diff --git a/DEPS b/DEPS
index 29a9fd8..2409d1b 100644
--- a/DEPS
+++ b/DEPS
@@ -40,11 +40,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': 'adf17dc52ff4b56720174f71a3e9507a682f8487',
+  'skia_revision': '489bef054ee912992195a905c1035b5059dc9c57',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'fd1dd40d65273a69c8850e5689f86d104d772121',
+  'v8_revision': 'bbfd15c4251b2455319fbb8adb4780260e43fe00',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -96,7 +96,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling catapult
   # and whatever else without interference from each other.
-  'catapult_revision': '49fbcfa16b5d148a595cc50036d5e8354739f13f',
+  'catapult_revision': '596aa47eec509819730749df6e0a848d374265d6',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libFuzzer
   # and whatever else without interference from each other.
diff --git a/base/BUILD.gn b/base/BUILD.gn
index d2352aa..21e1891 100644
--- a/base/BUILD.gn
+++ b/base/BUILD.gn
@@ -565,6 +565,7 @@
     "metrics/persistent_memory_allocator.h",
     "metrics/persistent_sample_map.cc",
     "metrics/persistent_sample_map.h",
+    "metrics/record_histogram_checker.h",
     "metrics/sample_map.cc",
     "metrics/sample_map.h",
     "metrics/sample_vector.cc",
diff --git a/base/android/jni_android.cc b/base/android/jni_android.cc
index e91e6f9..ffe2a95 100644
--- a/base/android/jni_android.cc
+++ b/base/android/jni_android.cc
@@ -285,6 +285,9 @@
       env, static_cast<jstring>(
           env->CallObjectMethod(bytearray_output_stream.obj(),
                                 bytearray_output_stream_tostring)));
+  if (ClearException(env)) {
+    return "Java OOM'd in exception handling, check logcat";
+  }
 
   return ConvertJavaStringToUTF8(exception_string);
 }
diff --git a/base/metrics/record_histogram_checker.h b/base/metrics/record_histogram_checker.h
new file mode 100644
index 0000000..686bf67
--- /dev/null
+++ b/base/metrics/record_histogram_checker.h
@@ -0,0 +1,27 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef BASE_METRICS_RECORD_HISTOGRAM_CHECKER_H_
+#define BASE_METRICS_RECORD_HISTOGRAM_CHECKER_H_
+
+#include <stdint.h>
+
+#include "base/base_export.h"
+
+namespace base {
+
+// RecordHistogramChecker provides an interface for checking whether
+// the given histogram should be recorded.
+class BASE_EXPORT RecordHistogramChecker {
+ public:
+  virtual ~RecordHistogramChecker() {}
+
+  // Returns true iff the given histogram should be recorded.
+  // This method may be called on any thread, so it should not mutate any state.
+  virtual bool ShouldRecord(uint64_t histogram_hash) const = 0;
+};
+
+}  // namespace base
+
+#endif  // BASE_METRICS_RECORD_HISTOGRAM_CHECKER_H_
diff --git a/base/metrics/statistics_recorder.cc b/base/metrics/statistics_recorder.cc
index 634f7b4..aee7b49 100644
--- a/base/metrics/statistics_recorder.cc
+++ b/base/metrics/statistics_recorder.cc
@@ -15,6 +15,7 @@
 #include "base/metrics/histogram_snapshot_manager.h"
 #include "base/metrics/metrics_hashes.h"
 #include "base/metrics/persistent_histogram_allocator.h"
+#include "base/metrics/record_histogram_checker.h"
 #include "base/stl_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/values.h"
@@ -45,6 +46,7 @@
   callbacks_ = existing_callbacks_.release();
   ranges_ = existing_ranges_.release();
   providers_ = existing_providers_.release();
+  record_checker_ = existing_record_checker_.release();
 }
 
 // static
@@ -435,6 +437,17 @@
 }
 
 // static
+void StatisticsRecorder::SetRecordChecker(
+    std::unique_ptr<RecordHistogramChecker> record_checker) {
+  record_checker_ = record_checker.release();
+}
+
+// static
+bool StatisticsRecorder::ShouldRecordHistogram(uint64_t histogram_hash) {
+  return !record_checker_ || record_checker_->ShouldRecord(histogram_hash);
+}
+
+// static
 std::vector<HistogramBase*> StatisticsRecorder::GetKnownHistograms(
     bool include_persistent) {
   std::vector<HistogramBase*> known;
@@ -478,11 +491,13 @@
   existing_callbacks_.reset(callbacks_);
   existing_ranges_.reset(ranges_);
   existing_providers_.reset(providers_);
+  existing_record_checker_.reset(record_checker_);
 
   histograms_ = new HistogramMap;
   callbacks_ = new CallbackMap;
   ranges_ = new RangesMap;
   providers_ = new HistogramProviders;
+  record_checker_ = nullptr;
 
   InitLogOnShutdownWithoutLock();
 }
@@ -496,21 +511,23 @@
 
 // static
 void StatisticsRecorder::Reset() {
-
   std::unique_ptr<HistogramMap> histograms_deleter;
   std::unique_ptr<CallbackMap> callbacks_deleter;
   std::unique_ptr<RangesMap> ranges_deleter;
   std::unique_ptr<HistogramProviders> providers_deleter;
+  std::unique_ptr<RecordHistogramChecker> record_checker_deleter;
   {
     base::AutoLock auto_lock(lock_.Get());
     histograms_deleter.reset(histograms_);
     callbacks_deleter.reset(callbacks_);
     ranges_deleter.reset(ranges_);
     providers_deleter.reset(providers_);
+    record_checker_deleter.reset(record_checker_);
     histograms_ = nullptr;
     callbacks_ = nullptr;
     ranges_ = nullptr;
     providers_ = nullptr;
+    record_checker_ = nullptr;
   }
   // We are going to leak the histograms and the ranges.
 }
@@ -532,6 +549,8 @@
 // static
 StatisticsRecorder::HistogramProviders* StatisticsRecorder::providers_;
 // static
+RecordHistogramChecker* StatisticsRecorder::record_checker_ = nullptr;
+// static
 base::LazyInstance<base::Lock>::Leaky StatisticsRecorder::lock_ =
     LAZY_INSTANCE_INITIALIZER;
 
diff --git a/base/metrics/statistics_recorder.h b/base/metrics/statistics_recorder.h
index b1063d7..16b462ab 100644
--- a/base/metrics/statistics_recorder.h
+++ b/base/metrics/statistics_recorder.h
@@ -25,6 +25,7 @@
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "base/metrics/histogram_base.h"
+#include "base/metrics/record_histogram_checker.h"
 #include "base/strings/string_piece.h"
 #include "base/synchronization/lock.h"
 
@@ -189,6 +190,21 @@
   // by a call to Initialize().
   static void UninitializeForTesting();
 
+  // Sets the record checker for determining if a histogram should be recorded.
+  // Record checker doesn't affect any already recorded histograms, so this
+  // method must be called very early, before any threads have started.
+  // Record checker methods can be called on any thread, so they shouldn't
+  // mutate any state.
+  // TODO(iburak): This is not yet hooked up to histogram recording
+  // infrastructure.
+  static void SetRecordChecker(
+      std::unique_ptr<RecordHistogramChecker> record_checker);
+
+  // Returns true iff the given histogram should be recorded based on
+  // the ShouldRecord() method of the record checker.
+  // If the record checker is not set, returns true.
+  static bool ShouldRecordHistogram(uint64_t histogram_hash);
+
  private:
   // We keep a map of callbacks to histograms, so that as histograms are
   // created, we can set the callback properly.
@@ -228,6 +244,7 @@
   std::unique_ptr<CallbackMap> existing_callbacks_;
   std::unique_ptr<RangesMap> existing_ranges_;
   std::unique_ptr<HistogramProviders> existing_providers_;
+  std::unique_ptr<RecordHistogramChecker> existing_record_checker_;
 
   bool vlog_initialized_ = false;
 
@@ -238,6 +255,7 @@
   static CallbackMap* callbacks_;
   static RangesMap* ranges_;
   static HistogramProviders* providers_;
+  static RecordHistogramChecker* record_checker_;
 
   // Lock protects access to above maps. This is a LazyInstance to avoid races
   // when the above methods are used before Initialize(). Previously each method
diff --git a/base/metrics/statistics_recorder_unittest.cc b/base/metrics/statistics_recorder_unittest.cc
index 7d0cd8f..39b1f4d 100644
--- a/base/metrics/statistics_recorder_unittest.cc
+++ b/base/metrics/statistics_recorder_unittest.cc
@@ -7,6 +7,7 @@
 #include <stddef.h>
 
 #include <memory>
+#include <utility>
 #include <vector>
 
 #include "base/bind.h"
@@ -15,6 +16,7 @@
 #include "base/memory/weak_ptr.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/persistent_histogram_allocator.h"
+#include "base/metrics/record_histogram_checker.h"
 #include "base/metrics/sparse_histogram.h"
 #include "base/values.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -37,6 +39,17 @@
   DISALLOW_COPY_AND_ASSIGN(LogStateSaver);
 };
 
+// Test implementation of RecordHistogramChecker interface.
+class OddRecordHistogramChecker : public base::RecordHistogramChecker {
+ public:
+  ~OddRecordHistogramChecker() override {}
+
+  // base::RecordHistogramChecker:
+  bool ShouldRecord(uint64_t histogram_hash) const override {
+    return histogram_hash % 2;
+  }
+};
+
 }  // namespace
 
 namespace base {
@@ -715,4 +728,13 @@
   EXPECT_EQ(1, snapshot->GetCount(5));
 }
 
+TEST_P(StatisticsRecorderTest, RecordHistogramChecker) {
+  // Record checker isn't set
+  EXPECT_TRUE(base::StatisticsRecorder::ShouldRecordHistogram(0));
+  auto record_checker = std::make_unique<OddRecordHistogramChecker>();
+  base::StatisticsRecorder::SetRecordChecker(std::move(record_checker));
+  EXPECT_TRUE(base::StatisticsRecorder::ShouldRecordHistogram(1));
+  EXPECT_FALSE(base::StatisticsRecorder::ShouldRecordHistogram(2));
+}
+
 }  // namespace base
diff --git a/cc/output/overlay_unittest.cc b/cc/output/overlay_unittest.cc
index b8e7307..e8e5745 100644
--- a/cc/output/overlay_unittest.cc
+++ b/cc/output/overlay_unittest.cc
@@ -28,6 +28,7 @@
 #include "cc/quads/stream_video_draw_quad.h"
 #include "cc/quads/texture_draw_quad.h"
 #include "cc/resources/display_resource_provider.h"
+#include "cc/resources/layer_tree_resource_provider.h"
 #include "cc/test/fake_output_surface_client.h"
 #include "cc/test/fake_resource_provider.h"
 #include "cc/test/geometry_test_utils.h"
@@ -264,17 +265,36 @@
   return pass;
 }
 
-viz::ResourceId CreateResource(ResourceProvider* resource_provider,
-                               const gfx::Size& size,
-                               bool is_overlay_candidate) {
-  viz::TextureMailbox mailbox =
-      viz::TextureMailbox(gpu::Mailbox::Generate(), gpu::SyncToken(),
-                          GL_TEXTURE_2D, size, is_overlay_candidate, false);
-  std::unique_ptr<SingleReleaseCallbackImpl> release_callback =
+static void CollectResources(std::vector<viz::ReturnedResource>* array,
+                             const std::vector<viz::ReturnedResource>& returned,
+                             BlockingTaskRunner* main_thread_task_runner) {}
+
+viz::ResourceId CreateResource(
+    DisplayResourceProvider* parent_resource_provider,
+    LayerTreeResourceProvider* child_resource_provider,
+    const gfx::Size& size,
+    bool is_overlay_candidate) {
+  viz::TextureMailbox mailbox(gpu::Mailbox::Generate(), gpu::SyncToken(),
+                              GL_TEXTURE_2D, size, is_overlay_candidate, false);
+  auto release_callback =
       SingleReleaseCallbackImpl::Create(base::Bind(&MailboxReleased));
 
-  return resource_provider->CreateResourceFromTextureMailbox(
-      mailbox, std::move(release_callback));
+  viz::ResourceId resource_id =
+      child_resource_provider->CreateResourceFromTextureMailbox(
+          mailbox, std::move(release_callback));
+
+  std::vector<viz::ReturnedResource> returned_to_child;
+  int child_id = parent_resource_provider->CreateChild(
+      base::Bind(&CollectResources, &returned_to_child));
+
+  // Transfer resource to the parent.
+  ResourceProvider::ResourceIdArray resource_ids_to_transfer;
+  resource_ids_to_transfer.push_back(resource_id);
+  std::vector<viz::TransferableResource> list;
+  child_resource_provider->PrepareSendToParent(resource_ids_to_transfer, &list);
+  parent_resource_provider->ReceiveFromChild(child_id, list);
+  viz::ResourceId parent_resource_id = list[0].id;
+  return parent_resource_id;
 }
 
 SolidColorDrawQuad* CreateSolidColorQuadAt(
@@ -288,10 +308,12 @@
   return quad;
 }
 
-TextureDrawQuad* CreateCandidateQuadAt(ResourceProvider* resource_provider,
-                                       const SharedQuadState* shared_quad_state,
-                                       RenderPass* render_pass,
-                                       const gfx::Rect& rect) {
+TextureDrawQuad* CreateCandidateQuadAt(
+    DisplayResourceProvider* parent_resource_provider,
+    LayerTreeResourceProvider* child_resource_provider,
+    const SharedQuadState* shared_quad_state,
+    RenderPass* render_pass,
+    const gfx::Rect& rect) {
   bool needs_blending = false;
   bool premultiplied_alpha = false;
   bool flipped = false;
@@ -299,8 +321,9 @@
   float vertex_opacity[4] = {1.0f, 1.0f, 1.0f, 1.0f};
   gfx::Size resource_size_in_pixels = rect.size();
   bool is_overlay_candidate = true;
-  viz::ResourceId resource_id = CreateResource(
-      resource_provider, resource_size_in_pixels, is_overlay_candidate);
+  viz::ResourceId resource_id =
+      CreateResource(parent_resource_provider, child_resource_provider,
+                     resource_size_in_pixels, is_overlay_candidate);
 
   TextureDrawQuad* overlay_quad =
       render_pass->CreateAndAppendDrawQuad<TextureDrawQuad>();
@@ -314,7 +337,9 @@
 }
 
 TextureDrawQuad* CreateTransparentCandidateQuadAt(
-    ResourceProvider* resource_provider,
+    DisplayResourceProvider* parent_resource_provider,
+    LayerTreeResourceProvider* child_resource_provider,
+
     const SharedQuadState* shared_quad_state,
     RenderPass* render_pass,
     const gfx::Rect& rect) {
@@ -325,8 +350,9 @@
   float vertex_opacity[4] = {1.0f, 1.0f, 1.0f, 1.0f};
   gfx::Size resource_size_in_pixels = rect.size();
   bool is_overlay_candidate = true;
-  viz::ResourceId resource_id = CreateResource(
-      resource_provider, resource_size_in_pixels, is_overlay_candidate);
+  viz::ResourceId resource_id =
+      CreateResource(parent_resource_provider, child_resource_provider,
+                     resource_size_in_pixels, is_overlay_candidate);
 
   TextureDrawQuad* overlay_quad =
       render_pass->CreateAndAppendDrawQuad<TextureDrawQuad>();
@@ -340,7 +366,8 @@
 }
 
 StreamVideoDrawQuad* CreateCandidateVideoQuadAt(
-    ResourceProvider* resource_provider,
+    DisplayResourceProvider* parent_resource_provider,
+    LayerTreeResourceProvider* child_resource_provider,
     const SharedQuadState* shared_quad_state,
     RenderPass* render_pass,
     const gfx::Rect& rect,
@@ -348,8 +375,9 @@
   bool needs_blending = false;
   gfx::Size resource_size_in_pixels = rect.size();
   bool is_overlay_candidate = true;
-  viz::ResourceId resource_id = CreateResource(
-      resource_provider, resource_size_in_pixels, is_overlay_candidate);
+  viz::ResourceId resource_id =
+      CreateResource(parent_resource_provider, child_resource_provider,
+                     resource_size_in_pixels, is_overlay_candidate);
 
   StreamVideoDrawQuad* overlay_quad =
       render_pass->CreateAndAppendDrawQuad<StreamVideoDrawQuad>();
@@ -360,25 +388,29 @@
 }
 
 TextureDrawQuad* CreateFullscreenCandidateQuad(
-    ResourceProvider* resource_provider,
+    DisplayResourceProvider* parent_resource_provider,
+    LayerTreeResourceProvider* child_resource_provider,
     const SharedQuadState* shared_quad_state,
     RenderPass* render_pass) {
-  return CreateCandidateQuadAt(resource_provider, shared_quad_state,
+  return CreateCandidateQuadAt(parent_resource_provider,
+                               child_resource_provider, shared_quad_state,
                                render_pass, render_pass->output_rect);
 }
 
 StreamVideoDrawQuad* CreateFullscreenCandidateVideoQuad(
-    ResourceProvider* resource_provider,
+    DisplayResourceProvider* parent_resource_provider,
+    LayerTreeResourceProvider* child_resource_provider,
     const SharedQuadState* shared_quad_state,
     RenderPass* render_pass,
     const gfx::Transform& transform) {
-  return CreateCandidateVideoQuadAt(resource_provider, shared_quad_state,
-                                    render_pass, render_pass->output_rect,
-                                    transform);
+  return CreateCandidateVideoQuadAt(
+      parent_resource_provider, child_resource_provider, shared_quad_state,
+      render_pass, render_pass->output_rect, transform);
 }
 
 YUVVideoDrawQuad* CreateFullscreenCandidateYUVVideoQuad(
-    ResourceProvider* resource_provider,
+    DisplayResourceProvider* parent_resource_provider,
+    LayerTreeResourceProvider* child_resource_provider,
     const SharedQuadState* shared_quad_state,
     RenderPass* render_pass) {
   bool needs_blending = false;
@@ -386,8 +418,9 @@
   gfx::Rect rect = render_pass->output_rect;
   gfx::Size resource_size_in_pixels = rect.size();
   bool is_overlay_candidate = true;
-  viz::ResourceId resource_id = CreateResource(
-      resource_provider, resource_size_in_pixels, is_overlay_candidate);
+  viz::ResourceId resource_id =
+      CreateResource(parent_resource_provider, child_resource_provider,
+                     resource_size_in_pixels, is_overlay_candidate);
 
   YUVVideoDrawQuad* overlay_quad =
       render_pass->CreateAndAppendDrawQuad<YUVVideoDrawQuad>();
@@ -474,6 +507,12 @@
     resource_provider_ = FakeResourceProvider::Create<DisplayResourceProvider>(
         provider_.get(), shared_bitmap_manager_.get());
 
+    child_provider_ = TestContextProvider::Create();
+    child_provider_->BindToCurrentThread();
+    child_resource_provider_ =
+        FakeResourceProvider::Create<LayerTreeResourceProvider>(
+            child_provider_.get(), shared_bitmap_manager_.get());
+
     overlay_processor_.reset(new OverlayProcessor(output_surface_.get()));
     overlay_processor_->Initialize();
   }
@@ -483,6 +522,8 @@
   FakeOutputSurfaceClient client_;
   std::unique_ptr<viz::SharedBitmapManager> shared_bitmap_manager_;
   std::unique_ptr<DisplayResourceProvider> resource_provider_;
+  scoped_refptr<TestContextProvider> child_provider_;
+  std::unique_ptr<LayerTreeResourceProvider> child_resource_provider_;
   std::unique_ptr<OverlayProcessor> overlay_processor_;
   gfx::Rect damage_rect_;
   std::vector<gfx::Rect> content_bounds_;
@@ -527,8 +568,8 @@
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
   gfx::Rect output_rect = pass->output_rect;
   TextureDrawQuad* original_quad = CreateFullscreenCandidateQuad(
-      resource_provider_.get(), pass->shared_quad_state_list.back(),
-      pass.get());
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
   unsigned original_resource_id = original_quad->resource_id();
 
   // Add something behind it.
@@ -562,9 +603,9 @@
 
 TEST_F(FullscreenOverlayTest, AlphaFail) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateTransparentCandidateQuadAt(resource_provider_.get(),
-                                   pass->shared_quad_state_list.back(),
-                                   pass.get(), pass.get()->output_rect);
+  CreateTransparentCandidateQuadAt(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get(), pass.get()->output_rect);
 
   // Check for potential candidates.
   OverlayCandidateList candidate_list;
@@ -588,8 +629,8 @@
 TEST_F(FullscreenOverlayTest, ResourceSizeInPixelsFail) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
   TextureDrawQuad* original_quad = CreateFullscreenCandidateQuad(
-      resource_provider_.get(), pass->shared_quad_state_list.back(),
-      pass.get());
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
   original_quad->set_resource_size_in_pixels(gfx::Size(64, 64));
 
   // Check for potential candidates.
@@ -618,9 +659,9 @@
                      pass->shared_quad_state_list.back(), pass.get(),
                      kOverlayTopLeftRect);
 
-  CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                pass->shared_quad_state_list.back(),
-                                pass.get());
+  CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
 
   // Check for potential candidates.
   OverlayCandidateList candidate_list;
@@ -644,9 +685,9 @@
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
   gfx::Rect inset_rect = pass->output_rect;
   inset_rect.Inset(0, 1, 0, 1);
-  CreateCandidateQuadAt(resource_provider_.get(),
-                        pass->shared_quad_state_list.back(), pass.get(),
-                        inset_rect);
+  CreateCandidateQuadAt(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get(), inset_rect);
 
   // Check for potential candidates.
   OverlayCandidateList candidate_list;
@@ -676,9 +717,9 @@
 
   SharedQuadState* shared_state = pass->CreateAndAppendSharedQuadState();
   shared_state->opacity = 1.f;
-  CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                pass->shared_quad_state_list.back(),
-                                pass.get());
+  CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
 
   // Check for potential candidates.
   OverlayCandidateList candidate_list;
@@ -701,10 +742,9 @@
 
 TEST_F(SingleOverlayOnTopTest, SuccessfulOverlay) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  TextureDrawQuad* original_quad =
-      CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                    pass->shared_quad_state_list.back(),
-                                    pass.get());
+  TextureDrawQuad* original_quad = CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
   unsigned original_resource_id = original_quad->resource_id();
 
   // Add something behind it.
@@ -743,17 +783,17 @@
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
   // Add a small quad.
   const auto kSmallCandidateRect = gfx::Rect(0, 0, 16, 16);
-  CreateCandidateQuadAt(resource_provider_.get(),
-                        pass->shared_quad_state_list.back(), pass.get(),
-                        kSmallCandidateRect);
+  CreateCandidateQuadAt(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get(), kSmallCandidateRect);
   output_surface_->GetOverlayCandidateValidator()->AddExpectedRect(
       gfx::RectF(kSmallCandidateRect));
 
   // Add a bigger quad below the previous one, but not occluded.
   const auto kBigCandidateRect = gfx::Rect(20, 20, 32, 32);
   TextureDrawQuad* quad_big = CreateCandidateQuadAt(
-      resource_provider_.get(), pass->shared_quad_state_list.back(), pass.get(),
-      kBigCandidateRect);
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get(), kBigCandidateRect);
   output_surface_->GetOverlayCandidateValidator()->AddExpectedRect(
       gfx::RectF(kBigCandidateRect));
 
@@ -786,9 +826,9 @@
 
 TEST_F(SingleOverlayOnTopTest, DamageRect) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                pass->shared_quad_state_list.back(),
-                                pass.get());
+  CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
   damage_rect_ = kOverlayRect;
 
   // Add something behind it.
@@ -850,9 +890,9 @@
   CreateFullscreenOpaqueQuad(resource_provider_.get(),
                              pass->shared_quad_state_list.back(), pass.get());
 
-  CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                pass->shared_quad_state_list.back(),
-                                pass.get());
+  CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
 
   RenderPassList pass_list;
   pass_list.push_back(std::move(pass));
@@ -875,9 +915,9 @@
 // Test with multiple render passes.
 TEST_F(SingleOverlayOnTopTest, MultipleRenderPasses) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                pass->shared_quad_state_list.back(),
-                                pass.get());
+  CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
 
   // Add something behind it.
   CreateFullscreenOpaqueQuad(resource_provider_.get(),
@@ -900,10 +940,9 @@
 
 TEST_F(SingleOverlayOnTopTest, AcceptBlending) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  TextureDrawQuad* quad =
-      CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                    pass->shared_quad_state_list.back(),
-                                    pass.get());
+  TextureDrawQuad* quad = CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
   quad->needs_blending = true;
 
   OverlayCandidateList candidate_list;
@@ -925,10 +964,9 @@
 
 TEST_F(SingleOverlayOnTopTest, RejectBackgroundColor) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  TextureDrawQuad* quad =
-      CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                    pass->shared_quad_state_list.back(),
-                                    pass.get());
+  TextureDrawQuad* quad = CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
   quad->background_color = SK_ColorBLACK;
 
   OverlayCandidateList candidate_list;
@@ -945,9 +983,9 @@
 
 TEST_F(SingleOverlayOnTopTest, RejectBlendMode) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                pass->shared_quad_state_list.back(),
-                                pass.get());
+  CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
   pass->shared_quad_state_list.back()->blend_mode = SkBlendMode::kScreen;
 
   OverlayCandidateList candidate_list;
@@ -964,9 +1002,9 @@
 
 TEST_F(SingleOverlayOnTopTest, RejectOpacity) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                pass->shared_quad_state_list.back(),
-                                pass.get());
+  CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
   pass->shared_quad_state_list.back()->opacity = 0.5f;
 
   OverlayCandidateList candidate_list;
@@ -983,9 +1021,9 @@
 
 TEST_F(SingleOverlayOnTopTest, RejectNonAxisAlignedTransform) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                pass->shared_quad_state_list.back(),
-                                pass.get());
+  CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
   pass->shared_quad_state_list.back()
       ->quad_to_target_transform.RotateAboutXAxis(45.f);
 
@@ -1003,9 +1041,9 @@
 
 TEST_F(SingleOverlayOnTopTest, AllowClipped) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                pass->shared_quad_state_list.back(),
-                                pass.get());
+  CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
   pass->shared_quad_state_list.back()->is_clipped = true;
   pass->shared_quad_state_list.back()->clip_rect = kOverlayClipRect;
 
@@ -1027,6 +1065,7 @@
   rect.Offset(0, -rect.height());
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
   CreateCandidateQuadAt(resource_provider_.get(),
+                        child_resource_provider_.get(),
                         pass->shared_quad_state_list.back(), pass.get(), rect);
   pass->shared_quad_state_list.back()->quad_to_target_transform.Scale(2.0f,
                                                                       -1.0f);
@@ -1050,6 +1089,7 @@
   rect.Offset(-rect.width(), 0);
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
   CreateCandidateQuadAt(resource_provider_.get(),
+                        child_resource_provider_.get(),
                         pass->shared_quad_state_list.back(), pass.get(), rect);
   pass->shared_quad_state_list.back()->quad_to_target_transform.Scale(-1.0f,
                                                                       2.0f);
@@ -1073,6 +1113,7 @@
   rect.set_width(rect.width() / 2);
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
   CreateCandidateQuadAt(resource_provider_.get(),
+                        child_resource_provider_.get(),
                         pass->shared_quad_state_list.back(), pass.get(), rect);
   pass->shared_quad_state_list.back()->quad_to_target_transform.Scale(2.0f,
                                                                       1.0f);
@@ -1093,6 +1134,7 @@
   rect.Offset(0, -rect.height());
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
   CreateCandidateQuadAt(resource_provider_.get(),
+                        child_resource_provider_.get(),
                         pass->shared_quad_state_list.back(), pass.get(), rect);
   pass->shared_quad_state_list.back()->quad_to_target_transform.Scale(1.f,
                                                                       -1.f);
@@ -1114,6 +1156,7 @@
   rect.Offset(0, -rect.height());
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
   CreateCandidateQuadAt(resource_provider_.get(),
+                        child_resource_provider_.get(),
                         pass->shared_quad_state_list.back(), pass.get(), rect);
   pass->shared_quad_state_list.back()
       ->quad_to_target_transform.RotateAboutZAxis(90.f);
@@ -1136,6 +1179,7 @@
   rect.Offset(-rect.width(), -rect.height());
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
   CreateCandidateQuadAt(resource_provider_.get(),
+                        child_resource_provider_.get(),
                         pass->shared_quad_state_list.back(), pass.get(), rect);
   pass->shared_quad_state_list.back()
       ->quad_to_target_transform.RotateAboutZAxis(180.f);
@@ -1158,6 +1202,7 @@
   rect.Offset(-rect.width(), 0);
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
   CreateCandidateQuadAt(resource_provider_.get(),
+                        child_resource_provider_.get(),
                         pass->shared_quad_state_list.back(), pass.get(), rect);
   pass->shared_quad_state_list.back()
       ->quad_to_target_transform.RotateAboutZAxis(270.f);
@@ -1183,10 +1228,9 @@
   CreateOpaqueQuadAt(resource_provider_.get(),
                      pass->shared_quad_state_list.back(), pass.get(),
                      kOverlayTopLeftRect);
-  CreateCandidateQuadAt(resource_provider_.get(),
-                        pass->shared_quad_state_list.back(),
-                        pass.get(),
-                        kOverlayBottomRightRect);
+  CreateCandidateQuadAt(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get(), kOverlayBottomRightRect);
 
   OverlayCandidateList candidate_list;
   OverlayProcessor::FilterOperationsMap render_pass_filters;
@@ -1211,8 +1255,9 @@
                          kOverlayBottomRightRect);
   shared_state = pass->CreateAndAppendSharedQuadState();
   shared_state->opacity = 1.f;
-  CreateCandidateQuadAt(resource_provider_.get(), shared_state, pass.get(),
-                        kOverlayBottomRightRect);
+  CreateCandidateQuadAt(resource_provider_.get(),
+                        child_resource_provider_.get(), shared_state,
+                        pass.get(), kOverlayBottomRightRect);
 
   OverlayCandidateList candidate_list;
   OverlayProcessor::FilterOperationsMap render_pass_filters;
@@ -1234,9 +1279,9 @@
   CreateSolidColorQuadAt(pass->shared_quad_state_list.back(),
                          SK_ColorTRANSPARENT, pass.get(),
                          kOverlayBottomRightRect);
-  CreateCandidateQuadAt(resource_provider_.get(),
-                        pass->shared_quad_state_list.back(), pass.get(),
-                        kOverlayBottomRightRect);
+  CreateCandidateQuadAt(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get(), kOverlayBottomRightRect);
 
   OverlayCandidateList candidate_list;
   OverlayProcessor::FilterOperationsMap render_pass_filters;
@@ -1258,8 +1303,9 @@
                          kOverlayBottomRightRect);
   shared_state = pass->CreateAndAppendSharedQuadState();
   shared_state->opacity = 1.f;
-  CreateCandidateQuadAt(resource_provider_.get(), shared_state, pass.get(),
-                        kOverlayBottomRightRect);
+  CreateCandidateQuadAt(resource_provider_.get(),
+                        child_resource_provider_.get(), shared_state,
+                        pass.get(), kOverlayBottomRightRect);
 
   OverlayCandidateList candidate_list;
   OverlayProcessor::FilterOperationsMap render_pass_filters;
@@ -1279,8 +1325,9 @@
   CreateSolidColorQuadAt(shared_state, SK_ColorTRANSPARENT, pass.get(),
                          kOverlayBottomRightRect)
       ->needs_blending = false;
-  CreateCandidateQuadAt(resource_provider_.get(), shared_state, pass.get(),
-                        kOverlayBottomRightRect);
+  CreateCandidateQuadAt(resource_provider_.get(),
+                        child_resource_provider_.get(), shared_state,
+                        pass.get(), kOverlayBottomRightRect);
 
   OverlayCandidateList candidate_list;
   OverlayProcessor::FilterOperationsMap render_pass_filters;
@@ -1296,9 +1343,9 @@
 
 TEST_F(SingleOverlayOnTopTest, RejectVideoSwapTransform) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateFullscreenCandidateVideoQuad(resource_provider_.get(),
-                                     pass->shared_quad_state_list.back(),
-                                     pass.get(), kSwapTransform);
+  CreateFullscreenCandidateVideoQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get(), kSwapTransform);
 
   OverlayCandidateList candidate_list;
   OverlayProcessor::FilterOperationsMap render_pass_filters;
@@ -1314,9 +1361,9 @@
 
 TEST_F(UnderlayTest, AllowVideoXMirrorTransform) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateFullscreenCandidateVideoQuad(resource_provider_.get(),
-                                     pass->shared_quad_state_list.back(),
-                                     pass.get(), kXMirrorTransform);
+  CreateFullscreenCandidateVideoQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get(), kXMirrorTransform);
 
   OverlayCandidateList candidate_list;
   OverlayProcessor::FilterOperationsMap render_pass_filters;
@@ -1332,9 +1379,9 @@
 
 TEST_F(UnderlayTest, AllowVideoBothMirrorTransform) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateFullscreenCandidateVideoQuad(resource_provider_.get(),
-                                     pass->shared_quad_state_list.back(),
-                                     pass.get(), kBothMirrorTransform);
+  CreateFullscreenCandidateVideoQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get(), kBothMirrorTransform);
 
   OverlayCandidateList candidate_list;
   OverlayProcessor::FilterOperationsMap render_pass_filters;
@@ -1350,9 +1397,9 @@
 
 TEST_F(UnderlayTest, AllowVideoNormalTransform) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateFullscreenCandidateVideoQuad(resource_provider_.get(),
-                                     pass->shared_quad_state_list.back(),
-                                     pass.get(), kNormalTransform);
+  CreateFullscreenCandidateVideoQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get(), kNormalTransform);
 
   OverlayCandidateList candidate_list;
   OverlayProcessor::FilterOperationsMap render_pass_filters;
@@ -1368,9 +1415,9 @@
 
 TEST_F(SingleOverlayOnTopTest, AllowVideoYMirrorTransform) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateFullscreenCandidateVideoQuad(resource_provider_.get(),
-                                     pass->shared_quad_state_list.back(),
-                                     pass.get(), kYMirrorTransform);
+  CreateFullscreenCandidateVideoQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get(), kYMirrorTransform);
 
   OverlayCandidateList candidate_list;
   OverlayProcessor::FilterOperationsMap render_pass_filters;
@@ -1391,9 +1438,9 @@
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
   CreateFullscreenOpaqueQuad(resource_provider_.get(),
                              pass->shared_quad_state_list.back(), pass.get());
-  CreateCandidateQuadAt(resource_provider_.get(),
-                        pass->shared_quad_state_list.back(), pass.get(),
-                        kOverlayBottomRightRect);
+  CreateCandidateQuadAt(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get(), kOverlayBottomRightRect);
 
   OverlayCandidateList candidate_list;
   OverlayProcessor::FilterOperationsMap render_pass_filters;
@@ -1419,9 +1466,9 @@
 
 TEST_F(UnderlayTest, AllowOnTop) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                pass->shared_quad_state_list.back(),
-                                pass.get());
+  CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
   pass->CreateAndAppendSharedQuadState()->opacity = 0.5f;
   CreateFullscreenOpaqueQuad(resource_provider_.get(),
                              pass->shared_quad_state_list.back(), pass.get());
@@ -1450,9 +1497,9 @@
 // The first time an underlay is scheduled its damage must not be subtracted.
 TEST_F(UnderlayTest, InitialUnderlayDamageNotSubtracted) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                pass->shared_quad_state_list.back(),
-                                pass.get());
+  CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
 
   damage_rect_ = kOverlayRect;
 
@@ -1474,9 +1521,9 @@
 TEST_F(UnderlayTest, DamageSubtractedForConsecutiveIdenticalUnderlays) {
   for (int i = 0; i < 2; ++i) {
     std::unique_ptr<RenderPass> pass = CreateRenderPass();
-    CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                  pass->shared_quad_state_list.back(),
-                                  pass.get());
+    CreateFullscreenCandidateQuad(
+        resource_provider_.get(), child_resource_provider_.get(),
+        pass->shared_quad_state_list.back(), pass.get());
 
     damage_rect_ = kOverlayRect;
 
@@ -1510,9 +1557,9 @@
 
     std::unique_ptr<RenderPass> pass = CreateRenderPass();
 
-    CreateCandidateQuadAt(resource_provider_.get(),
-                          pass->shared_quad_state_list.back(), pass.get(),
-                          overlay_rects[i]);
+    CreateCandidateQuadAt(
+        resource_provider_.get(), child_resource_provider_.get(),
+        pass->shared_quad_state_list.back(), pass.get(), overlay_rects[i]);
 
     damage_rect_ = overlay_rects[i];
 
@@ -1539,9 +1586,9 @@
     std::unique_ptr<RenderPass> pass = CreateRenderPass();
 
     if (has_fullscreen_candidate[i]) {
-      CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                    pass->shared_quad_state_list.back(),
-                                    pass.get());
+      CreateFullscreenCandidateQuad(
+          resource_provider_.get(), child_resource_provider_.get(),
+          pass->shared_quad_state_list.back(), pass.get());
     }
 
     damage_rect_ = kOverlayRect;
@@ -1570,9 +1617,9 @@
     // Add an overlapping quad above the candidate.
     CreateFullscreenOpaqueQuad(resource_provider_.get(),
                                pass->shared_quad_state_list.back(), pass.get());
-    CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                  pass->shared_quad_state_list.back(),
-                                  pass.get());
+    CreateFullscreenCandidateQuad(
+        resource_provider_.get(), child_resource_provider_.get(),
+        pass->shared_quad_state_list.back(), pass.get());
 
     damage_rect_ = kOverlayRect;
 
@@ -1601,6 +1648,7 @@
                        pass->shared_quad_state_list.back(), pass.get(),
                        kOverlayTopLeftRect);
     CreateCandidateQuadAt(resource_provider_.get(),
+                          child_resource_provider_.get(),
                           pass->shared_quad_state_list.back(), pass.get(),
                           kOverlayBottomRightRect);
 
@@ -1641,9 +1689,9 @@
 
 TEST_F(UnderlayCastTest, FullScreenOverlayContentBounds) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateCandidateQuadAt(resource_provider_.get(),
-                        pass->shared_quad_state_list.back(), pass.get(),
-                        kOverlayRect);
+  CreateCandidateQuadAt(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get(), kOverlayRect);
 
   OverlayCandidateList candidate_list;
   OverlayProcessor::FilterOperationsMap render_pass_filters;
@@ -1667,9 +1715,9 @@
   const gfx::Rect kTopRight(128, 0, 128, 128);
 
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateCandidateQuadAt(resource_provider_.get(),
-                        pass->shared_quad_state_list.back(), pass.get(),
-                        kOverlayBottomRightRect);
+  CreateCandidateQuadAt(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get(), kOverlayBottomRightRect);
   CreateOpaqueQuadAt(resource_provider_.get(),
                      pass->shared_quad_state_list.back(), pass.get(), kLeftSide,
                      SK_ColorBLACK);
@@ -1696,9 +1744,9 @@
   CreateOpaqueQuadAt(resource_provider_.get(),
                      pass->shared_quad_state_list.back(), pass.get(),
                      kOverlayTopLeftRect);
-  CreateCandidateQuadAt(resource_provider_.get(),
-                        pass->shared_quad_state_list.back(), pass.get(),
-                        kOverlayRect);
+  CreateCandidateQuadAt(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get(), kOverlayRect);
 
   OverlayCandidateList candidate_list;
   OverlayProcessor::FilterOperationsMap render_pass_filters;
@@ -1722,9 +1770,9 @@
   CreateOpaqueQuadAt(resource_provider_.get(),
                      pass->shared_quad_state_list.back(), pass.get(),
                      kOverlayBottomRightRect);
-  CreateCandidateQuadAt(resource_provider_.get(),
-                        pass->shared_quad_state_list.back(), pass.get(),
-                        kOverlayRect);
+  CreateCandidateQuadAt(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get(), kOverlayRect);
 
   OverlayCandidateList candidate_list;
   OverlayProcessor::FilterOperationsMap render_pass_filters;
@@ -1751,9 +1799,9 @@
   transform.Translate(0.5f, 0.5f);
 
   std::unique_ptr<RenderPass> pass = CreateRenderPassWithTransform(transform);
-  CreateCandidateQuadAt(resource_provider_.get(),
-                        pass->shared_quad_state_list.back(), pass.get(),
-                        overlay_rect);
+  CreateCandidateQuadAt(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get(), overlay_rect);
   CreateOpaqueQuadAt(resource_provider_.get(),
                      pass->shared_quad_state_list.back(), pass.get(),
                      gfx::Rect(0, 0, 10, 10), SK_ColorWHITE);
@@ -1784,9 +1832,9 @@
   transform.Translate(0.5f, 0.5f);
 
   std::unique_ptr<RenderPass> pass = CreateRenderPassWithTransform(transform);
-  CreateCandidateQuadAt(resource_provider_.get(),
-                        pass->shared_quad_state_list.back(), pass.get(),
-                        overlay_rect);
+  CreateCandidateQuadAt(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get(), overlay_rect);
   CreateOpaqueQuadAt(resource_provider_.get(),
                      pass->shared_quad_state_list.back(), pass.get(),
                      gfx::Rect(0, 0, 255, 255), SK_ColorWHITE);
@@ -1817,9 +1865,9 @@
 
 TEST_F(CALayerOverlayTest, AllowNonAxisAlignedTransform) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                pass->shared_quad_state_list.back(),
-                                pass.get());
+  CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
   pass->shared_quad_state_list.back()
       ->quad_to_target_transform.RotateAboutZAxis(45.f);
 
@@ -1842,9 +1890,9 @@
 
 TEST_F(CALayerOverlayTest, ThreeDTransform) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                pass->shared_quad_state_list.back(),
-                                pass.get());
+  CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
   pass->shared_quad_state_list.back()
       ->quad_to_target_transform.RotateAboutXAxis(45.f);
 
@@ -1870,9 +1918,9 @@
 
 TEST_F(CALayerOverlayTest, AllowContainingClip) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                pass->shared_quad_state_list.back(),
-                                pass.get());
+  CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
   pass->shared_quad_state_list.back()->is_clipped = true;
   pass->shared_quad_state_list.back()->clip_rect = kOverlayRect;
 
@@ -1895,9 +1943,9 @@
 
 TEST_F(CALayerOverlayTest, NontrivialClip) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                pass->shared_quad_state_list.back(),
-                                pass.get());
+  CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
   pass->shared_quad_state_list.back()->is_clipped = true;
   pass->shared_quad_state_list.back()->clip_rect = gfx::Rect(64, 64, 128, 128);
 
@@ -1923,9 +1971,9 @@
 
 TEST_F(CALayerOverlayTest, SkipTransparent) {
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                pass->shared_quad_state_list.back(),
-                                pass.get());
+  CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
   pass->shared_quad_state_list.back()->opacity = 0;
 
   gfx::Rect damage_rect;
@@ -1963,9 +2011,9 @@
   feature_list.InitAndEnableFeature(
       features::kDirectCompositionComplexOverlays);
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
-  CreateFullscreenCandidateYUVVideoQuad(resource_provider_.get(),
-                                        pass->shared_quad_state_list.back(),
-                                        pass.get());
+  CreateFullscreenCandidateYUVVideoQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
   pass->shared_quad_state_list.back()
       ->quad_to_target_transform.RotateAboutZAxis(45.f);
 
@@ -1995,8 +2043,8 @@
       features::kDirectCompositionNonrootOverlays);
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
   YUVVideoDrawQuad* yuv_quad = CreateFullscreenCandidateYUVVideoQuad(
-      resource_provider_.get(), pass->shared_quad_state_list.back(),
-      pass.get());
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
   yuv_quad->require_overlay = true;
   pass->shared_quad_state_list.back()
       ->quad_to_target_transform.RotateAboutZAxis(45.f);
@@ -2029,9 +2077,9 @@
     CreateOpaqueQuadAt(resource_provider_.get(),
                        pass->shared_quad_state_list.back(), pass.get(),
                        gfx::Rect(0, 2, 100, 100), SK_ColorWHITE);
-    CreateFullscreenCandidateYUVVideoQuad(resource_provider_.get(),
-                                          pass->shared_quad_state_list.back(),
-                                          pass.get());
+    CreateFullscreenCandidateYUVVideoQuad(
+        resource_provider_.get(), child_resource_provider_.get(),
+        pass->shared_quad_state_list.back(), pass.get());
 
     gfx::Rect damage_rect;
     DCLayerOverlayList dc_layer_list;
@@ -2058,9 +2106,9 @@
     CreateOpaqueQuadAt(resource_provider_.get(),
                        pass->shared_quad_state_list.back(), pass.get(),
                        gfx::Rect(2, 2, 100, 100), SK_ColorWHITE);
-    CreateFullscreenCandidateYUVVideoQuad(resource_provider_.get(),
-                                          pass->shared_quad_state_list.back(),
-                                          pass.get());
+    CreateFullscreenCandidateYUVVideoQuad(
+        resource_provider_.get(), child_resource_provider_.get(),
+        pass->shared_quad_state_list.back(), pass.get());
 
     gfx::Rect damage_rect;
     DCLayerOverlayList dc_layer_list;
@@ -2088,9 +2136,9 @@
 TEST_P(DCLayerOverlayTest, DamageRect) {
   for (int i = 0; i < 2; i++) {
     std::unique_ptr<RenderPass> pass = CreateRenderPass();
-    CreateFullscreenCandidateYUVVideoQuad(resource_provider_.get(),
-                                          pass->shared_quad_state_list.back(),
-                                          pass.get());
+    CreateFullscreenCandidateYUVVideoQuad(
+        resource_provider_.get(), child_resource_provider_.get(),
+        pass->shared_quad_state_list.back(), pass.get());
 
     gfx::Rect damage_rect;
     DCLayerOverlayList dc_layer_list;
@@ -2125,8 +2173,8 @@
     std::unique_ptr<RenderPass> pass1 = CreateRenderPass();
     pass1->id = child_pass_id;
     YUVVideoDrawQuad* yuv_quad = CreateFullscreenCandidateYUVVideoQuad(
-        resource_provider_.get(), pass1->shared_quad_state_list.back(),
-        pass1.get());
+        resource_provider_.get(), child_resource_provider_.get(),
+        pass1->shared_quad_state_list.back(), pass1.get());
     yuv_quad->require_overlay = true;
     pass1->damage_rect = gfx::Rect();
     pass1->transform_to_root_target.Translate(0, 100);
@@ -2204,6 +2252,7 @@
     SharedQuadState* shared_state = pass->CreateAndAppendSharedQuadState();
     shared_state->opacity = 1.f;
     CreateFullscreenCandidateYUVVideoQuad(resource_provider_.get(),
+                                          child_resource_provider_.get(),
                                           shared_state, pass.get());
     shared_state->is_clipped = true;
     // Clipped rect shouldn't be overlapped by clipped opaque quad rect.
@@ -2241,9 +2290,9 @@
   // frame.
   for (size_t i = 0; i < 2; ++i) {
     std::unique_ptr<RenderPass> pass = CreateRenderPass();
-    CreateFullscreenCandidateYUVVideoQuad(resource_provider_.get(),
-                                          pass->shared_quad_state_list.back(),
-                                          pass.get());
+    CreateFullscreenCandidateYUVVideoQuad(
+        resource_provider_.get(), child_resource_provider_.get(),
+        pass->shared_quad_state_list.back(), pass.get());
     pass->shared_quad_state_list.back()->opacity = 0.5f;
 
     DCLayerOverlayList dc_layer_list;
@@ -2328,6 +2377,12 @@
 
     provider_->support()->SetScheduleOverlayPlaneCallback(base::Bind(
         &MockOverlayScheduler::Schedule, base::Unretained(&scheduler_)));
+
+    child_provider_ = TestContextProvider::Create();
+    child_provider_->BindToCurrentThread();
+    child_resource_provider_ =
+        FakeResourceProvider::Create<LayerTreeResourceProvider>(
+            child_provider_.get(), nullptr);
   }
 
   void Init(bool use_validator) {
@@ -2370,6 +2425,8 @@
   std::unique_ptr<DisplayResourceProvider> resource_provider_;
   std::unique_ptr<OverlayInfoRendererGL> renderer_;
   scoped_refptr<TestContextProvider> provider_;
+  scoped_refptr<TestContextProvider> child_provider_;
+  std::unique_ptr<LayerTreeResourceProvider> child_resource_provider_;
   MockOverlayScheduler scheduler_;
 };
 
@@ -2384,9 +2441,9 @@
 
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
 
-  CreateCandidateQuadAt(resource_provider_.get(),
-                        pass->shared_quad_state_list.back(), pass.get(),
-                        kOverlayBottomRightRect);
+  CreateCandidateQuadAt(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get(), kOverlayBottomRightRect);
   CreateFullscreenOpaqueQuad(resource_provider_.get(),
                              pass->shared_quad_state_list.back(), pass.get());
   CreateFullscreenOpaqueQuad(resource_provider_.get(),
@@ -2428,9 +2485,9 @@
   CreateFullscreenOpaqueQuad(resource_provider_.get(),
                              pass->shared_quad_state_list.back(), pass.get());
 
-  CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                pass->shared_quad_state_list.back(),
-                                pass.get());
+  CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
 
   RenderPassList pass_list;
   pass_list.push_back(std::move(pass));
@@ -2463,9 +2520,9 @@
 
