser/storage_partition.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/browsing_data_remover_test_util.h"
 #include "content/public/test/mock_download_manager.h"
@@ -1122,12 +1124,13 @@
     content::GetNetworkService();
     task_environment_.RunUntilIdle();
 
-    auto network_context = std::make_unique<network::NetworkContext>(
+    mojo::PendingRemote<network::mojom::NetworkContext> network_context_remote;
+    network_context_ = std::make_unique<network::NetworkContext>(
         network::NetworkService::GetNetworkServiceForTesting(),
-        network_context_remote_.BindNewPipeAndPassReceiver(),
+        network_context_remote.InitWithNewPipeAndPassReceiver(),
         network::mojom::NetworkContextParams::New());
-    network_context_ = network_context.get();
-    profile_->SetNetworkContext(std::move(network_context));
+    content::BrowserContext::GetDefaultStoragePartition(profile_.get())
+        ->SetNetworkContextForTesting(std::move(network_context_remote));
 
     ProtocolHandlerRegistryFactory::GetInstance()->SetTestingFactory(
         profile_.get(), base::BindRepeating(&BuildProtocolHandlerRegistry));
@@ -1207,7 +1210,7 @@
     return remover_->GetLastUsedOriginTypeMaskForTesting();
   }
 
-  network::NetworkContext* network_context() { return network_context_; }
+  network::NetworkContext* network_context() { return network_context_.get(); }
 
   TestingProfile* GetProfile() {
     return profile_.get();
@@ -1225,8 +1228,7 @@
   content::BrowsingDataRemover* remover_;
 
   content::BrowserTaskEnvironment task_environment_;
-  mojo::Remote<network::mojom::NetworkContext> network_context_remote_;
-  network::NetworkContext* network_context_;
+  std::unique_ptr<network::NetworkContext> network_context_;
   std::unique_ptr<TestingProfile> profile_;
 
   DISALLOW_COPY_AND_ASSIGN(ChromeBrowsingDataRemoverDelegateTest);

diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
index cf61a5f7..dd86e2e 100644
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc

@@ -369,6 +369,7 @@
 #include "chrome/browser/apps/intent_helper/mac_apps_navigation_throttle.h"
 #include "chrome/browser/chrome_browser_main_mac.h"
 #elif defined(OS_CHROMEOS)
+#include "ash/public/cpp/ash_pref_names.h"
 #include "ash/public/cpp/tablet_mode.h"
 #include "chrome/app/chrome_crash_reporter_client.h"
 #include "chrome/browser/browser_process.h"
@@ -3171,6 +3172,11 @@
   web_prefs->force_dark_mode_enabled =
       prefs->GetBoolean(prefs::kWebKitForceDarkModeEnabled);
 
+#if defined(OS_CHROMEOS)
+  web_prefs->always_show_focus =
+      prefs->GetBoolean(ash::prefs::kAccessibilityFocusHighlightEnabled);
+#endif
+
 #if defined(OS_ANDROID)
   web_prefs->password_echo_enabled =
       prefs->GetBoolean(prefs::kWebKitPasswordEchoEnabled);
@@ -4760,13 +4766,16 @@
       network_service);
 }
 
-mojo::Remote<network::mojom::NetworkContext>
-ChromeContentBrowserClient::CreateNetworkContext(
+void ChromeContentBrowserClient::ConfigureNetworkContextParams(
     content::BrowserContext* context,
     bool in_memory,
-    const base::FilePath& relative_partition_path) {
+    const base::FilePath& relative_partition_path,
+    network::mojom::NetworkContextParams* network_context_params,
+    network::mojom::CertVerifierCreationParams* cert_verifier_creation_params) {
   Profile* profile = Profile::FromBrowserContext(context);
-  return profile->CreateNetworkContext(in_memory, relative_partition_path);
+  profile->ConfigureNetworkContextParams(in_memory, relative_partition_path,
+                                         network_context_params,
+                                         cert_verifier_creation_params);
 }
 
 std::vector<base::FilePath>

diff --git a/chrome/browser/chrome_content_browser_client.h b/chrome/browser/chrome_content_browser_client.h
index 7d7f49f..cd96f6bf 100644
--- a/chrome/browser/chrome_content_browser_client.h
+++ b/chrome/browser/chrome_content_browser_client.h

@@ -504,10 +504,13 @@
       override;
   void OnNetworkServiceCreated(
       network::mojom::NetworkService* network_service) override;
-  mojo::Remote<network::mojom::NetworkContext> CreateNetworkContext(
+  void ConfigureNetworkContextParams(
       content::BrowserContext* context,
       bool in_memory,
-      const base::FilePath& relative_partition_path) override;
+      const base::FilePath& relative_partition_path,
+      network::mojom::NetworkContextParams* network_context_params,
+      network::mojom::CertVerifierCreationParams* cert_verifier_creation_params)
+      override;
   std::vector<base::FilePath> GetNetworkContextsParentDirectory() override;
   bool AllowRenderingMhtmlOverHttp(
       content::NavigationUIData* navigation_ui_data) override;

diff --git a/chrome/browser/chromeos/BUILD.gn b/chrome/browser/chromeos/BUILD.gn
index e97ecdd..8ef4aea 100644
--- a/chrome/browser/chromeos/BUILD.gn
+++ b/chrome/browser/chromeos/BUILD.gn

@@ -3153,6 +3153,7 @@
     "policy/status_collector/app_info_generator_unittest.cc",
     "policy/status_collector/interval_map_unittest.cc",
     "policy/status_uploader_unittest.cc",
+    "policy/system_features_disable_list_policy_handler_unittest.cc",
     "policy/system_log_uploader_unittest.cc",
     "policy/system_proxy_manager_unittest.cc",
     "policy/tpm_auto_update_mode_policy_handler_unittest.cc",

diff --git a/chrome/browser/chromeos/arc/tracing/arc_system_stat_collector.cc b/chrome/browser/chromeos/arc/tracing/arc_system_stat_collector.cc
index f4ca4c6..d15880d 100644
--- a/chrome/browser/chromeos/arc/tracing/arc_system_stat_collector.cc
+++ b/chrome/browser/chromeos/arc/tracing/arc_system_stat_collector.cc

@@ -50,8 +50,11 @@
     FILE_PATH_LITERAL("/sys/class/powercap");
 const base::FilePath::CharType kIntelRaplQuery[] = FILE_PATH_LITERAL("intel-rapl:*");
 const base::FilePath::CharType kEnergyPath[] = FILE_PATH_LITERAL("energy_uj");
+const base::FilePath::CharType kLongTermConstraintPath[] =
+    FILE_PATH_LITERAL("constraint_0_power_limit_uw");
 const base::FilePath::CharType kNamePath[] = FILE_PATH_LITERAL("name");
 
+constexpr char kPackagePowerDomainName[] = "package-0";
 constexpr char kCpuPowerDomainName[] = "core";
 constexpr char kGpuPowerDomainName[] = "uncore";
 constexpr char kMemoryPowerDomainName[] = "dram";
@@ -130,6 +133,7 @@
   kCpuEnergy,
   kGpuEnergy,
   kMemoryEnergy,
+  kPackagePowerConstraint,
   kTotal
 };
 
@@ -150,6 +154,8 @@
   int cpu_power = 0;
   int gpu_power = 0;
   int memory_power = 0;
+  // Constraint in milli-watts.
+  int package_power_constraint = 0;
 };
 
 struct OneValueReaderInfo {
@@ -185,13 +191,20 @@
       }
 
       SystemReader reader;
+      base::FilePath component;
       base::TrimWhitespaceASCII(domain_name, base::TRIM_ALL, &domain_name);
-      if (domain_name == kCpuPowerDomainName) {
+      if (domain_name == kPackagePowerDomainName) {
+        reader = kPackagePowerConstraint;
+        component = base::FilePath(kLongTermConstraintPath);
+      } else if (domain_name == kCpuPowerDomainName) {
         reader = kCpuEnergy;
+        component = base::FilePath(kEnergyPath);
       } else if (domain_name == kGpuPowerDomainName) {
         reader = kGpuEnergy;
+        component = base::FilePath(kEnergyPath);
       } else if (domain_name == kMemoryPowerDomainName) {
         reader = kMemoryEnergy;
+        component = base::FilePath(kEnergyPath);
       } else {
         LOG(WARNING) << "Ignore power counter " << domain_name << " in "
                      << domain_file_path.value();
@@ -204,12 +217,12 @@
         continue;
       }
 
-      const base::FilePath energy_file_path = dir.Append(kEnergyPath);
+      const base::FilePath counter_file_path = dir.Append(component);
       context->system_readers[reader].reset(
-          open(energy_file_path.value().c_str(), O_RDONLY));
+          open(counter_file_path.value().c_str(), O_RDONLY));
       if (!context->system_readers[reader].is_valid()) {
         LOG(ERROR) << "Failed to open power counter: " << domain_name << " as "
-                   << energy_file_path.value();
+                   << counter_file_path.value();
       }
     }
   }
@@ -335,6 +348,9 @@
                                        ArcValueEvent::Type::kCpuTemperature);
   ArcValueEventTrimmer cpu_frequency(&system_model->memory_events(),
                                      ArcValueEvent::Type::kCpuFrequency);
+  ArcValueEventTrimmer package_power_constraint(
+      &system_model->memory_events(),
+      ArcValueEvent::Type::kPackagePowerConstraint);
   ArcValueEventTrimmer cpu_power(&system_model->memory_events(),
                                  ArcValueEvent::Type::kCpuPower);
   ArcValueEventTrimmer gpu_power(&system_model->memory_events(),
@@ -362,12 +378,15 @@
       cpu_temperature.MaybeAdd(timestamp, sample.cpu_temperature);
     if (sample.cpu_frequency > 0)
       cpu_frequency.MaybeAdd(timestamp, sample.cpu_frequency);
+    package_power_constraint.MaybeAdd(timestamp,
+                                      sample.package_power_constraint);
     cpu_power.MaybeAdd(timestamp, sample.cpu_power);
     gpu_power.MaybeAdd(timestamp, sample.gpu_power);
     memory_power.MaybeAdd(timestamp, sample.memory_power);
   }
 
   // These are optional. Keep it if non-zero value is detected.
+  package_power_constraint.ResetIfConstant(0);
   cpu_power.ResetIfConstant(0);
   gpu_power.ResetIfConstant(0);
   memory_power.ResetIfConstant(0);
@@ -461,6 +480,8 @@
       {SystemReader::kCpuTemperature, &context->current_frame.cpu_temperature,
        std::numeric_limits<int>::min()},
       {SystemReader::kCpuFrequency, &context->current_frame.cpu_frequency, 0},
+      {SystemReader::kPackagePowerConstraint,
+       &context->current_frame.package_power_constraint, 0},
       {SystemReader::kCpuEnergy, &context->current_frame.cpu_energy, 0},
       {SystemReader::kGpuEnergy, &context->current_frame.gpu_energy, 0},
       {SystemReader::kMemoryEnergy, &context->current_frame.memory_energy, 0},
@@ -527,6 +548,10 @@
   }
   current_sample.cpu_temperature = context->current_frame.cpu_temperature;
   current_sample.cpu_frequency = context->current_frame.cpu_frequency;
+  current_sample.package_power_constraint =
+      static_cast<int>(context->current_frame.package_power_constraint *
+                       0.001 /* micro-watts to milli-watts */);
+  DCHECK_GE(current_sample.package_power_constraint, 0);
   DCHECK_GE(current_sample.swap_sectors_read, 0);
   DCHECK_GE(current_sample.swap_sectors_write, 0);
   DCHECK_GE(current_sample.swap_waiting_time_ms, 0);
@@ -538,6 +563,8 @@
   context_ = std::move(context);
 }
 
+ArcSystemStatCollector::RuntimeFrame::RuntimeFrame() = default;
+
 bool ParseStatFile(int fd, const int* columns, int64_t* output) {
   char buffer[128];
   if (lseek(fd, 0, SEEK_SET))

diff --git a/chrome/browser/chromeos/arc/tracing/arc_system_stat_collector.h b/chrome/browser/chromeos/arc/tracing/arc_system_stat_collector.h
index 0e241092..08254739 100644
--- a/chrome/browser/chromeos/arc/tracing/arc_system_stat_collector.h
+++ b/chrome/browser/chromeos/arc/tracing/arc_system_stat_collector.h

@@ -88,6 +88,8 @@
   struct SystemReadersContext;
 
   struct RuntimeFrame {
+    RuntimeFrame();
+
     base::TimeTicks timestamp;
     // read, written sectors and total time in milliseconds.
     int64_t zram_stat[base::size(kZramStatColumns) - 1] = {0};
@@ -105,6 +107,8 @@
     int64_t gpu_energy = 0;
     // Memory energy in micro-joules for some Intel platforms.
     int64_t memory_energy = 0;
+    // Power constraint for CPU package.
+    int64_t package_power_constraint = 0;
   };
 
   // Schedules reading System stat files in |ReadSystemStatOnBackgroundThread|

diff --git a/chrome/browser/chromeos/arc/tracing/arc_value_event.cc b/chrome/browser/chromeos/arc/tracing/arc_value_event.cc
index a7b4a7d..b29fb11 100644
--- a/chrome/browser/chromeos/arc/tracing/arc_value_event.cc
+++ b/chrome/browser/chromeos/arc/tracing/arc_value_event.cc

@@ -52,6 +52,7 @@
       case ArcValueEvent::Type::kCpuPower:
       case ArcValueEvent::Type::kGpuPower:
       case ArcValueEvent::Type::kMemoryPower:
+      case ArcValueEvent::Type::kPackagePowerConstraint:
         break;
       default:
         return false;

diff --git a/chrome/browser/chromeos/arc/tracing/arc_value_event.h b/chrome/browser/chromeos/arc/tracing/arc_value_event.h
index f1c0696..9120f44c 100644
--- a/chrome/browser/chromeos/arc/tracing/arc_value_event.h
+++ b/chrome/browser/chromeos/arc/tracing/arc_value_event.h

@@ -28,6 +28,7 @@
     kCpuPower,
     kGpuPower,
     kMemoryPower,
+    kPackagePowerConstraint,
   };
 
   ArcValueEvent(int64_t timestamp, Type type, int value);
@@ -50,6 +51,7 @@
    * kCpuPower - milli-watts
    * kGpuPower - milli-watts
    * kMemporyPower - milli-watts
+   * kPackagePowerConstraint - milli-watts
    */
   int value;
 };

diff --git a/chrome/browser/chromeos/child_accounts/secondary_account_consent_logger.cc b/chrome/browser/chromeos/child_accounts/secondary_account_consent_logger.cc
index 38d024a1..943e2298 100644
--- a/chrome/browser/chromeos/child_accounts/secondary_account_consent_logger.cc
+++ b/chrome/browser/chromeos/child_accounts/secondary_account_consent_logger.cc

@@ -40,7 +40,7 @@
 // Version of the parental consent text. Must be updated when consent text is
 // changed. Format of the text version is "v<GERRIT_CL_NUMBER>" with number of
 // the last CL where strings with information for parents were changed.
-constexpr char kConsentScreenTextVersion[] = "v2153049";
+constexpr char kConsentScreenTextVersion[] = "v2199861";
 // The text version which requires invalidation of the secondary accounts added
 // before consent text changes. Format of the invalidation version is
 // "iv<GERRIT_CL_NUMBER>".

diff --git a/chrome/browser/chromeos/child_accounts/secondary_account_consent_logger_unittest.cc b/chrome/browser/chromeos/child_accounts/secondary_account_consent_logger_unittest.cc
index 94ff7d0f..e80abc5 100644
--- a/chrome/browser/chromeos/child_accounts/secondary_account_consent_logger_unittest.cc
+++ b/chrome/browser/chromeos/child_accounts/secondary_account_consent_logger_unittest.cc

@@ -42,7 +42,7 @@
    },
    "person_id": "me"
 })";
-constexpr char kConsentScreenTextVersion[] = "v2153049";
+constexpr char kConsentScreenTextVersion[] = "v2199861";
 
 std::string GetTestRequestBody(
     const std::string& chrome_os_unicorn_edu_coexistence_id,

diff --git a/chrome/browser/chromeos/crostini/crostini_terminal.cc b/chrome/browser/chromeos/crostini/crostini_terminal.cc
index 13104dd..6eb31ac 100644
--- a/chrome/browser/chromeos/crostini/crostini_terminal.cc
+++ b/chrome/browser/chromeos/crostini/crostini_terminal.cc

@@ -125,13 +125,22 @@
   ShowContainerTerminal(profile, launch_params, vsh_in_crosh_url, browser);
 }
 
-void LaunchTerminalSettings(Profile* profile) {
+Browser* LaunchTerminal(Profile* profile,
+                        const std::string& vm_name,
+                        const std::string& container_name) {
+  GURL vsh_in_crosh_url = GenerateVshInCroshUrl(
+      profile, vm_name, container_name, std::vector<std::string>());
+  return web_app::LaunchSystemWebApp(profile, web_app::SystemAppType::TERMINAL,
+                                     vsh_in_crosh_url);
+}
+
+Browser* LaunchTerminalSettings(Profile* profile) {
   DCHECK(base::FeatureList::IsEnabled(features::kTerminalSystemApp));
   auto params = web_app::CreateSystemWebAppLaunchParams(
       profile, web_app::SystemAppType::TERMINAL);
   if (!params.has_value()) {
     LOG(WARNING) << "Empty launch params for terminal";
-    return;
+    return nullptr;
   }
   std::string path = "html/terminal_settings.html";
   if (base::FeatureList::IsEnabled(
@@ -140,7 +149,7 @@
   }
   // Use an app pop window to host the settings page.
   params->disposition = WindowOpenDisposition::NEW_POPUP;
-  web_app::LaunchSystemWebApp(
+  return web_app::LaunchSystemWebApp(
       profile, web_app::SystemAppType::TERMINAL,
       GURL(base::StrCat({chrome::kChromeUIUntrustedTerminalURL, path})),
       *params);

diff --git a/chrome/browser/chromeos/crostini/crostini_terminal.h b/chrome/browser/chromeos/crostini/crostini_terminal.h
index c1ff3b6..adcfa64 100644
--- a/chrome/browser/chromeos/crostini/crostini_terminal.h
+++ b/chrome/browser/chromeos/crostini/crostini_terminal.h

@@ -9,6 +9,7 @@
 
 #include "base/optional.h"
 #include "chrome/browser/apps/app_service/app_launch_params.h"
+#include "chrome/browser/chromeos/crostini/crostini_util.h"
 #include "ui/gfx/geometry/point.h"
 
 class GURL;
@@ -126,8 +127,14 @@
                              const std::string& container_name,
                              const std::vector<std::string>& terminal_args);
 
+// Launches the terminal tabbed app.
+Browser* LaunchTerminal(
+    Profile* profile,
+    const std::string& vm_name = kCrostiniDefaultVmName,
+    const std::string& container_name = kCrostiniDefaultContainerName);
+
 // Launches the terminal settings popup window.
-void LaunchTerminalSettings(Profile* profile);
+Browser* LaunchTerminalSettings(Profile* profile);
 
 // Record which terminal settings have been changed by users.
 void RecordTerminalSettingsChangesUMAs(Profile* profile);

diff --git a/chrome/browser/chromeos/crostini/crostini_util.cc b/chrome/browser/chromeos/crostini/crostini_util.cc
index 0180f0c2..94e57ae 100644
--- a/chrome/browser/chromeos/crostini/crostini_util.cc
+++ b/chrome/browser/chromeos/crostini/crostini_util.cc

@@ -39,9 +39,7 @@
 #include "chrome/browser/ui/ash/launcher/shelf_spinner_item_controller.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_window.h"
-#include "chrome/browser/ui/web_applications/system_web_app_ui_utils.h"
 #include "chrome/browser/ui/webui/chromeos/crostini_upgrader/crostini_upgrader_dialog.h"
-#include "chrome/browser/web_applications/system_web_app_manager.h"
 #include "chrome/common/chrome_features.h"
 #include "chrome/grit/generated_resources.h"
 #include "chromeos/constants/chromeos_features.h"
@@ -146,11 +144,11 @@
       base::BindOnce(OnApplicationLaunched, std::move(callback), app_id));
 }
 
-void LaunchTerminal(Profile* profile,
-                    apps::AppLaunchParams launch_params,
-                    GURL vsh_in_crosh_url,
-                    Browser* browser,
-                    crostini::LaunchCrostiniAppCallback callback) {
+void LaunchTerminalApp(Profile* profile,
+                       apps::AppLaunchParams launch_params,
+                       GURL vsh_in_crosh_url,
+                       Browser* browser,
+                       crostini::LaunchCrostiniAppCallback callback) {
   crostini::ShowContainerTerminal(profile, launch_params, vsh_in_crosh_url,
                                   browser);
   RecordAppLaunchResultHistogram(crostini::CrostiniResult::SUCCESS);
@@ -409,12 +407,8 @@
     DCHECK(files.empty());
     RecordAppLaunchHistogram(CrostiniAppLaunchAppType::kTerminal);
 
-    GURL vsh_in_crosh_url = GenerateVshInCroshUrl(
-        profile, vm_name, container_name, std::vector<std::string>());
-
     if (base::FeatureList::IsEnabled(features::kTerminalSystemApp)) {
-      auto* browser = web_app::LaunchSystemWebApp(
-          profile, web_app::SystemAppType::TERMINAL, vsh_in_crosh_url);
+      auto* browser = LaunchTerminal(profile, vm_name, container_name);
       if (browser == nullptr) {
         RecordAppLaunchResultHistogram(crostini::CrostiniResult::UNKNOWN_ERROR);
       } else {
@@ -423,6 +417,8 @@
       return;
     }
 
+    GURL vsh_in_crosh_url = GenerateVshInCroshUrl(
+        profile, vm_name, container_name, std::vector<std::string>());
     apps::AppLaunchParams launch_params = GenerateTerminalAppLaunchParams();
     // Create the terminal here so it's created in the right display. If the
     // browser creation is delayed into the callback the root window for new
@@ -430,7 +426,7 @@
     Browser* browser =
         CreateContainerTerminal(profile, launch_params, vsh_in_crosh_url);
     launch_closure =
-        base::BindOnce(&LaunchTerminal, profile, launch_params,
+        base::BindOnce(&LaunchTerminalApp, profile, launch_params,
                        vsh_in_crosh_url, browser, std::move(callback));
   } else {
     RecordAppLaunchHistogram(CrostiniAppLaunchAppType::kRegisteredApp);

diff --git a/chrome/browser/chromeos/file_manager/file_manager_browsertest_base.cc b/chrome/browser/chromeos/file_manager/file_manager_browsertest_base.cc
index 9e89a1b..31cf197 100644
--- a/chrome/browser/chromeos/file_manager/file_manager_browsertest_base.cc
+++ b/chrome/browser/chromeos/file_manager/file_manager_browsertest_base.cc

@@ -78,6 +78,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/storage_partition.h"
+#include "content/public/common/content_switches.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/network_connection_change_simulator.h"
 #include "content/public/test/test_navigation_observer.h"
@@ -1469,6 +1470,13 @@
     command_line->AppendSwitchASCII(chromeos::switches::kShillStub, "clear=1");
   }
 
+  // TODO(crbug.com/937746): See crbug.com/1081581 for context, but
+  // the FilesApp does not work when custom elements v0 are enabled.
+  // Make sure they are disabled here. Remove this once WCv0 features
+  // are removed completely.
+  command_line->AppendSwitchASCII(switches::kDisableBlinkFeatures,
+                                  "ShadowDOMV0,CustomElementsV0,HTMLImports");
+
   std::vector<base::Feature> enabled_features;
   std::vector<base::Feature> disabled_features;
 

diff --git a/chrome/browser/chromeos/local_search_service/index.cc b/chrome/browser/chromeos/local_search_service/index.cc
index 1cab6f6..e05c0b9 100644
--- a/chrome/browser/chromeos/local_search_service/index.cc
+++ b/chrome/browser/chromeos/local_search_service/index.cc

@@ -7,6 +7,7 @@
 #include <utility>
 
 #include "base/optional.h"
+#include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "chrome/common/string_matching/fuzzy_tokenized_string_match.h"
 #include "chrome/common/string_matching/tokenized_string.h"
@@ -17,19 +18,42 @@
 
 using Hits = std::vector<local_search_service::Range>;
 
+// |individual_tokenized| can be nullptr if there is no need to split
+// the input search tags by space.
 void TokenizeSearchTags(
     const std::vector<base::string16>& search_tags,
-    std::vector<std::unique_ptr<TokenizedString>>* tokenized) {
+    std::vector<std::unique_ptr<TokenizedString>>* tokenized,
+    std::vector<std::unique_ptr<TokenizedString>>* individual_tokenized) {
   DCHECK(tokenized);
+
+  bool has_multiple_words = false;
+  std::set<base::string16> unique_tags;
   for (const auto& tag : search_tags) {
     tokenized->push_back(std::make_unique<TokenizedString>(tag));
+    if (individual_tokenized) {
+      const std::vector<base::string16> words =
+          base::SplitString(tag, base::kWhitespaceASCIIAs16,
+                            base::WhitespaceHandling::TRIM_WHITESPACE,
+                            base::SplitResult::SPLIT_WANT_NONEMPTY);
+      std::copy(words.begin(), words.end(),
+                std::inserter(unique_tags, unique_tags.end()));
+      if (words.size() > 1) {
+        has_multiple_words = true;
+      }
+    }
+  }
+
+  if (!has_multiple_words)
+    return;
+
+  DCHECK(individual_tokenized);
+  for (const auto& tag : unique_tags) {
+    individual_tokenized->push_back(std::make_unique<TokenizedString>(tag));
   }
 }
 
 // Returns whether a given item with |search_tags| is relevant to |query| using
 // fuzzy string matching.
-// TODO(1018613): add weight decay to relevance scores for search tags. Tags
-// at the front should have higher scores.
 bool IsItemRelevant(
     const TokenizedString& query,
     const std::vector<std::unique_ptr<TokenizedString>>& search_tags,
@@ -96,8 +120,12 @@
     DCHECK(!id.empty());
 
     // If a key already exists, it will overwrite earlier data.
-    data_[id] = std::vector<std::unique_ptr<TokenizedString>>();
-    TokenizeSearchTags(item.search_tags, &data_[id]);
+    data_[id] = {std::vector<std::unique_ptr<TokenizedString>>(),
+                 std::vector<std::unique_ptr<TokenizedString>>()};
+    auto& tokenized = data_[id];
+    TokenizeSearchTags(
+        item.search_tags, &tokenized.first,
+        search_params_.split_search_tags ? &tokenized.second : nullptr);
   }
 }
 
@@ -138,39 +166,74 @@
   search_params_ = search_params;
 }
 
-void Index::GetSearchParamsForTesting(double* relevance_threshold,
-                                      double* partial_match_penalty_rate,
-                                      bool* use_prefix_only,
-                                      bool* use_weighted_ratio,
-                                      bool* use_edit_distance) {
-  DCHECK(relevance_threshold);
-  DCHECK(partial_match_penalty_rate);
-  DCHECK(use_prefix_only);
-  DCHECK(use_weighted_ratio);
-  DCHECK(use_edit_distance);
+void Index::GetSearchTagsForTesting(
+    const std::string& id,
+    std::vector<base::string16>* search_tags,
+    std::vector<base::string16>* individual_search_tags) {
+  DCHECK(search_tags);
+  DCHECK(individual_search_tags);
 
-  *relevance_threshold = search_params_.relevance_threshold;
-  *partial_match_penalty_rate = search_params_.partial_match_penalty_rate;
-  *use_prefix_only = search_params_.use_prefix_only;
-  *use_weighted_ratio = search_params_.use_weighted_ratio;
-  *use_edit_distance = search_params_.use_edit_distance;
+  search_tags->clear();
+  individual_search_tags->clear();
+
+  const auto& it = data_.find(id);
+  if (it != data_.end()) {
+    for (const auto& tag : it->second.first) {
+      search_tags->push_back(tag->text());
+    }
+    for (const auto& tag : it->second.second) {
+      individual_search_tags->push_back(tag->text());
+    }
+  }
 }
 
+SearchParams Index::GetSearchParamsForTesting() {
+  return search_params_;
+}
+
+// For each data item, each of its search tag could be a single word
+// or multiple words. When we match a query with a search tag, we could match
+// the query with the full search tag, or with individual words in the search
+// tag.
+// 1. If the query itself is a single word, then we consider it a match if the
+// query matches with a word of the search tag. In this case, we use simple
+// fuzzy ratio and prefix matching (instead of weighted ratio) for better
+// accuracy and speeds. However, if the search tag is not split into words, then
+// we would need weighted ratio to discover the match. The accuracy may be
+// lower.
+// 2. If the query contains multiple words, then we will have to match it with
+// the full search tag because we do not split the query words.
+// TODO(jiameng): this is complex and multi-word query and search tags should
+// really be handled by TF-IDF based matching. We will soon move to TF-IDF
+// method.
 std::vector<local_search_service::Result> Index::GetSearchResults(
     const base::string16& query,
     uint32_t max_results) const {
+  const std::vector<base::string16> query_words =
+      base::SplitString(query, base::kWhitespaceASCIIAs16,
+                        base::WhitespaceHandling::TRIM_WHITESPACE,
+                        base::SplitResult::SPLIT_WANT_NONEMPTY);
+  const bool query_has_multiple_words = query_words.size() > 1;
+  const bool use_weighted_ratio =
+      query_has_multiple_words || !search_params_.split_search_tags;
+
   std::vector<local_search_service::Result> results;
   const TokenizedString tokenized_query(query);
 
   for (const auto& item : data_) {
     double relevance_score = 0.0;
     Hits hits;
-    if (IsItemRelevant(
-            tokenized_query, item.second, search_params_.relevance_threshold,
-            search_params_.use_prefix_only, search_params_.use_weighted_ratio,
-            search_params_.use_edit_distance,
-            search_params_.partial_match_penalty_rate, &relevance_score,
-            &hits)) {
+    // Use the full search tags if we use weighted ratio or if this data item
+    // has not split search tags.
+    const auto& used_search_tags =
+        (use_weighted_ratio || item.second.second.empty()) ? item.second.first
+                                                           : item.second.second;
+    if (IsItemRelevant(tokenized_query, used_search_tags,
+                       search_params_.relevance_threshold,
+                       search_params_.use_prefix_only, use_weighted_ratio,
+                       search_params_.use_edit_distance,
+                       search_params_.partial_match_penalty_rate,
+                       &relevance_score, &hits)) {
       local_search_service::Result result;
       result.id = item.first;
       result.score = relevance_score;

diff --git a/chrome/browser/chromeos/local_search_service/index.h b/chrome/browser/chromeos/local_search_service/index.h
index 69f6cde..1cb8e5d 100644
--- a/chrome/browser/chromeos/local_search_service/index.h
+++ b/chrome/browser/chromeos/local_search_service/index.h

@@ -36,11 +36,11 @@
 };
 
 struct SearchParams {
-  double relevance_threshold = 0.3;
+  double relevance_threshold = 0.32;
   double partial_match_penalty_rate = 0.9;
   bool use_prefix_only = false;
-  bool use_weighted_ratio = true;
   bool use_edit_distance = false;
+  bool split_search_tags = true;
 };
 
 // A numeric range used to represent the start and end position.
@@ -109,11 +109,12 @@
 
   void SetSearchParams(const local_search_service::SearchParams& search_params);
 
-  void GetSearchParamsForTesting(double* relevance_threshold,
-                                 double* partial_match_penalty_rate,
-                                 bool* use_prefix_only,
-                                 bool* use_weighted_ratio,
-                                 bool* use_edit_distance);
+  void GetSearchTagsForTesting(
+      const std::string& id,
+      std::vector<base::string16>* search_tags,
+      std::vector<base::string16>* individual_search_tags);
+
+  SearchParams GetSearchParamsForTesting();
 
  private:
   // Returns all search results for a given query.
@@ -122,7 +123,15 @@
       uint32_t max_results) const;
 
   // A map from key to tokenized search-tags.
-  std::map<std::string, std::vector<std::unique_ptr<TokenizedString>>> data_;
+  // The 1st component corresponds to the tokens of original input search tags.
+  // The 2nd component is only filled if |search_params_.split_search_tags| is
+  // true. For a data item, if all its search tags contain single words
+  // the corresponding 2nd component will be empty, as it'll be the same
+  // as the original input.
+  std::map<std::string,
+           std::pair<std::vector<std::unique_ptr<TokenizedString>>,
+                     std::vector<std::unique_ptr<TokenizedString>>>>
+      data_;
 
   // Search parameters.
   local_search_service::SearchParams search_params_;

diff --git a/chrome/browser/chromeos/local_search_service/index_unittest.cc b/chrome/browser/chromeos/local_search_service/index_unittest.cc
index 067f84b..89833f7 100644
--- a/chrome/browser/chromeos/local_search_service/index_unittest.cc
+++ b/chrome/browser/chromeos/local_search_service/index_unittest.cc

@@ -9,6 +9,7 @@
 #include <utility>
 #include <vector>
 
+#include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/chromeos/local_search_service/index.h"
 #include "chrome/browser/chromeos/local_search_service/test_utils.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -16,12 +17,16 @@
 namespace local_search_service {
 
 namespace {
-// Search parameters with default values.
-constexpr double kDefaultRelevanceThreshold = 0.3;
-constexpr double kDefaultPartialMatchPenaltyRate = 0.9;
-constexpr bool kDefaultUsePrefixOnly = false;
-constexpr bool kDefaultUseWeightedRatio = true;
-constexpr bool kDefaultUseEditDistance = false;
+
+void CheckSearchParams(const SearchParams& actual,
+                       const SearchParams& expected) {
+  EXPECT_DOUBLE_EQ(actual.relevance_threshold, expected.relevance_threshold);
+  EXPECT_DOUBLE_EQ(actual.partial_match_penalty_rate,
+                   expected.partial_match_penalty_rate);
+  EXPECT_EQ(actual.use_prefix_only, expected.use_prefix_only);
+  EXPECT_EQ(actual.use_edit_distance, expected.use_edit_distance);
+  EXPECT_EQ(actual.split_search_tags, expected.split_search_tags);
+}
 
 }  // namespace
 
@@ -33,60 +38,33 @@
 TEST_F(IndexTest, SetSearchParams) {
   {
     // No params are specified so default values are used.
-    const SearchParams search_params;
-    index_.SetSearchParams(search_params);
+    const SearchParams used_params = index_.GetSearchParamsForTesting();
 
-    // Initialize them to values different from default.
-    double relevance_threshold = kDefaultRelevanceThreshold * 2.0;
-    double partial_match_penalty_rate = kDefaultPartialMatchPenaltyRate * 2.0;
-    bool use_prefix_only = !kDefaultUsePrefixOnly;
-    bool use_weighted_ratio = !kDefaultUseWeightedRatio;
-    bool use_edit_distance = !kDefaultUseEditDistance;
-
-    index_.GetSearchParamsForTesting(
-        &relevance_threshold, &partial_match_penalty_rate, &use_prefix_only,
-        &use_weighted_ratio, &use_edit_distance);
-
-    EXPECT_DOUBLE_EQ(relevance_threshold, kDefaultRelevanceThreshold);
-    EXPECT_DOUBLE_EQ(partial_match_penalty_rate,
-                     kDefaultPartialMatchPenaltyRate);
-    EXPECT_EQ(use_prefix_only, kDefaultUsePrefixOnly);
-    EXPECT_EQ(use_weighted_ratio, kDefaultUseWeightedRatio);
-    EXPECT_EQ(use_edit_distance, kDefaultUseEditDistance);
+    CheckSearchParams(used_params, SearchParams());
   }
 
   {
     // Params are specified and are used.
-    const SearchParams search_params = {
-        kDefaultRelevanceThreshold / 2, kDefaultPartialMatchPenaltyRate / 2,
-        !kDefaultUsePrefixOnly, !kDefaultUseWeightedRatio,
-        !kDefaultUseEditDistance};
+    SearchParams search_params;
+    const SearchParams default_params;
+    search_params.relevance_threshold = default_params.relevance_threshold / 2;
+    search_params.partial_match_penalty_rate =
+        default_params.partial_match_penalty_rate / 2;
+    search_params.use_prefix_only = !default_params.use_prefix_only;
+    search_params.use_edit_distance = !default_params.use_edit_distance;
+    search_params.split_search_tags = !default_params.split_search_tags;
 
     index_.SetSearchParams(search_params);
 
-    // Initialize them to default values.
-    double relevance_threshold = kDefaultRelevanceThreshold;
-    double partial_match_penalty_rate = kDefaultPartialMatchPenaltyRate;
-    bool use_prefix_only = kDefaultUsePrefixOnly;
-    bool use_weighted_ratio = kDefaultUseWeightedRatio;
-    bool use_edit_distance = kDefaultUseEditDistance;
+    const SearchParams used_params = index_.GetSearchParamsForTesting();
 
-    index_.GetSearchParamsForTesting(
-        &relevance_threshold, &partial_match_penalty_rate, &use_prefix_only,
-        &use_weighted_ratio, &use_edit_distance);
-
-    EXPECT_DOUBLE_EQ(relevance_threshold, kDefaultRelevanceThreshold / 2);
-    EXPECT_DOUBLE_EQ(partial_match_penalty_rate,
-                     kDefaultPartialMatchPenaltyRate / 2);
-    EXPECT_EQ(use_prefix_only, !kDefaultUsePrefixOnly);
-    EXPECT_EQ(use_weighted_ratio, !kDefaultUseWeightedRatio);
-    EXPECT_EQ(use_edit_distance, !kDefaultUseEditDistance);
+    CheckSearchParams(used_params, search_params);
   }
 }
 
 TEST_F(IndexTest, RelevanceThreshold) {
   const std::map<std::string, std::vector<std::string>> data_to_register = {
-      {"id1", {"Clash Of Clan"}}, {"id2", {"famous"}}};
+      {"id1", {"Wi-Fi"}}, {"id2", {"famous"}}};
   std::vector<Data> data = CreateTestData(data_to_register);
   index_.AddOrUpdate(data);
   EXPECT_EQ(index_.GetSize(), 2u);
@@ -95,7 +73,7 @@
     search_params.relevance_threshold = 0.0;
     index_.SetSearchParams(search_params);
 
-    FindAndCheck(&index_, "CC",
+    FindAndCheck(&index_, "wifi",
                  /*max_results=*/-1, ResponseStatus::kSuccess, {"id1", "id2"});
   }
   {
@@ -103,7 +81,7 @@
     search_params.relevance_threshold = 0.3;
     index_.SetSearchParams(search_params);
 
-    FindAndCheck(&index_, "CC",
+    FindAndCheck(&index_, "wifi",
                  /*max_results=*/-1, ResponseStatus::kSuccess, {"id1"});
   }
   {
@@ -111,25 +89,143 @@
     search_params.relevance_threshold = 0.9;
     index_.SetSearchParams(search_params);
 
-    FindAndCheck(&index_, "CC",
+    FindAndCheck(&index_, "wifi",
                  /*max_results=*/-1, ResponseStatus::kSuccess, {});
   }
 }
 
 TEST_F(IndexTest, MaxResults) {
   const std::map<std::string, std::vector<std::string>> data_to_register = {
-      {"id1", {"Clash Of Clan"}}, {"id2", {"famous"}}};
+      {"id1", {"Wi-Fi"}}, {"id2", {"famous"}}};
   std::vector<Data> data = CreateTestData(data_to_register);
   index_.AddOrUpdate(data);
   EXPECT_EQ(index_.GetSize(), 2u);
   SearchParams search_params;
+  // Set relevance threshold to 0 to ensure everything matches.
   search_params.relevance_threshold = 0.0;
   index_.SetSearchParams(search_params);
 
-  FindAndCheck(&index_, "CC",
+  FindAndCheck(&index_, "wifi",
                /*max_results=*/-1, ResponseStatus::kSuccess, {"id1", "id2"});
-  FindAndCheck(&index_, "CC",
+  FindAndCheck(&index_, "wifi",
                /*max_results=*/1, ResponseStatus::kSuccess, {"id1"});
 }
 
+TEST_F(IndexTest, ResultFound) {
+  const std::map<std::string, std::vector<std::string>> data_to_register = {
+      {"id1", {"id1", "tag1a", "tag1b"}}, {"xyz", {"xyz"}}};
+  std::vector<Data> data = CreateTestData(data_to_register);
+  EXPECT_EQ(data.size(), 2u);
+
+  index_.AddOrUpdate(data);
+  EXPECT_EQ(index_.GetSize(), 2u);
+
+  // Find result with query "id1". It returns an exact match.
+  FindAndCheck(&index_, "id1",
+               /*max_results=*/-1, ResponseStatus::kSuccess, {"id1"});
+  FindAndCheck(&index_, "abc",
+               /*max_results=*/-1, ResponseStatus::kSuccess, {});
+}
+
+TEST_F(IndexTest, SearchTagSplit) {
+  const std::map<std::string, std::vector<std::string>> data_to_register = {
+      {"id1", {"hello hello again world!", "tag1a"}}, {"id2", {"tag2a"}}};
+  std::vector<Data> data = CreateTestData(data_to_register);
+  EXPECT_EQ(data.size(), 2u);
+
+  index_.AddOrUpdate(data);
+  EXPECT_EQ(index_.GetSize(), 2u);
+
+  {
+    std::vector<base::string16> search_tags;
+    std::vector<base::string16> individual_search_tags;
+    index_.GetSearchTagsForTesting("id1", &search_tags,
+                                   &individual_search_tags);
+    EXPECT_EQ(search_tags.size(), 2u);
+    EXPECT_EQ(search_tags[0], base::UTF8ToUTF16("hello hello again world!"));
+    EXPECT_EQ(search_tags[1], base::UTF8ToUTF16("tag1a"));
+    EXPECT_EQ(individual_search_tags.size(), 4u);
+    EXPECT_EQ(individual_search_tags[0], base::UTF8ToUTF16("again"));
+    EXPECT_EQ(individual_search_tags[1], base::UTF8ToUTF16("hello"));
+    EXPECT_EQ(individual_search_tags[2], base::UTF8ToUTF16("tag1a"));
+    EXPECT_EQ(individual_search_tags[3], base::UTF8ToUTF16("world!"));
+  }
+  {
+    std::vector<base::string16> search_tags;
+    std::vector<base::string16> individual_search_tags;
+    index_.GetSearchTagsForTesting("id2", &search_tags,
+                                   &individual_search_tags);
+    EXPECT_EQ(search_tags.size(), 1u);
+    EXPECT_EQ(search_tags[0], base::UTF8ToUTF16("tag2a"));
+    EXPECT_EQ(individual_search_tags.size(), 0u);
+  }
+
+  // Single-word query.
+  FindAndCheck(&index_, "vorld", /*max_results=*/-1, ResponseStatus::kSuccess,
+               {"id1"});
+  // Multi-word query.
+  FindAndCheck(&index_, "hello vorld hello", /*max_results=*/-1,
+               ResponseStatus::kSuccess, {"id1"});
+
+  EXPECT_EQ(index_.Delete({"id1", "id10"}), 1u);
+  {
+    std::vector<base::string16> search_tags;
+    std::vector<base::string16> individual_search_tags;
+    index_.GetSearchTagsForTesting("id1", &search_tags,
+                                   &individual_search_tags);
+    EXPECT_EQ(search_tags.size(), 0u);
+    EXPECT_EQ(individual_search_tags.size(), 0u);
+  }
+}
+
+TEST_F(IndexTest, SearchTagNotSplit) {
+  const std::map<std::string, std::vector<std::string>> data_to_register = {
+      {"id1", {"hello hello again world!", "tag1a"}}, {"id2", {"tag2a"}}};
+  std::vector<Data> data = CreateTestData(data_to_register);
+  EXPECT_EQ(data.size(), 2u);
+
+  SearchParams search_params;
+  search_params.split_search_tags = false;
+  index_.SetSearchParams(search_params);
+  index_.AddOrUpdate(data);
+  EXPECT_EQ(index_.GetSize(), 2u);
+
+  {
+    std::vector<base::string16> search_tags;
+    std::vector<base::string16> individual_search_tags;
+    index_.GetSearchTagsForTesting("id1", &search_tags,
+                                   &individual_search_tags);
+    EXPECT_EQ(search_tags.size(), 2u);
+    EXPECT_EQ(search_tags[0], base::UTF8ToUTF16("hello hello again world!"));
+    EXPECT_EQ(search_tags[1], base::UTF8ToUTF16("tag1a"));
+    EXPECT_EQ(individual_search_tags.size(), 0u);
+  }
+  {
+    std::vector<base::string16> search_tags;
+    std::vector<base::string16> individual_search_tags;
+    index_.GetSearchTagsForTesting("id2", &search_tags,
+                                   &individual_search_tags);
+    EXPECT_EQ(search_tags.size(), 1u);
+    EXPECT_EQ(search_tags[0], base::UTF8ToUTF16("tag2a"));
+    EXPECT_EQ(individual_search_tags.size(), 0u);
+  }
+
+  // Single-word query.
+  FindAndCheck(&index_, "vorld", /*max_results=*/-1, ResponseStatus::kSuccess,
+               {"id1"});
+  // Multi-word query.
+  FindAndCheck(&index_, "hello vorld hello", /*max_results=*/-1,
+               ResponseStatus::kSuccess, {"id1"});
+
+  EXPECT_EQ(index_.Delete({"id1", "id10"}), 1u);
+  {
+    std::vector<base::string16> search_tags;
+    std::vector<base::string16> individual_search_tags;
+    index_.GetSearchTagsForTesting("id1", &search_tags,
+                                   &individual_search_tags);
+    EXPECT_EQ(search_tags.size(), 0u);
+    EXPECT_EQ(individual_search_tags.size(), 0u);
+  }
+}
+
 }  // namespace local_search_service

diff --git a/chrome/browser/chromeos/local_search_service/inverted_index.cc b/chrome/browser/chromeos/local_search_service/inverted_index.cc
index 0d77a1f..e106c40 100644
--- a/chrome/browser/chromeos/local_search_service/inverted_index.cc
+++ b/chrome/browser/chromeos/local_search_service/inverted_index.cc

@@ -27,8 +27,7 @@
   if (dictionary_.find(term) != dictionary_.end())
     return dictionary_.at(term);
 
-  PostingList empty_list;
-  return empty_list;
+  return {};
 }
 
 InvertedIndex::InvertedIndex() = default;
@@ -62,6 +61,21 @@
 }
 
 std::vector<TfidfResult> InvertedIndex::GetTfidf(const base::string16& term) {
+  if (tfidf_cache_.find(term) != tfidf_cache_.end())
+    return tfidf_cache_.at(term);
+
+  return {};
+}
+
+void InvertedIndex::PopulateTfidfCache() {
+  tfidf_cache_.clear();
+  for (const auto& item : dictionary_) {
+    tfidf_cache_[item.first] = CalculateTfidf(item.first);
+  }
+}
+
+std::vector<TfidfResult> InvertedIndex::CalculateTfidf(
+    const base::string16& term) {
   std::vector<TfidfResult> results;
   const float idf =
       1.0 + log((1.0 + doc_length_.size()) / (1.0 + dictionary_[term].size()));
@@ -72,4 +86,5 @@
   }
   return results;
 }
+
 }  // namespace local_search_service

diff --git a/chrome/browser/chromeos/local_search_service/inverted_index.h b/chrome/browser/chromeos/local_search_service/inverted_index.h
index aeafc4b..24ef2e1 100644
--- a/chrome/browser/chromeos/local_search_service/inverted_index.h
+++ b/chrome/browser/chromeos/local_search_service/inverted_index.h

@@ -70,18 +70,29 @@
   // not in the index.
   void RemoveDocument(const std::string& document_id);
 
-  // Gets TF-IDF scores for a term.
+  // Gets TF-IDF scores for a term. The result is pre-computed from
+  // |tfidf_cache_|.
   std::vector<TfidfResult> GetTfidf(const base::string16& term);
 
+  // Populates the TF-IDF score cache so that TF-IDF scores can be obtained
+  // faster. This function should be called after the inverted index is updated
+  // (after adding/removing documents).
+  void PopulateTfidfCache();
+
  private:
   friend class InvertedIndexTest;
 
+  // Calculates TF-IDF scores for a term.
+  std::vector<TfidfResult> CalculateTfidf(const base::string16& term);
+
   // Contains the length of the document (the number of terms in the document).
   // The size of this map will always equal to the number of documents in the
   // index.
   std::unordered_map<std::string, int> doc_length_;
   // A map from term to PostingList.
   std::unordered_map<base::string16, PostingList> dictionary_;
+  // Contains the TF-IDF scores for all the term in the index.
+  std::unordered_map<base::string16, std::vector<TfidfResult>> tfidf_cache_;
 };
 
 }  // namespace local_search_service

diff --git a/chrome/browser/chromeos/local_search_service/inverted_index_unittest.cc b/chrome/browser/chromeos/local_search_service/inverted_index_unittest.cc
index c811f679..b352ea4 100644
--- a/chrome/browser/chromeos/local_search_service/inverted_index_unittest.cc
+++ b/chrome/browser/chromeos/local_search_service/inverted_index_unittest.cc

@@ -41,6 +41,7 @@
                                        TokenPosition("body", 3, 1),
                                        TokenPosition("header", 5, 1),
                                        TokenPosition("body", 7, 1)})}});
+    PopulateTfidfCache();
   }
 
   PostingList FindTerm(const base::string16& term) {
@@ -60,6 +61,8 @@
     return index_.GetTfidf(term);
   }
 
+  void PopulateTfidfCache() { index_.PopulateTfidfCache(); }
+
   std::unordered_map<base::string16, PostingList> GetDictionary() {
     return index_.dictionary_;
   }
@@ -68,6 +71,10 @@
     return index_.doc_length_;
   }
 
+  std::unordered_map<base::string16, std::vector<TfidfResult>> GetTfidfCache() {
+    return index_.tfidf_cache_;
+  }
+
  private:
   InvertedIndex index_;
 };
@@ -184,4 +191,32 @@
   results = GetTfidf(base::UTF8ToUTF16("D"));
   EXPECT_EQ(results.size(), static_cast<unsigned long>(0));
 }
+
+TEST_F(InvertedIndexTest, PopulateTfidfCacheTest) {
+  // Replaces "doc1"
+  AddDocument("doc1",
+              {{base::UTF8ToUTF16("A"),
+                {{"header", 1, 1}, {"body", 2, 1}, {"header", 4, 1}}},
+               {base::UTF8ToUTF16("D"), {{"header", 3, 1}, {"body", 5, 1}}}});
+
+  PopulateTfidfCache();
+
+  std::vector<TfidfResult> results = GetTfidf(base::UTF8ToUTF16("A"));
+  EXPECT_EQ(results.size(), static_cast<unsigned long>(2));
+  const std::vector<float> idf_scores = {
+      std::roundf(std::get<2>(results[0]) * 100) / 100.0,
+      std::roundf(std::get<2>(results[1]) * 100) / 100.0};
+  EXPECT_THAT(idf_scores, testing::UnorderedElementsAre(0.6, 0.33));
+
+  results = GetTfidf(base::UTF8ToUTF16("B"));
+  EXPECT_EQ(results.size(), static_cast<unsigned long>(0));
+
+  results = GetTfidf(base::UTF8ToUTF16("C"));
+  EXPECT_EQ(results.size(), static_cast<unsigned long>(1));
+  EXPECT_NEAR(std::get<2>(results[0]), 0.94, 0.01);
+
+  results = GetTfidf(base::UTF8ToUTF16("D"));
+  EXPECT_EQ(results.size(), static_cast<unsigned long>(1));
+  EXPECT_NEAR(std::get<2>(results[0]), 0.56, 0.01);
+}
 }  // namespace local_search_service

diff --git a/chrome/browser/chromeos/local_search_service/local_search_service_unittest.cc b/chrome/browser/chromeos/local_search_service/local_search_service_unittest.cc
index 252b8cd..0a8665d 100644
--- a/chrome/browser/chromeos/local_search_service/local_search_service_unittest.cc
+++ b/chrome/browser/chromeos/local_search_service/local_search_service_unittest.cc

@@ -9,10 +9,8 @@
 #include <utility>
 #include <vector>
 
-#include "base/strings/string16.h"
-#include "base/strings/utf_string_conversions.h"
+#include "chrome/browser/chromeos/local_search_service/index.h"
 #include "chrome/browser/chromeos/local_search_service/local_search_service.h"
-#include "chrome/browser/chromeos/local_search_service/test_utils.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace local_search_service {
@@ -22,85 +20,11 @@
   LocalSearchService service_;
 };
 
-// Tests a query that results in an exact match. We do not aim to test the
-// algorithm used in the search, but exact match should always be returned.
-TEST_F(LocalSearchServiceTest, ResultFound) {
+TEST_F(LocalSearchServiceTest, GetIndex) {
   Index* const index = service_.GetIndex(IndexId::kCrosSettings);
-  DCHECK(index);
+  CHECK(index);
 
   EXPECT_EQ(index->GetSize(), 0u);
-
-  // Register the following data to the search index, the map is id to
-  // search-tags.
-  const std::map<std::string, std::vector<std::string>> data_to_register = {
-      {"id1", {"id1", "tag1a", "tag1b"}}, {"xyz", {"xyz"}}};
-  std::vector<Data> data = CreateTestData(data_to_register);
-  EXPECT_EQ(data.size(), 2u);
-
-  index->AddOrUpdate(data);
-  EXPECT_EQ(index->GetSize(), 2u);
-
-  // Find result with query "id1". It returns an exact match.
-  FindAndCheck(index, "id1",
-               /*max_results=*/-1, ResponseStatus::kSuccess, {"id1"});
 }
 
-// Tests a query that results in no match. We do not aim to test the algorithm
-// used in the search, but a query too different from the item should have no
-// result returned.
-TEST_F(LocalSearchServiceTest, ResultNotFound) {
-  Index* const index = service_.GetIndex(IndexId::kCrosSettings);
-  DCHECK(index);
-
-  EXPECT_EQ(index->GetSize(), 0u);
-
-  // Register the following data to the search index, the map is id to
-  // search-tags.
-  const std::map<std::string, std::vector<std::string>> data_to_register = {
-      {"id1", {"id1", "tag1a", "tag1b"}}, {"id2", {"id2", "tag2a", "tag2b"}}};
-  std::vector<Data> data = CreateTestData(data_to_register);
-  EXPECT_EQ(data.size(), 2u);
-
-  index->AddOrUpdate(data);
-  EXPECT_EQ(index->GetSize(), 2u);
-
-  // Find result with query "xyz". It returns no match.
-  FindAndCheck(index, "xyz",
-               /*max_results=*/-1, ResponseStatus::kSuccess, {});
-}
-
-TEST_F(LocalSearchServiceTest, UpdateData) {
-  Index* const index = service_.GetIndex(IndexId::kCrosSettings);
-  DCHECK(index);
-
-  EXPECT_EQ(index->GetSize(), 0u);
-
-  // Register the following data to the search index, the map is id to
-  // search-tags.
-  const std::map<std::string, std::vector<std::string>> data_to_register = {
-      {"id1", {"tag1a", "tag1b"}}, {"id2", {"tag2a", "tag2b"}}};
-  std::vector<Data> data = CreateTestData(data_to_register);
-  EXPECT_EQ(data.size(), 2u);
-
-  index->AddOrUpdate(data);
-  EXPECT_EQ(index->GetSize(), 2u);
-
-  // Delete "id1" and "id10" from the index. Since "id10" doesn't exist, only
-  // one item is deleted.
-  EXPECT_EQ(index->Delete({"id1", "id10"}), 1u);
-  EXPECT_EQ(index->GetSize(), 1u);
-
-  // Add "id3" to the index.
-  Data data_id3("id3",
-                std::vector<base::string16>({base::UTF8ToUTF16("tag3a")}));
-  std::vector<Data> data_to_update;
-  data_to_update.push_back(data_id3);
-  index->AddOrUpdate(data_to_update);
-  EXPECT_EQ(index->GetSize(), 2u);
-
-  FindAndCheck(index, "id3",
-               /*max_results=*/-1, ResponseStatus::kSuccess, {"id3"});
-  FindAndCheck(index, "id1",
-               /*max_results=*/-1, ResponseStatus::kSuccess, {});
-}
 }  // namespace local_search_service

diff --git a/chrome/browser/chromeos/login/enrollment/enrollment_local_policy_server_browsertest.cc b/chrome/browser/chromeos/login/enrollment/enrollment_local_policy_server_browsertest.cc
index bdda2fe..1d83229 100644
--- a/chrome/browser/chromeos/login/enrollment/enrollment_local_policy_server_browsertest.cc
+++ b/chrome/browser/chromeos/login/enrollment/enrollment_local_policy_server_browsertest.cc

@@ -107,11 +107,15 @@
                                      FakeGaiaMixin::kFakeAuthCode);
   }
 
+  std::unique_ptr<content::WindowedNotificationObserver>
+  CreateLoginVisibleWaiter() {
+    return std::make_unique<content::WindowedNotificationObserver>(
+        chrome::NOTIFICATION_LOGIN_OR_LOCK_WEBUI_VISIBLE,
+        content::NotificationService::AllSources());
+  }
+
   void ConfirmAndWaitLoginScreen() {
-    auto login_screen_waiter =
-        std::make_unique<content::WindowedNotificationObserver>(
-            chrome::NOTIFICATION_LOGIN_OR_LOCK_WEBUI_VISIBLE,
-            content::NotificationService::AllSources());
+    auto login_screen_waiter = CreateLoginVisibleWaiter();
     enrollment_screen()->OnConfirmationClosed();
     login_screen_waiter->Wait();
   }
@@ -498,7 +502,9 @@
   enrollment_ui_.WaitForStep(test::ui::kEnrollmentStepError);
   EXPECT_TRUE(StartupUtils::IsDeviceRegistered());
   EXPECT_TRUE(InstallAttributes::Get()->IsCloudManaged());
+  auto login_waiter = CreateLoginVisibleWaiter();
   enrollment_ui_.LeaveDeviceAttributeErrorScreen();
+  login_waiter->Wait();
   OobeScreenWaiter(GaiaView::kScreenId).Wait();
 }
 

diff --git a/chrome/browser/chromeos/login/enrollment/enrollment_screen.cc b/chrome/browser/chromeos/login/enrollment/enrollment_screen.cc
index dbd66ae1..9b15ace3 100644
--- a/chrome/browser/chromeos/login/enrollment/enrollment_screen.cc
+++ b/chrome/browser/chromeos/login/enrollment/enrollment_screen.cc

@@ -14,7 +14,6 @@
 #include "chrome/browser/browser_process_platform_part.h"
 #include "chrome/browser/chromeos/login/configuration_keys.h"
 #include "chrome/browser/chromeos/login/enrollment/enrollment_uma.h"
-#include "chrome/browser/chromeos/login/login_wizard.h"
 #include "chrome/browser/chromeos/login/screen_manager.h"
 #include "chrome/browser/chromeos/login/startup_utils.h"
 #include "chrome/browser/chromeos/login/ui/login_display_host.h"
@@ -324,19 +323,8 @@
   // either case, passing exit_callback_ directly should be safe.
   ClearAuth(base::BindRepeating(exit_callback_, Result::COMPLETED));
 
-  if (ShouldAttemptRestart()) {
+  if (ShouldAttemptRestart())
     chrome::AttemptRestart();
-    return;
-  }
-
-  // Could be not managed in tests.
-  if (g_browser_process->platform_part()
-          ->browser_policy_connector_chromeos()
-          ->IsEnterpriseManaged()) {
-    DCHECK_EQ(LoginDisplayHost::default_host()->GetOobeUI()->display_type(),
-              OobeUI::kOobeDisplay);
-    SwitchWebUItoMojo();
-  }
 }
 
 void EnrollmentScreen::OnAuthError(const GoogleServiceAuthError& error) {

diff --git a/chrome/browser/chromeos/login/profile_auth_data_unittest.cc b/chrome/browser/chromeos/login/profile_auth_data_unittest.cc
index 3dc2cf5f..e7f310a 100644
--- a/chrome/browser/chromeos/login/profile_auth_data_unittest.cc
+++ b/chrome/browser/chromeos/login/profile_auth_data_unittest.cc

@@ -22,6 +22,7 @@
 #include "content/public/browser/storage_partition.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_utils.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "net/base/network_isolation_key.h"
 #include "net/cookies/canonical_cookie.h"
@@ -35,6 +36,7 @@
 #include "services/network/network_context.h"
 #include "services/network/network_service.h"
 #include "services/network/public/mojom/cookie_manager.mojom.h"
+#include "services/network/public/mojom/network_context.mojom-forward.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
 
@@ -57,23 +59,18 @@
 const char kSAMLIdPCookieDomain[] = "example.com";
 const char kSAMLIdPCookieDomainWithWildcard[] = ".example.com";
 
-class TestingProfileWithNetworkContext : public TestingProfile {
- public:
-  explicit TestingProfileWithNetworkContext(
-      network::NetworkService* network_service) {
-    auto network_context = std::make_unique<network::NetworkContext>(
-        network_service, network_context_remote_.BindNewPipeAndPassReceiver(),
-        network::mojom::NetworkContextParams::New());
-    network_context_ = network_context.get();
-    SetNetworkContext(std::move(network_context));
-  }
-
-  network::NetworkContext* network_context() { return network_context_; }
-
- private:
-  mojo::Remote<network::mojom::NetworkContext> network_context_remote_;
-  network::NetworkContext* network_context_;
-};
+std::unique_ptr<network::NetworkContext>
+CreateNetworkContextForDefaultStoragePartition(
+    network::NetworkService* network_service,
+    content::BrowserContext* browser_context) {
+  mojo::PendingRemote<network::mojom::NetworkContext> network_context_remote;
+  auto network_context = std::make_unique<network::NetworkContext>(
+      network_service, network_context_remote.InitWithNewPipeAndPassReceiver(),
+      network::mojom::NetworkContextParams::New());
+  content::BrowserContext::GetDefaultStoragePartition(browser_context)
+      ->SetNetworkContextForTesting(std::move(network_context_remote));
+  return network_context;
+}
 
 network::NetworkService* GetNetworkService() {
   content::GetNetworkService();
@@ -103,7 +100,8 @@
                          const std::string& expected_saml_idp_cookie_value);
 
  private:
-  void PopulateBrowserContext(TestingProfileWithNetworkContext* browser_context,
+  void PopulateBrowserContext(TestingProfile* browser_context,
+                              network::NetworkContext* network_context,
                               const std::string& proxy_auth_password,
                               const std::string& cookie_value);
 
@@ -114,23 +112,28 @@
   content::BrowserTaskEnvironment task_environment_;
 
   network::NetworkService* network_service_;
-  TestingProfileWithNetworkContext login_browser_context_;
-  TestingProfileWithNetworkContext user_browser_context_;
+  TestingProfile login_browser_context_;
+  TestingProfile user_browser_context_;
+  std::unique_ptr<network::NetworkContext> login_network_context_;
+  std::unique_ptr<network::NetworkContext> user_network_context_;
 };
 
 ProfileAuthDataTest::ProfileAuthDataTest()
-    : network_service_(GetNetworkService()),
-      login_browser_context_(network_service_),
-      user_browser_context_(network_service_) {}
+    : network_service_(GetNetworkService()) {
+  login_network_context_ = CreateNetworkContextForDefaultStoragePartition(
+      network_service_, &login_browser_context_);
+  user_network_context_ = CreateNetworkContextForDefaultStoragePartition(
+      network_service_, &user_browser_context_);
+}
 
 void ProfileAuthDataTest::SetUp() {
-  PopulateBrowserContext(&login_browser_context_, kProxyAuthPassword1,
-                         kCookieValue1);
+  PopulateBrowserContext(&login_browser_context_, login_network_context_.get(),
+                         kProxyAuthPassword1, kCookieValue1);
 }
 
 void ProfileAuthDataTest::PopulateUserBrowserContext() {
-  PopulateBrowserContext(&user_browser_context_, kProxyAuthPassword2,
-                         kCookieValue2);
+  PopulateBrowserContext(&user_browser_context_, user_network_context_.get(),
+                         kProxyAuthPassword2, kCookieValue2);
 }
 
 void ProfileAuthDataTest::Transfer(
@@ -169,7 +172,7 @@
 
 void ProfileAuthDataTest::VerifyTransferredUserProxyAuthEntry() {
   net::HttpAuthCache::Entry* entry =
-      GetAuthCache(user_browser_context_.network_context())
+      GetAuthCache(user_network_context_.get())
           ->Lookup(GURL(kProxyAuthURL), net::HttpAuth::AUTH_PROXY,
                    kProxyAuthRealm, net::HttpAuth::AUTH_SCHEME_BASIC,
                    net::NetworkIsolationKey());
@@ -202,10 +205,11 @@
 }
 
 void ProfileAuthDataTest::PopulateBrowserContext(
-    TestingProfileWithNetworkContext* browser_context,
+    TestingProfile* browser_context,
+    network::NetworkContext* network_context,
     const std::string& proxy_auth_password,
     const std::string& cookie_value) {
-  GetAuthCache(browser_context->network_context())
+  GetAuthCache(network_context)
       ->Add(GURL(kProxyAuthURL), net::HttpAuth::AUTH_PROXY, kProxyAuthRealm,
             net::HttpAuth::AUTH_SCHEME_BASIC, net::NetworkIsolationKey(),
             kProxyAuthChallenge,

diff --git a/chrome/browser/chromeos/login/signin_partition_manager.cc b/chrome/browser/chromeos/login/signin_partition_manager.cc
index eaa3cf6..ea2fc01 100644
--- a/chrome/browser/chromeos/login/signin_partition_manager.cc
+++ b/chrome/browser/chromeos/login/signin_partition_manager.cc

@@ -105,6 +105,9 @@
   current_storage_partition_ =
       content::BrowserContext::GetStoragePartitionForSite(browser_context_,
                                                           guest_site, true);
+  if (on_create_new_storage_partition_) {
+    on_create_new_storage_partition_.Run(current_storage_partition_);
+  }
 
   TransferHttpAuthCacheProxyEntries(
       get_system_network_context_task_.Run(), current_storage_partition_,
@@ -138,6 +141,11 @@
   get_system_network_context_task_ = get_system_network_context_task;
 }
 
+void SigninPartitionManager::SetOnCreateNewStoragePartitionForTesting(
+    OnCreateNewStoragePartition on_create_new_storage_partition) {
+  on_create_new_storage_partition_ = on_create_new_storage_partition;
+}
+
 const std::string& SigninPartitionManager::GetCurrentStoragePartitionName()
     const {
   DCHECK(IsInSigninSession());

diff --git a/chrome/browser/chromeos/login/signin_partition_manager.h b/chrome/browser/chromeos/login/signin_partition_manager.h
index e1eb91712..a688e8777 100644
--- a/chrome/browser/chromeos/login/signin_partition_manager.h
+++ b/chrome/browser/chromeos/login/signin_partition_manager.h

@@ -40,6 +40,9 @@
   using GetSystemNetworkContextTask =
       base::RepeatingCallback<network::mojom::NetworkContext*()>;
 
+  using OnCreateNewStoragePartition =
+      base::RepeatingCallback<void(content::StoragePartition*)>;
+
   using StartSigninSessionDoneCallback =
       base::OnceCallback<void(const std::string& partition_name)>;
 
@@ -85,6 +88,8 @@
       ClearStoragePartitionTask clear_storage_partition_task);
   void SetGetSystemNetworkContextForTesting(
       GetSystemNetworkContextTask get_system_network_context_task);
+  void SetOnCreateNewStoragePartitionForTesting(
+      OnCreateNewStoragePartition on_create_new_storage_partition);
 
   class Factory : public BrowserContextKeyedServiceFactory {
    public:
@@ -113,6 +118,7 @@
 
   ClearStoragePartitionTask clear_storage_partition_task_;
   GetSystemNetworkContextTask get_system_network_context_task_;
+  OnCreateNewStoragePartition on_create_new_storage_partition_;
 
   // GuestView StoragePartitions use the host of the embedder site's URL as the
   // domain of their StoragePartition.

diff --git a/chrome/browser/chromeos/login/signin_partition_manager_unittest.cc b/chrome/browser/chromeos/login/signin_partition_manager_unittest.cc
index 6437c06d..f17869b0 100644
--- a/chrome/browser/chromeos/login/signin_partition_manager_unittest.cc
+++ b/chrome/browser/chromeos/login/signin_partition_manager_unittest.cc

@@ -23,6 +23,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/test/test_utils.h"
 #include "content/public/test/web_contents_tester.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "net/base/network_isolation_key.h"
 #include "net/cookies/cookie_store.h"
@@ -84,14 +85,7 @@
     // Wait for the Network Service to initialize on the IO thread.
     content::RunAllPendingInMessageLoop(content::BrowserThread::IO);
 
-    auto network_context = std::make_unique<network::NetworkContext>(
-        network::NetworkService::GetNetworkServiceForTesting(),
-        signin_network_context_remote_.BindNewPipeAndPassReceiver(),
-        network::mojom::NetworkContextParams::New());
-    signin_network_context_ = network_context.get();
-    TestingProfile::Builder()
-        .BuildIncognito(signin_browser_context_.get())
-        ->SetNetworkContext(std::move(network_context));
+    TestingProfile::Builder().BuildIncognito(signin_browser_context_.get());
 
     signin_ui_web_contents_ = content::WebContentsTester::CreateTestWebContents(
         GetSigninProfile(), content::SiteInstance::Create(GetSigninProfile()));
@@ -113,6 +107,10 @@
         base::BindRepeating(
             &SigninPartitionManagerTest::GetSystemNetworkContext,
             base::Unretained(this)));
+    GetSigninPartitionManager()->SetOnCreateNewStoragePartitionForTesting(
+        base::BindRepeating(
+            &SigninPartitionManagerTest::OnCreateNewStoragePartition,
+            base::Unretained(this)));
   }
 
   void TearDown() override {
@@ -122,6 +120,8 @@
 
     signin_browser_context_.reset();
 
+    signin_network_context_.reset();
+
     ChromeRenderViewHostTestHarness::TearDown();
   }
 
@@ -160,6 +160,7 @@
         webcontents,
         base::BindOnce(&StorePartitionNameAndQuitLoop, &loop, &partition_name));
     loop.Run();
+
     return partition_name;
   }
 
@@ -172,7 +173,7 @@
   }
 
   network::NetworkContext* GetSigninNetworkContextImpl() {
-    return signin_network_context_;
+    return signin_network_context_.get();
   }
 
  private:
@@ -181,12 +182,24 @@
     pending_clear_tasks_.push_back({partition, std::move(clear_done_closure)});
   }
 
+  void OnCreateNewStoragePartition(
+      content::StoragePartition* storage_partition) {
+    // Bind the NetworkContext for the new StoragePartition.
+    mojo::PendingRemote<network::mojom::NetworkContext>
+        signin_network_context_remote;
+    signin_network_context_ = std::make_unique<network::NetworkContext>(
+        network::NetworkService::GetNetworkServiceForTesting(),
+        signin_network_context_remote.InitWithNewPipeAndPassReceiver(),
+        network::mojom::NetworkContextParams::New());
+    storage_partition->SetNetworkContextForTesting(
+        std::move(signin_network_context_remote));
+  }
+
   mojo::Remote<network::mojom::NetworkContext> system_network_context_remote_;
   std::unique_ptr<network::NetworkContext> system_network_context_;
 
   std::unique_ptr<TestingProfile> signin_browser_context_;
-  mojo::Remote<network::mojom::NetworkContext> signin_network_context_remote_;
-  network::NetworkContext* signin_network_context_;
+  std::unique_ptr<network::NetworkContext> signin_network_context_;
 
   // Web contents of the sign-in UI, embedder of the signin-frame webview.
   std::unique_ptr<content::WebContents> signin_ui_web_contents_;

diff --git a/chrome/browser/chromeos/login/wizard_controller.cc b/chrome/browser/chromeos/login/wizard_controller.cc
index 9358ba4..0742856 100644
--- a/chrome/browser/chromeos/login/wizard_controller.cc
+++ b/chrome/browser/chromeos/login/wizard_controller.cc

@@ -48,6 +48,7 @@
 #include "chrome/browser/chromeos/login/existing_user_controller.h"
 #include "chrome/browser/chromeos/login/helper.h"
 #include "chrome/browser/chromeos/login/hwid_checker.h"
+#include "chrome/browser/chromeos/login/login_wizard.h"
 #include "chrome/browser/chromeos/login/quick_unlock/quick_unlock_utils.h"
 #include "chrome/browser/chromeos/login/screens/app_downloading_screen.h"
 #include "chrome/browser/chromeos/login/screens/arc_terms_of_service_screen.h"
@@ -989,12 +990,20 @@
   // We need a log to understand when the device finished enrollment.
   VLOG(1) << "Enrollment done";
 
-  if (KioskAppManager::Get()->IsAutoLaunchEnabled())
+  if (KioskAppManager::Get()->IsAutoLaunchEnabled()) {
     AutoLaunchKioskApp();
-  else if (WebKioskAppManager::Get()->GetAutoLaunchAccountId().is_valid())
+  } else if (WebKioskAppManager::Get()->GetAutoLaunchAccountId().is_valid()) {
     AutoLaunchWebKioskApp();
-  else
+  } else if (g_browser_process->platform_part()
+                 ->browser_policy_connector_chromeos()
+                 ->IsEnterpriseManaged()) {
+    // Could be not managed in tests.
+    DCHECK_EQ(LoginDisplayHost::default_host()->GetOobeUI()->display_type(),
+              OobeUI::kOobeDisplay);
+    SwitchWebUItoMojo();
+  } else {
     ShowLoginScreen();
+  }
 }
 
 void WizardController::OnEnableAdbSideloadingScreenExit() {

diff --git a/chrome/browser/chromeos/policy/system_features_disable_list_policy_handler.cc b/chrome/browser/chromeos/policy/system_features_disable_list_policy_handler.cc
index 59c239b..62c5eb9e 100644
--- a/chrome/browser/chromeos/policy/system_features_disable_list_policy_handler.cc
+++ b/chrome/browser/chromeos/policy/system_features_disable_list_policy_handler.cc

@@ -5,6 +5,7 @@
 #include "system_features_disable_list_policy_handler.h"
 
 #include "ash/public/cpp/ash_pref_names.h"
+#include "base/metrics/histogram_functions.h"
 #include "base/values.h"
 #include "components/policy/core/common/policy_pref_names.h"
 #include "components/policy/policy_constants.h"
@@ -16,6 +17,9 @@
 const char kBrowserSettingsFeature[] = "browser_settings";
 const char kOsSettingsFeature[] = "os_settings";
 
+const char kSystemFeaturesDisableListHistogram[] =
+    "Enterprise.SystemFeaturesDisableList";
+
 SystemFeaturesDisableListPolicyHandler::SystemFeaturesDisableListPolicyHandler()
     : policy::ListPolicyHandler(key::kSystemFeaturesDisableList,
                                 base::Value::Type::STRING) {}
@@ -32,14 +36,26 @@
     base::Value filtered_list,
     PrefValueMap* prefs) {
   DCHECK(filtered_list.is_list());
+
   base::Value enums_list(base::Value::Type::LIST);
   bool os_settings_enabled = true;
+
+  base::Value* old_list = nullptr;
+  prefs->GetValue(policy_prefs::kSystemFeaturesDisableList, &old_list);
+
   for (const auto& element : filtered_list.GetList()) {
     SystemFeature feature = ConvertToEnum(element.GetString());
     enums_list.Append(feature);
     if (feature == SystemFeature::OS_SETTINGS)
       os_settings_enabled = false;
+
+    if (!old_list ||
+        !base::Contains(old_list->GetList(), base::Value(feature))) {
+      base::UmaHistogramEnumeration(kSystemFeaturesDisableListHistogram,
+                                    feature);
+    }
   }
+
   prefs->SetValue(policy_prefs::kSystemFeaturesDisableList,
                   std::move(enums_list));
   prefs->SetBoolean(ash::prefs::kOsSettingsEnabled, os_settings_enabled);
@@ -54,8 +70,8 @@
   if (system_feature == kBrowserSettingsFeature)
     return SystemFeature::BROWSER_SETTINGS;
 
-  NOTREACHED() << "Unsupported system feature: " << system_feature;
-  return LAST_SYSTEM_FEATURE;
+  LOG(ERROR) << "Unsupported system feature: " << system_feature;
+  return UNKNOWN_SYSTEM_FEATURE;
 }
 
 }  // namespace policy

diff --git a/chrome/browser/chromeos/policy/system_features_disable_list_policy_handler.h b/chrome/browser/chromeos/policy/system_features_disable_list_policy_handler.h
index 198b98d..91e60bd 100644
--- a/chrome/browser/chromeos/policy/system_features_disable_list_policy_handler.h
+++ b/chrome/browser/chromeos/policy/system_features_disable_list_policy_handler.h

@@ -16,18 +16,22 @@
 namespace policy {
 
 // A system feature that can be disabled by SystemFeaturesDisableList policy.
+// These values are persisted to logs. Entries should not be renumbered and
+// numeric values should never be reused.
 enum SystemFeature {
-  CAMERA = 0,        // The camera chrome app on Chrome OS.
-  BROWSER_SETTINGS,  // Browser settings.
-  OS_SETTINGS,       // The settings feature on Chrome OS.
-
-  LAST_SYSTEM_FEATURE
+  UNKNOWN_SYSTEM_FEATURE = 0,
+  CAMERA = 1,            // The camera chrome app on Chrome OS.
+  BROWSER_SETTINGS = 2,  // Browser settings.
+  OS_SETTINGS = 3,       // The settings feature on Chrome OS.
+  kMaxValue = OS_SETTINGS
 };
 
 extern const char kCameraFeature[];
 extern const char kBrowserSettingsFeature[];
 extern const char kOsSettingsFeature[];
 
+extern const char kSystemFeaturesDisableListHistogram[];
+
 class SystemFeaturesDisableListPolicyHandler
     : public policy::ListPolicyHandler {
  public:

diff --git a/chrome/browser/chromeos/policy/system_features_disable_list_policy_handler_unittest.cc b/chrome/browser/chromeos/policy/system_features_disable_list_policy_handler_unittest.cc
new file mode 100644
index 0000000..60e8986e
--- /dev/null
+++ b/chrome/browser/chromeos/policy/system_features_disable_list_policy_handler_unittest.cc

@@ -0,0 +1,105 @@
+// Copyright (c) 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/policy/system_features_disable_list_policy_handler.h"
+
+#include "ash/public/cpp/ash_pref_names.h"
+#include "base/test/metrics/histogram_tester.h"
+#include "base/values.h"
+#include "components/policy/core/common/policy_map.h"
+#include "components/policy/core/common/policy_pref_names.h"
+#include "components/policy/core/common/policy_types.h"
+#include "components/policy/policy_constants.h"
+#include "components/prefs/pref_value_map.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace policy {
+class SystemFeaturesDisableListPolicyHandlerTest : public testing::Test {
+ public:
+  SystemFeaturesDisableListPolicyHandlerTest() = default;
+  ~SystemFeaturesDisableListPolicyHandlerTest() override = default;
+
+  base::HistogramTester histogram_tester_;
+};
+
+// Tests that ApplyList sets the right enum values for the corresponding strings
+// & records them via UMA histogram.
+TEST_F(SystemFeaturesDisableListPolicyHandlerTest, ApplyListTest) {
+  PolicyMap policy_map;
+  PrefValueMap prefs;
+  base::Value* value = nullptr;
+  SystemFeaturesDisableListPolicyHandler policy_handler;
+  std::unique_ptr<base::Value> features_list =
+      std::make_unique<base::Value>(base::Value::Type::LIST);
+
+  features_list->Append("camera");
+  features_list->Append("browser_settings");
+
+  policy_map.Set(policy::key::kSystemFeaturesDisableList,
+                 policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER,
+                 policy::POLICY_SOURCE_CLOUD, std::move(features_list),
+                 nullptr);
+  policy_handler.ApplyPolicySettings(policy_map, &prefs);
+
+  EXPECT_TRUE(prefs.GetValue(ash::prefs::kOsSettingsEnabled, &value));
+  EXPECT_TRUE(value->GetBool());
+
+  base::Value expected_list(base::Value::Type::LIST);
+  expected_list.Append(SystemFeature::CAMERA);
+  expected_list.Append(SystemFeature::BROWSER_SETTINGS);
+
+  EXPECT_TRUE(prefs.GetValue(policy_prefs::kSystemFeaturesDisableList, &value));
+  EXPECT_EQ(expected_list, *value);
+
+  histogram_tester_.ExpectTotalCount(kSystemFeaturesDisableListHistogram, 2);
+  histogram_tester_.ExpectBucketCount(kSystemFeaturesDisableListHistogram,
+                                      SystemFeature::CAMERA,
+                                      /*amount*/ 1);
+  histogram_tester_.ExpectBucketCount(kSystemFeaturesDisableListHistogram,
+                                      SystemFeature::BROWSER_SETTINGS,
+                                      /*amount*/ 1);
+  histogram_tester_.ExpectBucketCount(kSystemFeaturesDisableListHistogram,
+                                      SystemFeature::OS_SETTINGS,
+                                      /*amount*/ 0);
+  histogram_tester_.ExpectBucketCount(kSystemFeaturesDisableListHistogram,
+                                      SystemFeature::UNKNOWN_SYSTEM_FEATURE,
+                                      /*amount*/ 0);
+
+  features_list = std::make_unique<base::Value>(base::Value::Type::LIST);
+  features_list->Append("camera");
+  features_list->Append("os_settings");
+  features_list->Append("gallery");
+
+  policy_map.Set(policy::key::kSystemFeaturesDisableList,
+                 policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER,
+                 policy::POLICY_SOURCE_CLOUD, std::move(features_list),
+                 nullptr);
+  policy_handler.ApplyPolicySettings(policy_map, &prefs);
+
+  EXPECT_TRUE(prefs.GetValue(ash::prefs::kOsSettingsEnabled, &value));
+  EXPECT_FALSE(value->GetBool());
+
+  expected_list.ClearList();
+  expected_list.Append(SystemFeature::CAMERA);
+  expected_list.Append(SystemFeature::OS_SETTINGS);
+  expected_list.Append(SystemFeature::UNKNOWN_SYSTEM_FEATURE);
+
+  EXPECT_TRUE(prefs.GetValue(policy_prefs::kSystemFeaturesDisableList, &value));
+  EXPECT_EQ(expected_list, *value);
+
+  histogram_tester_.ExpectTotalCount(kSystemFeaturesDisableListHistogram, 4);
+  histogram_tester_.ExpectBucketCount(kSystemFeaturesDisableListHistogram,
+                                      SystemFeature::CAMERA,
+                                      /*amount*/ 1);
+  histogram_tester_.ExpectBucketCount(kSystemFeaturesDisableListHistogram,
+                                      SystemFeature::BROWSER_SETTINGS,
+                                      /*amount*/ 1);
+  histogram_tester_.ExpectBucketCount(kSystemFeaturesDisableListHistogram,
+                                      SystemFeature::OS_SETTINGS,
+                                      /*amount*/ 1);
+  histogram_tester_.ExpectBucketCount(kSystemFeaturesDisableListHistogram,
+                                      SystemFeature::UNKNOWN_SYSTEM_FEATURE,
+                                      /*amount*/ 1);
+}
+}  // namespace policy

diff --git a/chrome/browser/chromeos/smb_client/smb_service.cc b/chrome/browser/chromeos/smb_client/smb_service.cc
index 23574f3..f86c9885a 100644
--- a/chrome/browser/chromeos/smb_client/smb_service.cc
+++ b/chrome/browser/chromeos/smb_client/smb_service.cc

@@ -890,6 +890,12 @@
       return true;
     }
   }
+
+  for (const auto& entry : smbfs_shares_) {
+    if (entry.second->share_url().ToString() == share.ToString()) {
+      return true;
+    }
+  }
   return false;
 }
 

diff --git a/chrome/browser/chromeos/smb_client/smb_service_unittest.cc b/chrome/browser/chromeos/smb_client/smb_service_unittest.cc
index c1ad699..151be2ee 100644
--- a/chrome/browser/chromeos/smb_client/smb_service_unittest.cc
+++ b/chrome/browser/chromeos/smb_client/smb_service_unittest.cc

@@ -70,9 +70,11 @@
 constexpr char kTestPassword[] = "my_secret_password";
 constexpr char kTestDomain[] = "EXAMPLE.COM";
 constexpr char kSharePath[] = "\\\\server\\foobar";
+constexpr char kSharePath2[] = "\\\\server2\\second_share";
 constexpr char kShareUrl[] = "smb://server/foobar";
 constexpr char kDisplayName[] = "My Share";
 constexpr char kMountPath[] = "/share/mount/path";
+constexpr char kMountPath2[] = "/share/mount/second_path";
 
 constexpr char kTestADUser[] = "ad-test-user";
 constexpr char kTestADDomain[] = "foorbar.corp";
@@ -1144,8 +1146,7 @@
                                 base::BindOnce([](SmbMountResult result) {
                                   EXPECT_EQ(SmbMountResult::kSuccess, result);
                                 })));
-  const char kMountPath2[] = "/share/mount/second_path";
-  ignore_result(MountBasicShare(kSharePath, kMountPath2,
+  ignore_result(MountBasicShare(kSharePath2, kMountPath2,
                                 base::BindOnce([](SmbMountResult result) {
                                   EXPECT_EQ(SmbMountResult::kSuccess, result);
                                 })));
@@ -1169,5 +1170,28 @@
       base::FilePath("/share/mount/third_path")));
 }
 
+TEST_F(SmbServiceWithSmbfsTest, MountDuplicate) {
+  CreateService(profile_);
+  WaitForSetupComplete();
+
+  ignore_result(MountBasicShare(kSharePath, kMountPath,
+                                base::BindOnce([](SmbMountResult result) {
+                                  EXPECT_EQ(SmbMountResult::kSuccess, result);
+                                })));
+
+  // A second mount with the same share path should fail.
+  ignore_result(MountBasicShare(
+      kSharePath, kMountPath2, base::BindOnce([](SmbMountResult result) {
+        EXPECT_EQ(SmbMountResult::kMountExists, result);
+      })));
+
+  // Unmounting and mounting again should succeed.
+  smb_service_->UnmountSmbFs(base::FilePath(kMountPath));
+  ignore_result(MountBasicShare(kSharePath, kMountPath2,
+                                base::BindOnce([](SmbMountResult result) {
+                                  EXPECT_EQ(SmbMountResult::kSuccess, result);
+                                })));
+}
+
 }  // namespace smb_client
 }  // namespace chromeos

diff --git a/chrome/browser/extensions/api/declarative_net_request/declarative_net_request_apitest.cc b/chrome/browser/extensions/api/declarative_net_request/declarative_net_request_apitest.cc
index 8ee536a..827ac89 100644
--- a/chrome/browser/extensions/api/declarative_net_request/declarative_net_request_apitest.cc
+++ b/chrome/browser/extensions/api/declarative_net_request/declarative_net_request_apitest.cc

@@ -52,10 +52,6 @@
   ASSERT_TRUE(RunExtensionTest("dynamic_rules")) << message_;
 }
 
-IN_PROC_BROWSER_TEST_F(DeclarativeNetRequestAPItest, HeaderRemoval) {
-  ASSERT_TRUE(RunExtensionTest("header_removal")) << message_;
-}
-
 // TODO(crbug.com/1029233) Restore this test. This is disabled due to
 // flakiness.
 IN_PROC_BROWSER_TEST_F(DeclarativeNetRequestAPItest,

diff --git a/chrome/browser/extensions/api/declarative_net_request/declarative_net_request_browsertest.cc b/chrome/browser/extensions/api/declarative_net_request/declarative_net_request_browsertest.cc
index 7084d70b..a5d9df7 100644
--- a/chrome/browser/extensions/api/declarative_net_request/declarative_net_request_browsertest.cc
+++ b/chrome/browser/extensions/api/declarative_net_request/declarative_net_request_browsertest.cc

@@ -2645,54 +2645,6 @@
   EXPECT_TRUE(IsNavigationBlocked(yahoo_url));
 }
 
-// Tests removal of the 'Referer' request header.
-IN_PROC_BROWSER_TEST_P(DeclarativeNetRequestBrowserTest,
-                       BlockRefererRequestHeader) {
-  auto test_referrer_blocked = [this](bool expected_referrer_blocked) {
-    const GURL initial_url =
-        embedded_test_server()->GetURL("example.com", "/simulate_click.html");
-    const GURL url_with_referrer =
-        embedded_test_server()->GetURL("example.com", "/echoheader?referer");
-    content::TestNavigationObserver observer(web_contents(),
-                                             2 /* number_of_navigations */);
-    observer.set_wait_event(
-        content::TestNavigationObserver::WaitEvent::kNavigationFinished);
-    ui_test_utils::NavigateToURL(browser(), initial_url);
-    observer.WaitForNavigationFinished();
-    ASSERT_EQ(url_with_referrer, observer.last_navigation_url());
-
-    std::string expected_referrer =
-        expected_referrer_blocked ? "None" : initial_url.spec();
-    EXPECT_EQ(expected_referrer, GetPageBody());
-  };
-
-  test_referrer_blocked(false);
-
-  // Load an extension which blocks the Referer header for requests to
-  // "example.com".
-  TestRule rule = CreateGenericRule();
-  rule.condition->url_filter = std::string("||example.com");
-  rule.condition->resource_types = std::vector<std::string>({"main_frame"});
-  rule.action->type = std::string("removeHeaders");
-  rule.action->remove_headers_list = std::vector<std::string>({"referer"});
-
-  EXPECT_FALSE(
-      ExtensionWebRequestEventRouter::GetInstance()->HasAnyExtraHeadersListener(
-          profile()));
-  ASSERT_NO_FATAL_FAILURE(LoadExtensionWithRules({rule}));
-  EXPECT_TRUE(
-      ExtensionWebRequestEventRouter::GetInstance()->HasAnyExtraHeadersListener(
-          profile()));
-  test_referrer_blocked(true);
-
-  DisableExtension(last_loaded_extension_id());
-  WaitForExtensionsWithRulesetsCount(0);
-  EXPECT_FALSE(
-      ExtensionWebRequestEventRouter::GetInstance()->HasAnyExtraHeadersListener(
-          profile()));
-  test_referrer_blocked(false);
-}
-
 // Tests rules using the Redirect dictionary.
 IN_PROC_BROWSER_TEST_P(DeclarativeNetRequestBrowserTest, Redirect) {
   TestRule rule1 = CreateGenericRule();
@@ -2810,14 +2762,11 @@
     int priority;
     std::string action_type;
     base::Optional<std::string> redirect_url;
-    base::Optional<std::vector<std::string>> remove_headers_list;
   } rules_data[] = {
-      {"abc.com", 1, 1, "block", base::nullopt, base::nullopt},
-      {"def.com", 2, 1, "redirect", "http://zzz.com", base::nullopt},
-      {"jkl.com", 3, 1, "removeHeaders", base::nullopt,
-       std::vector<std::string>({"referer"})},
-      {"abcd.com", 4, 1, "block", base::nullopt, base::nullopt},
-      {"abcd", 5, 1, "allow", base::nullopt, base::nullopt},
+      {"abc.com", 1, 1, "block", base::nullopt},
+      {"def.com", 2, 1, "redirect", "http://zzz.com"},
+      {"abcd.com", 4, 1, "block", base::nullopt},
+      {"abcd", 5, 1, "allow", base::nullopt},
   };
 
   // Load the extension.
@@ -2832,7 +2781,6 @@
     rule.action->type = rule_data.action_type;
     rule.action->redirect.emplace();
     rule.action->redirect->url = rule_data.redirect_url;
-    rule.action->remove_headers_list = rule_data.remove_headers_list;
     rules.push_back(rule);
   }
 
@@ -2862,16 +2810,10 @@
       // def.com is redirected by a matching rule and should increment the badge
       // text.
       {"def.com", "2", false},
-      // jkl.com matches with a removeHeaders rule, but has no headers.
-      // Therefore no action is taken and the badge text stays the same.
-      {"jkl.com", "2", false},
-      // jkl.com matches with a removeHeaders rule and has a referrer header.
-      // Therefore the badge text should be incremented.
-      {"jkl.com", "3", true},
       // abcd.com matches both a block rule and an allow rule. Since the allow
       // rule overrides the block rule, no action is taken and the badge text
       // stays the same,
-      {"abcd.com", "3", false},
+      {"abcd.com", "2", false},
   };
 
   ui_test_utils::NavigateToURL(browser(), page_url);
@@ -2937,11 +2879,9 @@
   // Four rules should be matched on the tab with |first_tab_id|:
   //   - the block rule for abc.com (ruleId = 1)
   //   - the redirect rule for def.com (ruleId = 2)
-  //   - the removeHeaders rule for jkl.com (ruleId = 3)
   //   - the allow rule for abcd.com (ruleId = 5)
-  EXPECT_EQ(base::StringPrintf("1,%s|2,%s|3,%s|5,%s", kDefaultRulesetID,
-                               kDefaultRulesetID, kDefaultRulesetID,
-                               kDefaultRulesetID),
+  EXPECT_EQ(base::StringPrintf("1,%s|2,%s|5,%s", kDefaultRulesetID,
+                               kDefaultRulesetID, kDefaultRulesetID),
             get_matched_rules(first_tab_id));
 
   // No rule should be matched on the tab with |second_tab_id|.
@@ -3240,10 +3180,6 @@
                                           "/pages_with_script/index.html");
   };
 
-  auto get_set_cookie_url = [this](std::string hostname) {
-    return embedded_test_server()->GetURL(hostname, "/set-cookie?a=b");
-  };
-
   struct {
     std::string url_filter;
     int id;
@@ -3251,23 +3187,16 @@
     std::string action_type;
     std::vector<std::string> resource_types;
     base::Optional<std::string> redirect_url;
-    base::Optional<std::vector<std::string>> remove_headers_list;
   } rules_data[] = {
       {"abc.com", 1, 1, "block", std::vector<std::string>({"script"}),
-       base::nullopt, base::nullopt},
+       base::nullopt},
       {"||def.com", 2, 1, "redirect", std::vector<std::string>({"main_frame"}),
-       get_url_for_host("abc.com").spec(), base::nullopt},
+       get_url_for_host("abc.com").spec()},
       {"gotodef.com", 3, 1, "redirect",
        std::vector<std::string>({"main_frame"}),
-       get_url_for_host("def.com").spec(), base::nullopt},
+       get_url_for_host("def.com").spec()},
       {"ghi.com", 4, 1, "block", std::vector<std::string>({"main_frame"}),
-       base::nullopt, base::nullopt},
-      {"gotosetcookie.com", 5, 1, "redirect",
-       std::vector<std::string>({"main_frame"}),
-       get_set_cookie_url("setcookie.com").spec(), base::nullopt},
-      {"setcookie.com", 6, 1, "removeHeaders",
-       std::vector<std::string>({"main_frame"}), base::nullopt,
-       std::vector<std::string>({"setCookie"})},
+       base::nullopt},
   };
 
   // Load the extension.
@@ -3281,7 +3210,6 @@
     rule.action->type = rule_data.action_type;
     rule.action->redirect.emplace();
     rule.action->redirect->url = rule_data.redirect_url;
-    rule.action->remove_headers_list = rule_data.remove_headers_list;
     rules.push_back(rule);
   }
 
@@ -3317,10 +3245,6 @@
       // gotodef.com to def.com caused by a rule match. Therefore the badge text
       // should be 3.
       {"gotodef.com", "3"},
-      // The request to gotosetcookie.com will match with a rule and redirect to
-      // setcookie.com. The Set-Cookie header on setcookie.com will also match
-      // with a rule and get removed. Therefore the badge text should be 2.
-      {"gotosetcookie.com", "2"},
   };
 
   int first_tab_id = ExtensionTabUtil::GetTabId(web_contents());
@@ -3334,125 +3258,6 @@
   }
 }
 
-// Test that the badge text for extensions will update correctly for
-// removeHeader rules.
-IN_PROC_BROWSER_TEST_P(DeclarativeNetRequestBrowserTest,
-                       RemoveHeadersBadgeText) {
-  auto get_referer_url = [this](std::string host) {
-    return embedded_test_server()->GetURL(host, "/set-header?referer: none");
-  };
-  auto get_set_cookie_url = [this](std::string host) {
-    return embedded_test_server()->GetURL(host, "/set-cookie?a=b");
-  };
-
-  auto create_remove_headers_rule =
-      [](int id, const std::string& url_filter,
-         const std::vector<std::string>& remove_headers_list) {
-        TestRule rule = CreateGenericRule();
-        rule.id = id;
-        rule.condition->url_filter = url_filter;
-        rule.condition->resource_types =
-            std::vector<std::string>({"sub_frame"});
-        rule.action->type = "removeHeaders";
-        rule.action->remove_headers_list = remove_headers_list;
-
-        return rule;
-      };
-
-  const std::string kFrameName1 = "frame1";
-  const GURL page_url = embedded_test_server()->GetURL(
-      "nomatch.com", "/page_with_two_frames.html");
-
-  // Create an extension with rules and get the ExtensionAction for it.
-  TestRule example_set_cookie_rule =
-      create_remove_headers_rule(kMinValidID, "example.com", {"setCookie"});
-
-  TestRule both_headers_rule = create_remove_headers_rule(
-      kMinValidID + 1, "google.com", {"referer", "setCookie"});
-
-  TestRule abc_set_cookie_rule =
-      create_remove_headers_rule(kMinValidID + 2, "abc.com", {"setCookie"});
-
-  TestRule abc_referer_rule =
-      create_remove_headers_rule(kMinValidID + 3, "abc.com", {"referer"});
-
-  ASSERT_NO_FATAL_FAILURE(
-      LoadExtensionWithRules({example_set_cookie_rule, both_headers_rule,
-                              abc_set_cookie_rule, abc_referer_rule},
-                             "extension_1", {}));
-
-  const ExtensionId extension_1_id = last_loaded_extension_id();
-  ExtensionPrefs::Get(profile())->SetDNRUseActionCountAsBadgeText(
-      extension_1_id, true);
-
-  ExtensionAction* extension_1_action =
-      ExtensionActionManager::Get(web_contents()->GetBrowserContext())
-          ->GetExtensionAction(*extension_registry()->GetExtensionById(
-              extension_1_id, extensions::ExtensionRegistry::ENABLED));
-
-  // Create another extension which removes the referer header from example.com
-  // and get the ExtensionAction for it.
-  TestRule example_referer_rule =
-      create_remove_headers_rule(kMinValidID, "example.com", {"referer"});
-
-  ASSERT_NO_FATAL_FAILURE(
-      LoadExtensionWithRules({example_referer_rule}, "extension_2", {}));
-
-  const ExtensionId extension_2_id = last_loaded_extension_id();
-  ExtensionPrefs::Get(profile())->SetDNRUseActionCountAsBadgeText(
-      extension_2_id, true);
-
-  ExtensionAction* extension_2_action =
-      ExtensionActionManager::Get(web_contents()->GetBrowserContext())
-          ->GetExtensionAction(*extension_registry()->GetExtensionById(
-              extension_2_id, extensions::ExtensionRegistry::ENABLED));
-
-  struct {
-    GURL url;
-    bool use_referrer;
-    std::string expected_ext_1_badge_text;
-    std::string expected_ext_2_badge_text;
-  } test_cases[] = {
-      // This request only has a Set-Cookie header. Only the badge text for the
-      // extension with a remove Set-Cookie header rule should be incremented.
-      {get_set_cookie_url("example.com"), false, "1", ""},
-      // This request only has a Referer header. Only the badge text for the
-      // extension with a remove Referer header rule should be incremented.
-      {get_referer_url("example.com"), true, "1", "1"},
-      // This request has both a Referer and a Set-Cookie header. The badge text
-      // for both extensions should be incremented.
-      {get_set_cookie_url("example.com"), true, "2", "2"},
-      // This request with a Referer and Set-Cookie header matches with one rule
-      // from |extension_1| and so the action count for |extension_1| should
-      // only increment by one,
-      {get_set_cookie_url("google.com"), true, "3", "2"},
-      // This request with a Referer and Set-Cookie header matches with two
-      // separate rules from |extension_1| and so the action count for
-      // |extension_1| should increment by two.
-      {get_set_cookie_url("abc.com"), true, "5", "2"},
-  };
-
-  ui_test_utils::NavigateToURL(browser(), page_url);
-  ASSERT_TRUE(WasFrameWithScriptLoaded(GetMainFrame()));
-
-  int first_tab_id = ExtensionTabUtil::GetTabId(web_contents());
-  EXPECT_EQ("", extension_1_action->GetDisplayBadgeText(first_tab_id));
-  EXPECT_EQ("", extension_2_action->GetDisplayBadgeText(first_tab_id));
-
-  for (const auto& test_case : test_cases) {
-    SCOPED_TRACE(base::StringPrintf("Testing URL: %s, using referrer: %s",
-                                    test_case.url.spec().c_str(),
-                                    test_case.use_referrer ? "true" : "false"));
-
-    NavigateFrame(kFrameName1, test_case.url, test_case.use_referrer);
-    EXPECT_EQ(test_case.expected_ext_1_badge_text,
-              extension_1_action->GetDisplayBadgeText(first_tab_id));
-
-    EXPECT_EQ(test_case.expected_ext_2_badge_text,
-              extension_2_action->GetDisplayBadgeText(first_tab_id));
-  }
-}
-
 // Test that the onRuleMatchedDebug event is only available for unpacked
 // extensions.
 IN_PROC_BROWSER_TEST_P(DeclarativeNetRequestBrowserTest,
@@ -3481,89 +3286,6 @@
   ASSERT_EQ(expected_event_availability, actual_event_availability);
 }
 
-// Test that the onRuleMatchedDebug event returns the correct number of matched
-// rules for a request which is matched with multiple rules.
-IN_PROC_BROWSER_TEST_P(DeclarativeNetRequestBrowserTest_Unpacked,
-                       OnRuleMatchedDebugMultipleRules) {
-  // This is only tested for unpacked extensions since the onRuleMatchedDebug
-  // event is only available for unpacked extensions.
-  ASSERT_EQ(ExtensionLoadType::UNPACKED, GetParam());
-
-  // Load the extension with a background script so scripts can be run from its
-  // generated background page. Also grant the feedback permission for the
-  // extension so it has access to the onRuleMatchedDebug event.
-  set_config_flags(ConfigFlag::kConfig_HasBackgroundScript |
-                   ConfigFlag::kConfig_HasFeedbackPermission);
-
-  auto create_remove_headers_rule =
-      [](int id, const std::string& url_filter,
-         const std::vector<std::string>& remove_headers_list) {
-        TestRule rule = CreateGenericRule();
-        rule.id = id;
-        rule.condition->url_filter = url_filter;
-        rule.condition->resource_types =
-            std::vector<std::string>({"sub_frame"});
-        rule.action->type = "removeHeaders";
-        rule.action->remove_headers_list = remove_headers_list;
-
-        return rule;
-      };
-
-  const std::string kFrameName1 = "frame1";
-  const std::string sub_frame_host = "abc.com";
-  const GURL page_url = embedded_test_server()->GetURL(
-      "nomatch.com", "/page_with_two_frames.html");
-
-  TestRule abc_referer_rule =
-      create_remove_headers_rule(kMinValidID, sub_frame_host, {"referer"});
-
-  TestRule abc_set_cookie_rule = create_remove_headers_rule(
-      kMinValidID + 1, sub_frame_host, {"setCookie"});
-
-  // Load an extension with removeHeaders rules for the Referer and Set-Cookie
-  // headers.
-  ASSERT_NO_FATAL_FAILURE(LoadExtensionWithRules(
-      {abc_set_cookie_rule, abc_referer_rule}, "extension_1", {}));
-
-  ui_test_utils::NavigateToURL(browser(), page_url);
-  ASSERT_TRUE(WasFrameWithScriptLoaded(GetMainFrame()));
-
-  // Start the onRuleMatchedDebug observer.
-  const char kOnRuleMatchedDebugScript[] = R"(
-    var matchedRules = [];
-    var onRuleMatchedDebugCallback = (rule) => {
-      matchedRules.push(rule);
-    };
-
-    chrome.declarativeNetRequest.onRuleMatchedDebug.addListener(
-      onRuleMatchedDebugCallback);
-    window.domAutomationController.send('ready');
-  )";
-
-  ASSERT_EQ("ready", ExecuteScriptInBackgroundPage(last_loaded_extension_id(),
-                                                   kOnRuleMatchedDebugScript));
-
-  auto set_cookie_and_referer_url =
-      embedded_test_server()->GetURL(sub_frame_host, "/set-cookie?a=b");
-
-  NavigateFrame(kFrameName1, set_cookie_and_referer_url);
-
-  // Now query the onRuleMatchedDebug results.
-  const char kQueryMatchedRulesScript[] = R"(
-    chrome.declarativeNetRequest.onRuleMatchedDebug.removeListener(
-      onRuleMatchedDebugCallback);
-    var ruleIds = matchedRules.map(matchedRule => matchedRule.rule.ruleId);
-    window.domAutomationController.send(ruleIds.sort().join());
-  )";
-
-  std::string matched_rule_ids = ExecuteScriptInBackgroundPage(
-      last_loaded_extension_id(), kQueryMatchedRulesScript);
-
-  // The request to |set_cookie_and_referer_url| should be matched with the
-  // Referer rule (ruleId 1) and the Set-Cookie rule (ruleId 2).
-  EXPECT_EQ("1,2", matched_rule_ids);
-}
-
 // Test that getMatchedRules returns the correct rules when called by different
 // extensions with rules matched by requests initiated from different tabs.
 IN_PROC_BROWSER_TEST_P(DeclarativeNetRequestBrowserTest,

diff --git a/chrome/browser/extensions/api/declarative_net_request/ruleset_manager_unittest.cc b/chrome/browser/extensions/api/declarative_net_request/ruleset_manager_unittest.cc
index 9ebdabe..2c18c23 100644
--- a/chrome/browser/extensions/api/declarative_net_request/ruleset_manager_unittest.cc
+++ b/chrome/browser/extensions/api/declarative_net_request/ruleset_manager_unittest.cc

@@ -456,79 +456,6 @@
   EXPECT_TRUE(request_4.dnr_actions->empty());
 }
 
-// Test that headers to be removed in removeHeaders rules are attributed to the
-// correct extension.
-TEST_P(RulesetManagerTest, RemoveHeaders) {
-  const Extension* extension_1 = nullptr;
-  const Extension* extension_2 = nullptr;
-  // Add an extension with a background page which removes the "cookie" and
-  // "setCookie" headers.
-  {
-    std::unique_ptr<CompositeMatcher> matcher;
-    TestRule rule = CreateGenericRule();
-    rule.condition->url_filter = std::string("*");
-    rule.action->type = std::string("removeHeaders");
-    rule.action->remove_headers_list =
-        std::vector<std::string>({"cookie", "setCookie"});
-
-    ASSERT_NO_FATAL_FAILURE(
-        CreateMatcherForRules({rule}, "test extension", &matcher));
-    extension_1 = last_loaded_extension();
-    manager()->AddRuleset(extension_1->id(), std::move(matcher));
-  }
-
-  // Add another extension with a background page which removes the "cookie" and
-  // "referer" headers.
-  {
-    std::unique_ptr<CompositeMatcher> matcher;
-    TestRule rule = CreateGenericRule();
-    rule.condition->url_filter = std::string("*");
-    rule.action->type = std::string("removeHeaders");
-    rule.action->remove_headers_list =
-        std::vector<std::string>({"cookie", "referer"});
-
-    ASSERT_NO_FATAL_FAILURE(
-        CreateMatcherForRules({rule}, "test extension 2", &matcher));
-    extension_2 = last_loaded_extension();
-    manager()->AddRuleset(extension_2->id(), std::move(matcher));
-  }
-
-  EXPECT_EQ(2u, manager()->GetMatcherCountForTest());
-
-  // Create a request with the "cookie" and "referer" request headers, and the
-  // "set-cookie" response header.
-  WebRequestInfo request_1(GetRequestParamsForURLWithHeaders(
-      "http://example.com", std::vector<std::string>({"cookie", "referer"})));
-  request_1.response_headers = base::MakeRefCounted<net::HttpResponseHeaders>(
-      net::HttpUtil::AssembleRawHeaders("HTTP/1.1 200 OK\r\n"
-                                        "Content-Type: text/plain; UTF-8\r\n"
-                                        "Set-Cookie: custom/value\r\n"));
-
-  const std::vector<RequestAction>& actual_actions =
-      manager()->EvaluateRequest(request_1, false /*is_incognito_context*/);
-  ASSERT_EQ(2u, actual_actions.size());
-
-  // Removal of the cookie header should be attributed to |extension_2| because
-  // it was installed later than |extension_1| and thus has more priority.
-  RequestAction expected_action_1 = CreateRequestActionForTesting(
-      RequestActionType::REMOVE_HEADERS, kMinValidID, kDefaultPriority,
-      kMinValidStaticRulesetID, extension_2->id());
-  expected_action_1.request_headers_to_remove.push_back(
-      net::HttpRequestHeaders::kCookie);
-
-  // Removal of the referer header should be attributed to |extension_2|.
-  expected_action_1.request_headers_to_remove.push_back(
-      net::HttpRequestHeaders::kReferer);
-
-  RequestAction expected_action_2 = CreateRequestActionForTesting(
-      RequestActionType::REMOVE_HEADERS, kMinValidID, kDefaultPriority,
-      kMinValidStaticRulesetID, extension_1->id());
-  expected_action_2.response_headers_to_remove.push_back("set-cookie");
-
-  EXPECT_EQ(expected_action_1, actual_actions[0]);
-  EXPECT_EQ(expected_action_2, actual_actions[1]);
-}
-
 // Test that the correct modifyHeaders actions are returned for each extension.
 TEST_P(RulesetManagerTest, ModifyHeaders) {
   // TODO(crbug.com/947591): Remove the channel override once implementation of

diff --git a/chrome/browser/extensions/api/image_writer_private/image_writer_utility_client.cc b/chrome/browser/extensions/api/image_writer_private/image_writer_utility_client.cc
index 10c31bf44..ec41994 100644
--- a/chrome/browser/extensions/api/image_writer_private/image_writer_utility_client.cc
+++ b/chrome/browser/extensions/api/image_writer_private/image_writer_utility_client.cc

@@ -9,9 +9,9 @@
 #include "base/location.h"
 #include "base/optional.h"
 #include "build/build_config.h"
+#include "chrome/browser/service_sandbox_type.h"
 #include "chrome/grit/generated_resources.h"
 #include "content/public/browser/browser_thread.h"
-#include "content/public/browser/sandbox_type.h"
 #include "content/public/browser/service_process_host.h"
 #include "mojo/public/cpp/bindings/receiver.h"
 #include "ui/base/l10n/l10n_util.h"
@@ -158,17 +158,10 @@
   if (removable_storage_writer_)
     return;
 
-#if defined(OS_WIN)
-  constexpr auto kSandboxType =
-      service_manager::SandboxType::kNoSandboxAndElevatedPrivileges;
-#else
-  constexpr auto kSandboxType = service_manager::SandboxType::kNoSandbox;
-#endif
   content::ServiceProcessHost::Launch(
       removable_storage_writer_.BindNewPipeAndPassReceiver(),
       content::ServiceProcessHost::Options()
           .WithDisplayName(IDS_UTILITY_PROCESS_IMAGE_WRITER_NAME)
-          .WithSandboxType(kSandboxType)
           .Pass());
   removable_storage_writer_.set_disconnect_handler(
       base::BindOnce(&ImageWriterUtilityClient::OnConnectionError, this));

diff --git a/chrome/browser/extensions/api/terminal/terminal_private_api.cc b/chrome/browser/extensions/api/terminal/terminal_private_api.cc
index 4c9c5f5..74a047b 100644
--- a/chrome/browser/extensions/api/terminal/terminal_private_api.cc
+++ b/chrome/browser/extensions/api/terminal/terminal_private_api.cc

@@ -493,6 +493,14 @@
   chromeos::ProcessProxyRegistry::Get()->AckOutput(terminal_id);
 }
 
+TerminalPrivateOpenWindowFunction::~TerminalPrivateOpenWindowFunction() =
+    default;
+
+ExtensionFunction::ResponseAction TerminalPrivateOpenWindowFunction::Run() {
+  crostini::LaunchTerminal(Profile::FromBrowserContext(browser_context()));
+  return RespondNow(NoArguments());
+}
+
 TerminalPrivateOpenOptionsPageFunction::
     ~TerminalPrivateOpenOptionsPageFunction() = default;
 

diff --git a/chrome/browser/extensions/api/terminal/terminal_private_api.h b/chrome/browser/extensions/api/terminal/terminal_private_api.h
index a901f544..200111e 100644
--- a/chrome/browser/extensions/api/terminal/terminal_private_api.h
+++ b/chrome/browser/extensions/api/terminal/terminal_private_api.h

@@ -163,6 +163,17 @@
   void AckOutputOnRegistryTaskRunner(const std::string& terminal_id);
 };
 
+class TerminalPrivateOpenWindowFunction : public ExtensionFunction {
+ public:
+  DECLARE_EXTENSION_FUNCTION("terminalPrivate.openWindow",
+                             TERMINALPRIVATE_OPENWINDOW)
+
+ protected:
+  ~TerminalPrivateOpenWindowFunction() override;
+
+  ExtensionFunction::ResponseAction Run() override;
+};
+
 class TerminalPrivateOpenOptionsPageFunction : public ExtensionFunction {
  public:
   DECLARE_EXTENSION_FUNCTION("terminalPrivate.openOptionsPage",

diff --git a/chrome/browser/extensions/api/web_request/web_request_api_unittest.cc b/chrome/browser/extensions/api/web_request/web_request_api_unittest.cc
index d013a401..c0ad861dd 100644
--- a/chrome/browser/extensions/api/web_request/web_request_api_unittest.cc
+++ b/chrome/browser/extensions/api/web_request/web_request_api_unittest.cc

@@ -864,42 +864,6 @@
       HasIgnoredAction(ignored_actions, "extid2",
                        web_request::IGNORED_ACTION_TYPE_REQUEST_HEADERS));
   EXPECT_TRUE(request_headers_modified3);
-
-  // Check that headers removed by Declarative Net Request API can't be modified
-  // and result in a conflict.
-  ignored_actions.clear();
-  ignore1.clear();
-  ignore2.clear();
-  bool request_headers_modified4 = false;
-  net::HttpRequestHeaders headers4;
-  headers4.MergeFrom(base_headers);
-
-  DNRRequestAction remove_headers_action =
-      CreateRequestActionForTesting(DNRRequestAction::Type::REMOVE_HEADERS);
-  remove_headers_action.request_headers_to_remove = {"key5"};
-  info.dnr_actions = std::vector<DNRRequestAction>();
-  info.dnr_actions->push_back(std::move(remove_headers_action));
-  MergeOnBeforeSendHeadersResponses(info, deltas, &headers4, &ignored_actions,
-                                    &ignore1, &ignore2,
-                                    &request_headers_modified4);
-  // deleted by |d1|.
-  EXPECT_FALSE(headers4.HasHeader("key1"));
-  // Added by |d1|.
-  ASSERT_TRUE(headers4.GetHeader("key2", &header_value));
-  EXPECT_EQ("value 3", header_value);
-  // Removed by Declarative Net Request API.
-  EXPECT_FALSE(headers4.HasHeader("key5"));
-  EXPECT_EQ(2u, ignored_actions.size());
-  EXPECT_TRUE(
-      HasIgnoredAction(ignored_actions, "extid2",
-                       web_request::IGNORED_ACTION_TYPE_REQUEST_HEADERS));
-  EXPECT_TRUE(
-      HasIgnoredAction(ignored_actions, "extid2",
-                       web_request::IGNORED_ACTION_TYPE_REQUEST_HEADERS));
-  EXPECT_TRUE(
-      HasIgnoredAction(ignored_actions, "extid3",
-                       web_request::IGNORED_ACTION_TYPE_REQUEST_HEADERS));
-  EXPECT_TRUE(request_headers_modified4);
 }
 
 // Ensure conflicts between different extensions are handled correctly with
@@ -1345,38 +1309,6 @@
       HasIgnoredAction(ignored_actions, "extid2",
                        web_request::IGNORED_ACTION_TYPE_RESPONSE_HEADERS));
   EXPECT_TRUE(response_headers_modified2);
-
-  // Ensure headers removed by Declarative Net Request API can't be added by web
-  // request extensions and result in a conflict.
-  DNRRequestAction remove_headers_action =
-      CreateRequestActionForTesting(DNRRequestAction::Type::REMOVE_HEADERS);
-  remove_headers_action.response_headers_to_remove = {"key3"};
-  info.dnr_actions = std::vector<DNRRequestAction>();
-  info.dnr_actions->push_back(std::move(remove_headers_action));
-
-  ignored_actions.clear();
-  bool response_headers_modified3 = false;
-  scoped_refptr<net::HttpResponseHeaders> new_headers3;
-  GURL preserve_fragment_on_redirect_url3;
-  MergeOnHeadersReceivedResponses(
-      info, deltas, base_headers.get(), &new_headers3,
-      &preserve_fragment_on_redirect_url3, &ignored_actions,
-      &response_headers_modified3);
-  ASSERT_TRUE(new_headers3.get());
-  EXPECT_TRUE(preserve_fragment_on_redirect_url3.is_empty());
-  iter = 0;
-  std::multimap<std::string, std::string> actual3;
-  while (new_headers3->EnumerateHeaderLines(&iter, &name, &value))
-    actual3.emplace(name, value);
-  std::multimap<std::string, std::string> expected3;
-  expected3.emplace("Key2", "Value4");
-  expected3.emplace("Key1", "Value1");
-  EXPECT_EQ(expected3, actual3);
-  EXPECT_EQ(1u, ignored_actions.size());
-  EXPECT_TRUE(
-      HasIgnoredAction(ignored_actions, "extid1",
-                       web_request::IGNORED_ACTION_TYPE_RESPONSE_HEADERS));
-  EXPECT_TRUE(response_headers_modified3);
 }
 
 // Check that we do not delete too much

diff --git a/chrome/browser/flag-metadata.json b/chrome/browser/flag-metadata.json
index cff96bf..c34374fa 100644
--- a/chrome/browser/flag-metadata.json
+++ b/chrome/browser/flag-metadata.json

@@ -1353,6 +1353,11 @@
     "expiry_milestone": 85
   },
   {
+    "name": "enable-cros-ime-input-logic-mozc",
+    "owners": [ "essential-inputs-team@google.com" ],
+    "expiry_milestone": 86
+  },
+  {
     "name": "enable-cros-ime-mozc-proto",
     "owners": [ "essential-inputs-team@google.com" ],
     "expiry_milestone": 85
@@ -1674,6 +1679,11 @@
     "expiry_milestone": 83
   },
   {
+    "name": "enable-instant-start",
+    "owners": [ "hanxi", "wychen"],
+    "expiry_milestone": 90
+  },
+  {
     "name": "enable-javascript-harmony",
     "owners": [ "adamk", "hablich" ],
     // This flag is used by web developers to test upcoming javascript features.
@@ -3534,6 +3544,11 @@
     "expiry_milestone": 85
   },
   {
+    "name": "print-with-reduced-rasterization",
+    "owners": [ "thestig" ],
+    "expiry_milestone": 89
+  },
+  {
     "name": "printer-status",
     "owners": [ "gavinwill", "cros-peripherals@google.com" ],
     "expiry_milestone": 85

diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc
index 91ead99..1375ef0d 100644
--- a/chrome/browser/flag_descriptions.cc
+++ b/chrome/browser/flag_descriptions.cc

@@ -2382,7 +2382,8 @@
 
 const char kContextMenuCopyImageName[] = "Copy Image";
 const char kContextMenuCopyImageDescription[] =
-    "Enable copying image to system clipboard via context menu.";
+    "Enable copying image to system clipboard via context menu. Copy image is "
+    "not available for Android O.";
 
 const char kContextMenuPerformanceInfoName[] = "Context menu performance hints";
 const char kContextMenuPerformanceInfoDescription[] =
@@ -2501,6 +2502,10 @@
     "homepage URL through a radio button group, and add promo box on NTP "
     "if homepage is not enabled.";
 
+const char kInstantStartName[] = "Enable instant start";
+const char kInstantStartDescription[] =
+    "Show start surface before native library is loaded.";
+
 const char kIntentBlockExternalFormRedirectsNoGestureName[] =
     "Block intents from form submissions without user gesture";
 const char kIntentBlockExternalFormRedirectsNoGestureDescription[] =
@@ -3051,6 +3056,11 @@
     "later).";
 
 #if BUILDFLAG(ENABLE_PRINTING)
+const char kPrintWithReducedRasterizationName[] =
+    "Print with reduced rasterization";
+const char kPrintWithReducedRasterizationDescription[] =
+    "When using GDI printing, avoid rasterization if possible.";
+
 const char kUseXpsForPrintingName[] = "Use XPS for printing";
 const char kUseXpsForPrintingDescription[] =
     "When enabled, use XPS printing API instead of the GDI print API.";
@@ -3673,6 +3683,10 @@
 const char kImeInputLogicHmmDescription[] =
     "Enable HMM Input Logic to replace the IME legacy input logic on NaCl";
 
+const char kImeInputLogicMozcName[] = "Enable MOZC Input Logic on IME";
+const char kImeInputLogicMozcDescription[] =
+    "Enable MOZC Input Logic to replace the IME legacy input logic on NaCl";
+
 const char kImeMozcProtoName[] = "Enable protobuf on Japanese IME";
 const char kImeMozcProtoDescription[] =
     "Enable Japanese IME to use protobuf as interactive message format to "

diff --git a/chrome/browser/flag_descriptions.h b/chrome/browser/flag_descriptions.h
index cede3145..cd0e523 100644
--- a/chrome/browser/flag_descriptions.h
+++ b/chrome/browser/flag_descriptions.h

@@ -1464,6 +1464,9 @@
 extern const char kHomepageSettingsUIConversionName[];
 extern const char kHomepageSettingsUIConversionDescription[];
 
+extern const char kInstantStartName[];
+extern const char kInstantStartDescription[];
+
 extern const char kIntentBlockExternalFormRedirectsNoGestureName[];
 extern const char kIntentBlockExternalFormRedirectsNoGestureDescription[];
 
@@ -1763,6 +1766,9 @@
 extern const char kUseWinrtMidiApiDescription[];
 
 #if BUILDFLAG(ENABLE_PRINTING)
+extern const char kPrintWithReducedRasterizationName[];
+extern const char kPrintWithReducedRasterizationDescription[];
+
 extern const char kUseXpsForPrintingName[];
 extern const char kUseXpsForPrintingDescription[];
 
@@ -2153,6 +2159,9 @@
 extern const char kImeInputLogicHmmName[];
 extern const char kImeInputLogicHmmDescription[];
 
+extern const char kImeInputLogicMozcName[];
+extern const char kImeInputLogicMozcDescription[];
+
 extern const char kImeMozcProtoName[];
 extern const char kImeMozcProtoDescription[];
 

diff --git a/chrome/browser/net/profile_network_context_service.cc b/chrome/browser/net/profile_network_context_service.cc
index 68e3496c..7b49d17e 100644
--- a/chrome/browser/net/profile_network_context_service.cc
+++ b/chrome/browser/net/profile_network_context_service.cc

@@ -259,18 +259,14 @@
 
 ProfileNetworkContextService::~ProfileNetworkContextService() = default;
 
-mojo::Remote<network::mojom::NetworkContext>
-ProfileNetworkContextService::CreateNetworkContext(
+void ProfileNetworkContextService::ConfigureNetworkContextParams(
     bool in_memory,
-    const base::FilePath& relative_partition_path) {
-  mojo::Remote<network::mojom::NetworkContext> network_context;
-
-  content::GetNetworkService()->CreateNetworkContext(
-      network_context.BindNewPipeAndPassReceiver(),
-      CreateNetworkContextParams(in_memory, relative_partition_path));
-
-  network_context->SetSplitAuthCacheByNetworkIsolationKey(
-      ShouldSplitAuthCacheByNetworkIsolationKey());
+    const base::FilePath& relative_partition_path,
+    network::mojom::NetworkContextParams* network_context_params,
+    network::mojom::CertVerifierCreationParams* cert_verifier_creation_params) {
+  ConfigureNetworkContextParamsInternal(in_memory, relative_partition_path,
+                                        network_context_params,
+                                        cert_verifier_creation_params);
 
   if ((!in_memory && !profile_->IsOffTheRecord())) {
     // TODO(jam): delete this code 1 year after Network Service shipped to all
@@ -287,11 +283,6 @@
         base::BindOnce(base::IgnoreResult(&base::DeleteFile), media_cache_path,
                        true /* recursive */));
   }
-
-  std::vector<network::mojom::NetworkContext*> contexts{network_context.get()};
-  UpdateCTPolicyForContexts(contexts);
-
-  return network_context;
 }
 
 #if defined(OS_CHROMEOS)
@@ -384,8 +375,7 @@
           enable_referrers_.GetValue()));
 }
 
-void ProfileNetworkContextService::UpdateCTPolicyForContexts(
-    const std::vector<network::mojom::NetworkContext*>& contexts) {
+network::mojom::CTPolicyPtr ProfileNetworkContextService::GetCTPolicy() {
   auto* prefs = profile_->GetPrefs();
   const base::ListValue* ct_required =
       prefs->GetList(certificate_transparency::prefs::kCTRequiredHosts);
@@ -403,9 +393,15 @@
   std::vector<std::string> excluded_legacy_spkis(
       TranslateStringArray(ct_excluded_legacy_spkis));
 
+  return network::mojom::CTPolicy::New(std::move(required), std::move(excluded),
+                                       std::move(excluded_spkis),
+                                       std::move(excluded_legacy_spkis));
+}
+
+void ProfileNetworkContextService::UpdateCTPolicyForContexts(
+    const std::vector<network::mojom::NetworkContext*>& contexts) {
   for (auto* context : contexts) {
-    context->SetCTPolicy(required, excluded, excluded_spkis,
-                         excluded_legacy_spkis);
+    context->SetCTPolicy(GetCTPolicy());
   }
 }
 
@@ -614,27 +610,18 @@
          current_field_trial_status != previous_field_trial_status;
 }
 
-network::mojom::NetworkContextParamsPtr
-ProfileNetworkContextService::CreateNetworkContextParams(
+void ProfileNetworkContextService::ConfigureNetworkContextParamsInternal(
     bool in_memory,
-    const base::FilePath& relative_partition_path) {
+    const base::FilePath& relative_partition_path,
+    network::mojom::NetworkContextParams* network_context_params,
+    network::mojom::CertVerifierCreationParams* cert_verifier_creation_params) {
   if (profile_->IsOffTheRecord())
     in_memory = true;
   base::FilePath path(GetPartitionPath(relative_partition_path));
 
-  network::mojom::NetworkContextParamsPtr network_context_params =
-      g_browser_process->system_network_context_manager()
-          ->CreateDefaultNetworkContextParams();
-
-  network::mojom::CertVerifierCreationParamsPtr cert_verifier_creation_params;
-  // Grab the existing CertVerifierCreationParams, if any.
-  if (network_context_params->cert_verifier_creation_params) {
-    cert_verifier_creation_params =
-        std::move(network_context_params->cert_verifier_creation_params);
-  } else {
-    cert_verifier_creation_params =
-        network::mojom::CertVerifierCreationParams::New();
-  }
+  g_browser_process->system_network_context_manager()
+      ->ConfigureDefaultNetworkContextParams(network_context_params,
+                                             cert_verifier_creation_params);
 
   network_context_params->context_name = std::string("main");
 
@@ -743,11 +730,13 @@
       base::FeatureList::IsEnabled(features::kFtpProtocol);
 #endif  // !BUILDFLAG(DISABLE_FTP_SUPPORT)
 
-  proxy_config_monitor_.AddToNetworkContextParams(network_context_params.get());
+  proxy_config_monitor_.AddToNetworkContextParams(network_context_params);
 
   network_context_params->enable_certificate_reporting = true;
   network_context_params->enable_expect_ct_reporting = true;
 
+  network_context_params->ct_policy = GetCTPolicy();
+
 #if BUILDFLAG(TRIAL_COMPARISON_CERT_VERIFIER_SUPPORTED)
   // Require the use_builtin_cert_verifier to be explicitly initialized, as
   // using the TrialComparisonCertVerifier requires knowing whether Chrome is
@@ -845,10 +834,8 @@
   network_context_params->reset_http_cache_backend =
       GetHttpCacheBackendResetParam(g_browser_process->local_state());
 
-  network_context_params->cert_verifier_creation_params =
-      std::move(cert_verifier_creation_params);
-
-  return network_context_params;
+  network_context_params->split_auth_cache_by_network_isolation_key =
+      ShouldSplitAuthCacheByNetworkIsolationKey();
 }
 
 base::FilePath ProfileNetworkContextService::GetPartitionPath(

diff --git a/chrome/browser/net/profile_network_context_service.h b/chrome/browser/net/profile_network_context_service.h
index e0e6d16..be3bf57 100644
--- a/chrome/browser/net/profile_network_context_service.h
+++ b/chrome/browser/net/profile_network_context_service.h

@@ -59,12 +59,15 @@
   explicit ProfileNetworkContextService(Profile* profile);
   ~ProfileNetworkContextService() override;
 
-  // Creates a NetworkContext for the BrowserContext, using the specified
-  // parameters. An empty |relative_partition_path| corresponds to the main
-  // network context.
-  mojo::Remote<network::mojom::NetworkContext> CreateNetworkContext(
+  // Configures the NetworkContextParams and the CertVerifierCreationParams for
+  // the BrowserContext, using the specified parameters. An empty
+  // |relative_partition_path| corresponds to the main network context.
+  void ConfigureNetworkContextParams(
       bool in_memory,
-      const base::FilePath& relative_partition_path);
+      const base::FilePath& relative_partition_path,
+      network::mojom::NetworkContextParams* network_context_params,
+      network::mojom::CertVerifierCreationParams*
+          cert_verifier_creation_params);
 
 #if defined(OS_CHROMEOS)
   void UpdateAdditionalCertificates();
@@ -117,6 +120,9 @@
 
   void UpdateReferrersEnabled();
 
+  // Gets the current CTPolicy from preferences.
+  network::mojom::CTPolicyPtr GetCTPolicy();
+
   // Update the CTPolicy for the given NetworkContexts.
   void UpdateCTPolicyForContexts(
       const std::vector<network::mojom::NetworkContext*>& contexts);
@@ -135,9 +141,12 @@
   // Creates parameters for the NetworkContext. Use |in_memory| instead of
   // |profile_->IsOffTheRecord()| because sometimes normal profiles want off the
   // record partitions (e.g. for webview tag).
-  network::mojom::NetworkContextParamsPtr CreateNetworkContextParams(
+  void ConfigureNetworkContextParamsInternal(
       bool in_memory,
-      const base::FilePath& relative_partition_path);
+      const base::FilePath& relative_partition_path,
+      network::mojom::NetworkContextParams* network_context_params,
+      network::mojom::CertVerifierCreationParams*
+          cert_verifier_creation_params);
 
   // Returns the path for a given storage partition.
   base::FilePath GetPartitionPath(

diff --git a/chrome/browser/net/profile_network_context_service_browsertest.cc b/chrome/browser/net/profile_network_context_service_browsertest.cc
index 9e84615..5bd46dd 100644
--- a/chrome/browser/net/profile_network_context_service_browsertest.cc
+++ b/chrome/browser/net/profile_network_context_service_browsertest.cc

