diff --git a/.clang-format b/.clang-format
index 8d4b5e4..fcbc9c321 100644
--- a/.clang-format
+++ b/.clang-format
@@ -7,9 +7,6 @@
 # 'int>>' if the file already contains at least one such instance.)
 Standard: Cpp11
 
-# TODO(thakis): Default this to true in -style=Chromium if we decide to keep it.
-SortIncludes: true
-
 # Make sure code like:
 # IPC_BEGIN_MESSAGE_MAP()
 #   IPC_MESSAGE_HANDLER(WidgetHostViewHost_Update, OnUpdate)
diff --git a/DEPS b/DEPS
index bb8507f..6468b7d0 100644
--- a/DEPS
+++ b/DEPS
@@ -44,7 +44,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': '31cf05f86bedaa512b8509290848e9317af67be7',
+  'v8_revision': '06d36330e481d098c19fe047809d45955837ee46',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
diff --git a/WATCHLISTS b/WATCHLISTS
index 5302ca2..3d170fe 100644
--- a/WATCHLISTS
+++ b/WATCHLISTS
@@ -1448,10 +1448,12 @@
     },
     'blink_serviceworkers' : {
       'filepath': 'third_party/WebKit/Source/modules/serviceworkers' \
-                  '|third_party/WebKit/LayoutTests/http/tests/serviceworker'
+                  '|third_party/WebKit/LayoutTests/http/tests/serviceworker' \
+                  '|third_party/WebKit/LayoutTests/external/wpt/service-workers'
     },
     'blink_serviceworkers_tests' : {
-      'filepath': 'third_party/WebKit/LayoutTests/http/tests/serviceworker'
+      'filepath': 'third_party/WebKit/LayoutTests/http/tests/serviceworker' \
+                  '|third_party/WebKit/LayoutTests/external/wpt/service-workers'
     },
     'blink_spellcheck' : {
       'filepath': 'third_party/WebKit/Source/core/editing/spellcheck'
@@ -1498,7 +1500,10 @@
       'filepath': 'third_party/WebKit/Source/modules/websockets/'
     },
     'blink_workers': {
-      'filepath': 'third_party/WebKit/Source/core/workers',
+      'filepath': 'third_party/WebKit/Source/core/workers' \
+                  '|third_party/WebKit/LayoutTests/http/tests/workers' \
+                  '|third_party/WebKit/LayoutTests/fast/workers' \
+                  '|third_party/WebKit/LayoutTests/external/wpt/workers'
     },
     'blink_wtf': {
       'filepath': 'third_party/WebKit/Source/wtf',
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabObserver.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabObserver.java
index 1dbe878..f777a687 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tab/TabObserver.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/TabObserver.java
@@ -66,9 +66,9 @@
     /**
      * Called when a tab has started to load a page.
      * <p>
-     * This will occur when the main frame has committed a provisional load, and will also
-     * occur in instances where we need to simulate load progress (i.e. swapping in a not
-     * fully loaded pre-rendered page).
+     * This will occur when the main frame starts the navigation, and will also occur in instances
+     * where we need to simulate load progress (i.e. swapping in a not fully loaded pre-rendered
+     * page).
      * <p>
      * For visual loading indicators/throbbers, {@link #onLoadStarted(Tab)} and
      * {@link #onLoadStopped(Tab)} should be used to drive updates.
diff --git a/chrome/android/java_sources.gni b/chrome/android/java_sources.gni
index 5a528bb5..95f20e9 100644
--- a/chrome/android/java_sources.gni
+++ b/chrome/android/java_sources.gni
@@ -1396,6 +1396,8 @@
   "javatests/src/org/chromium/chrome/browser/partnercustomizations/PartnerDisableIncognitoModeUnitTest.java",
   "javatests/src/org/chromium/chrome/browser/partnercustomizations/PartnerHomepageIntegrationTest.java",
   "javatests/src/org/chromium/chrome/browser/partnercustomizations/PartnerHomepageUnitTest.java",
+  "javatests/src/org/chromium/chrome/browser/physicalweb/MockPwsClient.java",
+  "javatests/src/org/chromium/chrome/browser/physicalweb/UrlManagerTest.java",
   "javatests/src/org/chromium/chrome/browser/policy/CombinedPolicyProviderTest.java",
   "javatests/src/org/chromium/chrome/browser/payments/CurrencyFormatterTest.java",
   "javatests/src/org/chromium/chrome/browser/payments/PaymentRequestAbortTest.java",
@@ -1615,11 +1617,9 @@
   "junit/src/org/chromium/chrome/browser/payments/AutofillContactTest.java",
   "junit/src/org/chromium/chrome/browser/payments/AutofillContactUnitTest.java",
   "junit/src/org/chromium/chrome/browser/payments/PaymentManifestVerifierTest.java",
-  "junit/src/org/chromium/chrome/browser/physicalweb/MockPwsClient.java",
   "junit/src/org/chromium/chrome/browser/physicalweb/PwsClientImplTest.java",
   "junit/src/org/chromium/chrome/browser/physicalweb/PwsResultTest.java",
   "junit/src/org/chromium/chrome/browser/physicalweb/UrlInfoTest.java",
-  "junit/src/org/chromium/chrome/browser/physicalweb/UrlManagerTest.java",
   "junit/src/org/chromium/chrome/browser/snackbar/SnackbarCollectionUnitTest.java",
   "junit/src/org/chromium/chrome/browser/suggestions/TileGroupTest.java",
   "junit/src/org/chromium/chrome/browser/suggestions/TileTest.java",
diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/physicalweb/MockPwsClient.java b/chrome/android/javatests/src/org/chromium/chrome/browser/physicalweb/MockPwsClient.java
similarity index 100%
rename from chrome/android/junit/src/org/chromium/chrome/browser/physicalweb/MockPwsClient.java
rename to chrome/android/javatests/src/org/chromium/chrome/browser/physicalweb/MockPwsClient.java
diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/physicalweb/UrlManagerTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/physicalweb/UrlManagerTest.java
similarity index 79%
rename from chrome/android/junit/src/org/chromium/chrome/browser/physicalweb/UrlManagerTest.java
rename to chrome/android/javatests/src/org/chromium/chrome/browser/physicalweb/UrlManagerTest.java
index d6668b2..4e2c848 100644
--- a/chrome/android/junit/src/org/chromium/chrome/browser/physicalweb/UrlManagerTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/physicalweb/UrlManagerTest.java
@@ -4,41 +4,26 @@
 
 package org.chromium.chrome.browser.physicalweb;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-
 import android.content.SharedPreferences;
-
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-
-import org.robolectric.RuntimeEnvironment;
-import org.robolectric.annotation.Config;
-import org.robolectric.shadows.ShadowLooper;
+import android.support.test.filters.SmallTest;
+import android.test.InstrumentationTestCase;
 
 import org.chromium.base.ContextUtils;
 import org.chromium.base.test.util.DisabledTest;
 import org.chromium.base.test.util.FlakyTest;
 import org.chromium.base.test.util.RetryOnFailure;
-import org.chromium.testing.local.LocalRobolectricTestRunner;
+import org.chromium.content.browser.test.util.Criteria;
+import org.chromium.content.browser.test.util.CriteriaHelper;
 
 import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.locks.Condition;
-import java.util.concurrent.locks.Lock;
-import java.util.concurrent.locks.ReentrantLock;
 
 /**
  * Tests for {@link UrlManager}.
  */
-@RunWith(LocalRobolectricTestRunner.class)
-@Config(manifest = Config.NONE)
-public class UrlManagerTest {
+public class UrlManagerTest extends InstrumentationTestCase {
     private static final String URL1 = "https://example.com/";
     private static final String TITLE1 = "Example";
     private static final String DESC1 = "Example Website";
@@ -55,13 +40,12 @@
     private static final int PHYSICAL_WEB_OFF = 0;
     private static final int PHYSICAL_WEB_ON = 1;
     private static final int PHYSICAL_WEB_ONBOARDING = 2;
-    private static final double EPSILON = .001;
     private UrlManager mUrlManager = null;
     private MockPwsClient mMockPwsClient = null;
 