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
 
-  CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                pass->shared_quad_state_list.back(),
-                                pass.get());
+  CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
 
   CreateFullscreenOpaqueQuad(resource_provider_.get(),
                              pass->shared_quad_state_list.back(), pass.get());
@@ -2497,9 +2554,9 @@
 
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
 
-  CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                pass->shared_quad_state_list.back(),
-                                pass.get());
+  CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
   CreateFullscreenOpaqueQuad(resource_provider_.get(),
                              pass->shared_quad_state_list.back(), pass.get());
   CreateFullscreenOpaqueQuad(resource_provider_.get(),
@@ -2528,9 +2585,9 @@
 
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
 
-  CreateFullscreenCandidateQuad(resource_provider_.get(),
-                                pass->shared_quad_state_list.back(),
-                                pass.get());
+  CreateFullscreenCandidateQuad(
+      resource_provider_.get(), child_resource_provider_.get(),
+      pass->shared_quad_state_list.back(), pass.get());
 
   CreateFullscreenOpaqueQuad(resource_provider_.get(),
                              pass->shared_quad_state_list.back(), pass.get());
@@ -2556,11 +2613,14 @@
   renderer_->set_expect_overlays(true);
 
   viz::ResourceId resource1 =
-      CreateResource(resource_provider_.get(), gfx::Size(32, 32), true);
+      CreateResource(resource_provider_.get(), child_resource_provider_.get(),
+                     gfx::Size(32, 32), true);
   viz::ResourceId resource2 =
-      CreateResource(resource_provider_.get(), gfx::Size(32, 32), true);
+      CreateResource(resource_provider_.get(), child_resource_provider_.get(),
+                     gfx::Size(32, 32), true);
   viz::ResourceId resource3 =
-      CreateResource(resource_provider_.get(), gfx::Size(32, 32), true);
+      CreateResource(resource_provider_.get(), child_resource_provider_.get(),
+                     gfx::Size(32, 32), true);
 
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
   RenderPassList pass_list;
@@ -2694,11 +2754,14 @@
   renderer_->set_expect_overlays(true);
 
   viz::ResourceId resource1 =
-      CreateResource(resource_provider_.get(), gfx::Size(32, 32), true);
+      CreateResource(resource_provider_.get(), child_resource_provider_.get(),
+                     gfx::Size(32, 32), true);
   viz::ResourceId resource2 =
-      CreateResource(resource_provider_.get(), gfx::Size(32, 32), true);
+      CreateResource(resource_provider_.get(), child_resource_provider_.get(),
+                     gfx::Size(32, 32), true);
   viz::ResourceId resource3 =
-      CreateResource(resource_provider_.get(), gfx::Size(32, 32), true);
+      CreateResource(resource_provider_.get(), child_resource_provider_.get(),
+                     gfx::Size(32, 32), true);
 
   std::unique_ptr<RenderPass> pass = CreateRenderPass();
   RenderPassList pass_list;
diff --git a/chrome/MAJOR_BRANCH_DATE b/chrome/MAJOR_BRANCH_DATE
new file mode 100644
index 0000000..07d7ff7
--- /dev/null
+++ b/chrome/MAJOR_BRANCH_DATE
@@ -0,0 +1 @@
+MAJOR_BRANCH_DATE=2017/08/31
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/firstrun/FirstRunActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/firstrun/FirstRunActivity.java
index 008f9c4..1c6c4c9 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/firstrun/FirstRunActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/firstrun/FirstRunActivity.java
@@ -7,6 +7,7 @@
 import android.app.Activity;
 import android.app.Fragment;
 import android.os.Bundle;
+import android.support.annotation.StringRes;
 import android.text.TextUtils;
 
 import org.chromium.base.ActivityState;
@@ -523,7 +524,7 @@
     }
 
     @Override
-    public void showInfoPage(int url) {
+    public void showInfoPage(@StringRes int url) {
         CustomTabActivity.showInfoPage(
                 this, LocalizationUtils.substituteLocalePlaceholder(getString(url)));
     }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/firstrun/LightweightFirstRunActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/firstrun/LightweightFirstRunActivity.java
index 5f9bea9..3275053 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/firstrun/LightweightFirstRunActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/firstrun/LightweightFirstRunActivity.java
@@ -5,6 +5,7 @@
 package org.chromium.chrome.browser.firstrun;
 
 import android.os.Bundle;
+import android.support.annotation.StringRes;
 import android.text.method.LinkMovementMethod;
 import android.view.LayoutInflater;
 import android.view.View;
@@ -164,7 +165,7 @@
      * Show an informational web page. The page doesn't show navigation control.
      * @param url Resource id for the URL of the web page.
      */
-    public void showInfoPage(int url) {
+    public void showInfoPage(@StringRes int url) {
         CustomTabActivity.showInfoPage(
                 this, LocalizationUtils.substituteLocalePlaceholder(getString(url)));
     }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/photo_picker/DecoderService.java b/chrome/android/java/src/org/chromium/chrome/browser/photo_picker/DecoderService.java
index f4b27ce..8b37705 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/photo_picker/DecoderService.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/photo_picker/DecoderService.java
@@ -14,9 +14,12 @@
 import android.os.SystemClock;
 
 import org.chromium.base.Log;
+import org.chromium.base.PathUtils;
+import org.chromium.base.ThreadUtils;
 import org.chromium.base.library_loader.LibraryLoader;
 import org.chromium.base.library_loader.LibraryProcessType;
 import org.chromium.base.library_loader.ProcessInitException;
+import org.chromium.chrome.browser.init.ChromeBrowserInitializer;
 
 import java.io.FileDescriptor;
 import java.io.IOException;
@@ -42,6 +45,12 @@
     @Override
     public void onCreate() {
         try {
+            // The decoder service relies on PathUtils.
+            ThreadUtils.runOnUiThreadBlocking(() -> {
+                PathUtils.setPrivateDataDirectorySuffix(
+                        ChromeBrowserInitializer.PRIVATE_DATA_DIRECTORY_SUFFIX);
+            });
+
             LibraryLoader.get(LibraryProcessType.PROCESS_CHILD).ensureInitialized();
             nativeInitializePhotoPickerSandbox();
 
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/suggestions/SuggestionsCarousel.java b/chrome/android/java/src/org/chromium/chrome/browser/suggestions/SuggestionsCarousel.java
index 9c6c4ca..0cb7987 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/suggestions/SuggestionsCarousel.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/suggestions/SuggestionsCarousel.java
@@ -11,8 +11,8 @@
 import android.support.annotation.Nullable;
 import android.support.v7.widget.LinearLayoutManager;
 import android.support.v7.widget.RecyclerView;
-import android.text.TextUtils;
 import android.view.ViewGroup;
+import android.webkit.URLUtil;
 
 import org.chromium.base.ApiCompatibilityUtils;
 import org.chromium.chrome.R;
@@ -24,6 +24,7 @@
 import org.chromium.chrome.browser.ntp.cards.OptionalLeaf;
 import org.chromium.chrome.browser.ntp.snippets.SnippetArticle;
 import org.chromium.chrome.browser.offlinepages.OfflinePageBridge;
+import org.chromium.chrome.browser.util.UrlUtilities;
 import org.chromium.chrome.browser.widget.displaystyle.UiConfig;
 import org.chromium.ui.widget.Toast;
 
@@ -68,7 +69,7 @@
      * was shown.
      */
     public void refresh(final Context context, @Nullable final String newUrl) {
-        if (TextUtils.isEmpty(newUrl)) {
+        if (!URLUtil.isNetworkUrl(newUrl)) {
             clearSuggestions();
             return;
         }
@@ -80,7 +81,7 @@
         mWasScrolledSinceShown = false;
 
         // Do nothing if there are already suggestions in the carousel for the new context.
-        if (TextUtils.equals(newUrl, mCurrentContextUrl)) return;
+        if (UrlUtilities.urlsMatchIgnoringFragments(newUrl, mCurrentContextUrl)) return;
 
         String text = "Fetching contextual suggestions...";
         Toast.makeText(context, text, Toast.LENGTH_SHORT).show();
diff --git a/chrome/browser/chrome_browser_main.cc b/chrome/browser/chrome_browser_main.cc
index 3af7f3e..39137ac 100644
--- a/chrome/browser/chrome_browser_main.cc
+++ b/chrome/browser/chrome_browser_main.cc
@@ -7,6 +7,7 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include <memory>
 #include <set>
 #include <string>
 #include <utility>
@@ -26,6 +27,7 @@
 #include "base/message_loop/message_loop.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/histogram_macros.h"
+#include "base/metrics/statistics_recorder.h"
 #include "base/path_service.h"
 #include "base/profiler/stack_sampling_profiler.h"
 #include "base/run_loop.h"
@@ -69,6 +71,7 @@
 #include "chrome/browser/gpu/three_d_api_observer.h"
 #include "chrome/browser/media/webrtc/media_capture_devices_dispatcher.h"
 #include "chrome/browser/metrics/chrome_metrics_service_accessor.h"
+#include "chrome/browser/metrics/expired_histograms_array.h"
 #include "chrome/browser/metrics/field_trial_synchronizer.h"
 #include "chrome/browser/metrics/renderer_uptime_tracker.h"
 #include "chrome/browser/metrics/thread_watcher.h"
@@ -126,6 +129,7 @@
 #include "components/google/core/browser/google_util.h"
 #include "components/language_usage_metrics/language_usage_metrics.h"
 #include "components/metrics/call_stack_profile_metrics_provider.h"
+#include "components/metrics/expired_histograms_checker.h"
 #include "components/metrics/metrics_reporting_default_state.h"
 #include "components/metrics/metrics_service.h"
 #include "components/metrics_services_manager/metrics_services_manager.h"
@@ -657,6 +661,11 @@
   // cookies need to go through one of Chrome's URLRequestContexts which have
   // a ChromeNetworkDelegate attached that selectively allows cookies again.
   net::URLRequest::SetDefaultCookiePolicyToBlock();
+
+  base::StatisticsRecorder::SetRecordChecker(
+      std::make_unique<metrics::ExpiredHistogramsChecker>(
+          chrome_metrics::kExpiredHistogramsHashes,
+          chrome_metrics::kNumExpiredHistograms));
 }
 
 ChromeBrowserMainParts::~ChromeBrowserMainParts() {
diff --git a/chrome/browser/extensions/api/storage/managed_value_store_cache.cc b/chrome/browser/extensions/api/storage/managed_value_store_cache.cc
index 506a8e5..8b4a846 100644
--- a/chrome/browser/extensions/api/storage/managed_value_store_cache.cc
+++ b/chrome/browser/extensions/api/storage/managed_value_store_cache.cc
@@ -14,7 +14,6 @@
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "base/scoped_observer.h"
-#include "base/threading/sequenced_worker_pool.h"
 #include "chrome/browser/extensions/api/storage/policy_value_store.h"
 #include "chrome/browser/policy/profile_policy_connector.h"
 #include "chrome/browser/policy/profile_policy_connector_factory.h"
@@ -27,6 +26,7 @@
 #include "components/policy/core/common/schema_registry.h"
 #include "content/public/browser/browser_thread.h"
 #include "extensions/browser/api/storage/backend_task_runner.h"
+#include "extensions/browser/extension_file_task_runner.h"
 #include "extensions/browser/extension_prefs.h"
 #include "extensions/browser/extension_registry.h"
 #include "extensions/browser/extension_registry_observer.h"
@@ -55,9 +55,6 @@
 
 namespace {
 
-const char kLoadSchemasBackgroundTaskTokenName[] =
-    "load_managed_storage_schemas_token";
-
 // Only extension settings are stored in the managed namespace - not apps.
 const ValueStoreFactory::ModelType kManagedModelType =
     ValueStoreFactory::ModelType::EXTENSION;
@@ -95,7 +92,7 @@
 
   // Loads the schemas of the |extensions| and passes a ComponentMap to
   // Register().
-  static void LoadSchemasOnBlockingPool(
+  static void LoadSchemasOnFileTaskRunner(
       std::unique_ptr<ExtensionSet> extensions,
       base::WeakPtr<ExtensionTracker> self);
   void Register(const policy::ComponentMap* components);
@@ -175,10 +172,9 @@
       added->Remove(to_remove);
   }
 
-  // Load the schema files in a background thread.
-  BrowserThread::PostBlockingPoolSequencedTask(
-      kLoadSchemasBackgroundTaskTokenName, FROM_HERE,
-      base::BindOnce(&ExtensionTracker::LoadSchemasOnBlockingPool,
+  GetExtensionFileTaskRunner()->PostTask(
+      FROM_HERE,
+      base::BindOnce(&ExtensionTracker::LoadSchemasOnFileTaskRunner,
                      base::Passed(&added), weak_factory_.GetWeakPtr()));
 }
 
@@ -188,7 +184,7 @@
 }
 
 // static
-void ManagedValueStoreCache::ExtensionTracker::LoadSchemasOnBlockingPool(
+void ManagedValueStoreCache::ExtensionTracker::LoadSchemasOnFileTaskRunner(
     std::unique_ptr<ExtensionSet> extensions,
     base::WeakPtr<ExtensionTracker> self) {
   base::ThreadRestrictions::AssertIOAllowed();
diff --git a/chrome/browser/extensions/api/virtual_keyboard_private/chrome_virtual_keyboard_delegate.cc b/chrome/browser/extensions/api/virtual_keyboard_private/chrome_virtual_keyboard_delegate.cc
index 6da975d..aaf3441 100644
--- a/chrome/browser/extensions/api/virtual_keyboard_private/chrome_virtual_keyboard_delegate.cc
+++ b/chrome/browser/extensions/api/virtual_keyboard_private/chrome_virtual_keyboard_delegate.cc
@@ -70,7 +70,9 @@
 void ChromeVirtualKeyboardDelegate::GetKeyboardConfig(
     OnKeyboardSettingsCallback on_settings_callback) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
-  media::AudioSystem::Get()->HasInputDevices(
+  if (!audio_system_)
+    audio_system_ = media::AudioSystem::CreateInstance();
+  audio_system_->HasInputDevices(
       base::BindOnce(&ChromeVirtualKeyboardDelegate::OnHasInputDevices,
                      weak_this_, std::move(on_settings_callback)));
 }
diff --git a/chrome/browser/extensions/api/virtual_keyboard_private/chrome_virtual_keyboard_delegate.h b/chrome/browser/extensions/api/virtual_keyboard_private/chrome_virtual_keyboard_delegate.h
index ac03deb..d29ca89 100644
--- a/chrome/browser/extensions/api/virtual_keyboard_private/chrome_virtual_keyboard_delegate.h
+++ b/chrome/browser/extensions/api/virtual_keyboard_private/chrome_virtual_keyboard_delegate.h
@@ -12,6 +12,10 @@
 #include "base/memory/weak_ptr.h"
 #include "extensions/browser/api/virtual_keyboard_private/virtual_keyboard_delegate.h"
 
+namespace media {
+class AudioSystem;
+}
+
 namespace extensions {
 
 class ChromeVirtualKeyboardDelegate : public VirtualKeyboardDelegate {
@@ -41,6 +45,7 @@
   void OnHasInputDevices(OnKeyboardSettingsCallback on_settings_callback,
                          bool has_input_devices);
 
+  std::unique_ptr<media::AudioSystem> audio_system_;
   base::WeakPtr<ChromeVirtualKeyboardDelegate> weak_this_;
   base::WeakPtrFactory<ChromeVirtualKeyboardDelegate> weak_factory_;
   DISALLOW_COPY_AND_ASSIGN(ChromeVirtualKeyboardDelegate);
diff --git a/chrome/browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.cc b/chrome/browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.cc
index c87e15d..63ed6ecd 100644
--- a/chrome/browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.cc
+++ b/chrome/browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.cc
@@ -129,6 +129,13 @@
   return device_id_salt_;
 }
 
+media::AudioSystem* WebrtcAudioPrivateFunction::GetAudioSystem() {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  if (!audio_system_)
+    audio_system_ = media::AudioSystem::CreateInstance();
+  return audio_system_.get();
+}
+
 // TODO(hlundin): Stolen from WebrtcLoggingPrivateFunction.
 // Consolidate and improve. http://crbug.com/710371
 content::RenderProcessHost*
@@ -180,7 +187,7 @@
 void WebrtcAudioPrivateGetSinksFunction::
     GetOutputDeviceDescriptionsOnIOThread() {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  media::AudioSystem::Get()->GetDeviceDescriptions(
+  GetAudioSystem()->GetDeviceDescriptions(
       false, base::BindOnce(&WebrtcAudioPrivateGetSinksFunction::
                                 ReceiveOutputDeviceDescriptionsOnIOThread,
                             this));
@@ -235,7 +242,7 @@
 void WebrtcAudioPrivateGetAssociatedSinkFunction::
     GetInputDeviceDescriptionsOnIOThread() {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  media::AudioSystem::Get()->GetDeviceDescriptions(
+  GetAudioSystem()->GetDeviceDescriptions(
       true, base::BindOnce(&WebrtcAudioPrivateGetAssociatedSinkFunction::
                                ReceiveInputDeviceDescriptionsOnIOThread,
                            this));
@@ -264,7 +271,7 @@
     CalculateHMACOnIOThread(std::string());
     return;
   }
-  media::AudioSystem::Get()->GetAssociatedOutputDeviceID(
+  GetAudioSystem()->GetAssociatedOutputDeviceID(
       raw_source_id,
       base::BindOnce(
           &WebrtcAudioPrivateGetAssociatedSinkFunction::CalculateHMACOnIOThread,
diff --git a/chrome/browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.h b/chrome/browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.h
index 201f72a..4b6f481 100644
--- a/chrome/browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.h
+++ b/chrome/browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.h
@@ -19,6 +19,10 @@
 #include "extensions/browser/browser_context_keyed_api_factory.h"
 #include "media/audio/audio_device_description.h"
 
+namespace media {
+class AudioSystem;
+}
+
 namespace extensions {
 
 // Listens for device changes and forwards as an extension event.
@@ -66,6 +70,8 @@
   // |InitDeviceIDSalt()|.
   std::string device_id_salt() const;
 
+  media::AudioSystem* GetAudioSystem();
+
   // Returns the RenderProcessHost associated with the given |request|
   // authorized by the |security_origin|. Returns null if unauthorized or
   // the RPH does not exist.
@@ -75,6 +81,7 @@
 
  private:
   std::string device_id_salt_;
+  std::unique_ptr<media::AudioSystem> audio_system_;
 
   DISALLOW_COPY_AND_ASSIGN(WebrtcAudioPrivateFunction);
 };
diff --git a/chrome/browser/extensions/api/webrtc_audio_private/webrtc_audio_private_browsertest.cc b/chrome/browser/extensions/api/webrtc_audio_private/webrtc_audio_private_browsertest.cc
index 596f5db..8eec628 100644
--- a/chrome/browser/extensions/api/webrtc_audio_private/webrtc_audio_private_browsertest.cc
+++ b/chrome/browser/extensions/api/webrtc_audio_private/webrtc_audio_private_browsertest.cc
@@ -62,7 +62,9 @@
 void GetAudioDeviceDescriptions(bool for_input,
                                 AudioDeviceDescriptions* device_descriptions) {
   base::RunLoop run_loop;
-  media::AudioSystem::Get()->GetDeviceDescriptions(
+  std::unique_ptr<media::AudioSystem> audio_system =
+      media::AudioSystem::CreateInstance();
+  audio_system->GetDeviceDescriptions(
       for_input,
       base::BindOnce(
           [](base::Closure finished_callback, AudioDeviceDescriptions* result,
diff --git a/chrome/browser/resources/chromeos/chromevox/cvox2/background/automation_predicate.js b/chrome/browser/resources/chromeos/chromevox/cvox2/background/automation_predicate.js
index db72fa8..415e524 100644
--- a/chrome/browser/resources/chromeos/chromevox/cvox2/background/automation_predicate.js
+++ b/chrome/browser/resources/chromeos/chromevox/cvox2/background/automation_predicate.js
@@ -175,6 +175,23 @@
 };
 
 /**
+ * @param {!AutomationNode} node
+ * @return {boolean}
+ */
+AutomationPredicate.leafWithWordStop = function(node) {
+  function hasWordStop(node) {
+    if (node.role == Role.INLINE_TEXT_BOX)
+      return node.wordStarts && node.wordStarts.length;
+
+    // Non-text objects  are treated as having a single word stop.
+    return true;
+  }
+  // Do not include static text leaves, which occur for an en end-of-line.
+  return AutomationPredicate.leaf(node) && !node.state[State.INVISIBLE] &&
+      node.role != Role.STATIC_TEXT && hasWordStop(node);
+};
+
+/**
  * Matches against leaves or static text nodes. Useful when restricting
  * traversal to non-inline textboxes while still allowing them if navigation
  * already entered into an inline textbox.
diff --git a/chrome/browser/resources/chromeos/chromevox/cvox2/background/background_test.extjs b/chrome/browser/resources/chromeos/chromevox/cvox2/background/background_test.extjs
index c370884..b748438 100644
--- a/chrome/browser/resources/chromeos/chromevox/cvox2/background/background_test.extjs
+++ b/chrome/browser/resources/chromeos/chromevox/cvox2/background/background_test.extjs
@@ -64,6 +64,14 @@
     <p>end<span>of test</span></p>
   */},
 
+  buttonDoc: function() {/*!
+    <p>start</p>
+    <button>hello button one</button>
+    cats
+    <button>hello button two</button>
+    <p>end</p>
+  */},
+
   formsDoc: function() {/*!
     <select id="fruitSelect">
       <option>apple</option>
@@ -188,6 +196,10 @@
         .expectSpeech('alpha', 'Link');
     mockFeedback.call(doCmd('nextWord'))
         .expectSpeech('beta', 'Link');
+    mockFeedback.call(doCmd('previousWord'))
+        .expectSpeech('alpha', 'Link');
+    mockFeedback.call(doCmd('nextWord'))
+        .expectSpeech('beta', 'Link');
     mockFeedback.call(doCmd('nextWord'))
         .expectSpeech('charlie', 'Heading 1');
     mockFeedback.call(doCmd('nextLine'))
@@ -218,6 +230,29 @@
   });
 });
 
+/** Tests that individual buttons are stops for move-by-word functionality. */
+TEST_F('BackgroundTest', 'CaretNavigationTreatsButtonAsWord', function() {
+  var mockFeedback = this.createMockFeedback();
+  this.runWithLoadedTree(this.buttonDoc, function() {
+    mockFeedback.expectSpeech('start');
+    mockFeedback.call(doCmd('nextWord'))
+        .expectSpeech('hello button one', 'Button');
+    mockFeedback.call(doCmd('nextWord'))
+        .expectSpeech('cats');
+    mockFeedback.call(doCmd('nextWord'))
+        .expectSpeech('hello button two', 'Button');
+    mockFeedback.call(doCmd('nextWord'))
+        .expectSpeech('end');
+    mockFeedback.call(doCmd('previousWord'))
+        .expectSpeech('hello button two', 'Button');
+    mockFeedback.call(doCmd('previousWord'))
+        .expectSpeech('cats');
+    mockFeedback.call(doCmd('previousWord'))
+        .expectSpeech('hello button one', 'Button');
+    mockFeedback.replay();
+  });
+});
+
 TEST_F('BackgroundTest', 'SelectSingleBasic', function() {
   var mockFeedback = this.createMockFeedback();
   this.runWithLoadedTree(this.formsDoc, function() {
diff --git a/chrome/browser/resources/chromeos/chromevox/cvox2/background/cursors.js b/chrome/browser/resources/chromeos/chromevox/cvox2/background/cursors.js
index d544e6a..1c8b628 100644
--- a/chrome/browser/resources/chromeos/chromevox/cvox2/background/cursors.js
+++ b/chrome/browser/resources/chromeos/chromevox/cvox2/background/cursors.js
@@ -292,11 +292,10 @@
     var newNode = originalNode;
     var newIndex = this.index_;
 
-    if (unit != Unit.NODE && newIndex === cursors.NODE_INDEX)
-      newIndex = 0;
-
     switch (unit) {
       case Unit.CHARACTER:
+        if (newIndex === cursors.NODE_INDEX)
+          newIndex = 0;
         // BOUND and DIRECTIONAL are the same for characters.
         var text = this.getText();
         newIndex = dir == Dir.FORWARD ?
@@ -317,12 +316,22 @@
         }
         break;
       case Unit.WORD:
-        if (newNode.role != RoleType.INLINE_TEXT_BOX) {
-          newNode = AutomationUtil.findNextNode(
-                        newNode, Dir.FORWARD, AutomationPredicate.inlineTextBox,
-                        {skipInitialSubtree: false}) ||
+        // If we're not already on a node with word stops, find the next one.
+        if (!AutomationPredicate.leafWithWordStop(newNode)) {
+          newNode =
+              AutomationUtil.findNextNode(
+                  newNode, Dir.FORWARD, AutomationPredicate.leafWithWordStop,
+                  {skipInitialSubtree: false}) ||
               newNode;
         }
+
+        // Ensure start position is on or after first word.
+        var firstWordStart = (newNode.wordStarts && newNode.wordStarts.length) ?
+            newNode.wordStarts[0] :
+            0;
+        if (newIndex < firstWordStart)  // Also catches cursors.NODE_INDEX case.
+          newIndex = firstWordStart;
+
         switch (movement) {
           case Movement.BOUND:
             if (newNode.role == RoleType.INLINE_TEXT_BOX) {
@@ -338,44 +347,47 @@
               if (goog.isDef(start) && goog.isDef(end))
                 newIndex = dir == Dir.FORWARD ? end : start;
             } else {
-              // TODO(dtseng): Figure out what to do in this case.
+              newIndex = cursors.NODE_INDEX;
             }
             break;
           case Movement.DIRECTIONAL:
+            var start;
             if (newNode.role == RoleType.INLINE_TEXT_BOX) {
-              var start, end;
+              // Go to the next word stop in the same piece of text.
               for (var i = 0; i < newNode.wordStarts.length; i++) {
                 if (newIndex >= newNode.wordStarts[i] &&
                     newIndex <= newNode.wordEnds[i]) {
                   var nextIndex = dir == Dir.FORWARD ? i + 1 : i - 1;
                   start = newNode.wordStarts[nextIndex];
-                  end = newNode.wordEnds[nextIndex];
                   break;
                 }
               }
-              if (goog.isDef(start)) {
-                newIndex = start;
-              } else {
+            }
+            if (goog.isDef(start)) {
+              // Succesfully found the next word stop within the same text node.
+              newIndex = start;
+            } else {
+              // Use adjacent word in adjacent next node in direction |dir|.
+              if (dir == Dir.BACKWARD && newIndex > firstWordStart) {
                 // The backward case is special at the beginning of nodes.
-                if (dir == Dir.BACKWARD && newIndex != 0) {
-                  newIndex = 0;
-                } else {
-                  newNode = AutomationUtil.findNextNode(
-                      newNode, dir, AutomationPredicate.leaf);
-                  if (newNode) {
-                    newIndex = 0;
-                    if (dir == Dir.BACKWARD &&
-                        newNode.role == RoleType.INLINE_TEXT_BOX) {
-                      var starts = newNode.wordStarts;
-                      newIndex = starts[starts.length - 1] || 0;
-                    } else {
-                      // TODO(dtseng): Figure out what to do for general nodes.
+                newIndex = firstWordStart;
+              } else {
+                newNode = AutomationUtil.findNextNode(
+                    newNode, dir, AutomationPredicate.leafWithWordStop);
+                if (newNode) {
+                  if (newNode.role == RoleType.INLINE_TEXT_BOX) {
+                    var starts = newNode.wordStarts;
+                    if (starts.length) {
+                      newIndex = dir == Dir.BACKWARD ?
+                          starts[starts.length - 1] :
+                          starts[0];
                     }
+                  } else {
+                    // For non-text nodes, move by word = by object.
+                    newIndex = cursors.NODE_INDEX;
                   }
                 }
               }
-            } else {
-              // TODO(dtseng): Figure out what to do in this case.
             }
         }
         break;
diff --git a/chrome/browser/resources/chromeos/chromevox/cvox2/background/output_test.extjs b/chrome/browser/resources/chromeos/chromevox/cvox2/background/output_test.extjs
index 5aaef28..21437a6 100644
--- a/chrome/browser/resources/chromeos/chromevox/cvox2/background/output_test.extjs
+++ b/chrome/browser/resources/chromeos/chromevox/cvox2/background/output_test.extjs
@@ -278,11 +278,12 @@
         '||Edit text, email entry',
         '||Password edit text',
         '||Edit text numeric only',
-        ['0|Min 0|Max 0||Spin button',
-         [{value: 'valueForRange', start: 0, end: 1},
-          {value: 'name', start: 14, end: 14},
-          {value: new Output.EarconAction('LISTBOX'), start: 14, end: 14},
-          {value: 'role', start: 15, end: 26}]
+        ['||Spin button',
+          [{value: new Output.SelectionSpan(0, 0), start: 0, end: 0},
+           {value: 'value', start: 0, end: 0},
+           {value: 'name', start: 1, end: 1},
+           {value: new Output.EarconAction('LISTBOX'), start: 1, end: 1},
+           {value: 'role', start: 2, end: 13}]
         ],
         ['Time control',
          [{value: 'role', start: 0, end: 12}]
@@ -306,7 +307,7 @@
         ' @ed 8dot',
         ' pwded',
         ' #ed',
-        {string_: '0 min:0 max:0 spnbtn'},
+        ' spnbtn',
         {string_: 'time'},
         {string_: 'date'},
         {string_: 'Choose File No file chosen btn'},
diff --git a/chrome/browser/resources/local_ntp/voice.js b/chrome/browser/resources/local_ntp/voice.js
index 2e0592c..38adc63 100644
--- a/chrome/browser/resources/local_ntp/voice.js
+++ b/chrome/browser/resources/local_ntp/voice.js
@@ -581,7 +581,7 @@
  * @param {KeyboardEvent} event The keydown event.
  */
 speech.onKeyDown = function(event) {
-  if (!speech.isRecognizing_()) {
+  if (!speech.isRecognizing()) {
     const ctrlKeyPressed =
         event.ctrlKey || (speech.isUserAgentMac_() && event.metaKey);
     if (speech.currentState_ == speech.State_.READY &&
@@ -766,11 +766,21 @@
 
 
 /**
+ * Check to see if the speech recognition interface is running, and has
+ * received any results.
+ * @return {boolean} True, if the speech recognition interface is running,
+ *     and has received any results.
+ */
+speech.hasReceivedResults = function() {
+  return speech.currentState_ == speech.State_.RESULT_RECEIVED;
+};
+
+
+/**
  * Check to see if the speech recognition interface is running.
  * @return {boolean} True, if the speech recognition interface is running.
- * @private
  */
-speech.isRecognizing_ = function() {
+speech.isRecognizing = function() {
   switch (speech.currentState_) {
     case speech.State_.STARTED:
     case speech.State_.AUDIO_RECEIVED:
@@ -785,7 +795,7 @@
 /**
  * Check if the controller is in a state where the UI is definitely hidden.
  * Since we show the UI for a few seconds after we receive an error from the
- * API, we need a separate definition to |speech.isRecognizing_()| to indicate
+ * API, we need a separate definition to |speech.isRecognizing()| to indicate
  * when the UI is hidden. <strong>Note:</strong> that if this function
  * returns false, it might not necessarily mean that the UI is visible.
  * @return {boolean} True if the UI is hidden.
@@ -1140,9 +1150,8 @@
  */
 text.startListeningMessageAnimation_ = function() {
   const animateListeningText = function() {
-    // TODO(oskopek): Substitute the fragile string comparison with a correct
-    // state condition.
-    if (text.interim_.textContent == speech.messages.ready) {
+    // If speech is active with no results yet, show the message and animation.
+    if (speech.isRecognizing() && !speech.hasReceivedResults()) {
       text.updateTextArea(speech.messages.listening);
       text.interim_.classList.add(text.LISTENING_ANIMATION_CLASS_);
     }
diff --git a/chrome/test/data/local_ntp/voice_speech_browsertest.js b/chrome/test/data/local_ntp/voice_speech_browsertest.js
index 509c447..59c4d164 100644
--- a/chrome/test/data/local_ntp/voice_speech_browsertest.js
+++ b/chrome/test/data/local_ntp/voice_speech_browsertest.js
@@ -222,7 +222,7 @@
   assertEquals(speech.State_.STARTED, speech.currentState_);
   assertEquals(1, test.speech.recognitionActiveCount);
   assertEquals(1, test.speech.viewActiveCount);
-  assertTrue(speech.isRecognizing_());
+  assertTrue(speech.isRecognizing());
   assertTrue(test.speech.clock.isTimeoutSet(speech.idleTimer_));
   assertFalse(test.speech.clock.isTimeoutSet(speech.errorTimer_));
 };
@@ -238,7 +238,7 @@
   assertEquals(speech.State_.STARTED, speech.currentState_);
   assertEquals(1, test.speech.recognitionActiveCount);
   assertEquals(1, test.speech.viewActiveCount);
-  assertTrue(speech.isRecognizing_());
+  assertTrue(speech.isRecognizing());
   assertTrue(test.speech.clock.isTimeoutSet(speech.idleTimer_));
   assertFalse(test.speech.clock.isTimeoutSet(speech.errorTimer_));
 
@@ -275,7 +275,7 @@
   speech.recognition_.onaudiostart(null);
 
   assertTrue('ready' in test.speech.viewState);
-  assertTrue(speech.isRecognizing_());
+  assertTrue(speech.isRecognizing());
   assertEquals(1, test.speech.recognitionActiveCount);
   assertFalse(elementIsVisible($(test.speech.FAKEBOX_MICROPHONE_ID)));
 };
@@ -292,7 +292,7 @@
   speech.recognition_.onspeechstart(null);
 
   assertTrue('receiving' in test.speech.viewState);
-  assertTrue(speech.isRecognizing_());
+  assertTrue(speech.isRecognizing());
   assertEquals(1, test.speech.recognitionActiveCount);
   assertFalse(elementIsVisible($(test.speech.FAKEBOX_MICROPHONE_ID)));
 };
@@ -315,7 +315,7 @@
   speech.recognition_.onspeechstart(null);
   speech.recognition_.onresult(responseEvent);
 
-  assertTrue(speech.isRecognizing_());
+  assertTrue(speech.isRecognizing());
   assertEquals(highConfidenceText, test.speech.viewState.final);
   assertEquals(viewText, test.speech.viewState.interim);
   assertEquals(highConfidenceText, speech.finalResult_);
@@ -374,7 +374,7 @@
   // The user interrupts speech.
   speech.stop();
 
-  assertFalse(speech.isRecognizing_());
+  assertFalse(speech.isRecognizing());
   assertEquals('', speech.interimResult_);
   assertEquals('', speech.finalResult_);
   assertEquals(0, test.speech.recognitionActiveCount);
@@ -383,7 +383,7 @@
   test.speech.createInterimResponse('result should', 'be ignored');
   speech.recognition_.onresult(responseEvent);
 
-  assertFalse(speech.isRecognizing_());
+  assertFalse(speech.isRecognizing());
   assertEquals('', speech.interimResult_);
   assertEquals('', speech.finalResult_);
   assertEquals(0, test.speech.recognitionActiveCount);
@@ -414,7 +414,7 @@
   speech.start();
   speech.recognition_.onerror({error: 'some-error'});
 
-  assertFalse(speech.isRecognizing_());
+  assertFalse(speech.isRecognizing());
   assertEquals(1, test.speech.recognitionActiveCount);
   assertEquals(1, test.speech.viewActiveCount);
   assertEquals(RecognitionError.OTHER, test.speech.viewState.error);
@@ -438,7 +438,7 @@
   speech.recognition_.onaudiostart(null);
   speech.recognition_.onend(null);
 
-  assertFalse(speech.isRecognizing_());
+  assertFalse(speech.isRecognizing());
   assertEquals(RecognitionError.NO_SPEECH, test.speech.viewState.error);
 
   test.speech.clock.advanceTime(7999);
@@ -490,7 +490,7 @@
   // Stop.
   speech.recognition_.onend(null);
   assertRecognitionHandlers(true);
-  assertFalse(speech.isRecognizing_());
+  assertFalse(speech.isRecognizing());
   assertEquals(RecognitionError.NO_SPEECH, test.speech.viewState.error);
 
   test.speech.clock.advanceTime(7999);
@@ -519,11 +519,11 @@
   test.speech.initSpeech();
   speech.start();
   assertEquals(speech.State_.STARTED, speech.currentState_);
-  assertTrue(speech.isRecognizing_());
+  assertTrue(speech.isRecognizing());
 
   speech.recognition_.onaudiostart(null);
   assertEquals(speech.State_.AUDIO_RECEIVED, speech.currentState_);
-  assertTrue(speech.isRecognizing_());
+  assertTrue(speech.isRecognizing());
 
   speech.stop();
   assertEquals(speech.State_.READY, speech.currentState_);
@@ -531,7 +531,7 @@
 
   speech.start();
   assertEquals(speech.State_.STARTED, speech.currentState_);
-  assertTrue(speech.isRecognizing_());
+  assertTrue(speech.isRecognizing());
 
   speech.stop();
   assertEquals(speech.State_.READY, speech.currentState_);
@@ -554,14 +554,14 @@
   assertEquals(speech.State_.STARTED, speech.currentState_);
 
   speech.recognition_.onaudiostart(null);
-  assertTrue(speech.isRecognizing_());
+  assertTrue(speech.isRecognizing());
 
   speech.onKeyDown(stopShortcut);
   assertEquals(speech.State_.READY, speech.currentState_);
   test.speech.validateInactive();
 
   speech.onKeyDown(startShortcut);
-  assertTrue(speech.isRecognizing_());
+  assertTrue(speech.isRecognizing());
   assertEquals(speech.State_.STARTED, speech.currentState_);
 
   speech.onKeyDown(stopShortcut);
@@ -635,10 +635,10 @@
   const ctrlShiftPeriod = new KeyboardEvent(
       'test', {ctrlKey: true, code: 'Period', shiftKey: true});
   speech.onKeyDown(ctrlShiftPeriod);
-  assertTrue(speech.isRecognizing_());
+  assertTrue(speech.isRecognizing());
 
   speech.onKeyDown(ctrlShiftPeriod);
-  assertTrue(speech.isRecognizing_());
+  assertTrue(speech.isRecognizing());
 };
 
 
@@ -671,10 +671,10 @@
   // Set a Mac user agent.
   isUserAgentMac = true;
   speech.onKeyDown(cmdShiftPeriod);
-  assertTrue(speech.isRecognizing_());
+  assertTrue(speech.isRecognizing());
 
   speech.onKeyDown(cmdShiftPeriod);
-  assertTrue(speech.isRecognizing_());
+  assertTrue(speech.isRecognizing());
 };
 
 
@@ -707,7 +707,7 @@
 
   speech.onClick_(
       /*submitQuery=*/false, /*shouldRetry=*/true, /*navigatingAway=*/false);
-  assertTrue(speech.isRecognizing_());
+  assertTrue(speech.isRecognizing());
   assertEquals(speech.State_.STARTED, speech.currentState_);
 };
 
@@ -739,7 +739,7 @@
   speech.recognition_.onspeechstart(null);
   speech.recognition_.onnomatch(null);
 
-  assertFalse(speech.isRecognizing_());
+  assertFalse(speech.isRecognizing());
   assertEquals(1, test.speech.recognitionActiveCount);
   assertEquals(1, test.speech.viewActiveCount);
   assertEquals(RecognitionError.NO_MATCH, test.speech.viewState.error);
@@ -880,7 +880,7 @@
  * Validates that speech is currently inactive and ready to start recognition.
  */
 test.speech.validateInactive = function() {
-  assertFalse(speech.isRecognizing_());
+  assertFalse(speech.isRecognizing());
   assertEquals(0, test.speech.recognitionActiveCount);
   assertEquals(0, test.speech.viewActiveCount);
   assertEquals('', speech.interimResult_);
diff --git a/chrome/test/data/local_ntp/voice_text_browsertest.js b/chrome/test/data/local_ntp/voice_text_browsertest.js
index 71c9b15..a4cd8fc 100644
--- a/chrome/test/data/local_ntp/voice_text_browsertest.js
+++ b/chrome/test/data/local_ntp/voice_text_browsertest.js
@@ -176,10 +176,13 @@
 
 
 /**
- * Test showing the listening message when the ready message is shown.
+ * Test showing the listening message when the ready message is shown,
+ * and results have not yet been received.
  */
 test.text.testListeningMessageWhenReady = function() {
   text.interim_.textContent = 'Ready';
+  test.text.stubs.replace(speech, 'isRecognizing', () => true);
+  test.text.stubs.replace(speech, 'hasReceivedResults', () => false);
 
   test.text.clock.setTime(1);
   text.startListeningMessageAnimation_();
@@ -197,10 +200,13 @@
 
 
 /**
- * Test not showing the listening message when the ready message is not shown.
+ * Test not showing the listening message when the ready message is shown,
+ * but results were already received.
  */
-test.text.testListeningMessageWhenNotReady = function() {
-  text.interim_.textContent = 'some text';
+test.text.testListeningMessageWhenReadyButResultsAlreadyReceived = function() {
+  text.interim_.textContent = 'Ready';
+  test.text.stubs.replace(speech, 'isRecognizing', () => true);
+  test.text.stubs.replace(speech, 'hasReceivedResults', () => true);
 
   test.text.clock.setTime(1);
   text.startListeningMessageAnimation_();
@@ -211,7 +217,32 @@
   test.text.clock.advanceTime(2000);
   test.text.clock.pendingTimeouts.shift().callback();
 
-  assertEquals('some text', text.interim_.textContent);
+  // The message was *not* changed to "Listening".
+  assertEquals('Ready', text.interim_.textContent);
+  assertEquals('', text.final_.textContent);
+  assertEquals(0, test.text.clock.pendingTimeouts.length);
+};
+
+
+/**
+ * Test showing the listening message when the ready message is not shown,
+ * and results have not yet been received.
+ */
+test.text.testListeningMessageWhenNotReady = function() {
+  text.interim_.textContent = 'some text';
+  test.text.stubs.replace(speech, 'isRecognizing', () => true);
+  test.text.stubs.replace(speech, 'hasReceivedResults', () => false);
+
+  test.text.clock.setTime(1);
+  text.startListeningMessageAnimation_();
+
+  assertEquals(1, test.text.clock.pendingTimeouts.length);
+  assertEquals(2001, test.text.clock.pendingTimeouts[0].activationTime);
+
+  test.text.clock.advanceTime(2000);
+  test.text.clock.pendingTimeouts.shift().callback();
+
+  assertEquals('Listening', text.interim_.textContent);
   assertEquals('', text.final_.textContent);
   assertEquals(0, test.text.clock.pendingTimeouts.length);
 };
@@ -219,7 +250,7 @@
 /**
  * Test not showing the listening message when the ready message is spoken.
  */
-test.text.testListeningMessageWhenNotReady = function() {
+test.text.testListeningMessageWhenReadySpoken = function() {
   // Show the "Ready" message.
   text.interim_.textContent = 'Ready';
   assertEquals('', text.final_.textContent);
diff --git a/components/metrics/BUILD.gn b/components/metrics/BUILD.gn
index 5aa6c47..98cc357 100644
--- a/components/metrics/BUILD.gn
+++ b/components/metrics/BUILD.gn
@@ -33,6 +33,8 @@
     "environment_recorder.h",
     "execution_phase.cc",
     "execution_phase.h",
+    "expired_histograms_checker.cc",
+    "expired_histograms_checker.h",
     "field_trials_provider.cc",
     "field_trials_provider.h",
     "file_metrics_provider.cc",
diff --git a/components/metrics/expired_histograms_checker.cc b/components/metrics/expired_histograms_checker.cc
new file mode 100644
index 0000000..2eb14e7
--- /dev/null
+++ b/components/metrics/expired_histograms_checker.cc
@@ -0,0 +1,21 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/metrics/expired_histograms_checker.h"
+
+#include <algorithm>
+
+namespace metrics {
+
+ExpiredHistogramsChecker::ExpiredHistogramsChecker(const uint64_t* array,
+                                                   size_t size)
+    : array_(array), size_(size) {}
+
+ExpiredHistogramsChecker::~ExpiredHistogramsChecker() {}
+
+bool ExpiredHistogramsChecker::ShouldRecord(uint64_t histogram_hash) const {
+  return !std::binary_search(array_, array_ + size_, histogram_hash);
+}
+
+}  // namespace metrics
diff --git a/components/metrics/expired_histograms_checker.h b/components/metrics/expired_histograms_checker.h
new file mode 100644
index 0000000..66834c8
--- /dev/null
+++ b/components/metrics/expired_histograms_checker.h
@@ -0,0 +1,35 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_METRICS_EXPIRED_HISTOGRAMS_CHECKER_H_
+#define COMPONENTS_METRICS_EXPIRED_HISTOGRAMS_CHECKER_H_
+
+#include <stdint.h>
+
+#include "base/macros.h"
+#include "base/metrics/record_histogram_checker.h"
+
+namespace metrics {
+
+// ExpiredHistogramsChecker implements RecordHistogramChecker interface
+// to avoid recording expired metrics.
+class ExpiredHistogramsChecker final : public base::RecordHistogramChecker {
+ public:
+  // Takes sorted in nondecreasing order array of histogram hashes and its size.
+  ExpiredHistogramsChecker(const uint64_t* array, size_t size);
+  ~ExpiredHistogramsChecker() override;
+
+  // Checks if the given |histogram_hash| corresponds to an expired histogram.
+  bool ShouldRecord(uint64_t histogram_hash) const override;
+
+ private:
+  const uint64_t* const array_;
+  const size_t size_;
+
+  DISALLOW_COPY_AND_ASSIGN(ExpiredHistogramsChecker);
+};
+
+}  // namespace metrics
+
+#endif  // COMPONENTS_METRICS_EXPIRED_HISTOGRAMS_CHECKER_H_
diff --git a/components/viz/service/hit_test/hit_test_aggregator.cc b/components/viz/service/hit_test/hit_test_aggregator.cc
index 3039072..fce4996 100644
--- a/components/viz/service/hit_test/hit_test_aggregator.cc
+++ b/components/viz/service/hit_test/hit_test_aggregator.cc
@@ -6,6 +6,7 @@
 
 #include "components/viz/common/hit_test/aggregated_hit_test_region.h"
 #include "components/viz/service/hit_test/hit_test_aggregator_delegate.h"
+#include "third_party/skia/include/core/SkMatrix44.h"
 
 namespace viz {
 
@@ -38,6 +39,17 @@
   return true;
 }
 
+void PrepareTransformForReadOnlySharedMemory(gfx::Transform* transform) {
+  // |transform| is going to be shared in read-only memory to HitTestQuery.
+  // However, if HitTestQuery tries to operate on it, then it is possible that
+  // it will attempt to perform write on the underlying SkMatrix44 [1], causing
+  // invalid memory write in read-only memory.
+  // [1]
+  // https://cs.chromium.org/chromium/src/third_party/skia/include/core/SkMatrix44.h?l=133
+  // Explicitly calling getType() to compute the type-mask in SkMatrix44.
+  transform->matrix().getType();
+}
+
 }  // namespace
 
 HitTestAggregator::HitTestAggregator(HitTestAggregatorDelegate* delegate)
@@ -176,6 +188,7 @@
   regions[0].flags = hit_test_region_list->flags;
   regions[0].rect = hit_test_region_list->bounds;
   regions[0].transform = hit_test_region_list->transform;
+  PrepareTransformForReadOnlySharedMemory(&regions[0].transform);
 
   size_t region_index = 1;
   for (const auto& region : hit_test_region_list->regions) {
@@ -230,6 +243,7 @@
         break;
     }
   }
+  PrepareTransformForReadOnlySharedMemory(&element->transform);
   DCHECK_GE(region_index - parent_index - 1, 0u);
   element->child_count = region_index - parent_index - 1;
   return region_index;
diff --git a/content/browser/browser_main_loop.cc b/content/browser/browser_main_loop.cc
index c703bd5..77a35f0 100644
--- a/content/browser/browser_main_loop.cc
+++ b/content/browser/browser_main_loop.cc
@@ -102,7 +102,7 @@
 #include "device/gamepad/gamepad_service.h"
 #include "gpu/vulkan/features.h"
 #include "media/audio/audio_manager.h"
-#include "media/audio/audio_system_impl.h"
+#include "media/audio/audio_system.h"
 #include "media/audio/audio_thread_impl.h"
 #include "media/base/media.h"
 #include "media/base/user_input_monitor.h"
@@ -1841,8 +1841,7 @@
         MediaInternals::GetInstance());
   }
   CHECK(audio_manager_);
-
-  audio_system_ = media::AudioSystemImpl::Create(audio_manager_.get());
+  audio_system_ = media::AudioSystem::CreateInstance();
   CHECK(audio_system_);
 }
 
diff --git a/content/browser/browser_main_loop.h b/content/browser/browser_main_loop.h
index d341e72..ee76dcf 100644
--- a/content/browser/browser_main_loop.h
+++ b/content/browser/browser_main_loop.h
@@ -332,8 +332,6 @@
   // |user_input_monitor_| has to outlive |audio_manager_|, so declared first.
   std::unique_ptr<media::UserInputMonitor> user_input_monitor_;
   std::unique_ptr<media::AudioManager> audio_manager_;
-  // Calls to |audio_system_| must not be posted to the audio thread if it
-  // differs from the UI one. See http://crbug.com/705455.
   std::unique_ptr<media::AudioSystem> audio_system_;
 
   std::unique_ptr<midi::MidiService> midi_service_;
diff --git a/content/browser/browsing_data/storage_partition_http_cache_data_remover.cc b/content/browser/browsing_data/storage_partition_http_cache_data_remover.cc
index 0b71b09..a405c15 100644
--- a/content/browser/browsing_data/storage_partition_http_cache_data_remover.cc
+++ b/content/browser/browsing_data/storage_partition_http_cache_data_remover.cc
@@ -11,7 +11,6 @@
 #include "content/browser/browsing_data/conditional_cache_deletion_helper.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/storage_partition.h"
-#include "net/base/sdch_manager.h"
 #include "net/disk_cache/blockfile/backend_impl.h"
 #include "net/disk_cache/disk_cache.h"
 #include "net/disk_cache/memory/mem_backend_impl.h"
@@ -129,15 +128,6 @@
             ->quic_stream_factory()
             ->ClearCachedStatesInCryptoConfig(url_predicate_);
 