@@ -121,10 +121,12 @@
   ProfileNetworkContextService* profile_network_context_service =
       ProfileNetworkContextServiceFactory::GetForContext(browser()->profile());
   base::FilePath empty_relative_partition_path;
-  network::mojom::NetworkContextParamsPtr network_context_params_ptr =
-      profile_network_context_service->CreateNetworkContextParams(
-          /*in_memory=*/false, empty_relative_partition_path);
-  EXPECT_EQ(0, network_context_params_ptr->http_cache_max_size);
+  network::mojom::NetworkContextParams network_context_params;
+  network::mojom::CertVerifierCreationParams cert_verifier_creation_params;
+  profile_network_context_service->ConfigureNetworkContextParams(
+      /*in_memory=*/false, empty_relative_partition_path,
+      &network_context_params, &cert_verifier_creation_params);
+  EXPECT_EQ(0, network_context_params.http_cache_max_size);
 }
 
 IN_PROC_BROWSER_TEST_F(ProfileNetworkContextServiceBrowsertest, BrotliEnabled) {
@@ -429,10 +431,12 @@
   ProfileNetworkContextService* profile_network_context_service =
       ProfileNetworkContextServiceFactory::GetForContext(browser()->profile());
   base::FilePath empty_relative_partition_path;
-  network::mojom::NetworkContextParamsPtr network_context_params_ptr =
-      profile_network_context_service->CreateNetworkContextParams(
-          /*in_memory=*/false, empty_relative_partition_path);
-  EXPECT_EQ(kCacheSize, network_context_params_ptr->http_cache_max_size);
+  network::mojom::NetworkContextParams network_context_params;
+  network::mojom::CertVerifierCreationParams cert_verifier_creation_params;
+  profile_network_context_service->ConfigureNetworkContextParams(
+      /*in_memory=*/false, empty_relative_partition_path,
+      &network_context_params, &cert_verifier_creation_params);
+  EXPECT_EQ(kCacheSize, network_context_params.http_cache_max_size);
 }
 
 #if BUILDFLAG(BUILTIN_CERT_VERIFIER_FEATURE_SUPPORTED)
@@ -457,16 +461,19 @@
   ProfileNetworkContextService* profile_network_context_service =
       ProfileNetworkContextServiceFactory::GetForContext(browser()->profile());
   base::FilePath empty_relative_partition_path;
-  network::mojom::NetworkContextParamsPtr network_context_params_ptr =
-      profile_network_context_service->CreateNetworkContextParams(
-          /*in_memory=*/false, empty_relative_partition_path);
+  {
+    network::mojom::NetworkContextParams network_context_params;
+    network::mojom::CertVerifierCreationParams cert_verifier_creation_params;
+    profile_network_context_service->ConfigureNetworkContextParams(
+        /*in_memory=*/false, empty_relative_partition_path,
+        &network_context_params, &cert_verifier_creation_params);
 
-  EXPECT_EQ(GetParam() ? network::mojom::CertVerifierCreationParams::
-                             CertVerifierImpl::kBuiltin
-                       : network::mojom::CertVerifierCreationParams::
-                             CertVerifierImpl::kSystem,
-            network_context_params_ptr->cert_verifier_creation_params
-                ->use_builtin_cert_verifier);
+    EXPECT_EQ(GetParam() ? network::mojom::CertVerifierCreationParams::
+                               CertVerifierImpl::kBuiltin
+                         : network::mojom::CertVerifierCreationParams::
+                               CertVerifierImpl::kSystem,
+              cert_verifier_creation_params.use_builtin_cert_verifier);
+  }
 
 #if BUILDFLAG(BUILTIN_CERT_VERIFIER_POLICY_SUPPORTED)
   // If the BuiltinCertificateVerifierEnabled policy is set it should override
@@ -476,25 +483,31 @@
             std::make_unique<base::Value>(true));
   UpdateProviderPolicy(policies);
 
-  network_context_params_ptr =
-      profile_network_context_service->CreateNetworkContextParams(
-          /*in_memory=*/false, empty_relative_partition_path);
-  EXPECT_EQ(
-      network::mojom::CertVerifierCreationParams::CertVerifierImpl::kBuiltin,
-      network_context_params_ptr->cert_verifier_creation_params
-          ->use_builtin_cert_verifier);
+  {
+    network::mojom::NetworkContextParams network_context_params;
+    network::mojom::CertVerifierCreationParams cert_verifier_creation_params;
+    profile_network_context_service->ConfigureNetworkContextParams(
+        /*in_memory=*/false, empty_relative_partition_path,
+        &network_context_params, &cert_verifier_creation_params);
+    EXPECT_EQ(
+        network::mojom::CertVerifierCreationParams::CertVerifierImpl::kBuiltin,
+        cert_verifier_creation_params.use_builtin_cert_verifier);
+  }
 
   SetPolicy(&policies, policy::key::kBuiltinCertificateVerifierEnabled,
             std::make_unique<base::Value>(false));
   UpdateProviderPolicy(policies);
 
-  network_context_params_ptr =
-      profile_network_context_service->CreateNetworkContextParams(
-          /*in_memory=*/false, empty_relative_partition_path);
-  EXPECT_EQ(
-      network::mojom::CertVerifierCreationParams::CertVerifierImpl::kSystem,
-      network_context_params_ptr->cert_verifier_creation_params
-          ->use_builtin_cert_verifier);
+  {
+    network::mojom::NetworkContextParams network_context_params;
+    network::mojom::CertVerifierCreationParams cert_verifier_creation_params;
+    profile_network_context_service->ConfigureNetworkContextParams(
+        /*in_memory=*/false, empty_relative_partition_path,
+        &network_context_params, &cert_verifier_creation_params);
+    EXPECT_EQ(
+        network::mojom::CertVerifierCreationParams::CertVerifierImpl::kSystem,
+        cert_verifier_creation_params.use_builtin_cert_verifier);
+  }
 #endif  // BUILDFLAG(BUILTIN_CERT_VERIFIER_POLICY_SUPPORTED)
 }
 

diff --git a/chrome/browser/net/profile_network_context_service_test_utils.cc b/chrome/browser/net/profile_network_context_service_test_utils.cc
index b768aac..0e850e4 100644
--- a/chrome/browser/net/profile_network_context_service_test_utils.cc
+++ b/chrome/browser/net/profile_network_context_service_test_utils.cc

@@ -17,6 +17,7 @@
 #include "chrome/common/chrome_features.h"
 #include "chrome/test/base/search_test_utils.h"
 #include "chrome/test/base/ui_test_utils.h"
+#include "services/network/public/mojom/network_context.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 enum class AmbientAuthProfileBit {
@@ -80,10 +81,12 @@
   ProfileNetworkContextService* profile_network_context_service =
       ProfileNetworkContextServiceFactory::GetForContext(profile);
   base::FilePath empty_relative_partition_path;
-  network::mojom::NetworkContextParamsPtr network_context_params_ptr =
-      profile_network_context_service->CreateNetworkContextParams(
-          /*in_memory=*/false, empty_relative_partition_path);
-  return network_context_params_ptr->http_auth_static_network_context_params
+  network::mojom::NetworkContextParams network_context_params;
+  network::mojom::CertVerifierCreationParams cert_verifier_creation_params;
+  profile_network_context_service->ConfigureNetworkContextParams(
+      /*in_memory=*/false, empty_relative_partition_path,
+      &network_context_params, &cert_verifier_creation_params);
+  return network_context_params.http_auth_static_network_context_params
              ->allow_default_credentials ==
          net::HttpAuthPreferences::ALLOW_DEFAULT_CREDENTIALS;
 }

diff --git a/chrome/browser/net/secure_dns_policy_handler.cc b/chrome/browser/net/secure_dns_policy_handler.cc
index 30286ec..cb94aec7 100644
--- a/chrome/browser/net/secure_dns_policy_handler.cc
+++ b/chrome/browser/net/secure_dns_policy_handler.cc

@@ -9,8 +9,8 @@
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_piece.h"
 #include "base/values.h"
-#include "chrome/browser/net/dns_util.h"
 #include "chrome/browser/net/secure_dns_config.h"
+#include "chrome/browser/net/secure_dns_util.h"
 #include "chrome/browser/prefs/session_startup_pref.h"
 #include "chrome/common/pref_names.h"
 #include "components/policy/core/browser/policy_error_map.h"
@@ -77,7 +77,7 @@
                mode_str == SecureDnsConfig::kModeOff) {
       errors->AddError(key::kDnsOverHttpsTemplates,
                        IDS_POLICY_SECURE_DNS_TEMPLATES_IRRELEVANT_MODE_ERROR);
-    } else if (!chrome_browser_net::IsValidDohTemplateGroup(templates_str)) {
+    } else if (!chrome_browser_net::secure_dns::IsValidGroup(templates_str)) {
       errors->AddError(key::kDnsOverHttpsTemplates,
                        IDS_POLICY_SECURE_DNS_TEMPLATES_INVALID_ERROR);
     }

diff --git a/chrome/browser/net/dns_util.cc b/chrome/browser/net/secure_dns_util.cc
similarity index 86%
rename from chrome/browser/net/dns_util.cc
rename to chrome/browser/net/secure_dns_util.cc
index 47ef9f0..e1c342e3 100644
--- a/chrome/browser/net/dns_util.cc
+++ b/chrome/browser/net/secure_dns_util.cc

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/net/dns_util.h"
+#include "chrome/browser/net/secure_dns_util.h"
 
 #include <algorithm>
 #include <string>
@@ -20,17 +20,19 @@
 
 namespace chrome_browser_net {
 
+namespace secure_dns {
+
 namespace {
 
 const char kAlternateErrorPagesBackup[] = "alternate_error_pages.backup";
 
 }  // namespace
 
-void RegisterDNSProbesSettingBackupPref(PrefRegistrySimple* registry) {
+void RegisterProbesSettingBackupPref(PrefRegistrySimple* registry) {
   registry->RegisterBooleanPref(kAlternateErrorPagesBackup, true);
 }
 
-void MigrateDNSProbesSettingToOrFromBackup(PrefService* prefs) {
+void MigrateProbesSettingToOrFromBackup(PrefService* prefs) {
   // If the privacy settings redesign is enabled and the user value of the
   // preference hasn't been backed up yet, back it up, and clear it. That way,
   // the preference will revert to using the hardcoded default value (unless
@@ -66,23 +68,23 @@
   }
 }
 
-std::vector<base::StringPiece> SplitDohTemplateGroup(base::StringPiece group) {
+std::vector<base::StringPiece> SplitGroup(base::StringPiece group) {
   // Templates in a group are whitespace-separated.
   return SplitStringPiece(group, " ", base::TRIM_WHITESPACE,
                           base::SPLIT_WANT_NONEMPTY);
 }
 
-bool IsValidDohTemplateGroup(base::StringPiece group) {
+bool IsValidGroup(base::StringPiece group) {
   // All templates must be valid for the group to be considered valid.
-  std::vector<base::StringPiece> templates = SplitDohTemplateGroup(group);
+  std::vector<base::StringPiece> templates = SplitGroup(group);
   return std::all_of(templates.begin(), templates.end(), [](auto t) {
     std::string method;
     return net::dns_util::IsValidDohTemplate(t, &method);
   });
 }
 
-void ApplyDohTemplate(net::DnsConfigOverrides* overrides,
-                      base::StringPiece server_template) {
+void ApplyTemplate(net::DnsConfigOverrides* overrides,
+                   base::StringPiece server_template) {
   std::string server_method;
   // We only allow use of templates that have already passed a format
   // validation check.
@@ -91,4 +93,6 @@
       std::string(server_template), server_method == "POST")});
 }
 
+}  // namespace secure_dns
+
 }  // namespace chrome_browser_net

diff --git a/chrome/browser/net/dns_util.h b/chrome/browser/net/secure_dns_util.h
similarity index 68%
rename from chrome/browser/net/dns_util.h
rename to chrome/browser/net/secure_dns_util.h
index b7e11c1..98ec18f 100644
--- a/chrome/browser/net/dns_util.h
+++ b/chrome/browser/net/secure_dns_util.h

@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CHROME_BROWSER_NET_DNS_UTIL_H_
-#define CHROME_BROWSER_NET_DNS_UTIL_H_
+#ifndef CHROME_BROWSER_NET_SECURE_DNS_UTIL_H_
+#define CHROME_BROWSER_NET_SECURE_DNS_UTIL_H_
 
 #include <vector>
 
@@ -18,30 +18,34 @@
 
 namespace chrome_browser_net {
 
+namespace secure_dns {
+
 // Implements the whitespace-delimited group syntax for DoH templates.
-std::vector<base::StringPiece> SplitDohTemplateGroup(base::StringPiece group);
+std::vector<base::StringPiece> SplitGroup(base::StringPiece group);
 
 // Returns true if a group of templates are all valid per
 // net::dns_util::IsValidDohTemplate().  This should be checked before updating
 // stored preferences.
-bool IsValidDohTemplateGroup(base::StringPiece group);
+bool IsValidGroup(base::StringPiece group);
 
 // Modifies |overrides| to use the DoH server specified by |server_template|.
-void ApplyDohTemplate(net::DnsConfigOverrides* overrides,
-                      base::StringPiece server_template);
+void ApplyTemplate(net::DnsConfigOverrides* overrides,
+                   base::StringPiece server_template);
 
 // Registers the backup preference required for the DNS probes setting reset.
 // TODO(crbug.com/1062698): Remove this once the privacy settings redesign
 // is fully launched.
-void RegisterDNSProbesSettingBackupPref(PrefRegistrySimple* registry);
+void RegisterProbesSettingBackupPref(PrefRegistrySimple* registry);
 
 // Backs up the unneeded preference controlling DNS and captive portal probes
 // once the privacy settings redesign is enabled, or restores the backup
 // in case the feature is rolled back.
 // TODO(crbug.com/1062698): Remove this once the privacy settings redesign
 // is fully launched.
-void MigrateDNSProbesSettingToOrFromBackup(PrefService* prefs);
+void MigrateProbesSettingToOrFromBackup(PrefService* prefs);
+
+}  // namespace secure_dns
 
 }  // namespace chrome_browser_net
 
-#endif  // CHROME_BROWSER_NET_DNS_UTIL_H_
+#endif  // CHROME_BROWSER_NET_SECURE_DNS_UTIL_H_

diff --git a/chrome/browser/net/dns_util_unittest.cc b/chrome/browser/net/secure_dns_util_unittest.cc
similarity index 79%
rename from chrome/browser/net/dns_util_unittest.cc
rename to chrome/browser/net/secure_dns_util_unittest.cc
index 29947b67..d99da3b6 100644
--- a/chrome/browser/net/dns_util_unittest.cc
+++ b/chrome/browser/net/secure_dns_util_unittest.cc

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/net/dns_util.h"
+#include "chrome/browser/net/secure_dns_util.h"
 
 #include <memory>
 
@@ -25,6 +25,8 @@
 
 }  // namespace
 
+namespace secure_dns {
+
 class DNSUtilTest : public testing::Test {
  public:
   void SetUp() override { DisableRedesign(); }
@@ -41,7 +43,7 @@
   base::test::ScopedFeatureList scoped_feature_list_;
 };
 
-TEST_F(DNSUtilTest, MigrateDNSProbesPref) {
+TEST_F(DNSUtilTest, MigrateProbesPref) {
   TestingPrefServiceSimple prefs;
   prefs.registry()->RegisterBooleanPref(
       embedder_support::kAlternateErrorPagesEnabled, true);
@@ -53,19 +55,19 @@
       prefs.FindPreference(kAlternateErrorPagesBackup);
 
   // No migration happens if the privacy settings redesign is not enabled.
-  MigrateDNSProbesSettingToOrFromBackup(&prefs);
+  MigrateProbesSettingToOrFromBackup(&prefs);
   EXPECT_FALSE(backup_pref->HasUserSetting());
 
   // The hardcoded default value of TRUE gets correctly migrated.
   EnableRedesign();
-  MigrateDNSProbesSettingToOrFromBackup(&prefs);
+  MigrateProbesSettingToOrFromBackup(&prefs);
   EXPECT_FALSE(current_pref->HasUserSetting());
   EXPECT_TRUE(backup_pref->HasUserSetting());
   EXPECT_TRUE(prefs.GetBoolean(kAlternateErrorPagesBackup));
 
   // And correctly restored.
   DisableRedesign();
-  MigrateDNSProbesSettingToOrFromBackup(&prefs);
+  MigrateProbesSettingToOrFromBackup(&prefs);
   EXPECT_TRUE(current_pref->HasUserSetting());
   EXPECT_TRUE(prefs.GetBoolean(embedder_support::kAlternateErrorPagesEnabled));
   EXPECT_FALSE(backup_pref->HasUserSetting());
@@ -73,14 +75,14 @@
   // An explicit user value of TRUE will be correctly migrated.
   EnableRedesign();
   prefs.SetBoolean(embedder_support::kAlternateErrorPagesEnabled, true);
-  MigrateDNSProbesSettingToOrFromBackup(&prefs);
+  MigrateProbesSettingToOrFromBackup(&prefs);
   EXPECT_FALSE(current_pref->HasUserSetting());
   EXPECT_TRUE(backup_pref->HasUserSetting());
   EXPECT_TRUE(prefs.GetBoolean(kAlternateErrorPagesBackup));
 
   // And correctly restored.
   DisableRedesign();
-  MigrateDNSProbesSettingToOrFromBackup(&prefs);
+  MigrateProbesSettingToOrFromBackup(&prefs);
   EXPECT_TRUE(current_pref->HasUserSetting());
   EXPECT_TRUE(prefs.GetBoolean(embedder_support::kAlternateErrorPagesEnabled));
   EXPECT_FALSE(backup_pref->HasUserSetting());
@@ -88,14 +90,14 @@
   // An explicit user value of FALSE will also be correctly migrated.
   EnableRedesign();
   prefs.SetBoolean(embedder_support::kAlternateErrorPagesEnabled, false);
-  MigrateDNSProbesSettingToOrFromBackup(&prefs);
+  MigrateProbesSettingToOrFromBackup(&prefs);
   EXPECT_FALSE(current_pref->HasUserSetting());
   EXPECT_TRUE(backup_pref->HasUserSetting());
   EXPECT_FALSE(prefs.GetBoolean(kAlternateErrorPagesBackup));
 
   // And correctly restored.
   DisableRedesign();
-  MigrateDNSProbesSettingToOrFromBackup(&prefs);
+  MigrateProbesSettingToOrFromBackup(&prefs);
   EXPECT_TRUE(current_pref->HasUserSetting());
   EXPECT_FALSE(prefs.GetBoolean(embedder_support::kAlternateErrorPagesEnabled));
   EXPECT_FALSE(backup_pref->HasUserSetting());
@@ -106,14 +108,14 @@
   prefs.SetManagedPref(embedder_support::kAlternateErrorPagesEnabled,
                        std::make_unique<base::Value>(true));
   EnableRedesign();
-  MigrateDNSProbesSettingToOrFromBackup(&prefs);
+  MigrateProbesSettingToOrFromBackup(&prefs);
   EXPECT_FALSE(current_pref->HasUserSetting());
   EXPECT_TRUE(backup_pref->HasUserSetting());
   EXPECT_FALSE(prefs.GetBoolean(kAlternateErrorPagesBackup));
 
   // And correctly restored.
   DisableRedesign();
-  MigrateDNSProbesSettingToOrFromBackup(&prefs);
+  MigrateProbesSettingToOrFromBackup(&prefs);
   EXPECT_TRUE(current_pref->HasUserSetting());
   {
     const base::Value* user_pref =
@@ -130,14 +132,14 @@
   prefs.SetManagedPref(embedder_support::kAlternateErrorPagesEnabled,
                        std::make_unique<base::Value>(false));
   EnableRedesign();
-  MigrateDNSProbesSettingToOrFromBackup(&prefs);
+  MigrateProbesSettingToOrFromBackup(&prefs);
   EXPECT_FALSE(current_pref->HasUserSetting());
   EXPECT_TRUE(backup_pref->HasUserSetting());
   EXPECT_TRUE(prefs.GetBoolean(kAlternateErrorPagesBackup));
 
   // And correctly restored.
   DisableRedesign();
-  MigrateDNSProbesSettingToOrFromBackup(&prefs);
+  MigrateProbesSettingToOrFromBackup(&prefs);
   EXPECT_TRUE(current_pref->HasUserSetting());
   {
     const base::Value* user_pref =
@@ -148,28 +150,28 @@
   EXPECT_FALSE(backup_pref->HasUserSetting());
 }
 
-TEST(DNSUtil, SplitDohTemplateGroup) {
-  EXPECT_THAT(SplitDohTemplateGroup("a"), ElementsAre("a"));
-  EXPECT_THAT(SplitDohTemplateGroup("a b"), ElementsAre("a", "b"));
-  EXPECT_THAT(SplitDohTemplateGroup("a \tb\nc"), ElementsAre("a", "b\nc"));
-  EXPECT_THAT(SplitDohTemplateGroup(" \ta b\n"), ElementsAre("a", "b"));
+TEST(DNSUtil, SplitGroup) {
+  EXPECT_THAT(SplitGroup("a"), ElementsAre("a"));
+  EXPECT_THAT(SplitGroup("a b"), ElementsAre("a", "b"));
+  EXPECT_THAT(SplitGroup("a \tb\nc"), ElementsAre("a", "b\nc"));
+  EXPECT_THAT(SplitGroup(" \ta b\n"), ElementsAre("a", "b"));
 }
 
-TEST(DNSUtil, IsValidDohTemplateGroup) {
-  EXPECT_TRUE(IsValidDohTemplateGroup(""));
-  EXPECT_TRUE(IsValidDohTemplateGroup("https://valid"));
-  EXPECT_TRUE(IsValidDohTemplateGroup("https://valid https://valid2"));
+TEST(DNSUtil, IsValidGroup) {
+  EXPECT_TRUE(IsValidGroup(""));
+  EXPECT_TRUE(IsValidGroup("https://valid"));
+  EXPECT_TRUE(IsValidGroup("https://valid https://valid2"));
 
-  EXPECT_FALSE(IsValidDohTemplateGroup("https://valid invalid"));
-  EXPECT_FALSE(IsValidDohTemplateGroup("invalid https://valid"));
-  EXPECT_FALSE(IsValidDohTemplateGroup("invalid"));
-  EXPECT_FALSE(IsValidDohTemplateGroup("invalid invalid2"));
+  EXPECT_FALSE(IsValidGroup("https://valid invalid"));
+  EXPECT_FALSE(IsValidGroup("invalid https://valid"));
+  EXPECT_FALSE(IsValidGroup("invalid"));
+  EXPECT_FALSE(IsValidGroup("invalid invalid2"));
 }
 
 TEST(DNSUtil, ApplyDohTemplatePost) {
   std::string post_template("https://valid");
   net::DnsConfigOverrides overrides;
-  ApplyDohTemplate(&overrides, post_template);
+  ApplyTemplate(&overrides, post_template);
 
   EXPECT_THAT(overrides.dns_over_https_servers,
               testing::Optional(ElementsAre(net::DnsOverHttpsServerConfig(
@@ -179,11 +181,13 @@
 TEST(DNSUtil, ApplyDohTemplateGet) {
   std::string get_template("https://valid/{?dns}");
   net::DnsConfigOverrides overrides;
-  ApplyDohTemplate(&overrides, get_template);
+  ApplyTemplate(&overrides, get_template);
 
   EXPECT_THAT(overrides.dns_over_https_servers,
               testing::Optional(ElementsAre(net::DnsOverHttpsServerConfig(
                   {get_template, false /* use_post */}))));
 }
 
+}  // namespace secure_dns
+
 }  // namespace chrome_browser_net

diff --git a/chrome/browser/net/stub_resolver_config_reader.cc b/chrome/browser/net/stub_resolver_config_reader.cc
index 36b9b571..37e70c0 100644
--- a/chrome/browser/net/stub_resolver_config_reader.cc
+++ b/chrome/browser/net/stub_resolver_config_reader.cc

@@ -21,8 +21,8 @@
 #include "base/values.h"
 #include "build/build_config.h"
 #include "chrome/browser/browser_process.h"
-#include "chrome/browser/net/dns_util.h"
 #include "chrome/browser/net/secure_dns_config.h"
+#include "chrome/browser/net/secure_dns_util.h"
 #include "chrome/browser/policy/chrome_browser_policy_connector.h"
 #include "chrome/common/chrome_features.h"
 #include "chrome/common/pref_names.h"
@@ -336,7 +336,7 @@
   if (!doh_templates.empty() &&
       secure_dns_mode != net::DnsConfig::SecureDnsMode::OFF) {
     for (base::StringPiece server_template :
-    chrome_browser_net::SplitDohTemplateGroup(doh_templates)) {
+         chrome_browser_net::secure_dns::SplitGroup(doh_templates)) {
       if (!net::dns_util::IsValidDohTemplate(server_template, &server_method)) {
         continue;
       }

diff --git a/chrome/browser/net/system_network_context_manager.cc b/chrome/browser/net/system_network_context_manager.cc
index 7debefff..bb3b12d 100644
--- a/chrome/browser/net/system_network_context_manager.cc
+++ b/chrome/browser/net/system_network_context_manager.cc

@@ -24,7 +24,6 @@
 #include "chrome/browser/component_updater/crl_set_component_installer.h"
 #include "chrome/browser/component_updater/tls_deprecation_config_component_installer.h"
 #include "chrome/browser/net/chrome_mojo_proxy_resolver_factory.h"
-#include "chrome/browser/net/dns_util.h"
 #include "chrome/browser/safe_browsing/safe_browsing_service.h"
 #include "chrome/browser/ssl/ssl_config_service_manager.h"
 #include "chrome/common/channel_info.h"
@@ -65,6 +64,7 @@
 #include "services/network/public/cpp/cross_thread_pending_shared_url_loader_factory.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
+#include "services/network/public/mojom/network_context.mojom.h"
 #include "services/proxy_resolver/public/mojom/proxy_resolver.mojom.h"
 #include "third_party/blink/public/common/features.h"
 #include "url/gurl.h"
@@ -536,13 +536,12 @@
       network_context_params);
 }
 
-network::mojom::NetworkContextParamsPtr
-SystemNetworkContextManager::CreateDefaultNetworkContextParams() {
-  network::mojom::NetworkContextParamsPtr network_context_params =
-      network::mojom::NetworkContextParams::New();
-  content::UpdateCorsExemptHeader(network_context_params.get());
-  variations::UpdateCorsExemptHeaderForVariations(network_context_params.get());
-  GoogleURLLoaderThrottle::UpdateCorsExemptHeader(network_context_params.get());
+void SystemNetworkContextManager::ConfigureDefaultNetworkContextParams(
+    network::mojom::NetworkContextParams* network_context_params,
+    network::mojom::CertVerifierCreationParams* cert_verifier_creation_params) {
+  content::UpdateCorsExemptHeader(network_context_params);
+  variations::UpdateCorsExemptHeaderForVariations(network_context_params);
+  GoogleURLLoaderThrottle::UpdateCorsExemptHeader(network_context_params);
 
   network_context_params->enable_brotli = true;
 
@@ -596,7 +595,7 @@
   // configuration. The SystemNetworkContextManager is owned by the
   // BrowserProcess itself, so will only be destroyed on shutdown, at which
   // point, all NetworkContexts will be destroyed as well.
-  AddSSLConfigToNetworkContextParams(network_context_params.get());
+  AddSSLConfigToNetworkContextParams(network_context_params);
 
 #if !defined(OS_ANDROID)
 
@@ -631,19 +630,26 @@
   }
 #endif
 
-  network_context_params->cert_verifier_creation_params =
-      network::mojom::CertVerifierCreationParams::New();
-
 #if BUILDFLAG(BUILTIN_CERT_VERIFIER_FEATURE_SUPPORTED)
-  network_context_params->cert_verifier_creation_params
-      ->use_builtin_cert_verifier =
+  cert_verifier_creation_params->use_builtin_cert_verifier =
       ShouldUseBuiltinCertVerifier(local_state_)
           ? network::mojom::CertVerifierCreationParams::CertVerifierImpl::
                 kBuiltin
           : network::mojom::CertVerifierCreationParams::CertVerifierImpl::
                 kSystem;
 #endif
+}
 
+network::mojom::NetworkContextParamsPtr
+SystemNetworkContextManager::CreateDefaultNetworkContextParams() {
+  network::mojom::NetworkContextParamsPtr network_context_params =
+      network::mojom::NetworkContextParams::New();
+  network::mojom::CertVerifierCreationParamsPtr cert_verifier_creation_params =
+      network::mojom::CertVerifierCreationParams::New();
+  ConfigureDefaultNetworkContextParams(network_context_params.get(),
+                                       cert_verifier_creation_params.get());
+  network_context_params->cert_verifier_creation_params =
+      std::move(cert_verifier_creation_params);
   return network_context_params;
 }
 

diff --git a/chrome/browser/net/system_network_context_manager.h b/chrome/browser/net/system_network_context_manager.h
index 755ef5a..38ddec6 100644
--- a/chrome/browser/net/system_network_context_manager.h
+++ b/chrome/browser/net/system_network_context_manager.h

@@ -12,7 +12,6 @@
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/optional.h"
-#include "chrome/browser/net/dns_util.h"
 #include "chrome/browser/net/proxy_config_monitor.h"
 #include "chrome/browser/net/stub_resolver_config_reader.h"
 #include "components/prefs/pref_change_registrar.h"
@@ -118,7 +117,15 @@
   void AddSSLConfigToNetworkContextParams(
       network::mojom::NetworkContextParams* network_context_params);
 
-  // Returns default set of parameters for configuring the network service.
+  // Configures default set of parameters for configuring the network context.
+  void ConfigureDefaultNetworkContextParams(
+      network::mojom::NetworkContextParams* network_context_params,
+      network::mojom::CertVerifierCreationParams*
+          cert_verifier_creation_params);
+
+  // Same as ConfigureDefaultNetworkContextParams() but returns a newly
+  // allocated network::mojom::NetworkContextParams with the
+  // CertVerifierCreationParams already placed into the NetworkContextParams.
   network::mojom::NetworkContextParamsPtr CreateDefaultNetworkContextParams();
 
   // Returns a shared global NetExportFileWriter instance, used by net-export.

diff --git a/chrome/browser/optimization_guide/prediction/prediction_manager.cc b/chrome/browser/optimization_guide/prediction/prediction_manager.cc
index ef83b35..38c8ea2 100644
--- a/chrome/browser/optimization_guide/prediction/prediction_manager.cc
+++ b/chrome/browser/optimization_guide/prediction/prediction_manager.cc

@@ -622,6 +622,11 @@
     if (ProcessAndStorePredictionModel(model)) {
       prediction_model_update_data->CopyPredictionModelIntoUpdateData(model);
       models_to_store = true;
+      base::UmaHistogramSparse(
+          "OptimizationGuide.PredictionModelUpdateVersion." +
+              GetStringNameForOptimizationTarget(
+                  model.model_info().optimization_target()),
+          model.model_info().version());
     }
   }
   if (models_to_store) {
@@ -734,7 +739,7 @@
     return;
 
   if (ProcessAndStorePredictionModel(*model)) {
-    base::UmaHistogramSparse("OptimizationGuide.PredictionModelVersion." +
+    base::UmaHistogramSparse("OptimizationGuide.PredictionModelLoadedVersion." +
                                  GetStringNameForOptimizationTarget(
                                      model->model_info().optimization_target()),
                              model->model_info().version());

diff --git a/chrome/browser/optimization_guide/prediction/prediction_manager_browsertest.cc b/chrome/browser/optimization_guide/prediction/prediction_manager_browsertest.cc
index 6fbb06e..2cbc4ffc 100644
--- a/chrome/browser/optimization_guide/prediction/prediction_manager_browsertest.cc
+++ b/chrome/browser/optimization_guide/prediction/prediction_manager_browsertest.cc

@@ -434,6 +434,8 @@
       "OptimizationGuide.PredictionManager.HostModelFeaturesStored", true, 1);
   histogram_tester.ExpectTotalCount(
       "OptimizationGuide.PredictionManager.PredictionModelsStored", 0);
+  histogram_tester.ExpectTotalCount(
+      "OptimizationGuide.PredictionModelUpdateVersion.PainfulPageLoad", 0);
 }
 
 IN_PROC_BROWSER_TEST_F(
@@ -453,6 +455,8 @@
       "OptimizationGuide.PredictionManager.HostModelFeaturesStored", true, 1);
   histogram_tester.ExpectUniqueSample(
       "OptimizationGuide.PredictionManager.PredictionModelsStored", true, 1);
+  histogram_tester.ExpectUniqueSample(
+      "OptimizationGuide.PredictionModelUpdateVersion.PainfulPageLoad", 2, 1);
 }
 
 IN_PROC_BROWSER_TEST_F(
@@ -477,6 +481,8 @@
       "OptimizationGuide.PredictionManager.HostModelFeaturesStored", 0);
   histogram_tester.ExpectTotalCount(
       "OptimizationGuide.PredictionManager.PredictionModelsStored", 0);
+  histogram_tester.ExpectTotalCount(
+      "OptimizationGuide.PredictionModelUpdateVersion.PainfulPageLoad", 0);
 }
 
 IN_PROC_BROWSER_TEST_F(

diff --git a/chrome/browser/optimization_guide/prediction/prediction_manager_unittest.cc b/chrome/browser/optimization_guide/prediction/prediction_manager_unittest.cc
index 1e4ec5e..782d94b 100644
--- a/chrome/browser/optimization_guide/prediction/prediction_manager_unittest.cc
+++ b/chrome/browser/optimization_guide/prediction/prediction_manager_unittest.cc

@@ -711,6 +711,8 @@
 
   histogram_tester.ExpectTotalCount(
       "OptimizationGuide.PredictionModelValidationLatency", 0);
+  histogram_tester.ExpectTotalCount(
+      "OptimizationGuide.PredictionModelUpdatedVersion.PainfulPageLoad", 0);
 }
 
 TEST_F(PredictionManagerTest, UpdateModelWithSameVersion) {
@@ -733,6 +735,8 @@
       get_models_response.get());
   histogram_tester.ExpectUniqueSample(
       "OptimizationGuide.PredictionManager.PredictionModelsStored", true, 1);
+  histogram_tester.ExpectUniqueSample(
+      "OptimizationGuide.PredictionModelUpdateVersion.PainfulPageLoad", 3, 1);
 
   get_models_response =
       BuildGetModelsResponse({} /* hosts */, {} /* client features */);
@@ -1053,7 +1057,7 @@
       PredictionManagerModelStatus::kStoreAvailableModelNotLoaded, 1);
 
   histogram_tester.ExpectTotalCount(
-      "OptimizationGuide.PredictionModelVersion.PainfulPageLoad", 0);
+      "OptimizationGuide.PredictionModelLoadedVersion.PainfulPageLoad", 0);
 }
 
 TEST_F(PredictionManagerTest,
@@ -1597,7 +1601,7 @@
 
   EXPECT_FALSE(prediction_model_fetcher()->models_fetched());
   histogram_tester.ExpectUniqueSample(
-      "OptimizationGuide.PredictionModelVersion.PainfulPageLoad", 1, 1);
+      "OptimizationGuide.PredictionModelLoadedVersion.PainfulPageLoad", 1, 1);
 }
 
 TEST_F(PredictionManagerTest,
@@ -1623,7 +1627,7 @@
 
   EXPECT_FALSE(prediction_model_fetcher()->models_fetched());
   histogram_tester.ExpectUniqueSample(
-      "OptimizationGuide.PredictionModelVersion.PainfulPageLoad", 1, 1);
+      "OptimizationGuide.PredictionModelLoadedVersion.PainfulPageLoad", 1, 1);
 }
 
 TEST_F(PredictionManagerTest, ModelFetcherTimerRetryDelay) {

diff --git a/chrome/browser/prefs/browser_prefs.cc b/chrome/browser/prefs/browser_prefs.cc
index 472c527..fd6b0ca 100644
--- a/chrome/browser/prefs/browser_prefs.cc
+++ b/chrome/browser/prefs/browser_prefs.cc

@@ -39,10 +39,10 @@
 #include "chrome/browser/media/webrtc/system_media_capture_permissions_stats_mac.h"
 #include "chrome/browser/memory/enterprise_memory_limit_pref_observer.h"
 #include "chrome/browser/metrics/chrome_metrics_service_client.h"
-#include "chrome/browser/net/dns_util.h"
 #include "chrome/browser/net/net_error_tab_helper.h"
 #include "chrome/browser/net/prediction_options.h"
 #include "chrome/browser/net/profile_network_context_service.h"
+#include "chrome/browser/net/secure_dns_util.h"
 #include "chrome/browser/net/system_network_context_manager.h"
 #include "chrome/browser/notifications/notification_channels_provider_android.h"
 #include "chrome/browser/notifications/notification_display_service_impl.h"
@@ -632,7 +632,7 @@
   registry->RegisterStringPref(kInvalidatorInvalidationState, std::string());
   registry->RegisterStringPref(kInvalidatorClientId, std::string());
 
-  chrome_browser_net::RegisterDNSProbesSettingBackupPref(registry);
+  chrome_browser_net::secure_dns::RegisterProbesSettingBackupPref(registry);
 
 #if defined(OS_CHROMEOS)
   registry->RegisterIntegerPref(kAmbientModeTopicSource, 0);
@@ -1249,7 +1249,8 @@
 
   // Added 3/2020.
   profile_prefs->ClearPref(kDataReductionNetworkProperties);
-  chrome_browser_net::MigrateDNSProbesSettingToOrFromBackup(profile_prefs);
+  chrome_browser_net::secure_dns::MigrateProbesSettingToOrFromBackup(
+      profile_prefs);
 
 #if defined(OS_CHROMEOS)
   // Added 4/2020.

diff --git a/chrome/browser/profiles/profile.cc b/chrome/browser/profiles/profile.cc
index b129d7b..e158259 100644
--- a/chrome/browser/profiles/profile.cc
+++ b/chrome/browser/profiles/profile.cc

@@ -396,11 +396,15 @@
   return false;
 }
 
-mojo::Remote<network::mojom::NetworkContext> Profile::CreateNetworkContext(
+void Profile::ConfigureNetworkContextParams(
     bool in_memory,
-    const base::FilePath& relative_partition_path) {
-  return ProfileNetworkContextServiceFactory::GetForContext(this)
-      ->CreateNetworkContext(in_memory, relative_partition_path);
+    const base::FilePath& relative_partition_path,
+    network::mojom::NetworkContextParams* network_context_params,
+    network::mojom::CertVerifierCreationParams* cert_verifier_creation_params) {
+  ProfileNetworkContextServiceFactory::GetForContext(this)
+      ->ConfigureNetworkContextParams(in_memory, relative_partition_path,
+                                      network_context_params,
+                                      cert_verifier_creation_params);
 }
 
 bool Profile::IsNewProfile() {

diff --git a/chrome/browser/profiles/profile.h b/chrome/browser/profiles/profile.h
index 4ed0769..a48ead96 100644
--- a/chrome/browser/profiles/profile.h
+++ b/chrome/browser/profiles/profile.h

@@ -464,11 +464,15 @@
   virtual bool ShouldRestoreOldSessionCookies();
   virtual bool ShouldPersistSessionCookies();
 
-  // Creates NetworkContext for the specified isolated app (or for the profile
-  // itself, if |relative_path| is empty).
-  virtual mojo::Remote<network::mojom::NetworkContext> CreateNetworkContext(
+  // Configures NetworkContextParams and CertVerifierCreationParams for the
+  // specified isolated app (or for the profile itself, if |relative_path| is
+  // empty).
+  virtual void ConfigureNetworkContextParams(
       bool in_memory,
-      const base::FilePath& relative_partition_path);
+      const base::FilePath& relative_partition_path,
+      network::mojom::NetworkContextParams* network_context_params,
+      network::mojom::CertVerifierCreationParams*
+          cert_verifier_creation_params);
 
   // Stop sending accessibility events until ResumeAccessibilityEvents().
   // Calls to Pause nest; no events will be sent until the number of

diff --git a/chrome/browser/reputation/reputation_web_contents_observer.cc b/chrome/browser/reputation/reputation_web_contents_observer.cc
index 5718bb5..7c9b8e06 100644
--- a/chrome/browser/reputation/reputation_web_contents_observer.cc
+++ b/chrome/browser/reputation/reputation_web_contents_observer.cc

@@ -105,6 +105,14 @@
   RecordHeuristicsUKMData(result, navigation_source_id, action);
 }
 
+// Safety Tips does not use starts_active (since flagged sites are so rare to
+// begin with), so this function records the same metric as "SafetyTipShown",
+// but does so after the flag check, which may impact flag recording.
+void RecordPostFlagCheckHistogram(security_state::SafetyTipStatus status) {
+  UMA_HISTOGRAM_ENUMERATION("Security.SafetyTips.SafetyTipShown_AfterFlag",
+                            status);
+}
+
 }  // namespace
 
 ReputationWebContentsObserver::~ReputationWebContentsObserver() = default;
@@ -248,11 +256,13 @@
       ReputationService::Get(profile_)->OnUIDisabledFirstVisit(result.url);
     }
 
+    RecordPostFlagCheckHistogram(result.safety_tip_status);
     FinalizeReputationCheckWhenTipNotShown(record_ukm_if_tip_not_shown, result,
                                            navigation_source_id);
     return;
   }
 
+  RecordPostFlagCheckHistogram(result.safety_tip_status);
   ShowSafetyTipDialog(web_contents(), result.safety_tip_status, result.url,
                       result.suggested_url,
                       base::BindOnce(OnSafetyTipClosed, result,

diff --git a/chrome/browser/resources/chromeos/arc_graphics_tracing/arc_overview_tracing_ui.js b/chrome/browser/resources/chromeos/arc_graphics_tracing/arc_overview_tracing_ui.js
index 423a1cd..e2252f43 100644
--- a/chrome/browser/resources/chromeos/arc_graphics_tracing/arc_overview_tracing_ui.js
+++ b/chrome/browser/resources/chromeos/arc_graphics_tracing/arc_overview_tracing_ui.js

@@ -490,7 +490,7 @@
     maxValue: 10000,
     minValue: 0,
     name: 'watts',
-    scale: 1.0 / 1024,
+    scale: 1.0 / 1000,
     width: 1.0
   };
   for (i = 0; i < models.length; i++) {
@@ -535,6 +535,9 @@
   addDeltaView(parent, resolution, duration, true /* appView */);
   addFPSView(parent, resolution, duration, false /* appView */);
   addDeltaView(parent, resolution, duration, false /* appView */);
+  addPowerView(
+      parent, 'Package power constraint', resolution, duration,
+      13 /* eventType */);
   addPowerView(parent, 'CPU Power', resolution, duration, 10 /* eventType */);
   addPowerView(parent, 'GPU Power', resolution, duration, 11 /* eventType */);
   addPowerView(

diff --git a/chrome/browser/resources/chromeos/arc_graphics_tracing/arc_tracing_ui.js b/chrome/browser/resources/chromeos/arc_graphics_tracing/arc_tracing_ui.js
index 36c4dc11..ca63020e 100644
--- a/chrome/browser/resources/chromeos/arc_graphics_tracing/arc_tracing_ui.js
+++ b/chrome/browser/resources/chromeos/arc_graphics_tracing/arc_tracing_ui.js

@@ -267,6 +267,14 @@
     scale: 1.0,
     width: 1.0
   },
+  // kPackagePowerConstraint.
+  13: {
+    color: '#dd0050',
+    minRange: 0.0,
+    name: 'CPU package constraint milli-watts.',
+    scale: 1.0,
+    width: 1.0
+  },
 };
 
 /**

diff --git a/chrome/browser/resources/chromeos/camera/src/js/BUILD.gn b/chrome/browser/resources/chromeos/camera/src/js/BUILD.gn
index cf741cb..e6f18ba 100644
--- a/chrome/browser/resources/chromeos/camera/src/js/BUILD.gn
+++ b/chrome/browser/resources/chromeos/camera/src/js/BUILD.gn

@@ -110,7 +110,6 @@
   deps = [
     ":perf",
     ":type",
-    "views:view",
   ]
 }
 
@@ -140,6 +139,7 @@
 
 js_library("util") {
   deps = [
+    ":state",
     ":tooltip",
     ":type",
     "browser_proxy:browser_proxy",

diff --git a/chrome/browser/resources/chromeos/camera/src/js/main.js b/chrome/browser/resources/chromeos/camera/src/js/main.js
index 079d4c9..28063ff 100644
--- a/chrome/browser/resources/chromeos/camera/src/js/main.js
+++ b/chrome/browser/resources/chromeos/camera/src/js/main.js

@@ -20,7 +20,7 @@
 import {PerfEvent} from './perf.js';
 import * as state from './state.js';
 import * as tooltip from './tooltip.js';
-import {Mode} from './type.js';
+import {Mode, ViewName} from './type.js';
 import * as util from './util.js';
 import {Camera} from './views/camera.js';
 import {CameraIntent} from './views/camera_intent.js';
@@ -30,7 +30,7 @@
   MasterSettings,
   ResolutionSettings,
 } from './views/settings.js';
-import {View, ViewName} from './views/view.js';
+import {View} from './views/view.js';
 import {Warning} from './views/warning.js';
 
 /**

diff --git a/chrome/browser/resources/chromeos/camera/src/js/metrics.js b/chrome/browser/resources/chromeos/camera/src/js/metrics.js
index 1fe84dc..77a589dc 100644
--- a/chrome/browser/resources/chromeos/camera/src/js/metrics.js
+++ b/chrome/browser/resources/chromeos/camera/src/js/metrics.js

@@ -137,13 +137,27 @@
 };
 
 /**
+ * Types of different ways to trigger shutter button.
+ * @enum {string}
+ */
+export const ShutterType = {
+  UNKNOWN: 'unknown',
+  MOUSE: 'mouse',
+  KEYBOARD: 'keyboard',
+  TOUCH: 'touch',
+  VOLUME_KEY: 'volume-key',
+};
+
+/**
  * Sends capture type event.
  * @param {!Facing} facingMode Camera facing-mode of the capture.
  * @param {number} length Length of 1 minute buckets for captured video.
  * @param {!Resolution} resolution Capture resolution.
  * @param {!IntentResultType} intentResult
+ * @param {!ShutterType} shutterType
  */
-function sendCaptureEvent(facingMode, length, resolution, intentResult) {
+function sendCaptureEvent(
+    facingMode, length, resolution, intentResult, shutterType) {
   /**
    * @param {!Array<state.StateUnion>} states
    * @param {state.StateUnion=} cond
@@ -183,6 +197,7 @@
         [10, resolution.toString()],
         [11, condState([State.FPS_30, State.FPS_60], Mode.VIDEO, true)],
         [12, intentResult],
+        [21, shutterType],
       ]));
 }
 

diff --git a/chrome/browser/resources/chromeos/camera/src/js/mojo/chrome_helper.js b/chrome/browser/resources/chromeos/camera/src/js/mojo/chrome_helper.js
index 7827343..7e28f4b 100644
--- a/chrome/browser/resources/chromeos/camera/src/js/mojo/chrome_helper.js
+++ b/chrome/browser/resources/chromeos/camera/src/js/mojo/chrome_helper.js

@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-import {assertBoolean} from '../chrome_util.js';
-
 /**
  * The singleton instance of ChromeHelper. Initialized by the first
  * invocation of getInstance().
@@ -24,37 +22,33 @@
      * @type {!chromeosCamera.mojom.CameraAppHelperRemote}
      */
     this.remote_ = chromeosCamera.mojom.CameraAppHelper.getRemote();
-
-    /**
-     * Whether device is in tablet mode.
-     * @type {?boolean}
-     */
-    this.isTabletMode_ = null;
   }
 
   /**
    * Starts tablet mode monitor monitoring tablet mode state of device.
-   * @return {!Promise}
+   * @param {function(boolean)} onChange Callback called each time when tablet
+   *     mode state of device changes with boolean parameter indecating whether
+   *     device is entering tablet mode.
+   * @return {!Promise<boolean>} Resolved to initial state of whether device is
+   *     is in tablet mode.
    */
-  async initTabletModeMonitor() {
+  async initTabletModeMonitor(onChange) {
     const monitorCallbackRouter =
         new chromeosCamera.mojom.TabletModeMonitorCallbackRouter();
-    monitorCallbackRouter.update.addListener((tableMode) => {
-      this.isTabletMode_ = tableMode;
-    });
+    monitorCallbackRouter.update.addListener(onChange);
 
-    this.isTabletMode_ =
-        (await this.remote_.setTabletMonitor(
-             monitorCallbackRouter.$.bindNewPipeAndPassRemote()))
-            .isTabletMode;
+    return (await this.remote_.setTabletMonitor(
+                monitorCallbackRouter.$.bindNewPipeAndPassRemote()))
+        .isTabletMode;
   }
 
   /**
    * Checks if the device is under tablet mode currently.
-   * @return {boolean}
+   * @return {!Promise<boolean>}
    */
-  isTabletMode() {
-    return assertBoolean(this.isTabletMode_);
+  async isTabletMode() {
+    const {isTabletMode} = await this.remote_.isTabletMode();
+    return isTabletMode;
   }
 
   /**

diff --git a/chrome/browser/resources/chromeos/camera/src/js/nav.js b/chrome/browser/resources/chromeos/camera/src/js/nav.js
index b5c67215..273d67de 100644
--- a/chrome/browser/resources/chromeos/camera/src/js/nav.js
+++ b/chrome/browser/resources/chromeos/camera/src/js/nav.js

@@ -7,11 +7,11 @@
 import {DeviceOperator} from './mojo/device_operator.js';
 import * as state from './state.js';
 import * as toast from './toast.js';
+// eslint-disable-next-line no-unused-vars
+import {ViewName} from './type.js';
 import * as util from './util.js';
-import {
-  View,      // eslint-disable-line no-unused-vars
-  ViewName,  // eslint-disable-line no-unused-vars
-} from './views/view.js';
+// eslint-disable-next-line no-unused-vars
+import {View} from './views/view.js';
 
 /**
  * All views stacked in ascending z-order (DOM order) for navigation, and only

diff --git a/chrome/browser/resources/chromeos/camera/src/js/state.js b/chrome/browser/resources/chromeos/camera/src/js/state.js
index 7b0ea3b..13ea5bb 100644
--- a/chrome/browser/resources/chromeos/camera/src/js/state.js
+++ b/chrome/browser/resources/chromeos/camera/src/js/state.js

@@ -4,10 +4,11 @@
 
 import {assert} from './chrome_util.js';
 import {PerfEvent} from './perf.js';
-import {Mode} from './type.js';
-// eslint-disable-next-line no-unused-vars
-import {PerfInformation} from './type.js';
-import {ViewName} from './views/view.js';
+import {
+  Mode,
+  PerfInformation,  // eslint-disable-line no-unused-vars
+  ViewName,
+} from './type.js';
 
 /**
  * @enum {string}
@@ -43,6 +44,7 @@
   SQUARE_PREVIEW: 'square-preview',
   STREAMING: 'streaming',
   SUSPEND: 'suspend',
+  TABLET: 'tablet',
   TABLET_LANDSCAPE: 'tablet-landscape',
   TAB_NAVIGATION: 'tab-navigation',
   TAKING: 'taking',

diff --git a/chrome/browser/resources/chromeos/camera/src/js/type.js b/chrome/browser/resources/chromeos/camera/src/js/type.js
index 8d534f3..d0589bd3 100644
--- a/chrome/browser/resources/chromeos/camera/src/js/type.js
+++ b/chrome/browser/resources/chromeos/camera/src/js/type.js

@@ -99,6 +99,22 @@
   UNKNOWN: 'unknown',
 };
 
+/**
+ * @enum {string}
+ */
+export const ViewName = {
+  CAMERA: 'view-camera',
+  EXPERT_SETTINGS: 'view-expert-settings',
+  GRID_SETTINGS: 'view-grid-settings',
+  MESSAGE_DIALOG: 'view-message-dialog',
+  PHOTO_RESOLUTION_SETTINGS: 'view-photo-resolution-settings',
+  RESOLUTION_SETTINGS: 'view-resolution-settings',
+  SETTINGS: 'view-settings',
+  SPLASH: 'view-splash',
+  TIMER_SETTINGS: 'view-timer-settings',
+  VIDEO_RESOLUTION_SETTINGS: 'view-video-resolution-settings',
+  WARNING: 'view-warning',
+};
 
 // The types here are used only in jsdoc and are required to be explicitly
 // exported in order to be referenced by closure compiler.

diff --git a/chrome/browser/resources/chromeos/camera/src/js/util.js b/chrome/browser/resources/chromeos/camera/src/js/util.js
index 768d2a6b5..e5a2ce2b 100644
--- a/chrome/browser/resources/chromeos/camera/src/js/util.js
+++ b/chrome/browser/resources/chromeos/camera/src/js/util.js

@@ -3,9 +3,9 @@
 // found in the LICENSE file.
 
 import {browserProxy} from './browser_proxy/browser_proxy.js';
-import {ChromeHelper} from './mojo/chrome_helper.js';
+import * as state from './state.js';
 import * as tooltip from './tooltip.js';
-import {Resolution} from './type.js';
+import {Facing, Resolution} from './type.js';
 
 /**
  * Gets the clockwise rotation and flip that can orient a photo to its upright
@@ -331,11 +331,10 @@
 
 /**
  * Gets default facing according to device mode.
- * @return {!Promise<string>}
+ * @return {!Facing}
  */
-export async function getDefaultFacing() {
-  return await ChromeHelper.getInstance().isTabletMode() ? 'environment' :
-                                                           'user';
+export function getDefaultFacing() {
+  return state.get(state.State.TABLET) ? Facing.ENVIRONMENT : Facing.USER;
 }
 
 /**

diff --git a/chrome/browser/resources/chromeos/camera/src/js/views/camera.js b/chrome/browser/resources/chromeos/camera/src/js/views/camera.js
index 1458fac..6667c6a 100644
--- a/chrome/browser/resources/chromeos/camera/src/js/views/camera.js
+++ b/chrome/browser/resources/chromeos/camera/src/js/views/camera.js

@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 import {browserProxy} from '../browser_proxy/browser_proxy.js';
-import {assert} from '../chrome_util.js';
+import {assert, assertInstanceof} from '../chrome_util.js';
 import {
   PhotoConstraintsPreferrer,  // eslint-disable-line no-unused-vars
   VideoConstraintsPreferrer,  // eslint-disable-line no-unused-vars
@@ -24,6 +24,7 @@
 import {
   Facing,
   Mode,
+  ViewName,
 } from '../type.js';
 import * as util from '../util.js';
 
@@ -36,7 +37,7 @@
 import {Options} from './camera/options.js';
 import {Preview} from './camera/preview.js';
 import * as timertick from './camera/timertick.js';
-import {View, ViewName} from './view.js';
+import {View} from './view.js';
 
 /**
  * Thrown when app window suspended during stream reconfiguration.
@@ -145,6 +146,12 @@
     this.facingMode_ = Facing.UNKNOWN;
 
     /**
+     * @type {!metrics.ShutterType}
+     * @protected
+     */
+    this.shutterType_ = metrics.ShutterType.UNKNOWN;
+
+    /**
      * @type {boolean}
      * @private
      */
@@ -173,16 +180,33 @@
      */
     this.take_ = null;
 
+    /**
+     * Gets type of ways to trigger shutter from click event.
+     * @param {!MouseEvent} e
+     * @return {!metrics.ShutterType}
+     */
+    const getShutterType = (e) => {
+      if (e.clientX === 0 && e.clientY === 0) {
+        return metrics.ShutterType.KEYBOARD;
+      }
+      return e.sourceCapabilities && e.sourceCapabilities.firesTouchEvents ?
+          metrics.ShutterType.TOUCH :
+          metrics.ShutterType.MOUSE;
+    };
+
     document.querySelector('#start-takephoto')
-        .addEventListener('click', () => this.beginTake_());
+        .addEventListener('click', (e) => {
+          const mouseEvent = assertInstanceof(e, MouseEvent);
+          this.beginTake_(getShutterType(mouseEvent));
+        });
 
     document.querySelector('#stop-takephoto')
         .addEventListener('click', () => this.endTake_());
 
     const videoShutter = document.querySelector('#recordvideo');
-    videoShutter.addEventListener('click', () => {
+    videoShutter.addEventListener('click', (e) => {
       if (!state.get(state.State.TAKING)) {
-        this.beginTake_();
+        this.beginTake_(getShutterType(assertInstanceof(e, MouseEvent)));
       } else {
         this.endTake_();
       }
@@ -225,7 +249,10 @@
    * @return {!Promise}
    */
   async initialize() {
-    await ChromeHelper.getInstance().initTabletModeMonitor();
+    const setTablet = (isTablet) => state.set(state.State.TABLET, isTablet);
+    const isTablet =
+        await ChromeHelper.getInstance().initTabletModeMonitor(setTablet);
+    setTablet(isTablet);
   }
 
   /**
@@ -242,7 +269,7 @@
    * @private
    */
   isTabletBackground_() {
-    return ChromeHelper.getInstance().isTabletMode() && !this.isVisible_;
+    return state.get(state.State.TABLET) && !this.isVisible_;
   }
 
   /**
@@ -265,16 +292,19 @@
 
   /**
    * Begins to take photo or recording with the current options, e.g. timer.
+   * @param {metrics.ShutterType} shutterType The shutter is triggered by which
+   *     shutter type.
    * @return {?Promise} Promise resolved when take action completes. Returns
    *     null if CCA can't start take action.
    * @protected
    */
-  beginTake_() {
+  beginTake_(shutterType) {
     if (!state.get(state.State.STREAMING) || state.get(state.State.TAKING)) {
       return null;
     }
 
     state.set(state.State.TAKING, true);
+    this.shutterType_ = shutterType;
     this.focus();  // Refocus the visible shutter button for ChromeVox.
     this.take_ = (async () => {
       let hasError = false;
@@ -318,7 +348,8 @@
   async doSavePhoto_(result, name) {
     metrics.log(
         metrics.Type.CAPTURE, this.facingMode_, /* length= */ 0,
-        result.resolution, metrics.IntentResultType.NOT_INTENT);
+        result.resolution, metrics.IntentResultType.NOT_INTENT,
+        this.shutterType_);
     try {
       await this.resultSaver_.savePhoto(result.blob, name);
     } catch (e) {
@@ -337,7 +368,8 @@
   async doSaveVideo_(result, name) {
     metrics.log(
         metrics.Type.CAPTURE, this.facingMode_, result.duration,
-        result.resolution, metrics.IntentResultType.NOT_INTENT);
+        result.resolution, metrics.IntentResultType.NOT_INTENT,
+        this.shutterType_);
     try {
       await this.resultSaver_.finishSaveVideo(result.videoSaver, name);
     } catch (e) {
@@ -362,12 +394,11 @@
       return true;
     }
     if ((key === 'AudioVolumeUp' || key === 'AudioVolumeDown') &&
-        ChromeHelper.getInstance().isTabletMode() &&
-        state.get(state.State.STREAMING)) {
+        state.get(state.State.TABLET) && state.get(state.State.STREAMING)) {
       if (state.get(state.State.TAKING)) {
         this.endTake_();
       } else {
-        this.beginTake_();
+        this.beginTake_(metrics.ShutterType.VOLUME_KEY);
       }
       return true;
     }
@@ -424,8 +455,7 @@
       }
     }
     if (resolCandidates === null) {
-      resolCandidates =
-          await this.modes_.getResolutionCandidatesV1(mode, deviceId);
+      resolCandidates = this.modes_.getResolutionCandidatesV1(mode, deviceId);
     }
     for (const {resolution: captureR, previewCandidates} of resolCandidates) {
       for (const constraints of previewCandidates) {

diff --git a/chrome/browser/resources/chromeos/camera/src/js/views/camera/modes.js b/chrome/browser/resources/chromeos/camera/src/js/views/camera/modes.js
index a4f4b39..85979bcf 100644
--- a/chrome/browser/resources/chromeos/camera/src/js/views/camera/modes.js
+++ b/chrome/browser/resources/chromeos/camera/src/js/views/camera/modes.js

@@ -110,10 +110,10 @@
   /**
    * Get stream constraints for HALv1 of this mode.
    * @param {?string} deviceId
-   * @return {!Promise<!Array<!MediaStreamConstraints>>}
+   * @return {!Array<!MediaStreamConstraints>}
    * @abstract
    */
-  async getV1Constraints(deviceId) {}
+  getV1Constraints(deviceId) {}
 
   /* eslint-disable getter-return */
 
@@ -203,11 +203,10 @@
      * Returns a set of available constraints for HALv1 device.
      * @param {boolean} videoMode Is getting constraints for video mode.
      * @param {?string} deviceId Id of video device.
-     * @return {!Promise<!Array<!MediaStreamConstraints>>} Result of
+     * @return {!Array<!MediaStreamConstraints>} Result of
      *     constraints-candidates.
      */
-    const getV1Constraints = async function(videoMode, deviceId) {
-      const defaultFacing = await util.getDefaultFacing();
+    const getV1Constraints = function(videoMode, deviceId) {
       return [
         {
           aspectRatio: {ideal: videoMode ? 1.7777777778 : 1.3333333333},
@@ -225,7 +224,7 @@
           // HALv1 devices are unable to know facing before stream
           // configuration, deviceId is set to null for requesting camera with
           // default facing.
-          constraint.facingMode = {exact: defaultFacing};
+          constraint.facingMode = {exact: util.getDefaultFacing()};
         }
         return {
           audio: videoMode ? {echoCancellation: false} : false,
@@ -387,11 +386,10 @@
    * given mode on camera HALv1 device.
    * @param {!Mode} mode
    * @param {?string} deviceId
-   * @return {!Promise<!Array<!CaptureCandidate>>}
+   * @return {!Array<!CaptureCandidate>}
    */
-  async getResolutionCandidatesV1(mode, deviceId) {
-    const previewCandidates =
-        await this.allModes_[mode].getV1Constraints(deviceId);
+  getResolutionCandidatesV1(mode, deviceId) {
+    const previewCandidates = this.allModes_[mode].getV1Constraints(deviceId);
     return [{resolution: null, previewCandidates}];
   }
 

diff --git a/chrome/browser/resources/chromeos/camera/src/js/views/camera/options.js b/chrome/browser/resources/chromeos/camera/src/js/views/camera/options.js
index 109c182..d82cce0 100644
--- a/chrome/browser/resources/chromeos/camera/src/js/views/camera/options.js
+++ b/chrome/browser/resources/chromeos/camera/src/js/views/camera/options.js

@@ -8,13 +8,11 @@
 import {Camera3DeviceInfo} from '../../device/camera3_device_info.js';
 // eslint-disable-next-line no-unused-vars
 import {DeviceInfoUpdater} from '../../device/device_info_updater.js';
-import {ChromeHelper} from '../../mojo/chrome_helper.js';
 import * as nav from '../../nav.js';
 import {PerfEvent} from '../../perf.js';
 import * as state from '../../state.js';
-import {Facing} from '../../type.js';
+import {Facing, ViewName} from '../../type.js';
 import * as util from '../../util.js';
-import {ViewName} from '../view.js';
 
 /**
  * Creates a controller for the options of Camera view.
@@ -267,9 +265,7 @@
       devices = await this.infoUpdater_.getDevicesInfo();
     }
 
-    const defaultFacing = await ChromeHelper.getInstance().isTabletMode() ?
-        Facing.ENVIRONMENT :
-        Facing.USER;
+    const defaultFacing = util.getDefaultFacing();
     // Put the selected video device id first.
     const sorted = devices.map((device) => device.deviceId).sort((a, b) => {
       if (a === b) {

diff --git a/chrome/browser/resources/chromeos/camera/src/js/views/camera_intent.js b/chrome/browser/resources/chromeos/camera/src/js/views/camera_intent.js
index c70d8a61..6154de19 100644
--- a/chrome/browser/resources/chromeos/camera/src/js/views/camera_intent.js
+++ b/chrome/browser/resources/chromeos/camera/src/js/views/camera_intent.js

@@ -133,12 +133,12 @@
   /**
    * @override
    */
-  beginTake_() {
+  beginTake_(shutterType) {
     // TODO(inker): Clean unused photo result blob properly.
     this.photoResult_ = null;
     this.videoResult_ = null;
 
-    const take = super.beginTake_();
+    const take = super.beginTake_(shutterType);
     if (take === null) {
       return null;
     }
@@ -161,7 +161,8 @@
           metrics.Type.CAPTURE, this.facingMode_, result.duration || 0,
           result.resolution,
           confirmed ? metrics.IntentResultType.CONFIRMED :
-                      metrics.IntentResultType.CANCELED);
+                      metrics.IntentResultType.CANCELED,
+          this.shutterType_);
       if (confirmed) {
         await this.intent_.finish();
         window.close();

diff --git a/chrome/browser/resources/chromeos/camera/src/js/views/dialog.js b/chrome/browser/resources/chromeos/camera/src/js/views/dialog.js
index 5eb031f6..da16c34b 100644
--- a/chrome/browser/resources/chromeos/camera/src/js/views/dialog.js
+++ b/chrome/browser/resources/chromeos/camera/src/js/views/dialog.js

@@ -3,9 +3,9 @@
 // found in the LICENSE file.
 
 import {assertInstanceof, assertString} from '../chrome_util.js';
-import {View,
-        ViewName,  // eslint-disable-line no-unused-vars
-} from './view.js';
+// eslint-disable-next-line no-unused-vars
+import {ViewName} from '../type.js';
+import {View} from './view.js';
 
 /**
  * Creates the Dialog view controller.

diff --git a/chrome/browser/resources/chromeos/camera/src/js/views/settings.js b/chrome/browser/resources/chromeos/camera/src/js/views/settings.js
index b4e2689..7e37ccd 100644
--- a/chrome/browser/resources/chromeos/camera/src/js/views/settings.js
+++ b/chrome/browser/resources/chromeos/camera/src/js/views/settings.js

@@ -19,9 +19,10 @@
   Facing,
   Resolution,      // eslint-disable-line no-unused-vars
   ResolutionList,  // eslint-disable-line no-unused-vars
+  ViewName,
 } from '../type.js';
 import * as util from '../util.js';
-import {View, ViewName} from './view.js';
+import {View} from './view.js';
 
 /* eslint-disable no-unused-vars */
 

diff --git a/chrome/browser/resources/chromeos/camera/src/js/views/view.js b/chrome/browser/resources/chromeos/camera/src/js/views/view.js
index 4e9aa00..ddde67ed 100644
--- a/chrome/browser/resources/chromeos/camera/src/js/views/view.js
+++ b/chrome/browser/resources/chromeos/camera/src/js/views/view.js

@@ -3,23 +3,8 @@
 // found in the LICENSE file.
 
 import {assertInstanceof} from '../chrome_util.js';
-
-/**
- * @enum {string}
- */
-export const ViewName = {
-  CAMERA: 'view-camera',
-  EXPERT_SETTINGS: 'view-expert-settings',
-  GRID_SETTINGS: 'view-grid-settings',
-  MESSAGE_DIALOG: 'view-message-dialog',
-  PHOTO_RESOLUTION_SETTINGS: 'view-photo-resolution-settings',
-  RESOLUTION_SETTINGS: 'view-resolution-settings',
-  SETTINGS: 'view-settings',
-  SPLASH: 'view-splash',
-  TIMER_SETTINGS: 'view-timer-settings',
-  VIDEO_RESOLUTION_SETTINGS: 'view-video-resolution-settings',
-  WARNING: 'view-warning',
-};
+// eslint-disable-next-line no-unused-vars
+import {ViewName} from '../type.js';
 
 /* eslint-disable no-unused-vars */
 

diff --git a/chrome/browser/resources/chromeos/camera/src/js/views/warning.js b/chrome/browser/resources/chromeos/camera/src/js/views/warning.js
index faa36cf..f2a13cc 100644
--- a/chrome/browser/resources/chromeos/camera/src/js/views/warning.js
+++ b/chrome/browser/resources/chromeos/camera/src/js/views/warning.js

@@ -4,7 +4,8 @@
 
 import {browserProxy} from '../browser_proxy/browser_proxy.js';
 import {assertString} from '../chrome_util.js';
-import {View, ViewName} from './view.js';
+import {ViewName} from '../type.js';
+import {View} from './view.js';
 
 /**
  * Creates the warning-view controller.

diff --git a/chrome/browser/resources/new_tab_page/BUILD.gn b/chrome/browser/resources/new_tab_page/BUILD.gn
index 2f2dd92a..ee0fbec1 100644
--- a/chrome/browser/resources/new_tab_page/BUILD.gn
+++ b/chrome/browser/resources/new_tab_page/BUILD.gn

@@ -18,6 +18,8 @@
     ":grid",
     ":logo",
     ":realbox",
+    ":realbox_dropdown",
+    ":realbox_match",
     ":theme_icon",
     ":untrusted_iframe",
     ":utils",
@@ -146,6 +148,23 @@
   ]
 }
 
+js_library("realbox_dropdown") {
+  deps = [
+    ":utils",
+    "//third_party/polymer/v3_0/components-chromium/polymer:polymer_bundled",
+    "//ui/webui/resources/js:assert.m",
+    "//ui/webui/resources/js:load_time_data.m",
+  ]
+}
+
+js_library("realbox_match") {
+  deps = [
+    ":utils",
+    "//third_party/polymer/v3_0/components-chromium/polymer:polymer_bundled",
+    "//ui/webui/resources/js:load_time_data.m",
+  ]
+}
+
 js_library("logo") {
   deps = [
     ":doodle_share_dialog",
@@ -182,6 +201,8 @@
     "mini_page.js",
     "most_visited.js",
     "realbox.js",
+    "realbox_dropdown.js",
+    "realbox_match.js",
     "theme_icon.js",
     "untrusted_iframe.js",
     "voice_search_overlay.js",

diff --git a/chrome/browser/resources/new_tab_page/app.html b/chrome/browser/resources/new_tab_page/app.html
index 838c215..2d6fe13a 100644
--- a/chrome/browser/resources/new_tab_page/app.html
+++ b/chrome/browser/resources/new_tab_page/app.html

@@ -49,6 +49,14 @@
     margin-bottom: 32px;
   }
 
+  ntp-realbox {
+    visibility: hidden;
+  }
+
+  ntp-realbox[shown] {
+    visibility: visible;
+  }
+
   ntp-most-visited[dark] {
     --icon-button-color-active: var(--google-grey-refresh-300);
     --icon-button-color: white;
@@ -197,6 +205,10 @@
   .fadein {
     animation: 100ms ease-in-out fadein;
   }
+
+  svg {
+    position: fixed;
+  }
 </style>
 <div id="content"
     style="--ntp-theme-text-color: [[rgbaOrInherit_(theme_.shortcutTextColor)]];
@@ -217,7 +229,8 @@
       hidden$="[[realboxEnabled_]]">
   </ntp-fakebox>
   <ntp-realbox id="realbox" on-open-voice-search="onVoiceSearchClick_"
-      theme="[[theme_.searchBox]]" hidden$="[[!realboxEnabled_]]">
+      theme="[[theme_.searchBox]]" shown$="[[realboxShown_]]"
+      hidden$="[[!realboxEnabled_]]">
   </ntp-realbox>
   <ntp-most-visited id="mostVisited" dark$="[[theme_.isDark]]"
       use-white-add-icon$="[[theme_.shortcutUseWhiteAddIcon]]"
@@ -246,7 +259,8 @@
            results when a custom background is set. Therefore, wrap customize
            button in container to enfore solid background color. -->
       <div id="customizeButtonContainer">
-        <cr-button id="customizeButton" on-click="onCustomizeClick_">
+        <cr-button id="customizeButton" on-click="onCustomizeClick_"
+            title="$i18n{customizeThisPage}">
           <div id="customizeIcon"></div>
           <div id="customizeText" hidden$="[[showBackgroundImage_]]">
             $i18n{customizeButton}
@@ -270,7 +284,7 @@
     </ntp-customize-dialog>
   </template>
 </dom-if>
-<svg hidden>
+<svg>
   <defs>
     <clipPath id="oneGoogleBarClipPath">
       <rect x="0" y="0" width="100vw" height="56"></rect>

diff --git a/chrome/browser/resources/new_tab_page/app.js b/chrome/browser/resources/new_tab_page/app.js
index d2876fb1..0b049ab 100644
--- a/chrome/browser/resources/new_tab_page/app.js
+++ b/chrome/browser/resources/new_tab_page/app.js

@@ -161,6 +161,12 @@
         value: () => loadTimeData.getBoolean('realboxEnabled'),
       },
 
+      /** @private */
+      realboxShown_: {
+        type: Boolean,
+        computed: 'computeRealboxShown_(theme_)',
+      },
+
       /**
        * If true, renders additional elements that were not deemed crucial to
        * to show up immediately on load.
@@ -410,6 +416,17 @@
     }
   }
 
+  /**
+   * @return {boolean}
+   * @private
+   */
+  computeRealboxShown_() {
+    // If realbox is to match the Omnibox's theme, keep it hidden until the
+    // theme arrives. Otherwise mismatching colors will cause flicker.
+    return !loadTimeData.getBoolean('realboxMatchOmniboxTheme') ||
+        !!this.theme_;
+  }
+
   /** @private */
   onVoiceSearchClick_() {
     this.showVoiceSearchOverlay_ = true;

diff --git a/chrome/browser/resources/new_tab_page/new_tab_page_resources.grd b/chrome/browser/resources/new_tab_page/new_tab_page_resources.grd
index 4a330ef6..8c6f242 100644
--- a/chrome/browser/resources/new_tab_page/new_tab_page_resources.grd
+++ b/chrome/browser/resources/new_tab_page/new_tab_page_resources.grd

@@ -59,6 +59,12 @@
       <include name="IDR_NEW_TAB_PAGE_REALBOX_JS"
           file="${root_gen_dir}/chrome/browser/resources/new_tab_page/realbox.js"
           use_base_dir="false" type="BINDATA" compress="false" />
+      <include name="IDR_NEW_TAB_PAGE_REALBOX_DROPDOWN_JS"
+          file="${root_gen_dir}/chrome/browser/resources/new_tab_page/realbox_dropdown.js"
+          use_base_dir="false" type="BINDATA" compress="false" />
+      <include name="IDR_NEW_TAB_PAGE_REALBOX_MATCH_JS"
+          file="${root_gen_dir}/chrome/browser/resources/new_tab_page/realbox_match.js"
+          use_base_dir="false" type="BINDATA" compress="false" />
       <include name="IDR_NEW_TAB_PAGE_BROWSER_PROXY_JS"
           file="browser_proxy.js" type="BINDATA" compress="false" />
       <include name="IDR_NEW_TAB_PAGE_UTILS_JS"

diff --git a/chrome/browser/resources/new_tab_page/realbox.html b/chrome/browser/resources/new_tab_page/realbox.html
index 65457a0f..b2ad313c 100644
--- a/chrome/browser/resources/new_tab_page/realbox.html
+++ b/chrome/browser/resources/new_tab_page/realbox.html

@@ -7,6 +7,10 @@
     width: 337px;
   }
 
+  :host([matches-are-visible]) {
+    box-shadow: none;
+  }
+
   @media (min-width: 560px) {
     :host {
       width: 449px;
@@ -19,7 +23,7 @@
     }
   }
 
-  #realboxInputWrapper {
+  #inputWrapper {
     height: 100%;
     position: relative;
   }
@@ -34,6 +38,7 @@
     outline: none;
     padding-inline-end:  40px;
     padding-inline-start: 52px;
+    position: relative;
     width: 100%;
   }
 
@@ -72,6 +77,7 @@
     height: 100%;
     left: 16px;
     position: absolute;
+    top: 0;
     width: 24px;
   }
 
@@ -113,14 +119,38 @@
   :host-context(.focus-outline-visible) #voiceSearchButton:focus {
     box-shadow: var(--ntp-focus-shadow);
   }
+
+  :-webkit-any(input, #realboxIcon, #voiceSearchButton) {
+   z-index: 2;
+  }
+
+  ntp-realbox-dropdown {
+    border-radius: calc(0.5 * var(--ntp-realbox-height));
+    box-shadow: 0 1px 6px 0 rgba(32, 33, 36, .28);
+    left: 0;
+    padding-bottom: 8px;
+    padding-top: var(--ntp-realbox-height);
+    position: absolute;
+    right: 0;
+    top: 0;
+    z-index: 1;
+  }
 </style>
-<div id="realboxInputWrapper">
-  <div id="realboxIcon" data-icon$="[[realboxIcon_]]"></div>
+<div id="inputWrapper" on-focusout=onInputWrapperFocusout_
+    on-keydown="onInputWrapperKeydown_">
   <input id="input" type="search" autocomplete="off" spellcheck="false"
       aria-live="polite" placeholder="$i18n{searchBoxHint}"
-      on-mousedown="onMouseDown_">
-  </input>
+      on-copy="onInputCutCopy_" on-cut="onInputCutCopy_"
+      on-focus="onInputFocus_" on-input="onInputInput_"
+      on-keydown="onInputKeydown_" on-keyup="onInputKeyup_"
+      on-mousedown="onInputMouseDown_" on-paste="onInputPaste_">
+  <div id="realboxIcon" data-icon$="[[realboxIcon_]]"></div>
   <button id="voiceSearchButton" on-click="onVoiceSearchClick_"
       title="$i18n{voiceSearchButtonLabel}">
   </button>
+  <ntp-realbox-dropdown id="matches" role="listbox" theme="[[theme]]"
+      result="[[result_]]" selected-match-index="{{selectedMatchIndex_}}"
+      on-result-repaint="onResultRepaint_"
+      on-match-focusin="onMatchFocusin_" hidden$="[[!matchesAreVisible]]">
+  </ntp-realbox-dropdown>
 </div>

diff --git a/chrome/browser/resources/new_tab_page/realbox.js b/chrome/browser/resources/new_tab_page/realbox.js
index bd560c1..999658f 100644
--- a/chrome/browser/resources/new_tab_page/realbox.js
+++ b/chrome/browser/resources/new_tab_page/realbox.js

@@ -3,13 +3,26 @@
 // found in the LICENSE file.
 
 import './strings.m.js';
+import './realbox_dropdown.js';
 
 import {assert} from 'chrome://resources/js/assert.m.js';
 import {loadTimeData} from 'chrome://resources/js/load_time_data.m.js';
 import {html, PolymerElement} from 'chrome://resources/polymer/v3_0/polymer/polymer_bundled.min.js';
 
 import {BrowserProxy} from './browser_proxy.js';
-import {mojoString16, skColorToRgba} from './utils.js';
+import {decodeString16, mojoString16, mojoTimeDelta, skColorToRgba} from './utils.js';
+
+/** @typedef {{text: string, inline: string,}} */
+let Input;
+
+/**
+ * @typedef {{
+ *   text: (string|undefined),
+ *   inline: (string|undefined),
+ *   moveCursorToEnd: (boolean|undefined),
+ * }}
+ */
+let InputUpdate;
 
 // A real search box that behaves just like the Omnibox.
 class RealboxElement extends PolymerElement {
@@ -23,16 +36,142 @@
 
   static get properties() {
     return {
-      /** @type {!newTabPage.mojom.SearchBoxTheme} */
+      //========================================================================
+      // Public properties
+      //========================================================================
+
+      /**
+       * Whether matches are currently visible.
+       * @type {boolean}
+       */
+      matchesAreVisible: {
+        type: Boolean,
+        value: false,
+        reflectToAttribute: true,
+      },
+
+      /**
+       * @type {!newTabPage.mojom.SearchBoxTheme}
+       */
       theme: {
         type: Object,
         observer: 'onThemeChange_',
       },
 
+      //========================================================================
+      // Private properties
+      //========================================================================
+
+      /**
+       * The time of the first character insert operation that has not yet been
+       * painted in milliseconds. Used to measure the realbox responsiveness.
+       * @type {number}
+       * @private
+       */
+      charTypedTime_: {
+        type: Number,
+        value: 0,
+      },
+
+      /**
+       * Whether user is deleting text in the input. Used to prevent the default
+       * match from offering inline autocompletion.
+       * @type {boolean}
+       * @private
+       */
+      isDeletingInput_: {
+        type: Boolean,
+        value: false,
+      },
+
+      /**
+       * The 'Enter' keydown event that was ignored due to matches being stale.
+       * Used to navigate to the default match once up-to-date matches arrive.
+       * @type {?Event}
+       * @private
+       */
+      lastIgnoredEnterEvent_: {
+        type: Object,
+        value: null,
+      },
+
+      /**
+       * Last state of the input (text and inline autocompletion). Updated
+       * by the user input or by the currently selected autocomplete match.
+       * @type {!Input}
+       * @private
+       */
+      lastInput_: {
+        type: Object,
+        value: {text: '', inline: ''},
+      },
+
+      /**
+       * The time at which the input was last focused in milliseconds. Passed to
+       * the browser when navigating to a match.
+       * @type {?number}
+       * @private
+       */
+      lastInputFocusTime_: {
+        type: Number,
+        value: null,
+      },
+
+      /**
+       * The last queried input text.
+       * @type {?string}
+       * @private
+       */
+      lastQueriedInput_: {
+        type: String,
+        value: null,
+      },
+
+      /**
+       * True if user just pasted into the input. Used to prevent the default
+       * match from offering inline autocompletion.
+       * @type {boolean}
+       * @private
+       */
+      pastedInInput_: {
+        type: Boolean,
+        value: false,
+      },
+
+      /** @private */
       realboxIcon_: {
         type: String,
-        value: () => loadTimeData.getString('realboxDefaultIcon')
-      }
+        value: () => loadTimeData.getString('realboxDefaultIcon'),
+      },
+
+      /**
+       * @type {?search.mojom.AutocompleteResult}
+       * @private
+       */
+      result_: {
+        type: Object,
+      },
+
+      /**
+       * The currently selected match, if any.
+       * @type {?search.mojom.AutocompleteMatch}
+       * @private
+       */
+      selectedMatch_: {
+        type: Object,
+        computed: `computeSelectedMatch_(result_, selectedMatchIndex_)`,
+      },
+
+      /**
+       * Index of the currently selected match, if any.
+       * Do not modify this. Use <ntp-realbox-dropdown> API to change selection.
+       * @type {number}
+       * @private
+       */
+      selectedMatchIndex_: {
+        type: Number,
+        value: -1,
+      },
     };
   }
 
@@ -53,9 +192,6 @@
     this.autocompleteResultChangedListenerId_ =
         this.callbackRouter_.autocompleteResultChanged.addListener(
             this.onAutocompleteResultChanged_.bind(this));
-
-    // Bind |this.onMouseDown_| to the 'onmousedown' handler to support tests.
-    this.$.input.onmousedown = this.onMouseDown_.bind(this);
   }
 
   /** @override */
@@ -71,27 +207,49 @@
     performance.measure('realbox-creation', 'realbox-creation-start');
   }
 
+  //============================================================================
+  // Callbacks
+  //============================================================================
+
   /**
    * @private
-   * @param {Event} e
+   * @param {search.mojom.AutocompleteResult} result
    */
-  onMouseDown_(e) {
-    if (!e.isTrusted || e.button !== 0) {
-      // Only handle main (generally left) button presses generated by a user
-      // action.
-      return;
+  onAutocompleteResultChanged_(result) {
+    if (this.lastQueriedInput_ === null ||
+        this.lastQueriedInput_.trimLeft() !== decodeString16(result.input)) {
+      return;  // Stale result; ignore.
     }
-    if (!this.$.input.value) {
-      this.pageHandler_.queryAutocomplete(mojoString16(''), false);
+
+    this.result_ = result;
+    const hasMatches = result && result.matches && result.matches.length > 0;
+    this.matchesAreVisible = hasMatches;
+
+    this.$.input.focus();
+
+    const firstMatch = hasMatches ? this.result_.matches[0] : null;
+    if (firstMatch && firstMatch.allowedToBeDefaultMatch) {
+      this.$.matches.selectFirst();
+      this.updateInput_(
+          {inline: decodeString16(firstMatch.inlineAutocompletion)});
+
+      // Navigate to the default up-to-date match if the user typed and pressed
+      // 'Enter' too fast.
+      if (this.lastIgnoredEnterEvent_) {
+        this.navigateToMatch_(firstMatch, this.lastIgnoredEnterEvent_);
+        this.lastIgnoredEnterEvent_ = null;
+      }
+    } else {
+      this.$.matches.unselect();
+      this.updateInput_({
+        inline: '',
+      });
     }
   }
 
-  /** @private */
-  onVoiceSearchClick_() {
-    this.dispatchEvent(new Event('open-voice-search'));
-  }
-
-  /** @private */
+  /**
+   * @private
+   */
   onThemeChange_() {
     if (!loadTimeData.getBoolean('realboxMatchOmniboxTheme')) {
       return;
@@ -106,12 +264,397 @@
     });
   }
 
+  //============================================================================
+  // Event handlers
+  //============================================================================
+
+  /**
+   * @param {!Event} e
+   * @private
+   */
+  onInputCutCopy_(e) {
+    // Only handle cut/copy when input has content and it's all selected.
+    if (!this.$.input.value || this.$.input.selectionStart !== 0 ||
+        this.$.input.selectionEnd !== this.$.input.value.length ||
+        !this.result_ || this.result_.matches.length === 0) {
+      return;
+    }
+
+    if (this.selectedMatch_ && !this.selectedMatch_.isSearchType) {
+      e.clipboardData.setData(
+          'text/plain', this.selectedMatch_.destinationUrl.url);
+      e.preventDefault();
+      if (e.type === 'cut') {
+        this.$.input.value = '';
+      }
+    }
+  }
+
   /**
    * @private
-   * @param {search.mojom.AutocompleteResult} result
    */
-  onAutocompleteResultChanged_(result) {
-    // TODO(crbug.com/1041129): Display the results.
+  onInputFocus_() {
+    this.lastInputFocusTime_ = window.performance.now();
+  }
+
+  /**
+   * @private
+   */
+  onInputInput_() {
+    const inputValue = this.$.input.value;
+    this.updateInput_({text: inputValue, inline: ''});
+
+    const charTyped = !this.isDeletingInput_ && !!inputValue.trim();
+    // If a character has been typed, update |charTypedTime_|. Otherwise reset
+    // it. If |charTypedTime_| is not 0, there's a pending typed character for
+    // which the results have not been painted yet. In that case, keep the
+    // earlier time.
+    this.charTypedTime_ =
+        charTyped ? this.charTypedTime_ || window.performance.now() : 0;
+
+    if (inputValue.trim()) {
+      this.queryAutocomplete_(inputValue);
+    } else {
+      this.matchesAreVisible = false;
+      this.clearAutocompleteMatches_();
+    }
+
+    this.pastedInInput_ = false;
+  }
+
+  /**
+   * @param {Event} e
+   * @private
+   */
+  onInputKeydown_(e) {
+    // Ignore this event if the input does not have any inline autocompletion.
+    if (!this.lastInput_.inline) {
+      return;
+    }
+
+    const inputValue = this.$.input.value;
+    const inputSelection = inputValue.substring(
+        this.$.input.selectionStart, this.$.input.selectionEnd);
+    const lastInputValue = this.lastInput_.text + this.lastInput_.inline;
+    // If the current input state (its value and selection) matches its last
+    // state (text and inline autocompletion) and the user types the next
+    // character in the inline autocompletion, stop the keydown event. Just move
+    // the selection and requery autocomplete. This is needed to avoid flicker.
+    if (inputSelection === this.lastInput_.inline &&
+        inputValue === lastInputValue &&
+        this.lastInput_.inline[0].toLocaleLowerCase() ===
+            e.key.toLocaleLowerCase()) {
+      this.updateInput_({
+        text: assert(this.lastInput_.text + e.key),
+        inline: this.lastInput_.inline.substr(1),
+      });
+
+      // If |charTypedTime_| is not 0, there's a pending typed character for
+      // which the results have not been painted yet. In that case, keep the
+      // earlier time.
+      this.charTypedTime_ = this.charTypedTime_ || window.performance.now();
+
+      this.queryAutocomplete_(this.lastInput_.text);
+      e.preventDefault();
+    }
+  }
+
+  /**
+   * @param {Event} e
+   * @private
+   */
+  onInputKeyup_(e) {
+    if (e.key !== 'Tab') {
+      return;
+    }
+
+    // Query for zero-prefix matches if user is tabbing into an empty input.
+    if (!this.$.input.value) {
+      this.queryAutocomplete_('');
+    }
+  }
+
+  /**
+   * @param {Event} e
+   * @private
+   */
+  onInputMouseDown_(e) {
+    if (!e.isTrusted || e.button !== 0) {
+      // Only handle main (generally left) button presses generated by a user
+      // action.
+      return;
+    }
+    if (!this.$.input.value) {
+      this.queryAutocomplete_('');
+    }
+  }
+
+  /**
+   * @param {Event} e
+   * @private
+   */
+  onInputPaste_(e) {
+    this.pastedInInput_ = true;
+  }
+
+  /**
+   * @param {Event} e
+   * @private
+   */
+  onInputWrapperFocusout_(e) {
+    // Hide the matches and stop autocomplete only when the focus goes outside
+    // of the realbox wrapper.
+    const relatedTarget = /** @type {Element} */ (e.relatedTarget);
+    if (!this.$.inputWrapper.contains(relatedTarget)) {
+      // Unselect the selected match and clear the input if the input was empty
+      // when the matches arrived.
+      if (this.lastQueriedInput_ === '') {
+        this.$.matches.unselect();
+        this.updateInput_({text: '', inline: ''});
+      }
+      this.matchesAreVisible = false;
+
+      // Stop autocomplete but leave (potentially stale) results and continue
+      // listening for key presses. These stale results should never be shown.
+      // They correspond to the potentially stale suggestion left in the realbox
+      // when blurred. That stale result may be navigated to by focusing and
+      // pressing 'Enter'.
+      this.pageHandler_.stopAutocomplete(/*clearResult=*/ false);
+    }
+  }
+
+  /**
+   * @param {Event} e
+   * @private
+   */
+  onInputWrapperKeydown_(e) {
+    const KEYDOWN_HANDLED_KEYS = [
+      'ArrowDown',
+      'ArrowUp',
+      'Delete',
+      'Enter',
+      'Escape',
+      'PageDown',
+      'PageUp',
+    ];
+    if (!KEYDOWN_HANDLED_KEYS.includes(e.key)) {
+      return;
+    }
+
+    // ArrowUp/ArrowDown query autocomplete when matches are not visible.
+    if (!this.matchesAreVisible) {
+      if (e.key === 'ArrowUp' || e.key === 'ArrowDown') {
+        const inputValue = this.$.input.value;
+        if (inputValue.trim() || !inputValue) {
+          this.queryAutocomplete_(inputValue);
+        }
+        e.preventDefault();
+        return;
+      }
+    }
+
+    // Do not handle the following keys if there are no matches available.
+    if (!this.result_ || this.result_.matches.length === 0) {
+      return;
+    }
+
+    if (e.key === 'Enter') {
+      if ([this.$.matches, this.$.input].includes(e.target)) {
+        if (this.lastQueriedInput_ === decodeString16(this.result_.input)) {
+          if (this.selectedMatch_) {
+            this.navigateToMatch_(this.selectedMatch_, e);
+          }
+        } else {
+          // User typed and pressed 'Enter' too quickly. Ignore this for now
+          // because the matches are stale. Navigate to the default match (if
+          // one exists) once the up-to-date matches arrive.
+          this.lastIgnoredEnterEvent_ = e;
+          e.preventDefault();
+        }
+      }
+      return;
+    }
+
+    if (e.key === 'Delete') {
+      if (e.shiftKey && !e.altKey && !e.ctrlKey && !e.metaKey) {
+        if (this.selectedMatch_ && this.selectedMatch_.supportsDeletion) {
+          this.pageHandler_.deleteAutocompleteMatch(this.selectedMatchIndex_);
+          e.preventDefault();
+        }
+      }
+      return;
+    }
+
+    // Do not handle the following keys if there are key modifiers.
+    if (e.altKey || e.ctrlKey || e.metaKey || e.shiftKey) {
+      return;
+    }
+
+    if (e.key === 'Escape' && this.selectedMatchIndex_ === 0) {
+      this.updateInput_({text: '', inline: ''});
+      this.matchesAreVisible = false;
+      this.clearAutocompleteMatches_();
+      e.preventDefault();
+      return;
+    }
+
+    if (e.key === 'ArrowDown') {
+      this.$.matches.selectNext();
+    } else if (e.key === 'ArrowUp') {
+      this.$.matches.selectPrevious();
+    } else if (e.key === 'Escape' || e.key === 'PageUp') {
+      this.$.matches.selectFirst();
+    } else if (e.key === 'PageDown') {
+      this.$.matches.selectLast();
+    }
+    e.preventDefault();
+
+    // Focus the selected match if focus is currently in the matches.
+    if (this.shadowRoot.activeElement === this.$.matches) {
+      this.$.matches.focusSelected();
+    }
+
+    // Update the input.
+    const newFill = decodeString16(this.selectedMatch_.fillIntoEdit);
+    const newInline = this.selectedMatch_.allowedToBeDefaultMatch ?
+        decodeString16(this.selectedMatch_.inlineAutocompletion) :
+        '';
+    const newFillEnd = newFill.length - newInline.length;
+    this.updateInput_({
+      text: assert(newFill.substr(0, newFillEnd)),
+      inline: newInline,
+      moveCursorToEnd: newInline.length === 0,
+    });
+  }
+
+  /**
+   * @param {!CustomEvent<number>} e Event containing index of the match that
+   *     received focus.
+   * @private
+   */
+  onMatchFocusin_(e) {
+    // Select the match that received focus.
+    this.$.matches.selectIndex(e.detail);
+    // Input selection (if any) likely drops due to focus change. Simply fill
+    // the input with the match and move the cursor to the end.
+    this.updateInput_({
+      text: decodeString16(this.selectedMatch_.fillIntoEdit),
+      inline: '',
+      moveCursorToEnd: true
+    });
+  }
+
+  /**
+   * @param {!CustomEvent<number>} e Event containing the result repaint time.
+   * @private
+   */
+  onResultRepaint_(e) {
+    if (this.charTypedTime_) {
+      this.pageHandler_.logCharTypedToRepaintLatency(
+          mojoTimeDelta(e.detail - this.charTypedTime_));
+      this.charTypedTime_ = 0;
+    }
+  }
+
+  /** @private */
+  onVoiceSearchClick_() {
+    this.dispatchEvent(new Event('open-voice-search'));
+  }
+
+  //============================================================================
+  // Helpers
+  //============================================================================
+
+  /**
+   * @return {?search.mojom.AutocompleteMatch}
+   * @private
+   */
+  computeSelectedMatch_() {
+    if (!this.result_ || !this.result_.matches) {
+      return null;
+    }
+    return this.result_.matches[this.selectedMatchIndex_] || null;
+  }
+
+  /**
+   * Clears the autocomplete results on
+   * @private
+   */
+  clearAutocompleteMatches_() {
+    this.result_ = null;
+    this.pageHandler_.stopAutocomplete(/*clearResult=*/ true);
+    // Autocomplete sends updates once it is stopped. Invalidate those results
+    // by setting the |this.lastQueriedInput_| to its default value.
+    this.lastQueriedInput_ = null;
+  }
+
+  /**
+   * @param {!search.mojom.AutocompleteMatch} match
+   * @param {!Event} e
+   * @private
+   */
+  navigateToMatch_(match, e) {
+    const line = this.result_.matches.indexOf(match);
+    assert(line >= 0);
+    assert(this.lastInputFocusTime_);
+    const delta =
+        mojoTimeDelta(window.performance.now() - this.lastInputFocusTime_);
+    this.pageHandler_.openAutocompleteMatch(
+        line, match.destinationUrl, this.matchesAreVisible, delta,
+        e.button || 0, e.altKey, e.ctrlKey, e.metaKey, e.shiftKey);
+    e.preventDefault();
+  }
+
+  /**
+   * @param {string} input
+   * @private
+   */
+  queryAutocomplete_(input) {
+    this.lastQueriedInput_ = input;
+
+    const caretNotAtEnd = this.$.input.selectionStart !== input.length;
+    const preventInlineAutocomplete =
+        this.isDeletingInput_ || this.pastedInInput_ || caretNotAtEnd;
+    this.pageHandler_.queryAutocomplete(
+        mojoString16(input), preventInlineAutocomplete);
+  }
+
+  /**
+   * Updates the input state (text and inline autocompletion) with |update|.
+   * @param {!InputUpdate} update
+   * @private
+   */
+  updateInput_(update) {
+    const newInput =
+        /** @type {!Input} */ (Object.assign({}, this.lastInput_, update));
+    const newInputValue = newInput.text + newInput.inline;
+    const lastInputValue = this.lastInput_.text + this.lastInput_.inline;
+
+    const inlineDiffers = newInput.inline !== this.lastInput_.inline;
+    const preserveSelection = !inlineDiffers && !update.moveCursorToEnd;
+    let needsSelectionUpdate = !preserveSelection;
+
+    const oldSelectionStart = this.$.input.selectionStart;
+    const oldSelectionEnd = this.$.input.selectionEnd;
+
+    if (newInputValue !== this.$.input.value) {
+      this.$.input.value = newInputValue;
+      needsSelectionUpdate = true;  // Setting .value blows away selection.
+    }
+
+    if (newInputValue.trim() && needsSelectionUpdate) {
+      // If the cursor is to be moved to the end (implies selection should not
+      // be perserved), set the selection start to same as the selection end.
+      this.$.input.selectionStart = preserveSelection ?
+          oldSelectionStart :
+          update.moveCursorToEnd ? newInputValue.length : newInput.text.length;
+      this.$.input.selectionEnd =
+          preserveSelection ? oldSelectionEnd : newInputValue.length;
+    }
+
+    this.isDeletingInput_ = lastInputValue.length > newInputValue.length &&
+        lastInputValue.startsWith(newInputValue);
+    this.lastInput_ = newInput;
   }
 }
 

diff --git a/chrome/browser/resources/new_tab_page/realbox_dropdown.html b/chrome/browser/resources/new_tab_page/realbox_dropdown.html
new file mode 100644
index 0000000..bcc8b96
--- /dev/null
+++ b/chrome/browser/resources/new_tab_page/realbox_dropdown.html

@@ -0,0 +1,41 @@
+<style>
+  :host {
+    background-color: var(--search-box-results-bg, white);
+    color: var(--search-box-results-text, var(--ntp-primary-text-color));
+    overflow: hidden;
+  }
+
+  @media (min-width: 560px) {
+    :host {
+      width: 449px;
+    }
+  }
+
+  @media (min-width: 672px) {
+    :host {
+      width: 561px;
+    }
+  }
+
+  ntp-realbox-match:-webkit-any(:focus-within, .selected) {
+    background-color: var(--search-box-results-bg-selected, rgb(219, 219, 220));
+    color: var(--search-box-results-text-selected, rgb(var(--GG900-rgb)));
+  }
+</style>
+<iron-selector id="selector" selectable="ntp-realbox-match"
+    items="{{selectableMatchElements_}}" selected="{{selectedMatchIndex}}"
+    selected-class="selected">
+  <template is="dom-repeat" items="[[groupIds_]]" as="groupId">
+    <template is="dom-if" if="[[groupHasHeader_(groupId)]]">
+      <!-- Header cannot be tabbed into but gets focus when clicked. This stops
+           the dropdown from losing focus and closing as a result. -->
+      <div tabindex="-1">[[headerForGroup_(groupId)]]</div>
+    </template>
+    <template is="dom-repeat" items="[[result.matches]]"
+        filter="[[computeMatchBelongsToGroup_(groupId)]]">
+      <ntp-realbox-match role="option" match="[[item]]"
+          on-focusin="onMatchFocusin_">
+      </ntp-realbox-match>
+    </template>
+  <template>
+</iron-selector>

diff --git a/chrome/browser/resources/new_tab_page/realbox_dropdown.js b/chrome/browser/resources/new_tab_page/realbox_dropdown.js
new file mode 100644
index 0000000..f5b1730e
--- /dev/null
+++ b/chrome/browser/resources/new_tab_page/realbox_dropdown.js

@@ -0,0 +1,257 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import './strings.m.js';
+import './realbox_match.js';
+
+import {assert} from 'chrome://resources/js/assert.m.js';
+import {loadTimeData} from 'chrome://resources/js/load_time_data.m.js';
+import {html, PolymerElement} from 'chrome://resources/polymer/v3_0/polymer/polymer_bundled.min.js';
+
+import {decodeString16, skColorToRgba} from './utils.js';
+
+/**
+ * Indicates a missing suggestion group Id. Based on
+ * SearchSuggestionParser::kNoSuggestionGroupId.
+ * @type {string}
+ */
+export const NO_SUGGESTION_GROUP_ID = '-1';
+
+// A dropdown element that contains autocomplete matches. Provides an API for
+// the embedder (i.e., <ntp-realbox>) to change the selection.
+class RealboxDropdownElement extends PolymerElement {
+  static get is() {
+    return 'ntp-realbox-dropdown';
+  }
+
+  static get template() {
+    return html`{__html_template__}`;
+  }
+
+  static get properties() {
+    return {
+      //========================================================================
+      // Public properties
+      //========================================================================
+
+      /**
+       * @type {!search.mojom.AutocompleteResult}
+       */
+      result: {
+        type: Object,
+        observer: 'onResultChange_',
+      },
+
+      /**
+       * Index of the selected match.
+       * @type {number}
+       */
+      selectedMatchIndex: {
+        type: Number,
+        value: -1,
+        notify: true,
+      },
+
+      /**
+       * @type {!newTabPage.mojom.SearchBoxTheme}
+       */
+      theme: {
+        type: Object,
+        observer: 'onThemeChange_',
+      },
+
+      //========================================================================
+      // Private properties
+      //========================================================================
+
+      /**
+       * The list of suggestion group IDs matches belong to.
+       * @type {!Array<string>}
+       * @private
+       */
+      groupIds_: {
+        type: Array,
+        computed: `computeGroupIds_(result)`,
+      },
+
+      /**
+       * The list of selectable match elements.
+       * @type {!Array<!Element>}
+       * @private
+       */
+      selectableMatchElements_: {
+        type: Array,
+        value: () => [],
+      },
+    };
+  }
+
+  //============================================================================
+  // Public methods
+  //============================================================================
+
+  /**
+   * Unselects the currently selected match, if any.
+   */
+  unselect() {
+    this.selectedMatchIndex = -1;
+  }
+
+  /**
+   * Focuses the selected match, if any.
+   */
+  focusSelected() {
+    if (this.$.selector.selectedItem) {
+      this.$.selector.selectedItem.focus();
+    }
+  }
+
+  /**
+   * Selects the first match.
+   */
+  selectFirst() {
+    this.selectedMatchIndex = 0;
+  }
+
+  /**
+   * Selects the match at the given index.
+   * @param {number} index
+   */
+  selectIndex(index) {
+    this.selectedMatchIndex = index;
+  }
+
+  /**
+   * Selects the previous match with respect to the currently selected one.
+   * Selects the last match if the first one is currently selected.
+   */
+  selectPrevious() {
+    this.selectedMatchIndex = this.selectedMatchIndex - 1 >= 0 ?
+        this.selectedMatchIndex - 1 :
+        this.selectableMatchElements_.length - 1;
+  }
+
+  /**
+   * Selects the last match.
+   */
+  selectLast() {
+    this.selectedMatchIndex = this.selectableMatchElements_.length - 1;
+  }
+
+  /**
+   * Selects the next match with respect to the currently selected one.
+   * Selects the first match if the last one is currently selected.
+   */
+  selectNext() {
+    this.selectedMatchIndex =
+        this.selectedMatchIndex + 1 < this.selectableMatchElements_.length ?
+        this.selectedMatchIndex + 1 :
+        0;
+  }
+
+  //============================================================================
+  // Callbacks
+  //============================================================================
+
+  /**
+   * @private
+   */
+  onResultChange_() {
+    // TODO(crbug.com/1041129): Find a more accurate estimate of when the
+    // results are actually painted.
+    this.dispatchEvent(new CustomEvent('result-repaint', {
+      bubbles: true,
+      composed: true,
+      detail: window.performance.now(),
+    }));
+  }
+
+  /**
+   * @private
+   */
+  onThemeChange_() {
+    if (!loadTimeData.getBoolean('realboxMatchOmniboxTheme')) {
+      return;
+    }
+
+    this.updateStyles({
+      '--search-box-results-bg': skColorToRgba(assert(this.theme.resultsBg)),
+      '--search-box-results-bg-selected':
+          skColorToRgba(assert(this.theme.resultsBgSelected)),
+      '--search-box-results-text':
+          skColorToRgba(assert(this.theme.resultsText)),
+      '--search-box-results-text-selected':
+          skColorToRgba(assert(this.theme.resultsTextSelected)),
+    });
+  }
+
+  //============================================================================
+  // Event handlers
+  //============================================================================
+
+  /**
+   * @param {!CustomEvent} e
+   * @private
+   */
+  onMatchFocusin_(e) {
+    e.stopPropagation();
+
+    this.dispatchEvent(new CustomEvent('match-focusin', {
+      bubbles: true,
+      composed: true,
+      detail: this.selectableMatchElements_.indexOf(
+          /** @type {!Element} */ (e.target)),
+    }));
+  }
+
+  //============================================================================
+  // Helpers
+  //============================================================================
+
+  /**
+   * @returns {!Array<string>}
+   * @private
+   */
+  computeGroupIds_() {
+    // Add |NO_SUGGESTION_GROUP_ID| to the list of suggestion group IDs.
+    return this.result ? [NO_SUGGESTION_GROUP_ID].concat(
+                             Object.keys(this.result.suggestionGroupsMap)) :
+                         [];
+  }
+
+  /**
+   * @param {string} groupId
+   * @returns {!function(!search.mojom.AutocompleteMatch):boolean} The filter
+   *     function to filter matches that belong to the given suggestion group
+   *     ID.
+   * @private
+   */
+  computeMatchBelongsToGroup_(groupId) {
+    return (match) => {
+      return match.suggestionGroupId === Number(groupId);
+    };
+  }
+  /**
+   * @param {string} groupId
+   * @returns {boolean} Whether the given suggestion group ID has a header.
+   * @private
+   */
+  groupHasHeader_(groupId) {
+    return groupId !== NO_SUGGESTION_GROUP_ID;
+  }
+
+  /**
+   * @param {string} groupId
+   * @returns {string} The header for the given suggestion group ID.
+   * @private
+   * @suppress {checkTypes}
+   */
+  headerForGroup_(groupId) {
+    return this.result && this.groupHasHeader_(groupId) ?
+        decodeString16(this.result.suggestionGroupsMap[groupId].header) :
+        '';
+  }
+}
+
+customElements.define(RealboxDropdownElement.is, RealboxDropdownElement);

diff --git a/chrome/browser/resources/new_tab_page/realbox_match.html b/chrome/browser/resources/new_tab_page/realbox_match.html
new file mode 100644
index 0000000..a69c224d
--- /dev/null
+++ b/chrome/browser/resources/new_tab_page/realbox_match.html

@@ -0,0 +1,27 @@
+<style>
+  :host {
+    display: block;
+  }
+
+  a {
+    color: inherit;
+    display: block;
+    font-size: 16px;
+    line-height: 1;
+    outline: none;
+    overflow: hidden;
+    padding-bottom: 8px;
+    padding-inline-end: 16px;
+    padding-inline-start: 52px;
+    padding-top: 8px;
+    position: relative;
+    text-decoration: none;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+  }
+</style>
+<a id="link" href$="[[match.destinationUrl.url]]">
+  <span id="contents">[[decodeString16_(match.contents)]]</span>
+  [[separatorText_]]
+  <span id="description">[[decodeString16_(match.description)]]</span>
+</a>

diff --git a/chrome/browser/resources/new_tab_page/realbox_match.js b/chrome/browser/resources/new_tab_page/realbox_match.js
new file mode 100644
index 0000000..790c596
--- /dev/null
+++ b/chrome/browser/resources/new_tab_page/realbox_match.js

@@ -0,0 +1,78 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import './strings.m.js';
+
+import {loadTimeData} from 'chrome://resources/js/load_time_data.m.js';
+import {html, PolymerElement} from 'chrome://resources/polymer/v3_0/polymer/polymer_bundled.min.js';
+
+import {decodeString16} from './utils.js';
+
+// Displays an autocomplete match similar to those in the Omnibox.
+class RealboxMatchElement extends PolymerElement {
+  static get is() {
+    return 'ntp-realbox-match';
+  }
+
+  static get template() {
+    return html`{__html_template__}`;
+  }
+
+  static get properties() {
+    return {
+      //========================================================================
+      // Public properties
+      //========================================================================
+
+      /**
+       * @type {!search.mojom.AutocompleteMatch}
+       */
+      match: {
+        type: Object,
+      },
+
+      //========================================================================
+      // Private properties
+      //========================================================================
+
+      /**
+       * Used to separate the contents from the description.
+       * @type {string}
+       * @private
+       */
+      separatorText_: {
+        type: String,
+        value: () => loadTimeData.getString('realboxSeparator'),
+      }
+    };
+  }
+
+  //============================================================================
+  // Public methods
+  //============================================================================
+
+  /**
+   * Focuses the <a> child element.
+   * @override
+   */
+  focus() {
+    this.$.link.focus();
+  }
+
+  //============================================================================
+  // Helpers
+  //============================================================================
+
+  /**
+   * Converts a mojoBase.mojom.String16 to a JavaScript String.
+   * @param {?mojoBase.mojom.String16} str
+   * @return {string}
+   * @private
+   */
+  decodeString16_(str) {
+    return decodeString16(str);
+  }
+}
+
+customElements.define(RealboxMatchElement.is, RealboxMatchElement);

diff --git a/chrome/browser/resources/settings/BUILD.gn b/chrome/browser/resources/settings/BUILD.gn
index 2b81df8..4250f4fa 100644
--- a/chrome/browser/resources/settings/BUILD.gn
+++ b/chrome/browser/resources/settings/BUILD.gn

@@ -216,6 +216,7 @@
     "autofill_page:password_manager_proxy",
     "people_page:sync_browser_proxy.m",
     "privacy_page:privacy_page_browser_proxy.m",
+    "safety_check_page:safety_check_browser_proxy",
     "search_engines_page:search_engines_browser_proxy.m",
     "settings_ui:settings_ui",
   ]

diff --git a/chrome/browser/resources/settings/basic_page/BUILD.gn b/chrome/browser/resources/settings/basic_page/BUILD.gn
index d3e0b3f..21924f6 100644
--- a/chrome/browser/resources/settings/basic_page/BUILD.gn
+++ b/chrome/browser/resources/settings/basic_page/BUILD.gn

@@ -20,6 +20,7 @@
     "..:search_settings.m",
     "../chrome_cleanup_page:chrome_cleanup_proxy",
     "../prefs:prefs_behavior.m",
+    "../safety_check_page:safety_check_page",
     "../search_page",
     "../settings_page:main_page_behavior.m",
     "//ui/webui/resources/js:load_time_data.m",

diff --git a/chrome/browser/resources/settings/privacy_page/privacy_page_browser_proxy.js b/chrome/browser/resources/settings/privacy_page/privacy_page_browser_proxy.js
index 4fda226..a839289 100644
--- a/chrome/browser/resources/settings/privacy_page/privacy_page_browser_proxy.js
+++ b/chrome/browser/resources/settings/privacy_page/privacy_page_browser_proxy.js

@@ -16,8 +16,8 @@
   /* #export */ let ResolverOption;
 
   /**
-   * Contains the possible string values for the secure DNS mode. This should be
-   * kept in sync with the modes in chrome/browser/net/dns_util.h.
+   * Contains the possible string values for the secure DNS mode. This must be
+   * kept in sync with the mode names in chrome/browser/net/secure_dns_config.h.
    * @enum {string}
    */
   /* #export */ const SecureDnsMode = {
@@ -28,7 +28,7 @@
 
   /**
    * Contains the possible management modes. This should be kept in sync with
-   * the management modes in chrome/browser/net/dns_util.h.
+   * the management modes in chrome/browser/net/secure_dns_config.h.
    * @enum {number}
    */
   /* #export */ const SecureDnsUiManagementMode = {

diff --git a/chrome/browser/resources/settings/safety_check_page/BUILD.gn b/chrome/browser/resources/settings/safety_check_page/BUILD.gn
index c33108c7..bbe3b9a 100644
--- a/chrome/browser/resources/settings/safety_check_page/BUILD.gn
+++ b/chrome/browser/resources/settings/safety_check_page/BUILD.gn

@@ -54,6 +54,7 @@
     "..:metrics_browser_proxy",
     "../autofill_page:password_manager_proxy",
     "//third_party/polymer/v3_0/components-chromium/iron-a11y-announcer:iron-a11y-announcer",
+    "//third_party/polymer/v3_0/components-chromium/iron-collapse:iron-collapse",
     "//third_party/polymer/v3_0/components-chromium/polymer:polymer_bundled",
     "//ui/webui/resources/js:assert.m",
     "//ui/webui/resources/js:i18n_behavior.m",

diff --git a/chrome/browser/resources/settings/settings_ui/BUILD.gn b/chrome/browser/resources/settings/settings_ui/BUILD.gn
index 32cfb807..5cc7141 100644
--- a/chrome/browser/resources/settings/settings_ui/BUILD.gn
+++ b/chrome/browser/resources/settings/settings_ui/BUILD.gn

@@ -18,6 +18,7 @@
     "..:page_visibility",
     "..:route",
     "..:router.m",
+    "../basic_page:basic_page",
     "../prefs:prefs.m",
     "../settings_main:settings_main",
     "//third_party/polymer/v3_0/components-chromium/polymer:polymer_bundled",

diff --git a/chrome/browser/service_sandbox_type.h b/chrome/browser/service_sandbox_type.h
index ac05340..1a662238 100644
--- a/chrome/browser/service_sandbox_type.h
+++ b/chrome/browser/service_sandbox_type.h

@@ -13,6 +13,22 @@
 // require a non-utility sandbox can be added here.  See
 // ServiceProcessHost::Launch() for how these templates are consumed.
 