-    @Before
-    public void setUp() {
-        ContextUtils.initApplicationContextForTests(RuntimeEnvironment.application);
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
         ContextUtils.getAppSharedPreferences()
                 .edit()
                 .putInt(PREF_PHYSICAL_WEB, PHYSICAL_WEB_ON)
@@ -111,7 +95,8 @@
                 .apply();
     }
 
-    @Test
+    @SmallTest
+    @RetryOnFailure
     public void testAddUrlAfterClearAllUrlsWorks() {
         addPwsResult1();
         addPwsResult2();
@@ -119,24 +104,25 @@
         addPwsResult2();
         addUrlInfo1();
         addUrlInfo2();
-        ShadowLooper.runUiThreadTasksIncludingDelayedTasks();
+        getInstrumentation().waitForIdleSync();
         mUrlManager.clearAllUrls();
 
         // Add some more URLs...this should not crash if we cleared correctly.
         addUrlInfo1();
         addUrlInfo2();
-        ShadowLooper.runUiThreadTasksIncludingDelayedTasks();
+        getInstrumentation().waitForIdleSync();
         List<UrlInfo> urlInfos = mUrlManager.getUrls();
         assertEquals(2, urlInfos.size());
     }
 
-    @Test
+    @SmallTest
+    @RetryOnFailure
     public void testClearNearbyUrlsWorks() {
         addPwsResult1();
         addPwsResult2();
         addUrlInfo1();
         addUrlInfo2();
-        ShadowLooper.runUiThreadTasksIncludingDelayedTasks();
+        getInstrumentation().waitForIdleSync();
 
         mUrlManager.clearNearbyUrls();
 
@@ -153,7 +139,7 @@
         assertFalse(mUrlManager.containsInAnyCache(URL2));
     }
 
-    @Test
+    @SmallTest
     @RetryOnFailure
     public void testAddUrlGarbageCollectsForSize() throws Exception {
         // Add and remove 101 URLs, making sure one is clearly slightly older than the others.
@@ -174,7 +160,7 @@
         assertTrue(mUrlManager.containsInAnyCache(URL1 + mUrlManager.getMaxCacheSize()));
     }
 
-    @Test
+    @SmallTest
     public void testAddUrlGarbageCollectsForAge() throws Exception {
         // Add a URL with a phony timestamp.
         addEmptyPwsResult();
@@ -191,7 +177,7 @@
         assertTrue(mUrlManager.containsInAnyCache(URL2));
     }
 
-    @Test
+    @SmallTest
     public void testAddUrlUpdatesCache() throws Exception {
         addEmptyPwsResult();
         addEmptyPwsResult();
@@ -200,7 +186,7 @@
         mUrlManager.addUrl(urlInfo);
         List<UrlInfo> urls = mUrlManager.getUrls(true);
         assertEquals(1, urls.size());
-        assertEquals(urlInfo.getDistance(), urls.get(0).getDistance(), EPSILON);
+        assertEquals(urlInfo.getDistance(), urls.get(0).getDistance());
         assertEquals(urlInfo.getDeviceAddress(), urls.get(0).getDeviceAddress());
         assertEquals(urlInfo.getFirstSeenTimestamp(), urls.get(0).getFirstSeenTimestamp());
 
@@ -208,11 +194,12 @@
         mUrlManager.addUrl(urlInfo);
         urls = mUrlManager.getUrls(true);
         assertEquals(1, urls.size());
-        assertEquals(urlInfo.getDistance(), urls.get(0).getDistance(), EPSILON);
+        assertEquals(urlInfo.getDistance(), urls.get(0).getDistance());
         assertEquals(urlInfo.getDeviceAddress(), urls.get(0).getDeviceAddress());
     }
 
-    @Test
+    @SmallTest
+    @RetryOnFailure
     public void testAddUrlTwiceWorks() throws Exception {
         // Add and remove an old URL twice and add new URL twice before removing.
         // This should cover several issues involved with updating the cache queue.
@@ -235,7 +222,7 @@
         assertTrue(mUrlManager.containsInAnyCache(URL2));
     }
 
-    @Test
+    @SmallTest
     public void testGetUrlsSortsAndDedups() throws Exception {
         // Construct results with matching group IDs and check that getUrls returns only the closest
         // URL in each group. The list should be sorted by distance, closest first.
@@ -249,31 +236,31 @@
         mUrlManager.addUrl(new UrlInfo(URL3, 10.0, System.currentTimeMillis()));
         mUrlManager.addUrl(new UrlInfo(URL4, 40.0, System.currentTimeMillis()));
         mUrlManager.addUrl(new UrlInfo(URL5, 50.0, System.currentTimeMillis()));
-        ShadowLooper.runUiThreadTasksIncludingDelayedTasks();
+        getInstrumentation().waitForIdleSync();
 
         // Make sure URLs are in order and duplicates are omitted.
         List<UrlInfo> urlInfos = mUrlManager.getUrls();
         assertEquals(3, urlInfos.size());
-        assertEquals(10.0, urlInfos.get(0).getDistance(), EPSILON);
+        assertEquals(10.0, urlInfos.get(0).getDistance());
         assertEquals(URL3, urlInfos.get(0).getUrl());
-        assertEquals(30.0, urlInfos.get(1).getDistance(), EPSILON);
+        assertEquals(30.0, urlInfos.get(1).getDistance());
         assertEquals(URL1, urlInfos.get(1).getUrl());
-        assertEquals(50.0, urlInfos.get(2).getDistance(), EPSILON);
+        assertEquals(50.0, urlInfos.get(2).getDistance());
         assertEquals(URL5, urlInfos.get(2).getUrl());
     }
 
     /*
+     * @SmallTest
      * Bug=crbug.com/684148
      */
     @DisabledTest
-    @Test
     public void testSerializationWorksWithPoorlySerializedResult() throws Exception {
         addPwsResult1();
         addPwsResult2();
         long curTime = System.currentTimeMillis();
         mUrlManager.addUrl(new UrlInfo(URL1, 99.5, curTime + 42));
         mUrlManager.addUrl(new UrlInfo(URL2, 100.5, curTime + 43));
-        ShadowLooper.runUiThreadTasksIncludingDelayedTasks();
+        getInstrumentation().waitForIdleSync();
 
         // Create an invalid serialization.
         Set<String> serializedUrls = new HashSet<>();
@@ -293,14 +280,15 @@
     }
 
     @FlakyTest(message = "https://crbug.com/685471")
-    @Test
+    @SmallTest
+    @RetryOnFailure
     public void testSerializationWorksWithoutGarbageCollection() throws Exception {
         addPwsResult1();
         addPwsResult2();
         long curTime = System.currentTimeMillis();
         mUrlManager.addUrl(new UrlInfo(URL1, 99.5, curTime + 42));
         mUrlManager.addUrl(new UrlInfo(URL2, 100.5, curTime + 43));
-        ShadowLooper.runUiThreadTasksIncludingDelayedTasks();
+        getInstrumentation().waitForIdleSync();
 
         // Make sure all URLs are restored.
         UrlManager urlManager = new UrlManager();
@@ -312,14 +300,14 @@
         assertEquals(2, resolvedUrls.size());
     }
 
+    @SmallTest
     @RetryOnFailure
-    @Test
     public void testSerializationWorksWithGarbageCollection() throws Exception {
         addPwsResult1();
         addPwsResult2();
         mUrlManager.addUrl(new UrlInfo(URL1, 99.5, 42));
         mUrlManager.addUrl(new UrlInfo(URL2, 100.5, 43));
-        ShadowLooper.runUiThreadTasksIncludingDelayedTasks();
+        getInstrumentation().waitForIdleSync();
 