-        // Clear SDCH dictionary state.
-        net::SdchManager* sdch_manager =
-            getter->GetURLRequestContext()->sdch_manager();
-        // The test is probably overkill, since chrome should always have an
-        // SdchManager.  But in general the URLRequestContext  is *not*
-        // guaranteed to have an SdchManager, so checking is wise.
-        if (sdch_manager)
-          sdch_manager->ClearData();
-
         rv = http_cache->GetBackend(
             &cache_,
             base::Bind(&StoragePartitionHttpCacheDataRemover::DoClearCache,
diff --git a/content/browser/renderer_host/media/audio_input_device_manager_unittest.cc b/content/browser/renderer_host/media/audio_input_device_manager_unittest.cc
index 441aa8d..0d5a5cf 100644
--- a/content/browser/renderer_host/media/audio_input_device_manager_unittest.cc
+++ b/content/browser/renderer_host/media/audio_input_device_manager_unittest.cc
@@ -80,9 +80,11 @@
   void SetUp() override {
     Initialize();
 
-    audio_system_ = media::AudioSystemImpl::Create(audio_manager_.get());
+    audio_system_ =
+        std::make_unique<media::AudioSystemImpl>(audio_manager_.get());
     manager_ = new AudioInputDeviceManager(audio_system_.get());
-    audio_input_listener_.reset(new MockAudioInputDeviceManagerListener());
+    audio_input_listener_ =
+        std::make_unique<MockAudioInputDeviceManagerListener>();
     manager_->RegisterListener(audio_input_listener_.get());
 
     // Wait until we get the list.
@@ -304,8 +306,8 @@
  protected:
   void Initialize() override {
     // MockAudioManager has no input and no output audio devices.
-    audio_manager_ = base::MakeUnique<media::MockAudioManager>(
-        base::MakeUnique<media::AudioThreadImpl>());
+    audio_manager_ = std::make_unique<media::MockAudioManager>(
+        std::make_unique<media::AudioThreadImpl>());
 
     // Devices to request from AudioInputDeviceManager.
     devices_.emplace_back(MEDIA_TAB_AUDIO_CAPTURE, "tab_capture",
diff --git a/content/browser/renderer_host/media/audio_input_renderer_host_unittest.cc b/content/browser/renderer_host/media/audio_input_renderer_host_unittest.cc
index af879d9..d10f2b2 100644
--- a/content/browser/renderer_host/media/audio_input_renderer_host_unittest.cc
+++ b/content/browser/renderer_host/media/audio_input_renderer_host_unittest.cc
@@ -263,10 +263,11 @@
     flags->AppendSwitch(switches::kUseFakeDeviceForMediaStream);
     flags->AppendSwitch(switches::kUseFakeUIForMediaStream);
 
-    audio_manager_.reset(new media::FakeAudioManager(
-        base::MakeUnique<media::TestAudioThread>(), &log_factory_));
-    audio_system_ = media::AudioSystemImpl::Create(audio_manager_.get());
-    media_stream_manager_ = base::MakeUnique<MediaStreamManager>(
+    audio_manager_ = std::make_unique<media::FakeAudioManager>(
+        std::make_unique<media::TestAudioThread>(), &log_factory_);
+    audio_system_ =
+        std::make_unique<media::AudioSystemImpl>(audio_manager_.get());
+    media_stream_manager_ = std::make_unique<MediaStreamManager>(
         audio_system_.get(), audio_manager_->GetTaskRunner());
     airh_ = new AudioInputRendererHostWithInterception(
         kRenderProcessId, kRendererPid, media::AudioManager::Get(),
diff --git a/content/browser/renderer_host/media/audio_output_authorization_handler_unittest.cc b/content/browser/renderer_host/media/audio_output_authorization_handler_unittest.cc
index 684afb7..a71893f 100644
--- a/content/browser/renderer_host/media/audio_output_authorization_handler_unittest.cc
+++ b/content/browser/renderer_host/media/audio_output_authorization_handler_unittest.cc
@@ -99,10 +99,11 @@
     // Starts thread bundle:
     RenderViewHostTestHarness::SetUp();
 
-    audio_manager_ = base::MakeUnique<media::FakeAudioManager>(
-        base::MakeUnique<media::AudioThreadImpl>(), &log_factory_);
-    audio_system_ = media::AudioSystemImpl::Create(audio_manager_.get());
-    media_stream_manager_ = base::MakeUnique<MediaStreamManager>(
+    audio_manager_ = std::make_unique<media::FakeAudioManager>(
+        std::make_unique<media::AudioThreadImpl>(), &log_factory_);
+    audio_system_ =
+        std::make_unique<media::AudioSystemImpl>(audio_manager_.get());
+    media_stream_manager_ = std::make_unique<MediaStreamManager>(
         audio_system_.get(), audio_manager_->GetTaskRunner());
 
     // Make sure everything is done initializing:
@@ -193,7 +194,7 @@
                             std::string()))
       .Times(1);
   std::unique_ptr<AudioOutputAuthorizationHandler> handler =
-      base::MakeUnique<AudioOutputAuthorizationHandler>(
+      std::make_unique<AudioOutputAuthorizationHandler>(
           GetAudioSystem(), GetMediaStreamManager(), process()->GetID(), kSalt);
 
   BrowserThread::PostTask(
@@ -215,7 +216,7 @@
                             std::string()))
       .Times(1);
   std::unique_ptr<AudioOutputAuthorizationHandler> handler =
-      base::MakeUnique<AudioOutputAuthorizationHandler>(
+      std::make_unique<AudioOutputAuthorizationHandler>(
           GetAudioSystem(), GetMediaStreamManager(), process()->GetID(), kSalt);
 
   BrowserThread::PostTask(
@@ -238,7 +239,7 @@
 
   MockAuthorizationCallback listener;
   std::unique_ptr<AudioOutputAuthorizationHandler> handler =
-      base::MakeUnique<AudioOutputAuthorizationHandler>(
+      std::make_unique<AudioOutputAuthorizationHandler>(
           GetAudioSystem(), GetMediaStreamManager(), process()->GetID(), kSalt);
   BrowserThread::PostTask(
       BrowserThread::IO, FROM_HERE,
@@ -270,7 +271,7 @@
       kSalt, SecurityOrigin(), raw_nondefault_id);
   MockAuthorizationCallback listener;
   std::unique_ptr<AudioOutputAuthorizationHandler> handler =
-      base::MakeUnique<AudioOutputAuthorizationHandler>(
+      std::make_unique<AudioOutputAuthorizationHandler>(
           GetAudioSystem(), GetMediaStreamManager(), process()->GetID(), kSalt);
   BrowserThread::PostTask(
       BrowserThread::IO, FROM_HERE,
@@ -297,7 +298,7 @@
 TEST_F(AudioOutputAuthorizationHandlerTest, AuthorizeInvalidDeviceId_NotFound) {
   MockAuthorizationCallback listener;
   std::unique_ptr<AudioOutputAuthorizationHandler> handler =
-      base::MakeUnique<AudioOutputAuthorizationHandler>(
+      std::make_unique<AudioOutputAuthorizationHandler>(
           GetAudioSystem(), GetMediaStreamManager(), process()->GetID(), kSalt);
 
   EXPECT_CALL(listener, Run(media::OUTPUT_DEVICE_STATUS_ERROR_NOT_FOUND, _,
@@ -331,7 +332,7 @@
       kSalt, origin, raw_nondefault_id);
   MockAuthorizationCallback listener;
   std::unique_ptr<AudioOutputAuthorizationHandler> handler =
-      base::MakeUnique<AudioOutputAuthorizationHandler>(
+      std::make_unique<AudioOutputAuthorizationHandler>(
           GetAudioSystem(), GetMediaStreamManager(), process()->GetID(), kSalt);
   NavigateAndCommit(url);
 
@@ -356,7 +357,7 @@
        AuthorizeWithSessionIdWithoutDevice_GivesDefault) {
   MockAuthorizationCallback listener;
   std::unique_ptr<AudioOutputAuthorizationHandler> handler =
-      base::MakeUnique<AudioOutputAuthorizationHandler>(
+      std::make_unique<AudioOutputAuthorizationHandler>(
           GetAudioSystem(), GetMediaStreamManager(), process()->GetID(), kSalt);
 
   EXPECT_CALL(listener, Run(media::OUTPUT_DEVICE_STATUS_OK, _, kDefaultDeviceId,
diff --git a/content/browser/renderer_host/media/audio_renderer_host_unittest.cc b/content/browser/renderer_host/media/audio_renderer_host_unittest.cc
index c1d4512..9e2f1fb 100644
--- a/content/browser/renderer_host/media/audio_renderer_host_unittest.cc
+++ b/content/browser/renderer_host/media/audio_renderer_host_unittest.cc
@@ -212,7 +212,8 @@
     RenderViewHostTestHarness::SetUp();
     audio_manager_ =
         base::MakeUnique<FakeAudioManagerWithAssociations>(&log_factory_);
-    audio_system_ = media::AudioSystemImpl::Create(audio_manager_.get());
+    audio_system_ =
+        std::make_unique<media::AudioSystemImpl>(audio_manager_.get());
     media_stream_manager_ = base::MakeUnique<MediaStreamManager>(
         audio_system_.get(), audio_manager_->GetTaskRunner());
     auth_run_loop_ = base::MakeUnique<base::RunLoop>();
diff --git a/content/browser/renderer_host/media/media_devices_dispatcher_host_unittest.cc b/content/browser/renderer_host/media/media_devices_dispatcher_host_unittest.cc
index f0daa8a..6b53458 100644
--- a/content/browser/renderer_host/media/media_devices_dispatcher_host_unittest.cc
+++ b/content/browser/renderer_host/media/media_devices_dispatcher_host_unittest.cc
@@ -93,24 +93,25 @@
         base::StringPrintf("video-input-default-id=%s, "
                            "audio-input-default-id=%s",
                            kDefaultVideoDeviceID, kDefaultAudioDeviceID));
-    audio_manager_.reset(new media::MockAudioManager(
-        base::MakeUnique<media::TestAudioThread>()));
-    audio_system_ = media::AudioSystemImpl::Create(audio_manager_.get());
+    audio_manager_ = std::make_unique<media::MockAudioManager>(
+        std::make_unique<media::TestAudioThread>());
+    audio_system_ =
+        std::make_unique<media::AudioSystemImpl>(audio_manager_.get());
 
     auto video_capture_device_factory =
-        base::MakeUnique<media::FakeVideoCaptureDeviceFactory>();
+        std::make_unique<media::FakeVideoCaptureDeviceFactory>();
     video_capture_device_factory_ = video_capture_device_factory.get();
-    auto video_capture_system = base::MakeUnique<media::VideoCaptureSystemImpl>(
+    auto video_capture_system = std::make_unique<media::VideoCaptureSystemImpl>(
         std::move(video_capture_device_factory));
     auto video_capture_provider =
-        base::MakeUnique<InProcessVideoCaptureProvider>(
+        std::make_unique<InProcessVideoCaptureProvider>(
             std::move(video_capture_system),
             base::ThreadTaskRunnerHandle::Get(), kIgnoreLogMessageCB);
 
-    media_stream_manager_ = base::MakeUnique<MediaStreamManager>(
+    media_stream_manager_ = std::make_unique<MediaStreamManager>(
         audio_system_.get(), audio_manager_->GetTaskRunner(),
         std::move(video_capture_provider));
-    host_ = base::MakeUnique<MediaDevicesDispatcherHost>(
+    host_ = std::make_unique<MediaDevicesDispatcherHost>(
         kProcessId, kRenderId, browser_context_.GetMediaDeviceIDSalt(),
         media_stream_manager_.get());
     host_->SetSecurityOriginForTesting(origin_);
@@ -314,7 +315,7 @@
 
   void SubscribeAndWaitForResult(bool has_permission) {
     host_->SetPermissionChecker(
-        base::MakeUnique<MediaDevicesPermissionChecker>(has_permission));
+        std::make_unique<MediaDevicesPermissionChecker>(has_permission));
     uint32_t subscription_id = 0u;
     for (size_t i = 0; i < NUM_MEDIA_DEVICE_TYPES; ++i) {
       MediaDeviceType type = static_cast<MediaDeviceType>(i);
diff --git a/content/browser/renderer_host/media/media_devices_manager_unittest.cc b/content/browser/renderer_host/media/media_devices_manager_unittest.cc
index 8e81ce4..7cb7e30 100644
--- a/content/browser/renderer_host/media/media_devices_manager_unittest.cc
+++ b/content/browser/renderer_host/media/media_devices_manager_unittest.cc
@@ -143,8 +143,9 @@
 
  protected:
   void SetUp() override {
-    audio_manager_.reset(new MockAudioManager());
-    audio_system_ = media::AudioSystemImpl::Create(audio_manager_.get());
+    audio_manager_ = std::make_unique<MockAudioManager>();
+    audio_system_ =
+        std::make_unique<media::AudioSystemImpl>(audio_manager_.get());
     auto video_capture_device_factory =
         base::MakeUnique<MockVideoCaptureDeviceFactory>();
     video_capture_device_factory_ = video_capture_device_factory.get();
diff --git a/content/browser/renderer_host/media/media_stream_dispatcher_host_unittest.cc b/content/browser/renderer_host/media/media_stream_dispatcher_host_unittest.cc
index 99dbf60..d620618 100644
--- a/content/browser/renderer_host/media/media_stream_dispatcher_host_unittest.cc
+++ b/content/browser/renderer_host/media/media_stream_dispatcher_host_unittest.cc
@@ -238,21 +238,22 @@
   MediaStreamDispatcherHostTest()
       : thread_bundle_(TestBrowserThreadBundle::IO_MAINLOOP),
         origin_(GURL("https://test.com")) {
-    audio_manager_.reset(new media::MockAudioManager(
-        base::MakeUnique<media::TestAudioThread>()));
-    audio_system_ = media::AudioSystemImpl::Create(audio_manager_.get());
+    audio_manager_ = std::make_unique<media::MockAudioManager>(
+        std::make_unique<media::TestAudioThread>());
+    audio_system_ =
+        std::make_unique<media::AudioSystemImpl>(audio_manager_.get());
     // Make sure we use fake devices to avoid long delays.
     base::CommandLine::ForCurrentProcess()->AppendSwitch(
         switches::kUseFakeDeviceForMediaStream);
     auto mock_video_capture_provider =
-        base::MakeUnique<MockVideoCaptureProvider>();
+        std::make_unique<MockVideoCaptureProvider>();
     mock_video_capture_provider_ = mock_video_capture_provider.get();
     // Create our own MediaStreamManager.
-    media_stream_manager_ = base::MakeUnique<MediaStreamManager>(
+    media_stream_manager_ = std::make_unique<MediaStreamManager>(
         audio_system_.get(), audio_manager_->GetTaskRunner(),
         std::move(mock_video_capture_provider));
 
-    host_ = base::MakeUnique<MockMediaStreamDispatcherHost>(
+    host_ = std::make_unique<MockMediaStreamDispatcherHost>(
         browser_context_.GetMediaDeviceIDSalt(),
         base::ThreadTaskRunnerHandle::Get(), media_stream_manager_.get());
     mojom::MediaStreamDispatcherPtr dispatcher =
@@ -791,7 +792,7 @@
   StreamControls controls(false, true);
 
   base::Closure close_callback;
-  auto stream_ui = base::MakeUnique<MockMediaStreamUIProxy>();
+  auto stream_ui = std::make_unique<MockMediaStreamUIProxy>();
   EXPECT_CALL(*stream_ui, MockOnStarted(_))
       .WillOnce(SaveArg<0>(&close_callback));
   media_stream_manager_->UseFakeUIForTests(std::move(stream_ui));
diff --git a/content/browser/renderer_host/media/media_stream_manager_unittest.cc b/content/browser/renderer_host/media/media_stream_manager_unittest.cc
index 097df8a..9e95110 100644
--- a/content/browser/renderer_host/media/media_stream_manager_unittest.cc
+++ b/content/browser/renderer_host/media/media_stream_manager_unittest.cc
@@ -67,7 +67,7 @@
 class MockAudioManager : public AudioManagerPlatform {
  public:
   MockAudioManager()
-      : AudioManagerPlatform(base::MakeUnique<media::TestAudioThread>(),
+      : AudioManagerPlatform(std::make_unique<media::TestAudioThread>(),
                              &fake_audio_log_factory_),
         num_output_devices_(2),
         num_input_devices_(2) {}
@@ -135,9 +135,10 @@
  public:
   MediaStreamManagerTest()
       : thread_bundle_(content::TestBrowserThreadBundle::IO_MAINLOOP) {
-    audio_manager_.reset(new MockAudioManager());
-    audio_system_ = media::AudioSystemImpl::Create(audio_manager_.get());
-    media_stream_manager_ = base::MakeUnique<MediaStreamManager>(
+    audio_manager_ = std::make_unique<MockAudioManager>();
+    audio_system_ =
+        std::make_unique<media::AudioSystemImpl>(audio_manager_.get());
+    media_stream_manager_ = std::make_unique<MediaStreamManager>(
         audio_system_.get(), audio_manager_->GetTaskRunner());
     base::RunLoop().RunUntilIdle();
   }
diff --git a/content/browser/renderer_host/media/video_capture_unittest.cc b/content/browser/renderer_host/media/video_capture_unittest.cc
index a730d19..9b3345d 100644
--- a/content/browser/renderer_host/media/video_capture_unittest.cc
+++ b/content/browser/renderer_host/media/video_capture_unittest.cc
@@ -112,9 +112,10 @@
  public:
   VideoCaptureTest()
       : thread_bundle_(content::TestBrowserThreadBundle::IO_MAINLOOP),
-        audio_manager_(new media::MockAudioManager(
-            base::MakeUnique<media::TestAudioThread>())),
-        audio_system_(media::AudioSystemImpl::Create(audio_manager_.get())),
+        audio_manager_(std::make_unique<media::MockAudioManager>(
+            std::make_unique<media::TestAudioThread>())),
+        audio_system_(
+            std::make_unique<media::AudioSystemImpl>(audio_manager_.get())),
         task_runner_(base::ThreadTaskRunnerHandle::Get()),
         opened_session_id_(kInvalidMediaCaptureSessionId),
         observer_binding_(this) {}
diff --git a/content/browser/speech/speech_recognition_browsertest.cc b/content/browser/speech/speech_recognition_browsertest.cc
index 2d9d0ce..3f6bfbc 100644
--- a/content/browser/speech/speech_recognition_browsertest.cc
+++ b/content/browser/speech/speech_recognition_browsertest.cc
@@ -122,11 +122,12 @@
     ASSERT_TRUE(SpeechRecognitionManagerImpl::GetInstance());
     media::AudioManager::StartHangMonitorIfNeeded(
         BrowserThread::GetTaskRunnerForThread(BrowserThread::IO));
-    audio_manager_.reset(new media::MockAudioManager(
-        base::MakeUnique<media::AudioThreadImpl>()));
+    audio_manager_ = std::make_unique<media::MockAudioManager>(
+        std::make_unique<media::AudioThreadImpl>());
     audio_manager_->SetInputStreamParameters(
         media::AudioParameters::UnavailableDeviceParams());
-    audio_system_ = media::AudioSystemImpl::Create(audio_manager_.get());
+    audio_system_ =
+        std::make_unique<media::AudioSystemImpl>(audio_manager_.get());
     SpeechRecognizerImpl::SetAudioEnvironmentForTesting(audio_system_.get(),
                                                         audio_manager_.get());
   }
diff --git a/content/browser/speech/speech_recognizer_impl_unittest.cc b/content/browser/speech/speech_recognizer_impl_unittest.cc
index 7ad2792..3dd2fb2 100644
--- a/content/browser/speech/speech_recognizer_impl_unittest.cc
+++ b/content/browser/speech/speech_recognizer_impl_unittest.cc
@@ -69,7 +69,8 @@
         base::MakeUnique<media::TestAudioThread>(true)));
     audio_manager_->SetInputStreamParameters(
         media::AudioParameters::UnavailableDeviceParams());
-    audio_system_ = media::AudioSystemImpl::Create(audio_manager_.get());
+    audio_system_ =
+        std::make_unique<media::AudioSystemImpl>(audio_manager_.get());
     recognizer_ = new SpeechRecognizerImpl(
         this, audio_system_.get(), audio_manager_.get(), kTestingSessionId,
         false, false, sr_engine);
diff --git a/content/browser/webrtc/webrtc_content_browsertest_base.cc b/content/browser/webrtc/webrtc_content_browsertest_base.cc
index 4e7c630..d6b66ba8 100644
--- a/content/browser/webrtc/webrtc_content_browsertest_base.cc
+++ b/content/browser/webrtc/webrtc_content_browsertest_base.cc
@@ -113,7 +113,8 @@
 bool WebRtcContentBrowserTestBase::HasAudioOutputDevices() {
   bool has_devices = false;
   base::RunLoop run_loop;
-  media::AudioSystem::Get()->HasOutputDevices(base::BindOnce(
+  auto audio_system = media::AudioSystem::CreateInstance();
+  audio_system->HasOutputDevices(base::BindOnce(
       [](base::Closure finished_callback, bool* result, bool received) {
         *result = received;
         finished_callback.Run();
diff --git a/content/renderer/accessibility/blink_ax_tree_source.cc b/content/renderer/accessibility/blink_ax_tree_source.cc
index b53793d..7eb04af 100644
--- a/content/renderer/accessibility/blink_ax_tree_source.cc
+++ b/content/renderer/accessibility/blink_ax_tree_source.cc
@@ -704,11 +704,19 @@
         dst->role == ui::AX_ROLE_SLIDER ||
         dst->role == ui::AX_ROLE_SPIN_BUTTON ||
         (dst->role == ui::AX_ROLE_SPLITTER && src.CanSetFocusAttribute())) {
-      dst->AddFloatAttribute(ui::AX_ATTR_VALUE_FOR_RANGE, src.ValueForRange());
-      dst->AddFloatAttribute(ui::AX_ATTR_MAX_VALUE_FOR_RANGE,
-                             src.MaxValueForRange());
-      dst->AddFloatAttribute(ui::AX_ATTR_MIN_VALUE_FOR_RANGE,
-                             src.MinValueForRange());
+      float value;
+      if (src.ValueForRange(&value))
+        dst->AddFloatAttribute(ui::AX_ATTR_VALUE_FOR_RANGE, value);
+
+      float max_value;
+      if (src.MaxValueForRange(&max_value)) {
+        dst->AddFloatAttribute(ui::AX_ATTR_MAX_VALUE_FOR_RANGE, max_value);
+      }
+
+      float min_value;
+      if (src.MinValueForRange(&min_value)) {
+        dst->AddFloatAttribute(ui::AX_ATTR_MIN_VALUE_FOR_RANGE, min_value);
+      }
     }
 
     if (dst->role == ui::AX_ROLE_DIALOG ||
diff --git a/content/shell/test_runner/web_ax_object_proxy.cc b/content/shell/test_runner/web_ax_object_proxy.cc
index 92da2d0..5651fb7 100644
--- a/content/shell/test_runner/web_ax_object_proxy.cc
+++ b/content/shell/test_runner/web_ax_object_proxy.cc
@@ -796,22 +796,30 @@
 
 int WebAXObjectProxy::IntValue() {
   accessibility_object_.UpdateLayoutAndCheckValidity();
-  if (accessibility_object_.SupportsRangeValue())
-    return accessibility_object_.ValueForRange();
-  else if (accessibility_object_.Role() == blink::kWebAXRoleHeading)
+
+  if (accessibility_object_.SupportsRangeValue()) {
+    float value = 0.0f;
+    accessibility_object_.ValueForRange(&value);
+    return static_cast<int>(value);
+  } else if (accessibility_object_.Role() == blink::kWebAXRoleHeading) {
     return accessibility_object_.HeadingLevel();
-  else
+  } else {
     return atoi(accessibility_object_.StringValue().Utf8().data());
+  }
 }
 
 int WebAXObjectProxy::MinValue() {
   accessibility_object_.UpdateLayoutAndCheckValidity();
-  return accessibility_object_.MinValueForRange();
+  float min_value = 0.0f;
+  accessibility_object_.MinValueForRange(&min_value);
+  return min_value;
 }
 
 int WebAXObjectProxy::MaxValue() {
   accessibility_object_.UpdateLayoutAndCheckValidity();
-  return accessibility_object_.MaxValueForRange();
+  float max_value = 0.0f;
+  accessibility_object_.MaxValueForRange(&max_value);
+  return max_value;
 }
 
 std::string WebAXObjectProxy::ValueDescription() {
diff --git a/content/test/data/accessibility/aria/aria-current-expected-blink.txt b/content/test/data/accessibility/aria/aria-current-expected-blink.txt
index c3d25b1..8a8e474 100644
--- a/content/test/data/accessibility/aria/aria-current-expected-blink.txt
+++ b/content/test/data/accessibility/aria/aria-current-expected-blink.txt
@@ -2,9 +2,13 @@
 ++link name='Section one'
 ++++staticText name='Section one'
 ++++++inlineTextBox name='Section one'
+++staticText name=' '
+++++inlineTextBox name=' '
 ++link name='Section two'
 ++++staticText name='Section two'
 ++++++inlineTextBox name='Section two'
+++staticText name=' '
+++++inlineTextBox name=' '
 ++link name='Section three' ariaCurrentState=location
 ++++staticText name='Section three'
 ++++++inlineTextBox name='Section three'
@@ -31,4 +35,4 @@
 ++++staticText name=' '
 ++++++inlineTextBox name=' '
 ++++staticText name='Span 3'
-++++++inlineTextBox name='Span 3'
+++++++inlineTextBox name='Span 3'
\ No newline at end of file
diff --git a/content/test/data/accessibility/aria/aria-current-expected-win.txt b/content/test/data/accessibility/aria/aria-current-expected-win.txt
index e795993..710cfc0 100644
--- a/content/test/data/accessibility/aria/aria-current-expected-win.txt
+++ b/content/test/data/accessibility/aria/aria-current-expected-win.txt
@@ -1,8 +1,10 @@
 ROLE_SYSTEM_DOCUMENT READONLY FOCUSABLE
 ++ROLE_SYSTEM_LINK name='Section one' FOCUSABLE
 ++++ROLE_SYSTEM_STATICTEXT name='Section one'
+++ROLE_SYSTEM_STATICTEXT name=' '
 ++ROLE_SYSTEM_LINK name='Section two' FOCUSABLE
 ++++ROLE_SYSTEM_STATICTEXT name='Section two'
+++ROLE_SYSTEM_STATICTEXT name=' '
 ++ROLE_SYSTEM_LINK name='Section three' FOCUSABLE current:location
 ++++ROLE_SYSTEM_STATICTEXT name='Section three'
 ++ROLE_SYSTEM_WHITESPACE name='<newline>'
@@ -19,4 +21,4 @@
 ++++IA2_ROLE_SECTION current:true
 ++++++ROLE_SYSTEM_STATICTEXT name='Span 2'
 ++++ROLE_SYSTEM_STATICTEXT name=' '
-++++ROLE_SYSTEM_STATICTEXT name='Span 3'
+++++ROLE_SYSTEM_STATICTEXT name='Span 3'
\ No newline at end of file
diff --git a/content/test/data/accessibility/aria/aria-orientation-expected-blink.txt b/content/test/data/accessibility/aria/aria-orientation-expected-blink.txt
index af0402f..7596c05 100644
--- a/content/test/data/accessibility/aria/aria-orientation-expected-blink.txt
+++ b/content/test/data/accessibility/aria/aria-orientation-expected-blink.txt
@@ -14,12 +14,12 @@
 ++radioGroup
 ++radioGroup horizontal
 ++radioGroup vertical
-++scrollBar vertical valueForRange=0.00 minValueForRange=0.00 maxValueForRange=0.00
-++scrollBar horizontal valueForRange=0.00 minValueForRange=0.00 maxValueForRange=0.00
-++scrollBar vertical valueForRange=0.00 minValueForRange=0.00 maxValueForRange=0.00
-++slider horizontal valueForRange=0.00 minValueForRange=0.00 maxValueForRange=0.00
-++slider horizontal valueForRange=0.00 minValueForRange=0.00 maxValueForRange=0.00
-++slider vertical valueForRange=0.00 minValueForRange=0.00 maxValueForRange=0.00
+++scrollBar vertical
+++scrollBar horizontal
+++scrollBar vertical
+++slider horizontal
+++slider horizontal
+++slider vertical
 ++splitter horizontal
 ++splitter horizontal
 ++splitter vertical
diff --git a/content/test/data/accessibility/aria/aria-orientation-expected-mac.txt b/content/test/data/accessibility/aria/aria-orientation-expected-mac.txt
index 94bf407..5aedaa2 100644
--- a/content/test/data/accessibility/aria/aria-orientation-expected-mac.txt
+++ b/content/test/data/accessibility/aria/aria-orientation-expected-mac.txt
@@ -14,12 +14,12 @@
 ++AXRadioGroup
 ++AXRadioGroup AXOrientation='AXHorizontalOrientation'
 ++AXRadioGroup AXOrientation='AXVerticalOrientation'
-++AXScrollBar AXValue='0' AXOrientation='AXVerticalOrientation'
-++AXScrollBar AXValue='0' AXOrientation='AXHorizontalOrientation'
-++AXScrollBar AXValue='0' AXOrientation='AXVerticalOrientation'
-++AXSlider AXValue='0' AXOrientation='AXHorizontalOrientation'
-++AXSlider AXValue='0' AXOrientation='AXHorizontalOrientation'
-++AXSlider AXValue='0' AXOrientation='AXVerticalOrientation'
+++AXScrollBar AXOrientation='AXVerticalOrientation'
+++AXScrollBar AXOrientation='AXHorizontalOrientation'
+++AXScrollBar AXOrientation='AXVerticalOrientation'
+++AXSlider AXOrientation='AXHorizontalOrientation'
+++AXSlider AXOrientation='AXHorizontalOrientation'
+++AXSlider AXOrientation='AXVerticalOrientation'
 ++AXSplitter AXOrientation='AXHorizontalOrientation'
 ++AXSplitter AXOrientation='AXHorizontalOrientation'
 ++AXSplitter AXOrientation='AXVerticalOrientation'
@@ -37,4 +37,4 @@
 ++AXTable AXOrientation='AXHorizontalOrientation'
 ++++AXGroup
 ++AXTable AXOrientation='AXVerticalOrientation'
-++++AXGroup
+++++AXGroup
\ No newline at end of file
diff --git a/content/test/data/accessibility/aria/aria-progressbar-expected-blink.txt b/content/test/data/accessibility/aria/aria-progressbar-expected-blink.txt
index 12cd448..acd7ae1 100644
--- a/content/test/data/accessibility/aria/aria-progressbar-expected-blink.txt
+++ b/content/test/data/accessibility/aria/aria-progressbar-expected-blink.txt
@@ -1,3 +1,3 @@
 rootWebArea
 ++progressIndicator valueForRange=3.00 minValueForRange=1.00 maxValueForRange=37.00
-++progressIndicator value='three' valueForRange=0.00 minValueForRange=1.00 maxValueForRange=96.00
\ No newline at end of file
+++progressIndicator value='three' minValueForRange=1.00 maxValueForRange=96.00
\ No newline at end of file
diff --git a/content/test/data/accessibility/aria/aria-progressbar-expected-mac.txt b/content/test/data/accessibility/aria/aria-progressbar-expected-mac.txt
index af63959..7f99082 100644
--- a/content/test/data/accessibility/aria/aria-progressbar-expected-mac.txt
+++ b/content/test/data/accessibility/aria/aria-progressbar-expected-mac.txt
@@ -1,3 +1,3 @@
 AXWebArea AXRoleDescription='HTML content'
 ++AXProgressIndicator AXRoleDescription='progress indicator' AXValue='3' AXMinValue='1' AXMaxValue='37'
-++AXProgressIndicator AXRoleDescription='progress indicator' AXValue='0' AXMinValue='1' AXMaxValue='96' AXValueDescription='three'
+++AXProgressIndicator AXRoleDescription='progress indicator' AXValue='three' AXMinValue='1' AXMaxValue='96' AXValueDescription='three'
\ No newline at end of file
diff --git a/content/test/data/accessibility/aria/aria-progressbar-expected-win.txt b/content/test/data/accessibility/aria/aria-progressbar-expected-win.txt
index 3285084..ba428388 100644
--- a/content/test/data/accessibility/aria/aria-progressbar-expected-win.txt
+++ b/content/test/data/accessibility/aria/aria-progressbar-expected-win.txt
@@ -1,3 +1,3 @@
 ROLE_SYSTEM_DOCUMENT READONLY FOCUSABLE
 ++ROLE_SYSTEM_PROGRESSBAR value='3' READONLY xml-roles:progressbar valuetext:3 currentValue=3.00 minimumValue=1.00 maximumValue=37.00
-++ROLE_SYSTEM_PROGRESSBAR value='three' READONLY xml-roles:progressbar valuetext:three currentValue=0.00 minimumValue=1.00 maximumValue=96.00
+++ROLE_SYSTEM_PROGRESSBAR value='three' READONLY xml-roles:progressbar valuetext:three minimumValue=1.00 maximumValue=96.00
\ No newline at end of file
diff --git a/content/test/data/accessibility/aria/aria-readonly-expected-mac.txt b/content/test/data/accessibility/aria/aria-readonly-expected-mac.txt
index 4935239..501c9b7 100644
--- a/content/test/data/accessibility/aria/aria-readonly-expected-mac.txt
+++ b/content/test/data/accessibility/aria/aria-readonly-expected-mac.txt
@@ -15,8 +15,8 @@
 ++AXComboBox AXDescription='Readonly combobox'
 ++AXList AXDescription='Readonly listbox'
 ++AXRadioGroup AXDescription='Readonly radiogroup'
-++AXSlider AXValue='0' AXDescription='Readonly slider'
-++AXIncrementor AXValue='0' AXDescription='Readonly spinbutton'
+++AXSlider AXDescription='Readonly slider'
+++AXIncrementor AXDescription='Readonly spinbutton'
 ++AXMenuItem AXValue='0' AXDescription='Readonly menuitemcheckbox'
 ++AXMenuItem AXValue='0' AXDescription='Readonly menuitemradio'
 ++AXTextField AXDescription='Readonly searchbox'
diff --git a/content/test/data/accessibility/aria/aria-scrollbar-expected-blink.txt b/content/test/data/accessibility/aria/aria-scrollbar-expected-blink.txt
index 674742a..f30ca591 100644
--- a/content/test/data/accessibility/aria/aria-scrollbar-expected-blink.txt
+++ b/content/test/data/accessibility/aria/aria-scrollbar-expected-blink.txt
@@ -1,3 +1,3 @@
 rootWebArea
-++scrollBar vertical valueForRange=55.00 minValueForRange=0.00 maxValueForRange=0.00
-++scrollBar horizontal valueForRange=55.00 minValueForRange=0.00 maxValueForRange=0.00
\ No newline at end of file
+++scrollBar vertical valueForRange=55.00
+++scrollBar horizontal valueForRange=55.00
\ No newline at end of file
diff --git a/content/test/data/accessibility/aria/aria-valuenow-expected-blink.txt b/content/test/data/accessibility/aria/aria-valuenow-expected-blink.txt
index f234f02..8c9f1d4 100644
--- a/content/test/data/accessibility/aria/aria-valuenow-expected-blink.txt
+++ b/content/test/data/accessibility/aria/aria-valuenow-expected-blink.txt
@@ -1,2 +1,2 @@
 rootWebArea
-++progressIndicator valueForRange=3.00 minValueForRange=0.00 maxValueForRange=0.00
\ No newline at end of file
+++progressIndicator valueForRange=3.00
\ No newline at end of file
diff --git a/content/test/data/accessibility/aria/aria-valuetext-expected-blink.txt b/content/test/data/accessibility/aria/aria-valuetext-expected-blink.txt
index 74a3b40..3283349 100644
--- a/content/test/data/accessibility/aria/aria-valuetext-expected-blink.txt
+++ b/content/test/data/accessibility/aria/aria-valuetext-expected-blink.txt
@@ -1,2 +1,2 @@
 rootWebArea
-++progressIndicator valueForRange=0.00 minValueForRange=1.00 maxValueForRange=96.00
\ No newline at end of file
+++progressIndicator minValueForRange=1.00 maxValueForRange=96.00
\ No newline at end of file
diff --git a/content/test/data/accessibility/aria/aria-valuetext-expected-mac.txt b/content/test/data/accessibility/aria/aria-valuetext-expected-mac.txt
index 0b422ae..856fd3d 100644
--- a/content/test/data/accessibility/aria/aria-valuetext-expected-mac.txt
+++ b/content/test/data/accessibility/aria/aria-valuetext-expected-mac.txt
@@ -1,2 +1,2 @@
 AXWebArea AXRoleDescription='HTML content'
-++AXProgressIndicator AXRoleDescription='progress indicator' AXValue='0' AXMinValue='1' AXMaxValue='96' AXValueDescription='three'
+++AXProgressIndicator AXRoleDescription='progress indicator' AXValue='three' AXMinValue='1' AXMaxValue='96' AXValueDescription='three'
\ No newline at end of file
diff --git a/content/test/data/accessibility/aria/aria-valuetext-expected-win.txt b/content/test/data/accessibility/aria/aria-valuetext-expected-win.txt
index cf62a3b..ac00f51 100644
--- a/content/test/data/accessibility/aria/aria-valuetext-expected-win.txt
+++ b/content/test/data/accessibility/aria/aria-valuetext-expected-win.txt
@@ -1,2 +1,2 @@
 ROLE_SYSTEM_DOCUMENT READONLY FOCUSABLE
-++ROLE_SYSTEM_PROGRESSBAR READONLY xml-roles:progressbar valuetext:three currentValue=0.00 minimumValue=1.00 maximumValue=96.00
+++ROLE_SYSTEM_PROGRESSBAR READONLY xml-roles:progressbar valuetext:three minimumValue=1.00 maximumValue=96.00
\ No newline at end of file
diff --git a/content/test/data/accessibility/html/a-name-calc-expected-android.txt b/content/test/data/accessibility/html/a-name-calc-expected-android.txt
index 6667beb..9358676 100644
--- a/content/test/data/accessibility/html/a-name-calc-expected-android.txt
+++ b/content/test/data/accessibility/html/a-name-calc-expected-android.txt
@@ -1,7 +1,10 @@
 android.webkit.WebView focusable focused scrollable
 ++android.view.View role_description='link' clickable focusable link name='InnerText0'
+++android.view.View name=' '
 ++android.view.View role_description='link' clickable focusable link name='InnerText1' hint='Title1'
+++android.view.View name=' '
 ++android.view.View role_description='link' clickable focusable link name='Title2'
+++android.view.View name=' '
 ++android.view.View role_description='link' clickable focusable link name='LabelledBy3'
 ++android.view.View role_description='link' clickable focusable link name='Title4'
 ++android.view.View role_description='link' clickable focusable link name='Label5'
diff --git a/content/test/data/accessibility/html/a-name-calc-expected-blink.txt b/content/test/data/accessibility/html/a-name-calc-expected-blink.txt
index a388995..57e73a2 100644
--- a/content/test/data/accessibility/html/a-name-calc-expected-blink.txt
+++ b/content/test/data/accessibility/html/a-name-calc-expected-blink.txt
@@ -2,12 +2,18 @@
 ++link name='InnerText0' nameFrom=contents
 ++++staticText name='InnerText0' nameFrom=contents
 ++++++inlineTextBox name='InnerText0' nameFrom=contents
+++staticText name=' ' nameFrom=contents
+++++inlineTextBox name=' ' nameFrom=contents
 ++link description='Title1' name='InnerText1' nameFrom=contents descriptionFrom=attribute
 ++++staticText name='InnerText1' nameFrom=contents
 ++++++inlineTextBox name='InnerText1' nameFrom=contents
+++staticText name=' ' nameFrom=contents
+++++inlineTextBox name=' ' nameFrom=contents
 ++link name='Title2' nameFrom=attribute
 ++++staticText name='InnerText2' nameFrom=contents
 ++++++inlineTextBox name='InnerText2' nameFrom=contents
+++staticText name=' ' nameFrom=contents
+++++inlineTextBox name=' ' nameFrom=contents
 ++link name='LabelledBy3' nameFrom=relatedElement
 ++++staticText name='InnerText3' nameFrom=contents
 ++++++inlineTextBox name='InnerText3' nameFrom=contents
diff --git a/content/test/data/accessibility/html/a-no-text-expected-android.txt b/content/test/data/accessibility/html/a-no-text-expected-android.txt
index e9962ac..225baf2 100644
--- a/content/test/data/accessibility/html/a-no-text-expected-android.txt
+++ b/content/test/data/accessibility/html/a-no-text-expected-android.txt
@@ -9,4 +9,5 @@
 ++++android.view.View role_description='link' clickable focusable link name='  '
 ++++android.view.View role_description='link' clickable focusable link name='  '
 ++++android.view.View role_description='link' clickable focusable link name='greenbox'
-++++android.view.View role_description='link' clickable focusable link name='greenbox'
+++++android.view.View name=' '
+++++android.view.View role_description='link' clickable focusable link name='greenbox'
\ No newline at end of file
diff --git a/content/test/data/accessibility/html/a-no-text-expected-blink.txt b/content/test/data/accessibility/html/a-no-text-expected-blink.txt
index 41fde89..3fa3bff 100644
--- a/content/test/data/accessibility/html/a-no-text-expected-blink.txt
+++ b/content/test/data/accessibility/html/a-no-text-expected-blink.txt
@@ -18,5 +18,7 @@
 ++++++image
 ++++link
 ++++++image
+++++staticText name=' '
+++++++inlineTextBox name=' '
 ++++link
-++++++image
+++++++image
\ No newline at end of file
diff --git a/content/test/data/accessibility/html/a-with-img-expected-android.txt b/content/test/data/accessibility/html/a-with-img-expected-android.txt
index 6cfea45..550f153 100644
--- a/content/test/data/accessibility/html/a-with-img-expected-android.txt
+++ b/content/test/data/accessibility/html/a-with-img-expected-android.txt
@@ -1,6 +1,9 @@
 android.webkit.WebView focusable focused scrollable
 ++android.view.View
 ++++android.view.View role_description='link' clickable focusable link name='Link with image at start.'
+++++android.view.View name=' '
 ++++android.view.View role_description='link' clickable focusable link name='Link with image in the middle.'
+++++android.view.View name=' '
 ++++android.view.View role_description='link' clickable focusable link name='Link with broken in the middle.'
+++++android.view.View name=' '
 ++++android.view.View role_description='link' clickable focusable link name='Link with image at the end'
\ No newline at end of file
diff --git a/content/test/data/accessibility/html/a-with-img-expected-blink.txt b/content/test/data/accessibility/html/a-with-img-expected-blink.txt
index 6b67b04..2c1a6b1 100644
--- a/content/test/data/accessibility/html/a-with-img-expected-blink.txt
+++ b/content/test/data/accessibility/html/a-with-img-expected-blink.txt
@@ -4,18 +4,24 @@
 ++++++image linked name='Link'
 ++++++staticText linked name=' with image at start.'
 ++++++++inlineTextBox name=' with image at start.'
+++++staticText name=' '
+++++++inlineTextBox name=' '
 ++++link linked name='Link with image in the middle.'
 ++++++staticText linked name='Link with '
 ++++++++inlineTextBox name='Link with '
 ++++++image linked name='image'
 ++++++staticText linked name=' in the middle.'
 ++++++++inlineTextBox name=' in the middle.'
+++++staticText name=' '
+++++++inlineTextBox name=' '
 ++++link linked name='Link with broken in the middle.'
 ++++++staticText linked name='Link with '
 ++++++++inlineTextBox name='Link with '
 ++++++image linked name='broken'
 ++++++staticText linked name=' in the middle.'
 ++++++++inlineTextBox name=' in the middle.'
+++++staticText name=' '
+++++++inlineTextBox name=' '
 ++++link linked name='Link with image at the end'
 ++++++staticText linked name='Link with image at the '
 ++++++++inlineTextBox name='Link with image at the '
diff --git a/content/test/data/accessibility/html/a-with-img-expected-mac.txt b/content/test/data/accessibility/html/a-with-img-expected-mac.txt
index 3e28922..ff34dda 100644
--- a/content/test/data/accessibility/html/a-with-img-expected-mac.txt
+++ b/content/test/data/accessibility/html/a-with-img-expected-mac.txt
@@ -3,14 +3,17 @@
 ++++AXLink AXTitle='Link with image at start.'
 ++++++AXImage AXDescription='Link'
 ++++++AXStaticText AXValue=' with image at start.'
+++++AXStaticText AXValue=' '
 ++++AXLink AXTitle='Link with image in the middle.'
 ++++++AXStaticText AXValue='Link with '
 ++++++AXImage AXDescription='image'
 ++++++AXStaticText AXValue=' in the middle.'
+++++AXStaticText AXValue=' '
 ++++AXLink AXTitle='Link with broken in the middle.'
 ++++++AXStaticText AXValue='Link with '
 ++++++AXImage AXDescription='broken'
 ++++++AXStaticText AXValue=' in the middle.'
+++++AXStaticText AXValue=' '
 ++++AXLink AXTitle='Link with image at the end'
 ++++++AXStaticText AXValue='Link with image at the '
-++++++AXImage AXDescription='end'
+++++++AXImage AXDescription='end'
\ No newline at end of file
diff --git a/content/test/data/accessibility/html/a-with-img-expected-win.txt b/content/test/data/accessibility/html/a-with-img-expected-win.txt
index 3cd7878..7bdf632 100644
--- a/content/test/data/accessibility/html/a-with-img-expected-win.txt
+++ b/content/test/data/accessibility/html/a-with-img-expected-win.txt
@@ -3,14 +3,17 @@
 ++++ROLE_SYSTEM_LINK name='Link with image at start.' FOCUSABLE
 ++++++ROLE_SYSTEM_GRAPHIC name='Link' READONLY
 ++++++ROLE_SYSTEM_STATICTEXT name=' with image at start.'
+++++ROLE_SYSTEM_STATICTEXT name=' '
 ++++ROLE_SYSTEM_LINK name='Link with image in the middle.' FOCUSABLE
 ++++++ROLE_SYSTEM_STATICTEXT name='Link with '
 ++++++ROLE_SYSTEM_GRAPHIC name='image' READONLY
 ++++++ROLE_SYSTEM_STATICTEXT name=' in the middle.'
+++++ROLE_SYSTEM_STATICTEXT name=' '
 ++++ROLE_SYSTEM_LINK name='Link with broken in the middle.' FOCUSABLE
 ++++++ROLE_SYSTEM_STATICTEXT name='Link with '
 ++++++ROLE_SYSTEM_GRAPHIC name='broken' READONLY
 ++++++ROLE_SYSTEM_STATICTEXT name=' in the middle.'
+++++ROLE_SYSTEM_STATICTEXT name=' '
 ++++ROLE_SYSTEM_LINK name='Link with image at the end' FOCUSABLE
 ++++++ROLE_SYSTEM_STATICTEXT name='Link with image at the '
-++++++ROLE_SYSTEM_GRAPHIC name='end' READONLY
+++++++ROLE_SYSTEM_GRAPHIC name='end' READONLY
\ No newline at end of file
diff --git a/content/test/data/accessibility/html/in-page-links-expected-android.txt b/content/test/data/accessibility/html/in-page-links-expected-android.txt
index adfa06a..2b0a3aa 100644
--- a/content/test/data/accessibility/html/in-page-links-expected-android.txt
+++ b/content/test/data/accessibility/html/in-page-links-expected-android.txt
@@ -1,9 +1,14 @@
 android.webkit.WebView focusable focused scrollable
 ++android.view.View role_description='link' clickable focusable link name='Empty anchor'
+++android.view.View name=' '
 ++android.view.View role_description='link' clickable focusable link name='Anchor with content'
+++android.view.View name=' '
 ++android.view.View role_description='link' clickable focusable link name='Anchor with ID'
+++android.view.View name=' '
 ++android.view.View role_description='link' clickable focusable link name='Empty span'
+++android.view.View name=' '
 ++android.view.View role_description='link' clickable focusable link name='Span with content'
+++android.view.View name=' '
 ++android.view.View role_description='link' clickable focusable link name='Paragraph with content'
 ++android.view.View
 ++++android.view.View clickable
@@ -17,4 +22,4 @@
 ++++android.view.View name='After empty span'
 ++android.view.View
 ++++android.view.View name='Span with content'
-++android.view.View name='Paragraph with content'
+++android.view.View name='Paragraph with content'
\ No newline at end of file
diff --git a/content/test/data/accessibility/html/in-page-links-expected-blink.txt b/content/test/data/accessibility/html/in-page-links-expected-blink.txt
index afe05d6..1f71bc3 100644
--- a/content/test/data/accessibility/html/in-page-links-expected-blink.txt
+++ b/content/test/data/accessibility/html/in-page-links-expected-blink.txt
@@ -2,18 +2,28 @@
 ++link name='Empty anchor' inPageLinkTargetId=anchor
 ++++staticText name='Empty anchor'
 ++++++inlineTextBox name='Empty anchor'
+++staticText name=' '
+++++inlineTextBox name=' '
 ++link name='Anchor with content' inPageLinkTargetId=anchor
 ++++staticText name='Anchor with content'
 ++++++inlineTextBox name='Anchor with content'
+++staticText name=' '
+++++inlineTextBox name=' '
 ++link name='Anchor with ID' inPageLinkTargetId=anchor
 ++++staticText name='Anchor with ID'
 ++++++inlineTextBox name='Anchor with ID'
+++staticText name=' '
+++++inlineTextBox name=' '
 ++link name='Empty span' inPageLinkTargetId=genericContainer
 ++++staticText name='Empty span'
 ++++++inlineTextBox name='Empty span'
+++staticText name=' '
+++++inlineTextBox name=' '
 ++link name='Span with content' inPageLinkTargetId=genericContainer
 ++++staticText name='Span with content'
 ++++++inlineTextBox name='Span with content'
+++staticText name=' '
+++++inlineTextBox name=' '
 ++link name='Paragraph with content' inPageLinkTargetId=paragraph
 ++++staticText name='Paragraph with content'
 ++++++inlineTextBox name='Paragraph with content'
@@ -39,4 +49,4 @@
 ++++++++inlineTextBox name='Span with content'
 ++paragraph
 ++++staticText name='Paragraph with content'
-++++++inlineTextBox name='Paragraph with content'
+++++++inlineTextBox name='Paragraph with content'
\ No newline at end of file
diff --git a/content/test/data/accessibility/html/in-page-links-expected-mac.txt b/content/test/data/accessibility/html/in-page-links-expected-mac.txt
index 8099aa6..b4ebc23 100644
--- a/content/test/data/accessibility/html/in-page-links-expected-mac.txt
+++ b/content/test/data/accessibility/html/in-page-links-expected-mac.txt
@@ -1,14 +1,19 @@
 AXWebArea
 ++AXLink AXTitle='Empty anchor' AXLinkedUIElements=["AXGroup"]
 ++++AXStaticText AXValue='Empty anchor'
+++AXStaticText AXValue=' '
 ++AXLink AXTitle='Anchor with content' AXLinkedUIElements=["AXGroup Anchor with content"]
 ++++AXStaticText AXValue='Anchor with content'
+++AXStaticText AXValue=' '
 ++AXLink AXTitle='Anchor with ID' AXLinkedUIElements=["AXGroup Anchor with ID"]
 ++++AXStaticText AXValue='Anchor with ID'
+++AXStaticText AXValue=' '
 ++AXLink AXTitle='Empty span' AXLinkedUIElements=["AXGroup"]
 ++++AXStaticText AXValue='Empty span'
+++AXStaticText AXValue=' '
 ++AXLink AXTitle='Span with content' AXLinkedUIElements=["AXGroup"]
 ++++AXStaticText AXValue='Span with content'
+++AXStaticText AXValue=' '
 ++AXLink AXTitle='Paragraph with content' AXLinkedUIElements=["AXGroup"]
 ++++AXStaticText AXValue='Paragraph with content'
 ++AXGroup
@@ -27,4 +32,4 @@
 ++++AXGroup
 ++++++AXStaticText AXValue='Span with content'
 ++AXGroup
-++++AXStaticText AXValue='Paragraph with content'
+++++AXStaticText AXValue='Paragraph with content'
\ No newline at end of file
diff --git a/content/test/data/accessibility/html/in-page-links-expected-win.txt b/content/test/data/accessibility/html/in-page-links-expected-win.txt
index 22faf55..e91e432 100644
--- a/content/test/data/accessibility/html/in-page-links-expected-win.txt
+++ b/content/test/data/accessibility/html/in-page-links-expected-win.txt
@@ -1,14 +1,19 @@
 ROLE_SYSTEM_DOCUMENT READONLY FOCUSABLE
 ++ROLE_SYSTEM_LINK name='Empty anchor' FOCUSABLE LINKED
 ++++ROLE_SYSTEM_STATICTEXT name='Empty anchor' LINKED
+++ROLE_SYSTEM_STATICTEXT name=' '
 ++ROLE_SYSTEM_LINK name='Anchor with content' FOCUSABLE LINKED
 ++++ROLE_SYSTEM_STATICTEXT name='Anchor with content' LINKED
+++ROLE_SYSTEM_STATICTEXT name=' '
 ++ROLE_SYSTEM_LINK name='Anchor with ID' FOCUSABLE LINKED
 ++++ROLE_SYSTEM_STATICTEXT name='Anchor with ID' LINKED
+++ROLE_SYSTEM_STATICTEXT name=' '
 ++ROLE_SYSTEM_LINK name='Empty span' FOCUSABLE LINKED
 ++++ROLE_SYSTEM_STATICTEXT name='Empty span' LINKED
+++ROLE_SYSTEM_STATICTEXT name=' '
 ++ROLE_SYSTEM_LINK name='Span with content' FOCUSABLE LINKED
 ++++ROLE_SYSTEM_STATICTEXT name='Span with content' LINKED
+++ROLE_SYSTEM_STATICTEXT name=' '
 ++ROLE_SYSTEM_LINK name='Paragraph with content' FOCUSABLE LINKED
 ++++ROLE_SYSTEM_STATICTEXT name='Paragraph with content' LINKED
 ++IA2_ROLE_PARAGRAPH
@@ -27,4 +32,4 @@
 ++++IA2_ROLE_SECTION
 ++++++ROLE_SYSTEM_STATICTEXT name='Span with content'
 ++IA2_ROLE_PARAGRAPH
-++++ROLE_SYSTEM_STATICTEXT name='Paragraph with content'
+++++ROLE_SYSTEM_STATICTEXT name='Paragraph with content'
\ No newline at end of file
diff --git a/content/test/data/accessibility/html/input-month-expected-blink.txt b/content/test/data/accessibility/html/input-month-expected-blink.txt
index 5608d93..6fecd5d 100644
--- a/content/test/data/accessibility/html/input-month-expected-blink.txt
+++ b/content/test/data/accessibility/html/input-month-expected-blink.txt
@@ -3,15 +3,15 @@
 ++++dateTime
 ++++++genericContainer
 ++++++++genericContainer
-++++++++++spinButton description='Month' descriptionFrom=attribute valueForRange=0.00 minValueForRange=1.00 maxValueForRange=12.00
+++++++++++spinButton description='Month' descriptionFrom=attribute minValueForRange=1.00 maxValueForRange=12.00
 ++++++++++++staticText name='---------'
 ++++++++++++++inlineTextBox name='---------'
 ++++++++++staticText name=' '
 ++++++++++++inlineTextBox name=' '
-++++++++++spinButton description='Year' descriptionFrom=attribute valueForRange=0.00 minValueForRange=1.00 maxValueForRange=275760.00
+++++++++++spinButton description='Year' descriptionFrom=attribute minValueForRange=1.00 maxValueForRange=275760.00
 ++++++++++++staticText name='----'
 ++++++++++++++inlineTextBox name='----'
 ++++++popUpButton haspopup
-++++++spinButton valueForRange=0.00 minValueForRange=0.00 maxValueForRange=0.00
+++++++spinButton
 ++++++++button
 ++++++++button
\ No newline at end of file
diff --git a/content/test/data/accessibility/html/input-month-expected-mac.txt b/content/test/data/accessibility/html/input-month-expected-mac.txt
index 8944d3d..acadfad 100644
--- a/content/test/data/accessibility/html/input-month-expected-mac.txt
+++ b/content/test/data/accessibility/html/input-month-expected-mac.txt
@@ -3,12 +3,12 @@
 ++++AXDateField AXRoleDescription='date field'
 ++++++AXGroup AXRoleDescription='group'
 ++++++++AXGroup AXRoleDescription='group'
-++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='0' AXHelp='Month'
+++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='---------' AXHelp='Month'
 ++++++++++++AXStaticText AXRoleDescription='text' AXValue='---------'
 ++++++++++AXStaticText AXRoleDescription='text' AXValue=' '
-++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='0' AXHelp='Year'
+++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='----' AXHelp='Year'
 ++++++++++++AXStaticText AXRoleDescription='text' AXValue='----'
 ++++++AXPopUpButton AXRoleDescription='pop up button'
-++++++AXIncrementor AXRoleDescription='stepper' AXValue='0'
+++++++AXIncrementor AXRoleDescription='stepper'
 ++++++++AXButton AXRoleDescription='button'
 ++++++++AXButton AXRoleDescription='button'
\ No newline at end of file
diff --git a/content/test/data/accessibility/html/input-time-expected-blink.txt b/content/test/data/accessibility/html/input-time-expected-blink.txt
index 745a6d5..70b515e 100644
--- a/content/test/data/accessibility/html/input-time-expected-blink.txt
+++ b/content/test/data/accessibility/html/input-time-expected-blink.txt
@@ -16,6 +16,6 @@
 ++++++++++spinButton description='AM/PM' descriptionFrom=attribute valueForRange=1.00 minValueForRange=1.00 maxValueForRange=2.00
 ++++++++++++staticText name='AM'
 ++++++++++++++inlineTextBox name='AM'
-++++++spinButton valueForRange=0.00 minValueForRange=0.00 maxValueForRange=0.00
+++++++spinButton
 ++++++++button
 ++++++++button
\ No newline at end of file
diff --git a/content/test/data/accessibility/html/input-time-expected-mac.txt b/content/test/data/accessibility/html/input-time-expected-mac.txt
index f0fdf18..65481be 100644
--- a/content/test/data/accessibility/html/input-time-expected-mac.txt
+++ b/content/test/data/accessibility/html/input-time-expected-mac.txt
@@ -11,6 +11,6 @@
 ++++++++++AXStaticText AXRoleDescription='text' AXValue=' '
 ++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='1' AXHelp='AM/PM'
 ++++++++++++AXStaticText AXRoleDescription='text' AXValue='AM'
-++++++AXIncrementor AXRoleDescription='stepper' AXValue='0'
+++++++AXIncrementor AXRoleDescription='stepper'
 ++++++++AXButton AXRoleDescription='button'
 ++++++++AXButton AXRoleDescription='button'
\ No newline at end of file
diff --git a/content/test/data/accessibility/html/input-week-expected-blink.txt b/content/test/data/accessibility/html/input-week-expected-blink.txt
index 19fd80f..3f6225a 100644
--- a/content/test/data/accessibility/html/input-week-expected-blink.txt
+++ b/content/test/data/accessibility/html/input-week-expected-blink.txt
@@ -5,15 +5,15 @@
 ++++++++genericContainer
 ++++++++++staticText name='Week '
 ++++++++++++inlineTextBox name='Week '
-++++++++++spinButton description='Week' descriptionFrom=attribute valueForRange=0.00 minValueForRange=1.00 maxValueForRange=53.00
+++++++++++spinButton description='Week' descriptionFrom=attribute minValueForRange=1.00 maxValueForRange=53.00
 ++++++++++++staticText name='--'
 ++++++++++++++inlineTextBox name='--'
 ++++++++++staticText name=', '
 ++++++++++++inlineTextBox name=', '
-++++++++++spinButton description='Year' descriptionFrom=attribute valueForRange=0.00 minValueForRange=1.00 maxValueForRange=275760.00
+++++++++++spinButton description='Year' descriptionFrom=attribute minValueForRange=1.00 maxValueForRange=275760.00
 ++++++++++++staticText name='----'
 ++++++++++++++inlineTextBox name='----'
 ++++++popUpButton haspopup
-++++++spinButton valueForRange=0.00 minValueForRange=0.00 maxValueForRange=0.00
+++++++spinButton
 ++++++++button
 ++++++++button
\ No newline at end of file
diff --git a/content/test/data/accessibility/html/input-week-expected-mac.txt b/content/test/data/accessibility/html/input-week-expected-mac.txt
index 0f4fa88..b09b040 100644
--- a/content/test/data/accessibility/html/input-week-expected-mac.txt
+++ b/content/test/data/accessibility/html/input-week-expected-mac.txt
@@ -4,12 +4,12 @@
 ++++++AXGroup AXRoleDescription='group'
 ++++++++AXGroup AXRoleDescription='group'
 ++++++++++AXStaticText AXRoleDescription='text' AXValue='Week '
-++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='0' AXHelp='Week'
+++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='--' AXHelp='Week'
 ++++++++++++AXStaticText AXRoleDescription='text' AXValue='--'
 ++++++++++AXStaticText AXRoleDescription='text' AXValue=', '
-++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='0' AXHelp='Year'
+++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='----' AXHelp='Year'
 ++++++++++++AXStaticText AXRoleDescription='text' AXValue='----'
 ++++++AXPopUpButton AXRoleDescription='pop up button'
-++++++AXIncrementor AXRoleDescription='stepper' AXValue='0'
+++++++AXIncrementor AXRoleDescription='stepper'
 ++++++++AXButton AXRoleDescription='button'
 ++++++++AXButton AXRoleDescription='button'
\ No newline at end of file
diff --git a/content/test/data/accessibility/html/span-expected-blink.txt b/content/test/data/accessibility/html/span-expected-blink.txt
index acc2601..ab500c4 100644
--- a/content/test/data/accessibility/html/span-expected-blink.txt
+++ b/content/test/data/accessibility/html/span-expected-blink.txt
@@ -21,18 +21,24 @@
 ++paragraph
 ++++staticText name='E1. Eat'
 ++++++inlineTextBox name='E1. Eat'
+++++staticText name=' '
+++++++inlineTextBox name=' '
 ++++link name='space'
 ++++++staticText name='space'
 ++++++++inlineTextBox name='space'
 ++paragraph
 ++++staticText name='E2. Eat'
 ++++++inlineTextBox name='E2. Eat'
+++++staticText name=' '
+++++++inlineTextBox name=' '
 ++++link name='space'
 ++++++staticText name='space'
 ++++++++inlineTextBox name='space'
 ++paragraph
 ++++staticText name='E3. Eat'
 ++++++inlineTextBox name='E3. Eat'
+++++staticText name=' '
+++++++inlineTextBox name=' '
 ++++link name='space'
 ++++++staticText name='space'
 ++++++++inlineTextBox name='space'
@@ -40,18 +46,24 @@
 ++++link name='E4. Eat'
 ++++++staticText name='E4. Eat'
 ++++++++inlineTextBox name='E4. Eat'
+++++staticText name=' '
+++++++inlineTextBox name=' '
 ++++staticText name='space'
 ++++++inlineTextBox name='space'
 ++paragraph
 ++++link name='E5. Eat'
 ++++++staticText name='E5. Eat'
 ++++++++inlineTextBox name='E5. Eat'
+++++staticText name=' '
+++++++inlineTextBox name=' '
 ++++staticText name='space'
 ++++++inlineTextBox name='space'
 ++paragraph
 ++++link name='E6. Eat'
 ++++++staticText name='E6. Eat'
 ++++++++inlineTextBox name='E6. Eat'
+++++staticText name=' '
+++++++inlineTextBox name=' '
 ++++staticText name='space'
 ++++++inlineTextBox name='space'
 ++paragraph
@@ -74,4 +86,4 @@
 ++++staticText name=' '
 ++++++inlineTextBox name=' '
 ++++staticText name='space'
-++++++inlineTextBox name='space'
+++++++inlineTextBox name='space'
\ No newline at end of file
diff --git a/content/test/data/accessibility/html/span-expected-mac.txt b/content/test/data/accessibility/html/span-expected-mac.txt
index ff17a36..18f567f 100644
--- a/content/test/data/accessibility/html/span-expected-mac.txt
+++ b/content/test/data/accessibility/html/span-expected-mac.txt
@@ -11,27 +11,33 @@
 ++++AXStaticText AXValue='.'
 ++AXGroup
 ++++AXStaticText AXValue='E1. Eat'
+++++AXStaticText AXValue=' '
 ++++AXLink
 ++++++AXStaticText AXValue='space'
 ++AXGroup
 ++++AXStaticText AXValue='E2. Eat'
+++++AXStaticText AXValue=' '
 ++++AXLink
 ++++++AXStaticText AXValue='space'
 ++AXGroup
 ++++AXStaticText AXValue='E3. Eat'
+++++AXStaticText AXValue=' '
 ++++AXLink
 ++++++AXStaticText AXValue='space'
 ++AXGroup
 ++++AXLink
 ++++++AXStaticText AXValue='E4. Eat'
+++++AXStaticText AXValue=' '
 ++++AXStaticText AXValue='space'
 ++AXGroup
 ++++AXLink
 ++++++AXStaticText AXValue='E5. Eat'
+++++AXStaticText AXValue=' '
 ++++AXStaticText AXValue='space'
 ++AXGroup
 ++++AXLink
 ++++++AXStaticText AXValue='E6. Eat'
+++++AXStaticText AXValue=' '
 ++++AXStaticText AXValue='space'
 ++AXGroup
 ++++AXStaticText AXValue='K1. Keep'
diff --git a/content/test/data/accessibility/html/span-expected-win.txt b/content/test/data/accessibility/html/span-expected-win.txt
index d10010f..690cd13 100644
--- a/content/test/data/accessibility/html/span-expected-win.txt
+++ b/content/test/data/accessibility/html/span-expected-win.txt
@@ -11,27 +11,33 @@
 ++++ROLE_SYSTEM_STATICTEXT name='.'
 ++IA2_ROLE_PARAGRAPH
 ++++ROLE_SYSTEM_STATICTEXT name='E1. Eat'
+++++ROLE_SYSTEM_STATICTEXT name=' '
 ++++ROLE_SYSTEM_LINK name='space' FOCUSABLE
 ++++++ROLE_SYSTEM_STATICTEXT name='space'
 ++IA2_ROLE_PARAGRAPH
 ++++ROLE_SYSTEM_STATICTEXT name='E2. Eat'
+++++ROLE_SYSTEM_STATICTEXT name=' '
 ++++ROLE_SYSTEM_LINK name='space' FOCUSABLE
 ++++++ROLE_SYSTEM_STATICTEXT name='space'
 ++IA2_ROLE_PARAGRAPH
 ++++ROLE_SYSTEM_STATICTEXT name='E3. Eat'
+++++ROLE_SYSTEM_STATICTEXT name=' '
 ++++ROLE_SYSTEM_LINK name='space' FOCUSABLE
 ++++++ROLE_SYSTEM_STATICTEXT name='space'
 ++IA2_ROLE_PARAGRAPH
 ++++ROLE_SYSTEM_LINK name='E4. Eat' FOCUSABLE
 ++++++ROLE_SYSTEM_STATICTEXT name='E4. Eat'
+++++ROLE_SYSTEM_STATICTEXT name=' '
 ++++ROLE_SYSTEM_STATICTEXT name='space'
 ++IA2_ROLE_PARAGRAPH
 ++++ROLE_SYSTEM_LINK name='E5. Eat' FOCUSABLE
 ++++++ROLE_SYSTEM_STATICTEXT name='E5. Eat'
+++++ROLE_SYSTEM_STATICTEXT name=' '
 ++++ROLE_SYSTEM_STATICTEXT name='space'
 ++IA2_ROLE_PARAGRAPH
 ++++ROLE_SYSTEM_LINK name='E6. Eat' FOCUSABLE
 ++++++ROLE_SYSTEM_STATICTEXT name='E6. Eat'
+++++ROLE_SYSTEM_STATICTEXT name=' '
 ++++ROLE_SYSTEM_STATICTEXT name='space'
 ++IA2_ROLE_PARAGRAPH
 ++++ROLE_SYSTEM_STATICTEXT name='K1. Keep'
diff --git a/content/test/renderer_audio_output_stream_factory_context_impl_unittest.cc b/content/test/renderer_audio_output_stream_factory_context_impl_unittest.cc
index 2052326..17a4f84 100644
--- a/content/test/renderer_audio_output_stream_factory_context_impl_unittest.cc
+++ b/content/test/renderer_audio_output_stream_factory_context_impl_unittest.cc
@@ -58,7 +58,7 @@
 