+// chrome::mojom::RemovableStorageWriter
+namespace chrome {
+namespace mojom {
+class RemovableStorageWriter;
+}  // namespace mojom
+}  // namespace chrome
+template <>
+inline content::SandboxType
+content::GetServiceSandboxType<chrome::mojom::RemovableStorageWriter>() {
+#if defined(OS_WIN)
+  return SandboxType::kNoSandboxAndElevatedPrivileges;
+#else
+  return SandboxType::kNoSandbox;
+#endif
+}
+
 // chrome::mojom::UtilWin
 #if defined(OS_WIN)
 namespace chrome {

diff --git a/chrome/browser/ui/prefs/pref_watcher.cc b/chrome/browser/ui/prefs/pref_watcher.cc
index a738dc8..c66a8439 100644
--- a/chrome/browser/ui/prefs/pref_watcher.cc
+++ b/chrome/browser/ui/prefs/pref_watcher.cc

@@ -16,6 +16,10 @@
 #include "components/language/core/browser/pref_names.h"
 #include "third_party/blink/public/mojom/renderer_preferences.mojom.h"
 
+#if defined(OS_CHROMEOS)
+#include "ash/public/cpp/ash_pref_names.h"
+#endif
+
 namespace {
 
 // The list of prefs we want to observe.
@@ -51,6 +55,9 @@
     prefs::kWebkitTabsToLinks,
     prefs::kWebKitTextAreasAreResizable,
     prefs::kWebKitWebSecurityEnabled,
+#if defined(OS_CHROMEOS)
+    ash::prefs::kAccessibilityFocusHighlightEnabled,
+#endif
 };
 
 const int kWebPrefsToObserveLength = base::size(kWebPrefsToObserve);

diff --git a/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.cc b/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.cc
index c4843d9a..2395aa34 100644
--- a/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.cc
+++ b/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.cc

@@ -14,12 +14,14 @@
 #include "chrome/browser/ui/views/frame/toolbar_button_provider.h"
 #include "chrome/browser/ui/views/page_action/page_action_icon_view.h"
 #include "chrome/browser/ui/views/web_apps/web_app_info_image_source.h"
+#include "chrome/common/chrome_features.h"
 #include "chrome/grit/generated_resources.h"
 #include "components/strings/grit/components_strings.h"
 #include "components/url_formatter/elide_url.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/gfx/image/image_skia.h"
 #include "ui/gfx/text_elider.h"
+#include "ui/views/controls/button/checkbox.h"
 #include "ui/views/controls/button/label_button.h"
 #include "ui/views/controls/image_view.h"
 #include "ui/views/controls/label.h"
@@ -124,6 +126,17 @@
   labels->AddChildView(
       CreateOriginLabel(url::Origin::Create(web_app_info_->app_url)).release());
 
+  if (base::FeatureList::IsEnabled(features::kDesktopPWAsTabStrip)) {
+    // This UI is only for prototyping and is not intended for shipping.
+    DCHECK_EQ(features::kDesktopPWAsTabStrip.default_state,
+              base::FEATURE_DISABLED_BY_DEFAULT);
+    tabbed_window_checkbox_ = labels->AddChildView(
+        std::make_unique<views::Checkbox>(l10n_util::GetStringUTF16(
+            IDS_BOOKMARK_APP_BUBBLE_OPEN_AS_TABBED_WINDOW)));
+    tabbed_window_checkbox_->SetChecked(
+        web_app_info_->enable_experimental_tabbed_window);
+  }
+
   chrome::RecordDialogCreation(chrome::DialogIdentifier::PWA_CONFIRMATION);
 
   SetHighlightedButton(highlight_button);
@@ -146,6 +159,10 @@
 
 bool PWAConfirmationBubbleView::Accept() {
   DCHECK(web_app_info_);
+  if (tabbed_window_checkbox_) {
+    web_app_info_->enable_experimental_tabbed_window =
+        tabbed_window_checkbox_->GetChecked();
+  }
   std::move(callback_).Run(true, std::move(web_app_info_));
   return true;
 }

diff --git a/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.h b/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.h
index 893012a..f63db32a 100644
--- a/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.h
+++ b/chrome/browser/ui/views/web_apps/pwa_confirmation_bubble_view.h

@@ -10,6 +10,10 @@
 #include "chrome/common/web_application_info.h"
 #include "content/public/browser/web_contents.h"
 
+namespace views {
+class Checkbox;
+}
+
 // PWAConfirmationBubbleView provides a bubble dialog for accepting or rejecting
 // the installation of a PWA (Progressive Web App) anchored off the PWA install
 // icon in the omnibox.
@@ -32,6 +36,9 @@
   std::unique_ptr<WebApplicationInfo> web_app_info_;
   chrome::AppInstallationAcceptanceCallback callback_;
 
+  // Checkbox to launch window with tab strip.
+  views::Checkbox* tabbed_window_checkbox_ = nullptr;
+
   DISALLOW_COPY_AND_ASSIGN(PWAConfirmationBubbleView);
 };
 

diff --git a/chrome/browser/ui/views/web_apps/web_app_confirmation_view.cc b/chrome/browser/ui/views/web_apps/web_app_confirmation_view.cc
index cf08f013..0e2b9373 100644
--- a/chrome/browser/ui/views/web_apps/web_app_confirmation_view.cc
+++ b/chrome/browser/ui/views/web_apps/web_app_confirmation_view.cc

@@ -25,6 +25,7 @@
 #include "ui/base/resource/resource_bundle.h"
 #include "ui/gfx/image/image_skia.h"
 #include "ui/views/controls/button/checkbox.h"
+#include "ui/views/controls/button/radio_button.h"
 #include "ui/views/controls/textfield/textfield.h"
 #include "ui/views/layout/grid_layout.h"
 #include "ui/views/layout/layout_provider.h"
@@ -35,6 +36,13 @@
 bool g_auto_accept_web_app_for_testing = false;
 bool g_auto_check_open_in_window_for_testing = false;
 
+bool ShowRadioButtons() {
+  // This UI is only for prototyping and is not intended for shipping.
+  DCHECK_EQ(features::kDesktopPWAsTabStrip.default_state,
+            base::FEATURE_DISABLED_BY_DEFAULT);
+  return base::FeatureList::IsEnabled(features::kDesktopPWAsTabStrip);
+}
+
 }  // namespace
 
 WebAppConfirmationView::~WebAppConfirmationView() {}
@@ -88,16 +96,54 @@
   layout->AddPaddingRow(
       views::GridLayout::kFixedSize,
       layout_provider->GetDistanceMetric(DISTANCE_CONTROL_LIST_VERTICAL));
-  auto open_as_window_checkbox = std::make_unique<views::Checkbox>(
-      l10n_util::GetStringUTF16(IDS_BOOKMARK_APP_BUBBLE_OPEN_AS_WINDOW));
-  open_as_window_checkbox->SetChecked(web_app_info_->open_as_window);
-  layout->StartRow(views::GridLayout::kFixedSize, kColumnSetId);
-  layout->SkipColumns(1);
-  open_as_window_checkbox_ =
-      layout->AddView(std::move(open_as_window_checkbox));
+
+  if (ShowRadioButtons()) {
+    constexpr int kRadioGroupId = 1;
+    auto open_as_tab_radio = std::make_unique<views::RadioButton>(
+        l10n_util::GetStringUTF16(IDS_BOOKMARK_APP_BUBBLE_OPEN_AS_TAB),
+        kRadioGroupId);
+    auto open_as_window_radio = std::make_unique<views::RadioButton>(
+        l10n_util::GetStringUTF16(IDS_BOOKMARK_APP_BUBBLE_OPEN_AS_WINDOW),
+        kRadioGroupId);
+    auto open_as_tabbed_window_radio = std::make_unique<views::RadioButton>(
+        l10n_util::GetStringUTF16(
+            IDS_BOOKMARK_APP_BUBBLE_OPEN_AS_TABBED_WINDOW),
+        kRadioGroupId);
+
+    layout->StartRow(views::GridLayout::kFixedSize, kColumnSetId);
+    layout->SkipColumns(1);
+    open_as_tab_radio_ = layout->AddView(std::move(open_as_tab_radio));
+
+    layout->StartRow(views::GridLayout::kFixedSize, kColumnSetId);
+    layout->SkipColumns(1);
+    open_as_window_radio_ = layout->AddView(std::move(open_as_window_radio));
+
+    layout->StartRow(views::GridLayout::kFixedSize, kColumnSetId);
+    layout->SkipColumns(1);
+    open_as_tabbed_window_radio_ =
+        layout->AddView(std::move(open_as_tabbed_window_radio));
+
+    if (!web_app_info_->open_as_window)
+      open_as_tab_radio_->SetChecked(true);
+    else if (!web_app_info_->enable_experimental_tabbed_window)
+      open_as_window_radio_->SetChecked(true);
+    else
+      open_as_tabbed_window_radio_->SetChecked(true);
+  } else {
+    auto open_as_window_checkbox = std::make_unique<views::Checkbox>(
+        l10n_util::GetStringUTF16(IDS_BOOKMARK_APP_BUBBLE_OPEN_AS_WINDOW));
+    open_as_window_checkbox->SetChecked(web_app_info_->open_as_window);
+    layout->StartRow(views::GridLayout::kFixedSize, kColumnSetId);
+    layout->SkipColumns(1);
+    open_as_window_checkbox_ =
+        layout->AddView(std::move(open_as_window_checkbox));
+  }
 
   if (g_auto_check_open_in_window_for_testing) {
-    open_as_window_checkbox_->SetChecked(true);
+    if (ShowRadioButtons())
+      open_as_window_radio_->SetChecked(true);
+    else
+      open_as_window_checkbox_->SetChecked(true);
   }
 
   title_tf_->SelectAll(true);
@@ -130,8 +176,17 @@
 bool WebAppConfirmationView::Accept() {
   DCHECK(web_app_info_);
   web_app_info_->title = GetTrimmedTitle();
-  web_app_info_->open_as_window =
-      open_as_window_checkbox_ && open_as_window_checkbox_->GetChecked();
+  if (ShowRadioButtons()) {
+    if (open_as_tabbed_window_radio_->GetChecked()) {
+      web_app_info_->open_as_window = true;
+      web_app_info_->enable_experimental_tabbed_window = true;
+    } else {
+      web_app_info_->open_as_window = open_as_window_radio_->GetChecked();
+      web_app_info_->enable_experimental_tabbed_window = false;
+    }
+  } else {
+    web_app_info_->open_as_window = open_as_window_checkbox_->GetChecked();
+  }
   std::move(callback_).Run(true, std::move(web_app_info_));
   return true;
 }

diff --git a/chrome/browser/ui/views/web_apps/web_app_confirmation_view.h b/chrome/browser/ui/views/web_apps/web_app_confirmation_view.h
index 3058b7c0..38f0589 100644
--- a/chrome/browser/ui/views/web_apps/web_app_confirmation_view.h
+++ b/chrome/browser/ui/views/web_apps/web_app_confirmation_view.h

@@ -15,6 +15,7 @@
 namespace views {
 class Checkbox;
 class Textfield;
+class RadioButton;
 }  // namespace views
 
 // WebAppConfirmationView provides views for editing the details to
@@ -55,6 +56,11 @@
   // Checkbox to launch as a window.
   views::Checkbox* open_as_window_checkbox_ = nullptr;
 
+  // Radio buttons to launch as a tab, window or tabbed window.
+  views::RadioButton* open_as_tab_radio_ = nullptr;
+  views::RadioButton* open_as_window_radio_ = nullptr;
+  views::RadioButton* open_as_tabbed_window_radio_ = nullptr;
+
   // Textfield showing the title of the app.
   views::Textfield* title_tf_ = nullptr;
 

diff --git a/chrome/browser/ui/views/web_apps/web_app_tab_strip_browsertest.cc b/chrome/browser/ui/views/web_apps/web_app_tab_strip_browsertest.cc
index b9f677e..14bd3de 100644
--- a/chrome/browser/ui/views/web_apps/web_app_tab_strip_browsertest.cc
+++ b/chrome/browser/ui/views/web_apps/web_app_tab_strip_browsertest.cc

@@ -52,10 +52,8 @@
   web_app_info->scope = embedded_test_server()->GetURL("/web_apps");
   web_app_info->title = base::ASCIIToUTF16("Test app");
   web_app_info->open_as_window = true;
+  web_app_info->enable_experimental_tabbed_window = true;
   AppId app_id = InstallWebApp(profile, std::move(web_app_info));
-  WebAppProviderBase::GetProviderBase(profile)
-      ->registry_controller()
-      .SetExperimentalTabbedWindowMode(app_id, true);
 
   Browser* app_browser = LaunchWebAppBrowser(profile, app_id);
   CustomTabBarView* custom_tab_bar =
@@ -106,10 +104,8 @@
   web_app_info->scope = app_url.GetWithoutFilename();
   web_app_info->title = base::ASCIIToUTF16("Test app");
   web_app_info->open_as_window = true;
+  web_app_info->enable_experimental_tabbed_window = true;
   AppId app_id = InstallWebApp(profile, std::move(web_app_info));
-  WebAppProviderBase::GetProviderBase(profile)
-      ->registry_controller()
-      .SetExperimentalTabbedWindowMode(app_id, true);
   Browser* app_browser = LaunchWebAppBrowser(profile, app_id);
   content::WebContents* web_contents =
       app_browser->tab_strip_model()->GetActiveWebContents();

diff --git a/chrome/browser/ui/webui/new_tab_page/new_tab_page.mojom b/chrome/browser/ui/webui/new_tab_page/new_tab_page.mojom
index 9aa9fc7d8..e646277 100644
--- a/chrome/browser/ui/webui/new_tab_page/new_tab_page.mojom
+++ b/chrome/browser/ui/webui/new_tab_page/new_tab_page.mojom

@@ -118,6 +118,7 @@
   skia.mojom.SkColor results_dim_selected;
   skia.mojom.SkColor results_text;
   skia.mojom.SkColor results_text_selected;
+  skia.mojom.SkColor results_url;
   skia.mojom.SkColor results_url_selected;
   skia.mojom.SkColor text;
 };

diff --git a/chrome/browser/ui/webui/new_tab_page/new_tab_page_handler.cc b/chrome/browser/ui/webui/new_tab_page/new_tab_page_handler.cc
index cbc13a7..316be98 100644
--- a/chrome/browser/ui/webui/new_tab_page/new_tab_page_handler.cc
+++ b/chrome/browser/ui/webui/new_tab_page/new_tab_page_handler.cc

@@ -148,6 +148,7 @@
   search_box->results_text = ntp_theme.search_box.results_text;
   search_box->results_text_selected =
       ntp_theme.search_box.results_text_selected;
+  search_box->results_url = ntp_theme.search_box.results_url;
   search_box->results_url_selected = ntp_theme.search_box.results_url_selected;
   search_box->text = ntp_theme.search_box.text;
   theme->search_box = std::move(search_box);

diff --git a/chrome/browser/ui/webui/settings/settings_secure_dns_handler.cc b/chrome/browser/ui/webui/settings/settings_secure_dns_handler.cc
index 57e6ec9..b0818ee 100644
--- a/chrome/browser/ui/webui/settings/settings_secure_dns_handler.cc
+++ b/chrome/browser/ui/webui/settings/settings_secure_dns_handler.cc

@@ -11,8 +11,8 @@
 #include "base/metrics/histogram_macros.h"
 #include "base/rand_util.h"
 #include "chrome/browser/browser_process.h"
-#include "chrome/browser/net/dns_util.h"
 #include "chrome/browser/net/secure_dns_config.h"
+#include "chrome/browser/net/secure_dns_util.h"
 #include "chrome/browser/net/stub_resolver_config_reader.h"
 #include "chrome/browser/net/system_network_context_manager.h"
 #include "chrome/common/chrome_features.h"
@@ -203,9 +203,9 @@
 
   // Return all templates in the entry, or none if they are not all valid.
   base::Value templates(base::Value::Type::LIST);
-  if (chrome_browser_net::IsValidDohTemplateGroup(custom_entry)) {
+  if (chrome_browser_net::secure_dns::IsValidGroup(custom_entry)) {
     for (base::StringPiece t :
-         chrome_browser_net::SplitDohTemplateGroup(custom_entry)) {
+         chrome_browser_net::secure_dns::SplitGroup(custom_entry)) {
       templates.Append(t);
     }
   }
@@ -236,7 +236,7 @@
   overrides.attempts = 1;
   overrides.randomize_ports = false;
   overrides.secure_dns_mode = net::DnsConfig::SecureDnsMode::SECURE;
-  chrome_browser_net::ApplyDohTemplate(&overrides, server_template);
+  chrome_browser_net::secure_dns::ApplyTemplate(&overrides, server_template);
   DCHECK(!runner_);
   runner_ = std::make_unique<chrome_browser_net::DnsProbeRunner>(
       overrides, network_context_getter_);

diff --git a/chrome/browser/ui/webui/tab_strip/tab_strip_ui_util.cc b/chrome/browser/ui/webui/tab_strip/tab_strip_ui_util.cc
index 6ed805a0..1f4b5460 100644
--- a/chrome/browser/ui/webui/tab_strip/tab_strip_ui_util.cc
+++ b/chrome/browser/ui/webui/tab_strip/tab_strip_ui_util.cc

@@ -14,6 +14,7 @@
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_list.h"
+#include "chrome/browser/ui/tabs/tab_group.h"
 #include "chrome/browser/ui/tabs/tab_group_model.h"
 #include "chrome/browser/ui/webui/tab_strip/tab_strip_ui.h"
 #include "components/tab_groups/tab_group_id.h"
@@ -92,8 +93,8 @@
     if (!iter.ReadStringPiece16(&type) || !iter.ReadStringPiece16(&data))
       return false;
 
-    // TODO(https://crbug.com/1069869): handle tab group drags.
-    if (type == base::ASCIIToUTF16(kWebUITabIdDataType))
+    if (type == base::ASCIIToUTF16(kWebUITabIdDataType) ||
+        type == base::ASCIIToUTF16(kWebUITabGroupIdDataType))
       return true;
   }
 
@@ -106,30 +107,69 @@
   drop_data.GetPickledData(ui::ClipboardFormatType::GetWebCustomDataType(),
                            &pickle);
 
-  // TODO(https://crbug.com/1069869): handle tab group drags.
   base::string16 tab_id_str;
+  base::string16 group_id_str;
   ui::ReadCustomDataForType(pickle.data(), pickle.size(),
                             base::ASCIIToUTF16(kWebUITabIdDataType),
                             &tab_id_str);
-  if (tab_id_str.empty())
-    return false;
+  if (tab_id_str.empty()) {
+    ui::ReadCustomDataForType(pickle.data(), pickle.size(),
+                              base::ASCIIToUTF16(kWebUITabGroupIdDataType),
+                              &group_id_str);
+  }
 
-  // |tab_id_str| should contain the extension tab id as a string.
-  int tab_id = -1;
-  if (!base::StringToInt(tab_id_str, &tab_id))
+  if (tab_id_str.empty() && group_id_str.empty())
     return false;
 
   Browser* source_browser = nullptr;
-  int source_index = -1;
-  if (!extensions::ExtensionTabUtil::GetTabById(
-          tab_id, new_browser->profile(), /* include_incognito = */ false,
-          &source_browser, /* tab_strip = */ nullptr,
-          /* contents = */ nullptr, &source_index)) {
-    return false;
+  std::vector<int> tab_indices_to_move;
+  base::Optional<tab_groups::TabGroupId> target_group_id;
+
+  // TODO(https://crbug.com/1069869): de-duplicate with
+  // TabStripUIHandler::HandleMoveTab and
+  // TabStripUIHandler::HandleMoveGroup.
+
+  if (!tab_id_str.empty()) {
+    int tab_id = -1;
+    if (!base::StringToInt(tab_id_str, &tab_id))
+      return false;
+
+    int source_index = -1;
+    if (!extensions::ExtensionTabUtil::GetTabById(
+            tab_id, new_browser->profile(), /* include_incognito = */ false,
+            &source_browser, /* tab_strip = */ nullptr,
+            /* contents = */ nullptr, &source_index)) {
+      return false;
+    }
+    tab_indices_to_move.push_back(source_index);
+  } else {
+    std::string group_id_utf8 = base::UTF16ToUTF8(group_id_str);
+    source_browser =
+        GetBrowserWithGroupId(new_browser->profile(), group_id_utf8);
+    if (!source_browser)
+      return false;
+    base::Optional<tab_groups::TabGroupId> source_group_id =
+        GetTabGroupIdFromString(
+            source_browser->tab_strip_model()->group_model(), group_id_utf8);
+    if (!source_group_id)
+      return false;
+
+    TabGroup* source_group =
+        source_browser->tab_strip_model()->group_model()->GetTabGroup(
+            *source_group_id);
+    tab_indices_to_move = source_group->ListTabs();
+
+    // Create a new group with the same visuals.
+    target_group_id = tab_groups::TabGroupId::GenerateNew();
+    new_browser->tab_strip_model()->group_model()->AddTabGroup(
+        *target_group_id, *source_group->visual_data());
   }
 
-  MoveTabAcrossWindows(source_browser, source_index, new_browser, 0,
-                       base::nullopt);
+  for (size_t i = 0; i < tab_indices_to_move.size(); ++i) {
+    int source_index = tab_indices_to_move[i] - i;
+    MoveTabAcrossWindows(source_browser, source_index, new_browser, i,
+                         target_group_id);
+  }
   new_browser->tab_strip_model()->ActivateTabAt(0);
   return true;
 }

diff --git a/chrome/browser/web_applications/BUILD.gn b/chrome/browser/web_applications/BUILD.gn
index 3cd38ba..6181b1a7 100644
--- a/chrome/browser/web_applications/BUILD.gn
+++ b/chrome/browser/web_applications/BUILD.gn

@@ -125,6 +125,8 @@
     "test/service_worker_registration_waiter.h",
     "test/test_app_registrar.cc",
     "test/test_app_registrar.h",
+    "test/test_app_registry_controller.cc",
+    "test/test_app_registry_controller.h",
     "test/test_app_shortcut_manager.cc",
     "test/test_app_shortcut_manager.h",
     "test/test_data_retriever.cc",

diff --git a/chrome/browser/web_applications/components/install_finalizer.cc b/chrome/browser/web_applications/components/install_finalizer.cc
index 113b12b..0f1e445 100644
--- a/chrome/browser/web_applications/components/install_finalizer.cc
+++ b/chrome/browser/web_applications/components/install_finalizer.cc

@@ -41,10 +41,13 @@
                           std::move(callback));
 }
 
-void InstallFinalizer::SetSubsystems(AppRegistrar* registrar,
-                                     WebAppUiManager* ui_manager) {
+void InstallFinalizer::SetSubsystems(
+    AppRegistrar* registrar,
+    WebAppUiManager* ui_manager,
+    AppRegistryController* registry_controller) {
   registrar_ = registrar;
   ui_manager_ = ui_manager;
+  registry_controller_ = registry_controller;
 }
 
 bool InstallFinalizer::CanAddAppToQuickLaunchBar() const {

diff --git a/chrome/browser/web_applications/components/install_finalizer.h b/chrome/browser/web_applications/components/install_finalizer.h
index 726db79ac..9173f29e 100644
--- a/chrome/browser/web_applications/components/install_finalizer.h
+++ b/chrome/browser/web_applications/components/install_finalizer.h

@@ -25,6 +25,7 @@
 enum class ExternalInstallSource;
 enum class InstallResultCode;
 class AppRegistrar;
+class AppRegistryController;
 class WebAppUiManager;
 
 // An abstract finalizer for the installation process, represents the last step.
@@ -102,16 +103,20 @@
                            bool shortcut_created,
                            content::WebContents* web_contents);
 
-  void SetSubsystems(AppRegistrar* registrar, WebAppUiManager* ui_manager);
+  void SetSubsystems(AppRegistrar* registrar,
+                     WebAppUiManager* ui_manager,
+                     AppRegistryController* registry_controller);
 
   virtual ~InstallFinalizer() = default;
 
  protected:
   AppRegistrar& registrar() const { return *registrar_; }
   WebAppUiManager& ui_manager() const { return *ui_manager_; }
+  AppRegistryController& registry_controller() { return *registry_controller_; }
 
  private:
   AppRegistrar* registrar_ = nullptr;
+  AppRegistryController* registry_controller_ = nullptr;
   WebAppUiManager* ui_manager_ = nullptr;
 };
 

diff --git a/chrome/browser/web_applications/components/install_finalizer_unittest.cc b/chrome/browser/web_applications/components/install_finalizer_unittest.cc
index ecd4144..2b7d122e 100644
--- a/chrome/browser/web_applications/components/install_finalizer_unittest.cc
+++ b/chrome/browser/web_applications/components/install_finalizer_unittest.cc

@@ -21,6 +21,7 @@
 #include "chrome/browser/web_applications/test/web_app_test.h"
 #include "chrome/browser/web_applications/web_app_icon_manager.h"
 #include "chrome/browser/web_applications/web_app_install_finalizer.h"
+#include "chrome/browser/web_applications/web_app_sync_bridge.h"
 #include "chrome/common/chrome_features.h"
 #include "chrome/common/web_application_info.h"
 #include "testing/gtest/include/gtest/gtest-param-test.h"
@@ -84,8 +85,7 @@
     switch (GetParam()) {
       case ProviderType::kWebApps:
         finalizer_ = std::make_unique<WebAppInstallFinalizer>(
-            profile(), &test_registry_controller_->sync_bridge(),
-            icon_manager_.get());
+            profile(), icon_manager_.get());
         break;
       case ProviderType::kBookmarkApps:
         InitializeEmptyExtensionService(profile());
@@ -94,7 +94,8 @@
         break;
     }
 
-    finalizer_->SetSubsystems(&registrar(), ui_manager_.get());
+    finalizer_->SetSubsystems(&registrar(), ui_manager_.get(),
+                              &test_registry_controller_->sync_bridge());
     test_registry_controller_->Init();
   }
 

diff --git a/chrome/browser/web_applications/extensions/bookmark_app_install_finalizer.cc b/chrome/browser/web_applications/extensions/bookmark_app_install_finalizer.cc
index eda05ebe..995eccc 100644
--- a/chrome/browser/web_applications/extensions/bookmark_app_install_finalizer.cc
+++ b/chrome/browser/web_applications/extensions/bookmark_app_install_finalizer.cc

@@ -16,6 +16,7 @@
 #include "chrome/browser/extensions/crx_installer.h"
 #include "chrome/browser/extensions/launch_util.h"
 #include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/web_applications/components/app_registry_controller.h"
 #include "chrome/browser/web_applications/components/web_app_constants.h"
 #include "chrome/browser/web_applications/components/web_app_helpers.h"
 #include "chrome/browser/web_applications/components/web_app_prefs_utils.h"
@@ -68,7 +69,7 @@
   crx_installer->set_installer_callback(base::BindOnce(
       &BookmarkAppInstallFinalizer::OnExtensionInstalled,
       weak_ptr_factory_.GetWeakPtr(), web_app_info.app_url, launch_type,
-      options.locally_installed,
+      web_app_info.enable_experimental_tabbed_window, options.locally_installed,
       options.install_source == WebappInstallSource::SYSTEM_DEFAULT,
       std::move(callback), crx_installer));
 
@@ -244,6 +245,7 @@
 void BookmarkAppInstallFinalizer::OnExtensionInstalled(
     const GURL& app_url,
     LaunchType launch_type,
+    bool enable_experimental_tabbed_window,
     bool is_locally_installed,
     bool is_system_app,
     InstallFinalizedCallback callback,
@@ -287,6 +289,9 @@
 
   SetLaunchType(profile_, extension->id(), launch_type);
 
+  registry_controller().SetExperimentalTabbedWindowMode(
+      extension->id(), enable_experimental_tabbed_window);
+
   SetBookmarkAppIsLocallyInstalled(profile_, extension, is_locally_installed);
 
   registrar().NotifyWebAppInstalled(extension->id());

diff --git a/chrome/browser/web_applications/extensions/bookmark_app_install_finalizer.h b/chrome/browser/web_applications/extensions/bookmark_app_install_finalizer.h
index 7f40a251b..1a5b6ff 100644
--- a/chrome/browser/web_applications/extensions/bookmark_app_install_finalizer.h
+++ b/chrome/browser/web_applications/extensions/bookmark_app_install_finalizer.h

@@ -69,6 +69,7 @@
 
   void OnExtensionInstalled(const GURL& app_url,
                             LaunchType launch_type,
+                            bool enable_experimental_tabbed_window,
                             bool is_locally_installed,
                             bool is_system_app,
                             InstallFinalizedCallback callback,

diff --git a/chrome/browser/web_applications/extensions/bookmark_app_install_finalizer_unittest.cc b/chrome/browser/web_applications/extensions/bookmark_app_install_finalizer_unittest.cc
index ac0d1a9a..6a8387667 100644
--- a/chrome/browser/web_applications/extensions/bookmark_app_install_finalizer_unittest.cc
+++ b/chrome/browser/web_applications/extensions/bookmark_app_install_finalizer_unittest.cc

@@ -22,6 +22,7 @@
 #include "chrome/browser/web_applications/components/web_app_helpers.h"
 #include "chrome/browser/web_applications/extensions/bookmark_app_registrar.h"
 #include "chrome/browser/web_applications/extensions/bookmark_app_util.h"
+#include "chrome/browser/web_applications/test/test_app_registry_controller.h"
 #include "chrome/browser/web_applications/test/test_web_app_ui_manager.h"
 #include "chrome/common/web_application_info.h"
 #include "chrome/test/base/chrome_render_view_host_test_harness.h"
@@ -152,10 +153,13 @@
                                         false /* autoupdate_enabled */);
 
     registrar_ = std::make_unique<BookmarkAppRegistrar>(profile());
+    registry_controller_ =
+        std::make_unique<web_app::TestAppRegistryController>(profile());
     ui_manager_ = std::make_unique<web_app::TestWebAppUiManager>();
 
     finalizer_ = std::make_unique<BookmarkAppInstallFinalizer>(profile());
-    finalizer_->SetSubsystems(registrar_.get(), ui_manager_.get());
+    finalizer_->SetSubsystems(registrar_.get(), ui_manager_.get(),
+                              registry_controller_.get());
   }
 
   web_app::AppId InstallExternalApp(const GURL& app_url) {
@@ -201,6 +205,7 @@
 
  private:
   std::unique_ptr<BookmarkAppRegistrar> registrar_;
+  std::unique_ptr<web_app::TestAppRegistryController> registry_controller_;
   std::unique_ptr<web_app::TestWebAppUiManager> ui_manager_;
   std::unique_ptr<BookmarkAppInstallFinalizer> finalizer_;
 

diff --git a/chrome/browser/web_applications/extensions/install_manager_bookmark_app_unittest.cc b/chrome/browser/web_applications/extensions/install_manager_bookmark_app_unittest.cc
index 325b2654..cfcb7dd 100644
--- a/chrome/browser/web_applications/extensions/install_manager_bookmark_app_unittest.cc
+++ b/chrome/browser/web_applications/extensions/install_manager_bookmark_app_unittest.cc

@@ -27,6 +27,7 @@
 #include "chrome/browser/web_applications/test/test_data_retriever.h"
 #include "chrome/browser/web_applications/test/test_web_app_provider.h"
 #include "chrome/browser/web_applications/test/test_web_app_url_loader.h"
+#include "chrome/browser/web_applications/test/web_app_test.h"
 #include "chrome/browser/web_applications/web_app_install_manager.h"
 #include "chrome/common/chrome_features.h"
 #include "chrome/common/extensions/manifest_handlers/app_launch_info.h"
@@ -84,17 +85,6 @@
   web_app->icon_bitmaps[size] = CreateSquareBitmapWithColor(size, color);
 }
 
-void TestAcceptDialogCallback(
-    content::WebContents* initiator_web_contents,
-    std::unique_ptr<WebApplicationInfo> web_app_info,
-    web_app::ForInstallableSite for_installable_site,
-    web_app::InstallManager::WebAppInstallationAcceptanceCallback
-        acceptance_callback) {
-  base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, base::BindOnce(std::move(acceptance_callback), true /*accept*/,
-                                std::move(web_app_info)));
-}
-
 // Use only real BookmarkAppInstallFinalizer::FinalizeInstall and mock any other
 // finalization steps as a no-operation.
 class BookmarkAppInstallFinalizerInstallOnly
@@ -257,7 +247,7 @@
     provider->install_manager().InstallWebAppFromManifestWithFallback(
         web_contents(),
         /*force_shortcut_app=*/false, WebappInstallSource::MENU_BROWSER_TAB,
-        base::BindOnce(TestAcceptDialogCallback),
+        base::BindOnce(web_app::TestAcceptDialogCallback),
         base::BindLambdaForTesting([&](const web_app::AppId& installed_app_id,
                                        web_app::InstallResultCode code) {
           EXPECT_EQ(web_app::InstallResultCode::kSuccessNewInstall, code);

diff --git a/chrome/browser/web_applications/manifest_update_manager_browsertest.cc b/chrome/browser/web_applications/manifest_update_manager_browsertest.cc
index 07d96d2..89181e0 100644
--- a/chrome/browser/web_applications/manifest_update_manager_browsertest.cc
+++ b/chrome/browser/web_applications/manifest_update_manager_browsertest.cc

@@ -18,6 +18,7 @@
 #include "chrome/browser/ui/browser_commands.h"
 #include "chrome/browser/web_applications/components/app_icon_manager.h"
 #include "chrome/browser/web_applications/components/app_registry_controller.h"
+#include "chrome/browser/web_applications/components/app_shortcut_manager.h"
 #include "chrome/browser/web_applications/components/install_finalizer.h"
 #include "chrome/browser/web_applications/components/install_manager.h"
 #include "chrome/browser/web_applications/components/pending_app_manager.h"
@@ -109,10 +110,7 @@
     : public InProcessBrowserTest,
       public ::testing::WithParamInterface<ProviderType> {
  public:
-  ManifestUpdateManagerBrowserTest() = default;
-  ~ManifestUpdateManagerBrowserTest() override = default;
-
-  void SetUp() override {
+  ManifestUpdateManagerBrowserTest() {
     if (GetParam() == ProviderType::kWebApps) {
       scoped_feature_list_.InitWithFeatures(
           {features::kDesktopPWAsLocalUpdating,
@@ -123,7 +121,11 @@
           {features::kDesktopPWAsLocalUpdating},
           {features::kDesktopPWAsWithoutExtensions});
     }
+  }
 
+  ~ManifestUpdateManagerBrowserTest() override = default;
+
+  void SetUp() override {
     http_server_.AddDefaultHandlers(GetChromeTestDataDir());
     http_server_.RegisterRequestHandler(base::BindRepeating(
         &ManifestUpdateManagerBrowserTest::RequestHandlerOverride,
@@ -133,6 +135,10 @@
     InProcessBrowserTest::SetUp();
   }
 
+  void SetUpOnMainThread() override {
+    GetProvider().shortcut_manager().SuppressShortcutsForTesting();
+  }
+
   std::unique_ptr<net::test_server::HttpResponse> RequestHandlerOverride(
       const net::test_server::HttpRequest& request) {
     if (request_override_)
@@ -172,16 +178,10 @@
 
     AppId app_id;
     base::RunLoop run_loop;
-    InstallManager::InstallParams params;
-    params.fallback_start_url = http_server_.GetURL("/fallback-url");
-    params.add_to_applications_menu = false;
-    params.add_to_desktop = false;
-    params.add_to_quick_launch_bar = false;
-    params.bypass_service_worker_check = true;
-    params.require_manifest = false;
-    GetProvider().install_manager().InstallWebAppWithParams(
-        browser()->tab_strip_model()->GetActiveWebContents(), params,
-        WebappInstallSource::OMNIBOX_INSTALL_ICON,
+    GetProvider().install_manager().InstallWebAppFromManifestWithFallback(
+        browser()->tab_strip_model()->GetActiveWebContents(),
+        /*force_shortcut_app=*/false, WebappInstallSource::OMNIBOX_INSTALL_ICON,
+        base::BindOnce(TestAcceptDialogCallback),
         base::BindLambdaForTesting(
             [&](const AppId& new_app_id, InstallResultCode code) {
               EXPECT_EQ(code, InstallResultCode::kSuccessNewInstall);

diff --git a/chrome/browser/web_applications/test/test_app_registry_controller.cc b/chrome/browser/web_applications/test/test_app_registry_controller.cc
new file mode 100644
index 0000000..ea5cd40f
--- /dev/null
+++ b/chrome/browser/web_applications/test/test_app_registry_controller.cc

@@ -0,0 +1,32 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/web_applications/test/test_app_registry_controller.h"
+
+namespace web_app {
+
+TestAppRegistryController::TestAppRegistryController(Profile* profile)
+    : AppRegistryController(profile) {}
+TestAppRegistryController::~TestAppRegistryController() = default;
+
+void TestAppRegistryController::Init(base::OnceClosure callback) {
+  std::move(callback).Run();
+}
+
+void TestAppRegistryController::SetAppUserDisplayMode(
+    const AppId& app_id,
+    DisplayMode display_mode) {}
+
+void TestAppRegistryController::SetAppIsDisabled(const AppId& app_id,
+                                                 bool is_disabled) {}
+
+void TestAppRegistryController::SetAppIsLocallyInstalled(
+    const AppId& app_id,
+    bool is_locally_installed) {}
+
+WebAppSyncBridge* TestAppRegistryController::AsWebAppSyncBridge() {
+  return nullptr;
+}
+
+}  // namespace web_app

diff --git a/chrome/browser/web_applications/test/test_app_registry_controller.h b/chrome/browser/web_applications/test/test_app_registry_controller.h
new file mode 100644
index 0000000..a0037ce1
--- /dev/null
+++ b/chrome/browser/web_applications/test/test_app_registry_controller.h

@@ -0,0 +1,29 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_WEB_APPLICATIONS_TEST_TEST_APP_REGISTRY_CONTROLLER_H_
+#define CHROME_BROWSER_WEB_APPLICATIONS_TEST_TEST_APP_REGISTRY_CONTROLLER_H_
+
+#include "chrome/browser/web_applications/components/app_registry_controller.h"
+
+namespace web_app {
+
+class TestAppRegistryController : public AppRegistryController {
+ public:
+  explicit TestAppRegistryController(Profile* profile);
+  ~TestAppRegistryController() override;
+
+  // AppRegistryController:
+  void Init(base::OnceClosure callback) override;
+  void SetAppUserDisplayMode(const AppId& app_id,
+                             DisplayMode display_mode) override;
+  void SetAppIsDisabled(const AppId& app_id, bool is_disabled) override;
+  void SetAppIsLocallyInstalled(const AppId& app_id,
+                                bool is_locally_installed) override;
+  WebAppSyncBridge* AsWebAppSyncBridge() override;
+};
+
+}  // namespace web_app
+
+#endif  // CHROME_BROWSER_WEB_APPLICATIONS_TEST_TEST_APP_REGISTRY_CONTROLLER_H_

diff --git a/chrome/browser/web_applications/test/web_app_test.cc b/chrome/browser/web_applications/test/web_app_test.cc
index 8a32eaa..855fb63 100644
--- a/chrome/browser/web_applications/test/web_app_test.cc
+++ b/chrome/browser/web_applications/test/web_app_test.cc

@@ -4,6 +4,9 @@
 
 #include "chrome/browser/web_applications/test/web_app_test.h"
 
+#include "base/threading/thread_task_runner_handle.h"
+#include "chrome/common/web_application_info.h"
+
 namespace web_app {
 
 std::string ProviderTypeParamToString(
@@ -16,4 +19,24 @@
   }
 }
 
+void TestAcceptDialogCallback(
+    content::WebContents* initiator_web_contents,
+    std::unique_ptr<WebApplicationInfo> web_app_info,
+    ForInstallableSite for_installable_site,
+    InstallManager::WebAppInstallationAcceptanceCallback acceptance_callback) {
+  base::ThreadTaskRunnerHandle::Get()->PostTask(
+      FROM_HERE, base::BindOnce(std::move(acceptance_callback), true /*accept*/,
+                                std::move(web_app_info)));
+}
+
+void TestDeclineDialogCallback(
+    content::WebContents* initiator_web_contents,
+    std::unique_ptr<WebApplicationInfo> web_app_info,
+    ForInstallableSite for_installable_site,
+    InstallManager::WebAppInstallationAcceptanceCallback acceptance_callback) {
+  base::ThreadTaskRunnerHandle::Get()->PostTask(
+      FROM_HERE, base::BindOnce(std::move(acceptance_callback),
+                                false /*accept*/, std::move(web_app_info)));
+}
+
 }  // namespace web_app

diff --git a/chrome/browser/web_applications/test/web_app_test.h b/chrome/browser/web_applications/test/web_app_test.h
index 84be978..c3f41bc 100644
--- a/chrome/browser/web_applications/test/web_app_test.h
+++ b/chrome/browser/web_applications/test/web_app_test.h

@@ -5,9 +5,19 @@
 #ifndef CHROME_BROWSER_WEB_APPLICATIONS_TEST_WEB_APP_TEST_H_
 #define CHROME_BROWSER_WEB_APPLICATIONS_TEST_WEB_APP_TEST_H_
 
+#include <memory>
+
+#include "chrome/browser/web_applications/components/web_app_install_utils.h"
+#include "chrome/browser/web_applications/web_app_install_manager.h"
 #include "chrome/test/base/chrome_render_view_host_test_harness.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
+struct WebApplicationInfo;
+
+namespace content {
+class WebContents;
+}  // namespace content
+
 namespace web_app {
 
 enum class ProviderType { kBookmarkApps, kWebApps };
@@ -15,6 +25,18 @@
 std::string ProviderTypeParamToString(
     const ::testing::TestParamInfo<ProviderType>& provider_type);
 
+void TestAcceptDialogCallback(
+    content::WebContents* initiator_web_contents,
+    std::unique_ptr<WebApplicationInfo> web_app_info,
+    ForInstallableSite for_installable_site,
+    InstallManager::WebAppInstallationAcceptanceCallback acceptance_callback);
+
+void TestDeclineDialogCallback(
+    content::WebContents* initiator_web_contents,
+    std::unique_ptr<WebApplicationInfo> web_app_info,
+    ForInstallableSite for_installable_site,
+    InstallManager::WebAppInstallationAcceptanceCallback acceptance_callback);
+
 }  // namespace web_app
 
 // Consider to implement web app specific test harness independent of

diff --git a/chrome/browser/web_applications/web_app_install_finalizer.cc b/chrome/browser/web_applications/web_app_install_finalizer.cc
index 6080ad6..41b05467 100644
--- a/chrome/browser/web_applications/web_app_install_finalizer.cc
+++ b/chrome/browser/web_applications/web_app_install_finalizer.cc

@@ -129,10 +129,8 @@
 }  // namespace
 
 WebAppInstallFinalizer::WebAppInstallFinalizer(Profile* profile,
-                                               WebAppSyncBridge* sync_bridge,
                                                WebAppIconManager* icon_manager)
     : profile_(profile),
-      sync_bridge_(sync_bridge),
       icon_manager_(icon_manager) {}
 
 WebAppInstallFinalizer::~WebAppInstallFinalizer() = default;
@@ -179,6 +177,12 @@
 
   UpdateIntWebAppPref(profile_->GetPrefs(), app_id, kLatestWebAppInstallSource,
                       static_cast<int>(options.install_source));
+
+  // TODO(crbug.com/897314): Store this as a display mode on WebApp to
+  // participate in the DB transactional model.
+  registry_controller().SetExperimentalTabbedWindowMode(
+      app_id, web_app_info.enable_experimental_tabbed_window);
+
   SetWebAppManifestFieldsAndWriteData(web_app_info, std::move(web_app),
                                       /*is_new_install=*/true,
                                       std::move(callback));
@@ -328,7 +332,7 @@
   if (ShouldRegisterShortcutsMenuWithOs())
     UnregisterShortcutsMenuWithOs(app_id, profile_->GetPath());
 
-  ScopedRegistryUpdate update(sync_bridge_);
+  ScopedRegistryUpdate update(registry_controller().AsWebAppSyncBridge());
   update->DeleteApp(app_id);
 
   icon_manager_->DeleteData(
@@ -352,7 +356,7 @@
   if (app->HasOnlySource(source)) {
     UninstallWebApp(app_id, std::move(callback));
   } else {
-    ScopedRegistryUpdate update(sync_bridge_);
+    ScopedRegistryUpdate update(registry_controller().AsWebAppSyncBridge());
     WebApp* app_to_update = update->UpdateApp(app_id);
     app_to_update->RemoveSource(source);
 
@@ -428,7 +432,8 @@
 
   AppId app_id = web_app->app_id();
 
-  std::unique_ptr<WebAppRegistryUpdate> update = sync_bridge_->BeginUpdate();
+  std::unique_ptr<WebAppRegistryUpdate> update =
+      registry_controller().AsWebAppSyncBridge()->BeginUpdate();
 
   WebApp* app_to_override = update->UpdateApp(app_id);
   if (app_to_override)
@@ -436,7 +441,7 @@
   else
     update->CreateApp(std::move(web_app));
 
-  sync_bridge_->CommitUpdate(
+  registry_controller().AsWebAppSyncBridge()->CommitUpdate(
       std::move(update),
       base::BindOnce(&WebAppInstallFinalizer::OnDatabaseCommitCompleted,
                      weak_ptr_factory_.GetWeakPtr(), std::move(callback),

diff --git a/chrome/browser/web_applications/web_app_install_finalizer.h b/chrome/browser/web_applications/web_app_install_finalizer.h
index 978465f..dc5117d 100644
--- a/chrome/browser/web_applications/web_app_install_finalizer.h
+++ b/chrome/browser/web_applications/web_app_install_finalizer.h

@@ -20,12 +20,10 @@
 class WebApp;
 class WebAppIconManager;
 class WebAppRegistrar;
-class WebAppSyncBridge;
 
 class WebAppInstallFinalizer final : public InstallFinalizer {
  public:
   WebAppInstallFinalizer(Profile* profile,
-                         WebAppSyncBridge* sync_bridge,
                          WebAppIconManager* icon_manager);
   ~WebAppInstallFinalizer() override;
 
@@ -82,7 +80,6 @@
   WebAppRegistrar& GetWebAppRegistrar() const;
 
   Profile* const profile_;
-  WebAppSyncBridge* const sync_bridge_;
   WebAppIconManager* const icon_manager_;
 
   base::WeakPtrFactory<WebAppInstallFinalizer> weak_ptr_factory_{this};

diff --git a/chrome/browser/web_applications/web_app_install_manager_unittest.cc b/chrome/browser/web_applications/web_app_install_manager_unittest.cc
index 4475c22..71ffd1d 100644
--- a/chrome/browser/web_applications/web_app_install_manager_unittest.cc
+++ b/chrome/browser/web_applications/web_app_install_manager_unittest.cc

@@ -35,6 +35,7 @@
 #include "chrome/browser/web_applications/web_app_icon_manager.h"
 #include "chrome/browser/web_applications/web_app_install_finalizer.h"
 #include "chrome/browser/web_applications/web_app_registrar.h"
+#include "chrome/browser/web_applications/web_app_sync_bridge.h"
 #include "chrome/test/base/testing_profile.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/mojom/manifest/display_mode.mojom-shared.h"
@@ -143,8 +144,7 @@
                                                         std::move(file_utils));
 
     install_finalizer_ = std::make_unique<WebAppInstallFinalizer>(
-        profile(), &test_registry_controller_->sync_bridge(),
-        icon_manager_.get());
+        profile(), icon_manager_.get());
 
     shortcut_manager_ = std::make_unique<TestAppShortcutManager>(profile());
     file_handler_manager_ = std::make_unique<TestFileHandlerManager>(profile());
@@ -163,7 +163,9 @@
 
     ui_manager_ = std::make_unique<TestWebAppUiManager>();
 
-    install_finalizer_->SetSubsystems(&registrar(), ui_manager_.get());
+    install_finalizer_->SetSubsystems(
+        &registrar(), ui_manager_.get(),
+        &test_registry_controller_->sync_bridge());
   }
 
   void TearDown() override {

diff --git a/chrome/browser/web_applications/web_app_install_task_unittest.cc b/chrome/browser/web_applications/web_app_install_task_unittest.cc
index 9d330f6..94b1730 100644
--- a/chrome/browser/web_applications/web_app_install_task_unittest.cc
+++ b/chrome/browser/web_applications/web_app_install_task_unittest.cc

@@ -68,26 +68,6 @@
 
 namespace {
 
-void TestAcceptDialogCallback(
-    content::WebContents* initiator_web_contents,
-    std::unique_ptr<WebApplicationInfo> web_app_info,
-    ForInstallableSite for_installable_site,
-    InstallManager::WebAppInstallationAcceptanceCallback acceptance_callback) {
-  base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, base::BindOnce(std::move(acceptance_callback), true /*accept*/,
-                                std::move(web_app_info)));
-}
-
-void TestDeclineDialogCallback(
-    content::WebContents* initiator_web_contents,
-    std::unique_ptr<WebApplicationInfo> web_app_info,
-    ForInstallableSite for_installable_site,
-    InstallManager::WebAppInstallationAcceptanceCallback acceptance_callback) {
-  base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, base::BindOnce(std::move(acceptance_callback),
-                                false /*accept*/, std::move(web_app_info)));
-}
-
 WebAppInstallManager::InstallParams MakeParams(
     web_app::DisplayMode display_mode = DisplayMode::kUndefined) {
   WebAppInstallManager::InstallParams params;
@@ -116,11 +96,13 @@
     ui_manager_ = std::make_unique<TestWebAppUiManager>();
 
     install_finalizer_ = std::make_unique<WebAppInstallFinalizer>(
-        profile(), &controller().sync_bridge(), icon_manager_.get());
+        profile(), icon_manager_.get());
     shortcut_manager_ = std::make_unique<TestAppShortcutManager>(profile());
     file_handler_manager_ = std::make_unique<TestFileHandlerManager>(profile());
 
-    install_finalizer_->SetSubsystems(&registrar(), ui_manager_.get());
+    install_finalizer_->SetSubsystems(
+        &registrar(), ui_manager_.get(),
+        &test_registry_controller_->sync_bridge());
     shortcut_manager_->SetSubsystems(&registrar());
     file_handler_manager_->SetSubsystems(&registrar());
 

diff --git a/chrome/browser/web_applications/web_app_provider.cc b/chrome/browser/web_applications/web_app_provider.cc
index 37fc4bf..8c2153e 100644
--- a/chrome/browser/web_applications/web_app_provider.cc
+++ b/chrome/browser/web_applications/web_app_provider.cc

@@ -201,8 +201,8 @@
 
   auto icon_manager = std::make_unique<WebAppIconManager>(
       profile, *registrar, std::make_unique<FileUtilsWrapper>());
-  install_finalizer_ = std::make_unique<WebAppInstallFinalizer>(
-      profile, sync_bridge.get(), icon_manager.get());
+  install_finalizer_ =
+      std::make_unique<WebAppInstallFinalizer>(profile, icon_manager.get());
   file_handler_manager_ = std::make_unique<WebAppFileHandlerManager>(profile);
   shortcut_manager_ = std::make_unique<WebAppShortcutManager>(
       profile, icon_manager.get(), file_handler_manager_.get());
@@ -238,7 +238,8 @@
 void WebAppProvider::ConnectSubsystems() {
   DCHECK(!started_);
 
-  install_finalizer_->SetSubsystems(registrar_.get(), ui_manager_.get());
+  install_finalizer_->SetSubsystems(registrar_.get(), ui_manager_.get(),
+                                    registry_controller_.get());
   install_manager_->SetSubsystems(registrar_.get(), shortcut_manager_.get(),
                                   file_handler_manager_.get(),
                                   install_finalizer_.get());

diff --git a/chrome/common/extensions/api/terminal_private.json b/chrome/common/extensions/api/terminal_private.json
index 3b82b66..eea7a86 100644
--- a/chrome/common/extensions/api/terminal_private.json
+++ b/chrome/common/extensions/api/terminal_private.json

@@ -186,6 +186,19 @@
         ]
       },
       {
+        "name": "openWindow",
+        "type": "function",
+        "description": "Open the Terminal tabbed window.",
+        "parameters": [
+          {
+            "name": "callback",
+            "type": "function",
+            "description": "Callback that will be called when complete.",
+            "parameters": []
+          }
+        ]
+      },
+      {
         "name": "openOptionsPage",
         "type": "function",
         "description": "Open the Terminal Settings page.",

diff --git a/chrome/common/extensions/docs/templates/intros/declarativeNetRequest.html b/chrome/common/extensions/docs/templates/intros/declarativeNetRequest.html
index cf9a98d1..b718b3f5 100644
--- a/chrome/common/extensions/docs/templates/intros/declarativeNetRequest.html
+++ b/chrome/common/extensions/docs/templates/intros/declarativeNetRequest.html

@@ -17,16 +17,16 @@
 <h2 id="manifest">Manifest</h2>
 
 <p>
-You must declare the <code>"declarativeNetRequest"</code> permission in the
-extension <a href="manifest">manifest</a> to use this API. The
+Extensions must declare the <code>"declarativeNetRequest"</code> permission in
+the extension <a href="manifest">manifest</a> to use this API. The
 <code>"declarativeNetRequestFeedback"</code> permission is required to access
 functions and events which return information on declarative rules matched.
 <a href="declare_permissions">Host permissions</a> are required if the extension
-wants to redirect requests. You must also declare the
+wants to redirect requests. To specify static
+<a href="#type-Ruleset">Rulesets</a>, extensions must also declare the
 <code>"declarative_net_request"</code> manifest key, which should be a
 dictionary with a single key called <code>"rule_resources"</code>. It should be
-a list containing a single dictionary of type
-<a href="#type-Ruleset">Ruleset</a>, as shown below.
+a list containing dictionaries of type $(ref:Ruleset), as shown below.
 </p>
 
 <pre data-filename="manifest.json">
@@ -38,7 +38,11 @@
     "rule_resources" : [{
       "id": "ruleset_1",
       "enabled": true,
-      "path": "rules.json"
+      "path": "rules_1.json"
+    }, {
+      "id": "ruleset_2",
+      "enabled": false,
+      "path": "rules_2.json"
     }]
   },
   "permissions": [
@@ -53,18 +57,18 @@
 <h2 id="rule-resources">Rule Resources</h2>
 
 <p>
-The JSON file specified as part of <code>"rule_resources"</code> in the manifest
-contains a list of rules. The number of rules that an extension can specify is
-bound by the <a href="#property-MAX_NUMBER_OF_RULES">
-chrome.declarativeNetRequest.MAX_NUMBER_OF_RULES</a> constant.
+An extension can specify up to $(ref:MAX_NUMBER_OF_STATIC_RULESETS)
+<a href="#type-Ruleset">rulesets</a> as part of the
+<code>"rule_resources"</code> manifest key. The number of rules
+across <b>enabled</b> static rulesets must be less than the
+$(ref:MAX_NUMBER_OF_RULES) constant.
 </p>
 
 <h2 id="rules">Rules</h2>
 
 <p>
-A single declarative rule consists of four fields: <code>id</code>,
-<code>priority</code>, <code>condition</code> and <code>action</code>. See the
-<a href="#type-Rule">Rule</a> section below for more information on the format.
+A single declarative $(ref:Rule) consists of four fields: <code>id</code>,
+<code>priority</code>, <code>condition</code> and <code>action</code>.
 There are the following kinds of rules:
 </p>
 
@@ -168,27 +172,41 @@
 
 <p>
 To add or remove rules dynamically, extensions can use the
-<a href="#method-updateDynamicRules">
-chrome.declarativeNetRequest.updateDynamicRules</a> API method.
+$(ref:updateDynamicRules) API method.
 
 <ul>
 <li>
   The number of dynamic rules that an an extension can add is bounded by the
-  <a href="#property-MAX_NUMBER_OF_DYNAMIC_RULES">chrome.declarativeNetRequest.MAX_NUMBER_OF_DYNAMIC_RULES</a>
-  constant.
+  $(ref:MAX_NUMBER_OF_DYNAMIC_RULES) constant.
 </li>
 <li>
-  An extension's dynamic ruleset is maintained separately from its static
-  ruleset (the ruleset specified as part of the extension package). For example,
-  it's possible to have the same rule ID across static and dynamic rulesets.
-</li>
-<li>
-  For conflicting actions, dynamic rules are given priority over static rules.
+  The dynamic rules for an extension are persisted across both sessions and
+  extension updates.
 </li>
 </ul>
 
 </p>
 
+<h2 id="updating-enabled-rulesets">Updating enabled rulesets</h2>
+
+<p>
+An extension can update the set of enabled static rulesets using the
+$(ref:updateEnabledRulesets) API method.
+
+<ul>
+  <li>
+    The number of rules across enabled static rulesets must be less than the
+    $(ref:MAX_NUMBER_OF_RULES) constant.
+  </li>
+  <li>
+    The set of enabled static rulesets is persisted across sessions but not
+    across extension updates. The <code>rule_resources</code> manifest key will
+    determine the set of enabled static rulesets on initial extension install
+    and on each subsequent extension update.
+  </li>
+</ul>
+</p>
+
 <h2 id="implementation-details">Implementation details</h2>
 
 <h3 id="matching-algorithm">Matching algorithm</h3>

diff --git a/chrome/common/web_application_info.cc b/chrome/common/web_application_info.cc
index 09cef123..e5fa3d9 100644
--- a/chrome/common/web_application_info.cc
+++ b/chrome/common/web_application_info.cc

@@ -36,11 +36,7 @@
 WebApplicationShortcutInfo& WebApplicationShortcutInfo::operator=(
     WebApplicationShortcutInfo&&) noexcept = default;
 
-WebApplicationInfo::WebApplicationInfo()
-    : mobile_capable(MOBILE_CAPABLE_UNSPECIFIED),
-      generated_icon_color(SK_ColorTRANSPARENT),
-      display_mode(blink::mojom::DisplayMode::kBrowser),
-      open_as_window(false) {}
+WebApplicationInfo::WebApplicationInfo() = default;
 
 WebApplicationInfo::WebApplicationInfo(const WebApplicationInfo& other) =
     default;

diff --git a/chrome/common/web_application_info.h b/chrome/common/web_application_info.h
index 9efc2c42..6cfde5a 100644
--- a/chrome/common/web_application_info.h
+++ b/chrome/common/web_application_info.h

@@ -89,10 +89,10 @@
 
   // Whether the page is marked as mobile-capable, including apple specific meta
   // tag.
-  MobileCapable mobile_capable;
+  MobileCapable mobile_capable = MOBILE_CAPABLE_UNSPECIFIED;
 
   // The color to use if an icon needs to be generated for the web app.
-  SkColor generated_icon_color;
+  SkColor generated_icon_color = SK_ColorTRANSPARENT;
 
   // The color to use for the web app frame.
   base::Optional<SkColor> theme_color;
@@ -101,13 +101,17 @@
   // in a window (with or without minimal-ui buttons), or full screen. Defaults
   // to browser display mode as specified in
   // https://w3c.github.io/manifest/#display-modes
-  blink::mojom::DisplayMode display_mode;
+  blink::mojom::DisplayMode display_mode = blink::mojom::DisplayMode::kBrowser;
 
   // User preference as to whether the app should be opened in a window.
   // If false, the app will be opened in a tab.
   // If true, the app will be opened in a window, with minimal-ui buttons
   // if display_mode is kBrowser or kMinimalUi.
-  bool open_as_window;
+  bool open_as_window = false;
+
+  // Whether standalone app windows should have a tab strip. Currently a user
+  // preference for the sake of experimental exploration.
+  bool enable_experimental_tabbed_window = false;
 
   // The extensions and mime types the app can handle.
   std::vector<blink::Manifest::FileHandler> file_handlers;

diff --git a/chrome/renderer/safe_browsing/phishing_classifier_delegate.cc b/chrome/renderer/safe_browsing/phishing_classifier_delegate.cc
index c1f55b4..0afae4e 100644
--- a/chrome/renderer/safe_browsing/phishing_classifier_delegate.cc
+++ b/chrome/renderer/safe_browsing/phishing_classifier_delegate.cc

@@ -146,9 +146,11 @@
 void PhishingClassifierDelegate::StartPhishingDetection(
     const GURL& url,
     StartPhishingDetectionCallback callback) {
+  RecordEvent(SBPhishingClassifierEvent::kPhishingDetectionRequested);
+
   if (!callback_.is_null())
     std::move(callback_).Run(mojom::PhishingDetectorResult::CANCELLED, "");
-
+  is_phishing_detection_running_ = true;
   last_url_received_from_browser_ = StripRef(url);
   callback_ = std::move(callback);
   // Start classifying the current page if all conditions are met.
@@ -178,6 +180,8 @@
 
 void PhishingClassifierDelegate::PageCaptured(base::string16* page_text,
                                               bool preliminary_capture) {
+  RecordEvent(SBPhishingClassifierEvent::kPageTextCaptured);
+
   if (preliminary_capture) {
     return;
   }
@@ -223,6 +227,7 @@
     const ClientPhishingRequest& verdict) {
   DVLOG(2) << "Phishy verdict = " << verdict.is_phishing()
            << " score = " << verdict.client_score();
+  is_phishing_detection_running_ = false;
   if (callback_.is_null())
     return;
 
@@ -240,17 +245,18 @@
   // We can begin phishing classification when the following conditions are
   // met:
   //  1. A Scorer has been created
-  //  2. The browser has sent a StartPhishingDetection message for the current
-  //     toplevel URL.
+  //  2. The browser has sent a StartPhishingDetection message for the
+  //     current toplevel URL.
   //  3. The page has finished loading and the page text has been extracted.
   //  4. The load is a new navigation (not a session history navigation).
   //  5. The toplevel URL has not already been classified.
   //
   // Note that if we determine that this particular navigation should not be
-  // classified at all (as opposed to deferring it until we get an IPC or the
-  // load completes), we discard the page text since it won't be needed.
+  // classified at all (as opposed to deferring it until we get an IPC or
+  // the load completes), we discard the page text since it won't be needed.
   if (!classifier_->is_ready()) {
     DVLOG(2) << "Not starting classification, no Scorer created.";
+    is_phishing_detection_running_ = false;
     // Keep classifier_page_text_, in case a Scorer is set later.
     if (!callback_.is_null())
       std::move(callback_).Run(
@@ -266,6 +272,7 @@
     last_url_sent_to_classifier_ = last_finished_load_url_;
     classifier_page_text_.clear();  // we won't need this.
     have_page_text_ = false;
+    is_phishing_detection_running_ = false;
     if (!callback_.is_null())
       std::move(callback_).Run(
           mojom::PhishingDetectorResult::FORWARD_BACK_TRANSITION, "");
@@ -275,10 +282,12 @@
   GURL stripped_last_load_url(StripRef(last_finished_load_url_));
   if (!have_page_text_) {
     DVLOG(2) << "Not starting classification, there is no page text ready.";
+    RecordEvent(SBPhishingClassifierEvent::kPageTextNotLoaded);
     return;
   }
 
   if (last_url_received_from_browser_ != stripped_last_load_url) {
+    RecordEvent(SBPhishingClassifierEvent::kUrlShouldNotBeClassified);
     // The browser has not yet confirmed that this URL should be classified,
     // so defer classification for now.  Note: the ref does not affect
     // any of the browser's preclassification checks, so we don't require it
@@ -300,7 +309,14 @@
                      base::Unretained(this)));
 }
 
+void PhishingClassifierDelegate::RecordEvent(SBPhishingClassifierEvent event) {
+  UMA_HISTOGRAM_ENUMERATION("SBClientPhishing.Classifier.Event", event);
+}
+
 void PhishingClassifierDelegate::OnDestruct() {
+  if (is_phishing_detection_running_) {
+    RecordEvent(SBPhishingClassifierEvent::kDestructedBeforeClassificationDone);
+  }
   delete this;
 }
 

diff --git a/chrome/renderer/safe_browsing/phishing_classifier_delegate.h b/chrome/renderer/safe_browsing/phishing_classifier_delegate.h
index 5e23602..5228c18 100644
--- a/chrome/renderer/safe_browsing/phishing_classifier_delegate.h
+++ b/chrome/renderer/safe_browsing/phishing_classifier_delegate.h

@@ -25,6 +25,19 @@
 class PhishingClassifier;
 class Scorer;
 
+enum class SBPhishingClassifierEvent {
+  kPhishingDetectionRequested = 0,
+  kPageTextCaptured = 1,
+  // Phishing detection could not start because the page text was not loaded.
+  kPageTextNotLoaded = 2,
+  // Phishing detection could not start because the url was not specified to be
+  // classified.
+  kUrlShouldNotBeClassified = 3,
+  // Phishing detection could not finish because the class was destructed.
+  kDestructedBeforeClassificationDone = 4,
+  kMaxValue = kDestructedBeforeClassificationDone,
+};
+
 class PhishingClassifierFilter : public mojom::PhishingModelSetter {
  public:
   PhishingClassifierFilter();
@@ -91,6 +104,9 @@
   // Cancels any pending classification and frees the page text.
   void CancelPendingClassification(CancelClassificationReason reason);
 
+  // Records in UMA of a specific event that happens in the phishing classifier.
+  void RecordEvent(SBPhishingClassifierEvent event);
+
   void OnDestruct() override;
 
   void OnInterfaceRequestForFrame(
@@ -150,6 +166,10 @@
   // Set to true if the classifier is currently running.
   bool is_classifying_;
 
+  // Set to true when StartPhishingDetection method is called. It is
+  // set to false whenever phishing detection has finished.
+  bool is_phishing_detection_running_;
+
   // The callback from the most recent call to StartPhishingDetection.
   StartPhishingDetectionCallback callback_;
 

diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
index b8a661f..6b9308e 100644
--- a/chrome/test/BUILD.gn
+++ b/chrome/test/BUILD.gn

@@ -3218,13 +3218,13 @@
     "../browser/net/chrome_network_delegate_unittest.cc",
     "../browser/net/dns_probe_runner_unittest.cc",
     "../browser/net/dns_probe_service_factory_unittest.cc",
-    "../browser/net/dns_util_unittest.cc",
     "../browser/net/file_downloader_unittest.cc",
     "../browser/net/net_error_tab_helper_unittest.cc",
     "../browser/net/probe_message_unittest.cc",
     "../browser/net/referrer_policy_policy_handler_unittest.cc",
     "../browser/net/secure_dns_config_unittest.cc",
     "../browser/net/secure_dns_policy_handler_unittest.cc",
+    "../browser/net/secure_dns_util_unittest.cc",
     "../browser/net/stub_resolver_config_reader_unittest.cc",
     "../browser/nfc/nfc_permission_context_unittest.cc",
     "../browser/notifications/metrics/notification_metrics_logger_unittest.cc",

diff --git a/chrome/test/base/testing_profile.cc b/chrome/test/base/testing_profile.cc
index b822d28a..52aca6c 100644
--- a/chrome/test/base/testing_profile.cc
+++ b/chrome/test/base/testing_profile.cc

@@ -1139,31 +1139,13 @@
   return last_session_exited_cleanly_ ? EXIT_NORMAL : EXIT_CRASHED;
 }
 
-void TestingProfile::SetNetworkContext(
-    std::unique_ptr<network::mojom::NetworkContext> network_context) {
-  DCHECK(!network_context_);
-  network_context_ = std::move(network_context);
-}
-
-mojo::Remote<network::mojom::NetworkContext>
-TestingProfile::CreateNetworkContext(
+void TestingProfile::ConfigureNetworkContextParams(
     bool in_memory,
-    const base::FilePath& relative_partition_path) {
-  if (network_context_) {
-    mojo::Remote<network::mojom::NetworkContext> network_context_remote;
-    network_context_receivers_.Add(
-        network_context_.get(),
-        network_context_remote.BindNewPipeAndPassReceiver());
-    return network_context_remote;
-  }
-  mojo::Remote<network::mojom::NetworkContext> network_context;
-  network::mojom::NetworkContextParamsPtr context_params =
-      network::mojom::NetworkContextParams::New();
-  context_params->user_agent = GetUserAgent();
-  context_params->accept_language = "en-us,en";
-  content::GetNetworkService()->CreateNetworkContext(
-      network_context.BindNewPipeAndPassReceiver(), std::move(context_params));
-  return network_context;
+    const base::FilePath& relative_partition_path,
+    network::mojom::NetworkContextParams* network_context_params,
+    network::mojom::CertVerifierCreationParams* cert_verifier_creation_params) {
+  network_context_params->user_agent = GetUserAgent();
+  network_context_params->accept_language = "en-us,en";
 }
 
 TestingProfile::Builder::Builder()

diff --git a/chrome/test/base/testing_profile.h b/chrome/test/base/testing_profile.h
index eaca0ad5..be7b4be3 100644
--- a/chrome/test/base/testing_profile.h
+++ b/chrome/test/base/testing_profile.h

@@ -267,10 +267,6 @@
 
   sync_preferences::TestingPrefServiceSyncable* GetTestingPrefService();
 
-  // Sets the Profile's NetworkContext.
-  void SetNetworkContext(
-      std::unique_ptr<network::mojom::NetworkContext> network_context);
-
   // Called on the parent of an OffTheRecord |otr_profile|. Usually called from
   // the constructor of an OffTheRecord TestingProfile, but can also be used by
   // tests to provide an OffTheRecordProfileImpl instance.
@@ -376,9 +372,12 @@
   bool IsNewProfile() override;
   void SetExitType(ExitType exit_type) override {}
   ExitType GetLastSessionExitType() override;
-  mojo::Remote<network::mojom::NetworkContext> CreateNetworkContext(
+  void ConfigureNetworkContextParams(
       bool in_memory,
-      const base::FilePath& relative_partition_path) override;
+      const base::FilePath& relative_partition_path,
+      network::mojom::NetworkContextParams* network_context_params,
+      network::mojom::CertVerifierCreationParams* cert_verifier_creation_params)
+      override;
 
 #if defined(OS_CHROMEOS)
   void ChangeAppLocale(const std::string&, AppLocaleChangedVia) override;
@@ -453,9 +452,6 @@
   std::unique_ptr<net::CookieStore, content::BrowserThread::DeleteOnIOThread>
       extensions_cookie_store_;
 
-  std::unique_ptr<network::mojom::NetworkContext> network_context_;
-  mojo::ReceiverSet<network::mojom::NetworkContext> network_context_receivers_;
-
   std::unique_ptr<Profile> incognito_profile_;
   TestingProfile* original_profile_;
 

diff --git a/chrome/test/data/extensions/api_test/declarative_net_request/header_removal/background.js b/chrome/test/data/extensions/api_test/declarative_net_request/header_removal/background.js
deleted file mode 100644
index 0df6e6a26..0000000
--- a/chrome/test/data/extensions/api_test/declarative_net_request/header_removal/background.js
+++ /dev/null

@@ -1,318 +0,0 @@
-// Copyright 2019 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Navigates to |url| and invokes |callback| when the navigation is complete.
-function navigateTab(url, callback) {
-  chrome.tabs.onUpdated.addListener(function updateCallback(_, info, tab) {
-    if (info.status == 'complete' && tab.url == url) {
-      chrome.tabs.onUpdated.removeListener(updateCallback);
-      callback(tab);
-    }
-  });
-
-  chrome.tabs.update({url: url});
-}
-
-var testServerPort;
-var host = 'xyz.com';
-function getServerURL(path) {
-  if (!testServerPort)
-    throw new Error('Called getServerURL outside of runTests.');
-  return `http://${host}:${testServerPort}/${path}`
-}
-
-// Returns whether |headerName| is present in |headers|.
-function checkHasHeader(headers, headerName) {
-  return !!headers.find(header => header.name.toLowerCase() == headerName);
-}
-
-// Adds or updates the given header name/value to |headers|.
-function addOrUpdateHeader(headers, headerName, headerValue) {
-  var index =
-      headers.findIndex(header => header.name.toLowerCase() == headerName);
-  if (index != -1) {
-    headers[index].value = headerValue;
-  } else {
-    headers.push({name: headerName, value: headerValue});
-  }
-}
-
-// Checks whether the cookie request header was removed from the request and
-// that it isn't visible to web request listeners. Then proceeds to the next
-// test.
-function checkCookieHeaderRemoved(expectRemoved) {
-  var echoCookieUrl = getServerURL('echoheader?cookie');
-
-  // Register web request listeners for |echoCookieUrl|.
-  var filter = {urls: [echoCookieUrl]};
-  var extraInfoSpec = ['requestHeaders', 'extraHeaders'];
-  var onBeforeSendHeadersSeen = false;
-  chrome.webRequest.onBeforeSendHeaders.addListener(function listener(details) {
-    chrome.webRequest.onBeforeSendHeaders.removeListener(listener);
-    onBeforeSendHeadersSeen = true;
-    chrome.test.assertEq(
-        !expectRemoved, checkHasHeader(details.requestHeaders, 'cookie'));
-  }, filter, extraInfoSpec);
-
-  var onSendHeadersSeen = false;
-  chrome.webRequest.onSendHeaders.addListener(function listener(details) {
-    chrome.webRequest.onSendHeaders.removeListener(listener);
-    onSendHeadersSeen = true;
-    chrome.test.assertEq(
-        !expectRemoved, checkHasHeader(details.requestHeaders, 'cookie'));
-  }, filter, extraInfoSpec);
-
-  navigateTab(echoCookieUrl, function(tab) {
-    chrome.test.assertTrue(onBeforeSendHeadersSeen);
-    chrome.test.assertTrue(onSendHeadersSeen);
-    chrome.tabs.executeScript(
-        tab.id, {code: 'document.body.innerText'}, function(results) {
-          chrome.test.assertNoLastError();
-          chrome.test.assertEq(
-              expectRemoved ? 'None' : 'foo1=bar1; foo2=bar2', results[0]);
-          chrome.test.succeed();
-        });
-  });
-}
-
-// Removes all the cookies and optionally checks if |optCurrentCookiesSet|
-// corresponds to the current cookies. Returns a promise.
-function checkAndResetCookies(optCurrentCookiesSet) {
-  var removeCookiesPromise =
-      function(cookieParams) {
-    return new Promise((resolve, reject) => {
-      chrome.cookies.remove(cookieParams, function(details) {
-        chrome.test.assertNoLastError();
-        resolve();
-      });
-    });
-  }
-
-  var url = getServerURL('');
-
-  return new Promise((resolve, reject) => {
-    chrome.cookies.getAll({url: url}, function(cookies) {
-      if (optCurrentCookiesSet) {
-        chrome.test.assertEq(cookies.length, optCurrentCookiesSet.size);
-        for (var i = 0; i < cookies.length; ++i)
-          chrome.test.assertTrue(optCurrentCookiesSet.has(cookies[i].name));
-      }
-
-      var promises = [];
-      for (var i = 0; i < cookies.length; ++i)
-        promises.push(removeCookiesPromise({url: url, name: cookies[i].name}));
-
-      Promise.all(promises).then(resolve, reject);
-    });
-  });
-}
-
-// Checks whether the set-cookie response header was removed from the request
-// and that it isn't visible to web request listeners. Then proceeds to the next
-// test.
-function checkSetCookieHeaderRemoved(expectRemoved) {
-  var setCookieUrl = getServerURL('set-cookie?foo1=bar1&foo2=bar2');
-
-  // Register web request listeners for |setCookieUrl|.
-  var filter = {urls: [setCookieUrl]};
-  var extraInfoSpec = ['responseHeaders', 'extraHeaders'];
-  var onHeadersReceivedSeen = false;
-  chrome.webRequest.onHeadersReceived.addListener(function listener(details) {
-    chrome.webRequest.onHeadersReceived.removeListener(listener);
-    onHeadersReceivedSeen = true;
-    chrome.test.assertEq(
-        !expectRemoved, checkHasHeader(details.responseHeaders, 'set-cookie'));
-  }, filter, extraInfoSpec);
-
-  var onResponseStartedSeen = false;
-  chrome.webRequest.onResponseStarted.addListener(function listener(details) {
-    chrome.webRequest.onResponseStarted.removeListener(listener);
-    onResponseStartedSeen = true;
-    chrome.test.assertEq(
-        !expectRemoved, checkHasHeader(details.responseHeaders, 'set-cookie'));
-  }, filter, extraInfoSpec);
-
-
-  // Clear cookies from existing tests.
-  checkAndResetCookies().then(function() {
-    navigateTab(setCookieUrl, function(tab) {
-      chrome.test.assertTrue(onHeadersReceivedSeen);
-      chrome.test.assertTrue(onResponseStartedSeen);
-
-      var expectedCookies = expectRemoved ? [] : ['foo1', 'foo2'];
-      checkAndResetCookies(new Set(expectedCookies)).then(chrome.test.succeed);
-    });
-  });
-}
-
-// Checks whether the cookie request header added by Web request extension was
-// removed. Then proceeds to the next test.
-function checkAddWebRequestCookie(expectRemoved) {
-  var echoCookieUrl = getServerURL('echoheader?cookie');
-
-  // Register web request listeners for |echoCookieUrl|.
-  var filter = {urls: [echoCookieUrl]};
-  var extraInfoSpec = ['requestHeaders', 'extraHeaders', 'blocking'];
-  var onBeforeSendHeadersSeen = false;
-  var onBeforeSendHeadersListener = function listener(details) {
-    onBeforeSendHeadersSeen = true;
-    addOrUpdateHeader(details.requestHeaders, 'cookie', 'webRequest=true');
-    return {requestHeaders: details.requestHeaders};
-  };
-  chrome.webRequest.onBeforeSendHeaders.addListener(
-      onBeforeSendHeadersListener, filter, extraInfoSpec);
-
-  var onActionIgnoredCalled = false;
-  var onActionIgnoredListener = function(details) {
-    onActionIgnoredCalled = true;
-    chrome.test.assertEq('request_headers', details.action);
-  };
-  chrome.webRequest.onActionIgnored.addListener(onActionIgnoredListener);
-
-  navigateTab(echoCookieUrl, function(tab) {
-    chrome.webRequest.onBeforeSendHeaders.removeListener(
-        onBeforeSendHeadersListener);
-    chrome.webRequest.onActionIgnored.removeListener(onActionIgnoredListener);
-
-    chrome.test.assertTrue(onBeforeSendHeadersSeen);
-    chrome.test.assertEq(expectRemoved, onActionIgnoredCalled);
-
-    chrome.tabs.executeScript(
-        tab.id, {code: 'document.body.innerText'}, function(results) {
-          chrome.test.assertNoLastError();
-          chrome.test.assertEq(
-              expectRemoved ? 'None' : 'webRequest=true', results[0]);
-          chrome.test.succeed();
-        });
-  });
-}
-
-// Checks whether the set-cookie request header added by Web request extension
-// was removed.
-function checkAddWebRequestSetCookie(expectRemoved) {
-  var url = getServerURL('echo');
-
-  // Register web request listeners for |url|.
-  var filter = {urls: [url]};
-  var extraInfoSpec = ['responseHeaders', 'extraHeaders', 'blocking'];
-  var onHeadersReceivedSeen = false;
-  var onHeadersReceivedListener = function listener(details) {
-    onHeadersReceivedSeen = true;
-    addOrUpdateHeader(details.responseHeaders, 'set-cookie', 'webRequest=true');
-    return {responseHeaders: details.responseHeaders};
-  };
-  chrome.webRequest.onHeadersReceived.addListener(
-      onHeadersReceivedListener, filter, extraInfoSpec);
-
-  var onActionIgnoredCalled = false;
-  var onActionIgnoredListener = function(details) {
-    onActionIgnoredCalled = true;
-    chrome.test.assertEq('response_headers', details.action);
-  };
-  chrome.webRequest.onActionIgnored.addListener(onActionIgnoredListener);
-
-  checkAndResetCookies().then(function() {
-    navigateTab(url, function(tab) {
-      chrome.webRequest.onHeadersReceived.removeListener(
-          onHeadersReceivedListener);
-      chrome.webRequest.onActionIgnored.removeListener(onActionIgnoredListener);
-
-      chrome.test.assertTrue(onHeadersReceivedSeen);
-      chrome.test.assertEq(expectRemoved, onActionIgnoredCalled);
-
-      var expectedCookies = expectRemoved ? [] : ['webRequest']
-      checkAndResetCookies(new Set(expectedCookies)).then(chrome.test.succeed);
-    });
-  });
-}
-
-// Clears the current state by removing rules specified in |ruleIds| and
-// clearing all cookies.
-function clearState(ruleIds, callback) {
-  chrome.declarativeNetRequest.updateDynamicRules(ruleIds, [], function() {
-    chrome.test.assertNoLastError();
-    checkAndResetCookies().then(callback);
-  });
-}
-
-var removeCookieRule = {
-  id: 1,
-  condition: {urlFilter: host, resourceTypes: ['main_frame']},
-  action: {type: 'removeHeaders', removeHeadersList: ['cookie']}
-};
-var removeSetCookieRule = {
-  id: 2,
-  condition: {urlFilter: host, resourceTypes: ['main_frame']},
-  action: {type: 'removeHeaders', removeHeadersList: ['setCookie']}
-};
-var allowRule = {
-  id: 3,
-  priority: 1,
-  condition: {urlFilter: host, resourceTypes: ['main_frame']},
-  action: {type: 'allow'}
-};
-
-var tests = [
-  function testCookieWithoutRules() {
-    navigateTab(getServerURL('set-cookie?foo1=bar1&foo2=bar2'), function() {
-      checkCookieHeaderRemoved(false);
-    });
-  },
-
-  function addRulesAndTestCookieRemoval() {
-    var rules = [removeCookieRule];
-    chrome.declarativeNetRequest.updateDynamicRules([], rules, function() {
-      chrome.test.assertNoLastError();
-      checkCookieHeaderRemoved(true);
-    });
-  },
-
-  function testSetCookieWithoutRules() {
-    checkSetCookieHeaderRemoved(false);
-  },
-
-  function addRulesAndTestSetCookieRemoval() {
-    var rules = [removeSetCookieRule];
-    chrome.declarativeNetRequest.updateDynamicRules([], rules, function() {
-      chrome.test.assertNoLastError();
-      checkSetCookieHeaderRemoved(true);
-    });
-  },
-
-  function testAddWebRequestCookie() {
-    // First clear the rules and cookies.
-    clearState([1, 2], () => {
-      checkAddWebRequestCookie(false);
-    });
-  },
-
-  function testAddWebRequestCookieWithRules() {
-    var rules = [removeCookieRule];
-    chrome.declarativeNetRequest.updateDynamicRules([], rules, function() {
-      checkAddWebRequestCookie(true);
-    });
-  },
-
-  function testAddWebRequestSetCookie() {
-    checkAddWebRequestSetCookie(false);
-  },
-
-  function testAddWebRequestSetCookieWithRules() {
-    var rules = [removeSetCookieRule];
-    chrome.declarativeNetRequest.updateDynamicRules([], rules, function() {
-      checkAddWebRequestSetCookie(true);
-    });
-  },
-
-  function testAddWebRequestCookieWithAllowRule() {
-    chrome.declarativeNetRequest.updateDynamicRules([], [allowRule], () => {
-       checkAddWebRequestSetCookie(false);
-    });
-  },
-];
-
-chrome.test.getConfig(function(config) {
-  testServerPort = config.testServer.port;
-  chrome.test.runTests(tests);
-});

diff --git a/chrome/test/data/extensions/api_test/declarative_net_request/header_removal/manifest.json b/chrome/test/data/extensions/api_test/declarative_net_request/header_removal/manifest.json
deleted file mode 100644
index 433d0209..0000000
--- a/chrome/test/data/extensions/api_test/declarative_net_request/header_removal/manifest.json
+++ /dev/null

@@ -1,27 +0,0 @@
-{
-  "name": "Test cookie/set-cookie header removal.",
-  "declarative_net_request": {
-    "rule_resources": [{
-      "id": "header_removal",
-      "path": "rules_file_empty.json",
-      "enabled": true
-    }
-    ]
-  },
-  "manifest_version": 2,
-  "permissions": [
-    "declarativeNetRequest",
-    "webRequest",
-    "webRequestBlocking",
-    "<all_urls>",
-    "tabs",
-    "cookies"
-  ],
-  "version": "1.0",
-  "background": {
-    "scripts": [
-      "background.js"
-    ]
-  }
-}
-

diff --git a/chrome/test/data/extensions/api_test/declarative_net_request/header_removal/rules_file_empty.json b/chrome/test/data/extensions/api_test/declarative_net_request/header_removal/rules_file_empty.json
deleted file mode 100644
index fe51488..0000000
--- a/chrome/test/data/extensions/api_test/declarative_net_request/header_removal/rules_file_empty.json
+++ /dev/null

@@ -1 +0,0 @@
-[]

diff --git a/chrome/test/data/nacl/BUILD.gn b/chrome/test/data/nacl/BUILD.gn
index 9769883..4dc4d39 100644
--- a/chrome/test/data/nacl/BUILD.gn
+++ b/chrome/test/data/nacl/BUILD.gn

@@ -61,9 +61,11 @@
   if (target_cpu != "arm") {
     data_deps += [ ":partly_invalid($newlib)" ]
   }
-  if (target_cpu != "mipsel" && !is_mac) {
+  if (target_cpu != "mipsel" && !is_mac && !is_win) {
     # GlibC tools are not available for MIPS
-    # The GlibC toolchain is based on gcc, which no longer runs on mac
+    # The GlibC toolchain is based on gcc, which no longer runs on mac;
+    # it still runs on Windows but is flaky due to its use of cygwin, so also
+    # disable it there.
     glibc = "//build/toolchain/nacl:glibc_${target_cpu}"
     data_deps += [
       ":exit_status_test($glibc)",

diff --git a/chrome/test/data/webui/new_tab_page/app_test.js b/chrome/test/data/webui/new_tab_page/app_test.js
index 564b97f8..e10adfe9 100644
--- a/chrome/test/data/webui/new_tab_page/app_test.js
+++ b/chrome/test/data/webui/new_tab_page/app_test.js

@@ -117,6 +117,14 @@
     // Assert.
     assertNotStyle($$(app, '#fakebox'), 'display', 'none');
     assertStyle($$(app, '#realbox'), 'display', 'none');
+    assertStyle($$(app, '#realbox'), 'visibility', 'hidden');
+
+    // Act.
+    testProxy.callbackRouterRemote.setTheme(createTheme());
+    await testProxy.callbackRouterRemote.$.flushForTesting();
+
+    // Assert.
+    assertStyle($$(app, '#realbox'), 'visibility', 'visible');
   });
 
   test('open voice search event opens voice search overlay', async () => {

diff --git a/chrome/test/data/webui/new_tab_page/realbox_test.js b/chrome/test/data/webui/new_tab_page/realbox_test.js
index a7928f4..74e8c78 100644
--- a/chrome/test/data/webui/new_tab_page/realbox_test.js
+++ b/chrome/test/data/webui/new_tab_page/realbox_test.js

@@ -100,7 +100,7 @@
     assertStyle(realbox, '--search-box-bg', 'rgba(0, 0, 0, 255)');
     assertStyle(realbox, '--search-box-placeholder', 'rgba(0, 0, 3, 255)');
     assertStyle(realbox, '--search-box-results-bg', 'rgba(0, 0, 4, 255)');
-    assertStyle(realbox, '--search-box-text', 'rgba(0, 0, 12, 255)');
+    assertStyle(realbox, '--search-box-text', 'rgba(0, 0, 13, 255)');
     assertStyle(realbox, '--search-box-icon', 'rgba(0, 0, 1, 255)');
   });
 
@@ -128,7 +128,9 @@
 
   test('left-clicking input when empty queries autocomplete', async () => {
     realbox.$.input.value = '';
-    realbox.$.input.onmousedown(createTrustedEvent('mousedown', {button: 0}));
+    // Cannot use realbox.$.input.dispatchEvent() since the parameter is not of
+    // type 'Event'.
+    realbox.onInputMouseDown_(createTrustedEvent('mousedown', {button: 0}));
     assertEquals(1, testProxy.handler.getCallCount('queryAutocomplete'));
     await testProxy.handler.whenCalled('queryAutocomplete').then((args) => {
       assertTrue(decodeString16(args.input) === '');
@@ -136,16 +138,16 @@
     });
 
     // Only left clicks query autocomplete.
-    realbox.$.input.onmousedown(createTrustedEvent('mousedown', {button: 1}));
+    realbox.onInputMouseDown_(createTrustedEvent('mousedown', {button: 1}));
     assertEquals(1, testProxy.handler.getCallCount('queryAutocomplete'));
 
     // Untrusted events won't qeury autocomplete.
-    realbox.$.input.onmousedown(new MouseEvent('mousedown', {button: 0}));
+    realbox.onInputMouseDown_(new MouseEvent('mousedown', {button: 0}));
     assertEquals(1, testProxy.handler.getCallCount('queryAutocomplete'));
 
     // Non-empty input won't query autocomplete.
     realbox.$.input.value = '   ';
-    realbox.$.input.onmousedown(createTrustedEvent('mousedown', {button: 0}));
+    realbox.onInputMouseDown_(createTrustedEvent('mousedown', {button: 0}));
     assertEquals(1, testProxy.handler.getCallCount('queryAutocomplete'));
   });
 });

diff --git a/chrome/test/data/webui/new_tab_page/test_support.js b/chrome/test/data/webui/new_tab_page/test_support.js
index 9bb81b9c..f7dc9d1 100644
--- a/chrome/test/data/webui/new_tab_page/test_support.js
+++ b/chrome/test/data/webui/new_tab_page/test_support.js

@@ -77,8 +77,9 @@
     resultsDimSelected: {value: 0xff000008},
     resultsText: {value: 0xff000009},
     resultsTextSelected: {value: 0xff00000a},
-    resultsUrlSelected: {value: 0xff00000b},
-    text: {value: 0xff00000c},
+    resultsUrl: {value: 0xff00000b},
+    resultsUrlSelected: {value: 0xff00000c},
+    text: {value: 0xff00000d},
   };
   return {
     type: newTabPage.mojom.ThemeType.DEFAULT,

diff --git a/chrome/test/data/webui/settings/BUILD.gn b/chrome/test/data/webui/settings/BUILD.gn
index ce0c649..4ba2e44a 100644
--- a/chrome/test/data/webui/settings/BUILD.gn
+++ b/chrome/test/data/webui/settings/BUILD.gn

@@ -58,31 +58,136 @@
                     "js_module_root=../../chrome/test/data/webui/",
                     "js_module_root=./gen/chrome/test/data/webui/",
                   ]
+
+  # TODO(crbug.com/1000989): Add JS type checking for all commented out targets.
   deps = [
     ":about_page_tests",
     ":advanced_page_test",
+
+    #":all_sites_tests",
+    #":appearance_fonts_page_test",
+    #":appearance_page_test",
+    #":autofill_page_test",
+    #":autofill_section_test",
+    #":basic_page_test",
+    #":category_default_setting_tests",
+    #":category_setting_exceptions_tests",
+    #":checkbox_tests",
+    #":chooser_exception_list_entry_tests",
+    #":chooser_exception_list_tests",
+    #":chrome_cleanup_page_test",
+    #":clear_browsing_data_test",
+    #":collapse_radio_button_tests",
+    #":controlled_button_tests",
+    #":controlled_radio_button_tests",
     ":cookies_page_test",
+
+    #":default_browser_browsertest",
+    #":do_not_track_toggle_test",
+    #":downloads_page_test",
+    #":dropdown_menu_tests",
+    #":edit_dictionary_page_test",
+    #":ensure_lazy_loaded",
+    #":extension_controlled_indicator_tests",
+    #":fake_input_method_private",
+    #":fake_language_settings_private",
+    #":fake_settings_private",
+    #":help_page_v3_test",
+    #":idle_load_tests",
+    #":import_data_dialog_test",
+    #":incompatible_applications_page_test",
+    #":languages_page_tests",
+    #":languages_tests",
+    #":metrics_reporting_tests",
+    #":on_startup_page_tests",
+    #":password_check_test",
     ":passwords_and_autofill_fake_data",
+
+    #":passwords_export_test",
+    #":passwords_leak_detection_toggle_test",
+    #":passwords_section_test",
+    #":passwords_section_test_cros",
+    #":payments_section_test",
+    #":people_page_manage_profile_test",
+    #":people_page_sync_controls_test",
+    #":people_page_sync_page_interactive_test",
+    #":people_page_sync_page_test",
+    #":people_page_test",
+    #":people_page_test_cros",
+    #":personalization_options_test",
+    #":pref_util_tests",
+    #":prefs_test_cases",
+    #":prefs_tests",
+    #":privacy_page_test",
+    #":protocol_handlers_tests",
+    #":recent_site_permissions_test",
+    #":reset_page_test",
+    #":reset_profile_banner_test",
+    #":route_tests",
+    ":safety_check_page_test",
+
+    #":search_engines_page_test",
     ":search_page_test",
+
+    #":search_settings_test",
+    #":secure_dns_interactive_test",
+    #":secure_dns_test",
+    #":security_keys_subpage_test",
     ":security_page_test",
+
+    #":settings_animated_pages_test",
+    #":settings_main_test",
+    #":settings_menu_test",
     ":settings_page_test_util",
+
+    #":settings_slider_tests",
+    #":settings_subpage_test",
+    #":settings_textarea_tests",
+    #":settings_toggle_button_tests",
+    #":settings_ui_tests",
+    #":site_data_details_subpage_tests",
+    #":site_data_test",
+    #":site_details_permission_tests",
+    #":site_details_tests",
+    #":site_entry_tests",
+    #":site_favicon_test",
+    #":site_list_entry_tests",
     ":site_list_tests",
+
+    #":site_list_tests_cros",
     ":site_settings_page_test",
+
+    #":startup_urls_page_test",
+    #":sync_account_control_test",
+    #":sync_test_util",
+    #":system_page_tests",
     ":test_about_page_browser_proxy",
+
+    #":test_android_info_browser_proxy",
+    #":test_clear_browsing_data_browser_proxy",
+    #":test_extension_control_browser_proxy",
     ":test_hats_browser_proxy",
+
+    #":test_languages_browser_proxy",
     ":test_lifetime_browser_proxy.m",
     ":test_local_data_browser_proxy",
     ":test_metrics_browser_proxy",
     ":test_open_window_proxy",
     ":test_password_manager_proxy",
+
+    #":test_plural_string_proxy",
     ":test_privacy_page_browser_proxy",
+
+    #":test_profile_info_browser_proxy",
+    #":test_reset_browser_proxy",
     ":test_safe_browsing_browser_proxy",
     ":test_search_engines_browser_proxy.m",
     ":test_site_settings_prefs_browser_proxy",
     ":test_sync_browser_proxy.m",
     ":test_util",
 
-    # TODO(crbug.com/1000989): Add targets for more files here.
+    #":test_wallpaper_browser_proxy",
+    #":zoom_levels_tests",
   ]
 }
 
@@ -92,6 +197,7 @@
     ":test_lifetime_browser_proxy.m",
     "..:chai_assert",
     "//chrome/browser/resources/settings:settings",
+    "//ui/webui/resources/js:load_time_data.m",
   ]
   externs_list = [ "$externs_path/mocha-2.5.js" ]
 }
@@ -131,6 +237,21 @@
   ]
 }
 
+js_library("safety_check_page_test") {
+  deps = [
+    ":test_hats_browser_proxy",
+    ":test_lifetime_browser_proxy.m",
+    ":test_metrics_browser_proxy",
+    ":test_open_window_proxy",
+    ":test_password_manager_proxy",
+    "..:chai_assert",
+    "..:test_browser_proxy.m",
+    "//chrome/browser/resources/settings:settings",
+    "//ui/webui/resources/js:load_time_data.m",
+  ]
+  externs_list = [ "$externs_path/mocha-2.5.js" ]
+}
+
 js_library("test_metrics_browser_proxy") {
   deps = [
     "..:test_browser_proxy.m",

diff --git a/chrome/test/data/webui/settings/chromeos/os_settings_browsertest.js b/chrome/test/data/webui/settings/chromeos/os_settings_browsertest.js
index e9471227..ae8b090a 100644
--- a/chrome/test/data/webui/settings/chromeos/os_settings_browsertest.js
+++ b/chrome/test/data/webui/settings/chromeos/os_settings_browsertest.js

@@ -527,7 +527,7 @@
   mocha.grep('MainPage').run();
 });
 
-TEST_F('OSSettingsCrostiniPageTest', 'SubPageDefault', function() {
+TEST_F('OSSettingsCrostiniPageTest', 'DISABLED_SubPageDefault', function() {
   mocha.grep('SubPageDefault').run();
 });
 

diff --git a/chrome/test/data/webui/settings/safety_check_page_test.js b/chrome/test/data/webui/settings/safety_check_page_test.js
index 1a72efd..de2a30b 100644
--- a/chrome/test/data/webui/settings/safety_check_page_test.js
+++ b/chrome/test/data/webui/settings/safety_check_page_test.js

@@ -4,14 +4,18 @@
 
 // clang-format off
 import {webUIListenerCallback} from 'chrome://resources/js/cr.m.js';
+import {loadTimeData} from 'chrome://resources/js/load_time_data.m.js';
 import {flush} from 'chrome://resources/polymer/v3_0/polymer/polymer_bundled.min.js';
 import {HatsBrowserProxyImpl, LifetimeBrowserProxyImpl, MetricsBrowserProxyImpl, OpenWindowProxyImpl, PasswordManagerImpl, PasswordManagerProxy, Router, routes, SafetyCheckBrowserProxy, SafetyCheckBrowserProxyImpl, SafetyCheckCallbackConstants, SafetyCheckExtensionsStatus, SafetyCheckIconStatus, SafetyCheckInteractions, SafetyCheckParentStatus, SafetyCheckPasswordsStatus, SafetyCheckSafeBrowsingStatus, SafetyCheckUpdatesStatus} from 'chrome://settings/settings.js';
-import {TestHatsBrowserProxy} from 'chrome://test/settings/test_hats_browser_proxy.js';
-import {TestLifetimeBrowserProxy} from 'chrome://test/settings/test_lifetime_browser_proxy.m.js';
-import {TestMetricsBrowserProxy} from 'chrome://test/settings/test_metrics_browser_proxy.js';
-import {TestOpenWindowProxy} from 'chrome://test/settings/test_open_window_proxy.js';
-import {TestPasswordManagerProxy} from 'chrome://test/settings/test_password_manager_proxy.js';
-import {TestBrowserProxy} from 'chrome://test/test_browser_proxy.m.js';
+
+import {assertEquals, assertFalse, assertTrue} from '../chai_assert.js';
+import {TestBrowserProxy} from '../test_browser_proxy.m.js';
+
+import {TestHatsBrowserProxy} from './test_hats_browser_proxy.js';
+import {TestLifetimeBrowserProxy} from './test_lifetime_browser_proxy.m.js';
+import {TestMetricsBrowserProxy} from './test_metrics_browser_proxy.js';
+import {TestOpenWindowProxy} from './test_open_window_proxy.js';
+import {TestPasswordManagerProxy} from './test_password_manager_proxy.js';
 
 // clang-format on
 
@@ -19,7 +23,7 @@
 
 /**
  * Fire a safety check parent event.
- * @param {SafetyCheckParentStatus}
+ * @param {SafetyCheckParentStatus} state
  */
 function fireSafetyCheckParentEvent(state) {
   const event = {};
@@ -30,7 +34,7 @@
 
 /**
  * Fire a safety check updates event.
- * @param {SafetyCheckUpdatesStatus}
+ * @param {SafetyCheckUpdatesStatus} state
  */
 function fireSafetyCheckUpdatesEvent(state) {
   const event = {};
@@ -41,7 +45,7 @@
 
 /**
  * Fire a safety check passwords event.
- * @param {SafetyCheckPasswordsStatus}
+ * @param {SafetyCheckPasswordsStatus} state
  */
 function fireSafetyCheckPasswordsEvent(state) {
   const event = {};
@@ -53,7 +57,7 @@
 
 /**
  * Fire a safety check safe browsing event.
- * @param {SafetyCheckSafeBrowsingStatus}
+ * @param {SafetyCheckSafeBrowsingStatus} state
  */
 function fireSafetyCheckSafeBrowsingEvent(state) {
   const event = {};
@@ -65,7 +69,7 @@
 
 /**
  * Fire a safety check extensions event.
- * @param {SafetyCheckExtensionsStatus}
+ * @param {SafetyCheckExtensionsStatus} state
  */
 function fireSafetyCheckExtensionsEvent(state) {
   const event = {};
@@ -79,12 +83,12 @@
  * as specified.
  * @param {!{
  *   page: !PolymerElement,
- *   iconStatus: !SafetyCheckExtensionsStatus,
+ *   iconStatus: !SafetyCheckIconStatus,
  *   label: string,
- *   buttonLabel: string|undefined,
- *   buttonAriaLabel: string|undefined,
- *   buttonClass: string|undefined,
- *   managedIcon: string|undefined,
+ *   buttonLabel: (string|undefined),
+ *   buttonAriaLabel: (string|undefined),
+ *   buttonClass: (string|undefined),
+ *   managedIcon: (boolean|undefined),
  * }} destructured1
  */
 function assertSafetyCheckChild({
@@ -107,25 +111,56 @@
   assertTrue(!!managedIcon === !!safetyCheckChild.managedIcon);
 }
 
+/** @implements {SafetyCheckBrowserProxy} */
+class TestSafetyCheckBrowserProxy extends TestBrowserProxy {
+  constructor() {
+    super([
+      'getParentRanDisplayString',
+      'runSafetyCheck',
+    ]);
+
+    /** @private {string} */
+    this.parentRanDisplayString_ = '';
+  }
+
+  /** @override */
+  runSafetyCheck() {
+    this.methodCalled('runSafetyCheck');
+  }
+
+  /** @param {string} string */
+  setParentRanDisplayString(string) {
+    this.parentRanDisplayString_ = string;
+  }
+
+  /** @override */
+  getParentRanDisplayString() {
+    this.methodCalled('getParentRanDisplayString');
+    return Promise.resolve(this.parentRanDisplayString_);
+  }
+}
+
 suite('SafetyCheckPageUiTests', function() {
-  /** @type {settings.TestMetricsBrowserProxy} */
+  /** @type {?TestMetricsBrowserProxy} */
   let metricsBrowserProxy = null;
-  /** @type {SafetyCheckBrowserProxy} */
+
+  /** @type {?TestSafetyCheckBrowserProxy} */
   let safetyCheckBrowserProxy = null;
-  /** @type {SettingsBasicPageElement} */
-  let page = null;
+
+  /** @type {!SettingsSafetyCheckPageElement} */
+  let page;
 
   setup(function() {
     metricsBrowserProxy = new TestMetricsBrowserProxy();
     MetricsBrowserProxyImpl.instance_ = metricsBrowserProxy;
-    safetyCheckBrowserProxy =
-        TestBrowserProxy.fromClass(SafetyCheckBrowserProxy);
-    safetyCheckBrowserProxy.setResultFor(
-        'getParentRanDisplayString', Promise.resolve('Dummy string'));
+
+    safetyCheckBrowserProxy = new TestSafetyCheckBrowserProxy();
+    safetyCheckBrowserProxy.setParentRanDisplayString('Dummy string');
     SafetyCheckBrowserProxyImpl.instance_ = safetyCheckBrowserProxy;
 
-    PolymerTest.clearBody();
-    page = document.createElement('settings-safety-check-page');
+    document.body.innerHTML = '';
+    page = /** @type {!SettingsSafetyCheckPageElement} */ (
+        document.createElement('settings-safety-check-page'));
     document.body.appendChild(page);
     flush();
   });
@@ -140,7 +175,9 @@
     assertTrue(!!page.$$('#safetyCheckParentButton'));
     assertFalse(!!page.$$('#safetyCheckParentIconButton'));
     // Collapse is not opened.
-    assertFalse(page.$$('#safetyCheckCollapse').opened);
+    const collapse =
+        /** @type {!IronCollapseElement} */ (page.$$('#safetyCheckCollapse'));
+    assertFalse(collapse.opened);
 
     // User starts check.
     page.$$('#safetyCheckParentButton').click();
@@ -160,7 +197,7 @@
     assertFalse(!!page.$$('#safetyCheckParentButton'));
     assertTrue(!!page.$$('#safetyCheckParentIconButton'));
     // Collapse is opened.
-    assertTrue(page.$$('#safetyCheckCollapse').opened);
+    assertTrue(collapse.opened);
 
     // Mock all incoming messages that indicate safety check completion.
     fireSafetyCheckUpdatesEvent(SafetyCheckUpdatesStatus.UPDATED);
@@ -191,12 +228,13 @@
 });
 
 suite('SafetyCheckChildTests', function() {
-  /** @type {SettingsBasicPageElement} */
-  let page = null;
+  /** @type {!SettingsSafetyCheckChildElement} */
+  let page;
 
   setup(function() {
-    PolymerTest.clearBody();
-    page = document.createElement('settings-safety-check-child');
+    document.body.innerHTML = '';
+    page = /** @type {!SettingsSafetyCheckChildElement} */ (
+        document.createElement('settings-safety-check-child'));
     document.body.appendChild(page);
   });
 
@@ -308,12 +346,14 @@
 });
 
 suite('SafetyCheckUpdatesElementUiTests', function() {
-  /** @type {?LifetimeBrowserProxy} */
+  /** @type {?TestLifetimeBrowserProxy} */
   let lifetimeBrowserProxy = null;
-  /** @type {settings.TestMetricsBrowserProxy} */
+
+  /** @type {?TestMetricsBrowserProxy} */
   let metricsBrowserProxy = null;
-  /** @type {SettingsBasicPageElement} */
-  let page = null;
+
+  /** @type {!SettingsSafetyCheckUpdatesElementElement} */
+  let page;
 
   setup(function() {
     lifetimeBrowserProxy = new TestLifetimeBrowserProxy();
@@ -321,8 +361,9 @@
     metricsBrowserProxy = new TestMetricsBrowserProxy();
     MetricsBrowserProxyImpl.instance_ = metricsBrowserProxy;
 
-    PolymerTest.clearBody();
-    page = document.createElement('settings-safety-check-updates-element');
+    document.body.innerHTML = '';
+    page = /** @type {!SettingsSafetyCheckUpdatesElementElement} */ (
+        document.createElement('settings-safety-check-updates-element'));
     document.body.appendChild(page);
     flush();
   });
@@ -430,17 +471,19 @@
 });
 
 suite('SafetyCheckPasswordsElementUiTests', function() {
-  /** @type {settings.TestMetricsBrowserProxy} */
+  /** @type {?TestMetricsBrowserProxy} */
   let metricsBrowserProxy = null;
-  /** @type {SettingsBasicPageElement} */
-  let page = null;
+
+  /** @type {!SettingsSafetyCheckPasswordsElementElement} */
+  let page;
 
   setup(function() {
     metricsBrowserProxy = new TestMetricsBrowserProxy();
     MetricsBrowserProxyImpl.instance_ = metricsBrowserProxy;
 
-    PolymerTest.clearBody();
-    page = document.createElement('settings-safety-check-passwords-element');
+    document.body.innerHTML = '';
+    page = /** @type {!SettingsSafetyCheckPasswordsElementElement} */ (
+        document.createElement('settings-safety-check-passwords-element'));
     document.body.appendChild(page);
     flush();
   });
@@ -450,7 +493,7 @@
   });
 
   test('passwordCheckingUiTest', function() {
-    fireSafetyCheckPasswordsEvent(SafetyCheckUpdatesStatus.CHECKING);
+    fireSafetyCheckPasswordsEvent(SafetyCheckPasswordsStatus.CHECKING);
     flush();
     assertSafetyCheckChild({
       page: page,
@@ -534,18 +577,19 @@
 });
 
 suite('SafetyCheckSafeBrowsingElementUiTests', function() {
-  /** @type {settings.TestMetricsBrowserProxy} */
+  /** @type {?TestMetricsBrowserProxy} */
   let metricsBrowserProxy = null;
-  /** @type {SettingsBasicPageElement} */
-  let page = null;
+
+  /** @type {!SettingsSafetyCheckSafeBrowsingElementElement} */
+  let page;
 
   setup(function() {
     metricsBrowserProxy = new TestMetricsBrowserProxy();
     MetricsBrowserProxyImpl.instance_ = metricsBrowserProxy;
 
-    PolymerTest.clearBody();
-    page =
-        document.createElement('settings-safety-check-safe-browsing-element');
+    document.body.innerHTML = '';
+    page = /** @type {!SettingsSafetyCheckSafeBrowsingElementElement} */ (
+        document.createElement('settings-safety-check-safe-browsing-element'));
     document.body.appendChild(page);
     flush();
   });
@@ -638,12 +682,14 @@
 });
 
 suite('SafetyCheckExtensionsElementUiTests', function() {
-  /** @type {settings.TestMetricsBrowserProxy} */
+  /** @type {?TestMetricsBrowserProxy} */
   let metricsBrowserProxy = null;
-  /** @type {OpenWindowProxy} */
+
+  /** @type {?TestOpenWindowProxy} */
   let openWindowProxy = null;
-  /** @type {SettingsBasicPageElement} */
-  let page = null;
+
+  /** @type {!SettingsSafetyCheckExtensionsElementElement} */
+  let page;
 
   setup(function() {
     metricsBrowserProxy = new TestMetricsBrowserProxy();
@@ -651,8 +697,9 @@
     openWindowProxy = new TestOpenWindowProxy();
     OpenWindowProxyImpl.instance_ = openWindowProxy;
 
-    PolymerTest.clearBody();
-    page = document.createElement('settings-safety-check-extensions-element');
+    document.body.innerHTML = '';
+    page = /** @type {!SettingsSafetyCheckExtensionsElementElement} */ (
+        document.createElement('settings-safety-check-extensions-element'));
     document.body.appendChild(page);
     flush();
   });

diff --git a/chrome/test/nacl/nacl_browsertest_util.h b/chrome/test/nacl/nacl_browsertest_util.h
index 87cdae3..1c438dc 100644
--- a/chrome/test/nacl/nacl_browsertest_util.h
+++ b/chrome/test/nacl/nacl_browsertest_util.h

@@ -177,8 +177,9 @@
 #endif
 
 // NaCl glibc toolchain is not available on MIPS
-// It also no longer runs on recent versions of MacOS
-#if defined(ARCH_CPU_MIPS_FAMILY) || defined(OS_MACOSX)
+// It also no longer runs on recent versions of MacOS, and is flaky on Windows
+// due to use of cygwin.
+#if defined(ARCH_CPU_MIPS_FAMILY) || defined(OS_MACOSX) || defined(OS_WIN)
 #  define MAYBE_GLIBC(test_name) DISABLED_##test_name
 #else
 #  define MAYBE_GLIBC(test_name) test_name

diff --git a/chromecast/browser/cast_content_browser_client.cc b/chromecast/browser/cast_content_browser_client.cc
index b05e34c..149dde3 100644
--- a/chromecast/browser/cast_content_browser_client.cc
+++ b/chromecast/browser/cast_content_browser_client.cc

@@ -887,13 +887,15 @@
   cast_network_contexts_->OnNetworkServiceCreated(network_service);
 }
 
-mojo::Remote<network::mojom::NetworkContext>
-CastContentBrowserClient::CreateNetworkContext(
+void CastContentBrowserClient::ConfigureNetworkContextParams(
     content::BrowserContext* context,
     bool in_memory,
-    const base::FilePath& relative_partition_path) {
-  return cast_network_contexts_->CreateNetworkContext(context, in_memory,
-                                                      relative_partition_path);
+    const base::FilePath& relative_partition_path,
+    network::mojom::NetworkContextParams* network_context_params,
+    network::mojom::CertVerifierCreationParams* cert_verifier_creation_params) {
+  return cast_network_contexts_->ConfigureNetworkContextParams(
+      context, in_memory, relative_partition_path, network_context_params,
+      cert_verifier_creation_params);
 }
 
 bool CastContentBrowserClient::DoesSiteRequireDedicatedProcess(

diff --git a/chromecast/browser/cast_content_browser_client.h b/chromecast/browser/cast_content_browser_client.h
index af878729..70562ba7 100644
--- a/chromecast/browser/cast_content_browser_client.h
+++ b/chromecast/browser/cast_content_browser_client.h

@@ -235,10 +235,13 @@
       NonNetworkURLLoaderFactoryMap* factories) override;
   void OnNetworkServiceCreated(
       network::mojom::NetworkService* network_service) override;
-  mojo::Remote<network::mojom::NetworkContext> CreateNetworkContext(
+  void ConfigureNetworkContextParams(
       content::BrowserContext* context,
       bool in_memory,
-      const base::FilePath& relative_partition_path) override;
+      const base::FilePath& relative_partition_path,
+      network::mojom::NetworkContextParams* network_context_params,
+      network::mojom::CertVerifierCreationParams* cert_verifier_creation_params)
+      override;
   std::string GetUserAgent() override;
   bool DoesSiteRequireDedicatedProcess(content::BrowserContext* browser_context,
                                        const GURL& effective_site_url) override;

diff --git a/chromecast/browser/cast_network_contexts.cc b/chromecast/browser/cast_network_contexts.cc
index 299e766b..d4056d0 100644
--- a/chromecast/browser/cast_network_contexts.cc
+++ b/chromecast/browser/cast_network_contexts.cc

@@ -141,25 +141,20 @@
   return system_shared_url_loader_factory_;
 }
 
-mojo::Remote<network::mojom::NetworkContext>
-CastNetworkContexts::CreateNetworkContext(
+void CastNetworkContexts::ConfigureNetworkContextParams(
     content::BrowserContext* context,
     bool in_memory,
-    const base::FilePath& relative_partition_path) {
+    const base::FilePath& relative_partition_path,
+    network::mojom::NetworkContextParams* network_context_params,
+    network::mojom::CertVerifierCreationParams* cert_verifier_creation_params) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 
-  mojo::Remote<network::mojom::NetworkContext> network_context;
-  network::mojom::NetworkContextParamsPtr context_params =
-      CreateDefaultNetworkContextParams();
+  ConfigureDefaultNetworkContextParams(network_context_params);
 
-  content::UpdateCorsExemptHeader(context_params.get());
+  content::UpdateCorsExemptHeader(network_context_params);
 
   // Copy of what's in ContentBrowserClient::CreateNetworkContext for now.
-  context_params->accept_language = "en-us,en";
-
-  content::GetNetworkService()->CreateNetworkContext(
-      network_context.BindNewPipeAndPassReceiver(), std::move(context_params));
-  return network_context;
+  network_context_params->accept_language = "en-us,en";
 }
 
 void CastNetworkContexts::OnNetworkServiceCreated(
@@ -196,11 +191,8 @@
     pref_proxy_config_tracker_impl_->DetachFromPrefService();
 }
 
-network::mojom::NetworkContextParamsPtr
-CastNetworkContexts::CreateDefaultNetworkContextParams() {
-  network::mojom::NetworkContextParamsPtr network_context_params =
-      network::mojom::NetworkContextParams::New();
-
+void CastNetworkContexts::ConfigureDefaultNetworkContextParams(
+    network::mojom::NetworkContextParams* network_context_params) {
   network_context_params->http_cache_enabled = false;
   network_context_params->user_agent = GetUserAgent();
   network_context_params->accept_language =
@@ -215,17 +207,16 @@
   network_context_params->disable_idle_sockets_close_on_memory_pressure =
       IsFeatureEnabled(kDisableIdleSocketsCloseOnMemoryPressure);
 
-  AddProxyToNetworkContextParams(network_context_params.get());
+  AddProxyToNetworkContextParams(network_context_params);
 
   network_context_params->cors_exempt_header_list = cors_exempt_headers_list_;
-
-  return network_context_params;
 }
 
 network::mojom::NetworkContextParamsPtr
 CastNetworkContexts::CreateSystemNetworkContextParams() {
   network::mojom::NetworkContextParamsPtr network_context_params =
-      CreateDefaultNetworkContextParams();
+      network::mojom::NetworkContextParams::New();
+  ConfigureDefaultNetworkContextParams(network_context_params.get());
   content::UpdateCorsExemptHeader(network_context_params.get());
 
   network_context_params->context_name = std::string("system");

diff --git a/chromecast/browser/cast_network_contexts.h b/chromecast/browser/cast_network_contexts.h
index 085227f..475e66f 100644
--- a/chromecast/browser/cast_network_contexts.h
+++ b/chromecast/browser/cast_network_contexts.h

@@ -71,10 +71,13 @@
   // system NetworkContext, if the network service is enabled.
   void OnNetworkServiceCreated(network::mojom::NetworkService* network_service);
 
-  mojo::Remote<network::mojom::NetworkContext> CreateNetworkContext(
+  void ConfigureNetworkContextParams(
       content::BrowserContext* context,
       bool in_memory,
-      const base::FilePath& relative_partition_path);
+      const base::FilePath& relative_partition_path,
+      network::mojom::NetworkContextParams* network_context_params,
+      network::mojom::CertVerifierCreationParams*
+          cert_verifier_creation_params);
 
   // Called when the locale has changed.
   void OnLocaleUpdate();
@@ -85,8 +88,10 @@
  private:
   class URLLoaderFactoryForSystem;
 
-  // Returns default set of parameters for configuring the network service.
-  network::mojom::NetworkContextParamsPtr CreateDefaultNetworkContextParams();
+  // Fills in |network_context_params| with the default set of parameters for
+  // configuring the network service.
+  void ConfigureDefaultNetworkContextParams(
+      network::mojom::NetworkContextParams* network_context_params);
 
   // Creates parameters for the system NetworkContext. May only be called once,
   // since it initializes some class members.

diff --git a/chromeos/profiles/airmont.afdo.newest.txt b/chromeos/profiles/airmont.afdo.newest.txt
index 11cfbbb02..e9a28d32 100644
--- a/chromeos/profiles/airmont.afdo.newest.txt
+++ b/chromeos/profiles/airmont.afdo.newest.txt

@@ -1 +1 @@
-chromeos-chrome-amd64-airmont-84-4129.0-1588587148-benchmark-84.0.4140.0-r1-redacted.afdo.xz
\ No newline at end of file
+chromeos-chrome-amd64-airmont-84-4136.1-1589194235-benchmark-84.0.4142.0-r1-redacted.afdo.xz
\ No newline at end of file

diff --git a/chromeos/profiles/broadwell.afdo.newest.txt b/chromeos/profiles/broadwell.afdo.newest.txt
index dcc1d9e..94c97b6029 100644
--- a/chromeos/profiles/broadwell.afdo.newest.txt
+++ b/chromeos/profiles/broadwell.afdo.newest.txt

@@ -1 +1 @@
-chromeos-chrome-amd64-broadwell-84-4118.0-1588586006-benchmark-84.0.4140.0-r1-redacted.afdo.xz
\ No newline at end of file
+chromeos-chrome-amd64-broadwell-84-4129.0-1589191546-benchmark-84.0.4142.0-r1-redacted.afdo.xz
\ No newline at end of file

diff --git a/chromeos/profiles/silvermont.afdo.newest.txt b/chromeos/profiles/silvermont.afdo.newest.txt
index 610a34c..d1ce1e2 100644
--- a/chromeos/profiles/silvermont.afdo.newest.txt
+++ b/chromeos/profiles/silvermont.afdo.newest.txt

@@ -1 +1 @@
-chromeos-chrome-amd64-silvermont-84-4129.0-1588586778-benchmark-84.0.4140.0-r1-redacted.afdo.xz
\ No newline at end of file
+chromeos-chrome-amd64-silvermont-84-4136.1-1589189756-benchmark-84.0.4142.0-r1-redacted.afdo.xz
\ No newline at end of file

diff --git a/components/arc/ime/arc_ime_service.cc b/components/arc/ime/arc_ime_service.cc
index a194200b..7913a6b 100644
--- a/components/arc/ime/arc_ime_service.cc
+++ b/components/arc/ime/arc_ime_service.cc

@@ -441,8 +441,10 @@
   // According to the document in text_input_client.h, InsertChar() is called
   // even when the text input type is NONE. We ignore such events, since for
   // ARC we are only interested in the event as a method of text input.
-  if (ime_type_ == ui::TEXT_INPUT_TYPE_NONE)
+  if (ime_type_ == ui::TEXT_INPUT_TYPE_NONE ||
+      ime_type_ == ui::TEXT_INPUT_TYPE_NULL) {
     return;
+  }
 
   InvalidateSurroundingTextAndSelectionRange();
 

diff --git a/components/autofill/core/common/password_form_generation_data.cc b/components/autofill/core/common/password_form_generation_data.cc
index 83f0251..6ebec23 100644
--- a/components/autofill/core/common/password_form_generation_data.cc
+++ b/components/autofill/core/common/password_form_generation_data.cc

@@ -18,12 +18,14 @@
 
 #if defined(OS_IOS)
 PasswordFormGenerationData::PasswordFormGenerationData(
-    base::string16 form_name,
+    FormRendererId form_renderer_id,
     base::string16 new_password_element,
-    base::string16 confirmation_password_element)
-    : form_name(std::move(form_name)),
-      new_password_element(std::move(new_password_element)),
-      confirmation_password_element(std::move(confirmation_password_element)) {}
+    FieldRendererId new_password_renderer_id,
+    FieldRendererId confirmation_password_renderer_id)
+    : form_renderer_id(form_renderer_id),
+      new_password_element(new_password_element),
+      new_password_renderer_id(new_password_renderer_id),
+      confirmation_password_renderer_id(confirmation_password_renderer_id) {}
 
 PasswordFormGenerationData::PasswordFormGenerationData(
     const PasswordFormGenerationData&) = default;

diff --git a/components/autofill/core/common/password_form_generation_data.h b/components/autofill/core/common/password_form_generation_data.h
index d9bc7368..c76f1ecc 100644
--- a/components/autofill/core/common/password_form_generation_data.h
+++ b/components/autofill/core/common/password_form_generation_data.h

@@ -8,10 +8,7 @@
 #include <stdint.h>
 
 #include "base/optional.h"
-#include "base/strings/string16.h"
 #include "build/build_config.h"
-#include "components/autofill/core/common/form_field_data.h"
-#include "components/autofill/core/common/password_form.h"
 #include "components/autofill/core/common/renderer_id.h"
 #include "url/gurl.h"
 
@@ -24,9 +21,10 @@
   PasswordFormGenerationData(FieldRendererId new_password_renderer_id,
                              FieldRendererId confirmation_password_renderer_id);
 #if defined(OS_IOS)
-  PasswordFormGenerationData(base::string16 form_name,
+  PasswordFormGenerationData(FormRendererId form_renderer_id,
                              base::string16 new_password_element,
-                             base::string16 confirmation_password_element);
+                             FieldRendererId new_password_renderer_id,
+                             FieldRendererId confirmation_password_renderer_id);
 
   PasswordFormGenerationData(const PasswordFormGenerationData&);
   PasswordFormGenerationData& operator=(const PasswordFormGenerationData&);
@@ -34,9 +32,10 @@
   PasswordFormGenerationData& operator=(PasswordFormGenerationData&&);
   ~PasswordFormGenerationData();
 
-  base::string16 form_name;
+  FormRendererId form_renderer_id;
+  // TODO(crbug.com/1075444): Remove this once VotesUploader starts to use
+  // unique renderer IDs.
   base::string16 new_password_element;
-  base::string16 confirmation_password_element;
 #endif
   FieldRendererId new_password_renderer_id;
   FieldRendererId confirmation_password_renderer_id;

diff --git a/components/autofill/ios/browser/autofill_agent.mm b/components/autofill/ios/browser/autofill_agent.mm
index 7482fee..fceb06e 100644
--- a/components/autofill/ios/browser/autofill_agent.mm
+++ b/components/autofill/ios/browser/autofill_agent.mm

@@ -380,7 +380,9 @@
 
 - (void)didSelectSuggestion:(FormSuggestion*)suggestion
                        form:(NSString*)formName
+               uniqueFormID:(FormRendererId)uniqueFormID
             fieldIdentifier:(NSString*)fieldIdentifier
+              uniqueFieldID:(FieldRendererId)uniqueFieldID
                     frameID:(NSString*)frameID
           completionHandler:(SuggestionHandledCompletion)completion {
   [[UIDevice currentDevice] playInputClick];

diff --git a/components/autofill/ios/browser/fake_autofill_agent.mm b/components/autofill/ios/browser/fake_autofill_agent.mm
index 98d490cb..23b40b00 100644
--- a/components/autofill/ios/browser/fake_autofill_agent.mm
+++ b/components/autofill/ios/browser/fake_autofill_agent.mm

@@ -91,7 +91,9 @@
 
 - (void)didSelectSuggestion:(FormSuggestion*)suggestion
                        form:(NSString*)formName
+               uniqueFormID:(FormRendererId)uniqueFormID
             fieldIdentifier:(NSString*)fieldIdentifier
+              uniqueFieldID:(FieldRendererId)uniqueFieldID
                     frameID:(NSString*)frameID
           completionHandler:(SuggestionHandledCompletion)completion {
   base::PostTask(FROM_HERE, {web::WebThread::UI}, base::BindOnce(^{

diff --git a/components/autofill/ios/browser/form_suggestion_provider.h b/components/autofill/ios/browser/form_suggestion_provider.h
index 92cad1d..be55d08 100644
--- a/components/autofill/ios/browser/form_suggestion_provider.h
+++ b/components/autofill/ios/browser/form_suggestion_provider.h

@@ -48,7 +48,9 @@
 // field, invoking |completion| when finished.
 - (void)didSelectSuggestion:(FormSuggestion*)suggestion
                        form:(NSString*)formName
+               uniqueFormID:(autofill::FormRendererId)uniqueFormID
             fieldIdentifier:(NSString*)fieldIdentifier
+              uniqueFieldID:(autofill::FieldRendererId)uniqueFieldID
                     frameID:(NSString*)frameID
           completionHandler:(SuggestionHandledCompletion)completion;
 

diff --git a/components/autofill/ios/form_util/resources/form.js b/components/autofill/ios/form_util/resources/form.js
index 898642a..d393d81 100644
--- a/components/autofill/ios/form_util/resources/form.js
+++ b/components/autofill/ios/form_util/resources/form.js

@@ -271,6 +271,24 @@
 };
 
 /**
+ * Returns the form element from an unique form id.
+ *
+ * @param {number} identifier An ID string obtained via getFormIdentifier.
+ * @return {HTMLFormElement} The original form element, if it can be determined.
+ */
+__gCrWeb.form.getFormElementFromUniqueFormId = function(identifier) {
+  const forms = document.forms;
+  for (let i = 0; i < forms.length; i++) {
+    const form = forms[i];
+    const uniqueID = Symbol.for('__gChrome~uniqueID');
+    if (identifier === form[uniqueID]) {
+      return form;
+    }
+  }
+  return null;
+};
+
+/**
  * Returns whether the last |input| or |change| event on |element| was
  * triggered by a user action (was "trusted").
  */

diff --git a/components/browser_ui/widget/android/BUILD.gn b/components/browser_ui/widget/android/BUILD.gn
index 2728c3cb..c2eb8ff4 100644
--- a/components/browser_ui/widget/android/BUILD.gn
+++ b/components/browser_ui/widget/android/BUILD.gn

@@ -109,6 +109,8 @@
 android_resources("java_resources") {
   custom_package = "org.chromium.components.browser_ui.widget"
   sources = [
+    "java/res/anim/image_grid_enter.xml",
+    "java/res/anim/image_tile_enter.xml",
     "java/res/anim/menu_enter.xml",
     "java/res/anim/menu_enter_from_bottom.xml",
     "java/res/anim/menu_exit.xml",

diff --git a/components/browser_ui/widget/android/java/res/anim/image_grid_enter.xml b/components/browser_ui/widget/android/java/res/anim/image_grid_enter.xml
new file mode 100644
index 0000000..643c3c2
--- /dev/null
+++ b/components/browser_ui/widget/android/java/res/anim/image_grid_enter.xml

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2020 The Chromium Authors. All rights reserved.
+     Use of this source code is governed by a BSD-style license that can be
+     found in the LICENSE file.
+-->
+
+<layoutAnimation xmlns:android="http://schemas.android.com/apk/res/android"
+    android:animation="@anim/image_tile_enter"
+    android:delay="0%"
+    android:animationOrder="normal"/>
\ No newline at end of file

diff --git a/components/browser_ui/widget/android/java/res/anim/image_tile_enter.xml b/components/browser_ui/widget/android/java/res/anim/image_tile_enter.xml
new file mode 100644
index 0000000..46e427c
--- /dev/null
+++ b/components/browser_ui/widget/android/java/res/anim/image_tile_enter.xml

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Copyright 2020 The Chromium Authors. All rights reserved.
+     Use of this source code is governed by a BSD-style license that can be
+     found in the LICENSE file.
+-->
+
+<set xmlns:android="http://schemas.android.com/apk/res/android"
+    android:duration="200">
+    <translate
+        android:fromXDelta="20%"
+        android:toXDelta="0"
+        android:interpolator="@android:anim/accelerate_decelerate_interpolator" />
+
+    <alpha android:fromAlpha="0"
+        android:toAlpha="1"
+        android:interpolator="@android:anim/accelerate_decelerate_interpolator" />
+</set>

diff --git a/components/browser_ui/widget/android/java/src/org/chromium/components/browser_ui/widget/image_tiles/TileListView.java b/components/browser_ui/widget/android/java/src/org/chromium/components/browser_ui/widget/image_tiles/TileListView.java
index 0b2a3f20..cd6020d 100644
--- a/components/browser_ui/widget/android/java/src/org/chromium/components/browser_ui/widget/image_tiles/TileListView.java
+++ b/components/browser_ui/widget/android/java/src/org/chromium/components/browser_ui/widget/image_tiles/TileListView.java

@@ -8,6 +8,7 @@
 import android.content.res.Configuration;
 import android.graphics.Rect;
 import android.view.View;
+import android.view.animation.AnimationUtils;
 
 import androidx.annotation.NonNull;
 import androidx.annotation.Nullable;
@@ -52,6 +53,9 @@
         mLayoutManager = new LinearLayoutManager(context, LinearLayoutManager.HORIZONTAL, false);
         mView.setLayoutManager(mLayoutManager);
         mView.addItemDecoration(new ItemDecorationImpl(context));
+        mView.setLayoutAnimation(
+                AnimationUtils.loadLayoutAnimation(context, R.anim.image_grid_enter));
+
         mTileSizeSupplier = new TileSizeSupplier(context);
 
         PropertyModelChangeProcessor.create(
@@ -71,6 +75,7 @@
     /** Scrolls the recycler view to the given {@code position}. */
     public void scrollToPosition(int position) {
         mView.getLayoutManager().scrollToPosition(0);
+        mView.scheduleLayoutAnimation();
     }
 
     private class ItemDecorationImpl extends ItemDecoration {

diff --git a/components/exo/keyboard.cc b/components/exo/keyboard.cc
index a580848..64aa296e 100644
--- a/components/exo/keyboard.cc
+++ b/components/exo/keyboard.cc

@@ -71,8 +71,10 @@
   views::Widget* widget =
       views::Widget::GetTopLevelWidgetForNativeView(focus->window());
   ui::InputMethod* ime = widget ? widget->GetInputMethod() : nullptr;
-  if (!ime || ime->GetTextInputType() == ui::TEXT_INPUT_TYPE_NONE)
+  if (!ime || ime->GetTextInputType() == ui::TEXT_INPUT_TYPE_NONE ||
+      ime->GetTextInputType() == ui::TEXT_INPUT_TYPE_NULL) {
     return false;
+  }
 
   // Case 1:
   // When IME ate a key event but did not emit character insertion event yet
@@ -300,10 +302,11 @@
 
   switch (event->type()) {
     case ui::ET_KEY_PRESSED: {
-      // Process key press event if not already handled and not already pressed.
       auto it = pressed_keys_.find(physical_code);
       if (it == pressed_keys_.end() && !consumed_by_ime && !event->handled() &&
           physical_code != ui::DomCode::NONE) {
+        // Process key press event if not already handled and not already
+        // pressed.
         uint32_t serial =
             delegate_->OnKeyboardKey(event->time_stamp(), event->code(), true);
         if (AreKeyboardKeyAcksNeeded()) {
@@ -316,6 +319,14 @@
         // Keep track of both the physical code and potentially re-written
         // code that this event generated.
         pressed_keys_.insert({physical_code, event->code()});
+      } else if (it != pressed_keys_.end() && !event->handled()) {
+        // Non-repeate key events for already pressed key can be sent in some
+        // cases (e.g. Holding 'A' key then holding 'B' key then releasing 'A'
+        // key sends a non-repeat 'B' key press event).
+        // When it happens, we don't want to send the press event to a client
+        // and also want to avoid it from invoking any accelerator.
+        if (AreKeyboardKeyAcksNeeded())
+          event->SetHandled();
       }
     } break;
     case ui::ET_KEY_RELEASED: {

diff --git a/components/exo/keyboard_unittest.cc b/components/exo/keyboard_unittest.cc
index 0337e10..83e176f 100644
--- a/components/exo/keyboard_unittest.cc
+++ b/components/exo/keyboard_unittest.cc

@@ -706,6 +706,22 @@
   // AcceleratorPressed is not called when the accelerator is already handled.
   keyboard->AckKeyboardKey(3, true /* handled */);
 
+  // A repeat key event should not be sent to the client and also should not
+  // invoke the accelerator.
+  EXPECT_CALL(*shell_surface.get(), AcceleratorPressed(ui::Accelerator(
+                                        ui::VKEY_W, ui::EF_CONTROL_DOWN,
+                                        ui::Accelerator::KeyState::PRESSED)))
+      .Times(0);
+  generator.PressKey(ui::VKEY_W, ui::EF_CONTROL_DOWN | ui::EF_IS_REPEAT);
+
+  // Another key press event while holding the key is also ignored and should
+  // not invoke the accelerator.
+  EXPECT_CALL(*shell_surface.get(), AcceleratorPressed(ui::Accelerator(
+                                        ui::VKEY_W, ui::EF_CONTROL_DOWN,
+                                        ui::Accelerator::KeyState::PRESSED)))
+      .Times(0);
+  generator.PressKey(ui::VKEY_W, ui::EF_CONTROL_DOWN);
+
   // Release the key and reset modifier_flags.
   EXPECT_CALL(delegate, OnKeyboardModifiers(0));
   EXPECT_CALL(delegate, OnKeyboardKey(testing::_, ui::DomCode::US_W, false));

diff --git a/components/password_manager/core/browser/password_form_manager.cc b/components/password_manager/core/browser/password_form_manager.cc
index a52f0a6..a60398c 100644
--- a/components/password_manager/core/browser/password_form_manager.cc
+++ b/components/password_manager/core/browser/password_form_manager.cc

@@ -786,10 +786,13 @@
   if (observed_password_form->is_new_password_reliable && !IsBlacklisted()) {
 #if defined(OS_IOS)
     driver_->FormEligibleForGenerationFound(
-        {/*form_name*/ observed_password_form->form_data.name,
+        {/*form_renderer_id*/ observed_password_form->form_data
+             .unique_renderer_id,
          /*new_password_element*/ observed_password_form->new_password_element,
-         /*confirmation_password_element*/
-         observed_password_form->confirmation_password_element});
+         /*new_password_element_renderer_id*/
+         observed_password_form->new_password_element_renderer_id,
+         /*confirmation_password_element_renderer_id*/
+         observed_password_form->confirmation_password_element_renderer_id});
 #else
     driver_->FormEligibleForGenerationFound(
         {/*new_password_renderer_id*/

diff --git a/components/password_manager/core/browser/password_form_manager_unittest.cc b/components/password_manager/core/browser/password_form_manager_unittest.cc
index 94b58fd..40e181c 100644
--- a/components/password_manager/core/browser/password_form_manager_unittest.cc
+++ b/components/password_manager/core/browser/password_form_manager_unittest.cc

@@ -48,6 +48,7 @@
 using autofill::FieldPropertiesFlags;
 using autofill::FormData;
 using autofill::FormFieldData;
+using autofill::FormRendererId;
 using autofill::FormSignature;
 using autofill::FormStructure;
 using autofill::GaiaIdHash;
@@ -299,7 +300,7 @@
     observed_form_.url = origin;
     observed_form_.action = action;
     observed_form_.name = ASCIIToUTF16("sign-in");
-    observed_form_.unique_renderer_id = autofill::FormRendererId(1);
+    observed_form_.unique_renderer_id = FormRendererId(0);
     observed_form_.is_form_tag = true;
 
     observed_form_only_password_fields_ = observed_form_;
@@ -333,7 +334,7 @@
     field.id_attribute = field.name;
     field.name_attribute = field.name;
     field.form_control_type = "password";
-    field.unique_renderer_id = autofill::FieldRendererId(5);
+    field.unique_renderer_id = autofill::FieldRendererId(4);
     observed_form_only_password_fields_.fields.push_back(field);
 
 // On iOS the unique_id member uniquely addresses this field in the DOM.
@@ -556,9 +557,9 @@
   EXPECT_TRUE(fill_data.password_field.unique_renderer_id.is_null());
   EXPECT_EQ(saved_match_.password_value, fill_data.password_field.value);
 #if defined(OS_IOS)
-  EXPECT_EQ(ASCIIToUTF16("sign-in"), generation_data.form_name);
+  EXPECT_EQ(observed_form_.unique_renderer_id,
+            generation_data.form_renderer_id);
   EXPECT_EQ(ASCIIToUTF16("password"), generation_data.new_password_element);
-  EXPECT_EQ(base::string16(), generation_data.confirmation_password_element);
 #else
   EXPECT_EQ(observed_form_.fields.back().unique_renderer_id,
             generation_data.new_password_renderer_id);
@@ -591,9 +592,9 @@
 
   task_environment_.FastForwardUntilNoTasksRemain();
 #if defined(OS_IOS)
-  EXPECT_EQ(ASCIIToUTF16("sign-in"), generation_data.form_name);
+  EXPECT_EQ(observed_form_.unique_renderer_id,
+            generation_data.form_renderer_id);
   EXPECT_EQ(ASCIIToUTF16("password"), generation_data.new_password_element);
-  EXPECT_EQ(base::string16(), generation_data.confirmation_password_element);
 #else
   EXPECT_EQ(new_password_render_id, generation_data.new_password_renderer_id);
   EXPECT_EQ(confirm_password_render_id,

diff --git a/components/password_manager/core/browser/votes_uploader.h b/components/password_manager/core/browser/votes_uploader.h
index 78b1c2c5..bac1c27 100644
--- a/components/password_manager/core/browser/votes_uploader.h
+++ b/components/password_manager/core/browser/votes_uploader.h

@@ -213,6 +213,7 @@
   bool is_manual_generation_ = false;
 
   // A password field name that is used for generation.
+  // TODO(crbug.com/1075444): Use unique renderer id of a field instead.
   base::string16 generation_element_;
 
   // True iff a user edited the username value in a prompt and new username is

diff --git a/components/password_manager/ios/js_password_manager.h b/components/password_manager/ios/js_password_manager.h
index d274b0c7..ebd5a257 100644
--- a/components/password_manager/ios/js_password_manager.h
+++ b/components/password_manager/ios/js_password_manager.h

@@ -6,6 +6,7 @@
 #define COMPONENTS_PASSWORD_MANAGER_IOS_JS_PASSWORD_MANAGER_H_
 
 #include "base/ios/block_types.h"
+#include "components/autofill/core/common/renderer_id.h"
 #import "ios/web/public/deprecated/crw_js_injection_receiver.h"
 
 namespace autofill {
@@ -51,8 +52,8 @@
 // For example. the JSON string for a form with a single password field is:
 // {"action":null,"method":null,"usernameElement":"","usernameValue":"",
 // "passwords":[{"element":"","value":"asd"}]}
-- (void)extractForm:(NSString*)formName
-  completionHandler:(void (^)(NSString*))completionHandler;
+- (void)extractForm:(autofill::FormRendererId)formIdentifier
+    completionHandler:(void (^)(NSString*))completionHandler;
 
 // Fills in the password form specified by |JSONString| with the given
 // |username| and |password|. Assumes JavaScript has been injected previously
@@ -69,9 +70,10 @@
 // (optional) confirm password field |confirmPasswordIdentifier| in the form
 // identified by |formData|. Invokes |completionHandler| with true if any fields
 // were filled, false otherwise.
-- (void)fillPasswordForm:(NSString*)formName
-        newPasswordIdentifier:(NSString*)newPasswordIdentifier
-    confirmPasswordIdentifier:(NSString*)confirmPasswordIdentifier
+- (void)fillPasswordForm:(autofill::FormRendererId)formIdentifier
+        newPasswordIdentifier:(autofill::FieldRendererId)newPasswordIdentifier
+    confirmPasswordIdentifier:
+        (autofill::FieldRendererId)confirmPasswordIdentifier
             generatedPassword:(NSString*)generatedPassword
             completionHandler:(void (^)(BOOL))completionHandler;
 

diff --git a/components/password_manager/ios/js_password_manager.mm b/components/password_manager/ios/js_password_manager.mm
index ddcbe826..6cc058a5 100644
--- a/components/password_manager/ios/js_password_manager.mm
+++ b/components/password_manager/ios/js_password_manager.mm

@@ -104,12 +104,12 @@
              }];
 }
 
-- (void)extractForm:(NSString*)formName
-      completionHandler:(void (^)(NSString*))completionHandler {
+- (void)extractForm:(FormRendererId)formIdentifier
+    completionHandler:(void (^)(NSString*))completionHandler {
   DCHECK(completionHandler);
   NSString* extra = [NSString
-      stringWithFormat:@"__gCrWeb.passwords.getPasswordFormDataAsString(%@)",
-                       JSONEscape(formName)];
+      stringWithFormat:@"__gCrWeb.passwords.getPasswordFormDataAsString(%u)",
+                       formIdentifier.value()];
   [_receiver executeJavaScript:extra
              completionHandler:^(id result, NSError*) {
                completionHandler(base::mac::ObjCCastStrict<NSString>(result));
@@ -130,16 +130,16 @@
              }];
 }
 
-- (void)fillPasswordForm:(NSString*)formName
-        newPasswordIdentifier:(NSString*)newPasswordIdentifier
-    confirmPasswordIdentifier:(NSString*)confirmPasswordIdentifier
+- (void)fillPasswordForm:(FormRendererId)formIdentifier
+        newPasswordIdentifier:(FieldRendererId)newPasswordIdentifier
+    confirmPasswordIdentifier:(FieldRendererId)confirmPasswordIdentifier
             generatedPassword:(NSString*)generatedPassword
             completionHandler:(void (^)(BOOL))completionHandler {
   NSString* script = [NSString
       stringWithFormat:@"__gCrWeb.passwords."
-                       @"fillPasswordFormWithGeneratedPassword(%@, %@, %@, %@)",
-                       JSONEscape(formName), JSONEscape(newPasswordIdentifier),
-                       JSONEscape(confirmPasswordIdentifier),
+                       @"fillPasswordFormWithGeneratedPassword(%u, %u, %u, %@)",
+                       formIdentifier.value(), newPasswordIdentifier.value(),
+                       confirmPasswordIdentifier.value(),
                        JSONEscape(generatedPassword)];
   [_receiver executeJavaScript:script
              completionHandler:^(id result, NSError*) {

diff --git a/components/password_manager/ios/password_form_helper.h b/components/password_manager/ios/password_form_helper.h
index e1077f98..aaab831 100644
--- a/components/password_manager/ios/password_form_helper.h
+++ b/components/password_manager/ios/password_form_helper.h

@@ -7,6 +7,7 @@
 
 #import <Foundation/Foundation.h>
 
+#include "components/autofill/core/common/renderer_id.h"
 #import "components/autofill/ios/form_util/form_activity_observer_bridge.h"
 #import "ios/web/public/web_state_observer_bridge.h"
 #include "url/gurl.h"
@@ -70,9 +71,10 @@
 // for (optional as @"") confirm password field |confirmPasswordIdentifier| in
 // the form identified by |formData|. Invokes |completionHandler| with true if
 // any fields were filled, false otherwise.
-- (void)fillPasswordForm:(NSString*)formName
-        newPasswordIdentifier:(NSString*)newPasswordIdentifier
-    confirmPasswordIdentifier:(NSString*)confirmPasswordIdentifier
+- (void)fillPasswordForm:(autofill::FormRendererId)formIdentifier
+        newPasswordIdentifier:(autofill::FieldRendererId)newPasswordIdentifier
+    confirmPasswordIdentifier:
+        (autofill::FieldRendererId)confirmPasswordIdentifier
             generatedPassword:(NSString*)generatedPassword
             completionHandler:(nullable void (^)(BOOL))completionHandler;
 
@@ -89,10 +91,10 @@
                            completionHandler:
                                (nullable void (^)(BOOL))completionHandler;
 
-// Finds the password form named |formName| and calls
+// Finds the password form with unique ID |formIdentifier| and calls
 // |completionHandler| with the populated |FormData| data structure. |found| is
 // YES if the current form was found successfully, NO otherwise.
-- (void)extractPasswordFormData:(NSString*)formName
+- (void)extractPasswordFormData:(autofill::FormRendererId)formIdentifier
               completionHandler:
                   (void (^)(BOOL found,
                             const autofill::FormData& form))completionHandler;

diff --git a/components/password_manager/ios/password_form_helper.mm b/components/password_manager/ios/password_form_helper.mm
index 70c0f4687..db70654 100644
--- a/components/password_manager/ios/password_form_helper.mm
+++ b/components/password_manager/ios/password_form_helper.mm

@@ -25,6 +25,8 @@
 #endif
 
 using autofill::FormData;
+using autofill::FormRendererId;
+using autofill::FieldRendererId;
 using autofill::PasswordForm;
 using autofill::PasswordFormFillData;
 using password_manager::FillData;
@@ -311,13 +313,13 @@
        completionHandler:completionHandler];
 }
 
-- (void)fillPasswordForm:(NSString*)formName
-        newPasswordIdentifier:(NSString*)newPasswordIdentifier
-    confirmPasswordIdentifier:(NSString*)confirmPasswordIdentifier
+- (void)fillPasswordForm:(FormRendererId)formIdentifier
+        newPasswordIdentifier:(FieldRendererId)newPasswordIdentifier
+    confirmPasswordIdentifier:(FieldRendererId)confirmPasswordIdentifier
             generatedPassword:(NSString*)generatedPassword
             completionHandler:(nullable void (^)(BOOL))completionHandler {
   // Send JSON over to the web view.
-  [self.jsPasswordManager fillPasswordForm:formName
+  [self.jsPasswordManager fillPasswordForm:formIdentifier
                      newPasswordIdentifier:newPasswordIdentifier
                  confirmPasswordIdentifier:confirmPasswordIdentifier
                          generatedPassword:generatedPassword
@@ -375,7 +377,7 @@
 // Finds the password form named |formName| and calls
 // |completionHandler| with the populated |FormData| data structure. |found| is
 // YES if the current form was found successfully, NO otherwise.
-- (void)extractPasswordFormData:(NSString*)formName
+- (void)extractPasswordFormData:(FormRendererId)formIdentifier
               completionHandler:(void (^)(BOOL found, const FormData& form))
                                     completionHandler {
   DCHECK(completionHandler);
@@ -407,7 +409,7 @@
     completionHandler(YES, formData);
   };
 
-  [self.jsPasswordManager extractForm:formName
+  [self.jsPasswordManager extractForm:formIdentifier
                     completionHandler:extractFormDataCompletionHandler];
 }
 

diff --git a/components/password_manager/ios/password_form_helper_unittest.mm b/components/password_manager/ios/password_form_helper_unittest.mm
index 12283ff..ccd4d339 100644
--- a/components/password_manager/ios/password_form_helper_unittest.mm
+++ b/components/password_manager/ios/password_form_helper_unittest.mm

@@ -32,6 +32,7 @@
 NS_ASSUME_NONNULL_BEGIN
 
 using autofill::FormData;
+using autofill::FormRendererId;
 using autofill::PasswordForm;
 using autofill::PasswordFormFillData;
 using base::test::ios::kWaitForJSCompletionTimeout;
@@ -142,15 +143,6 @@
   }
 
  protected:
-  // Returns an identifier for the |form_index|th form in the page.
-  std::string GetFormId(int form_index) {
-    NSString* kGetFormIdScript =
-        @"__gCrWeb.form.getFormIdentifier("
-         "    document.querySelectorAll('form')[%d]);";
-    return base::SysNSStringToUTF8(ExecuteJavaScript(
-        [NSString stringWithFormat:kGetFormIdScript, form_index]));
-  }
-
   // PasswordFormHelper for testing.
   PasswordFormHelper* helper_;
 
@@ -387,10 +379,13 @@
             "<input id='p2' type='password' name='pw2'></form>"
             "<form><input id='u3' type='text' name='un3'>"
             "<input id='p3' type='password' name='pw3'></form>");
+  ExecuteJavaScript(@"__gCrWeb.fill.setUpForUniqueIDs(0);");
+  // Run password forms search to set up unique IDs.
+  EXPECT_TRUE(ExecuteJavaScript(@"__gCrWeb.passwords.findPasswordForms();"));
   __block int call_counter = 0;
   __block int success_counter = 0;
   __block FormData result = FormData();
-  [helper_ extractPasswordFormData:base::SysUTF8ToNSString(GetFormId(1))
+  [helper_ extractPasswordFormData:FormRendererId(0)
                  completionHandler:^(BOOL complete, const FormData& form) {
                    ++call_counter;
                    if (complete) {
@@ -402,13 +397,13 @@
     return call_counter == 1;
   }));
   EXPECT_EQ(1, success_counter);
-  EXPECT_EQ(result.name, base::ASCIIToUTF16(GetFormId(1)));
+  EXPECT_EQ(result.unique_renderer_id, FormRendererId(0));
 
   call_counter = 0;
   success_counter = 0;
   result = FormData();
 