         // Make sure all URLs are restored.
         UrlManager urlManager = new UrlManager();
@@ -329,49 +317,35 @@
         assertEquals(0, resolvedUrls.size());
     }
 
-    @Test
+    @SmallTest
     public void testUpgradeFromNone() throws Exception {
         Set<String> oldResolvedUrls = new HashSet<String>();
         oldResolvedUrls.add("old");
-        SharedPreferences prefs = ContextUtils.getAppSharedPreferences();
-        prefs.edit()
+        ContextUtils.getAppSharedPreferences()
+                .edit()
                 .remove(UrlManager.getVersionKey())
                 .putStringSet("physicalweb_nearby_urls", oldResolvedUrls)
                 .putInt("org.chromium.chrome.browser.physicalweb.VERSION", 1)
                 .putInt("org.chromium.chrome.browser.physicalweb.BOTTOM_BAR_DISPLAY_COUNT", 1)
-                .putBoolean("physical_web_ignore_other_clients", true)
                 .apply();
-        final Lock lock = new ReentrantLock();
-        final Condition condition = lock.newCondition();
-        prefs.registerOnSharedPreferenceChangeListener(
-                new SharedPreferences.OnSharedPreferenceChangeListener() {
-                    public void onSharedPreferenceChanged(
-                            SharedPreferences sharedPreferences, String key) {
-                        lock.lock();
-                        try {
-                            condition.signal();
-                        } finally {
-                            lock.unlock();
-                        }
-                    }
-                });
         new UrlManager();
-        lock.lock();
-        try {
-            assertTrue(condition.await(2, TimeUnit.SECONDS));
-        } finally {
-            lock.unlock();
-        }
 
         // Make sure the new prefs are populated and old prefs are gone.
-        SharedPreferences sharedPreferences = ContextUtils.getAppSharedPreferences();
-        assertTrue(sharedPreferences.contains(UrlManager.getVersionKey()));
+        final SharedPreferences sharedPreferences = ContextUtils.getAppSharedPreferences();
+        CriteriaHelper.pollInstrumentationThread(new Criteria() {
+            @Override
+            public boolean isSatisfied() {
+                SharedPreferences sharedPreferences = ContextUtils.getAppSharedPreferences();
+                return sharedPreferences.contains(UrlManager.getVersionKey())
+                        && !sharedPreferences.contains("physicalweb_nearby_urls")
+                        && !sharedPreferences.contains(
+                                   "org.chromium.chrome.browser.physicalweb.VERSION")
+                        && !sharedPreferences.contains("org.chromium.chrome.browser.physicalweb"
+                                   + ".BOTTOM_BAR_DISPLAY_COUNT");
+            }
+        }, 5000, CriteriaHelper.DEFAULT_POLLING_INTERVAL);
+
         assertEquals(
                 UrlManager.getVersion(), sharedPreferences.getInt(UrlManager.getVersionKey(), 0));
-        assertFalse(sharedPreferences.contains("physicalweb_nearby_urls"));
-        assertFalse(sharedPreferences.contains("org.chromium.chrome.browser.physicalweb.VERSION"));
-        assertFalse(sharedPreferences.contains(
-                "org.chromium.chrome.browser.physicalweb.BOTTOM_BAR_DISPLAY_COUNT"));
-        assertFalse(sharedPreferences.contains("physical_web_ignore_other_clients"));
     }
 }
diff --git a/chrome/browser/apps/drive/drive_service_bridge.cc b/chrome/browser/apps/drive/drive_service_bridge.cc
index 1d8bf26..648aa2933 100644
--- a/chrome/browser/apps/drive/drive_service_bridge.cc
+++ b/chrome/browser/apps/drive/drive_service_bridge.cc
@@ -21,6 +21,7 @@
 #include "components/signin/core/browser/profile_oauth2_token_service.h"
 #include "components/signin/core/browser/signin_manager.h"
 #include "content/public/browser/browser_thread.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace {
 
@@ -81,12 +82,11 @@
   ProfileOAuth2TokenService* token_service =
       ProfileOAuth2TokenServiceFactory::GetForProfile(profile_);
   drive_service_.reset(new drive::DriveAPIService(
-      token_service,
-      profile_->GetRequestContext(),
-      drive_task_runner.get(),
+      token_service, profile_->GetRequestContext(), drive_task_runner.get(),
       GURL(google_apis::DriveApiUrlGenerator::kBaseUrlForProduction),
       GURL(google_apis::DriveApiUrlGenerator::kBaseThumbnailUrlForProduction),
-      std::string() /* custom_user_agent */));
+      std::string(), /* custom_user_agent */
+      NO_TRAFFIC_ANNOTATION_YET));
   SigninManagerBase* signin_manager =
       SigninManagerFactory::GetForProfile(profile_);
   drive_service_->Initialize(signin_manager->GetAuthenticatedAccountId());
diff --git a/chrome/browser/chromeos/drive/drive_integration_service.cc b/chrome/browser/chromeos/drive/drive_integration_service.cc
index fd120ff..eca1836 100644
--- a/chrome/browser/chromeos/drive/drive_integration_service.cc
+++ b/chrome/browser/chromeos/drive/drive_integration_service.cc
@@ -51,6 +51,7 @@
 #include "content/public/browser/notification_service.h"
 #include "content/public/common/user_agent.h"
 #include "google_apis/drive/auth_service.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "storage/browser/fileapi/external_mount_points.h"
 #include "ui/base/l10n/l10n_util.h"
 
@@ -264,7 +265,7 @@
         blocking_task_runner_.get(),
         GURL(google_apis::DriveApiUrlGenerator::kBaseUrlForProduction),
         GURL(google_apis::DriveApiUrlGenerator::kBaseThumbnailUrlForProduction),
-        GetDriveUserAgent()));
+        GetDriveUserAgent(), NO_TRAFFIC_ANNOTATION_YET));
   }
   scheduler_.reset(new JobScheduler(
       profile_->GetPrefs(),
diff --git a/chrome/browser/page_load_metrics/page_load_metrics_browsertest.cc b/chrome/browser/page_load_metrics/page_load_metrics_browsertest.cc
index f7dd24d1..aaa3999 100644
--- a/chrome/browser/page_load_metrics/page_load_metrics_browsertest.cc
+++ b/chrome/browser/page_load_metrics/page_load_metrics_browsertest.cc
@@ -640,7 +640,7 @@
                                embedded_test_server()->GetURL("/title1.html"));
 
   // Wait until the renderer finishes observing layouts.
-  const int kNetworkIdleTime = 500;
+  const int kNetworkIdleTime = 3000;
   const int kMargin = 500;
   const std::string javascript = base::StringPrintf(
       "setTimeout(() => window.domAutomationController.send(true), %d)",
diff --git a/chrome/browser/resources/.clang-format b/chrome/browser/resources/.clang-format
deleted file mode 100644
index d455a85..0000000
--- a/chrome/browser/resources/.clang-format
+++ /dev/null
@@ -1,8 +0,0 @@
-# Please keep this file the same as ui/webui/resources/.clang-format.
-BasedOnStyle: Chromium
-
-# Renaming quotes in <include> and <if> break things.
-# For normal JS code, please prefer ' to ".
-JavaScriptQuotes: Leave
-
-AllowShortFunctionsOnASingleLine: Empty
diff --git a/chrome/browser/sync_file_system/drive_backend/sync_engine.cc b/chrome/browser/sync_file_system/drive_backend/sync_engine.cc
index 42a6015..ac1af18 100644
--- a/chrome/browser/sync_file_system/drive_backend/sync_engine.cc
+++ b/chrome/browser/sync_file_system/drive_backend/sync_engine.cc
@@ -56,6 +56,7 @@
 #include "extensions/browser/extensions_browser_client.h"
 #include "extensions/common/extension.h"
 #include "google_apis/drive/drive_api_url_generator.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "storage/browser/blob/scoped_file.h"
 #include "storage/common/fileapi/file_system_util.h"
@@ -66,6 +67,29 @@
 