 std::unique_ptr<media::AudioOutputStream::AudioSourceCallback>
 GetTestAudioSource() {
-  return base::MakeUnique<media::SineWaveAudioSource>(kChannels, kWaveFrequency,
+  return std::make_unique<media::SineWaveAudioSource>(kChannels, kWaveFrequency,
                                                       kSampleFrequency);
 }
 
@@ -222,11 +222,12 @@
       : media_stream_manager_(),
         thread_bundle_(TestBrowserThreadBundle::Options::REAL_IO_THREAD),
         log_factory_(),
-        audio_manager_(
-            new MockAudioManager(base::MakeUnique<media::AudioThreadImpl>(),
-                                 &log_factory_)),
-        audio_system_(media::AudioSystemImpl::Create(audio_manager_.get())) {
-    media_stream_manager_ = base::MakeUnique<MediaStreamManager>(
+        audio_manager_(std::make_unique<MockAudioManager>(
+            std::make_unique<media::AudioThreadImpl>(),
+            &log_factory_)),
+        audio_system_(
+            std::make_unique<media::AudioSystemImpl>(audio_manager_.get())) {
+    media_stream_manager_ = std::make_unique<MediaStreamManager>(
         audio_system_.get(), audio_manager_->GetTaskRunner());
   }
 
@@ -290,7 +291,7 @@
   SyncWith(renderer_ipc_task_runner);
 
   auto renderer_side_ipc =
-      base::MakeUnique<MojoAudioOutputIPC>(base::BindRepeating(
+      std::make_unique<MojoAudioOutputIPC>(base::BindRepeating(
           [](mojom::RendererAudioOutputStreamFactory* factory_ptr) {
             return factory_ptr;
           },
diff --git a/extensions/browser/content_hash_fetcher.cc b/extensions/browser/content_hash_fetcher.cc
index 4e3cc07..6c041a0 100644
--- a/extensions/browser/content_hash_fetcher.cc
+++ b/extensions/browser/content_hash_fetcher.cc
@@ -26,6 +26,7 @@
 #include "extensions/browser/computed_hashes.h"
 #include "extensions/browser/content_hash_tree.h"
 #include "extensions/browser/content_verifier_delegate.h"
+#include "extensions/browser/extension_file_task_runner.h"
 #include "extensions/browser/verified_contents.h"
 #include "extensions/common/constants.h"
 #include "extensions/common/extension.h"
@@ -350,10 +351,8 @@
     return;
   }
 
-  content::BrowserThread::PostBlockingPoolSequencedTask(
-      "ContentHashFetcher",
-      FROM_HERE,
-      base::Bind(&ContentHashFetcherJob::MaybeCreateHashes, this));
+  GetExtensionFileTaskRunner()->PostTask(
+      FROM_HERE, base::Bind(&ContentHashFetcherJob::MaybeCreateHashes, this));
 }
 
 void ContentHashFetcherJob::MaybeCreateHashes() {
diff --git a/headless/public/headless_web_contents.h b/headless/public/headless_web_contents.h
index 96259c3..bf7a74f 100644
--- a/headless/public/headless_web_contents.h
+++ b/headless/public/headless_web_contents.h
@@ -99,8 +99,7 @@
 
   virtual int GetMainFrameTreeNodeId() const = 0;
 
- private:
-  friend class HeadlessWebContentsImpl;
+ protected:
   HeadlessWebContents() {}
 
   DISALLOW_COPY_AND_ASSIGN(HeadlessWebContents);
diff --git a/ios/chrome/app/strings/ios_strings.grd b/ios/chrome/app/strings/ios_strings.grd
index 7705683..886ccdd 100644
--- a/ios/chrome/app/strings/ios_strings.grd
+++ b/ios/chrome/app/strings/ios_strings.grd
@@ -1570,6 +1570,9 @@
       <message name="IDS_IOS_CHOOSE_DEFAULT_EMAIL_CLIENT_APP" desc="Title for action sheet to select an email client app when user taps on an URL that has a mailto: URL scheme. [Length: 50em]">
         Choose Default Email App
       </message>
+      <message name="IDS_IOS_CHOOSE_EMAIL_APP" desc="Title for bottom sheet to choose an email client app when user taps on an URL that has a mailto: URL scheme. [Length 40em]">
+        Choose Email App
+      </message>
       <message name="IDS_IOS_CHOOSE_EMAIL_APP_HOW_TO_CHANGE" desc="Subtitle for action sheet to choose mailto:// handler with instructions on how to change the preference in the future. [Length: 80]">
         You can change this preference any time in Chrome settings
       </message>
diff --git a/ios/chrome/browser/autofill/form_suggestion_label.mm b/ios/chrome/browser/autofill/form_suggestion_label.mm
index aae0c37..033232a 100644
--- a/ios/chrome/browser/autofill/form_suggestion_label.mm
+++ b/ios/chrome/browser/autofill/form_suggestion_label.mm
@@ -92,17 +92,19 @@
     const CGFloat frameHeight = CGRectGetHeight(proposedFrame);
     CGFloat currentX = kBorderWidth;
 
-    const int iconImageID = autofill::data_util::GetPaymentRequestData(
-                                base::SysNSStringToUTF8(suggestion.icon))
-                                .icon_resource_id;
-    UIImage* iconImage = NativeImage(iconImageID);
-    UIImageView* iconView = [[UIImageView alloc] initWithImage:iconImage];
-    const CGFloat iconY =
-        std::floor((frameHeight - iconImage.size.height) / 2.0f);
-    iconView.frame = CGRectMake(currentX, iconY, iconImage.size.width,
-                                iconImage.size.height);
-    [self addSubview:iconView];
-    currentX += CGRectGetWidth(iconView.frame) + kSpacing;
+    if (suggestion.icon.length > 0) {
+      const int iconImageID = autofill::data_util::GetPaymentRequestData(
+                                  base::SysNSStringToUTF8(suggestion.icon))
+                                  .icon_resource_id;
+      UIImage* iconImage = NativeImage(iconImageID);
+      UIImageView* iconView = [[UIImageView alloc] initWithImage:iconImage];
+      const CGFloat iconY =
+          std::floor((frameHeight - iconImage.size.height) / 2.0f);
+      iconView.frame = CGRectMake(currentX, iconY, iconImage.size.width,
+                                  iconImage.size.height);
+      [self addSubview:iconView];
+      currentX += CGRectGetWidth(iconView.frame) + kSpacing;
+    }
 
     UILabel* label = TextLabel(suggestion.value, kMainLabelAlpha, YES);
     const CGFloat labelY =
diff --git a/ios/chrome/browser/browser_state/off_the_record_chrome_browser_state_io_data.mm b/ios/chrome/browser/browser_state/off_the_record_chrome_browser_state_io_data.mm
index f7133e6..73c3bad 100644
--- a/ios/chrome/browser/browser_state/off_the_record_chrome_browser_state_io_data.mm
+++ b/ios/chrome/browser/browser_state/off_the_record_chrome_browser_state_io_data.mm
@@ -13,6 +13,7 @@
 #include "base/logging.h"
 #include "base/mac/bind_objc_block.h"
 #include "base/stl_util.h"
+#include "base/task_scheduler/post_task.h"
 #include "components/net_log/chrome_net_log.h"
 #include "components/prefs/pref_service.h"
 #include "ios/chrome/browser/browser_state/chrome_browser_state.h"
@@ -187,7 +188,8 @@
   DCHECK(!channel_id_path_.empty());
   channel_id_store = new net::SQLiteChannelIDStore(
       channel_id_path_,
-      web::WebThread::GetTaskRunnerForThread(web::WebThread::DB));
+      base::CreateSequencedTaskRunnerWithTraits(
+          {base::MayBlock(), base::TaskPriority::BACKGROUND}));
 
   net::ChannelIDService* channel_id_service = new net::ChannelIDService(
       new net::DefaultChannelIDStore(channel_id_store.get()));
diff --git a/ios/chrome/browser/context_menu/context_menu_egtest.mm b/ios/chrome/browser/context_menu/context_menu_egtest.mm
index 243d1b5..a40d0d9 100644
--- a/ios/chrome/browser/context_menu/context_menu_egtest.mm
+++ b/ios/chrome/browser/context_menu/context_menu_egtest.mm
@@ -6,6 +6,7 @@
 #import <UIKit/UIKit.h>
 #import <XCTest/XCTest.h>
 
+#include "base/ios/ios_util.h"
 #include "ios/chrome/browser/ui/ui_util.h"
 #include "ios/chrome/grit/ios_strings.h"
 #import "ios/chrome/test/app/chrome_test_util.h"
@@ -161,6 +162,13 @@
 
 // Tests "Open in New Tab" on context menu.
 - (void)testContextMenuOpenInNewTab {
+  // TODO(crbug.com/764691): This test is flaky on iOS 11.  The bots retry
+  // failures, so this test sometimes appears green because it passes on the
+  // retry.
+  if (base::ios::IsRunningOnIOS11OrLater()) {
+    EARL_GREY_TEST_DISABLED(@"Test disabled on iOS 11.");
+  }
+
   // Set up test simple http server.
   std::map<GURL, std::string> responses;
   GURL initialURL = web::test::HttpServer::MakeUrl(kUrlInitialPage);
diff --git a/ios/chrome/browser/tabs/BUILD.gn b/ios/chrome/browser/tabs/BUILD.gn
index c2408bd..463122f 100644
--- a/ios/chrome/browser/tabs/BUILD.gn
+++ b/ios/chrome/browser/tabs/BUILD.gn
@@ -58,6 +58,8 @@
     "tab_model_synced_window_delegate_getter.mm",
     "tab_model_web_state_list_delegate.h",
     "tab_model_web_state_list_delegate.mm",
+    "tab_model_web_usage_enabled_observer.h",
+    "tab_model_web_usage_enabled_observer.mm",
     "tab_parenting_observer.h",
     "tab_parenting_observer.mm",
   ]
diff --git a/ios/chrome/browser/tabs/tab_model.mm b/ios/chrome/browser/tabs/tab_model.mm
index 1702e3f..90f74f0 100644
--- a/ios/chrome/browser/tabs/tab_model.mm
+++ b/ios/chrome/browser/tabs/tab_model.mm
@@ -42,6 +42,7 @@
 #import "ios/chrome/browser/tabs/tab_model_selected_tab_observer.h"
 #import "ios/chrome/browser/tabs/tab_model_synced_window_delegate.h"
 #import "ios/chrome/browser/tabs/tab_model_web_state_list_delegate.h"
+#import "ios/chrome/browser/tabs/tab_model_web_usage_enabled_observer.h"
 #import "ios/chrome/browser/tabs/tab_parenting_observer.h"
 #import "ios/chrome/browser/web/page_placeholder_tab_helper.h"
 #import "ios/chrome/browser/web_state_list/web_state_list.h"
@@ -156,6 +157,9 @@
   // The delegate for sync.
   std::unique_ptr<TabModelSyncedWindowDelegate> _syncedWindowDelegate;
 
+  // The observer that sends kTabModelNewTabWillOpenNotification notifications.
+  TabModelNotificationObserver* _tabModelNotificationObserver;
+
   // Counters for metrics.
   WebStateListMetricsObserver* _webStateListMetricsObserver;
 
@@ -313,7 +317,12 @@
     _webStateListObservers.push_back(std::move(webStateListMetricsObserver));
 
     _webStateListObservers.push_back(
-        base::MakeUnique<TabModelNotificationObserver>(self));
+        base::MakeUnique<TabModelWebUsageEnabledObserver>(self));
+
+    auto tabModelNotificationObserver =
+        base::MakeUnique<TabModelNotificationObserver>(self);
+    _tabModelNotificationObserver = tabModelNotificationObserver.get();
+    _webStateListObservers.push_back(std::move(tabModelNotificationObserver));
 
     for (const auto& webStateListObserver : _webStateListObservers)
       _webStateList->AddObserver(webStateListObserver.get());
@@ -569,7 +578,8 @@
   UnregisterTabModelFromChromeBrowserState(_browserState, self);
   _browserState = nullptr;
 
-  // Clear weak pointer to WebStateListMetricsObserver before destroying it.
+  // Clear weak pointer to observers before destroying them.
+  _tabModelNotificationObserver = nullptr;
   _webStateListMetricsObserver = nullptr;
 
   // Close all tabs. Do this in an @autoreleasepool as WebStateList observers
@@ -646,6 +656,11 @@
   if (!window.sessions.count)
     return NO;
 
+  // Disable sending the kTabModelNewTabWillOpenNotification notification
+  // while restoring a session as it breaks the BVC (see crbug.com/763964).
+  if (_tabModelNotificationObserver)
+    _tabModelNotificationObserver->set_enabled(false);
+
   int oldCount = _webStateList->count();
   DCHECK_GE(oldCount, 0);
 
@@ -695,6 +710,10 @@
     _tabUsageRecorder->InitialRestoredTabs(self.currentTab.webState,
                                            restoredWebStates);
   }
+
+  if (_tabModelNotificationObserver)
+    _tabModelNotificationObserver->set_enabled(true);
+
   return closedNTPTab;
 }
 
diff --git a/ios/chrome/browser/tabs/tab_model_notification_observer.h b/ios/chrome/browser/tabs/tab_model_notification_observer.h
index d376d28..11c56ae 100644
--- a/ios/chrome/browser/tabs/tab_model_notification_observer.h
+++ b/ios/chrome/browser/tabs/tab_model_notification_observer.h
@@ -15,18 +15,18 @@
   explicit TabModelNotificationObserver(TabModel* tab_model);
   ~TabModelNotificationObserver() override;
 
+  // Controls whether sending notification is enabled or not.
+  void set_enabled(bool enabled) { enabled_ = enabled; }
+
   // WebStateListObserver implementation.
   void WebStateInsertedAt(WebStateList* web_state_list,
                           web::WebState* web_state,
                           int index,
                           bool activating) override;
-  void WebStateReplacedAt(WebStateList* web_state_list,
-                          web::WebState* old_web_state,
-                          web::WebState* new_web_state,
-                          int index) override;
 
  private:
   __weak TabModel* tab_model_;
+  bool enabled_ = false;
 
   DISALLOW_COPY_AND_ASSIGN(TabModelNotificationObserver);
 };
diff --git a/ios/chrome/browser/tabs/tab_model_notification_observer.mm b/ios/chrome/browser/tabs/tab_model_notification_observer.mm
index a1b8f43..b172406 100644
--- a/ios/chrome/browser/tabs/tab_model_notification_observer.mm
+++ b/ios/chrome/browser/tabs/tab_model_notification_observer.mm
@@ -12,18 +12,6 @@
 #error "This file requires ARC support."
 #endif
 
-namespace {
-
-// Sets |web_state| web usage enabled property and starts loading the content
-// if necessary.
-void SetWebUsageEnabled(web::WebState* web_state, bool web_usage_enabled) {
-  web_state->SetWebUsageEnabled(web_usage_enabled);
-  if (web_usage_enabled)
-    web_state->GetNavigationManager()->LoadIfNecessary();
-}
-
-}  // namespace
-
 TabModelNotificationObserver::TabModelNotificationObserver(TabModel* tab_model)
     : tab_model_(tab_model) {}
 
@@ -34,7 +22,8 @@
     web::WebState* web_state,
     int index,
     bool activating) {
-  SetWebUsageEnabled(web_state, tab_model_.webUsageEnabled);
+  if (!enabled_)
+    return;
 
   Tab* tab = LegacyTabHelper::GetTabForWebState(web_state);
   [[NSNotificationCenter defaultCenter]
@@ -46,10 +35,3 @@
                   }];
 }
 
-void TabModelNotificationObserver::WebStateReplacedAt(
-    WebStateList* web_state_list,
-    web::WebState* old_web_state,
-    web::WebState* new_web_state,
-    int index) {
-  SetWebUsageEnabled(new_web_state, tab_model_.webUsageEnabled);
-}
diff --git a/ios/chrome/browser/tabs/tab_model_web_usage_enabled_observer.h b/ios/chrome/browser/tabs/tab_model_web_usage_enabled_observer.h
new file mode 100644
index 0000000..6c2aa32
--- /dev/null
+++ b/ios/chrome/browser/tabs/tab_model_web_usage_enabled_observer.h
@@ -0,0 +1,34 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_CHROME_BROWSER_TABS_TAB_MODEL_WEB_USAGE_ENABLED_OBSERVER_H_
+#define IOS_CHROME_BROWSER_TABS_TAB_MODEL_WEB_USAGE_ENABLED_OBSERVER_H_
+
+#include "base/macros.h"
+#import "ios/chrome/browser/web_state_list/web_state_list_observer.h"
+
+@class TabModel;
+
+class TabModelWebUsageEnabledObserver : public WebStateListObserver {
+ public:
+  explicit TabModelWebUsageEnabledObserver(TabModel* tab_model);
+  ~TabModelWebUsageEnabledObserver() override;
+
+  // WebStateListObserver implementation.
+  void WebStateInsertedAt(WebStateList* web_state_list,
+                          web::WebState* web_state,
+                          int index,
+                          bool activating) override;
+  void WebStateReplacedAt(WebStateList* web_state_list,
+                          web::WebState* old_web_state,
+                          web::WebState* new_web_state,
+                          int index) override;
+
+ private:
+  __weak TabModel* tab_model_;
+
+  DISALLOW_COPY_AND_ASSIGN(TabModelWebUsageEnabledObserver);
+};
+
+#endif  // IOS_CHROME_BROWSER_TABS_TAB_MODEL_WEB_USAGE_ENABLED_OBSERVER_H_
diff --git a/ios/chrome/browser/tabs/tab_model_web_usage_enabled_observer.mm b/ios/chrome/browser/tabs/tab_model_web_usage_enabled_observer.mm
new file mode 100644
index 0000000..30fda0b
--- /dev/null
+++ b/ios/chrome/browser/tabs/tab_model_web_usage_enabled_observer.mm
@@ -0,0 +1,46 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/chrome/browser/tabs/tab_model_web_usage_enabled_observer.h"
+
+#import "ios/chrome/browser/tabs/tab_model.h"
+#import "ios/web/public/web_state/web_state.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+namespace {
+
+// Sets |web_state| web usage enabled property and starts loading the content
+// if necessary.
+void SetWebUsageEnabled(web::WebState* web_state, bool web_usage_enabled) {
+  web_state->SetWebUsageEnabled(web_usage_enabled);
+  if (web_usage_enabled)
+    web_state->GetNavigationManager()->LoadIfNecessary();
+}
+
+}  // namespace
+
+TabModelWebUsageEnabledObserver::TabModelWebUsageEnabledObserver(
+    TabModel* tab_model)
+    : tab_model_(tab_model) {}
+
+TabModelWebUsageEnabledObserver::~TabModelWebUsageEnabledObserver() = default;
+
+void TabModelWebUsageEnabledObserver::WebStateInsertedAt(
+    WebStateList* web_state_list,
+    web::WebState* web_state,
+    int index,
+    bool activating) {
+  SetWebUsageEnabled(web_state, tab_model_.webUsageEnabled);
+}
+
+void TabModelWebUsageEnabledObserver::WebStateReplacedAt(
+    WebStateList* web_state_list,
+    web::WebState* old_web_state,
+    web::WebState* new_web_state,
+    int index) {
+  SetWebUsageEnabled(new_web_state, tab_model_.webUsageEnabled);
+}
diff --git a/ios/chrome/browser/ui/browser_list/browser_web_state_list_delegate.mm b/ios/chrome/browser/ui/browser_list/browser_web_state_list_delegate.mm
index 06ca27d..dac18c2 100644
--- a/ios/chrome/browser/ui/browser_list/browser_web_state_list_delegate.mm
+++ b/ios/chrome/browser/ui/browser_list/browser_web_state_list_delegate.mm
@@ -8,6 +8,7 @@
 #import "ios/chrome/browser/find_in_page/find_tab_helper.h"
 #import "ios/chrome/browser/sessions/ios_chrome_session_tab_helper.h"
 #import "ios/chrome/browser/ssl/ios_security_state_tab_helper.h"
+#import "ios/chrome/browser/web/sad_tab_tab_helper.h"
 #import "ios/chrome/browser/web/tab_id_tab_helper.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
@@ -20,6 +21,7 @@
 
 void BrowserWebStateListDelegate::WillAddWebState(web::WebState* web_state) {
   FindTabHelper::CreateForWebState(web_state, nil);
+  SadTabTabHelper::CreateForWebState(web_state, nil);
   IOSChromeSessionTabHelper::CreateForWebState(web_state);
   IOSSecurityStateTabHelper::CreateForWebState(web_state);
   TabIdTabHelper::CreateForWebState(web_state);
diff --git a/ios/chrome/browser/ui/browser_view_controller.h b/ios/chrome/browser/ui/browser_view_controller.h
index d66e4eb..a8c7a6d 100644
--- a/ios/chrome/browser/ui/browser_view_controller.h
+++ b/ios/chrome/browser/ui/browser_view_controller.h
@@ -142,10 +142,6 @@
 // Dismisses all presented views then calls |completion|.
 - (void)clearPresentedStateWithCompletion:(ProceduralBlock)completion;
 
-// Returns a set with the names of the files received from other applications
-// that are bookmarked or referenced by an open or recently closed tab.
-- (NSSet*)referencedExternalFiles;
-
 // Removes files received from other applications. If |immediately| is YES,
 // initiates the removal of files immediately. |completionHandler| is called
 // when files have been removed.
diff --git a/ios/chrome/browser/ui/browser_view_controller.mm b/ios/chrome/browser/ui/browser_view_controller.mm
index 4223e0f..8101822 100644
--- a/ios/chrome/browser/ui/browser_view_controller.mm
+++ b/ios/chrome/browser/ui/browser_view_controller.mm
@@ -2419,32 +2419,12 @@
 
 #pragma mark - External files
 
-- (NSSet*)referencedExternalFiles {
-  NSSet* filesReferencedByTabs = [_model currentlyReferencedExternalFiles];
-
-  // TODO(noyau): this is incorrect, the caller should know that the model is
-  // not loaded yet.
-  if (!_bookmarkModel || !_bookmarkModel->loaded())
-    return filesReferencedByTabs;
-
-  std::vector<bookmarks::BookmarkModel::URLAndTitle> bookmarks;
-  _bookmarkModel->GetBookmarks(&bookmarks);
-  NSMutableSet* bookmarkedFiles = [NSMutableSet set];
-  for (const auto& bookmark : bookmarks) {
-    GURL bookmarkUrl = bookmark.url;
-    if (UrlIsExternalFileReference(bookmarkUrl)) {
-      [bookmarkedFiles
-          addObject:base::SysUTF8ToNSString(bookmarkUrl.ExtractFileName())];
-    }
-  }
-  return [filesReferencedByTabs setByAddingObjectsFromSet:bookmarkedFiles];
-}
-
 - (void)removeExternalFilesImmediately:(BOOL)immediately
                      completionHandler:(ProceduralBlock)completionHandler {
   DCHECK_CURRENTLY_ON(web::WebThread::UI);
   DCHECK(!_isOffTheRecord);
-  _externalFileRemover.reset(new ExternalFileRemover(self));
+  _externalFileRemover =
+      std::make_unique<ExternalFileRemover>(self.browserState);
   // Delay the cleanup of the unreferenced files received from other apps
   // to not impact startup performance.
   int delay = immediately ? 0 : kExternalFilesCleanupDelaySeconds;
diff --git a/ios/chrome/browser/ui/external_file_remover.h b/ios/chrome/browser/ui/external_file_remover.h
index 37a96f7..bea1f78 100644
--- a/ios/chrome/browser/ui/external_file_remover.h
+++ b/ios/chrome/browser/ui/external_file_remover.h
@@ -10,7 +10,9 @@
 #include "base/time/time.h"
 #include "components/sessions/core/tab_restore_service_observer.h"
 
-@class BrowserViewController;
+namespace ios {
+class ChromeBrowserState;
+}
 namespace sessions {
 class TabRestoreService;
 }
@@ -22,7 +24,7 @@
  public:
   // Creates an ExternalFileRemover to remove external documents not referenced
   // by the specified BrowserViewController. Use Remove to initiate the removal.
-  explicit ExternalFileRemover(BrowserViewController* bvc);
+  explicit ExternalFileRemover(ios::ChromeBrowserState* browser_state);
   ~ExternalFileRemover() override;
 
   // sessions::TabRestoreServiceObserver methods
@@ -36,23 +38,27 @@
                         const base::Closure& callback);
 
  private:
+  // Loads the |tabRestoreService_| if necessary. Removes all files received
+  // from other apps if |all_files| is true. Otherwise, removes the unreferenced
+  // files only. |callback| is called when the removal finishes.
+  void Remove(bool all_files, const base::Closure& callback);
   // Removes files received from other apps. If |all_files| is true, then
   // all files including files that may be referenced by tabs through restore
   // service or history. Otherwise, only the unreferenced files are removed.
   // |callback| is called when the removal finishes.
   void RemoveFiles(bool all_files, const base::Closure& callback);
+  // Returns all Referenced External files.
+  NSSet* GetReferencedExternalFiles();
   // Pointer to the tab restore service in the browser state associated with
   // |bvc_|.
-  sessions::TabRestoreService* tabRestoreService_;
-  // BrowserViewController used to get the referenced files. Must outlive this
+  sessions::TabRestoreService* tab_restore_service_ = nullptr;
+  // ChromeBrowserState used to get the referenced files. Must outlive this
   // object.
-  __unsafe_unretained BrowserViewController* bvc_;
+  ios::ChromeBrowserState* browser_state_ = nullptr;
   // Used to ensure |Remove()| is not run when this object is destroyed.
   base::WeakPtrFactory<ExternalFileRemover> weak_ptr_factory_;
-  // Loads the |tabRestoreService_| if necessary. Removes all files received
-  // from other apps if |all_files| is true. Otherwise, removes the unreferenced
-  // files only. |callback| is called when the removal finishes.
-  void Remove(bool all_files, const base::Closure& callback);
+
+  DISALLOW_COPY_AND_ASSIGN(ExternalFileRemover);
 };
 
 #endif  // IOS_CHROME_BROWSER_UI_EXTERNAL_FILE_REMOVER_H_
diff --git a/ios/chrome/browser/ui/external_file_remover.mm b/ios/chrome/browser/ui/external_file_remover.mm
index ac9a27c..5a913bb7 100644
--- a/ios/chrome/browser/ui/external_file_remover.mm
+++ b/ios/chrome/browser/ui/external_file_remover.mm
@@ -6,11 +6,16 @@
 
 #include "base/logging.h"
 #import "base/mac/bind_objc_block.h"
+#include "base/strings/sys_string_conversions.h"
 #include "base/task_scheduler/post_task.h"
+#include "components/bookmarks/browser/bookmark_model.h"
 #include "components/sessions/core/tab_restore_service.h"
+#include "ios/chrome/browser/bookmarks/bookmark_model_factory.h"
 #include "ios/chrome/browser/browser_state/chrome_browser_state.h"
+#include "ios/chrome/browser/chrome_url_util.h"
 #include "ios/chrome/browser/sessions/ios_chrome_tab_restore_service_factory.h"
-#import "ios/chrome/browser/ui/browser_view_controller.h"
+#import "ios/chrome/browser/tabs/tab_model.h"
+#import "ios/chrome/browser/tabs/tab_model_list.h"
 #import "ios/chrome/browser/ui/external_file_controller.h"
 #include "ios/web/public/web_thread.h"
 
@@ -18,18 +23,18 @@
 #error "This file requires ARC support."
 #endif
 
-ExternalFileRemover::ExternalFileRemover(BrowserViewController* bvc)
-    : tabRestoreService_(NULL), bvc_(bvc), weak_ptr_factory_(this) {}
+ExternalFileRemover::ExternalFileRemover(ios::ChromeBrowserState* browser_state)
+    : browser_state_(browser_state), weak_ptr_factory_(this) {}
 