-  [helper_ extractPasswordFormData:@"unknown"
+  [helper_ extractPasswordFormData:FormRendererId(404)
                  completionHandler:^(BOOL complete, const FormData& form) {
                    ++call_counter;
                    if (complete) {

diff --git a/components/password_manager/ios/resources/password_controller.js b/components/password_manager/ios/resources/password_controller.js
index ab5c5d3..9966ce2 100644
--- a/components/password_manager/ios/resources/password_controller.js
+++ b/components/password_manager/ios/resources/password_controller.js

@@ -124,24 +124,6 @@
  * Returns the element from |inputs| which has the field identifier equal to
  * |identifier| and null if there is no such element.
  * @param {Array<HTMLInputElement>} inputs
- * @param {string} identifier
- * @return {HTMLInputElement}
- */
-// TODO(crbug.com/1075444): Remove this function once stable IDs are used for
-// filling of generated passwords.
-const findInputByFieldIdentifier = function(inputs, identifier) {
-  for (let i = 0; i < inputs.length; ++i) {
-    if (identifier === __gCrWeb.form.getFieldIdentifier(inputs[i])) {
-      return inputs[i];
-    }
-  }
-  return null;
-};
-
-/**
- * Returns the element from |inputs| which has the field identifier equal to
- * |identifier| and null if there is no such element.
- * @param {Array<HTMLInputElement>} inputs
  * @param {number} identifier
  * @return {HTMLInputElement}
  */
@@ -159,11 +141,11 @@
  * Returns the password form with the given |identifier| as a JSON string
  * from the frame |win| and all its same-origin subframes.
  * @param {Window} win The window in which to look for forms.
- * @param {string} identifier The name of the form to extract.
+ * @param {number} identifier The name of the form to extract.
  * @return {HTMLFormElement} The password form.
  */
 const getPasswordFormElement = function(win, identifier) {
-  let el = win.__gCrWeb.form.getFormElementFromIdentifier(identifier);
+  let el = win.__gCrWeb.form.getFormElementFromUniqueFormId(identifier);
   if (el) {
     return el;
   }
@@ -191,7 +173,7 @@
 
 /**
  * Returns the password form with the given |identifier| as a JSON string.
- * @param {string} identifier The identifier of the form to extract.
+ * @param {number} identifier The identifier of the form to extract.
  * @return {string} The password form.
  */
 __gCrWeb.passwords['getPasswordFormDataAsString'] = function(identifier) {
@@ -233,22 +215,23 @@
  * Fills all password fields in the form identified by |formName|
  * with |password|.
  *
- * @param {string} formName The name of the form to fill.
- * @param {string} newPasswordIdentifier The id of password element to fill.
- * @param {string} confirmPasswordIdentifier The id of confirm password element
+ * @param {number} formIdentifier The name of the form to fill.
+ * @param {number} newPasswordIdentifier The id of password element to fill.
+ * @param {number} confirmPasswordIdentifier The id of confirm password element
  *   to fill.
  * @param {string} password The password to fill.
  * @return {boolean} Whether new password field has been filled.
-*/
+ */
 __gCrWeb.passwords['fillPasswordFormWithGeneratedPassword'] = function(
-    formName, newPasswordIdentifier, confirmPasswordIdentifier, password) {
-  const form = __gCrWeb.form.getFormElementFromIdentifier(formName);
+    formIdentifier, newPasswordIdentifier, confirmPasswordIdentifier,
+    password) {
+  const form = __gCrWeb.form.getFormElementFromUniqueFormId(formIdentifier);
   if (!form) {
     return false;
   }
   const inputs = getFormInputElements(form);
   const newPasswordField =
-      findInputByFieldIdentifier(inputs, newPasswordIdentifier);
+      findInputByUniqueFieldId(inputs, newPasswordIdentifier);
   if (!newPasswordField) {
     return false;
   }
@@ -257,7 +240,7 @@
     __gCrWeb.fill.setInputElementValue(password, newPasswordField);
   }
   const confirmPasswordField =
-      findInputByFieldIdentifier(inputs, confirmPasswordIdentifier);
+      findInputByUniqueFieldId(inputs, confirmPasswordIdentifier);
   if (confirmPasswordField && confirmPasswordField.value !== password) {
     __gCrWeb.fill.setInputElementValue(password, confirmPasswordField);
   }
@@ -277,15 +260,11 @@
  */
 const fillPasswordFormWithData = function(formData, username, password, win) {
   const doc = win.document;
-  const forms = doc.forms;
   let filled = false;
 
-  for (let i = 0; i < forms.length; i++) {
-    const form = forms[i];
-    const uniqueID = Symbol.for('__gChrome~uniqueID');
-    if (formData.unique_renderer_id !== form[uniqueID]) {
-      continue;
-    }
+  const form = win.__gCrWeb.form.getFormElementFromUniqueFormId(
+      formData.unique_renderer_id);
+  if (form) {
     const inputs = getFormInputElements(form);
     if (fillUsernameAndPassword_(inputs, formData, username, password)) {
       filled = true;

diff --git a/components/query_tiles/internal/BUILD.gn b/components/query_tiles/internal/BUILD.gn
index f2e9916..fe1bad26 100644
--- a/components/query_tiles/internal/BUILD.gn
+++ b/components/query_tiles/internal/BUILD.gn

@@ -12,6 +12,8 @@
     "cached_image_loader.cc",
     "cached_image_loader.h",
     "image_loader.h",
+    "image_prefetcher.cc",
+    "image_prefetcher.h",
     "init_aware_tile_service.cc",
     "init_aware_tile_service.h",
     "proto_conversion.cc",
@@ -59,6 +61,7 @@
 
   sources = [
     "cached_image_loader_unittest.cc",
+    "image_prefetcher_unittest.cc",
     "init_aware_tile_service_unittest.cc",
     "proto_conversion_unittest.cc",
     "tile_config_unittest.cc",

diff --git a/components/query_tiles/internal/image_prefetcher.cc b/components/query_tiles/internal/image_prefetcher.cc
new file mode 100644
index 0000000..d9ec0f3
--- /dev/null
+++ b/components/query_tiles/internal/image_prefetcher.cc

@@ -0,0 +1,133 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/query_tiles/internal/image_prefetcher.h"
+
+#include <utility>
+#include <vector>
+
+#include "base/bind_helpers.h"
+#include "base/memory/weak_ptr.h"
+#include "base/notreached.h"
+#include "base/threading/thread_task_runner_handle.h"
+#include "components/query_tiles/internal/image_loader.h"
+#include "components/query_tiles/internal/tile_group.h"
+#include "components/query_tiles/internal/tile_iterator.h"
+#include "third_party/skia/include/core/SkBitmap.h"
+
+namespace query_tiles {
+namespace {
+
+int ToTileIteratorLevel(ImagePrefetchMode mode) {
+  switch (mode) {
+    case ImagePrefetchMode::kTopLevel:
+      return 0;
+    case ImagePrefetchMode::kAll:
+      return TileIterator::kAllTiles;
+    default:
+      NOTREACHED();
+      return 0;
+  }
+}
+
+class ImagePrefetcherImpl : public ImagePrefetcher {
+ public:
+  ImagePrefetcherImpl(ImagePrefetchMode mode,
+                      std::unique_ptr<ImageLoader> image_loader)
+      : mode_(mode), image_loader_(std::move(image_loader)) {}
+  ~ImagePrefetcherImpl() override = default;
+
+ private:
+  // ImagePrefetcher implementation.
+  void Prefetch(TileGroup tile_group,
+                bool is_from_reduced_mode,
+                base::OnceClosure done_callback) override {
+    DCHECK(done_callback);
+    if (mode_ == ImagePrefetchMode::kNone) {
+      base::ThreadTaskRunnerHandle::Get()->PostTask(
+          FROM_HERE, base::BindOnce(std::move(done_callback)));
+      return;
+    }
+
+    // Get the URLs to fetch.
+    std::vector<GURL> urls_to_fetch;
+    int level = ToTileIteratorLevel(mode_);
+    TileIterator it(tile_group, level);
+    while (it.HasNext()) {
+      const auto* tile = it.Next();
+      DCHECK(tile);
+      if (tile->image_metadatas.empty())
+        continue;
+      GURL url = tile->image_metadatas.front().url;
+      if (!url.is_valid() || url.is_empty())
+        continue;
+      urls_to_fetch.emplace_back(std::move(url));
+    }
+
+    FetchImages(std::move(urls_to_fetch), is_from_reduced_mode,
+                std::move(done_callback));
+  }
+
+  // Fetch all images in |urls_to_fetch|.
+  void FetchImages(std::vector<GURL> urls_to_fetch,
+                   bool is_from_reduced_mode,
+                   base::OnceClosure done_callback) {
+    // All image urls are fetched.
+    if (urls_to_fetch.empty()) {
+      DCHECK(done_callback);
+      base::ThreadTaskRunnerHandle::Get()->PostTask(
+          FROM_HERE, base::BindOnce(std::move(done_callback)));
+      return;
+    }
+
+    // Prefetch images one by one.
+    GURL url = urls_to_fetch.back();
+    DCHECK(url.is_valid());
+    urls_to_fetch.pop_back();
+    auto next =
+        base::BindOnce(&ImagePrefetcherImpl::FetchImages,
+                       weak_ptr_factory_.GetWeakPtr(), std::move(urls_to_fetch),
+                       is_from_reduced_mode, std::move(done_callback));
+    if (is_from_reduced_mode) {
+      // The image won't be decoded in reduced mode.
+      image_loader_->PrefetchImage(
+          url, base::BindOnce(&ImagePrefetcherImpl::OnImageFetchedInReducedMode,
+                              weak_ptr_factory_.GetWeakPtr(), std::move(next)));
+    } else {
+      image_loader_->FetchImage(
+          url, base::BindOnce(&ImagePrefetcherImpl::OnImageFetched,
+                              weak_ptr_factory_.GetWeakPtr(), std::move(next)));
+    }
+  }
+
+  void OnImageFetched(base::OnceClosure next, SkBitmap bitmap) {
+    if (next) {
+      base::ThreadTaskRunnerHandle::Get()->PostTask(
+          FROM_HERE, base::BindOnce(std::move(next)));
+    }
+  }
+
+  void OnImageFetchedInReducedMode(base::OnceClosure next, bool success) {
+    if (next) {
+      base::ThreadTaskRunnerHandle::Get()->PostTask(
+          FROM_HERE, base::BindOnce(std::move(next)));
+    }
+  }
+
+  ImagePrefetchMode mode_;
+  std::unique_ptr<ImageLoader> image_loader_;
+  base::WeakPtrFactory<ImagePrefetcherImpl> weak_ptr_factory_{this};
+};
+
+}  // namespace
+
+// static
+std::unique_ptr<ImagePrefetcher> ImagePrefetcher::Create(
+    ImagePrefetchMode prefetch_mode,
+    std::unique_ptr<ImageLoader> image_loader) {
+  return std::make_unique<ImagePrefetcherImpl>(prefetch_mode,
+                                               std::move(image_loader));
+}
+
+}  // namespace query_tiles

diff --git a/components/query_tiles/internal/image_prefetcher.h b/components/query_tiles/internal/image_prefetcher.h
new file mode 100644
index 0000000..4880889
--- /dev/null
+++ b/components/query_tiles/internal/image_prefetcher.h

@@ -0,0 +1,40 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_QUERY_TILES_INTERNAL_IMAGE_PREFETCHER_H_
+#define COMPONENTS_QUERY_TILES_INTERNAL_IMAGE_PREFETCHER_H_
+
+#include <memory>
+
+#include "base/callback.h"
+#include "components/query_tiles/internal/tile_types.h"
+
+namespace query_tiles {
+
+class ImageLoader;
+struct TileGroup;
+
+// Used to prefetch images for a tile group in a background task.
+class ImagePrefetcher {
+ public:
+  static std::unique_ptr<ImagePrefetcher> Create(
+      ImagePrefetchMode prefetch_mode,
+      std::unique_ptr<ImageLoader> image_loader);
+
+  ImagePrefetcher() = default;
+  virtual ~ImagePrefetcher() = default;
+
+  ImagePrefetcher(const ImagePrefetcher&) = delete;
+  ImagePrefetcher& operator=(const ImagePrefetcher&) = delete;
+
+  // Prefetch a |tile_group|. |done_callback| will be invoked after prefetching
+  // is done.
+  virtual void Prefetch(TileGroup tile_group,
+                        bool is_from_reduced_mode,
+                        base::OnceClosure done_callback) = 0;
+};
+
+}  // namespace query_tiles
+
+#endif  // COMPONENTS_QUERY_TILES_INTERNAL_IMAGE_PREFETCHER_H_

diff --git a/components/query_tiles/internal/image_prefetcher_unittest.cc b/components/query_tiles/internal/image_prefetcher_unittest.cc
new file mode 100644
index 0000000..2272d6d1
--- /dev/null
+++ b/components/query_tiles/internal/image_prefetcher_unittest.cc

@@ -0,0 +1,150 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/query_tiles/internal/image_prefetcher.h"
+
+#include <memory>
+#include <utility>
+
+#include "base/bind_helpers.h"
+#include "base/test/task_environment.h"
+#include "components/query_tiles/internal/image_loader.h"
+#include "components/query_tiles/internal/tile_group.h"
+#include "components/query_tiles/test/test_utils.h"
+#include "components/query_tiles/tile.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/skia/include/core/SkBitmap.h"
+
+using testing::_;
+using testing::Invoke;
+using testing::StrictMock;
+
+namespace query_tiles {
+namespace {
+
+const char kImageUrl[] = "https://www.example.com/image";
+const char kOtherImageUrl[] = "https://www.example.com/image/other";
+const char kInvalidUrl[] = "Not a URL..";
+
+class MockImageLoader : public ImageLoader {
+ public:
+  MockImageLoader() = default;
+  ~MockImageLoader() override = default;
+
+  // ImageLoader implementation.
+  MOCK_METHOD(void,
+              FetchImage,
+              (const GURL& url, BitmapCallback callback),
+              (override));
+  MOCK_METHOD(void,
+              PrefetchImage,
+              (const GURL& url, SuccessCallback callback),
+              (override));
+
+  // Callback stubs.
+  MOCK_METHOD(void, DoneCallbackStub, (), ());
+};
+
+class ImagePrefetcherTest : public testing::Test {
+ public:
+  ImagePrefetcherTest() = default;
+  ~ImagePrefetcherTest() override = default;
+
+ protected:
+  MockImageLoader* image_loader() { return image_loader_; }
+  ImagePrefetcher* prefetcher() { return image_prefetcher_.get(); }
+
+  void Init(ImagePrefetchMode mode) {
+    auto image_loader = std::make_unique<StrictMock<MockImageLoader>>();
+    image_loader_ = image_loader.get();
+    image_prefetcher_ = ImagePrefetcher::Create(mode, std::move(image_loader));
+
+    ON_CALL(*image_loader_, FetchImage(_, _))
+        .WillByDefault(
+            Invoke([](const GURL& url, ImageLoader::BitmapCallback callback) {
+              std::move(callback).Run(SkBitmap());
+            }));
+
+    ON_CALL(*image_loader_, PrefetchImage(_, _))
+        .WillByDefault(
+            Invoke([](const GURL& url, ImageLoader::SuccessCallback callback) {
+              std::move(callback).Run(true);
+            }));
+  }
+
+  void ResetImageUrls(TileGroup* group) {
+    // Make the group to have one valid URL at top level, one valid URL at
+    // second level, and one invalid URL.
+    test::ResetTestGroup(group);
+    group->tiles[0]->image_metadatas.clear();
+    group->tiles[0]->image_metadatas.emplace_back(
+        ImageMetadata(GURL(kInvalidUrl)));
+    group->tiles[0]->sub_tiles[0]->image_metadatas.emplace_back(
+        ImageMetadata(GURL(kImageUrl)));
+    group->tiles[1]->image_metadatas.emplace_back(
+        ImageMetadata(GURL(kOtherImageUrl)));
+  }
+
+  void Prefetch(bool is_from_reduced_mode) {
+    DCHECK(image_loader_);
+    DCHECK(image_prefetcher_);
+    TileGroup group;
+    ResetImageUrls(&group);
+    prefetcher()->Prefetch(std::move(group), is_from_reduced_mode,
+                           base::BindOnce(&MockImageLoader::DoneCallbackStub,
+                                          base::Unretained(image_loader_)));
+  }
+
+  void RunUntilIdle() { task_environment_.RunUntilIdle(); }
+
+ private:
+  base::test::TaskEnvironment task_environment_;
+  MockImageLoader* image_loader_;
+  std::unique_ptr<ImagePrefetcher> image_prefetcher_;
+};
+
+// All images should be fetched for ImagePrefetchMode::kAll.
+TEST_F(ImagePrefetcherTest, PrefetchAll) {
+  Init(ImagePrefetchMode::kAll);
+  EXPECT_CALL(*image_loader(), DoneCallbackStub());
+  EXPECT_CALL(*image_loader(), FetchImage(GURL(kImageUrl), _));
+  EXPECT_CALL(*image_loader(), FetchImage(GURL(kOtherImageUrl), _));
+
+  Prefetch(false /*is_from_reduced_mode*/);
+  RunUntilIdle();
+}
+
+// Top level images should be fetched for ImagePrefetchMode::kTopLevel.
+TEST_F(ImagePrefetcherTest, PrefetchTopLevel) {
+  Init(ImagePrefetchMode::kTopLevel);
+  EXPECT_CALL(*image_loader(), DoneCallbackStub());
+  EXPECT_CALL(*image_loader(), FetchImage(GURL(kOtherImageUrl), _));
+
+  Prefetch(false /*is_from_reduced_mode*/);
+  RunUntilIdle();
+}
+
+// No image should be fetched for ImagePrefetchMode::kNone.
+TEST_F(ImagePrefetcherTest, PrefetchNone) {
+  Init(ImagePrefetchMode::kNone);
+  EXPECT_CALL(*image_loader(), DoneCallbackStub());
+  EXPECT_CALL(*image_loader(), FetchImage(_, _)).Times(0);
+
+  Prefetch(false /*is_from_reduced_mode*/);
+  RunUntilIdle();
+}
+
+// Reduced mode API is called when fetching the images.
+TEST_F(ImagePrefetcherTest, PrefetchReducedMode) {
+  Init(ImagePrefetchMode::kTopLevel);
+  EXPECT_CALL(*image_loader(), DoneCallbackStub());
+  EXPECT_CALL(*image_loader(), PrefetchImage(GURL(kOtherImageUrl), _));
+
+  Prefetch(true /*is_from_reduced_mode*/);
+  RunUntilIdle();
+}
+
+}  // namespace
+}  // namespace query_tiles

diff --git a/components/query_tiles/internal/tile_service_impl.cc b/components/query_tiles/internal/tile_service_impl.cc
index 875b2d0..3972dcf3 100644
--- a/components/query_tiles/internal/tile_service_impl.cc
+++ b/components/query_tiles/internal/tile_service_impl.cc

@@ -37,12 +37,12 @@
 }  // namespace
 
 TileServiceImpl::TileServiceImpl(
-    std::unique_ptr<ImageLoader> image_loader,
+    std::unique_ptr<ImagePrefetcher> image_prefetcher,
     std::unique_ptr<TileManager> tile_manager,
     background_task::BackgroundTaskScheduler* scheduler,
     std::unique_ptr<TileFetcher> tile_fetcher,
     base::Clock* clock)
-    : image_loader_(std::move(image_loader)),
+    : image_prefetcher_(std::move(image_prefetcher)),
       tile_manager_(std::move(tile_manager)),
       scheduler_(scheduler),
       tile_fetcher_(std::move(tile_fetcher)),
@@ -112,12 +112,13 @@
   DCHECK(tile_fetcher_);
   tile_fetcher_->StartFetchForTiles(base::BindOnce(
       &TileServiceImpl::OnFetchFinished, weak_ptr_factory_.GetWeakPtr(),
-      std::move(task_finished_callback)));
+      is_from_reduced_mode, std::move(task_finished_callback)));
 }
 
 // TODO(crbug.com/1077173): Handle the failures, retry mechanism and
 // related metrics.
 void TileServiceImpl::OnFetchFinished(
+    bool is_from_reduced_mode,
     BackgroundTaskFinishedCallback task_finished_callback,
     TileInfoRequestStatus status,
     const std::unique_ptr<std::string> response_body) {
@@ -129,10 +130,12 @@
       TileGroupFromResponse(response_proto, &group);
       group.id = base::GenerateGUID();
       group.last_updated_ts = clock_->Now();
+      auto group_copy = std::make_unique<TileGroup>(group);
       tile_manager_->SaveTiles(
-          std::make_unique<TileGroup>(group),
+          std::move(group_copy),
           base::BindOnce(&TileServiceImpl::OnTilesSaved,
-                         weak_ptr_factory_.GetWeakPtr(),
+                         weak_ptr_factory_.GetWeakPtr(), std::move(group),
+                         is_from_reduced_mode,
                          std::move(task_finished_callback)));
     }
   } else {
@@ -141,8 +144,25 @@
 }
 
 void TileServiceImpl::OnTilesSaved(
+    TileGroup tile_group,
+    bool is_from_reduced_mode,
     BackgroundTaskFinishedCallback task_finished_callback,
     TileGroupStatus status) {
+  if (status != TileGroupStatus::kSuccess) {
+    std::move(task_finished_callback).Run(false /*reschedule*/);
+    return;
+  }
+
+  image_prefetcher_->Prefetch(
+      std::move(tile_group), is_from_reduced_mode,
+      base::BindOnce(&TileServiceImpl::OnPrefetchImagesDone,
+                     weak_ptr_factory_.GetWeakPtr(),
+                     std::move(task_finished_callback)));
+}
+
+void TileServiceImpl::OnPrefetchImagesDone(
+    BackgroundTaskFinishedCallback task_finished_callback) {
+  DCHECK(task_finished_callback);
   std::move(task_finished_callback).Run(false /*reschedule*/);
 }
 

diff --git a/components/query_tiles/internal/tile_service_impl.h b/components/query_tiles/internal/tile_service_impl.h
index c43e842..0b33a64 100644
--- a/components/query_tiles/internal/tile_service_impl.h
+++ b/components/query_tiles/internal/tile_service_impl.h

@@ -10,7 +10,7 @@
 
 #include "base/memory/weak_ptr.h"
 #include "components/background_task_scheduler/background_task_scheduler.h"
-#include "components/query_tiles/internal/image_loader.h"
+#include "components/query_tiles/internal/image_prefetcher.h"
 #include "components/query_tiles/internal/tile_fetcher.h"
 #include "components/query_tiles/internal/tile_manager.h"
 #include "components/query_tiles/internal/tile_types.h"
@@ -30,7 +30,7 @@
 
 class TileServiceImpl : public InitializableTileService {
  public:
-  TileServiceImpl(std::unique_ptr<ImageLoader> image_loader,
+  TileServiceImpl(std::unique_ptr<ImagePrefetcher> image_prefetcher,
                   std::unique_ptr<TileManager> tile_manager,
                   background_task::BackgroundTaskScheduler* scheduler,
                   std::unique_ptr<TileFetcher> tile_fetcher,
@@ -59,16 +59,23 @@
   void ScheduleDailyTask();
 
   // Called when fetching from server is completed.
-  void OnFetchFinished(BackgroundTaskFinishedCallback task_finished_callback,
+  void OnFetchFinished(bool is_from_reduced_mode,
+                       BackgroundTaskFinishedCallback task_finished_callback,
                        TileInfoRequestStatus status,
                        const std::unique_ptr<std::string> response_body);
 
   // Called when saving to db via manager layer is completed.
-  void OnTilesSaved(BackgroundTaskFinishedCallback task_finished_callback,
+  void OnTilesSaved(TileGroup tile_group,
+                    bool is_from_reduced_mode,
+                    BackgroundTaskFinishedCallback task_finished_callback,
                     TileGroupStatus status);
 
-  // Used to load tile images.
-  std::unique_ptr<ImageLoader> image_loader_;
+  // Called when image prefetching are finished.
+  void OnPrefetchImagesDone(
+      BackgroundTaskFinishedCallback task_finished_callback);
+
+  // Used to preload tile images.
+  std::unique_ptr<ImagePrefetcher> image_prefetcher_;
 
   // Manages in memory tile group and coordinates with TileStore.
   std::unique_ptr<TileManager> tile_manager_;

diff --git a/components/query_tiles/internal/tile_service_impl_unittest.cc b/components/query_tiles/internal/tile_service_impl_unittest.cc
index 187f55bb..e4b95f2 100644
--- a/components/query_tiles/internal/tile_service_impl_unittest.cc
+++ b/components/query_tiles/internal/tile_service_impl_unittest.cc

@@ -13,6 +13,7 @@
 #include "base/test/simple_test_clock.h"
 #include "base/test/task_environment.h"
 #include "base/threading/thread_task_runner_handle.h"
+#include "components/query_tiles/internal/image_prefetcher.h"
 #include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
 #include "services/network/test/test_url_loader_factory.h"
 #include "services/network/test/test_utils.h"
@@ -46,6 +47,14 @@
   MOCK_METHOD1(Cancel, void(int));
 };
 
+class MockImagePrefetcher : public ImagePrefetcher {
+ public:
+  MockImagePrefetcher() = default;
+  ~MockImagePrefetcher() override = default;
+
+  MOCK_METHOD(void, Prefetch, (TileGroup, bool, base::OnceClosure), (override));
+};
+
 }  // namespace
 
 class TileServiceImplTest : public testing::Test {
@@ -59,6 +68,13 @@
   void SetUp() override {
     auto tile_manager = std::make_unique<MockTileManager>();
     tile_manager_ = tile_manager.get();
+    auto image_prefetcher = std::make_unique<MockImagePrefetcher>();
+    image_prefetcher_ = image_prefetcher.get();
+    ON_CALL(*image_prefetcher_, Prefetch(_, _, _))
+        .WillByDefault(Invoke([](TileGroup, bool, base::OnceClosure callback) {
+          std::move(callback).Run();
+        }));
+
     auto tile_fetcher =
         TileFetcher::Create(GURL("https://www.test.com"), "US", "en", "apikey",
                             "", test_shared_url_loader_factory_);
@@ -69,7 +85,7 @@
         }));
     EXPECT_CALL(task_scheduler_, Schedule(_));
     tile_service_impl_ = std::make_unique<TileServiceImpl>(
-        nullptr /* image_loader */, std::move(tile_manager), &task_scheduler_,
+        std::move(image_prefetcher), std::move(tile_manager), &task_scheduler_,
         std::move(tile_fetcher), &clock_);
   }
 
@@ -115,6 +131,7 @@
   }
 
   MockTileManager* tile_manager() { return tile_manager_; }
+  MockImagePrefetcher* image_prefetcher() { return image_prefetcher_; }
 
  private:
   base::test::TaskEnvironment task_environment_;
@@ -122,6 +139,7 @@
   std::unique_ptr<TileServiceImpl> tile_service_impl_;
   MockBackgroundTaskScheduler task_scheduler_;
   MockTileManager* tile_manager_;
+  MockImagePrefetcher* image_prefetcher_;
   network::TestURLLoaderFactory test_url_loader_factory_;
   scoped_refptr<network::SharedURLLoaderFactory>
       test_shared_url_loader_factory_;
@@ -154,6 +172,8 @@
                           base::OnceCallback<void(TileGroupStatus)> callback) {
         std::move(callback).Run(TileGroupStatus::kSuccess);
       }));
+  EXPECT_CALL(*image_prefetcher(), Prefetch(_, _, _));
+
   FetchForTilesSuceeded();
 }
 

diff --git a/components/query_tiles/tile_service_factory_helper.cc b/components/query_tiles/tile_service_factory_helper.cc
index acfdf8e..2d507ff 100644
--- a/components/query_tiles/tile_service_factory_helper.cc
+++ b/components/query_tiles/tile_service_factory_helper.cc

@@ -4,6 +4,7 @@
 
 #include "components/query_tiles/tile_service_factory_helper.h"
 
+#include <string>
 #include <utility>
 
 #include "base/sequenced_task_runner.h"
@@ -16,6 +17,7 @@
 #include "components/leveldb_proto/public/proto_database_provider.h"
 #include "components/leveldb_proto/public/shared_proto_database_client_list.h"
 #include "components/query_tiles/internal/cached_image_loader.h"
+#include "components/query_tiles/internal/image_prefetcher.h"
 #include "components/query_tiles/internal/init_aware_tile_service.h"
 #include "components/query_tiles/internal/tile_config.h"
 #include "components/query_tiles/internal/tile_fetcher.h"
@@ -46,6 +48,8 @@
       image_fetcher::ImageFetcherConfig::kReducedMode);
   auto image_loader = std::make_unique<CachedImageLoader>(
       cached_image_fetcher, reduced_mode_image_fetcher);
+  auto image_prefetcher = ImagePrefetcher::Create(
+      TileConfig::GetImagePrefetchMode(), std::move(image_loader));
 
   auto* clock = base::DefaultClock::GetInstance();
   // Create tile store and manager.
@@ -65,7 +69,7 @@
       api_key, TileConfig::GetExperimentTag(), url_loader_factory);
 
   auto tile_service_impl = std::make_unique<TileServiceImpl>(
-      std::move(image_loader), std::move(tile_manager), scheduler,
+      std::move(image_prefetcher), std::move(tile_manager), scheduler,
       std::move(tile_fetcher), clock);
   return std::make_unique<InitAwareTileService>(std::move(tile_service_impl));
 }

diff --git a/components/sync/protocol/proto_enum_conversions.cc b/components/sync/protocol/proto_enum_conversions.cc
index 9a92ef38..e01ff9a0 100644
--- a/components/sync/protocol/proto_enum_conversions.cc
+++ b/components/sync/protocol/proto_enum_conversions.cc

@@ -427,6 +427,19 @@
 }
 
 const char* ProtoEnumToString(
+    sync_pb::UserEventSpecifics::FlocIdComputed::EventTrigger trigger) {
+  ASSERT_ENUM_BOUNDS(sync_pb::UserEventSpecifics::FlocIdComputed, EventTrigger,
+                     UNSPECIFIED, REFRESHED);
+  switch (trigger) {
+    ENUM_CASE(sync_pb::UserEventSpecifics::FlocIdComputed, UNSPECIFIED);
+    ENUM_CASE(sync_pb::UserEventSpecifics::FlocIdComputed, NEW);
+    ENUM_CASE(sync_pb::UserEventSpecifics::FlocIdComputed, REFRESHED);
+  }
+  NOTREACHED();
+  return "";
+}
+
+const char* ProtoEnumToString(
     sync_pb::WalletMaskedCreditCard::WalletCardStatus wallet_card_status) {
   ASSERT_ENUM_BOUNDS(sync_pb::WalletMaskedCreditCard, WalletCardStatus, VALID,
                      EXPIRED);

diff --git a/components/sync/protocol/proto_enum_conversions.h b/components/sync/protocol/proto_enum_conversions.h
index 7882eb4..0b030c8 100644
--- a/components/sync/protocol/proto_enum_conversions.h
+++ b/components/sync/protocol/proto_enum_conversions.h

@@ -91,6 +91,9 @@
     sync_pb::UserEventSpecifics::GaiaPasswordCaptured::EventTrigger trigger);
 
 const char* ProtoEnumToString(
+    sync_pb::UserEventSpecifics::FlocIdComputed::EventTrigger trigger);
+
+const char* ProtoEnumToString(
     sync_pb::WalletMaskedCreditCard::WalletCardStatus wallet_card_status);
 
 const char* ProtoEnumToString(

diff --git a/components/sync/protocol/proto_visitors.h b/components/sync/protocol/proto_visitors.h
index 17c63bc2..cdb0421 100644
--- a/components/sync/protocol/proto_visitors.h
+++ b/components/sync/protocol/proto_visitors.h

@@ -878,6 +878,11 @@
   VISIT_ENUM(event_trigger);
 }
 
+VISIT_PROTO_FIELDS(const sync_pb::UserEventSpecifics::FlocIdComputed& proto) {
+  VISIT_ENUM(event_trigger);
+  VISIT(floc_id);
+}
+
 VISIT_PROTO_FIELDS(const sync_pb::TabNavigation& proto) {
   VISIT(virtual_url);
   VISIT(referrer);
@@ -998,6 +1003,7 @@
   VISIT(test_event);
   VISIT(gaia_password_reuse_event);
   VISIT(gaia_password_captured_event);
+  VISIT(floc_id_computed_event);
 }
 
 VISIT_PROTO_FIELDS(const sync_pb::UserEventSpecifics::Test& proto) {}

diff --git a/components/sync/protocol/user_event_specifics.proto b/components/sync/protocol/user_event_specifics.proto
index 30f9ab1..ee417eabe 100644
--- a/components/sync/protocol/user_event_specifics.proto
+++ b/components/sync/protocol/user_event_specifics.proto

@@ -179,6 +179,19 @@
     optional EventTrigger event_trigger = 1;
   }
 
+  message FlocIdComputed {
+    enum EventTrigger {
+      UNSPECIFIED = 0;
+      // Event added because the floc id is computed for the 1st floc session.
+      NEW = 1;
+      // Event added because the floc id is re-computed due to a long period of
+      // time has passed since the last computation.
+      REFRESHED = 2;
+    }
+    optional EventTrigger event_trigger = 1;
+    optional uint64 floc_id = 2;
+  }
+
   oneof event {
     Test test_event = 8;
     LanguageDetection language_detection_event = 10 [deprecated = true];
@@ -187,6 +200,7 @@
     // Happens when a user types their Google account password on another site.
     GaiaPasswordReuse gaia_password_reuse_event = 104;
     GaiaPasswordCaptured gaia_password_captured_event = 15;
+    FlocIdComputed floc_id_computed_event = 16;
   }
   reserved "field_trial_event";
   reserved 9;

diff --git a/components/sync_user_events/user_event_service_impl.cc b/components/sync_user_events/user_event_service_impl.cc
index 6a1c2dd..e04f286 100644
--- a/components/sync_user_events/user_event_service_impl.cc
+++ b/components/sync_user_events/user_event_service_impl.cc

@@ -35,6 +35,7 @@
     case UserEventSpecifics::kLanguageDetectionEvent:
     case UserEventSpecifics::kTranslationEvent:
     case UserEventSpecifics::kUserConsent:
+    case UserEventSpecifics::kFlocIdComputedEvent:
     case UserEventSpecifics::EVENT_NOT_SET:
       break;
   }

diff --git a/components/variations/android/java/src/org/chromium/components/variations/VariationsAssociatedData.java b/components/variations/android/java/src/org/chromium/components/variations/VariationsAssociatedData.java
index 914e84a..76343e2 100644
--- a/components/variations/android/java/src/org/chromium/components/variations/VariationsAssociatedData.java
+++ b/components/variations/android/java/src/org/chromium/components/variations/VariationsAssociatedData.java

@@ -34,9 +34,22 @@
         return map;
     }
 
+    /**
+     * Returns the list of Google App variations from active finch field trials.
+     * @return A space separated list of ids with leading and trailing space.
+     * For example, " 123 456 ".
+     * IMPORTANT: This string is only approved for integrations with the Android
+     * Google App and must receive a privacy review before extending to other apps.
+     */
+    public static String getGoogleAppVariations() {
+        String variations = VariationsAssociatedDataJni.get().getGoogleAppVariations();
+        return variations;
+    }
+
     @NativeMethods
     interface Natives {
         String getVariationParamValue(String trialName, String paramName);
         String getFeedbackVariations();
+        String getGoogleAppVariations();
     }
 }

diff --git a/components/variations/android/variations_associated_data_android.cc b/components/variations/android/variations_associated_data_android.cc
index b4d1439..6b12a306 100644
--- a/components/variations/android/variations_associated_data_android.cc
+++ b/components/variations/android/variations_associated_data_android.cc

@@ -35,5 +35,12 @@
   return ConvertUTF8ToJavaString(env, values);
 }
 
+ScopedJavaLocalRef<jstring> JNI_VariationsAssociatedData_GetGoogleAppVariations(
+    JNIEnv* env) {
+  const std::string values = VariationsHttpHeaderProvider::GetInstance()
+                                 ->GetGoogleAppVariationsString();
+  return ConvertUTF8ToJavaString(env, values);
+}
+
 }  // namespace android
 }  // namespace variations

diff --git a/components/variations/proto/study.proto b/components/variations/proto/study.proto
index fd106d6..0e8911069 100644
--- a/components/variations/proto/study.proto
+++ b/components/variations/proto/study.proto

@@ -46,7 +46,7 @@
 
   // An experiment within the study.
   //
-  // Next tag: 14
+  // Next tag: 16
   message Experiment {
     // A named parameter value for this experiment.
     //
@@ -78,6 +78,13 @@
     // Optional id used to uniquely identify this experiment for Chrome Sync.
     optional uint64 chrome_sync_experiment_id = 10;
 
+    // Optional id used to uniquely identify this experiment when activating
+    // integrations with the Android Google App.
+    // IMPORTANT: This field is only approved for integrations with the Android
+    // Google App and must receive a privacy review before extending to other
+    // apps.
+    optional uint64 google_app_experiment_id = 15;
+
     // Specifies the feature association parameters for this experiment group.
     //
     // Next tag: 5

diff --git a/components/variations/variations_associated_data.cc b/components/variations/variations_associated_data.cc
index 07443b18..5ca29b0 100644
--- a/components/variations/variations_associated_data.cc
+++ b/components/variations/variations_associated_data.cc

@@ -37,7 +37,7 @@
                    const ActiveGroupId& group_identifier,
                    const VariationID id,
                    const bool force) {
-    static_assert(3 == ID_COLLECTION_COUNT,
+    static_assert(4 == ID_COLLECTION_COUNT,
                   "If you add a new collection key, add handling code here!");
 #if DCHECK_IS_ON()
     // Ensure that at most one of the trigger/non-trigger/signed-in web property

diff --git a/components/variations/variations_associated_data.h b/components/variations/variations_associated_data.h
index 55b9021c..aa581ca 100644
--- a/components/variations/variations_associated_data.h
+++ b/components/variations/variations_associated_data.h

@@ -65,6 +65,9 @@
   // server side experimental behavior, transmitted through the
   // X-Client-Data header.
   GOOGLE_WEB_PROPERTIES_TRIGGER,
+  // This collection is used by the Google App and is passed at the time
+  // the cross-app communication is triggered.
+  GOOGLE_APP,
   // The total count of collections.
   ID_COLLECTION_COUNT,
 };

diff --git a/components/variations/variations_http_header_provider.cc b/components/variations/variations_http_header_provider.cc
index 99e21de..d620cc5 100644
--- a/components/variations/variations_http_header_provider.cc
+++ b/components/variations/variations_http_header_provider.cc

@@ -55,7 +55,8 @@
   return variation_ids_header_copy;
 }
 
-std::string VariationsHttpHeaderProvider::GetVariationsString() {
+std::string VariationsHttpHeaderProvider::GetVariationsString(
+    IDCollectionKey key) {
   InitVariationIDsCacheIfNeeded();
 
   // Construct a space-separated string with leading and trailing spaces from
@@ -65,7 +66,7 @@
   {
     base::AutoLock scoped_lock(lock_);
     for (const VariationIDEntry& entry : GetAllVariationIds()) {
-      if (entry.second == GOOGLE_WEB_PROPERTIES) {
+      if (entry.second == key) {
         ids_string.append(base::NumberToString(entry.first));
         ids_string.push_back(' ');
       }
@@ -74,6 +75,14 @@
   return ids_string;
 }
 
+std::string VariationsHttpHeaderProvider::GetGoogleAppVariationsString() {
+  return GetVariationsString(GOOGLE_APP);
+}
+
+std::string VariationsHttpHeaderProvider::GetVariationsString() {
+  return GetVariationsString(GOOGLE_WEB_PROPERTIES);
+}
+
 std::vector<VariationID> VariationsHttpHeaderProvider::GetVariationsVector(
     IDCollectionKey key) {
   InitVariationIDsCacheIfNeeded();
@@ -157,6 +166,7 @@
   CacheVariationsId(trial_name, group_name, GOOGLE_WEB_PROPERTIES);
   CacheVariationsId(trial_name, group_name, GOOGLE_WEB_PROPERTIES_SIGNED_IN);
   CacheVariationsId(trial_name, group_name, GOOGLE_WEB_PROPERTIES_TRIGGER);
+  CacheVariationsId(trial_name, group_name, GOOGLE_APP);
   if (variation_ids_set_.size() != old_size)
     UpdateVariationIDsHeaderValue();
 }
@@ -179,6 +189,8 @@
       synthetic_variation_ids_set_.insert(
           VariationIDEntry(id, GOOGLE_WEB_PROPERTIES_SIGNED_IN));
     }
+    // Google App IDs omitted because they should never be defined
+    // synthetically.
   }
   UpdateVariationIDsHeaderValue();
 }
@@ -203,6 +215,7 @@
                       GOOGLE_WEB_PROPERTIES_SIGNED_IN);
     CacheVariationsId(entry.trial_name, entry.group_name,
                       GOOGLE_WEB_PROPERTIES_TRIGGER);
+    CacheVariationsId(entry.trial_name, entry.group_name, GOOGLE_APP);
   }
   UpdateVariationIDsHeaderValue();
 
@@ -255,6 +268,9 @@
       case GOOGLE_WEB_PROPERTIES_TRIGGER:
         proto.add_trigger_variation_id(entry.first);
         break;
+      case GOOGLE_APP:
+        // These IDs should not be added into Google Web headers.
+        break;
       case ID_COLLECTION_COUNT:
         // This case included to get full enum coverage for switch, so that
         // new enums introduce compiler warnings. Nothing to do for this.

diff --git a/components/variations/variations_http_header_provider.h b/components/variations/variations_http_header_provider.h
index 73ced9a6..bf324c7 100644
--- a/components/variations/variations_http_header_provider.h
+++ b/components/variations/variations_http_header_provider.h

@@ -52,10 +52,18 @@
   // Returns a space-separated string containing the list of current active
   // variations (as would be reported in the |variation_id| repeated field of
   // the ClientVariations proto). Does not include variation ids that should be
-  // sent for signed-in users only. The returned string is guaranteed to have a
-  // a leading and trailing space, e.g. " 123 234 345 ".
+  // sent for signed-in users only and does not include Google app variations.
+  // The returned string is guaranteed to have a leading and trailing space,
+  // e.g. " 123 234 345 ".
   std::string GetVariationsString();
 
+  // Same as GetVariationString(), but returns Google App variation ids rather
+  // than Google Web variations.
+  // IMPORTANT: This string is only approved for integrations with the Android
+  // Google App and must receive a privacy review before extending to other
+  // apps.
+  std::string GetGoogleAppVariationsString();
+
   // Returns the collection of of variation ids matching the given |key|. Each
   // entry in the returned vector will be unique.
   std::vector<VariationID> GetVariationsVector(IDCollectionKey key);
@@ -108,6 +116,8 @@
   FRIEND_TEST_ALL_PREFIXES(VariationsHttpHeaderProviderTest,
                            OnFieldTrialGroupFinalized);
   FRIEND_TEST_ALL_PREFIXES(VariationsHttpHeaderProviderTest,
+                           GetGoogleAppVariationsString);
+  FRIEND_TEST_ALL_PREFIXES(VariationsHttpHeaderProviderTest,
                            GetVariationsString);
   FRIEND_TEST_ALL_PREFIXES(VariationsHttpHeaderProviderTest,
                            GetVariationsVector);
@@ -115,6 +125,11 @@
   VariationsHttpHeaderProvider();
   ~VariationsHttpHeaderProvider() override;
 
+  // Returns a space-separated string containing the list of current active
+  // variations (as would be reported in the |variation_id| repeated field of
+  // the ClientVariations proto) for a given ID collection.
+  std::string GetVariationsString(IDCollectionKey key);
+
   // base::FieldTrialList::Observer:
   // This will add the variation ID associated with |trial_name| and
   // |group_name| to the variation ID cache.

diff --git a/components/variations/variations_http_header_provider_unittest.cc b/components/variations/variations_http_header_provider_unittest.cc
index 58bd69f..e4bdf31 100644
--- a/components/variations/variations_http_header_provider_unittest.cc
+++ b/components/variations/variations_http_header_provider_unittest.cc

@@ -211,6 +211,21 @@
   }
 }
 
+TEST_F(VariationsHttpHeaderProviderTest, GetGoogleAppVariationsString) {
+  base::test::SingleThreadTaskEnvironment task_environment;
+  // All GOOGLE_WEB_PROPERTIES(_X) ids shouldn't be included.
+  CreateTrialAndAssociateId("t1", "g1", GOOGLE_WEB_PROPERTIES, 123);
+  CreateTrialAndAssociateId("t2", "g2", GOOGLE_WEB_PROPERTIES, 124);
+  CreateTrialAndAssociateId("t3", "g3", GOOGLE_WEB_PROPERTIES_SIGNED_IN, 125);
+
+  // GOOGLE_APP ids should be included.
+  CreateTrialAndAssociateId("t4", "g4", GOOGLE_APP, 126);
+
+  VariationsHttpHeaderProvider provider;
+  provider.ForceVariationIds({"100", "200"}, "");
+  EXPECT_EQ(" 126 ", provider.GetGoogleAppVariationsString());
+}
+
 TEST_F(VariationsHttpHeaderProviderTest, GetVariationsString) {
   base::test::SingleThreadTaskEnvironment task_environment;
 
@@ -218,6 +233,8 @@
   CreateTrialAndAssociateId("t2", "g2", GOOGLE_WEB_PROPERTIES, 124);
   // SIGNED_IN ids shouldn't be included.
   CreateTrialAndAssociateId("t3", "g3", GOOGLE_WEB_PROPERTIES_SIGNED_IN, 125);
+  // GOOGLE_APP ids shouldn't be included.
+  CreateTrialAndAssociateId("t4", "g4", GOOGLE_APP, 126);
 
   VariationsHttpHeaderProvider provider;
   provider.ForceVariationIds({"100", "200"}, "");
@@ -231,6 +248,7 @@
   CreateTrialAndAssociateId("t3", "g3", GOOGLE_WEB_PROPERTIES_TRIGGER, 123);
   CreateTrialAndAssociateId("t4", "g4", GOOGLE_WEB_PROPERTIES_TRIGGER, 124);
   CreateTrialAndAssociateId("t5", "g5", GOOGLE_WEB_PROPERTIES_SIGNED_IN, 125);
+  CreateTrialAndAssociateId("t6", "g6", GOOGLE_APP, 126);
 
   VariationsHttpHeaderProvider provider;
   provider.ForceVariationIds({"100", "200", "t101"}, "");
@@ -241,6 +259,8 @@
             provider.GetVariationsVector(GOOGLE_WEB_PROPERTIES_TRIGGER));
   EXPECT_EQ((std::vector<VariationID>{125}),
             provider.GetVariationsVector(GOOGLE_WEB_PROPERTIES_SIGNED_IN));
+  EXPECT_EQ((std::vector<VariationID>{126}),
+            provider.GetVariationsVector(GOOGLE_APP));
 }
 
 }  // namespace variations

diff --git a/components/variations/variations_seed_processor.cc b/components/variations/variations_seed_processor.cc
index 2a61928..ab5d7063 100644
--- a/components/variations/variations_seed_processor.cc
+++ b/components/variations/variations_seed_processor.cc

@@ -50,9 +50,14 @@
   if (experiment.has_google_web_trigger_experiment_id()) {
     const VariationID variation_id =
         static_cast<VariationID>(experiment.google_web_trigger_experiment_id());
-    AssociateGoogleVariationIDForce(GOOGLE_WEB_PROPERTIES_TRIGGER,
-                                    trial_name,
-                                    experiment.name(),
+    AssociateGoogleVariationIDForce(GOOGLE_WEB_PROPERTIES_TRIGGER, trial_name,
+                                    experiment.name(), variation_id);
+  }
+
+  if (experiment.has_google_app_experiment_id()) {
+    const VariationID variation_id =
+        static_cast<VariationID>(experiment.google_app_experiment_id());
+    AssociateGoogleVariationIDForce(GOOGLE_APP, trial_name, experiment.name(),
                                     variation_id);
   }
 }

diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
index edd0921..9b19892 100644
--- a/content/browser/BUILD.gn
+++ b/content/browser/BUILD.gn

@@ -257,6 +257,8 @@
   ]
 
   sources = [
+    "$target_gen_dir/devtools/protocol/audits.cc",
+    "$target_gen_dir/devtools/protocol/audits.h",
     "$target_gen_dir/devtools/protocol/background_service.cc",
     "$target_gen_dir/devtools/protocol/background_service.h",
     "$target_gen_dir/devtools/protocol/base_string_adapter.cc",
@@ -755,6 +757,8 @@
     "devtools/devtools_video_consumer.h",
     "devtools/forwarding_agent_host.cc",
     "devtools/forwarding_agent_host.h",
+    "devtools/protocol/audits_handler.cc",
+    "devtools/protocol/audits_handler.h",
     "devtools/protocol/background_service_handler.cc",
     "devtools/protocol/background_service_handler.h",
     "devtools/protocol/browser_handler.cc",

diff --git a/content/browser/browser_context.cc b/content/browser/browser_context.cc
index 79129f5c..05473c62 100644
--- a/content/browser/browser_context.cc
+++ b/content/browser/browser_context.cc

@@ -439,6 +439,7 @@
   indexed_db_control.SetForceKeepSessionState();
 }
 
+// static
 void BrowserContext::SetDownloadManagerForTesting(
     BrowserContext* browser_context,
     std::unique_ptr<content::DownloadManager> download_manager) {

diff --git a/content/browser/devtools/BUILD.gn b/content/browser/devtools/BUILD.gn
index d3670fb..a39fe43 100644
--- a/content/browser/devtools/BUILD.gn
+++ b/content/browser/devtools/BUILD.gn

@@ -63,6 +63,8 @@
 
   # These are relative to $target_gen_dir.
   outputs = [
+    "protocol/audits.cc",
+    "protocol/audits.h",
     "protocol/background_service.cc",
     "protocol/background_service.h",
     "protocol/base_string_adapter.cc",

diff --git a/content/browser/devtools/protocol/audits_handler.cc b/content/browser/devtools/protocol/audits_handler.cc
new file mode 100644
index 0000000..9f32e63e
--- /dev/null
+++ b/content/browser/devtools/protocol/audits_handler.cc

@@ -0,0 +1,38 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/devtools/protocol/audits_handler.h"
+
+#include "content/browser/devtools/devtools_agent_host_impl.h"
+
+namespace content {
+namespace protocol {
+
+AuditsHandler::AuditsHandler()
+    : DevToolsDomainHandler(Audits::Metainfo::domainName) {}
+AuditsHandler::~AuditsHandler() = default;
+
+// static
+std::vector<AuditsHandler*> AuditsHandler::ForAgentHost(
+    DevToolsAgentHostImpl* host) {
+  return host->HandlersByName<AuditsHandler>(Audits::Metainfo::domainName);
+}
+
+void AuditsHandler::Wire(UberDispatcher* dispatcher) {
+  frontend_ = std::make_unique<Audits::Frontend>(dispatcher->channel());
+  Audits::Dispatcher::wire(dispatcher, this);
+}
+
+DispatchResponse AuditsHandler::Disable() {
+  enabled_ = false;
+  return Response::FallThrough();
+}
+
+DispatchResponse AuditsHandler::Enable() {
+  enabled_ = true;
+  return Response::FallThrough();
+}
+
+}  // namespace protocol
+}  // namespace content

diff --git a/content/browser/devtools/protocol/audits_handler.h b/content/browser/devtools/protocol/audits_handler.h
new file mode 100644
index 0000000..1d00247
--- /dev/null
+++ b/content/browser/devtools/protocol/audits_handler.h

@@ -0,0 +1,44 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_DEVTOOLS_PROTOCOL_AUDITS_HANDLER_H_
+#define CONTENT_BROWSER_DEVTOOLS_PROTOCOL_AUDITS_HANDLER_H_
+
+#include "base/macros.h"
+#include "content/browser/devtools/protocol/audits.h"
+#include "content/browser/devtools/protocol/devtools_domain_handler.h"
+#include "mojo/public/cpp/bindings/remote.h"
+
+namespace content {
+
+class DevToolsAgentHostImpl;
+
+namespace protocol {
+
+class AuditsHandler final : public DevToolsDomainHandler,
+                            public Audits::Backend {
+ public:
+  AuditsHandler();
+  ~AuditsHandler() override;
+
+  static std::vector<AuditsHandler*> ForAgentHost(DevToolsAgentHostImpl* host);
+
+  // DevToolsDomainHandler implementation.
+  void Wire(UberDispatcher* dispatcher) override;
+
+  // Audits::Backend implementation.
+  DispatchResponse Disable() override;
+  DispatchResponse Enable() override;
+
+ private:
+  std::unique_ptr<Audits::Frontend> frontend_;
+  bool enabled_ = false;
+
+  DISALLOW_COPY_AND_ASSIGN(AuditsHandler);
+};
+
+}  // namespace protocol
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_DEVTOOLS_PROTOCOL_AUDITS_HANDLER_H_

diff --git a/content/browser/devtools/protocol/page_handler.cc b/content/browser/devtools/protocol/page_handler.cc
index 929b63a..b182143 100644
--- a/content/browser/devtools/protocol/page_handler.cc
+++ b/content/browser/devtools/protocol/page_handler.cc

@@ -961,14 +961,14 @@
 
 void PageHandler::GetAppManifest(
     std::unique_ptr<GetAppManifestCallback> callback) {
-  WebContentsImpl* web_contents = GetWebContents();
-  if (!web_contents || !web_contents->GetManifestManagerHost()) {
+  if (!host_) {
     callback->sendFailure(Response::ServerError("Cannot retrieve manifest"));
     return;
   }
-  web_contents->GetManifestManagerHost()->RequestManifestDebugInfo(
-      base::BindOnce(&PageHandler::GotManifest, weak_factory_.GetWeakPtr(),
-                     std::move(callback)));
+  ManifestManagerHost::GetOrCreateForCurrentDocument(host_->GetMainFrame())
+      ->RequestManifestDebugInfo(base::BindOnce(&PageHandler::GotManifest,
+                                                weak_factory_.GetWeakPtr(),
+                                                std::move(callback)));
 }
 
 WebContentsImpl* PageHandler::GetWebContents() {

diff --git a/content/browser/devtools/protocol_config.json b/content/browser/devtools/protocol_config.json
index 604cebf..61abf10a 100644
--- a/content/browser/devtools/protocol_config.json
+++ b/content/browser/devtools/protocol_config.json

@@ -10,6 +10,10 @@
         "export_header": "content/common/content_export.h",
         "options": [
             {
+                "domain": "Audits",
+                "include": ["enable", "disable"]
+            },
+            {
                 "domain": "BackgroundService",
                 "async": ["startObserving"]
             },

diff --git a/content/browser/devtools/render_frame_devtools_agent_host.cc b/content/browser/devtools/render_frame_devtools_agent_host.cc
index d70c3971..90ea37c6 100644
--- a/content/browser/devtools/render_frame_devtools_agent_host.cc
+++ b/content/browser/devtools/render_frame_devtools_agent_host.cc

@@ -21,6 +21,7 @@
 #include "content/browser/devtools/devtools_manager.h"
 #include "content/browser/devtools/devtools_renderer_channel.h"
 #include "content/browser/devtools/devtools_session.h"
+#include "content/browser/devtools/protocol/audits_handler.h"
 #include "content/browser/devtools/protocol/background_service_handler.h"
 #include "content/browser/devtools/protocol/browser_handler.h"
 #include "content/browser/devtools/protocol/dom_handler.h"
@@ -291,6 +292,7 @@
   auto emulation_handler = std::make_unique<protocol::EmulationHandler>();
   protocol::EmulationHandler* emulation_handler_ptr = emulation_handler.get();
 
+  session->AddHandler(std::make_unique<protocol::AuditsHandler>());
   session->AddHandler(std::make_unique<protocol::BackgroundServiceHandler>());
   auto browser_handler = std::make_unique<protocol::BrowserHandler>(
       session->GetClient()->MayWriteLocalFiles());

diff --git a/content/browser/frame_host/navigator.cc b/content/browser/frame_host/navigator.cc
index 89ae014..e052b64 100644
--- a/content/browser/frame_host/navigator.cc
+++ b/content/browser/frame_host/navigator.cc

@@ -177,10 +177,6 @@
   return controller_;
 }
 
-base::TimeTicks Navigator::GetCurrentLoadStart() {
-  return base::TimeTicks::Now();
-}
-
 void Navigator::DidFailLoadWithError(RenderFrameHostImpl* render_frame_host,
                                      const GURL& url,
                                      int error_code) {

diff --git a/content/browser/frame_host/navigator.h b/content/browser/frame_host/navigator.h
index 211298e..19ce444 100644
--- a/content/browser/frame_host/navigator.h
+++ b/content/browser/frame_host/navigator.h

@@ -83,8 +83,6 @@
   // Returns the NavigationController associated with this Navigator.
   NavigationController* GetController();
 
-  base::TimeTicks GetCurrentLoadStart();
-
   // Notifications coming from the RenderFrameHosts ----------------------------
 
   // The RenderFrameHostImpl has failed to load the document.

diff --git a/content/browser/frame_host/render_document_host_user_data_browsertest.cc b/content/browser/frame_host/render_document_host_user_data_browsertest.cc
index 290e550..09dff78 100644
--- a/content/browser/frame_host/render_document_host_user_data_browsertest.cc
+++ b/content/browser/frame_host/render_document_host_user_data_browsertest.cc

@@ -88,7 +88,7 @@
 
 // Test basic functionality of RenderDocumentHostUserData.
 IN_PROC_BROWSER_TEST_F(RenderDocumentHostUserDataTest,
-                       GetAndCreateForCurrentDocument) {
+                       GetCreateAndDeleteForCurrentDocument) {
   ASSERT_TRUE(embedded_test_server()->Start());
   GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
 
@@ -104,8 +104,14 @@
   // 3) Create Data and check that GetForCurrentDocument shouldn't return null
   // now.
   Data::CreateForCurrentDocument(rfh_a);
-  data = Data::GetForCurrentDocument(rfh_a);
-  EXPECT_TRUE(data);
+  base::WeakPtr<Data> created_data =
+      Data::GetForCurrentDocument(rfh_a)->GetWeakPtr();
+  EXPECT_TRUE(created_data);
+
+  // 4) Delete Data and check that GetForCurrentDocument should return null.
+  Data::DeleteForCurrentDocument(rfh_a);
+  EXPECT_FALSE(created_data);
+  EXPECT_FALSE(Data::GetForCurrentDocument(rfh_a));
 }
 
 // Tests that RenderDocumentHostUserData objects are different for each

diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index d10d99df7..30bc648 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc

@@ -75,6 +75,7 @@
 #include "content/browser/loader/navigation_url_loader_impl.h"
 #include "content/browser/loader/prefetch_url_loader_service.h"
 #include "content/browser/log_console_message.h"
+#include "content/browser/manifest/manifest_manager_host.h"
 #include "content/browser/media/capture/audio_mirroring_manager.h"
 #include "content/browser/media/media_interface_proxy.h"
 #include "content/browser/media/webaudio/audio_context_manager_impl.h"
@@ -6145,6 +6146,15 @@
               std::make_unique<ActiveURLMessageFilter>(impl));
         },
         base::Unretained(this)));
+
+    associated_registry_->AddInterface(base::BindRepeating(
+        [](RenderFrameHostImpl* impl,
+           mojo::PendingAssociatedReceiver<
+               blink::mojom::ManifestUrlChangeObserver> receiver) {
+          ManifestManagerHost::GetOrCreateForCurrentDocument(impl)
+              ->BindObserver(std::move(receiver));
+        },
+        base::Unretained(this)));
   }
 
   associated_registry_->AddInterface(base::BindRepeating(

diff --git a/content/browser/frame_host/render_frame_host_impl.h b/content/browser/frame_host/render_frame_host_impl.h
index 2bba134..bfd4213 100644
--- a/content/browser/frame_host/render_frame_host_impl.h
+++ b/content/browser/frame_host/render_frame_host_impl.h

@@ -1595,6 +1595,10 @@
     document_associated_data_.SetUserData(key, std::move(data));
   }
 
+  void RemoveRenderDocumentHostUserData(const void* key) {
+    document_associated_data_.RemoveUserData(key);
+  }
+
   // Returns the child RenderFrameHostImpl if |child_frame_routing_id| is an
   // immediate child of this FrameTreeNode. |child_frame_routing_id| is
   // considered untrusted, so the renderer process is killed if it refers to a

diff --git a/content/browser/gpu/gpu_process_host.cc b/content/browser/gpu/gpu_process_host.cc
index c0ce98fe..4843ab08 100644
--- a/content/browser/gpu/gpu_process_host.cc
+++ b/content/browser/gpu/gpu_process_host.cc

@@ -61,6 +61,7 @@
 #include "gpu/config/gpu_driver_bug_workaround_type.h"
 #include "gpu/config/gpu_finch_features.h"
 #include "gpu/config/gpu_preferences.h"
+#include "gpu/config/gpu_switches.h"
 #include "gpu/ipc/common/gpu_client_ids.h"
 #include "gpu/ipc/host/shader_disk_cache.h"
 #include "gpu/ipc/in_process_command_buffer.h"
@@ -1120,6 +1121,25 @@
     cmd_line->AppendSwitch(service_manager::switches::kDisableGpuSandbox);
     cmd_line->AppendSwitchASCII(switches::kUseGL,
                                 gl::kGLImplementationDisabledName);
+
+    // Pass the current device info to the info-collection GPU process for
+    // crash key logging.
+    const gpu::GPUInfo::GPUDevice& device_info = GetGPUInfo().active_gpu();
+    cmd_line->AppendSwitchASCII(
+        switches::kGpuVendorId,
+        base::StringPrintf("%u", device_info.vendor_id));
+    cmd_line->AppendSwitchASCII(
+        switches::kGpuDeviceId,
+        base::StringPrintf("%u", device_info.device_id));
+#if defined(OS_WIN)
+    cmd_line->AppendSwitchASCII(
+        switches::kGpuSubSystemId,
+        base::StringPrintf("%u", device_info.sub_sys_id));
+    cmd_line->AppendSwitchASCII(switches::kGpuRevision,
+                                base::StringPrintf("%u", device_info.revision));
+#endif
+    cmd_line->AppendSwitchASCII(switches::kGpuDriverVersion,
+                                device_info.driver_version.c_str());
   }
 
   // TODO(penghuang): Replace all GPU related switches with GpuPreferences.

diff --git a/content/browser/loader/quic_transport_browsertest.cc b/content/browser/loader/quic_transport_browsertest.cc
index 92068b5..cc588e5 100644
--- a/content/browser/loader/quic_transport_browsertest.cc
+++ b/content/browser/loader/quic_transport_browsertest.cc

@@ -288,5 +288,52 @@
   ASSERT_TRUE(WaitForTitle(ASCIIToUTF16("PASS"), {ASCIIToUTF16("FAIL")}));
 }
 
+IN_PROC_BROWSER_TEST_F(QuicTransportBrowserTest, BidirectionalStream) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  ASSERT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title2.html")));
+
+  ASSERT_TRUE(WaitForTitle(ASCIIToUTF16("Title Of Awesomeness")));
+
+  ASSERT_TRUE(ExecuteScript(
+      shell(), base::StringPrintf(R"JS(
+    async function run() {
+      const transport = new QuicTransport('quic-transport://localhost:%d/echo');
+
+      await transport.ready;
+
+      const data = [65, 66, 67];
+
+      const bidiStream = await transport.createBidirectionalStream();
+      const writer = bidiStream.writable.getWriter();
+      await writer.write(new Uint8Array(data));
+
+      const reader = bidiStream.readable.getReader();
+
+      const {value, done: done1} = await reader.read();
+      if (done1) {
+        throw new Error('reading should not be done');
+      }
+      const actual = Array.from(value);
+      if (JSON.stringify(actual) !== JSON.stringify(data)) {
+        throw new Error('arrays do not match');
+      }
+
+      await writer.close();
+
+      const {done: done2} = await reader.read();
+      if (!done2) {
+        throw new Error('receiveStream should be done');
+      }
+    }
+
+    run().then(() => { document.title = 'PASS'; },
+               (e) => { console.log(e); document.title = 'FAIL'; });
+)JS",
+                                  server_.server_address().port())));
+
+  ASSERT_TRUE(WaitForTitle(ASCIIToUTF16("PASS"), {ASCIIToUTF16("FAIL")}));
+}
+
 }  // namespace
 }  // namespace content

diff --git a/content/browser/manifest/manifest_manager_host.cc b/content/browser/manifest/manifest_manager_host.cc
index b063e0d..68ea016 100644
--- a/content/browser/manifest/manifest_manager_host.cc
+++ b/content/browser/manifest/manifest_manager_host.cc

@@ -9,25 +9,34 @@
 #include "base/bind.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/render_frame_host.h"
-#include "content/public/browser/web_contents.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/blink/public/common/manifest/manifest.h"
 
 namespace content {
 
-ManifestManagerHost::ManifestManagerHost(WebContents* web_contents)
-    : WebContentsObserver(web_contents),
-      manifest_url_change_observer_receivers_(web_contents, this) {}
+ManifestManagerHost::ManifestManagerHost(RenderFrameHost* render_frame_host)
+    : manifest_manager_frame_(render_frame_host) {
+  // Check that |manifest_manager_frame_| is a main frame.
+  DCHECK(!manifest_manager_frame_->GetParent());
+}
 
 ManifestManagerHost::~ManifestManagerHost() {
   OnConnectionError();
 }
 
-void ManifestManagerHost::RenderFrameDeleted(
-    RenderFrameHost* render_frame_host) {
-  if (render_frame_host == manifest_manager_frame_)
-    OnConnectionError();
+void ManifestManagerHost::BindObserver(
+    mojo::PendingAssociatedReceiver<blink::mojom::ManifestUrlChangeObserver>
+        receiver) {
+  manifest_url_change_observer_receiver_.Bind(std::move(receiver));
+}
+
+ManifestManagerHost* ManifestManagerHost::GetOrCreateForCurrentDocument(
+    RenderFrameHostImpl* rfh) {
+  DCHECK(rfh->is_main_frame());
+  if (!GetForCurrentDocument(rfh))
+    CreateForCurrentDocument(rfh);
+  return GetForCurrentDocument(rfh);
 }
 
 void ManifestManagerHost::GetManifest(GetManifestCallback callback) {
@@ -45,11 +54,7 @@
 }
 
 blink::mojom::ManifestManager& ManifestManagerHost::GetManifestManager() {
-  if (manifest_manager_frame_ != web_contents()->GetMainFrame())
-    OnConnectionError();
-
   if (!manifest_manager_) {
-    manifest_manager_frame_ = web_contents()->GetMainFrame();
     manifest_manager_frame_->GetRemoteInterfaces()->GetInterface(
         manifest_manager_.BindNewPipeAndPassReceiver());
     manifest_manager_.set_disconnect_handler(base::BindOnce(
@@ -59,8 +64,6 @@
 }
 
 void ManifestManagerHost::OnConnectionError() {
-  manifest_manager_frame_ = nullptr;
-  manifest_manager_.reset();
   std::vector<GetManifestCallback> callbacks;
   for (CallbackMap::iterator it(&callbacks_); !it.IsAtEnd(); it.Advance()) {
     callbacks.push_back(std::move(*it.GetCurrentValue()));
@@ -68,6 +71,10 @@
   callbacks_.Clear();
   for (auto& callback : callbacks)
     std::move(callback).Run(GURL(), blink::Manifest());
+
+  if (GetForCurrentDocument(manifest_manager_frame_)) {
+    DeleteForCurrentDocument(manifest_manager_frame_);
+  }
 }
 
 void ManifestManagerHost::OnRequestManifestResponse(
@@ -81,12 +88,16 @@
 
 void ManifestManagerHost::ManifestUrlChanged(
     const base::Optional<GURL>& manifest_url) {
-  if (manifest_url_change_observer_receivers_.GetCurrentTargetFrame() !=
-      web_contents()->GetMainFrame()) {
+  if (!manifest_manager_frame_->IsCurrent())
     return;
-  }
-  static_cast<WebContentsImpl*>(web_contents())
+
+  // TODO(yuzus): |NotifyManifestUrlChanged| should start taking a
+  // |RenderFrameHost| parameter.
+  WebContents* web_contents =
+      WebContents::FromRenderFrameHost(manifest_manager_frame_);
+  static_cast<WebContentsImpl*>(web_contents)
       ->NotifyManifestUrlChanged(manifest_url);
 }
 
+RENDER_DOCUMENT_HOST_USER_DATA_KEY_IMPL(ManifestManagerHost)
 }  // namespace content

diff --git a/content/browser/manifest/manifest_manager_host.h b/content/browser/manifest/manifest_manager_host.h
index 3dc0bbf6..57f51dc 100644
--- a/content/browser/manifest/manifest_manager_host.h
+++ b/content/browser/manifest/manifest_manager_host.h

@@ -8,8 +8,8 @@
 #include "base/callback_forward.h"
 #include "base/containers/id_map.h"
 #include "base/macros.h"
-#include "content/public/browser/web_contents_observer.h"
-#include "content/public/browser/web_contents_receiver_set.h"
+#include "content/public/browser/render_document_host_user_data.h"
+#include "mojo/public/cpp/bindings/associated_receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/mojom/manifest/manifest_manager.mojom.h"
 #include "third_party/blink/public/mojom/manifest/manifest_observer.mojom.h"
@@ -21,16 +21,16 @@
 namespace content {
 
 class RenderFrameHost;
-class WebContents;
+class RenderFrameHostImpl;
 
 // ManifestManagerHost is a helper class that allows callers to get the Manifest
 // associated with the main frame of the observed WebContents. It handles the
 // IPC messaging with the child process.
 // TODO(mlamouri): keep a cached version and a dirty bit here.
-class ManifestManagerHost : public WebContentsObserver,
-                            public blink::mojom::ManifestUrlChangeObserver {
+class ManifestManagerHost
+    : public RenderDocumentHostUserData<ManifestManagerHost>,
+      public blink::mojom::ManifestUrlChangeObserver {
  public:
-  explicit ManifestManagerHost(WebContents* web_contents);
   ~ManifestManagerHost() override;
 
   using GetManifestCallback =
@@ -44,10 +44,18 @@
   void RequestManifestDebugInfo(
       blink::mojom::ManifestManager::RequestManifestDebugInfoCallback callback);
 
-  // WebContentsObserver
-  void RenderFrameDeleted(RenderFrameHost* render_frame_host) override;
+  void BindObserver(
+      mojo::PendingAssociatedReceiver<blink::mojom::ManifestUrlChangeObserver>
+          receiver);
+
+  static ManifestManagerHost* GetOrCreateForCurrentDocument(
+      RenderFrameHostImpl* rfh);
 
  private:
+  explicit ManifestManagerHost(RenderFrameHost* render_frame_host);
+
+  friend class RenderDocumentHostUserData<ManifestManagerHost>;
+
   using CallbackMap = base::IDMap<std::unique_ptr<GetManifestCallback>>;
 
   blink::mojom::ManifestManager& GetManifestManager();
@@ -60,13 +68,14 @@
   // blink::mojom::ManifestUrlChangeObserver:
   void ManifestUrlChanged(const base::Optional<GURL>& manifest_url) override;
 
-  RenderFrameHost* manifest_manager_frame_ = nullptr;
+  RenderFrameHost* manifest_manager_frame_;
   mojo::Remote<blink::mojom::ManifestManager> manifest_manager_;
   CallbackMap callbacks_;
 
-  WebContentsFrameReceiverSet<blink::mojom::ManifestUrlChangeObserver>
-      manifest_url_change_observer_receivers_;
+  mojo::AssociatedReceiver<blink::mojom::ManifestUrlChangeObserver>
+      manifest_url_change_observer_receiver_{this};
 
+  RENDER_DOCUMENT_HOST_USER_DATA_KEY_DECL();
   DISALLOW_COPY_AND_ASSIGN(ManifestManagerHost);
 };
 

diff --git a/content/browser/media/media_interface_proxy.cc b/content/browser/media/media_interface_proxy.cc
index 5f03d8c..b9328271 100644
--- a/content/browser/media/media_interface_proxy.cc
+++ b/content/browser/media/media_interface_proxy.cc

@@ -16,6 +16,7 @@
 #include "base/time/time.h"
 #include "content/browser/frame_host/render_frame_host_delegate.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
+#include "content/browser/service_sandbox_type.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/media_service.h"
 #include "content/public/browser/render_frame_host.h"
@@ -125,7 +126,6 @@
         remote.BindNewPipeAndPassReceiver(),
         ServiceProcessHost::Options()
             .WithDisplayName(cdm_name)
-            .WithSandboxType(service_manager::SandboxType::kCdm)
             .Pass());
     remote.set_disconnect_handler(
         base::BindOnce(&EraseCdmServiceForGuid, guid));
@@ -135,7 +135,7 @@
 
   return *remote.get();
 }
-#endif
+#endif  // ENABLE_LIBRARY_CDMS
 
 #if BUILDFLAG(ENABLE_LIBRARY_CDMS) && defined(OS_MACOSX)
 

diff --git a/content/browser/network_service_instance_impl.cc b/content/browser/network_service_instance_impl.cc
index 30220533..04da0a1 100644
--- a/content/browser/network_service_instance_impl.cc
+++ b/content/browser/network_service_instance_impl.cc

@@ -25,6 +25,7 @@
 #include "build/build_config.h"
 #include "content/browser/browser_main_loop.h"
 #include "content/browser/network_service_client.h"
+#include "content/browser/service_sandbox_type.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
@@ -263,7 +264,6 @@
           ServiceProcessHost::Launch(
               std::move(receiver),
               ServiceProcessHost::Options()
-                  .WithSandboxType(service_manager::SandboxType::kNetwork)
                   .WithDisplayName(base::UTF8ToUTF16("Network Service"))
                   .Pass());
         }

diff --git a/content/browser/service_sandbox_type.h b/content/browser/service_sandbox_type.h
index 218e04e..c238fb1 100644
--- a/content/browser/service_sandbox_type.h
+++ b/content/browser/service_sandbox_type.h

@@ -25,6 +25,30 @@
   return content::SandboxType::kAudio;
 }
 
+// media::mojom::CdmService
+namespace media {
+namespace mojom {
+class CdmService;
+}
+}  // namespace media
+template <>
+inline content::SandboxType
+content::GetServiceSandboxType<media::mojom::CdmService>() {
+  return content::SandboxType::kCdm;
+}
+
+// network::mojom::NetworkService
+namespace network {
+namespace mojom {
+class NetworkService;
+}
+}  // namespace network
+template <>
+inline content::SandboxType
+content::GetServiceSandboxType<network::mojom::NetworkService>() {
+  return content::SandboxType::kNetwork;
+}
+
 // device::mojom::XRDeviceService
 #if defined(OS_WIN)
 namespace device {

diff --git a/content/browser/service_worker/service_worker_container_host.h b/content/browser/service_worker/service_worker_container_host.h
index ccb0c39..5aeff58 100644
--- a/content/browser/service_worker/service_worker_container_host.h
+++ b/content/browser/service_worker/service_worker_container_host.h

@@ -451,7 +451,7 @@
   base::WeakPtr<ServiceWorkerContainerHost> GetWeakPtr();
 
  private:
-  friend class ServiceWorkerProviderHostTest;
+  friend class ServiceWorkerContainerHostTest;
   friend class service_worker_object_host_unittest::ServiceWorkerObjectHostTest;
   FRIEND_TEST_ALL_PREFIXES(ServiceWorkerJobTest, Unregister);
   FRIEND_TEST_ALL_PREFIXES(ServiceWorkerJobTest, RegisterDuplicateScript);

diff --git a/content/browser/service_worker/service_worker_provider_host_unittest.cc b/content/browser/service_worker/service_worker_container_host_unittest.cc
similarity index 93%
rename from content/browser/service_worker/service_worker_provider_host_unittest.cc
rename to content/browser/service_worker/service_worker_container_host_unittest.cc
index 67e2df35..7142ed53f 100644
--- a/content/browser/service_worker/service_worker_provider_host_unittest.cc
+++ b/content/browser/service_worker/service_worker_container_host_unittest.cc

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/browser/service_worker/service_worker_provider_host.h"
+#include "content/browser/service_worker/service_worker_container_host.h"
 
 #include <memory>
 #include <set>
@@ -18,8 +18,8 @@
 #include "base/threading/thread_task_runner_handle.h"
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/service_worker/embedded_worker_test_helper.h"
-#include "content/browser/service_worker/service_worker_container_host.h"
 #include "content/browser/service_worker/service_worker_context_core.h"
+#include "content/browser/service_worker/service_worker_provider_host.h"
 #include "content/browser/service_worker/service_worker_register_job.h"
 #include "content/browser/service_worker/service_worker_registration.h"
 #include "content/browser/service_worker/service_worker_test_utils.h"
@@ -101,22 +101,20 @@
 
 }  // namespace
 
-// TODO(https://crbug.com/931087): Rename ServiceWorkerProviderHostTest to
-// ServiceWorkerContainerHostTest.
-class ServiceWorkerProviderHostTest : public testing::Test {
+class ServiceWorkerContainerHostTest : public testing::Test {
  protected:
-  ServiceWorkerProviderHostTest()
+  ServiceWorkerContainerHostTest()
       : task_environment_(BrowserTaskEnvironment::IO_MAINLOOP) {
     SetContentClient(&test_content_client_);
     ReRegisterContentSchemesForTests();
   }
-  ~ServiceWorkerProviderHostTest() override {}
+  ~ServiceWorkerContainerHostTest() override {}
 
   void SetUp() override {
     old_content_browser_client_ =
         SetBrowserClientForTesting(&test_content_browser_client_);
     mojo::core::SetDefaultProcessErrorCallback(base::BindRepeating(
-        &ServiceWorkerProviderHostTest::OnMojoError, base::Unretained(this)));
+        &ServiceWorkerContainerHostTest::OnMojoError, base::Unretained(this)));
 
     helper_.reset(new EmbeddedWorkerTestHelper(base::FilePath()));
     context_ = helper_->context();
@@ -312,8 +310,7 @@
       blink::mojom::ServiceWorkerClientType client_type,
       const GURL& url);
 
-  void TestBackForwardCachedClientsAreNotExposed(
-      const GURL& url);
+  void TestBackForwardCachedClientsAreNotExposed(const GURL& url);
 
   BrowserTaskEnvironment task_environment_;
 
@@ -347,17 +344,17 @@
 
   url::ScopedSchemeRegistryForTests scoped_registry_;
 
-  DISALLOW_COPY_AND_ASSIGN(ServiceWorkerProviderHostTest);
+  DISALLOW_COPY_AND_ASSIGN(ServiceWorkerContainerHostTest);
 };
 
 // Run tests with PlzDedicatedWorker.
 // TODO(https://crbug.com/906991): Merge this test fixture into
-// ServiceWorkerProviderHostTest once PlzDedicatedWorker is enabled by default.
-class ServiceWorkerProviderHostTestWithPlzDedicatedWorker
-    : public ServiceWorkerProviderHostTest {
+// ServiceWorkerContainerHostTest once PlzDedicatedWorker is enabled by default.
+class ServiceWorkerContainerHostTestWithPlzDedicatedWorker
+    : public ServiceWorkerContainerHostTest {
  public:
-  ServiceWorkerProviderHostTestWithPlzDedicatedWorker() {
-    // ServiceWorkerProviderHost for dedicated workers is available only when
+  ServiceWorkerContainerHostTestWithPlzDedicatedWorker() {
+    // ServiceWorkerContainerHost for dedicated workers is available only when
     // PlzDedicatedWorker is enabled.
     scoped_feature_list_.InitAndEnableFeature(
         blink::features::kPlzDedicatedWorker);
@@ -367,7 +364,7 @@
   base::test::ScopedFeatureList scoped_feature_list_;
 };
 
-TEST_F(ServiceWorkerProviderHostTest, MatchRegistration) {
+TEST_F(ServiceWorkerContainerHostTest, MatchRegistration) {
   base::WeakPtr<ServiceWorkerContainerHost> container_host =
       CreateContainerHost(GURL("https://www.example.com/example1.html"));
 
@@ -399,7 +396,7 @@
   ASSERT_EQ(nullptr, container_host->MatchRegistration());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, ContextSecurity) {
+TEST_F(ServiceWorkerContainerHostTest, ContextSecurity) {
   base::WeakPtr<ServiceWorkerContainerHost> container_host_secure_parent =
       CreateContainerHost(GURL("https://www.example.com/example1.html"));
   base::WeakPtr<ServiceWorkerContainerHost> container_host_insecure_parent =
@@ -442,7 +439,7 @@
       container_host_insecure_parent->IsContextSecureForServiceWorker());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, UpdateUrls_SameOriginRedirect) {
+TEST_F(ServiceWorkerContainerHostTest, UpdateUrls_SameOriginRedirect) {
   const GURL url1("https://origin1.example.com/page1.html");
   const GURL url2("https://origin1.example.com/page2.html");
 
@@ -464,7 +461,7 @@
                                       container_host->client_uuid()));
 }
 
-TEST_F(ServiceWorkerProviderHostTest, UpdateUrls_CrossOriginRedirect) {
+TEST_F(ServiceWorkerContainerHostTest, UpdateUrls_CrossOriginRedirect) {
   const GURL url1("https://origin1.example.com/page1.html");
   const GURL url2("https://origin2.example.com/page2.html");
 
@@ -514,7 +511,7 @@
   std::set<ServiceWorkerRegistration::Listener*> listeners_;
 };
 
-TEST_F(ServiceWorkerProviderHostTest, RemoveProvider) {
+TEST_F(ServiceWorkerContainerHostTest, RemoveProvider) {
   // Create a container host connected with the renderer process.
   base::WeakPtr<ServiceWorkerContainerHost> container_host =
       CreateContainerHost(GURL("https://www.example.com/example1.html"));
@@ -552,7 +549,7 @@
   mojo::AssociatedReceiver<blink::mojom::ServiceWorkerContainer> receiver_;
 };
 
-TEST_F(ServiceWorkerProviderHostTest, Controller) {
+TEST_F(ServiceWorkerContainerHostTest, Controller) {
   // Create a host.
   std::unique_ptr<ServiceWorkerContainerHostAndInfo> host_and_info =
       CreateContainerHostAndInfoForWindow(helper_->context()->AsWeakPtr(),
@@ -588,7 +585,7 @@
   EXPECT_EQ(registration1_.get(), container_host->MatchRegistration());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, UncontrolledWithMatchingRegistration) {
+TEST_F(ServiceWorkerContainerHostTest, UncontrolledWithMatchingRegistration) {
   // Create a host.
   std::unique_ptr<ServiceWorkerContainerHostAndInfo> host_and_info =
       CreateContainerHostAndInfoForWindow(helper_->context()->AsWeakPtr(),
@@ -623,7 +620,7 @@
   EXPECT_EQ(registration1_.get(), container_host->MatchRegistration());
 }
 
-TEST_F(ServiceWorkerProviderHostTest,
+TEST_F(ServiceWorkerContainerHostTest,
        Register_ContentSettingsDisallowsServiceWorker) {
   ServiceWorkerTestContentBrowserClient test_browser_client;
   ContentBrowserClient* old_browser_client =
@@ -682,7 +679,7 @@
   SetBrowserClientForTesting(old_browser_client);
 }
 
-TEST_F(ServiceWorkerProviderHostTest, AllowsServiceWorker) {
+TEST_F(ServiceWorkerContainerHostTest, AllowsServiceWorker) {
   // Create an active version.
   scoped_refptr<ServiceWorkerVersion> version =
       base::MakeRefCounted<ServiceWorkerVersion>(
@@ -717,7 +714,7 @@
   SetBrowserClientForTesting(old_browser_client);
 }
 
-TEST_F(ServiceWorkerProviderHostTest, Register_HTTPS) {
+TEST_F(ServiceWorkerContainerHostTest, Register_HTTPS) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com/foo"));
 
@@ -727,7 +724,7 @@
                      GURL("https://www.example.com/bar")));
 }
 
-TEST_F(ServiceWorkerProviderHostTest, Register_NonSecureTransportLocalhost) {
+TEST_F(ServiceWorkerContainerHostTest, Register_NonSecureTransportLocalhost) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("http://127.0.0.3:81/foo"));
 
@@ -737,7 +734,7 @@
                      GURL("http://127.0.0.3:81/baz")));
 }
 
-TEST_F(ServiceWorkerProviderHostTest, Register_InvalidScopeShouldFail) {
+TEST_F(ServiceWorkerContainerHostTest, Register_InvalidScopeShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com/foo"));
 
@@ -747,7 +744,7 @@
   EXPECT_EQ(1u, bad_messages_.size());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, Register_InvalidScriptShouldFail) {
+TEST_F(ServiceWorkerContainerHostTest, Register_InvalidScriptShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com/foo"));
 
@@ -757,7 +754,7 @@
   EXPECT_EQ(1u, bad_messages_.size());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, Register_NonSecureOriginShouldFail) {
+TEST_F(ServiceWorkerContainerHostTest, Register_NonSecureOriginShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("http://www.example.com/foo"));
 
@@ -767,7 +764,7 @@
   EXPECT_EQ(1u, bad_messages_.size());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, Register_CrossOriginShouldFail) {
+TEST_F(ServiceWorkerContainerHostTest, Register_CrossOriginShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com/foo"));
 
@@ -806,7 +803,7 @@
   EXPECT_EQ(6u, bad_messages_.size());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, Register_BadCharactersShouldFail) {
+TEST_F(ServiceWorkerContainerHostTest, Register_BadCharactersShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com"));
 
@@ -842,7 +839,7 @@
   EXPECT_EQ(6u, bad_messages_.size());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, Register_FileSystemDocumentShouldFail) {
+TEST_F(ServiceWorkerContainerHostTest, Register_FileSystemDocumentShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(
           GURL("filesystem:https://www.example.com/temporary/a"));
@@ -864,7 +861,7 @@
   EXPECT_EQ(3u, bad_messages_.size());
 }
 
-TEST_F(ServiceWorkerProviderHostTest,
+TEST_F(ServiceWorkerContainerHostTest,
        Register_FileSystemScriptOrScopeShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(
@@ -887,7 +884,7 @@
   EXPECT_EQ(3u, bad_messages_.size());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, EarlyContextDeletion) {
+TEST_F(ServiceWorkerContainerHostTest, EarlyContextDeletion) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com/foo"));
 
@@ -896,12 +893,12 @@
   // Let the shutdown reach the simulated IO thread.
   base::RunLoop().RunUntilIdle();
 
-  // Because ServiceWorkerContextCore owns ServiceWorkerProviderHost, our
-  // ServiceWorkerProviderHost instance has destroyed.
+  // Because ServiceWorkerContextCore owns ServiceWorkerContainerHost, our
+  // ServiceWorkerContainerHost instance has destroyed.
   EXPECT_FALSE(remote_endpoint.host_remote()->is_connected());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, GetRegistration_Success) {
+TEST_F(ServiceWorkerContainerHostTest, GetRegistration_Success) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com/foo"));
 
@@ -917,7 +914,7 @@
   EXPECT_EQ(kScope, info->scope);
 }
 
-TEST_F(ServiceWorkerProviderHostTest,
+TEST_F(ServiceWorkerContainerHostTest,
        GetRegistration_NotFoundShouldReturnNull) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com/foo"));
@@ -929,7 +926,7 @@
   EXPECT_FALSE(info);
 }
 
-TEST_F(ServiceWorkerProviderHostTest, GetRegistration_CrossOriginShouldFail) {
+TEST_F(ServiceWorkerContainerHostTest, GetRegistration_CrossOriginShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com/foo"));
 
@@ -939,7 +936,7 @@
   EXPECT_EQ(1u, bad_messages_.size());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, GetRegistration_InvalidScopeShouldFail) {
+TEST_F(ServiceWorkerContainerHostTest, GetRegistration_InvalidScopeShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com/foo"));
 
@@ -948,7 +945,7 @@
   EXPECT_EQ(1u, bad_messages_.size());
 }
 
-TEST_F(ServiceWorkerProviderHostTest,
+TEST_F(ServiceWorkerContainerHostTest,
        GetRegistration_NonSecureOriginShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("http://www.example.com/foo"));
@@ -959,7 +956,7 @@
   EXPECT_EQ(1u, bad_messages_.size());
 }
 
-TEST_F(ServiceWorkerProviderHostTest, GetRegistrations_SecureOrigin) {
+TEST_F(ServiceWorkerContainerHostTest, GetRegistrations_SecureOrigin) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("https://www.example.com/foo"));
 
@@ -967,7 +964,7 @@
             GetRegistrations(remote_endpoint.host_remote()->get()));
 }
 
-TEST_F(ServiceWorkerProviderHostTest,
+TEST_F(ServiceWorkerContainerHostTest,
        GetRegistrations_NonSecureOriginShouldFail) {
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerContainerHost(GURL("http://www.example.com/foo"));
@@ -980,7 +977,7 @@
 // Test that a "reserved" (i.e., not execution ready) client is not included
 // when iterating over client container hosts. If it were, it'd be undesirably
 // exposed via the Clients API.
-void ServiceWorkerProviderHostTest::TestReservedClientsAreNotExposed(
+void ServiceWorkerContainerHostTest::TestReservedClientsAreNotExposed(
     blink::mojom::ServiceWorkerClientType client_type,
     const GURL& url) {
   {
@@ -1028,7 +1025,7 @@
   }
 }
 
-TEST_F(ServiceWorkerProviderHostTestWithPlzDedicatedWorker,
+TEST_F(ServiceWorkerContainerHostTestWithPlzDedicatedWorker,
        ReservedClientsAreNotExposedToClientsApiForDedicatedWorker) {
   ASSERT_TRUE(
       base::FeatureList::IsEnabled(blink::features::kPlzDedicatedWorker));
@@ -1037,7 +1034,7 @@
       GURL("https://www.example.com/dedicated_worker.js"));
 }
 
-TEST_F(ServiceWorkerProviderHostTest,
+TEST_F(ServiceWorkerContainerHostTest,
        ReservedClientsAreNotExposedToClientsApiForSharedWorker) {
   TestReservedClientsAreNotExposed(
       blink::mojom::ServiceWorkerClientType::kSharedWorker,
@@ -1045,7 +1042,7 @@
 }
 
 // Tests the client phase transitions for a navigation.
-TEST_F(ServiceWorkerProviderHostTest, ClientPhaseForWindow) {
+TEST_F(ServiceWorkerContainerHostTest, ClientPhaseForWindow) {
   std::unique_ptr<ServiceWorkerContainerHostAndInfo> host_and_info =
       CreateContainerHostAndInfoForWindow(helper_->context()->AsWeakPtr(),
                                           /*are_ancestors_secure=*/true);
@@ -1069,7 +1066,7 @@
 }
 
 // Tests the client phase transitions for workers.
-void ServiceWorkerProviderHostTest::TestClientPhaseTransition(
+void ServiceWorkerContainerHostTest::TestClientPhaseTransition(
     blink::mojom::ServiceWorkerClientType client_type,
     const GURL& url) {
   mojo::PendingAssociatedRemote<blink::mojom::ServiceWorkerContainer>
@@ -1099,7 +1096,7 @@
   EXPECT_TRUE(container_host->is_execution_ready());
 }
 
-TEST_F(ServiceWorkerProviderHostTestWithPlzDedicatedWorker,
+TEST_F(ServiceWorkerContainerHostTestWithPlzDedicatedWorker,
        ClientPhaseForDedicatedWorker) {
   ASSERT_TRUE(
       base::FeatureList::IsEnabled(blink::features::kPlzDedicatedWorker));
@@ -1108,17 +1105,17 @@
       GURL("https://www.example.com/dedicated_worker.js"));
 }
 
-TEST_F(ServiceWorkerProviderHostTest, ClientPhaseForSharedWorker) {
+TEST_F(ServiceWorkerContainerHostTest, ClientPhaseForSharedWorker) {
   TestClientPhaseTransition(
       blink::mojom::ServiceWorkerClientType::kSharedWorker,
       GURL("https://www.example.com/shared_worker.js"));
 }
 
 // Run tests with BackForwardCache.
-class ServiceWorkerProviderHostTestWithBackForwardCache
-    : public ServiceWorkerProviderHostTest {
+class ServiceWorkerContainerHostTestWithBackForwardCache
+    : public ServiceWorkerContainerHostTest {
  public:
-  ServiceWorkerProviderHostTestWithBackForwardCache() {
+  ServiceWorkerContainerHostTestWithBackForwardCache() {
     scoped_feature_list_.InitWithFeaturesAndParameters(
         {{features::kBackForwardCache, {GetFeatureParams()}},
          {features::kServiceWorkerOnUI, {}}},
@@ -1138,7 +1135,7 @@
 // Test that a client in BackForwardCache is not included
 // when iterating over client container hosts. If it were, it'd be undesirably
 // exposed via the Clients API.
-void ServiceWorkerProviderHostTest::TestBackForwardCachedClientsAreNotExposed(
+void ServiceWorkerContainerHostTest::TestBackForwardCachedClientsAreNotExposed(
     const GURL& url) {
   std::unique_ptr<ServiceWorkerProviderHost> provider_host;
   {
@@ -1179,7 +1176,7 @@
   }
 }
 
-TEST_F(ServiceWorkerProviderHostTestWithBackForwardCache,
+TEST_F(ServiceWorkerContainerHostTestWithBackForwardCache,
        SkipBackForwardCachedServiceWorker) {
   ASSERT_TRUE(IsBackForwardCacheEnabled());
   ASSERT_TRUE(ServiceWorkerContext::IsServiceWorkerOnUIEnabled());
@@ -1191,7 +1188,7 @@
 // Tests that the service worker involved with a navigation (via
 // AddServiceWorkerToUpdate) is updated when the host for the navigation is
 // destroyed.
-TEST_F(ServiceWorkerProviderHostTest, UpdateServiceWorkerOnDestruction) {
+TEST_F(ServiceWorkerContainerHostTest, UpdateServiceWorkerOnDestruction) {
   // Make a window.
   base::WeakPtr<ServiceWorkerContainerHost> container_host =
       CreateContainerHost(GURL("https://www.example.com/example.html"));
@@ -1232,7 +1229,7 @@
 
 // Tests that the service worker involved with a navigation is updated when the
 // host receives a HintToUpdateServiceWorker message.
-TEST_F(ServiceWorkerProviderHostTest, HintToUpdateServiceWorker) {
+TEST_F(ServiceWorkerContainerHostTest, HintToUpdateServiceWorker) {
   // Make an active version.
   auto version1 = base::MakeRefCounted<ServiceWorkerVersion>(
       registration1_.get(), GURL("https://www.example.com/sw.js"),
@@ -1265,7 +1262,7 @@
 // Tests that the host receives a HintToUpdateServiceWorker message but
 // there was no service worker at main resource request time. This
 // can happen due to claim().
-TEST_F(ServiceWorkerProviderHostTest,
+TEST_F(ServiceWorkerContainerHostTest,
        HintToUpdateServiceWorkerButNoVersionToUpdate) {
   // Make a window.
   base::WeakPtr<ServiceWorkerContainerHost> container_host =
@@ -1297,7 +1294,7 @@
   EXPECT_FALSE(HasVersionToUpdate(container_host.get()));
 }
 
-TEST_F(ServiceWorkerProviderHostTest, HintToUpdateServiceWorkerMultiple) {
+TEST_F(ServiceWorkerContainerHostTest, HintToUpdateServiceWorkerMultiple) {
   // Make active versions.
   auto version1 = base::MakeRefCounted<ServiceWorkerVersion>(
       registration1_.get(), GURL("https://www.example.com/sw.js"),

diff --git a/content/browser/service_worker/service_worker_context_unittest.cc b/content/browser/service_worker/service_worker_context_unittest.cc
index ed4cdcc..4489786 100644
--- a/content/browser/service_worker/service_worker_context_unittest.cc
+++ b/content/browser/service_worker/service_worker_context_unittest.cc

@@ -1026,8 +1026,6 @@
       CreateProviderHostForServiceWorkerContext(
           kRenderProcessId2, true /* is_parent_frame_secure */, version.get(),
           context()->AsWeakPtr(), &remote_endpoints.back());
-  EXPECT_NE(provider_host4->provider_id(),
-            blink::kInvalidServiceWorkerProviderId);
 
   ASSERT_TRUE(container_host1);
   ASSERT_TRUE(container_host2);

diff --git a/content/browser/service_worker/service_worker_provider_host.cc b/content/browser/service_worker/service_worker_provider_host.cc
index 5a18dd2..18ca2aef 100644
--- a/content/browser/service_worker/service_worker_provider_host.cc
+++ b/content/browser/service_worker/service_worker_provider_host.cc

@@ -31,12 +31,6 @@
 
 namespace {
 
-// This function provides the next ServiceWorkerProviderHost ID.
-int NextProviderId() {
-  static int g_next_provider_id = 0;
-  return g_next_provider_id++;
-}
-
 void CreateQuicTransportConnectorImpl(
     int process_id,
     const url::Origin& origin,
@@ -59,8 +53,7 @@
         host_receiver,
     ServiceWorkerVersion* running_hosted_version,
     base::WeakPtr<ServiceWorkerContextCore> context)
-    : provider_id_(NextProviderId()),
-      running_hosted_version_(running_hosted_version),
+    : running_hosted_version_(running_hosted_version),
       container_host_(std::make_unique<content::ServiceWorkerContainerHost>(
           std::move(context))),
       host_receiver_(container_host_.get(), std::move(host_receiver)) {

diff --git a/content/browser/service_worker/service_worker_provider_host.h b/content/browser/service_worker/service_worker_provider_host.h
index d6417df..d8afd01 100644
--- a/content/browser/service_worker/service_worker_provider_host.h
+++ b/content/browser/service_worker/service_worker_provider_host.h

@@ -55,7 +55,6 @@
       base::WeakPtr<ServiceWorkerContextCore> context);
   ~ServiceWorkerProviderHost();
 
-  int provider_id() const { return provider_id_; }
   int worker_process_id() const { return worker_process_id_; }
   ServiceWorkerVersion* running_hosted_version() const {
     return running_hosted_version_;
@@ -83,9 +82,6 @@
   void ReportNoBinderForInterface(const std::string& error);
 
  private:
-  // Unique among all provider hosts.
-  const int provider_id_;
-
   int worker_process_id_ = ChildProcessHost::kInvalidUniqueID;
 
   // The instance of service worker this provider hosts.

diff --git a/content/browser/service_worker/service_worker_storage_control_impl_unittest.cc b/content/browser/service_worker/service_worker_storage_control_impl_unittest.cc
index 115711c..f6b40a65 100644
--- a/content/browser/service_worker/service_worker_storage_control_impl_unittest.cc
+++ b/content/browser/service_worker/service_worker_storage_control_impl_unittest.cc

@@ -514,12 +514,13 @@
   // Create a registration with a single resource and stores the registration.
   DatabaseStatus CreateAndStoreRegistration(int64_t registration_id,
                                             int64_t version_id,
+                                            int64_t resource_id,
                                             const GURL& scope,
                                             const GURL& script_url,
                                             int64_t script_size) {
     std::vector<storage::mojom::ServiceWorkerResourceRecordPtr> resources;
     resources.push_back(storage::mojom::ServiceWorkerResourceRecord::New(
-        registration_id, script_url, script_size));
+        resource_id, script_url, script_size));
 
     auto data = storage::mojom::ServiceWorkerRegistrationData::New();
     data->registration_id = registration_id;
@@ -682,8 +683,10 @@
   // Preparation: Store a registration.
   const int64_t registration_id = GetNewRegistrationId();
   const int64_t version_id = GetNewVersionId();
-  DatabaseStatus status = CreateAndStoreRegistration(
-      registration_id, version_id, kScope, kScriptUrl, kScriptSize);
+  const int64_t resource_id = GetNewResourceId();
+  DatabaseStatus status =
+      CreateAndStoreRegistration(registration_id, version_id, resource_id,
+                                 kScope, kScriptUrl, kScriptSize);
   ASSERT_EQ(status, DatabaseStatus::kOk);
 
   // The stored registration shouldn't be activated yet.
@@ -717,8 +720,10 @@
   // Preparation: Store a registration.
   const int64_t registration_id = GetNewRegistrationId();
   const int64_t version_id = GetNewVersionId();
-  DatabaseStatus status = CreateAndStoreRegistration(
-      registration_id, version_id, kScope, kScriptUrl, kScriptSize);
+  const int64_t resource_id = GetNewResourceId();
+  DatabaseStatus status =
+      CreateAndStoreRegistration(registration_id, version_id, resource_id,
+                                 kScope, kScriptUrl, kScriptSize);
   ASSERT_EQ(status, DatabaseStatus::kOk);
 
   // The stored registration shouldn't have the last update check time yet.
@@ -753,8 +758,10 @@
   // Preparation: Store a registration.
   const int64_t registration_id = GetNewRegistrationId();
   const int64_t version_id = GetNewVersionId();
-  DatabaseStatus status = CreateAndStoreRegistration(
-      registration_id, version_id, kScope, kScriptUrl, kScriptSize);
+  const int64_t resource_id = GetNewResourceId();
+  DatabaseStatus status =
+      CreateAndStoreRegistration(registration_id, version_id, resource_id,
+                                 kScope, kScriptUrl, kScriptSize);
   ASSERT_EQ(status, DatabaseStatus::kOk);
 
   // Check the stored registration has default navigation preload fields.
@@ -800,13 +807,17 @@
   DatabaseStatus status;
   const int64_t registration_id1 = GetNewRegistrationId();
   const int64_t version_id1 = GetNewVersionId();
-  status = CreateAndStoreRegistration(registration_id1, version_id1, kScope1,
-                                      kScriptUrl1, kScriptSize);
+  const int64_t resource_id1 = GetNewResourceId();
+  status =
+      CreateAndStoreRegistration(registration_id1, version_id1, resource_id1,
+                                 kScope1, kScriptUrl1, kScriptSize);
   ASSERT_EQ(status, DatabaseStatus::kOk);
   const int64_t registration_id2 = GetNewRegistrationId();
   const int64_t version_id2 = GetNewVersionId();
-  status = CreateAndStoreRegistration(registration_id2, version_id2, kScope2,
-                                      kScriptUrl2, kScriptSize);
+  const int64_t resource_id2 = GetNewResourceId();
+  status =
+      CreateAndStoreRegistration(registration_id2, version_id2, resource_id2,
+                                 kScope2, kScriptUrl2, kScriptSize);
   ASSERT_EQ(status, DatabaseStatus::kOk);
 
   // Get registrations for the origin.
@@ -932,9 +943,10 @@
 
   const int64_t registration_id = GetNewRegistrationId();
   const int64_t version_id = GetNewVersionId();
+  const int64_t resource_id = GetNewResourceId();
   DatabaseStatus status;
-  status = CreateAndStoreRegistration(registration_id, version_id, kScope,
-                                      kScriptUrl, kScriptSize);
+  status = CreateAndStoreRegistration(registration_id, version_id, resource_id,
+                                      kScope, kScriptUrl, kScriptSize);
   ASSERT_EQ(status, DatabaseStatus::kOk);
 
   // Store user data with two entries.
@@ -991,13 +1003,15 @@
   // scope.
   const int64_t new_registration_id = GetNewRegistrationId();
   const int64_t new_version_id = GetNewVersionId();
+  const int64_t new_resource_id = GetNewResourceId();
   {
     DeleteRegistrationResult result =
         DeleteRegistration(registration_id, kScope.GetOrigin());
     ASSERT_EQ(result.status, DatabaseStatus::kOk);
 
     status = CreateAndStoreRegistration(new_registration_id, new_version_id,
-                                        kScope, kScriptUrl, kScriptSize);
+                                        new_resource_id, kScope, kScriptUrl,
+                                        kScriptSize);
     ASSERT_EQ(status, DatabaseStatus::kOk);
   }
 
@@ -1020,9 +1034,10 @@
 
   const int64_t registration_id = GetNewRegistrationId();
   const int64_t version_id = GetNewVersionId();
+  const int64_t resource_id = GetNewResourceId();
   DatabaseStatus status;
-  status = CreateAndStoreRegistration(registration_id, version_id, kScope,
-                                      kScriptUrl, kScriptSize);
+  status = CreateAndStoreRegistration(registration_id, version_id, resource_id,
+                                      kScope, kScriptUrl, kScriptSize);
   ASSERT_EQ(status, DatabaseStatus::kOk);
 
   // Store some user data with prefixes.
@@ -1097,13 +1112,17 @@
   DatabaseStatus status;
   const int64_t registration_id1 = GetNewRegistrationId();
   const int64_t version_id1 = GetNewVersionId();
-  status = CreateAndStoreRegistration(registration_id1, version_id1, kScope1,
-                                      kScriptUrl1, kScriptSize);
+  const int64_t resource_id1 = GetNewResourceId();
+  status =
+      CreateAndStoreRegistration(registration_id1, version_id1, resource_id1,
+                                 kScope1, kScriptUrl1, kScriptSize);
   ASSERT_EQ(status, DatabaseStatus::kOk);
   const int64_t registration_id2 = GetNewRegistrationId();
   const int64_t version_id2 = GetNewVersionId();
-  status = CreateAndStoreRegistration(registration_id2, version_id2, kScope2,
-                                      kScriptUrl2, kScriptSize);
+  const int64_t resource_id2 = GetNewResourceId();
+  status =
+      CreateAndStoreRegistration(registration_id2, version_id2, resource_id2,
+                                 kScope2, kScriptUrl2, kScriptSize);
   ASSERT_EQ(status, DatabaseStatus::kOk);
 
   // Preparation: Store some user data to registrations. Both registrations have
@@ -1197,13 +1216,17 @@
   DatabaseStatus status;
   const int64_t registration_id1 = GetNewRegistrationId();
   const int64_t version_id1 = GetNewVersionId();
-  status = CreateAndStoreRegistration(registration_id1, version_id1, kScope1,
-                                      kScriptUrl1, kScriptSize);
+  const int64_t resource_id1 = GetNewResourceId();
+  status =
+      CreateAndStoreRegistration(registration_id1, version_id1, resource_id1,
+                                 kScope1, kScriptUrl1, kScriptSize);
   ASSERT_EQ(status, DatabaseStatus::kOk);
   const int64_t registration_id2 = GetNewRegistrationId();
   const int64_t version_id2 = GetNewVersionId();
-  status = CreateAndStoreRegistration(registration_id2, version_id2, kScope2,
-                                      kScriptUrl2, kScriptSize);
+  const int64_t resource_id2 = GetNewResourceId();
+  status =
+      CreateAndStoreRegistration(registration_id2, version_id2, resource_id2,
+                                 kScope2, kScriptUrl2, kScriptSize);
   ASSERT_EQ(status, DatabaseStatus::kOk);
 
   // Update policies to purge the registration for |kScope2| on shutdown.

diff --git a/content/browser/service_worker/service_worker_version.h b/content/browser/service_worker/service_worker_version.h
index 65a35e01a..3de68c59 100644
--- a/content/browser/service_worker/service_worker_version.h
+++ b/content/browser/service_worker/service_worker_version.h

@@ -590,7 +590,7 @@
   friend class base::RefCounted<ServiceWorkerVersion>;
   friend class EmbeddedWorkerInstanceTest;
   friend class ServiceWorkerPingController;
-  friend class ServiceWorkerProviderHostTest;
+  friend class ServiceWorkerContainerHostTest;
   friend class ServiceWorkerReadFromCacheJobTest;
   friend class ServiceWorkerVersionBrowserTest;
   friend class ServiceWorkerActivationTest;
@@ -604,8 +604,6 @@
   FRIEND_TEST_ALL_PREFIXES(service_worker_controllee_request_handler_unittest::
                                ServiceWorkerControlleeRequestHandlerTest,
                            FallbackWithNoFetchHandler);
-  FRIEND_TEST_ALL_PREFIXES(ServiceWorkerProviderHostTest,
-                           DontSetControllerInDestructor);
   FRIEND_TEST_ALL_PREFIXES(ServiceWorkerJobTest, Register);
   FRIEND_TEST_ALL_PREFIXES(
       service_worker_version_unittest::ServiceWorkerVersionTest,

diff --git a/content/browser/storage_partition_impl.cc b/content/browser/storage_partition_impl.cc
index 875d8a13..abf47290 100644
--- a/content/browser/storage_partition_impl.cc
+++ b/content/browser/storage_partition_impl.cc

@@ -2282,6 +2282,13 @@
   }
 }
 
+void StoragePartitionImpl::SetNetworkContextForTesting(
+    mojo::PendingRemote<network::mojom::NetworkContext>
+        network_context_remote) {
+  network_context_.reset();
+  network_context_.Bind(std::move(network_context_remote));
+}
+
 BrowserContext* StoragePartitionImpl::browser_context() const {
   return browser_context_;
 }
@@ -2374,8 +2381,24 @@
 }
 
 void StoragePartitionImpl::InitNetworkContext() {
-  network_context_ = GetContentClient()->browser()->CreateNetworkContext(
-      browser_context_, is_in_memory_, relative_partition_path_);
+  network::mojom::NetworkContextParamsPtr context_params =
+      network::mojom::NetworkContextParams::New();
+  network::mojom::CertVerifierCreationParamsPtr cert_verifier_creation_params =
+      network::mojom::CertVerifierCreationParams::New();
+  GetContentClient()->browser()->ConfigureNetworkContextParams(
+      browser_context_, is_in_memory_, relative_partition_path_,
+      context_params.get(), cert_verifier_creation_params.get());
+  DCHECK(!context_params->cert_verifier_creation_params)
+      << "|cert_verifier_creation_params| should not be set in the "
+         "NetworkContextParams, as they will eventually be removed when the "
+         "CertVerifierService ships.";
+
+  context_params->cert_verifier_creation_params =
+      std::move(cert_verifier_creation_params);
+
+  network_context_.reset();
+  GetNetworkService()->CreateNetworkContext(
+      network_context_.BindNewPipeAndPassReceiver(), std::move(context_params));
   DCHECK(network_context_);
 
   network_context_client_receiver_.reset();

diff --git a/content/browser/storage_partition_impl.h b/content/browser/storage_partition_impl.h
index 5a34344..75ec35f8 100644
--- a/content/browser/storage_partition_impl.h
+++ b/content/browser/storage_partition_impl.h

@@ -183,6 +183,9 @@
   void FlushNetworkInterfaceForTesting() override;
   void WaitForDeletionTasksForTesting() override;
   void WaitForCodeCacheShutdownForTesting() override;
+  void SetNetworkContextForTesting(
+      mojo::PendingRemote<network::mojom::NetworkContext>
+          network_context_remote) override;
   BackgroundFetchContext* GetBackgroundFetchContext();
   PaymentAppContextImpl* GetPaymentAppContext();
   BroadcastChannelProvider* GetBroadcastChannelProvider();

diff --git a/content/browser/web_contents/web_contents_impl.cc b/content/browser/web_contents/web_contents_impl.cc
index 708362b..024415b 100644
--- a/content/browser/web_contents/web_contents_impl.cc
+++ b/content/browser/web_contents/web_contents_impl.cc

@@ -2122,8 +2122,6 @@
 
   screen_orientation_provider_.reset(new ScreenOrientationProvider(this));
 
-  manifest_manager_host_.reset(new ManifestManagerHost(this));
-
 #if defined(OS_ANDROID)
   DateTimeChooserAndroid::CreateForWebContents(this);
 #endif
@@ -4204,7 +4202,10 @@
 }
 
 void WebContentsImpl::GetManifest(GetManifestCallback callback) {
-  manifest_manager_host_->GetManifest(std::move(callback));
+  // TODO(yuzus, 1061899): Move this function to RenderFrameHostImpl.
+  ManifestManagerHost* manifest_manager_host =
+      ManifestManagerHost::GetOrCreateForCurrentDocument(GetMainFrame());
+  manifest_manager_host->GetManifest(std::move(callback));
 }
 
 void WebContentsImpl::ExitFullscreen(bool will_cause_resize) {
@@ -5939,17 +5940,12 @@
   // Use the last committed entry rather than the active one, in case a
   // pending entry has been created.
   NavigationEntry* entry = controller_.GetLastCommittedEntry();
-  Navigator* navigator = frame_tree_.root()->navigator();
 
   // An entry may not exist for a stop when loading an initial blank page or
   // if an iframe injected by script into a blank page finishes loading.
   if (entry) {
-    base::TimeDelta elapsed =
-        base::TimeTicks::Now() - navigator->GetCurrentLoadStart();
-
     details.reset(new LoadNotificationDetails(
         entry->GetVirtualURL(),
-        elapsed,
         &controller_,
         controller_.GetCurrentEntryIndex()));
   }

diff --git a/content/browser/web_contents/web_contents_impl.h b/content/browser/web_contents/web_contents_impl.h
index e86be96..59510b1 100644
--- a/content/browser/web_contents/web_contents_impl.h
+++ b/content/browser/web_contents/web_contents_impl.h

@@ -102,7 +102,6 @@
 class FindRequestManager;
 class JavaScriptDialogManager;
 class JavaScriptDialogNavigationDeferrer;
-class ManifestManagerHost;
 class MediaWebContentsObserver;
 class NFCHost;
 class PluginContentOriginAllowlist;
@@ -312,10 +311,6 @@
 
   void NotifyManifestUrlChanged(const base::Optional<GURL>& manifest_url);
 
-  ManifestManagerHost* GetManifestManagerHost() const {
-    return manifest_manager_host_.get();
-  }
-
 #if defined(OS_ANDROID)
   void SetMainFrameImportance(ChildProcessImportance importance);
 #endif
@@ -1902,8 +1897,6 @@
 
   std::unique_ptr<ScreenOrientationProvider> screen_orientation_provider_;
 
-  std::unique_ptr<ManifestManagerHost> manifest_manager_host_;
-
   // The accessibility mode for all frames. This is queried when each frame
   // is created, and broadcast to all frames when it changes.
   ui::AXMode accessibility_mode_;

diff --git a/content/public/browser/browser_context.h b/content/public/browser/browser_context.h
index e7f322e..8140c9b 100644
--- a/content/public/browser/browser_context.h
+++ b/content/public/browser/browser_context.h

@@ -25,6 +25,7 @@
 #include "net/url_request/url_request_job_factory.h"
 #include "services/content/public/mojom/navigable_contents_factory.mojom-forward.h"
 #include "services/network/public/mojom/cors_origin_pattern.mojom-forward.h"
+#include "services/network/public/mojom/network_context.mojom-forward.h"
 #include "third_party/blink/public/mojom/blob/blob.mojom-forward.h"
 #include "third_party/blink/public/mojom/push_messaging/push_messaging_status.mojom-forward.h"
 

diff --git a/content/public/browser/content_browser_client.cc b/content/public/browser/content_browser_client.cc
index 37ada4e8..5c344d9 100644
--- a/content/public/browser/content_browser_client.cc
+++ b/content/public/browser/content_browser_client.cc

@@ -818,20 +818,14 @@
 void ContentBrowserClient::OnNetworkServiceCreated(
     network::mojom::NetworkService* network_service) {}
 
-mojo::Remote<network::mojom::NetworkContext>
-ContentBrowserClient::CreateNetworkContext(
+void ContentBrowserClient::ConfigureNetworkContextParams(
     BrowserContext* context,
     bool in_memory,
-    const base::FilePath& relative_partition_path) {
-  DCHECK(context);
-  mojo::Remote<network::mojom::NetworkContext> network_context;
-  network::mojom::NetworkContextParamsPtr context_params =
-      network::mojom::NetworkContextParams::New();
-  context_params->user_agent = GetUserAgent();
-  context_params->accept_language = "en-us,en";
-  GetNetworkService()->CreateNetworkContext(
-      network_context.BindNewPipeAndPassReceiver(), std::move(context_params));
-  return network_context;
+    const base::FilePath& relative_partition_path,
+    network::mojom::NetworkContextParams* network_context_params,
+    network::mojom::CertVerifierCreationParams* cert_verifier_creation_params) {
+  network_context_params->user_agent = GetUserAgent();
+  network_context_params->accept_language = "en-us,en";
 }
 
 std::vector<base::FilePath>

diff --git a/content/public/browser/content_browser_client.h b/content/public/browser/content_browser_client.h
index ec1ad090..d6c203a 100644
--- a/content/public/browser/content_browser_client.h
+++ b/content/public/browser/content_browser_client.h

@@ -14,6 +14,7 @@
 #include <vector>
 
 #include "base/callback.h"
+#include "base/callback_forward.h"
 #include "base/containers/flat_map.h"
 #include "base/containers/flat_set.h"
 #include "base/files/file_path.h"
@@ -1460,15 +1461,10 @@
   virtual void OnNetworkServiceCreated(
       network::mojom::NetworkService* network_service);
 
-  // Creates a NetworkContext for a BrowserContext's StoragePartition. If the
-  // network service is enabled, it must return a NetworkContext using the
-  // network service. If the network service is disabled, the embedder may
-  // return a NetworkContext, or it may return nullptr, in which case the
-  // StoragePartition will create one wrapping the URLRequestContext obtained
-  // from the BrowserContext.
-  //
-  // Called before the corresonding BrowserContext::CreateRequestContext method
-  // is called.
+  // Configures the NetworkContextParams (|network_context_params|) and
+  // CertVerifierCreationParams (|cert_verifier_creation_params|) for a
+  // BrowserContext's StoragePartition. StoragePartition will use the
+  // NetworkService to create a new NetworkContext using these params.
   //
   // If |in_memory| is true, |relative_partition_path| is still a path that
   // uniquely identifies the storage partition, though nothing should be written
@@ -1476,14 +1472,13 @@
   //
   // If |relative_partition_path| is the empty string, it means this needs to
   // create the default NetworkContext for the BrowserContext.
-  //
-  // For NetworkContexts returned from the Network Service, some requirements:
-  //   -enable data URL support (or else data URLs will fail)
-  //   -disable file URL support (for security)
-  virtual mojo::Remote<network::mojom::NetworkContext> CreateNetworkContext(
+  virtual void ConfigureNetworkContextParams(
       BrowserContext* context,
       bool in_memory,
-      const base::FilePath& relative_partition_path);
+      const base::FilePath& relative_partition_path,
+      network::mojom::NetworkContextParams* network_context_params,
+      network::mojom::CertVerifierCreationParams*
+          cert_verifier_creation_params);
 
   // Returns the parent paths that contain all the network service's
   // BrowserContexts' storage. Multiple paths can be returned, e.g. in case the

diff --git a/content/public/browser/load_notification_details.h b/content/public/browser/load_notification_details.h
index b02e0f0..3a6fd76 100644
--- a/content/public/browser/load_notification_details.h
+++ b/content/public/browser/load_notification_details.h

@@ -5,7 +5,6 @@
 #ifndef CONTENT_PUBLIC_BROWSER_LOAD_NOTIFICATION_DETAILS_H_
 #define CONTENT_PUBLIC_BROWSER_LOAD_NOTIFICATION_DETAILS_H_
 
-#include "base/time/time.h"
 #include "content/public/browser/navigation_controller.h"
 #include "ui/base/page_transition_types.h"
 #include "url/gurl.h"
@@ -17,20 +16,15 @@
 // log page load metrics.
 struct LoadNotificationDetails {
   LoadNotificationDetails(const GURL& url,
-                          base::TimeDelta load_time,
                           NavigationController* controller,
                           int session_index)
       : url(url),
-        load_time(load_time),
         session_index(session_index),
         controller(controller) {}
 
   // The URL loaded.
   GURL url;
 
-  // The length of time the page load took.
-  base::TimeDelta load_time;
-
   // The index of the load within the tab session.
   int session_index;
 

diff --git a/content/public/browser/render_document_host_user_data.cc b/content/public/browser/render_document_host_user_data.cc
index b1b3854..3b58bf8 100644
--- a/content/public/browser/render_document_host_user_data.cc
+++ b/content/public/browser/render_document_host_user_data.cc

@@ -23,4 +23,8 @@
       key, std::move(data));
 }
 
+void RemoveRenderDocumentHostUserData(RenderFrameHost* rfh, const void* key) {
+  static_cast<RenderFrameHostImpl*>(rfh)->RemoveRenderDocumentHostUserData(key);
+}
+
 }  // namespace content

diff --git a/content/public/browser/render_document_host_user_data.h b/content/public/browser/render_document_host_user_data.h
index f55f24f6..a138fd6 100644
--- a/content/public/browser/render_document_host_user_data.h
+++ b/content/public/browser/render_document_host_user_data.h

@@ -22,6 +22,9 @@
     const void* key,
     std::unique_ptr<base::SupportsUserData::Data> data);
 
+CONTENT_EXPORT void RemoveRenderDocumentHostUserData(RenderFrameHost* rfh,
+                                                     const void* key);
+
 // This class approximates the lifetime of a single blink::Document in the
 // browser process. At the moment RenderFrameHost can correspond to multiple
 // blink::Documents (when RenderFrameHost is reused for same-process
@@ -82,6 +85,12 @@
     return static_cast<T*>(GetRenderDocumentHostUserData(rfh, UserDataKey()));
   }
 
+  static void DeleteForCurrentDocument(RenderFrameHost* rfh) {
+    DCHECK(rfh);
+    DCHECK(GetForCurrentDocument(rfh));
+    RemoveRenderDocumentHostUserData(rfh, UserDataKey());
+  }
+
   static const void* UserDataKey() { return &T::kUserDataKey; }
 };
 

diff --git a/content/public/browser/storage_partition.h b/content/public/browser/storage_partition.h
index c47368e8..01ab7ba 100644
--- a/content/public/browser/storage_partition.h
+++ b/content/public/browser/storage_partition.h

@@ -260,6 +260,10 @@
   // Wait until code cache's shutdown is complete. For test use only.
   virtual void WaitForCodeCacheShutdownForTesting() = 0;
 
+  virtual void SetNetworkContextForTesting(
+      mojo::PendingRemote<network::mojom::NetworkContext>
+          network_context_remote) = 0;
+
   // The value pointed to by |settings| should remain valid until the
   // the function is called again with a new value or a nullptr.
   static void SetDefaultQuotaSettingsForTesting(

diff --git a/content/public/common/common_param_traits_macros.h b/content/public/common/common_param_traits_macros.h
index 2a10ee2..c7a8716 100644
--- a/content/public/common/common_param_traits_macros.h
+++ b/content/public/common/common_param_traits_macros.h

@@ -249,6 +249,7 @@
   IPC_STRUCT_TRAITS_MEMBER(lazy_image_loading_distance_thresholds_px)
   IPC_STRUCT_TRAITS_MEMBER(lazy_image_first_k_fully_load)
   IPC_STRUCT_TRAITS_MEMBER(allow_mixed_content_upgrades)
+  IPC_STRUCT_TRAITS_MEMBER(always_show_focus)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(blink::mojom::WindowFeatures)

diff --git a/content/public/common/web_preferences.cc b/content/public/common/web_preferences.cc
index 13999e8..eac2562 100644
--- a/content/public/common/web_preferences.cc
+++ b/content/public/common/web_preferences.cc

@@ -230,7 +230,8 @@
       translate_service_available(false),
       network_quality_estimator_web_holdback(
           net::EFFECTIVE_CONNECTION_TYPE_UNKNOWN),
-      allow_mixed_content_upgrades(true) {
+      allow_mixed_content_upgrades(true),
+      always_show_focus(false) {
   standard_font_family_map[kCommonScript] =
       base::ASCIIToUTF16("Times New Roman");
   fixed_font_family_map[kCommonScript] = base::ASCIIToUTF16("Courier New");

diff --git a/content/public/common/web_preferences.h b/content/public/common/web_preferences.h
index dab86fb..4ba03d3 100644
--- a/content/public/common/web_preferences.h
+++ b/content/public/common/web_preferences.h

@@ -358,6 +358,10 @@
   // sites.
   bool allow_mixed_content_upgrades;
 
+  // Whether the focused element should always be indicated (for example, by
+  // forcing :focus-visible to match regardless of focus method).
+  bool always_show_focus;
+
   // We try to keep the default values the same as the default values in
   // chrome, except for the cases where it would require lots of extra work for
   // the embedder to use the same default value.

diff --git a/content/public/test/test_storage_partition.cc b/content/public/test/test_storage_partition.cc
index c94e579..0ce139c1 100644
--- a/content/public/test/test_storage_partition.cc
+++ b/content/public/test/test_storage_partition.cc

@@ -186,4 +186,8 @@
 
 void TestStoragePartition::WaitForCodeCacheShutdownForTesting() {}
 
+void TestStoragePartition::SetNetworkContextForTesting(
+    mojo::PendingRemote<network::mojom::NetworkContext>
+        network_context_remote) {}
+
 }  // namespace content

diff --git a/content/public/test/test_storage_partition.h b/content/public/test/test_storage_partition.h
index 37aca9b..7dd1ab4 100644
--- a/content/public/test/test_storage_partition.h
+++ b/content/public/test/test_storage_partition.h

@@ -11,6 +11,7 @@
 #include "components/services/storage/public/mojom/indexed_db_control.mojom.h"
 #include "content/public/browser/storage_partition.h"
 #include "mojo/public/cpp/bindings/remote.h"
+#include "services/network/public/mojom/network_context.mojom.h"
 
 namespace leveldb_proto {
 class ProtoDatabaseProvider;
@@ -199,9 +200,13 @@
   void FlushNetworkInterfaceForTesting() override;
   void WaitForDeletionTasksForTesting() override;
   void WaitForCodeCacheShutdownForTesting() override;
+  void SetNetworkContextForTesting(
+      mojo::PendingRemote<network::mojom::NetworkContext>
+          network_context_remote) override;
 
  private:
   base::FilePath file_path_;
+  mojo::Remote<network::mojom::NetworkContext> network_context_remote_;
   network::mojom::NetworkContext* network_context_ = nullptr;
   network::mojom::CookieManager* cookie_manager_for_browser_process_ = nullptr;
   storage::QuotaManager* quota_manager_ = nullptr;

diff --git a/content/renderer/render_view_impl.cc b/content/renderer/render_view_impl.cc
index 4091674..6fc04eb1 100644
--- a/content/renderer/render_view_impl.cc
+++ b/content/renderer/render_view_impl.cc

@@ -820,6 +820,8 @@
 #endif  // defined(OS_ANDROID)
   settings->SetForceDarkModeEnabled(prefs.force_dark_mode_enabled);
 
+  settings->SetAccessibilityAlwaysShowFocus(prefs.always_show_focus);
+
   switch (prefs.autoplay_policy) {
     case AutoplayPolicy::kNoUserGestureRequired:
       settings->SetAutoplayPolicy(

diff --git a/content/shell/browser/shell_content_browser_client.cc b/content/shell/browser/shell_content_browser_client.cc
index 53def82d..99d36d3 100644
--- a/content/shell/browser/shell_content_browser_client.cc
+++ b/content/shell/browser/shell_content_browser_client.cc

@@ -381,17 +381,14 @@
 }
 #endif  // defined(OS_LINUX) || defined(OS_ANDROID)
 
-mojo::Remote<network::mojom::NetworkContext>
-ShellContentBrowserClient::CreateNetworkContext(
+void ShellContentBrowserClient::ConfigureNetworkContextParams(
     BrowserContext* context,
     bool in_memory,
-    const base::FilePath& relative_partition_path) {
-  network::mojom::NetworkContextParamsPtr context_params =
-      CreateNetworkContextParams(context);
-  mojo::Remote<network::mojom::NetworkContext> network_context;
-  GetNetworkService()->CreateNetworkContext(
-      network_context.BindNewPipeAndPassReceiver(), std::move(context_params));
-  return network_context;
+    const base::FilePath& relative_partition_path,
+    network::mojom::NetworkContextParams* network_context_params,
+    network::mojom::CertVerifierCreationParams* cert_verifier_creation_params) {
+  ConfigureNetworkContextParamsForShell(context, network_context_params,
+                                        cert_verifier_creation_params);
 }
 
 std::vector<base::FilePath>
@@ -408,11 +405,11 @@
   return shell_browser_main_parts_->off_the_record_browser_context();
 }
 
-network::mojom::NetworkContextParamsPtr
-ShellContentBrowserClient::CreateNetworkContextParams(BrowserContext* context) {
-  network::mojom::NetworkContextParamsPtr context_params =
-      network::mojom::NetworkContextParams::New();
-  UpdateCorsExemptHeader(context_params.get());
+void ShellContentBrowserClient::ConfigureNetworkContextParamsForShell(
+    BrowserContext* context,
+    network::mojom::NetworkContextParams* context_params,
+    network::mojom::CertVerifierCreationParams* cert_verifier_creation_params) {
+  UpdateCorsExemptHeader(context_params);
   context_params->allow_any_cors_exempt_header_for_browser =
       allow_any_cors_exempt_header_for_browser_;
   context_params->user_agent = GetUserAgent();
@@ -422,7 +419,6 @@
           "cors_exempt_header_list");
   if (!exempt_header.empty())
     context_params->cors_exempt_header_list.push_back(exempt_header);
-  return context_params;
 }
 
 }  // namespace content

diff --git a/content/shell/browser/shell_content_browser_client.h b/content/shell/browser/shell_content_browser_client.h
index 1af8045..e64bdf6 100644
--- a/content/shell/browser/shell_content_browser_client.h
+++ b/content/shell/browser/shell_content_browser_client.h

@@ -103,10 +103,13 @@
       int child_process_id,
       content::PosixFileDescriptorInfo* mappings) override;
 #endif  // defined(OS_LINUX) || defined(OS_ANDROID)
-  mojo::Remote<network::mojom::NetworkContext> CreateNetworkContext(
+  void ConfigureNetworkContextParams(
       BrowserContext* context,
       bool in_memory,
-      const base::FilePath& relative_partition_path) override;
+      const base::FilePath& relative_partition_path,
+      network::mojom::NetworkContextParams* network_context_params,
+      network::mojom::CertVerifierCreationParams* cert_verifier_creation_params)
+      override;
   std::vector<base::FilePath> GetNetworkContextsParentDirectory() override;
 
   ShellBrowserContext* browser_context();
@@ -167,10 +170,13 @@
     shell_browser_main_parts_ = parts;
   }
 
-  // Used by CreateNetworkContext(), and can be overridden to change the
-  // parameters used there.
-  virtual network::mojom::NetworkContextParamsPtr CreateNetworkContextParams(
-      BrowserContext* context);
+  // Used by ConfigureNetworkContextParams(), and can be overridden to change
+  // the parameters used there.
+  virtual void ConfigureNetworkContextParamsForShell(
+      BrowserContext* context,
+      network::mojom::NetworkContextParams* context_params,
+      network::mojom::CertVerifierCreationParams*
+          cert_verifier_creation_params);
 
  private:
   static bool allow_any_cors_exempt_header_for_browser_;

diff --git a/content/shell/browser/web_test/web_test_content_browser_client.cc b/content/shell/browser/web_test/web_test_content_browser_client.cc
index 15b553f..f963cc7 100644
--- a/content/shell/browser/web_test/web_test_content_browser_client.cc
+++ b/content/shell/browser/web_test/web_test_content_browser_client.cc

@@ -30,6 +30,7 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/common/service_names.mojom.h"
 #include "content/shell/browser/shell_browser_context.h"
+#include "content/shell/browser/shell_content_browser_client.h"
 #include "content/shell/browser/web_test/fake_bluetooth_chooser.h"
 #include "content/shell/browser/web_test/fake_bluetooth_chooser_factory.h"
 #include "content/shell/browser/web_test/fake_bluetooth_delegate.h"
@@ -487,11 +488,12 @@
   return nullptr;
 }
 