 namespace drive_backend {
 
+constexpr net::NetworkTrafficAnnotationTag kTrafficAnnotation =
+    net::DefineNetworkTrafficAnnotation("sync_file_system", R"(
+        semantics {
+          sender: "Sync FileSystem Chrome API"
+          description:
+            "Sync FileSystem API provides an isolated FileSystem to Chrome "
+            "Apps. The contents of the FileSystem are automatically synced "
+            "among application instances through a hidden folder on Google "
+            "Drive. This service uploades or downloads these files for "
+            "synchronization."
+          trigger:
+            "When a Chrome App uses Sync FileSystem API, or when a file on "
+            "Google Drive is modified."
+          data:
+            "Files created by Chrome Apps via Sync FileSystem API."
+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false
+          setting: "This feature cannot be disabled in settings."
+          policy_exception_justification: "Not implemented."
+        })");
+
 std::unique_ptr<drive::DriveServiceInterface>
 SyncEngine::DriveServiceFactory::CreateDriveService(
     OAuth2TokenService* oauth2_token_service,
@@ -76,7 +100,8 @@
       oauth2_token_service, url_request_context_getter, blocking_task_runner,
       GURL(google_apis::DriveApiUrlGenerator::kBaseUrlForProduction),
       GURL(google_apis::DriveApiUrlGenerator::kBaseThumbnailUrlForProduction),
-      std::string() /* custom_user_agent */));
+      std::string(), /* custom_user_agent */
+      kTrafficAnnotation));
 }
 
 class SyncEngine::WorkerObserver : public SyncWorkerInterface::Observer {
diff --git a/chrome/browser/ui/libgtkui/gtk_ui.cc b/chrome/browser/ui/libgtkui/gtk_ui.cc
index c1c6be7..06e2f94 100644
--- a/chrome/browser/ui/libgtkui/gtk_ui.cc
+++ b/chrome/browser/ui/libgtkui/gtk_ui.cc
@@ -46,6 +46,7 @@
 #include "ui/base/resource/resource_bundle.h"
 #include "ui/display/display.h"
 #include "ui/gfx/canvas.h"
+#include "ui/gfx/font_render_params.h"
 #include "ui/gfx/geometry/rect.h"
 #include "ui/gfx/geometry/size.h"
 #include "ui/gfx/image/image.h"
@@ -948,6 +949,8 @@
 }
 
 void GtkUi::UpdateDefaultFont() {
+  gfx::SetFontRenderParamsDeviceScaleFactor(device_scale_factor_);
+
   GtkWidget* fake_label = gtk_label_new(nullptr);
   g_object_ref_sink(fake_label);  // Remove the floating reference.
   PangoContext* pc = gtk_widget_get_pango_context(fake_label);
diff --git a/components/autofill/core/browser/payments/payments_client.cc b/components/autofill/core/browser/payments/payments_client.cc
index 5fbeca3..44e85c2 100644
--- a/components/autofill/core/browser/payments/payments_client.cc
+++ b/components/autofill/core/browser/payments/payments_client.cc
@@ -28,6 +28,7 @@
 #include "net/base/escape.h"
 #include "net/base/load_flags.h"
 #include "net/http/http_status_code.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "net/url_request/url_fetcher.h"
 #include "net/url_request/url_request_context_getter.h"
 
@@ -415,9 +416,44 @@
 }
 
 void PaymentsClient::InitializeUrlFetcher() {
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("payments_sync_cards", R"(
+        semantics {
+          sender: "Payments"
+          description:
+            "This service communicates with Google Payments servers to upload "
+            "(save) or receive the user's credit card info."
+          trigger:
+            "Requests are triggered by a user action, such as selecting a "
+            "masked server card from Chromium's credit card autofill dropdown, "
+            "submitting a form which has credit card information, or accepting "
+            "the prompt to save a credit card to Payments servers."
+          data:
+            "In case of save, a protocol buffer containing relevant address "
+            "and credit card information which should be saved in Google "
+            "Payments servers, along with user credentials. In case of load, a "
+            "protocol buffer containing the id of the credit card to unmask, "
+            "an encrypted cvc value, an optional updated card expiration date, "
+            "and user credentials."
+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false
+          setting:
+            "Users can enable or disable this feature in Chromium settings by "
+            "toggling 'Credit cards and addresses using Google Payments', "
+            "under 'Advanced sync settings...'. This feature is enabled by "
+            "default."
+          chrome_policy {
+            AutoFillEnabled {
+              policy_options {mode: MANDATORY}
+              AutoFillEnabled: false
+            }
+          }
+        })");
   url_fetcher_ =
       net::URLFetcher::Create(0, GetRequestUrl(request_->GetRequestUrlPath()),
-                              net::URLFetcher::POST, this);
+                              net::URLFetcher::POST, this, traffic_annotation);
 
   data_use_measurement::DataUseUserData::AttachToFetcher(
       url_fetcher_.get(), data_use_measurement::DataUseUserData::AUTOFILL);
diff --git a/components/dom_distiller/core/javascript/domdistiller.js b/components/dom_distiller/core/javascript/domdistiller.js
index bbd2d00..6e9a417a 100644
--- a/components/dom_distiller/core/javascript/domdistiller.js
+++ b/components/dom_distiller/core/javascript/domdistiller.js
@@ -8,7 +8,12 @@
   try {
     function initialize() {
       // This include will be processed at build time by grit.
+      // Note: this <include> is not behind a single-line comment because the
+      // first line of the file is source code (so the first line would be
+      // skipped) instead of a licence header.
+      // clang-format off
       <include src="../../../../third_party/dom_distiller_js/dist/js/domdistiller.js"/>
+      // clang-format on
     }
     window.setTimeout = function() {};
     window.clearTimeout = function() {};
diff --git a/components/drive/service/drive_api_service.cc b/components/drive/service/drive_api_service.cc
index b630803b..189baa3 100644
--- a/components/drive/service/drive_api_service.cc
+++ b/components/drive/service/drive_api_service.cc
@@ -254,14 +254,16 @@
     base::SequencedTaskRunner* blocking_task_runner,
     const GURL& base_url,
     const GURL& base_thumbnail_url,
-    const std::string& custom_user_agent)
+    const std::string& custom_user_agent,
+    const net::NetworkTrafficAnnotationTag& traffic_annotation)
     : oauth2_token_service_(oauth2_token_service),
       url_request_context_getter_(url_request_context_getter),
       blocking_task_runner_(blocking_task_runner),
-      url_generator_(base_url, base_thumbnail_url,
+      url_generator_(base_url,
+                     base_thumbnail_url,
                      google_apis::GetTeamDrivesIntegrationSwitch()),
-      custom_user_agent_(custom_user_agent) {
-}
+      custom_user_agent_(custom_user_agent),
+      traffic_annotation_(traffic_annotation) {}
 