 ExternalFileRemover::~ExternalFileRemover() {
-  if (tabRestoreService_)
-    tabRestoreService_->RemoveObserver(this);
+  if (tab_restore_service_)
+    tab_restore_service_->RemoveObserver(this);
 }
 
 void ExternalFileRemover::TabRestoreServiceChanged(
     sessions::TabRestoreService* service) {
   if (service->IsLoaded()) {
-    tabRestoreService_->RemoveObserver(this);
+    tab_restore_service_->RemoveObserver(this);
     RemoveFiles(false, base::Closure());
   }
 }
@@ -45,15 +50,15 @@
   // |IOSChromeTabRestoreServiceFactory::GetForBrowserState| has to be called on
   // the UI thread.
   DCHECK_CURRENTLY_ON(web::WebThread::UI);
-  tabRestoreService_ =
-      IOSChromeTabRestoreServiceFactory::GetForBrowserState(bvc_.browserState);
-  DCHECK(tabRestoreService_);
-  if (!tabRestoreService_->IsLoaded()) {
+  tab_restore_service_ =
+      IOSChromeTabRestoreServiceFactory::GetForBrowserState(browser_state_);
+  DCHECK(tab_restore_service_);
+  if (!tab_restore_service_->IsLoaded()) {
     // TODO(crbug.com/430902): In the case of the presence of tab restore
     // service, only unreferenced files are removed. This can be addressed with
     // the larger problem of Clear All browsing data not clearing Tab Restore.
-    tabRestoreService_->AddObserver(this);
-    tabRestoreService_->LoadTabsFromLastSession();
+    tab_restore_service_->AddObserver(this);
+    tab_restore_service_->LoadTabsFromLastSession();
     if (!callback.is_null()) {
       web::WebThread::PostTask(web::WebThread::UI, FROM_HERE, callback);
     }
@@ -64,9 +69,13 @@
 
 void ExternalFileRemover::RemoveFiles(bool all_files,
                                       const base::Closure& callback) {
-  NSSet* referencedFiles = all_files ? nil : [bvc_ referencedExternalFiles];
+  NSSet* referenced_files = nil;
+  if (all_files) {
+    referenced_files = GetReferencedExternalFiles();
+  }
+
   const NSInteger kMinimumAgeInDays = 30;
-  NSInteger ageInDays = all_files ? 0 : kMinimumAgeInDays;
+  NSInteger age_in_days = all_files ? 0 : kMinimumAgeInDays;
 
   base::Closure callback_wrapper = callback;
   if (callback_wrapper.is_null()) {
@@ -75,8 +84,8 @@
   base::PostTaskWithTraitsAndReply(
       FROM_HERE, {base::MayBlock(), base::TaskPriority::BACKGROUND},
       base::BindBlockArc(^{
-        [ExternalFileController removeFilesExcluding:referencedFiles
-                                           olderThan:ageInDays];
+        [ExternalFileController removeFilesExcluding:referenced_files
+                                           olderThan:age_in_days];
       }),
       callback_wrapper);
 }
@@ -99,3 +108,33 @@
       }),
       delay);
 }
+
+NSSet* ExternalFileRemover::GetReferencedExternalFiles() {
+  // Add files from all TabModels.
+  NSMutableSet* referenced_external_files = [NSMutableSet set];
+  for (TabModel* tab_model in GetTabModelsForChromeBrowserState(
+           browser_state_)) {
+    NSSet* tab_model_files = [tab_model currentlyReferencedExternalFiles];
+    if (tab_model_files) {
+      [referenced_external_files unionSet:tab_model_files];
+    }
+  }
+
+  bookmarks::BookmarkModel* bookmark_model =
+      ios::BookmarkModelFactory::GetForBrowserState(browser_state_);
+  // Check if the bookmark model is loaded.
+  if (!bookmark_model || !bookmark_model->loaded())
+    return referenced_external_files;
+
+  // Add files from Bookmarks.
+  std::vector<bookmarks::BookmarkModel::URLAndTitle> bookmarks;
+  bookmark_model->GetBookmarks(&bookmarks);
+  for (const auto& bookmark : bookmarks) {
+    GURL bookmark_url = bookmark.url;
+    if (UrlIsExternalFileReference(bookmark_url)) {
+      [referenced_external_files
+          addObject:base::SysUTF8ToNSString(bookmark_url.ExtractFileName())];
+    }
+  }
+  return referenced_external_files;
+}
diff --git a/ios/chrome/browser/ui/main/main_view_controller_unittest.mm b/ios/chrome/browser/ui/main/main_view_controller_unittest.mm
index c8e2519..1efca18 100644
--- a/ios/chrome/browser/ui/main/main_view_controller_unittest.mm
+++ b/ios/chrome/browser/ui/main/main_view_controller_unittest.mm
@@ -6,7 +6,6 @@
 
 #import <UIKit/UIKit.h>
 
-#include "base/ios/ios_util.h"
 #include "testing/gtest_mac.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
@@ -114,9 +113,6 @@
 }
 
 TEST(MainViewControllerTest, StatusBar) {
-  // TODO(crbug.com/748738) This is broken with iOS11/Xcode 9 beta 4.
-  if (base::ios::IsRunningOnIOS11OrLater())
-    return;
   MainViewController* main_view_controller = [[MainViewController alloc] init];
   // MVC needs to be the root view controller for this to work, so save the
   // current one and restore it at the end of the test.
diff --git a/ios/chrome/browser/ui/payments/cells/payments_text_item.h b/ios/chrome/browser/ui/payments/cells/payments_text_item.h
index 9e21145..b421104 100644
--- a/ios/chrome/browser/ui/payments/cells/payments_text_item.h
+++ b/ios/chrome/browser/ui/payments/cells/payments_text_item.h
@@ -15,13 +15,21 @@
 @interface PaymentsTextItem : CollectionViewItem<PaymentsIsSelectable>
 
 // The main text to display.
-@property(nonatomic, copy) NSString* text;
+@property(nonatomic, nullable, copy) NSString* text;
 
 // The secondary text to display.
-@property(nonatomic, copy) NSString* detailText;
+@property(nonatomic, nullable, copy) NSString* detailText;
+
+// The color of the main text. Default is the 900 tint color of the grey
+// palette.
+@property(nonatomic, null_resettable, copy) UIColor* textColor;
+
+// The color of the secondary text. Default is the 900 tint color of the grey
+// palette.
+@property(nonatomic, null_resettable, copy) UIColor* detailTextColor;
 
 // The image to display.
-@property(nonatomic, strong) UIImage* image;
+@property(nonatomic, nullable, strong) UIImage* image;
 
 // The accessory type for the represented cell.
 @property(nonatomic) MDCCollectionViewCellAccessoryType accessoryType;
@@ -38,13 +46,13 @@
 @interface PaymentsTextCell : MDCCollectionViewCell
 
 // UILabel corresponding to |text| from the item.
-@property(nonatomic, readonly, strong) UILabel* textLabel;
+@property(nonatomic, readonly, nullable, strong) UILabel* textLabel;
 
 // UILabel corresponding to |detailText| from the item.
-@property(nonatomic, readonly, strong) UILabel* detailTextLabel;
+@property(nonatomic, readonly, nullable, strong) UILabel* detailTextLabel;
 
 // UIImageView corresponding to |image| from the item.
-@property(nonatomic, readonly, strong) UIImageView* imageView;
+@property(nonatomic, readonly, nullable, strong) UIImageView* imageView;
 
 @end
 
diff --git a/ios/chrome/browser/ui/payments/cells/payments_text_item.mm b/ios/chrome/browser/ui/payments/cells/payments_text_item.mm
index e6239a9..652fee6 100644
--- a/ios/chrome/browser/ui/payments/cells/payments_text_item.mm
+++ b/ios/chrome/browser/ui/payments/cells/payments_text_item.mm
@@ -30,6 +30,8 @@
 
 @synthesize text = _text;
 @synthesize detailText = _detailText;
+@synthesize textColor = _textColor;
+@synthesize detailTextColor = _detailTextColor;
 @synthesize image = _image;
 @synthesize accessoryType = _accessoryType;
 @synthesize complete = _complete;
@@ -44,11 +46,27 @@
   return self;
 }
 
+- (UIColor*)textColor {
+  if (!_textColor) {
+    _textColor = [[MDCPalette greyPalette] tint900];
+  }
+  return _textColor;
+}
+
+- (UIColor*)detailTextColor {
+  if (!_detailTextColor) {
+    _detailTextColor = [[MDCPalette greyPalette] tint900];
+  }
+  return _detailTextColor;
+}
+
 - (void)configureCell:(PaymentsTextCell*)cell {
   [super configureCell:cell];
   cell.accessoryType = self.accessoryType;
   cell.textLabel.text = self.text;
+  cell.textLabel.textColor = self.textColor;
   cell.detailTextLabel.text = self.detailText;
+  cell.detailTextLabel.textColor = self.detailTextColor;
   cell.imageView.image = self.image;
 }
 
@@ -107,12 +125,10 @@
 // Set default font and text colors for labels.
 - (void)setDefaultViewStyling {
   _textLabel.font = [MDCTypography body2Font];
-  _textLabel.textColor = [[MDCPalette greyPalette] tint900];
   _textLabel.numberOfLines = 0;
   _textLabel.lineBreakMode = NSLineBreakByWordWrapping;
 
   _detailTextLabel.font = [MDCTypography body1Font];
-  _detailTextLabel.textColor = [[MDCPalette greyPalette] tint900];
   _detailTextLabel.numberOfLines = 0;
   _detailTextLabel.lineBreakMode = NSLineBreakByWordWrapping;
 }
diff --git a/ios/chrome/browser/ui/payments/payment_request_mediator.mm b/ios/chrome/browser/ui/payments/payment_request_mediator.mm
index 50eb606..d56e3fe 100644
--- a/ios/chrome/browser/ui/payments/payment_request_mediator.mm
+++ b/ios/chrome/browser/ui/payments/payment_request_mediator.mm
@@ -126,7 +126,7 @@
   return item;
 }
 
-- (CollectionViewItem*)shippingSectionHeaderItem {
+- (PaymentsTextItem*)shippingSectionHeaderItem {
   PaymentsTextItem* item = [[PaymentsTextItem alloc] init];
   item.text = GetShippingSectionTitle(self.paymentRequest->shipping_type());
   return item;
@@ -177,7 +177,7 @@
   return item;
 }
 
-- (CollectionViewItem*)paymentMethodSectionHeaderItem {
+- (PaymentsTextItem*)paymentMethodSectionHeaderItem {
   if (!self.paymentRequest->selected_payment_method())
     return nil;
   PaymentsTextItem* item = [[PaymentsTextItem alloc] init];
@@ -221,7 +221,7 @@
   return item;
 }
 
-- (CollectionViewItem*)contactInfoSectionHeaderItem {
+- (PaymentsTextItem*)contactInfoSectionHeaderItem {
   if (!self.paymentRequest->selected_contact_profile())
     return nil;
   PaymentsTextItem* item = [[PaymentsTextItem alloc] init];
diff --git a/ios/chrome/browser/ui/payments/payment_request_view_controller.mm b/ios/chrome/browser/ui/payments/payment_request_view_controller.mm
index c9150a0..9700f9ef 100644
--- a/ios/chrome/browser/ui/payments/payment_request_view_controller.mm
+++ b/ios/chrome/browser/ui/payments/payment_request_view_controller.mm
@@ -16,6 +16,7 @@
 #import "ios/chrome/browser/ui/collection_view/collection_view_model.h"
 #import "ios/chrome/browser/ui/colors/MDCPalette+CrAdditions.h"
 #import "ios/chrome/browser/ui/payments/cells/page_info_item.h"
+#import "ios/chrome/browser/ui/payments/cells/payments_text_item.h"
 #import "ios/chrome/browser/ui/payments/cells/price_item.h"
 #import "ios/chrome/browser/ui/payments/payment_request_view_controller_actions.h"
 #include "ios/chrome/browser/ui/rtl_geometry.h"
@@ -50,7 +51,7 @@
   ItemTypeSummaryPageInfo = kItemTypeEnumZero,
   ItemTypeSpinner,
   ItemTypeSummaryTotal,
-  ItemTypeShippingTitle,
+  ItemTypeShippingHeader,
   ItemTypeShippingAddress,
   ItemTypeShippingOption,
   ItemTypePaymentHeader,
@@ -193,9 +194,10 @@
   if ([_dataSource requestShipping]) {
     [model addSectionWithIdentifier:SectionIdentifierShipping];
 
-    CollectionViewItem* shippingSectionHeaderItem =
+    PaymentsTextItem* shippingSectionHeaderItem =
         [_dataSource shippingSectionHeaderItem];
-    [shippingSectionHeaderItem setType:ItemTypeShippingTitle];
+    [shippingSectionHeaderItem setTextColor:[[MDCPalette greyPalette] tint500]];
+    [shippingSectionHeaderItem setType:ItemTypeShippingHeader];
     [model setHeader:shippingSectionHeaderItem
         forSectionWithIdentifier:SectionIdentifierShipping];
 
@@ -459,10 +461,12 @@
 - (void)populatePaymentMethodSection {
   CollectionViewModel* model = self.collectionViewModel;
 
-  CollectionViewItem* paymentMethodSectionHeaderItem =
+  PaymentsTextItem* paymentMethodSectionHeaderItem =
       [_dataSource paymentMethodSectionHeaderItem];
   if (paymentMethodSectionHeaderItem) {
     [paymentMethodSectionHeaderItem setType:ItemTypePaymentHeader];
+    [paymentMethodSectionHeaderItem
+        setTextColor:[[MDCPalette greyPalette] tint500]];
     [model setHeader:paymentMethodSectionHeaderItem
         forSectionWithIdentifier:SectionIdentifierPayment];
   }
@@ -477,10 +481,12 @@
 - (void)populateContactInfoSection {
   CollectionViewModel* model = self.collectionViewModel;
 
-  CollectionViewItem* contactInfoSectionHeaderItem =
+  PaymentsTextItem* contactInfoSectionHeaderItem =
       [_dataSource contactInfoSectionHeaderItem];
   if (contactInfoSectionHeaderItem) {
     [contactInfoSectionHeaderItem setType:ItemTypeContactInfoHeader];
+    [contactInfoSectionHeaderItem
+        setTextColor:[[MDCPalette greyPalette] tint500]];
     [model setHeader:contactInfoSectionHeaderItem
         forSectionWithIdentifier:SectionIdentifierContactInfo];
   }
diff --git a/ios/chrome/browser/ui/payments/payment_request_view_controller_data_source.h b/ios/chrome/browser/ui/payments/payment_request_view_controller_data_source.h
index 1f130b3..aa87cf6 100644
--- a/ios/chrome/browser/ui/payments/payment_request_view_controller_data_source.h
+++ b/ios/chrome/browser/ui/payments/payment_request_view_controller_data_source.h
@@ -9,6 +9,7 @@
 
 @class CollectionViewFooterItem;
 @class CollectionViewItem;
+@class PaymentsTextItem;
 
 // Data source protocol for PaymentRequestViewController.
 @protocol PaymentRequestViewControllerDataSource
@@ -36,7 +37,7 @@
 - (CollectionViewItem*)paymentSummaryItem;
 
 // Returns the header item for the Shipping section.
-- (CollectionViewItem*)shippingSectionHeaderItem;
+- (PaymentsTextItem*)shippingSectionHeaderItem;
 
 // Returns the Shipping Address item displayed in the Shipping section.
 - (CollectionViewItem*)shippingAddressItem;
@@ -45,13 +46,13 @@
 - (CollectionViewItem*)shippingOptionItem;
 
 // Returns the header item for the Payment Method section.
-- (CollectionViewItem*)paymentMethodSectionHeaderItem;
+- (PaymentsTextItem*)paymentMethodSectionHeaderItem;
 
 // Returns the item displayed in the Payment Method section.
 - (CollectionViewItem*)paymentMethodItem;
 
 // Returns the header item for the Contact Info section.
-- (CollectionViewItem*)contactInfoSectionHeaderItem;
+- (PaymentsTextItem*)contactInfoSectionHeaderItem;
 
 // Returns the item displayed in the Contact Info section.
 - (CollectionViewItem*)contactInfoItem;
diff --git a/ios/chrome/browser/ui/toolbar/keyboard_assist/toolbar_keyboard_accessory_view.mm b/ios/chrome/browser/ui/toolbar/keyboard_assist/toolbar_keyboard_accessory_view.mm
index b2ca394..07023cb 100644
--- a/ios/chrome/browser/ui/toolbar/keyboard_assist/toolbar_keyboard_accessory_view.mm
+++ b/ios/chrome/browser/ui/toolbar/keyboard_assist/toolbar_keyboard_accessory_view.mm
@@ -88,18 +88,32 @@
   [self addSubview:searchStackView];
 
   // Position the stack views.
-  NSArray* constraints = @[
-    @"H:|-horizontalMargin-[searchStackView]-(>=0)-[shortcutStackView]",
-    @"[shortcutStackView]-horizontalMargin-|",
-  ];
-  NSDictionary* viewsDictionary = @{
-    @"searchStackView" : searchStackView,
-    @"shortcutStackView" : shortcutStackView,
-  };
-  NSDictionary* metrics = @{
-    @"horizontalMargin" : @(kHorizontalMargin),
-  };
-  ApplyVisualConstraintsWithMetrics(constraints, viewsDictionary, metrics);
+  if (@available(iOS 11, *)) {
+    UILayoutGuide* layoutGuide = self.safeAreaLayoutGuide;
+    [NSLayoutConstraint activateConstraints:@[
+      [searchStackView.leadingAnchor
+          constraintEqualToAnchor:layoutGuide.leadingAnchor
+                         constant:kHorizontalMargin],
+      [shortcutStackView.trailingAnchor
+          constraintEqualToAnchor:layoutGuide.trailingAnchor
+                         constant:-kHorizontalMargin],
+      [searchStackView.trailingAnchor
+          constraintLessThanOrEqualToAnchor:shortcutStackView.leadingAnchor]
+    ]];
+  } else {
+    NSArray* constraints = @[
+      @"H:|-horizontalMargin-[searchStackView]-(>=0)-[shortcutStackView]",
+      @"[shortcutStackView]-horizontalMargin-|",
+    ];
+    NSDictionary* viewsDictionary = @{
+      @"searchStackView" : searchStackView,
+      @"shortcutStackView" : shortcutStackView,
+    };
+    NSDictionary* metrics = @{
+      @"horizontalMargin" : @(kHorizontalMargin),
+    };
+    ApplyVisualConstraintsWithMetrics(constraints, viewsDictionary, metrics);
+  }
   AddSameCenterYConstraint(searchStackView, self);
   AddSameCenterYConstraint(shortcutStackView, self);
 }
@@ -135,6 +149,17 @@
   return YES;
 }
 
+- (void)layoutMarginsDidChange {
+  NSLog(@"$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$");
+  NSLog(@"$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$");
+  NSLog(@"$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$");
+  NSLog(@"$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$");
+
+  NSLog(@"%i", self.preservesSuperviewLayoutMargins);
+  NSLog(@"%f %f", self.layoutMargins.left, self.layoutMargins.right);
+  [super layoutMarginsDidChange];
+}
+
 - (void)keyboardButtonPressed:(id)sender {
   UIButton* button = base::mac::ObjCCastStrict<UIButton>(sender);
   [[UIDevice currentDevice] playInputClick];
diff --git a/ios/chrome/browser/web/sad_tab_tab_helper.h b/ios/chrome/browser/web/sad_tab_tab_helper.h
index 93a12db3..4aa9ed4 100644
--- a/ios/chrome/browser/web/sad_tab_tab_helper.h
+++ b/ios/chrome/browser/web/sad_tab_tab_helper.h
@@ -30,6 +30,9 @@
                                 double repeat_failure_interval,
                                 id<SadTabTabHelperDelegate> delegate);
 
+  // Sets the SadTabHelper delegate.
+  void SetDelegate(id<SadTabTabHelperDelegate> delegate);
+
   ~SadTabTabHelper() override;
 
  private:
diff --git a/ios/chrome/browser/web/sad_tab_tab_helper.mm b/ios/chrome/browser/web/sad_tab_tab_helper.mm
index d575077..8b47e71 100644
--- a/ios/chrome/browser/web/sad_tab_tab_helper.mm
+++ b/ios/chrome/browser/web/sad_tab_tab_helper.mm
@@ -68,6 +68,10 @@
   }
 }
 
+void SadTabTabHelper::SetDelegate(id<SadTabTabHelperDelegate> delegate) {
+  delegate_ = delegate;
+}
+
 void SadTabTabHelper::WasShown() {
   is_visible_ = true;
 
diff --git a/ios/clean/chrome/browser/ui/web_contents/BUILD.gn b/ios/clean/chrome/browser/ui/web_contents/BUILD.gn
index 76cc38b..96e55dc 100644
--- a/ios/clean/chrome/browser/ui/web_contents/BUILD.gn
+++ b/ios/clean/chrome/browser/ui/web_contents/BUILD.gn
@@ -18,6 +18,9 @@
     "//ios/chrome/browser/ui/browser_list",
     "//ios/chrome/browser/ui/commands",
     "//ios/chrome/browser/ui/coordinators",
+    "//ios/chrome/browser/ui/sad_tab",
+    "//ios/chrome/browser/web",
+    "//ios/chrome/browser/web:tab_helper_delegates",
     "//ios/clean/chrome/browser/ui/commands",
     "//ios/clean/chrome/browser/ui/dialogs/context_menu",
     "//ios/clean/chrome/browser/ui/dialogs/http_auth_dialogs",
diff --git a/ios/clean/chrome/browser/ui/web_contents/web_contents_mediator.h b/ios/clean/chrome/browser/ui/web_contents/web_contents_mediator.h
index 0be926e..98192f9 100644
--- a/ios/clean/chrome/browser/ui/web_contents/web_contents_mediator.h
+++ b/ios/clean/chrome/browser/ui/web_contents/web_contents_mediator.h
@@ -7,6 +7,9 @@
 
 #import <Foundation/Foundation.h>
 
+#import "ios/chrome/browser/web/sad_tab_tab_helper_delegate.h"
+
+@protocol ApplicationCommands;
 namespace web {
 class WebState;
 }
@@ -14,7 +17,7 @@
 
 // A mediator object that provides the relevant properties of a web state
 // to a consumer.
-@interface WebContentsMediator : NSObject
+@interface WebContentsMediator : NSObject<SadTabTabHelperDelegate>
 
 // Updates to this webState are mediated to the consumer. This can change
 // during the lifetime of this object and may be nil.
@@ -24,6 +27,9 @@
 // object and may be nil.
 @property(nonatomic, weak) id<WebContentsConsumer> consumer;
 
+// The dispatcher for this mediator.
+@property(nonatomic, weak) id<ApplicationCommands> dispatcher;
+
 @end
 
 #endif  // IOS_CLEAN_CHROME_BROWSER_UI_WEB_CONTENTS_WEB_CONTENTS_MEDIATOR_H_
diff --git a/ios/clean/chrome/browser/ui/web_contents/web_contents_mediator.mm b/ios/clean/chrome/browser/ui/web_contents/web_contents_mediator.mm
index cfd238a..ade7a3b 100644
--- a/ios/clean/chrome/browser/ui/web_contents/web_contents_mediator.mm
+++ b/ios/clean/chrome/browser/ui/web_contents/web_contents_mediator.mm
@@ -7,8 +7,10 @@
 #include "base/memory/ptr_util.h"
 #include "base/scoped_observer.h"
 #include "ios/chrome/browser/chrome_url_constants.h"
+#import "ios/chrome/browser/ui/sad_tab/sad_tab_view.h"
 #import "ios/clean/chrome/browser/ui/web_contents/web_contents_consumer.h"
 #import "ios/web/public/navigation_manager.h"
+#import "ios/web/public/web_state/ui/crw_generic_content_view.h"
 #include "ios/web/public/web_state/web_state.h"
 #include "ui/base/page_transition_types.h"
 #include "url/gurl.h"
@@ -20,6 +22,7 @@
 @implementation WebContentsMediator
 @synthesize webState = _webState;
 @synthesize consumer = _consumer;
+@synthesize dispatcher = _dispatcher;
 
 #pragma mark - Properties
 
@@ -60,4 +63,18 @@
   }
 }
 
+#pragma mark - SadTabTabHelperDelegate
+
+- (void)presentSadTabForRepeatedFailure:(BOOL)repeatedFailure {
+  // Create a SadTabView so |webstate| presents it.
+  SadTabView* sadTabview = [[SadTabView alloc]
+           initWithMode:repeatedFailure ? SadTabViewMode::FEEDBACK
+                                        : SadTabViewMode::RELOAD
+      navigationManager:self.webState->GetNavigationManager()];
+  sadTabview.dispatcher = self.dispatcher;
+  CRWContentView* contentView =
+      [[CRWGenericContentView alloc] initWithView:sadTabview];
+  self.webState->ShowTransientContentView(contentView);
+}
+
 @end
diff --git a/ios/clean/chrome/browser/ui/web_contents/web_coordinator.mm b/ios/clean/chrome/browser/ui/web_contents/web_coordinator.mm
index 532f342..bf7baf0 100644
--- a/ios/clean/chrome/browser/ui/web_contents/web_coordinator.mm
+++ b/ios/clean/chrome/browser/ui/web_contents/web_coordinator.mm
@@ -9,6 +9,7 @@
 #import "ios/chrome/browser/ui/browser_list/browser.h"
 #import "ios/chrome/browser/ui/commands/command_dispatcher.h"
 #import "ios/chrome/browser/ui/coordinators/browser_coordinator+internal.h"
+#import "ios/chrome/browser/web/sad_tab_tab_helper.h"
 #import "ios/clean/chrome/browser/ui/commands/context_menu_commands.h"
 #import "ios/clean/chrome/browser/ui/dialogs/context_menu/context_menu_dialog_coordinator.h"
 #import "ios/clean/chrome/browser/ui/dialogs/context_menu/context_menu_dialog_request.h"
@@ -60,6 +61,13 @@
   self.webState->SetDelegate(_webStateDelegate.get());
   self.mediator.webState = self.webState;
   [self setWebStateOverlayParent];
+  SadTabTabHelper* sadTabHelper = SadTabTabHelper::FromWebState(self.webState);
+  // Set the mediator as a SadTabHelper delegate, and set the mediator's
+  // dispatcher.
+  if (sadTabHelper) {
+    sadTabHelper->SetDelegate(self.mediator);
+    self.mediator.dispatcher = static_cast<id>(self.dispatcher);
+  }
 }
 
 - (void)start {
@@ -73,6 +81,9 @@
 
 - (void)stop {
   [self resetWebStateOverlayParent];
+  SadTabTabHelper* sadTabHelper = SadTabTabHelper::FromWebState(self.webState);
+  if (sadTabHelper)
+    sadTabHelper->SetDelegate(nil);
   [super stop];
 }
 
diff --git a/media/audio/audio_system.cc b/media/audio/audio_system.cc
index 953be40..dfcd7bd 100644
--- a/media/audio/audio_system.cc
+++ b/media/audio/audio_system.cc
@@ -4,35 +4,18 @@
 
 #include "media/audio/audio_system.h"
 
-namespace media {
+#include "base/memory/ptr_util.h"
+#include "media/audio/audio_manager.h"
+#include "media/audio/audio_system_impl.h"
 
-static AudioSystem* g_last_created = nullptr;
+namespace media {
 
 AudioSystem::~AudioSystem() {}
 
-AudioSystem* AudioSystem::Get() {
-  return g_last_created;
-}
-
-void AudioSystem::SetInstance(AudioSystem* audio_system) {
-  DCHECK(audio_system);
-  if (g_last_created && audio_system) {
-    // We create multiple instances of AudioSystem only when testing.
-    // We should not encounter this case in production.
-    LOG(WARNING) << "Multiple instances of AudioSystem detected";
-  }
-  g_last_created = audio_system;
-}
-
-void AudioSystem::ClearInstance(const AudioSystem* audio_system) {
-  DCHECK(audio_system);
-  if (g_last_created != audio_system) {
-    // We create multiple instances of AudioSystem only when testing.
-    // We should not encounter this case in production.
-    LOG(WARNING) << "Multiple instances of AudioSystem detected";
-  } else {
-    g_last_created = nullptr;
-  }
+// static
+std::unique_ptr<AudioSystem> AudioSystem::CreateInstance() {
+  DCHECK(AudioManager::Get()) << "AudioManager instance is not created";
+  return std::make_unique<AudioSystemImpl>(AudioManager::Get());
 }
 
 }  // namespace media
diff --git a/media/audio/audio_system.h b/media/audio/audio_system.h
index e2de500..406b23c 100644
--- a/media/audio/audio_system.h
+++ b/media/audio/audio_system.h
@@ -18,8 +18,9 @@
 // Provides asynchronous interface to access audio device information
 class MEDIA_EXPORT AudioSystem {
  public:
-  // Replies are asynchronously sent from audio system thread to the thread the
-  // call is issued on. Attention! Audio system thread may outlive the client
+  // Replies are sent asynchronously to the thread the calls are issued on.
+  // Instance is bound to the thread it's called on the first time.
+  // Attention! Audio system thread may outlive the client
   // objects; bind callbacks with care.
 
   // Non-empty optional AudioParameters are guaranteed to be valid.
@@ -40,7 +41,8 @@
       base::OnceCallback<void(AudioDeviceDescriptions)>;
   using OnDeviceIdCallback = base::OnceCallback<void(const std::string&)>;
 
-  static AudioSystem* Get();
+  // The global AudioManager instance must be created prior to that.
+  static std::unique_ptr<AudioSystem> CreateInstance();
 
   virtual ~AudioSystem();
 
@@ -72,15 +74,8 @@
   virtual void GetInputDeviceInfo(
       const std::string& input_device_id,
       OnInputDeviceInfoCallback on_input_device_info_cb) = 0;
-
- protected:
-  // Sets the global AudioSystem pointer to the specified non-null value.
-  static void SetInstance(AudioSystem* audio_system);
-
-  // Sets the global AudioSystem pointer to null if it equals the specified one.
-  static void ClearInstance(const AudioSystem* audio_system);
 };
 
 }  // namespace media
 
-#endif  // MEDIA_AUDIO_AUDIO_SYSTEM_H_
+#endif  // MEDIA_AUDIO_AUDIO_SYSTEM_H_s
diff --git a/media/audio/audio_system_helper.cc b/media/audio/audio_system_helper.cc
index e43bedf..511a7ce 100644
--- a/media/audio/audio_system_helper.cc
+++ b/media/audio/audio_system_helper.cc
@@ -41,33 +41,33 @@
 void AudioSystemHelper::GetInputStreamParameters(
     const std::string& device_id,
     AudioSystem::OnAudioParamsCallback on_params_cb) {
-  DCHECK(GetTaskRunner()->BelongsToCurrentThread());
+  DCHECK(audio_manager_->GetTaskRunner()->BelongsToCurrentThread());
   std::move(on_params_cb).Run(ComputeInputParameters(device_id));
 }
 
 void AudioSystemHelper::GetOutputStreamParameters(
     const std::string& device_id,
     AudioSystem::OnAudioParamsCallback on_params_cb) {
-  DCHECK(GetTaskRunner()->BelongsToCurrentThread());
+  DCHECK(audio_manager_->GetTaskRunner()->BelongsToCurrentThread());
   std::move(on_params_cb).Run(ComputeOutputParameters(device_id));
 }
 
 void AudioSystemHelper::HasInputDevices(
     AudioSystem::OnBoolCallback on_has_devices_cb) {
-  DCHECK(GetTaskRunner()->BelongsToCurrentThread());
+  DCHECK(audio_manager_->GetTaskRunner()->BelongsToCurrentThread());
   std::move(on_has_devices_cb).Run(audio_manager_->HasAudioInputDevices());
 }
 
 void AudioSystemHelper::HasOutputDevices(
     AudioSystem::OnBoolCallback on_has_devices_cb) {
-  DCHECK(GetTaskRunner()->BelongsToCurrentThread());
+  DCHECK(audio_manager_->GetTaskRunner()->BelongsToCurrentThread());
   std::move(on_has_devices_cb).Run(audio_manager_->HasAudioOutputDevices());
 }
 
 void AudioSystemHelper::GetDeviceDescriptions(
     bool for_input,
     AudioSystem::OnDeviceDescriptionsCallback on_descriptions_cb) {
-  DCHECK(GetTaskRunner()->BelongsToCurrentThread());
+  DCHECK(audio_manager_->GetTaskRunner()->BelongsToCurrentThread());
   AudioDeviceDescriptions descriptions;
   if (for_input)
     audio_manager_->GetAudioInputDeviceDescriptions(&descriptions);
@@ -79,7 +79,7 @@
 void AudioSystemHelper::GetAssociatedOutputDeviceID(
     const std::string& input_device_id,
     AudioSystem::OnDeviceIdCallback on_device_id_cb) {
-  DCHECK(GetTaskRunner()->BelongsToCurrentThread());
+  DCHECK(audio_manager_->GetTaskRunner()->BelongsToCurrentThread());
   std::move(on_device_id_cb)
       .Run(audio_manager_->GetAssociatedOutputDeviceID(input_device_id));
 }
@@ -87,7 +87,7 @@
 void AudioSystemHelper::GetInputDeviceInfo(
     const std::string& input_device_id,
     AudioSystem::OnInputDeviceInfoCallback on_input_device_info_cb) {
-  DCHECK(GetTaskRunner()->BelongsToCurrentThread());
+  DCHECK(audio_manager_->GetTaskRunner()->BelongsToCurrentThread());
   const std::string associated_output_device_id =
       audio_manager_->GetAssociatedOutputDeviceID(input_device_id);
 
@@ -99,13 +99,9 @@
            associated_output_device_id);
 }
 
-base::SingleThreadTaskRunner* AudioSystemHelper::GetTaskRunner() {
-  return audio_manager_->GetTaskRunner();
-}
-
 base::Optional<AudioParameters> AudioSystemHelper::ComputeInputParameters(
     const std::string& device_id) {
-  DCHECK(GetTaskRunner()->BelongsToCurrentThread());
+  DCHECK(audio_manager_->GetTaskRunner()->BelongsToCurrentThread());
 
   // TODO(olka): remove this when AudioManager::GetInputStreamParameters()
   // returns invalid parameters if the device is not found.
@@ -127,7 +123,7 @@
 
 base::Optional<AudioParameters> AudioSystemHelper::ComputeOutputParameters(
     const std::string& device_id) {
-  DCHECK(GetTaskRunner()->BelongsToCurrentThread());
+  DCHECK(audio_manager_->GetTaskRunner()->BelongsToCurrentThread());
 
   // TODO(olka): remove this when
   // AudioManager::Get[Default]OutputStreamParameters() returns invalid
diff --git a/media/audio/audio_system_helper.h b/media/audio/audio_system_helper.h
index 1ae6a86..e3e1642 100644
--- a/media/audio/audio_system_helper.h
+++ b/media/audio/audio_system_helper.h
@@ -8,10 +8,6 @@
 #include "media/audio/audio_system.h"
 #include "media/base/media_export.h"
 
-namespace base {
-class SingleThreadTaskRunner;
-}
-
 namespace media {
 class AudioManager;
 
@@ -47,8 +43,6 @@
       const std::string& input_device_id,
       AudioSystem::OnInputDeviceInfoCallback on_input_device_info_cb);
 
-  base::SingleThreadTaskRunner* GetTaskRunner();
-
  private:
   base::Optional<AudioParameters> ComputeInputParameters(
       const std::string& device_id);
diff --git a/media/audio/audio_system_impl.cc b/media/audio/audio_system_impl.cc
index 2a31254a..12a5eab 100644
--- a/media/audio/audio_system_impl.cc
+++ b/media/audio/audio_system_impl.cc
@@ -7,10 +7,11 @@
 #include "base/memory/ptr_util.h"
 #include "base/single_thread_task_runner.h"
 #include "base/task_runner_util.h"
+#include "media/audio/audio_manager.h"
 #include "media/base/bind_to_current_loop.h"
 
-// Using base::Unretained for |&helper_| is safe since AudioSystem is deleted
-// after audio thread is stopped.
+// Using base::Unretained for |audio_manager_| is safe since AudioManager is
+// deleted after audio thread is stopped.
 
 // No need to bind the callback to the current loop if we are on the audio
 // thread. However, the client still expects to receive the reply
@@ -20,94 +21,150 @@
 
 namespace media {
 
+namespace {
+
+void GetInputStreamParametersOnAudioThread(
+    AudioManager* audio_manager,
+    const std::string& device_id,
+    AudioSystem::OnAudioParamsCallback on_params_cb) {
+  AudioSystemHelper(audio_manager)
+      .GetInputStreamParameters(device_id, std::move(on_params_cb));
+}
+
+void GetOutputStreamParametersOnAudioThread(
+    AudioManager* audio_manager,
+    const std::string& device_id,
+    AudioSystem::OnAudioParamsCallback on_params_cb) {
+  AudioSystemHelper(audio_manager)
+      .GetOutputStreamParameters(device_id, std::move(on_params_cb));
+}
+
+void HasInputDevicesOnAudioThread(
+    AudioManager* audio_manager,
+    AudioSystem::OnBoolCallback on_has_devices_cb) {
+  AudioSystemHelper(audio_manager)
+      .HasInputDevices(std::move(on_has_devices_cb));
+}
+
+void HasOutputDevicesOnAudioThread(
+    AudioManager* audio_manager,
+    AudioSystem::OnBoolCallback on_has_devices_cb) {
+  AudioSystemHelper(audio_manager)
+      .HasOutputDevices(std::move(on_has_devices_cb));
+}
+
+void GetDeviceDescriptionsOnAudioThread(
+    AudioManager* audio_manager,
+    bool for_input,
+    AudioSystem::OnDeviceDescriptionsCallback on_descriptions_cb) {
+  AudioSystemHelper(audio_manager)
+      .GetDeviceDescriptions(for_input, std::move(on_descriptions_cb));
+}
+
+void GetAssociatedOutputDeviceIDOnAudioThread(
+    AudioManager* audio_manager,
+    const std::string& input_device_id,
+    AudioSystem::OnDeviceIdCallback on_device_id_cb) {
+  AudioSystemHelper(audio_manager)
+      .GetAssociatedOutputDeviceID(input_device_id, std::move(on_device_id_cb));
+}
+
+void GetInputDeviceInfoOnAudioThread(
+    AudioManager* audio_manager,
+    const std::string& input_device_id,
+    AudioSystem::OnInputDeviceInfoCallback on_input_device_info_cb) {
+  AudioSystemHelper(audio_manager)
+      .GetInputDeviceInfo(input_device_id, std::move(on_input_device_info_cb));
+}
+
+}  // namespace
+
 template <typename... Args>
 inline base::OnceCallback<void(Args...)>
 AudioSystemImpl::MaybeBindToCurrentLoop(
     base::OnceCallback<void(Args...)> callback) {
-  return helper_.GetTaskRunner()->BelongsToCurrentThread()
+  return audio_manager_->GetTaskRunner()->BelongsToCurrentThread()
              ? std::move(callback)
              : media::BindToCurrentLoop(std::move(callback));
 }
 
 AudioSystemImpl::AudioSystemImpl(AudioManager* audio_manager)
-    : helper_(audio_manager) {
-  AudioSystem::SetInstance(this);
-}
-
-AudioSystemImpl::~AudioSystemImpl() {
-  AudioSystem::ClearInstance(this);
-}
-
-// static
-std::unique_ptr<AudioSystem> AudioSystemImpl::Create(
-    AudioManager* audio_manager) {
-  return base::WrapUnique(new AudioSystemImpl(audio_manager));
+    : audio_manager_(audio_manager) {
+  DETACH_FROM_THREAD(thread_checker_);
 }
 
 void AudioSystemImpl::GetInputStreamParameters(
     const std::string& device_id,
     OnAudioParamsCallback on_params_cb) {
-  helper_.GetTaskRunner()->PostTask(
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  audio_manager_->GetTaskRunner()->PostTask(
       FROM_HERE,
-      base::BindOnce(&AudioSystemHelper::GetInputStreamParameters,
-                     base::Unretained(&helper_), device_id,
+      base::BindOnce(&GetInputStreamParametersOnAudioThread,
+                     base::Unretained(audio_manager_), device_id,
                      MaybeBindToCurrentLoop(std::move(on_params_cb))));
 }
 
 void AudioSystemImpl::GetOutputStreamParameters(
     const std::string& device_id,
     OnAudioParamsCallback on_params_cb) {
-  helper_.GetTaskRunner()->PostTask(
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  audio_manager_->GetTaskRunner()->PostTask(
       FROM_HERE,
-      base::BindOnce(&AudioSystemHelper::GetOutputStreamParameters,
-                     base::Unretained(&helper_), device_id,
+      base::BindOnce(&GetOutputStreamParametersOnAudioThread,
+                     base::Unretained(audio_manager_), device_id,
                      MaybeBindToCurrentLoop(std::move(on_params_cb))));
 }
 
 void AudioSystemImpl::HasInputDevices(OnBoolCallback on_has_devices_cb) {
-  helper_.GetTaskRunner()->PostTask(
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  audio_manager_->GetTaskRunner()->PostTask(
       FROM_HERE,
-      base::BindOnce(&AudioSystemHelper::HasInputDevices,
-                     base::Unretained(&helper_),
+      base::BindOnce(&HasInputDevicesOnAudioThread,
+                     base::Unretained(audio_manager_),
                      MaybeBindToCurrentLoop(std::move(on_has_devices_cb))));
 }
 
 void AudioSystemImpl::HasOutputDevices(OnBoolCallback on_has_devices_cb) {
-  helper_.GetTaskRunner()->PostTask(
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  audio_manager_->GetTaskRunner()->PostTask(
       FROM_HERE,
-      base::BindOnce(&AudioSystemHelper::HasOutputDevices,
-                     base::Unretained(&helper_),
+      base::BindOnce(&HasOutputDevicesOnAudioThread,
+                     base::Unretained(audio_manager_),
                      MaybeBindToCurrentLoop(std::move(on_has_devices_cb))));
 }
 
 void AudioSystemImpl::GetDeviceDescriptions(
     bool for_input,
     OnDeviceDescriptionsCallback on_descriptions_cb) {
-  helper_.GetTaskRunner()->PostTask(
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  audio_manager_->GetTaskRunner()->PostTask(
       FROM_HERE,
-      base::BindOnce(&AudioSystemHelper::GetDeviceDescriptions,
-                     base::Unretained(&helper_), for_input,
+      base::BindOnce(&GetDeviceDescriptionsOnAudioThread,
+                     base::Unretained(audio_manager_), for_input,
                      MaybeBindToCurrentLoop(std::move(on_descriptions_cb))));
 }
 
 void AudioSystemImpl::GetAssociatedOutputDeviceID(
     const std::string& input_device_id,
     OnDeviceIdCallback on_device_id_cb) {
-  helper_.GetTaskRunner()->PostTask(
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  audio_manager_->GetTaskRunner()->PostTask(
       FROM_HERE,
-      base::BindOnce(&AudioSystemHelper::GetAssociatedOutputDeviceID,
-                     base::Unretained(&helper_), input_device_id,
+      base::BindOnce(&GetAssociatedOutputDeviceIDOnAudioThread,
+                     base::Unretained(audio_manager_), input_device_id,
                      MaybeBindToCurrentLoop(std::move(on_device_id_cb))));
 }
 
 void AudioSystemImpl::GetInputDeviceInfo(
     const std::string& input_device_id,
     OnInputDeviceInfoCallback on_input_device_info_cb) {
-  helper_.GetTaskRunner()->PostTask(
-      FROM_HERE, base::BindOnce(&AudioSystemHelper::GetInputDeviceInfo,
-                                base::Unretained(&helper_), input_device_id,
-                                MaybeBindToCurrentLoop(
-                                    std::move(on_input_device_info_cb))));
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+  audio_manager_->GetTaskRunner()->PostTask(
+      FROM_HERE,
+      base::BindOnce(
+          &GetInputDeviceInfoOnAudioThread, base::Unretained(audio_manager_),
+          input_device_id,
+          MaybeBindToCurrentLoop(std::move(on_input_device_info_cb))));
 }
 
 }  // namespace media
diff --git a/media/audio/audio_system_impl.h b/media/audio/audio_system_impl.h
index 8ff9e00..e5be75d 100644
--- a/media/audio/audio_system_impl.h
+++ b/media/audio/audio_system_impl.h
@@ -5,6 +5,7 @@
 #ifndef MEDIA_AUDIO_AUDIO_SYSTEM_IMPL_H_
 #define MEDIA_AUDIO_AUDIO_SYSTEM_IMPL_H_
 
+#include "base/threading/thread_checker.h"
 #include "media/audio/audio_system.h"
 #include "media/audio/audio_system_helper.h"
 
@@ -13,9 +14,7 @@
 
 class MEDIA_EXPORT AudioSystemImpl : public AudioSystem {
  public:
-  static std::unique_ptr<AudioSystem> Create(AudioManager* audio_manager);
-
-  ~AudioSystemImpl() override;
+  explicit AudioSystemImpl(AudioManager* audio_manager);
 
   // AudioSystem implementation.
   void GetInputStreamParameters(const std::string& device_id,
@@ -40,15 +39,14 @@
       OnInputDeviceInfoCallback on_input_device_info_cb) override;
 
  private:
-  AudioSystemImpl(AudioManager* audio_manager);
-
   // No-op if called on helper_.GetTaskRunner() thread, otherwise binds
   // |callback| to the current loop.
   template <typename... Args>
   base::OnceCallback<void(Args...)> MaybeBindToCurrentLoop(
       base::OnceCallback<void(Args...)> callback);
 
-  AudioSystemHelper helper_;
+  THREAD_CHECKER(thread_checker_);
+  AudioManager* const audio_manager_;
 
   DISALLOW_COPY_AND_ASSIGN(AudioSystemImpl);
 };
diff --git a/media/audio/audio_system_impl_unittest.cc b/media/audio/audio_system_impl_unittest.cc
index 3e72a43..43e0783 100644
--- a/media/audio/audio_system_impl_unittest.cc
+++ b/media/audio/audio_system_impl_unittest.cc
@@ -70,8 +70,7 @@
         base::Bind(get_device_descriptions,
                    base::Unretained(&output_device_descriptions_)));
 
-    audio_system_ = AudioSystemImpl::Create(audio_manager_.get());
-    EXPECT_EQ(AudioSystem::Get(), audio_system_.get());
+    audio_system_ = std::make_unique<AudioSystemImpl>(audio_manager_.get());
   }
 
   ~AudioSystemImplTest() override { audio_manager_->Shutdown(); }
diff --git a/services/ui/ws/event_targeter.cc b/services/ui/ws/event_targeter.cc
index ddd1353..54bea53 100644
--- a/services/ui/ws/event_targeter.cc
+++ b/services/ui/ws/event_targeter.cc
@@ -6,6 +6,7 @@
 
 #include "base/command_line.h"
 #include "base/memory/ptr_util.h"
+#include "base/metrics/user_metrics.h"
 #include "base/task_scheduler/post_task.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "components/viz/host/hit_test/hit_test_query.h"
@@ -65,9 +66,10 @@
             event_targeter_delegate_->GetWindowFromFrameSinkId(
                 target.frame_sink_id);
         if (!target_window) {
-          // TODO(riajiang): There's no target window with this frame_sink_id,
-          // maybe a security fault. http://crbug.com/746470
-          NOTREACHED();
+          // TODO(riajiang): Investigate when this would be a security fault.
+          // http://crbug.com/746470
+          base::RecordAction(
+              base::UserMetricsAction("EventTargeting_DeletedTarget"));
         }
         deepest_window.window = target_window;
         // TODO(riajiang): use |target.location_in_target|.
diff --git a/third_party/WebKit/LayoutTests/ASANExpectations b/third_party/WebKit/LayoutTests/ASANExpectations
index bb37c30..22b2350 100644
--- a/third_party/WebKit/LayoutTests/ASANExpectations
+++ b/third_party/WebKit/LayoutTests/ASANExpectations
@@ -72,5 +72,3 @@
 # Intentionally failed allocations, via partitionAllocGenericFlags()
 crbug.com/577889 [ Linux ] fast/js/typed-array-allocation-failure.html [ Crash ]
 