-network::mojom::NetworkContextParamsPtr
-WebTestContentBrowserClient::CreateNetworkContextParams(
-    BrowserContext* context) {
-  network::mojom::NetworkContextParamsPtr context_params =
-      ShellContentBrowserClient::CreateNetworkContextParams(context);
+void WebTestContentBrowserClient::ConfigureNetworkContextParamsForShell(
+    BrowserContext* context,
+    network::mojom::NetworkContextParams* context_params,
+    network::mojom::CertVerifierCreationParams* cert_verifier_creation_params) {
+  ShellContentBrowserClient::ConfigureNetworkContextParamsForShell(
+      context, context_params, cert_verifier_creation_params);
 
 #if BUILDFLAG(ENABLE_REPORTING)
   // Configure the Reporting service in a manner expected by certain Web
@@ -503,8 +505,6 @@
       kReportingDeliveryIntervalTimeForWebTests;
   context_params->skip_reporting_send_permission_check = true;
 #endif
-
-  return context_params;
 }
 
 void WebTestContentBrowserClient::CreateFakeBluetoothChooserFactory(

diff --git a/content/shell/browser/web_test/web_test_content_browser_client.h b/content/shell/browser/web_test/web_test_content_browser_client.h
index 9031cbb..45b6bbbd 100644
--- a/content/shell/browser/web_test/web_test_content_browser_client.h
+++ b/content/shell/browser/web_test/web_test_content_browser_client.h

@@ -107,8 +107,11 @@
 
  private:
   // ShellContentBrowserClient overrides.
-  network::mojom::NetworkContextParamsPtr CreateNetworkContextParams(
-      BrowserContext* context) override;
+  void ConfigureNetworkContextParamsForShell(
+      BrowserContext* context,
+      network::mojom::NetworkContextParams* context_params,
+      network::mojom::CertVerifierCreationParams* cert_verifier_creation_params)
+      override;
 
   // Creates and stores a FakeBluetoothChooserFactory instance.
   void CreateFakeBluetoothChooserFactory(

diff --git a/content/test/BUILD.gn b/content/test/BUILD.gn
index 53571390..e0448888 100644
--- a/content/test/BUILD.gn
+++ b/content/test/BUILD.gn

@@ -1826,6 +1826,7 @@
     "../browser/screenlock_monitor/screenlock_monitor_unittest.cc",
     "../browser/service_worker/embedded_worker_instance_unittest.cc",
     "../browser/service_worker/service_worker_cache_writer_unittest.cc",
+    "../browser/service_worker/service_worker_container_host_unittest.cc",
     "../browser/service_worker/service_worker_context_core_unittest.cc",
     "../browser/service_worker/service_worker_context_unittest.cc",
     "../browser/service_worker/service_worker_context_watcher_unittest.cc",
@@ -1840,7 +1841,6 @@
     "../browser/service_worker/service_worker_new_script_loader_unittest.cc",
     "../browser/service_worker/service_worker_object_host_unittest.cc",
     "../browser/service_worker/service_worker_process_manager_unittest.cc",
-    "../browser/service_worker/service_worker_provider_host_unittest.cc",
     "../browser/service_worker/service_worker_registration_unittest.cc",
     "../browser/service_worker/service_worker_registry_unittest.cc",
     "../browser/service_worker/service_worker_script_loader_factory_unittest.cc",

diff --git a/dbus/object_proxy.cc b/dbus/object_proxy.cc
index 1e6a141c..1c028f8c 100644
--- a/dbus/object_proxy.cc
+++ b/dbus/object_proxy.cc

@@ -119,8 +119,7 @@
     : bus_(bus),
       service_name_(service_name),
       object_path_(object_path),
-      ignore_service_unknown_errors_(
-          options & IGNORE_SERVICE_UNKNOWN_ERRORS) {
+      ignore_service_unknown_errors_(options & IGNORE_SERVICE_UNKNOWN_ERRORS) {
   LOG_IF(FATAL, !object_path_.IsValid()) << object_path_.value();
 }
 
@@ -137,8 +136,7 @@
     ScopedDBusError* error) {
   bus_->AssertOnDBusThread();
 
-  if (!bus_->Connect() ||
-      !method_call->SetDestination(service_name_) ||
+  if (!bus_->Connect() || !method_call->SetDestination(service_name_) ||
       !method_call->SetPath(object_path_))
     return std::unique_ptr<Response>();
 
@@ -152,13 +150,11 @@
   UMA_HISTOGRAM_ENUMERATION("DBus.SyncMethodCallSuccess",
                             response_message ? 1 : 0,
                             kSuccessRatioHistogramMaxValue);
-  statistics::AddBlockingSentMethodCall(service_name_,
-                                        method_call->GetInterface(),
-                                        method_call->GetMember());
+  statistics::AddBlockingSentMethodCall(
+      service_name_, method_call->GetInterface(), method_call->GetMember());
 
   if (!response_message) {
-    LogMethodCallFailure(method_call->GetInterface(),
-                         method_call->GetMember(),
+    LogMethodCallFailure(method_call->GetInterface(), method_call->GetMember(),
                          error->is_set() ? error->name() : "unknown error type",
                          error->is_set() ? error->message() : "");
     return std::unique_ptr<Response>();
@@ -216,8 +212,7 @@
   DBusMessage* request_message = method_call->raw_message();
   dbus_message_ref(request_message);
 
-  statistics::AddSentMethodCall(service_name_,
-                                method_call->GetInterface(),
+  statistics::AddSentMethodCall(service_name_, method_call->GetInterface(),
                                 method_call->GetMember());
 
   // Wait for the response in the D-Bus thread.
@@ -442,16 +437,14 @@
 
   // Add a match_rule listening NameOwnerChanged for the well-known name
   // |service_name_|.
-  const std::string name_owner_changed_match_rule =
-      base::StringPrintf(
-          "type='signal',interface='org.freedesktop.DBus',"
-          "member='NameOwnerChanged',path='/org/freedesktop/DBus',"
-          "sender='org.freedesktop.DBus',arg0='%s'",
-          service_name_.c_str());
+  const std::string name_owner_changed_match_rule = base::StringPrintf(
+      "type='signal',interface='org.freedesktop.DBus',"
+      "member='NameOwnerChanged',path='/org/freedesktop/DBus',"
+      "sender='org.freedesktop.DBus',arg0='%s'",
+      service_name_.c_str());
 
-  const bool success =
-      AddMatchRuleWithoutCallback(name_owner_changed_match_rule,
-                                  "org.freedesktop.DBus.NameOwnerChanged");
+  const bool success = AddMatchRuleWithoutCallback(
+      name_owner_changed_match_rule, "org.freedesktop.DBus.NameOwnerChanged");
 
   // Try getting the current name owner. It's not guaranteed that we can get
   // the name owner at this moment, as the service may not yet be started. If
@@ -487,8 +480,7 @@
       "type='signal', sender='%s', interface='%s', path='%s'",
       service_name_.c_str(), interface_name.c_str(),
       object_path_.value().c_str());
-  return AddMatchRuleWithCallback(match_rule,
-                                  absolute_signal_name,
+  return AddMatchRuleWithCallback(match_rule, absolute_signal_name,
                                   signal_callback);
 }
 
@@ -514,9 +506,8 @@
   }
 }
 
-DBusHandlerResult ObjectProxy::HandleMessage(
-    DBusConnection* connection,
-    DBusMessage* raw_message) {
+DBusHandlerResult ObjectProxy::HandleMessage(DBusConnection* connection,
+                                             DBusMessage* raw_message) {
   bus_->AssertOnDBusThread();
 
   if (dbus_message_get_type(raw_message) != DBUS_MESSAGE_TYPE_SIGNAL)
@@ -551,8 +542,8 @@
   statistics::AddReceivedSignal(service_name_, interface, member);
 
   // Check if we know about the signal.
-  const std::string absolute_signal_name = GetAbsoluteMemberName(
-      interface, member);
+  const std::string absolute_signal_name =
+      GetAbsoluteMemberName(interface, member);
   MethodTable::const_iterator iter = method_table_.find(absolute_signal_name);
   if (iter == method_table_.end()) {
     // Don't know about the signal.
@@ -601,10 +592,9 @@
                       base::TimeTicks::Now() - start_time);
 }
 
-DBusHandlerResult ObjectProxy::HandleMessageThunk(
-    DBusConnection* connection,
-    DBusMessage* raw_message,
-    void* user_data) {
+DBusHandlerResult ObjectProxy::HandleMessageThunk(DBusConnection* connection,
+                                                  DBusMessage* raw_message,
+                                                  void* user_data) {
   ObjectProxy* self = reinterpret_cast<ObjectProxy*>(user_data);
   return self->HandleMessage(connection, raw_message);
 }
@@ -620,8 +610,8 @@
 
   std::ostringstream msg;
   msg << "Failed to call method: " << interface_name << "." << method_name
-      << ": object_path= " << object_path_.value()
-      << ": " << error_name << ": " << error_message;
+      << ": object_path= " << object_path_.value() << ": " << error_name << ": "
+      << error_message;
 
   // "UnknownObject" indicates that an object or service is no longer available,
   // e.g. a Shill network service has gone out of range. Treat these as warnings
@@ -730,10 +720,8 @@
       signal->GetSender() == kDBusSystemObjectAddress) {
     MessageReader reader(signal.get());
     std::string name, old_owner, new_owner;
-    if (reader.PopString(&name) &&
-        reader.PopString(&old_owner) &&
-        reader.PopString(&new_owner) &&
-        name == service_name_) {
+    if (reader.PopString(&name) && reader.PopString(&old_owner) &&
+        reader.PopString(&new_owner) && name == service_name_) {
       service_name_owner_ = new_owner;
       bus_->GetOriginTaskRunner()->PostTask(
           FROM_HERE, base::BindOnce(&ObjectProxy::RunNameOwnerChangedCallback,

diff --git a/dbus/values_util.cc b/dbus/values_util.cc
index d2bcb97..013aa18 100644
--- a/dbus/values_util.cc
+++ b/dbus/values_util.cc

@@ -17,7 +17,7 @@
 namespace {
 
 // Returns whether |value| is exactly representable by double or not.
-template<typename T>
+template <typename T>
 bool IsExactlyRepresentableByDouble(T value) {
   return value == static_cast<T>(static_cast<double>(value));
 }
@@ -135,8 +135,8 @@
     case Message::INT64: {
       int64_t value = 0;
       if (reader->PopInt64(&value)) {
-        DLOG_IF(WARNING, !IsExactlyRepresentableByDouble(value)) <<
-            value << " is not exactly representable by double";
+        DLOG_IF(WARNING, !IsExactlyRepresentableByDouble(value))
+            << value << " is not exactly representable by double";
         result = std::make_unique<base::Value>(static_cast<double>(value));
       }
       break;
@@ -144,8 +144,8 @@
     case Message::UINT64: {
       uint64_t value = 0;
       if (reader->PopUint64(&value)) {
-        DLOG_IF(WARNING, !IsExactlyRepresentableByDouble(value)) <<
-            value << " is not exactly representable by double";
+        DLOG_IF(WARNING, !IsExactlyRepresentableByDouble(value))
+            << value << " is not exactly representable by double";
         result = std::make_unique<base::Value>(static_cast<double>(value));
       }
       break;
@@ -265,8 +265,8 @@
       value.GetAsDictionary(&dictionary);
       dbus::MessageWriter array_writer(nullptr);
       writer->OpenArray("{sv}", &array_writer);
-      for (base::DictionaryValue::Iterator iter(*dictionary);
-           !iter.IsAtEnd(); iter.Advance()) {
+      for (base::DictionaryValue::Iterator iter(*dictionary); !iter.IsAtEnd();
+           iter.Advance()) {
         dbus::MessageWriter dict_entry_writer(nullptr);
         array_writer.OpenDictEntry(&dict_entry_writer);
         dict_entry_writer.AppendString(iter.key());

diff --git a/extensions/browser/api/declarative_net_request/composite_matcher.cc b/extensions/browser/api/declarative_net_request/composite_matcher.cc
index d2da82a8..8240f45 100644
--- a/extensions/browser/api/declarative_net_request/composite_matcher.cc
+++ b/extensions/browser/api/declarative_net_request/composite_matcher.cc

@@ -144,34 +144,6 @@
   return ActionInfo(base::nullopt, notify_request_withheld);
 }
 
-uint8_t CompositeMatcher::GetRemoveHeadersMask(
-    const RequestParams& params,
-    uint8_t excluded_remove_headers_mask,
-    std::vector<RequestAction>* remove_headers_actions) const {
-  uint8_t mask = 0;
-  for (const auto& matcher : matchers_) {
-    // An allow or allowAllRequests rule will override remove header rules
-    // within |matcher|.
-    if (!params.allow_rule_cache.contains(matcher.get())) {
-      // GetBeforeRequestAction is normally called before GetRemoveHeadersMask,
-      // so this should never happen in non-test builds. There are tests that
-      // call GetRemoveHeadersMask directly, though.
-      base::Optional<RequestAction> action =
-          matcher->GetBeforeRequestAction(params);
-      params.allow_rule_cache[matcher.get()] =
-          action && action->IsAllowOrAllowAllRequests();
-    }
-    if (params.allow_rule_cache[matcher.get()])
-      return 0;
-
-    mask |= matcher->GetRemoveHeadersMask(
-        params, mask | excluded_remove_headers_mask, remove_headers_actions);
-  }
-
-  DCHECK(!(mask & excluded_remove_headers_mask));
-  return mask;
-}
-
 std::vector<RequestAction> CompositeMatcher::GetModifyHeadersActions(
     const RequestParams& params) const {
   std::vector<RequestAction> modify_headers_actions;

diff --git a/extensions/browser/api/declarative_net_request/composite_matcher.h b/extensions/browser/api/declarative_net_request/composite_matcher.h
index 4e77b3e..0fae102 100644
--- a/extensions/browser/api/declarative_net_request/composite_matcher.h
+++ b/extensions/browser/api/declarative_net_request/composite_matcher.h

@@ -74,16 +74,6 @@
       const RequestParams& params,
       PermissionsData::PageAccess page_access) const;
 
-  // Returns the bitmask of headers to remove from the request corresponding to
-  // rules matched from this extension. The bitmask corresponds to
-  // RemoveHeadersMask type. |excluded_remove_headers_mask| denotes the current
-  // mask of headers to be skipped for evaluation and is excluded in the return
-  // value.
-  uint8_t GetRemoveHeadersMask(
-      const RequestParams& params,
-      uint8_t excluded_remove_headers_mask,
-      std::vector<RequestAction>* remove_headers_actions) const;
-
   // Returns all matching RequestActions for the request corresponding to
   // modifyHeaders rules matched from this extension, sorted in descending order
   // by rule priority.

diff --git a/extensions/browser/api/declarative_net_request/composite_matcher_unittest.cc b/extensions/browser/api/declarative_net_request/composite_matcher_unittest.cc
index 356e427..3b18341 100644
--- a/extensions/browser/api/declarative_net_request/composite_matcher_unittest.cc
+++ b/extensions/browser/api/declarative_net_request/composite_matcher_unittest.cc

@@ -96,92 +96,6 @@
   EXPECT_EQ(action_info.action->type, RequestAction::Type::ALLOW);
 }
 
-// Tests that header masks are correctly attributed to rules for multiple
-// matchers in a CompositeMatcher.
-TEST_F(CompositeMatcherTest, HeadersMaskForRules) {
-  auto create_remove_headers_rule =
-      [](int id, const std::string& url_filter,
-         const std::vector<std::string>& remove_headers_list) {
-        TestRule rule = CreateGenericRule();
-        rule.id = id;
-        rule.condition->url_filter = url_filter;
-        rule.action->type = std::string("removeHeaders");
-        rule.action->remove_headers_list = remove_headers_list;
-
-        return rule;
-      };
-
-  TestRule static_rule_1 = create_remove_headers_rule(
-      kMinValidID, "google.com", std::vector<std::string>({"cookie"}));
-
-  TestRule dynamic_rule_1 = create_remove_headers_rule(
-      kMinValidID, "/path", std::vector<std::string>({"referer"}));
-
-  TestRule dynamic_rule_2 = create_remove_headers_rule(
-      kMinValidID + 1, "/path", std::vector<std::string>({"setCookie"}));
-
-  // Create the first ruleset matcher, which matches all requests from
-  // |google.com|.
-  const RulesetID kSource1ID(5);
-  std::unique_ptr<RulesetMatcher> matcher_1;
-  ASSERT_TRUE(CreateVerifiedMatcher(
-      {static_rule_1}, CreateTemporarySource(kSource1ID), &matcher_1));
-
-  // Create a second ruleset matcher, which matches all requests with |/path| in
-  // their URL.
-  const RulesetID kSource2ID = kDynamicRulesetID;
-  std::unique_ptr<RulesetMatcher> matcher_2;
-  ASSERT_TRUE(CreateVerifiedMatcher({dynamic_rule_1, dynamic_rule_2},
-                                    CreateTemporarySource(kSource2ID),
-                                    &matcher_2));
-
-  // Create a composite matcher with the two rulesets.
-  std::vector<std::unique_ptr<RulesetMatcher>> matchers;
-  matchers.push_back(std::move(matcher_1));
-  matchers.push_back(std::move(matcher_2));
-  auto composite_matcher =
-      std::make_unique<CompositeMatcher>(std::move(matchers));
-
-  GURL google_url = GURL("http://google.com/path");
-  RequestParams google_params;
-  google_params.url = &google_url;
-  google_params.element_type = url_pattern_index::flat::ElementType_SUBDOCUMENT;
-  google_params.is_third_party = false;
-
-  const uint8_t expected_mask = flat::RemoveHeaderType_referer |
-                                flat::RemoveHeaderType_cookie |
-                                flat::RemoveHeaderType_set_cookie;
-
-  std::vector<RequestAction> actions;
-  EXPECT_EQ(expected_mask, composite_matcher->GetRemoveHeadersMask(
-                               google_params, 0u, &actions));
-
-  // Construct expected request actions to be taken for a request to google.com.
-  // Static actions are attributed to |matcher_1| and dynamic actions are
-  // attributed to |matcher_2|.
-  RequestAction static_action_1 = CreateRequestActionForTesting(
-      RequestAction::Type::REMOVE_HEADERS, *static_rule_1.id, kDefaultPriority,
-      kSource1ID);
-  static_action_1.request_headers_to_remove.push_back(
-      net::HttpRequestHeaders::kCookie);
-
-  RequestAction dynamic_action_1 = CreateRequestActionForTesting(
-      RequestAction::Type::REMOVE_HEADERS, *dynamic_rule_1.id, kDefaultPriority,
-      kDynamicRulesetID);
-  dynamic_action_1.request_headers_to_remove.push_back(
-      net::HttpRequestHeaders::kReferer);
-
-  RequestAction dynamic_action_2 = CreateRequestActionForTesting(
-      RequestAction::Type::REMOVE_HEADERS, *dynamic_rule_2.id, kDefaultPriority,
-      kDynamicRulesetID);
-  dynamic_action_2.response_headers_to_remove.push_back("set-cookie");
-
-  EXPECT_THAT(actions, ::testing::UnorderedElementsAre(
-                           ::testing::Eq(::testing::ByRef(static_action_1)),
-                           ::testing::Eq(::testing::ByRef(dynamic_action_1)),
-                           ::testing::Eq(::testing::ByRef(dynamic_action_2))));
-}
-
 // Tests the GetModifyHeadersActions method.
 TEST_F(CompositeMatcherTest, GetModifyHeadersActions) {
   // TODO(crbug.com/947591): Remove the channel override once implementation of

diff --git a/extensions/browser/api/declarative_net_request/constants.cc b/extensions/browser/api/declarative_net_request/constants.cc
index 078962ae..deb70eb 100644
--- a/extensions/browser/api/declarative_net_request/constants.cc
+++ b/extensions/browser/api/declarative_net_request/constants.cc

@@ -35,9 +35,6 @@
 const char kErrorPersisting[] = "Internal error while parsing rules.";
 const char kErrorNonAscii[] =
     "Rule with id * cannot have non-ascii characters as part of \"*\" key.";
-const char kErrorEmptyRemoveHeadersList[] =
-    "Rule with id * does not specify the value for \"*\" key. This is required "
-    "for \"removeHeaders\" rules.";
 const char kErrorInvalidKey[] =
     "Rule with id * specifies an incorrect value for the \"*\" key.";
 const char kErrorInvalidTransformScheme[] =

diff --git a/extensions/browser/api/declarative_net_request/constants.h b/extensions/browser/api/declarative_net_request/constants.h
index 39f378d..7e4cdcf 100644
--- a/extensions/browser/api/declarative_net_request/constants.h
+++ b/extensions/browser/api/declarative_net_request/constants.h

@@ -36,7 +36,6 @@
   ERROR_NON_ASCII_EXCLUDED_DOMAIN,
 
   ERROR_INVALID_URL_FILTER,
-  ERROR_EMPTY_REMOVE_HEADERS_LIST,
   ERROR_INVALID_REDIRECT,
   ERROR_INVALID_EXTENSION_PATH,
   ERROR_INVALID_TRANSFORM_SCHEME,
@@ -100,7 +99,6 @@
 extern const char kErrorDuplicateIDs[];
 extern const char kErrorPersisting[];
 extern const char kErrorNonAscii[];
-extern const char kErrorEmptyRemoveHeadersList[];
 extern const char kErrorInvalidKey[];
 extern const char kErrorInvalidTransformScheme[];
 extern const char kErrorQueryAndTransformBothSpecified[];

diff --git a/extensions/browser/api/declarative_net_request/extension_url_pattern_index_matcher.cc b/extensions/browser/api/declarative_net_request/extension_url_pattern_index_matcher.cc
index fbd1313..3c2370d8 100644
--- a/extensions/browser/api/declarative_net_request/extension_url_pattern_index_matcher.cc
+++ b/extensions/browser/api/declarative_net_request/extension_url_pattern_index_matcher.cc

@@ -40,24 +40,10 @@
 
 bool IsExtraHeadersMatcherInternal(
     const std::vector<url_pattern_index::UrlPatternIndexMatcher>& matchers) {
-  // We only support removing a subset of extra headers currently. If that
-  // changes, the implementation here should change as well.
-  static_assert(flat::IndexType_count == 6,
+  static_assert(flat::IndexType_count == 3,
                 "Modify this method to ensure IsExtraHeadersMatcherInternal is "
                 "updated as new actions are added.");
-  static const flat::IndexType extra_header_indices[] = {
-      flat::IndexType_remove_cookie_header,
-      flat::IndexType_remove_referer_header,
-      flat::IndexType_remove_set_cookie_header,
-      flat::IndexType_modify_headers,
-  };
-
-  for (flat::IndexType index : extra_header_indices) {
-    if (matchers[index].GetRulesCount() > 0)
-      return true;
-  }
-
-  return false;
+  return matchers[flat::IndexType_modify_headers].GetRulesCount() > 0;
 }
 
 size_t GetRulesCountInternal(
@@ -84,62 +70,6 @@
 
 ExtensionUrlPatternIndexMatcher::~ExtensionUrlPatternIndexMatcher() = default;
 
-uint8_t ExtensionUrlPatternIndexMatcher::GetRemoveHeadersMask(
-    const RequestParams& params,
-    uint8_t excluded_remove_headers_mask,
-    std::vector<RequestAction>* remove_headers_actions) const {
-  // The same flat_rule::UrlRule may be split across different action indices.
-  // To ensure we return one RequestAction for one ID/rule, maintain a map from
-  // the rule to the mask of rules removed for that rule.
-  base::flat_map<const flat_rule::UrlRule*, uint8_t> rule_to_mask_map;
-  auto handle_remove_header_bit = [this, &params, excluded_remove_headers_mask,
-                                   &rule_to_mask_map](uint8_t bit,
-                                                      flat::IndexType index) {
-    if (excluded_remove_headers_mask & bit)
-      return;
-
-    const flat_rule::UrlRule* rule = GetMatchingRule(params, index);
-    if (!rule)
-      return;
-
-    rule_to_mask_map[rule] |= bit;
-  };
-
-  // Iterate over each RemoveHeaderType value.
-  uint8_t bit = 0;
-  for (int i = 0; i <= dnr_api::REMOVE_HEADER_TYPE_LAST; ++i) {
-    switch (i) {
-      case dnr_api::REMOVE_HEADER_TYPE_NONE:
-        break;
-      case dnr_api::REMOVE_HEADER_TYPE_COOKIE:
-        bit = flat::RemoveHeaderType_cookie;
-        handle_remove_header_bit(bit, flat::IndexType_remove_cookie_header);
-        break;
-      case dnr_api::REMOVE_HEADER_TYPE_REFERER:
-        bit = flat::RemoveHeaderType_referer;
-        handle_remove_header_bit(bit, flat::IndexType_remove_referer_header);
-        break;
-      case dnr_api::REMOVE_HEADER_TYPE_SETCOOKIE:
-        bit = flat::RemoveHeaderType_set_cookie;
-        handle_remove_header_bit(bit, flat::IndexType_remove_set_cookie_header);
-        break;
-    }
-  }
-
-  uint8_t mask = 0;
-  for (const auto& it : rule_to_mask_map) {
-    uint8_t mask_for_rule = it.second;
-    DCHECK(mask_for_rule);
-    mask |= mask_for_rule;
-
-    remove_headers_actions->push_back(
-        GetRemoveHeadersActionForMask(*it.first, mask_for_rule));
-  }
-
-  DCHECK(!(mask & excluded_remove_headers_mask));
-  return mask;
-}
-
 base::Optional<RequestAction>
 ExtensionUrlPatternIndexMatcher::GetAllowAllRequestsAction(
     const RequestParams& params) const {
@@ -191,7 +121,6 @@
     case flat::ActionType_upgrade_scheme:
       return CreateUpgradeAction(params, *rule);
     case flat::ActionType_allow_all_requests:
-    case flat::ActionType_remove_headers:
     case flat::ActionType_modify_headers:
     case flat::ActionType_count:
       NOTREACHED();

diff --git a/extensions/browser/api/declarative_net_request/extension_url_pattern_index_matcher.h b/extensions/browser/api/declarative_net_request/extension_url_pattern_index_matcher.h
index 8cbfb43..ccf520a 100644
--- a/extensions/browser/api/declarative_net_request/extension_url_pattern_index_matcher.h
+++ b/extensions/browser/api/declarative_net_request/extension_url_pattern_index_matcher.h

@@ -28,10 +28,6 @@
 
   // RulesetMatcherBase override:
   ~ExtensionUrlPatternIndexMatcher() override;
-  uint8_t GetRemoveHeadersMask(
-      const RequestParams& params,
-      uint8_t excluded_remove_headers_mask,
-      std::vector<RequestAction>* remove_headers_actions) const override;
   std::vector<RequestAction> GetModifyHeadersActions(
       const RequestParams& params) const override;
   bool IsExtraHeadersMatcher() const override {

diff --git a/extensions/browser/api/declarative_net_request/flat/extension_ruleset.fbs b/extensions/browser/api/declarative_net_request/flat/extension_ruleset.fbs
index c9d3b91..046cef8 100644
--- a/extensions/browser/api/declarative_net_request/flat/extension_ruleset.fbs
+++ b/extensions/browser/api/declarative_net_request/flat/extension_ruleset.fbs

@@ -17,7 +17,6 @@
   allow,
   redirect,
   upgrade_scheme,
-  remove_headers,
   modify_headers,
   allow_all_requests,
   /// Number of actions. Must be the last entry.
@@ -93,24 +92,12 @@
   /// since they need to be evaluated separately when a navigation commits.
   allow_all_requests,
 
-  remove_cookie_header,
-  remove_referer_header,
-  remove_set_cookie_header,
-
   modify_headers,
 
   /// Number of indices. Must be the last entry.
   count
 }
 
-/// The type of header to remove. Corresponds to
-/// extensions::api::declarative_net_request::RemoveHeaderType.
-enum RemoveHeaderType : ubyte (bit_flags) {
-  cookie,
-  referer,
-  set_cookie
-}
-
 /// The type of header operation for modifyHeaders rules. Corresponds to
 /// extensions::api::declarative_net_request::HeaderOperation.
 enum HeaderOperation : ubyte {
@@ -138,9 +125,6 @@
   // regex rules.
   action_type: ActionType;
 
-  /// The headers to be removed. Mask of RemoveHeaderType.
-  remove_headers_mask: ubyte;
-
   /// The regex substitution pattern for this rule if specified.
   regex_substitution: string;
 }

diff --git a/extensions/browser/api/declarative_net_request/flat_ruleset_indexer.cc b/extensions/browser/api/declarative_net_request/flat_ruleset_indexer.cc
index f53ad41..ff9430d0 100644
--- a/extensions/browser/api/declarative_net_request/flat_ruleset_indexer.cc
+++ b/extensions/browser/api/declarative_net_request/flat_ruleset_indexer.cc

@@ -222,7 +222,7 @@
             : FlatStringOffset();
     regex_rules_.push_back(flat::CreateRegexRule(
         builder_, offset, ConvertToFlatActionType(indexed_rule.action_type),
-        GetRemoveHeadersMask(indexed_rule), regex_substitution_offset));
+        regex_substitution_offset));
   }
 
   FlatStringOffset redirect_url_offset;
@@ -280,28 +280,6 @@
   return base::make_span(builder_.GetBufferPointer(), builder_.GetSize());
 }
 
-uint8_t FlatRulesetIndexer::GetRemoveHeadersMask(
-    const IndexedRule& indexed_rule) const {
-  uint8_t mask = 0;
-  for (const dnr_api::RemoveHeaderType type : indexed_rule.remove_headers_set) {
-    switch (type) {
-      case dnr_api::REMOVE_HEADER_TYPE_NONE:
-        NOTREACHED();
-        break;
-      case dnr_api::REMOVE_HEADER_TYPE_COOKIE:
-        mask |= flat::RemoveHeaderType_cookie;
-        break;
-      case dnr_api::REMOVE_HEADER_TYPE_REFERER:
-        mask |= flat::RemoveHeaderType_referer;
-        break;
-      case dnr_api::REMOVE_HEADER_TYPE_SETCOOKIE:
-        mask |= flat::RemoveHeaderType_set_cookie;
-        break;
-    }
-  }
-  return mask;
-}
-
 std::vector<FlatRulesetIndexer::UrlPatternIndexBuilder*>
 FlatRulesetIndexer::GetBuilders(const IndexedRule& indexed_rule) {
   switch (indexed_rule.action_type) {
@@ -314,8 +292,6 @@
                       .get()};
     case dnr_api::RULE_ACTION_TYPE_ALLOWALLREQUESTS:
       return {index_builders_[flat::IndexType_allow_all_requests].get()};
-    case dnr_api::RULE_ACTION_TYPE_REMOVEHEADERS:
-      return GetRemoveHeaderBuilders(indexed_rule.remove_headers_set);
     case dnr_api::RULE_ACTION_TYPE_MODIFYHEADERS:
       return {index_builders_[flat::IndexType_modify_headers].get()};
     case dnr_api::RULE_ACTION_TYPE_NONE:
@@ -325,34 +301,5 @@
   return {};
 }
 
-std::vector<FlatRulesetIndexer::UrlPatternIndexBuilder*>
-FlatRulesetIndexer::GetRemoveHeaderBuilders(
-    const std::set<dnr_api::RemoveHeaderType>& types) {
-  // A single "removeHeaders" JSON/indexed rule does still correspond to a
-  // single flatbuffer rule but can be stored in multiple indices.
-  DCHECK(!types.empty());
-  std::vector<UrlPatternIndexBuilder*> result;
-  for (dnr_api::RemoveHeaderType type : types) {
-    switch (type) {
-      case dnr_api::REMOVE_HEADER_TYPE_NONE:
-        NOTREACHED();
-        break;
-      case dnr_api::REMOVE_HEADER_TYPE_COOKIE:
-        result.push_back(
-            index_builders_[flat::IndexType_remove_cookie_header].get());
-        break;
-      case dnr_api::REMOVE_HEADER_TYPE_REFERER:
-        result.push_back(
-            index_builders_[flat::IndexType_remove_referer_header].get());
-        break;
-      case dnr_api::REMOVE_HEADER_TYPE_SETCOOKIE:
-        result.push_back(
-            index_builders_[flat::IndexType_remove_set_cookie_header].get());
-        break;
-    }
-  }
-  return result;
-}
-
 }  // namespace declarative_net_request
 }  // namespace extensions

diff --git a/extensions/browser/api/declarative_net_request/flat_ruleset_indexer.h b/extensions/browser/api/declarative_net_request/flat_ruleset_indexer.h
index 5b480dc..d651364 100644
--- a/extensions/browser/api/declarative_net_request/flat_ruleset_indexer.h
+++ b/extensions/browser/api/declarative_net_request/flat_ruleset_indexer.h

@@ -45,11 +45,8 @@
  private:
   using UrlPatternIndexBuilder = url_pattern_index::UrlPatternIndexBuilder;
 
-  uint8_t GetRemoveHeadersMask(const IndexedRule& indexed_rule) const;
   std::vector<UrlPatternIndexBuilder*> GetBuilders(
       const IndexedRule& indexed_rule);
-  std::vector<UrlPatternIndexBuilder*> GetRemoveHeaderBuilders(
-      const std::set<api::declarative_net_request::RemoveHeaderType>& types);
 
   flatbuffers::FlatBufferBuilder builder_;
 

diff --git a/extensions/browser/api/declarative_net_request/flat_ruleset_indexer_unittest.cc b/extensions/browser/api/declarative_net_request/flat_ruleset_indexer_unittest.cc
index 9e7119c..24c08e4 100644
--- a/extensions/browser/api/declarative_net_request/flat_ruleset_indexer_unittest.cc
+++ b/extensions/browser/api/declarative_net_request/flat_ruleset_indexer_unittest.cc

@@ -156,7 +156,6 @@
     std::vector<std::string> excluded_domains,
     base::Optional<std::string> redirect_url,
     dnr_api::RuleActionType action_type,
-    std::set<dnr_api::RemoveHeaderType> remove_headers_set,
     std::unique_ptr<dnr_api::URLTransform> url_transform,
     base::Optional<std::string> regex_substitution,
     std::vector<dnr_api::ModifyHeaderInfo> request_headers,
@@ -175,7 +174,6 @@
   rule.excluded_domains = std::move(excluded_domains);
   rule.redirect_url = std::move(redirect_url);
   rule.action_type = action_type;
-  rule.remove_headers_set = std::move(remove_headers_set);
   rule.url_transform = std::move(url_transform);
   rule.regex_substitution = std::move(regex_substitution);
   rule.request_headers = std::move(request_headers);
@@ -403,15 +401,15 @@
       flat_rule::ElementType_OBJECT, flat_rule::ActivationType_NONE,
       flat_rule::UrlPatternType_SUBSTRING, flat_rule::AnchorType_NONE,
       flat_rule::AnchorType_BOUNDARY, "google.com", {"a.com"}, {"x.a.com"},
-      base::nullopt, dnr_api::RULE_ACTION_TYPE_BLOCK, {}, nullptr,
-      base::nullopt, {}, {}));
+      base::nullopt, dnr_api::RULE_ACTION_TYPE_BLOCK, nullptr, base::nullopt,
+      {}, {}));
   rules_to_index.push_back(CreateIndexedRule(
       2, kMinValidPriority, flat_rule::OptionFlag_APPLIES_TO_THIRD_PARTY,
       flat_rule::ElementType_IMAGE | flat_rule::ElementType_WEBSOCKET,
       flat_rule::ActivationType_NONE, flat_rule::UrlPatternType_WILDCARDED,
       flat_rule::AnchorType_NONE, flat_rule::AnchorType_NONE, "*google*",
-      {"a.com"}, {}, base::nullopt, dnr_api::RULE_ACTION_TYPE_BLOCK, {},
-      nullptr, base::nullopt, {}, {}));
+      {"a.com"}, {}, base::nullopt, dnr_api::RULE_ACTION_TYPE_BLOCK, nullptr,
+      base::nullopt, {}, {}));
 
   // Redirect rules.
   rules_to_index.push_back(CreateIndexedRule(
@@ -419,27 +417,27 @@
       flat_rule::ElementType_IMAGE, flat_rule::ActivationType_NONE,
       flat_rule::UrlPatternType_SUBSTRING, flat_rule::AnchorType_SUBDOMAIN,
       flat_rule::AnchorType_BOUNDARY, "google.com", {}, {},
-      "http://example1.com", dnr_api::RULE_ACTION_TYPE_REDIRECT, {}, nullptr,
+      "http://example1.com", dnr_api::RULE_ACTION_TYPE_REDIRECT, nullptr,
       base::nullopt, {}, {}));
   rules_to_index.push_back(CreateIndexedRule(
       10, 2, flat_rule::OptionFlag_NONE,
       flat_rule::ElementType_SUBDOCUMENT | flat_rule::ElementType_SCRIPT,
       flat_rule::ActivationType_NONE, flat_rule::UrlPatternType_SUBSTRING,
       flat_rule::AnchorType_NONE, flat_rule::AnchorType_NONE, "example1", {},
-      {"a.com"}, "http://example2.com", dnr_api::RULE_ACTION_TYPE_REDIRECT, {},
+      {"a.com"}, "http://example2.com", dnr_api::RULE_ACTION_TYPE_REDIRECT,
       nullptr, base::nullopt, {}, {}));
   rules_to_index.push_back(CreateIndexedRule(
       9, 3, flat_rule::OptionFlag_NONE, flat_rule::ElementType_NONE,
       flat_rule::ActivationType_NONE, flat_rule::UrlPatternType_WILDCARDED,
       flat_rule::AnchorType_NONE, flat_rule::AnchorType_NONE, "*", {}, {},
-      "http://example2.com", dnr_api::RULE_ACTION_TYPE_REDIRECT, {}, nullptr,
+      "http://example2.com", dnr_api::RULE_ACTION_TYPE_REDIRECT, nullptr,
       base::nullopt, {}, {}));
   rules_to_index.push_back(CreateIndexedRule(
       100, 3, flat_rule::OptionFlag_NONE, flat_rule::ElementType_NONE,
       flat_rule::ActivationType_NONE, flat_rule::UrlPatternType_WILDCARDED,
       flat_rule::AnchorType_NONE, flat_rule::AnchorType_NONE, "*", {}, {},
-      base::nullopt, dnr_api::RULE_ACTION_TYPE_REDIRECT, {},
-      CreateUrlTransform(), base::nullopt, {}, {}));
+      base::nullopt, dnr_api::RULE_ACTION_TYPE_REDIRECT, CreateUrlTransform(),
+      base::nullopt, {}, {}));
 
   // Allow rules.
   rules_to_index.push_back(CreateIndexedRule(
@@ -448,7 +446,7 @@
       flat_rule::ActivationType_NONE, flat_rule::UrlPatternType_SUBSTRING,
       flat_rule::AnchorType_SUBDOMAIN, flat_rule::AnchorType_NONE,
       "example1.com", {"xyz.com"}, {}, base::nullopt,
-      dnr_api::RULE_ACTION_TYPE_ALLOW, {}, nullptr, base::nullopt, {}, {}));
+      dnr_api::RULE_ACTION_TYPE_ALLOW, nullptr, base::nullopt, {}, {}));
   rules_to_index.push_back(CreateIndexedRule(
       16, kMinValidPriority,
       flat_rule::OptionFlag_IS_WHITELIST |
@@ -456,35 +454,15 @@
       flat_rule::ElementType_IMAGE, flat_rule::ActivationType_NONE,
       flat_rule::UrlPatternType_SUBSTRING, flat_rule::AnchorType_NONE,
       flat_rule::AnchorType_NONE, "example3", {}, {}, base::nullopt,
-      dnr_api::RULE_ACTION_TYPE_ALLOW, {}, nullptr, base::nullopt, {}, {}));
-
-  // Remove request header rules.
-  rules_to_index.push_back(CreateIndexedRule(
-      20, kMinValidPriority, flat_rule::OptionFlag_IS_CASE_INSENSITIVE,
-      flat_rule::ElementType_SUBDOCUMENT, flat_rule::ActivationType_NONE,
-      flat_rule::UrlPatternType_SUBSTRING, flat_rule::AnchorType_SUBDOMAIN,
-      flat_rule::AnchorType_NONE, "abc", {}, {}, base::nullopt,
-      dnr_api::RULE_ACTION_TYPE_REMOVEHEADERS,
-      {dnr_api::REMOVE_HEADER_TYPE_COOKIE,
-       dnr_api::REMOVE_HEADER_TYPE_SETCOOKIE},
-      nullptr, base::nullopt, {}, {}));
-  rules_to_index.push_back(CreateIndexedRule(
-      21, kMinValidPriority, flat_rule::OptionFlag_NONE,
-      flat_rule::ElementType_NONE, flat_rule::ActivationType_NONE,
-      flat_rule::UrlPatternType_SUBSTRING, flat_rule::AnchorType_NONE,
-      flat_rule::AnchorType_BOUNDARY, "xyz", {}, {"exclude.com"}, base::nullopt,
-      dnr_api::RULE_ACTION_TYPE_REMOVEHEADERS,
-      {dnr_api::REMOVE_HEADER_TYPE_SETCOOKIE,
-       dnr_api::REMOVE_HEADER_TYPE_COOKIE, dnr_api::REMOVE_HEADER_TYPE_REFERER},
-      nullptr, base::nullopt, {}, {}));
+      dnr_api::RULE_ACTION_TYPE_ALLOW, nullptr, base::nullopt, {}, {}));
 
   // Allow all requests rule.
   rules_to_index.push_back(CreateIndexedRule(
       22, 3, flat_rule::OptionFlag_NONE, flat_rule::ElementType_SUBDOCUMENT,
       flat_rule::ActivationType_NONE, flat_rule::UrlPatternType_SUBSTRING,
       flat_rule::AnchorType_NONE, flat_rule::AnchorType_NONE, "example.com", {},
-      {}, base::nullopt, dnr_api::RULE_ACTION_TYPE_ALLOWALLREQUESTS, {},
-      nullptr, base::nullopt, {}, {}));
+      {}, base::nullopt, dnr_api::RULE_ACTION_TYPE_ALLOWALLREQUESTS, nullptr,
+      base::nullopt, {}, {}));
 
   // Modify headers rules.
   std::vector<dnr_api::ModifyHeaderInfo> request_headers_1;
@@ -500,7 +478,7 @@
       flat_rule::ElementType_SUBDOCUMENT, flat_rule::ActivationType_NONE,
       flat_rule::UrlPatternType_SUBSTRING, flat_rule::AnchorType_SUBDOMAIN,
       flat_rule::AnchorType_NONE, "example.com", {}, {}, base::nullopt,
-      dnr_api::RULE_ACTION_TYPE_MODIFYHEADERS, {}, nullptr, base::nullopt,
+      dnr_api::RULE_ACTION_TYPE_MODIFYHEADERS, nullptr, base::nullopt,
       std::move(request_headers_1), std::move(response_headers_1)));
 
   std::vector<dnr_api::ModifyHeaderInfo> request_headers_2;
@@ -512,7 +490,7 @@
       flat_rule::ElementType_SUBDOCUMENT, flat_rule::ActivationType_NONE,
       flat_rule::UrlPatternType_SUBSTRING, flat_rule::AnchorType_SUBDOMAIN,
       flat_rule::AnchorType_NONE, "example.com", {}, {}, base::nullopt,
-      dnr_api::RULE_ACTION_TYPE_MODIFYHEADERS, {}, nullptr, base::nullopt,
+      dnr_api::RULE_ACTION_TYPE_MODIFYHEADERS, nullptr, base::nullopt,
       std::move(request_headers_2), {}));
 
   // Note: It's unsafe to store/return pointers to a mutable vector since the
@@ -527,17 +505,10 @@
           &rules_to_index[6], &rules_to_index[7]};
 
   expected_index_lists[flat::IndexType_allow_all_requests] = {
-      &rules_to_index[10]};
+      &rules_to_index[8]};
 
-  expected_index_lists[flat::IndexType_remove_cookie_header] = {
-      &rules_to_index[8], &rules_to_index[9]};
-  expected_index_lists[flat::IndexType_remove_referer_header] = {
-      &rules_to_index[9]};
-  expected_index_lists[flat::IndexType_remove_set_cookie_header] = {
-      &rules_to_index[8], &rules_to_index[9]};
-
-  expected_index_lists[flat::IndexType_modify_headers] = {&rules_to_index[11],
-                                                          &rules_to_index[12]};
+  expected_index_lists[flat::IndexType_modify_headers] = {&rules_to_index[9],
+                                                          &rules_to_index[10]};
 
   AddRulesAndVerifyIndex(rules_to_index, expected_index_lists);
 }
@@ -552,7 +523,7 @@
       flat_rule::ElementType_OBJECT, flat_rule::ActivationType_NONE,
       flat_rule::UrlPatternType_REGEXP, flat_rule::AnchorType_NONE,
       flat_rule::AnchorType_NONE, R"(^https://(abc|def))", {"a.com"},
-      {"x.a.com"}, base::nullopt, dnr_api::RULE_ACTION_TYPE_BLOCK, {}, nullptr,
+      {"x.a.com"}, base::nullopt, dnr_api::RULE_ACTION_TYPE_BLOCK, nullptr,
       base::nullopt, {}, {}));
   // Redirect rule.
   rules_to_index.push_back(CreateIndexedRule(
@@ -560,7 +531,7 @@
       flat_rule::ElementType_IMAGE, flat_rule::ActivationType_NONE,
       flat_rule::UrlPatternType_REGEXP, flat_rule::AnchorType_NONE,
       flat_rule::AnchorType_NONE, R"(^(http|https))", {}, {},
-      "http://example1.com", dnr_api::RULE_ACTION_TYPE_REDIRECT, {}, nullptr,
+      "http://example1.com", dnr_api::RULE_ACTION_TYPE_REDIRECT, nullptr,
       base::nullopt, {}, {}));
   // Regex substitution rule.
   rules_to_index.push_back(CreateIndexedRule(
@@ -568,18 +539,8 @@
       flat_rule::ElementType_SCRIPT, flat_rule::ActivationType_NONE,
       flat_rule::UrlPatternType_REGEXP, flat_rule::AnchorType_NONE,
       flat_rule::AnchorType_NONE, R"((\d+\).google.com)", {}, {}, base::nullopt,
-      dnr_api::RULE_ACTION_TYPE_REDIRECT, {}, nullptr,
+      dnr_api::RULE_ACTION_TYPE_REDIRECT, nullptr,
       R"(http://redirect.com?num=\1)", {}, {}));
-  // Remove headers rule.
-  rules_to_index.push_back(CreateIndexedRule(
-      20, kMinValidPriority, flat_rule::OptionFlag_IS_CASE_INSENSITIVE,
-      flat_rule::ElementType_SUBDOCUMENT, flat_rule::ActivationType_NONE,
-      flat_rule::UrlPatternType_REGEXP, flat_rule::AnchorType_NONE,
-      flat_rule::AnchorType_NONE, "*", {}, {}, base::nullopt,
-      dnr_api::RULE_ACTION_TYPE_REMOVEHEADERS,
-      {dnr_api::REMOVE_HEADER_TYPE_COOKIE,
-       dnr_api::REMOVE_HEADER_TYPE_SETCOOKIE},
-      nullptr, base::nullopt, {}, {}));
 
   // Modify headers rule.
   std::vector<dnr_api::ModifyHeaderInfo> request_headers;
@@ -590,7 +551,7 @@
       flat_rule::ElementType_SUBDOCUMENT, flat_rule::ActivationType_NONE,
       flat_rule::UrlPatternType_REGEXP, flat_rule::AnchorType_NONE,
       flat_rule::AnchorType_NONE, "*", {}, {}, base::nullopt,
-      dnr_api::RULE_ACTION_TYPE_MODIFYHEADERS, {}, nullptr, base::nullopt,
+      dnr_api::RULE_ACTION_TYPE_MODIFYHEADERS, nullptr, base::nullopt,
       std::move(request_headers), {}));
 
   FlatRulesetIndexer indexer;
@@ -613,12 +574,11 @@
   }
 
   ASSERT_TRUE(ruleset->regex_rules());
-  ASSERT_EQ(5u, ruleset->regex_rules()->size());
+  ASSERT_EQ(4u, ruleset->regex_rules()->size());
 
   const flat::RegexRule* blocking_rule = nullptr;
   const flat::RegexRule* redirect_rule = nullptr;
   const flat::RegexRule* regex_substitution_rule = nullptr;
-  const flat::RegexRule* remove_header_rule = nullptr;
   const flat::RegexRule* modify_header_rule = nullptr;
   for (const auto* regex_rule : *ruleset->regex_rules()) {
     if (regex_rule->action_type() == flat::ActionType_block)
@@ -628,40 +588,27 @@
         regex_substitution_rule = regex_rule;
       else
         redirect_rule = regex_rule;
-    } else if (regex_rule->action_type() == flat::ActionType_remove_headers)
-      remove_header_rule = regex_rule;
-    else if (regex_rule->action_type() == flat::ActionType_modify_headers)
+    } else if (regex_rule->action_type() == flat::ActionType_modify_headers)
       modify_header_rule = regex_rule;
   }
 
   ASSERT_TRUE(blocking_rule);
   EXPECT_TRUE(AreRulesEqual(&rules_to_index[0], blocking_rule->url_rule()));
-  EXPECT_EQ(0u, blocking_rule->remove_headers_mask());
   EXPECT_FALSE(blocking_rule->regex_substitution());
 
   ASSERT_TRUE(redirect_rule);
   EXPECT_TRUE(AreRulesEqual(&rules_to_index[1], redirect_rule->url_rule()));
-  EXPECT_EQ(0u, redirect_rule->remove_headers_mask());
   EXPECT_FALSE(redirect_rule->regex_substitution());
 
   ASSERT_TRUE(regex_substitution_rule);
   EXPECT_TRUE(
       AreRulesEqual(&rules_to_index[2], regex_substitution_rule->url_rule()));
-  EXPECT_EQ(0u, regex_substitution_rule->remove_headers_mask());
   EXPECT_EQ(R"(http://redirect.com?num=\1)",
             ToString(regex_substitution_rule->regex_substitution()));
 
-  ASSERT_TRUE(remove_header_rule);
-  EXPECT_TRUE(
-      AreRulesEqual(&rules_to_index[3], remove_header_rule->url_rule()));
-  EXPECT_EQ(flat::RemoveHeaderType_cookie | flat::RemoveHeaderType_set_cookie,
-            remove_header_rule->remove_headers_mask());
-  EXPECT_FALSE(remove_header_rule->regex_substitution());
-
   ASSERT_TRUE(modify_header_rule);
   EXPECT_TRUE(
-      AreRulesEqual(&rules_to_index[4], modify_header_rule->url_rule()));
-  EXPECT_EQ(0u, modify_header_rule->remove_headers_mask());
+      AreRulesEqual(&rules_to_index[3], modify_header_rule->url_rule()));
   EXPECT_FALSE(modify_header_rule->regex_substitution());
 }
 

diff --git a/extensions/browser/api/declarative_net_request/indexed_rule.cc b/extensions/browser/api/declarative_net_request/indexed_rule.cc
index 900d2405..2181175b 100644
--- a/extensions/browser/api/declarative_net_request/indexed_rule.cc
+++ b/extensions/browser/api/declarative_net_request/indexed_rule.cc

@@ -393,8 +393,6 @@
     case dnr_api::RULE_ACTION_TYPE_ALLOWALLREQUESTS:
     case dnr_api::RULE_ACTION_TYPE_MODIFYHEADERS:
       return true;
-    case dnr_api::RULE_ACTION_TYPE_REMOVEHEADERS:
-      return false;
     case dnr_api::RULE_ACTION_TYPE_NONE:
       break;
   }
@@ -414,7 +412,6 @@
       return 2;
     case dnr_api::RULE_ACTION_TYPE_REDIRECT:
       return 1;
-    case dnr_api::RULE_ACTION_TYPE_REMOVEHEADERS:
     case dnr_api::RULE_ACTION_TYPE_MODIFYHEADERS:
       return 0;
     case dnr_api::RULE_ACTION_TYPE_NONE:
@@ -588,17 +585,6 @@
   if (indexed_rule->options & flat_rule::OptionFlag_IS_CASE_INSENSITIVE)
     indexed_rule->url_pattern = base::ToLowerASCII(indexed_rule->url_pattern);
 
-  if (parsed_rule.action.type == dnr_api::RULE_ACTION_TYPE_REMOVEHEADERS) {
-    if (!parsed_rule.action.remove_headers_list ||
-        parsed_rule.action.remove_headers_list->empty()) {
-      return ParseResult::ERROR_EMPTY_REMOVE_HEADERS_LIST;
-    }
-
-    indexed_rule->remove_headers_set.insert(
-        parsed_rule.action.remove_headers_list->begin(),
-        parsed_rule.action.remove_headers_list->end());
-  }
-
   if (parsed_rule.action.type == dnr_api::RULE_ACTION_TYPE_MODIFYHEADERS) {
     if (!parsed_rule.action.request_headers &&
         !parsed_rule.action.response_headers)

diff --git a/extensions/browser/api/declarative_net_request/indexed_rule.h b/extensions/browser/api/declarative_net_request/indexed_rule.h
index 411f0e2..8b63699 100644
--- a/extensions/browser/api/declarative_net_request/indexed_rule.h
+++ b/extensions/browser/api/declarative_net_request/indexed_rule.h

@@ -65,9 +65,6 @@
   // UrlTransform for this rule.
   std::unique_ptr<api::declarative_net_request::URLTransform> url_transform;
 
-  // List of headers to remove, valid iff this is a remove headers rule.
-  std::set<api::declarative_net_request::RemoveHeaderType> remove_headers_set;
-
   // List of request headers to modify. Valid iff this is a modify headers rule.
   std::vector<api::declarative_net_request::ModifyHeaderInfo> request_headers;
 

diff --git a/extensions/browser/api/declarative_net_request/indexed_rule_unittest.cc b/extensions/browser/api/declarative_net_request/indexed_rule_unittest.cc
index cb8e429..1821cdd4 100644
--- a/extensions/browser/api/declarative_net_request/indexed_rule_unittest.cc
+++ b/extensions/browser/api/declarative_net_request/indexed_rule_unittest.cc

@@ -128,22 +128,6 @@
                                            cases[i].action_type),
                 indexed_rule.priority);
   }
-
-  // Ensure priority is ignored for non-before-request rules.
-  {
-    dnr_api::Rule rule = CreateGenericParsedRule();
-    rule.action.type = dnr_api::RULE_ACTION_TYPE_REMOVEHEADERS;
-    rule.priority = std::make_unique<int>(5);
-    rule.action.remove_headers_list =
-        std::make_unique<std::vector<dnr_api::RemoveHeaderType>>(
-            std::vector<dnr_api::RemoveHeaderType>{
-                dnr_api::REMOVE_HEADER_TYPE_COOKIE});
-    IndexedRule indexed_rule;
-    ParseResult result = IndexedRule::CreateIndexedRule(
-        std::move(rule), GetBaseURL(), &indexed_rule);
-    EXPECT_EQ(ParseResult::SUCCESS, result);
-    EXPECT_EQ(static_cast<uint32_t>(kDefaultPriority), indexed_rule.priority);
-  }
 }
 
 TEST_F(IndexedRuleTest, OptionsParsing) {
@@ -445,50 +429,6 @@
   }
 }
 
-TEST_F(IndexedRuleTest, RemoveHeadersParsing) {
-  using RemoveHeaderTypeVec = std::vector<dnr_api::RemoveHeaderType>;
-  using RemoveHeaderTypeSet = std::set<dnr_api::RemoveHeaderType>;
-  struct {
-    std::unique_ptr<RemoveHeaderTypeVec> types;
-    ParseResult expected_result;
-    // Valid iff |expected_result| is SUCCESS.
-    RemoveHeaderTypeSet expected_types;
-  } cases[] = {
-      {nullptr, ParseResult::ERROR_EMPTY_REMOVE_HEADERS_LIST, {}},
-      {std::make_unique<RemoveHeaderTypeVec>(),
-       ParseResult::ERROR_EMPTY_REMOVE_HEADERS_LIST,
-       {}},
-      {std::make_unique<RemoveHeaderTypeVec>(
-           RemoveHeaderTypeVec({dnr_api::REMOVE_HEADER_TYPE_COOKIE,
-                                dnr_api::REMOVE_HEADER_TYPE_REFERER})),
-       ParseResult::SUCCESS,
-       RemoveHeaderTypeSet({dnr_api::REMOVE_HEADER_TYPE_COOKIE,
-                            dnr_api::REMOVE_HEADER_TYPE_REFERER})},
-      {std::make_unique<RemoveHeaderTypeVec>(
-           RemoveHeaderTypeVec({dnr_api::REMOVE_HEADER_TYPE_COOKIE,
-                                dnr_api::REMOVE_HEADER_TYPE_COOKIE})),
-       ParseResult::SUCCESS,
-       RemoveHeaderTypeSet({dnr_api::REMOVE_HEADER_TYPE_COOKIE})},
-  };
-
-  for (size_t i = 0; i < base::size(cases); ++i) {
-    SCOPED_TRACE(base::StringPrintf("Testing case[%" PRIuS "]", i));
-    dnr_api::Rule rule = CreateGenericParsedRule();
-    rule.action.type = dnr_api::RULE_ACTION_TYPE_REMOVEHEADERS;
-    rule.action.remove_headers_list = std::move(cases[i].types);
-
-    IndexedRule indexed_rule;
-    ParseResult result = IndexedRule::CreateIndexedRule(
-        std::move(rule), GetBaseURL(), &indexed_rule);
-    EXPECT_EQ(cases[i].expected_result, result);
-    if (result != ParseResult::SUCCESS)
-      continue;
-    EXPECT_EQ(dnr_api::RULE_ACTION_TYPE_REMOVEHEADERS,
-              indexed_rule.action_type);
-    EXPECT_EQ(cases[i].expected_types, indexed_rule.remove_headers_set);
-  }
-}
-
 TEST_F(IndexedRuleTest, RedirectParsing) {
   struct {
     std::string redirect_dictionary_json;

diff --git a/extensions/browser/api/declarative_net_request/indexed_ruleset_format_version_unittest.cc b/extensions/browser/api/declarative_net_request/indexed_ruleset_format_version_unittest.cc
index 91f6677..ea29e06 100644
--- a/extensions/browser/api/declarative_net_request/indexed_ruleset_format_version_unittest.cc
+++ b/extensions/browser/api/declarative_net_request/indexed_ruleset_format_version_unittest.cc

@@ -25,7 +25,6 @@
   allow,
   redirect,
   upgrade_scheme,
-  remove_headers,
   modify_headers,
   allow_all_requests,
   count
@@ -61,17 +60,9 @@
 enum IndexType : ubyte {
   before_request_except_allow_all_requests = 0,
   allow_all_requests,
-  remove_cookie_header,
-  remove_referer_header,
-  remove_set_cookie_header,
   modify_headers,
   count
 }
-enum RemoveHeaderType : ubyte (bit_flags) {
-  cookie,
-  referer,
-  set_cookie
-}
 enum HeaderOperation : ubyte {
   remove
 }
@@ -82,7 +73,6 @@
 table RegexRule {
   url_rule: url_pattern_index.flat.UrlRule;
   action_type: ActionType;
-  remove_headers_mask: ubyte;
   regex_substitution: string;
 }
 table ExtensionIndexedRuleset {
@@ -156,7 +146,7 @@
   EXPECT_EQ(StripCommentsAndWhitespace(kFlatbufferSchemaExpected),
             StripCommentsAndWhitespace(flatbuffer_schema))
       << "Schema change detected; update this test and the schema version.";
-  EXPECT_EQ(16, GetIndexedRulesetFormatVersionForTesting())
+  EXPECT_EQ(17, GetIndexedRulesetFormatVersionForTesting())
       << "Update this test if you update the schema version.";
 }
 

diff --git a/extensions/browser/api/declarative_net_request/parse_info.cc b/extensions/browser/api/declarative_net_request/parse_info.cc
index c105f7c..3069695 100644
--- a/extensions/browser/api/declarative_net_request/parse_info.cc
+++ b/extensions/browser/api/declarative_net_request/parse_info.cc

@@ -84,10 +84,6 @@
     case ParseResult::ERROR_INVALID_URL_FILTER:
       return ErrorUtils::FormatErrorMessage(
           kErrorInvalidKey, base::NumberToString(*rule_id), kUrlFilterKey);
-    case ParseResult::ERROR_EMPTY_REMOVE_HEADERS_LIST:
-      return ErrorUtils::FormatErrorMessage(kErrorEmptyRemoveHeadersList,
-                                            base::NumberToString(*rule_id),
-                                            kRemoveHeadersListKey);
     case ParseResult::ERROR_INVALID_REDIRECT:
       return ErrorUtils::FormatErrorMessage(
           kErrorInvalidKey, base::NumberToString(*rule_id), kRedirectPath);

diff --git a/extensions/browser/api/declarative_net_request/regex_rules_matcher.cc b/extensions/browser/api/declarative_net_request/regex_rules_matcher.cc
index e049a41..f890771 100644
--- a/extensions/browser/api/declarative_net_request/regex_rules_matcher.cc
+++ b/extensions/browser/api/declarative_net_request/regex_rules_matcher.cc

@@ -25,16 +25,15 @@
 
   // We only support removing a subset of extra headers currently. If that
   // changes, the implementation here should change as well.
-  static_assert(flat::ActionType_count == 7,
+  static_assert(flat::ActionType_count == 6,
                 "Modify this method to ensure IsExtraHeadersMatcherInternal is "
                 "updated as new actions are added.");
 
-  return std::any_of(
-      regex_list->begin(), regex_list->end(),
-      [](const flat::RegexRule* regex_rule) {
-        return regex_rule->action_type() == flat::ActionType_remove_headers ||
-               regex_rule->action_type() == flat::ActionType_modify_headers;
-      });
+  return std::any_of(regex_list->begin(), regex_list->end(),
+                     [](const flat::RegexRule* regex_rule) {
+                       return regex_rule->action_type() ==
+                              flat::ActionType_modify_headers;
+                     });
 }
 
 re2::StringPiece ToRE2StringPiece(const ::flatbuffers::String& str) {
@@ -64,7 +63,6 @@
     case flat::ActionType_upgrade_scheme:
     case flat::ActionType_allow_all_requests:
       return true;
-    case flat::ActionType_remove_headers:
     case flat::ActionType_modify_headers:
       return false;
     case flat::ActionType_count:
@@ -97,45 +95,6 @@
 
 RegexRulesMatcher::~RegexRulesMatcher() = default;
 
-uint8_t RegexRulesMatcher::GetRemoveHeadersMask(
-    const RequestParams& params,
-    uint8_t excluded_remove_headers_mask,
-    std::vector<RequestAction>* remove_headers_actions) const {
-  DCHECK(remove_headers_actions);
-
-  const std::vector<RegexRuleInfo>& potential_matches =
-      GetPotentialMatches(params);
-
-  // Subtracts |mask2| from |mask1|.
-  auto subtract_mask = [](uint8_t mask1, uint8_t mask2) {
-    return mask1 & (~mask2);
-  };
-
-  uint8_t mask = 0;
-  for (const RegexRuleInfo& info : potential_matches) {
-    if (info.regex_rule->action_type() != flat::ActionType_remove_headers)
-      continue;
-
-    // The current rule won't be responsible for any headers already removed (in
-    // |mask|) or any headers to be ignored (in |excluded_remove_headers_mask|).
-    uint8_t effective_mask_for_rule =
-        subtract_mask(info.regex_rule->remove_headers_mask(),
-                      excluded_remove_headers_mask | mask);
-    if (!effective_mask_for_rule)
-      continue;
-
-    if (!re2::RE2::PartialMatch(params.url->spec(), *info.regex))
-      continue;
-
-    mask |= effective_mask_for_rule;
-    remove_headers_actions->push_back(GetRemoveHeadersActionForMask(
-        *info.regex_rule->url_rule(), effective_mask_for_rule));
-  }
-
-  DCHECK(!(mask & excluded_remove_headers_mask));
-  return mask;
-}
-
 std::vector<RequestAction> RegexRulesMatcher::GetModifyHeadersActions(
     const RequestParams& params) const {
   const std::vector<RegexRuleInfo>& potential_matches =
@@ -201,7 +160,6 @@
       return CreateUpgradeAction(params, rule);
     case flat::ActionType_allow_all_requests:
       return CreateAllowAllRequestsAction(params, rule);
-    case flat::ActionType_remove_headers:
     case flat::ActionType_modify_headers:
     case flat::ActionType_count:
       NOTREACHED();

diff --git a/extensions/browser/api/declarative_net_request/regex_rules_matcher.h b/extensions/browser/api/declarative_net_request/regex_rules_matcher.h
index 9ade9a48..5db5980e 100644
--- a/extensions/browser/api/declarative_net_request/regex_rules_matcher.h
+++ b/extensions/browser/api/declarative_net_request/regex_rules_matcher.h

@@ -57,10 +57,6 @@
 
   // RulesetMatcherBase override:
   ~RegexRulesMatcher() override;
-  uint8_t GetRemoveHeadersMask(
-      const RequestParams& params,
-      uint8_t excluded_remove_headers_mask,
-      std::vector<RequestAction>* remove_headers_actions) const override;
   std::vector<RequestAction> GetModifyHeadersActions(
       const RequestParams& params) const override;
   bool IsExtraHeadersMatcher() const override {

diff --git a/extensions/browser/api/declarative_net_request/request_action.h b/extensions/browser/api/declarative_net_request/request_action.h
index 4275da95..7bc7be2 100644
--- a/extensions/browser/api/declarative_net_request/request_action.h
+++ b/extensions/browser/api/declarative_net_request/request_action.h

@@ -49,8 +49,6 @@
     REDIRECT,
     // Upgrade the scheme of the network request.
     UPGRADE,
-    // Remove request/response headers.
-    REMOVE_HEADERS,
     // Allow the network request. This request is either for an allowlisted
     // frame or originated from one.
     ALLOW_ALL_REQUESTS,
@@ -88,11 +86,6 @@
   // The id of the extension the action is attributed to.
   ExtensionId extension_id;
 
-  // Valid iff |type| is |REMOVE_HEADERS|. The vectors point to strings of
-  // static storage duration.
-  std::vector<const char*> request_headers_to_remove;
-  std::vector<const char*> response_headers_to_remove;
-
   // Valid iff |type| is |MODIFY_HEADERS|.
   // TODO(crbug.com/1074530): Constructing these vectors could involve lots of
   // string copies. One potential enhancement involves storing a WeakPtr to the

diff --git a/extensions/browser/api/declarative_net_request/ruleset_manager.cc b/extensions/browser/api/declarative_net_request/ruleset_manager.cc
index 46f0fe06..2701918 100644
--- a/extensions/browser/api/declarative_net_request/ruleset_manager.cc
+++ b/extensions/browser/api/declarative_net_request/ruleset_manager.cc

@@ -188,17 +188,14 @@
   const std::vector<RequestAction>& actions =
       EvaluateRequest(request, is_incognito_context);
 
-  static_assert(flat::ActionType_count == 7,
+  static_assert(flat::ActionType_count == 6,
                 "Modify this method to ensure HasExtraHeadersMatcherForRequest "
                 "is updated as new actions are added.");
 
-  for (const auto& action : actions) {
-    if (action.type == RequestAction::Type::REMOVE_HEADERS ||
-        action.type == RequestAction::Type::MODIFY_HEADERS)
-      return true;
-  }
-
-  return false;
+  return std::any_of(
+      actions.begin(), actions.end(), [](const RequestAction& action) {
+        return action.type == RequestAction::Type::MODIFY_HEADERS;
+      });
 }
 
 void RulesetManager::OnRenderFrameCreated(content::RenderFrameHost* host) {
@@ -268,7 +265,6 @@
       case RequestAction::Type::ALLOW:
       case RequestAction::Type::ALLOW_ALL_REQUESTS:
         return 1;
-      case RequestAction::Type::REMOVE_HEADERS:
       case RequestAction::Type::MODIFY_HEADERS:
         NOTREACHED();
         return 0;
@@ -300,33 +296,6 @@
   return action;
 }
 
-std::vector<RequestAction> RulesetManager::GetRemoveHeadersActions(
-    const std::vector<RulesetAndPageAccess>& rulesets,
-    const RequestParams& params) const {
-  std::vector<RequestAction> remove_headers_actions;
-
-  // Keep a combined mask of all headers to be removed to be passed into
-  // GetRemoveHeadersMask. This is done to ensure the ruleset matchers will skip
-  // matching rules for headers already slated to be removed.
-  uint8_t combined_mask = 0;
-  for (const RulesetAndPageAccess& ruleset_and_access : rulesets) {
-    const ExtensionRulesetData* ruleset = ruleset_and_access.first;
-
-    uint8_t extension_ruleset_mask = ruleset->matcher->GetRemoveHeadersMask(
-        params, combined_mask /* excluded_remove_headers_mask */,
-        &remove_headers_actions);
-    if (!extension_ruleset_mask)
-      continue;
-
-    // Sanity check that extension matchers do not try to remove a header that
-    // has already been marked as removed.
-    DCHECK(!(extension_ruleset_mask & combined_mask));
-    combined_mask |= extension_ruleset_mask;
-  }
-
-  return remove_headers_actions;
-}
-
 std::vector<RequestAction> RulesetManager::GetModifyHeadersActions(
     const std::vector<RulesetAndPageAccess>& rulesets,
     const WebRequestInfo& request,
@@ -446,15 +415,6 @@
     return actions;
   }
 
-  // Removing headers doesn't require host permissions.
-  // Note: If we add other "non-destructive" actions (i.e., actions that don't
-  // end the request), we should combine them with the remove-headers action.
-  std::vector<RequestAction> remove_headers_actions =
-      GetRemoveHeadersActions(rulesets_to_evaluate, params);
-
-  if (!remove_headers_actions.empty())
-    return remove_headers_actions;
-
   // TODO(crbug.com/947591): Remove the channel check once implementation of
   // modifyHeaders action is complete.
   if (GetCurrentChannel() != version_info::Channel::STABLE) {

diff --git a/extensions/browser/api/declarative_net_request/ruleset_manager.h b/extensions/browser/api/declarative_net_request/ruleset_manager.h
index 4e652d6..e048514 100644
--- a/extensions/browser/api/declarative_net_request/ruleset_manager.h
+++ b/extensions/browser/api/declarative_net_request/ruleset_manager.h

@@ -124,9 +124,6 @@
       const std::vector<RulesetAndPageAccess>& rulesets,
       const WebRequestInfo& request,
       const RequestParams& params) const;
-  std::vector<RequestAction> GetRemoveHeadersActions(
-      const std::vector<RulesetAndPageAccess>& rulesets,
-      const RequestParams& params) const;
 
   // Returns the list of matching modifyHeaders actions sorted in descending
   // order of priority (|rulesets| is sorted in descending order of extension

diff --git a/extensions/browser/api/declarative_net_request/ruleset_matcher.cc b/extensions/browser/api/declarative_net_request/ruleset_matcher.cc
index 2c1fb57..b76d491 100644
--- a/extensions/browser/api/declarative_net_request/ruleset_matcher.cc
+++ b/extensions/browser/api/declarative_net_request/ruleset_matcher.cc

@@ -70,22 +70,6 @@
       regex_matcher_.GetBeforeRequestAction(params));
 }
 
-uint8_t RulesetMatcher::GetRemoveHeadersMask(
-    const RequestParams& params,
-    uint8_t excluded_remove_headers_mask,
-    std::vector<RequestAction>* remove_headers_actions) const {
-  DCHECK(remove_headers_actions);
-  static_assert(
-      flat::RemoveHeaderType_ANY <= std::numeric_limits<uint8_t>::max(),
-      "flat::RemoveHeaderType can't fit in a uint8_t");
-
-  uint8_t mask = url_pattern_index_matcher_.GetRemoveHeadersMask(
-      params, excluded_remove_headers_mask, remove_headers_actions);
-  return mask | regex_matcher_.GetRemoveHeadersMask(
-                    params, excluded_remove_headers_mask | mask,
-                    remove_headers_actions);
-}
-
 std::vector<RequestAction> RulesetMatcher::GetModifyHeadersActions(
     const RequestParams& params) const {
   std::vector<RequestAction> modify_header_actions =

diff --git a/extensions/browser/api/declarative_net_request/ruleset_matcher.h b/extensions/browser/api/declarative_net_request/ruleset_matcher.h
index 37ff093..728abb2 100644
--- a/extensions/browser/api/declarative_net_request/ruleset_matcher.h
+++ b/extensions/browser/api/declarative_net_request/ruleset_matcher.h

@@ -74,10 +74,6 @@
 
   base::Optional<RequestAction> GetBeforeRequestAction(
       const RequestParams& params) const;
-  uint8_t GetRemoveHeadersMask(
-      const RequestParams& params,
-      uint8_t excluded_remove_headers_mask,
-      std::vector<RequestAction>* remove_headers_actions) const;
   std::vector<RequestAction> GetModifyHeadersActions(
       const RequestParams& params) const;
 

diff --git a/extensions/browser/api/declarative_net_request/ruleset_matcher_base.cc b/extensions/browser/api/declarative_net_request/ruleset_matcher_base.cc
index 8a70c45b..8ffe3fae 100644
--- a/extensions/browser/api/declarative_net_request/ruleset_matcher_base.cc
+++ b/extensions/browser/api/declarative_net_request/ruleset_matcher_base.cc

@@ -15,9 +15,7 @@
 #include "extensions/browser/api/declarative_net_request/utils.h"
 #include "extensions/common/api/declarative_net_request.h"
 #include "net/base/url_util.h"
-#include "net/http/http_request_headers.h"
 #include "url/gurl.h"
-#include "url/url_constants.h"
 
 namespace extensions {
 namespace declarative_net_request {
@@ -26,8 +24,6 @@
 
 namespace {
 
-constexpr const char kSetCookieResponseHeader[] = "set-cookie";
-
 bool ShouldCollapseResourceType(flat_rule::ElementType type) {
   // TODO(crbug.com/848842): Add support for other element types like
   // OBJECT.
@@ -368,39 +364,6 @@
   return redirect_action;
 }
 
-RequestAction RulesetMatcherBase::GetRemoveHeadersActionForMask(
-    const url_pattern_index::flat::UrlRule& rule,
-    uint8_t mask) const {
-  DCHECK(mask);
-  RequestAction action =
-      CreateRequestAction(RequestAction::Type::REMOVE_HEADERS, rule);
-
-  for (int header = 0; header <= dnr_api::REMOVE_HEADER_TYPE_LAST; ++header) {
-    switch (header) {
-      case dnr_api::REMOVE_HEADER_TYPE_NONE:
-        break;
-      case dnr_api::REMOVE_HEADER_TYPE_COOKIE:
-        if (mask & flat::RemoveHeaderType_cookie) {
-          action.request_headers_to_remove.push_back(
-              net::HttpRequestHeaders::kCookie);
-        }
-        break;
-      case dnr_api::REMOVE_HEADER_TYPE_REFERER:
-        if (mask & flat::RemoveHeaderType_referer) {
-          action.request_headers_to_remove.push_back(
-              net::HttpRequestHeaders::kReferer);
-        }
-        break;
-      case dnr_api::REMOVE_HEADER_TYPE_SETCOOKIE:
-        if (mask & flat::RemoveHeaderType_set_cookie)
-          action.response_headers_to_remove.push_back(kSetCookieResponseHeader);
-        break;
-    }
-  }
-
-  return action;
-}
-
 std::vector<RequestAction>
 RulesetMatcherBase::GetModifyHeadersActionsFromMetadata(
     const RequestParams& params,

diff --git a/extensions/browser/api/declarative_net_request/ruleset_matcher_base.h b/extensions/browser/api/declarative_net_request/ruleset_matcher_base.h
index 7258ec60..6abe560 100644
--- a/extensions/browser/api/declarative_net_request/ruleset_matcher_base.h
+++ b/extensions/browser/api/declarative_net_request/ruleset_matcher_base.h

@@ -41,15 +41,6 @@
   base::Optional<RequestAction> GetBeforeRequestAction(
       const RequestParams& params) const;
 
-  // Returns the bitmask of headers to remove from the request. The bitmask
-  // corresponds to flat::RemoveHeaderType. |excluded_remove_headers_mask|
-  // denotes the mask of headers to be skipped for evaluation and is excluded in
-  // the return value.
-  virtual uint8_t GetRemoveHeadersMask(
-      const RequestParams& params,
-      uint8_t excluded_remove_headers_mask,
-      std::vector<RequestAction>* remove_headers_actions) const = 0;
-
   // Returns a vector of RequestAction for all matching modifyHeaders rules.
   virtual std::vector<RequestAction> GetModifyHeadersActions(
       const RequestParams& params) const = 0;
@@ -112,12 +103,6 @@
       const url_pattern_index::flat::UrlRule& rule,
       GURL redirect_url) const;
 
-  // Helper to create a RequestAction of type |REMOVE_HEADERS|. |mask|
-  // corresponds to bitmask of flat::RemoveHeaderType, and must be non-empty.
-  RequestAction GetRemoveHeadersActionForMask(
-      const url_pattern_index::flat::UrlRule& rule,
-      uint8_t mask) const;
-
   // Helper to create a list of RequestActions of type |MODIFY_HEADERS| with the
   // appropriate list of headers for each action.
   std::vector<RequestAction> GetModifyHeadersActionsFromMetadata(

diff --git a/extensions/browser/api/declarative_net_request/ruleset_matcher_unittest.cc b/extensions/browser/api/declarative_net_request/ruleset_matcher_unittest.cc
index ac7b5d5..9643aa5a 100644
--- a/extensions/browser/api/declarative_net_request/ruleset_matcher_unittest.cc
+++ b/extensions/browser/api/declarative_net_request/ruleset_matcher_unittest.cc

@@ -181,130 +181,6 @@
                                                   &matcher));
 }
 
-// Tests IsExtraHeadersMatcher and GetRemoveHeadersMask.
-TEST_F(RulesetMatcherTest, RemoveHeaders) {
-  TestRule rule = CreateGenericRule();
-  rule.condition->url_filter = std::string("example.com");
-
-  std::unique_ptr<RulesetMatcher> matcher;
-  ASSERT_TRUE(CreateVerifiedMatcher({rule}, CreateTemporarySource(), &matcher));
-  EXPECT_FALSE(matcher->IsExtraHeadersMatcher());
-
-  GURL example_url("http://example.com");
-  std::vector<RequestAction> remove_header_actions;
-
-  RequestParams params;
-  params.url = &example_url;
-  params.element_type = url_pattern_index::flat::ElementType_SUBDOCUMENT;
-  params.is_third_party = true;
-  EXPECT_EQ(0u, matcher->GetRemoveHeadersMask(
-                    params, 0u /* excluded_remove_headers_mask */,
-                    &remove_header_actions));
-  EXPECT_TRUE(remove_header_actions.empty());
-
-  rule.action->type = std::string("removeHeaders");
-  rule.action->remove_headers_list =
-      std::vector<std::string>({"referer", "cookie", "setCookie"});
-  ASSERT_TRUE(CreateVerifiedMatcher({rule}, CreateTemporarySource(), &matcher));
-  EXPECT_TRUE(matcher->IsExtraHeadersMatcher());
-  const uint8_t expected_mask = flat::RemoveHeaderType_referer |
-                                flat::RemoveHeaderType_cookie |
-                                flat::RemoveHeaderType_set_cookie;
-
-  EXPECT_EQ(expected_mask, matcher->GetRemoveHeadersMask(
-                               params, 0u /* excluded_remove_headers_mask */,
-                               &remove_header_actions));
-
-  RequestAction expected_action =
-      CreateRequestActionForTesting(RequestAction::Type::REMOVE_HEADERS);
-  expected_action.request_headers_to_remove.push_back(
-      net::HttpRequestHeaders::kCookie);
-  expected_action.request_headers_to_remove.push_back(
-      net::HttpRequestHeaders::kReferer);
-  expected_action.response_headers_to_remove.push_back("set-cookie");
-
-  ASSERT_EQ(1u, remove_header_actions.size());
-  EXPECT_EQ(expected_action, remove_header_actions[0]);
-
-  remove_header_actions.clear();
-
-  GURL google_url("http://google.com");
-  params.url = &google_url;
-  EXPECT_EQ(0u, matcher->GetRemoveHeadersMask(
-                    params, 0u /* excluded_remove_headers_mask */,
-                    &remove_header_actions));
-  EXPECT_TRUE(remove_header_actions.empty());
-
-  uint8_t excluded_remove_headers_mask =
-      flat::RemoveHeaderType_referer | flat::RemoveHeaderType_set_cookie;
-  EXPECT_EQ(0u,
-            matcher->GetRemoveHeadersMask(params, excluded_remove_headers_mask,
-                                          &remove_header_actions));
-  EXPECT_TRUE(remove_header_actions.empty());
-
-  // The current mask is ignored while matching and is not returned as part of
-  // the result.
-  params.url = &example_url;
-  EXPECT_EQ(flat::RemoveHeaderType_cookie,
-            matcher->GetRemoveHeadersMask(params, excluded_remove_headers_mask,
-                                          &remove_header_actions));
-
-  expected_action.request_headers_to_remove.clear();
-  expected_action.response_headers_to_remove.clear();
-  expected_action.request_headers_to_remove.push_back(
-      net::HttpRequestHeaders::kCookie);
-
-  ASSERT_EQ(1u, remove_header_actions.size());
-  EXPECT_EQ(expected_action, remove_header_actions[0]);
-}
-
-// Tests that GetRemoveHeadersMask for multiple rules will return one
-// RequestAction per matching rule.
-TEST_F(RulesetMatcherTest, RemoveHeadersMultipleRules) {
-  TestRule rule_1 = CreateGenericRule();
-  rule_1.condition->url_filter = std::string("example.com");
-  rule_1.action->type = std::string("removeHeaders");
-  rule_1.action->remove_headers_list = std::vector<std::string>({"referer"});
-
-  TestRule rule_2 = CreateGenericRule();
-  rule_2.id = kMinValidID + 1;
-  rule_2.condition->url_filter = std::string("example.com");
-  rule_2.action->type = std::string("removeHeaders");
-  rule_2.action->remove_headers_list = std::vector<std::string>({"cookie"});
-
-  std::unique_ptr<RulesetMatcher> matcher;
-  ASSERT_TRUE(CreateVerifiedMatcher({rule_1, rule_2}, CreateTemporarySource(),
-                                    &matcher));
-  EXPECT_TRUE(matcher->IsExtraHeadersMatcher());
-
-  GURL example_url("http://example.com");
-  RequestParams params;
-  params.url = &example_url;
-  params.element_type = url_pattern_index::flat::ElementType_SUBDOCUMENT;
-  params.is_third_party = true;
-
-  RequestAction rule_1_action = CreateRequestActionForTesting(
-      RequestAction::Type::REMOVE_HEADERS, *rule_1.id);
-  rule_1_action.request_headers_to_remove.push_back(
-      net::HttpRequestHeaders::kReferer);
-
-  RequestAction rule_2_action = CreateRequestActionForTesting(
-      RequestAction::Type::REMOVE_HEADERS, *rule_2.id);
-  rule_2_action.request_headers_to_remove.push_back(
-      net::HttpRequestHeaders::kCookie);
-
-  std::vector<RequestAction> remove_header_actions;
-  EXPECT_EQ(flat::RemoveHeaderType_cookie | flat::RemoveHeaderType_referer,
-            matcher->GetRemoveHeadersMask(params,
-                                          0u /* excluded_remove_headers_mask */,
-                                          &remove_header_actions));
-
-  EXPECT_THAT(remove_header_actions,
-              ::testing::UnorderedElementsAre(
-                  ::testing::Eq(::testing::ByRef(rule_1_action)),
-                  ::testing::Eq(::testing::ByRef(rule_2_action))));
-}
-
 TEST_F(RulesetMatcherTest, ModifyHeaders_IsExtraHeaderMatcher) {
   // TODO(crbug.com/947591): Remove the channel override once implementation of
   // modifyHeaders action is complete.
@@ -616,14 +492,6 @@
   upgrade_rule.priority = kMinValidPriority;
   rules.push_back(upgrade_rule);
 
-  // Add a remove headers rule.
-  TestRule remove_headers_rule =
-      create_regex_rule(5, R"(^(?:http|https)://[a-z\.]+\.in)");
-  remove_headers_rule.action->type = "removeHeaders";
-  remove_headers_rule.action->remove_headers_list =
-      std::vector<std::string>({"referer", "cookie"});
-  rules.push_back(remove_headers_rule);
-
   // Add a modify headers rule.
   TestRule modify_headers_rule =
       create_regex_rule(6, R"(^(?:http|https)://[a-z\.]+\.org)");
@@ -638,8 +506,6 @@
   struct TestCase {
     const char* url = nullptr;
     base::Optional<RequestAction> expected_action;
-    uint8_t expected_remove_headers_mask = 0u;
-    base::Optional<RequestAction> expected_remove_header_action;
     base::Optional<RequestAction> expected_modify_header_action;
   };
 
@@ -654,7 +520,6 @@
 
   {
     TestCase test_case = {"http://www.collapse.com/PATH"};
-    test_cases.push_back(std::move(test_case));
     // Filters are case sensitive by default, hence the request doesn't match.
     test_cases.push_back(std::move(test_case));
   }
@@ -695,27 +560,6 @@
   }
 
   {
-    TestCase test_case = {"http://abc.in/path"};
-    test_case.expected_remove_headers_mask =
-        flat::RemoveHeaderType_cookie | flat::RemoveHeaderType_referer;
-    test_case.expected_remove_header_action = CreateRequestActionForTesting(
-        RequestAction::Type::REMOVE_HEADERS, *remove_headers_rule.id);
-    test_case.expected_remove_header_action->request_headers_to_remove = {
-        net::HttpRequestHeaders::kCookie, net::HttpRequestHeaders::kReferer};
-    test_cases.push_back(std::move(test_case));
-  }
-
-  {
-    TestCase test_case = {"http://abc123.in/path"};
-    test_cases.push_back(std::move(test_case));
-  }
-
-  {
-    TestCase test_case = {"http://abc123.org/path"};
-    test_cases.push_back(std::move(test_case));
-  }
-
-  {
     TestCase test_case = {"http://abc.org/path"};
     test_case.expected_modify_header_action = CreateRequestActionForTesting(
         RequestAction::Type::MODIFY_HEADERS, *modify_headers_rule.id);
@@ -738,23 +582,10 @@
 
     EXPECT_EQ(test_case.expected_action,
               matcher->GetBeforeRequestAction(params));
-    std::vector<RequestAction> remove_header_actions;
-    EXPECT_EQ(test_case.expected_remove_headers_mask,
-              matcher->GetRemoveHeadersMask(
-                  params, 0u /* excluded_remove_headers_mask */,
-                  &remove_header_actions));
 
     std::vector<RequestAction> modify_header_actions =
         matcher->GetModifyHeadersActions(params);
 
-    if (test_case.expected_remove_header_action) {
-      EXPECT_THAT(remove_header_actions,
-                  testing::ElementsAre(testing::Eq(testing::ByRef(
-                      test_case.expected_remove_header_action))));
-    } else {
-      EXPECT_TRUE(remove_header_actions.empty());
-    }
-
     if (test_case.expected_modify_header_action) {
       EXPECT_THAT(modify_header_actions,
                   testing::ElementsAre(testing::Eq(testing::ByRef(
@@ -1030,84 +861,6 @@
   }
 }
 
-// Ensures that RulesetMatcher combines the results of regex and filter-list
-// style remove headers rules correctly.
-TEST_F(RulesetMatcherTest, RegexAndFilterListRules_RemoveHeaders) {
-  std::vector<TestRule> rules;
-
-  TestRule rule = CreateGenericRule();
-  rule.id = 1;
-  rule.action->type = "removeHeaders";
-  rule.condition->url_filter = "abc";
-  rule.action->remove_headers_list = std::vector<std::string>({"cookie"});
-  rules.push_back(rule);
-  RequestAction action_1 =
-      CreateRequestActionForTesting(RequestAction::Type::REMOVE_HEADERS, 1);
-  action_1.request_headers_to_remove = {net::HttpRequestHeaders::kCookie};
-
-  rule = CreateGenericRule();
-  rule.id = 2;
-  rule.condition->url_filter.reset();
-  rule.condition->regex_filter = "example";
-  rule.action->type = "removeHeaders";
-  rule.action->remove_headers_list =
-      std::vector<std::string>({"cookie", "setCookie"});
-  rules.push_back(rule);
-  RequestAction action_2 =
-      CreateRequestActionForTesting(RequestAction::Type::REMOVE_HEADERS, 2);
-  action_2.request_headers_to_remove = {net::HttpRequestHeaders::kCookie};
-  action_2.response_headers_to_remove = {"set-cookie"};
-
-  std::unique_ptr<RulesetMatcher> matcher;
-  ASSERT_TRUE(CreateVerifiedMatcher(rules, CreateTemporarySource(), &matcher));
-
-  {
-    GURL url("http://abc.com");
-    SCOPED_TRACE(url.spec());
-    RequestParams params;
-    params.url = &url;
-    std::vector<RequestAction> actions;
-    EXPECT_EQ(flat::RemoveHeaderType_cookie,
-              matcher->GetRemoveHeadersMask(
-                  params, 0 /* excluded_remove_headers_mask */, &actions));
-    EXPECT_THAT(actions, testing::UnorderedElementsAre(
-                             testing::Eq(testing::ByRef(action_1))));
-  }
-
-  {
-    GURL url("http://example.com");
-    SCOPED_TRACE(url.spec());
-    RequestParams params;
-    params.url = &url;
-    std::vector<RequestAction> actions;
-    EXPECT_EQ(flat::RemoveHeaderType_cookie | flat::RemoveHeaderType_set_cookie,
-              matcher->GetRemoveHeadersMask(
-                  params, 0 /* excluded_remove_headers_mask */, &actions));
-    EXPECT_THAT(actions, testing::UnorderedElementsAre(
-                             testing::Eq(testing::ByRef(action_2))));
-  }
-
-  {
-    GURL url("http://abc.com/example");
-    SCOPED_TRACE(url.spec());
-    RequestParams params;
-    params.url = &url;
-    std::vector<RequestAction> actions;
-    EXPECT_EQ(flat::RemoveHeaderType_cookie | flat::RemoveHeaderType_set_cookie,
-              matcher->GetRemoveHeadersMask(
-                  params, 0 /* excluded_remove_headers_mask */, &actions));
-
-    // Removal of the cookie header will be attributed to rule 1 since filter
-    // list style rules are evaluated first for efficiency reasons. (Note this
-    // is an internal implementation detail). Hence only the set-cookie header
-    // removal will be attributed to rule 2.
-    action_2.request_headers_to_remove = {};
-    EXPECT_THAT(actions, testing::UnorderedElementsAre(
-                             testing::Eq(testing::ByRef(action_1)),
-                             testing::Eq(testing::ByRef(action_2))));
-  }
-}
-
 TEST_F(RulesetMatcherTest, RegexAndFilterListRules_ModifyHeaders) {
   // TODO(crbug.com/947591): Remove the channel override once implementation of
   // modifyHeaders action is complete.

diff --git a/extensions/browser/api/declarative_net_request/test_utils.cc b/extensions/browser/api/declarative_net_request/test_utils.cc
index bee70ba..34eeec4 100644
--- a/extensions/browser/api/declarative_net_request/test_utils.cc
+++ b/extensions/browser/api/declarative_net_request/test_utils.cc

@@ -43,8 +43,6 @@
         return dnr_api::RULE_ACTION_TYPE_REDIRECT;
       case RequestAction::Type::UPGRADE:
         return dnr_api::RULE_ACTION_TYPE_UPGRADESCHEME;
-      case RequestAction::Type::REMOVE_HEADERS:
-        return dnr_api::RULE_ACTION_TYPE_REMOVEHEADERS;
       case RequestAction::Type::ALLOW_ALL_REQUESTS:
         return dnr_api::RULE_ACTION_TYPE_ALLOWALLREQUESTS;
       case RequestAction::Type::MODIFY_HEADERS:
@@ -71,16 +69,10 @@
 // with gtest. This reuses the logic used to test action equality in
 // TestRequestAction in test_utils.h.
 bool operator==(const RequestAction& lhs, const RequestAction& rhs) {
-  static_assert(flat::IndexType_count == 6,
+  static_assert(flat::IndexType_count == 3,
                 "Modify this method to ensure it stays updated as new actions "
                 "are added.");
 
-  auto are_vectors_equal = [](std::vector<const char*> a,
-                              std::vector<const char*> b) {
-    return std::set<base::StringPiece>(a.begin(), a.end()) ==
-           std::set<base::StringPiece>(b.begin(), b.end());
-  };
-
   auto get_members_tuple = [](const RequestAction& action) {
     return std::tie(action.type, action.redirect_url, action.rule_id,
                     action.index_priority, action.ruleset_id,
@@ -102,10 +94,6 @@
   };
 
   return get_members_tuple(lhs) == get_members_tuple(rhs) &&
-         are_vectors_equal(lhs.request_headers_to_remove,
-                           rhs.request_headers_to_remove) &&
-         are_vectors_equal(lhs.response_headers_to_remove,
-                           rhs.response_headers_to_remove) &&
          are_headers_equal(lhs.request_headers_to_modify,
                            rhs.request_headers_to_modify) &&
          are_headers_equal(lhs.response_headers_to_modify,
@@ -129,9 +117,6 @@
     case RequestAction::Type::UPGRADE:
       output << "UPGRADE";
       break;
-    case RequestAction::Type::REMOVE_HEADERS:
-      output << "REMOVE_HEADERS";
-      break;
     case RequestAction::Type::ALLOW_ALL_REQUESTS:
       output << "ALLOW_ALL_REQUESTS";
       break;
@@ -153,10 +138,6 @@
   output << "|index_priority| " << action.index_priority << "\n";
   output << "|ruleset_id| " << action.ruleset_id << "\n";
   output << "|extension_id| " << action.extension_id << "\n";
-  output << "|request_headers_to_remove| "
-         << ::testing::PrintToString(action.request_headers_to_remove) << "\n";
-  output << "|response_headers_to_remove| "
-         << ::testing::PrintToString(action.response_headers_to_remove) << "\n";
   output << "|request_headers_to_modify| "
          << ::testing::PrintToString(action.request_headers_to_modify) << "\n";
   output << "|response_headers_to_modify| "
@@ -224,9 +205,6 @@
     case ParseResult::ERROR_INVALID_URL_FILTER:
       output << "ERROR_INVALID_URL_FILTER";
       break;
-    case ParseResult::ERROR_EMPTY_REMOVE_HEADERS_LIST:
-      output << "ERROR_EMPTY_REMOVE_HEADERS_LIST";
-      break;
     case ParseResult::ERROR_INVALID_REDIRECT:
       output << "ERROR_INVALID_REDIRECT";
       break;

diff --git a/extensions/browser/api/declarative_net_request/utils.cc b/extensions/browser/api/declarative_net_request/utils.cc
index c325a88..792709e 100644
--- a/extensions/browser/api/declarative_net_request/utils.cc
+++ b/extensions/browser/api/declarative_net_request/utils.cc

@@ -39,7 +39,7 @@
 // url_pattern_index.fbs. Whenever an extension with an indexed ruleset format
 // version different from the one currently used by Chrome is loaded, the
 // extension ruleset will be reindexed.
-constexpr int kIndexedRulesetFormatVersion = 16;
+constexpr int kIndexedRulesetFormatVersion = 17;
 
 // This static assert is meant to catch cases where
 // url_pattern_index::kUrlPatternIndexFormatVersion is incremented without
@@ -255,8 +255,6 @@
       return flat::ActionType_allow;
     case dnr_api::RULE_ACTION_TYPE_REDIRECT:
       return flat::ActionType_redirect;
-    case dnr_api::RULE_ACTION_TYPE_REMOVEHEADERS:
-      return flat::ActionType_remove_headers;
     case dnr_api::RULE_ACTION_TYPE_MODIFYHEADERS:
       return flat::ActionType_modify_headers;
     case dnr_api::RULE_ACTION_TYPE_UPGRADESCHEME:

diff --git a/extensions/browser/api/web_request/web_request_api.cc b/extensions/browser/api/web_request/web_request_api.cc
index 8127211..50db1d2 100644
--- a/extensions/browser/api/web_request/web_request_api.cc
+++ b/extensions/browser/api/web_request/web_request_api.cc

@@ -480,22 +480,6 @@
     LogEventListenerFlag(WebRequestEventListenerFlag::kExtraHeaders);
 }
 
-// Helper to remove headers from |response_headers|. Returns whether or not any
-// headers were removed.
-bool FilterResponseHeaders(net::HttpResponseHeaders* response_headers,
-                           const std::vector<const char*>& headers_to_remove) {
-  bool headers_filtered = false;
-  for (const char* header : headers_to_remove) {
-    if (!response_headers->HasHeader(header))
-      continue;
-
-    headers_filtered = true;
-    response_headers->RemoveHeader(header);
-  }
-
-  return headers_filtered;
-}
-
 // Helper to record a matched DNR action in RulesetManager's ActionTracker.
 void OnDNRActionMatched(content::BrowserContext* browser_context,
                         const WebRequestInfo& request,
@@ -511,28 +495,6 @@
   action.tracked = true;
 }
 
-// Helper to remove request headers based on a matched DNR action. Returns
-// whether or not request headers were actually removed and populates the
-// removed headers in |removed_headers|.
-bool RemoveRequestHeadersForAction(net::HttpRequestHeaders* headers,
-                                   const DNRRequestAction& action,
-                                   std::set<std::string>* removed_headers) {
-  bool headers_removed = false;
-
-  for (const char* header : action.request_headers_to_remove) {
-    if (!headers->HasHeader(header))
-      continue;
-
-    removed_headers->insert(header);
-    headers_removed = true;
-    do {
-      headers->RemoveHeader(header);
-    } while (headers->HasHeader(header));
-  }
-
-  return headers_removed;
-}
-
 }  // namespace
 
 void WebRequestAPI::Proxy::HandleAuthRequest(
@@ -931,10 +893,6 @@
   // for OnBeforeSendHeaders.
   net::HttpRequestHeaders* request_headers = nullptr;
 
-  // The request headers removed from this request by the Declarative Net
-  // Request API.
-  std::set<std::string> request_headers_removed;
-
   // The response headers that were received from the server and subsequently
   // filtered by the Declarative Net Request API. Only valid for
   // OnHeadersReceived.
@@ -1145,16 +1103,6 @@
         OnDNRActionMatched(browser_context, *request, action);
         *new_url = action.redirect_url.value();
         return net::OK;
-      case DNRRequestAction::Type::REMOVE_HEADERS:
-        // Unlike other actions, allow web request extensions to intercept the
-        // request here. The headers will be removed during subsequent request
-        // stages.
-        DCHECK(std::all_of(request->dnr_actions->begin(),
-                           request->dnr_actions->end(), [](const auto& action) {
-                             return action.type ==
-                                    DNRRequestAction::Type::REMOVE_HEADERS;
-                           }));
-        break;
       case DNRRequestAction::Type::MODIFY_HEADERS:
         // TODO(crbug.com/947591): Evaluate modify headers DNR actions.
         NOTREACHED();
@@ -1188,19 +1136,8 @@
   if (ShouldHideEvent(browser_context, *request))
     return net::OK;
 
-  // Remove request headers for the Declarative Net Request API. It is given
-  // preference over the Web Request API and this also hides the removed headers
-  // from extensions using the Web Request API.
-  DCHECK(request->dnr_actions);
-  std::set<std::string> removed_headers;
-
-  for (const auto& action : *request->dnr_actions) {
-    bool headers_removed_for_action =
-        RemoveRequestHeadersForAction(headers, action, &removed_headers);
-
-    if (headers_removed_for_action)
-      OnDNRActionMatched(browser_context, *request, action);
-  }
+  // TODO(crbug.com/947591): Handle request header modification by the
+  // Declarative Net Request API.
 
   bool initialize_blocked_requests = false;
 
@@ -1236,7 +1173,6 @@
   blocked_request.request = request;
   blocked_request.before_send_headers_callback = std::move(callback);
   blocked_request.request_headers = headers;
-  blocked_request.request_headers_removed = std::move(removed_headers);
 
   if (blocked_request.num_handlers_blocking == 0) {
     // If there are no blocking handlers, only the declarative rules tried
@@ -1281,45 +1217,10 @@
   if (ShouldHideEvent(browser_context, *request))
     return net::OK;
 
-  // Handle header removal by the Declarative Net Request API. We filter these
-  // headers so that headers removed by Declarative Net Request API are not
-  // visible to web request extensions.
-  DCHECK(request->dnr_actions);
-  bool should_remove_headers = !request->dnr_actions->empty() &&
-                               (*request->dnr_actions)[0].type ==
-                                   DNRRequestAction::Type::REMOVE_HEADERS &&
-                               original_response_headers;
-
-  scoped_refptr<const net::HttpResponseHeaders> filtered_response_headers;
-  if (!should_remove_headers) {
-    filtered_response_headers = original_response_headers;
-  } else {
-    // Make a non-const copy of |original_response_headers| in order to be
-    // modified in-place by FilterResponseHeaders.
-    scoped_refptr<net::HttpResponseHeaders> mutable_response_headers =
-        base::MakeRefCounted<net::HttpResponseHeaders>(
-            original_response_headers->raw_headers());
-
-    bool headers_filtered = false;
-    for (const auto& action : *request->dnr_actions) {
-      bool headers_filtered_for_action = FilterResponseHeaders(
-          mutable_response_headers.get(), action.response_headers_to_remove);
-
-      if (headers_filtered_for_action)
-        OnDNRActionMatched(browser_context, *request, action);
-
-      headers_filtered |= headers_filtered_for_action;
-    }
-
-    filtered_response_headers = mutable_response_headers;
-    if (headers_filtered) {
-      // Create a deep copy to ensure |filtered_response_headers| and
-      // |override_response_headers| don't point to the same object.
-      *override_response_headers =
-          base::MakeRefCounted<net::HttpResponseHeaders>(
-              filtered_response_headers->raw_headers());
-    }
-  }
+  // TODO(crbug.com/947591): Handle header modification by the Declarative Net
+  // Request API.
+  scoped_refptr<const net::HttpResponseHeaders> filtered_response_headers =
+      original_response_headers;
 
   bool initialize_blocked_requests = false;
 
@@ -2341,11 +2242,6 @@
         &request_headers_removed, &request_headers_set,
         &request_headers_modified);
 
-    // Also include headers removed by the declarative net request API.
-    request_headers_removed.insert(
-        blocked_request.request_headers_removed.begin(),
-        blocked_request.request_headers_removed.end());
-
   } else if (blocked_request.event == kOnHeadersReceived) {
     CHECK(!blocked_request.callback.is_null());
     helpers::MergeOnHeadersReceivedResponses(

diff --git a/extensions/browser/api/web_request/web_request_api_helpers.cc b/extensions/browser/api/web_request/web_request_api_helpers.cc
index e8a64ec..2e5874d5 100644
--- a/extensions/browser/api/web_request/web_request_api_helpers.cc
+++ b/extensions/browser/api/web_request/web_request_api_helpers.cc

@@ -332,34 +332,16 @@
 bool HasMatchingRemovedDNRRequestHeader(
     const extensions::WebRequestInfo& request,
     const std::string& header) {
-  for (const auto& action : *request.dnr_actions) {
-    if (std::find_if(action.request_headers_to_remove.begin(),
-                     action.request_headers_to_remove.end(),
-                     [&header](const char* header_to_remove) {
-                       return base::EqualsCaseInsensitiveASCII(header_to_remove,
-                                                               header);
-                     }) != action.request_headers_to_remove.end()) {
-      return true;
-    }
-  }
-
+  // TODO(crbug.com/947591): Reimplement this method with
+  // |action.request_headers_to_modify|.
   return false;
 }
 
 bool HasMatchingRemovedDNRResponseHeader(
     const extensions::WebRequestInfo& request,
     const std::string& header) {
-  for (const auto& action : *request.dnr_actions) {
-    if (std::find_if(action.response_headers_to_remove.begin(),
-                     action.response_headers_to_remove.end(),
-                     [&header](const char* header_to_remove) {
-                       return base::EqualsCaseInsensitiveASCII(
-                           header, header_to_remove);
-                     }) != action.response_headers_to_remove.end()) {
-      return true;
-    }
-  }
-
+  // TODO(crbug.com/947591): Reimplement this method with
+  // |action.response_headers_to_modify|.
   return false;
 }
 

diff --git a/extensions/browser/extension_function_histogram_value.h b/extensions/browser/extension_function_histogram_value.h
index 718bb7e..ba368bf 100644
--- a/extensions/browser/extension_function_histogram_value.h
+++ b/extensions/browser/extension_function_histogram_value.h

@@ -1533,6 +1533,7 @@
   TERMINALPRIVATE_OPENOPTIONSPAGE = 1470,
   DECLARATIVENETREQUEST_UPDATEENABLEDRULESETS = 1471,
   DECLARATIVENETREQUEST_GETENABLEDRULESETS = 1472,
+  TERMINALPRIVATE_OPENWINDOW = 1473,
   // Last entry: Add new entries above, then run:
   // python tools/metrics/histograms/update_extension_histograms.py
   ENUM_BOUNDARY

diff --git a/extensions/common/api/_api_features.json b/extensions/common/api/_api_features.json
index 5cb281f0..9cc9ff8 100644
--- a/extensions/common/api/_api_features.json
+++ b/extensions/common/api/_api_features.json

@@ -144,6 +144,7 @@
     "channel": "stable",
     "contexts": ["webui_untrusted"],
     "matches": [
+      "chrome-untrusted://help-app/*",
       "chrome-untrusted://media-app/*"
     ]
   }],

diff --git a/extensions/common/api/declarative_net_request.idl b/extensions/common/api/declarative_net_request.idl
index 013d6f65..9edc856 100644
--- a/extensions/common/api/declarative_net_request.idl
+++ b/extensions/common/api/declarative_net_request.idl

@@ -33,13 +33,6 @@
     thirdParty
   };
 
-  // This describes the headers which can be removed from the network request.
-  enum RemoveHeaderType {
-    cookie,
-    referer,
-    setCookie
-  };
-
   // This describes the possible operations for a "modifyHeaders" rule.
   // TODO(crbug.com/947591): Add documentation once implementation is complete.
   [nodoc]
@@ -59,8 +52,6 @@
     // Upgrade the network request url's scheme to https if the request is http
     // or ftp.
     upgradeScheme,
-    // Remove request/response headers from the network request.
-    removeHeaders,
     // Modify request/response headers from the network request.
     // TODO(crbug.com/947591): Add documentation once implementation is
     // complete.
@@ -251,10 +242,6 @@
     // rules.
     Redirect? redirect;
 
-    // The headers to remove from the request. Only valid if RuleActionType is
-    // "removeHeaders".
-    RemoveHeaderType[]? removeHeadersList;
-
     // The request headers to modify for the request. Only valid if
     // RuleActionType is "modifyHeaders".
     // TODO(crbug.com/947591): Add documentation once implementation is
@@ -274,9 +261,8 @@
     // An id which uniquely identifies a rule. Mandatory and should be >= 1.
     long id;
 
-    // Rule priority. Mandatory for all rules other than removeHeaders, and
-    // should be >= 1. This is used to break ties between multiple matching
-    // rules.
+    // Rule priority. Mandatory and should be >= 1. This is used to break ties
+    // between multiple matching rules.
     long? priority;
 
     // The condition under which this rule is triggered.
@@ -416,8 +402,6 @@
     // $(ref:runtime.lastError) will be set and no change will be made to set of
     // enabled rulesets. This can happen for multiple reasons, such as invalid
     // ruleset IDs, rule count limit exceeded, or internal errors.
-    // TODO(crbug.com/754526): Enable the documentation.
-    [nodoc]
     static void updateEnabledRulesets(
         DOMString[] rulesetIdsToDisable, DOMString[] rulesetIdsToEnable,
         EmptyCallback callback);
@@ -425,8 +409,6 @@
     // Returns the ids for the current set of enabled static rulesets.
     // |callback|: Called with a list of ids, where each id corresponds to an
     // enabled static $(ref:Ruleset).
-    // TODO(crbug.com/754526): Enable the documentation.
-    [nodoc]
     static void getEnabledRulesets(GetEnabledRulesetsCallback callback);
 
     // Returns all rules matched for the extension. Callers can optionally
@@ -439,9 +421,9 @@
     // than five minutes ago will not be returned.
     // |filter|: An object to filter the list of matched rules.
     // |callback|: Called once the list of matched rules has been fetched. In
-    // case of an error, $(ref:runtime.lastError) will be set to denote the
-    // error and no rules will be returned. This can happen for multiple
-    // reasons, such as insufficient permissions, or exceeding the quota.
+    // case of an error, $(ref:runtime.lastError) will be set and no rules will
+    // be returned. This can happen for multiple reasons, such as insufficient
+    // permissions, or exceeding the quota.
     static void getMatchedRules(optional MatchedRulesFilter filter,
                                 GetMatchedRulesCallback callback);
 
@@ -452,9 +434,9 @@
   };
 
   interface Properties {
-    // The maximum number of rules that an extension can specify in the rule
-    // resources file. Any excess rules will be ignored and an install warning
-    // will be raised.
+    // The maximum number of rules that an extension can specify across its
+    // enabled static rulesets. Any excess rules will be ignored and an install
+    // warning will be raised.
     [value=30000] static long MAX_NUMBER_OF_RULES();
 
     // The maximum number of dynamic rules that an extension can add.
@@ -478,7 +460,7 @@
 
     // The maximum number of static <code>Rulesets</code> an extension can
     // specify as part of the <code>"rule_resources"</code> manifest key.
-    [value=10, nodoc] static long MAX_NUMBER_OF_STATIC_RULESETS();
+    [value=10] static long MAX_NUMBER_OF_STATIC_RULESETS();
 
     // Ruleset ID for the dynamic rules added by the extension.
     [value="_dynamic"] static DOMString DYNAMIC_RULESET_ID();

diff --git a/extensions/common/api/declarative_net_request/constants.cc b/extensions/common/api/declarative_net_request/constants.cc
index f509b4f..6ded0092 100644
--- a/extensions/common/api/declarative_net_request/constants.cc
+++ b/extensions/common/api/declarative_net_request/constants.cc

@@ -23,7 +23,6 @@
 const char kExcludedResourceTypesKey[] = "excludedResourceTypes";
 const char kDomainTypeKey[] = "domainType";
 const char kRuleActionTypeKey[] = "type";
-const char kRemoveHeadersListKey[] = "removeHeadersList";
 const char kRedirectPath[] = "action.redirect";
 const char kExtensionPathPath[] = "action.redirect.extensionPath";
 const char kTransformSchemePath[] = "action.redirect.transform.scheme";

diff --git a/extensions/common/api/declarative_net_request/constants.h b/extensions/common/api/declarative_net_request/constants.h
index 45a21a58..85a1263 100644
--- a/extensions/common/api/declarative_net_request/constants.h
+++ b/extensions/common/api/declarative_net_request/constants.h

@@ -46,7 +46,6 @@
 extern const char kExcludedResourceTypesKey[];
 extern const char kDomainTypeKey[];
 extern const char kRuleActionTypeKey[];
-extern const char kRemoveHeadersListKey[];
 extern const char kRedirectPath[];
 extern const char kExtensionPathPath[];
 extern const char kTransformSchemePath[];

diff --git a/extensions/common/api/declarative_net_request/test_utils.cc b/extensions/common/api/declarative_net_request/test_utils.cc
index daa3605c..ad0382da 100644
--- a/extensions/common/api/declarative_net_request/test_utils.cc
+++ b/extensions/common/api/declarative_net_request/test_utils.cc

@@ -168,7 +168,6 @@
 std::unique_ptr<base::DictionaryValue> TestRuleAction::ToValue() const {
   auto dict = std::make_unique<base::DictionaryValue>();
   SetValue(dict.get(), kRuleActionTypeKey, type);
-  SetValue(dict.get(), kRemoveHeadersListKey, remove_headers_list);
   SetValue(dict.get(), kRequestHeadersKey, request_headers);
   SetValue(dict.get(), kResponseHeadersKey, response_headers);
   SetValue(dict.get(), kRedirectKey, redirect);

diff --git a/extensions/common/api/declarative_net_request/test_utils.h b/extensions/common/api/declarative_net_request/test_utils.h
index 443da2c8..cd3200cd 100644
--- a/extensions/common/api/declarative_net_request/test_utils.h
+++ b/extensions/common/api/declarative_net_request/test_utils.h

@@ -125,7 +125,6 @@
   TestRuleAction& operator=(const TestRuleAction&);
 
   base::Optional<std::string> type;
-  base::Optional<std::vector<std::string>> remove_headers_list;
   base::Optional<std::vector<TestHeaderInfo>> request_headers;
   base::Optional<std::vector<TestHeaderInfo>> response_headers;
   base::Optional<TestRuleRedirect> redirect;

diff --git a/fuchsia/engine/BUILD.gn b/fuchsia/engine/BUILD.gn
index 8c277b1c..59e33ce 100644
--- a/fuchsia/engine/BUILD.gn
+++ b/fuchsia/engine/BUILD.gn

@@ -346,6 +346,7 @@
     "//fuchsia/base:test_support",
     "//media",
     "//media/fuchsia/audio:test_support",
+    "//media/fuchsia/camera:test_support",
     "//third_party/fuchsia-sdk/sdk/fidl/fuchsia.sys",
     "//third_party/fuchsia-sdk/sdk/fidl/fuchsia.web",
   ]

diff --git a/fuchsia/engine/browser/web_engine_content_browser_client.cc b/fuchsia/engine/browser/web_engine_content_browser_client.cc
index cd192a3..6d77b2e 100644
--- a/fuchsia/engine/browser/web_engine_content_browser_client.cc
+++ b/fuchsia/engine/browser/web_engine_content_browser_client.cc

@@ -192,29 +192,22 @@
   return throttles;
 }
 
-mojo::Remote<network::mojom::NetworkContext>
-WebEngineContentBrowserClient::CreateNetworkContext(
+void WebEngineContentBrowserClient::ConfigureNetworkContextParams(
     content::BrowserContext* context,
     bool in_memory,
-    const base::FilePath& relative_partition_path) {
-  // Same as ContentBrowserClient::CreateNetworkContext().
-  mojo::Remote<network::mojom::NetworkContext> network_context;
-  network::mojom::NetworkContextParamsPtr params =
-      network::mojom::NetworkContextParams::New();
-  params->user_agent = GetUserAgent();
-  params->accept_language = "en-us,en";
+    const base::FilePath& relative_partition_path,
+    network::mojom::NetworkContextParams* network_context_params,
+    network::mojom::CertVerifierCreationParams* cert_verifier_creation_params) {
+  // Same as ContentBrowserClient::ConfigureNetworkContextParams().
+  network_context_params->user_agent = GetUserAgent();
+  network_context_params->accept_language = "en-us,en";
 
   // Set the list of cors_exempt_headers which may be specified in a URLRequest,
   // starting with the headers passed in via
   // |CreateContextParams.cors_exempt_headers|.
-  params->cors_exempt_header_list = cors_exempt_headers_;
+  network_context_params->cors_exempt_header_list = cors_exempt_headers_;
 
   // Exempt the minimal headers needed for CORS preflight checks (Purpose,
   // X-Requested-With).
-  content::UpdateCorsExemptHeader(params.get());
-
-  content::GetNetworkService()->CreateNetworkContext(
-      network_context.BindNewPipeAndPassReceiver(), std::move(params));
-
-  return network_context;
+  content::UpdateCorsExemptHeader(network_context_params);
 }

diff --git a/fuchsia/engine/browser/web_engine_content_browser_client.h b/fuchsia/engine/browser/web_engine_content_browser_client.h
index a80f20c..2c1255c 100644
--- a/fuchsia/engine/browser/web_engine_content_browser_client.h
+++ b/fuchsia/engine/browser/web_engine_content_browser_client.h

@@ -55,10 +55,13 @@
       const base::RepeatingCallback<content::WebContents*()>& wc_getter,
       content::NavigationUIData* navigation_ui_data,
       int frame_tree_node_id) final;
-  mojo::Remote<network::mojom::NetworkContext> CreateNetworkContext(
+  void ConfigureNetworkContextParams(
       content::BrowserContext* context,
       bool in_memory,
-      const base::FilePath& relative_partition_path) override;
+      const base::FilePath& relative_partition_path,
+      network::mojom::NetworkContextParams* network_context_params,
+      network::mojom::CertVerifierCreationParams* cert_verifier_creation_params)
+      override;
 
  private:
   fidl::InterfaceRequest<fuchsia::web::Context> request_;

diff --git a/fuchsia/engine/test/data/camera.html b/fuchsia/engine/test/data/camera.html
new file mode 100644
index 0000000..256a4c8a
--- /dev/null
+++ b/fuchsia/engine/test/data/camera.html

@@ -0,0 +1,49 @@
+<script>
+    function callGetUserMedia(haveAccess) {
+      return navigator.mediaDevices.getUserMedia({ audio: false, video: true })
+        .then(() => {
+          if (!haveAccess) {
+            throw "getUserMedia() succeeded when the page doesn't have " +
+                  "camera access";
+          }
+        })
+        .catch((e) => {
+          if (!haveAccess && e.name == "NotFoundError")
+            return;
+          throw e;
+        });
+    }
+
+    function callEnumerateDevices(haveAccess) {
+      return navigator.mediaDevices.enumerateDevices().then((devices)=>{
+        var found = false;
+        for (d of devices) {
+          if (d.kind == "videoinput") {
+              console.log("FOUND CAMERA ", d.deviceId, d.label)
+            found = true;
+            if (d.deviceId == "" && haveAccess) {
+              throw "deviceId must not be empty when camera permission is granted.";
+            } else if (d.deviceId != "" && !haveAccess) {
+              throw "deviceId must be non-empty only when camera permission is granted.";
+            }
+            if (d.label != "" && !haveAccess) {
+              throw "device label must be empty unless camera permission is granted.";
+            }
+            // TODO(crbug.com/1065436): Verify that d.label is set when camera
+            // permission is granted.
+          }
+        }
+        if (!found) {
+          throw "enumerateDevices() didn't return any videoinput devices.";
+        }
+      });
+    }
+
+    // NoPermission is passed in the URL when the page doesn't have camera
+    // access.
+    var haveAccess = (window.location.href.indexOf("NoPermission") < 0);
+
+    callGetUserMedia(haveAccess)
+    .then(() => { return callEnumerateDevices(haveAccess); })
+    .then(() => { document.title = "ended"; })
+  </script>
\ No newline at end of file

diff --git a/fuchsia/engine/web_engine_integration_test.cc b/fuchsia/engine/web_engine_integration_test.cc
index 03beb41a..685698c3 100644
--- a/fuchsia/engine/web_engine_integration_test.cc
+++ b/fuchsia/engine/web_engine_integration_test.cc

@@ -27,6 +27,7 @@
 #include "fuchsia/base/test_navigation_listener.h"
 #include "media/base/media_switches.h"
 #include "media/fuchsia/audio/fake_audio_consumer.h"
+#include "media/fuchsia/camera/fake_fuchsia_camera.h"
 #include "net/base/test_completion_callback.h"
 #include "net/http/http_request_headers.h"
 #include "net/socket/tcp_client_socket.h"
@@ -100,6 +101,26 @@
     return create_params;
   }
 
+  fuchsia::web::CreateContextParams
+  ContextParamsWithFilteredServiceDirectory() {
+    filtered_service_directory_ =
+        std::make_unique<base::fuchsia::FilteredServiceDirectory>(
+            base::fuchsia::ComponentContextForCurrentProcess()->svc().get());
+    fidl::InterfaceHandle<fuchsia::io::Directory> svc_dir;
+    filtered_service_directory_->ConnectClient(svc_dir.NewRequest());
+
+    // Push all services from /svc to the service directory.
+    base::FileEnumerator file_enum(base::FilePath("/svc"), false,
+                                   base::FileEnumerator::FILES);
+    for (auto file = file_enum.Next(); !file.empty(); file = file_enum.Next()) {
+      filtered_service_directory_->AddService(file.BaseName().value().c_str());
+    }
+
+    fuchsia::web::CreateContextParams create_params;
+    create_params.set_service_directory(std::move(svc_dir));
+    return create_params;
+  }
+
   void CreateNavigationListener() {
     // Attach a navigation listener, to monitor the state of the Frame.
     navigation_listener_ =
@@ -194,6 +215,9 @@
   std::unique_ptr<fidl::Binding<fuchsia::web::NavigationEventListener>>
       navigation_listener_binding_;
 
+  std::unique_ptr<base::fuchsia::FilteredServiceDirectory>
+      filtered_service_directory_;
+
   DISALLOW_COPY_AND_ASSIGN(WebEngineIntegrationTest);
 };
 
@@ -449,25 +473,13 @@
 
   // Use a FilteredServiceDirectory in order to inject a fake AudioConsumer
   // service.
-  base::fuchsia::FilteredServiceDirectory filtered_services(
-      base::fuchsia::ComponentContextForCurrentProcess()->svc().get());
-  fidl::InterfaceHandle<fuchsia::io::Directory> svc_dir;
-  filtered_services.ConnectClient(svc_dir.NewRequest());
+  fuchsia::web::CreateContextParams create_params =
+      ContextParamsWithFilteredServiceDirectory();
 
-  // Push all services from /svc to the service directory.
-  base::FileEnumerator file_enum(base::FilePath("/svc"), false,
-                                 base::FileEnumerator::FILES);
-  for (auto file = file_enum.Next(); !file.empty(); file = file_enum.Next()) {
-    filtered_services.AddService(file.BaseName().value().c_str());
-  }
-
-  // Publish fake AudioConsumer in the service directory.
   media::FakeAudioConsumerService fake_audio_consumer_service(
-      filtered_services.outgoing_directory()->GetOrCreateDirectory("svc"));
+      filtered_service_directory_->outgoing_directory()->GetOrCreateDirectory(
+          "svc"));
 
-  // Create Context and Frame.
-  fuchsia::web::CreateContextParams create_params;
-  create_params.set_service_directory(std::move(svc_dir));
   create_params.mutable_content_directories()->push_back(
       CreateTestDataDirectoryProvider());
   create_params.set_features(fuchsia::web::ContextFeatureFlags::AUDIO);
@@ -667,3 +679,40 @@
 
   EXPECT_EQ(navigation_listener_->title(), "present");
 }
+
+TEST_F(WebEngineIntegrationTest, CameraAccess_WithPermission) {
+  StartWebEngine();
+  fuchsia::web::CreateContextParams create_params =
+      ContextParamsWithFilteredServiceDirectory();
+
+  media::FakeCameraDeviceWatcher fake_camera_device_watcher(
+      filtered_service_directory_->outgoing_directory());
+
+  CreateContextAndFrame(std::move(create_params));
+
+  GrantPermission(fuchsia::web::PermissionType::CAMERA,
+                  embedded_test_server_.GetURL("/").GetOrigin().spec());
+
+  EXPECT_TRUE(cr_fuchsia::LoadUrlAndExpectResponse(
+      navigation_controller_.get(), fuchsia::web::LoadUrlParams(),
+      embedded_test_server_.GetURL("/camera.html").spec()));
+
+  navigation_listener_->RunUntilTitleEquals("ended");
+}
+
+TEST_F(WebEngineIntegrationTest, CameraAccess_WithoutPermission) {
+  StartWebEngine();
+  fuchsia::web::CreateContextParams create_params =
+      ContextParamsWithFilteredServiceDirectory();
+
+  media::FakeCameraDeviceWatcher fake_camera_device_watcher(
+      filtered_service_directory_->outgoing_directory());
+
+  CreateContextAndFrame(std::move(create_params));
+
+  EXPECT_TRUE(cr_fuchsia::LoadUrlAndExpectResponse(
+      navigation_controller_.get(), fuchsia::web::LoadUrlParams(),
+      embedded_test_server_.GetURL("/camera.html?NoPermission").spec()));
+
+  navigation_listener_->RunUntilTitleEquals("ended");
+}

diff --git a/gpu/config/gpu_info_collector.cc b/gpu/config/gpu_info_collector.cc
index 448dc961..66e061f 100644
--- a/gpu/config/gpu_info_collector.cc
+++ b/gpu/config/gpu_info_collector.cc

@@ -157,8 +157,58 @@
 
 namespace gpu {
 
+bool CollectGraphicsDeviceInfoFromCommandLine(
+    const base::CommandLine* command_line,
+    GPUInfo* gpu_info) {
+  GPUInfo::GPUDevice& gpu = gpu_info->gpu;
+
+  if (command_line->HasSwitch(switches::kGpuVendorId)) {
+    const std::string vendor_id_str =
+        command_line->GetSwitchValueASCII(switches::kGpuVendorId);
+    base::StringToUint(vendor_id_str, &gpu.vendor_id);
+  }
+
+  if (command_line->HasSwitch(switches::kGpuDeviceId)) {
+    const std::string device_id_str =
+        command_line->GetSwitchValueASCII(switches::kGpuDeviceId);
+    base::StringToUint(device_id_str, &gpu.device_id);
+  }
+
+#if defined(OS_WIN)
+  if (command_line->HasSwitch(switches::kGpuSubSystemId)) {
+    const std::string syb_system_id_str =
+        command_line->GetSwitchValueASCII(switches::kGpuSubSystemId);
+    base::StringToUint(syb_system_id_str, &gpu.sub_sys_id);
+  }
+
+  if (command_line->HasSwitch(switches::kGpuRevision)) {
+    const std::string revision_str =
+        command_line->GetSwitchValueASCII(switches::kGpuRevision);
+    base::StringToUint(revision_str, &gpu.revision);
+  }
+#endif
+
+  if (command_line->HasSwitch(switches::kGpuDriverVersion)) {
+    gpu.driver_version =
+        command_line->GetSwitchValueASCII(switches::kGpuDriverVersion);
+  }
+
+  bool info_updated = gpu.vendor_id || gpu.device_id ||
+#if defined(OS_WIN)
+                      gpu.sub_sys_id || gpu.revision ||
+#endif
+                      !gpu.driver_version.empty();
+
+  return info_updated;
+}
+
 bool CollectBasicGraphicsInfo(const base::CommandLine* command_line,
                               GPUInfo* gpu_info) {
+  // In the info-collection GPU process on Windows, we get the device info from
+  // the browser.
+  if (CollectGraphicsDeviceInfoFromCommandLine(command_line, gpu_info))
+    return true;
+
   std::string use_gl = command_line->GetSwitchValueASCII(switches::kUseGL);
   std::string use_angle =
       command_line->GetSwitchValueASCII(switches::kUseANGLE);

diff --git a/gpu/config/gpu_switches.cc b/gpu/config/gpu_switches.cc
index 39b28e7..c44e307 100644
--- a/gpu/config/gpu_switches.cc
+++ b/gpu/config/gpu_switches.cc

@@ -57,4 +57,24 @@
 // Enables measures of how long GPU Main Thread was blocked between SwapBuffers
 const char kEnableGpuBlockedTime[] = "enable-gpu-blocked-time";
 
+// Passes the active graphics vendor id from browser process to info collection
+// GPU process.
+const char kGpuVendorId[] = "gpu-vendor-id";
+
+// Passes the active graphics device id from browser process to info collection
+// GPU process.
+const char kGpuDeviceId[] = "gpu-device-id";
+
+// Passes the active graphics sub system id from browser process to info
+// collection GPU process.
+const char kGpuSubSystemId[] = "gpu-sub-system-id";
+
+// Passes the active graphics revision info from browser process to info
+// collection GPU process.
+const char kGpuRevision[] = "gpu-revision";
+
+// Passes the active graphics driver version from browser process to info
+// collection GPU process.
+const char kGpuDriverVersion[] = "gpu-driver-version";
+
 }  // namespace switches

diff --git a/gpu/config/gpu_switches.h b/gpu/config/gpu_switches.h
index 8eee9fb..c7f70a79 100644
--- a/gpu/config/gpu_switches.h
+++ b/gpu/config/gpu_switches.h

@@ -22,6 +22,11 @@
 GPU_EXPORT extern const char kUseHighGPUThreadPriorityForPerfTests[];
 GPU_EXPORT extern const char kNoDelayForDX12VulkanInfoCollection[];
 GPU_EXPORT extern const char kEnableGpuBlockedTime[];
+GPU_EXPORT extern const char kGpuVendorId[];
+GPU_EXPORT extern const char kGpuDeviceId[];
+GPU_EXPORT extern const char kGpuSubSystemId[];
+GPU_EXPORT extern const char kGpuRevision[];
+GPU_EXPORT extern const char kGpuDriverVersion[];
 
 }  // namespace switches
 

diff --git a/gpu/ipc/service/gpu_init.cc b/gpu/ipc/service/gpu_init.cc
index 4392321..da3cadec 100644
--- a/gpu/ipc/service/gpu_init.cc
+++ b/gpu/ipc/service/gpu_init.cc

@@ -129,14 +129,6 @@
 bool GpuInit::InitializeAndStartSandbox(base::CommandLine* command_line,
                                         const GpuPreferences& gpu_preferences) {
   gpu_preferences_ = gpu_preferences;
-
-  if (gpu_preferences_.enable_perf_data_collection) {
-    // This is only enabled on the info collection GPU process.
-    DevicePerfInfo device_perf_info;
-    CollectDevicePerfInfo(&device_perf_info, /*in_browser_process=*/false);
-    device_perf_info_ = device_perf_info;
-  }
-
   // Blacklist decisions based on basic GPUInfo may not be final. It might
   // need more context based GPUInfo. In such situations, switching to
   // SwiftShader needs to wait until creating a context.
@@ -161,6 +153,13 @@
   gpu_info_.subpixel_font_rendering = true;
 #endif
 
+  if (gpu_preferences_.enable_perf_data_collection) {
+    // This is only enabled on the info collection GPU process.
+    DevicePerfInfo device_perf_info;
+    CollectDevicePerfInfo(&device_perf_info, /*in_browser_process=*/false);
+    device_perf_info_ = device_perf_info;
+  }
+
 #if defined(OS_LINUX) && !defined(OS_CHROMEOS)
   if (gpu_info_.gpu.vendor_id == 0x10de &&  // NVIDIA
       gpu_info_.gpu.driver_vendor == "NVIDIA" && !CanAccessNvidiaDeviceFile())
@@ -735,5 +734,4 @@
       gpu::kGpuFeatureStatusDisabled;
 #endif  // BUILDFLAG(ENABLE_VULKAN)
 }
-
 }  // namespace gpu

diff --git a/headless/lib/browser/headless_browser_context_impl.cc b/headless/lib/browser/headless_browser_context_impl.cc
index 0d5e272..208ce54 100644
--- a/headless/lib/browser/headless_browser_context_impl.cc
+++ b/headless/lib/browser/headless_browser_context_impl.cc

@@ -285,12 +285,15 @@
   return UniqueId();
 }
 
-mojo::Remote<::network::mojom::NetworkContext>
-HeadlessBrowserContextImpl::CreateNetworkContext(
+void HeadlessBrowserContextImpl::ConfigureNetworkContextParams(
     bool in_memory,
-    const base::FilePath& relative_partition_path) {
-  return request_context_manager_->CreateNetworkContext(
-      in_memory, relative_partition_path);
+    const base::FilePath& relative_partition_path,
+    ::network::mojom::NetworkContextParams* network_context_params,
+    ::network::mojom::CertVerifierCreationParams*
+        cert_verifier_creation_params) {
+  request_context_manager_->ConfigureNetworkContextParams(
+      in_memory, relative_partition_path, network_context_params,
+      cert_verifier_creation_params);
 }
 