 DriveAPIService::~DriveAPIService() {
   DCHECK(thread_checker_.CalledOnValidThread());
@@ -283,13 +285,10 @@
   scopes.push_back(kDocsListScope);
 
   sender_.reset(new RequestSender(
-      new google_apis::AuthService(oauth2_token_service_,
-                                   account_id,
-                                   url_request_context_getter_.get(),
-                                   scopes),
-      url_request_context_getter_.get(),
-      blocking_task_runner_.get(),
-      custom_user_agent_));
+      new google_apis::AuthService(oauth2_token_service_, account_id,
+                                   url_request_context_getter_.get(), scopes),
+      url_request_context_getter_.get(), blocking_task_runner_.get(),
+      custom_user_agent_, traffic_annotation_));
   sender_->auth_service()->AddObserver(this);
 
   files_list_request_runner_.reset(
diff --git a/components/drive/service/drive_api_service.h b/components/drive/service/drive_api_service.h
index 09e4390..ca47cbf 100644
--- a/components/drive/service/drive_api_service.h
+++ b/components/drive/service/drive_api_service.h
@@ -19,6 +19,7 @@
 #include "google_apis/drive/auth_service_interface.h"
 #include "google_apis/drive/auth_service_observer.h"
 #include "google_apis/drive/drive_api_url_generator.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 class GURL;
 class OAuth2TokenService;
@@ -98,13 +99,15 @@
   // from image server.
   // |custom_user_agent| will be used for the User-Agent header in HTTP
   // requests issues through the service if the value is not empty.
-  DriveAPIService(
-      OAuth2TokenService* oauth2_token_service,
-      net::URLRequestContextGetter* url_request_context_getter,
-      base::SequencedTaskRunner* blocking_task_runner,
-      const GURL& base_url,
-      const GURL& base_thumbnail_url,
-      const std::string& custom_user_agent);
+  // |traffic_annotation| will be used to annotate the network request that will
+  // be created to perform this service.
+  DriveAPIService(OAuth2TokenService* oauth2_token_service,
+                  net::URLRequestContextGetter* url_request_context_getter,
+                  base::SequencedTaskRunner* blocking_task_runner,
+                  const GURL& base_url,
+                  const GURL& base_thumbnail_url,
+                  const std::string& custom_user_agent,
+                  const net::NetworkTrafficAnnotationTag& traffic_annotation);
   ~DriveAPIService() override;
 
   // DriveServiceInterface Overrides
@@ -265,6 +268,7 @@
   base::ObserverList<DriveServiceObserver> observers_;
   google_apis::DriveApiUrlGenerator url_generator_;
   const std::string custom_user_agent_;
+  const net::NetworkTrafficAnnotationTag traffic_annotation_;
 
   DISALLOW_COPY_AND_ASSIGN(DriveAPIService);
 };
diff --git a/components/drive/service/drive_api_service_unittest.cc b/components/drive/service/drive_api_service_unittest.cc
index a349671..70143b4 100644
--- a/components/drive/service/drive_api_service_unittest.cc
+++ b/components/drive/service/drive_api_service_unittest.cc
@@ -2,13 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "components/drive/service/drive_api_service.h"
 #include "base/memory/ptr_util.h"
 #include "base/message_loop/message_loop.h"
 #include "base/test/test_simple_task_runner.h"
-#include "components/drive/service/drive_api_service.h"
 #include "google_apis/drive/dummy_auth_service.h"
 #include "google_apis/drive/request_sender.h"
 #include "google_apis/drive/test_util.h"
+#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "net/url_request/url_request_test_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -43,9 +44,9 @@
       new base::TestSimpleTaskRunner();
   scoped_refptr<net::TestURLRequestContextGetter> request_context_getter =
       new net::TestURLRequestContextGetter(task_runner.get());
-  google_apis::RequestSender sender(new TestAuthService,
-                                    request_context_getter.get(),
-                                    task_runner.get(), kTestUserAgent);
+  google_apis::RequestSender sender(
+      new TestAuthService, request_context_getter.get(), task_runner.get(),
+      kTestUserAgent, TRAFFIC_ANNOTATION_FOR_TESTS);
   std::unique_ptr<google_apis::drive::BatchUploadRequest> request =
       base::MakeUnique<google_apis::drive::BatchUploadRequest>(&sender,
                                                                url_generator);
diff --git a/components/exo/BUILD.gn b/components/exo/BUILD.gn
index e91c8e0..a7dd686 100644
--- a/components/exo/BUILD.gn
+++ b/components/exo/BUILD.gn
@@ -131,6 +131,7 @@
     "//base",
     "//base/test:test_support",
     "//cc",
+    "//cc:test_support",
     "//cc/surfaces:surfaces",
     "//components/user_manager",
     "//device/gamepad:test_helpers",
diff --git a/components/exo/compositor_frame_sink_holder.cc b/components/exo/compositor_frame_sink_holder.cc
index 3d55a7d..3d6e5a2 100644
--- a/components/exo/compositor_frame_sink_holder.cc
+++ b/components/exo/compositor_frame_sink_holder.cc
@@ -22,6 +22,7 @@
       begin_frame_source_(base::MakeUnique<cc::ExternalBeginFrameSource>(this)),
       weak_factory_(this) {
   surface_->AddSurfaceObserver(this);
+  surface_->SetBeginFrameSource(begin_frame_source_.get());
 }
 
 bool CompositorFrameSinkHolder::HasReleaseCallbackForResource(
@@ -36,11 +37,6 @@
   release_callbacks_[id] = callback;
 }
 
-void CompositorFrameSinkHolder::SetNeedsBeginFrame(bool needs_begin_frame) {
-  needs_begin_frame_ = needs_begin_frame;
-  OnNeedsBeginFrames(needs_begin_frame);
-}
-
 ////////////////////////////////////////////////////////////////////////////////
 // cc::mojom::MojoCompositorFrameSinkClient overrides:
 
@@ -49,10 +45,6 @@
 }
 
 void CompositorFrameSinkHolder::OnBeginFrame(const cc::BeginFrameArgs& args) {
-  // TODO(eseckler): Hook up |surface_| to the ExternalBeginFrameSource.
-  if (surface_)
-    surface_->BeginFrame(args.frame_time);
-
   begin_frame_source_->OnBeginFrame(args);
 }
 
@@ -73,22 +65,10 @@
     const gfx::Rect& damage_rect) {
   if (surface_)
     surface_->WillDraw();
-
-  UpdateNeedsBeginFrame();
 }
 
 ////////////////////////////////////////////////////////////////////////////////
-// cc::BeginFrameObserver overrides:
-
-const cc::BeginFrameArgs& CompositorFrameSinkHolder::LastUsedBeginFrameArgs()
-    const {
-  return last_begin_frame_args_;
-}
-
-void CompositorFrameSinkHolder::OnBeginFrameSourcePausedChanged(bool paused) {}
-
-////////////////////////////////////////////////////////////////////////////////
-// cc::ExternalBeginFrameSouceClient overrides:
+// cc::ExternalBeginFrameSourceClient overrides:
 
 void CompositorFrameSinkHolder::OnNeedsBeginFrames(bool needs_begin_frames) {
   frame_sink_->SetNeedsBeginFrame(needs_begin_frames);
@@ -114,16 +94,4 @@
     surface_->RemoveSurfaceObserver(this);
 }
 
-void CompositorFrameSinkHolder::UpdateNeedsBeginFrame() {
-  if (!begin_frame_source_)
-    return;
-
-  bool needs_begin_frame = surface_ && surface_->NeedsBeginFrame();
-  if (needs_begin_frame == needs_begin_frame_)
-    return;
-
-  needs_begin_frame_ = needs_begin_frame;
-  OnNeedsBeginFrames(needs_begin_frame_);
-}
-
 }  // namespace exo
diff --git a/components/exo/compositor_frame_sink_holder.h b/components/exo/compositor_frame_sink_holder.h
index 4f3b0a2..0ba280ef 100644
--- a/components/exo/compositor_frame_sink_holder.h
+++ b/components/exo/compositor_frame_sink_holder.h
@@ -28,7 +28,6 @@
     : public base::RefCounted<CompositorFrameSinkHolder>,
       public cc::ExternalBeginFrameSourceClient,
       public cc::mojom::MojoCompositorFrameSinkClient,
-      public cc::BeginFrameObserver,
       public SurfaceObserver {
  public:
   CompositorFrameSinkHolder(Surface* surface,
@@ -45,8 +44,6 @@
     return weak_factory_.GetWeakPtr();
   }
 
-  void SetNeedsBeginFrame(bool needs_begin_frame);
-
   // Overridden from cc::mojom::MojoCompositorFrameSinkClient:
   void DidReceiveCompositorFrameAck() override;
   void OnBeginFrame(const cc::BeginFrameArgs& args) override;
@@ -54,10 +51,6 @@
   void WillDrawSurface(const cc::LocalSurfaceId& local_surface_id,
                        const gfx::Rect& damage_rect) override;
 