-crbug.com/717019 [ Linux ] virtual/gpu/fast/canvas/canvas-clip-rule.html [ Crash ]
-crbug.com/717019 [ Linux ] virtual/gpu/fast/canvas/canvas-path-context-clip.html [ Crash ]
diff --git a/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG b/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
index 6f5e976..f710ca1 100644
--- a/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
+++ b/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
@@ -1638,8 +1638,8 @@
 crbug.com/591099 css3/masking/clip-path-circle-overflow.html [ Failure Pass ]
 crbug.com/591099 css3/masking/clip-path-circle-relative-overflow.html [ Failure Pass ]
 crbug.com/591099 css3/masking/clip-path-circle.html [ Failure Pass ]
-crbug.com/591099 css3/masking/clip-path-columns-shape.html [ Failure ]
-crbug.com/591099 css3/masking/clip-path-columns-svg-clippath-usou.html [ Failure ]
+crbug.com/591099 css3/masking/clip-path-columns-shape.html [ Failure Pass ]
+crbug.com/591099 css3/masking/clip-path-columns-svg-clippath-usou.html [ Failure Pass ]
 crbug.com/591099 css3/masking/clip-path-ellipse.html [ Failure Pass ]
 crbug.com/591099 css3/masking/clip-path-inset-corners.html [ Failure ]
 crbug.com/591099 css3/masking/clip-path-polygon-evenodd.html [ Failure Pass ]
@@ -3774,7 +3774,7 @@
 crbug.com/591099 external/wpt/css/css-writing-modes-3/block-flow-direction-vrl-021.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/block-flow-direction-vrl-024.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/block-flow-direction-vrl-026.xht [ Failure ]
-crbug.com/591099 external/wpt/css/css-writing-modes-3/block-plaintext-004.html [ Failure ]
+crbug.com/591099 external/wpt/css/css-writing-modes-3/block-plaintext-004.html [ Failure Pass ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/central-baseline-alignment-002.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/clearance-calculations-vrl-002.xht [ Failure ]
 crbug.com/591099 external/wpt/css/css-writing-modes-3/clearance-calculations-vrl-004.xht [ Failure ]
@@ -3903,8 +3903,9 @@
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/variables/variable-declaration-17.html [ Failure Pass ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/variables/variable-declaration-18.html [ Failure Pass ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/variables/variable-font-face-01.html [ Failure Pass ]
-crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/writing-modes-3/dynamic-offset-vrl-002.html [ Failure ]
-crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/writing-modes-3/dynamic-offset-vrl-rtl-002.html [ Failure ]
+crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/variables/variable-font-face-02.html [ Failure Pass ]
+crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/writing-modes-3/dynamic-offset-vrl-002.html [ Failure Pass ]
+crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/writing-modes-3/dynamic-offset-vrl-rtl-002.html [ Failure Pass ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/writing-modes-3/text-combine-upright-break-inside-001.html [ Failure ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/writing-modes-3/text-combine-upright-compression-001.html [ Crash Failure Pass ]
 crbug.com/591099 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/writing-modes-3/text-combine-upright-compression-003.html [ Crash Failure ]
@@ -4098,6 +4099,7 @@
 crbug.com/591099 external/wpt/longtask-timing/longtask-in-sibling-iframe.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/media-source/mediasource-getvideoplaybackquality.html [ Crash Timeout ]
 crbug.com/591099 external/wpt/offscreen-canvas/fill-and-stroke-styles/2d.pattern.basic.nocontext.worker.html [ Pass ]
+crbug.com/591099 external/wpt/payment-request/interfaces.https.html [ Timeout ]
 crbug.com/591099 external/wpt/payment-request/payment-allowed-by-feature-policy.https.sub.html [ Pass ]
 crbug.com/591099 external/wpt/payment-request/payment-disabled-by-feature-policy.https.sub.html [ Pass ]
 crbug.com/591099 external/wpt/performance-timeline/po-callback-mutate.any.html [ Pass ]
@@ -4136,7 +4138,7 @@
 crbug.com/591099 external/wpt/selection/extend-00.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/selection/extend-20.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/selection/selectAllChildren.html [ Pass Timeout ]
-crbug.com/591099 external/wpt/service-workers/service-worker/fetch-frame-resource.https.html [ Crash Timeout ]
+crbug.com/591099 external/wpt/service-workers/service-worker/fetch-frame-resource.https.html [ Crash Pass Timeout ]
 crbug.com/591099 external/wpt/svg/interfaces.html [ Pass Timeout ]
 crbug.com/591099 external/wpt/svg/linking/reftests/href-filter-element.html [ Crash Failure ]
 crbug.com/591099 external/wpt/uievents/order-of-events/focus-events/focus-manual.html [ Crash Failure Timeout ]
@@ -7028,7 +7030,7 @@
 crbug.com/591099 fast/events/event-targets.html [ Crash Failure Pass ]
 crbug.com/591099 fast/events/event-trace.html [ Failure Pass ]
 crbug.com/591099 fast/events/event-trusted.html [ Failure ]
-crbug.com/591099 fast/events/event-view-toString.html [ Failure Pass ]
+crbug.com/591099 fast/events/event-view-toString.html [ Failure Pass Timeout ]
 crbug.com/591099 fast/events/fire-mousedown-while-pressing-mouse-button.html [ Crash Failure Pass ]
 crbug.com/591099 fast/events/fire-popstate-event.html [ Failure Pass ]
 crbug.com/591099 fast/events/fire-scroll-event-element.html [ Failure Pass Timeout ]
@@ -7578,7 +7580,7 @@
 crbug.com/591099 fast/forms/calendar-picker/calendar-picker-with-step.html [ Crash Failure Pass ]
 crbug.com/591099 fast/forms/calendar-picker/date-open-picker-with-f4-key.html [ Failure Pass ]
 crbug.com/591099 fast/forms/calendar-picker/date-picker-ax.html [ Crash Failure Pass ]
-crbug.com/591099 fast/forms/calendar-picker/date-picker-choose-default-value-after-set-value.html [ Crash Failure Pass ]
+crbug.com/591099 fast/forms/calendar-picker/date-picker-choose-default-value-after-set-value.html [ Crash Failure Pass Timeout ]
 crbug.com/591099 fast/forms/calendar-picker/date-picker-events.html [ Crash Failure Pass Timeout ]
 crbug.com/591099 fast/forms/calendar-picker/date-picker-open-without-focus.html [ Failure Pass ]
 crbug.com/591099 fast/forms/calendar-picker/datetimelocal-change-type-on-input-crash.html [ Crash Failure Pass ]
@@ -8786,7 +8788,7 @@
 crbug.com/591099 fast/html/imports/sub-imports-onload.html [ Failure Pass ]
 crbug.com/591099 fast/html/imports/xhr.html [ Failure Pass ]
 crbug.com/591099 fast/html/input-type-change-crash.html [ Failure Pass ]
-crbug.com/757767 fast/html/layout-runs-and-floats-crash.html [ Timeout ]
+crbug.com/757767 fast/html/layout-runs-and-floats-crash.html [ Pass Timeout ]
 crbug.com/591099 fast/html/meter-user-modify.html [ Failure Pass ]
 crbug.com/591099 fast/html/object-border.html [ Failure Pass ]
 crbug.com/591099 fast/html/progress-user-modify.html [ Failure Pass ]
@@ -9398,7 +9400,7 @@
 crbug.com/591099 fast/multicol/change-height.html [ Failure ]
 crbug.com/591099 fast/multicol/client-rect-after-spanner.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/client-rect-nested.html [ Failure Timeout ]
-crbug.com/591099 fast/multicol/client-rects-crossing-boundaries-nested.html [ Failure ]
+crbug.com/591099 fast/multicol/client-rects-crossing-boundaries-nested.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/client-rects-crossing-boundaries.html [ Failure ]
 crbug.com/591099 fast/multicol/client-rects-rtl.html [ Failure ]
 crbug.com/591099 fast/multicol/client-rects-sole-empty-block.html [ Failure ]
@@ -9409,7 +9411,7 @@
 crbug.com/591099 fast/multicol/column-width-zero.html [ Failure Pass ]
 crbug.com/591099 fast/multicol/columns-shorthand-parsing-2.html [ Failure Pass ]
 crbug.com/591099 fast/multicol/columns-shorthand-parsing.html [ Failure ]
-crbug.com/591099 fast/multicol/composited-inner-multicol.html [ Failure ]
+crbug.com/591099 fast/multicol/composited-inner-multicol.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/composited-layer-multiple-fragments-translated.html [ Failure ]
 crbug.com/591099 fast/multicol/composited-layer.html [ Failure ]
 crbug.com/591099 fast/multicol/composited-opacity-2nd-and-3rd-column.html [ Failure ]
@@ -9426,7 +9428,7 @@
 crbug.com/591099 fast/multicol/cssom-view.html [ Failure ]
 crbug.com/591099 fast/multicol/doubly-nested-with-increasing-row-heights-crash.html [ Failure Pass ]
 crbug.com/757767 fast/multicol/doubly-nested-with-insane-child-height-crash.html [ Timeout ]
-crbug.com/591099 fast/multicol/doubly-nested-with-top-padding-crossing-row-boundaries.html [ Failure ]
+crbug.com/591099 fast/multicol/doubly-nested-with-top-padding-crossing-row-boundaries.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/dynamic/abspos-becomes-spanner.html [ Failure ]
 crbug.com/591099 fast/multicol/dynamic/abspos-multicol-with-spanner-becomes-spanner.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/dynamic/block-becomes-spanner.html [ Failure ]
@@ -9494,7 +9496,7 @@
 crbug.com/591099 fast/multicol/dynamic/valid-spanner-container-becomes-invalid.html [ Failure ]
 crbug.com/591099 fast/multicol/empty-list-item.html [ Failure Pass ]
 crbug.com/591099 fast/multicol/event-offset-complex-tree.html [ Failure ]
-crbug.com/591099 fast/multicol/event-offset-in-nested.html [ Failure ]
+crbug.com/591099 fast/multicol/event-offset-in-nested.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/event-offset.html [ Failure ]
 crbug.com/591099 fast/multicol/explicit-columns-auto.html [ Failure Pass ]
 crbug.com/591099 fast/multicol/filter-in-second-column.html [ Failure ]
@@ -9602,7 +9604,7 @@
 crbug.com/591099 fast/multicol/nested-with-padding.html [ Failure ]
 crbug.com/591099 fast/multicol/nested-with-single-empty-block.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/nested-with-single-tall-line.html [ Failure ]
-crbug.com/591099 fast/multicol/nested-with-tall-block.html [ Failure ]
+crbug.com/591099 fast/multicol/nested-with-tall-block.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/newmulticol/avoid-column-break-inside.html [ Failure ]
 crbug.com/591099 fast/multicol/newmulticol/balance-images.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/newmulticol/balance-maxheight1.html [ Failure ]
@@ -9679,7 +9681,7 @@
 crbug.com/591099 fast/multicol/span/abspos-containing-block-outside-spanner.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/span/adjacent-spanners-with-margin.html [ Failure ]
 crbug.com/591099 fast/multicol/span/adjacent-spanners.html [ Failure Timeout ]
-crbug.com/591099 fast/multicol/span/after-row-with-uneven-height-nested-multicol.html [ Failure ]
+crbug.com/591099 fast/multicol/span/after-row-with-uneven-height-nested-multicol.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/span/anonymous-before-child-parent-crash.html [ Failure Pass ]
 crbug.com/591099 fast/multicol/span/anonymous-split-block-crash.html [ Failure Pass ]
 crbug.com/591099 fast/multicol/span/as-inner-multicol-after-composited-layer-crash.html [ Failure Pass ]
@@ -9720,7 +9722,7 @@
 crbug.com/591099 fast/multicol/span/invalid-spanner-in-transform.html [ Failure ]
 crbug.com/591099 fast/multicol/span/margin-on-multicol.html [ Failure ]
 crbug.com/591099 fast/multicol/span/multicol-with-padding.html [ Failure ]
-crbug.com/591099 fast/multicol/span/nested-multicol.html [ Failure ]
+crbug.com/591099 fast/multicol/span/nested-multicol.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/span/offset-properties-empty-content.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/span/offset-properties.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/span/outer-column-break-after-inner-spanner-2.html [ Failure ]
@@ -9791,7 +9793,7 @@
 crbug.com/757767 fast/multicol/vertical-lr/caret-range-outside-columns-rtl.html [ Failure Timeout ]
 crbug.com/757767 fast/multicol/vertical-lr/caret-range-outside-columns.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/vertical-lr/client-rect-after-spanner.html [ Failure Timeout ]
-crbug.com/591099 fast/multicol/vertical-lr/client-rects-crossing-boundaries-nested.html [ Failure ]
+crbug.com/591099 fast/multicol/vertical-lr/client-rects-crossing-boundaries-nested.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/vertical-lr/column-break-with-balancing.html [ Failure ]
 crbug.com/591099 fast/multicol/vertical-lr/column-count-with-rules.html [ Failure ]
 crbug.com/591099 fast/multicol/vertical-lr/column-rules.html [ Failure ]
@@ -9806,7 +9808,7 @@
 crbug.com/591099 fast/multicol/vertical-lr/gap-non-negative.html [ Failure Pass ]
 crbug.com/591099 fast/multicol/vertical-lr/image-inside-nested-blocks-with-border.html [ Failure ]
 crbug.com/591099 fast/multicol/vertical-lr/nested-columns.html [ Failure ]
-crbug.com/591099 fast/multicol/vertical-lr/offset-top-and-left-at-boundaries-nested.html [ Failure ]
+crbug.com/591099 fast/multicol/vertical-lr/offset-top-and-left-at-boundaries-nested.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/vertical-lr/offset-top-and-left-at-boundaries.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/vertical-lr/offset-top-and-left-nested.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/vertical-lr/rules-with-border-before.html [ Failure ]
@@ -9822,7 +9824,7 @@
 crbug.com/591099 fast/multicol/vertical-rl/caret-range-outside-columns-rtl.html [ Failure ]
 crbug.com/591099 fast/multicol/vertical-rl/caret-range-outside-columns.html [ Failure ]
 crbug.com/591099 fast/multicol/vertical-rl/client-rect-after-spanner.html [ Failure Timeout ]
-crbug.com/591099 fast/multicol/vertical-rl/client-rects-crossing-boundaries-nested.html [ Failure ]
+crbug.com/591099 fast/multicol/vertical-rl/client-rects-crossing-boundaries-nested.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/vertical-rl/column-break-with-balancing.html [ Failure ]
 crbug.com/591099 fast/multicol/vertical-rl/column-count-with-rules.html [ Failure ]
 crbug.com/591099 fast/multicol/vertical-rl/column-rules.html [ Failure ]
@@ -9837,7 +9839,7 @@
 crbug.com/591099 fast/multicol/vertical-rl/gap-non-negative.html [ Failure Pass ]
 crbug.com/591099 fast/multicol/vertical-rl/image-inside-nested-blocks-with-border.html [ Failure ]
 crbug.com/757767 fast/multicol/vertical-rl/nested-columns.html [ Crash Failure ]
-crbug.com/591099 fast/multicol/vertical-rl/offset-top-and-left-at-boundaries-nested.html [ Failure ]
+crbug.com/591099 fast/multicol/vertical-rl/offset-top-and-left-at-boundaries-nested.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/vertical-rl/offset-top-and-left-at-boundaries.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/vertical-rl/offset-top-and-left-nested.html [ Failure Timeout ]
 crbug.com/591099 fast/multicol/vertical-rl/rules-with-border-before.html [ Failure ]
@@ -10740,7 +10742,7 @@
 crbug.com/591099 fast/text/international/text-combine-parser-test.html [ Failure Pass ]
 crbug.com/591099 fast/text/international/thai-cursor-position.html [ Failure Pass ]
 crbug.com/591099 fast/text/international/thai-offsetForPosition-inside-character.html [ Failure Pass ]
-crbug.com/591099 fast/text/international/unicode-bidi-plaintext.html [ Failure ]
+crbug.com/591099 fast/text/international/unicode-bidi-plaintext.html [ Failure Pass ]
 crbug.com/591099 fast/text/international/vertical-text-metrics-test.html [ Failure Pass ]
 crbug.com/591099 fast/text/justify-ideograph-vertical.html [ Crash Failure ]
 crbug.com/591099 fast/text/large-text-composed-char.html [ Failure Timeout ]
@@ -11315,7 +11317,7 @@
 crbug.com/591099 html/dialog/inert-node-is-unselectable.html [ Failure ]
 crbug.com/591099 html/dialog/modal-dialog-ancestor-is-inert.html [ Failure Pass ]
 crbug.com/591099 html/dialog/modal-dialog-blocks-mouse-events.html [ Failure Pass ]
-crbug.com/591099 html/dialog/modal-dialog-distributed-child-is-not-inert.html [ Failure Pass ]
+crbug.com/591099 html/dialog/modal-dialog-distributed-child-is-not-inert.html [ Failure Pass Timeout ]
 crbug.com/591099 html/dialog/multiple-centered-dialogs.html [ Failure ]
 crbug.com/591099 html/dialog/non-modal-dialog-does-not-block-mouse-events.html [ Failure Pass ]
 crbug.com/591099 html/dialog/non-modal-dialog-layout.html [ Failure Pass ]
@@ -11479,6 +11481,9 @@
 crbug.com/591099 http/tests/devtools/animation/animation-timeline.html [ Crash Failure Pass ]
 crbug.com/591099 http/tests/devtools/animation/animation-transition-setTiming-crash.html [ Crash Failure Pass Timeout ]
 crbug.com/591099 http/tests/devtools/animation/animation-web-anim-negative-start-time.html [ Crash Failure Pass ]
+crbug.com/591099 http/tests/devtools/appcache/appcache-iframe-manifests.html [ Crash Failure Pass Timeout ]
+crbug.com/591099 http/tests/devtools/appcache/appcache-manifest-with-non-existing-file.html [ Failure Timeout ]
+crbug.com/591099 http/tests/devtools/appcache/appcache-swap.html [ Failure Timeout ]
 crbug.com/591099 http/tests/devtools/audits/audits-empty-stylesheet.html [ Crash Failure Pass ]
 crbug.com/591099 http/tests/devtools/audits/audits-panel-functional.html [ Crash Failure Pass ]
 crbug.com/591099 http/tests/devtools/changes/changes-highlighter.html [ Crash Failure Pass Timeout ]
@@ -11644,6 +11649,7 @@
 crbug.com/591099 http/tests/devtools/elements/elements-delete-inline-style.html [ Crash Failure Pass ]
 crbug.com/591099 http/tests/devtools/elements/elements-img-tooltip.html [ Crash Failure Pass ]
 crbug.com/591099 http/tests/devtools/elements/elements-inspect-iframe-from-different-domain.html [ Crash Failure Pass Timeout ]
+crbug.com/591099 http/tests/devtools/elements/elements-linkify-attributes.html [ Crash Failure Timeout ]
 crbug.com/591099 http/tests/devtools/elements/elements-panel-correct-case.html [ Crash Failure Pass ]
 crbug.com/591099 http/tests/devtools/elements/elements-panel-limited-children.html [ Crash Failure Pass Timeout ]
 crbug.com/591099 http/tests/devtools/elements/elements-panel-reload-assert.html [ Crash Failure Pass Timeout ]
@@ -11841,6 +11847,7 @@
 crbug.com/591099 http/tests/devtools/modules-load-source.html [ Failure Pass ]
 crbug.com/591099 http/tests/devtools/network/network-columns-visible.html [ Crash Failure Pass Timeout ]
 crbug.com/591099 http/tests/devtools/network/network-cookies-pane.html [ Crash Failure Pass ]
+crbug.com/591099 http/tests/devtools/network/network-datareceived.html [ Pass Timeout ]
 crbug.com/591099 http/tests/devtools/network/network-disable-cache-preloads.php [ Crash Failure ]
 crbug.com/591099 http/tests/devtools/network/network-domain-filter.html [ Failure Pass ]
 crbug.com/591099 http/tests/devtools/network/network-filmstrip-overview-showing.html [ Failure Pass ]
@@ -11933,6 +11940,11 @@
 crbug.com/591099 http/tests/devtools/sass/test-ssp-editing.html [ Crash Failure Pass ]
 crbug.com/591099 http/tests/devtools/sass/test-ssp-incremental-edit-invalid-value.html [ Crash Failure Pass ]
 crbug.com/591099 http/tests/devtools/schema-get-domains-matches-agents.html [ Failure Pass ]
+crbug.com/591099 http/tests/devtools/search/search-in-non-existing-resource.html [ Failure ]
+crbug.com/591099 http/tests/devtools/search/search-in-resource.html [ Failure ]
+crbug.com/591099 http/tests/devtools/search/search-in-script.html [ Failure ]
+crbug.com/591099 http/tests/devtools/search/search-in-static.html [ Failure ]
+crbug.com/591099 http/tests/devtools/service-workers/user-agent-override.html [ Failure Pass Timeout ]
 crbug.com/591099 http/tests/devtools/sources/autocomplete-css.html [ Crash Failure Pass ]
 crbug.com/591099 http/tests/devtools/sources/autocomplete-general.html [ Crash Failure Pass ]
 crbug.com/591099 http/tests/devtools/sources/autocomplete-hide-on-smart-brace.html [ Crash Failure Pass ]
@@ -12348,9 +12360,6 @@
 crbug.com/591099 http/tests/inspector-protocol/network/request-interception-patterns.js [ Timeout ]
 crbug.com/591099 http/tests/inspector-unit/viewport-datagrid-items-attached-to-dom.js [ Failure ]
 crbug.com/591099 http/tests/inspector-unit/viewport-datagrid-items-expandable-attached-to-dom.js [ Failure ]
-crbug.com/591099 http/tests/devtools/appcache/appcache-iframe-manifests.html [ Crash Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/appcache/appcache-manifest-with-non-existing-file.html [ Failure Timeout ]
-crbug.com/591099 http/tests/devtools/appcache/appcache-swap.html [ Failure Timeout ]
 crbug.com/591099 http/tests/inspector/application-panel/resources-panel-on-navigation.html [ Failure Pass Timeout ]
 crbug.com/591099 http/tests/inspector/application-panel/resources-panel-resource-preview.html [ Failure Pass Timeout ]
 crbug.com/591099 http/tests/inspector/application-panel/resources-panel-selection-on-reload.html [ Failure Pass Timeout ]
@@ -12375,12 +12384,6 @@
 crbug.com/591099 http/tests/inspector/bindings/sourcemap-navigator-multiple-frames.html [ Crash Failure Pass Timeout ]
 crbug.com/591099 http/tests/inspector/bindings/suspendtarget-bindings.html [ Crash Failure Pass Timeout ]
 crbug.com/591099 http/tests/inspector/bindings/suspendtarget-navigator.html [ Crash Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/cache-storage/cache-data.html [ Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/cache-storage/cache-deletion.html [ Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/cache-storage/cache-entry-deletion.html [ Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/cache-storage/cache-live-update-cache-content.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/cache-storage/cache-live-update-list.html [ Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/cache-storage/cache-names.html [ Failure Pass Timeout ]
 crbug.com/591099 http/tests/inspector/command-line-api-inspect.html [ Crash Failure Pass ]
 crbug.com/591099 http/tests/inspector/compiler-script-mapping.html [ Crash Failure Pass ]
 crbug.com/591099 http/tests/inspector/compiler-source-mapping-debug.html [ Crash Failure Pass ]
@@ -12393,21 +12396,6 @@
 crbug.com/591099 http/tests/inspector/console-xhr-logging-async.html [ Crash Failure Pass ]
 crbug.com/591099 http/tests/inspector/console-xhr-logging.html [ Crash Failure Pass ]
 crbug.com/591099 http/tests/inspector/console/console-links-on-messages-before-inspection.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/debugger/fetch-breakpoints.html [ Crash Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/elements/elements-linkify-attributes.html [ Crash Failure Timeout ]
-crbug.com/591099 http/tests/devtools/elements/event-listeners-framework-with-service-worker.html [ Crash Failure Pass ]
-crbug.com/591099 http/tests/devtools/elements/html-link-import.html [ Crash Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/elements/styles/edit-css-with-source-url.html [ Crash Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/elements/styles/import-added-through-js-crash.html [ Crash Failure Pass ]
-crbug.com/591099 http/tests/devtools/elements/styles/inline-stylesheet-sourceurl-and-sourcemapurl.html [ Crash Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/elements/styles/selector-line-deprecated.html [ Crash Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/elements/styles/selector-line-sourcemap-header-deprecated.html [ Crash Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/elements/styles/selector-line-sourcemap-header.html [ Crash Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/elements/styles/selector-line.html [ Crash Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/elements/styles/styles-do-not-add-inline-stylesheets-in-navigator.html [ Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/elements/styles/styles-redirected-css.html [ Crash Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/elements/styles/stylesheet-tracking.html [ Crash Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/elements/styles/xsl-transformed.xml [ Crash Failure Pass Timeout ]
 crbug.com/591099 http/tests/inspector/extensions-headers.html [ Crash Failure Pass ]
 crbug.com/591099 http/tests/inspector/extensions-iframe-eval.html [ Crash Failure Pass ]
 crbug.com/591099 http/tests/inspector/extensions-ignore-cache.html [ Crash Failure Pass ]
@@ -12470,76 +12458,6 @@
 crbug.com/591099 http/tests/inspector/resource-har-headers.html [ Crash Failure Pass ]
 crbug.com/591099 http/tests/inspector/resource-parameters-ipv6.html [ Crash Failure Pass ]
 crbug.com/591099 http/tests/inspector/resource-parameters.html [ Crash Failure Pass ]
-crbug.com/591099 http/tests/devtools/resource-tree/cached-resource-metadata.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/resource-tree/iframe-main-resource.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/resource-tree/resource-metadata.html [ Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/resource-tree/resource-request-content-after-loading-and-clearing-cache.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/resource-tree/resource-request-content-while-loading.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/resource-tree/resource-tree-crafted-frame-add.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/resource-tree/resource-tree-document-url.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/resource-tree/resource-tree-events.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/resource-tree/resource-tree-frame-add.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/resource-tree/resource-tree-frame-in-crafted-frame.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/resource-tree/resource-tree-frame-navigate.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/resource-tree/resource-tree-htmlimports.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/resource-tree/resource-tree-invalid-mime-type-css-content.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/resource-tree/resource-tree-no-xhrs.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/resource-tree/resource-tree-non-unique-url.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/search/search-ignore-binary-files.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/search/search-in-non-existing-resource.html [ Failure ]
-crbug.com/591099 http/tests/devtools/search/search-in-resource.html [ Failure ]
-crbug.com/591099 http/tests/devtools/search/search-in-script.html [ Failure ]
-crbug.com/591099 http/tests/devtools/search/search-in-static.html [ Failure ]
-crbug.com/591099 http/tests/devtools/search/source-frame-replace-1.html [ Crash Failure Pass ]
-crbug.com/591099 http/tests/devtools/search/source-frame-replace-2.html [ Crash Failure Pass ]
-crbug.com/591099 http/tests/devtools/search/source-frame-replace-3.html [ Crash Failure Pass ]
-crbug.com/591099 http/tests/devtools/search/source-frame-replace-4.html [ Crash Failure Pass ]
-crbug.com/591099 http/tests/devtools/search/source-frame-search.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/search/sources-search-scope-in-files.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/search/sources-search-scope-many-projects.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/security/blank-origins-not-shown.html [ Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/security/blocked-mixed-content.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/security/failed-request.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/security/interstitial-sidebar.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/security/main-origin-assigned-despite-request-missing.html [ Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/security/mixed-content-active-and-passive-reload.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/security/mixed-content-reload.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/security/origin-group-names-unique.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/security/origin-view-then-interstitial.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/security/security-blocked-mixed-content.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/security/security-details-updated-with-security-state.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/security/security-explanation-ordering.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/security/security-state-comparator.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/security/security-summary.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/security/security-unknown-resource.html [ Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/service-workers/lazy-addeventlisteners.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/service-workers/service-worker-agents.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/service-workers/service-worker-manager.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/service-workers/service-worker-network-fetch-blocked.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/service-workers/service-worker-network-fetch.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/service-workers/service-worker-pause.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/service-workers/service-workers-bypass-for-network-redirect.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/service-workers/service-workers-force-update-on-page-load.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/service-workers/service-workers-navigation-preload.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/service-workers/service-workers-redundant.html [ Crash Failure Pass ]
-crbug.com/591099 http/tests/devtools/service-workers/service-workers-view.html [ Crash Failure Pass ]
-crbug.com/591099 http/tests/devtools/service-workers/user-agent-override.html [ Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/sources/css-sourcemaps-toggle-enabled.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/sources/debugger/async-callstack-fetch.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/sources/debugger/async-callstack-network-initiator-image.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/sources/debugger/async-callstack-network-initiator.html [ Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/sources/debugger/pause-in-removed-frame.html [ Crash Failure Pass ]
-crbug.com/591099 http/tests/devtools/sources/debugger/source-map-http-header.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/sources/debugger/worker-debugging-script-mapping.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/sources/debugger/worker-debugging.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/sources/event-listener-breakpoints-script-fst-stmt-for-module.html [ Failure Pass Timeout ]
-crbug.com/591099 http/tests/devtools/sources/js-sourcemaps-toggle-enabled.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/sources/navigator-view-content-scripts.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/sources/ui-source-code-highlight.php [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/sources/ui-source-code-metadata.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/stacktraces/csp-inline-warning-contains-stacktrace.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/stacktraces/csp-setInterval-warning-contains-stacktrace.html [ Failure Pass ]
-crbug.com/591099 http/tests/devtools/stacktraces/csp-setTimeout-warning-contains-stacktrace.html [ Failure Pass ]
 crbug.com/591099 http/tests/inspector/stylesheet-source-mapping.html [ Crash Failure Pass ]
 crbug.com/591099 http/tests/inspector/template-content-inspect-crash.html [ Crash Failure Pass ]
 crbug.com/591099 http/tests/inspector/text-source-map.html [ Crash Failure Pass ]
@@ -14569,9 +14487,9 @@
 crbug.com/591099 plugins/release-frame-content-window.html [ Failure Pass ]
 crbug.com/591099 plugins/sequential-focus.html [ Failure Pass ]
 crbug.com/591099 plugins/tabindex.html [ Crash Failure ]
-crbug.com/591099 plugins/webview-plugin-lifecycle.html [ Failure Pass ]
-crbug.com/591099 plugins/webview-plugin-nested-iframe-scroll.html [ Failure ]
-crbug.com/591099 plugins/webview-plugin-scroll.html [ Failure Pass ]
+crbug.com/591099 plugins/webview-plugin-lifecycle.html [ Crash Failure Pass ]
+crbug.com/591099 plugins/webview-plugin-nested-iframe-scroll.html [ Crash Failure ]
+crbug.com/591099 plugins/webview-plugin-scroll.html [ Crash Failure Pass ]
 crbug.com/591099 plugins/webview-plugin-type-change.html [ Failure Pass ]
 crbug.com/591099 pointer-lock/bug90391-move-then-window-open-crash.html [ Failure Pass ]
 crbug.com/591099 pointer-lock/lock-already-locked.html [ Failure Pass ]
diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index 477922a..07da1be 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations
@@ -89,6 +89,9 @@
 crbug.com/726075 [ Win ] external/wpt/webvtt/rendering/cues-with-video/processing-model/dom_override_remove_cue_while_paused.html [ Failure ]
 crbug.com/726075 [ Win Debug ] virtual/exotic-color-space/images/color-profile-border-fade.html [ Failure ]
 
+# Fails because the manual test hasn't been automated yet
+crbug.com/762054 external/wpt/cssom-view/scrollBoundaryBehavior-manual.html [ Skip ]
+
 # Fails consistently on WebKit Mac10.10, WebKit Mac10.11 (retina) and mac10.10_blink_rel tryserver, but not on other Mac bots.
 crbug.com/614910 [ Mac ] virtual/gpu-rasterization/images/pixel-crack-image-background-webkit-transform-scale.html [ Pass Failure ]
 
@@ -104,9 +107,6 @@
 # Should make a pixel test to keep coverage.
 crbug.com/713891 virtual/exotic-color-space/images/animated-png.html [ Pass Failure ]
 
-crbug.com/717389 [ Linux Debug ] virtual/gpu/fast/canvas/canvas-clip-rule.html [ Crash ]
-crbug.com/717389 [ Win7 Debug ] virtual/gpu/fast/canvas/canvas-clip-rule.html [ Timeout ]
-
 # Flakily timing out or failing.
 # TODO(ccameron): Investigate this.
 crbug.com/730267 virtual/gpu-rasterization/images/color-profile-group.html [ Pass Timeout Failure ]
@@ -1490,7 +1490,7 @@
 crbug.com/548765 http/tests/inspector/console-fetch-logging.html [ Failure Pass ]
 crbug.com/548765 virtual/mojo-loading/http/tests/inspector/console-fetch-logging.html [ Failure Pass ]
 
-crbug.com/564109 [ Win ]  external/wpt/css-font-display/font-display.html [ Pass Failure Timeout ]
+crbug.com/564109 [ Win ] external/wpt/css-fonts/font-display/font-display.html [ Failure Pass Timeout ]
 crbug.com/564109 [ Win ]  http/tests/webfont/font-display-intervention.html [ Pass Failure Timeout ]
 crbug.com/564109 [ Win ]  virtual/mojo-loading/http/tests/webfont/font-display-intervention.html [ Pass Failure Timeout ]
 
diff --git a/third_party/WebKit/LayoutTests/accessibility/set-selection-child-offset.html b/third_party/WebKit/LayoutTests/accessibility/set-selection-child-offset.html
index 8c3f2d3..483a29e 100644
--- a/third_party/WebKit/LayoutTests/accessibility/set-selection-child-offset.html
+++ b/third_party/WebKit/LayoutTests/accessibility/set-selection-child-offset.html
@@ -52,7 +52,7 @@
         assert_equals(sel.startContainer.textContent, "this is a");
 
         // Select the second child.
-        axRegion.setSelection(axRegion, 1, axRegion, 2);
+        axRegion.setSelection(axRegion, 1, axRegion, 3);
         updateSelectedRangeFromPage();
         assert_equals(sel.toString(), "test\n");
         assert_false(sel.collapsed);
@@ -65,7 +65,7 @@
         assert_equals(sel.endContainer.textContent, "\n    ");
 
         // Next, another insertion point between second and third child.
-        axRegion.setSelection(axRegion, 2, axRegion, 2);
+        axRegion.setSelection(axRegion, 3, axRegion, 3);
         updateSelectedRangeFromPage();
         assert_equals(sel.toString(), "");
         assert_true(sel.collapsed);
@@ -74,7 +74,7 @@
         assert_equals(sel.startContainer.textContent, "\n    ");
 
         // Select the third child.
-        axRegion.setSelection(axRegion, 2, axRegion, 3);
+        axRegion.setSelection(axRegion, 3, axRegion, 4);
         updateSelectedRangeFromPage();
         assert_equals(sel.toString(), "of selection");
         assert_false(sel.collapsed);
@@ -86,7 +86,7 @@
         assert_equals(sel.endContainer.textContent, "of selection");
 
         // Select the first and second children.
-        axRegion.setSelection(axRegion, 0, axRegion, 2);
+        axRegion.setSelection(axRegion, 0, axRegion, 3);
         updateSelectedRangeFromPage();
         assert_equals(sel.toString(), "this is atest\n");
         assert_false(sel.collapsed);
@@ -98,7 +98,7 @@
         assert_equals(sel.endContainer.textContent, "\n    ");
 
         // Select the second and third children.
-        axRegion.setSelection(axRegion, 1, axRegion, 3);
+        axRegion.setSelection(axRegion, 1, axRegion, 4);
         updateSelectedRangeFromPage();
         assert_equals(sel.toString(), "test\n    of selection");
         assert_false(sel.collapsed);
@@ -110,7 +110,7 @@
         assert_equals(sel.endContainer.textContent, "of selection");
 
         // Select everything.
-        axRegion.setSelection(axRegion, 0, axRegion, 3);
+        axRegion.setSelection(axRegion, 0, axRegion, 4);
         updateSelectedRangeFromPage();
         assert_equals(sel.toString(), "this is atest\n    of selection");
         assert_false(sel.collapsed);
@@ -122,7 +122,7 @@
         assert_equals(sel.endContainer.textContent, "of selection");
 
         // Last, the insertion point after third child.
-        axRegion.setSelection(axRegion, 3, axRegion, 3);
+        axRegion.setSelection(axRegion, 4, axRegion, 4);
         updateSelectedRangeFromPage();
         assert_equals(sel.toString(), "");
         assert_true(sel.collapsed);
diff --git a/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json b/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json
index 09af48f..f795dd6 100644
--- a/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json
+++ b/third_party/WebKit/LayoutTests/external/WPT_BASE_MANIFEST.json
@@ -5511,12 +5511,12 @@
      {}
     ]
    ],
-   "css-font-display/font-display.html": [
+   "css-fonts/font-display/font-display.html": [
     [
-     "/css-font-display/font-display.html",
+     "/css-fonts/font-display/font-display.html",
      [
       [
-       "/css-font-display/font-display-ref.html",
+       "/css-fonts/font-display/font-display-ref.html",
        "=="
       ]
      ],
@@ -73488,16 +73488,6 @@
      {}
     ]
    ],
-   "css-font-display/font-display-ref.html": [
-    [
-     {}
-    ]
-   ],
-   "css-font-display/resources/slow-ahem-loading.py": [
-    [
-     {}
-    ]
-   ],
    "css-font-loading/OWNERS": [
     [
      {}
@@ -73508,6 +73498,16 @@
      {}
     ]
    ],
+   "css-fonts/font-display/font-display-ref.html": [
+    [
+     {}
+    ]
+   ],
+   "css-fonts/font-display/resources/slow-ahem-loading.py": [
+    [
+     {}
+    ]
+   ],
    "css-fonts/matching/README.md": [
     [
      {}
@@ -87963,6 +87963,11 @@
      {}
     ]
    ],
+   "css/css-logical-1/OWNERS": [
+    [
+     {}
+    ]
+   ],
    "css/css-logical-1/cascading-001-ref.html": [
     [
      {}
@@ -101063,11 +101068,6 @@
      {}
     ]
    ],
-   "generic-sensor/idlharness-expected.txt": [
-    [
-     {}
-    ]
-   ],
    "geolocation-API/OWNERS": [
     [
      {}
@@ -101098,11 +101098,6 @@
      {}
     ]
    ],
-   "gyroscope/idlharness.https-expected.txt": [
-    [
-     {}
-    ]
-   ],
    "hr-time/OWNERS": [
     [
      {}
@@ -115293,11 +115288,6 @@
      {}
     ]
    ],
-   "orientation-sensor/idlharness.https-expected.txt": [
-    [
-     {}
-    ]
-   ],
    "page-visibility/OWNERS": [
     [
      {}
@@ -133511,6 +133501,12 @@
      {}
     ]
    ],
+   "XMLHttpRequest/access-control-preflight-async-not-supported.htm": [
+    [
+     "/XMLHttpRequest/access-control-preflight-async-not-supported.htm",
+     {}
+    ]
+   ],
    "XMLHttpRequest/access-control-preflight-credential-async.htm": [
     [
      "/XMLHttpRequest/access-control-preflight-credential-async.htm",
@@ -133583,6 +133579,12 @@
      {}
     ]
    ],
+   "XMLHttpRequest/access-control-preflight-sync-not-supported.htm": [
+    [
+     "/XMLHttpRequest/access-control-preflight-sync-not-supported.htm",
+     {}
+    ]
+   ],
    "XMLHttpRequest/access-control-response-with-body.htm": [
     [
      "/XMLHttpRequest/access-control-response-with-body.htm",
@@ -146803,9 +146805,9 @@
      {}
     ]
    ],
-   "generic-sensor/idlharness.html": [
+   "generic-sensor/idlharness.https.html": [
     [
-     "/generic-sensor/idlharness.html",
+     "/generic-sensor/idlharness.https.html",
      {}
     ]
    ],
@@ -190653,7 +190655,7 @@
    "support"
   ],
   "./lint.whitelist": [
-   "41972c110065c638f914d33d35d123a5732f84d6",
+   "85909de8994c7339bd86c969094a072de473a6de",
    "support"
   ],
   "./update-built-tests.sh": [
@@ -196805,7 +196807,7 @@
    "testharness"
   ],
   "WebCryptoAPI/OWNERS": [
-   "6b3912f3c429e9c99ba542db34c51986b6de890b",
+   "6761dcfa3196604b8f4f3be42f1abfd432d9f8f0",
    "support"
   ],
   "WebCryptoAPI/README.md": [
@@ -197421,7 +197423,7 @@
    "testharness"
   ],
   "WebIDL/OWNERS": [
-   "84dab860a34720bd705697303b702ab3a87cffe6",
+   "bc227c95d467672dac52ec90562d31d9dcae16c4",
    "support"
   ],
   "WebIDL/current-realm-expected.txt": [
@@ -197509,7 +197511,7 @@
    "testharness"
   ],
   "XMLHttpRequest/OWNERS": [
-   "5e0081d16b92f9be37809fc63c8e16773382fc45",
+   "bb2738dafe22a65000695059dfb22d1b3559772d",
    "support"
   ],
   "XMLHttpRequest/README.md": [
@@ -197688,6 +197690,10 @@
    "29bb39b957742d739bb0d54464b48a53533206fe",
    "testharness"
   ],
+  "XMLHttpRequest/access-control-preflight-async-not-supported.htm": [
+   "7520098b97455ca0795304751cef93197be469f6",
+   "testharness"
+  ],
   "XMLHttpRequest/access-control-preflight-credential-async.htm": [
    "ae93b44faf45f95927a1ee82052a414273333e61",
    "testharness"
@@ -197736,6 +197742,10 @@
    "536deb1a3322c4ef45e259849e659d1fa4bea7c7",
    "testharness"
   ],
+  "XMLHttpRequest/access-control-preflight-sync-not-supported.htm": [
+   "997d43197782650b479ccdef1cc43d8bde7e31e4",
+   "testharness"
+  ],
   "XMLHttpRequest/access-control-response-with-body.htm": [
    "e5b2ae207a2ae58bd20a4d6903991cff5e27b5a7",
    "testharness"
@@ -199097,11 +199107,11 @@
    "support"
   ],
   "accelerometer/idlharness.https-expected.txt": [
-   "adc83b19e793491b1c6ea0fd8b46cd9f32e592fc",
+   "fad45e3137874b58df73f6609bef167a2f1cd586",
    "support"
   ],
   "accelerometer/idlharness.https.html": [
-   "ac421649ad01868af57e06d322515b4fa36a2dda",
+   "a4b5c164268d6742e7da504d15d6b9eeb4cfc6ce",
    "testharness"
   ],
   "apng/OWNERS": [
@@ -199261,7 +199271,7 @@
    "support"
   ],
   "battery-status/OWNERS": [
-   "0a6b169fb5e90abd7e72bc708c58b6c46fb3306c",
+   "6bf7340116fe26dce548f3eabac414f02c75b17b",
    "support"
   ],
   "battery-status/battery-charging-manual.https.html": [
@@ -202505,7 +202515,7 @@
    "testharness"
   ],
   "cors/OWNERS": [
-   "5e0081d16b92f9be37809fc63c8e16773382fc45",
+   "6c3764028d1d7154d9d4200bf28a2249dbbb333f",
    "support"
   ],
   "cors/README.md": [
@@ -202696,18 +202706,6 @@
    "67ecb845c4bcdacc8185b0f78d36856f9a408342",
    "testharness"
   ],
-  "css-font-display/font-display-ref.html": [
-   "26fcc2758c649ce922397cd1c4aa862bdbf1e6a0",
-   "support"
-  ],
-  "css-font-display/font-display.html": [
-   "d83914326318602ce0eef5f248254a391b338df0",
-   "reftest"
-  ],
-  "css-font-display/resources/slow-ahem-loading.py": [
-   "aac16c1e618841ebdd28463adf5688ca837b9d57",
-   "support"
-  ],
   "css-font-loading/OWNERS": [
    "5046d8b1e4fbcb3579ba632d66e81b1cd82384e8",
    "support"
@@ -202720,6 +202718,18 @@
    "9e80ce00e7e18fb9f37ece769507e08432f35cc7",
    "support"
   ],
+  "css-fonts/font-display/font-display-ref.html": [
+   "26fcc2758c649ce922397cd1c4aa862bdbf1e6a0",
+   "support"
+  ],
+  "css-fonts/font-display/font-display.html": [
+   "d83914326318602ce0eef5f248254a391b338df0",
+   "reftest"
+  ],
+  "css-fonts/font-display/resources/slow-ahem-loading.py": [
+   "450ae01cb9fbd2c2cc436f1a8ace5386eb13442c",
+   "support"
+  ],
   "css-fonts/matching/README.md": [
    "194fbc4cdaf1ff4a43e1a4e6b7bc7fbc17eec6d8",
    "support"
@@ -229000,6 +229010,10 @@
    "e633dc7584fbc7bfe99177aa5dd9fbd107a2d3f5",
    "support"
   ],
+  "css/css-logical-1/OWNERS": [
+   "adcf6f1311695d9cc8f490be1f7e411a1048d824",
+   "support"
+  ],
   "css/css-logical-1/cascading-001-ref.html": [
    "b95cd62ce3592f653aaa54de0dbc27e16618064b",
    "support"
@@ -245029,7 +245043,7 @@
    "testharness"
   ],
   "css/geometry-1/OWNERS": [
-   "aaa869d8034b625e56b6a42a751640dd8c3bb18f",
+   "d285ff64ce6e1d989fcdaa872058291292c4a383",
    "support"
   ],
   "css/geometry-1/WebKitCSSMatrix.html": [
@@ -252737,7 +252751,7 @@
    "support"
   ],
   "eventsource/OWNERS": [
-   "5e0081d16b92f9be37809fc63c8e16773382fc45",
+   "ddfd29fafabbb74b189fbee2c6cb208d713954b6",
    "support"
   ],
   "eventsource/README.md": [
@@ -253121,7 +253135,7 @@
    "support"
   ],
   "fetch/OWNERS": [
-   "812135b282a6af912a5d67187fa74cb10a0178f9",
+   "6bc2dd179ac2fa34263a4b623ef4a14245a4ec3f",
    "support"
   ],
   "fetch/README.md": [
@@ -254481,27 +254495,23 @@
    "support"
   ],
   "gamepad/idlharness.html": [
-   "9bbceffc0b80b990f6f72e1e77a9fa451536bbbc",
+   "c9d8668d614404f24a8bf15d803e07e2ff6debd4",
    "testharness"
   ],
   "generic-sensor/OWNERS": [
-   "305876b135d7b96817de262d8f5df28cf11ba5ef",
+   "1cb8a0e23d31dcdeb5ba273a40e35c021c0c53f2",
    "support"
   ],
   "generic-sensor/generic-sensor-tests.js": [
    "0b89e14eadd32fd23202977471c9913f5213dce4",
    "support"
   ],
-  "generic-sensor/idlharness-expected.txt": [
-   "adc83b19e793491b1c6ea0fd8b46cd9f32e592fc",
-   "support"
-  ],
-  "generic-sensor/idlharness.html": [
-   "f968f5a81d25796f79cd22987810ec6832fa120d",
+  "generic-sensor/idlharness.https.html": [
+   "fdb816b5036bae53a60672d3b6910ddb06dd9d51",
    "testharness"
   ],
   "geolocation-API/OWNERS": [
-   "249b200b19b1bae83fbd114ab32bb3c7e91a637e",
+   "4c338ed1db3ab41c3a0664ea20c95dc6896c377e",
    "support"
   ],
   "geolocation-API/PositionOptions.https.html": [
@@ -254588,16 +254598,12 @@
    "4f1c57a6bfbceaea2e725ce40ab449b5a687d611",
    "support"
   ],
-  "gyroscope/idlharness.https-expected.txt": [
-   "adc83b19e793491b1c6ea0fd8b46cd9f32e592fc",
-   "support"
-  ],
   "gyroscope/idlharness.https.html": [
-   "69699b3b533c8fd4047a3b5e80f95f8cdc82d24d",
+   "2aedb883f553cae594afb7c5ef59222c0ee3fefb",
    "testharness"
   ],
   "hr-time/OWNERS": [
-   "84dab860a34720bd705697303b702ab3a87cffe6",
+   "e07e8c929145256675de1fcac336296cc31576d0",
    "support"
   ],
   "hr-time/basic.any.js": [
@@ -254709,7 +254715,7 @@
    "support"
   ],
   "html-media-capture/OWNERS": [
-   "784bcb876f764153dd31dd7c6e76bff82b695313",
+   "5ff5e5457fe80ab08a86e491a7fc1d980805714a",
    "support"
   ],
   "html-media-capture/capture_audio-manual.html": [
@@ -271457,7 +271463,7 @@
    "support"
   ],
   "http/OWNERS": [
-   "a7ec90613b57afc2f99d40420119e8ece80586b0",
+   "1344f0cf0c9b61570697a2f8c3e5a89f0c39bf74",
    "support"
   ],
   "http/basic-auth-cache-test-ref.html": [
@@ -271725,7 +271731,7 @@
    "support"
   ],
   "innerText/getter-expected.txt": [
-   "77e80d74e88dbaceb78773b67522423ae1bf7515",
+   "79c93b5b2ca4e98fd2d0eb38f5c7128df84ff64d",
    "support"
   ],
   "innerText/getter-tests.js": [
@@ -271981,7 +271987,7 @@
    "testharness"
   ],
   "longtask-timing/OWNERS": [
-   "ef8e006eb532afaf6f561aa9ba2a46afa6b5693c",
+   "6f4986c5e5cc0863d61e32ecfce3cd7a8cc4a4d6",
    "support"
   ],
   "longtask-timing/longtask-attributes.html": [
@@ -272053,11 +272059,11 @@
    "support"
   ],
   "magnetometer/idlharness.https-expected.txt": [
-   "adc83b19e793491b1c6ea0fd8b46cd9f32e592fc",
+   "6078f1d70aaf7d8a274127b501972fcc2f704684",
    "support"
   ],
   "magnetometer/idlharness.https.html": [
-   "caa1de6ebcd32508ea4e61a7412f6c165699cc58",
+   "a72e1c3443feae9bf9d19385c0ba96e66b97f20c",
    "testharness"
   ],
   "media-capabilities/OWNERS": [
@@ -272721,7 +272727,7 @@
    "testharness"
   ],
   "mediacapture-record/OWNERS": [
-   "249b200b19b1bae83fbd114ab32bb3c7e91a637e",
+   "516d0ce85279e3cc210b69f49e9ea7259226ef03",
    "support"
   ],
   "mediacapture-record/idlharness-expected.txt": [
@@ -272889,11 +272895,11 @@
    "testharness"
   ],
   "mediacapture-streams/OWNERS": [
-   "1b2f5b099268a66853be224cbf59c3f1b55bc4c3",
+   "07fc6a5ece5e626316fe1d70f23fbe377b6618d3",
    "support"
   ],
   "mediasession/OWNERS": [
-   "9de93c74b73f6aa008e24ad02f98c4b4476cf708",
+   "27bf5ebefa8583974d0961d9a9b68ebede0dfb67",
    "support"
   ],
   "mediasession/README.md": [
@@ -274605,7 +274611,7 @@
    "support"
   ],
   "navigation-timing/OWNERS": [
-   "ddecc912f630fc43e1a64a73f97d102fe9fcfa78",
+   "877fd815e2bd375bdde158455bf077f4ae878916",
    "support"
   ],
   "navigation-timing/idlharness.html": [
@@ -274817,7 +274823,7 @@
    "testharness"
   ],
   "notifications/OWNERS": [
-   "d1fd72951c6f1860cd862c0e694c64c1076bc049",
+   "4ed62abe9b6484ff66fbec2f517e3faec811e4c0",
    "support"
   ],
   "notifications/body-basic-manual.html": [
@@ -281120,12 +281126,8 @@
    "6f0eb976affc21e49f48c42c1bd9d9eb0083ee40",
    "manual"
   ],
-  "orientation-sensor/idlharness.https-expected.txt": [
-   "adc83b19e793491b1c6ea0fd8b46cd9f32e592fc",
-   "support"
-  ],
   "orientation-sensor/idlharness.https.html": [
-   "71100177bcb537c18f98edfd7bf04d420714a78b",
+   "9301519eebff3db962bbeb148bf3dd3b1e305a23",
    "testharness"
   ],
   "page-visibility/OWNERS": [
@@ -281205,7 +281207,7 @@
    "testharness"
   ],
   "paint-timing/OWNERS": [
-   "09e469f1ff3205daa6163ef3860735bb423dd1a7",
+   "36a1024fde66dc2ce8ea694b6e95a863f0c3e62a",
    "support"
   ],
   "paint-timing/basetest.html": [
@@ -281489,7 +281491,7 @@
    "manual"
   ],
   "performance-timeline/OWNERS": [
-   "117a9d08c8413d908bd157018e5dfe848e38c0d7",
+   "ce4a23c1bac992f3085f3dd3575ebc376c51f432",
    "support"
   ],
   "performance-timeline/case-sensitivity.any.js": [
@@ -282105,7 +282107,7 @@
    "testharness"
   ],
   "presentation-api/OWNERS": [
-   "6da9f3292a8790c1713e459e20cbf64e811933a3",
+   "b02ed0132a687bf09ad3f7380e1a4ceda6f2c3a7",
    "support"
   ],
   "presentation-api/README.md": [
@@ -282333,7 +282335,7 @@
    "support"
   ],
   "progress-events/OWNERS": [
-   "5e0081d16b92f9be37809fc63c8e16773382fc45",
+   "bb2738dafe22a65000695059dfb22d1b3559772d",
    "support"
   ],
   "progress-events/Status.html": [
@@ -289853,7 +289855,7 @@
    "testharness"
   ],
   "remote-playback/OWNERS": [
-   "adab36a884d16dd8db9d979a8c4ee170ff95fa38",
+   "0898aa08d3d5ef8f8b7399b4ca443c73cc1253f2",
    "support"
   ],
   "remote-playback/README.md": [
@@ -289885,7 +289887,7 @@
    "testharness"
   ],
   "resource-timing/OWNERS": [
-   "5fed409fed6c24eb8002e608db5fc85535572756",
+   "826012660a4485be172a109082c77fc6305e7307",
    "support"
   ],
   "resource-timing/SyntheticResponse.py": [
@@ -290073,7 +290075,7 @@
    "support"
   ],
   "screen-orientation/OWNERS": [
-   "6450ccc43d7f182fa76c7f9770d6003a401522b6",
+   "970c0e5b33815109f17231ffeaf4cea22cf9096c",
    "support"
   ],
   "screen-orientation/lock-bad-argument-expected.txt": [
@@ -291065,7 +291067,7 @@
    "testharness"
   ],
   "service-workers/service-worker/fetch-frame-resource.https.html": [
-   "77709ff94cfaeec0b01e157714244d1b568c6b18",
+   "0e0cf1dbe113b8403d6f1de0462ca8dd9641b3c4",
    "testharness"
   ],
   "service-workers/service-worker/fetch-header-visibility.https.html": [
@@ -293201,7 +293203,7 @@
    "testharness"
   ],
   "storage/OWNERS": [
-   "84dab860a34720bd705697303b702ab3a87cffe6",
+   "12440f4f1664a6de93ebe0662f153492cbe5e428",
    "support"
   ],
   "storage/README.md": [
@@ -293285,7 +293287,7 @@
    "testharness"
   ],
   "streams/OWNERS": [
-   "a24ac1da1e1fdf2dd31486f54f646a2220f498bb",
+   "20bf01bf67bc93c91033814539b4550efdf0ef7e",
    "support"
   ],
   "streams/README.md": [
@@ -294533,7 +294535,7 @@
    "testharness"
   ],
   "uievents/OWNERS": [
-   "fb1bd00f4c9383566682fcec6ba0bac105b8203e",
+   "96e9f482d18db4fbce38a14c069af1494171fc4a",
    "support"
   ],
   "uievents/README.md": [
@@ -294937,7 +294939,7 @@
    "testharness"
   ],
   "url/OWNERS": [
-   "5e0081d16b92f9be37809fc63c8e16773382fc45",
+   "ddfd29fafabbb74b189fbee2c6cb208d713954b6",
    "support"
   ],
   "url/README.md": [
@@ -295089,7 +295091,7 @@
    "support"
   ],
   "user-timing/OWNERS": [
-   "84dab860a34720bd705697303b702ab3a87cffe6",
+   "6f4986c5e5cc0863d61e32ecfce3cd7a8cc4a4d6",
    "support"
   ],
   "user-timing/clear_all_marks.any.js": [
@@ -295177,7 +295179,7 @@
    "testharness"
   ],
   "vibration/OWNERS": [
-   "d1fd72951c6f1860cd862c0e694c64c1076bc049",
+   "dc5baeffc8871efedf5e79588219466cfe76eb36",
    "support"
   ],
   "vibration/api-is-present.html": [
@@ -295805,7 +295807,7 @@
    "testharness"
   ],
   "web-nfc/OWNERS": [
-   "02d51aabab777d41cee48e8bfcaedec67f712325",
+   "8be535b568f97ca151f13ede98fcd2459640308f",
    "support"
   ],
   "web-nfc/idlharness.https.html": [
@@ -295985,7 +295987,7 @@
    "support"
   ],
   "webaudio/OWNERS": [
-   "416da2f04aa3f612a5c5d8f7a459f64578f37877",
+   "73d9bb2cb2f23589c3935bef954cd2c5e280ff13",
    "support"
   ],
   "webaudio/README.md": [
@@ -296281,7 +296283,7 @@
    "testharness"
   ],
   "webmessaging/OWNERS": [
-   "9d4c63a866073b94bd7eb921bcb8ccdf2c5f67dd",
+   "36bd10410e1cffb8705cf58b60a9a6e51d2b6718",
    "support"
   ],
   "webmessaging/README.md": [
@@ -296669,7 +296671,7 @@
    "testharness"
   ],
   "webrtc/OWNERS": [
-   "d9a7290ec6c2f0b4715b8161d1b683f64938fe07",
+   "8edd63a3a9622e18424a4e9c6dc41ae8620c6af9",
    "support"
   ],
   "webrtc/RTCCertificate-expected.txt": [
@@ -296693,11 +296695,11 @@
    "support"
   ],
   "webrtc/RTCConfiguration-iceCandidatePoolSize-expected.txt": [
-   "03f43188c1e8484e881d5c63e542d617ca77a8b2",
+   "61a7ffbb058a16327cd5252b39b3b8c3f237cce6",
    "support"
   ],
   "webrtc/RTCConfiguration-iceCandidatePoolSize.html": [
-   "7816790d82628acb7cf04e0a046046884c1207e7",
+   "6b55bd01a1422f2315cae765a7d539bf81151c1f",
    "testharness"
   ],
   "webrtc/RTCConfiguration-iceServers-expected.txt": [
@@ -297385,7 +297387,7 @@
    "testharness"
   ],
   "websockets/OWNERS": [
-   "5e0081d16b92f9be37809fc63c8e16773382fc45",
+   "f3989c79b38f8107e53c21c79148e705cf3ff500",
    "support"
   ],
   "websockets/README.md": [
@@ -298581,7 +298583,7 @@
    "testharness"
   ],
   "webvr/OWNERS": [
-   "a410828e76aa74576eaadc4ebed114f36a2d7e12",
+   "4fa6f2f6ab03104db765afe5f8551564461c95d7",
    "support"
   ],
   "webvr/idlharness-expected.txt": [
@@ -298625,7 +298627,7 @@
    "support"
   ],
   "webvtt/OWNERS": [
-   "5cce79f37f795f4fb35130c174d3a553f18fcff4",
+   "dcf85b8b4c54addc98e82ecc66501eee0368e475",
    "support"
   ],
   "webvtt/README.md": [
diff --git a/third_party/WebKit/LayoutTests/external/wpt/accelerometer/idlharness.https-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/accelerometer/idlharness.https-expected.txt
index 8b13789..e017612 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/accelerometer/idlharness.https-expected.txt
+++ b/third_party/WebKit/LayoutTests/external/wpt/accelerometer/idlharness.https-expected.txt
@@ -1 +1,69 @@
+This is a testharness.js-based test.
+PASS Sensor interface: existence and properties of interface object
+PASS Sensor interface object length
+PASS Sensor interface object name
+PASS Sensor interface: existence and properties of interface prototype object
+PASS Sensor interface: existence and properties of interface prototype object's "constructor" property
+PASS Sensor interface: attribute activated
+PASS Sensor interface: attribute timestamp
+PASS Sensor interface: operation start()
+PASS Sensor interface: operation stop()
+PASS Sensor interface: attribute onreading
+PASS Sensor interface: attribute onactivate
+PASS Sensor interface: attribute onerror
+PASS Accelerometer interface: existence and properties of interface object
+PASS Accelerometer interface object length
+PASS Accelerometer interface object name
+PASS Accelerometer interface: existence and properties of interface prototype object
+PASS Accelerometer interface: existence and properties of interface prototype object's "constructor" property
+PASS Accelerometer interface: attribute x
+PASS Accelerometer interface: attribute y
+PASS Accelerometer interface: attribute z
+PASS Accelerometer must be primary interface of new Accelerometer();
+PASS Stringification of new Accelerometer();
+PASS Accelerometer interface: new Accelerometer(); must inherit property "x" with the proper type
+PASS Accelerometer interface: new Accelerometer(); must inherit property "y" with the proper type
+PASS Accelerometer interface: new Accelerometer(); must inherit property "z" with the proper type
+PASS Sensor interface: new Accelerometer(); must inherit property "activated" with the proper type
+PASS Sensor interface: new Accelerometer(); must inherit property "timestamp" with the proper type
+PASS Sensor interface: new Accelerometer(); must inherit property "start()" with the proper type
+PASS Sensor interface: new Accelerometer(); must inherit property "stop()" with the proper type
+PASS Sensor interface: new Accelerometer(); must inherit property "onreading" with the proper type
+PASS Sensor interface: new Accelerometer(); must inherit property "onactivate" with the proper type
+PASS Sensor interface: new Accelerometer(); must inherit property "onerror" with the proper type
+PASS LinearAccelerationSensor interface: existence and properties of interface object
+PASS LinearAccelerationSensor interface object length
+PASS LinearAccelerationSensor interface object name
+PASS LinearAccelerationSensor interface: existence and properties of interface prototype object
+PASS LinearAccelerationSensor interface: existence and properties of interface prototype object's "constructor" property
+PASS LinearAccelerationSensor must be primary interface of new LinearAccelerationSensor();
+PASS Stringification of new LinearAccelerationSensor();
+PASS Accelerometer interface: new LinearAccelerationSensor(); must inherit property "x" with the proper type
+PASS Accelerometer interface: new LinearAccelerationSensor(); must inherit property "y" with the proper type
+PASS Accelerometer interface: new LinearAccelerationSensor(); must inherit property "z" with the proper type
+PASS Sensor interface: new LinearAccelerationSensor(); must inherit property "activated" with the proper type
+PASS Sensor interface: new LinearAccelerationSensor(); must inherit property "timestamp" with the proper type
+PASS Sensor interface: new LinearAccelerationSensor(); must inherit property "start()" with the proper type
+PASS Sensor interface: new LinearAccelerationSensor(); must inherit property "stop()" with the proper type
+PASS Sensor interface: new LinearAccelerationSensor(); must inherit property "onreading" with the proper type
+PASS Sensor interface: new LinearAccelerationSensor(); must inherit property "onactivate" with the proper type
+PASS Sensor interface: new LinearAccelerationSensor(); must inherit property "onerror" with the proper type
+FAIL GravitySensor interface: existence and properties of interface object assert_own_property: self does not have own property "GravitySensor" expected property "GravitySensor" missing
+FAIL GravitySensor interface object length assert_own_property: self does not have own property "GravitySensor" expected property "GravitySensor" missing
+FAIL GravitySensor interface object name assert_own_property: self does not have own property "GravitySensor" expected property "GravitySensor" missing
+FAIL GravitySensor interface: existence and properties of interface prototype object assert_own_property: self does not have own property "GravitySensor" expected property "GravitySensor" missing
+FAIL GravitySensor interface: existence and properties of interface prototype object's "constructor" property assert_own_property: self does not have own property "GravitySensor" expected property "GravitySensor" missing
+FAIL GravitySensor must be primary interface of new GravitySensor(); assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: GravitySensor is not defined"
+FAIL Stringification of new GravitySensor(); assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: GravitySensor is not defined"
+FAIL Accelerometer interface: new GravitySensor(); must inherit property "x" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: GravitySensor is not defined"
+FAIL Accelerometer interface: new GravitySensor(); must inherit property "y" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: GravitySensor is not defined"
+FAIL Accelerometer interface: new GravitySensor(); must inherit property "z" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: GravitySensor is not defined"
+FAIL Sensor interface: new GravitySensor(); must inherit property "activated" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: GravitySensor is not defined"
+FAIL Sensor interface: new GravitySensor(); must inherit property "timestamp" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: GravitySensor is not defined"
+FAIL Sensor interface: new GravitySensor(); must inherit property "start()" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: GravitySensor is not defined"
+FAIL Sensor interface: new GravitySensor(); must inherit property "stop()" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: GravitySensor is not defined"
+FAIL Sensor interface: new GravitySensor(); must inherit property "onreading" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: GravitySensor is not defined"
+FAIL Sensor interface: new GravitySensor(); must inherit property "onactivate" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: GravitySensor is not defined"
+FAIL Sensor interface: new GravitySensor(); must inherit property "onerror" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: GravitySensor is not defined"
+Harness: the test ran to completion.
 