 HeadlessBrowserContext::Builder::Builder(HeadlessBrowserImpl* browser)

diff --git a/headless/lib/browser/headless_browser_context_impl.h b/headless/lib/browser/headless_browser_context_impl.h
index 6fc8efa9..a16612a 100644
--- a/headless/lib/browser/headless_browser_context_impl.h
+++ b/headless/lib/browser/headless_browser_context_impl.h

@@ -100,9 +100,12 @@
   const base::UnguessableToken* GetDevToolsFrameTokenForFrameTreeNodeId(
       int frame_tree_node_id) const;
 
-  mojo::Remote<::network::mojom::NetworkContext> CreateNetworkContext(
+  void ConfigureNetworkContextParams(
       bool in_memory,
-      const base::FilePath& relative_partition_path);
+      const base::FilePath& relative_partition_path,
+      ::network::mojom::NetworkContextParams* network_context_params,
+      ::network::mojom::CertVerifierCreationParams*
+          cert_verifier_creation_params);
 
  private:
   HeadlessBrowserContextImpl(

diff --git a/headless/lib/browser/headless_content_browser_client.cc b/headless/lib/browser/headless_content_browser_client.cc
index c91d09a6..2631cc0 100644
--- a/headless/lib/browser/headless_content_browser_client.cc
+++ b/headless/lib/browser/headless_content_browser_client.cc

@@ -300,13 +300,16 @@
   return browser_->options()->site_per_process;
 }
 
-mojo::Remote<::network::mojom::NetworkContext>
-HeadlessContentBrowserClient::CreateNetworkContext(
+void HeadlessContentBrowserClient::ConfigureNetworkContextParams(
     content::BrowserContext* context,
     bool in_memory,
-    const base::FilePath& relative_partition_path) {
-  return HeadlessBrowserContextImpl::From(context)->CreateNetworkContext(
-      in_memory, relative_partition_path);
+    const base::FilePath& relative_partition_path,
+    ::network::mojom::NetworkContextParams* network_context_params,
+    ::network::mojom::CertVerifierCreationParams*
+        cert_verifier_creation_params) {
+  HeadlessBrowserContextImpl::From(context)->ConfigureNetworkContextParams(
+      in_memory, relative_partition_path, network_context_params,
+      cert_verifier_creation_params);
 }
 
 std::string HeadlessContentBrowserClient::GetProduct() {

diff --git a/headless/lib/browser/headless_content_browser_client.h b/headless/lib/browser/headless_content_browser_client.h
index 51576d29..2f6ecd8 100644
--- a/headless/lib/browser/headless_content_browser_client.h
+++ b/headless/lib/browser/headless_content_browser_client.h

@@ -55,10 +55,13 @@
       std::unique_ptr<content::ClientCertificateDelegate> delegate) override;
   bool ShouldEnableStrictSiteIsolation() override;
 
-  mojo::Remote<::network::mojom::NetworkContext> CreateNetworkContext(
+  void ConfigureNetworkContextParams(
       content::BrowserContext* context,
       bool in_memory,
-      const base::FilePath& relative_partition_path) override;
+      const base::FilePath& relative_partition_path,
+      ::network::mojom::NetworkContextParams* network_context_params,
+      ::network::mojom::CertVerifierCreationParams*
+          cert_verifier_creation_params) override;
 
   std::string GetProduct() override;
   std::string GetUserAgent() override;

diff --git a/headless/lib/browser/headless_request_context_manager.cc b/headless/lib/browser/headless_request_context_manager.cc
index d68d678..aa183d0 100644
--- a/headless/lib/browser/headless_request_context_manager.cc
+++ b/headless/lib/browser/headless_request_context_manager.cc

@@ -19,6 +19,7 @@
 #include "net/proxy_resolution/configured_proxy_resolution_service.h"
 #include "services/network/network_service.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/mojom/network_context.mojom.h"
 #include "services/network/public/mojom/network_service.mojom.h"
 #include "services/network/url_request_context_builder_mojo.h"
 
@@ -172,9 +173,19 @@
   auto* network_service = content::GetNetworkService();
   network_service->ConfigureHttpAuthPrefs(std::move(auth_params));
 
+  ::network::mojom::NetworkContextParamsPtr network_context_params =
+      ::network::mojom::NetworkContextParams::New();
+  ::network::mojom::CertVerifierCreationParamsPtr
+      cert_verifier_creation_params =
+          ::network::mojom::CertVerifierCreationParams::New();
+  manager->ConfigureNetworkContextParamsInternal(
+      /* is_system = */ true, network_context_params.get(),
+      cert_verifier_creation_params.get());
+  network_context_params->cert_verifier_creation_params =
+      std::move(cert_verifier_creation_params);
   network_service->CreateNetworkContext(
       manager->system_context_.InitWithNewPipeAndPassReceiver(),
-      manager->CreateNetworkContextParams(/* is_system = */ true));
+      std::move(network_context_params));
 
   return manager;
 }
@@ -217,21 +228,22 @@
     HeadlessProxyConfigMonitor::DeleteSoon(std::move(proxy_config_monitor_));
 }
 
-mojo::Remote<::network::mojom::NetworkContext>
-HeadlessRequestContextManager::CreateNetworkContext(
+void HeadlessRequestContextManager::ConfigureNetworkContextParams(
     bool in_memory,
-    const base::FilePath& relative_partition_path) {
-  mojo::Remote<::network::mojom::NetworkContext> network_context;
-  content::GetNetworkService()->CreateNetworkContext(
-      network_context.BindNewPipeAndPassReceiver(),
-      CreateNetworkContextParams(/* is_system = */ false));
-  return network_context;
+    const base::FilePath& relative_partition_path,
+    ::network::mojom::NetworkContextParams* network_context_params,
+    ::network::mojom::CertVerifierCreationParams*
+        cert_verifier_creation_params) {
+  ConfigureNetworkContextParamsInternal(
+      /*is_system=*/false, network_context_params,
+      cert_verifier_creation_params);
 }
 
-::network::mojom::NetworkContextParamsPtr
-HeadlessRequestContextManager::CreateNetworkContextParams(bool is_system) {
-  auto context_params = ::network::mojom::NetworkContextParams::New();
-
+void HeadlessRequestContextManager::ConfigureNetworkContextParamsInternal(
+    bool is_system,
+    ::network::mojom::NetworkContextParams* context_params,
+    ::network::mojom::CertVerifierCreationParams*
+        cert_verifier_creation_params) {
   context_params->user_agent = user_agent_;
   context_params->accept_language = accept_language_;
   context_params->primary_network_context = is_system;
@@ -259,10 +271,9 @@
     context_params->initial_proxy_config = net::ProxyConfigWithAnnotation(
         *proxy_config_, GetProxyConfigTrafficAnnotationTag());
   } else {
-    proxy_config_monitor_->AddToNetworkContextParams(context_params.get());
+    proxy_config_monitor_->AddToNetworkContextParams(context_params);
   }
-  content::UpdateCorsExemptHeader(context_params.get());
-  return context_params;
+  content::UpdateCorsExemptHeader(context_params);
 }
 
 }  // namespace headless

diff --git a/headless/lib/browser/headless_request_context_manager.h b/headless/lib/browser/headless_request_context_manager.h
index 01882ee..b9609c1 100644
--- a/headless/lib/browser/headless_request_context_manager.h
+++ b/headless/lib/browser/headless_request_context_manager.h

@@ -35,17 +35,23 @@
                                 base::FilePath user_data_path);
   ~HeadlessRequestContextManager();
 
-  mojo::Remote<::network::mojom::NetworkContext> CreateNetworkContext(
+  void ConfigureNetworkContextParams(
       bool in_memory,
-      const base::FilePath& relative_partition_path);
+      const base::FilePath& relative_partition_path,
+      ::network::mojom::NetworkContextParams* network_context_params,
+      ::network::mojom::CertVerifierCreationParams*
+          cert_verifier_creation_params);
 
   content::ResourceContext* GetResourceContext() {
     return resource_context_.get();
   }
 
  private:
-  ::network::mojom::NetworkContextParamsPtr CreateNetworkContextParams(
-      bool is_system);
+  void ConfigureNetworkContextParamsInternal(
+      bool is_system,
+      ::network::mojom::NetworkContextParams* network_context_params,
+      ::network::mojom::CertVerifierCreationParams*
+          cert_verifier_creation_params);
 
   const bool cookie_encryption_enabled_;
 

diff --git a/ios/chrome/browser/autofill/form_suggestion_controller.mm b/ios/chrome/browser/autofill/form_suggestion_controller.mm
index fbfed78b..5bf2f77 100644
--- a/ios/chrome/browser/autofill/form_suggestion_controller.mm
+++ b/ios/chrome/browser/autofill/form_suggestion_controller.mm

@@ -36,13 +36,19 @@
 // Struct that describes suggestion state.
 struct AutofillSuggestionState {
   AutofillSuggestionState(const std::string& form_name,
+                          FormRendererId unique_form_id,
                           const std::string& field_identifier,
+                          FieldRendererId unique_field_id,
                           const std::string& frame_identifier,
                           const std::string& typed_value);
   // The name of the form for autofill.
   std::string form_name;
+  // The unique numeric identifier of the form for autofill.
+  FormRendererId unique_form_id;
   // The identifier of the field for autofill.
   std::string field_identifier;
+  // The unique numeric identifier of the field for autofill.
+  FieldRendererId unique_field_id;
   // The identifier of the frame for autofill.
   std::string frame_identifier;
   // The user-typed value in the field.
@@ -53,11 +59,15 @@
 
 AutofillSuggestionState::AutofillSuggestionState(
     const std::string& form_name,
+    FormRendererId unique_form_id,
     const std::string& field_identifier,
+    FieldRendererId unique_field_id,
     const std::string& frame_identifier,
     const std::string& typed_value)
     : form_name(form_name),
+      unique_form_id(unique_form_id),
       field_identifier(field_identifier),
+      unique_field_id(unique_field_id),
       frame_identifier(frame_identifier),
       typed_value(typed_value) {}
 
@@ -317,8 +327,10 @@
   [_provider
       didSelectSuggestion:suggestion
                      form:base::SysUTF8ToNSString(_suggestionState->form_name)
+             uniqueFormID:_suggestionState->unique_form_id
           fieldIdentifier:base::SysUTF8ToNSString(
                               _suggestionState->field_identifier)
+            uniqueFieldID:_suggestionState->unique_field_id
                   frameID:base::SysUTF8ToNSString(
                               _suggestionState->frame_identifier)
         completionHandler:^{
@@ -333,9 +345,10 @@
           accessoryViewUpdateBlock:
               (FormSuggestionsReadyCompletion)accessoryViewUpdateBlock {
   [self processPage:webState];
-  _suggestionState.reset(
-      new AutofillSuggestionState(params.form_name, params.field_identifier,
-                                  params.frame_id, params.value));
+  _suggestionState.reset(new AutofillSuggestionState(
+      params.form_name, FormRendererId(params.unique_form_id),
+      params.field_identifier, FieldRendererId(params.unique_field_id),
+      params.frame_id, params.value));
   _accessoryViewUpdateBlock = [accessoryViewUpdateBlock copy];
   [self retrieveSuggestionsForForm:params webState:webState];
 }

diff --git a/ios/chrome/browser/autofill/form_suggestion_controller_unittest.mm b/ios/chrome/browser/autofill/form_suggestion_controller_unittest.mm
index de6f309..76231bc 100644
--- a/ios/chrome/browser/autofill/form_suggestion_controller_unittest.mm
+++ b/ios/chrome/browser/autofill/form_suggestion_controller_unittest.mm

@@ -57,7 +57,9 @@
 @implementation TestSuggestionProvider {
   NSArray* _suggestions;
   NSString* _formName;
+  FormRendererId _uniqueFormID;
   NSString* _fieldIdentifier;
+  FieldRendererId _uniqueFieldID;
   NSString* _frameID;
   FormSuggestion* _suggestion;
 }
@@ -123,13 +125,17 @@
 
 - (void)didSelectSuggestion:(FormSuggestion*)suggestion
                        form:(NSString*)formName
+               uniqueFormID:(FormRendererId)uniqueFormID
             fieldIdentifier:(NSString*)fieldIdentifier
+              uniqueFieldID:(FieldRendererId)uniqueFieldID
                     frameID:(NSString*)frameID
           completionHandler:(SuggestionHandledCompletion)completion {
   self.selected = YES;
   _suggestion = suggestion;
   _formName = [formName copy];
+  _uniqueFormID = uniqueFormID;
   _fieldIdentifier = [fieldIdentifier copy];
+  _uniqueFieldID = uniqueFieldID;
   _frameID = [frameID copy];
   completion();
 }

diff --git a/ios/chrome/browser/passwords/password_controller.mm b/ios/chrome/browser/passwords/password_controller.mm
index 00bbb4d2..f5ad773b 100644
--- a/ios/chrome/browser/passwords/password_controller.mm
+++ b/ios/chrome/browser/passwords/password_controller.mm

@@ -137,7 +137,7 @@
 @property(nonatomic, assign) BOOL isPasswordGenerated;
 
 // Tracks field when current password was generated.
-@property(nonatomic, copy) NSString* passwordGeneratedIdentifier;
+@property(nonatomic) FieldRendererId passwordGeneratedIdentifier;
 
 // Tracks current potential generated password until accepted or rejected.
 @property(nonatomic, copy) NSString* generatedPotentialPassword;
@@ -200,7 +200,7 @@
   std::unique_ptr<autofill::PasswordForm> _pendingAutoSigninPasswordForm;
 
   // Form data for password generation on this page.
-  std::map<base::string16, PasswordFormGenerationData> _formGenerationData;
+  std::map<FormRendererId, PasswordFormGenerationData> _formGenerationData;
 
   NSString* _lastTypedfieldIdentifier;
   NSString* _lastTypedValue;
@@ -399,7 +399,7 @@
                        }];
 
   if (self.isPasswordGenerated &&
-      [formQuery.fieldIdentifier isEqual:self.passwordGeneratedIdentifier]) {
+      formQuery.uniqueFieldID == self.passwordGeneratedIdentifier) {
     // On other platforms, when the user clicks on generation field, we show
     // password in clear text. And the user has the possibility to edit it. On
     // iOS, it's harder to do (it's probably bad idea to change field type from
@@ -407,14 +407,14 @@
     // flow and avoid the manual flow, for a cleaner and simpler UI.
     if (formQuery.typedValue.length < kMinimumLengthForEditedPassword) {
       self.isPasswordGenerated = NO;
-      self.passwordGeneratedIdentifier = nil;
+      self.passwordGeneratedIdentifier = FieldRendererId();
       self.passwordManager->OnPasswordNoLongerGenerated(
           self.passwordManagerDriver);
     } else {
       // Inject updated value to possibly update confirmation field.
-      [self injectGeneratedPasswordForFormName:formQuery.formName
-                             generatedPassword:formQuery.typedValue
-                             completionHandler:nil];
+      [self injectGeneratedPasswordForFormId:formQuery.uniqueFormID
+                           generatedPassword:formQuery.typedValue
+                           completionHandler:nil];
     }
   }
 
@@ -469,8 +469,8 @@
     suggestion_state = PasswordDropdownState::kStandard;
   }
 
-  if ([self canGeneratePasswordForForm:formQuery.formName
-                       fieldIdentifier:formQuery.fieldIdentifier
+  if ([self canGeneratePasswordForForm:formQuery.uniqueFormID
+                       fieldIdentifier:formQuery.uniqueFieldID
                              fieldType:formQuery.fieldType]) {
     // Add "Suggest Password...".
     NSString* suggestPassword = GetNSString(IDS_IOS_SUGGEST_PASSWORD);
@@ -495,7 +495,9 @@
 
 - (void)didSelectSuggestion:(FormSuggestion*)suggestion
                        form:(NSString*)formName
+               uniqueFormID:(FormRendererId)uniqueFormID
             fieldIdentifier:(NSString*)fieldIdentifier
+              uniqueFieldID:(FieldRendererId)uniqueFieldID
                     frameID:(NSString*)frameID
           completionHandler:(SuggestionHandledCompletion)completion {
   switch (suggestion.identifier) {
@@ -512,8 +514,8 @@
     case autofill::POPUP_ITEM_ID_GENERATE_PASSWORD_ENTRY: {
       // Don't call completion because current siggestion state should remain
       // whether user injects a generated password or cancels.
-      [self generatePasswordForFormName:formName
-                        fieldIdentifier:fieldIdentifier];
+      [self generatePasswordForFormId:uniqueFormID
+                      fieldIdentifier:uniqueFieldID];
       password_manager::metrics_util::LogPasswordDropdownItemSelected(
           password_manager::metrics_util::PasswordDropdownSelectedOption::
               kGenerate,
@@ -650,7 +652,7 @@
 }
 
 - (void)formEligibleForGenerationFound:(const PasswordFormGenerationData&)form {
-  _formGenerationData[form.form_name] = form;
+  _formGenerationData[form.form_renderer_id] = form;
 }
 
 #pragma mark - PasswordFormHelperDelegate
@@ -853,8 +855,8 @@
   self.notifyAutoSigninViewController = nil;
 }
 
-- (BOOL)canGeneratePasswordForForm:(NSString*)formName
-                   fieldIdentifier:(NSString*)fieldIdentifier
+- (BOOL)canGeneratePasswordForForm:(FormRendererId)formIdentifier
+                   fieldIdentifier:(FieldRendererId)fieldIdentifier
                          fieldType:(NSString*)fieldType {
   if (_passwordManagerClient->IsIncognito() ||
       !_passwordManagerDriver->GetPasswordGenerationHelper()
@@ -864,31 +866,30 @@
   if (![fieldType isEqual:kPasswordFieldType])
     return NO;
   const PasswordFormGenerationData* generation_data =
-      [self getFormForGenerationFromFormName:formName];
+      [self getFormForGenerationFromFormId:formIdentifier];
   if (!generation_data)
     return NO;
 
-  NSString* newPasswordIdentifier =
-      SysUTF16ToNSString(generation_data->new_password_element);
-  if ([fieldIdentifier isEqual:newPasswordIdentifier])
+  FieldRendererId newPasswordIdentifier =
+      generation_data->new_password_renderer_id;
+  if (fieldIdentifier == newPasswordIdentifier)
     return YES;
 
   // Don't show password generation if the field is 'confirm password'.
   return NO;
 }
 
-- (const PasswordFormGenerationData*)getFormForGenerationFromFormName:
-    (NSString*)formName {
-  const base::string16 name = SysNSStringToUTF16(formName);
-  if (_formGenerationData.find(name) != _formGenerationData.end()) {
-    return &_formGenerationData[name];
+- (const PasswordFormGenerationData*)getFormForGenerationFromFormId:
+    (FormRendererId)formIdentifier {
+  if (_formGenerationData.find(formIdentifier) != _formGenerationData.end()) {
+    return &_formGenerationData[formIdentifier];
   }
   return nullptr;
 }
 
-- (void)generatePasswordForFormName:(NSString*)formName
-                    fieldIdentifier:(NSString*)fieldIdentifier {
-  if (![self getFormForGenerationFromFormName:formName])
+- (void)generatePasswordForFormId:(FormRendererId)formIdentifier
+                  fieldIdentifier:(FieldRendererId)fieldIdentifier {
+  if (![self getFormForGenerationFromFormId:formIdentifier])
     return;
 
   // TODO(crbug.com/886583): pass correct |max_length|.
@@ -931,10 +932,10 @@
       addItemWithTitle:GetNSString(IDS_IOS_USE_SUGGESTED_PASSWORD)
                 action:^{
                   [weakSelf
-                      injectGeneratedPasswordForFormName:formName
-                                       generatedPassword:
-                                           weakSelf.generatedPotentialPassword
-                                       completionHandler:popupDismissed];
+                      injectGeneratedPasswordForFormId:formIdentifier
+                                     generatedPassword:
+                                         weakSelf.generatedPotentialPassword
+                                     completionHandler:popupDismissed];
                 }
                  style:UIAlertActionStyleDefault];
 
@@ -982,17 +983,19 @@
   [self.actionSheetCoordinator updateAttributedText];
 }
 
-- (void)injectGeneratedPasswordForFormName:(NSString*)formName
-                         generatedPassword:(NSString*)generatedPassword
-                         completionHandler:(void (^)())completionHandler {
+- (void)injectGeneratedPasswordForFormId:(FormRendererId)formIdentifier
+                       generatedPassword:(NSString*)generatedPassword
+                       completionHandler:(void (^)())completionHandler {
   const autofill::PasswordFormGenerationData* generation_data =
-      [self getFormForGenerationFromFormName:formName];
+      [self getFormForGenerationFromFormId:formIdentifier];
   if (!generation_data)
     return;
   NSString* newPasswordIdentifier =
       SysUTF16ToNSString(generation_data->new_password_element);
-  NSString* confirmPasswordIdentifier =
-      SysUTF16ToNSString(generation_data->confirmation_password_element);
+  FieldRendererId newPasswordUniqueId =
+      generation_data->new_password_renderer_id;
+  FieldRendererId confirmPasswordUniqueId =
+      generation_data->confirmation_password_renderer_id;
 
   auto generatedPasswordInjected = ^(BOOL success) {
     auto passwordPresaved = ^(BOOL found, const autofill::FormData& form) {
@@ -1006,18 +1009,18 @@
       // and here. There isn't much that can be done.
     };
     if (success) {
-      [self.formHelper extractPasswordFormData:formName
+      [self.formHelper extractPasswordFormData:formIdentifier
                              completionHandler:passwordPresaved];
       self.isPasswordGenerated = YES;
-      self.passwordGeneratedIdentifier = newPasswordIdentifier;
+      self.passwordGeneratedIdentifier = newPasswordUniqueId;
     }
     if (completionHandler)
       completionHandler();
   };
 
-  [self.formHelper fillPasswordForm:formName
-              newPasswordIdentifier:newPasswordIdentifier
-          confirmPasswordIdentifier:confirmPasswordIdentifier
+  [self.formHelper fillPasswordForm:formIdentifier
+              newPasswordIdentifier:newPasswordUniqueId
+          confirmPasswordIdentifier:confirmPasswordUniqueId
                   generatedPassword:generatedPassword
                   completionHandler:generatedPasswordInjected];
 }

diff --git a/ios/chrome/browser/passwords/password_controller_js_unittest.mm b/ios/chrome/browser/passwords/password_controller_js_unittest.mm
index 58faac28..ad1912a8 100644
--- a/ios/chrome/browser/passwords/password_controller_js_unittest.mm
+++ b/ios/chrome/browser/passwords/password_controller_js_unittest.mm

@@ -25,6 +25,12 @@
   PasswordControllerJsTest()
       : web::WebJsTest<web::WebTestWithWebState>(
             @[ @"chrome_bundle_all_frames", @"chrome_bundle_main_frame" ]) {}
+
+  void SetUpUniqueIDs() {
+    ExecuteJavaScript(@"__gCrWeb.fill.setUpForUniqueIDs(0);");
+    // Run password forms search to set up unique IDs.
+    EXPECT_TRUE(ExecuteJavaScript(@"__gCrWeb.passwords.findPasswordForms();"));
+  }
 };
 
 // IDs used in the Username and Password <input> elements.
@@ -80,9 +86,7 @@
   NSString* const username = @"john.doe@gmail.com";
   NSString* const password = @"super!secret";
   LoadHtmlAndInject(GAIASignInForm(formOrigin, username, YES), GURL(origin));
-  ExecuteJavaScript(@"__gCrWeb.fill.setUpForUniqueIDs(0);");
-  // Run password forms search to set up unique IDs.
-  EXPECT_TRUE(ExecuteJavaScript(@"__gCrWeb.passwords.findPasswordForms();"));
+  SetUpUniqueIDs();
   EXPECT_NSEQ(
       @YES, ExecuteJavaScriptWithFormat(
                 @"__gCrWeb.passwords.fillPasswordForm(%@, '%@', '%@')",
@@ -105,9 +109,7 @@
   NSString* const username2 = @"jean.dubois@gmail.com";
   NSString* const password = @"super!secret";
   LoadHtmlAndInject(GAIASignInForm(formOrigin, username1, YES), GURL(origin));
-  ExecuteJavaScript(@"__gCrWeb.fill.setUpForUniqueIDs(0);");
-  // Run password forms search to set up unique IDs.
-  EXPECT_TRUE(ExecuteJavaScript(@"__gCrWeb.passwords.findPasswordForms();"));
+  SetUpUniqueIDs();
   EXPECT_NSEQ(
       @NO, ExecuteJavaScriptWithFormat(
                @"__gCrWeb.passwords.fillPasswordForm(%@, '%@', '%@')",
@@ -130,9 +132,7 @@
   NSString* const username2 = @"jane.doe@gmail.com";
   NSString* const password = @"super!secret";
   LoadHtmlAndInject(GAIASignInForm(formOrigin, username1, NO), GURL(origin));
-  ExecuteJavaScript(@"__gCrWeb.fill.setUpForUniqueIDs(0);");
-  // Run password forms search to set up unique IDs.
-  EXPECT_TRUE(ExecuteJavaScript(@"__gCrWeb.passwords.findPasswordForms();"));
+  SetUpUniqueIDs();
   EXPECT_NSEQ(
       @YES, ExecuteJavaScriptWithFormat(
                 @"__gCrWeb.passwords.fillPasswordForm(%@, '%@', '%@')",
@@ -404,9 +404,7 @@
        "  <input type='submit' value='Submit'>"
        "</form>"
        "</body></html>");
-  ExecuteJavaScript(@"__gCrWeb.fill.setUpForUniqueIDs(0);");
-  // Run password forms search to set up unique IDs.
-  EXPECT_TRUE(ExecuteJavaScript(@"__gCrWeb.passwords.findPasswordForms();"));
+  SetUpUniqueIDs();
 
   NSString* const username = @"john.doe@gmail.com";
   NSString* const password = @"super!secret";
@@ -447,15 +445,16 @@
                      "    </form>"
                      "  </body"
                      "</html>");
-  NSString* const formName = @"bar";
+  SetUpUniqueIDs();
+
+  uint32_t formIdentifier = 404;
   NSString* const password = @"abc";
-  NSString* const newPasswordIdentifier = @"ps1";
-  EXPECT_NSEQ(
-      @NO,
-      ExecuteJavaScriptWithFormat(
-          @"__gCrWeb.passwords."
-          @"fillPasswordFormWithGeneratedPassword('%@',  '%@', '%@', '%@')",
-          formName, newPasswordIdentifier, @"", password));
+  uint32_t newPasswordIdentifier = 1;
+  EXPECT_NSEQ(@NO,
+              ExecuteJavaScriptWithFormat(
+                  @"__gCrWeb.passwords."
+                  @"fillPasswordFormWithGeneratedPassword(%d, %d, %d, '%@')",
+                  formIdentifier, newPasswordIdentifier, -1, password));
 }
 
 // Check that filling a form without password fields fails.
@@ -469,15 +468,17 @@
                      "    </form>"
                      "  </body"
                      "</html>");
-  NSString* const formName = @"foo";
+  SetUpUniqueIDs();
+
+  uint32_t formIdentifier = 0;
   NSString* const password = @"abc";
-  NSString* const newPasswordIdentifier = @"ps1";
-  NSString* const confirmPasswordIdentifier = @"ps2";
+  uint32_t const newPasswordIdentifier = 2;
+  uint32_t const confirmPasswordIdentifier = 3;
   EXPECT_NSEQ(
       @NO, ExecuteJavaScriptWithFormat(
                @"__gCrWeb.passwords."
-               @"fillPasswordFormWithGeneratedPassword('%@', '%@', '%@', '%@')",
-               formName, newPasswordIdentifier, confirmPasswordIdentifier,
+               @"fillPasswordFormWithGeneratedPassword(%d, %d, %d, '%@')",
+               formIdentifier, newPasswordIdentifier, confirmPasswordIdentifier,
                password));
 }
 
@@ -495,17 +496,18 @@
                      "    </form>"
                      "  </body"
                      "</html>");
-  NSString* const formName = @"foo";
+  SetUpUniqueIDs();
+
+  uint32_t formIdentifier = 0;
   NSString* const password = @"abc";
-  NSString* const newPasswordIdentifier = @"ps1";
-  NSString* const confirmPasswordIdentifier = @"ps2";
-  EXPECT_NSEQ(
-      @YES,
-      ExecuteJavaScriptWithFormat(
-          @"__gCrWeb.passwords."
-          @"fillPasswordFormWithGeneratedPassword('%@', '%@', '%@', '%@')",
-          formName, newPasswordIdentifier, confirmPasswordIdentifier,
-          password));
+  uint32_t const newPasswordIdentifier = 2;
+  uint32_t const confirmPasswordIdentifier = 3;
+  EXPECT_NSEQ(@YES,
+              ExecuteJavaScriptWithFormat(
+                  @"__gCrWeb.passwords."
+                  @"fillPasswordFormWithGeneratedPassword(%u, %u, %u, '%@')",
+                  formIdentifier, newPasswordIdentifier,
+                  confirmPasswordIdentifier, password));
   EXPECT_NSEQ(@YES,
               ExecuteJavaScriptWithFormat(
                   @"document.getElementById('ps1').value == '%@'", password));
@@ -532,15 +534,16 @@
                      "    </form>"
                      "  </body"
                      "</html>");
-  NSString* const formName = @"foo";
+  SetUpUniqueIDs();
+
+  uint32_t formIdentifier = 0;
   NSString* const password = @"abc";
-  NSString* const newPasswordIdentifier = @"ps1";
-  EXPECT_NSEQ(
-      @YES,
-      ExecuteJavaScriptWithFormat(
-          @"__gCrWeb.passwords."
-          @"fillPasswordFormWithGeneratedPassword('%@', '%@', '%@', '%@')",
-          formName, newPasswordIdentifier, @"", password));
+  uint32_t const newPasswordIdentifier = 2;
+  EXPECT_NSEQ(@YES,
+              ExecuteJavaScriptWithFormat(
+                  @"__gCrWeb.passwords."
+                  @"fillPasswordFormWithGeneratedPassword(%u, %u, %u, '%@')",
+                  formIdentifier, newPasswordIdentifier, -1, password));
   EXPECT_NSEQ(@YES,
               ExecuteJavaScriptWithFormat(
                   @"document.getElementById('ps1').value == '%@'", password));
@@ -566,14 +569,16 @@
                      "    </form>"
                      "  </body"
                      "</html>");
-  NSString* const formName = @"foo";
+  SetUpUniqueIDs();
+
+  uint32_t formIdentifier = 0;
   NSString* const password = @"abc";
-  NSString* const confirmPasswordIdentifier = @"ps2";
-  EXPECT_NSEQ(
-      @NO, ExecuteJavaScriptWithFormat(
-               @"__gCrWeb.passwords."
-               @"fillPasswordFormWithGeneratedPassword('%@', '%@', '%@', '%@')",
-               formName, @"", confirmPasswordIdentifier, password));
+  uint32_t const confirmPasswordIdentifier = 3;
+  EXPECT_NSEQ(@NO,
+              ExecuteJavaScriptWithFormat(
+                  @"__gCrWeb.passwords."
+                  @"fillPasswordFormWithGeneratedPassword(%u, %u, %u, '%@')",
+                  formIdentifier, -1, confirmPasswordIdentifier, password));
   EXPECT_NSEQ(@YES, ExecuteJavaScriptWithFormat(
                         @"document.getElementById('ps1').value == '%@'", @""));
   EXPECT_NSEQ(@YES, ExecuteJavaScriptWithFormat(
@@ -596,13 +601,15 @@
                      "    </form>"
                      "  </body"
                      "</html>");
-  NSString* const formName = @"foo";
+  SetUpUniqueIDs();
+
+  uint32_t formIdentifier = 0;
   NSString* const password = @"abc";
   EXPECT_NSEQ(
       @NO, ExecuteJavaScriptWithFormat(
                @"__gCrWeb.passwords."
-               @"fillPasswordFormWithGeneratedPassword('%@', '%@', null, '%@')",
-               formName, @"hello", password));
+               @"fillPasswordFormWithGeneratedPassword(%u, '%@', null, '%@')",
+               formIdentifier, @"hello", password));
   EXPECT_NSEQ(@YES, ExecuteJavaScriptWithFormat(
                         @"document.getElementById('ps1').value == '%@'", @""));
   EXPECT_NSEQ(@YES, ExecuteJavaScriptWithFormat(
@@ -620,9 +627,8 @@
        "  Password: <input type='password' name='password' id='password'>"
        "</form>"
        "</body></html>");
-  ExecuteJavaScript(@"__gCrWeb.fill.setUpForUniqueIDs(0);");
-  // Run password forms search to set up unique IDs.
-  EXPECT_TRUE(ExecuteJavaScript(@"__gCrWeb.passwords.findPasswordForms();"));
+  SetUpUniqueIDs();
+
   NSString* const password = @"super!secret";
   std::string page_origin = BaseUrl() + "origin1";
   std::string form_fill_data_origin = BaseUrl() + "origin2";

diff --git a/ios/chrome/browser/passwords/password_controller_unittest.mm b/ios/chrome/browser/passwords/password_controller_unittest.mm
index f39c265..9937cbc 100644
--- a/ios/chrome/browser/passwords/password_controller_unittest.mm
+++ b/ios/chrome/browser/passwords/password_controller_unittest.mm

@@ -1216,7 +1216,9 @@
     };
     [passwordController_ didSelectSuggestion:suggestion
                                         form:SysUTF8ToNSString(FormName(0))
+                                uniqueFormID:form_renderer_id
                              fieldIdentifier:@"u"
+                               uniqueFieldID:username_renderer_id
                                      frameID:SysUTF8ToNSString(mainFrameID)
                            completionHandler:completion];
     EXPECT_TRUE(

diff --git a/ios/chrome/common/app_group/app_group_metrics.h b/ios/chrome/common/app_group/app_group_metrics.h
index 3f52933..1175abb 100644
--- a/ios/chrome/common/app_group/app_group_metrics.h
+++ b/ios/chrome/common/app_group/app_group_metrics.h

@@ -58,6 +58,10 @@
 // selected a Password from the list since last Chrome launch.
 extern NSString* const kCredentialExtensionPasswordUseCount;
 
+// An app_group key to the number of times Credential Extension returned
+// a Password to the context without direct user intervention.
+extern NSString* const kCredentialExtensionQuickPasswordUseCount;
+
 // Offsets the sessionID to avoid collision. The sessionID is limited to 1<<23.
 int AppGroupSessionID(int sessionID, AppGroupApplications application);
 

diff --git a/ios/chrome/common/app_group/app_group_metrics.mm b/ios/chrome/common/app_group/app_group_metrics.mm
index fd80a76..caa08e7 100644
--- a/ios/chrome/common/app_group/app_group_metrics.mm
+++ b/ios/chrome/common/app_group/app_group_metrics.mm

@@ -44,6 +44,9 @@
 NSString* const kCredentialExtensionPasswordUseCount =
     @"CredentialExtensionPasswordUseCount";
 
+NSString* const kCredentialExtensionQuickPasswordUseCount =
+    @"CredentialExtensionQuickPasswordUseCount";
+
 // To avoid collision between session_ids from chrome or external
 // components, the session ID is offset depending on the application.
 int AppGroupSessionID(int session_id, AppGroupApplications application) {

diff --git a/ios/chrome/common/app_group/app_group_metrics_mainapp.mm b/ios/chrome/common/app_group/app_group_metrics_mainapp.mm
index c6e9e55..a7c1f8f2 100644
--- a/ios/chrome/common/app_group/app_group_metrics_mainapp.mm
+++ b/ios/chrome/common/app_group/app_group_metrics_mainapp.mm

@@ -6,7 +6,7 @@
 
 #include <stdint.h>
 
-#include "base/metrics/histogram_macros.h"
+#include "base/metrics/histogram_functions.h"
 #include "base/threading/scoped_blocking_call.h"
 #include "ios/chrome/common/app_group/app_group_constants.h"
 #include "ios/chrome/common/app_group/app_group_metrics.h"
@@ -23,14 +23,61 @@
   NSUserDefaults* shared_defaults = GetGroupUserDefaults();
   int content_extension_count =
       [shared_defaults integerForKey:kContentExtensionDisplayCount];
-  UMA_HISTOGRAM_COUNTS_1000("IOS.ContentExtension.DisplayCount",
-                            content_extension_count);
+  base::UmaHistogramCounts1000("IOS.ContentExtension.DisplayCount",
+                               content_extension_count);
   [shared_defaults setInteger:0 forKey:kContentExtensionDisplayCount];
   int search_extension_count =
       [shared_defaults integerForKey:kSearchExtensionDisplayCount];
-  UMA_HISTOGRAM_COUNTS_1000("IOS.SearchExtension.DisplayCount",
-                            search_extension_count);
+  base::UmaHistogramCounts1000("IOS.SearchExtension.DisplayCount",
+                               search_extension_count);
   [shared_defaults setInteger:0 forKey:kSearchExtensionDisplayCount];
+
+  int credential_extension_count =
+      [shared_defaults integerForKey:kCredentialExtensionDisplayCount];
+  base::UmaHistogramCounts1000("IOS.CredentialExtension.DisplayCount",
+                               credential_extension_count);
+  [shared_defaults setInteger:0 forKey:kCredentialExtensionDisplayCount];
+  int credential_extension_reauth_count =
+      [shared_defaults integerForKey:kCredentialExtensionReauthCount];
+  base::UmaHistogramCounts1000("IOS.CredentialExtension.ReauthCount",
+                               credential_extension_reauth_count);
+  [shared_defaults setInteger:0 forKey:kCredentialExtensionReauthCount];
+  int credential_extension_copy_url_count =
+      [shared_defaults integerForKey:kCredentialExtensionCopyURLCount];
+  base::UmaHistogramCounts1000("IOS.CredentialExtension.CopyURLCount",
+                               credential_extension_copy_url_count);
+  [shared_defaults setInteger:0 forKey:kCredentialExtensionCopyURLCount];
+  int credential_extension_copy_username_count =
+      [shared_defaults integerForKey:kCredentialExtensionCopyUsernameCount];
+  base::UmaHistogramCounts1000("IOS.CredentialExtension.CopyUsernameCount",
+                               credential_extension_copy_username_count);
+  [shared_defaults setInteger:0 forKey:kCredentialExtensionCopyUsernameCount];
+  int credential_extension_copy_password_count =
+      [shared_defaults integerForKey:kCredentialExtensionCopyPasswordCount];
+  base::UmaHistogramCounts1000("IOS.CredentialExtension.CopyPasswordCount",
+                               credential_extension_copy_password_count);
+  [shared_defaults setInteger:0 forKey:kCredentialExtensionCopyPasswordCount];
+  int credential_extension_show_password_count =
+      [shared_defaults integerForKey:kCredentialExtensionShowPasswordCount];
+  base::UmaHistogramCounts1000("IOS.CredentialExtension.ShowPasswordCount",
+                               credential_extension_show_password_count);
+  [shared_defaults setInteger:0 forKey:kCredentialExtensionShowPasswordCount];
+  int credential_extension_search_count =
+      [shared_defaults integerForKey:kCredentialExtensionSearchCount];
+  base::UmaHistogramCounts1000("IOS.CredentialExtension.SearchCount",
+                               credential_extension_search_count);
+  [shared_defaults setInteger:0 forKey:kCredentialExtensionSearchCount];
+  int credential_extension_password_use_count =
+      [shared_defaults integerForKey:kCredentialExtensionPasswordUseCount];
+  base::UmaHistogramCounts1000("IOS.CredentialExtension.PasswordUseCount",
+                               credential_extension_password_use_count);
+  [shared_defaults setInteger:0 forKey:kCredentialExtensionPasswordUseCount];
+  int credential_extension_quick_password_use_count =
+      [shared_defaults integerForKey:kCredentialExtensionQuickPasswordUseCount];
+  base::UmaHistogramCounts1000("IOS.CredentialExtension.QuickPasswordUseCount",
+                               credential_extension_quick_password_use_count);
+  [shared_defaults setInteger:0
+                       forKey:kCredentialExtensionQuickPasswordUseCount];
 }
 
 void ProcessPendingLogs(ProceduralBlockWithData callback) {

diff --git a/ios/chrome/credential_provider_extension/credential_provider_view_controller.mm b/ios/chrome/credential_provider_extension/credential_provider_view_controller.mm
index ed47a688..13878a73 100644
--- a/ios/chrome/credential_provider_extension/credential_provider_view_controller.mm
+++ b/ios/chrome/credential_provider_extension/credential_provider_view_controller.mm

@@ -167,6 +167,8 @@
     NSString* password =
         PasswordWithKeychainIdentifier(credential.keychainIdentifier);
     if (password) {
+      UpdateUMACountForKey(
+          app_group::kCredentialExtensionQuickPasswordUseCount);
       ASPasswordCredential* ASCredential =
           [ASPasswordCredential credentialWithUser:credential.user
                                           password:password];

diff --git a/ios/web_view/internal/autofill/cwv_autofill_controller.mm b/ios/web_view/internal/autofill/cwv_autofill_controller.mm
index b22cb79..6234ac32 100644
--- a/ios/web_view/internal/autofill/cwv_autofill_controller.mm
+++ b/ios/web_view/internal/autofill/cwv_autofill_controller.mm

@@ -303,7 +303,9 @@
   } else {
     [_autofillAgent didSelectSuggestion:suggestion.formSuggestion
                                    form:suggestion.formName
+                           uniqueFormID:_lastFormActivityUniqueFormID
                         fieldIdentifier:suggestion.fieldIdentifier
+                          uniqueFieldID:_lastFormActivityUniqueFieldID
                                 frameID:suggestion.frameID
                       completionHandler:^{
                         if (completionHandler) {

diff --git a/media/fuchsia/camera/fake_fuchsia_camera.cc b/media/fuchsia/camera/fake_fuchsia_camera.cc
index 0f592c7..921a1b6 100644
--- a/media/fuchsia/camera/fake_fuchsia_camera.cc
+++ b/media/fuchsia/camera/fake_fuchsia_camera.cc

@@ -17,6 +17,8 @@
 
 namespace {
 
+constexpr uint64_t kDefaultFakeDeviceId = 42;
+
 constexpr uint8_t kYPlaneSalt = 1;
 constexpr uint8_t kUPlaneSalt = 2;
 constexpr uint8_t kVPlaneSalt = 3;
@@ -474,4 +476,42 @@
   ADD_FAILURE() << "NotImplemented_: " << name;
 }
 
+FakeCameraDeviceWatcher::FakeCameraDeviceWatcher(
+    sys::OutgoingDirectory* outgoing_directory) {
+  outgoing_directory->AddPublicService<fuchsia::camera3::DeviceWatcher>(
+      [this](fidl::InterfaceRequest<fuchsia::camera3::DeviceWatcher> request) {
+        bindings_.AddBinding(std::make_unique<Client>(&device_),
+                             std::move(request));
+      });
+}
+
+FakeCameraDeviceWatcher::~FakeCameraDeviceWatcher() = default;
+
+FakeCameraDeviceWatcher::Client::Client(FakeCameraDevice* device)
+    : device_(device) {}
+FakeCameraDeviceWatcher::Client::~Client() {}
+
+void FakeCameraDeviceWatcher::Client::WatchDevices(
+    WatchDevicesCallback callback) {
+  if (devices_sent_)
+    return;
+
+  std::vector<fuchsia::camera3::WatchDevicesEvent> events(1);
+  events[0].set_added(kDefaultFakeDeviceId);
+  callback(std::move(events));
+
+  devices_sent_ = true;
+}
+
+void FakeCameraDeviceWatcher::Client::ConnectToDevice(
+    uint64_t id,
+    fidl::InterfaceRequest<fuchsia::camera3::Device> request) {
+  if (id == kDefaultFakeDeviceId)
+    device_->Bind(std::move(request));
+}
+
+void FakeCameraDeviceWatcher::Client::NotImplemented_(const std::string& name) {
+  ADD_FAILURE() << "NotImplemented_: " << name;
+}
+
 }  // namespace media
\ No newline at end of file

diff --git a/media/fuchsia/camera/fake_fuchsia_camera.h b/media/fuchsia/camera/fake_fuchsia_camera.h
index 591082d..016c68d0 100644
--- a/media/fuchsia/camera/fake_fuchsia_camera.h
+++ b/media/fuchsia/camera/fake_fuchsia_camera.h

@@ -8,6 +8,8 @@
 #include <fuchsia/camera3/cpp/fidl.h>
 #include <fuchsia/camera3/cpp/fidl_test_base.h>
 #include <lib/fidl/cpp/binding.h>
+#include <lib/fidl/cpp/binding_set.h>
+#include <lib/sys/cpp/outgoing_directory.h>
 
 #include <vector>
 
@@ -149,6 +151,44 @@
   FakeCameraStream* const stream_;
 };
 
+class FakeCameraDeviceWatcher {
+ public:
+  explicit FakeCameraDeviceWatcher(sys::OutgoingDirectory* outgoing_directory);
+  ~FakeCameraDeviceWatcher();
+
+  FakeCameraDeviceWatcher(const FakeCameraDeviceWatcher&) = delete;
+  FakeCameraDeviceWatcher& operator=(const FakeCameraDeviceWatcher&) = delete;
+
+ private:
+  class Client : public fuchsia::camera3::testing::DeviceWatcher_TestBase {
+   public:
+    explicit Client(FakeCameraDevice* device);
+    ~Client() final;
+
+    Client(const Client&) = delete;
+    Client& operator=(const Client&) = delete;
+
+    // fuchsia::camera3::testing::DeviceWatcher_TestBase override.
+    void NotImplemented_(const std::string& name) final;
+
+    // fuchsia::camera3::DeviceWatcher implementation.
+    void WatchDevices(WatchDevicesCallback callback) final;
+    void ConnectToDevice(
+        uint64_t id,
+        fidl::InterfaceRequest<fuchsia::camera3::Device> request) final;
+
+   private:
+    bool devices_sent_ = false;
+    FakeCameraDevice* const device_;
+  };
+
+  fidl::BindingSet<fuchsia::camera3::DeviceWatcher, std::unique_ptr<Client>>
+      bindings_;
+
+  FakeCameraStream stream_;
+  FakeCameraDevice device_{&stream_};
+};
+
 }  // namespace media
 
 #endif  // MEDIA_FUCHSIA_CAMERA_FAKE_FUCHSIA_CAMERA_H_

diff --git a/net/quic/quic_flags_list.h b/net/quic/quic_flags_list.h
index 2ae5a88b..e90d9ee3 100644
--- a/net/quic/quic_flags_list.h
+++ b/net/quic/quic_flags_list.h

@@ -393,3 +393,25 @@
 
 // If true, support for IETF QUIC 0-rtt is enabled.
 QUIC_FLAG(bool, FLAGS_quic_reloadable_flag_quic_enable_zero_rtt_for_tls, false)
+
+// If true, default on PTO which unifies TLP + RTO loss recovery.
+QUIC_FLAG(bool, FLAGS_quic_reloadable_flag_quic_default_on_pto, false)
+
+// When true, QUIC+TLS will not send nor parse the old-format Google-specific
+// transport parameters.
+QUIC_FLAG(bool,
+          FLAGS_quic_restart_flag_quic_google_transport_param_omit_old,
+          false)
+
+// When true, QUIC+TLS will send and parse the new-format Google-specific
+// transport parameters.
+QUIC_FLAG(bool,
+          FLAGS_quic_restart_flag_quic_google_transport_param_send_new,
+          true)
+
+// If true, if a buffered MTU packet causes a write to return MSG_TOO_BIG, this
+// error will be ignored.
+QUIC_FLAG(
+    bool,
+    FLAGS_quic_reloadable_flag_quic_ignore_msg_too_big_from_buffered_packets,
+    true)

diff --git a/ppapi/BUILD.gn b/ppapi/BUILD.gn
index 56590dec..ad1525f1 100644
--- a/ppapi/BUILD.gn
+++ b/ppapi/BUILD.gn

@@ -452,7 +452,7 @@
       ":ppapi_nacl_tests(//build/toolchain/nacl:newlib_pnacl)",
     ]
 
-    if (target_cpu != "mipsel" && !is_mac) {
+    if (target_cpu != "mipsel" && !is_mac && !is_win) {
       data_deps +=
           [ ":ppapi_nacl_tests(//build/toolchain/nacl:glibc_${target_cpu})" ]
     }

diff --git a/services/network/network_context.cc b/services/network/network_context.cc
index 9ab4981..ba936e8d 100644
--- a/services/network/network_context.cc
+++ b/services/network/network_context.cc

@@ -370,6 +370,19 @@
   }
 
   InitializeCorsParams();
+
+  SetSplitAuthCacheByNetworkIsolationKey(
+      params_->split_auth_cache_by_network_isolation_key);
+
+#if BUILDFLAG(IS_CT_SUPPORTED)
+  if (params_->ct_policy)
+    SetCTPolicy(std::move(params_->ct_policy));
+#endif
+
+#if defined(OS_ANDROID)
+  if (params_->cookie_manager)
+    GetCookieManager(std::move(params_->cookie_manager));
+#endif
 }
 
 NetworkContext::NetworkContext(
@@ -950,16 +963,13 @@
 #endif  // defined(OS_CHROMEOS)
 
 #if BUILDFLAG(IS_CT_SUPPORTED)
-void NetworkContext::SetCTPolicy(
-    const std::vector<std::string>& required_hosts,
-    const std::vector<std::string>& excluded_hosts,
-    const std::vector<std::string>& excluded_spkis,
-    const std::vector<std::string>& excluded_legacy_spkis) {
+void NetworkContext::SetCTPolicy(mojom::CTPolicyPtr ct_policy) {
   if (!require_ct_delegate_)
     return;
 
-  require_ct_delegate_->UpdateCTPolicies(required_hosts, excluded_hosts,
-                                         excluded_spkis, excluded_legacy_spkis);
+  require_ct_delegate_->UpdateCTPolicies(
+      ct_policy->required_hosts, ct_policy->excluded_hosts,
+      ct_policy->excluded_spkis, ct_policy->excluded_legacy_spkis);
 }
 
 void NetworkContext::AddExpectCT(const std::string& domain,

diff --git a/services/network/network_context.h b/services/network/network_context.h
index 2a3d8440..932ca19 100644
--- a/services/network/network_context.h
+++ b/services/network/network_context.h

@@ -44,6 +44,7 @@
 #include "services/network/public/mojom/cookie_access_observer.mojom.h"
 #include "services/network/public/mojom/cookie_manager.mojom-shared.h"
 #include "services/network/public/mojom/host_resolver.mojom.h"
+#include "services/network/public/mojom/network_context.mojom-forward.h"
 #include "services/network/public/mojom/network_context.mojom.h"
 #include "services/network/public/mojom/origin_policy_manager.mojom.h"
 #include "services/network/public/mojom/proxy_lookup_client.mojom.h"
@@ -245,11 +246,7 @@
       mojom::AdditionalCertificatesPtr additional_certificates) override;
 #endif
 #if BUILDFLAG(IS_CT_SUPPORTED)
-  void SetCTPolicy(
-      const std::vector<std::string>& required_hosts,
-      const std::vector<std::string>& excluded_hosts,
-      const std::vector<std::string>& excluded_spkis,
-      const std::vector<std::string>& excluded_legacy_spkis) override;
+  void SetCTPolicy(mojom::CTPolicyPtr ct_policy) override;
   void AddExpectCT(const std::string& domain,
                    base::Time expiry,
                    bool enforce,

diff --git a/services/network/public/mojom/network_context.mojom b/services/network/public/mojom/network_context.mojom
index fb829746..3dcca6a5 100644
--- a/services/network/public/mojom/network_context.mojom
+++ b/services/network/public/mojom/network_context.mojom

@@ -190,6 +190,14 @@
      = DefaultCredentials.ALLOW_DEFAULT_CREDENTIALS;
 };
 
+[EnableIf=is_ct_supported]
+struct CTPolicy {
+  array<string> required_hosts;
+  array<string> excluded_hosts;
+  array<string> excluded_spkis;
+  array<string> excluded_legacy_spkis;
+};
+
 // Parameters for constructing a network context.
 struct NetworkContextParams {
   // Name used by memory tools to identify the context.
@@ -353,6 +361,11 @@
   [EnableIf=is_ct_supported]
   array<CTLogInfo> ct_logs;
 
+  // The initial CT policy to be used for requests. See
+  // NetworkContext.SetCTPolicy() for more.
+  [EnableIf=is_ct_supported]
+  CTPolicy? ct_policy;
+
   // When the Certificate Transparency logs in |ct_logs| were last updated. If
   // |enforce_chrome_ct_policy| is set, and |ct_log_update_time| is not
   // sufficiently recent, enforcement of the "Certificate Transparency in
@@ -371,6 +384,11 @@
   // Parameters for constructing the cookie manager.
   CookieManagerParams? cookie_manager_params;
 
+  // Binds to the cookie manager associated with this network context, which
+  // should only be handed out to trusted processes.
+  [EnableIf=is_android]
+  pending_receiver<CookieManager>? cookie_manager;
+
   // Whether to enable Domain Reliability.
   bool enable_domain_reliability = false;
 
@@ -451,6 +469,9 @@
   // A reset throws out all existing cache content when loading the cache,
   // effectively starting with an empty cache.
   bool reset_http_cache_backend = false;
+
+  // See comments on NetworkContext.SetSplitAuthCacheByNetworkIsolationKey.
+  bool split_auth_cache_by_network_isolation_key = false;
 };
 
 struct NetworkConditions {
@@ -986,10 +1007,7 @@
   // TODO(rsleevi): Remove this once Chrome-specific policies are moved out
   // of the network service.
   [EnableIf=is_ct_supported]
-  SetCTPolicy(array<string> required_hosts,
-              array<string> excluded_hosts,
-              array<string> excluded_spkis,
-              array<string> excluded_legacy_spkis);
+  SetCTPolicy(CTPolicy ct_policy);
 
   // Adds explicitly-specified data as if it was processed from an Expect-CT
   // header.

diff --git a/services/network/test/test_network_context.h b/services/network/test/test_network_context.h
index 251874a..eff66d99 100644
--- a/services/network/test/test_network_context.h
+++ b/services/network/test/test_network_context.h

@@ -21,6 +21,7 @@
 #include "services/network/public/mojom/cookie_access_observer.mojom.h"
 #include "services/network/public/mojom/cookie_manager.mojom.h"
 #include "services/network/public/mojom/host_resolver.mojom.h"
+#include "services/network/public/mojom/network_context.mojom-forward.h"
 #include "services/network/public/mojom/network_service.mojom.h"
 #include "services/network/public/mojom/proxy_resolving_socket.mojom.h"
 #include "services/network/public/mojom/restricted_cookie_manager.mojom.h"
@@ -111,11 +112,7 @@
       mojom::AdditionalCertificatesPtr additional_certificates) override {}
 #endif
 #if BUILDFLAG(IS_CT_SUPPORTED)
-  void SetCTPolicy(
-      const std::vector<std::string>& required_hosts,
-      const std::vector<std::string>& excluded_hosts,
-      const std::vector<std::string>& excluded_spkis,
-      const std::vector<std::string>& excluded_legacy_spkis) override {}
+  void SetCTPolicy(mojom::CTPolicyPtr ct_policy) override {}
   void AddExpectCT(const std::string& domain,
                    base::Time expiry,
                    bool enforce,

diff --git a/testing/buildbot/filters/fuchsia.content_unittests.filter b/testing/buildbot/filters/fuchsia.content_unittests.filter
index 2db06d98..fe07903 100644
--- a/testing/buildbot/filters/fuchsia.content_unittests.filter
+++ b/testing/buildbot/filters/fuchsia.content_unittests.filter

@@ -39,7 +39,7 @@
 -LevelDBTransactionRangeTests/LevelDBTransactionRangeTest.*
 
 # Flaky: https://crbug.com/780508.
--ServiceWorkerProviderHostTest.*
+-ServiceWorkerContainerHostTest.*
 
 # Flaky, https://crbug.com/784449.
 -WebContentsAudioInputStreamTest.MirroringOneStreamAfterTargetChange*

diff --git a/third_party/blink/public/web/web_settings.h b/third_party/blink/public/web/web_settings.h
index 9a47e89b9..51ec819 100644
--- a/third_party/blink/public/web/web_settings.h
+++ b/third_party/blink/public/web/web_settings.h

@@ -244,6 +244,7 @@
   virtual void SetTextAreasAreResizable(bool) = 0;
   virtual void SetTextAutosizingEnabled(bool) = 0;
   virtual void SetAccessibilityFontScaleFactor(float) = 0;
+  virtual void SetAccessibilityAlwaysShowFocus(bool) = 0;
   virtual void SetTextTrackKindUserPreference(TextTrackKindUserPreference) = 0;
   virtual void SetTextTrackBackgroundColor(const WebString&) = 0;
   virtual void SetTextTrackFontFamily(const WebString&) = 0;

diff --git a/third_party/blink/renderer/bindings/idl_in_modules.gni b/third_party/blink/renderer/bindings/idl_in_modules.gni
index 2c79c50..eb0c40b5 100644
--- a/third_party/blink/renderer/bindings/idl_in_modules.gni
+++ b/third_party/blink/renderer/bindings/idl_in_modules.gni

@@ -913,6 +913,7 @@
           "//third_party/blink/renderer/modules/websockets/websocket_connection.idl",
           "//third_party/blink/renderer/modules/websockets/websocket_stream.idl",
           "//third_party/blink/renderer/modules/websockets/websocket_stream_options.idl",
+          "//third_party/blink/renderer/modules/webtransport/bidirectional_stream.idl",
           "//third_party/blink/renderer/modules/webtransport/quic_transport.idl",
           "//third_party/blink/renderer/modules/webtransport/receive_stream.idl",
           "//third_party/blink/renderer/modules/webtransport/send_stream.idl",

diff --git a/third_party/blink/renderer/bindings/scripts/bind_gen/dictionary.py b/third_party/blink/renderer/bindings/scripts/bind_gen/dictionary.py
index ea908e8..851d5ea 100644
--- a/third_party/blink/renderer/bindings/scripts/bind_gen/dictionary.py
+++ b/third_party/blink/renderer/bindings/scripts/bind_gen/dictionary.py

@@ -169,6 +169,22 @@
             source_class_fwd_decls, source_struct_fwd_decls)
 
 
+def make_dict_constructors(cg_context):
+    decls = ListNode()
+    defs = ListNode()
+
+    dictionary = cg_context.dictionary
+    class_name = blink_class_name(dictionary)
+
+    ctor_decl = CxxFuncDeclNode(name=class_name,
+                                arg_decls=[],
+                                return_type="",
+                                default=True)
+    decls.append(ctor_decl)
+
+    return decls, defs
+
+
 def make_dict_member_get(cg_context):
     assert isinstance(cg_context, CodeGenContext)
 
@@ -742,8 +758,7 @@
     create_decl, create_def = make_dict_create_funcs(cg_context)
 
     # Constructor and destructor
-    constructor_decl = CxxFuncDeclNode(
-        name=cg_context.class_name, arg_decls=[], return_type="", default=True)
+    constructor_decls, constructor_defs = make_dict_constructors(cg_context)
     destructor_decl = CxxFuncDeclNode(
         name="~${class_name}", arg_decls=[], return_type="", default=True)
 
@@ -833,7 +848,7 @@
     header_blink_ns.body.append(class_def)
     class_def.public_section.extend([
         create_decl,
-        constructor_decl,
+        constructor_decls,
         destructor_decl,
         TextNode(""),
         trace_decl,
@@ -857,6 +872,8 @@
         member_presense_var_defs,
     ])
     source_blink_ns.body.extend([
+        constructor_defs,
+        TextNode(""),
         get_v8_member_names_def,
         TextNode(""),
         create_def,

diff --git a/third_party/blink/renderer/bindings/scripts/bind_gen/interface.py b/third_party/blink/renderer/bindings/scripts/bind_gen/interface.py
index 3d84a29..b3fb8ff1 100644
--- a/third_party/blink/renderer/bindings/scripts/bind_gen/interface.py
+++ b/third_party/blink/renderer/bindings/scripts/bind_gen/interface.py

@@ -5804,7 +5804,7 @@
   ${class_name}::{}(
       context, world, instance_object, prototype_object, interface_object,
       interface_template,
-      bindings::V8InterfaceBridgeBase::FeatureSelector(world));
+      bindings::V8InterfaceBridgeBase::FeatureSelector());
 }}
 """
         wrapper_type_info_def.append(
@@ -6645,7 +6645,7 @@
 v8::Local<v8::Object> prototype_object;
 v8::Local<v8::Function> interface_object;
 v8::Local<v8::FunctionTemplate> interface_template;
-V8InterfaceBridgeBase::FeatureSelector feature_selector(world, feature);
+V8InterfaceBridgeBase::FeatureSelector feature_selector(feature);
 
 for (const auto& pair : wrapper_type_info_list) {
   const WrapperTypeInfo* wrapper_type_info = pair.first;

diff --git a/third_party/blink/renderer/core/css/css_properties.json5 b/third_party/blink/renderer/core/css/css_properties.json5
index 4121f2e..4982b99 100644
--- a/third_party/blink/renderer/core/css/css_properties.json5
+++ b/third_party/blink/renderer/core/css/css_properties.json5

@@ -2728,10 +2728,11 @@
       property_methods: ["ParseSingleValue", "CSSValueFromComputedStyleInternal"],
       interpolable: true,
       field_group: "*",
-      field_template: "primitive",
-      default_value: "0",
-      type_name: "int",
-      converter: "ConvertComputedLength<int>",
+      field_template: "external",
+      include_paths: ["third_party/blink/renderer/platform/geometry/layout_unit.h"],
+      default_value: "LayoutUnit(0)",
+      type_name: "LayoutUnit",
+      converter: "ConvertLayoutUnit",
       typedom_types: ["Length"],
       valid_for_cue: true,
     },

diff --git a/third_party/blink/renderer/core/css/properties/longhands/custom_property.cc b/third_party/blink/renderer/core/css/properties/longhands/custom_property.cc
index bf022a5a..74da284 100644
--- a/third_party/blink/renderer/core/css/properties/longhands/custom_property.cc
+++ b/third_party/blink/renderer/core/css/properties/longhands/custom_property.cc

@@ -15,6 +15,16 @@
 
 namespace blink {
 
+namespace {
+
+CSSProperty::Flags InheritedFlag(const PropertyRegistration* registration) {
+  if (!registration || registration->Inherits())
+    return CSSProperty::kInherited;
+  return 0;
+}
+
+}  // namespace
+
 CustomProperty::CustomProperty(const AtomicString& name,
                                const Document& document)
     : CustomProperty(
@@ -27,7 +37,8 @@
 
 CustomProperty::CustomProperty(const AtomicString& name,
                                const PropertyRegistration* registration)
-    : Variable(!registration || registration->Inherits()),
+    : Variable(InheritedFlag(registration) |
+               CSSProperty::kComputedValueComparable),
       name_(name),
       registration_(registration) {}
 
@@ -153,6 +164,20 @@
   }
 }
 
+bool CustomProperty::ComputedValuesEqual(const ComputedStyle& a,
+                                         const ComputedStyle& b) const {
+  if (registration_) {
+    const CSSValue* a_value = a.GetVariableValue(name_, IsInherited());
+    const CSSValue* b_value = b.GetVariableValue(name_, IsInherited());
+    if (!DataEquivalent(a_value, b_value))
+      return false;
+  }
+
+  CSSVariableData* a_data = a.GetVariableData(name_, IsInherited());
+  CSSVariableData* b_data = b.GetVariableData(name_, IsInherited());
+  return DataEquivalent(a_data, b_data);
+}
+
 const CSSValue* CustomProperty::CSSValueFromComputedStyleInternal(
     const ComputedStyle& style,
     const SVGComputedStyle&,

diff --git a/third_party/blink/renderer/core/css/properties/longhands/custom_property.h b/third_party/blink/renderer/core/css/properties/longhands/custom_property.h
index 1e498cd3..28b2991 100644
--- a/third_party/blink/renderer/core/css/properties/longhands/custom_property.h
+++ b/third_party/blink/renderer/core/css/properties/longhands/custom_property.h

@@ -41,6 +41,9 @@
                                    const CSSParserContext&,
                                    const CSSParserLocalContext&) const override;
 
+  bool ComputedValuesEqual(const ComputedStyle&,
+                           const ComputedStyle&) const override;
+
   const CSSValue* CSSValueFromComputedStyleInternal(
       const ComputedStyle&,
       const SVGComputedStyle&,

diff --git a/third_party/blink/renderer/core/css/properties/longhands/custom_property_test.cc b/third_party/blink/renderer/core/css/properties/longhands/custom_property_test.cc
index 9819322..1b206d5 100644
--- a/third_party/blink/renderer/core/css/properties/longhands/custom_property_test.cc
+++ b/third_party/blink/renderer/core/css/properties/longhands/custom_property_test.cc

@@ -29,9 +29,13 @@
     UpdateAllLifecyclePhasesForTest();
   }
 
-  const CSSValue* GetComputedValue(const CustomProperty& property) {
+  const ComputedStyle& GetComputedStyle() {
     Element* node = GetDocument().getElementById("target");
-    return property.CSSValueFromComputedStyle(node->ComputedStyleRef(),
+    return node->ComputedStyleRef();
+  }
+
+  const CSSValue* GetComputedValue(const CustomProperty& property) {
+    return property.CSSValueFromComputedStyle(GetComputedStyle(),
                                               nullptr /* layout_object */,
                                               false /* allow_visited_style */);
   }
@@ -82,6 +86,38 @@
   EXPECT_EQ(AtomicString("--x"), property.GetPropertyNameAtomicString());
 }
 
+TEST_F(CustomPropertyTest, ComputedValuesEqual) {
+  RegisterProperty(GetDocument(), "--y", "<length>", "100px", false);
+
+  CustomProperty x("--x", GetDocument());
+  CustomProperty y("--y", GetDocument());
+
+  SetElementWithStyle("--x:foo;--y:10px");
+  auto style1 = ComputedStyle::Clone(GetComputedStyle());
+
+  SetElementWithStyle("--x:foo;--y:10px");
+  auto style2 = ComputedStyle::Clone(GetComputedStyle());
+
+  SetElementWithStyle("--x:bar;--y:30px");
+  auto style3 = ComputedStyle::Clone(GetComputedStyle());
+
+  ASSERT_TRUE(x.IsComputedValueComparable());
+  EXPECT_TRUE(x.ComputedValuesEqual(*style1, *style1));
+  EXPECT_TRUE(x.ComputedValuesEqual(*style2, *style2));
+  EXPECT_TRUE(x.ComputedValuesEqual(*style1, *style2));
+  EXPECT_TRUE(x.ComputedValuesEqual(*style2, *style1));
+  EXPECT_FALSE(x.ComputedValuesEqual(*style1, *style3));
+  EXPECT_FALSE(x.ComputedValuesEqual(*style2, *style3));
+
+  ASSERT_TRUE(y.IsComputedValueComparable());
+  EXPECT_TRUE(y.ComputedValuesEqual(*style1, *style1));
+  EXPECT_TRUE(y.ComputedValuesEqual(*style2, *style2));
+  EXPECT_TRUE(y.ComputedValuesEqual(*style1, *style2));
+  EXPECT_TRUE(y.ComputedValuesEqual(*style2, *style1));
+  EXPECT_FALSE(y.ComputedValuesEqual(*style1, *style3));
+  EXPECT_FALSE(y.ComputedValuesEqual(*style2, *style3));
+}
+
 TEST_F(CustomPropertyTest, ComputedCSSValueUnregistered) {
   CustomProperty property("--x", GetDocument());
   SetElementWithStyle("--x:foo");

diff --git a/third_party/blink/renderer/core/css/properties/longhands/variable.h b/third_party/blink/renderer/core/css/properties/longhands/variable.h
index db5c776..012dc77 100644
--- a/third_party/blink/renderer/core/css/properties/longhands/variable.h
+++ b/third_party/blink/renderer/core/css/properties/longhands/variable.h

@@ -33,10 +33,9 @@
   static bool IsStaticInstance(const CSSProperty&);
 
  protected:
-  constexpr Variable(bool inherited)
+  explicit constexpr Variable(CSSProperty::Flags flags)
       : Longhand(CSSPropertyID::kVariable,
-                 kProperty | (inherited ? kInherited : 0) |
-                     kValidForFirstLetter | kValidForMarker,
+                 kProperty | kValidForFirstLetter | kValidForMarker | flags,
                  '\0') {}
 };
 

diff --git a/third_party/blink/renderer/core/css/resolver/matched_properties_cache.cc b/third_party/blink/renderer/core/css/resolver/matched_properties_cache.cc
index 1c62dec8..f4b7788 100644
--- a/third_party/blink/renderer/core/css/resolver/matched_properties_cache.cc
+++ b/third_party/blink/renderer/core/css/resolver/matched_properties_cache.cc

@@ -33,9 +33,16 @@
 #include "third_party/blink/renderer/core/css/css_property_value_set.h"
 #include "third_party/blink/renderer/core/css/resolver/style_resolver_state.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
+#include "third_party/blink/renderer/platform/wtf/text/string_hasher.h"
 
 namespace blink {
 
+static unsigned ComputeMatchedPropertiesHash(const MatchResult& result) {
+  const MatchedPropertiesVector& vector = result.GetMatchedProperties();
+  return StringHasher::HashMemory(vector.data(),
+                                  sizeof(MatchedProperties) * vector.size());
+}
+
 void CachedMatchedProperties::Set(const ComputedStyle& style,
                                   const ComputedStyle& parent_style,
                                   const MatchedPropertiesVector& properties) {
@@ -59,19 +66,22 @@
 
 MatchedPropertiesCache::MatchedPropertiesCache() = default;
 
-const CachedMatchedProperties* MatchedPropertiesCache::Find(
-    unsigned hash,
-    const StyleResolverState& style_resolver_state,
-    const MatchedPropertiesVector& properties) {
-  DCHECK(hash);
+MatchedPropertiesCache::Key::Key(const MatchResult& result)
+    : result_(result),
+      hash_(result.IsCacheable() ? ComputeMatchedPropertiesHash(result) : 0) {}
 
-  Cache::iterator it = cache_.find(hash);
+const CachedMatchedProperties* MatchedPropertiesCache::Find(
+    const Key& key,
+    const StyleResolverState& style_resolver_state) {
+  DCHECK(key.IsValid());
+  DCHECK(key.hash_);
+  Cache::iterator it = cache_.find(key.hash_);
   if (it == cache_.end())
     return nullptr;
   CachedMatchedProperties* cache_item = it->value.Get();
   if (!cache_item)
     return nullptr;
-  if (*cache_item != properties)
+  if (*cache_item != key.result_.GetMatchedProperties())
     return nullptr;
   if (cache_item->computed_style->InsideLink() !=
       style_resolver_state.Style()->InsideLink())
@@ -104,12 +114,12 @@
   return !(*this == properties);
 }
 
-void MatchedPropertiesCache::Add(const ComputedStyle& style,
-                                 const ComputedStyle& parent_style,
-                                 unsigned hash,
-                                 const MatchedPropertiesVector& properties) {
-  DCHECK(hash);
-  Cache::AddResult add_result = cache_.insert(hash, nullptr);
+void MatchedPropertiesCache::Add(const Key& key,
+                                 const ComputedStyle& style,
+                                 const ComputedStyle& parent_style) {
+  DCHECK(key.IsValid());
+  DCHECK(key.hash_);
+  Cache::AddResult add_result = cache_.insert(key.hash_, nullptr);
   if (add_result.is_new_entry || !add_result.stored_value->value) {
     add_result.stored_value->value =
         MakeGarbageCollected<CachedMatchedProperties>();
@@ -119,7 +129,7 @@
   if (!add_result.is_new_entry)
     cache_item->Clear();
 
-  cache_item->Set(style, parent_style, properties);
+  cache_item->Set(style, parent_style, key.result_.GetMatchedProperties());
 }
 
 void MatchedPropertiesCache::Clear() {

diff --git a/third_party/blink/renderer/core/css/resolver/matched_properties_cache.h b/third_party/blink/renderer/core/css/resolver/matched_properties_cache.h
index 750a969..ed6d106 100644
--- a/third_party/blink/renderer/core/css/resolver/matched_properties_cache.h
+++ b/third_party/blink/renderer/core/css/resolver/matched_properties_cache.h

@@ -67,13 +67,21 @@
   MatchedPropertiesCache();
   ~MatchedPropertiesCache() { DCHECK(cache_.IsEmpty()); }
 
-  const CachedMatchedProperties* Find(unsigned hash,
-                                      const StyleResolverState&,
-                                      const MatchedPropertiesVector&);
-  void Add(const ComputedStyle&,
-           const ComputedStyle& parent_style,
-           unsigned hash,
-           const MatchedPropertiesVector&);
+  class CORE_EXPORT Key {
+    STACK_ALLOCATED();
+
+   public:
+    explicit Key(const MatchResult&);
+    bool IsValid() const { return hash_ != 0; }
+
+   private:
+    friend class MatchedPropertiesCache;
+    const MatchResult& result_;
+    unsigned hash_;
+  };
+
+  const CachedMatchedProperties* Find(const Key&, const StyleResolverState&);
+  void Add(const Key&, const ComputedStyle&, const ComputedStyle& parent_style);
 
   void Clear();
   void ClearViewportDependent();

diff --git a/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc b/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc
index a4f7039..8a34c4c5 100644
--- a/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc
+++ b/third_party/blink/renderer/core/css/resolver/style_builder_converter.cc

@@ -992,6 +992,11 @@
                         defaultMaximumForClamp<float>());
 }
 
+LayoutUnit StyleBuilderConverter::ConvertLayoutUnit(StyleResolverState& state,
+                                                    const CSSValue& value) {
+  return LayoutUnit::Clamp(ConvertComputedLength<float>(state, value));
+}
+
 GapLength StyleBuilderConverter::ConvertGapLength(StyleResolverState& state,
                                                   const CSSValue& value) {
   auto* identifier_value = DynamicTo<CSSIdentifierValue>(value);

diff --git a/third_party/blink/renderer/core/css/resolver/style_builder_converter.h b/third_party/blink/renderer/core/css/resolver/style_builder_converter.h
index fbf3cef5..f0e732e 100644
--- a/third_party/blink/renderer/core/css/resolver/style_builder_converter.h
+++ b/third_party/blink/renderer/core/css/resolver/style_builder_converter.h

@@ -162,6 +162,7 @@
   template <typename T>
   static T ConvertLineWidth(StyleResolverState&, const CSSValue&);
   static float ConvertBorderWidth(StyleResolverState&, const CSSValue&);
+  static LayoutUnit ConvertLayoutUnit(StyleResolverState&, const CSSValue&);
   static GapLength ConvertGapLength(const StyleResolverState&, const CSSValue&);
   static Length ConvertLength(const StyleResolverState&, const CSSValue&);
   static UnzoomedLength ConvertUnzoomedLength(const StyleResolverState&,

diff --git a/third_party/blink/renderer/core/css/resolver/style_resolver.cc b/third_party/blink/renderer/core/css/resolver/style_resolver.cc
index 3ab344f..f6211a6 100644
--- a/third_party/blink/renderer/core/css/resolver/style_resolver.cc
+++ b/third_party/blink/renderer/core/css/resolver/style_resolver.cc

@@ -1726,12 +1726,6 @@
   }
 }
 
-static unsigned ComputeMatchedPropertiesHash(
-    const MatchedProperties* properties,
-    unsigned size) {
-  return StringHasher::HashMemory(properties, sizeof(MatchedProperties) * size);
-}
-
 void StyleResolver::InvalidateMatchedPropertiesCache() {
   matched_properties_cache_.Clear();
 }
@@ -1847,17 +1841,12 @@
     const MatchResult& match_result) {
   const Element& element = state.GetElement();
 
-  unsigned cache_hash = match_result.IsCacheable()
-                            ? ComputeMatchedPropertiesHash(
-                                  match_result.GetMatchedProperties().data(),
-                                  match_result.GetMatchedProperties().size())
-                            : 0;
+  MatchedPropertiesCache::Key key(match_result);
+
   bool is_inherited_cache_hit = false;
   bool is_non_inherited_cache_hit = false;
   const CachedMatchedProperties* cached_matched_properties =
-      cache_hash ? matched_properties_cache_.Find(
-                       cache_hash, state, match_result.GetMatchedProperties())
-                 : nullptr;
+      key.IsValid() ? matched_properties_cache_.Find(key, state) : nullptr;
 
   if (cached_matched_properties && MatchedPropertiesCache::IsCacheable(state)) {
     INCREMENT_STYLE_STATS_COUNTER(GetDocument().GetStyleEngine(),
@@ -1895,8 +1884,8 @@
     UpdateFont(state);
   }
 
-  return CacheSuccess(is_inherited_cache_hit, is_non_inherited_cache_hit,
-                      cache_hash, cached_matched_properties);
+  return CacheSuccess(is_inherited_cache_hit, is_non_inherited_cache_hit, key,
+                      cached_matched_properties);
 }
 
 void StyleResolver::MaybeAddToMatchedPropertiesCache(
@@ -1904,13 +1893,12 @@
     const CacheSuccess& cache_success,
     const MatchResult& match_result) {
   if (!state.IsAnimatingCustomProperties() &&
-      !cache_success.cached_matched_properties && cache_success.cache_hash &&
+      !cache_success.cached_matched_properties && cache_success.key.IsValid() &&
       MatchedPropertiesCache::IsCacheable(state)) {
     INCREMENT_STYLE_STATS_COUNTER(GetDocument().GetStyleEngine(),
                                   matched_property_cache_added, 1);
-    matched_properties_cache_.Add(*state.Style(), *state.ParentStyle(),
-                                  cache_success.cache_hash,
-                                  match_result.GetMatchedProperties());
+    matched_properties_cache_.Add(cache_success.key, *state.Style(),
+                                  *state.ParentStyle());
   }
 }
 

diff --git a/third_party/blink/renderer/core/css/resolver/style_resolver.h b/third_party/blink/renderer/core/css/resolver/style_resolver.h
index 7c259ec..463adfd 100644
--- a/third_party/blink/renderer/core/css/resolver/style_resolver.h
+++ b/third_party/blink/renderer/core/css/resolver/style_resolver.h

@@ -181,16 +181,16 @@
    public:
     bool is_inherited_cache_hit;
     bool is_non_inherited_cache_hit;
-    unsigned cache_hash;
+    MatchedPropertiesCache::Key key;
     const CachedMatchedProperties* cached_matched_properties;
 
     CacheSuccess(bool is_inherited_cache_hit,
                  bool is_non_inherited_cache_hit,
-                 unsigned cache_hash,
+                 MatchedPropertiesCache::Key key,
                  const CachedMatchedProperties* cached_matched_properties)
         : is_inherited_cache_hit(is_inherited_cache_hit),
           is_non_inherited_cache_hit(is_non_inherited_cache_hit),
-          cache_hash(cache_hash),
+          key(key),
           cached_matched_properties(cached_matched_properties) {}
 
     bool IsFullCacheHit() const {

diff --git a/third_party/blink/renderer/core/css/selector_checker.cc b/third_party/blink/renderer/core/css/selector_checker.cc
index b28cc13..8f748ae 100644
--- a/third_party/blink/renderer/core/css/selector_checker.cc
+++ b/third_party/blink/renderer/core/css/selector_checker.cc

@@ -46,6 +46,7 @@
 #include "third_party/blink/renderer/core/editing/frame_selection.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/frame/picture_in_picture_controller.h"
+#include "third_party/blink/renderer/core/frame/settings.h"
 #include "third_party/blink/renderer/core/fullscreen/fullscreen.h"
 #include "third_party/blink/renderer/core/html/custom/element_internals.h"
 #include "third_party/blink/renderer/core/html/forms/html_form_control_element.h"
@@ -1659,15 +1660,17 @@
     return false;
 
   const Document& document = element.GetDocument();
-  bool always_show_focus_ring = element.MayTriggerVirtualKeyboard();
+  const Settings* settings = document.GetSettings();
+  bool always_show_focus = settings->GetAccessibilityAlwaysShowFocus();
+  bool is_text_input = element.MayTriggerVirtualKeyboard();
   bool last_focus_from_mouse =
       document.GetFrame() &&
       document.GetFrame()->Selection().FrameIsFocusedAndActive() &&
       document.LastFocusType() == mojom::blink::FocusType::kMouse;
   bool had_keyboard_event = document.HadKeyboardEvent();
 
-  return (!last_focus_from_mouse || had_keyboard_event ||
-          always_show_focus_ring);
+  return (always_show_focus || is_text_input || !last_focus_from_mouse ||
+          had_keyboard_event);
 }
 
 // static

diff --git a/third_party/blink/renderer/core/exported/web_page_popup_impl.cc b/third_party/blink/renderer/core/exported/web_page_popup_impl.cc
index 8ec44bb7..2c6f9c8 100644
--- a/third_party/blink/renderer/core/exported/web_page_popup_impl.cc
+++ b/third_party/blink/renderer/core/exported/web_page_popup_impl.cc

@@ -41,6 +41,7 @@
 #include "third_party/blink/renderer/core/dom/context_features.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/dom/events/event_dispatch_forbidden_scope.h"
+#include "third_party/blink/renderer/core/dom/node_computed_style.h"
 #include "third_party/blink/renderer/core/events/message_event.h"
 #include "third_party/blink/renderer/core/events/web_input_event_conversion.h"
 #include "third_party/blink/renderer/core/exported/web_settings_impl.h"
@@ -292,6 +293,22 @@
   page_->GetSettings().SetPrimaryPointerType(
       main_settings.GetPrimaryPointerType());
 
+  // The style can be out-of-date if e.g. a key event handler modified the
+  // OwnerElement()'s style before the default handler started opening the
+  // popup. If the key handler forced a style update the style may be up-to-date
+  // and null.
+  // Note that if there's a key event handler which changes the color-scheme
+  // between the key is pressed and the popup is opened, the color-scheme of the
+  // form element and its popup may not match.
+  // If we think it's important to have an up-to-date style here, we need to run
+  // an UpdateStyleAndLayoutTree() before opening the popup in the various
+  // default event handlers.
+  if (const auto* style = popup_client_->OwnerElement().GetComputedStyle()) {
+    page_->GetSettings().SetPreferredColorScheme(
+        style->UsedColorScheme() == WebColorScheme::kDark
+            ? PreferredColorScheme::kDark
+            : PreferredColorScheme::kLight);
+  }
   popup_client_->CreatePagePopupController(*page_, *this);
 
   ProvideContextFeaturesTo(*page_, std::make_unique<PagePopupFeaturesClient>());

diff --git a/third_party/blink/renderer/core/exported/web_settings_impl.cc b/third_party/blink/renderer/core/exported/web_settings_impl.cc
index 075b02a..f11e516 100644
--- a/third_party/blink/renderer/core/exported/web_settings_impl.cc
+++ b/third_party/blink/renderer/core/exported/web_settings_impl.cc

@@ -152,6 +152,10 @@
   settings_->SetAccessibilityFontScaleFactor(font_scale_factor);
 }
 
+void WebSettingsImpl::SetAccessibilityAlwaysShowFocus(bool always_show_focus) {
+  settings_->SetAccessibilityAlwaysShowFocus(always_show_focus);
+}
+
 void WebSettingsImpl::SetAccessibilityPasswordValuesEnabled(bool enabled) {
   settings_->SetAccessibilityPasswordValuesEnabled(enabled);
 }

diff --git a/third_party/blink/renderer/core/exported/web_settings_impl.h b/third_party/blink/renderer/core/exported/web_settings_impl.h
index 7af44a9..c3f38e9 100644
--- a/third_party/blink/renderer/core/exported/web_settings_impl.h
+++ b/third_party/blink/renderer/core/exported/web_settings_impl.h

@@ -165,6 +165,7 @@
   void SetTextAreasAreResizable(bool) override;
   void SetTextAutosizingEnabled(bool) override;
   void SetAccessibilityFontScaleFactor(float) override;
+  void SetAccessibilityAlwaysShowFocus(bool) override;
   void SetTextTrackKindUserPreference(TextTrackKindUserPreference) override;
   void SetTextTrackBackgroundColor(const WebString&) override;
   void SetTextTrackFontFamily(const WebString&) override;

diff --git a/third_party/blink/renderer/core/frame/settings.json5 b/third_party/blink/renderer/core/frame/settings.json5
index 6d08316..aa7083d 100644
--- a/third_party/blink/renderer/core/frame/settings.json5
+++ b/third_party/blink/renderer/core/frame/settings.json5

@@ -1082,5 +1082,12 @@
       invalidate: "MediaQuery",
       type: "NavigationControls",
     },
+
+    {
+      name: "accessibilityAlwaysShowFocus",
+      initial: false,
+      invalidate: "Style",
+      type: "bool"
+    }
   ],
 }

diff --git a/third_party/blink/renderer/core/html/forms/date_time_chooser_impl.cc b/third_party/blink/renderer/core/html/forms/date_time_chooser_impl.cc
index b879e11..ca0dabab 100644
--- a/third_party/blink/renderer/core/html/forms/date_time_chooser_impl.cc
+++ b/third_party/blink/renderer/core/html/forms/date_time_chooser_impl.cc

@@ -123,7 +123,10 @@
         GetLocale().QueryString(IDS_FORM_OTHER_DATE_LABEL);
   }
 
-  AddString("<!DOCTYPE html><head><meta charset='UTF-8'><style>\n", data);
+  AddString(
+      "<!DOCTYPE html><head><meta charset='UTF-8'><meta name='color-scheme' "
+      "content='light,dark'><style>\n",
+      data);
 
   data->Append(ChooserResourceLoader::GetPickerCommonStyleSheet());
   if (!features::IsFormControlsRefreshEnabled())
@@ -213,9 +216,9 @@
         data);
     AddProperty("otherDateLabel", other_date_label_string, data);
 
-    DCHECK(OwnerElement().GetComputedStyle());
+    const ComputedStyle* style = OwnerElement().GetComputedStyle();
     WebColorScheme color_scheme =
-        OwnerElement().GetComputedStyle()->UsedColorScheme();
+        style ? style->UsedColorScheme() : WebColorScheme::kLight;
 
     AddProperty("suggestionHighlightColor",
                 LayoutTheme::GetTheme()

diff --git a/third_party/blink/renderer/core/imagebitmap/image_bitmap.cc b/third_party/blink/renderer/core/imagebitmap/image_bitmap.cc
index e165b60..4a4ab8e 100644
--- a/third_party/blink/renderer/core/imagebitmap/image_bitmap.cc
+++ b/third_party/blink/renderer/core/imagebitmap/image_bitmap.cc

@@ -1071,15 +1071,17 @@
 unsigned ImageBitmap::width() const {
   if (!image_)
     return 0;
-  DCHECK_GT(image_->width(), 0);
-  return image_->width();
+  IntSize size = image_->SizeRespectingOrientation();
+  DCHECK_GT(size.Width(), 0);
+  return size.Width();
 }
 
 unsigned ImageBitmap::height() const {
   if (!image_)
     return 0;
-  DCHECK_GT(image_->height(), 0);
-  return image_->height();
+  IntSize size = image_->SizeRespectingOrientation();
+  DCHECK_GT(size.Height(), 0);
+  return size.Height();
 }
 
 bool ImageBitmap::IsAccelerated() const {

diff --git a/third_party/blink/renderer/core/inspector/BUILD.gn b/third_party/blink/renderer/core/inspector/BUILD.gn
index a61b2411..e8a912f 100644
--- a/third_party/blink/renderer/core/inspector/BUILD.gn
+++ b/third_party/blink/renderer/core/inspector/BUILD.gn

@@ -28,6 +28,8 @@
     "dom_editor.h",
     "dom_patch_support.cc",
     "dom_patch_support.h",
+    "dom_traversal_utils.cc",
+    "dom_traversal_utils.h",
     "identifiers_factory.cc",
     "identifiers_factory.h",
     "inspect_tools.cc",

diff --git a/third_party/blink/renderer/core/inspector/dom_traversal_utils.cc b/third_party/blink/renderer/core/inspector/dom_traversal_utils.cc
new file mode 100644
index 0000000..71a752e0
--- /dev/null
+++ b/third_party/blink/renderer/core/inspector/dom_traversal_utils.cc

@@ -0,0 +1,46 @@
+#include "third_party/blink/renderer/core/inspector/dom_traversal_utils.h"
+
+#include "third_party/blink/renderer/core/dom/flat_tree_traversal.h"
+#include "third_party/blink/renderer/core/dom/node.h"
+#include "third_party/blink/renderer/core/dom/shadow_root.h"
+
+namespace blink {
+namespace dom_traversal_utils {
+
+Node* FirstChild(const Node& node, bool include_user_agent_shadow_tree) {
+  DCHECK(include_user_agent_shadow_tree || !node.IsInUserAgentShadowRoot());
+  if (!include_user_agent_shadow_tree) {
+    ShadowRoot* shadow_root = node.GetShadowRoot();
+    if (shadow_root && shadow_root->GetType() == ShadowRootType::kUserAgent) {
+      Node* child = node.firstChild();
+      while (child && !child->CanParticipateInFlatTree())
+        child = child->nextSibling();
+      return child;
+    }
+  }
+  return FlatTreeTraversal::FirstChild(node);
+}
+
+// static
+bool HasChildren(const Node& node, bool include_user_agent_shadow_tree) {
+  return FirstChild(node, include_user_agent_shadow_tree);
+}
+
+// static
+Node* NextSibling(const Node& node, bool include_user_agent_shadow_tree) {
+  DCHECK(include_user_agent_shadow_tree || !node.IsInUserAgentShadowRoot());
+  if (!include_user_agent_shadow_tree) {
+    if (node.ParentElementShadowRoot() &&
+        node.ParentElementShadowRoot()->GetType() ==
+            ShadowRootType::kUserAgent) {
+      Node* sibling = node.nextSibling();
+      while (sibling && !sibling->CanParticipateInFlatTree())
+        sibling = sibling->nextSibling();
+      return sibling;
+    }
+  }
+  return FlatTreeTraversal::NextSibling(node);
+}
+
+}  // namespace dom_traversal_utils
+}  // namespace blink

diff --git a/third_party/blink/renderer/core/inspector/dom_traversal_utils.h b/third_party/blink/renderer/core/inspector/dom_traversal_utils.h
new file mode 100644
index 0000000..d4a52a40
--- /dev/null
+++ b/third_party/blink/renderer/core/inspector/dom_traversal_utils.h

@@ -0,0 +1,22 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_BLINK_RENDERER_CORE_INSPECTOR_DOM_TRAVERSAL_UTILS_H_
+#define THIRD_PARTY_BLINK_RENDERER_CORE_INSPECTOR_DOM_TRAVERSAL_UTILS_H_
+
+namespace blink {
+
+class Node;
+
+namespace dom_traversal_utils {
+
+// These are deprecated, do not use in new code. Use FlatTreeTraversal directly.
+Node* FirstChild(const Node& node, bool include_user_agent_shadow_tree);
+bool HasChildren(const Node& node, bool include_user_agent_shadow_tree);
+Node* NextSibling(const Node& node, bool include_user_agent_shadow_tree);
+
+}  // namespace dom_traversal_utils
+}  // namespace blink
+
+#endif  // THIRD_PARTY_BLINK_RENDERER_CORE_INSPECTOR_DOM_TRAVERSAL_UTILS_H_

diff --git a/third_party/blink/renderer/core/inspector/inspector_dom_snapshot_agent.cc b/third_party/blink/renderer/core/inspector/inspector_dom_snapshot_agent.cc
index 85e99a9..42755c8 100644
--- a/third_party/blink/renderer/core/inspector/inspector_dom_snapshot_agent.cc
+++ b/third_party/blink/renderer/core/inspector/inspector_dom_snapshot_agent.cc

@@ -141,6 +141,63 @@
   return node->GetDocument().Url().GetString();
 }
 
+class DOMTreeIterator {
+  STACK_ALLOCATED();
+
+ public:
+  DOMTreeIterator(Node* root, int root_node_id)
+      : current_(root), path_to_current_node_({root_node_id}) {
+    DCHECK(current_);
+  }
+
+  void Advance(int next_node_id) {
+    DCHECK(current_);
+    const bool skip_shadow_root =
+        current_->GetShadowRoot() && current_->GetShadowRoot()->IsUserAgent();
+    if (Node* first_child = skip_shadow_root
+                                ? FirstFlatTreeSibling(current_->firstChild())
+                                : FlatTreeTraversal::FirstChild(*current_)) {
+      current_ = first_child;
+      path_to_current_node_.push_back(next_node_id);
+      return;
+    }
+    // No children, let's try siblings, then ancestor siblings.
+    while (current_) {
+      const bool in_ua_shadow_tree =
+          current_->ParentElementShadowRoot() &&
+          current_->ParentElementShadowRoot()->IsUserAgent();
+      if (Node* node = in_ua_shadow_tree
+                           ? FirstFlatTreeSibling(current_->nextSibling())
+                           : FlatTreeTraversal::NextSibling(*current_)) {
+        path_to_current_node_.back() = next_node_id;
+        current_ = node;
+        return;
+      }
+      current_ = in_ua_shadow_tree ? current_->parentNode()
+                                   : FlatTreeTraversal::Parent(*current_);
+      path_to_current_node_.pop_back();
+    }
+    DCHECK(path_to_current_node_.IsEmpty());
+  }
+
+  Node* CurrentNode() const { return current_; }
+
+  int ParentNodeId() const {
+    return path_to_current_node_.size() > 1
+               ? *(path_to_current_node_.rbegin() + 1)
+               : -1;
+  }
+
+ private:
+  static Node* FirstFlatTreeSibling(Node* node) {
+    while (node && !node->CanParticipateInFlatTree())
+      node = node->nextSibling();
+    return node;
+  }
+  Node* current_;
+  WTF::Vector<int> path_to_current_node_;
+};
+
 }  // namespace
 
 // Returns |layout_object|'s bounding box in document coordinates.
@@ -417,11 +474,16 @@
         std::make_unique<protocol::Array<protocol::Array<double>>>());
   }
 
-  VisitNode(document, -1);
+  auto* node_names = document_->getNodes()->getNodeName(nullptr);
+  for (DOMTreeIterator it(document, node_names->size()); it.CurrentNode();
+       it.Advance(node_names->size())) {
+    DCHECK(!it.CurrentNode()->IsInUserAgentShadowRoot());
+    VisitNode(it.CurrentNode(), it.ParentNodeId());
+  }
   documents_->emplace_back(std::move(document_));
 }
 
-int InspectorDOMSnapshotAgent::VisitNode(Node* node, int parent_index) {
+void InspectorDOMSnapshotAgent::VisitNode(Node* node, int parent_index) {
   String node_value;
   switch (node->getNodeType()) {
     case Node::kTextNode:
@@ -508,62 +570,6 @@
               image_element->currentSrc());
     }
   }
-  if (node->IsContainerNode())
-    VisitContainerChildren(node, index);
-  return index;
-}
-
-// static
-Node* InspectorDOMSnapshotAgent::FirstChild(
-    const Node& node,
-    bool include_user_agent_shadow_tree) {
-  DCHECK(include_user_agent_shadow_tree || !node.IsInUserAgentShadowRoot());
-  if (!include_user_agent_shadow_tree) {
-    ShadowRoot* shadow_root = node.GetShadowRoot();
-    if (shadow_root && shadow_root->GetType() == ShadowRootType::kUserAgent) {
-      Node* child = node.firstChild();
-      while (child && !child->CanParticipateInFlatTree())
-        child = child->nextSibling();
-      return child;
-    }
-  }
-  return FlatTreeTraversal::FirstChild(node);
-}
-
-// static
-bool InspectorDOMSnapshotAgent::HasChildren(
-    const Node& node,
-    bool include_user_agent_shadow_tree) {
-  return FirstChild(node, include_user_agent_shadow_tree);
-}
-
-// static
-Node* InspectorDOMSnapshotAgent::NextSibling(
-    const Node& node,
-    bool include_user_agent_shadow_tree) {
-  DCHECK(include_user_agent_shadow_tree || !node.IsInUserAgentShadowRoot());
-  if (!include_user_agent_shadow_tree) {
-    if (node.ParentElementShadowRoot() &&
-        node.ParentElementShadowRoot()->GetType() ==
-            ShadowRootType::kUserAgent) {
-      Node* sibling = node.nextSibling();
-      while (sibling && !sibling->CanParticipateInFlatTree())
-        sibling = sibling->nextSibling();
-      return sibling;
-    }
-  }
-  return FlatTreeTraversal::NextSibling(node);
-}
-
-void InspectorDOMSnapshotAgent::VisitContainerChildren(Node* container,
-                                                       int parent_index) {
-  if (!HasChildren(*container, false))
-    return;
-
-  for (Node* child = FirstChild(*container, false); child;
-       child = NextSibling(*child, false)) {
-    VisitNode(child, parent_index);
-  }
 }
 
 void InspectorDOMSnapshotAgent::VisitPseudoElements(Element* parent,

diff --git a/third_party/blink/renderer/core/inspector/inspector_dom_snapshot_agent.h b/third_party/blink/renderer/core/inspector/inspector_dom_snapshot_agent.h
index 8587c61..d5ef9a5 100644
--- a/third_party/blink/renderer/core/inspector/inspector_dom_snapshot_agent.h
+++ b/third_party/blink/renderer/core/inspector/inspector_dom_snapshot_agent.h

@@ -57,14 +57,6 @@
   void CharacterDataModified(CharacterData*);
   void DidInsertDOMNode(Node*);
 
-  // Helpers for traversal.
-  static bool HasChildren(const Node& node,
-                          bool include_user_agent_shadow_tree);
-  static Node* FirstChild(const Node& node,
-                          bool include_user_agent_shadow_tree);
-  static Node* NextSibling(const Node& node,
-                           bool include_user_agent_shadow_tree);
-
   // Helpers for rects
   static PhysicalRect RectInDocument(const LayoutObject* layout_object);
   static PhysicalRect TextFragmentRectInDocument(
@@ -88,7 +80,8 @@
                const String& value);
   void SetRare(protocol::DOMSnapshot::RareBooleanData* data, int index);
   void VisitDocument(Document*);
-  int VisitNode(Node*, int parent_index);
+
+  void VisitNode(Node*, int parent_index);
   void VisitContainerChildren(Node* container, int parent_index);
   void VisitPseudoElements(Element* parent, int parent_index);
   std::unique_ptr<protocol::Array<int>> BuildArrayForElementAttributes(Node*);
@@ -127,6 +120,7 @@
   Member<InspectedFrames> inspected_frames_;
   Member<InspectorDOMDebuggerAgent> dom_debugger_agent_;
   InspectorAgentState::Boolean enabled_;
+
   DISALLOW_COPY_AND_ASSIGN(InspectorDOMSnapshotAgent);
 };
 

diff --git a/third_party/blink/renderer/core/inspector/inspector_highlight.cc b/third_party/blink/renderer/core/inspector/inspector_highlight.cc
index bbdeef3..e0b532a 100644
--- a/third_party/blink/renderer/core/inspector/inspector_highlight.cc
+++ b/third_party/blink/renderer/core/inspector/inspector_highlight.cc

@@ -13,8 +13,8 @@
 #include "third_party/blink/renderer/core/frame/local_frame_view.h"
 #include "third_party/blink/renderer/core/frame/visual_viewport.h"
 #include "third_party/blink/renderer/core/geometry/dom_rect.h"
+#include "third_party/blink/renderer/core/inspector/dom_traversal_utils.h"
 #include "third_party/blink/renderer/core/inspector/inspector_dom_agent.h"
-#include "third_party/blink/renderer/core/inspector/inspector_dom_snapshot_agent.h"
 #include "third_party/blink/renderer/core/layout/adjust_for_absolute_zoom.h"
 #include "third_party/blink/renderer/core/layout/layout_box.h"
 #include "third_party/blink/renderer/core/layout/layout_grid.h"
@@ -639,10 +639,10 @@
 
   if (!node->IsContainerNode())
     return;
-  Node* first_child = InspectorDOMSnapshotAgent::FirstChild(*node, false);
-  for (Node* child = first_child; child;
-       child = InspectorDOMSnapshotAgent::NextSibling(*child, false))
+  for (Node* child = blink::dom_traversal_utils::FirstChild(*node, false);
+       child; child = blink::dom_traversal_utils::NextSibling(*child, false)) {
     VisitAndCollectDistanceInfo(child);
+  }
 }
 
 void InspectorHighlight::VisitAndCollectDistanceInfo(

diff --git a/third_party/blink/renderer/core/inspector/legacy_dom_snapshot_agent.cc b/third_party/blink/renderer/core/inspector/legacy_dom_snapshot_agent.cc
index 8970aaf50..e39da97 100644
--- a/third_party/blink/renderer/core/inspector/legacy_dom_snapshot_agent.cc
+++ b/third_party/blink/renderer/core/inspector/legacy_dom_snapshot_agent.cc

@@ -27,6 +27,7 @@
 #include "third_party/blink/renderer/core/html/html_link_element.h"
 #include "third_party/blink/renderer/core/html/html_template_element.h"
 #include "third_party/blink/renderer/core/input_type_names.h"
+#include "third_party/blink/renderer/core/inspector/dom_traversal_utils.h"
 #include "third_party/blink/renderer/core/inspector/identifiers_factory.h"
 #include "third_party/blink/renderer/core/inspector/inspector_dom_agent.h"
 #include "third_party/blink/renderer/core/inspector/inspector_dom_debugger_agent.h"
@@ -303,16 +304,16 @@
     bool include_user_agent_shadow_tree) {
   auto children = std::make_unique<protocol::Array<int>>();
 
-  if (!InspectorDOMSnapshotAgent::HasChildren(*container,
-                                              include_user_agent_shadow_tree))
+  if (!blink::dom_traversal_utils::HasChildren(*container,
+                                               include_user_agent_shadow_tree))
     return nullptr;
 
-  Node* child = InspectorDOMSnapshotAgent::FirstChild(
+  Node* child = blink::dom_traversal_utils::FirstChild(
       *container, include_user_agent_shadow_tree);
   while (child) {
     children->emplace_back(VisitNode(child, include_event_listeners,
                                      include_user_agent_shadow_tree));
-    child = InspectorDOMSnapshotAgent::NextSibling(
+    child = blink::dom_traversal_utils::NextSibling(
         *child, include_user_agent_shadow_tree);
   }
 

diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_fragment_item_test.cc b/third_party/blink/renderer/core/layout/ng/inline/ng_fragment_item_test.cc
index 70716ca..873117e 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_fragment_item_test.cc
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_fragment_item_test.cc

@@ -26,6 +26,45 @@
       : ScopedLayoutNGFragmentItemForTest(true),
         ScopedLayoutNGFragmentTraversalForTest(true) {}
 
+  LayoutBlockFlow* GetLayoutBlockFlowByElementId(const char* id) {
+    return To<LayoutBlockFlow>(GetLayoutObjectByElementId(id));
+  }
+
+  const NGFragmentItems* GetFragmentItemsByElementId(const char* id) {
+    const auto* block_flow =
+        To<LayoutBlockFlow>(GetLayoutObjectByElementId("container"));
+    return block_flow->FragmentItems();
+  }
+
+  Vector<NGInlineCursorPosition> GetLines(NGInlineCursor* cursor) {
+    Vector<NGInlineCursorPosition> lines;
+    for (cursor->MoveToFirstLine(); *cursor; cursor->MoveToNextLine())
+      lines.push_back(cursor->Current());
+    return lines;
+  }
+
+  wtf_size_t IndexOf(const Vector<NGInlineCursorPosition>& items,
+                     const NGFragmentItem* target) {
+    wtf_size_t index = 0;
+    for (const auto& item : items) {
+      if (item.Item() == target)
+        return index;
+      ++index;
+    }
+    return kNotFound;
+  }
+
+  void TestFirstDirtyLineIndex(const char* id, wtf_size_t expected_index) {
+    LayoutBlockFlow* block_flow = GetLayoutBlockFlowByElementId(id);
+    const NGFragmentItems* items = block_flow->FragmentItems();
+    items->DirtyLinesFromNeedsLayout(block_flow);
+    const NGFragmentItem* end_reusable_item = items->EndOfReusableItems();
+
+    NGInlineCursor cursor(*items);
+    const auto lines = GetLines(&cursor);
+    EXPECT_EQ(IndexOf(lines, end_reusable_item), expected_index);
+  }
+
   Vector<const NGFragmentItem*> ItemsForAsVector(
       const LayoutObject& layout_object) {
     Vector<const NGFragmentItem*> list;
@@ -239,4 +278,139 @@
   EXPECT_EQ(IntRect(0, 20, 80, 10), span2->AbsoluteBoundingBoxRect());
 }
 
+TEST_F(NGFragmentItemTest, MarkLineBoxesDirtyByRemoveChildAfterForcedBreak) {
+  SetBodyInnerHTML(R"HTML(
+    <div id=container>
+      line 1<br>
+      <b id=target>line 2</b><br>
+      line 3<br>
+    </div>
+  )HTML");
+  Element& target = *GetDocument().getElementById("target");
+  target.remove();
+  // TODO(kojii): This can be more optimized.
+  TestFirstDirtyLineIndex("container", 0);
+}
+
+TEST_F(NGFragmentItemTest, MarkLineBoxesDirtyByRemoveForcedBreak) {
+  SetBodyInnerHTML(R"HTML(
+    <div id=container>
+      line 1<br>
+      line 2<br id=target>
+      line 3<br>
+    </div>"
+  )HTML");
+  Element& target = *GetDocument().getElementById("target");
+  target.remove();
+  // TODO(kojii): This can be more optimized.
+  TestFirstDirtyLineIndex("container", 0);
+}
+
+TEST_F(NGFragmentItemTest, MarkLineBoxesDirtyByRemoveSpanWithForcedBreak) {
+  SetBodyInnerHTML(R"HTML(
+    <div id=container>
+      line 1<br>
+      line 2<span id=target><br>
+      </span>line 3<br>
+    </div>
+  )HTML");
+  // |target| is a culled inline box. There is no fragment in fragment tree.
+  Element& target = *GetDocument().getElementById("target");
+  target.remove();
+  // TODO(kojii): This can be more optimized.
+  TestFirstDirtyLineIndex("container", 0);
+}
+
+TEST_F(NGFragmentItemTest, MarkLineBoxesDirtyByInsertAtStart) {
+  SetBodyInnerHTML(R"HTML(
+    <div id=container>
+      line 1<br>
+      <b id=target>line 2</b><br>
+      line 3<br>
+    </div>
+  )HTML");
+  Element& target = *GetDocument().getElementById("target");
+  target.parentNode()->insertBefore(Text::Create(GetDocument(), "XYZ"),
+                                    &target);
+  GetDocument().UpdateStyleAndLayoutTree();
+  // TODO(kojii): This can be more optimized.
+  TestFirstDirtyLineIndex("container", 0);
+}
+
+TEST_F(NGFragmentItemTest, MarkLineBoxesDirtyByInsertAtLast) {
+  SetBodyInnerHTML(R"HTML(
+    <div id=container>
+      line 1<br>
+      <b id=target>line 2</b><br>
+      line 3<br>
+    </div>
+  )HTML");
+  Element& target = *GetDocument().getElementById("target");
+  target.parentNode()->appendChild(Text::Create(GetDocument(), "XYZ"));
+  GetDocument().UpdateStyleAndLayoutTree();
+  TestFirstDirtyLineIndex("container", 1);
+}
+
+TEST_F(NGFragmentItemTest, MarkLineBoxesDirtyByInsertAtMiddle) {
+  SetBodyInnerHTML(R"HTML(
+    <div id=container>
+      line 1<br>
+      <b id=target>line 2</b><br>
+      line 3<br>
+    </div>
+  )HTML");
+  Element& target = *GetDocument().getElementById("target");
+  target.parentNode()->insertBefore(Text::Create(GetDocument(), "XYZ"),
+                                    target.nextSibling());
+  GetDocument().UpdateStyleAndLayoutTree();
+  // TODO(kojii): This can be more optimized.
+  TestFirstDirtyLineIndex("container", 0);
+}
+
+TEST_F(NGFragmentItemTest, MarkLineBoxesDirtyByTextSetData) {
+  SetBodyInnerHTML(R"HTML(
+    <div id=container>
+      line 1<br>
+      <b id=target>line 2</b><br>
+      line 3<br>
+    </div>
+  )HTML");
+  Element& target = *GetDocument().getElementById("target");
+  To<Text>(*target.firstChild()).setData("abc");
+  // TODO(kojii): This can be more optimized.
+  TestFirstDirtyLineIndex("container", 0);
+}
+
+TEST_F(NGFragmentItemTest, MarkLineBoxesDirtyWrappedLine) {
+  SetBodyInnerHTML(R"HTML(
+    <style>
+    #container {
+      font-size: 10px;
+      width: 10ch;
+    }
+    </style>
+    <div id=container>
+      1234567
+      123456<span id="target">7</span>
+    </div>
+  )HTML");
+  Element& target = *GetDocument().getElementById("target");
+  target.remove();
+  // TODO(kojii): This can be more optimized.
+  TestFirstDirtyLineIndex("container", 0);
+}
+
+TEST_F(NGFragmentItemTest, MarkLineBoxesDirtyInsideInlineBlock) {
+  SetBodyInnerHTML(R"HTML(
+    <div id=container>
+      <div id="inline-block" style="display: inline-block">
+        <span id="target">DELETE ME</span>
+      </div>
+    </div>
+  )HTML");
+  Element& target = *GetDocument().getElementById("target");
+  target.remove();
+  TestFirstDirtyLineIndex("container", 0);
+}
+
 }  // namespace blink

diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_cursor.h b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_cursor.h
index 49f652a..6e2b0d8 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_cursor.h
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_cursor.h

@@ -42,8 +42,6 @@
 // 2. Allows to save |Current()|, and can move back later. Moving to |Position|
 // is faster than moving to |NGFragmentItem|.
 class CORE_EXPORT NGInlineCursorPosition {
-  STACK_ALLOCATED();
-
  public:
   using ItemsSpan = base::span<const scoped_refptr<const NGFragmentItem>>;
 

diff --git a/third_party/blink/renderer/core/paint/compositing/composited_layer_mapping.cc b/third_party/blink/renderer/core/paint/compositing/composited_layer_mapping.cc
index b77dc46..6e77e20 100644
--- a/third_party/blink/renderer/core/paint/compositing/composited_layer_mapping.cc
+++ b/third_party/blink/renderer/core/paint/compositing/composited_layer_mapping.cc

@@ -179,7 +179,7 @@
       layout_object.IsCanvas() || IsA<LayoutVideo>(layout_object);
 
   return could_obscure_decorations && layout_object.StyleRef().HasOutline() &&
-         layout_object.StyleRef().OutlineOffset() < -min_border_width;
+         layout_object.StyleRef().OutlineOffsetInt() < -min_border_width;
 }
 
 CompositedLayerMapping::CompositedLayerMapping(PaintLayer& layer)

diff --git a/third_party/blink/renderer/core/paint/image_painter.cc b/third_party/blink/renderer/core/paint/image_painter.cc
index 86470ade..6436abe 100644
--- a/third_party/blink/renderer/core/paint/image_painter.cc
+++ b/third_party/blink/renderer/core/paint/image_painter.cc

@@ -127,7 +127,7 @@
   paint_info.context.Clip(PixelSnappedIntRect(focus_rect));
   paint_info.context.DrawFocusRing(
       path, area_element_style->GetOutlineStrokeWidthForFocusRing(),
-      area_element_style->OutlineOffset(),
+      area_element_style->OutlineOffsetInt(),
       layout_image_.ResolveColor(*area_element_style,
                                  GetCSSPropertyOutlineColor()));
   paint_info.context.Restore();

diff --git a/third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.cc b/third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.cc
index 20f330e..8dff29b4 100644
--- a/third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.cc
+++ b/third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.cc

@@ -2148,8 +2148,13 @@
 
     if (block_child.IsPaintedAtomically()) {
       if (HitTestAllPhasesInFragment(block_child, hit_test_location,
-                                     child_offset, &result))
+                                     child_offset, &result)) {
+        if (const LayoutObject* child_object = block_child.GetLayoutObject()) {
+          child_object->UpdateHitTestResult(
+              result, hit_test_location.Point() - accumulated_offset);
+        }
         return true;
+      }
 
       continue;
     }

diff --git a/third_party/blink/renderer/core/paint/ng/ng_paint_fragment_test.cc b/third_party/blink/renderer/core/paint/ng/ng_paint_fragment_test.cc
index d778705c..35d01701 100644
--- a/third_party/blink/renderer/core/paint/ng/ng_paint_fragment_test.cc
+++ b/third_party/blink/renderer/core/paint/ng/ng_paint_fragment_test.cc

@@ -704,22 +704,6 @@
   EXPECT_EQ(1u, lines[0]->Children().size());
 }
 
-TEST_F(NGPaintFragmentTest, MarkLineBoxesDirtyByRemoveBr) {
-  if (RuntimeEnabledFeatures::LayoutNGFragmentItemEnabled())
-    return;
-  if (!RuntimeEnabledFeatures::LayoutNGLineCacheEnabled())
-    return;
-  SetBodyInnerHTML(
-      "<div id=container>line 1<br>line 2<br id=target>line 3<br>"
-      "</div>");
-  Element& target = *GetDocument().getElementById("target");
-  target.remove();
-  const NGPaintFragment& container = *GetPaintFragmentByElementId("container");
-  EXPECT_FALSE(container.FirstChild()->IsDirty());
-  EXPECT_TRUE(ToList(container.Children())[1]->IsDirty());
-  EXPECT_FALSE(ToList(container.Children())[2]->IsDirty());
-}
-
 static const char* inline_child_data[] = {
     "<span id='child'>XXX</span>",
     "<span id='child' style='background: yellow'>XXX</span>",
@@ -760,194 +744,4 @@
   EXPECT_EQ(linebox.Children().size(), 2u);
 }
 
-TEST_F(NGPaintFragmentTest, MarkLineBoxesDirtyByRemoveChild) {
-  if (RuntimeEnabledFeatures::LayoutNGFragmentItemEnabled())
-    return;
-  if (!RuntimeEnabledFeatures::LayoutNGLineCacheEnabled())
-    return;
-  SetBodyInnerHTML(
-      "<div id=container>line 1<br><b id=target>line 2</b><br>line 3<br>"
-      "</div>");
-  Element& target = *GetDocument().getElementById("target");
-  target.remove();
-  const NGPaintFragment& container = *GetPaintFragmentByElementId("container");
-  auto lines = ToList(container.Children());
-  EXPECT_TRUE(lines[0]->IsDirty());
-  EXPECT_FALSE(lines[1]->IsDirty());
-  EXPECT_FALSE(lines[2]->IsDirty());
-}
-
-TEST_F(NGPaintFragmentTest, MarkLineBoxesDirtyByRemoveSpanWithBr) {
-  if (RuntimeEnabledFeatures::LayoutNGFragmentItemEnabled())
-    return;
-  if (!RuntimeEnabledFeatures::LayoutNGLineCacheEnabled())
-    return;
-  SetBodyInnerHTML(
-      "<div id=container>line 1<br>line 2<span id=target><br></span>line 3<br>"
-      "</div>");
-  // |target| is a culled inline box. There is no fragment in fragment tree.
-  Element& target = *GetDocument().getElementById("target");
-  target.remove();
-  const NGPaintFragment& container = *GetPaintFragmentByElementId("container");
-  EXPECT_FALSE(container.FirstChild()->IsDirty());
-  EXPECT_TRUE(ToList(container.Children())[1]->IsDirty());
-  EXPECT_FALSE(ToList(container.Children())[2]->IsDirty());
-}
-
-// "ByInsert" tests are disabled, because they require |UpdateStyleAndLayout()|
-// to update |IsDirty|, but NGPaintFragment maybe re-used during the layout. In
-// such case, the result is not deterministic.
-TEST_F(NGPaintFragmentTest, DISABLED_MarkLineBoxesDirtyByInsertAtStart) {
-  if (RuntimeEnabledFeatures::LayoutNGFragmentItemEnabled())
-    return;
-  if (!RuntimeEnabledFeatures::LayoutNGLineCacheEnabled())
-    return;
-  SetBodyInnerHTML(
-      "<div id=container>line 1<br><b id=target>line 2</b><br>line 3<br>"
-      "</div>");
-  const NGPaintFragment& container = *GetPaintFragmentByElementId("container");
-  const scoped_refptr<const NGPaintFragment> line1 = container.FirstChild();
-  ASSERT_TRUE(line1->PhysicalFragment().IsLineBox()) << line1;
-  const scoped_refptr<const NGPaintFragment> line2 =
-      ToList(container.Children())[1];
-  ASSERT_TRUE(line2->PhysicalFragment().IsLineBox()) << line2;
-  const scoped_refptr<const NGPaintFragment> line3 =
-      ToList(container.Children())[2];
-  ASSERT_TRUE(line3->PhysicalFragment().IsLineBox()) << line3;
-  Element& target = *GetDocument().getElementById("target");
-  target.parentNode()->insertBefore(Text::Create(GetDocument(), "XYZ"),
-                                    &target);
-  GetDocument().UpdateStyleAndLayout(DocumentUpdateReason::kTest);
-
-  EXPECT_TRUE(line1->IsDirty());
-  EXPECT_FALSE(line2->IsDirty());
-  EXPECT_FALSE(line3->IsDirty());
-}
-
-// "ByInsert" tests are disabled, because they require |UpdateStyleAndLayout()|
-// to update |IsDirty|, but NGPaintFragment maybe re-used during the layout. In
-// such case, the result is not deterministic.
-TEST_F(NGPaintFragmentTest, DISABLED_MarkLineBoxesDirtyByInsertAtLast) {
-  if (RuntimeEnabledFeatures::LayoutNGFragmentItemEnabled())
-    return;
-  if (!RuntimeEnabledFeatures::LayoutNGLineCacheEnabled())
-    return;
-  SetBodyInnerHTML(
-      "<div id=container>line 1<br><b id=target>line 2</b><br>line 3<br>"
-      "</div>");
-  const NGPaintFragment& container = *GetPaintFragmentByElementId("container");
-  const scoped_refptr<const NGPaintFragment> line1 = container.FirstChild();
-  ASSERT_TRUE(line1->PhysicalFragment().IsLineBox()) << line1;
-  const scoped_refptr<const NGPaintFragment> line2 =
-      ToList(container.Children())[1];
-  ASSERT_TRUE(line2->PhysicalFragment().IsLineBox()) << line2;
-  const scoped_refptr<const NGPaintFragment> line3 =
-      ToList(container.Children())[2];
-  ASSERT_TRUE(line3->PhysicalFragment().IsLineBox()) << line3;
-  Element& target = *GetDocument().getElementById("target");
-  target.parentNode()->appendChild(Text::Create(GetDocument(), "XYZ"));
-  GetDocument().UpdateStyleAndLayout(DocumentUpdateReason::kTest);
-
-  EXPECT_FALSE(line1->IsDirty());
-  EXPECT_FALSE(line2->IsDirty());
-  EXPECT_TRUE(line3->IsDirty());
-}
-
-// "ByInsert" tests are disabled, because they require |UpdateStyleAndLayout()|
-// to update |IsDirty|, but NGPaintFragment maybe re-used during the layout. In
-// such case, the result is not deterministic.
-TEST_F(NGPaintFragmentTest, DISABLED_MarkLineBoxesDirtyByInsertAtMiddle) {
-  if (RuntimeEnabledFeatures::LayoutNGFragmentItemEnabled())
-    return;
-  if (!RuntimeEnabledFeatures::LayoutNGLineCacheEnabled())
-    return;
-  SetBodyInnerHTML(
-      "<div id=container>line 1<br><b id=target>line 2</b><br>line 3<br>"
-      "</div>");
-  const NGPaintFragment& container = *GetPaintFragmentByElementId("container");
-  const scoped_refptr<const NGPaintFragment> line1 = container.FirstChild();
-  ASSERT_TRUE(line1->PhysicalFragment().IsLineBox()) << line1;
-  const scoped_refptr<const NGPaintFragment> line2 =
-      ToList(container.Children())[1];
-  ASSERT_TRUE(line2->PhysicalFragment().IsLineBox()) << line2;
-  const scoped_refptr<const NGPaintFragment> line3 =
-      ToList(container.Children())[2];
-  ASSERT_TRUE(line3->PhysicalFragment().IsLineBox()) << line3;
-  Element& target = *GetDocument().getElementById("target");
-  target.parentNode()->insertBefore(Text::Create(GetDocument(), "XYZ"),
-                                    target.nextSibling());
-  GetDocument().UpdateStyleAndLayout(DocumentUpdateReason::kTest);
-
-  EXPECT_TRUE(line1->IsDirty());
-  EXPECT_FALSE(line2->IsDirty());
-  EXPECT_FALSE(line3->IsDirty());
-}
-
-TEST_F(NGPaintFragmentTest, MarkLineBoxesDirtyByTextSetData) {
-  if (RuntimeEnabledFeatures::LayoutNGFragmentItemEnabled())
-    return;
-  if (!RuntimeEnabledFeatures::LayoutNGLineCacheEnabled())
-    return;
-  SetBodyInnerHTML(
-      "<div id=container>line 1<br><b id=target>line 2</b><br>line "
-      "3<br></div>");
-  Element& target = *GetDocument().getElementById("target");
-  To<Text>(*target.firstChild()).setData("abc");
-  const NGPaintFragment& container = *GetPaintFragmentByElementId("container");
-  auto lines = ToList(container.Children());
-  // TODO(kojii): Currently we don't optimzie for <br>. We can do this, then
-  // lines[0] should not be dirty.
-  EXPECT_TRUE(lines[0]->IsDirty());
-}
-
-TEST_F(NGPaintFragmentTest, MarkLineBoxesDirtyWrappedLine) {
-  if (RuntimeEnabledFeatures::LayoutNGFragmentItemEnabled())
-    return;
-  if (!RuntimeEnabledFeatures::LayoutNGLineCacheEnabled())
-    return;
-  SetBodyInnerHTML(R"HTML(
-    <style>
-    #container {
-      font-size: 10px;
-      width: 10ch;
-    }
-    </style>
-    <div id=container>
-      1234567
-      123456<span id="target">7</span>
-    </div>)HTML");
-  Element& target = *GetDocument().getElementById("target");
-  target.remove();
-
-  const NGPaintFragment& container = *GetPaintFragmentByElementId("container");
-  const NGPaintFragment& line0 = *container.FirstChild();
-  const NGPaintFragment& line1 = *line0.NextSibling();
-  EXPECT_FALSE(line0.IsDirty());
-  EXPECT_TRUE(line1.IsDirty());
-}
-
-TEST_F(NGPaintFragmentTest, MarkLineBoxesDirtyInsideInlineBlock) {
-  if (RuntimeEnabledFeatures::LayoutNGFragmentItemEnabled())
-    return;
-  if (!RuntimeEnabledFeatures::LayoutNGLineCacheEnabled())
-    return;
-  SetBodyInnerHTML(R"HTML(
-    <div id=container>
-      <div id="inline-block" style="display: inline-block">
-        <span id="target">DELETE ME</span>
-      </div>
-    </div>)HTML");
-  Element& target = *GetDocument().getElementById("target");
-  target.remove();
-
-  const NGPaintFragment& container = *GetPaintFragmentByElementId("container");
-  const NGPaintFragment& line0 = *container.FirstChild();
-  EXPECT_FALSE(line0.IsDirty());
-
-  const NGPaintFragment& inline_block =
-      *GetPaintFragmentByElementId("inline-block");
-  const NGPaintFragment& inner_line0 = *inline_block.FirstChild();
-  EXPECT_TRUE(inner_line0.IsDirty());
-}
-
 }  // namespace blink

diff --git a/third_party/blink/renderer/core/paint/object_painter_base.cc b/third_party/blink/renderer/core/paint/object_painter_base.cc
index 63719e6..78936e5e 100644
--- a/third_party/blink/renderer/core/paint/object_painter_base.cc
+++ b/third_party/blink/renderer/core/paint/object_painter_base.cc

@@ -99,7 +99,7 @@
   // Construct a clockwise path along the outer edge of the outline.
   SkRegion region;
   uint16_t width = style.OutlineWidthInt();
-  int outset = style.OutlineOffset() + style.OutlineWidthInt();
+  int outset = style.OutlineOffsetInt() + style.OutlineWidthInt();
   for (auto& r : rects) {
     IntRect rect = r;
     rect.Inflate(outset);
@@ -205,7 +205,7 @@
   DCHECK(!style.OutlineStyleIsAuto());
 
   PhysicalRect inner(rect);
-  inner.Inflate(LayoutUnit(style.OutlineOffset()));
+  inner.Inflate(LayoutUnit(style.OutlineOffsetInt()));
   PhysicalRect outer(inner);
   outer.Inflate(LayoutUnit(style.OutlineWidthInt()));
   const BorderEdge common_edge_info(style.OutlineWidthInt(), color,
@@ -563,7 +563,7 @@
     float border_radius = GetFocusRingBorderRadius(style);
     paint_info.context.DrawFocusRing(
         pixel_snapped_outline_rects, style.GetOutlineStrokeWidthForFocusRing(),
-        style.OutlineOffset(), border_radius, min_border_width, color);
+        style.OutlineOffsetInt(), border_radius, min_border_width, color);
     return;
   }
 

diff --git a/third_party/blink/renderer/core/style/computed_style.cc b/third_party/blink/renderer/core/style/computed_style.cc
index f77cc3a..84a8e91 100644
--- a/third_party/blink/renderer/core/style/computed_style.cc
+++ b/third_party/blink/renderer/core/style/computed_style.cc

@@ -2283,9 +2283,9 @@
     return 0;
   if (OutlineStyleIsAuto()) {
     return GraphicsContext::FocusRingOutsetExtent(
-        OutlineOffset(), std::ceil(GetOutlineStrokeWidthForFocusRing()));
+        OutlineOffsetInt(), std::ceil(GetOutlineStrokeWidthForFocusRing()));
   }
-  return base::ClampAdd(OutlineWidthInt(), OutlineOffset()).Max(0);
+  return base::ClampAdd(OutlineWidthInt(), OutlineOffsetInt()).Max(0);
 }
 
 float ComputedStyle::GetOutlineStrokeWidthForFocusRing() const {

diff --git a/third_party/blink/renderer/core/style/computed_style.h b/third_party/blink/renderer/core/style/computed_style.h
index a52eae20..0f4b334 100644
--- a/third_party/blink/renderer/core/style/computed_style.h
+++ b/third_party/blink/renderer/core/style/computed_style.h

@@ -739,6 +739,9 @@
     return OutlineWidthInternal().ToUnsigned();
   }
 
+  // outline-offset
+  int16_t OutlineOffsetInt() const { return OutlineOffset().ToInt(); }
+
   // -webkit-perspective-origin-x
   const Length& PerspectiveOriginX() const { return PerspectiveOrigin().X(); }
   void SetPerspectiveOriginX(const Length& v) {

diff --git a/third_party/blink/renderer/modules/accessibility/ax_node_object.cc b/third_party/blink/renderer/modules/accessibility/ax_node_object.cc
index 7dc396c..10a8708 100644
--- a/third_party/blink/renderer/modules/accessibility/ax_node_object.cc
+++ b/third_party/blink/renderer/modules/accessibility/ax_node_object.cc

@@ -81,6 +81,7 @@
 #include "third_party/blink/renderer/core/layout/layout_object.h"
 #include "third_party/blink/renderer/core/layout/layout_table.h"
 #include "third_party/blink/renderer/core/layout/layout_view.h"
+#include "third_party/blink/renderer/core/mathml_names.h"
 #include "third_party/blink/renderer/core/page/focus_controller.h"
 #include "third_party/blink/renderer/core/page/page.h"
 #include "third_party/blink/renderer/core/svg/svg_element.h"
@@ -794,7 +795,7 @@
   if (GetNode()->HasTagName(html_names::kDtTag))
     return ax::mojom::Role::kDescriptionListTerm;
 
-  if (GetNode()->nodeName() == "math")
+  if (GetNode()->nodeName() == mathml_names::kMathTag.LocalName())
     return ax::mojom::Role::kMath;
 
   if (GetNode()->HasTagName(html_names::kRpTag) ||
@@ -889,7 +890,7 @@
   if (GetNode()->HasTagName(html_names::kFigureTag))
     return ax::mojom::Role::kFigure;
 
-  if (GetNode()->nodeName() == "TIME")
+  if (GetNode()->HasTagName(html_names::kTimeTag))
     return ax::mojom::Role::kTime;
 
   if (IsA<HTMLPlugInElement>(GetNode())) {

diff --git a/third_party/blink/renderer/modules/clipboard/clipboard.cc b/third_party/blink/renderer/modules/clipboard/clipboard.cc
index b108d8d..66c427a 100644
--- a/third_party/blink/renderer/modules/clipboard/clipboard.cc
+++ b/third_party/blink/renderer/modules/clipboard/clipboard.cc

@@ -6,8 +6,8 @@
 
 #include <utility>
 #include "third_party/blink/renderer/bindings/core/v8/script_promise_resolver.h"
+#include "third_party/blink/renderer/bindings/modules/v8/v8_clipboard_item_options.h"
 #include "third_party/blink/renderer/core/execution_context/execution_context.h"
-#include "third_party/blink/renderer/modules/clipboard/clipboard_item_options.h"
 #include "third_party/blink/renderer/modules/clipboard/clipboard_promise.h"
 
 namespace blink {

diff --git a/third_party/blink/renderer/modules/media_capabilities/media_capabilities.cc b/third_party/blink/renderer/modules/media_capabilities/media_capabilities.cc
index 4c80885a..f667553 100644
--- a/third_party/blink/renderer/modules/media_capabilities/media_capabilities.cc
+++ b/third_party/blink/renderer/modules/media_capabilities/media_capabilities.cc

@@ -907,7 +907,7 @@
     return ScriptPromise();
   }
 
-  MediaCapabilitiesKeySystemConfiguration* key_system_config =
+  const MediaCapabilitiesKeySystemConfiguration* key_system_config =
       configuration->keySystemConfiguration();
   if (!key_system_config->hasKeySystem() ||
       key_system_config->keySystem().IsEmpty()) {

diff --git a/third_party/blink/renderer/modules/media_controls/resources/default_100_percent/loading_mask_1_white.svg b/third_party/blink/renderer/modules/media_controls/resources/default_100_percent/loading_mask_1_white.svg
new file mode 100644
index 0000000..075da26
--- /dev/null
+++ b/third_party/blink/renderer/modules/media_controls/resources/default_100_percent/loading_mask_1_white.svg

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 19.2.1, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<svg fill="#ffffff" version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 viewBox="0 0 196 196" style="enable-background:new 0 0 196 196;" xml:space="preserve">
+<path class="st0" d="M98,49v4c-24.9,0-45,20.1-45,45
+	c0,18,10.6,33.6,25.9,40.8l-1.7,3.6c0.1,0,0.2,0.1,0.3,0.1c-0.1,0-0.2-0.1-0.3-0.1l0,0C60.5,134.5,49,117.6,49,98
+	C49,70.9,70.9,49,98,49z"/>
+</svg>

diff --git a/third_party/blink/renderer/modules/media_controls/resources/default_100_percent/loading_mask_2_white.svg b/third_party/blink/renderer/modules/media_controls/resources/default_100_percent/loading_mask_2_white.svg
new file mode 100644
index 0000000..25c3f1e
--- /dev/null
+++ b/third_party/blink/renderer/modules/media_controls/resources/default_100_percent/loading_mask_2_white.svg