-  // Overridden from cc::BeginFrameObserver:
-  const cc::BeginFrameArgs& LastUsedBeginFrameArgs() const override;
-  void OnBeginFrameSourcePausedChanged(bool paused) override;
-
   // Overridden from cc::ExternalBeginFrameSourceClient:
   void OnNeedsBeginFrames(bool needs_begin_frames) override;
   void OnDidFinishFrame(const cc::BeginFrameAck& ack) override;
@@ -70,18 +63,13 @@
 
   ~CompositorFrameSinkHolder() override;
 
-  void UpdateNeedsBeginFrame();
-
   // A collection of callbacks used to release resources.
   using ResourceReleaseCallbackMap = std::map<int, cc::ReleaseCallback>;
   ResourceReleaseCallbackMap release_callbacks_;
 
   Surface* surface_;
   std::unique_ptr<CompositorFrameSink> frame_sink_;
-
   std::unique_ptr<cc::ExternalBeginFrameSource> begin_frame_source_;
-  bool needs_begin_frame_ = false;
-  cc::BeginFrameArgs last_begin_frame_args_;
 
   base::WeakPtrFactory<CompositorFrameSinkHolder> weak_factory_;
 
diff --git a/components/exo/surface.cc b/components/exo/surface.cc
index be4b90b..bdcd7465 100644
--- a/components/exo/surface.cc
+++ b/components/exo/surface.cc
@@ -432,6 +432,13 @@
     CheckIfSurfaceHierarchyNeedsCommitToNewSurfaces();
     CommitSurfaceHierarchy();
   }
+
+  if (begin_frame_source_ && current_begin_frame_ack_.sequence_number !=
+                                 cc::BeginFrameArgs::kInvalidFrameNumber) {
+    begin_frame_source_->DidFinishFrame(this, current_begin_frame_ack_);
+    current_begin_frame_ack_.sequence_number =
+        cc::BeginFrameArgs::kInvalidFrameNumber;
+  }
 }
 
 void Surface::CommitSurfaceHierarchy() {
@@ -603,17 +610,42 @@
                                  frame_callbacks_);
   swapping_presentation_callbacks_.splice(
       swapping_presentation_callbacks_.end(), presentation_callbacks_);
+  UpdateNeedsBeginFrame();
 }
 
-bool Surface::NeedsBeginFrame() const {
-  return !active_frame_callbacks_.empty();
+void Surface::SetBeginFrameSource(cc::BeginFrameSource* begin_frame_source) {
+  if (needs_begin_frame_) {
+    DCHECK(begin_frame_source_);
+    begin_frame_source_->RemoveObserver(this);
+    needs_begin_frame_ = false;
+  }
+  begin_frame_source_ = begin_frame_source;
+  UpdateNeedsBeginFrame();
 }
 
-void Surface::BeginFrame(base::TimeTicks frame_time) {
+void Surface::UpdateNeedsBeginFrame() {
+  if (!begin_frame_source_)
+    return;
+
+  bool needs_begin_frame = !active_frame_callbacks_.empty();
+  if (needs_begin_frame == needs_begin_frame_)
+    return;
+
+  needs_begin_frame_ = needs_begin_frame;
+  if (needs_begin_frame_)
+    begin_frame_source_->AddObserver(this);
+  else
+    begin_frame_source_->RemoveObserver(this);
+}
+
+bool Surface::OnBeginFrameDerivedImpl(const cc::BeginFrameArgs& args) {
+  current_begin_frame_ack_ = cc::BeginFrameAck(
+      args.source_id, args.sequence_number, args.sequence_number, 0, false);
   while (!active_frame_callbacks_.empty()) {
-    active_frame_callbacks_.front().Run(frame_time);
+    active_frame_callbacks_.front().Run(args.frame_time);
     active_frame_callbacks_.pop_front();
   }
+  return true;
 }
 
 void Surface::CheckIfSurfaceHierarchyNeedsCommitToNewSurfaces() {
@@ -806,6 +838,9 @@
   quad_state->opacity = state_.alpha;
 
   cc::CompositorFrame frame;
+  current_begin_frame_ack_.has_damage = true;
+  frame.metadata.begin_frame_ack = current_begin_frame_ack_;
+
   if (current_resource_.id) {
     // Texture quad is only needed if buffer is not fully transparent.
     if (state_.alpha) {
diff --git a/components/exo/surface.h b/components/exo/surface.h
index ecda812..8e4a6ad 100644
--- a/components/exo/surface.h
+++ b/components/exo/surface.h
@@ -15,6 +15,7 @@
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
 #include "base/observer_list.h"
+#include "cc/output/begin_frame_args.h"
 #include "cc/resources/transferable_resource.h"
 #include "cc/scheduler/begin_frame_source.h"
 #include "cc/surfaces/local_surface_id_allocator.h"
@@ -62,7 +63,8 @@
 class Surface : public ui::ContextFactoryObserver,
                 public aura::WindowObserver,
                 public ui::PropertyHandler,
-                public ui::CompositorVSyncManager::Observer {
+                public ui::CompositorVSyncManager::Observer,
+                public cc::BeginFrameObserverBase {
  public:
   using PropertyDeallocator = void (*)(int64_t value);
 
@@ -192,12 +194,8 @@
   // Call this to indicate that surface is being scheduled for a draw.
   void WillDraw();
 
-  // Returns true when there's an active frame callback that requires a
-  // BeginFrame() call.
-  bool NeedsBeginFrame() const;
-
-  // Call this to indicate that it's a good time to start producing a new frame.
-  void BeginFrame(base::TimeTicks frame_time);
+  // Called when the begin frame source has changed.
+  void SetBeginFrameSource(cc::BeginFrameSource* begin_frame_source);
 
   // Check whether this Surface and its children need to create new cc::Surface
   // IDs for their contents next time they get new buffer contents.
@@ -222,6 +220,10 @@
     return pending_damage_.contains(gfx::RectToSkIRect(damage));
   }
 
+  // Overridden from cc::BeginFrameObserverBase:
+  bool OnBeginFrameDerivedImpl(const cc::BeginFrameArgs& args) override;
+  void OnBeginFrameSourcePausedChanged(bool paused) override {}
+
  private:
   struct State {
     State();
@@ -282,6 +284,9 @@
   // current_resource_.
   void UpdateSurface(bool full_damage);
 
+  // Adds/Removes begin frame observer based on state.
+  void UpdateNeedsBeginFrame();
+
   // This returns true when the surface has some contents assigned to it.
   bool has_contents() const { return !!current_buffer_.buffer(); }
 
@@ -389,6 +394,11 @@
   // references to surfaces.
   scoped_refptr<cc::SurfaceReferenceFactory> surface_reference_factory_;
 
+  // The begin frame source being observed.
+  cc::BeginFrameSource* begin_frame_source_ = nullptr;
+  bool needs_begin_frame_ = false;
+  cc::BeginFrameAck current_begin_frame_ack_;
+
   DISALLOW_COPY_AND_ASSIGN(Surface);
 };
 
diff --git a/components/exo/surface_unittest.cc b/components/exo/surface_unittest.cc
index 3b8f4c47..eb06aa2 100644
--- a/components/exo/surface_unittest.cc
+++ b/components/exo/surface_unittest.cc
@@ -2,11 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "cc/surfaces/surface.h"
 #include "base/bind.h"
 #include "cc/output/compositor_frame.h"
 #include "cc/quads/texture_draw_quad.h"
-#include "cc/surfaces/surface.h"
 #include "cc/surfaces/surface_manager.h"
+#include "cc/test/begin_frame_args_test.h"
+#include "cc/test/fake_external_begin_frame_source.h"
 #include "components/exo/buffer.h"
 #include "components/exo/surface.h"
 #include "components/exo/test/exo_test_base.h"
@@ -311,5 +313,41 @@
   surface->Commit();
 }
 