diff --git a/third_party/WebKit/LayoutTests/external/wpt/accelerometer/idlharness.https.html b/third_party/WebKit/LayoutTests/external/wpt/accelerometer/idlharness.https.html
index 6c9c9bb..b6d9ce5 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/accelerometer/idlharness.https.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/accelerometer/idlharness.https.html
@@ -8,32 +8,20 @@
 <script src="/resources/testharnessreport.js"></script>
 <script src="/resources/WebIDLParser.js"></script>
 <script src="/resources/idlharness.js"></script>
-<style>
-  pre {
-    display: none;
-  }
-</style>
 <div id="log"></div>
 
-<pre id="idl">
-interface Event {
-};
-
-interface Error {
-};
-
-dictionary EventInit {
-};
-
+<script id="idl" type="text/plain">
 interface EventTarget {
 };
 
 interface EventHandler {
 };
-</pre>
+</script>
 
-<pre id="generic-idl">
-[SecureContext]
+<script id="accelerometer-idl" type="text/plain">
+// The interface of Sensor is defined in
+// https://www.w3.org/TR/generic-sensor/#idl-index
+[SecureContext, Exposed=Window]
 interface Sensor : EventTarget {
   readonly attribute boolean activated;
   readonly attribute DOMHighResTimeStamp? timestamp;
@@ -44,44 +32,27 @@
   attribute EventHandler onerror;
 };
 
-dictionary SensorOptions {
-  double? frequency;
-};
-
-[SecureContext, Constructor(DOMString type, SensorErrorEventInit errorEventInitDict)]
-interface SensorErrorEvent : Event {
-  readonly attribute Error error;
-};
-
-dictionary SensorErrorEventInit : EventInit {
-  required Error error;
-};
-</pre>
-
-<pre id="accelerometer-idl">
-[Constructor(optional SensorOptions options)]
+[Constructor(optional SensorOptions options), Exposed=Window]
 interface Accelerometer : Sensor {
   readonly attribute unrestricted double? x;
   readonly attribute unrestricted double? y;
   readonly attribute unrestricted double? z;
 };
 
-[Constructor(optional SensorOptions options)]
+[Constructor(optional SensorOptions options), Exposed=Window]
 interface LinearAccelerationSensor : Accelerometer {
 };
 
-[Constructor(optional SensorOptions options)]
+[Constructor(optional SensorOptions options), Exposed=Window]
 interface GravitySensor : Accelerometer {
 };
-</pre>
+</script>
 
 <script>
-
 (() => {
   "use strict";
   let idl_array = new IdlArray();
   idl_array.add_untested_idls(document.getElementById('idl').textContent);
-  idl_array.add_untested_idls(document.getElementById('generic-idl').textContent);
   idl_array.add_idls(document.getElementById('accelerometer-idl').textContent);
 
   idl_array.add_objects({
@@ -92,5 +63,4 @@
 
   idl_array.test();
 })();
-
 </script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css-font-display/font-display-ref.html b/third_party/WebKit/LayoutTests/external/wpt/css-fonts/font-display/font-display-ref.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/external/wpt/css-font-display/font-display-ref.html
rename to third_party/WebKit/LayoutTests/external/wpt/css-fonts/font-display/font-display-ref.html
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css-font-display/font-display.html b/third_party/WebKit/LayoutTests/external/wpt/css-fonts/font-display/font-display.html
similarity index 100%
rename from third_party/WebKit/LayoutTests/external/wpt/css-font-display/font-display.html
rename to third_party/WebKit/LayoutTests/external/wpt/css-fonts/font-display/font-display.html
diff --git a/third_party/WebKit/LayoutTests/external/wpt/css-font-display/resources/slow-ahem-loading.py b/third_party/WebKit/LayoutTests/external/wpt/css-fonts/font-display/resources/slow-ahem-loading.py
similarity index 80%
rename from third_party/WebKit/LayoutTests/external/wpt/css-font-display/resources/slow-ahem-loading.py
rename to third_party/WebKit/LayoutTests/external/wpt/css-fonts/font-display/resources/slow-ahem-loading.py
index 4598950..bb556d1 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css-font-display/resources/slow-ahem-loading.py
+++ b/third_party/WebKit/LayoutTests/external/wpt/css-fonts/font-display/resources/slow-ahem-loading.py
@@ -2,7 +2,7 @@
 import time
 
 def main(request, response):
-    body = open(os.path.join(os.path.dirname(__file__), "../../css/fonts/ahem/ahem.ttf"), "rb").read()
+    body = open(os.path.join(os.path.dirname(__file__), "../../../css/fonts/ahem/ahem.ttf"), "rb").read()
     delay = float(request.GET.first("ms", 500))
     if delay > 0:
         time.sleep(delay / 1E3);
diff --git a/third_party/WebKit/LayoutTests/external/wpt/cssom-view/scrollBoundaryBehavior-manual.html b/third_party/WebKit/LayoutTests/external/wpt/cssom-view/scrollBoundaryBehavior-manual.html
new file mode 100644
index 0000000..efd0043
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/cssom-view/scrollBoundaryBehavior-manual.html
@@ -0,0 +1,151 @@
+<!doctype html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<style>
+.outer {
+  height: 400px;
+  width: 1000px;
+  background: white
+}
+.content {
+  height: 600px;
+  width: 1200px;
+}
+#root {
+  overflow: scroll;
+  height: 600px;
+  width: 800px;
+  background: white;
+}
+#container {
+  overflow: scroll;
+}
+#non_scrollable {
+  overflow: none;
+}
+#green {
+  background: repeating-linear-gradient(to bottom right, green 15%, white 30%);
+}
+#blue {
+  background: repeating-linear-gradient(to bottom right, blue 15%, white 30%);
+}
+</style>
+
+<div id='root'>
+  <div id='non_scrollable' class='outer'>
+    <div id='green' class='content'></div>
+  </div>
+  <div id='container' class='outer'>
+    <div id='blue' class='content'></div>
+  </div>
+</div>
+<input type="button" id="btnDone" value="DONE" style="width: 100px; height: 50px;"/>
+<h1>scroll-boundary-behavior</h1>
+<h4>Tests that scroll-boundary-behavior prevents scroll-propagation in the area and direction as specified.</h4>
+<ol>
+  <li id="i1">Make two scrolls on <span style="color: blue">BLUE</span>, in this order: scroll UP (or drag down), then scroll LEFT (or drag right). Scroll (or drag) until nothing is scrolling. Then tap on DONE.</li>
+  <li id="i2">Repeat the same scrolls as in step 1 and then tap on DONE.</li>
+  <li id="i3">Repeat the same scrolls as in step 1 and then tap on DONE.</li>
+  <li id="i4">Make two separate scrolls on <span style="color: green">GREEN</span>, in this order: scroll UP (or drag down), then scroll LEFT (or drag right). Scroll (or drag) until nothing is scrolling. Then tap on DONE.</li>
+</ol>
+
+
+<script>
+const container = document.getElementById('container');
+const non_scrollable = document.getElementById('non_scrollable');
+const root = document.getElementById('root');
+var test = async_test("scroll-boundary-behavior prevents scroll-propagation in the area and direction as specified");
+var instruction1 = document.getElementById("i1");
+var instruction2 = document.getElementById("i2");
+var instruction3 = document.getElementById("i3");
+var instruction4 = document.getElementById("i4");
+
+function setUpForRoot(offset) {
+  root.scrollTop = offset;
+  root.scrollLeft = offset;
+}
+
+function setUpForContainer(offset) {
+  container.scrollTop = offset;
+  container.scrollLeft = offset
+}
+
+function set_boundary_prevents_y() {
+  instruction1.style.color = 'red';
+  instruction1.style.fontWeight = 'bold';
+  container.style.scrollBoundaryBehaviorX = 'auto';
+  container.style.scrollBoundaryBehaviorY = 'none';
+  setUpForRoot(100);
+  setUpForContainer(0);
+}
+
+function verify_y_prevented_and_set_boundary_prevents_x() {
+  instruction1.style.fontWeight = 'normal';
+  instruction2.style.fontWeight = 'bold';
+  test.step(function() {
+    assert_equals(root.scrollTop, 100);
+    assert_equals(root.scrollLeft, 0);
+  }, "scroll-boundary-behavior-y: none should only prevent scroll propagation on y axis.");
+
+  container.style.scrollBoundaryBehaviorX = 'none';
+  container.style.scrollBoundaryBehaviorY = 'auto';
+  setUpForRoot(100);
+  setUpForContainer(0);
+}
+
+function verify_x_prevented_and_set_boundary_allows_inner() {
+  instruction2.style.fontWeight = 'normal';
+  instruction3.style.fontWeight = 'bold';
+  test.step(function() {
+    assert_equals(root.scrollTop, 0);
+    assert_equals(root.scrollLeft, 100);
+  }, "scroll-boundary-behavior-x: none should only prevent scroll propagation on x axis.");
+
+  container.style.scrollBoundaryBehaviorX = 'none';
+  container.style.scrollBoundaryBehaviorY = 'none';
+  setUpForRoot(100);
+  setUpForContainer(100);
+}
+
+function verify_inner_allowed_and_set_nonscrollable_allows_propagation() {
+  instruction1.style.color = 'black';
+  instruction4.style.color = 'red';
+  instruction3.style.fontWeight = 'normal';
+  instruction4.style.fontWeight = 'bold';
+  test.step(function() {
+    assert_equals(container.scrollTop, 0);
+    assert_equals(container.scrollLeft, 0);
+    assert_equals(root.scrollTop, 100);
+    assert_equals(root.scrollLeft, 100);
+  }, "scroll-boundary-behavior should latch the scroll to the inner container.");
+
+  non_scrollable.style.scrollBoundaryBehaviorX = 'none';
+  non_scrollable.style.scrollBoundaryBehaviorY = 'none';
+  setUpForRoot(100);
+}
+
+function verify_non_scrollable_allows_propagation() {
+  test.step(function() {
+    assert_equals(root.scrollLeft, 0);
+    assert_equals(root.scrollTop, 0);
+  }, "scroll-boundary-behavior on non-scrollable area should not affect scroll propagation.");
+  test.done();
+}
+
+var verifyAndSetupForNext = [
+    set_boundary_prevents_y,
+    verify_y_prevented_and_set_boundary_prevents_x,
+    verify_x_prevented_and_set_boundary_allows_inner,
+    verify_inner_allowed_and_set_nonscrollable_allows_propagation,
+    verify_non_scrollable_allows_propagation];
+
+on_event(document.getElementById("btnDone"), "click", function() {
+  if (current_test < verifyAndSetupForNext.length)
+    verifyAndSetupForNext[current_test++]();
+});
+
+var current_test = 0;
+verifyAndSetupForNext[current_test++]();
+
+</script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/gamepad/idlharness.html b/third_party/WebKit/LayoutTests/external/wpt/gamepad/idlharness.html
index 0acd4ca..559d2ef 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/gamepad/idlharness.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/gamepad/idlharness.html
@@ -26,8 +26,8 @@
     readonly    attribute boolean             connected;
     readonly    attribute DOMHighResTimeStamp timestamp;
     readonly    attribute GamepadMappingType  mapping;
-    readonly    attribute double[]            axes;
-    readonly    attribute GamepadButton[]     buttons;
+    readonly    attribute FrozenArray<double> axes;
+    readonly    attribute FrozenArray<GamepadButton> buttons;
 };
 
 enum GamepadMappingType {
diff --git a/third_party/WebKit/LayoutTests/external/wpt/generic-sensor/idlharness-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/generic-sensor/idlharness-expected.txt
deleted file mode 100644
index 8b13789..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/generic-sensor/idlharness-expected.txt
+++ /dev/null
@@ -1 +0,0 @@
-
diff --git a/third_party/WebKit/LayoutTests/external/wpt/generic-sensor/idlharness.html b/third_party/WebKit/LayoutTests/external/wpt/generic-sensor/idlharness.https.html
similarity index 82%
rename from third_party/WebKit/LayoutTests/external/wpt/generic-sensor/idlharness.html
rename to third_party/WebKit/LayoutTests/external/wpt/generic-sensor/idlharness.https.html
index 5fffbbb..da0bb71 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/generic-sensor/idlharness.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/generic-sensor/idlharness.https.html
@@ -7,14 +7,9 @@
 <script src="/resources/testharnessreport.js"></script>
 <script src="/resources/WebIDLParser.js"></script>
 <script src="/resources/idlharness.js"></script>
-<style>
-  pre {
-    display: none;
-  }
-</style>
 <div id="log"></div>
 
-<pre id="idl">
+<script id="idl" type="text/plain">
 interface Event {
 };
 
@@ -24,7 +19,7 @@
 dictionary EventInit {
 };
 
-[SecureContext]
+[SecureContext, Exposed=Window]
 interface Sensor : EventTarget {
   readonly attribute boolean activated;
   readonly attribute DOMHighResTimeStamp? timestamp;
@@ -38,10 +33,11 @@
 dictionary SensorOptions {
   double? frequency;
 };
-</pre>
+</script>
 
-<pre id="generic-idl">
-[SecureContext, Constructor(DOMString type, SensorErrorEventInit errorEventInitDict)]
+<script id="generic-idl" type="text/plain">
+[Constructor(DOMString type, SensorErrorEventInit errorEventInitDict),
+ SecureContext, Exposed=Window]
 interface SensorErrorEvent : Event {
   readonly attribute Error error;
 };
@@ -49,12 +45,12 @@
 dictionary SensorErrorEventInit : EventInit {
   required Error error;
 };
-</pre>
+</script>
 
 <script>
-(function() {
+(() => {
   "use strict";
-  var idl_array = new IdlArray();
+  let idl_array = new IdlArray();
   idl_array.add_untested_idls(document.getElementById('idl').textContent);
   idl_array.add_idls(document.getElementById('generic-idl').textContent);
 
diff --git a/third_party/WebKit/LayoutTests/external/wpt/gyroscope/idlharness.https-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/gyroscope/idlharness.https-expected.txt
deleted file mode 100644
index 8b13789..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/gyroscope/idlharness.https-expected.txt
+++ /dev/null
@@ -1 +0,0 @@
-
diff --git a/third_party/WebKit/LayoutTests/external/wpt/gyroscope/idlharness.https.html b/third_party/WebKit/LayoutTests/external/wpt/gyroscope/idlharness.https.html
index 791bdc1..ca8f69d 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/gyroscope/idlharness.https.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/gyroscope/idlharness.https.html
@@ -8,32 +8,20 @@
 <script src="/resources/testharnessreport.js"></script>
 <script src="/resources/WebIDLParser.js"></script>
 <script src="/resources/idlharness.js"></script>
-<style>
-  pre {
-    display: none;
-  }
-</style>
 <div id="log"></div>
 
-<pre id="idl">
-interface Event {
-};
-
-interface Error {
-};
-
-dictionary EventInit {
-};
-
+<script id="idl" type="text/plain">
 interface EventTarget {
 };
 
 interface EventHandler {
 };
-</pre>
+</script>
 
-<pre id="generic-idl">
-[SecureContext]
+<script id="gyroscope-idl" type="text/plain">
+// The interface of Sensor is defined in
+// https://www.w3.org/TR/generic-sensor/#idl-index
+[SecureContext, Exposed=Window]
 interface Sensor : EventTarget {
   readonly attribute boolean activated;
   readonly attribute DOMHighResTimeStamp? timestamp;
@@ -44,36 +32,19 @@
   attribute EventHandler onerror;
 };
 
-dictionary SensorOptions {
-  double? frequency;
-};
-
-[SecureContext, Constructor(DOMString type, SensorErrorEventInit errorEventInitDict)]
-interface SensorErrorEvent : Event {
-  readonly attribute Error error;
-};
-
-dictionary SensorErrorEventInit : EventInit {
-  required Error error;
-};
-</pre>
-
-<pre id="gyroscope-idl">
-[Constructor(optional SensorOptions sensorOptions)]
+[Constructor(optional SensorOptions sensorOptions), Exposed=Window]
 interface Gyroscope : Sensor {
   readonly attribute unrestricted double? x;
   readonly attribute unrestricted double? y;
   readonly attribute unrestricted double? z;
 };
-</pre>
+</script>
 
 <script>
-
 (() => {
   "use strict";
   let idl_array = new IdlArray();
   idl_array.add_untested_idls(document.getElementById('idl').textContent);
-  idl_array.add_untested_idls(document.getElementById('generic-idl').textContent);
   idl_array.add_idls(document.getElementById('gyroscope-idl').textContent);
 
   idl_array.add_objects({
@@ -82,5 +53,4 @@
 
   idl_array.test();
 })();
-
 </script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/lint.whitelist b/third_party/WebKit/LayoutTests/external/wpt/lint.whitelist
index 7e33959..40d2a7d 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/lint.whitelist
+++ b/third_party/WebKit/LayoutTests/external/wpt/lint.whitelist
@@ -152,7 +152,7 @@
 SET TIMEOUT: common/reftest-wait.js
 SET TIMEOUT: conformance-checkers/*
 SET TIMEOUT: content-security-policy/*
-SET TIMEOUT: css-font-display/font-display.html
+SET TIMEOUT: css-fonts/font-display/font-display.html
 SET TIMEOUT: encrypted-media/Google/migrated_to_root_disabled/encrypted-media-utils.js
 SET TIMEOUT: encrypted-media/polyfill/chrome-polyfill.js
 SET TIMEOUT: encrypted-media/polyfill/clearkey-polyfill.js
diff --git a/third_party/WebKit/LayoutTests/external/wpt/magnetometer/idlharness.https-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/magnetometer/idlharness.https-expected.txt
index 8b13789..3af2ee7 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/magnetometer/idlharness.https-expected.txt
+++ b/third_party/WebKit/LayoutTests/external/wpt/magnetometer/idlharness.https-expected.txt
@@ -1 +1,61 @@
+This is a testharness.js-based test.
+PASS Sensor interface: existence and properties of interface object
+PASS Sensor interface object length
+PASS Sensor interface object name
+PASS Sensor interface: existence and properties of interface prototype object
+PASS Sensor interface: existence and properties of interface prototype object's "constructor" property
+PASS Sensor interface: attribute activated
+PASS Sensor interface: attribute timestamp
+PASS Sensor interface: operation start()
+PASS Sensor interface: operation stop()
+PASS Sensor interface: attribute onreading
+PASS Sensor interface: attribute onactivate
+PASS Sensor interface: attribute onerror
+PASS Magnetometer interface: existence and properties of interface object
+PASS Magnetometer interface object length
+PASS Magnetometer interface object name
+PASS Magnetometer interface: existence and properties of interface prototype object
+PASS Magnetometer interface: existence and properties of interface prototype object's "constructor" property
+PASS Magnetometer interface: attribute x
+PASS Magnetometer interface: attribute y
+PASS Magnetometer interface: attribute z
+PASS Magnetometer must be primary interface of new Magnetometer();
+PASS Stringification of new Magnetometer();
+PASS Magnetometer interface: new Magnetometer(); must inherit property "x" with the proper type
+PASS Magnetometer interface: new Magnetometer(); must inherit property "y" with the proper type
+PASS Magnetometer interface: new Magnetometer(); must inherit property "z" with the proper type
+PASS Sensor interface: new Magnetometer(); must inherit property "activated" with the proper type
+PASS Sensor interface: new Magnetometer(); must inherit property "timestamp" with the proper type
+PASS Sensor interface: new Magnetometer(); must inherit property "start()" with the proper type
+PASS Sensor interface: new Magnetometer(); must inherit property "stop()" with the proper type
+PASS Sensor interface: new Magnetometer(); must inherit property "onreading" with the proper type
+PASS Sensor interface: new Magnetometer(); must inherit property "onactivate" with the proper type
+PASS Sensor interface: new Magnetometer(); must inherit property "onerror" with the proper type
+FAIL UncalibratedMagnetometer interface: existence and properties of interface object assert_own_property: self does not have own property "UncalibratedMagnetometer" expected property "UncalibratedMagnetometer" missing
+FAIL UncalibratedMagnetometer interface object length assert_own_property: self does not have own property "UncalibratedMagnetometer" expected property "UncalibratedMagnetometer" missing
+FAIL UncalibratedMagnetometer interface object name assert_own_property: self does not have own property "UncalibratedMagnetometer" expected property "UncalibratedMagnetometer" missing
+FAIL UncalibratedMagnetometer interface: existence and properties of interface prototype object assert_own_property: self does not have own property "UncalibratedMagnetometer" expected property "UncalibratedMagnetometer" missing
+FAIL UncalibratedMagnetometer interface: existence and properties of interface prototype object's "constructor" property assert_own_property: self does not have own property "UncalibratedMagnetometer" expected property "UncalibratedMagnetometer" missing
+FAIL UncalibratedMagnetometer interface: attribute x assert_own_property: self does not have own property "UncalibratedMagnetometer" expected property "UncalibratedMagnetometer" missing
+FAIL UncalibratedMagnetometer interface: attribute y assert_own_property: self does not have own property "UncalibratedMagnetometer" expected property "UncalibratedMagnetometer" missing
+FAIL UncalibratedMagnetometer interface: attribute z assert_own_property: self does not have own property "UncalibratedMagnetometer" expected property "UncalibratedMagnetometer" missing
+FAIL UncalibratedMagnetometer interface: attribute xBias assert_own_property: self does not have own property "UncalibratedMagnetometer" expected property "UncalibratedMagnetometer" missing
+FAIL UncalibratedMagnetometer interface: attribute yBias assert_own_property: self does not have own property "UncalibratedMagnetometer" expected property "UncalibratedMagnetometer" missing
+FAIL UncalibratedMagnetometer interface: attribute zBias assert_own_property: self does not have own property "UncalibratedMagnetometer" expected property "UncalibratedMagnetometer" missing
+FAIL UncalibratedMagnetometer must be primary interface of new UncalibratedMagnetometer(); assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: UncalibratedMagnetometer is not defined"
+FAIL Stringification of new UncalibratedMagnetometer(); assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: UncalibratedMagnetometer is not defined"
+FAIL UncalibratedMagnetometer interface: new UncalibratedMagnetometer(); must inherit property "x" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: UncalibratedMagnetometer is not defined"
+FAIL UncalibratedMagnetometer interface: new UncalibratedMagnetometer(); must inherit property "y" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: UncalibratedMagnetometer is not defined"
+FAIL UncalibratedMagnetometer interface: new UncalibratedMagnetometer(); must inherit property "z" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: UncalibratedMagnetometer is not defined"
+FAIL UncalibratedMagnetometer interface: new UncalibratedMagnetometer(); must inherit property "xBias" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: UncalibratedMagnetometer is not defined"
+FAIL UncalibratedMagnetometer interface: new UncalibratedMagnetometer(); must inherit property "yBias" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: UncalibratedMagnetometer is not defined"
+FAIL UncalibratedMagnetometer interface: new UncalibratedMagnetometer(); must inherit property "zBias" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: UncalibratedMagnetometer is not defined"
+FAIL Sensor interface: new UncalibratedMagnetometer(); must inherit property "activated" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: UncalibratedMagnetometer is not defined"
+FAIL Sensor interface: new UncalibratedMagnetometer(); must inherit property "timestamp" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: UncalibratedMagnetometer is not defined"
+FAIL Sensor interface: new UncalibratedMagnetometer(); must inherit property "start()" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: UncalibratedMagnetometer is not defined"
+FAIL Sensor interface: new UncalibratedMagnetometer(); must inherit property "stop()" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: UncalibratedMagnetometer is not defined"
+FAIL Sensor interface: new UncalibratedMagnetometer(); must inherit property "onreading" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: UncalibratedMagnetometer is not defined"
+FAIL Sensor interface: new UncalibratedMagnetometer(); must inherit property "onactivate" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: UncalibratedMagnetometer is not defined"
+FAIL Sensor interface: new UncalibratedMagnetometer(); must inherit property "onerror" with the proper type assert_equals: Unexpected exception when evaluating object expected null but got object "ReferenceError: UncalibratedMagnetometer is not defined"
+Harness: the test ran to completion.
 
diff --git a/third_party/WebKit/LayoutTests/external/wpt/magnetometer/idlharness.https.html b/third_party/WebKit/LayoutTests/external/wpt/magnetometer/idlharness.https.html
index f32b727..2f98dda 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/magnetometer/idlharness.https.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/magnetometer/idlharness.https.html
@@ -8,32 +8,20 @@
 <script src="/resources/testharnessreport.js"></script>
 <script src="/resources/WebIDLParser.js"></script>
 <script src="/resources/idlharness.js"></script>
-<style>
-  pre {
-    display: none;
-  }
-</style>
 <div id="log"></div>
 
-<pre id="idl">
-interface Event {
-};
-
-interface Error {
-};
-
-dictionary EventInit {
-};
-
+<script id="idl" type="text/plain">
 interface EventTarget {
 };
 
 interface EventHandler {
 };
-</pre>
+</script>
 
-<pre id="generic-idl">
-[SecureContext]
+<script id="magnetometer-idl" type="text/plain">
+// The interface of Sensor is defined in
+// https://www.w3.org/TR/generic-sensor/#idl-index
+[SecureContext, Exposed=Window]
 interface Sensor : EventTarget {
   readonly attribute boolean activated;
   readonly attribute DOMHighResTimeStamp? timestamp;
@@ -44,29 +32,14 @@
   attribute EventHandler onerror;
 };
 
-dictionary SensorOptions {
-  double? frequency;
-};
-
-[SecureContext, Constructor(DOMString type, SensorErrorEventInit errorEventInitDict)]
-interface SensorErrorEvent : Event {
-  readonly attribute Error error;
-};
-
-dictionary SensorErrorEventInit : EventInit {
-  required Error error;
-};
-</pre>
-
-<pre id="magnetometer-idl">
-[Constructor(optional SensorOptions sensorOptions)]
+[Constructor(optional SensorOptions sensorOptions), Exposed=Window]
 interface Magnetometer : Sensor {
   readonly attribute unrestricted double? x;
   readonly attribute unrestricted double? y;
   readonly attribute unrestricted double? z;
 };
 
-[Constructor(optional SensorOptions sensorOptions)]
+[Constructor(optional SensorOptions sensorOptions), Exposed=Window]
 interface UncalibratedMagnetometer : Sensor {
   readonly attribute unrestricted double? x;
   readonly attribute unrestricted double? y;
@@ -75,26 +48,20 @@
   readonly attribute unrestricted double? yBias;
   readonly attribute unrestricted double? zBias;
 };
-</pre>
+</script>
 
 <script>
-
 (() => {
   "use strict";
   let idl_array = new IdlArray();
   idl_array.add_untested_idls(document.getElementById('idl').textContent);
-  idl_array.add_untested_idls(document.getElementById('generic-idl').textContent);
   idl_array.add_idls(document.getElementById('magnetometer-idl').textContent);
 
   idl_array.add_objects({
-    Magnetometer: ['new Magnetometer();']
-  });
-
-  idl_array.add_objects({
+    Magnetometer: ['new Magnetometer();'],
     UncalibratedMagnetometer: ['new UncalibratedMagnetometer();']
   });
 
   idl_array.test();
 })();
-
 </script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/orientation-sensor/idlharness.https-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/orientation-sensor/idlharness.https-expected.txt
deleted file mode 100644
index 8b13789..0000000
--- a/third_party/WebKit/LayoutTests/external/wpt/orientation-sensor/idlharness.https-expected.txt
+++ /dev/null
@@ -1 +0,0 @@
-
diff --git a/third_party/WebKit/LayoutTests/external/wpt/orientation-sensor/idlharness.https.html b/third_party/WebKit/LayoutTests/external/wpt/orientation-sensor/idlharness.https.html
index 92ed7d4b..82ab9b3 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/orientation-sensor/idlharness.https.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/orientation-sensor/idlharness.https.html
@@ -8,32 +8,20 @@
 <script src="/resources/testharnessreport.js"></script>
 <script src="/resources/WebIDLParser.js"></script>
 <script src="/resources/idlharness.js"></script>
-<style>
-  pre {
-    display: none;
-  }
-</style>
 <div id="log"></div>
 
-<pre id="idl">
-interface Event {
-};
-
-interface Error {
-};
-
-dictionary EventInit {
-};
-
+<script id="idl" type="text/plain">
 interface EventTarget {
 };
 
 interface EventHandler {
 };
-</pre>
+</script>
 
-<pre id="generic-idl">
-[SecureContext]
+<script id="orientation-idl" type="text/plain">
+// The interface of Sensor is defined in
+// https://www.w3.org/TR/generic-sensor/#idl-index
+[SecureContext, Exposed=Window]
 interface Sensor : EventTarget {
   readonly attribute boolean activated;
   readonly attribute DOMHighResTimeStamp? timestamp;
@@ -44,54 +32,35 @@
   attribute EventHandler onerror;
 };
 
-dictionary SensorOptions {
-  double? frequency;
-};
-
-[SecureContext, Constructor(DOMString type, SensorErrorEventInit errorEventInitDict)]
-interface SensorErrorEvent : Event {
-  readonly attribute Error error;
-};
-
-dictionary SensorErrorEventInit : EventInit {
-  required Error error;
-};
-</pre>
-
-<pre id="orientation-idl">
 typedef (Float32Array or Float64Array or DOMMatrix) RotationMatrixType;
+
+[Exposed=Window]
 interface OrientationSensor : Sensor {
   readonly attribute FrozenArray<double>? quaternion;
   void populateMatrix(RotationMatrixType targetMatrix);
 };
 
-[Constructor(optional SensorOptions sensorOptions)]
+[Constructor(optional SensorOptions sensorOptions), Exposed=Window]
 interface AbsoluteOrientationSensor : OrientationSensor {
 };
 
-[Constructor(optional SensorOptions sensorOptions)]
+[Constructor(optional SensorOptions sensorOptions), Exposed=Window]
 interface RelativeOrientationSensor : OrientationSensor {
 };
-</pre>
+</script>
 
 <script>
-
 (() => {
   "use strict";
   let idl_array = new IdlArray();
   idl_array.add_untested_idls(document.getElementById('idl').textContent);
-  idl_array.add_untested_idls(document.getElementById('generic-idl').textContent);
   idl_array.add_idls(document.getElementById('orientation-idl').textContent);
 
   idl_array.add_objects({
-    AbsoluteOrientationSensor: ['new AbsoluteOrientationSensor();']
-  });
-
-  idl_array.add_objects({
+    AbsoluteOrientationSensor: ['new AbsoluteOrientationSensor();'],
     RelativeOrientationSensor: ['new RelativeOrientationSensor();']
   });
 
   idl_array.test();
 })();
-
 </script>
diff --git a/third_party/WebKit/LayoutTests/external/wpt/webrtc/RTCConfiguration-iceCandidatePoolSize-expected.txt b/third_party/WebKit/LayoutTests/external/wpt/webrtc/RTCConfiguration-iceCandidatePoolSize-expected.txt
index 318f6cb..9165128 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/webrtc/RTCConfiguration-iceCandidatePoolSize-expected.txt
+++ b/third_party/WebKit/LayoutTests/external/wpt/webrtc/RTCConfiguration-iceCandidatePoolSize-expected.txt
@@ -1,11 +1,11 @@
 This is a testharness.js-based test.
-FAIL Initialize a new RTCPeerConnection with no iceCandidatePoolSize pc.getConfiguration is not a function
-FAIL Initialize a new RTCPeerConnection with iceCandidatePoolSize: 0 pc.getConfiguration is not a function
-FAIL Initialize a new RTCPeerConnection with iceCandidatePoolSize: 255 pc.getConfiguration is not a function
+FAIL Initialize a new RTCPeerConnection with no iceCandidatePoolSize assert_idl_attribute: property "getConfiguration" not found in prototype chain
+FAIL Initialize a new RTCPeerConnection with iceCandidatePoolSize: 0 assert_idl_attribute: property "getConfiguration" not found in prototype chain
+FAIL Initialize a new RTCPeerConnection with iceCandidatePoolSize: 255 assert_idl_attribute: property "getConfiguration" not found in prototype chain
 PASS Initialize a new RTCPeerConnection with iceCandidatePoolSize: -1 (Out Of Range)
 PASS Initialize a new RTCPeerConnection with iceCandidatePoolSize: 256 (Out Of Range)
-FAIL Reconfigure RTCPeerConnection instance iceCandidatePoolSize to 0 pc.getConfiguration is not a function
-FAIL Reconfigure RTCPeerConnection instance iceCandidatePoolSize to 255 pc.getConfiguration is not a function
+FAIL Reconfigure RTCPeerConnection instance iceCandidatePoolSize to 0 assert_idl_attribute: property "getConfiguration" not found in prototype chain
+FAIL Reconfigure RTCPeerConnection instance iceCandidatePoolSize to 255 assert_idl_attribute: property "getConfiguration" not found in prototype chain
 PASS Reconfigure RTCPeerConnection instance iceCandidatePoolSize to -1 (Out Of Range)
 PASS Reconfigure RTCPeerConnection instance iceCandidatePoolSize to 256 (Out Of Range)
 Harness: the test ran to completion.
diff --git a/third_party/WebKit/LayoutTests/external/wpt/webrtc/RTCConfiguration-iceCandidatePoolSize.html b/third_party/WebKit/LayoutTests/external/wpt/webrtc/RTCConfiguration-iceCandidatePoolSize.html
index f424ec6..2e6859d 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/webrtc/RTCConfiguration-iceCandidatePoolSize.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/webrtc/RTCConfiguration-iceCandidatePoolSize.html
@@ -26,6 +26,7 @@
 */
 test(() => {
   const pc = new RTCPeerConnection();
+  assert_idl_attribute(pc, "getConfiguration");
   assert_equals(pc.getConfiguration().iceCandidatePoolSize, 0);
 }, "Initialize a new RTCPeerConnection with no iceCandidatePoolSize");
 
@@ -33,6 +34,7 @@
   const pc = new RTCPeerConnection({
     iceCandidatePoolSize: 0
   });
+  assert_idl_attribute(pc, "getConfiguration");
   assert_equals(pc.getConfiguration().iceCandidatePoolSize, 0);
 }, "Initialize a new RTCPeerConnection with iceCandidatePoolSize: 0");
 
@@ -40,6 +42,7 @@
   const pc = new RTCPeerConnection({
     iceCandidatePoolSize: 255
   });
+  assert_idl_attribute(pc, "getConfiguration");
   assert_equals(pc.getConfiguration().iceCandidatePoolSize, 255);
 }, "Initialize a new RTCPeerConnection with iceCandidatePoolSize: 255");
 