@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generator: Adobe Illustrator 19.2.1, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
+<svg fill="#ffffff" version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"
+	 viewBox="0 0 196 196" style="enable-background:new 0 0 196 196;" xml:space="preserve">
+<path class="st0" d="M147,98c0,19.6-11.5,36.5-28.2,44.4l0,0c-0.1,0-0.2,0.1-0.3,0.1
+	c0.1,0,0.2-0.1,0.3-0.1l-1.7-3.6C132.4,131.6,143,116,143,98c0-24.9-20.1-45-45-45v-4C125.1,49,147,70.9,147,98z"/>
+</svg>

diff --git a/third_party/blink/renderer/modules/media_controls/resources/ic_arrow_back_white.svg b/third_party/blink/renderer/modules/media_controls/resources/ic_arrow_back_white.svg
new file mode 100644
index 0000000..6fab9d2
--- /dev/null
+++ b/third_party/blink/renderer/modules/media_controls/resources/ic_arrow_back_white.svg

@@ -0,0 +1,4 @@
+<svg fill="#ffffff" height="24" viewBox="0 0 24 24" width="24" xmlns="http://www.w3.org/2000/svg">
+    <path d="M0 0h24v24H0z" fill="none"/>
+    <path d="M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.41L7.83 13H20v-2z"/>
+</svg>
\ No newline at end of file

diff --git a/third_party/blink/renderer/modules/media_controls/resources/ic_cast_off_white.svg b/third_party/blink/renderer/modules/media_controls/resources/ic_cast_off_white.svg
new file mode 100644
index 0000000..4fcc4346
--- /dev/null
+++ b/third_party/blink/renderer/modules/media_controls/resources/ic_cast_off_white.svg

@@ -0,0 +1,5 @@
+<svg fill="#ffffff" height="24" viewBox="0 0 24 24" width="24" xmlns="http://www.w3.org/2000/svg">
+    <path d="M0 0h24v24H0z" fill="none" opacity=".1"/>
+    <path d="M0 0h24v24H0z" fill="none"/>
+    <path d="M21 3H3c-1.1 0-2 .9-2 2v3h2V5h18v14h-7v2h7c1.1 0 2-.9 2-2V5c0-1.1-.9-2-2-2zM1 18v3h3c0-1.66-1.34-3-3-3zm0-4v2c2.76 0 5 2.24 5 5h2c0-3.87-3.13-7-7-7zm0-4v2c4.97 0 9 4.03 9 9h2c0-6.08-4.93-11-11-11z"/>
+</svg>
\ No newline at end of file

diff --git a/third_party/blink/renderer/modules/media_controls/resources/ic_cast_on_white.svg b/third_party/blink/renderer/modules/media_controls/resources/ic_cast_on_white.svg
new file mode 100644
index 0000000..e284efa
--- /dev/null
+++ b/third_party/blink/renderer/modules/media_controls/resources/ic_cast_on_white.svg

@@ -0,0 +1,5 @@
+<svg fill="#ffffff" height="24" viewBox="0 0 24 24" width="24" xmlns="http://www.w3.org/2000/svg">
+    <path d="M0 0h24v24H0z" fill="none" opacity=".1"/>
+    <path d="M0 0h24v24H0z" fill="none"/>
+    <path d="M1 18v3h3c0-1.66-1.34-3-3-3zm0-4v2c2.76 0 5 2.24 5 5h2c0-3.87-3.13-7-7-7zm18-7H5v1.63c3.96 1.28 7.09 4.41 8.37 8.37H19V7zM1 10v2c4.97 0 9 4.03 9 9h2c0-6.08-4.93-11-11-11zm20-7H3c-1.1 0-2 .9-2 2v3h2V5h18v14h-7v2h7c1.1 0 2-.9 2-2V5c0-1.1-.9-2-2-2z"/>
+</svg>
\ No newline at end of file

diff --git a/third_party/blink/renderer/modules/media_controls/resources/ic_closed_caption_white.svg b/third_party/blink/renderer/modules/media_controls/resources/ic_closed_caption_white.svg
new file mode 100644
index 0000000..2974c39
--- /dev/null
+++ b/third_party/blink/renderer/modules/media_controls/resources/ic_closed_caption_white.svg

@@ -0,0 +1,4 @@
+<svg fill="#ffffff" height="24" viewBox="0 0 24 24" width="24" xmlns="http://www.w3.org/2000/svg">
+    <path d="M0 0h24v24H0z" fill="none"/>
+    <path d="M19 4H5c-1.11 0-2 .9-2 2v12c0 1.1.89 2 2 2h14c1.1 0 2-.9 2-2V6c0-1.1-.9-2-2-2zm-8 7H9.5v-.5h-2v3h2V13H11v1c0 .55-.45 1-1 1H7c-.55 0-1-.45-1-1v-4c0-.55.45-1 1-1h3c.55 0 1 .45 1 1v1zm7 0h-1.5v-.5h-2v3h2V13H18v1c0 .55-.45 1-1 1h-3c-.55 0-1-.45-1-1v-4c0-.55.45-1 1-1h3c.55 0 1 .45 1 1v1z"/>
+</svg>
\ No newline at end of file

diff --git a/third_party/blink/renderer/modules/media_controls/resources/ic_download_white.svg b/third_party/blink/renderer/modules/media_controls/resources/ic_download_white.svg
new file mode 100644
index 0000000..7e00d50
--- /dev/null
+++ b/third_party/blink/renderer/modules/media_controls/resources/ic_download_white.svg

@@ -0,0 +1,4 @@
+<svg fill="#ffffff" height="24" viewBox="0 0 24 24" width="24" xmlns="http://www.w3.org/2000/svg">
+    <path d="M19 9h-4V3H9v6H5l7 7 7-7zM5 18v2h14v-2H5z"/>
+    <path d="M0 0h24v24H0z" fill="none"/>
+</svg>
\ No newline at end of file

diff --git a/third_party/blink/renderer/modules/media_controls/resources/ic_no_source_white.svg b/third_party/blink/renderer/modules/media_controls/resources/ic_no_source_white.svg
new file mode 100644
index 0000000..764cdb17
--- /dev/null
+++ b/third_party/blink/renderer/modules/media_controls/resources/ic_no_source_white.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24px" height="24px" viewBox="0 0 24 24" fill="#ffffff">
+    <path fill="none" d="M0 0h24v24H0zm0 0h24v24H0zm21 19c0 1.1-.9 2-2 2H5c-1.1 0-2-.9-2-2V5c0-1.1.9-2 2-2h14c1.1 0 2 .9 2 2"/>
+    <path fill="none" d="M0 0h24v24H0z"/>
+    <path d="M21 5v6.59l-3-3.01-4 4.01-4-4-4 4-3-3.01V5c0-1.1.9-2 2-2h14c1.1 0 2 .9 2 2zm-3 6.42l3 3.01V19c0 1.1-.9 2-2 2H5c-1.1 0-2-.9-2-2v-6.58l3 2.99 4-4 4 4 4-3.99z"/>
+</svg>

diff --git a/third_party/blink/renderer/modules/media_controls/resources/ic_picture_in_picture_exit_white.svg b/third_party/blink/renderer/modules/media_controls/resources/ic_picture_in_picture_exit_white.svg
new file mode 100644
index 0000000..b6475bd
--- /dev/null
+++ b/third_party/blink/renderer/modules/media_controls/resources/ic_picture_in_picture_exit_white.svg

@@ -0,0 +1,6 @@
+<svg width="22" height="18" xmlns="http://www.w3.org/2000/svg">
+  <g fill="none" fill-rule="evenodd" opacity=".87">
+    <path d="M18 4H4v10h14V4zm4 12V1.98C22 .88 21.1 0 20 0H2C.9 0 0 .88 0 1.98V16c0 1.1.9 2 2 2h18c1.1 0 2-.9 2-2zm-2 .02H2V1.97h18v14.05z" fill="#ffffff" fill-rule="nonzero"/>
+    <path d="M-1-3h24v24H-1z"/>
+  </g>
+</svg>
\ No newline at end of file

diff --git a/third_party/blink/renderer/modules/media_controls/resources/ic_picture_in_picture_white.svg b/third_party/blink/renderer/modules/media_controls/resources/ic_picture_in_picture_white.svg
new file mode 100644
index 0000000..8ff6c152
--- /dev/null
+++ b/third_party/blink/renderer/modules/media_controls/resources/ic_picture_in_picture_white.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24px" height="24px" viewBox="0 0 24 24" fill="#ffffff">
+    <path d="M19 11h-8v6h8v-6zm4 8V4.98C23 3.88 22.1 3 21 3H3c-1.1 0-2 .88-2 1.98V19c0 1.1.9 2 2 2h18c1.1 0 2-.9 2-2zm-2 .02H3V4.97h18v14.05z"/>
+    <path fill="none" d="M0 0h24v24H0V0z"/>
+</svg>

diff --git a/third_party/blink/renderer/modules/media_controls/resources/ic_subtitles_white.svg b/third_party/blink/renderer/modules/media_controls/resources/ic_subtitles_white.svg
new file mode 100644
index 0000000..94cb292
--- /dev/null
+++ b/third_party/blink/renderer/modules/media_controls/resources/ic_subtitles_white.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24px" height="24px" viewBox="0 0 24 24" fill="#ffffff">
+    <path d="M0 0h24v24H0z" fill="none"/>
+    <path d="M20 4H4c-1.1 0-2 .9-2 2v12c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V6c0-1.1-.9-2-2-2zM4 12h4v2H4v-2zm10 6H4v-2h10v2zm6 0h-4v-2h4v2zm0-4H10v-2h10v2z"/>
+</svg>

diff --git a/third_party/blink/renderer/modules/media_controls/resources/mediaControls.css b/third_party/blink/renderer/modules/media_controls/resources/mediaControls.css
index 8fcfaa0..d459f85 100644
--- a/third_party/blink/renderer/modules/media_controls/resources/mediaControls.css
+++ b/third_party/blink/renderer/modules/media_controls/resources/mediaControls.css

@@ -331,15 +331,16 @@
 
 audio::-webkit-media-controls-play-button,
 video::-webkit-media-controls-play-button {
-  background-image: -webkit-image-set(url(ic_play_arrow.svg) 1x);
+  background-image: -internal-light-dark(-webkit-image-set(url(ic_play_arrow.svg) 1x), -webkit-image-set(url(ic_play_arrow_white.svg) 1x));
 }
+
 video::-webkit-media-controls:not(.audio-only) [pseudo="-webkit-media-controls-panel"] [pseudo="-webkit-media-controls-play-button"] {
   background-image: -webkit-image-set(url(ic_play_arrow_white.svg) 1x);
 }
 
 audio::-webkit-media-controls-mute-button,
 video::-webkit-media-controls-mute-button {
-  background-image: -webkit-image-set(url(ic_volume_up.svg) 1x);
+  background-image: -internal-light-dark(-webkit-image-set(url(ic_volume_up.svg) 1x), -webkit-image-set(url(ic_volume_up_white.svg) 1x));
 }
 video::-webkit-media-controls:not(.audio-only) [pseudo="-webkit-media-controls-panel"] [pseudo="-webkit-media-controls-mute-button"] {
   background-image: -webkit-image-set(url(ic_volume_up_white.svg) 1x);
@@ -347,7 +348,7 @@
 
 audio::-webkit-media-controls-mute-button.muted,
 video::-webkit-media-controls-mute-button.muted {
-  background-image: -webkit-image-set(url(ic_volume_off.svg) 1x);
+  background-image: -internal-light-dark(-webkit-image-set(url(ic_volume_off.svg) 1x), -webkit-image-set(url(ic_volume_off_white.svg) 1x));
 }
 video::-webkit-media-controls:not(.audio-only) [pseudo="-webkit-media-controls-panel"] [pseudo="-webkit-media-controls-mute-button"].muted {
   background-image: -webkit-image-set(url(ic_volume_off_white.svg) 1x);
@@ -363,7 +364,7 @@
 
 audio::-webkit-media-controls-fullscreen-button,
 video::-webkit-media-controls-fullscreen-button {
-  background-image: -webkit-image-set(url(ic_fullscreen.svg) 1x);
+  background-image: -internal-light-dark(-webkit-image-set(url(ic_fullscreen.svg) 1x), -webkit-image-set(url(ic_fullscreen_white.svg) 1x));
 }
 video::-webkit-media-controls:not(.audio-only) [pseudo="-webkit-media-controls-panel"] [pseudo="-webkit-media-controls-fullscreen-button"] {
   background-image: -webkit-image-set(url(ic_fullscreen_white.svg) 1x);
@@ -371,7 +372,7 @@
 
 audio::-webkit-media-controls-fullscreen-button.fullscreen,
 video::-webkit-media-controls-fullscreen-button.fullscreen {
-  background-image: -webkit-image-set(url(ic_fullscreen_exit.svg) 1x);
+  background-image: -internal-light-dark(-webkit-image-set(url(ic_fullscreen_exit.svg) 1x), -webkit-image-set(url(ic_fullscreen_exit_white.svg) 1x));
 }
 video::-webkit-media-controls:not(.audio-only) [pseudo="-webkit-media-controls-panel"] [pseudo="-webkit-media-controls-fullscreen-button"].fullscreen {
   background-image: -webkit-image-set(url(ic_fullscreen_exit_white.svg) 1x);
@@ -391,12 +392,12 @@
 
 audio::-internal-media-controls-cast-button,
 video::-internal-media-controls-cast-button {
-  background-image: -webkit-image-set(url(ic_cast_off.svg) 1x);
+  background-image: -internal-light-dark(-webkit-image-set(url(ic_cast_off.svg) 1x), -webkit-image-set(url(ic_cast_off_white.svg) 1x));
 }
 
 audio::-internal-media-controls-cast-button.on,
 video::-internal-media-controls-cast-button.on {
-  background-image: -webkit-image-set(url(ic_cast_on.svg) 1x);
+  background-image: -internal-light-dark(-webkit-image-set(url(ic_cast_on.svg) 1x), -webkit-image-set(url(ic_cast_on_white.svg) 1x));
 }
 
 audio::-webkit-media-controls-toggle-closed-captions-button {
@@ -404,31 +405,29 @@
 }
 
 video::-webkit-media-controls-toggle-closed-captions-button {
-  background-image: -webkit-image-set(url(ic_subtitles.svg) 1x);
+  background-image: -internal-light-dark(-webkit-image-set(url(ic_subtitles.svg) 1x), -webkit-image-set(url(ic_subtitles_white.svg) 1x));
 }
 
 video::-webkit-media-controls-toggle-closed-captions-button.closed-captions {
-  background-image: -webkit-image-set(url(ic_closed_caption.svg) 1x);
+  background-image: -internal-light-dark(-webkit-image-set(url(ic_closed_caption.svg) 1x), -webkit-image-set(url(ic_closed_caption_white.svg) 1x));
 }
 
 video::-internal-media-controls-download-button,
 audio::-internal-media-controls-download-button {
-  background-image: -webkit-image-set(url(ic_download.svg) 1x);
+  background-image: -internal-light-dark(-webkit-image-set(url(ic_download.svg) 1x), -webkit-image-set(url(ic_download_white.svg) 1x));
 }
 
 video::-internal-media-controls-overflow-button,
 audio::-internal-media-controls-overflow-button {
-  background-image: -webkit-image-set(url(ic_menu.svg) 1x);
+  background-image: -internal-light-dark(-webkit-image-set(url(ic_menu.svg) 1x), -webkit-image-set(url(ic_menu_white.svg) 1x));
 }
 
 video::-internal-media-controls-picture-in-picture-button {
-  background-image: -webkit-image-set(
-    url(ic_picture_in_picture.svg) 1x);
+  background-image: -internal-light-dark(-webkit-image-set(url(ic_picture_in_picture.svg) 1x), -webkit-image-set(url(ic_picture_in_picture_white.svg) 1x));
 }
 
 video::-internal-media-controls-picture-in-picture-button.on {
-  background-image: -webkit-image-set(
-    url(ic_picture_in_picture_exit.svg) 1x);
+    background-image: -internal-light-dark(-webkit-image-set(url(ic_picture_in_picture_exit.svg) 1x), -webkit-image-set(url(ic_picture_in_picture_exit_white.svg) 1x));
 }
 
 video::-webkit-media-controls:not(.audio-only) [pseudo="-webkit-media-controls-panel"] [pseudo="-internal-media-controls-overflow-button"] {
@@ -565,7 +564,7 @@
   background-size: 50%;
   background-repeat: no-repeat;
   background-position: center center;
-  background-image: -webkit-image-set(url(ic_play_arrow.svg) 1x);
+  background-image: -internal-light-dark(-webkit-image-set(url(ic_play_arrow.svg) 1x), -webkit-image-set(url(ic_play_arrow_white.svg) 1x));
   background-color: rgba(255, 255, 255, .9);
   box-shadow: 0 0 20px 0 rgba(0, 0, 0, 0.10);
 
@@ -585,7 +584,7 @@
 audio::-webkit-media-controls.state-buffering input[pseudo="-webkit-media-controls-play-button" i],
 video::-webkit-media-controls.state-buffering input[pseudo="-webkit-media-controls-play-button" i],
 video::-webkit-media-controls.state-buffering input[pseudo="-webkit-media-controls-overlay-play-button" i]::-internal-media-controls-overlay-play-button-internal {
-  background-image: -webkit-image-set(url(ic_pause.svg) 1x);
+  background-image: -internal-light-dark(-webkit-image-set(url(ic_pause.svg) 1x), -webkit-image-set(url(ic_pause_white.svg) 1x));
 }
 
 /* For the play button inside the button panel, we want to use a white icon
@@ -702,15 +701,13 @@
 
 div[pseudo="-internal-media-controls-loading-panel" i]::-internal-media-controls-loading-panel-spinner-mask-1-background {
   left: 0;
-  background-image: -webkit-image-set(
-    url(default_100_percent/loading_mask_1.svg) 1x);
+    background-image: -internal-light-dark(-webkit-image-set(url(default_100_percent/loading_mask_1.svg) 1x), -webkit-image-set(url(default_100_percent/loading_mask_1_white.svg) 1x));
   background-position: center left;
 }
 
 div[pseudo="-internal-media-controls-loading-panel" i]::-internal-media-controls-loading-panel-spinner-mask-2-background {
   left: -100%;
-  background-image: -webkit-image-set(
-    url(default_100_percent/loading_mask_2.svg) 1x);
+    background-image: -internal-light-dark(-webkit-image-set(url(default_100_percent/loading_mask_2.svg) 1x), -webkit-image-set(url(default_100_percent/loading_mask_2_white.svg) 1x));
   background-position: center right;
 }
 
@@ -719,7 +716,7 @@
   -webkit-appearance: -internal-media-control;
 
   flex: 1;
-  background: rgba(0, 0, 0, .2);
+  background: -internal-light-dark(rgba(0, 0, 0, .2), rgba(255, 255, 255, 0.2));
   border-radius: 2px;
   position: relative;
 }
@@ -732,8 +729,9 @@
 input[pseudo="-webkit-media-controls-timeline" i]::-webkit-slider-thumb,
 input[pseudo="-webkit-media-controls-volume-slider" i]::-webkit-slider-thumb {
   -webkit-appearance: -internal-media-control;
-  background: rgba(0, 0, 0, .87);
-  box-shadow: 0 0 10px 0 #fff;
+  background: -internal-light-dark(rgba(0, 0, 0, .87), rgba(255, 255, 255, 0.87));
+
+  box-shadow: 0 0 10px 0 -internal-light-dark(#ffffff, #000000);
 
   width: 12px;
   height: 12px;
@@ -771,7 +769,7 @@
 
 input[pseudo="-webkit-media-controls-timeline" i]::-internal-track-segment-highlight-before,
 input[pseudo="-webkit-media-controls-volume-slider" i]::-internal-track-segment-highlight-before {
-  background: rgba(0, 0, 0, .87);
+  background: -internal-light-dark(rgba(0, 0, 0, .87), rgba(255, 255, 255, 0.87));
   border-radius: 100px;
 }
 video::-webkit-media-controls:not(.audio-only) input[pseudo="-webkit-media-controls-timeline" i]::-internal-track-segment-highlight-before,
@@ -781,7 +779,7 @@
 
 input[pseudo="-webkit-media-controls-timeline" i]::-internal-track-segment-highlight-after,
 input[pseudo="-webkit-media-controls-volume-slider" i]::-internal-track-segment-highlight-after {
-  background: rgba(0, 0, 0, .54);
+  background: -internal-light-dark(rgba(0, 0, 0, .54), rgba(255, 255, 255, 0.54));
   border-radius: 2px;
 }
 video::-webkit-media-controls:not(.audio-only) input[pseudo="-webkit-media-controls-timeline" i]::-internal-track-segment-highlight-after,
@@ -837,9 +835,9 @@
   opacity: 0.87;
   font-family: Roboto-Regular, Roboto, sans-serif;
   font-size: 14px;
-  color: #000000;
+  color: -internal-light-dark(#000000, #ffffff);
   letter-spacing: 0;
-  text-shadow: 0 0 10px #FFFFFF;
+  text-shadow: 0 0 10px -internal-light-dark(#ffffff, #3b3b3b);
 }
 video::-webkit-media-controls:not(.audio-only) [pseudo="-webkit-media-controls-current-time-display"],
 video::-webkit-media-controls:not(.audio-only) [pseudo="-webkit-media-controls-time-remaining-display"] {
@@ -894,7 +892,7 @@
 
   font-family: Roboto-Regular, Roboto, sans-serif;
   font-size: 12px;
-  color: rgba(0,0,0,0.87);
+  color: -internal-light-dark(rgba(0,0,0,0.87), rgba(255,255,255,0.87));
   letter-spacing: 0;
 
   line-height: 48px;
@@ -1015,7 +1013,8 @@
 video::-internal-media-controls-overflow-menu-list-item:focus,
 audio::-internal-media-controls-text-track-list-item:focus,
 video::-internal-media-controls-text-track-list-item:focus {
-  background-color: #e0e0e0;
+  background-color: -internal-light-dark(#e0e0e0, #3b3b3b);
+  color: -internal-light-dark(rgba(0,0,0,0.87), rgba(255,255,255,0.87));
   outline: none;
 }
 
@@ -1032,7 +1031,7 @@
   background-size: 18px;
   background-position: 20px center;
   background-repeat: no-repeat;
-  background-image: -webkit-image-set(url(ic_arrow_back.svg) 1x);
+  background-image: -internal-light-dark(-webkit-image-set(url(ic_arrow_back.svg) 1x), -webkit-image-set(url(ic_arrow_back_white.svg) 1x));
 }
 
 label[pseudo="-internal-media-controls-text-track-list-item"] * {
@@ -1085,7 +1084,7 @@
 video::-webkit-media-controls.audio-only [pseudo="-webkit-media-controls-enclosure"] {
   max-height: 54px;
   flex-direction: row;
-  background: #F1F3F4;
+  background: -internal-light-dark(#F1F3F4, #3B3B3B);
   border-radius: 100px;
   overflow: hidden;
 }
@@ -1144,7 +1143,7 @@
 
 .state-no-source input[pseudo="-webkit-media-controls-overlay-play-button" i]::-internal-media-controls-overlay-play-button-internal {
   opacity: .3;
-  background-image: -webkit-image-set(url(ic_no_source.svg) 1x);
+  background-image: -internal-light-dark(-webkit-image-set(url(ic_no_source.svg) 1x), -webkit-image-set(url(ic_no_source_white.svg) 1x));
 }
 
 /**
@@ -1314,8 +1313,7 @@
 
 video::-internal-media-controls-text-track-list-kind-captions {
     -webkit-appearance: none;
-    background-image: -webkit-image-set(
-      url(ic_closed_caption.svg) 1x);
+      background-image: -internal-light-dark(-webkit-image-set(url(ic_closed_caption.svg) 1x), -webkit-image-set(url(ic_closed_caption_white.svg) 1x));
     background-size: 32px;
     background-repeat: no-repeat;
     background-position: center center;
@@ -1327,8 +1325,7 @@
 
 video::-internal-media-controls-text-track-list-kind-subtitles {
     -webkit-appearance: none;
-    background-image: -webkit-image-set(
-      url(ic_subtitles.svg) 1x);
+      background-image: -internal-light-dark(-webkit-image-set(url(ic_subtitles.svg) 1x), -webkit-image-set(url(ic_subtitles_white.svg) 1x));
     background-size: 32px;
     background-repeat: no-repeat;
     background-position: center center;

diff --git a/third_party/blink/renderer/modules/payments/payment_request_event.h b/third_party/blink/renderer/modules/payments/payment_request_event.h
index 783fe4a..615b51e 100644
--- a/third_party/blink/renderer/modules/payments/payment_request_event.h
+++ b/third_party/blink/renderer/modules/payments/payment_request_event.h

@@ -91,10 +91,10 @@
   String payment_request_origin_;
   String payment_request_id_;
   HeapVector<Member<PaymentMethodData>> method_data_;
-  Member<PaymentCurrencyAmount> total_;
+  Member<const PaymentCurrencyAmount> total_;
   HeapVector<Member<PaymentDetailsModifier>> modifiers_;
   String instrument_key_;
-  Member<PaymentOptions> payment_options_;
+  Member<const PaymentOptions> payment_options_;
   HeapVector<Member<PaymentShippingOption>> shipping_options_;
 
   Member<ScriptPromiseResolver> change_payment_request_details_resolver_;

diff --git a/third_party/blink/renderer/modules/webcodecs/image_decoder_external.h b/third_party/blink/renderer/modules/webcodecs/image_decoder_external.h
index 463747a..a9f8767a 100644
--- a/third_party/blink/renderer/modules/webcodecs/image_decoder_external.h
+++ b/third_party/blink/renderer/modules/webcodecs/image_decoder_external.h

@@ -64,7 +64,7 @@
 
   // Construction parameters.
   Member<const ImageDecoderInit> init_data_;
-  Member<ImageBitmapOptions> options_;
+  Member<const ImageBitmapOptions> options_;
 
   bool data_complete_ = false;
 

diff --git a/third_party/blink/renderer/modules/webcodecs/video_decoder.cc b/third_party/blink/renderer/modules/webcodecs/video_decoder.cc
index 0d11415..d8aa2db 100644
--- a/third_party/blink/renderer/modules/webcodecs/video_decoder.cc
+++ b/third_party/blink/renderer/modules/webcodecs/video_decoder.cc

@@ -17,9 +17,9 @@
 #include "media/media_buildflags.h"
 #include "third_party/blink/renderer/bindings/modules/v8/v8_encoded_video_chunk.h"
 #include "third_party/blink/renderer/bindings/modules/v8/v8_encoded_video_config.h"
+#include "third_party/blink/renderer/bindings/modules/v8/v8_video_decoder_init.h"
 #include "third_party/blink/renderer/core/dom/dom_exception.h"
 #include "third_party/blink/renderer/modules/webcodecs/encoded_video_chunk.h"
-#include "third_party/blink/renderer/modules/webcodecs/video_decoder_init.h"
 #include "third_party/blink/renderer/modules/webcodecs/video_frame.h"
 #include "third_party/blink/renderer/platform/bindings/exception_code.h"
 #include "third_party/blink/renderer/platform/bindings/exception_state.h"

diff --git a/third_party/blink/renderer/modules/webtransport/BUILD.gn b/third_party/blink/renderer/modules/webtransport/BUILD.gn
index efa1ccbd..5a176b1 100644
--- a/third_party/blink/renderer/modules/webtransport/BUILD.gn
+++ b/third_party/blink/renderer/modules/webtransport/BUILD.gn

@@ -6,6 +6,8 @@
 
 blink_modules_sources("webtransport") {
   sources = [
+    "bidirectional_stream.cc",
+    "bidirectional_stream.h",
     "incoming_stream.cc",
     "incoming_stream.h",
     "outgoing_stream.cc",
@@ -23,9 +25,12 @@
 jumbo_source_set("unit_tests") {
   testonly = true
   sources = [
+    "bidirectional_stream_test.cc",
     "incoming_stream_test.cc",
     "outgoing_stream_test.cc",
     "quic_transport_test.cc",
+    "test_utils.cc",
+    "test_utils.h",
   ]
 
   configs += [

diff --git a/third_party/blink/renderer/modules/webtransport/bidirectional_stream.cc b/third_party/blink/renderer/modules/webtransport/bidirectional_stream.cc
new file mode 100644
index 0000000..2ab40ec
--- /dev/null
+++ b/third_party/blink/renderer/modules/webtransport/bidirectional_stream.cc

@@ -0,0 +1,85 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/blink/renderer/modules/webtransport/bidirectional_stream.h"
+
+#include <utility>
+
+#include "base/check.h"
+#include "base/logging.h"
+#include "third_party/blink/renderer/modules/webtransport/quic_transport.h"
+#include "third_party/blink/renderer/platform/heap/heap.h"
+#include "third_party/blink/renderer/platform/heap/persistent.h"
+#include "third_party/blink/renderer/platform/heap/visitor.h"
+
+namespace blink {
+
+BidirectionalStream::BidirectionalStream(
+    ScriptState* script_state,
+    QuicTransport* quic_transport,
+    uint32_t stream_id,
+    mojo::ScopedDataPipeProducerHandle outgoing_producer,
+    mojo::ScopedDataPipeConsumerHandle incoming_consumer)
+    : outgoing_stream_(
+          MakeGarbageCollected<OutgoingStream>(script_state,
+                                               this,
+                                               std::move(outgoing_producer))),
+      incoming_stream_(MakeGarbageCollected<IncomingStream>(
+          script_state,
+          WTF::Bind(&BidirectionalStream::OnIncomingStreamAbort,
+                    WrapWeakPersistent(this)),
+          std::move(incoming_consumer))),
+      quic_transport_(quic_transport),
+      stream_id_(stream_id) {}
+
+void BidirectionalStream::Init() {
+  outgoing_stream_->Init();
+  incoming_stream_->Init();
+}
+
+void BidirectionalStream::OnIncomingStreamClosed(bool fin_received) {
+  incoming_stream_->OnIncomingStreamClosed(fin_received);
+  // TODO(ricea): Review this behaviour when adding detail to the specification.
+  if (!sent_fin_) {
+    outgoing_stream_->Reset();
+  }
+}
+
+void BidirectionalStream::Reset() {
+  outgoing_stream_->Reset();
+  incoming_stream_->Reset();
+}
+
+void BidirectionalStream::ContextDestroyed() {
+  outgoing_stream_->ContextDestroyed();
+  incoming_stream_->ContextDestroyed();
+}
+
+void BidirectionalStream::SendFin() {
+  quic_transport_->SendFin(stream_id_);
+  sent_fin_ = true;
+  // The IncomingStream will be closed on the network service side.
+}
+
+void BidirectionalStream::OnOutgoingStreamAbort() {
+  DCHECK(!sent_fin_);
+  quic_transport_->ForgetStream(stream_id_);
+  incoming_stream_->Reset();
+}
+
+void BidirectionalStream::Trace(Visitor* visitor) {
+  visitor->Trace(outgoing_stream_);
+  visitor->Trace(incoming_stream_);
+  visitor->Trace(quic_transport_);
+  ScriptWrappable::Trace(visitor);
+  WebTransportStream::Trace(visitor);
+  OutgoingStream::Client::Trace(visitor);
+}
+
+void BidirectionalStream::OnIncomingStreamAbort() {
+  quic_transport_->ForgetStream(stream_id_);
+  outgoing_stream_->Reset();
+}
+
+}  // namespace blink

diff --git a/third_party/blink/renderer/modules/webtransport/bidirectional_stream.h b/third_party/blink/renderer/modules/webtransport/bidirectional_stream.h
new file mode 100644
index 0000000..a86b937
--- /dev/null
+++ b/third_party/blink/renderer/modules/webtransport/bidirectional_stream.h

@@ -0,0 +1,86 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_BLINK_RENDERER_MODULES_WEBTRANSPORT_BIDIRECTIONAL_STREAM_H_
+#define THIRD_PARTY_BLINK_RENDERER_MODULES_WEBTRANSPORT_BIDIRECTIONAL_STREAM_H_
+
+#include <stdint.h>
+
+#include "mojo/public/cpp/system/data_pipe.h"
+#include "third_party/blink/renderer/modules/modules_export.h"
+#include "third_party/blink/renderer/modules/webtransport/incoming_stream.h"
+#include "third_party/blink/renderer/modules/webtransport/outgoing_stream.h"
+#include "third_party/blink/renderer/modules/webtransport/web_transport_stream.h"
+#include "third_party/blink/renderer/platform/bindings/script_wrappable.h"
+#include "third_party/blink/renderer/platform/heap/garbage_collected.h"
+
+namespace blink {
+
+class ScriptState;
+class QuicTransport;
+
+class MODULES_EXPORT BidirectionalStream final : public ScriptWrappable,
+                                                 public WebTransportStream,
+                                                 public OutgoingStream::Client {
+  DEFINE_WRAPPERTYPEINFO();
+  USING_GARBAGE_COLLECTED_MIXIN(BidirectionalStream);
+
+ public:
+  // BidirectionalStream doesn't have a JavaScript constructor. It is only
+  // constructed from C++.
+  explicit BidirectionalStream(ScriptState*,
+                               QuicTransport*,
+                               uint32_t stream_id,
+                               mojo::ScopedDataPipeProducerHandle,
+                               mojo::ScopedDataPipeConsumerHandle);
+
+  void Init();
+
+  // Implementation of bidirectional_stream.idl. As noted in the IDL file, these
+  // properties are implemented on OutgoingStream and IncomingStream in the
+  // standard.
+  WritableStream* writable() const { return outgoing_stream_->Writable(); }
+
+  ScriptPromise writingAborted() const {
+    return outgoing_stream_->WritingAborted();
+  }
+
+  void abortWriting(StreamAbortInfo* abort_info) {
+    outgoing_stream_->AbortWriting(abort_info);
+  }
+
+  ReadableStream* readable() const { return incoming_stream_->Readable(); }
+
+  ScriptPromise readingAborted() const {
+    return incoming_stream_->ReadingAborted();
+  }
+
+  void abortReading(StreamAbortInfo* info) {
+    incoming_stream_->AbortReading(info);
+  }
+
+  // Implementation of WebTransportStream.
+  void OnIncomingStreamClosed(bool fin_received) override;
+  void Reset() override;
+  void ContextDestroyed() override;
+
+  // Implementation of OutgoingStream::Client.
+  void SendFin() override;
+  void OnOutgoingStreamAbort() override;
+
+  void Trace(Visitor*) override;
+
+ private:
+  void OnIncomingStreamAbort();
+
+  const Member<OutgoingStream> outgoing_stream_;
+  const Member<IncomingStream> incoming_stream_;
+  const Member<QuicTransport> quic_transport_;
+  const uint32_t stream_id_;
+  bool sent_fin_ = false;
+};
+
+}  // namespace blink
+
+#endif  // THIRD_PARTY_BLINK_RENDERER_MODULES_WEBTRANSPORT_BIDIRECTIONAL_STREAM_H_

diff --git a/third_party/blink/renderer/modules/webtransport/bidirectional_stream.idl b/third_party/blink/renderer/modules/webtransport/bidirectional_stream.idl
new file mode 100644
index 0000000..1a6744fb
--- /dev/null
+++ b/third_party/blink/renderer/modules/webtransport/bidirectional_stream.idl

@@ -0,0 +1,21 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// https://wicg.github.io/web-transport/#bidirectionalstream
+
+[ Exposed=(Window,Worker),
+  RuntimeEnabled=QuicTransport ]
+interface BidirectionalStream {
+  // Attributes from the OutgoingStream mixin. OutgoingStream and IncomingStream
+  // are not real mixins in this implementation because it would lead to diamond
+  // inheritance.
+  readonly attribute WritableStream writable;
+  readonly attribute Promise<StreamAbortInfo> writingAborted;
+  void abortWriting(optional StreamAbortInfo abortInfo);
+
+  // Attributes from the IncomingStream mixin.
+  readonly attribute ReadableStream readable;
+  readonly attribute Promise<StreamAbortInfo> readingAborted;
+  void abortReading(optional StreamAbortInfo abortInfo);
+};

diff --git a/third_party/blink/renderer/modules/webtransport/bidirectional_stream_test.cc b/third_party/blink/renderer/modules/webtransport/bidirectional_stream_test.cc
new file mode 100644
index 0000000..a02f766
--- /dev/null
+++ b/third_party/blink/renderer/modules/webtransport/bidirectional_stream_test.cc

@@ -0,0 +1,572 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/blink/renderer/modules/webtransport/bidirectional_stream.h"
+
+#include <memory>
+#include <utility>
+
+#include "base/bind.h"
+#include "base/callback.h"
+#include "base/memory/weak_ptr.h"
+#include "base/notreached.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
+#include "services/network/public/mojom/quic_transport.mojom-blink.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/browser_interface_broker_proxy.h"
+#include "third_party/blink/public/mojom/webtransport/quic_transport_connector.mojom-blink.h"
+#include "third_party/blink/renderer/bindings/core/v8/script_promise_tester.h"
+#include "third_party/blink/renderer/bindings/core/v8/script_value.h"
+#include "third_party/blink/renderer/bindings/core/v8/v8_binding_for_testing.h"
+#include "third_party/blink/renderer/bindings/core/v8/v8_uint8_array.h"
+#include "third_party/blink/renderer/bindings/modules/v8/v8_bidirectional_stream.h"
+#include "third_party/blink/renderer/core/execution_context/execution_context.h"
+#include "third_party/blink/renderer/core/streams/readable_stream.h"
+#include "third_party/blink/renderer/core/streams/readable_stream_default_reader.h"
+#include "third_party/blink/renderer/core/streams/writable_stream.h"
+#include "third_party/blink/renderer/core/streams/writable_stream_default_writer.h"
+#include "third_party/blink/renderer/core/typed_arrays/dom_typed_array.h"
+#include "third_party/blink/renderer/modules/webtransport/quic_transport.h"
+#include "third_party/blink/renderer/modules/webtransport/test_utils.h"
+#include "third_party/blink/renderer/platform/testing/unit_test_helpers.h"
+#include "third_party/blink/renderer/platform/weborigin/kurl.h"
+#include "third_party/blink/renderer/platform/wtf/allocator/allocator.h"
+#include "v8/include/v8.h"
+
+namespace blink {
+
+namespace {
+
+// These tests only ever create one stream at a time, so use a hardcoded stream
+// id.
+constexpr uint32_t kDefaultStreamId = 0;
+
+// BidirectionalStream depends on blink::QuicTransport. Rather than virtualise
+// blink::QuicTransport for these tests, we use a stub implementation of
+// network::mojom::blink::QuicTransport to get the behaviour we want. This class
+// only supports the creation of one BidirectionalStream at a time for
+// simplicity.
+class StubQuicTransport : public network::mojom::blink::QuicTransport {
+ public:
+  explicit StubQuicTransport(
+      mojo::PendingReceiver<network::mojom::blink::QuicTransport>
+          pending_receiver)
+      : receiver_(this, std::move(pending_receiver)) {}
+
+  // Functions used by tests to inspect and manipulate the object.
+
+  // Data written to the |writable| side of the bidirectional stream can be read
+  // from this handle.
+  mojo::ScopedDataPipeConsumerHandle& OutputConsumer() {
+    return output_consumer_;
+  }
+
+  // Data written to this handle will appear on the |readable| side of the
+  // bidirectional stream.
+  mojo::ScopedDataPipeProducerHandle& InputProducer() {
+    return input_producer_;
+  }
+
+  bool WasSendFinCalled() const { return was_send_fin_called_; }
+
+  // Responds to an earlier call to AcceptBidirectionalStream with a new stream
+  // as if it was created by the remote server. The remote handles can be
+  // accessed via OutputConsumer() and InputConsumer() as with locally-created
+  // streams.
+  void CreateRemote() {
+    ASSERT_TRUE(accept_callback_);
+    mojo::ScopedDataPipeProducerHandle output_producer;
+    mojo::ScopedDataPipeConsumerHandle output_consumer;
+
+    ASSERT_TRUE(
+        CreateDataPipeForWebTransportTests(&output_producer, &output_consumer));
+    output_consumer_ = std::move(output_consumer);
+
+    mojo::ScopedDataPipeProducerHandle input_producer;
+    mojo::ScopedDataPipeConsumerHandle input_consumer;
+
+    ASSERT_TRUE(
+        CreateDataPipeForWebTransportTests(&input_producer, &input_consumer));
+    input_producer_ = std::move(input_producer);
+
+    std::move(accept_callback_)
+        .Run(kDefaultStreamId, std::move(input_consumer),
+             std::move(output_producer));
+
+    // This prevents redundant calls to AcceptBidirectionalStream() by ensuring
+    // the call to Enqueue() happens before the next call to pull().
+    test::RunPendingTasks();
+  }
+
+  // Implementation of QuicTransport.
+  void SendDatagram(base::span<const uint8_t> data,
+                    base::OnceCallback<void(bool)>) override {
+    NOTREACHED();
+  }
+
+  void CreateStream(
+      mojo::ScopedDataPipeConsumerHandle output_consumer,
+      mojo::ScopedDataPipeProducerHandle input_producer,
+      base::OnceCallback<void(bool, uint32_t)> callback) override {
+    EXPECT_TRUE(output_consumer.is_valid());
+    EXPECT_FALSE(output_consumer_.is_valid());
+    output_consumer_ = std::move(output_consumer);
+
+    EXPECT_TRUE(input_producer.is_valid());
+    EXPECT_FALSE(input_producer_.is_valid());
+    input_producer_ = std::move(input_producer);
+
+    std::move(callback).Run(true, kDefaultStreamId);
+  }
+
+  void AcceptBidirectionalStream(
+      base::OnceCallback<void(uint32_t,
+                              mojo::ScopedDataPipeConsumerHandle,
+                              mojo::ScopedDataPipeProducerHandle)> callback)
+      override {
+    DCHECK(!accept_callback_);
+    accept_callback_ = std::move(callback);
+  }
+
+  void AcceptUnidirectionalStream(
+      base::OnceCallback<void(uint32_t, mojo::ScopedDataPipeConsumerHandle)>
+          callback) override {
+    DCHECK(!ignored_unidirectional_stream_callback_);
+    // This method is always called. We have to retain the callback to avoid an
+    // error about early destruction, but never call it.
+    ignored_unidirectional_stream_callback_ = std::move(callback);
+  }
+
+  void SendFin(uint32_t stream_id) override {
+    EXPECT_EQ(stream_id, kDefaultStreamId);
+    was_send_fin_called_ = true;
+  }
+
+ private:
+  base::OnceCallback<void(uint32_t,
+                          mojo::ScopedDataPipeConsumerHandle,
+                          mojo::ScopedDataPipeProducerHandle)>
+      accept_callback_;
+  base::OnceCallback<void(uint32_t, mojo::ScopedDataPipeConsumerHandle)>
+      ignored_unidirectional_stream_callback_;
+  mojo::Receiver<network::mojom::blink::QuicTransport> receiver_;
+  mojo::ScopedDataPipeConsumerHandle output_consumer_;
+  mojo::ScopedDataPipeProducerHandle input_producer_;
+  bool was_send_fin_called_ = false;
+};
+
+// This class sets up a connected blink::QuicTransport object using a
+// StubQuicTransport and provides access to both.
+class ScopedQuicTransport : public mojom::blink::QuicTransportConnector {
+  STACK_ALLOCATED();
+
+ public:
+  // For convenience, this class does work in the constructor. This is okay
+  // because it is only used for testing.
+  explicit ScopedQuicTransport(const V8TestingScope& scope)
+      : browser_interface_broker_(
+            &scope.GetExecutionContext()->GetBrowserInterfaceBroker()) {
+    browser_interface_broker_->SetBinderForTesting(
+        mojom::blink::QuicTransportConnector::Name_,
+        base::BindRepeating(&ScopedQuicTransport::BindConnector,
+                            weak_ptr_factory_.GetWeakPtr()));
+    quic_transport_ = QuicTransport::Create(scope.GetScriptState(),
+                                            "quic-transport://example.com/",
+                                            ASSERT_NO_EXCEPTION);
+
+    test::RunPendingTasks();
+  }
+
+  ~ScopedQuicTransport() override {
+    browser_interface_broker_->SetBinderForTesting(
+        mojom::blink::QuicTransportConnector::Name_, {});
+  }
+
+  QuicTransport* GetQuicTransport() const { return quic_transport_; }
+  StubQuicTransport* Stub() const { return stub_.get(); }
+
+  void ResetStub() { stub_.reset(); }
+
+  BidirectionalStream* CreateBidirectionalStream(const V8TestingScope& scope) {
+    auto* script_state = scope.GetScriptState();
+    ScriptPromise bidirectional_stream_promise =
+        quic_transport_->createBidirectionalStream(script_state,
+                                                   ASSERT_NO_EXCEPTION);
+    ScriptPromiseTester tester(script_state, bidirectional_stream_promise);
+
+    tester.WaitUntilSettled();
+
+    EXPECT_TRUE(tester.IsFulfilled());
+    auto* bidirectional_stream = V8BidirectionalStream::ToImplWithTypeCheck(
+        scope.GetIsolate(), tester.Value().V8Value());
+    EXPECT_TRUE(bidirectional_stream);
+    return bidirectional_stream;
+  }
+
+  BidirectionalStream* RemoteCreateBidirectionalStream(
+      const V8TestingScope& scope) {
+    stub_->CreateRemote();
+    ReadableStream* streams = quic_transport_->receiveBidirectionalStreams();
+
+    v8::Local<v8::Value> v8value = ReadValueFromStream(scope, streams);
+
+    BidirectionalStream* bidirectional_stream =
+        V8BidirectionalStream::ToImplWithTypeCheck(scope.GetIsolate(), v8value);
+    EXPECT_TRUE(bidirectional_stream);
+
+    return bidirectional_stream;
+  }
+
+  // Implementation of mojom::blink::QuicTransportConnector.
+  void Connect(
+      const KURL&,
+      mojo::PendingRemote<network::mojom::blink::QuicTransportHandshakeClient>
+          pending_handshake_client) override {
+    mojo::Remote<network::mojom::blink::QuicTransportHandshakeClient>
+        handshake_client(std::move(pending_handshake_client));
+
+    mojo::PendingRemote<network::mojom::blink::QuicTransport>
+        quic_transport_to_pass;
+    mojo::PendingRemote<network::mojom::blink::QuicTransportClient>
+        client_remote;
+
+    stub_ = std::make_unique<StubQuicTransport>(
+        quic_transport_to_pass.InitWithNewPipeAndPassReceiver());
+
+    handshake_client->OnConnectionEstablished(
+        std::move(quic_transport_to_pass),
+        client_remote.InitWithNewPipeAndPassReceiver());
+    client_remote_.Bind(std::move(client_remote));
+  }
+
+ private:
+  void BindConnector(mojo::ScopedMessagePipeHandle handle) {
+    connector_receiver_.Bind(
+        mojo::PendingReceiver<mojom::blink::QuicTransportConnector>(
+            std::move(handle)));
+  }
+
+  // |browser_interface_broker_| is cached here because we need to use it in the
+  // destructor. This means ScopedQuicTransport must always be destroyed before
+  // the V8TestingScope object that owns the BrowserInterfaceBrokerProxy.
+  BrowserInterfaceBrokerProxy* browser_interface_broker_;
+  QuicTransport* quic_transport_;
+  std::unique_ptr<StubQuicTransport> stub_;
+  mojo::Remote<network::mojom::blink::QuicTransportClient> client_remote_;
+  mojo::Receiver<mojom::blink::QuicTransportConnector> connector_receiver_{
+      this};
+
+  base::WeakPtrFactory<ScopedQuicTransport> weak_ptr_factory_{this};
+};
+
+// This test fragment is common to CreateLocallyAndWrite and
+// CreateRemotelyAndWrite.
+void TestWrite(const V8TestingScope& scope,
+               ScopedQuicTransport* scoped_quic_transport,
+               BidirectionalStream* bidirectional_stream) {
+  auto* script_state = scope.GetScriptState();
+  auto* writer = bidirectional_stream->writable()->getWriter(
+      script_state, ASSERT_NO_EXCEPTION);
+  auto* chunk = DOMUint8Array::Create(1);
+  *chunk->Data() = 'A';
+  ScriptPromise result =
+      writer->write(script_state, ScriptValue::From(script_state, chunk),
+                    ASSERT_NO_EXCEPTION);
+  ScriptPromiseTester tester(script_state, result);
+  tester.WaitUntilSettled();
+  EXPECT_TRUE(tester.IsFulfilled());
+  EXPECT_TRUE(tester.Value().IsUndefined());
+
+  mojo::ScopedDataPipeConsumerHandle& output_consumer =
+      scoped_quic_transport->Stub()->OutputConsumer();
+  const void* buffer = nullptr;
+  uint32_t buffer_num_bytes = 0;
+  MojoResult mojo_result = output_consumer->BeginReadData(
+      &buffer, &buffer_num_bytes, MOJO_BEGIN_READ_DATA_FLAG_NONE);
+
+  ASSERT_EQ(mojo_result, MOJO_RESULT_OK);
+  EXPECT_EQ(buffer_num_bytes, 1u);
+  EXPECT_EQ(reinterpret_cast<const char*>(buffer)[0], 'A');
+
+  output_consumer->EndReadData(buffer_num_bytes);
+}
+
+TEST(BidirectionalStreamTest, CreateLocallyAndWrite) {
+  V8TestingScope scope;
+  ScopedQuicTransport scoped_quic_transport(scope);
+  auto* bidirectional_stream =
+      scoped_quic_transport.CreateBidirectionalStream(scope);
+  ASSERT_TRUE(bidirectional_stream);
+
+  TestWrite(scope, &scoped_quic_transport, bidirectional_stream);
+}
+
+TEST(BidirectionalStreamTest, CreateRemotelyAndWrite) {
+  V8TestingScope scope;
+  ScopedQuicTransport scoped_quic_transport(scope);
+  auto* bidirectional_stream =
+      scoped_quic_transport.RemoteCreateBidirectionalStream(scope);
+  ASSERT_TRUE(bidirectional_stream);
+
+  TestWrite(scope, &scoped_quic_transport, bidirectional_stream);
+}
+
+// This test fragment is common to CreateLocallyAndRead and
+// CreateRemotelyAndRead.
+void TestRead(const V8TestingScope& scope,
+              ScopedQuicTransport* scoped_quic_transport,
+              BidirectionalStream* bidirectional_stream) {
+  mojo::ScopedDataPipeProducerHandle& input_producer =
+      scoped_quic_transport->Stub()->InputProducer();
+  constexpr char input[] = {'B'};
+  uint32_t input_num_bytes = sizeof(input);
+  MojoResult mojo_result = input_producer->WriteData(
+      input, &input_num_bytes, MOJO_WRITE_DATA_FLAG_ALL_OR_NONE);
+
+  ASSERT_EQ(mojo_result, MOJO_RESULT_OK);
+
+  v8::Local<v8::Value> v8array =
+      ReadValueFromStream(scope, bidirectional_stream->readable());
+  DOMUint8Array* u8array =
+      V8Uint8Array::ToImplWithTypeCheck(scope.GetIsolate(), v8array);
+  ASSERT_TRUE(u8array);
+
+  ASSERT_EQ(u8array->byteLengthAsSizeT(), 1u);
+  EXPECT_EQ(reinterpret_cast<char*>(u8array->Data())[0], 'B');
+}
+
+TEST(BidirectionalStreamTest, CreateLocallyAndRead) {
+  V8TestingScope scope;
+  ScopedQuicTransport scoped_quic_transport(scope);
+  auto* bidirectional_stream =
+      scoped_quic_transport.CreateBidirectionalStream(scope);
+  ASSERT_TRUE(bidirectional_stream);
+
+  TestRead(scope, &scoped_quic_transport, bidirectional_stream);
+}
+
+TEST(BidirectionalStreamTest, CreateRemotelyAndRead) {
+  V8TestingScope scope;
+  ScopedQuicTransport scoped_quic_transport(scope);
+  auto* bidirectional_stream =
+      scoped_quic_transport.RemoteCreateBidirectionalStream(scope);
+  ASSERT_TRUE(bidirectional_stream);
+
+  TestRead(scope, &scoped_quic_transport, bidirectional_stream);
+}
+
+TEST(BidirectionalStreamTest, IncomingStreamCleanClose) {
+  V8TestingScope scope;
+  ScopedQuicTransport scoped_quic_transport(scope);
+  auto* bidirectional_stream =
+      scoped_quic_transport.CreateBidirectionalStream(scope);
+  ASSERT_TRUE(bidirectional_stream);
+
+  scoped_quic_transport.GetQuicTransport()->OnIncomingStreamClosed(
+      kDefaultStreamId, true);
+  scoped_quic_transport.Stub()->InputProducer().reset();
+
+  ScriptPromiseTester tester(scope.GetScriptState(),
+                             bidirectional_stream->writingAborted());
+  tester.WaitUntilSettled();
+  EXPECT_TRUE(tester.IsFulfilled());
+}
+
+TEST(BidirectionalStreamTest, IncomingStreamAbort) {
+  V8TestingScope scope;
+  ScopedQuicTransport scoped_quic_transport(scope);
+  auto* bidirectional_stream =
+      scoped_quic_transport.CreateBidirectionalStream(scope);
+  ASSERT_TRUE(bidirectional_stream);
+
+  bidirectional_stream->abortReading(nullptr);
+
+  ScriptPromiseTester tester(scope.GetScriptState(),
+                             bidirectional_stream->writingAborted());
+  tester.WaitUntilSettled();
+  EXPECT_TRUE(tester.IsFulfilled());
+}
+
+TEST(BidirectionalStreamTest, OutgoingStreamAbort) {
+  V8TestingScope scope;
+  ScopedQuicTransport scoped_quic_transport(scope);
+  auto* bidirectional_stream =
+      scoped_quic_transport.CreateBidirectionalStream(scope);
+  ASSERT_TRUE(bidirectional_stream);
+
+  bidirectional_stream->abortWriting(nullptr);
+
+  ScriptPromiseTester tester(scope.GetScriptState(),
+                             bidirectional_stream->readingAborted());
+  tester.WaitUntilSettled();
+  EXPECT_TRUE(tester.IsFulfilled());
+}
+
+TEST(BidirectionalStreamTest, OutgoingStreamCleanClose) {
+  V8TestingScope scope;
+  ScopedQuicTransport scoped_quic_transport(scope);
+  auto* bidirectional_stream =
+      scoped_quic_transport.CreateBidirectionalStream(scope);
+  ASSERT_TRUE(bidirectional_stream);
+
+  auto* script_state = scope.GetScriptState();
+  ScriptPromise close_promise = bidirectional_stream->writable()->close(
+      script_state, ASSERT_NO_EXCEPTION);
+  ScriptPromiseTester close_tester(script_state, close_promise);
+  close_tester.WaitUntilSettled();
+  EXPECT_TRUE(close_tester.IsFulfilled());
+
+  // The incoming side is closed by the network service.
+  scoped_quic_transport.GetQuicTransport()->OnIncomingStreamClosed(
+      kDefaultStreamId, false);
+  scoped_quic_transport.Stub()->InputProducer().reset();
+
+  ScriptPromiseTester tester(script_state,
+                             bidirectional_stream->readingAborted());
+  tester.WaitUntilSettled();
+  EXPECT_TRUE(tester.IsFulfilled());
+}
+
+TEST(BidirectionalStreamTest, AbortBothOutgoingFirst) {
+  V8TestingScope scope;
+  ScopedQuicTransport scoped_quic_transport(scope);
+  auto* bidirectional_stream =
+      scoped_quic_transport.CreateBidirectionalStream(scope);
+  ASSERT_TRUE(bidirectional_stream);
+
+  bidirectional_stream->abortWriting(nullptr);
+  bidirectional_stream->abortReading(nullptr);
+
+  ScriptPromiseTester reading_tester(scope.GetScriptState(),
+                                     bidirectional_stream->readingAborted());
+  reading_tester.WaitUntilSettled();
+  EXPECT_TRUE(reading_tester.IsFulfilled());
+
+  ScriptPromiseTester writing_tester(scope.GetScriptState(),
+                                     bidirectional_stream->writingAborted());
+  writing_tester.WaitUntilSettled();
+  EXPECT_TRUE(writing_tester.IsFulfilled());
+}
+
+TEST(BidirectionalStreamTest, AbortBothIncomingFirst) {
+  V8TestingScope scope;
+  ScopedQuicTransport scoped_quic_transport(scope);
+  auto* bidirectional_stream =
+      scoped_quic_transport.CreateBidirectionalStream(scope);
+  ASSERT_TRUE(bidirectional_stream);
+
+  bidirectional_stream->abortReading(nullptr);
+  bidirectional_stream->abortWriting(nullptr);
+
+  ScriptPromiseTester reading_tester(scope.GetScriptState(),
+                                     bidirectional_stream->readingAborted());
+  reading_tester.WaitUntilSettled();
+  EXPECT_TRUE(reading_tester.IsFulfilled());
+
+  ScriptPromiseTester writing_tester(scope.GetScriptState(),
+                                     bidirectional_stream->writingAborted());
+  writing_tester.WaitUntilSettled();
+  EXPECT_TRUE(writing_tester.IsFulfilled());
+}
+
+TEST(BidirectionalStreamTest, CloseOutgoingThenAbortIncoming) {
+  V8TestingScope scope;
+  ScopedQuicTransport scoped_quic_transport(scope);
+  auto* bidirectional_stream =
+      scoped_quic_transport.CreateBidirectionalStream(scope);
+  ASSERT_TRUE(bidirectional_stream);
+
+  // 1. Close outgoing.
+  auto* script_state = scope.GetScriptState();
+  ScriptPromise close_promise = bidirectional_stream->writable()->close(
+      script_state, ASSERT_NO_EXCEPTION);
+  ScriptPromiseTester close_tester(script_state, close_promise);
+  close_tester.WaitUntilSettled();
+  EXPECT_TRUE(close_tester.IsFulfilled());
+
+  // 2. Abort incoming.
+  bidirectional_stream->abortReading(nullptr);
+
+  // 3. The network service closes the incoming data pipe as a result of 1.
+  scoped_quic_transport.GetQuicTransport()->OnIncomingStreamClosed(
+      kDefaultStreamId, false);
+  scoped_quic_transport.Stub()->InputProducer().reset();
+
+  ScriptPromiseTester tester(script_state,
+                             bidirectional_stream->readingAborted());
+  tester.WaitUntilSettled();
+  EXPECT_TRUE(tester.IsFulfilled());
+}
+
+TEST(BidirectionalStreamTest, AbortIncomingThenCloseOutgoing) {
+  V8TestingScope scope;
+  ScopedQuicTransport scoped_quic_transport(scope);
+  auto* bidirectional_stream =
+      scoped_quic_transport.CreateBidirectionalStream(scope);
+  ASSERT_TRUE(bidirectional_stream);
+
+  // 1. Abort incoming.
+  bidirectional_stream->abortReading(nullptr);
+
+  // 2. Close outgoing. It should already have been closed when we aborted
+  // reading, so this should be a no-op.
+  auto* script_state = scope.GetScriptState();
+  ScriptPromise close_promise = bidirectional_stream->writable()->close(
+      script_state, ASSERT_NO_EXCEPTION);
+  ScriptPromiseTester close_tester(script_state, close_promise);
+  close_tester.WaitUntilSettled();
+  EXPECT_TRUE(close_tester.IsRejected());
+
+  ScriptPromiseTester tester(script_state,
+                             bidirectional_stream->writingAborted());
+  tester.WaitUntilSettled();
+  EXPECT_TRUE(tester.IsFulfilled());
+}
+
+TEST(BidirectionalStreamTest, CloseQuicTransport) {
+  V8TestingScope scope;
+  ScopedQuicTransport scoped_quic_transport(scope);
+  auto* bidirectional_stream =
+      scoped_quic_transport.CreateBidirectionalStream(scope);
+  ASSERT_TRUE(bidirectional_stream);
+
+  scoped_quic_transport.GetQuicTransport()->close(nullptr);
+
+  ScriptPromiseTester reading_tester(scope.GetScriptState(),
+                                     bidirectional_stream->readingAborted());
+  reading_tester.WaitUntilSettled();
+  EXPECT_TRUE(reading_tester.IsFulfilled());
+
+  ScriptPromiseTester writing_tester(scope.GetScriptState(),
+                                     bidirectional_stream->writingAborted());
+  writing_tester.WaitUntilSettled();
+  EXPECT_TRUE(writing_tester.IsFulfilled());
+}
+
+TEST(BidirectionalStreamTest, RemoteDropQuicTransport) {
+  V8TestingScope scope;
+  ScopedQuicTransport scoped_quic_transport(scope);
+  auto* bidirectional_stream =
+      scoped_quic_transport.CreateBidirectionalStream(scope);
+  ASSERT_TRUE(bidirectional_stream);
+
+  scoped_quic_transport.ResetStub();
+
+  ScriptPromiseTester reading_tester(scope.GetScriptState(),
+                                     bidirectional_stream->readingAborted());
+  reading_tester.WaitUntilSettled();
+  EXPECT_TRUE(reading_tester.IsFulfilled());
+
+  ScriptPromiseTester writing_tester(scope.GetScriptState(),
+                                     bidirectional_stream->writingAborted());
+  writing_tester.WaitUntilSettled();
+  EXPECT_TRUE(writing_tester.IsFulfilled());
+}
+
+}  // namespace
+
+}  // namespace blink

diff --git a/third_party/blink/renderer/modules/webtransport/idls.gni b/third_party/blink/renderer/modules/webtransport/idls.gni
index dad7e5f..b74def74 100644
--- a/third_party/blink/renderer/modules/webtransport/idls.gni
+++ b/third_party/blink/renderer/modules/webtransport/idls.gni

@@ -3,6 +3,7 @@
 # found in the LICENSE file.
 
 modules_idl_files = [
+  "bidirectional_stream.idl",
   "quic_transport.idl",
   "receive_stream.idl",
   "send_stream.idl",

diff --git a/third_party/blink/renderer/modules/webtransport/incoming_stream.cc b/third_party/blink/renderer/modules/webtransport/incoming_stream.cc
index 9f7bdb03..d162e1d2 100644
--- a/third_party/blink/renderer/modules/webtransport/incoming_stream.cc
+++ b/third_party/blink/renderer/modules/webtransport/incoming_stream.cc

@@ -6,6 +6,8 @@
 
 #include <string.h>
 
+#include <utility>
+
 #include "third_party/blink/renderer/bindings/core/v8/script_function.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_array_buffer.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_iterator_result_value.h"
@@ -65,10 +67,10 @@
 };
 
 IncomingStream::IncomingStream(ScriptState* script_state,
-                               base::OnceClosure forget_stream,
+                               base::OnceClosure on_abort,
                                mojo::ScopedDataPipeConsumerHandle handle)
     : script_state_(script_state),
-      forget_stream_(std::move(forget_stream)),
+      on_abort_(std::move(on_abort)),
       data_pipe_(std::move(handle)),
       read_watcher_(FROM_HERE, mojo::SimpleWatcher::ArmingPolicy::MANUAL),
       close_watcher_(FROM_HERE, mojo::SimpleWatcher::ArmingPolicy::AUTOMATIC) {}
@@ -126,8 +128,8 @@
 void IncomingStream::Reset() {
   DVLOG(1) << "IncomingStream::Reset() this=" << this;
 
-  // We no longer need to call |forget_stream_|.
-  forget_stream_.Reset();
+  // We no longer need to call |on_abort_|.
+  on_abort_.Reset();
 
   ErrorStreamAbortAndReset(CreateAbortException(IsLocalAbort(false)));
 }
@@ -135,11 +137,6 @@
 void IncomingStream::ContextDestroyed() {
   DVLOG(1) << "IncomingStream::ContextDestroyed() this=" << this;
 
-  if (forget_stream_) {
-    // Make QuicTransport drop its reference to us.
-    std::move(forget_stream_).Run();
-  }
-
   ResetPipe();
 }
 
@@ -317,9 +314,9 @@
     reading_aborted_resolver_ = nullptr;
   }
 
-  if (forget_stream_) {
+  if (on_abort_) {
     // Cause QuicTransport to drop its reference to us.
-    std::move(forget_stream_).Run();
+    std::move(on_abort_).Run();
   }
 
   ResetPipe();

diff --git a/third_party/blink/renderer/modules/webtransport/incoming_stream.h b/third_party/blink/renderer/modules/webtransport/incoming_stream.h
index 1fa7c7d..eec9f8b 100644
--- a/third_party/blink/renderer/modules/webtransport/incoming_stream.h
+++ b/third_party/blink/renderer/modules/webtransport/incoming_stream.h

@@ -36,7 +36,7 @@
 
  public:
   IncomingStream(ScriptState*,
-                 base::OnceClosure forget_stream,
+                 base::OnceClosure on_abort,
                  mojo::ScopedDataPipeConsumerHandle);
   ~IncomingStream();
 
@@ -119,7 +119,7 @@
 
   const Member<ScriptState> script_state_;
 
-  base::OnceClosure forget_stream_;
+  base::OnceClosure on_abort_;
 
   mojo::ScopedDataPipeConsumerHandle data_pipe_;
 

diff --git a/third_party/blink/renderer/modules/webtransport/incoming_stream_test.cc b/third_party/blink/renderer/modules/webtransport/incoming_stream_test.cc
index 81c1a619..a6cc933 100644
--- a/third_party/blink/renderer/modules/webtransport/incoming_stream_test.cc
+++ b/third_party/blink/renderer/modules/webtransport/incoming_stream_test.cc

@@ -53,8 +53,7 @@
     CreateDataPipe(capacity);
     auto* script_state = scope.GetScriptState();
     auto* incoming_stream = MakeGarbageCollected<IncomingStream>(
-        script_state, mock_forget_stream_.Get(),
-        std::move(data_pipe_consumer_));
+        script_state, mock_on_abort_.Get(), std::move(data_pipe_consumer_));
     incoming_stream->Init();
     return incoming_stream;
   }
@@ -123,7 +122,7 @@
     return ret;
   }
 
-  base::MockOnceClosure mock_forget_stream_;
+  base::MockOnceClosure mock_on_abort_;
   mojo::ScopedDataPipeProducerHandle data_pipe_producer_;
   mojo::ScopedDataPipeConsumerHandle data_pipe_consumer_;
 };
@@ -143,7 +142,7 @@
       incoming_stream->Readable()->getReader(script_state, ASSERT_NO_EXCEPTION);
   ScriptPromise reading_aborted = incoming_stream->ReadingAborted();
 
-  EXPECT_CALL(mock_forget_stream_, Run());
+  EXPECT_CALL(mock_on_abort_, Run());
 
   incoming_stream->AbortReading(nullptr);
 
@@ -171,7 +170,7 @@
 
   auto* incoming_stream = CreateIncomingStream(scope);
 
-  EXPECT_CALL(mock_forget_stream_, Run());
+  EXPECT_CALL(mock_on_abort_, Run());
 
   incoming_stream->AbortReading(nullptr);
 

diff --git a/third_party/blink/renderer/modules/webtransport/outgoing_stream.cc b/third_party/blink/renderer/modules/webtransport/outgoing_stream.cc
index a93912e..f8b165d 100644
--- a/third_party/blink/renderer/modules/webtransport/outgoing_stream.cc
+++ b/third_party/blink/renderer/modules/webtransport/outgoing_stream.cc

@@ -388,7 +388,7 @@
   }
 
   if (client_) {
-    client_->ForgetStream();
+    client_->OnOutgoingStreamAbort();
     client_ = nullptr;
   }
 

diff --git a/third_party/blink/renderer/modules/webtransport/outgoing_stream.h b/third_party/blink/renderer/modules/webtransport/outgoing_stream.h
index 317dd9e0..c3f1978 100644
--- a/third_party/blink/renderer/modules/webtransport/outgoing_stream.h
+++ b/third_party/blink/renderer/modules/webtransport/outgoing_stream.h

@@ -46,8 +46,10 @@
     // that the QuicTransport object drop its reference to the stream.
     virtual void SendFin() = 0;
 
-    // Request that the QuicTransport object drop its reference to the stream.
-    virtual void ForgetStream() = 0;
+    // Indicates that this stream is aborted. QuicTransport should drop its
+    // reference to the stream, and in a bidirectional stream the incoming side
+    // should be reset.
+    virtual void OnOutgoingStreamAbort() = 0;
   };
 
   OutgoingStream(ScriptState*, Client*, mojo::ScopedDataPipeProducerHandle);

diff --git a/third_party/blink/renderer/modules/webtransport/outgoing_stream_test.cc b/third_party/blink/renderer/modules/webtransport/outgoing_stream_test.cc
index 08c4bf7f..0b73041 100644
--- a/third_party/blink/renderer/modules/webtransport/outgoing_stream_test.cc
+++ b/third_party/blink/renderer/modules/webtransport/outgoing_stream_test.cc

@@ -36,7 +36,7 @@
 
  public:
   MOCK_METHOD0(SendFin, void());
-  MOCK_METHOD0(ForgetStream, void());
+  MOCK_METHOD0(OnOutgoingStreamAbort, void());
 };
 
 // The purpose of this class is to ensure that the data pipe is reset before the
@@ -118,7 +118,7 @@
   auto* outgoing_stream = stream_creator.Create(scope);
   EXPECT_TRUE(outgoing_stream->Writable());
 
-  EXPECT_CALL(stream_creator.GetMockClient(), ForgetStream());
+  EXPECT_CALL(stream_creator.GetMockClient(), OnOutgoingStreamAbort());
 }
 
 TEST(OutgoingStreamTest, AbortWriting) {
@@ -133,7 +133,7 @@
 
   ScriptPromise writing_aborted = outgoing_stream->WritingAborted();
 
-  EXPECT_CALL(stream_creator.GetMockClient(), ForgetStream());
+  EXPECT_CALL(stream_creator.GetMockClient(), OnOutgoingStreamAbort());
 
   outgoing_stream->AbortWriting(nullptr);
 
@@ -167,7 +167,7 @@
   EXPECT_TRUE(tester.IsFulfilled());
   EXPECT_THAT(stream_creator.ReadAllPendingData(), ElementsAre('A'));
 
-  EXPECT_CALL(stream_creator.GetMockClient(), ForgetStream());
+  EXPECT_CALL(stream_creator.GetMockClient(), OnOutgoingStreamAbort());
 }
 
 TEST(OutgoingStreamTest, WriteArrayBufferView) {
@@ -188,7 +188,7 @@
   EXPECT_TRUE(tester.IsFulfilled());
   EXPECT_THAT(stream_creator.ReadAllPendingData(), ElementsAre('B'));
 
-  EXPECT_CALL(stream_creator.GetMockClient(), ForgetStream());
+  EXPECT_CALL(stream_creator.GetMockClient(), OnOutgoingStreamAbort());
 }
 
 bool IsAllNulls(base::span<const uint8_t> data) {
@@ -250,7 +250,7 @@
   // Nothing should be left to read.
   EXPECT_THAT(stream_creator.ReadAllPendingData(), ElementsAre());
 
-  EXPECT_CALL(stream_creator.GetMockClient(), ForgetStream());
+  EXPECT_CALL(stream_creator.GetMockClient(), OnOutgoingStreamAbort());
 }
 
 // Writing immediately followed by closing should not lose data.
@@ -301,7 +301,7 @@
   ScriptPromise closed = writer->closed(script_state);
   ScriptPromiseTester closed_tester(script_state, closed);
 
-  EXPECT_CALL(stream_creator.GetMockClient(), ForgetStream());
+  EXPECT_CALL(stream_creator.GetMockClient(), OnOutgoingStreamAbort());
 
   // Close the other end of the pipe.
   stream_creator.Reset();
@@ -361,7 +361,7 @@
   ScriptPromise closed = writer->closed(script_state);
   ScriptPromiseTester closed_tester(script_state, closed);
 
-  EXPECT_CALL(stream_creator.GetMockClient(), ForgetStream());
+  EXPECT_CALL(stream_creator.GetMockClient(), OnOutgoingStreamAbort());
 
   // Close the other end of the pipe.
   stream_creator.Reset();

diff --git a/third_party/blink/renderer/modules/webtransport/quic_transport.cc b/third_party/blink/renderer/modules/webtransport/quic_transport.cc
index f68cb1d..4a5cd4b4 100644
--- a/third_party/blink/renderer/modules/webtransport/quic_transport.cc
+++ b/third_party/blink/renderer/modules/webtransport/quic_transport.cc

@@ -25,6 +25,7 @@
 #include "third_party/blink/renderer/core/streams/underlying_source_base.h"
 #include "third_party/blink/renderer/core/streams/writable_stream.h"
 #include "third_party/blink/renderer/core/typed_arrays/dom_typed_array.h"
+#include "third_party/blink/renderer/modules/webtransport/bidirectional_stream.h"
 #include "third_party/blink/renderer/modules/webtransport/receive_stream.h"
 #include "third_party/blink/renderer/modules/webtransport/send_stream.h"
 #include "third_party/blink/renderer/modules/webtransport/web_transport_stream.h"
@@ -38,6 +39,33 @@
 
 namespace blink {
 
+namespace {
+
+// Creates a mojo DataPipe with the options we use for our stream data pipes. On
+// success, returns true. On failure, throws an exception and returns false.
+bool CreateStreamDataPipe(mojo::ScopedDataPipeProducerHandle* producer,
+                          mojo::ScopedDataPipeConsumerHandle* consumer,
+                          ExceptionState& exception_state) {
+  MojoCreateDataPipeOptions options;
+  options.struct_size = sizeof(MojoCreateDataPipeOptions);
+  options.flags = MOJO_CREATE_DATA_PIPE_FLAG_NONE;
+  options.element_num_bytes = 1;
+  // TODO(ricea): Find an appropriate value for capacity_num_bytes.
+  options.capacity_num_bytes = 0;
+
+  MojoResult result = mojo::CreateDataPipe(&options, producer, consumer);
+  if (result != MOJO_RESULT_OK) {
+    // Probably out of resources.
+    exception_state.ThrowDOMException(DOMExceptionCode::kUnknownError,
+                                      "Insufficient resources.");
+    return false;
+  }
+
+  return true;
+}
+
+}  // namespace
+
 // Sends a datagram on write().
 class QuicTransport::DatagramUnderlyingSink final : public UnderlyingSinkBase {
  public:
@@ -161,14 +189,30 @@
   Member<QuicTransport> quic_transport_;
 };
 
-class QuicTransport::ReceivedStreamsUnderlyingSource final
+class QuicTransport::StreamVendingUnderlyingSource final
     : public UnderlyingSourceBase {
  public:
-  ReceivedStreamsUnderlyingSource(ScriptState* script_state,
-                                  QuicTransport* quic_transport)
+  class StreamVendor : public GarbageCollected<StreamVendor> {
+   public:
+    using EnqueueCallback = base::OnceCallback<void(ScriptWrappable*)>;
+    virtual void RequestStream(EnqueueCallback) = 0;
+    virtual void Trace(Visitor*) {}
+  };
+
+  template <class VendorType>
+  static StreamVendingUnderlyingSource* CreateWithVendor(
+      ScriptState* script_state,
+      QuicTransport* quic_transport) {
+    auto* vendor =
+        MakeGarbageCollected<VendorType>(script_state, quic_transport);
+    return MakeGarbageCollected<StreamVendingUnderlyingSource>(script_state,
+                                                               vendor);
+  }
+
+  StreamVendingUnderlyingSource(ScriptState* script_state, StreamVendor* vendor)
       : UnderlyingSourceBase(script_state),
         script_state_(script_state),
-        quic_transport_(quic_transport) {}
+        vendor_(vendor) {}
 
   ScriptPromise pull(ScriptState* script_state) override {
     if (!is_opened_) {
@@ -176,9 +220,8 @@
       return ScriptPromise::CastUndefined(script_state);
     }
 
-    quic_transport_->quic_transport_->AcceptUnidirectionalStream(WTF::Bind(
-        &ReceivedStreamsUnderlyingSource::OnAcceptUnidirectionalStreamResponse,
-        WrapWeakPersistent(this)));
+    vendor_->RequestStream(WTF::Bind(&StreamVendingUnderlyingSource::Enqueue,
+                                     WrapWeakPersistent(this)));
 
     return ScriptPromise::CastUndefined(script_state);
   }
@@ -203,12 +246,40 @@
 
   void Trace(Visitor* visitor) override {
     visitor->Trace(script_state_);
-    visitor->Trace(quic_transport_);
+    visitor->Trace(vendor_);
     UnderlyingSourceBase::Trace(visitor);
   }
 
  private:
+  void Enqueue(ScriptWrappable* stream) { Controller()->Enqueue(stream); }
+
+  const Member<ScriptState> script_state_;
+  const Member<StreamVendor> vendor_;
+  bool is_opened_ = false;
+  bool is_pull_waiting_ = false;
+};
+
+class QuicTransport::ReceiveStreamVendor final
+    : public QuicTransport::StreamVendingUnderlyingSource::StreamVendor {
+ public:
+  ReceiveStreamVendor(ScriptState* script_state, QuicTransport* quic_transport)
+      : script_state_(script_state), quic_transport_(quic_transport) {}
+
+  void RequestStream(EnqueueCallback enqueue) override {
+    quic_transport_->quic_transport_->AcceptUnidirectionalStream(
+        WTF::Bind(&ReceiveStreamVendor::OnAcceptUnidirectionalStreamResponse,
+                  WrapWeakPersistent(this), std::move(enqueue)));
+  }
+
+  void Trace(Visitor* visitor) override {
+    visitor->Trace(script_state_);
+    visitor->Trace(quic_transport_);
+    StreamVendor::Trace(visitor);
+  }
+
+ private:
   void OnAcceptUnidirectionalStreamResponse(
+      EnqueueCallback enqueue,
       uint32_t stream_id,
       mojo::ScopedDataPipeConsumerHandle readable) {
     ScriptState::Scope scope(script_state_);
@@ -219,13 +290,52 @@
     CHECK_LT(stream_id, 0xfffffffe);
     quic_transport_->stream_map_.insert(stream_id, receive_stream);
 
-    Controller()->Enqueue(receive_stream);
+    std::move(enqueue).Run(receive_stream);
   }
 
   const Member<ScriptState> script_state_;
   const Member<QuicTransport> quic_transport_;
-  bool is_opened_ = false;
-  bool is_pull_waiting_ = false;
+};
+
+class QuicTransport::BidirectionalStreamVendor final
+    : public QuicTransport::StreamVendingUnderlyingSource::StreamVendor {
+ public:
+  BidirectionalStreamVendor(ScriptState* script_state,
+                            QuicTransport* quic_transport)
+      : script_state_(script_state), quic_transport_(quic_transport) {}
+
+  void RequestStream(EnqueueCallback enqueue) override {
+    quic_transport_->quic_transport_->AcceptBidirectionalStream(WTF::Bind(
+        &BidirectionalStreamVendor::OnAcceptBidirectionalStreamResponse,
+        WrapWeakPersistent(this), std::move(enqueue)));
+  }
+
+  void Trace(Visitor* visitor) override {
+    visitor->Trace(script_state_);
+    visitor->Trace(quic_transport_);
+    StreamVendor::Trace(visitor);
+  }
+
+ private:
+  void OnAcceptBidirectionalStreamResponse(
+      EnqueueCallback enqueue,
+      uint32_t stream_id,
+      mojo::ScopedDataPipeConsumerHandle incoming_consumer,
+      mojo::ScopedDataPipeProducerHandle outgoing_producer) {
+    ScriptState::Scope scope(script_state_);
+    auto* bidirectional_stream = MakeGarbageCollected<BidirectionalStream>(
+        script_state_, quic_transport_, stream_id, std::move(outgoing_producer),
+        std::move(incoming_consumer));
+    bidirectional_stream->Init();
+    // 0xfffffffe and 0xffffffff are reserved values in stream_map_.
+    CHECK_LT(stream_id, 0xfffffffe);
+    quic_transport_->stream_map_.insert(stream_id, bidirectional_stream);
+
+    std::move(enqueue).Run(bidirectional_stream);
+  }
+
+  const Member<ScriptState> script_state_;
+  const Member<QuicTransport> quic_transport_;
 };
 
 QuicTransport* QuicTransport::Create(ScriptState* script_state,
@@ -264,6 +374,37 @@
     return ScriptPromise();
   }
 
+  mojo::ScopedDataPipeProducerHandle data_pipe_producer;
+  mojo::ScopedDataPipeConsumerHandle data_pipe_consumer;
+
+  if (!CreateStreamDataPipe(&data_pipe_producer, &data_pipe_consumer,
+                            exception_state)) {
+    return ScriptPromise();
+  }
+
+  auto* resolver = MakeGarbageCollected<ScriptPromiseResolver>(script_state);
+  create_stream_resolvers_.insert(resolver);
+  quic_transport_->CreateStream(
+      std::move(data_pipe_consumer), mojo::ScopedDataPipeProducerHandle(),
+      WTF::Bind(&QuicTransport::OnCreateSendStreamResponse,
+                WrapWeakPersistent(this), WrapWeakPersistent(resolver),
+                std::move(data_pipe_producer)));
+
+  return resolver->Promise();
+}
+
+ScriptPromise QuicTransport::createBidirectionalStream(
+    ScriptState* script_state,
+    ExceptionState& exception_state) {
+  DVLOG(1) << "QuicTransport::createBidirectionalStream() this=" << this;
+
+  if (!quic_transport_.is_bound()) {
+    // TODO(ricea): We should wait if we are still connecting.
+    exception_state.ThrowDOMException(DOMExceptionCode::kNetworkError,
+                                      "No connection.");
+    return ScriptPromise();
+  }
+
   MojoCreateDataPipeOptions options;
   options.struct_size = sizeof(MojoCreateDataPipeOptions);
   options.flags = MOJO_CREATE_DATA_PIPE_FLAG_NONE;
@@ -271,24 +412,27 @@
   // TODO(ricea): Find an appropriate value for capacity_num_bytes.
   options.capacity_num_bytes = 0;
 
-  mojo::ScopedDataPipeProducerHandle data_pipe_producer;
-  mojo::ScopedDataPipeConsumerHandle data_pipe_consumer;
-  MojoResult result =
-      mojo::CreateDataPipe(&options, &data_pipe_producer, &data_pipe_consumer);
-  if (result != MOJO_RESULT_OK) {
-    // Probably out of resources.
-    exception_state.ThrowDOMException(DOMExceptionCode::kUnknownError,
-                                      "Insufficient resources.");
+  mojo::ScopedDataPipeProducerHandle outgoing_producer;
+  mojo::ScopedDataPipeConsumerHandle outgoing_consumer;
+  if (!CreateStreamDataPipe(&outgoing_producer, &outgoing_consumer,
+                            exception_state)) {
+    return ScriptPromise();
+  }
+
+  mojo::ScopedDataPipeProducerHandle incoming_producer;
+  mojo::ScopedDataPipeConsumerHandle incoming_consumer;
+  if (!CreateStreamDataPipe(&incoming_producer, &incoming_consumer,
+                            exception_state)) {
     return ScriptPromise();
   }
 
   auto* resolver = MakeGarbageCollected<ScriptPromiseResolver>(script_state);
-  create_send_stream_resolvers_.insert(resolver);
+  create_stream_resolvers_.insert(resolver);
   quic_transport_->CreateStream(
-      std::move(data_pipe_consumer), mojo::ScopedDataPipeProducerHandle(),
-      WTF::Bind(&QuicTransport::OnCreateStreamResponse,
+      std::move(outgoing_consumer), std::move(incoming_producer),
+      WTF::Bind(&QuicTransport::OnCreateBidirectionalStreamResponse,
                 WrapWeakPersistent(this), WrapWeakPersistent(resolver),
-                std::move(data_pipe_producer)));
+                std::move(outgoing_producer), std::move(incoming_consumer)));
 
   return resolver->Promise();
 }
@@ -309,6 +453,7 @@
   }
 
   received_streams_underlying_source_->Close();
+  received_bidirectional_streams_underlying_source_->Close();
 
   // If we don't manage to close the writable stream here, then it will
   // error when a write() is attempted.
@@ -346,6 +491,7 @@
   quic_transport_.Bind(std::move(quic_transport), task_runner);
 
   received_streams_underlying_source_->NotifyOpened();
+  received_bidirectional_streams_underlying_source_->NotifyOpened();
 
   ready_resolver_->Resolve();
 }
@@ -390,8 +536,11 @@
   DVLOG(1) << "QuicTransport::OnIncomingStreamClosed(" << stream_id << ", "
            << fin_received << ") this=" << this;
   WebTransportStream* stream = stream_map_.at(stream_id);
-  DCHECK(stream);
-  stream->OnIncomingStreamClosed(fin_received);
+  // |stream| can be unset because of races between different ways of closing
+  // |bidirectional streams.
+  if (stream) {
+    stream->OnIncomingStreamClosed(fin_received);
+  }
 }
 
 void QuicTransport::ContextDestroyed() {
@@ -412,7 +561,6 @@
 
 void QuicTransport::SendFin(uint32_t stream_id) {
   quic_transport_->SendFin(stream_id);
-  stream_map_.erase(stream_id);
 }
 
 void QuicTransport::ForgetStream(uint32_t stream_id) {
@@ -424,7 +572,7 @@
   visitor->Trace(received_datagrams_controller_);
   visitor->Trace(outgoing_datagrams_);
   visitor->Trace(script_state_);
-  visitor->Trace(create_send_stream_resolvers_);
+  visitor->Trace(create_stream_resolvers_);
   visitor->Trace(quic_transport_);
   visitor->Trace(handshake_client_receiver_);
   visitor->Trace(client_receiver_);
@@ -435,6 +583,8 @@
   visitor->Trace(stream_map_);
   visitor->Trace(received_streams_);
   visitor->Trace(received_streams_underlying_source_);
+  visitor->Trace(received_bidirectional_streams_);
+  visitor->Trace(received_bidirectional_streams_underlying_source_);
   ExecutionContextLifecycleObserver::Trace(visitor);
   ScriptWrappable::Trace(visitor);
 }
@@ -514,10 +664,18 @@
       script_state_, MakeGarbageCollected<DatagramUnderlyingSink>(this), 1);
 
   received_streams_underlying_source_ =
-      MakeGarbageCollected<ReceivedStreamsUnderlyingSource>(script_state_,
-                                                            this);
+      StreamVendingUnderlyingSource::CreateWithVendor<ReceiveStreamVendor>(
+          script_state_, this);
   received_streams_ = ReadableStream::CreateWithCountQueueingStrategy(
       script_state_, received_streams_underlying_source_, 1);
+
+  received_bidirectional_streams_underlying_source_ =
+      StreamVendingUnderlyingSource::CreateWithVendor<
+          BidirectionalStreamVendor>(script_state_, this);
+
+  received_bidirectional_streams_ =
+      ReadableStream::CreateWithCountQueueingStrategy(
+          script_state_, received_bidirectional_streams_underlying_source_, 1);
 }
 
 void QuicTransport::ResetAll() {
@@ -554,6 +712,7 @@
       received_datagrams_controller_ = nullptr;
     }
     received_streams_underlying_source_->Error(reason);
+    received_bidirectional_streams_underlying_source_->Error(reason);
     WritableStreamDefaultController::ErrorIfNeeded(
         script_state_, outgoing_datagrams_->Controller(), reason);
     ready_resolver_->Reject(reason);
@@ -567,18 +726,18 @@
 void QuicTransport::RejectPendingStreamResolvers() {
   v8::Local<v8::Value> reason = V8ThrowException::CreateTypeError(
       script_state_->GetIsolate(), "Connection lost.");
-  for (ScriptPromiseResolver* resolver : create_send_stream_resolvers_) {
+  for (ScriptPromiseResolver* resolver : create_stream_resolvers_) {
     resolver->Reject(reason);
   }
-  create_send_stream_resolvers_.clear();
+  create_stream_resolvers_.clear();
 }
 
-void QuicTransport::OnCreateStreamResponse(
+void QuicTransport::OnCreateSendStreamResponse(
     ScriptPromiseResolver* resolver,
     mojo::ScopedDataPipeProducerHandle producer,
     bool succeeded,
     uint32_t stream_id) {
-  DVLOG(1) << "QuicTransport::OnCreateStreamResponse() this=" << this
+  DVLOG(1) << "QuicTransport::OnCreateSendStreamResponse() this=" << this
            << " succeeded=" << succeeded << " stream_id=" << stream_id;
 
   // Shouldn't resolve the promise if the execution context has gone away.
@@ -586,7 +745,7 @@
     return;
 
   // Shouldn't resolve the promise if the mojo interface is disconnected.
-  if (!resolver || !create_send_stream_resolvers_.Take(resolver))
+  if (!resolver || !create_stream_resolvers_.Take(resolver))
     return;
 
   ScriptState::Scope scope(script_state_);
@@ -608,4 +767,41 @@
   resolver->Resolve(send_stream);
 }
 
+void QuicTransport::OnCreateBidirectionalStreamResponse(
+    ScriptPromiseResolver* resolver,
+    mojo::ScopedDataPipeProducerHandle outgoing_producer,
+    mojo::ScopedDataPipeConsumerHandle incoming_consumer,
+    bool succeeded,
+    uint32_t stream_id) {
+  DVLOG(1) << "QuicTransport::OnCreateBidirectionalStreamResponse() this="
+           << this << " succeeded=" << succeeded << " stream_id=" << stream_id;
+
+  // Shouldn't resolve the promise if the execution context has gone away.
+  if (!GetExecutionContext())
+    return;
+
+  // Shouldn't resolve the promise if the mojo interface is disconnected.
+  if (!resolver || !create_stream_resolvers_.Take(resolver))
+    return;
+
+  ScriptState::Scope scope(script_state_);
+  if (!succeeded) {
+    resolver->Reject(V8ThrowDOMException::CreateOrEmpty(
+        script_state_->GetIsolate(), DOMExceptionCode::kNetworkError,
+        "Failed to create bidirectional stream."));
+    return;
+  }
+
+  auto* bidirectional_stream = MakeGarbageCollected<BidirectionalStream>(
+      script_state_, this, stream_id, std::move(outgoing_producer),
+      std::move(incoming_consumer));
+  bidirectional_stream->Init();
+
+  // 0xfffffffe and 0xffffffff are reserved values in stream_map_.
+  CHECK_LT(stream_id, 0xfffffffe);
+  stream_map_.insert(stream_id, bidirectional_stream);
+
+  resolver->Resolve(bidirectional_stream);
+}
+
 }  // namespace blink

diff --git a/third_party/blink/renderer/modules/webtransport/quic_transport.h b/third_party/blink/renderer/modules/webtransport/quic_transport.h
index 55ed1f9..95657f3 100644
--- a/third_party/blink/renderer/modules/webtransport/quic_transport.h
+++ b/third_party/blink/renderer/modules/webtransport/quic_transport.h

@@ -61,6 +61,11 @@
   ScriptPromise createSendStream(ScriptState*, ExceptionState&);
   ReadableStream* receiveStreams() { return received_streams_; }
 
+  ScriptPromise createBidirectionalStream(ScriptState*, ExceptionState&);
+  ReadableStream* receiveBidirectionalStreams() {
+    return received_bidirectional_streams_;
+  }
+
   WritableStream* sendDatagrams() { return outgoing_datagrams_; }
   ReadableStream* receiveDatagrams() { return received_datagrams_; }
   void close(const WebTransportCloseInfo*);
@@ -96,7 +101,9 @@
  private:
   class DatagramUnderlyingSink;
   class DatagramUnderlyingSource;
-  class ReceivedStreamsUnderlyingSource;
+  class StreamVendingUnderlyingSource;
+  class ReceiveStreamVendor;
+  class BidirectionalStreamVendor;
 
   QuicTransport(ScriptState*, const String& url, ExecutionContext* context);
 
@@ -104,13 +111,19 @@
 
   // Reset the QuicTransport object and all associated streams.
   void ResetAll();
+
   void Dispose();
   void OnConnectionError();
   void RejectPendingStreamResolvers();
-  void OnCreateStreamResponse(ScriptPromiseResolver*,
-                              mojo::ScopedDataPipeProducerHandle producer,
-                              bool succeeded,
-                              uint32_t stream_id);
+  void OnCreateSendStreamResponse(ScriptPromiseResolver*,
+                                  mojo::ScopedDataPipeProducerHandle,
+                                  bool succeeded,
+                                  uint32_t stream_id);
+  void OnCreateBidirectionalStreamResponse(ScriptPromiseResolver*,
+                                           mojo::ScopedDataPipeProducerHandle,
+                                           mojo::ScopedDataPipeConsumerHandle,
+                                           bool succeeded,
+                                           uint32_t stream_id);
 
   bool cleanly_closed_ = false;
   Member<ReadableStream> received_datagrams_;
@@ -145,14 +158,18 @@
   Member<ScriptPromiseResolver> closed_resolver_;
   ScriptPromise closed_;
 
-  // Tracks resolvers for in-progress createSendStream() operations so they can
-  // be rejected
-  HeapHashSet<Member<ScriptPromiseResolver>> create_send_stream_resolvers_;
+  // Tracks resolvers for in-progress createSendStream() and
+  // createBidirectionalStream() operations so they can be rejected.
+  HeapHashSet<Member<ScriptPromiseResolver>> create_stream_resolvers_;
 
   // The [[ReceivedStreams]] slot.
   // https://wicg.github.io/web-transport/#dom-quictransport-receivedstreams-slot
   Member<ReadableStream> received_streams_;
-  Member<ReceivedStreamsUnderlyingSource> received_streams_underlying_source_;
+  Member<StreamVendingUnderlyingSource> received_streams_underlying_source_;
+
+  Member<ReadableStream> received_bidirectional_streams_;
+  Member<StreamVendingUnderlyingSource>
+      received_bidirectional_streams_underlying_source_;
 };
 
 }  // namespace blink

diff --git a/third_party/blink/renderer/modules/webtransport/quic_transport.idl b/third_party/blink/renderer/modules/webtransport/quic_transport.idl
index 1879b5af..e481328 100644
--- a/third_party/blink/renderer/modules/webtransport/quic_transport.idl
+++ b/third_party/blink/renderer/modules/webtransport/quic_transport.idl

@@ -21,6 +21,11 @@
   // standard.
   [MeasureAs=QuicTransportStreamApis] ReadableStream receiveStreams();
 
+  // From BidirectionalStreamsTransport
+  [CallWith=ScriptState, RaisesException, MeasureAs=QuicTransportStreamApis] Promise<BidirectionalStream>
+      createBidirectionalStream();
+  [MeasureAs=QuicTransportStreamApis] ReadableStream receiveBidirectionalStreams();
+
   // From DatagramTransport mixin
   [MeasureAs=QuicTransportDatagramApis] WritableStream sendDatagrams();
   [MeasureAs=QuicTransportDatagramApis] ReadableStream receiveDatagrams();

diff --git a/third_party/blink/renderer/modules/webtransport/quic_transport_test.cc b/third_party/blink/renderer/modules/webtransport/quic_transport_test.cc
index 89582ca..6d0ad97 100644
--- a/third_party/blink/renderer/modules/webtransport/quic_transport_test.cc
+++ b/third_party/blink/renderer/modules/webtransport/quic_transport_test.cc

@@ -26,6 +26,7 @@
 #include "third_party/blink/renderer/bindings/core/v8/v8_gc_controller.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_iterator_result_value.h"
 #include "third_party/blink/renderer/bindings/core/v8/v8_uint8_array.h"
+#include "third_party/blink/renderer/bindings/modules/v8/v8_bidirectional_stream.h"
 #include "third_party/blink/renderer/bindings/modules/v8/v8_receive_stream.h"
 #include "third_party/blink/renderer/bindings/modules/v8/v8_send_stream.h"
 #include "third_party/blink/renderer/bindings/modules/v8/v8_web_transport_close_info.h"
@@ -38,6 +39,7 @@
 #include "third_party/blink/renderer/core/typed_arrays/dom_typed_array.h"
 #include "third_party/blink/renderer/modules/webtransport/receive_stream.h"
 #include "third_party/blink/renderer/modules/webtransport/send_stream.h"
+#include "third_party/blink/renderer/modules/webtransport/test_utils.h"
 #include "third_party/blink/renderer/platform/bindings/exception_code.h"
 #include "third_party/blink/renderer/platform/bindings/exception_state.h"
 #include "third_party/blink/renderer/platform/heap/persistent.h"
@@ -127,6 +129,10 @@
  public:
   using AcceptUnidirectionalStreamCallback =
       base::OnceCallback<void(uint32_t, mojo::ScopedDataPipeConsumerHandle)>;
+  using AcceptBidirectionalStreamCallback =
+      base::OnceCallback<void(uint32_t,
+                              mojo::ScopedDataPipeConsumerHandle,
+                              mojo::ScopedDataPipeProducerHandle)>;
 
   void AddBinder(const V8TestingScope& scope) {
     interface_broker_ =
@@ -167,10 +173,17 @@
     mock_quic_transport_ = std::make_unique<StrictMock<MockQuicTransport>>(
         quic_transport_to_pass.InitWithNewPipeAndPassReceiver());
 
-    // This is called on every connection, so expect it in every test.
+    // These are called on every connection, so expect them in every test.
     EXPECT_CALL(*mock_quic_transport_, AcceptUnidirectionalStream(_))
         .WillRepeatedly([this](AcceptUnidirectionalStreamCallback callback) {
-          pending_accept_callbacks_.push_back(std::move(callback));
+          pending_unidirectional_accept_callbacks_.push_back(
+              std::move(callback));
+        });
+
+    EXPECT_CALL(*mock_quic_transport_, AcceptBidirectionalStream(_))
+        .WillRepeatedly([this](AcceptBidirectionalStreamCallback callback) {
+          pending_bidirectional_accept_callbacks_.push_back(
+              std::move(callback));
         });
 
     handshake_client->OnConnectionEstablished(
@@ -214,22 +227,16 @@
   }
 
   mojo::ScopedDataPipeProducerHandle DoAcceptUnidirectionalStream() {
-    MojoCreateDataPipeOptions options;
-    options.struct_size = sizeof(MojoCreateDataPipeOptions);
-    options.flags = MOJO_CREATE_DATA_PIPE_FLAG_NONE;
-    options.element_num_bytes = 1;
-    options.capacity_num_bytes = 0;
-
     mojo::ScopedDataPipeProducerHandle producer;
     mojo::ScopedDataPipeConsumerHandle consumer;
-    MojoResult result = mojo::CreateDataPipe(&options, &producer, &consumer);
-    if (result != MOJO_RESULT_OK) {
-      ADD_FAILURE() << "CreateDataPipe() returned " << result;
-    }
 
-    std::move(pending_accept_callbacks_.front())
+    // There's no good way to handle failure to create the pipe, so just
+    // continue.
+    CreateDataPipeForWebTransportTests(&producer, &consumer);
+
+    std::move(pending_unidirectional_accept_callbacks_.front())
         .Run(next_stream_id_++, std::move(consumer));
-    pending_accept_callbacks_.pop_front();
+    pending_unidirectional_accept_callbacks_.pop_front();
 
     return producer;
   }
@@ -237,24 +244,8 @@
   ReceiveStream* ReadReceiveStream(const V8TestingScope& scope,
                                    QuicTransport* quic_transport) {
     ReadableStream* streams = quic_transport->receiveStreams();
-    auto* script_state = scope.GetScriptState();
-    auto* reader = streams->getReader(script_state, ASSERT_NO_EXCEPTION);
 
-    ScriptPromise read_promise =
-        reader->read(script_state, ASSERT_NO_EXCEPTION);
-
-    ScriptPromiseTester read_tester(script_state, read_promise);
-    read_tester.WaitUntilSettled();
-    EXPECT_TRUE(read_tester.IsFulfilled());
-
-    v8::Local<v8::Value> result = read_tester.Value().V8Value();
-    DCHECK(result->IsObject());
-    v8::Local<v8::Value> v8value;
-    bool done = false;
-    EXPECT_TRUE(
-        V8UnpackIteratorResult(script_state, result.As<v8::Object>(), &done)
-            .ToLocal(&v8value));
-    EXPECT_FALSE(done);
+    v8::Local<v8::Value> v8value = ReadValueFromStream(scope, streams);
 
     ReceiveStream* receive_stream =
         V8ReceiveStream::ToImplWithTypeCheck(scope.GetIsolate(), v8value);
@@ -276,7 +267,10 @@
   }
 
   BrowserInterfaceBrokerProxy* interface_broker_ = nullptr;
-  WTF::Deque<AcceptUnidirectionalStreamCallback> pending_accept_callbacks_;
+  WTF::Deque<AcceptUnidirectionalStreamCallback>
+      pending_unidirectional_accept_callbacks_;
+  WTF::Deque<AcceptBidirectionalStreamCallback>
+      pending_bidirectional_accept_callbacks_;
   QuicTransportConnector connector_;
   std::unique_ptr<MockQuicTransport> mock_quic_transport_;
   mojo::Remote<network::mojom::blink::QuicTransportClient> client_remote_;
@@ -1167,6 +1161,65 @@
             "The stream was aborted by the remote server");
 }
 
+// BidirectionalStreams are thoroughly tested in bidirectional_stream_test.cc.
+// Here we just test the QuicTransport APIs.
+TEST_F(QuicTransportTest, CreateBidirectionalStream) {
+  V8TestingScope scope;
+
+  auto* quic_transport =
+      CreateAndConnectSuccessfully(scope, "quic-transport://example.com");
+
+  EXPECT_CALL(
+      *mock_quic_transport_,
+      CreateStream(Truly(ValidConsumerHandle), Truly(ValidProducerHandle), _))
+      .WillOnce([](Unused, Unused,
+                   base::OnceCallback<void(bool, uint32_t)> callback) {
+        std::move(callback).Run(true, 0);
+      });
+
+  auto* script_state = scope.GetScriptState();
+  ScriptPromise bidirectional_stream_promise =
+      quic_transport->createBidirectionalStream(script_state,
+                                                ASSERT_NO_EXCEPTION);
+  ScriptPromiseTester tester(script_state, bidirectional_stream_promise);
+
+  tester.WaitUntilSettled();
+
+  EXPECT_TRUE(tester.IsFulfilled());
+  auto* bidirectional_stream = V8BidirectionalStream::ToImplWithTypeCheck(
+      scope.GetIsolate(), tester.Value().V8Value());
+  EXPECT_TRUE(bidirectional_stream);
+}
+
+TEST_F(QuicTransportTest, ReceiveBidirectionalStream) {
+  V8TestingScope scope;
+
+  auto* quic_transport =
+      CreateAndConnectSuccessfully(scope, "quic-transport://example.com");
+
+  mojo::ScopedDataPipeProducerHandle outgoing_producer;
+  mojo::ScopedDataPipeConsumerHandle outgoing_consumer;
+  ASSERT_TRUE(CreateDataPipeForWebTransportTests(&outgoing_producer,
+                                                 &outgoing_consumer));
+
+  mojo::ScopedDataPipeProducerHandle incoming_producer;
+  mojo::ScopedDataPipeConsumerHandle incoming_consumer;
+  ASSERT_TRUE(CreateDataPipeForWebTransportTests(&incoming_producer,
+                                                 &incoming_consumer));
+
+  std::move(pending_bidirectional_accept_callbacks_.front())
+      .Run(next_stream_id_++, std::move(incoming_consumer),
+           std::move(outgoing_producer));
+
+  ReadableStream* streams = quic_transport->receiveBidirectionalStreams();
+
+  v8::Local<v8::Value> v8value = ReadValueFromStream(scope, streams);
+
+  BidirectionalStream* bidirectional_stream =
+      V8BidirectionalStream::ToImplWithTypeCheck(scope.GetIsolate(), v8value);
+  EXPECT_TRUE(bidirectional_stream);
+}
+
 }  // namespace
 
 }  // namespace blink

diff --git a/third_party/blink/renderer/modules/webtransport/receive_stream.cc b/third_party/blink/renderer/modules/webtransport/receive_stream.cc
index f06d966..2e0ccb0 100644
--- a/third_party/blink/renderer/modules/webtransport/receive_stream.cc
+++ b/third_party/blink/renderer/modules/webtransport/receive_stream.cc

@@ -20,7 +20,7 @@
                              mojo::ScopedDataPipeConsumerHandle handle)
     : incoming_stream_(MakeGarbageCollected<IncomingStream>(
           script_state,
-          WTF::Bind(&ReceiveStream::ForgetStream, WrapWeakPersistent(this)),
+          WTF::Bind(&ReceiveStream::OnAbort, WrapWeakPersistent(this)),
           std::move(handle))),
       quic_transport_(quic_transport),
       stream_id_(stream_id) {}
@@ -44,7 +44,7 @@
   WebTransportStream::Trace(visitor);
 }
 
-void ReceiveStream::ForgetStream() {
+void ReceiveStream::OnAbort() {
   quic_transport_->ForgetStream(stream_id_);
 }
 

diff --git a/third_party/blink/renderer/modules/webtransport/receive_stream.h b/third_party/blink/renderer/modules/webtransport/receive_stream.h
index a46fa92..fe76f206 100644
--- a/third_party/blink/renderer/modules/webtransport/receive_stream.h
+++ b/third_party/blink/renderer/modules/webtransport/receive_stream.h

@@ -57,7 +57,7 @@
   void Trace(Visitor*) override;
 
  private:
-  void ForgetStream();
+  void OnAbort();
 
   const Member<IncomingStream> incoming_stream_;
   const Member<QuicTransport> quic_transport_;

diff --git a/third_party/blink/renderer/modules/webtransport/send_stream.cc b/third_party/blink/renderer/modules/webtransport/send_stream.cc
index eb25ea4..88771198 100644
--- a/third_party/blink/renderer/modules/webtransport/send_stream.cc
+++ b/third_party/blink/renderer/modules/webtransport/send_stream.cc

@@ -40,9 +40,10 @@
 
 void SendStream::SendFin() {
   quic_transport_->SendFin(stream_id_);
+  quic_transport_->ForgetStream(stream_id_);
 }
 
-void SendStream::ForgetStream() {
+void SendStream::OnOutgoingStreamAbort() {
   quic_transport_->ForgetStream(stream_id_);
 }
 

diff --git a/third_party/blink/renderer/modules/webtransport/send_stream.h b/third_party/blink/renderer/modules/webtransport/send_stream.h
index 228b2ee..3d9f56b2 100644
--- a/third_party/blink/renderer/modules/webtransport/send_stream.h
+++ b/third_party/blink/renderer/modules/webtransport/send_stream.h

@@ -56,7 +56,7 @@
 
   // Implementation of OutgoingStream::Client
   void SendFin() override;
-  void ForgetStream() override;
+  void OnOutgoingStreamAbort() override;
 
   void Trace(Visitor*) override;
 

diff --git a/third_party/blink/renderer/modules/webtransport/test_utils.cc b/third_party/blink/renderer/modules/webtransport/test_utils.cc
new file mode 100644
index 0000000..00e6f7ad
--- /dev/null
+++ b/third_party/blink/renderer/modules/webtransport/test_utils.cc

@@ -0,0 +1,57 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/blink/renderer/modules/webtransport/test_utils.h"
+
+#include "base/check.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/renderer/bindings/core/v8/script_promise.h"
+#include "third_party/blink/renderer/bindings/core/v8/script_promise_tester.h"
+#include "third_party/blink/renderer/bindings/core/v8/v8_binding_for_testing.h"
+#include "third_party/blink/renderer/bindings/core/v8/v8_iterator_result_value.h"
+#include "third_party/blink/renderer/core/streams/readable_stream.h"
+#include "third_party/blink/renderer/core/streams/readable_stream_reader.h"
+
+namespace blink {
+
+bool CreateDataPipeForWebTransportTests(
+    mojo::ScopedDataPipeProducerHandle* producer,
+    mojo::ScopedDataPipeConsumerHandle* consumer) {
+  MojoCreateDataPipeOptions options;
+  options.struct_size = sizeof(MojoCreateDataPipeOptions);
+  options.flags = MOJO_CREATE_DATA_PIPE_FLAG_NONE;
+  options.element_num_bytes = 1;
+  options.capacity_num_bytes = 0;  // 0 means the system default size.
+
+  MojoResult result = mojo::CreateDataPipe(&options, producer, consumer);
+  if (result != MOJO_RESULT_OK) {
+    ADD_FAILURE() << "CreateDataPipe() returned " << result;
+    return false;
+  }
+  return true;
+}
+
+v8::Local<v8::Value> ReadValueFromStream(const V8TestingScope& scope,
+                                         ReadableStream* stream) {
+  auto* script_state = scope.GetScriptState();
+  auto* reader = stream->getReader(script_state, ASSERT_NO_EXCEPTION);
+
+  ScriptPromise read_promise = reader->read(script_state, ASSERT_NO_EXCEPTION);
+
+  ScriptPromiseTester read_tester(script_state, read_promise);
+  read_tester.WaitUntilSettled();
+  EXPECT_TRUE(read_tester.IsFulfilled());
+
+  v8::Local<v8::Value> result = read_tester.Value().V8Value();
+  DCHECK(result->IsObject());
+  v8::Local<v8::Value> v8value;
+  bool done = false;
+  EXPECT_TRUE(
+      V8UnpackIteratorResult(script_state, result.As<v8::Object>(), &done)
+          .ToLocal(&v8value));
+  EXPECT_FALSE(done);
+  return v8value;
+}
+
+}  // namespace blink

diff --git a/third_party/blink/renderer/modules/webtransport/test_utils.h b/third_party/blink/renderer/modules/webtransport/test_utils.h
new file mode 100644
index 0000000..7485508
--- /dev/null
+++ b/third_party/blink/renderer/modules/webtransport/test_utils.h

@@ -0,0 +1,33 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Utilities for testing classes in this directory. They assume they are running
+// inside a gtest test.
+
+#ifndef THIRD_PARTY_BLINK_RENDERER_MODULES_WEBTRANSPORT_TEST_UTILS_H_
+#define THIRD_PARTY_BLINK_RENDERER_MODULES_WEBTRANSPORT_TEST_UTILS_H_
+
+#include "mojo/public/cpp/system/data_pipe.h"
+#include "v8/include/v8.h"
+
+namespace blink {
+
+class V8TestingScope;
+class ReadableStream;
+
+// Creates a mojo data pipe with the normal options for WebTransportTests.
+// Returns true for success. Returns false and causes a test failure
+// otherwise.
+bool CreateDataPipeForWebTransportTests(
+    mojo::ScopedDataPipeProducerHandle* producer,
+    mojo::ScopedDataPipeConsumerHandle* consumer);
+
+// Read the next value from a stream. It is expected that there is a value,
+// ie. that |done| will be false. Fails the test if no value is available.
+v8::Local<v8::Value> ReadValueFromStream(const V8TestingScope& scope,
+                                         ReadableStream* stream);
+
+}  // namespace blink
+
+#endif  // THIRD_PARTY_BLINK_RENDERER_MODULES_WEBTRANSPORT_TEST_UTILS_H_

diff --git a/third_party/blink/renderer/platform/bindings/script_state.h b/third_party/blink/renderer/platform/bindings/script_state.h
index 22baa518..fe8f521 100644
--- a/third_party/blink/renderer/platform/bindings/script_state.h
+++ b/third_party/blink/renderer/platform/bindings/script_state.h

@@ -24,7 +24,7 @@
 class V8PerContextData;
 
 // ScriptState is an abstraction class that holds all information about script
-// exectuion (e.g., v8::Isolate, v8::Context, DOMWrapperWorld, ExecutionContext
+// execution (e.g., v8::Isolate, v8::Context, DOMWrapperWorld, ExecutionContext
 // etc). If you need any info about the script execution, you're expected to
 // pass around ScriptState in the code base. ScriptState is in a 1:1
 // relationship with v8::Context.

diff --git a/third_party/blink/renderer/platform/bindings/to_v8.h b/third_party/blink/renderer/platform/bindings/to_v8.h
index 50ae965..ccec0c3 100644
--- a/third_party/blink/renderer/platform/bindings/to_v8.h
+++ b/third_party/blink/renderer/platform/bindings/to_v8.h

@@ -45,7 +45,7 @@
 
 // Dictionary
 
-inline v8::Local<v8::Value> ToV8(bindings::DictionaryBase* dictionary,
+inline v8::Local<v8::Value> ToV8(const bindings::DictionaryBase* dictionary,
                                  v8::Local<v8::Object> creation_context,
                                  v8::Isolate* isolate) {
   if (UNLIKELY(!dictionary))

diff --git a/third_party/blink/renderer/platform/bindings/v8_interface_bridge.h b/third_party/blink/renderer/platform/bindings/v8_interface_bridge.h
index 3aae93e..fc4c903 100644
--- a/third_party/blink/renderer/platform/bindings/v8_interface_bridge.h
+++ b/third_party/blink/renderer/platform/bindings/v8_interface_bridge.h

@@ -5,7 +5,6 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_PLATFORM_BINDINGS_V8_INTERFACE_BRIDGE_H_
 #define THIRD_PARTY_BLINK_RENDERER_PLATFORM_BINDINGS_V8_INTERFACE_BRIDGE_H_
 
-#include "third_party/blink/renderer/platform/bindings/dom_wrapper_world.h"
 #include "third_party/blink/renderer/platform/bindings/script_wrappable.h"
 #include "third_party/blink/renderer/platform/bindings/v8_per_isolate_data.h"
 #include "third_party/blink/renderer/platform/bindings/wrapper_type_info.h"
@@ -15,6 +14,8 @@
 
 namespace blink {
 
+class DOMWrapperWorld;
+
 namespace bindings {
 
 // The common base class of code-generated V8-Blink bridge class of IDL
@@ -34,21 +35,17 @@
   //   trial feature gets enabled later on), install only (c) properties that
   //   are associated to the origin trial feature that has got enabled.
   //
-  // FeatureSelector(world) is used for usage 1) and
-  // FeatureSelector(world, feature) is used for usage 2).
+  // FeatureSelector() is used for usage 1) and
+  // FeatureSelector(feature) is used for usage 2).
   class FeatureSelector final {
    public:
     // Selects all properties not associated to any origin trial feature and
     // properties associated with the origin trial features that are already
     // enabled.
-    FeatureSelector(const DOMWrapperWorld& world)
-        : does_support_origin_trials_(DoesSupportOriginTrials(world)),
-          does_select_all_(true) {}
+    FeatureSelector() : does_select_all_(true) {}
     // Selects only the properties that are associated to the given origin
     // trial feature.
-    FeatureSelector(const DOMWrapperWorld& world, OriginTrialFeature feature)
-        : does_support_origin_trials_(DoesSupportOriginTrials(world)),
-          selector_(feature) {}
+    FeatureSelector(OriginTrialFeature feature) : selector_(feature) {}
     FeatureSelector(const FeatureSelector&) = default;
     FeatureSelector(FeatureSelector&&) = default;
     ~FeatureSelector() = default;
@@ -62,22 +59,13 @@
     // with any origin trial feature.
     bool AnyOf() const { return does_select_all_; }
     bool AnyOf(OriginTrialFeature feature1) const {
-      if (!does_support_origin_trials_)
-        return false;
       return does_select_all_ || selector_ == feature1;
     }
     bool AnyOf(OriginTrialFeature feature1, OriginTrialFeature feature2) const {
-      if (!does_support_origin_trials_)
-        return false;
       return does_select_all_ || selector_ == feature1 || selector_ == feature2;
     }
 
    private:
-    static bool DoesSupportOriginTrials(const DOMWrapperWorld& world) {
-      return world.IsMainWorld() || world.IsWorkerWorld();
-    }
-
-    bool does_support_origin_trials_;
     bool does_select_all_ = false;
     OriginTrialFeature selector_ = OriginTrialFeature::kNonExisting;
   };

diff --git a/third_party/blink/renderer/platform/heap/heap_compact.cc b/third_party/blink/renderer/platform/heap/heap_compact.cc
index 24194d0d..84cf0aa87 100644
--- a/third_party/blink/renderer/platform/heap/heap_compact.cc
+++ b/third_party/blink/renderer/platform/heap/heap_compact.cc

@@ -357,7 +357,8 @@
 
   // Only enable compaction when in a memory reduction garbage collection as it
   // may significantly increase the final garbage collection pause.
-  if (reason == BlinkGC::GCReason::kUnifiedHeapForMemoryReductionGC) {
+  if (reason == BlinkGC::GCReason::kUnifiedHeapForMemoryReductionGC ||
+      reason == BlinkGC::GCReason::kUnifiedHeapForcedForTestingGC) {
     return free_list_size_ > kFreeListSizeThreshold;
   }
 

diff --git a/third_party/blink/renderer/platform/heap/thread_state.h b/third_party/blink/renderer/platform/heap/thread_state.h
index 8d1323f7..fc3f53d 100644
--- a/third_party/blink/renderer/platform/heap/thread_state.h
+++ b/third_party/blink/renderer/platform/heap/thread_state.h

@@ -276,7 +276,9 @@
   // Returns true if the current GC is a memory reducing GC.
   bool IsMemoryReducingGC() const {
     return current_gc_data_.reason ==
-           BlinkGC::GCReason::kUnifiedHeapForMemoryReductionGC;
+               BlinkGC::GCReason::kUnifiedHeapForMemoryReductionGC ||
+           current_gc_data_.reason ==
+               BlinkGC::GCReason::kUnifiedHeapForcedForTestingGC;
   }
 
   bool IsUnifiedHeapGC() const {

diff --git a/third_party/blink/web_tests/TestExpectations b/third_party/blink/web_tests/TestExpectations
index cb5afe7..a2aee6a 100644
--- a/third_party/blink/web_tests/TestExpectations
+++ b/third_party/blink/web_tests/TestExpectations

@@ -305,7 +305,7 @@
 # Fail due to lack of fuzzy matching on Linux, Win and Mac platforms for WPT. The pixels in the pre-rotated reference
 # images do not exactly match the exif rotated images, probably due to jpeg decoding/encoding issues. Maybe
 # adjusting the image size to a multiple of 8 would fix this (so all jpeg blocks are solid color).
-crbug.com/997202 external/wpt/2dcontext/drawing-images-to-the-canvas/image-orientation/drawImage-with-src-rect.tentative.html [ Failure ]
+crbug.com/997202 external/wpt/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-with-src-rect.tentative.html [ Failure ]
 crbug.com/997202 external/wpt/css/css-images/image-orientation/image-orientation-default.html [ Failure ]
 crbug.com/997202 external/wpt/css/css-images/image-orientation/image-orientation-from-image-composited-dynamic1.html [ Failure ]
 crbug.com/997202 external/wpt/css/css-images/image-orientation/image-orientation-from-image-composited.html [ Failure ]
@@ -5934,7 +5934,3 @@
 # Sheriff 2020-05-06
 crbug.com/1078863 [ Mac ] fast/speech/scripted/speechrecognition-restart-onend.html [ Pass Timeout ]
 crbug.com/1071915 fast/hidpi/image-srcset-png-canvas.html [ Pass Failure ]
-
-# Sheriff 2020-05-13
-# Flaking on Webkit Linux Leak
-crbug.com/998948 [ Linux ] external/wpt/pointerevents/pointerevent_capture_mouse.html [ Pass Failure ]

diff --git a/third_party/blink/web_tests/external/wpt/css/css-flexbox/hittest-before-pseudo.html b/third_party/blink/web_tests/external/wpt/css/css-flexbox/hittest-before-pseudo.html
new file mode 100644
index 0000000..afba77e
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/css/css-flexbox/hittest-before-pseudo.html

@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<link rel="help" href="https://crbug.com/1081789" />
+<link rel="stylesheet" type="text/css" href="/fonts/ahem.css" />
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<style>
+#target::before {
+  font: 50px/1 Ahem;
+  display: inline-flex;
+  content: "X";
+  border: 2px solid black;
+  color: green;
+}
+</style>
+<div id=target></div>
+<script>
+test(function(t) {
+  const target = document.getElementById('target');
+  assert_equals(target, document.elementFromPoint(30, 30));
+}, 'Hit-testing text within a pseudo-element flex-item should return the flexbox as the hittest result.');
+</script>

diff --git a/third_party/blink/web_tests/external/wpt/css/css-ui/parsing/outline-offset-computed.html b/third_party/blink/web_tests/external/wpt/css/css-ui/parsing/outline-offset-computed.html
index 3ba35217..39da9f7 100644
--- a/third_party/blink/web_tests/external/wpt/css/css-ui/parsing/outline-offset-computed.html
+++ b/third_party/blink/web_tests/external/wpt/css/css-ui/parsing/outline-offset-computed.html

@@ -17,6 +17,7 @@
 </style>
 <div id="target"></div>
 <script>
+test_computed_value("outline-offset", "2.5px");
 test_computed_value("outline-offset", "10px");
 test_computed_value("outline-offset", "0.5em", "20px");
 test_computed_value("outline-offset", "calc(10px + 0.5em)", "30px");

diff --git a/third_party/blink/web_tests/external/wpt/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-blob.tentative.html b/third_party/blink/web_tests/external/wpt/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-blob.tentative.html
index 633f7e4..e84fce71 100644
--- a/third_party/blink/web_tests/external/wpt/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-blob.tentative.html
+++ b/third_party/blink/web_tests/external/wpt/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-from-blob.tentative.html

@@ -10,7 +10,7 @@
   function makeBlob() {
     return new Promise(function(resolve, reject) {
         var xhr = new XMLHttpRequest();
-        xhr.open("GET", '/css/css-images/image-orientation/support/exif-orientation-3-lr.jpg');
+        xhr.open("GET", '/css/css-images/image-orientation/support/exif-orientation-8-llo.jpg');
         xhr.responseType = 'blob';
         xhr.send();
         xhr.onload = function() {
@@ -22,7 +22,7 @@
   window.onload = function() {
     var cfb = document.getElementById("canvasWithFileBitmap");
     makeBlob().then(function(blob){createImageBitmap(blob).then(bitmap => {
-        cfb.getContext("2d").drawImage(bitmap, 0, 0);
+        cfb.getContext("2d").drawImage(bitmap, 0, 0, 150, 150 * bitmap.height / bitmap.width);
         window.requestAnimationFrame(() => {
           document.documentElement.removeAttribute("class");
         });
@@ -32,6 +32,6 @@
 </script>
 </head>
 <body>
-  <canvas id="canvasWithFileBitmap" width="300" height="300"></canvas>
+  <canvas id="canvasWithFileBitmap" width="150" height="300"></canvas>
 </body>
 </html>
\ No newline at end of file

diff --git a/third_party/blink/web_tests/external/wpt/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-with-src-rect.tentative.html b/third_party/blink/web_tests/external/wpt/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-with-src-rect.tentative.html
index 260f96e..47d1f8b4 100644
--- a/third_party/blink/web_tests/external/wpt/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-with-src-rect.tentative.html
+++ b/third_party/blink/web_tests/external/wpt/html/canvas/element/drawing-images-to-the-canvas/image-orientation/drawImage-with-src-rect.tentative.html

@@ -19,7 +19,7 @@
   </script>
 </head>
 <body>
-  <img id="img-element" src="../../../css/css-images/image-orientation/support/exif-orientation-3-lr.jpg">
+  <img id="img-element" src="/css/css-images/image-orientation/support/exif-orientation-3-lr.jpg">
   <canvas id="bitmap-canvas"></canvas>
 </body>
 </html>
\ No newline at end of file

diff --git a/third_party/blink/web_tests/external/wpt/html/canvas/element/drawing-images-to-the-canvas/image-orientation/reference/drawImage-from-blob-ref.html b/third_party/blink/web_tests/external/wpt/html/canvas/element/drawing-images-to-the-canvas/image-orientation/reference/drawImage-from-blob-ref.html
index d1d3554c..2bd60378 100644
--- a/third_party/blink/web_tests/external/wpt/html/canvas/element/drawing-images-to-the-canvas/image-orientation/reference/drawImage-from-blob-ref.html
+++ b/third_party/blink/web_tests/external/wpt/html/canvas/element/drawing-images-to-the-canvas/image-orientation/reference/drawImage-from-blob-ref.html

@@ -5,6 +5,6 @@
 <title>createImageBitmap and drawImage from a blob with image orientation: from-image, reference</title>
 </head>
 <body>
-  <img id="img-element" src="/css/css-images/image-orientation/support/exif-orientation-3-lr.jpg">
+  <img id="img-element" style="width: 150px; height: 300px;" src="/css/css-images/image-orientation/support/exif-orientation-8-llo.jpg">
 </body>
 </html>

diff --git a/third_party/blink/web_tests/external/wpt/html/canvas/element/drawing-images-to-the-canvas/image-orientation/reference/drawImage-with-src-rect-ref.html b/third_party/blink/web_tests/external/wpt/html/canvas/element/drawing-images-to-the-canvas/image-orientation/reference/drawImage-with-src-rect-ref.html
index d59dd2d9..19ffcc3 100644
--- a/third_party/blink/web_tests/external/wpt/html/canvas/element/drawing-images-to-the-canvas/image-orientation/reference/drawImage-with-src-rect-ref.html
+++ b/third_party/blink/web_tests/external/wpt/html/canvas/element/drawing-images-to-the-canvas/image-orientation/reference/drawImage-with-src-rect-ref.html

@@ -16,7 +16,7 @@
   </script>
 </head>
 <body>
-  <img id="img-element" src="../../../../css/css-images/image-orientation/support/exif-orientation-3-lr-pre-rotated.jpg">
+  <img id="img-element" src="/css/css-images/image-orientation/support/exif-orientation-3-lr-pre-rotated.jpg">
   <canvas id="bitmap-canvas"></canvas>
 </body>
 </html>
\ No newline at end of file

diff --git a/third_party/blink/web_tests/external/wpt/pointerevents/pointerevent_capture_mouse.html b/third_party/blink/web_tests/external/wpt/pointerevents/pointerevent_capture_mouse.html
index 03b1ba6..bae2d14 100644
--- a/third_party/blink/web_tests/external/wpt/pointerevents/pointerevent_capture_mouse.html
+++ b/third_party/blink/web_tests/external/wpt/pointerevents/pointerevent_capture_mouse.html

@@ -40,7 +40,10 @@
             var ownEventForTheCapturedTargetGot = false;
             var count=0;
             var event_log = [];
-            var actions_promise;
+            var actions_promise1;
+            var actions_promise2;
+            var actions_promise3;
+            var actions_promise4;
 
             var detected_pointertypes = {};
             add_completion_callback(end_of_test);
@@ -65,12 +68,14 @@
                 });
 
                 on_event(target0, 'gotpointercapture', function(e) {
-                    test_gotpointercapture.done();
+                    actions_promise3.then( () => {
+                        test_gotpointercapture.done();
+                    });
                     event_log.push('gotpointercapture@target0');
                 });
 
                 on_event(target0, 'lostpointercapture', function(e) {
-                    actions_promise.then( () => {
+                    actions_promise4.then( () => {
                         test_lostpointercapture.done();
                     });
                     isPointerCapture = false;
@@ -87,7 +92,7 @@
                 on_event(target0, "pointermove", function (event) {
                     detected_pointertypes[ event.pointerType ] = true;
                     if(!pointermoveNoCaptureGot0) {
-                        actions_promise = actions_promise.then( () => {
+                        actions_promise2 = actions_promise1.then( () => {
                             test_pointermove0.done();
                             event_log.push('pointermove@target0');
                             pointermoveNoCaptureGot0 = true;
@@ -110,8 +115,8 @@
                             event_log.push('pointermove@target0');
                             pointermoveCaptureGot0 = true;
                             // Fourth dispatch a pointer move to target0.
-                            actions_promise = actions_promise.then( () => {
-                                new test_driver.Actions().pointerMove(0, 0, {origin: target0}).send();
+                            actions_promise4 = actions_promise3.then( () => {
+                                return new test_driver.Actions().pointerMove(0, 0, {origin: target0}).send();
                             });
                         }
                         if((event.clientX > target0.getBoundingClientRect().left)&&
@@ -129,7 +134,7 @@
                 });
 
                 // First dispatch a pointer move to target0.
-                actions_promise = new test_driver.Actions().pointerMove(0, 0, {origin: target0}).send();
+                actions_promise1 = new test_driver.Actions().pointerMove(0, 0, {origin: target0}).send();
 
                 on_event(target1, "pointermove", function (event) {
                     test(function() {
@@ -137,7 +142,7 @@
                     }, "pointermove shouldn't trigger for the purple rectangle while the black rectangle has capture");
 
                     if(!pointermoveNoCaptureGot1) {
-                        actions_promise = actions_promise.then( () => {
+                        actions_promise3 = actions_promise2.then( () => {
                             test_pointermove1.done();
                             event_log.push('pointermove@target1');
                             pointermoveNoCaptureGot1 = true;

diff --git a/third_party/blink/web_tests/external/wpt/service-workers/service-worker/idlharness-sw.https.html b/third_party/blink/web_tests/external/wpt/service-workers/service-worker/idlharness-sw.https.html
index 33fd35b3..5209cc6 100644
--- a/third_party/blink/web_tests/external/wpt/service-workers/service-worker/idlharness-sw.https.html
+++ b/third_party/blink/web_tests/external/wpt/service-workers/service-worker/idlharness-sw.https.html

@@ -1,5 +1,6 @@
 <!DOCTYPE html>
 <title>Service Worker Global Scope Interfaces</title>
+<meta name="timeout" content="long">
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="resources/test-helpers.sub.js"></script>

diff --git a/third_party/blink/web_tests/fast/css/focus-visible-setting.html b/third_party/blink/web_tests/fast/css/focus-visible-setting.html
new file mode 100644
index 0000000..4f5d24a8
--- /dev/null
+++ b/third_party/blink/web_tests/fast/css/focus-visible-setting.html

@@ -0,0 +1,62 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>CSS Test (Selectors): "Always show focus" preference causes :focus-visible to always match</title>
+  <script src="../../resources/testharness.js"></script>
+  <script src="../../resources/testharnessreport.js"></script>
+  <style>
+    :focus-visible {
+      outline: darkgreen dotted 1px; /* fallback for Edge */
+      outline: darkgreen auto 5px;
+    }
+
+    :focus:not(:focus-visible) {
+      outline-color: darkred;
+      background-color: darkred;
+    }
+  </style>
+</head>
+<body>
+  <div id="el" tabindex="0">Focus me.</div>
+  <script>
+    function clickOn(element) {
+      return new Promise(function(resolve, reject) {
+        if (!window.eventSender)
+          return reject();
+
+        var rect = element.getBoundingClientRect();
+        var x = rect.left + (rect.width / 2);
+        var y = rect.top + (rect.height / 2);
+        var pointerActions = [{
+          source: "mouse",
+          actions: [
+              { name: "pointerMove", x: x, y: y },
+              { name: "pointerDown", x: x, y: y, button: 0 },
+              { name: "pointerUp", x: x, y: y, button: 0 },
+              { name: "pointerMove", x: 0, y: 0 }
+          ]
+        }];
+        chrome.gpuBenchmarking.pointerActionSequence(pointerActions, resolve);
+      });
+    }
+
+    async_test(function(t) {
+      el.addEventListener("focus", t.step_func(function() {
+        assert_equals(getComputedStyle(el).outlineColor, "rgb(139, 0, 0)");
+        internals.settings.setAccessibilityAlwaysShowFocus(true);
+        // changing the setting should trigger style recalc
+        assert_equals(getComputedStyle(el).outlineColor, "rgb(0, 100, 0)");
+      }), true);
+
+      // Click the div; without the setting, this would not trigger :focus-visible matching
+      clickOn(el)
+        .then(t.step_func(() => {
+          t.done();
+        })).catch(t.step_func((reason) => {
+          assert_true(false, reason);
+          t.done();
+        }));
+    }, ":focus-visible always matches if the 'always show focus' setting is enabled.");
+  </script>
+</body>
+</html>

diff --git a/third_party/blink/web_tests/http/tests/fetch/README b/third_party/blink/web_tests/http/tests/fetch/README
index 234c6ce..b95cfa0 100644
--- a/third_party/blink/web_tests/http/tests/fetch/README
+++ b/third_party/blink/web_tests/http/tests/fetch/README

@@ -64,6 +64,26 @@
   For thorough tests: ,-other-https,-base-https-other-https
   For others: ,-base-https-other-https
 
+# HOSTS and custom hostnames
+
+One can also override the hostnames used for the base origin and other origin.
+By default they are '127.0.0.1' and 'localhost', but some tests may require
+use of other URLs for behavior that differs between localhost URLs and web URLs.
+
+For example (to use base host 'a.test' and remote host 'b.test'):
+  Put this in the script-tests X.js file (and run generate.py):
+    // HOSTS: 'a.test', 'b.test'
+  Add the same hostnames to the URL getter calls in X.js as well:
+    get_fetch_test_options('a.test', 'b.test');
+    get_thorough_test_options('a.test', 'b.test');
+
+Then when running the test, there will be a preliminary redirect from the
+starting URL of http://127.0.0.1/.../X.html to http://a.test/.../X.html before
+proceeding.
+
+TODO(chlily): Finish plumbing work to actually apply custom hostnames. The
+get_*_test_options() calls should take the custom hostnames.
+
 # File structure
 
 Helper JS files and server side scripts are located on

diff --git a/third_party/blink/web_tests/http/tests/fetch/generate.py b/third_party/blink/web_tests/http/tests/fetch/generate.py
index f337273..a5251fd 100644
--- a/third_party/blink/web_tests/http/tests/fetch/generate.py
+++ b/third_party/blink/web_tests/http/tests/fetch/generate.py

@@ -11,6 +11,7 @@
 The following tokens in the template files are replaced:
 - TESTNAME -> X
 - OPTIONS -> OPTIONS string (see README).
+- HOSTS -> HOSTS string (see README).
 