+TEST_F(SurfaceTest, SendsBeginFrameAcks) {
+  cc::FakeExternalBeginFrameSource source(0.f, false);
+  gfx::Size buffer_size(1, 1);
+  std::unique_ptr<Buffer> buffer(
+      new Buffer(exo_test_helper()->CreateGpuMemoryBuffer(buffer_size)));
+  std::unique_ptr<Surface> surface(new Surface);
+  surface->SetBeginFrameSource(&source);
+  surface->Attach(buffer.get());
+
+  // Request a frame callback so that Surface now needs BeginFrames.
+  base::TimeTicks frame_time;
+  surface->RequestFrameCallback(
+      base::Bind(&SetFrameTime, base::Unretained(&frame_time)));
+  surface->Commit();  // Move callback from pending callbacks to current ones.
+  RunAllPendingInMessageLoop();
+
+  // Surface should add itself as observer during WillDraw().
+  surface->WillDraw();
+  EXPECT_EQ(1u, source.num_observers());
+
+  cc::BeginFrameArgs args(source.CreateBeginFrameArgs(BEGINFRAME_FROM_HERE));
+  args.frame_time = base::TimeTicks::FromInternalValue(100);
+  source.TestOnBeginFrame(args);  // Runs the frame callback.
+  EXPECT_EQ(args.frame_time, frame_time);
+
+  surface->Commit();  // Acknowledges the BeginFrame.
+  RunAllPendingInMessageLoop();
+
+  cc::BeginFrameAck expected_ack(args.source_id, args.sequence_number,
+                                 args.sequence_number, 0, true);
+  EXPECT_EQ(expected_ack, source.LastAckForObserver(surface.get()));
+
+  const cc::CompositorFrame& frame = GetFrameFromSurface(surface.get());
+  EXPECT_EQ(expected_ack, frame.metadata.begin_frame_ack);
+}
+
 }  // namespace
 }  // namespace exo
diff --git a/components/nacl/renderer/nexe_load_manager.cc b/components/nacl/renderer/nexe_load_manager.cc
index ebfc0cd..e97927c 100644
--- a/components/nacl/renderer/nexe_load_manager.cc
+++ b/components/nacl/renderer/nexe_load_manager.cc
@@ -20,7 +20,6 @@
 #include "components/nacl/renderer/pnacl_translation_resource_host.h"
 #include "components/nacl/renderer/progress_event.h"
 #include "components/nacl/renderer/trusted_plugin_channel.h"
-#include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/sandbox_init.h"
 #include "content/public/renderer/pepper_plugin_instance.h"
diff --git a/components/security_state/content/content_utils.cc b/components/security_state/content/content_utils.cc
index 266eeb3a..ae007c3 100644
--- a/components/security_state/content/content_utils.cc
+++ b/components/security_state/content/content_utils.cc
@@ -19,7 +19,6 @@
 #include "content/public/browser/security_style_explanations.h"
 #include "content/public/browser/ssl_status.h"
 #include "content/public/browser/web_contents.h"
-#include "content/public/common/content_client.h"
 #include "net/base/net_errors.h"
 #include "net/cert/x509_certificate.h"
 #include "net/ssl/ssl_cipher_suite_names.h"
diff --git a/components/sessions/content/content_serialized_navigation_driver.cc b/components/sessions/content/content_serialized_navigation_driver.cc
index d9e4b1c7..475f8dd 100644
--- a/components/sessions/content/content_serialized_navigation_driver.cc
+++ b/components/sessions/content/content_serialized_navigation_driver.cc
@@ -116,7 +116,7 @@
   // change.
   if (IsUberOrUberReplacementURL(navigation->virtual_url_) &&
       IsUberOrUberReplacementURL(navigation->original_request_url_)) {
-    navigation->encoded_page_state_ = std::string();
+    navigation->encoded_page_state_.clear();
   }
 
   // No need to compare the policy, as it doesn't change during
@@ -158,7 +158,7 @@
     // chrome-native://history to the old web UI.
     navigation->virtual_url_ = GURL(content::kChromeUIHistoryURL);
     navigation->original_request_url_ = navigation->virtual_url_;
-    navigation->encoded_page_state_ = std::string();
+    navigation->encoded_page_state_.clear();
   }
 #endif  // defined(OS_ANDROID)
 }
diff --git a/components/sessions/core/tab_restore_service_client.h b/components/sessions/core/tab_restore_service_client.h
index a6aa4a8f..b5d3b97 100644
--- a/components/sessions/core/tab_restore_service_client.h
+++ b/components/sessions/core/tab_restore_service_client.h
@@ -12,18 +12,18 @@
 #include "components/sessions/core/session_id.h"
 #include "components/sessions/core/sessions_export.h"
 
+class GURL;
+
 namespace base {
 class CancelableTaskTracker;
 class SequencedWorkerPool;
 }
 
-class GURL;
-
 namespace sessions {
 
 class LiveTab;
-struct SessionWindow;
 class LiveTabContext;
+struct SessionWindow;
 
 // Callback from TabRestoreServiceClient::GetLastSession.
 // The second parameter is the id of the window that was last active.
diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
index 8d10c1b..b5ada72d 100644
--- a/content/browser/BUILD.gn
+++ b/content/browser/BUILD.gn
@@ -1816,8 +1816,6 @@
       "renderer_host/render_widget_host_view_android.h",
       "screen_orientation/screen_orientation_delegate_android.cc",
       "screen_orientation/screen_orientation_delegate_android.h",
-      "screen_orientation/screen_orientation_listener_android.cc",
-      "screen_orientation/screen_orientation_listener_android.h",
       "web_contents/web_contents_android.cc",
       "web_contents/web_contents_android.h",
       "web_contents/web_contents_view_android.cc",
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index 06761dd..ae2509f1 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc
@@ -203,7 +203,6 @@
 #include "ui/native_theme/native_theme_switches.h"
 
 #if defined(OS_ANDROID)
-#include "content/browser/screen_orientation/screen_orientation_listener_android.h"
 #include "content/public/browser/android/java_interfaces.h"
 #include "ipc/ipc_sync_channel.h"
 #include "media/audio/android/audio_manager_android.h"
@@ -1188,7 +1187,6 @@
   AddFilter(new HistogramMessageFilter());
   AddFilter(new MemoryMessageFilter(this));
 #if defined(OS_ANDROID)
-  AddFilter(new ScreenOrientationListenerAndroid());
   synchronous_compositor_filter_ =
       new SynchronousCompositorBrowserFilter(GetID());
   AddFilter(synchronous_compositor_filter_.get());
diff --git a/content/browser/screen_orientation/screen_orientation_delegate_android.cc b/content/browser/screen_orientation/screen_orientation_delegate_android.cc
index d534d30..6a95d7db 100644
--- a/content/browser/screen_orientation/screen_orientation_delegate_android.cc
+++ b/content/browser/screen_orientation/screen_orientation_delegate_android.cc
@@ -20,18 +20,6 @@
   ScreenOrientationProvider::SetDelegate(nullptr);
 }
 
-// static
-void ScreenOrientationDelegateAndroid::StartAccurateListening() {
-  Java_ScreenOrientationProvider_startAccurateListening(
-      base::android::AttachCurrentThread());
-}
-
-// static
-void ScreenOrientationDelegateAndroid::StopAccurateListening() {
-  Java_ScreenOrientationProvider_stopAccurateListening(
-      base::android::AttachCurrentThread());
-}
-
 bool ScreenOrientationDelegateAndroid::FullScreenRequired(
     WebContents* web_contents) {
   ContentViewCoreImpl* cvc =
diff --git a/content/browser/screen_orientation/screen_orientation_delegate_android.h b/content/browser/screen_orientation/screen_orientation_delegate_android.h
index 3243d44..e9da0fb 100644
--- a/content/browser/screen_orientation/screen_orientation_delegate_android.h
+++ b/content/browser/screen_orientation/screen_orientation_delegate_android.h
@@ -22,16 +22,6 @@
   ScreenOrientationDelegateAndroid();
   ~ScreenOrientationDelegateAndroid() override;
 