@@ -63,9 +66,11 @@
 /*
 Reconfiguration
 */
-const pc = new RTCPeerConnection({});
 
 test(() => {
+  const pc = new RTCPeerConnection();
+  assert_idl_attribute(pc, "getConfiguration");
+  assert_idl_attribute(pc, "setConfiguration");
   pc.setConfiguration({
     iceCandidatePoolSize: 0
   });
@@ -73,6 +78,9 @@
 }, "Reconfigure RTCPeerConnection instance iceCandidatePoolSize to 0");
 
 test(() => {
+  const pc = new RTCPeerConnection();
+  assert_idl_attribute(pc, "getConfiguration");
+  assert_idl_attribute(pc, "setConfiguration");
   pc.setConfiguration({
     iceCandidatePoolSize: 255
   });
@@ -88,8 +96,8 @@
 */
 
 test(() => {
+  const pc = new RTCPeerConnection();
   assert_equals(typeof pc.setConfiguration, "function", "RTCPeerConnection.prototype.setConfiguration is not implemented");
-
   assert_throws(new TypeError(), () => {
     pc.setConfiguration({
       iceCandidatePoolSize: -1
@@ -98,8 +106,8 @@
 }, "Reconfigure RTCPeerConnection instance iceCandidatePoolSize to -1 (Out Of Range)");
 
 test(() => {
+  const pc = new RTCPeerConnection();
   assert_equals(typeof pc.setConfiguration, "function", "RTCPeerConnection.prototype.setConfiguration is not implemented");
-
   assert_throws(new TypeError(), () => {
     pc.setConfiguration({
       iceCandidatePoolSize: 256
diff --git a/third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp b/third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp
index 8124e36..050d751 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSParserFastPaths.cpp
@@ -12,6 +12,7 @@
 #include "core/css/CSSInheritedValue.h"
 #include "core/css/CSSInitialValue.h"
 #include "core/css/CSSPrimitiveValue.h"
+#include "core/css/CSSUnsetValue.h"
 #include "core/css/StyleColor.h"
 #include "core/css/parser/CSSParserIdioms.h"
 #include "core/css/parser/CSSPropertyParser.h"
@@ -985,12 +986,13 @@
   DCHECK(!string.IsEmpty());
 
   if (!CSSParserFastPaths::IsKeywordPropertyID(property_id)) {
-    // All properties accept the values of "initial" and "inherit".
+    // All properties accept the values of "initial," "inherit" and "unset".
     if (!EqualIgnoringASCIICase(string, "initial") &&
-        !EqualIgnoringASCIICase(string, "inherit"))
+        !EqualIgnoringASCIICase(string, "inherit") &&
+        !EqualIgnoringASCIICase(string, "unset"))
       return nullptr;
 
-    // Parse initial/inherit shorthands using the CSSPropertyParser.
+    // Parse initial/inherit/unset shorthands using the CSSPropertyParser.
     if (shorthandForProperty(property_id).length())
       return nullptr;
 
@@ -1008,6 +1010,8 @@
     return CSSInheritedValue::Create();
   if (value_id == CSSValueInitial)
     return CSSInitialValue::Create();
+  if (value_id == CSSValueUnset)
+    return CSSUnsetValue::Create();
   if (CSSParserFastPaths::IsValidKeywordPropertyAndValue(property_id, value_id,
                                                          parser_mode))
     return CSSIdentifierValue::Create(value_id);
diff --git a/third_party/WebKit/Source/core/css/parser/CSSParserFastPathsTest.cpp b/third_party/WebKit/Source/core/css/parser/CSSParserFastPathsTest.cpp
index d2a96be..eff8239 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSParserFastPathsTest.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSParserFastPathsTest.cpp
@@ -24,7 +24,8 @@
                                               kHTMLStandardMode);
   ASSERT_EQ(nullptr, value);
 }
-TEST(CSSParserFastPathsTest, ParseInitialAndInheritKeyword) {
+
+TEST(CSSParserFastPathsTest, ParseCSSWideKeywords) {
   CSSValue* value = CSSParserFastPaths::MaybeParseValue(
       CSSPropertyMarginTop, "inherit", kHTMLStandardMode);
   ASSERT_NE(nullptr, value);
@@ -41,6 +42,14 @@
                                               kHTMLStandardMode);
   ASSERT_NE(nullptr, value);
   EXPECT_TRUE(value->IsInitialValue());
+  value = CSSParserFastPaths::MaybeParseValue(CSSPropertyMarginTop, "unset",
+                                              kHTMLStandardMode);
+  ASSERT_NE(nullptr, value);
+  EXPECT_TRUE(value->IsUnsetValue());
+  value = CSSParserFastPaths::MaybeParseValue(CSSPropertyMarginLeft, "unsEt",
+                                              kHTMLStandardMode);
+  ASSERT_NE(nullptr, value);
+  EXPECT_TRUE(value->IsUnsetValue());
   // Fast path doesn't handle short hands.
   value = CSSParserFastPaths::MaybeParseValue(CSSPropertyMargin, "initial",
                                               kHTMLStandardMode);
diff --git a/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp b/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp
index 2ee5ef7..e1d71fd 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp
@@ -112,7 +112,7 @@
 }
 
 void AXInlineTextBox::GetWordBoundaries(Vector<AXRange>& words) const {
-  if (!inline_text_box_)
+  if (!inline_text_box_ || inline_text_box_->GetText().ContainsOnlyWhitespace())
     return;
 
   Vector<AbstractInlineTextBox::WordBoundaries> word_boundaries;
diff --git a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp
index 9b7e2af..e2e6098 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp
@@ -733,15 +733,6 @@
   return true;
 }
 
-bool AXLayoutObject::IsFocusableByDefault(Element* elem) const {
-  // These are the only naturally focusable elements that are focusable without
-  // contenteditable or tabindex.
-  DCHECK(elem);
-  return elem->IsFormControlElement() || elem->HasTagName(aTag) ||
-         elem->HasTagName(audioTag) || elem->HasTagName(iframeTag) ||
-         elem->HasTagName(summaryTag) || elem->HasTagName(videoTag);
-}
-
 bool AXLayoutObject::HasAriaCellRole(Element* elem) const {
   DCHECK(elem);
   const AtomicString& aria_role_str = elem->FastGetAttribute(roleAttr);
@@ -792,7 +783,7 @@
   Node* node = layout->GetNode();
   if (node && node->IsElementNode()) {
     Element* elem = ToElement(node);
-    if (IsFocusableByDefault(elem) || HasAriaCellRole(elem))
+    if (HasAriaCellRole(elem))
       return true;
   }
 
diff --git a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.h b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.h
index 1d0c937..4bee3a1 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.h
@@ -213,7 +213,6 @@
 
   bool CanIgnoreTextAsEmpty() const;
   bool CanIgnoreSpaceNextTo(LayoutObject*, bool is_after) const;
-  bool IsFocusableByDefault(Element*) const;
   bool HasAriaCellRole(Element*) const;
 };
 
diff --git a/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp b/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp
index 48d6a42..aca2060 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp
@@ -335,7 +335,10 @@
   if (RoleValue() != kSliderRole)
     return;
 
-  float value = ValueForRange();
+  float value;
+  if (!ValueForRange(&value))
+    return;
+
   float step = StepValueForRange();
 
   value += increase ? step : -step;
@@ -1803,46 +1806,64 @@
       .GetString();
 }
 
-float AXNodeObject::ValueForRange() const {
+bool AXNodeObject::ValueForRange(float* out_value) const {
   float value_now;
-  if (HasAOMPropertyOrARIAAttribute(AOMFloatProperty::kValueNow, value_now))
-    return value_now;
+  if (HasAOMPropertyOrARIAAttribute(AOMFloatProperty::kValueNow, value_now)) {
+    *out_value = value_now;
+    return true;
+  }
 
-  if (IsNativeSlider())
-    return toHTMLInputElement(*GetNode()).valueAsNumber();
+  if (IsNativeSlider()) {
+    *out_value = toHTMLInputElement(*GetNode()).valueAsNumber();
+    return true;
+  }
 
-  if (isHTMLMeterElement(GetNode()))
-    return toHTMLMeterElement(*GetNode()).value();
+  if (isHTMLMeterElement(GetNode())) {
+    *out_value = toHTMLMeterElement(*GetNode()).value();
+    return true;
+  }
 
-  return 0.0;
+  return false;
 }
 
-float AXNodeObject::MaxValueForRange() const {
+bool AXNodeObject::MaxValueForRange(float* out_value) const {
   float value_max;
-  if (HasAOMPropertyOrARIAAttribute(AOMFloatProperty::kValueMax, value_max))
-    return value_max;
+  if (HasAOMPropertyOrARIAAttribute(AOMFloatProperty::kValueMax, value_max)) {
+    *out_value = value_max;
+    return true;
+  }
 
-  if (IsNativeSlider())
-    return toHTMLInputElement(*GetNode()).Maximum();
+  if (IsNativeSlider()) {
+    *out_value = toHTMLInputElement(*GetNode()).Maximum();
+    return true;
+  }
 
-  if (isHTMLMeterElement(GetNode()))
-    return toHTMLMeterElement(*GetNode()).max();
+  if (isHTMLMeterElement(GetNode())) {
+    *out_value = toHTMLMeterElement(*GetNode()).max();
+    return true;
+  }
 
-  return 0.0;
+  return false;
 }
 
-float AXNodeObject::MinValueForRange() const {
+bool AXNodeObject::MinValueForRange(float* out_value) const {
   float value_min;
-  if (HasAOMPropertyOrARIAAttribute(AOMFloatProperty::kValueMin, value_min))
-    return value_min;
+  if (HasAOMPropertyOrARIAAttribute(AOMFloatProperty::kValueMin, value_min)) {
+    *out_value = value_min;
+    return true;
+  }
 
-  if (IsNativeSlider())
-    return toHTMLInputElement(*GetNode()).Minimum();
+  if (IsNativeSlider()) {
+    *out_value = toHTMLInputElement(*GetNode()).Minimum();
+    return true;
+  }
 
-  if (isHTMLMeterElement(GetNode()))
-    return toHTMLMeterElement(*GetNode()).min();
+  if (isHTMLMeterElement(GetNode())) {
+    *out_value = toHTMLMeterElement(*GetNode()).min();
+    return true;
+  }
 
-  return 0.0;
+  return false;
 }
 
 float AXNodeObject::StepValueForRange() const {
@@ -1962,7 +1983,9 @@
           GetAOMPropertyOrARIAAttribute(AOMStringProperty::kValueText);
       if (!aria_valuetext.IsNull())
         return aria_valuetext.GetString();
-      return String::Number(ValueForRange());
+      float value;
+      if (ValueForRange(&value))
+        return String::Number(value);
     }
 
     return StringValue();
diff --git a/third_party/WebKit/Source/modules/accessibility/AXNodeObject.h b/third_party/WebKit/Source/modules/accessibility/AXNodeObject.h
index a69b6f4..47f97a5 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXNodeObject.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXNodeObject.h
@@ -151,9 +151,9 @@
   // Only used when invalidState() returns InvalidStateOther.
   String AriaInvalidValue() const final;
   String ValueDescription() const override;
-  float ValueForRange() const override;
-  float MaxValueForRange() const override;
-  float MinValueForRange() const override;
+  bool ValueForRange(float* out_value) const override;
+  bool MaxValueForRange(float* out_value) const override;
+  bool MinValueForRange(float* out_value) const override;
   String StringValue() const override;
 
   // ARIA attributes.
diff --git a/third_party/WebKit/Source/modules/accessibility/AXObject.h b/third_party/WebKit/Source/modules/accessibility/AXObject.h
index 72cf1dd..ceee717 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXObject.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXObject.h
@@ -626,9 +626,9 @@
   // Only used when invalidState() returns InvalidStateOther.
   virtual String AriaInvalidValue() const { return String(); }
   virtual String ValueDescription() const { return String(); }
-  virtual float ValueForRange() const { return 0.0f; }
-  virtual float MaxValueForRange() const { return 0.0f; }
-  virtual float MinValueForRange() const { return 0.0f; }
+  virtual bool ValueForRange(float* out_value) const { return 0.0f; }
+  virtual bool MaxValueForRange(float* out_value) const { return 0.0f; }
+  virtual bool MinValueForRange(float* out_value) const { return false; }
   virtual String StringValue() const { return String(); }
   virtual AXRestriction Restriction() const { return kNone; }
 
diff --git a/third_party/WebKit/Source/modules/accessibility/AXProgressIndicator.cpp b/third_party/WebKit/Source/modules/accessibility/AXProgressIndicator.cpp
index 3ea26de..7fc606f 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXProgressIndicator.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXProgressIndicator.cpp
@@ -51,31 +51,41 @@
   return AccessibilityIsIgnoredByDefault(ignored_reasons);
 }
 
-float AXProgressIndicator::ValueForRange() const {
+bool AXProgressIndicator::ValueForRange(float* out_value) const {
   float value_now;
-  if (HasAOMPropertyOrARIAAttribute(AOMFloatProperty::kValueNow, value_now))
-    return value_now;
+  if (HasAOMPropertyOrARIAAttribute(AOMFloatProperty::kValueNow, value_now)) {
+    *out_value = value_now;
+    return true;
+  }
 
-  if (GetProgressElement()->position() >= 0)
-    return clampTo<float>(GetProgressElement()->value());
-  // Indeterminate progress bar should return 0.
-  return 0.0f;
+  if (GetProgressElement()->position() >= 0) {
+    *out_value = clampTo<float>(GetProgressElement()->value());
+    return true;
+  }
+  // Indeterminate progress bar has no value.
+  return false;
 }
 
-float AXProgressIndicator::MaxValueForRange() const {
+bool AXProgressIndicator::MaxValueForRange(float* out_value) const {
   float value_max;
-  if (HasAOMPropertyOrARIAAttribute(AOMFloatProperty::kValueMax, value_max))
-    return value_max;
+  if (HasAOMPropertyOrARIAAttribute(AOMFloatProperty::kValueMax, value_max)) {
+    *out_value = value_max;
+    return true;
+  }
 
-  return clampTo<float>(GetProgressElement()->max());
+  *out_value = clampTo<float>(GetProgressElement()->max());
+  return true;
 }
 
-float AXProgressIndicator::MinValueForRange() const {
+bool AXProgressIndicator::MinValueForRange(float* out_value) const {
   float value_min;
-  if (HasAOMPropertyOrARIAAttribute(AOMFloatProperty::kValueMin, value_min))
-    return value_min;
+  if (HasAOMPropertyOrARIAAttribute(AOMFloatProperty::kValueMin, value_min)) {
+    *out_value = value_min;
+    return true;
+  }
 
-  return 0.0f;
+  *out_value = 0.0f;
+  return true;
 }
 
 HTMLProgressElement* AXProgressIndicator::GetProgressElement() const {
diff --git a/third_party/WebKit/Source/modules/accessibility/AXProgressIndicator.h b/third_party/WebKit/Source/modules/accessibility/AXProgressIndicator.h
index e3aae0e..dd7fd44 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXProgressIndicator.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXProgressIndicator.h
@@ -40,9 +40,9 @@
 
   bool IsProgressIndicator() const override { return true; }
 
-  float ValueForRange() const override;
-  float MaxValueForRange() const override;
-  float MinValueForRange() const override;
+  bool ValueForRange(float* out_value) const override;
+  bool MaxValueForRange(float* out_value) const override;
+  bool MinValueForRange(float* out_value) const override;
 
   AXProgressIndicator(LayoutProgress*, AXObjectCacheImpl&);
 
diff --git a/third_party/WebKit/Source/modules/accessibility/AccessibilityObjectModelTest.cpp b/third_party/WebKit/Source/modules/accessibility/AccessibilityObjectModelTest.cpp
index a41d279..f00e2f7 100644
--- a/third_party/WebKit/Source/modules/accessibility/AccessibilityObjectModelTest.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AccessibilityObjectModelTest.cpp
@@ -149,9 +149,13 @@
   auto* cache = AXObjectCache();
   ASSERT_NE(nullptr, cache);
   auto* ax_slider = cache->GetOrCreate(slider);
-  EXPECT_EQ(-0.5f, ax_slider->MinValueForRange());
-  EXPECT_EQ(0.5f, ax_slider->MaxValueForRange());
-  EXPECT_EQ(0.1f, ax_slider->ValueForRange());
+  float value = 0.0f;
+  EXPECT_TRUE(ax_slider->MinValueForRange(&value));
+  EXPECT_EQ(-0.5f, value);
+  EXPECT_TRUE(ax_slider->MaxValueForRange(&value));
+  EXPECT_EQ(0.5f, value);
+  EXPECT_TRUE(ax_slider->ValueForRange(&value));
+  EXPECT_EQ(0.1f, value);
 }
 
 TEST_F(AccessibilityObjectModelTest, Level) {
diff --git a/third_party/WebKit/Source/modules/accessibility/InspectorAccessibilityAgent.cpp b/third_party/WebKit/Source/modules/accessibility/InspectorAccessibilityAgent.cpp
index 6317734..083107b 100644
--- a/third_party/WebKit/Source/modules/accessibility/InspectorAccessibilityAgent.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/InspectorAccessibilityAgent.cpp
@@ -227,12 +227,18 @@
   }
 
   if (ax_object.IsRange()) {
-    properties.addItem(
-        CreateProperty(AXWidgetAttributesEnum::Valuemin,
-                       CreateValue(ax_object.MinValueForRange())));
-    properties.addItem(
-        CreateProperty(AXWidgetAttributesEnum::Valuemax,
-                       CreateValue(ax_object.MaxValueForRange())));
+    float min_value;
+    if (ax_object.MinValueForRange(&min_value)) {
+      properties.addItem(CreateProperty(AXWidgetAttributesEnum::Valuemin,
+                                        CreateValue(min_value)));
+    }
+
+    float max_value;
+    if (ax_object.MaxValueForRange(&max_value)) {
+      properties.addItem(CreateProperty(AXWidgetAttributesEnum::Valuemax,
+                                        CreateValue(max_value)));
+    }
+
     properties.addItem(
         CreateProperty(AXWidgetAttributesEnum::Valuetext,
                        CreateValue(ax_object.ValueDescription())));
@@ -646,7 +652,9 @@
   }
   // Value.
   if (ax_object.SupportsRangeValue()) {
-    node_object.setValue(CreateValue(ax_object.ValueForRange()));
+    float value;
+    if (ax_object.ValueForRange(&value))
+      node_object.setValue(CreateValue(value));
   } else {
     String string_value = ax_object.StringValue();
     if (!string_value.IsEmpty())
diff --git a/third_party/WebKit/Source/modules/exported/WebAXObject.cpp b/third_party/WebKit/Source/modules/exported/WebAXObject.cpp
index 01a1dfd..5ad46f3 100644
--- a/third_party/WebKit/Source/modules/exported/WebAXObject.cpp
+++ b/third_party/WebKit/Source/modules/exported/WebAXObject.cpp
@@ -965,25 +965,25 @@
   return private_->ValueDescription();
 }
 
-float WebAXObject::ValueForRange() const {
+bool WebAXObject::ValueForRange(float* out_value) const {
   if (IsDetached())
-    return 0.0;
+    return false;
 
-  return private_->ValueForRange();
+  return private_->ValueForRange(out_value);
 }
 
-float WebAXObject::MaxValueForRange() const {
+bool WebAXObject::MaxValueForRange(float* out_value) const {
   if (IsDetached())
-    return 0.0;
+    return false;
 
-  return private_->MaxValueForRange();
+  return private_->MaxValueForRange(out_value);
 }
 
-float WebAXObject::MinValueForRange() const {
+bool WebAXObject::MinValueForRange(float* out_value) const {
   if (IsDetached())
-    return 0.0;
+    return false;
 
-  return private_->MinValueForRange();
+  return private_->MinValueForRange(out_value);
 }
 
 WebNode WebAXObject::GetNode() const {
diff --git a/third_party/WebKit/Source/platform/scheduler/base/task_queue.cc b/third_party/WebKit/Source/platform/scheduler/base/task_queue.cc
index f2d6a30..e28ed44 100644
--- a/third_party/WebKit/Source/platform/scheduler/base/task_queue.cc
+++ b/third_party/WebKit/Source/platform/scheduler/base/task_queue.cc
@@ -20,6 +20,15 @@
                       bool nestable)
     : PendingTask(posted_from, std::move(task), desired_run_time, nestable) {}
 
+TaskQueue::PostedTask::PostedTask(base::OnceClosure callback,
+                                  base::Location posted_from,
+                                  base::TimeDelta delay,
+                                  bool nestable)
+    : callback(std::move(callback)),
+      posted_from(posted_from),
+      delay(delay),
+      nestable(nestable) {}
+
 void TaskQueue::UnregisterTaskQueue() {
   impl_->UnregisterTaskQueue(this);
 }
@@ -31,13 +40,15 @@
 bool TaskQueue::PostDelayedTask(const base::Location& from_here,
                                 base::OnceClosure task,
                                 base::TimeDelta delay) {
-  return impl_->PostDelayedTask(from_here, std::move(task), delay);
+  return impl_->PostDelayedTask(
+      PostedTask(std::move(task), from_here, delay, /* nestable */ true));
 }
 
 bool TaskQueue::PostNonNestableDelayedTask(const base::Location& from_here,
                                            base::OnceClosure task,
                                            base::TimeDelta delay) {
-  return impl_->PostNonNestableDelayedTask(from_here, std::move(task), delay);
+  return impl_->PostDelayedTask(
+      PostedTask(std::move(task), from_here, delay, /* nestable */ false));
 }
 
 std::unique_ptr<TaskQueue::QueueEnabledVoter>
diff --git a/third_party/WebKit/Source/platform/scheduler/base/task_queue.h b/third_party/WebKit/Source/platform/scheduler/base/task_queue.h
index 3613a9a..77b9154 100644
--- a/third_party/WebKit/Source/platform/scheduler/base/task_queue.h
+++ b/third_party/WebKit/Source/platform/scheduler/base/task_queue.h
@@ -48,6 +48,20 @@
                                           base::TimeTicks next_wake_up) = 0;
   };
 
+  // A wrapper around base::OnceClosure with additional metadata to be passed
+  // to PostTask and plumbed until PendingTask is created.
+  struct PostedTask {
+    PostedTask(base::OnceClosure callback,
+               base::Location posted_from,
+               base::TimeDelta delay,
+               bool nestable);
+
+    base::OnceClosure callback;
+    base::Location posted_from;
+    base::TimeDelta delay;
+    bool nestable;
+  };
+
   // Unregisters the task queue after which no tasks posted to it will run and
   // the TaskQueueManager's reference to it will be released soon.
   virtual void UnregisterTaskQueue();
diff --git a/third_party/WebKit/Source/platform/scheduler/base/task_queue_impl.cc b/third_party/WebKit/Source/platform/scheduler/base/task_queue_impl.cc
index 9ad2512..9a4b43b 100644
--- a/third_party/WebKit/Source/platform/scheduler/base/task_queue_impl.cc
+++ b/third_party/WebKit/Source/platform/scheduler/base/task_queue_impl.cc
@@ -164,33 +164,17 @@
   return base::PlatformThread::CurrentId() == thread_id_;
 }
 
-bool TaskQueueImpl::PostDelayedTask(const base::Location& from_here,
-                                    base::OnceClosure task,
-                                    base::TimeDelta delay) {
-  if (delay.is_zero())
-    return PostImmediateTaskImpl(from_here, std::move(task), TaskType::NORMAL);
+bool TaskQueueImpl::PostDelayedTask(TaskQueue::PostedTask task) {
+  if (task.delay.is_zero())
+    return PostImmediateTaskImpl(std::move(task));
 
-  return PostDelayedTaskImpl(from_here, std::move(task), delay,
-                             TaskType::NORMAL);
+  return PostDelayedTaskImpl(std::move(task));
 }
 
-bool TaskQueueImpl::PostNonNestableDelayedTask(const base::Location& from_here,
-                                               base::OnceClosure task,
-                                               base::TimeDelta delay) {
-  if (delay.is_zero())
-    return PostImmediateTaskImpl(from_here, std::move(task),
-                                 TaskType::NON_NESTABLE);
-
-  return PostDelayedTaskImpl(from_here, std::move(task), delay,
-                             TaskType::NON_NESTABLE);
-}
-
-bool TaskQueueImpl::PostImmediateTaskImpl(const base::Location& from_here,
-                                          base::OnceClosure task,
-                                          TaskType task_type) {
+bool TaskQueueImpl::PostImmediateTaskImpl(TaskQueue::PostedTask task) {
   // Use CHECK instead of DCHECK to crash earlier. See http://crbug.com/711167
   // for details.
-  CHECK(task);
+  CHECK(task.callback);
   base::AutoLock lock(any_thread_lock_);
   if (!any_thread().task_queue_manager)
     return false;
@@ -198,20 +182,17 @@
   EnqueueOrder sequence_number =
       any_thread().task_queue_manager->GetNextSequenceNumber();
 
-  PushOntoImmediateIncomingQueueLocked(from_here, std::move(task),
-                                       base::TimeTicks(), sequence_number,
-                                       task_type != TaskType::NON_NESTABLE);
+  PushOntoImmediateIncomingQueueLocked(
+      Task(task.posted_from, std::move(task.callback), base::TimeTicks(),
+           sequence_number, task.nestable, sequence_number));
   return true;
 }
 
-bool TaskQueueImpl::PostDelayedTaskImpl(const base::Location& from_here,
-                                        base::OnceClosure task,
-                                        base::TimeDelta delay,
-                                        TaskType task_type) {
+bool TaskQueueImpl::PostDelayedTaskImpl(TaskQueue::PostedTask task) {
   // Use CHECK instead of DCHECK to crash earlier. See http://crbug.com/711167
   // for details.
-  CHECK(task);
-  DCHECK_GT(delay, base::TimeDelta());
+  CHECK(task.callback);
+  DCHECK_GT(task.delay, base::TimeDelta());
   if (base::PlatformThread::CurrentId() == thread_id_) {
     // Lock-free fast path for delayed tasks posted from the main thread.
     if (!main_thread_only().task_queue_manager)
@@ -221,10 +202,10 @@
         main_thread_only().task_queue_manager->GetNextSequenceNumber();
 
     base::TimeTicks time_domain_now = main_thread_only().time_domain->Now();
-    base::TimeTicks time_domain_delayed_run_time = time_domain_now + delay;
+    base::TimeTicks time_domain_delayed_run_time = time_domain_now + task.delay;
     PushOntoDelayedIncomingQueueFromMainThread(
-        Task(from_here, std::move(task), time_domain_delayed_run_time,
-             sequence_number, task_type != TaskType::NON_NESTABLE),
+        Task(task.posted_from, std::move(task.callback),
+             time_domain_delayed_run_time, sequence_number, task.nestable),
         time_domain_now);
   } else {
     // NOTE posting a delayed task from a different thread is not expected to
@@ -239,10 +220,10 @@
         any_thread().task_queue_manager->GetNextSequenceNumber();
 
     base::TimeTicks time_domain_now = any_thread().time_domain->Now();
-    base::TimeTicks time_domain_delayed_run_time = time_domain_now + delay;
+    base::TimeTicks time_domain_delayed_run_time = time_domain_now + task.delay;
     PushOntoDelayedIncomingQueueLocked(
-        Task(from_here, std::move(task), time_domain_delayed_run_time,
-             sequence_number, task_type != TaskType::NON_NESTABLE));
+        Task(task.posted_from, std::move(task.callback),
+             time_domain_delayed_run_time, sequence_number, task.nestable));
   }
   return true;
 }
@@ -273,10 +254,11 @@
   int thread_hop_task_sequence_number =
       any_thread().task_queue_manager->GetNextSequenceNumber();
   PushOntoImmediateIncomingQueueLocked(
-      FROM_HERE,
-      base::Bind(&TaskQueueImpl::ScheduleDelayedWorkTask,
-                 base::Unretained(this), base::Passed(&pending_task)),
-      base::TimeTicks(), thread_hop_task_sequence_number, false);
+      Task(FROM_HERE,
+           base::Bind(&TaskQueueImpl::ScheduleDelayedWorkTask,
+                      base::Unretained(this), base::Passed(&pending_task)),
+           base::TimeTicks(), thread_hop_task_sequence_number, false,
+           thread_hop_task_sequence_number));
 }
 
 void TaskQueueImpl::ScheduleDelayedWorkTask(Task pending_task) {
@@ -300,22 +282,18 @@
   TraceQueueSize();
 }
 
-void TaskQueueImpl::PushOntoImmediateIncomingQueueLocked(
-    const base::Location& posted_from,
-    base::OnceClosure task,
-    base::TimeTicks desired_run_time,
-    EnqueueOrder sequence_number,
-    bool nestable) {
+void TaskQueueImpl::PushOntoImmediateIncomingQueueLocked(Task task) {
   // If the |immediate_incoming_queue| is empty we need a DoWork posted to make
   // it run.
   bool was_immediate_incoming_queue_empty;
 
+  EnqueueOrder sequence_number = task.sequence_num;
+  base::TimeTicks desired_run_time = task.delayed_run_time;
+
   {
     base::AutoLock lock(immediate_incoming_queue_lock_);
     was_immediate_incoming_queue_empty = immediate_incoming_queue().empty();
-    immediate_incoming_queue().emplace_back(posted_from, std::move(task),
-                                            desired_run_time, sequence_number,
-                                            nestable, sequence_number);
+    immediate_incoming_queue().push_back(std::move(task));
     any_thread().task_queue_manager->DidQueueTask(
         immediate_incoming_queue().back());
   }
diff --git a/third_party/WebKit/Source/platform/scheduler/base/task_queue_impl.h b/third_party/WebKit/Source/platform/scheduler/base/task_queue_impl.h
index 0bf4356..388f130 100644
--- a/third_party/WebKit/Source/platform/scheduler/base/task_queue_impl.h
+++ b/third_party/WebKit/Source/platform/scheduler/base/task_queue_impl.h
@@ -143,12 +143,7 @@
   // TaskQueue implementation.
   const char* GetName() const;
   bool RunsTasksInCurrentSequence() const;
-  bool PostDelayedTask(const base::Location& from_here,
-                       base::OnceClosure task,
-                       base::TimeDelta delay);
-  bool PostNonNestableDelayedTask(const base::Location& from_here,
-                                  base::OnceClosure task,
-                                  base::TimeDelta delay);
+  bool PostDelayedTask(TaskQueue::PostedTask task);
   // Require a reference to enclosing task queue for lifetime control.
   std::unique_ptr<TaskQueue::QueueEnabledVoter> CreateQueueEnabledVoter(
       scoped_refptr<TaskQueue> owning_task_queue);
@@ -280,11 +275,6 @@
   friend class WorkQueue;
   friend class WorkQueueTest;
 
-  enum class TaskType {
-    NORMAL,
-    NON_NESTABLE,
-  };
-
   struct AnyThread {
     AnyThread(TaskQueueManager* task_queue_manager, TimeDomain* time_domain);
     ~AnyThread();
@@ -329,13 +319,8 @@
     bool is_enabled_for_test;
   };
 
-  bool PostImmediateTaskImpl(const base::Location& from_here,
-                             base::OnceClosure task,
-                             TaskType task_type);
-  bool PostDelayedTaskImpl(const base::Location& from_here,
-                           base::OnceClosure task,
-                           base::TimeDelta delay,
-                           TaskType task_type);
+  bool PostImmediateTaskImpl(TaskQueue::PostedTask task);
+  bool PostDelayedTaskImpl(TaskQueue::PostedTask task);
 
   // Push the task onto the |delayed_incoming_queue|. Lock-free main thread
   // only fast path.
@@ -353,11 +338,7 @@
   // Push the task onto the |immediate_incoming_queue| and for auto pumped
   // queues it calls MaybePostDoWorkOnMainRunner if the Incoming queue was
   // empty.
-  void PushOntoImmediateIncomingQueueLocked(const base::Location& posted_from,
-                                            base::OnceClosure task,
-                                            base::TimeTicks desired_run_time,
-                                            EnqueueOrder sequence_number,
-                                            bool nestable);
+  void PushOntoImmediateIncomingQueueLocked(Task task);
 
   // We reserve an inline capacity of 8 tasks to try and reduce the load on
   // PartitionAlloc.
diff --git a/third_party/WebKit/public/web/WebAXObject.h b/third_party/WebKit/public/web/WebAXObject.h
index b796e87..d32762f 100644
--- a/third_party/WebKit/public/web/WebAXObject.h
+++ b/third_party/WebKit/public/web/WebAXObject.h
@@ -248,9 +248,9 @@
 
   BLINK_EXPORT bool SupportsRangeValue() const;
   BLINK_EXPORT WebString ValueDescription() const;
-  BLINK_EXPORT float ValueForRange() const;
-  BLINK_EXPORT float MaxValueForRange() const;
-  BLINK_EXPORT float MinValueForRange() const;
+  BLINK_EXPORT bool ValueForRange(float* out_value) const;
+  BLINK_EXPORT bool MaxValueForRange(float* out_value) const;
+  BLINK_EXPORT bool MinValueForRange(float* out_value) const;
 
   BLINK_EXPORT WebNode GetNode() const;
   BLINK_EXPORT WebDocument GetDocument() const;
diff --git a/third_party/gvr-android-sdk/BUILD.gn b/third_party/gvr-android-sdk/BUILD.gn
index bc7e79e..754fd0c 100644
--- a/third_party/gvr-android-sdk/BUILD.gn
+++ b/third_party/gvr-android-sdk/BUILD.gn
@@ -40,6 +40,195 @@
     "*google/common/logging/nano/Vr\$VREvent\$Cyclops*.class",
     "*google/common/logging/nano/Vr\$VREvent\$AudioStats.class",
     "*ThrowableExtension*.class",
+
+    # The following list contains all the java classes in
+    # com.google.vr.cardboard.* and com.google.vr.ndk.base.*. Gvr allows
+    # loading GvrLayout and GvrUiLayout from VrCore. So a lot of classes in the
+    # two namespaces are no longer needed.
+    # For classes that are still needed, we comment them out from the list
+    # instead of removing them.
+    # If any class is needed in the future, please also comment it out from the
+    # list instead of removing.
+    # TODO(bshe): Instead of excluding classes, we should consider use something
+    # like jar_included_patterns. So that we only need to include the classes
+    # that we need. And we don't need to worry about forget to exclude new
+    # classes after a GVR roll. See crbug.com/764446
+    #"*google/vr/cardboard/AndroidNCompat\$1.class",
+    #"*google/vr/cardboard/AndroidNCompat\$2.class",
+    #"*google/vr/cardboard/AndroidNCompat\$3.class",
+    #"*google/vr/cardboard/AndroidNCompat.class",
+    "*google/vr/cardboard/CardboardGLSurfaceView.class",
+    "*google/vr/cardboard/CardboardGLSurfaceView\$DetachListener.class",
+    #"*google/vr/cardboard/ConfigUtils.class",
+    #"*google/vr/cardboard/ContentProviderVrParamsProvider.class",
+    #"*google/vr/cardboard/ContextUtils.class",
+    #"*google/vr/cardboard/DisplaySynchronizer.class",
+    #"*google/vr/cardboard/DisplayUtils.class",
+    "*google/vr/cardboard/EglFactory.class",
+    "*google/vr/cardboard/EglReadyListener.class",
+    "*google/vr/cardboard/EglReadyListener\$EventListener.class",
+    "*google/vr/cardboard/ExternalSurfaceManager\$1.class",
+    "*google/vr/cardboard/ExternalSurfaceManager.class",
+    "*google/vr/cardboard/ExternalSurfaceManager\$ExternalSurface\$1.class",
+    "*google/vr/cardboard/ExternalSurfaceManager\$ExternalSurfaceCallback.class",
+    "*google/vr/cardboard/ExternalSurfaceManager\$ExternalSurface.class",
+    "*google/vr/cardboard/ExternalSurfaceManager\$ExternalSurfaceData.class",
+    "*google/vr/cardboard/ExternalSurfaceManager\$UpdateSurfaceCallback.class",
+    #"*google/vr/cardboard/FrameMonitor.class",
+    "*google/vr/cardboard/FullscreenMode\$1\$1.class",
+    "*google/vr/cardboard/FullscreenMode\$1.class",
+    "*google/vr/cardboard/FullscreenMode.class",
+    "*google/vr/cardboard/LegacyVrParamsProvider.class",
+    "*google/vr/cardboard/MutableEglConfigChooser.class",
+    "*google/vr/cardboard/NFCUtils\$1.class",
+    "*google/vr/cardboard/NFCUtils.class",
+    #"*google/vr/cardboard/PackageUtils.class",
+    "*google/vr/cardboard/PhoneParams.class",
+    "*google/vr/cardboard/PhoneParams\$PpiOverride.class",
+    "*google/vr/cardboard/ScanlineRacingRenderer\$1.class",
+    "*google/vr/cardboard/ScanlineRacingRenderer.class",
+    "*google/vr/cardboard/ScreenOrientationDetector.class",
+    "*google/vr/cardboard/ScreenOrientationDetector\$Listener.class",
+    "*google/vr/cardboard/ScreenOrientationDetector\$Orientation.class",
+    "*google/vr/cardboard/StoragePermissionUtils.class",
+    "*google/vr/cardboard/ThreadUtils.class",
+    "*google/vr/cardboard/TransitionView\$1.class",
+    "*google/vr/cardboard/TransitionView\$2.class",
+    "*google/vr/cardboard/TransitionView\$3.class",
+    "*google/vr/cardboard/TransitionView\$4.class",
+    "*google/vr/cardboard/TransitionView\$5.class",
+    "*google/vr/cardboard/TransitionView.class",
+    "*google/vr/cardboard/UiLayer\$10.class",
+    "*google/vr/cardboard/UiLayer\$11.class",
+    "*google/vr/cardboard/UiLayer\$1.class",
+    "*google/vr/cardboard/UiLayer\$2.class",
+    "*google/vr/cardboard/UiLayer\$3.class",
+    "*google/vr/cardboard/UiLayer\$4.class",
+    "*google/vr/cardboard/UiLayer\$5.class",
+    "*google/vr/cardboard/UiLayer\$6.class",
+    "*google/vr/cardboard/UiLayer\$7.class",
+    "*google/vr/cardboard/UiLayer\$8.class",
+    "*google/vr/cardboard/UiLayer\$9.class",
+    "*google/vr/cardboard/UiLayer.class",
+    "*google/vr/cardboard/UiUtils\$1.class",
+    "*google/vr/cardboard/UiUtils\$2.class",
+    "*google/vr/cardboard/UiUtils\$3.class",
+    "*google/vr/cardboard/UiUtils\$4.class",
+    "*google/vr/cardboard/UiUtils.class",
+    "*google/vr/cardboard/UsedByNative.class",
+    #"*google/vr/cardboard/VrContextWrapper.class",
+    #"*google/vr/cardboard/VrCoreLibraryLoader.class",
+    #"*google/vr/cardboard/VrParamsProvider.class",
+    #"*google/vr/cardboard/VrParamsProviderFactory.class",
+    #"*google/vr/cardboard/VrParamsProviderFactory\$ContentProviderClientHandle.class",
+    "*google/vr/cardboard/VrParamsProviderJni.class",
+    #"*google/vr/cardboard/VrSettingsProviderContract.class",
+    "*google/vr/cardboard/annotations/UsedByNative.class",
+    "*google/vr/cardboard/annotations/UsedByReflection.class",
+    "*google/vr/ndk/base/AbstractDaydreamTouchListener.class",
+    #"*google/vr/ndk/base/AndroidCompat.class",
+    "*google/vr/ndk/base/BufferSpec.class",
+    "*google/vr/ndk/base/BufferSpec\$ColorFormat.class",
+    "*google/vr/ndk/base/BufferSpec\$DepthStencilFormat.class",
+    "*google/vr/ndk/base/BufferViewport.class",
+    "*google/vr/ndk/base/BufferViewport\$EyeType.class",
+    "*google/vr/ndk/base/BufferViewportList.class",
+    "*google/vr/ndk/base/BufferViewport\$Reprojection.class",
+    #"*google/vr/ndk/base/BuildConstants.class",
+    "*google/vr/ndk/base/BuildFlags.class",
+    "*google/vr/ndk/base/CardboardEmulator.class",
+    "*google/vr/ndk/base/CardboardEmulator\$ControllerCallbacks.class",
+    "*google/vr/ndk/base/Constants.class",
+    #"*google/vr/ndk/base/DaydreamApi\$10.class",
+    #"*google/vr/ndk/base/DaydreamApi\$11.class",
+    #"*google/vr/ndk/base/DaydreamApi\$12.class",
+    #"*google/vr/ndk/base/DaydreamApi\$1.class",
+    #"*google/vr/ndk/base/DaydreamApi\$2.class",
+    #"*google/vr/ndk/base/DaydreamApi\$3.class",
+    #"*google/vr/ndk/base/DaydreamApi\$4.class",
+    #"*google/vr/ndk/base/DaydreamApi\$5.class",
+    #"*google/vr/ndk/base/DaydreamApi\$6\$1.class",
+    #"*google/vr/ndk/base/DaydreamApi\$6.class",
+    #"*google/vr/ndk/base/DaydreamApi\$7.class",
+    #"*google/vr/ndk/base/DaydreamApi\$8.class",
+    #"*google/vr/ndk/base/DaydreamApi\$9.class",
+    #"*google/vr/ndk/base/DaydreamApi.class",
+    #"*google/vr/ndk/base/DaydreamUtils.class",
+    "*google/vr/ndk/base/DaydreamUtilsWrapper.class",
+    "*google/vr/ndk/base/ExtensionManager.class",
+    "*google/vr/ndk/base/ExternalSurface\$1.class",
+    "*google/vr/ndk/base/ExternalSurface\$2.class",
+    "*google/vr/ndk/base/ExternalSurface.class",
+    "*google/vr/ndk/base/FadeOverlayView\$1.class",
+    "*google/vr/ndk/base/FadeOverlayView\$2.class",
+    "*google/vr/ndk/base/FadeOverlayView.class",
+    "*google/vr/ndk/base/Frame.class",
+    #"*google/vr/ndk/base/GvrApi.class",
+    "*google/vr/ndk/base/GvrApi\$Error.class",
+    "*google/vr/ndk/base/GvrApi\$Feature.class",
+    "*google/vr/ndk/base/GvrApi\$IdleListener.class",
+    "*google/vr/ndk/base/GvrApi\$PoseTracker.class",
+    "*google/vr/ndk/base/GvrApi\$ViewerType.class",
+    #"*google/vr/ndk/base/GvrLayout.class",
+    "*google/vr/ndk/base/GvrLayout\$ExternalSurfaceListener.class",
+    #"*google/vr/ndk/base/GvrLayoutFactory.class",
+    "*google/vr/ndk/base/GvrLayoutImpl\$1.class",
+    "*google/vr/ndk/base/GvrLayoutImpl\$2.class",
+    "*google/vr/ndk/base/GvrLayoutImpl\$3.class",
+    "*google/vr/ndk/base/GvrLayoutImpl\$4.class",
+    "*google/vr/ndk/base/GvrLayoutImpl\$AsyncReprojectionSurfaceView\$1.class",
+    "*google/vr/ndk/base/GvrLayoutImpl\$AsyncReprojectionSurfaceView.class",
+    "*google/vr/ndk/base/GvrLayoutImpl.class",
+    "*google/vr/ndk/base/GvrLayoutImpl\$FrameFlushWorkaround.class",
+    "*google/vr/ndk/base/GvrLayoutImpl\$NullExtensionManager.class",
+    "*google/vr/ndk/base/GvrLayoutImpl\$PresentationFactory.class",
+    "*google/vr/ndk/base/GvrLayoutImpl\$PresentationHelper.class",
+    "*google/vr/ndk/base/GvrLayoutImpl\$PresentationListener.class",
+    "*google/vr/ndk/base/GvrLayoutImpl\$ScreenOnManager\$1.class",
+    "*google/vr/ndk/base/GvrLayoutImpl\$ScreenOnManager\$2.class",
+    "*google/vr/ndk/base/GvrLayoutImpl\$ScreenOnManager.class",
+    "*google/vr/ndk/base/GvrLayoutImplWrapper.class",
+    "*google/vr/ndk/base/GvrSurfaceView\$1.class",
+    "*google/vr/ndk/base/GvrSurfaceView\$BaseConfigChooser.class",
+    "*google/vr/ndk/base/GvrSurfaceView.class",
+    "*google/vr/ndk/base/GvrSurfaceView\$ComponentSizeChooser.class",
+    "*google/vr/ndk/base/GvrSurfaceView\$DefaultContextFactory.class",
+    "*google/vr/ndk/base/GvrSurfaceView\$DefaultWindowSurfaceFactory.class",
+    "*google/vr/ndk/base/GvrSurfaceView\$EglHelper.class",
+    "*google/vr/ndk/base/GvrSurfaceView\$GLThread.class",
+    "*google/vr/ndk/base/GvrSurfaceView\$GLThread\$GLThreadManager.class",
+    "*google/vr/ndk/base/GvrSurfaceView\$GLWrapper.class",
+    "*google/vr/ndk/base/GvrSurfaceView\$LogWriter.class",
+    "*google/vr/ndk/base/GvrSurfaceView\$SimpleEGLConfigChooser.class",
+    #"*google/vr/ndk/base/GvrUiLayout.class",
+    "*google/vr/ndk/base/GvrUiLayoutImpl\$1.class",
+    "*google/vr/ndk/base/GvrUiLayoutImpl\$2.class",
+    "*google/vr/ndk/base/GvrUiLayoutImpl\$3.class",
+    "*google/vr/ndk/base/GvrUiLayoutImpl.class",
+    "*google/vr/ndk/base/GvrUiLayoutImpl\$CloseButtonListenerWrapper.class",
+    #"*google/vr/ndk/base/SdkConfigurationReader.class",
+    "*google/vr/ndk/base/SdkDaydreamTouchListener\$1.class",
+    "*google/vr/ndk/base/SdkDaydreamTouchListener.class",
+    "*google/vr/ndk/base/SdkDaydreamTouchListener\$FinishInitilizationTask.class",
+    "*google/vr/ndk/base/SdkDaydreamTouchListener\$RefreshViewerProfileTask.class",
+    "*google/vr/ndk/base/SerializationConstants.class",
+    "*google/vr/ndk/base/SwapChain.class",
+    "*google/vr/ndk/base/ThrottlingMonitor\$1.class",
+    "*google/vr/ndk/base/ThrottlingMonitor\$2.class",
+    "*google/vr/ndk/base/ThrottlingMonitor.class",
+    "*google/vr/ndk/base/ThrottlingMonitor\$SetupCallback.class",
+    "*google/vr/ndk/base/ThrottlingMonitor\$TemperatureTrigger.class",
+    "*google/vr/ndk/base/ThrottlingMonitor\$ThrottlingTriggerCallback\$1.class",
+    "*google/vr/ndk/base/ThrottlingMonitor\$ThrottlingTriggerCallback.class",
+    #"*google/vr/ndk/base/TraceCompat.class",
+    "*google/vr/ndk/base/UserPrefs.class",
+    "*google/vr/ndk/base/UserPrefs\$ControllerHandedness.class",
+    #"*google/vr/ndk/base/Version.class",
+    "*google/vr/ndk/base/VrCoreSdkClient\$1.class",
+    "*google/vr/ndk/base/VrCoreSdkClient.class",
+    "*google/vr/ndk/base/VrCoreSdkClient\$DaydreamListenerImpl\$1.class",
+    "*google/vr/ndk/base/VrCoreSdkClient\$DaydreamListenerImpl\$2.class",
+    "*google/vr/ndk/base/VrCoreSdkClient\$DaydreamListenerImpl.class",
   ]
 
   deps = [
diff --git a/third_party/gvr-android-sdk/proguard-gvr-chromium.txt b/third_party/gvr-android-sdk/proguard-gvr-chromium.txt
index 5b30344..78c52d5 100644
--- a/third_party/gvr-android-sdk/proguard-gvr-chromium.txt
+++ b/third_party/gvr-android-sdk/proguard-gvr-chromium.txt
@@ -29,3 +29,4 @@
 # All the above is copied from src/proguard-gvr.txt.
 # Chromium needs the following line to be able to exclude some unused auto generated classes.
 -dontwarn com.google.common.logging.nano.Vr$**
+-dontwarn com.google.vr.**
diff --git a/tools/metrics/actions/actions.xml b/tools/metrics/actions/actions.xml
index 63c89e4..1d37731 100644
--- a/tools/metrics/actions/actions.xml
+++ b/tools/metrics/actions/actions.xml
@@ -4600,6 +4600,15 @@
   <description>Please enter the description of this user action.</description>
 </action>
 
+<action name="EventTargeting_DeletedTarget">
+  <owner>riajiang@chromium.org</owner>
+  <owner>rjkroege@chromium.org</owner>
+  <description>
+    Events for a target window are processed after that target window has been
+    deleted.
+  </description>
+</action>
+
 <action name="Exit">
   <owner>Please list the metric's owners. Add more owner tags as needed.</owner>
   <description>Please enter the description of this user action.</description>
diff --git a/tools/v8_context_snapshot/BUILD.gn b/tools/v8_context_snapshot/BUILD.gn
index b1b3572..12f80524 100644
--- a/tools/v8_context_snapshot/BUILD.gn
+++ b/tools/v8_context_snapshot/BUILD.gn
@@ -10,7 +10,6 @@
 import("//build/config/c++/c++.gni")
 import("//build/config/chromecast_build.gni")
 import("//build/config/compiler/compiler.gni")
-import("//build/config/v8_target_cpu.gni")
 import("//v8/snapshot_toolchain.gni")
 
 if (is_android) {
@@ -18,9 +17,7 @@
 }
 
 declare_args() {
-  # TODO(crbug.com/764576): Enable the feature on more environments.
-  use_v8_context_snapshot = !is_chromeos && !is_android && !is_chromecast &&
-                            v8_target_cpu == target_cpu
+  use_v8_context_snapshot = !is_chromeos && !is_android && !is_chromecast
 }
 
 if (is_android) {
diff --git a/ui/gfx/transform.h b/ui/gfx/transform.h
index 0964f74..0ee622e 100644
--- a/ui/gfx/transform.h
+++ b/ui/gfx/transform.h
@@ -122,6 +122,7 @@
   void ConcatTransform(const Transform& transform);
 
   // Returns true if this is the identity matrix.
+  // This function modifies a mutable variable in |matrix_|.
   bool IsIdentity() const { return matrix_.isIdentity(); }
 
   // Returns true if the matrix is either identity or pure translation.