 Run
 $ python generate.py
@@ -27,13 +28,14 @@
 script_tests_path = os.path.join(top_path, 'script-tests')
 
 
-def generate(output_path, template_path, context, testname, options):
+def generate(output_path, template_path, context, testname, options, hosts):
     output_basename = testname + options + '.html'
 
     with open(template_path, 'rb') as template_file:
         template_data = template_file.read()
         output_data = re.sub(r'TESTNAME', testname, template_data)
         output_data = re.sub(r'OPTIONS', options, output_data)
+        output_data = re.sub(r'HOSTS', hosts, output_data)
 
     with open(os.path.join(output_path, output_basename), 'wb') as output_file:
         output_file.write(output_data)
@@ -46,20 +48,23 @@
             continue
         testname = re.sub(r'\.js$', '', os.path.basename(script))
         options = original_options
+        hosts = ""
 
-        # Read OPTIONS list.
+        # Read OPTIONS list and HOSTS list.
         with open(os.path.join(directory_path, script), 'rb') as script_file:
             script = script_file.read()
-            m = re.search(r'// *OPTIONS: *([a-z\-,]*)', script)
-            if m:
-                options = re.split(',', m.group(1))
+            options_match = re.search(r'// *OPTIONS: *([a-z\-,]*)', script)
+            if options_match:
+                options = re.split(',', options_match.group(1))
+            hosts_match = re.search(r'// *HOSTS: *([a-z\-\.\', ]*)', script)
+            if hosts_match:
+                hosts = hosts_match.group(1)
 
         for context in contexts:
             template_path = os.path.join(
                 directory_path, 'TEMPLATE-' + context + '.html')
             for option in options:
-                generate(os.path.join(top_path, context, relative_path),
-                         template_path, context, testname, option)
+                generate(os.path.join(top_path, context, relative_path), template_path, context, testname, option, hosts)
 
 
 def main():

diff --git a/third_party/blink/web_tests/http/tests/fetch/referrer/no-referrer-document.html b/third_party/blink/web_tests/http/tests/fetch/referrer/no-referrer-document.html
index 4139f23..f6705b9 100644
--- a/third_party/blink/web_tests/http/tests/fetch/referrer/no-referrer-document.html
+++ b/third_party/blink/web_tests/http/tests/fetch/referrer/no-referrer-document.html

@@ -3,6 +3,7 @@
 <meta name="referrer" content="no-referrer">
 <title>Fetch in a document with &quot;referrer no-referrer&quot; policy</title>
 <body>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
@@ -10,6 +11,7 @@
 <script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script>
 
+const {BASE_ORIGIN, OTHER_ORIGIN} = get_fetch_test_options();
 const BASE_URL = BASE_ORIGIN + '/fetch/resources/referrer.php';
 const OTHER_URL = OTHER_ORIGIN + '/fetch/resources/referrer.php';
 const REFERRER_SOURCE = location.href;

diff --git a/third_party/blink/web_tests/http/tests/fetch/referrer/origin-only-document.html b/third_party/blink/web_tests/http/tests/fetch/referrer/origin-only-document.html
index 9d30601..e26b3439 100644
--- a/third_party/blink/web_tests/http/tests/fetch/referrer/origin-only-document.html
+++ b/third_party/blink/web_tests/http/tests/fetch/referrer/origin-only-document.html

@@ -3,6 +3,7 @@
 <meta name="referrer" content="origin">
 <title>Fetch in a document with &quot;referrer origin&quot; policy</title>
 <body>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
@@ -10,6 +11,7 @@
 <script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script>
 
+const {BASE_ORIGIN, OTHER_ORIGIN} = get_fetch_test_options();
 const BASE_URL = BASE_ORIGIN + '/fetch/resources/referrer.php';
 const OTHER_URL = OTHER_ORIGIN + '/fetch/resources/referrer.php';
 const REFERRER_SOURCE = location.href;

diff --git a/third_party/blink/web_tests/http/tests/fetch/referrer/origin-when-cross-origin-dedicated-worker.html b/third_party/blink/web_tests/http/tests/fetch/referrer/origin-when-cross-origin-dedicated-worker.html
index d383f2f8..0327ff1 100644
--- a/third_party/blink/web_tests/http/tests/fetch/referrer/origin-when-cross-origin-dedicated-worker.html
+++ b/third_party/blink/web_tests/http/tests/fetch/referrer/origin-when-cross-origin-dedicated-worker.html

@@ -1,6 +1,7 @@
 <!doctype html>
 <head>
 <title>Fetch in a dedicated worker with &quot;referrer origin-when-cross-origin&quot; policy</title>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/referrer/origin-when-cross-origin-document.html b/third_party/blink/web_tests/http/tests/fetch/referrer/origin-when-cross-origin-document.html
index 1f64de9..15850d1 100644
--- a/third_party/blink/web_tests/http/tests/fetch/referrer/origin-when-cross-origin-document.html
+++ b/third_party/blink/web_tests/http/tests/fetch/referrer/origin-when-cross-origin-document.html

@@ -3,6 +3,7 @@
 <meta name="referrer" content="origin-when-cross-origin">
 <title>Fetch in a document with &quot;referrer origin-when-cross-origin&quot; policy</title>
 <body>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
@@ -10,6 +11,7 @@
 <script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script>
 
+const {BASE_ORIGIN, OTHER_ORIGIN} = get_fetch_test_options();
 const BASE_URL = BASE_ORIGIN + '/fetch/resources/referrer.php';
 const OTHER_URL = OTHER_ORIGIN + '/fetch/resources/referrer.php';
 const REFERRER_SOURCE = location.href;

diff --git a/third_party/blink/web_tests/http/tests/fetch/referrer/resources/origin-when-cross-origin-dedicated-worker-js.php b/third_party/blink/web_tests/http/tests/fetch/referrer/resources/origin-when-cross-origin-dedicated-worker-js.php
index 791de344..dd1708c4 100644
--- a/third_party/blink/web_tests/http/tests/fetch/referrer/resources/origin-when-cross-origin-dedicated-worker-js.php
+++ b/third_party/blink/web_tests/http/tests/fetch/referrer/resources/origin-when-cross-origin-dedicated-worker-js.php

@@ -6,6 +6,7 @@
 
 importScripts('/fetch/resources/fetch-test-helpers.js');
 
+const {BASE_ORIGIN, OTHER_ORIGIN} = get_fetch_test_options();
 const BASE_URL = BASE_ORIGIN + '/fetch/resources/referrer.php';
 const OTHER_URL = OTHER_ORIGIN + '/fetch/resources/referrer.php';
 const REFERRER_SOURCE = location.href;

diff --git a/third_party/blink/web_tests/http/tests/fetch/referrer/resources/origin-when-cross-origin-serviceworker-from-document.html b/third_party/blink/web_tests/http/tests/fetch/referrer/resources/origin-when-cross-origin-serviceworker-from-document.html
index 1372c08..10e5def 100644
--- a/third_party/blink/web_tests/http/tests/fetch/referrer/resources/origin-when-cross-origin-serviceworker-from-document.html
+++ b/third_party/blink/web_tests/http/tests/fetch/referrer/resources/origin-when-cross-origin-serviceworker-from-document.html

@@ -1,6 +1,7 @@
 <!doctype html>
 <html>
 <body>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
@@ -11,6 +12,7 @@
    '/fetch/referrer/resources/origin-when-cross-origin-simple-onfetch-js.php';
 const SCOPE = location.href;
 
+const {BASE_ORIGIN, OTHER_ORIGIN} = get_fetch_test_options();
 const BASE_URL = BASE_ORIGIN + '/fetch/resources/referrer.php';
 const OTHER_URL = OTHER_ORIGIN + '/fetch/resources/referrer.php';
 const REFERRER_SOURCE = location.href;

diff --git a/third_party/blink/web_tests/http/tests/fetch/referrer/serviceworker-echo-referrer-from-default-document.html b/third_party/blink/web_tests/http/tests/fetch/referrer/serviceworker-echo-referrer-from-default-document.html
index c3b883f..865e23d 100644
--- a/third_party/blink/web_tests/http/tests/fetch/referrer/serviceworker-echo-referrer-from-default-document.html
+++ b/third_party/blink/web_tests/http/tests/fetch/referrer/serviceworker-echo-referrer-from-default-document.html

@@ -1,6 +1,7 @@
 <!doctype html>
 <html>
 <title>Echo referrer in ServiceWorker: from a document with the default referrer policy</title>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
@@ -9,6 +10,7 @@
 <script>
 const SCRIPT = '/fetch/referrer/resources/echo-referrer.js';
 const SCOPE = '/fetch/referrer/resources/empty.html';
+const {BASE_ORIGIN} = get_fetch_test_options();
 const URL = BASE_ORIGIN + '/fetch/resources/echo';
 const REFERRER_SOURCE = BASE_ORIGIN + SCOPE;
 

diff --git a/third_party/blink/web_tests/http/tests/fetch/referrer/serviceworker-from-origin-only-document.html b/third_party/blink/web_tests/http/tests/fetch/referrer/serviceworker-from-origin-only-document.html
index 3f1968b..3404f9b 100644
--- a/third_party/blink/web_tests/http/tests/fetch/referrer/serviceworker-from-origin-only-document.html
+++ b/third_party/blink/web_tests/http/tests/fetch/referrer/serviceworker-from-origin-only-document.html

@@ -2,6 +2,7 @@
 <html>
 <title>Fetch in a document with &quot;referrer origin&quot; policy and controlled by a ServiceWorker</title>
 <body>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
@@ -11,6 +12,7 @@
 const SCRIPT = '/fetch/referrer/resources/simple-onfetch.js';
 const SCOPE = '/fetch/referrer/resources/empty-referrer-origin.html';
 
+const {BASE_ORIGIN, OTHER_ORIGIN} = get_fetch_test_options();
 const BASE_URL = BASE_ORIGIN + '/fetch/resources/referrer.php';
 const OTHER_URL = OTHER_ORIGIN + '/fetch/resources/referrer.php';
 const REFERRER_SOURCE = BASE_ORIGIN + SCOPE;

diff --git a/third_party/blink/web_tests/http/tests/fetch/resources/fetch-test-helpers.js b/third_party/blink/web_tests/http/tests/fetch/resources/fetch-test-helpers.js
index a1dc234..abddaee 100644
--- a/third_party/blink/web_tests/http/tests/fetch/resources/fetch-test-helpers.js
+++ b/third_party/blink/web_tests/http/tests/fetch/resources/fetch-test-helpers.js

@@ -1,4 +1,5 @@
 if (self.importScripts) {
+  importScripts('/resources/get-host-info.js?pipe=sub');
   importScripts('/resources/testharness.js');
   importScripts('/serviceworker/resources/test-helpers.js');
   importScripts('/fetch/resources/fetch-test-options.js');

diff --git a/third_party/blink/web_tests/http/tests/fetch/resources/fetch-test-options.js b/third_party/blink/web_tests/http/tests/fetch/resources/fetch-test-options.js
index 62f335f..ba7d4b8 100644
--- a/third_party/blink/web_tests/http/tests/fetch/resources/fetch-test-options.js
+++ b/third_party/blink/web_tests/http/tests/fetch/resources/fetch-test-options.js

@@ -1,15 +1,35 @@
-var BASE_ORIGIN = 'http://127.0.0.1:8000';
-var OTHER_ORIGIN = 'http://localhost:8000';
-var TEST_OPTIONS = '';
-// TEST_OPTIONS is '', '-other-https', '-base-https', or
-// '-base-https-other-https'.
+// |base_host| and |other_host| are custom hostnames for the base/other origin.
+// They default to '127.0.0.1' and 'localhost' respectively.
+function get_fetch_test_options(base_host, other_host) {
+  const {
+    HTTP_ORIGIN: BASE_HTTP_ORIGIN,
+    HTTP_REMOTE_ORIGIN: OTHER_HTTP_ORIGIN,
+    HTTPS_ORIGIN: BASE_HTTPS_ORIGIN,
+    HTTPS_REMOTE_ORIGIN: OTHER_HTTPS_ORIGIN
+  } = get_host_info(base_host, other_host);
+  var BASE_ORIGIN = BASE_HTTP_ORIGIN;
+  var OTHER_ORIGIN = OTHER_HTTP_ORIGIN;
+  var TEST_OPTIONS = '';
+  // TEST_OPTIONS is '', '-other-https', '-base-https', or
+  // '-base-https-other-https'.
 
-if (location.href.indexOf('base-https') >= 0) {
-  BASE_ORIGIN = 'https://127.0.0.1:8443';
-  TEST_OPTIONS += '-base-https';
-}
+  if (location.href.indexOf('base-https') >= 0) {
+    BASE_ORIGIN = BASE_HTTPS_ORIGIN;
+    TEST_OPTIONS += '-base-https';
+  }
 
-if (location.href.indexOf('other-https') >= 0) {
-  OTHER_ORIGIN = 'https://localhost:8443';
-  TEST_OPTIONS += '-other-https';
+  if (location.href.indexOf('other-https') >= 0) {
+    OTHER_ORIGIN = OTHER_HTTPS_ORIGIN;
+    TEST_OPTIONS += '-other-https';
+  }
+
+  return {
+    BASE_HTTP_ORIGIN: BASE_HTTP_ORIGIN,
+    OTHER_HTTP_ORIGIN: OTHER_HTTP_ORIGIN,
+    BASE_HTTPS_ORIGIN: BASE_HTTPS_ORIGIN,
+    OTHER_HTTPS_ORIGIN: OTHER_HTTPS_ORIGIN,
+    BASE_ORIGIN: BASE_ORIGIN,
+    OTHER_ORIGIN: OTHER_ORIGIN,
+    TEST_OPTIONS: TEST_OPTIONS
+  };
 }

diff --git a/third_party/blink/web_tests/http/tests/fetch/resources/init.js b/third_party/blink/web_tests/http/tests/fetch/resources/init.js
index 2ec08f1..99e1980 100644
--- a/third_party/blink/web_tests/http/tests/fetch/resources/init.js
+++ b/third_party/blink/web_tests/http/tests/fetch/resources/init.js

@@ -14,11 +14,17 @@
   testRunner.setBlockThirdPartyCookies(false);
 }
 
+// There must be an |options| object in scope before running this script, which
+// is obtained via either get_thorough_test_options() or
+// get_fetch_test_options().
+//
 // How tests starts:
 // 1. http://127.0.0.1:8000/.../X.html is loaded.
+//   1a. Sometimes we use a custom base origin instead of 127.0.0.1, in which
+//       case first we redirect from 127.0.0.1 to that origin.
 // 2. init(): Do initialization.
 //    In thorough/* tests
-//    (see init() in thorough-util.js):
+//    (see init() in each test category's TEMPLATE file):
 //    - Login to HTTP pages.
 //      This is done first from HTTP origin to avoid mixed content blocking.
 //    - Login to HTTPS pages.
@@ -26,16 +32,22 @@
 //   3a. start(): Start tests.
 // Otherwise:
 //   3b. Redirect to https://127.0.0.1:8443/.../X.html.
+//       - If we redirected to a different URL in step 1a, this will be the
+//         HTTPS origin with that hostname, instead of 127.0.0.1.
 //   4b. start(): Start tests.
 
 var t = async_test('Startup');
-if (location.protocol != 'https:') {
+var start_url = new URL(options["BASE_HTTP_ORIGIN"] + location.pathname);
+if (location.hostname != start_url.hostname) {
+  // Step 1a.
+  location = start_url;
+} else if (location.protocol != 'https:') {
   init(t)
     .then(function() {
         // Initialization done. In thorough/* tests, login done.
         if (location.pathname.indexOf('base-https') >= 0) {
           // Step 3b. For base-https tests, redirect to HTTPS page here.
-          location = 'https://127.0.0.1:8443' + location.pathname;
+          location = options["BASE_ORIGIN"] + location.pathname;
         } else {
           // Step 3a. For non-base-https tests, start tests here.
           start(t);

diff --git a/third_party/blink/web_tests/http/tests/fetch/resources/thorough-iframe.html b/third_party/blink/web_tests/http/tests/fetch/resources/thorough-iframe.html
index 30acddc5..b46101dc 100644
--- a/third_party/blink/web_tests/http/tests/fetch/resources/thorough-iframe.html
+++ b/third_party/blink/web_tests/http/tests/fetch/resources/thorough-iframe.html

@@ -12,7 +12,7 @@
 function report(data) {
   window.parent.postMessage(
     data,
-    BASE_ORIGIN);
+    document.location.origin);
 }
 function onload() {
   window.addEventListener('message', onMessage, false);

diff --git a/third_party/blink/web_tests/http/tests/fetch/resources/thorough-util.js b/third_party/blink/web_tests/http/tests/fetch/resources/thorough-util.js
index 5373b9e..fe84fda 100644
--- a/third_party/blink/web_tests/http/tests/fetch/resources/thorough-util.js
+++ b/third_party/blink/web_tests/http/tests/fetch/resources/thorough-util.js

@@ -1,27 +1,36 @@
-var SCOPE = BASE_ORIGIN +
-  '/fetch/resources/thorough-iframe.html?' + TEST_OPTIONS;
-var IFRAME_ORIGIN = BASE_ORIGIN;
-var BASE_URL = BASE_ORIGIN +
-  '/serviceworker/resources/fetch-access-control.php?';
-var OTHER_BASE_URL = OTHER_ORIGIN +
-  '/serviceworker/resources/fetch-access-control.php?';
-var BASE_URL_WITH_USERNAME = BASE_URL.replace('://', '://user@');
-var OTHER_BASE_URL_WITH_USERNAME = OTHER_BASE_URL.replace('://', '://user@');
-var BASE_URL_WITH_PASSWORD = BASE_URL.replace('://', '://user:pass@');
-var OTHER_BASE_URL_WITH_PASSWORD =
-  OTHER_BASE_URL.replace('://', '://user:pass@');
-var REDIRECT_URL = BASE_ORIGIN +
-  '/serviceworker/resources/redirect.php?Redirect=';
-var OTHER_REDIRECT_URL = OTHER_ORIGIN +
-  '/serviceworker/resources/redirect.php?Redirect=';
-var REDIRECT_LOOP_URL = BASE_ORIGIN +
-  '/fetch/resources/redirect-loop.php?Redirect=';
-var OTHER_REDIRECT_LOOP_URL = OTHER_ORIGIN +
-  '/fetch/resources/redirect-loop.php?Redirect=';
-var IFRAME_URL = SCOPE;
-var WORKER_URL = BASE_ORIGIN +
-  '/fetch/resources/thorough-worker.js?' +
-  TEST_OPTIONS;
+// |base_host| and |other_host| are custom hostnames for the base/other origin.
+// They default to '127.0.0.1' and 'localhost' respectively.
+// See fetch-test-options.js.
+function get_thorough_test_options(base_host, other_host) {
+  var options = get_fetch_test_options(base_host, other_host);
+  var BASE_URL = options['BASE_ORIGIN'] +
+      '/serviceworker/resources/fetch-access-control.php?';
+  var OTHER_BASE_URL = options['OTHER_ORIGIN'] +
+      '/serviceworker/resources/fetch-access-control.php?';
+  var SCOPE = options['BASE_ORIGIN'] +
+      '/fetch/resources/thorough-iframe.html?' + options['TEST_OPTIONS'];
+  return Object.assign({
+    BASE_URL: BASE_URL,
+    OTHER_BASE_URL: OTHER_BASE_URL,
+    SCOPE: SCOPE,
+    IFRAME_ORIGIN: options['BASE_ORIGIN'],
+    BASE_URL_WITH_USERNAME: BASE_URL.replace('://', '://user@'),
+    OTHER_BASE_URL_WITH_USERNAME: OTHER_BASE_URL.replace('://', '://user@'),
+    BASE_URL_WITH_PASSWORD: BASE_URL.replace('://', '://user:pass@'),
+    OTHER_BASE_URL_WITH_PASSWORD: OTHER_BASE_URL.replace('://', '://user:pass@'),
+    REDIRECT_URL: options['BASE_ORIGIN'] +
+        '/serviceworker/resources/redirect.php?Redirect=',
+    OTHER_REDIRECT_URL: options['OTHER_ORIGIN'] +
+        '/serviceworker/resources/redirect.php?Redirect=',
+    REDIRECT_LOOP_URL: options['BASE_ORIGIN'] +
+        '/fetch/resources/redirect-loop.php?Redirect=',
+    OTHER_REDIRECT_LOOP_URL: options['OTHER_ORIGIN'] +
+        '/fetch/resources/redirect-loop.php?Redirect=',
+    IFRAME_URL: SCOPE,
+    WORKER_URL: options['BASE_ORIGIN'] +
+        '/fetch/resources/thorough-worker.js?' + options['TEST_OPTIONS']
+    }, options);
+}
 
 function onlyOnServiceWorkerProxiedTest(checkFuncs) {
   return [];
@@ -30,7 +39,7 @@
 // Cookies accessed in a cross-site context must be marked SameSite=None and
 // Secure, so tests for cross-site cookies must only run on https.
 function shouldIncludeCrossSiteCookieTests() {
-  return TEST_OPTIONS.indexOf("-other-https") !== -1;
+  return location.href.indexOf("other-https") !== -1;
 }
 
 function onlyForCrossSiteCookieTest(checkFunc) {
@@ -205,8 +214,9 @@
 if (location.href.indexOf('other-https') >= 0)
   authCheck2 = checkJsonpAuth.bind(this, 'username2s', 'password2s', 'cookie2');
 
-function executeServiceWorkerProxiedTests(test_targets) {
+function executeServiceWorkerProxiedTests(test_targets, thorough_options) {
   var test = async_test('Verify access control of fetch() in a Service Worker');
+  var {WORKER_URL, IFRAME_ORIGIN, SCOPE} = thorough_options;
   test.step(function() {
       var worker = undefined;
       var frameWindow = {};

diff --git a/third_party/blink/web_tests/http/tests/fetch/resources/thorough-worker.js b/third_party/blink/web_tests/http/tests/fetch/resources/thorough-worker.js
index 1c93957..719ed0d 100644
--- a/third_party/blink/web_tests/http/tests/fetch/resources/thorough-worker.js
+++ b/third_party/blink/web_tests/http/tests/fetch/resources/thorough-worker.js

@@ -1,3 +1,4 @@
+importScripts('/resources/get-host-info.js?pipe=sub');
 importScripts('fetch-test-options.js');
 importScripts('thorough-util.js');
 

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/TEMPLATE-serviceworker.html b/third_party/blink/web_tests/http/tests/fetch/script-tests/TEMPLATE-serviceworker.html
index da9bdba..3d103fb 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/TEMPLATE-serviceworker.html
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/TEMPLATE-serviceworker.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options(HOSTS);
 function start(t) {
   service_worker_test(
     '../script-tests/TESTNAME.js?OPTIONS',

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/TEMPLATE-window.html b/third_party/blink/web_tests/http/tests/fetch/script-tests/TEMPLATE-window.html
index e39ad0f..a0d8e778 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/TEMPLATE-window.html
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/TEMPLATE-window.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options(HOSTS);
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/TESTNAME.js?OPTIONS';

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/TEMPLATE-workers.html b/third_party/blink/web_tests/http/tests/fetch/script-tests/TEMPLATE-workers.html
index 7c80000..f08a2fc 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/TEMPLATE-workers.html
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/TEMPLATE-workers.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options(HOSTS);
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/TESTNAME.js?OPTIONS'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/fetch.js b/third_party/blink/web_tests/http/tests/fetch/script-tests/fetch.js
index 3952d04e..64c5980 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/fetch.js
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/fetch.js

@@ -2,6 +2,8 @@
   importScripts('../resources/fetch-test-helpers.js');
 }
 
+var {BASE_ORIGIN, OTHER_ORIGIN} = get_fetch_test_options();
+
 promise_test(function(t) {
     return fetch('http://')
       .then(

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/filtered-response.js b/third_party/blink/web_tests/http/tests/fetch/script-tests/filtered-response.js
index f04b9fd..c1b691c 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/filtered-response.js
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/filtered-response.js

@@ -5,6 +5,7 @@
 
 // Spec: https://fetch.spec.whatwg.org/#concept-filtered-response
 
+var {OTHER_ORIGIN} = get_fetch_test_options();
 var base_url = '../resources/filtered-response.php';
 var other_url = OTHER_ORIGIN + '/fetch/resources/filtered-response.php';
 

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/referrer.js b/third_party/blink/web_tests/http/tests/fetch/script-tests/referrer.js
index eec6b29..c684ed6 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/referrer.js
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/referrer.js

@@ -3,6 +3,7 @@
   importScripts('/fetch/resources/fetch-test-helpers.js');
 }
 
+const {BASE_ORIGIN, OTHER_ORIGIN} = get_fetch_test_options();
 const BASE_URL = BASE_ORIGIN + '/fetch/resources/referrer.php';
 const OTHER_URL = OTHER_ORIGIN + '/fetch/resources/referrer.php';
 const REFERRER_SOURCE = location.href;

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/request.js b/third_party/blink/web_tests/http/tests/fetch/script-tests/request.js
index 8eeb2250..73978ef 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/request.js
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/request.js

@@ -2,6 +2,7 @@
   importScripts('../resources/fetch-test-helpers.js');
 }
 
+var {BASE_ORIGIN, OTHER_ORIGIN} = get_fetch_test_options();
 var URL = 'https://www.example.com/test.html';
 
 test(function() {

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/TEMPLATE-serviceworker-proxied.html b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/TEMPLATE-serviceworker-proxied.html
index 46c2200..509a6d0 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/TEMPLATE-serviceworker-proxied.html
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/TEMPLATE-serviceworker-proxied.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options(HOSTS);
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/TEMPLATE-serviceworker.html b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/TEMPLATE-serviceworker.html
index 4d1a8c74..0f8bbee 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/TEMPLATE-serviceworker.html
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/TEMPLATE-serviceworker.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options(HOSTS);
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/TESTNAME.js?OPTIONS',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/TEMPLATE-window.html b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/TEMPLATE-window.html
index 0033d879..d933441 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/TEMPLATE-window.html
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/TEMPLATE-window.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options(HOSTS);
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/TEMPLATE-workers.html b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/TEMPLATE-workers.html
index 6f92169..8905725a 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/TEMPLATE-workers.html
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/TEMPLATE-workers.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options(HOSTS);
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/TESTNAME.js?OPTIONS'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/access-control.js b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/access-control.js
index db4e57b9..f6d9e44 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/access-control.js
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/access-control.js

@@ -4,6 +4,7 @@
   importScripts('/fetch/resources/thorough-util.js');
 }
 
+var {BASE_URL} = get_thorough_test_options();
 var TEST_TARGETS = [
   // Test mode=same-origin.
   [BASE_URL + 'mode=same-origin&method=GET',

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/auth-nocors.js b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/auth-nocors.js
index f8065385..bd60a948 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/auth-nocors.js
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/auth-nocors.js

@@ -3,6 +3,8 @@
   importScripts('/fetch/resources/thorough-util.js');
 }
 
+var {BASE_URL, OTHER_BASE_URL} = get_thorough_test_options();
+
 var TEST_TARGETS = [
   // Auth check
   // Test that default mode is no-cors in serviceworker-proxied tests.

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/auth.js b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/auth.js
index af3600f..c8889c4 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/auth.js
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/auth.js

@@ -3,6 +3,8 @@
   importScripts('/fetch/resources/thorough-util.js');
 }
 
+var {BASE_ORIGIN, OTHER_ORIGIN, BASE_URL, OTHER_BASE_URL} = get_thorough_test_options();
+
 var TEST_TARGETS = [
   // Auth check
   [BASE_URL + 'Auth&mode=same-origin&credentials=omit',

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/cookie-nocors.js b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/cookie-nocors.js
index bbd5399a..f47eade 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/cookie-nocors.js
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/cookie-nocors.js

@@ -5,6 +5,7 @@
 
 // This test assumes TEST_TARGETS are executed in order and sequentially.
 var TEST_TARGETS = [];
+var {BASE_ORIGIN, BASE_URL, OTHER_BASE_URL} = get_thorough_test_options();
 
 // cookieCheckX checks the cookies sent in the request.
 // SetCookie=cookieX indicates to set cookies in the response.

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/cookie.js b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/cookie.js
index f4e258c9..7a780441 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/cookie.js
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/cookie.js

@@ -5,6 +5,7 @@
 
 // This test assumes TEST_TARGETS are executed in order and sequentially.
 var TEST_TARGETS = [];
+var {BASE_ORIGIN, BASE_URL, OTHER_BASE_URL} = get_thorough_test_options();
 
 // cookieCheckX checks the cookies sent in the request.
 // SetCookie=cookieX indicates to set cookies in the response.

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/cors-preflight.js b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/cors-preflight.js
index f78e8e1b..7f144d6 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/cors-preflight.js
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/cors-preflight.js

@@ -7,6 +7,7 @@
 // Spec: https://fetch.spec.whatwg.org/#cors-preflight-fetch
 
 var TEST_TARGETS = [];
+var {BASE_ORIGIN, OTHER_BASE_URL} = get_thorough_test_options();
 
 ['GET', 'POST'].forEach(function(method) {
     var checkMethod = checkJsonpMethod.bind(this, method);

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/cors-preflight2.js b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/cors-preflight2.js
index e52245c..06dbe9f 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/cors-preflight2.js
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/cors-preflight2.js

@@ -7,6 +7,7 @@
 // Spec: https://fetch.spec.whatwg.org/#cors-preflight-fetch
 
 var TEST_TARGETS = [];
+var {BASE_ORIGIN, OTHER_BASE_URL} = get_thorough_test_options();
 
 ['PUT', 'XXX'].forEach(function(method) {
     var checkMethod = checkJsonpMethod.bind(this, method);

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/cors.js b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/cors.js
index 9902a39..b88b605 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/cors.js
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/cors.js

@@ -5,6 +5,8 @@
 
 // Tests for CORS check and CORS filtered response.
 
+var {BASE_ORIGIN, OTHER_BASE_URL} = get_thorough_test_options();
+
 var TEST_TARGETS = [
   // CORS test
 

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/nocors.js b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/nocors.js
index b3a1083..84986c1 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/nocors.js
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/nocors.js

@@ -3,6 +3,7 @@
   importScripts('/fetch/resources/thorough-util.js');
 }
 
+var {BASE_URL, OTHER_BASE_URL} = get_thorough_test_options();
 var TEST_TARGETS = [
   // Test that default mode is no-cors in serviceworker-proxied tests.
   onlyOnServiceWorkerProxiedTest(

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/redirect-credentials.js b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/redirect-credentials.js
index d0e1aa8..d7df37f 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/redirect-credentials.js
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/redirect-credentials.js

@@ -3,6 +3,9 @@
   importScripts('/fetch/resources/thorough-util.js');
 }
 
+var {BASE_ORIGIN, BASE_URL, REDIRECT_URL, OTHER_BASE_URL, OTHER_REDIRECT_URL} =
+    get_thorough_test_options();
+
 var TEST_TARGETS = [
   // Redirect: same origin -> same origin
   // Credential test

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/redirect-loop.js b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/redirect-loop.js
index a86c4fb8..eac9f0b 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/redirect-loop.js
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/redirect-loop.js

@@ -11,6 +11,9 @@
   return array;
 }
 
+var {REDIRECT_LOOP_URL, OTHER_REDIRECT_LOOP_URL, BASE_URL, OTHER_BASE_URL} =
+  get_thorough_test_options();
+
 var TEST_TARGETS = [
   // Redirect loop: same origin -> same origin
   [REDIRECT_LOOP_URL + encodeURIComponent(BASE_URL) + '&Count=20&mode=cors' +

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/redirect-nocors.js b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/redirect-nocors.js
index 71c2ad028..0b5aa34e 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/redirect-nocors.js
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/redirect-nocors.js

@@ -3,6 +3,9 @@
   importScripts('/fetch/resources/thorough-util.js');
 }
 
+var {BASE_URL, OTHER_BASE_URL, REDIRECT_URL, OTHER_REDIRECT_URL} =
+    get_thorough_test_options();
+
 var TEST_TARGETS = [
   // Redirect: same origin -> same origin
   [REDIRECT_URL + encodeURIComponent(BASE_URL) +

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/redirect-password.js b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/redirect-password.js
index 1bc0677..bc05bbe 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/redirect-password.js
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/redirect-password.js

@@ -3,6 +3,15 @@
   importScripts('/fetch/resources/thorough-util.js');
 }
 
+var {
+  REDIRECT_URL,
+  OTHER_REDIRECT_URL,
+  BASE_URL_WITH_PASSWORD,
+  BASE_URL_WITH_USERNAME,
+  OTHER_BASE_URL_WITH_PASSWORD,
+  OTHER_BASE_URL_WITH_USERNAME
+} = get_thorough_test_options();
+
 var TEST_TARGETS = [
   // Redirects to URLs with username/password; these requests are blocked.
   //

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/redirect.js b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/redirect.js
index afb86e7..491101d 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/redirect.js
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/redirect.js

@@ -3,6 +3,9 @@
   importScripts('/fetch/resources/thorough-util.js');
 }
 
+var {BASE_ORIGIN, BASE_URL, REDIRECT_URL, OTHER_BASE_URL, OTHER_REDIRECT_URL} =
+    get_thorough_test_options();
+
 var TEST_TARGETS = [
   // Redirect: same origin -> same origin
   [REDIRECT_URL + encodeURIComponent(BASE_URL) +

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/scheme-blob.js b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/scheme-blob.js
index aacebfc..8f4ecd6 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/scheme-blob.js
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/scheme-blob.js

@@ -8,6 +8,7 @@
 // Only [Exposed=(Window,DedicatedWorker,SharedWorker)].
 if ('createObjectURL' in URL) {
   var url = URL.createObjectURL(new Blob(["report({jsonpResult: 'success'});"], {type: 'application/json'}));
+  var {BASE_URL} = get_thorough_test_options();
 
   TEST_TARGETS = [
     // Same-origin blob: requests.

diff --git a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/scheme-data.js b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/scheme-data.js
index 4bd55d8..53a1ec0 100644
--- a/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/scheme-data.js
+++ b/third_party/blink/web_tests/http/tests/fetch/script-tests/thorough/scheme-data.js

@@ -4,6 +4,7 @@
 }
 
 var url = "data:application/json,report({jsonpResult: 'success'});";
+var {BASE_URL, REDIRECT_URL, OTHER_REDIRECT_URL} = get_thorough_test_options();
 
 var TEST_TARGETS = [
 // data: requests.

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/access-control-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/access-control-base-https-other-https.html
index 49dfb65e1..3848a8e 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/access-control-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/access-control-base-https-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/access-control.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/access-control.html
index 8a8b05b..b6048113 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/access-control.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/access-control.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth-base-https-other-https.html
index 75e80d14..abfccde 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth-base-https-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth-nocors-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth-nocors-base-https-other-https.html
index e71aeb8..6d3999a8 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth-nocors-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth-nocors-base-https-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth-nocors-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth-nocors-other-https.html
index 3854314..e643f30a 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth-nocors-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth-nocors-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth-nocors.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth-nocors.html
index 8199791d..3b63bac 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth-nocors.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth-nocors.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth-other-https.html
index 99f88a1c..8cf221dc 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth.html
index fac6a35..0f35ba2 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/auth.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie-base-https-other-https.html
index 9ec6c4df..8b7e062 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie-base-https-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie-nocors-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie-nocors-base-https-other-https.html
index 7384151..fd7e6670 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie-nocors-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie-nocors-base-https-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie-nocors-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie-nocors-other-https.html
index ea99382e..0221b4cf 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie-nocors-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie-nocors-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie-nocors.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie-nocors.html
index c5efca4..c052963 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie-nocors.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie-nocors.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie-other-https.html
index 28ea3da..6c7abb3 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie.html
index c002ac6..c61119d 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cookie.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-base-https-other-https.html
index 32bc2ef..57723dcf 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-base-https-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-other-https.html
index 0ecb134..46feb31 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight-base-https-other-https.html
index 56f09c9..5001407 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight-base-https-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight-other-https.html
index 14fb22c..fd8db828 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight.html
index 2d0c91a..c27d838 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight2-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight2-base-https-other-https.html
index 7e8478e..85e02059 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight2-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight2-base-https-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight2-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight2-other-https.html
index 93c90ad..3d152e3 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight2-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight2-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight2.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight2.html
index bffffee0..480dc9f 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight2.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors-preflight2.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors.html
index 56ee8813..f102134 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/cors.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/nocors-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/nocors-base-https-other-https.html
index a99b4c3..539ac2c 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/nocors-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/nocors-base-https-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/nocors-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/nocors-other-https.html
index 288c203..a3a2ed0f 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/nocors-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/nocors-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/nocors.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/nocors.html
index 7d5aa44..1ba0565 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/nocors.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/nocors.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-base-https-other-https.html
index 1d39a980..0d70804 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-base-https-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-credentials-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-credentials-base-https-other-https.html
index 274ad46..f8d54df0 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-credentials-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-credentials-base-https-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-credentials-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-credentials-other-https.html
index f701f5e..2723be7 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-credentials-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-credentials-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-credentials.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-credentials.html
index 526494d..66d9867 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-credentials.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-credentials.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-loop-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-loop-base-https-other-https.html
index 68967b5..44e24b6b 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-loop-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-loop-base-https-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-loop-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-loop-other-https.html
index 1eca93e0..f5e8de1 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-loop-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-loop-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-loop.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-loop.html
index ada590c7..df56b0b 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-loop.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-loop.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-nocors-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-nocors-base-https-other-https.html
index a0c28d5..c08dc33d 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-nocors-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-nocors-base-https-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-nocors-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-nocors-other-https.html
index 87f5c6b..641a9a8 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-nocors-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-nocors-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-nocors.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-nocors.html
index 3001c03e..3730027 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-nocors.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-nocors.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-other-https.html
index bfd6507..f78dec7 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-password-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-password-base-https-other-https.html
index 3007f91e..506da12 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-password-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-password-base-https-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-password-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-password-other-https.html
index cad96ba..cfa032e 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-password-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-password-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-password.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-password.html
index 4f1c529..e1a6b8bc 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-password.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect-password.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect.html
index 90b931d..aca61b7 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/redirect.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-blob-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-blob-base-https-other-https.html
index 395eb9f2..a419866 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-blob-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-blob-base-https-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-blob-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-blob-other-https.html
index cd51089..a0178ca 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-blob-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-blob-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-blob.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-blob.html
index e03899a..5aa25d4 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-blob.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-blob.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-data-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-data-base-https-other-https.html
index 06738a3..7c6bc94 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-data-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-data-base-https-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-data-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-data-other-https.html
index aea76da..8a21615 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-data-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-data-other-https.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-data.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-data.html
index f6fde102..57e81e7 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-data.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker-proxied/thorough/scheme-data.html

@@ -17,19 +17,18 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
-  executeServiceWorkerProxiedTests(TEST_TARGETS);
+  executeServiceWorkerProxiedTests(TEST_TARGETS, options);
   t.done();
 }
 function init(test) {
-  return login(test, host_info["HTTP_ORIGIN"], host_info["HTTP_REMOTE_ORIGIN"])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info["HTTPS_ORIGIN"],
-          host_info["HTTPS_REMOTE_ORIGIN"]);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
-
 </script>
 <script src = "/fetch/resources/init.js"></script>
 </body>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/block-mixed-content-base-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/block-mixed-content-base-https.html
index 5af9f7e..406805c 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/block-mixed-content-base-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/block-mixed-content-base-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/block-mixed-content.js?-base-https',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/block-mixed-content-nocors-base-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/block-mixed-content-nocors-base-https.html
index 83788db..f6473c8 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/block-mixed-content-nocors-base-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/block-mixed-content-nocors-base-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/block-mixed-content-nocors.js?-base-https',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/body-mixin-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/body-mixin-base-https-other-https.html
index 75e204f..a3f9b3f 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/body-mixin-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/body-mixin-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/body-mixin.js?-base-https-other-https',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/body-mixin.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/body-mixin.html
index 8cc203a..8734dc8 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/body-mixin.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/body-mixin.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/body-mixin.js?',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/cache-override-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/cache-override-base-https-other-https.html
index 59bf14e9..0abb654e 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/cache-override-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/cache-override-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/cache-override.js?-base-https-other-https',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/cache-override.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/cache-override.html
index 8816c9bf..e26e956e 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/cache-override.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/cache-override.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/cache-override.js?',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/fetch-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/fetch-base-https-other-https.html
index d54a92a..b5e902a 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/fetch-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/fetch-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/fetch.js?-base-https-other-https',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/fetch.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/fetch.html
index 966e626..d8ea28c 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/fetch.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/fetch.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/fetch.js?',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/filtered-response-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/filtered-response-base-https-other-https.html
index 58c0c08..d34f555 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/filtered-response-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/filtered-response-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/filtered-response.js?-base-https-other-https',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/filtered-response-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/filtered-response-other-https.html
index 1afa1f2d..67d754cd 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/filtered-response-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/filtered-response-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/filtered-response.js?-other-https',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/filtered-response.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/filtered-response.html
index c655a85..4822380 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/filtered-response.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/filtered-response.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/filtered-response.js?',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/headers-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/headers-base-https-other-https.html
index d920d4e..f8e568d6 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/headers-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/headers-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/headers.js?-base-https-other-https',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/headers-guard-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/headers-guard-base-https-other-https.html
index 6936d4f..0ee1a3c5 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/headers-guard-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/headers-guard-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/headers-guard.js?-base-https-other-https',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/headers-guard.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/headers-guard.html
index 5f29360..3a4d9a61 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/headers-guard.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/headers-guard.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/headers-guard.js?',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/headers.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/headers.html
index f2a92c8..74f7123 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/headers.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/headers.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/headers.js?',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/referrer-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/referrer-base-https-other-https.html
index 6e2ba73..95eafb01 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/referrer-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/referrer-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/referrer.js?-base-https-other-https',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/referrer.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/referrer.html
index 993c165..d27c537 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/referrer.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/referrer.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/referrer.js?',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/request-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/request-base-https-other-https.html
index 7899f80..7af6941 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/request-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/request-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/request.js?-base-https-other-https',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/request.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/request.html
index 2acdd029..242057d 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/request.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/request.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/request.js?',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/response-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/response-base-https-other-https.html
index 3211965..c8e1605 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/response-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/response-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/response.js?-base-https-other-https',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/response-content-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/response-content-base-https-other-https.html
index 305cd49..6f02158 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/response-content-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/response-content-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/response-content.js?-base-https-other-https',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/response-content.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/response-content.html
index d69cf36..dae0a07 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/response-content.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/response-content.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/response-content.js?',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/response.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/response.html
index 4a931cd..9886723 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/response.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/response.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/response.js?',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/stream-reader-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/stream-reader-base-https-other-https.html
index 236838e..7f79a2a9d 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/stream-reader-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/stream-reader-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/stream-reader.js?-base-https-other-https',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/stream-reader.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/stream-reader.html
index d7e4574..4192a14 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/stream-reader.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/stream-reader.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   service_worker_test(
     '../script-tests/stream-reader.js?',

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/access-control-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/access-control-base-https-other-https.html
index f12a0a2..abd0505b 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/access-control-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/access-control-base-https-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/access-control.js?-base-https-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/access-control.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/access-control.html
index fd32914..70e719e 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/access-control.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/access-control.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/access-control.js?',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth-base-https-other-https.html
index 1d8f1140..40a75f9 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth-base-https-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/auth.js?-base-https-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth-nocors-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth-nocors-base-https-other-https.html
index 64174f9..4e92616b 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth-nocors-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth-nocors-base-https-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/auth-nocors.js?-base-https-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth-nocors-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth-nocors-other-https.html
index 368b393..43e1cd201 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth-nocors-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth-nocors-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/auth-nocors.js?-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth-nocors.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth-nocors.html
index 88232e7..6f02c8b 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth-nocors.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth-nocors.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/auth-nocors.js?',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth-other-https.html
index 2c1f09a..e9cf54b 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/auth.js?-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth.html
index 1ba886d..cebf10ca 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/auth.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/auth.js?',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie-base-https-other-https.html
index 520eadc..3e1993c 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie-base-https-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/cookie.js?-base-https-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie-nocors-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie-nocors-base-https-other-https.html
index 9822f5d7..510b304 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie-nocors-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie-nocors-base-https-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/cookie-nocors.js?-base-https-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie-nocors-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie-nocors-other-https.html
index 411de0c..68b72ca 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie-nocors-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie-nocors-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/cookie-nocors.js?-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie-nocors.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie-nocors.html
index 18ddc0b..4b95d6eb 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie-nocors.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie-nocors.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/cookie-nocors.js?',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie-other-https.html
index 35457e5..e7dd204 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/cookie.js?-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie.html
index 8b3869612..9907e12 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cookie.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/cookie.js?',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-base-https-other-https.html
index c7d840fc3..8a1c067a8 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-base-https-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/cors.js?-base-https-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-other-https.html
index 5449e4e..8b88944 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/cors.js?-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight-base-https-other-https.html
index 681fffb..7d6e6615 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight-base-https-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/cors-preflight.js?-base-https-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight-other-https.html
index 4c295a5..d838286 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/cors-preflight.js?-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight.html
index e3c5161..c0dbef6c 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/cors-preflight.js?',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight2-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight2-base-https-other-https.html
index 97448a98..164258d 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight2-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight2-base-https-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/cors-preflight2.js?-base-https-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight2-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight2-other-https.html
index ba4e25d..ba30350 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight2-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight2-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/cors-preflight2.js?-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight2.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight2.html
index d20a4b13..8aa5735c 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight2.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors-preflight2.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/cors-preflight2.js?',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors.html
index 8a01059..ff6256ab 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/cors.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/cors.js?',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/nocors-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/nocors-base-https-other-https.html
index 3243a967..daa92499 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/nocors-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/nocors-base-https-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/nocors.js?-base-https-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/nocors-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/nocors-other-https.html
index 8de10e38..e9d6a2f 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/nocors-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/nocors-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/nocors.js?-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/nocors.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/nocors.html
index 8c3d94a..e126d41e 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/nocors.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/nocors.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/nocors.js?',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-base-https-other-https.html
index 62488072..d39300b 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-base-https-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/redirect.js?-base-https-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-credentials-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-credentials-base-https-other-https.html
index 0c36ebc..4f9658b 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-credentials-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-credentials-base-https-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/redirect-credentials.js?-base-https-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-credentials-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-credentials-other-https.html
index d68080925..7b206e13 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-credentials-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-credentials-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/redirect-credentials.js?-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-credentials.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-credentials.html
index e58423d..15187a2 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-credentials.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-credentials.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/redirect-credentials.js?',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-loop-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-loop-base-https-other-https.html
index 517485d7..d23d555 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-loop-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-loop-base-https-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/redirect-loop.js?-base-https-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-loop-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-loop-other-https.html
index 5ed4c90a..0be40055 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-loop-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-loop-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/redirect-loop.js?-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-loop.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-loop.html
index b9b2841..2c2751c5 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-loop.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-loop.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/redirect-loop.js?',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-nocors-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-nocors-base-https-other-https.html
index 9eb067fd..a019338 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-nocors-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-nocors-base-https-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/redirect-nocors.js?-base-https-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-nocors-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-nocors-other-https.html
index 2792827..0c15c727 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-nocors-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-nocors-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/redirect-nocors.js?-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-nocors.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-nocors.html
index fcb3aec..2da5d169 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-nocors.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-nocors.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/redirect-nocors.js?',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-other-https.html
index af7c279..5225e819 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/redirect.js?-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-password-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-password-base-https-other-https.html
index d2dce6b..dd7bf387 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-password-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-password-base-https-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/redirect-password.js?-base-https-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-password-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-password-other-https.html
index 7b615a3..62d9229b 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-password-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-password-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/redirect-password.js?-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-password.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-password.html
index 69c28c7b..c79f559 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-password.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect-password.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/redirect-password.js?',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect.html
index dd5b13a8..c87c63b 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/redirect.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/redirect.js?',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-blob-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-blob-base-https-other-https.html
index fa8c8590..73df052 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-blob-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-blob-base-https-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/scheme-blob.js?-base-https-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-blob-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-blob-other-https.html
index 14e6f44..e2a8006 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-blob-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-blob-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/scheme-blob.js?-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-blob.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-blob.html
index e9eaed1..4c632c7 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-blob.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-blob.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/scheme-blob.js?',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-data-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-data-base-https-other-https.html
index a181b942..1d95586 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-data-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-data-base-https-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/scheme-data.js?-base-https-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-data-other-https.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-data-other-https.html
index 1b1859d..7e67df7 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-data-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-data-other-https.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/scheme-data.js?-other-https',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-data.html b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-data.html
index 9d6c3d1..6f576ef 100644
--- a/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-data.html
+++ b/third_party/blink/web_tests/http/tests/fetch/serviceworker/thorough/scheme-data.html

@@ -4,11 +4,13 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   service_worker_test(
     '/fetch/script-tests/thorough/scheme-data.js?',
@@ -16,10 +18,11 @@
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-      return login(test, host_info['HTTPS_ORIGIN'],
-        host_info['HTTPS_REMOTE_ORIGIN']); });
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
+      });
 }
 </script>
 <script src = "/fetch/resources/init.js"></script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/block-mixed-content-base-https.html b/third_party/blink/web_tests/http/tests/fetch/window/block-mixed-content-base-https.html
index 9e2a9533..9cbbb51f 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/block-mixed-content-base-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/block-mixed-content-base-https.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/block-mixed-content.js?-base-https';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/block-mixed-content-nocors-base-https.html b/third_party/blink/web_tests/http/tests/fetch/window/block-mixed-content-nocors-base-https.html
index 07ca59d9..0c6a94f 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/block-mixed-content-nocors-base-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/block-mixed-content-nocors-base-https.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/block-mixed-content-nocors.js?-base-https';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/body-mixin-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/body-mixin-base-https-other-https.html
index f0f1c44..06bc1ee 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/body-mixin-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/body-mixin-base-https-other-https.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/body-mixin.js?-base-https-other-https';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/body-mixin.html b/third_party/blink/web_tests/http/tests/fetch/window/body-mixin.html
index eed7b42..83d48949 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/body-mixin.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/body-mixin.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/body-mixin.js?';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/cache-override-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/cache-override-base-https-other-https.html
index c00879d1..e6757688 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/cache-override-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/cache-override-base-https-other-https.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/cache-override.js?-base-https-other-https';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/cache-override.html b/third_party/blink/web_tests/http/tests/fetch/window/cache-override.html
index dd1d7f4..44593266 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/cache-override.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/cache-override.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/cache-override.js?';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/fetch-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/fetch-base-https-other-https.html
index f3f8c7e..012d7bb 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/fetch-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/fetch-base-https-other-https.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/fetch.js?-base-https-other-https';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/fetch.html b/third_party/blink/web_tests/http/tests/fetch/window/fetch.html
index 350af518..9ab6427d 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/fetch.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/fetch.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/fetch.js?';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/filtered-response-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/filtered-response-base-https-other-https.html
index 8d4bf5a6..5e68c4c 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/filtered-response-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/filtered-response-base-https-other-https.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/filtered-response.js?-base-https-other-https';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/filtered-response-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/filtered-response-other-https.html
index da4dda2..2179a0a 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/filtered-response-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/filtered-response-other-https.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/filtered-response.js?-other-https';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/filtered-response.html b/third_party/blink/web_tests/http/tests/fetch/window/filtered-response.html
index 023c08f..b91ce4e 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/filtered-response.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/filtered-response.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/filtered-response.js?';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/headers-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/headers-base-https-other-https.html
index 458ccc94..d74e209 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/headers-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/headers-base-https-other-https.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/headers.js?-base-https-other-https';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/headers-guard-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/headers-guard-base-https-other-https.html
index efb29fb..f99210ef 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/headers-guard-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/headers-guard-base-https-other-https.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/headers-guard.js?-base-https-other-https';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/headers-guard.html b/third_party/blink/web_tests/http/tests/fetch/window/headers-guard.html
index 997fdee..3de3ce9a 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/headers-guard.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/headers-guard.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/headers-guard.js?';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/headers.html b/third_party/blink/web_tests/http/tests/fetch/window/headers.html
index 027f0ab5..68fb668 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/headers.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/headers.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/headers.js?';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/referrer-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/referrer-base-https-other-https.html
index a7a3ab28..2928d6b2 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/referrer-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/referrer-base-https-other-https.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/referrer.js?-base-https-other-https';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/referrer.html b/third_party/blink/web_tests/http/tests/fetch/window/referrer.html
index 7d4ea4b6..c7e8e34 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/referrer.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/referrer.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/referrer.js?';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/request-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/request-base-https-other-https.html
index 69e83bb..d279d8e 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/request-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/request-base-https-other-https.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/request.js?-base-https-other-https';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/request.html b/third_party/blink/web_tests/http/tests/fetch/window/request.html
index 10ac508..75102dea 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/request.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/request.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/request.js?';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/response-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/response-base-https-other-https.html
index 143eb70..a8eb4b0 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/response-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/response-base-https-other-https.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/response.js?-base-https-other-https';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/response-content-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/response-content-base-https-other-https.html
index 467412f..5c4b44e 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/response-content-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/response-content-base-https-other-https.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/response-content.js?-base-https-other-https';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/response-content.html b/third_party/blink/web_tests/http/tests/fetch/window/response-content.html
index fffbe2c..b8ff97f1d9 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/response-content.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/response-content.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/response-content.js?';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/response.html b/third_party/blink/web_tests/http/tests/fetch/window/response.html
index 99a79e71..a00f4275 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/response.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/response.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/response.js?';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/stream-reader-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/stream-reader-base-https-other-https.html
index bcd151e7..2c5339b30 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/stream-reader-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/stream-reader-base-https-other-https.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/stream-reader.js?-base-https-other-https';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/stream-reader.html b/third_party/blink/web_tests/http/tests/fetch/window/stream-reader.html
index 5f46322c..a05b8d14 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/stream-reader.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/stream-reader.html

@@ -1,15 +1,17 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
-<script src = "../resources/fetch-test-options.js"></script>
-<script src = "../resources/fetch-test-helpers.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/fetch-test-helpers.js"></script>
 <script src = "/streams/resources/rs-utils.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   var script = document.createElement('script');
   script.src = '../script-tests/stream-reader.js?';

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/access-control-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/access-control-base-https-other-https.html
index ef99e50..b46fb68 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/access-control-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/access-control-base-https-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/access-control.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/access-control.html
index 39d6568c..35404ea 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/access-control.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/access-control.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth-base-https-other-https.html
index 8f2a082d..826ee3c 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth-base-https-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth-nocors-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth-nocors-base-https-other-https.html
index 7f0d507..167a0bb 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth-nocors-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth-nocors-base-https-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth-nocors-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth-nocors-other-https.html
index 700dbda..b3c645ff 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth-nocors-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth-nocors-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth-nocors.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth-nocors.html
index fe840c0..daa2c861 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth-nocors.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth-nocors.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth-other-https.html
index 26c2a656..55cddd2 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth.html
index 72b84ce..525e52a 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/auth.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie-base-https-other-https.html
index 88b153a2..460450f 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie-base-https-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie-nocors-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie-nocors-base-https-other-https.html
index 78b0769..c72431dc 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie-nocors-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie-nocors-base-https-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie-nocors-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie-nocors-other-https.html
index bd0c46b0..59422571 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie-nocors-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie-nocors-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie-nocors.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie-nocors.html
index 3f426ca..9d7176d 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie-nocors.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie-nocors.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie-other-https.html
index cb5f297..d4182cf1 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie.html
index 38ebd34..183c1c1a 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cookie.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-base-https-other-https.html
index 6d13b8a..abd6532 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-base-https-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-other-https.html
index 90e7114..5bcd820 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight-base-https-other-https.html
index 6499cca..9cd4d77 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight-base-https-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight-other-https.html
index cacfede..85a1868 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight.html
index e7fcde4..91b57c49 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight2-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight2-base-https-other-https.html
index b743579b..7f6a8b7 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight2-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight2-base-https-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight2-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight2-other-https.html
index 6cac3284..43ce3f4 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight2-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight2-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight2.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight2.html
index 1bca9f15..c5331ae 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight2.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors-preflight2.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors.html
index a5a8bc21..d15b2fb 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/cors.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/nocors-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/nocors-base-https-other-https.html
index cf68091..e534886 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/nocors-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/nocors-base-https-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/nocors-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/nocors-other-https.html
index d7cadc2..7dacbe14 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/nocors-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/nocors-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/nocors.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/nocors.html
index b134819..0cccb2c 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/nocors.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/nocors.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-base-https-other-https.html
index 6919d1a..f35ff69 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-base-https-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-credentials-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-credentials-base-https-other-https.html
index 2e8da74763..02dd0e5 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-credentials-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-credentials-base-https-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-credentials-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-credentials-other-https.html
index a655d28..68bfda8 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-credentials-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-credentials-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-credentials.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-credentials.html
index 4d35b76..efba4fa 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-credentials.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-credentials.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-loop-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-loop-base-https-other-https.html
index 8cd8a6f..53a871c 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-loop-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-loop-base-https-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-loop-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-loop-other-https.html
index 23794ad8..770c4e50 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-loop-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-loop-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-loop.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-loop.html
index 1526a9ff..bb2c5f6 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-loop.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-loop.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-nocors-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-nocors-base-https-other-https.html
index a00a3cb..30578e5 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-nocors-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-nocors-base-https-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-nocors-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-nocors-other-https.html
index da5166d0..e20f41c 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-nocors-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-nocors-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-nocors.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-nocors.html
index a64703a..fe0c4db 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-nocors.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-nocors.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-other-https.html
index 22d036e4..56b7051 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-password-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-password-base-https-other-https.html
index 4b158d42..5ec3d3c 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-password-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-password-base-https-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-password-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-password-other-https.html
index 10c745e..a76e08a 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-password-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-password-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-password.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-password.html
index 02661c0..cdcad0f 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-password.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect-password.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect.html
index 1d65e51..b637db24 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/redirect.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-blob-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-blob-base-https-other-https.html
index 3759698..f31905d 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-blob-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-blob-base-https-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-blob-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-blob-other-https.html
index c26f484..53213b1 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-blob-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-blob-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-blob.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-blob.html
index 0f56eee..c05ee0e 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-blob.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-blob.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-data-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-data-base-https-other-https.html
index 954a0b9..8943070b 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-data-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-data-base-https-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-data-other-https.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-data-other-https.html
index 433dc8a..92311b8 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-data-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-data-other-https.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-data.html b/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-data.html
index 80b3a1f02..3116c20c 100644
--- a/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-data.html
+++ b/third_party/blink/web_tests/http/tests/fetch/window/thorough/scheme-data.html

@@ -12,16 +12,16 @@
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   executeTests(TEST_TARGETS);
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/block-mixed-content-base-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/block-mixed-content-base-https.html
index 40de41d..258eae812 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/block-mixed-content-base-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/block-mixed-content-base-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/block-mixed-content.js?-base-https'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/block-mixed-content-nocors-base-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/block-mixed-content-nocors-base-https.html
index 0696aa7..b912d52 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/block-mixed-content-nocors-base-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/block-mixed-content-nocors-base-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/block-mixed-content-nocors.js?-base-https'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/body-mixin-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/body-mixin-base-https-other-https.html
index 855594bc9..db80f7a 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/body-mixin-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/body-mixin-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/body-mixin.js?-base-https-other-https'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/body-mixin.html b/third_party/blink/web_tests/http/tests/fetch/workers/body-mixin.html
index 6a2734d..292de8f 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/body-mixin.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/body-mixin.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/body-mixin.js?'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/cache-override-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/cache-override-base-https-other-https.html
index bd3078d..2f88f9e 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/cache-override-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/cache-override-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/cache-override.js?-base-https-other-https'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/cache-override.html b/third_party/blink/web_tests/http/tests/fetch/workers/cache-override.html
index 18f699dd..30d7218 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/cache-override.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/cache-override.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/cache-override.js?'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/fetch-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/fetch-base-https-other-https.html
index 87def2a..6bac6d2 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/fetch-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/fetch-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/fetch.js?-base-https-other-https'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/fetch.html b/third_party/blink/web_tests/http/tests/fetch/workers/fetch.html
index 67d6327..2a315e32 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/fetch.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/fetch.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/fetch.js?'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/filtered-response-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/filtered-response-base-https-other-https.html
index 8aaedf4..f2c33d1f 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/filtered-response-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/filtered-response-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/filtered-response.js?-base-https-other-https'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/filtered-response-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/filtered-response-other-https.html
index ab8b6317..ac586a9 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/filtered-response-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/filtered-response-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/filtered-response.js?-other-https'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/filtered-response.html b/third_party/blink/web_tests/http/tests/fetch/workers/filtered-response.html
index b20c450..9ecea7b 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/filtered-response.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/filtered-response.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/filtered-response.js?'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/headers-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/headers-base-https-other-https.html
index 313eb5c..9802961 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/headers-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/headers-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/headers.js?-base-https-other-https'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/headers-guard-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/headers-guard-base-https-other-https.html
index ab1fde7c..86ab57d 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/headers-guard-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/headers-guard-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/headers-guard.js?-base-https-other-https'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/headers-guard.html b/third_party/blink/web_tests/http/tests/fetch/workers/headers-guard.html
index face948..d92a05e3 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/headers-guard.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/headers-guard.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/headers-guard.js?'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/headers.html b/third_party/blink/web_tests/http/tests/fetch/workers/headers.html
index 162eed4c..ec7b4515 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/headers.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/headers.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/headers.js?'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/referrer-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/referrer-base-https-other-https.html
index a161532..09320c2f 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/referrer-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/referrer-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/referrer.js?-base-https-other-https'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/referrer.html b/third_party/blink/web_tests/http/tests/fetch/workers/referrer.html
index bc80877b..2004900 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/referrer.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/referrer.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/referrer.js?'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/request-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/request-base-https-other-https.html
index f9308c89..ae3d3f5 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/request-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/request-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/request.js?-base-https-other-https'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/request.html b/third_party/blink/web_tests/http/tests/fetch/workers/request.html
index 95e985da..d4a2d6bb 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/request.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/request.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/request.js?'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/response-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/response-base-https-other-https.html
index f31e9ab..ead39af7 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/response-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/response-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/response.js?-base-https-other-https'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/response-content-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/response-content-base-https-other-https.html
index 028fcd7..11adf76 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/response-content-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/response-content-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/response-content.js?-base-https-other-https'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/response-content.html b/third_party/blink/web_tests/http/tests/fetch/workers/response-content.html
index 1ee67831..e4cb734 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/response-content.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/response-content.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/response-content.js?'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/response.html b/third_party/blink/web_tests/http/tests/fetch/workers/response.html
index 89962ae..b0b2950 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/response.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/response.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/response.js?'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/stream-reader-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/stream-reader-base-https-other-https.html
index 55a8337..d62a6be 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/stream-reader-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/stream-reader-base-https-other-https.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/stream-reader.js?-base-https-other-https'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/stream-reader.html b/third_party/blink/web_tests/http/tests/fetch/workers/stream-reader.html
index f9802b7..3507812 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/stream-reader.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/stream-reader.html

@@ -1,12 +1,15 @@
 <!doctype html>
 <head>
 <meta name="timeout" content="long"></meta>
+<script src = "/resources/get-host-info.js?pipe=sub"></script>
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
+var options = get_fetch_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('../script-tests/stream-reader.js?'));

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/access-control-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/access-control-base-https-other-https.html
index cacb639..1d3324c 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/access-control-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/access-control-base-https-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/access-control.js?-base-https-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/access-control.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/access-control.html
index 27a13d0..0b068851 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/access-control.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/access-control.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/access-control.js?'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth-base-https-other-https.html
index badbcd2..2a0ae52 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth-base-https-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/auth.js?-base-https-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth-nocors-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth-nocors-base-https-other-https.html
index 9b5bd79..0232e526 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth-nocors-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth-nocors-base-https-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/auth-nocors.js?-base-https-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth-nocors-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth-nocors-other-https.html
index ee56378ba..17d719c2 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth-nocors-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth-nocors-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/auth-nocors.js?-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth-nocors.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth-nocors.html
index c1e23f3..f289131 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth-nocors.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth-nocors.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/auth-nocors.js?'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth-other-https.html
index 856bb18..fc0e990 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/auth.js?-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth.html
index 00fae1c6..7604d77 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/auth.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/auth.js?'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie-base-https-other-https.html
index aa8350d..150ac00 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie-base-https-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/cookie.js?-base-https-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie-nocors-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie-nocors-base-https-other-https.html
index e468707c..f0bc734 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie-nocors-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie-nocors-base-https-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/cookie-nocors.js?-base-https-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie-nocors-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie-nocors-other-https.html
index ee42154..d6865c8 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie-nocors-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie-nocors-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/cookie-nocors.js?-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie-nocors.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie-nocors.html
index 097fa5b..5c618846 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie-nocors.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie-nocors.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/cookie-nocors.js?'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie-other-https.html
index 0e3eb26..c9c4d86 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/cookie.js?-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie.html
index 6dc0987d..82b2cda 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cookie.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/cookie.js?'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-base-https-other-https.html
index 73fdbc5..5f9e432 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-base-https-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/cors.js?-base-https-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-other-https.html
index 7df2f8c40..edf388cf 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/cors.js?-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight-base-https-other-https.html
index 4ff003b..d15a733 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight-base-https-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/cors-preflight.js?-base-https-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight-other-https.html
index 32537f50..54d093c 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/cors-preflight.js?-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight.html
index ff74b4d0..82df1bd 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/cors-preflight.js?'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight2-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight2-base-https-other-https.html
index aa867fb8..ca6130a7 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight2-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight2-base-https-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/cors-preflight2.js?-base-https-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight2-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight2-other-https.html
index c59b4c9b..427d03e 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight2-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight2-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/cors-preflight2.js?-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight2.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight2.html
index dcfc78f..62c69899 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight2.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors-preflight2.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/cors-preflight2.js?'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors.html
index f062348a..8969c1c 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/cors.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/cors.js?'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/nocors-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/nocors-base-https-other-https.html
index 38ab857..df588cd 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/nocors-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/nocors-base-https-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/nocors.js?-base-https-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/nocors-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/nocors-other-https.html
index 75a6a2c..2c92d67 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/nocors-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/nocors-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/nocors.js?-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/nocors.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/nocors.html
index 0ce2aab6..2a79bd2 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/nocors.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/nocors.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/nocors.js?'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-base-https-other-https.html
index 775c18f1..15c3d39 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-base-https-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/redirect.js?-base-https-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-credentials-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-credentials-base-https-other-https.html
index db80b074..95f0192 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-credentials-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-credentials-base-https-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/redirect-credentials.js?-base-https-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-credentials-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-credentials-other-https.html
index 8879f608..a9fce105 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-credentials-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-credentials-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/redirect-credentials.js?-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-credentials.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-credentials.html
index 7772f0d..d683d92 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-credentials.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-credentials.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/redirect-credentials.js?'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-loop-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-loop-base-https-other-https.html
index 9f9d84e..30feb087 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-loop-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-loop-base-https-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/redirect-loop.js?-base-https-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-loop-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-loop-other-https.html
index a4476c5..e5768d23 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-loop-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-loop-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/redirect-loop.js?-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-loop.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-loop.html
index ca694da..8e1fea2 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-loop.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-loop.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/redirect-loop.js?'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-nocors-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-nocors-base-https-other-https.html
index 9156a5d..9b6e975 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-nocors-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-nocors-base-https-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/redirect-nocors.js?-base-https-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-nocors-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-nocors-other-https.html
index fe4e10f..8feb1b05 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-nocors-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-nocors-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/redirect-nocors.js?-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-nocors.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-nocors.html
index 3e59771..97705e4 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-nocors.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-nocors.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/redirect-nocors.js?'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-other-https.html
index 74f744c4..c5e98aad 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/redirect.js?-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-password-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-password-base-https-other-https.html
index 25bffd0..da6fea5d 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-password-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-password-base-https-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/redirect-password.js?-base-https-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-password-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-password-other-https.html
index b74dd9e..e9d618b 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-password-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-password-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/redirect-password.js?-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-password.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-password.html
index cfba3715..60e010c 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-password.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect-password.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/redirect-password.js?'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect.html
index 30999932..90dde95e 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/redirect.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/redirect.js?'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-blob-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-blob-base-https-other-https.html
index 991412b..6abb6642 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-blob-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-blob-base-https-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/scheme-blob.js?-base-https-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-blob-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-blob-other-https.html
index ef0cee5..9938261 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-blob-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-blob-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/scheme-blob.js?-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-blob.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-blob.html
index b2aca56..77a7ab2 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-blob.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-blob.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/scheme-blob.js?'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-data-base-https-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-data-base-https-other-https.html
index f5dde891..22215bfc 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-data-base-https-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-data-base-https-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/scheme-data.js?-base-https-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-data-other-https.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-data-other-https.html
index 44ce0b2..49c5fb96 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-data-other-https.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-data-other-https.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/scheme-data.js?-other-https'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-data.html b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-data.html
index 518bddac..0494743 100644
--- a/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-data.html
+++ b/third_party/blink/web_tests/http/tests/fetch/workers/thorough/scheme-data.html

@@ -4,21 +4,23 @@
 <script src = "/resources/testharness.js"></script>
 <script src = "/resources/testharnessreport.js"></script>
 <script src = "/resources/get-host-info.js?pipe=sub"></script>
+<script src = "/fetch/resources/fetch-test-options.js"></script>
+<script src = "/fetch/resources/thorough-util.js"></script>
 <script src = "/serviceworker/resources/test-helpers.js"></script>
 </head>
 <body>
 <script>
-var host_info = get_host_info();
+var options = get_thorough_test_options();
 function start(t) {
   fetch_tests_from_worker(
     new Worker('/fetch/script-tests/thorough/scheme-data.js?'));
   t.done();
 }
 function init(test) {
-  return login(test, host_info['HTTP_ORIGIN'], host_info['HTTP_REMOTE_ORIGIN'])
+  return login(test, options['BASE_HTTP_ORIGIN'], options['OTHER_HTTP_ORIGIN'])
     .then(function() {
-        return login(test, host_info['HTTPS_ORIGIN'],
-                     host_info['HTTPS_REMOTE_ORIGIN']);
+      return login(test, options['BASE_HTTPS_ORIGIN'],
+        options['OTHER_HTTPS_ORIGIN']);
       });
 }
 </script>

diff --git a/third_party/blink/web_tests/http/tests/resources/get-host-info.js b/third_party/blink/web_tests/http/tests/resources/get-host-info.js
index a7d31d7..54740bd 100644
--- a/third_party/blink/web_tests/http/tests/resources/get-host-info.js
+++ b/third_party/blink/web_tests/http/tests/resources/get-host-info.js

@@ -1,6 +1,10 @@
-function get_host_info() {
-  var ORIGINAL_HOST = '127.0.0.1';
-  var REMOTE_HOST = 'localhost';
+// |original_host_override| and |remote_host_override| are custom hostnames.
+// These are for tests where we cannot just use '127.0.0.1' and 'localhost'
+// because some web platform features may behave differently for localhost
+// URLs, which means we must use other URLs to get realistic behavior.
+function get_host_info(original_host_override, remote_host_override) {
+  var ORIGINAL_HOST = original_host_override || '127.0.0.1';
+  var REMOTE_HOST = remote_host_override || 'localhost';
   // TODO(mkwst): This should be a host that WPT supports. I don't know why we're using 'example.test'.
   var OTHER_HOST = 'example.test';
   var HTTP_PORT = 8000;

diff --git a/third_party/blink/web_tests/http/tests/serviceworker/webexposed/global-interface-listing-service-worker-expected.txt b/third_party/blink/web_tests/http/tests/serviceworker/webexposed/global-interface-listing-service-worker-expected.txt
index 1684c94a..aa4b3c9 100644
--- a/third_party/blink/web_tests/http/tests/serviceworker/webexposed/global-interface-listing-service-worker-expected.txt
+++ b/third_party/blink/web_tests/http/tests/serviceworker/webexposed/global-interface-listing-service-worker-expected.txt

@@ -54,6 +54,15 @@
     attribute @@toStringTag
     method constructor
     method detect
+interface BidirectionalStream
+    attribute @@toStringTag
+    getter readable
+    getter readingAborted
+    getter writable
+    getter writingAborted
+    method abortReading
+    method abortWriting
+    method constructor
 interface Blob
     attribute @@toStringTag
     getter size
@@ -1248,7 +1257,9 @@
     getter ready
     method close
     method constructor
+    method createBidirectionalStream
     method createSendStream
+    method receiveBidirectionalStreams
     method receiveDatagrams
     method receiveStreams
     method sendDatagrams

diff --git a/third_party/blink/web_tests/inspector-protocol/dom-snapshot/captureSnapshot-ua-shadow-tree2-expected.txt b/third_party/blink/web_tests/inspector-protocol/dom-snapshot/captureSnapshot-ua-shadow-tree2-expected.txt
new file mode 100644
index 0000000..f7a6815f
--- /dev/null
+++ b/third_party/blink/web_tests/inspector-protocol/dom-snapshot/captureSnapshot-ua-shadow-tree2-expected.txt

@@ -0,0 +1,343 @@
+Blocked access to external URL http://example.com/A.png
+Blocked access to external URL http://example.com/B.png
+Blocked access to external URL http://example.com/C.png
+Tests that DOMSnapshot skips UA shadow root when traversing the DOM tree
+{
+    documents : [
+        [0] : {
+            baseURL : 0
+            contentHeight : 600
+            contentLanguage : -1
+            contentWidth : 800
+            documentURL : <number>
+            encodingName : 1
+            frameId : <number>
+            layout : {
+                bounds : [
+                    [0] : [
+                        [0] : 0
+                        [1] : 0
+                        [2] : 800
+                        [3] : 600
+                    ]
+                    [1] : [
+                        [0] : 0
+                        [1] : 0
+                        [2] : 800
+                        [3] : 600
+                    ]
+                    [2] : [
+                        [0] : 8
+                        [1] : 8
+                        [2] : 784
+                        [3] : 584
+                    ]
+                    [3] : [
+                        [0] : 8
+                        [1] : 8
+                        [2] : 16
+                        [3] : 16
+                    ]
+                    [4] : [
+                        [0] : 24
+                        [1] : 16
+                        [2] : 10
+                        [3] : 10
+                    ]
+                    [5] : [
+                        [0] : 34
+                        [1] : 8
+                        [2] : 16
+                        [3] : 16
+                    ]
+                    [6] : [
+                        [0] : 50
+                        [1] : 16
+                        [2] : 10
+                        [3] : 10
+                    ]
+                    [7] : [
+                        [0] : 60
+                        [1] : 8
+                        [2] : 16
+                        [3] : 16
+                    ]
+                    [8] : [
+                        [0] : 0
+                        [1] : 0
+                        [2] : 0
+                        [3] : 0
+                    ]
+                ]
+                nodeIndex : [
+                    [0] : 0
+                    [1] : 1
+                    [2] : 6
+                    [3] : 8
+                    [4] : 9
+                    [5] : 10
+                    [6] : 11
+                    [7] : 12
+                    [8] : 13
+                ]
+                stackingContexts : {
+                    index : [
+                        [0] : 0
+                        [1] : 1
+                    ]
+                }
+                styles : [
+                    [0] : [
+                    ]
+                    [1] : [
+                    ]
+                    [2] : [
+                    ]
+                    [3] : [
+                    ]
+                    [4] : [
+                    ]
+                    [5] : [
+                    ]
+                    [6] : [
+                    ]
+                    [7] : [
+                    ]
+                    [8] : [
+                    ]
+                ]
+                text : [
+                    [0] : -1
+                    [1] : -1
+                    [2] : -1
+                    [3] : -1
+                    [4] : 9
+                    [5] : -1
+                    [6] : 9
+                    [7] : -1
+                    [8] : 20
+                ]
+            }
+            nodes : {
+                attributes : [
+                    [0] : [
+                    ]
+                    [1] : [
+                    ]
+                    [2] : [
+                    ]
+                    [3] : [
+                    ]
+                    [4] : [
+                    ]
+                    [5] : [
+                    ]
+                    [6] : [
+                    ]
+                    [7] : [
+                    ]
+                    [8] : [
+                        [0] : 12
+                        [1] : 13
+                        [2] : 14
+                        [3] : 15
+                    ]
+                    [9] : [
+                    ]
+                    [10] : [
+                        [0] : 12
+                        [1] : 16
+                        [2] : 14
+                        [3] : 17
+                    ]
+                    [11] : [
+                    ]
+                    [12] : [
+                        [0] : 12
+                        [1] : 18
+                        [2] : 14
+                        [3] : 19
+                    ]
+                    [13] : [
+                    ]
+                ]
+                backendNodeId : <object>
+                contentDocumentIndex : {
+                    index : [
+                    ]
+                    value : [
+                    ]
+                }
+                currentSourceURL : {
+                    index : [
+                        [0] : 8
+                        [1] : 10
+                        [2] : 12
+                    ]
+                    value : [
+                        [0] : -1
+                        [1] : -1
+                        [2] : -1
+                    ]
+                }
+                inputChecked : {
+                    index : [
+                    ]
+                }
+                inputValue : {
+                    index : [
+                    ]
+                    value : [
+                    ]
+                }
+                isClickable : {
+                    index : [
+                    ]
+                }
+                nodeName : [
+                    [0] : 3
+                    [1] : 4
+                    [2] : 5
+                    [3] : 6
+                    [4] : 7
+                    [5] : 7
+                    [6] : 10
+                    [7] : 7
+                    [8] : 11
+                    [9] : 7
+                    [10] : 11
+                    [11] : 7
+                    [12] : 11
+                    [13] : 7
+                ]
+                nodeType : [
+                    [0] : 9
+                    [1] : 1
+                    [2] : 1
+                    [3] : 1
+                    [4] : 3
+                    [5] : 3
+                    [6] : 1
+                    [7] : 3
+                    [8] : 1
+                    [9] : 3
+                    [10] : 1
+                    [11] : 3
+                    [12] : 1
+                    [13] : 3
+                ]
+                nodeValue : [
+                    [0] : -1
+                    [1] : -1
+                    [2] : -1
+                    [3] : -1
+                    [4] : 8
+                    [5] : 9
+                    [6] : -1
+                    [7] : 9
+                    [8] : -1
+                    [9] : 9
+                    [10] : -1
+                    [11] : 9
+                    [12] : -1
+                    [13] : 20
+                ]
+                optionSelected : {
+                    index : [
+                    ]
+                }
+                originURL : {
+                    index : [
+                    ]
+                    value : [
+                    ]
+                }
+                parentIndex : [
+                    [0] : -1
+                    [1] : 0
+                    [2] : 1
+                    [3] : 2
+                    [4] : 3
+                    [5] : 2
+                    [6] : 1
+                    [7] : 6
+                    [8] : 6
+                    [9] : 6
+                    [10] : 6
+                    [11] : 6
+                    [12] : 6
+                    [13] : 6
+                ]
+                pseudoType : {
+                    index : [
+                    ]
+                    value : [
+                    ]
+                }
+                textValue : {
+                    index : [
+                    ]
+                    value : [
+                    ]
+                }
+            }
+            publicId : -1
+            scrollOffsetX : 0
+            scrollOffsetY : 0
+            systemId : -1
+            textBoxes : {
+                bounds : [
+                    [0] : [
+                        [0] : 24
+                        [1] : 16
+                        [2] : 10
+                        [3] : 10
+                    ]
+                    [1] : [
+                        [0] : 50
+                        [1] : 16
+                        [2] : 10
+                        [3] : 10
+                    ]
+                ]
+                layoutIndex : [
+                    [0] : 4
+                    [1] : 6
+                ]
+                length : [
+                    [0] : 1
+                    [1] : 1
+                ]
+                start : [
+                    [0] : 0
+                    [1] : 0
+                ]
+            }
+            title : -1
+        }
+    ]
+    strings : [
+        [0] : 
+        [1] : windows-1252
+        [2] : 
+        [3] : #document
+        [4] : HTML
+        [5] : HEAD
+        [6] : STYLE
+        [7] : #text
+        [8] :     body { font: 10px Ahem; }   
+        [9] :    
+        [10] : BODY
+        [11] : IMG
+        [12] : id
+        [13] : one
+        [14] : src
+        [15] : http://example.com/A.png
+        [16] : two
+        [17] : http://example.com/B.png
+        [18] : three
+        [19] : http://example.com/C.png
+        [20] :       
+    ]
+}
+

diff --git a/third_party/blink/web_tests/inspector-protocol/dom-snapshot/captureSnapshot-ua-shadow-tree2.js b/third_party/blink/web_tests/inspector-protocol/dom-snapshot/captureSnapshot-ua-shadow-tree2.js
new file mode 100644
index 0000000..2a3c507e
--- /dev/null
+++ b/third_party/blink/web_tests/inspector-protocol/dom-snapshot/captureSnapshot-ua-shadow-tree2.js

@@ -0,0 +1,25 @@
+(async function(testRunner) {
+  var {page, session, dp} = await testRunner.startHTML(`
+  <html>
+  <style>
+   body { font: 10px Ahem; }
+  </style>
+  <body>
+  <img id="one" src="http://example.com/A.png"/>
+  <img id="two" src="http://example.com/B.png"/>
+  <img id="three" src="http://example.com/C.png"/>
+  </body>
+  </html>`, 'Tests that DOMSnapshot skips UA shadow root when traversing the DOM tree');
+
+  var response = await dp.DOMSnapshot.captureSnapshot({computedStyles: []});
+  if (response.error) {
+    testRunner.log(response);
+  } else {
+    response.result.strings[response.result.documents[0].documentURL] = '';
+    response.result.strings[response.result.documents[0].frameId] = '';
+    testRunner.log(
+        response.result, undefined,
+        ['documentURL', 'frameId', 'backendNodeId']);
+  }
+  testRunner.completeTest();
+})

diff --git a/third_party/blink/web_tests/inspector-protocol/dom-snapshot/captureSnapshot-ua-shadow-tree3-expected.txt b/third_party/blink/web_tests/inspector-protocol/dom-snapshot/captureSnapshot-ua-shadow-tree3-expected.txt
new file mode 100644
index 0000000..bfdd158
--- /dev/null
+++ b/third_party/blink/web_tests/inspector-protocol/dom-snapshot/captureSnapshot-ua-shadow-tree3-expected.txt

@@ -0,0 +1,217 @@
+Tests that DOMSnapshot properly descends into the shadow tree
+{
+    documents : [
+        [0] : {
+            baseURL : 0
+            contentHeight : 600
+            contentLanguage : -1
+            contentWidth : 800
+            documentURL : <number>
+            encodingName : 1
+            frameId : <number>
+            layout : {
+                bounds : <object>
+                nodeIndex : [
+                    [0] : 0
+                    [1] : 1
+                    [2] : 6
+                    [3] : 8
+                    [4] : 10
+                ]
+                stackingContexts : {
+                    index : [
+                        [0] : 0
+                        [1] : 1
+                    ]
+                }
+                styles : [
+                    [0] : [
+                    ]
+                    [1] : [
+                    ]
+                    [2] : [
+                    ]
+                    [3] : [
+                    ]
+                    [4] : [
+                    ]
+                ]
+                text : [
+                    [0] : -1
+                    [1] : -1
+                    [2] : -1
+                    [3] : -1
+                    [4] : 17
+                ]
+            }
+            nodes : {
+                attributes : [
+                    [0] : [
+                    ]
+                    [1] : [
+                    ]
+                    [2] : [
+                    ]
+                    [3] : [
+                    ]
+                    [4] : [
+                    ]
+                    [5] : [
+                    ]
+                    [6] : [
+                    ]
+                    [7] : [
+                    ]
+                    [8] : [
+                        [0] : 12
+                        [1] : 13
+                        [2] : 14
+                        [3] : 15
+                    ]
+                    [9] : [
+                    ]
+                    [10] : [
+                    ]
+                ]
+                backendNodeId : <object>
+                contentDocumentIndex : {
+                    index : [
+                    ]
+                    value : [
+                    ]
+                }
+                currentSourceURL : {
+                    index : [
+                    ]
+                    value : [
+                    ]
+                }
+                inputChecked : {
+                    index : [
+                    ]
+                }
+                inputValue : {
+                    index : [
+                    ]
+                    value : [
+                    ]
+                }
+                isClickable : {
+                    index : [
+                    ]
+                }
+                nodeName : [
+                    [0] : 3
+                    [1] : 4
+                    [2] : 5
+                    [3] : 6
+                    [4] : 7
+                    [5] : 7
+                    [6] : 10
+                    [7] : 7
+                    [8] : 11
+                    [9] : 7
+                    [10] : 7
+                ]
+                nodeType : [
+                    [0] : 9
+                    [1] : 1
+                    [2] : 1
+                    [3] : 1
+                    [4] : 3
+                    [5] : 3
+                    [6] : 1
+                    [7] : 3
+                    [8] : 1
+                    [9] : 3
+                    [10] : 3
+                ]
+                nodeValue : [
+                    [0] : -1
+                    [1] : -1
+                    [2] : -1
+                    [3] : -1
+                    [4] : 8
+                    [5] : 9
+                    [6] : -1
+                    [7] : 9
+                    [8] : -1
+                    [9] : 16
+                    [10] : 17
+                ]
+                optionSelected : {
+                    index : [
+                    ]
+                }
+                originURL : {
+                    index : [
+                    ]
+                    value : [
+                    ]
+                }
+                parentIndex : [
+                    [0] : -1
+                    [1] : 0
+                    [2] : 1
+                    [3] : 2
+                    [4] : 3
+                    [5] : 2
+                    [6] : 1
+                    [7] : 6
+                    [8] : 6
+                    [9] : 8
+                    [10] : 6
+                ]
+                pseudoType : {
+                    index : [
+                    ]
+                    value : [
+                    ]
+                }
+                textValue : {
+                    index : [
+                        [0] : 8
+                    ]
+                    value : [
+                        [0] : 16
+                    ]
+                }
+            }
+            publicId : -1
+            scrollOffsetX : 0
+            scrollOffsetY : 0
+            systemId : -1
+            textBoxes : {
+                bounds : <object>
+                layoutIndex : [
+                ]
+                length : [
+                ]
+                start : [
+                ]
+            }
+            title : -1
+        }
+    ]
+    strings : [
+        [0] : 
+        [1] : windows-1252
+        [2] : 
+        [3] : #document
+        [4] : HTML
+        [5] : HEAD
+        [6] : STYLE
+        [7] : #text
+        [8] :     body { font: 10px Ahem; }   
+        [9] :    
+        [10] : BODY
+        [11] : TEXTAREA
+        [12] : rows
+        [13] : 10
+        [14] : cols
+        [15] : 30
+        [16] : We apologize for the inconvenience.
+        [17] :       
+    ]
+}
+

diff --git a/third_party/blink/web_tests/inspector-protocol/dom-snapshot/captureSnapshot-ua-shadow-tree3.js b/third_party/blink/web_tests/inspector-protocol/dom-snapshot/captureSnapshot-ua-shadow-tree3.js
new file mode 100644
index 0000000..c38fed8
--- /dev/null
+++ b/third_party/blink/web_tests/inspector-protocol/dom-snapshot/captureSnapshot-ua-shadow-tree3.js

@@ -0,0 +1,23 @@
+(async function(testRunner) {
+  var {page, session, dp} = await testRunner.startHTML(`
+  <html>
+  <style>
+   body { font: 10px Ahem; }
+  </style>
+  <body>
+  <textarea rows="10" cols="30">We apologize for the inconvenience.</textarea>
+  </body>
+  </html>`, 'Tests that DOMSnapshot properly descends into the shadow tree');
+
+  var response = await dp.DOMSnapshot.captureSnapshot({computedStyles: []});
+  if (response.error) {
+    testRunner.log(response);
+  } else {
+    response.result.strings[response.result.documents[0].documentURL] = '';
+    response.result.strings[response.result.documents[0].frameId] = '';
+    testRunner.log(
+        response.result, undefined,
+        ['documentURL', 'frameId', 'backendNodeId', 'bounds']);
+  }
+  testRunner.completeTest();
+})

diff --git a/third_party/blink/web_tests/platform/linux/virtual/dark-color-scheme/media/audio-controls-rendering-expected.png b/third_party/blink/web_tests/platform/linux/virtual/dark-color-scheme/media/audio-controls-rendering-expected.png
new file mode 100644
index 0000000..b4b6a62
--- /dev/null
+++ b/third_party/blink/web_tests/platform/linux/virtual/dark-color-scheme/media/audio-controls-rendering-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/linux/virtual/dark-color-scheme/media/video-controls-rendering-expected.png b/third_party/blink/web_tests/platform/linux/virtual/dark-color-scheme/media/video-controls-rendering-expected.png
new file mode 100644
index 0000000..12be4fd7
--- /dev/null
+++ b/third_party/blink/web_tests/platform/linux/virtual/dark-color-scheme/media/video-controls-rendering-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/mac-mac10.12/virtual/dark-color-scheme/media/audio-controls-rendering-expected.png b/third_party/blink/web_tests/platform/mac-mac10.12/virtual/dark-color-scheme/media/audio-controls-rendering-expected.png
new file mode 100644
index 0000000..5cc82587
--- /dev/null
+++ b/third_party/blink/web_tests/platform/mac-mac10.12/virtual/dark-color-scheme/media/audio-controls-rendering-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/mac-mac10.12/virtual/dark-color-scheme/media/video-controls-rendering-expected.png b/third_party/blink/web_tests/platform/mac-mac10.12/virtual/dark-color-scheme/media/video-controls-rendering-expected.png
new file mode 100644
index 0000000..9561916
--- /dev/null
+++ b/third_party/blink/web_tests/platform/mac-mac10.12/virtual/dark-color-scheme/media/video-controls-rendering-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/mac/virtual/dark-color-scheme/media/audio-controls-rendering-expected.png b/third_party/blink/web_tests/platform/mac/virtual/dark-color-scheme/media/audio-controls-rendering-expected.png
new file mode 100644
index 0000000..efa1be41
--- /dev/null
+++ b/third_party/blink/web_tests/platform/mac/virtual/dark-color-scheme/media/audio-controls-rendering-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/mac/virtual/dark-color-scheme/media/video-controls-rendering-expected.png b/third_party/blink/web_tests/platform/mac/virtual/dark-color-scheme/media/video-controls-rendering-expected.png
new file mode 100644
index 0000000..cf20db7d
--- /dev/null
+++ b/third_party/blink/web_tests/platform/mac/virtual/dark-color-scheme/media/video-controls-rendering-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/win/virtual/dark-color-scheme/media/audio-controls-rendering-expected.png b/third_party/blink/web_tests/platform/win/virtual/dark-color-scheme/media/audio-controls-rendering-expected.png
new file mode 100644
index 0000000..09b59312
--- /dev/null
+++ b/third_party/blink/web_tests/platform/win/virtual/dark-color-scheme/media/audio-controls-rendering-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/platform/win/virtual/dark-color-scheme/media/video-controls-rendering-expected.png b/third_party/blink/web_tests/platform/win/virtual/dark-color-scheme/media/video-controls-rendering-expected.png
new file mode 100644
index 0000000..4ab673a
--- /dev/null
+++ b/third_party/blink/web_tests/platform/win/virtual/dark-color-scheme/media/video-controls-rendering-expected.png
Binary files differ

diff --git a/third_party/blink/web_tests/virtual/dark-color-scheme/media/audio-controls-rendering.html b/third_party/blink/web_tests/virtual/dark-color-scheme/media/audio-controls-rendering.html
new file mode 100644
index 0000000..86deab4
--- /dev/null
+++ b/third_party/blink/web_tests/virtual/dark-color-scheme/media/audio-controls-rendering.html

@@ -0,0 +1,4 @@
+<html>
+    <meta name="color-scheme" content="dark">
+    <audio controls src="../../../webaudio/resources/media/128kbps-44khz.mp3"></audio>
+</html>

diff --git a/third_party/blink/web_tests/virtual/dark-color-scheme/media/video-controls-rendering.html b/third_party/blink/web_tests/virtual/dark-color-scheme/media/video-controls-rendering.html
new file mode 100644
index 0000000..bdc71e751
--- /dev/null
+++ b/third_party/blink/web_tests/virtual/dark-color-scheme/media/video-controls-rendering.html

@@ -0,0 +1,19 @@
+<html>
+<script src="../../../media/media-file.js"></script>
+<script src="../../../media/video-paint-test.js"></script>
+<script src="../../../media/media-controls.js"></script>
+<meta name="color-scheme" content="dark">
+
+<video controls>
+</video>
+
+<script>
+    const videos = document.getElementsByTagName('video');
+    for (var i = 0; i < videos.length; ++i) {
+        enableTestMode(videos[i]);
+    }
+    init();
+    setSrcByTagName('video', '../../../media/content/test.ogv');
+</script>
+
+</html>
\ No newline at end of file

diff --git a/third_party/blink/web_tests/webexposed/global-interface-listing-dedicated-worker-expected.txt b/third_party/blink/web_tests/webexposed/global-interface-listing-dedicated-worker-expected.txt
index dceb7235..042c78e8d 100644
--- a/third_party/blink/web_tests/webexposed/global-interface-listing-dedicated-worker-expected.txt
+++ b/third_party/blink/web_tests/webexposed/global-interface-listing-dedicated-worker-expected.txt

@@ -47,6 +47,15 @@
 [Worker]     attribute @@toStringTag
 [Worker]     method constructor
 [Worker]     method detect
+[Worker] interface BidirectionalStream
+[Worker]     attribute @@toStringTag
+[Worker]     getter readable
+[Worker]     getter readingAborted
+[Worker]     getter writable
+[Worker]     getter writingAborted
+[Worker]     method abortReading
+[Worker]     method abortWriting
+[Worker]     method constructor
 [Worker] interface Blob
 [Worker]     attribute @@toStringTag
 [Worker]     getter size
@@ -1180,7 +1189,9 @@
 [Worker]     getter ready
 [Worker]     method close
 [Worker]     method constructor
+[Worker]     method createBidirectionalStream
 [Worker]     method createSendStream
+[Worker]     method receiveBidirectionalStreams
 [Worker]     method receiveDatagrams
 [Worker]     method receiveStreams
 [Worker]     method sendDatagrams

diff --git a/third_party/blink/web_tests/webexposed/global-interface-listing-expected.txt b/third_party/blink/web_tests/webexposed/global-interface-listing-expected.txt
index 0823355..5cd7f2ef 100644
--- a/third_party/blink/web_tests/webexposed/global-interface-listing-expected.txt
+++ b/third_party/blink/web_tests/webexposed/global-interface-listing-expected.txt

@@ -516,6 +516,15 @@
     getter returnValue
     method constructor
     setter returnValue
+interface BidirectionalStream
+    attribute @@toStringTag
+    getter readable
+    getter readingAborted
+    getter writable
+    getter writingAborted
+    method abortReading
+    method abortWriting
+    method constructor
 interface BiquadFilterNode : AudioNode
     attribute @@toStringTag
     getter Q
@@ -6274,7 +6283,9 @@
     getter ready
     method close
     method constructor
+    method createBidirectionalStream
     method createSendStream
+    method receiveBidirectionalStreams
     method receiveDatagrams
     method receiveStreams
     method sendDatagrams

diff --git a/third_party/blink/web_tests/webexposed/global-interface-listing-shared-worker-expected.txt b/third_party/blink/web_tests/webexposed/global-interface-listing-shared-worker-expected.txt
index e76692b..cb634ff 100644
--- a/third_party/blink/web_tests/webexposed/global-interface-listing-shared-worker-expected.txt
+++ b/third_party/blink/web_tests/webexposed/global-interface-listing-shared-worker-expected.txt

@@ -47,6 +47,15 @@
 [Worker]     attribute @@toStringTag
 [Worker]     method constructor
 [Worker]     method detect
+[Worker] interface BidirectionalStream
+[Worker]     attribute @@toStringTag
+[Worker]     getter readable
+[Worker]     getter readingAborted
+[Worker]     getter writable
+[Worker]     getter writingAborted
+[Worker]     method abortReading
+[Worker]     method abortWriting
+[Worker]     method constructor
 [Worker] interface Blob
 [Worker]     attribute @@toStringTag
 [Worker]     getter size
@@ -1138,7 +1147,9 @@
 [Worker]     getter ready
 [Worker]     method close
 [Worker]     method constructor
+[Worker]     method createBidirectionalStream
 [Worker]     method createSendStream
+[Worker]     method receiveBidirectionalStreams
 [Worker]     method receiveDatagrams
 [Worker]     method receiveStreams
 [Worker]     method sendDatagrams

diff --git a/tools/metrics/actions/actions.xml b/tools/metrics/actions/actions.xml
index 51053e5..0a9f534 100644
--- a/tools/metrics/actions/actions.xml
+++ b/tools/metrics/actions/actions.xml

@@ -15586,6 +15586,18 @@
   </description>
 </action>
 
+<action name="OfflineIndicator.Hidden">
+  <owner>sinansahin@google.com</owner>
+  <owner>twellington@chromium.org</owner>
+  <description>Recorded when the offline indicator is hidden.</description>
+</action>
+
+<action name="OfflineIndicator.Shown">
+  <owner>sinansahin@google.com</owner>
+  <owner>twellington@chromium.org</owner>
+  <description>Recorded when the offline indicator is shown.</description>
+</action>
+
 <action name="OfflinePages.Edit.RemoveButtonClicked">
   <obsolete>Offline pages were pulled out of bookmarks UI.</obsolete>
   <owner>jianli@chromium.org</owner>

diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index c3f972a..54853a08 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml

@@ -22928,6 +22928,7 @@
   <int value="1470" label="TERMINALPRIVATE_OPENOPTIONSPAGE"/>
   <int value="1471" label="DECLARATIVENETREQUEST_UPDATEENABLEDRULESETS"/>
   <int value="1472" label="DECLARATIVENETREQUEST_GETENABLEDRULESETS"/>
+  <int value="1473" label="TERMINALPRIVATE_OPENWINDOW"/>
 </enum>
 
 <enum name="ExtensionIconState">
@@ -39610,6 +39611,7 @@
   <int value="-567920515" label="disable-experimental-hotwording"/>
   <int value="-563980787" label="disable-webrtc"/>
   <int value="-563600258" label="PhotoPickerVideoSupport:disabled"/>
+  <int value="-562771426" label="InstantStart:disabled"/>
   <int value="-562274241" label="enable-extension-action-redesign"/>
   <int value="-561194974" label="AutofillExpandedPopupViews:enabled"/>
   <int value="-560551550" label="use-memory-pressure-chromeos"/>
@@ -40704,6 +40706,7 @@
   <int value="705407202" label="AutofillSaveCardImprovedUserConsent:disabled"/>
   <int value="705712478" label="EnablePalmOnToolTypePalm:disabled"/>
   <int value="705713283" label="EasyUnlockPromotions:disabled"/>
+  <int value="709138900" label="InstantStart:enabled"/>
   <int value="709850261" label="disable-touch-editing"/>
   <int value="710700286" label="ImmersiveFullscreen:disabled"/>
   <int value="711424932" label="enable-cloud-print-xps"/>
@@ -40781,6 +40784,7 @@
   <int value="783270752" label="AndroidHistoryManager:enabled"/>
   <int value="787080596" label="DynamicTcmallocTuning:enabled"/>
   <int value="787385958" label="RegionalLocalesAsDisplayUI:enabled"/>
+  <int value="798696013" label="ImeInputLogicMozc:enabled"/>
   <int value="799680074" label="ContextualSearchTranslationModel:enabled"/>
   <int value="803282885" label="PreferHtmlOverPlugins:disabled"/>
   <int value="805661595" label="ChromeosVideoDecoder:enabled"/>
@@ -40846,6 +40850,7 @@
   <int value="879699575" label="disable-gesture-tap-highlight"/>
   <int value="879992337" label="disable-pull-to-refresh-effect"/>
   <int value="880510010" label="enable-permissions-bubbles"/>
+  <int value="883190338" label="PrintWithReducedRasterization:disabled"/>
   <int value="884106779" label="supervised-user-safesites"/>
   <int value="885004540" label="ArcEnableApplicationZoomFeature:enabled"/>
   <int value="885971656" label="EnablePlayStoreAppSearch:enabled"/>
@@ -41498,6 +41503,7 @@
   <int value="1622131033" label="ozone-test-single-overlay-support"/>
   <int value="1622672308" label="ReaderMode:enabled"/>
   <int value="1626824478" label="ExperimentalAppBanners:disabled"/>
+  <int value="1627416551" label="ImeInputLogicMozc:disabled"/>
   <int value="1627666567" label="ChromeOSAmbientMode:disabled"/>
   <int value="1628259213" label="DuetTabStripIntegrationAndroid:enabled"/>
   <int value="1628831121" label="SafeBrowsingUseLocalBlacklistsV2:enabled"/>
@@ -41520,6 +41526,7 @@
   <int value="1639314588" label="LookalikeUrlNavigationSuggestions:disabled"/>
   <int value="1640386037" label="ContextualSuggestionsSlimPeekUI:disabled"/>
   <int value="1643626730" label="PrinterStatus:disabled"/>
+  <int value="1643712769" label="PrintWithReducedRasterization:enabled"/>
   <int value="1645447927" label="MixedContentSiteSetting:disabled"/>
   <int value="1645479440" label="HistoryManipulationIntervention:disabled"/>
   <int value="1646498561" label="OfflineBookmarks:disabled"/>
@@ -48977,6 +48984,13 @@
   <int value="1" label="Clicked"/>
 </enum>
 
+<enum name="OfflineIndicatorSurfaceState">
+  <int value="0" label="Can animate controls"/>
+  <int value="1" label="Can animate controls, omnibox focused"/>
+  <int value="2" label="Cannot animate controls"/>
+  <int value="3" label="Cannot animate controls, omnibox focused"/>
+</enum>
+
 <enum name="OfflineItemsStateAtCancel">
   <int value="0" label="Downloading"/>
   <int value="1" label="Paused"/>
@@ -59812,6 +59826,14 @@
   <int value="8" label="SKIPPED_VERSION_CHECK_EQUAL"/>
 </enum>
 
+<enum name="SBPhishingClassifierEvent">
+  <int value="0" label="Phishing detection was requested to start"/>
+  <int value="1" label="Page text was captured"/>
+  <int value="2" label="Page text not loaded"/>
+  <int value="3" label="Url should not be classified"/>
+  <int value="4" label="Phishing classifier was destructed"/>
+</enum>
+
 <enum name="ScheduledNavigationType">
   <obsolete>
     Deprecated August 2018
@@ -65682,6 +65704,14 @@
   <int value="2" label="Active"/>
 </enum>
 
+<enum name="SystemFeature">
+  <summary>System Features to be disabled by a policy.</summary>
+  <int value="0" label="Unknown"/>
+  <int value="1" label="Camera"/>
+  <int value="2" label="Browser Settings"/>
+  <int value="3" label="OS Settings"/>
+</enum>
+
 <enum name="SystemLogPIIType">
   <obsolete>
     Deprecated and removed from code as of 01/2016.

diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index d35489d..12f784d 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml

@@ -46867,6 +46867,17 @@
   </summary>
 </histogram>
 
+<histogram name="Enterprise.SystemFeaturesDisableList" enum="SystemFeature"
+    expires_after="2020-12-01">
+  <owner>ayaelattar@chromium.org</owner>
+  <owner>poromov@chromium.org</owner>
+  <summary>
+    Shows which system features are set to be disabled by
+    SystemFeaturesDisableList policy. Recorded when the policy preference is
+    updated with a new system feature. No-op updates aren't counted.
+  </summary>
+</histogram>
+
 <histogram name="Enterprise.SystemLogPIILeak" enum="SystemLogPIIType"
     expires_after="2016-01-26">
   <obsolete>
@@ -69187,6 +69198,97 @@
   </summary>
 </histogram>
 
+<histogram name="IOS.CredentialExtension.CopyPasswordCount" units="count"
+    expires_after="2021-01-31">
+  <owner>javierrobles@chromium.org</owner>
+  <owner>djean@chromium.org</owner>
+  <summary>
+    The number of times the Credential Extension user copied a Password since
+    last Chrome foregrounding. Reported when Chrome is put in foreground.
+  </summary>
+</histogram>
+
+<histogram name="IOS.CredentialExtension.CopyURLCount" units="count"
+    expires_after="2021-01-31">
+  <owner>javierrobles@chromium.org</owner>
+  <owner>djean@chromium.org</owner>
+  <summary>
+    The number of times the Credential Extension user copied a URL since last
+    Chrome foregrounding. Reported when Chrome is put in foreground.
+  </summary>
+</histogram>
+
+<histogram name="IOS.CredentialExtension.CopyUsernameCount" units="count"
+    expires_after="2021-01-31">
+  <owner>javierrobles@chromium.org</owner>
+  <owner>djean@chromium.org</owner>
+  <summary>
+    The number of times the Credential Extension user copied a Username since
+    last Chrome foregrounding. Reported when Chrome is put in foreground.
+  </summary>
+</histogram>
+
+<histogram name="IOS.CredentialExtension.DisplayCount" units="count"
+    expires_after="2021-01-31">
+  <owner>javierrobles@chromium.org</owner>
+  <owner>djean@chromium.org</owner>
+  <summary>
+    The number of times the Credential Extension was displayed since last Chrome
+    foregrounding. Reported when Chrome is put in foreground.
+  </summary>
+</histogram>
+
+<histogram name="IOS.CredentialExtension.PasswordUseCount" units="count"
+    expires_after="2021-01-31">
+  <owner>javierrobles@chromium.org</owner>
+  <owner>djean@chromium.org</owner>
+  <summary>
+    The number of times the Credential Extension user selected for a Password
+    since last Chrome foregrounding. Reported when Chrome is put in foreground.
+  </summary>
+</histogram>
+
+<histogram name="IOS.CredentialExtension.QuickPasswordUseCount" units="count"
+    expires_after="2021-01-31">
+  <owner>javierrobles@chromium.org</owner>
+  <owner>djean@chromium.org</owner>
+  <summary>
+    The number of times the Credential Extension selected a Password without
+    user intervention since last Chrome foregrounding. Reported when Chrome is
+    put in foreground.
+  </summary>
+</histogram>
+
+<histogram name="IOS.CredentialExtension.ReauthCount" units="count"
+    expires_after="2021-01-31">
+  <owner>javierrobles@chromium.org</owner>
+  <owner>djean@chromium.org</owner>
+  <summary>
+    The number of times the Credential Extension needed user reauthentication
+    since last Chrome foregrounding. Reported when Chrome is put in foreground.
+  </summary>
+</histogram>
+
+<histogram name="IOS.CredentialExtension.SearchCount" units="count"
+    expires_after="2021-01-31">
+  <owner>javierrobles@chromium.org</owner>
+  <owner>djean@chromium.org</owner>
+  <summary>
+    The number of times the Credential Extension user searched for a Password
+    since last Chrome foregrounding. Reported when Chrome is put in foreground.
+  </summary>
+</histogram>
+
+<histogram name="IOS.CredentialExtension.ShowPasswordCount" units="count"
+    expires_after="2021-01-31">
+  <owner>javierrobles@chromium.org</owner>
+  <owner>djean@chromium.org</owner>
+  <summary>
+    The number of times the Credential Extension user unobfuscated a Password
+    since last Chrome foregrounding. Reported when Chrome is put in foreground.
+  </summary>
+</histogram>
+
 <histogram name="IOS.CriticalActionBackgroundTimeRemaining" units="ms"
     expires_after="2020-11-30">
   <owner>justincohen@chromium.org</owner>
@@ -107679,6 +107781,28 @@
   </summary>
 </histogram>
 
+<histogram name="OfflineIndicator.ConnectivityChanged.DeviceState.Offline"
+    enum="OfflineIndicatorSurfaceState" expires_after="2021-01-01">
+  <owner>sinansahin@google.com</owner>
+  <owner>twellington@chromium.org</owner>
+  <summary>
+    For OfflineIndicatorV2, records whether the native browser controls can be
+    animated and whether the omnibox is focused. Recorded when the device goes
+    offline.
+  </summary>
+</histogram>
+
+<histogram name="OfflineIndicator.ConnectivityChanged.DeviceState.Online"
+    enum="OfflineIndicatorSurfaceState" expires_after="2021-01-01">
+  <owner>sinansahin@google.com</owner>
+  <owner>twellington@chromium.org</owner>
+  <summary>
+    For OfflineIndicatorV2, records whether the native browser controls can be
+    animated and whether the omnibox is focused. Recorded when the device goes
+    online.
+  </summary>
+</histogram>
+
 <histogram name="OfflineIndicator.CTR" enum="OfflineIndicatorCTREvent"
     expires_after="2019-11-30">
   <owner>dimich@chromium.org</owner>
@@ -107689,6 +107813,16 @@
   </summary>
 </histogram>
 
+<histogram name="OfflineIndicator.ShownDuration" units="s"
+    expires_after="2021-01-01">
+  <owner>sinansahin@google.com</owner>
+  <owner>twellington@chromium.org</owner>
+  <summary>
+    The duration the offline indicator was shown. Recorded when the offline
+    indicator hides.
+  </summary>
+</histogram>
+
 <histogram base="true" name="OfflinePages.AccessCount" units="units"
     expires_after="M85">
   <owner>jianli@chromium.org</owner>
@@ -112048,6 +112182,17 @@
   </summary>
 </histogram>
 
+<histogram name="OptimizationGuide.PredictionModelLoadedVersion"
+    units="version number" expires_after="M89">
+  <owner>mcrouse@chromium.org</owner>
+  <owner>sophiechang@chromium.org</owner>
+  <summary>
+    Records the version of the prediction model that was loaded from the store
+    and used until updated by a fetch. Recorded only if the loaded model was
+    valid.
+  </summary>
+</histogram>
+
 <histogram
     name="OptimizationGuide.PredictionModelStore.HostModelFeaturesLoadMetadataResult"
     enum="BooleanLoaded" expires_after="M85">
@@ -112073,6 +112218,16 @@
   </summary>
 </histogram>
 
+<histogram name="OptimizationGuide.PredictionModelUpdateVersion"
+    units="version number" expires_after="M89">
+  <owner>mcrouse@chromium.org</owner>
+  <owner>sophiechang@chromium.org</owner>
+  <summary>
+    Records the version of the prediction model that was fetched as an update.
+    Recorded only if a model returned was valid and is available for use.
+  </summary>
+</histogram>
+
 <histogram name="OptimizationGuide.PredictionModelValidationLatency" units="ms"
     expires_after="M85">
   <owner>mcrouse@chromium.org</owner>
@@ -112087,6 +112242,10 @@
 
 <histogram name="OptimizationGuide.PredictionModelVersion"
     units="version number" expires_after="M87">
+  <obsolete>
+    Removed as of 05/2020 to in favor of recording the version on update and on
+    load.
+  </obsolete>
   <owner>mcrouse@chromium.org</owner>
   <owner>sophiechang@chromium.org</owner>
   <summary>
@@ -143752,6 +143911,16 @@
   </summary>
 </histogram>
 
+<histogram name="SBClientPhishing.Classifier.Event"
+    enum="SBPhishingClassifierEvent" expires_after="2020-09-27">
+  <owner>bdea@chromium.org</owner>
+  <owner>chrome-safebrowsing-alerts@google.com</owner>
+  <summary>
+    Records events in the phishing classifier including reasons that prevents
+    phishing detection to complete on the renderer side.
+  </summary>
+</histogram>
+
 <histogram name="SBClientPhishing.ClassifierNotReadyReason"
     enum="SBClientPhishingClientModelStatus" expires_after="2020-09-27">
   <owner>drubery@chromium.org</owner>
@@ -148637,6 +148806,18 @@
   </summary>
 </histogram>
 
+<histogram base="true" name="Security.SafetyTips.SafetyTipShown_AfterFlag"
+    enum="SafetyTipStatus" expires_after="M85">
+  <owner>jdeblasio@chromium.org</owner>
+  <owner>src/chrome/browser/reputation/OWNERS</owner>
+  <summary>
+    TEMPORARY histogram that records the Safety Tip status of a page after
+    navigation commit or page visibility change. This is the same as
+    SafetyTipShown, but records *after* the flag is checked to evaluate the
+    impact of starts_active.
+  </summary>
+</histogram>
+
 <histogram name="Security.SecurityLevel.CryptographicScheme"
     enum="SecurityLevel" expires_after="M81">
   <owner>estark@chromium.org</owner>
@@ -199058,9 +199239,16 @@
   <affected-histogram name="OptimizationGuide.IsPredictionModelValid"/>
   <affected-histogram
       name="OptimizationGuide.PredictionModelEvaluationLatency"/>
+  <affected-histogram name="OptimizationGuide.PredictionModelLoadedVersion"/>
+  <affected-histogram name="OptimizationGuide.PredictionModelUpdateVersion"/>
   <affected-histogram
       name="OptimizationGuide.PredictionModelValidationLatency"/>
-  <affected-histogram name="OptimizationGuide.PredictionModelVersion"/>
+  <affected-histogram name="OptimizationGuide.PredictionModelVersion">
+    <obsolete>
+      Removed as of 05/2020 in favor of recording on update and load of the
+      prediction model.
+    </obsolete>
+  </affected-histogram>
   <affected-histogram
       name="OptimizationGuide.ShouldTargetNavigation.PredictionModelStatus"/>
   <affected-histogram name="OptimizationGuide.TargetDecision"/>

diff --git a/ui/accessibility/platform/ax_platform_node_base.cc b/ui/accessibility/platform/ax_platform_node_base.cc
index 1dacc8b7..99de6603 100644
--- a/ui/accessibility/platform/ax_platform_node_base.cc
+++ b/ui/accessibility/platform/ax_platform_node_base.cc

@@ -551,11 +551,10 @@
     return GetNameAsString16();
 
   base::string16 text;
-  // TODO(Nektar): Remove const_cast by making all tree traversal methods const.
-  AXPlatformNodeBase* child =
-      const_cast<AXPlatformNodeBase*>(this)->GetFirstChild();
-  for (; child; child = child->GetNextSibling())
-    text += child->GetInnerText();
+  for (auto child_iter = AXPlatformNodeChildrenBegin();
+       child_iter != AXPlatformNodeChildrenEnd(); ++child_iter) {
+    text += child_iter->GetInnerText();
+  }
   return text;
 }
 
@@ -1440,10 +1439,12 @@
   // cross-tree traversal is necessary.
   if (child->IsTextOnlyObject()) {
     int32_t hypertext_offset = 0;
-    for (AXPlatformNodeBase* sibling = GetFirstChild();
-         sibling && sibling != child; sibling = sibling->GetNextSibling()) {
-      if (sibling->IsTextOnlyObject()) {
-        hypertext_offset += (int32_t)sibling->GetHypertext().size();
+    for (auto child_iter = AXPlatformNodeChildrenBegin();
+         child_iter != AXPlatformNodeChildrenEnd() && child_iter.get() != child;
+         ++child_iter) {
+      if (child_iter->IsTextOnlyObject()) {
+        hypertext_offset +=
+            static_cast<int32_t>(child_iter->GetHypertext().size());
       } else {
         ++hypertext_offset;
       }
@@ -1553,10 +1554,10 @@
   // We can safely assume that the endpoint is in another part of the tree or
   // at common parent, and that this object is a descendant of common parent.
   base::Optional<int> endpoint_index_in_common_parent;
-  for (AXPlatformNodeBase* child = common_parent->GetFirstChild();
-       child != nullptr; child = child->GetNextSibling()) {
-    if (endpoint_object->IsDescendantOf(child)) {
-      endpoint_index_in_common_parent = child->GetIndexInParent();
+  for (auto child_iter = common_parent->AXPlatformNodeChildrenBegin();
+       child_iter != common_parent->AXPlatformNodeChildrenEnd(); ++child_iter) {
+    if (endpoint_object->IsDescendantOf(child_iter.get())) {
+      endpoint_index_in_common_parent = child_iter->GetIndexInParent();
       break;
     }
   }
@@ -2092,17 +2093,17 @@
     int max_items,
     std::vector<AXPlatformNodeBase*>* out_selected_items) const {
   int selected_count = 0;
-  // TODO(Nektar): Remove const_cast by making all tree traversal methods const.
-  for (AXPlatformNodeBase* child =
-           const_cast<AXPlatformNodeBase*>(this)->GetFirstChild();
-       child && selected_count < max_items; child = child->GetNextSibling()) {
-    if (!IsItemLike(child->GetData().role)) {
-      selected_count += child->GetSelectedItems(max_items - selected_count,
-                                                out_selected_items);
-    } else if (child->GetBoolAttribute(ax::mojom::BoolAttribute::kSelected)) {
+  for (auto child_iter = AXPlatformNodeChildrenBegin();
+       child_iter != AXPlatformNodeChildrenEnd() && selected_count < max_items;
+       ++child_iter) {
+    if (!IsItemLike(child_iter->GetData().role)) {
+      selected_count += child_iter->GetSelectedItems(max_items - selected_count,
+                                                     out_selected_items);
+    } else if (child_iter->GetBoolAttribute(
+                   ax::mojom::BoolAttribute::kSelected)) {
       selected_count++;
       if (out_selected_items)
-        out_selected_items->emplace_back(child);
+        out_selected_items->emplace_back(child_iter.get());
     }
   }
   return selected_count;

diff --git a/ui/file_manager/file_manager/foreground/images/common/ic_selected.svg b/ui/file_manager/file_manager/foreground/images/common/ic_selected.svg
index f6996ea..674a8a9 100644
--- a/ui/file_manager/file_manager/foreground/images/common/ic_selected.svg
+++ b/ui/file_manager/file_manager/foreground/images/common/ic_selected.svg

@@ -1,3 +1,3 @@
 <svg xmlns="http://www.w3.org/2000/svg" width="20" height="20"  viewBox="0 0 20 20">
-  <path fill-rule="evenodd" clip-rule="evenodd" d="M10 18a8 8 0 100-16 8 8 0 000 16zm0-2a6 6 0 100-12 6 6 0 000 12zm3.707-8.707a1 1 0 00-1.414 0L9 10.586 7.707 9.293a1 1 0 00-1.414 1.414l2 2a1 1 0 001.414 0l4-4a1 1 0 000-1.414z" fill="#1A73E8"/>
+  <path fill="#1A73E8" fill-rule="evenodd" clip-rule="evenodd" d="M10 18a8 8 0 100-16 8 8 0 000 16zm0-2a6 6 0 100-12 6 6 0 000 12zm3.707-8.707a1 1 0 00-1.414 0L9 10.586 7.707 9.293a1 1 0 00-1.414 1.414l2 2a1 1 0 001.414 0l4-4a1 1 0 000-1.414z"/>
 </svg>

diff --git a/ui/views/controls/textfield/textfield.cc b/ui/views/controls/textfield/textfield.cc
index 0a60dd2..d8e8fd0a 100644
--- a/ui/views/controls/textfield/textfield.cc
+++ b/ui/views/controls/textfield/textfield.cc

@@ -303,12 +303,11 @@
       selection_controller_(this) {
   set_context_menu_controller(this);
   set_drag_controller(this);
-  cursor_view_.SetPaintToLayer(ui::LAYER_SOLID_COLOR);
-  cursor_view_.layer()->SetColor(GetTextColor());
-  // |cursor_view_| is owned by Textfield view.
-  cursor_view_.set_owned_by_client();
-  cursor_view_.GetViewAccessibility().OverrideIsIgnored(true);
-  AddChildView(&cursor_view_);
+  auto cursor_view = std::make_unique<View>();
+  cursor_view->SetPaintToLayer(ui::LAYER_SOLID_COLOR);
+  cursor_view->layer()->SetColor(GetTextColor());
+  cursor_view->GetViewAccessibility().OverrideIsIgnored(true);
+  cursor_view_ = AddChildView(std::move(cursor_view));
   GetRenderText()->SetFontList(GetDefaultFontList());
   UpdateBorder();
   SetFocusBehavior(FocusBehavior::ALWAYS);
@@ -590,7 +589,7 @@
 
 void Textfield::SetColor(SkColor value) {
   GetRenderText()->SetColor(value);
-  cursor_view_.layer()->SetColor(value);
+  cursor_view_->layer()->SetColor(value);
   OnPropertyChanged(&model_ + kTextfieldTextColor, kPropertyEffectsPaint);
 }
 
@@ -1128,7 +1127,7 @@
   GetRenderText()->set_focused(true);
   if (ShouldShowCursor()) {
     UpdateCursorViewPosition();
-    cursor_view_.SetVisible(true);
+    cursor_view_->SetVisible(true);
   }
   if (GetInputMethod())
     GetInputMethod()->SetFocusedTextInputClient(this);
@@ -1157,7 +1156,7 @@
 #endif  // defined(OS_CHROMEOS)
   }
   StopBlinkingCursor();
-  cursor_view_.SetVisible(false);
+  cursor_view_->SetVisible(false);
 
   DestroyTouchSelection();
 
@@ -1181,7 +1180,7 @@
   render_text->set_selection_color(GetSelectionTextColor());
   render_text->set_selection_background_focused_color(
       GetSelectionBackgroundColor());
-  cursor_view_.layer()->SetColor(GetTextColor());
+  cursor_view_->layer()->SetColor(GetTextColor());
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -2253,7 +2252,7 @@
 }
 
 void Textfield::UpdateCursorVisibility() {
-  cursor_view_.SetVisible(ShouldShowCursor());
+  cursor_view_->SetVisible(ShouldShowCursor());
   if (ShouldBlinkCursor())
     StartBlinkingCursor();
   else
@@ -2266,7 +2265,7 @@
   location.set_height(
       std::min(location.height(),
                GetLocalBounds().height() - location.y() - location.y()));
-  cursor_view_.SetBoundsRect(location);
+  cursor_view_->SetBoundsRect(location);
 }
 
 int Textfield::GetTextStyle() const {
@@ -2457,7 +2456,7 @@
 void Textfield::OnCursorBlinkTimerFired() {
   DCHECK(ShouldBlinkCursor());
   UpdateCursorViewPosition();
-  cursor_view_.SetVisible(!cursor_view_.GetVisible());
+  cursor_view_->SetVisible(!cursor_view_->GetVisible());
 }
 
 void Textfield::OnEnabledChanged() {

diff --git a/ui/views/controls/textfield/textfield.h b/ui/views/controls/textfield/textfield.h
index 0b0262e..825c4551 100644
--- a/ui/views/controls/textfield/textfield.h
+++ b/ui/views/controls/textfield/textfield.h

@@ -657,7 +657,7 @@
   std::unique_ptr<views::MenuRunner> context_menu_runner_;
 
   // View containing the text cursor.
-  View cursor_view_;
+  View* cursor_view_ = nullptr;
 
 #if defined(OS_MACOSX)
   // Used to track active password input sessions.

diff --git a/ui/views/controls/textfield/textfield_test_api.cc b/ui/views/controls/textfield/textfield_test_api.cc
index 5be8eae..099f22e9 100644
--- a/ui/views/controls/textfield/textfield_test_api.cc
+++ b/ui/views/controls/textfield/textfield_test_api.cc

@@ -31,7 +31,7 @@
 }
 
 void TextfieldTestApi::SetCursorViewRect(gfx::Rect bounds) {
-  textfield_->cursor_view_.SetBoundsRect(bounds);
+  textfield_->cursor_view_->SetBoundsRect(bounds);
 }
 
 bool TextfieldTestApi::IsTextDirectionCheckedInContextMenu(

diff --git a/ui/views/controls/textfield/textfield_test_api.h b/ui/views/controls/textfield/textfield_test_api.h
index a133e336..3f346da6 100644
--- a/ui/views/controls/textfield/textfield_test_api.h
+++ b/ui/views/controls/textfield/textfield_test_api.h

@@ -46,10 +46,12 @@
     return textfield_->cursor_blink_timer_.IsRunning();
   }
 
-  gfx::Rect GetCursorViewRect() { return textfield_->cursor_view_.bounds(); }
+  gfx::Rect GetCursorViewRect() { return textfield_->cursor_view_->bounds(); }
   void SetCursorViewRect(gfx::Rect bounds);
 
-  bool IsCursorVisible() const { return textfield_->cursor_view_.GetVisible(); }
+  bool IsCursorVisible() const {
+    return textfield_->cursor_view_->GetVisible();
+  }
 
   bool IsTextDirectionCheckedInContextMenu(
       base::i18n::TextDirection direction) const;

diff --git a/weblayer/browser/content_browser_client_impl.cc b/weblayer/browser/content_browser_client_impl.cc
index b18160f..cb5700f8 100644
--- a/weblayer/browser/content_browser_client_impl.cc
+++ b/weblayer/browser/content_browser_client_impl.cc

@@ -298,15 +298,14 @@
     tab->SetWebPreferences(prefs);
 }
 
-mojo::Remote<network::mojom::NetworkContext>
-ContentBrowserClientImpl::CreateNetworkContext(
+void ContentBrowserClientImpl::ConfigureNetworkContextParams(
     content::BrowserContext* context,
     bool in_memory,
-    const base::FilePath& relative_partition_path) {
-  mojo::Remote<network::mojom::NetworkContext> network_context;
-  network::mojom::NetworkContextParamsPtr context_params =
-      SystemNetworkContextManager::CreateDefaultNetworkContextParams(
-          GetUserAgent());
+    const base::FilePath& relative_partition_path,
+    network::mojom::NetworkContextParams* context_params,
+    network::mojom::CertVerifierCreationParams* cert_verifier_creation_params) {
+  SystemNetworkContextManager::ConfigureDefaultNetworkContextParams(
+      context_params, GetUserAgent());
   // Headers coming from the embedder are implicitly trusted and should not
   // trigger CORS checks.
   context_params->allow_any_cors_exempt_header_for_browser = true;
@@ -333,10 +332,7 @@
         proxy_config,
         net::DefineNetworkTrafficAnnotation("undefined", "Nothing here yet."));
   }
-  variations::UpdateCorsExemptHeaderForVariations(context_params.get());
-  content::GetNetworkService()->CreateNetworkContext(
-      network_context.BindNewPipeAndPassReceiver(), std::move(context_params));
-  return network_context;
+  variations::UpdateCorsExemptHeaderForVariations(context_params);
 }
 
 void ContentBrowserClientImpl::OnNetworkServiceCreated(

diff --git a/weblayer/browser/content_browser_client_impl.h b/weblayer/browser/content_browser_client_impl.h
index 58a02d3..42d9b3c1 100644
--- a/weblayer/browser/content_browser_client_impl.h
+++ b/weblayer/browser/content_browser_client_impl.h

@@ -48,10 +48,13 @@
   blink::UserAgentMetadata GetUserAgentMetadata() override;
   void OverrideWebkitPrefs(content::RenderViewHost* render_view_host,
                            content::WebPreferences* prefs) override;
-  mojo::Remote<network::mojom::NetworkContext> CreateNetworkContext(
+  void ConfigureNetworkContextParams(
       content::BrowserContext* context,
       bool in_memory,
-      const base::FilePath& relative_partition_path) override;
+      const base::FilePath& relative_partition_path,
+      network::mojom::NetworkContextParams* network_context_params,
+      network::mojom::CertVerifierCreationParams* cert_verifier_creation_params)
+      override;
   void OnNetworkServiceCreated(
       network::mojom::NetworkService* network_service) override;
   std::vector<std::unique_ptr<blink::URLLoaderThrottle>>

diff --git a/weblayer/browser/system_network_context_manager.cc b/weblayer/browser/system_network_context_manager.cc
index 08ab7e1..9a5cd54 100644
--- a/weblayer/browser/system_network_context_manager.cc
+++ b/weblayer/browser/system_network_context_manager.cc

@@ -51,12 +51,20 @@
     const std::string& user_agent) {
   network::mojom::NetworkContextParamsPtr network_context_params =
       network::mojom::NetworkContextParams::New();
+  ConfigureDefaultNetworkContextParams(network_context_params.get(),
+                                       user_agent);
+  return network_context_params;
+}
+
+// static
+void SystemNetworkContextManager::ConfigureDefaultNetworkContextParams(
+    network::mojom::NetworkContextParams* network_context_params,
+    const std::string& user_agent) {
   network_context_params->user_agent = user_agent;
 #if defined(OS_LINUX) || defined(OS_WIN)
   // We're not configuring the cookie encryption on these platforms yet.
   network_context_params->enable_encrypted_cookies = false;
 #endif
-  return network_context_params;
 }
 
 SystemNetworkContextManager::SystemNetworkContextManager(

diff --git a/weblayer/browser/system_network_context_manager.h b/weblayer/browser/system_network_context_manager.h
index a31e4278..ecc423f8c 100644
--- a/weblayer/browser/system_network_context_manager.h
+++ b/weblayer/browser/system_network_context_manager.h

@@ -37,6 +37,10 @@
   static network::mojom::NetworkContextParamsPtr
   CreateDefaultNetworkContextParams(const std::string& user_agent);
 
+  static void ConfigureDefaultNetworkContextParams(
+      network::mojom::NetworkContextParams* network_context_params,
+      const std::string& user_agent);
+
   ~SystemNetworkContextManager();
 
   // Returns the System NetworkContext. Does any initialization of the

diff --git a/weblayer/shell/android/BUILD.gn b/weblayer/shell/android/BUILD.gn
index bd88de4..bc3a270 100644
--- a/weblayer/shell/android/BUILD.gn
+++ b/weblayer/shell/android/BUILD.gn

@@ -193,6 +193,8 @@
   target_sdk_version = 28
   android_manifest_dep = ":weblayer_support_manifest"
   shared_resources = true
+  version_name = chrome_version_name
+  version_code = webview_stable_version_code
 
   product_config_java_packages = [ weblayer_product_config_java_package ]