-  // Ask the ScreenOrientationListener (Java) to start accurately listening to
-  // the screen orientation. It keep track of the number of start request if it
-  // is already running an accurate listening.
-  static void StartAccurateListening();
-
-  // Ask the ScreenOrientationListener (Java) to stop accurately listening to
-  // the screen orientation. It will actually stop only if the number of stop
-  // requests matches the number of start requests.
-  static void StopAccurateListening();
-
   // ScreenOrientationDelegate:
   bool FullScreenRequired(WebContents* web_contents) override;
   void Lock(WebContents* web_contents,
diff --git a/content/browser/screen_orientation/screen_orientation_listener_android.cc b/content/browser/screen_orientation/screen_orientation_listener_android.cc
deleted file mode 100644
index 850e89e5..0000000
--- a/content/browser/screen_orientation/screen_orientation_listener_android.cc
+++ /dev/null
@@ -1,46 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/screen_orientation/screen_orientation_listener_android.h"
-
-#include "base/message_loop/message_loop.h"
-#include "content/browser/screen_orientation/screen_orientation_delegate_android.h"
-#include "content/common/screen_orientation_messages.h"
-
-namespace content {
-
-ScreenOrientationListenerAndroid::ScreenOrientationListenerAndroid()
-    : BrowserMessageFilter(ScreenOrientationMsgStart),
-      BrowserAssociatedInterface<device::mojom::ScreenOrientationListener>(
-          this,
-          this),
-      listeners_count_(0) {}
-
-ScreenOrientationListenerAndroid::~ScreenOrientationListenerAndroid() {
-  DCHECK(base::MessageLoopForIO::IsCurrent());
-  if (listeners_count_ > 0)
-    ScreenOrientationDelegateAndroid::StopAccurateListening();
-}
-
-bool ScreenOrientationListenerAndroid::OnMessageReceived(
-    const IPC::Message& message) {
-  return false;
-}
-
-void ScreenOrientationListenerAndroid::Start() {
-  DCHECK(base::MessageLoopForIO::IsCurrent());
-  ++listeners_count_;
-  if (listeners_count_ == 1)
-    ScreenOrientationDelegateAndroid::StartAccurateListening();
-}
-
-void ScreenOrientationListenerAndroid::Stop() {
-  DCHECK(base::MessageLoopForIO::IsCurrent());
-  DCHECK(listeners_count_ > 0);
-  --listeners_count_;
-  if (listeners_count_ == 0)
-    ScreenOrientationDelegateAndroid::StopAccurateListening();
-}
-
-}  // namespace content
diff --git a/content/browser/screen_orientation/screen_orientation_listener_android.h b/content/browser/screen_orientation/screen_orientation_listener_android.h
deleted file mode 100644
index 680af97..0000000
--- a/content/browser/screen_orientation/screen_orientation_listener_android.h
+++ /dev/null
@@ -1,40 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_SCREEN_ORIENTATION_SCREEN_ORIENTATION_LISTENER_ANDROID_H_
-#define CONTENT_BROWSER_SCREEN_ORIENTATION_SCREEN_ORIENTATION_LISTENER_ANDROID_H_
-
-#include "base/macros.h"
-#include "content/public/browser/browser_associated_interface.h"
-#include "content/public/browser/browser_message_filter.h"
-#include "device/screen_orientation/public/interfaces/screen_orientation.mojom.h"
-
-namespace content {
-
-class ScreenOrientationListenerAndroid
-    : public BrowserMessageFilter,
-      public BrowserAssociatedInterface<
-          device::mojom::ScreenOrientationListener>,
-      public NON_EXPORTED_BASE(device::mojom::ScreenOrientationListener) {
- public:
-  ScreenOrientationListenerAndroid();
-
-  // BrowserMessageFilter implementation.
-  bool OnMessageReceived(const IPC::Message& message) override;
-
- private:
-  ~ScreenOrientationListenerAndroid() override;
-
-  // device::mojom::ScreenOrientationListener:
-  void Start() override;
-  void Stop() override;
-
-  int listeners_count_;
-
-  DISALLOW_COPY_AND_ASSIGN(ScreenOrientationListenerAndroid);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_BROWSER_SCREEN_ORIENTATION_SCREEN_ORIENTATION_LISTENER_ANDROID_H_
diff --git a/content/browser/service_manager/service_manager_context.cc b/content/browser/service_manager/service_manager_context.cc
index 52cb1b9..091bfb6 100644
--- a/content/browser/service_manager/service_manager_context.cc
+++ b/content/browser/service_manager/service_manager_context.cc
@@ -71,6 +71,8 @@
   service_factory->CreateService(std::move(request), service_name);
 }
 
+#if (ENABLE_MOJO_MEDIA_IN_GPU_PROCESS)
+
 // Request service_manager::mojom::ServiceFactory from GPU process host. Must be
 // called on IO thread.
 void StartServiceInGpuProcess(const std::string& service_name,
@@ -93,6 +95,8 @@
   service_factory->CreateService(std::move(request), service_name);
 }
 
+#endif  // ENABLE_MOJO_MEDIA_IN_GPU_PROCESS
+
 // A ManifestProvider which resolves application names to builtin manifest
 // resources for the catalog service to consume.
 class BuiltinManifestProvider : public catalog::ManifestProvider {
@@ -285,7 +289,8 @@
   ServiceInfo device_info;
   device_info.factory =
       base::Bind(&device::CreateDeviceService,
-                 BrowserThread::GetTaskRunnerForThread(BrowserThread::FILE));
+                 BrowserThread::GetTaskRunnerForThread(BrowserThread::FILE),
+                 BrowserThread::GetTaskRunnerForThread(BrowserThread::IO));
   device_info.task_runner = base::ThreadTaskRunnerHandle::Get();
   packaged_services_connection_->AddEmbeddedService(device::mojom::kServiceName,
                                                     device_info);
@@ -317,6 +322,9 @@
   GetContentClient()
       ->browser()
       ->RegisterUnsandboxedOutOfProcessServices(&unsandboxed_services);
+  unsandboxed_services.insert(
+      std::make_pair(shape_detection::mojom::kServiceName,
+                     base::ASCIIToUTF16("Shape Detection Service")));
   for (const auto& service : unsandboxed_services) {
     packaged_services_connection_->AddServiceRequestHandler(
         service.first, base::Bind(&StartServiceInUtilityProcess, service.first,
@@ -327,12 +335,6 @@
   packaged_services_connection_->AddServiceRequestHandler(
       "media", base::Bind(&StartServiceInGpuProcess, "media"));
 #endif
-
-  packaged_services_connection_->AddServiceRequestHandler(
-      shape_detection::mojom::kServiceName,
-      base::Bind(&StartServiceInGpuProcess,
-                 shape_detection::mojom::kServiceName));
-
   packaged_services_connection_->Start();
   ServiceManagerConnection::GetForProcess()->Start();
 }
diff --git a/content/common/screen_orientation_messages.h b/content/common/screen_orientation_messages.h
index fd456622..c8d1177a 100644
--- a/content/common/screen_orientation_messages.h
+++ b/content/common/screen_orientation_messages.h
@@ -13,8 +13,6 @@
 #undef IPC_MESSAGE_EXPORT
 #define IPC_MESSAGE_EXPORT CONTENT_EXPORT
 
-#define IPC_MESSAGE_START ScreenOrientationMsgStart
-
 // Only used by content/common/manifest_manager_messages.h.
 IPC_ENUM_TRAITS_MIN_MAX_VALUE(blink::WebScreenOrientationLockType,
                               blink::WebScreenOrientationLockDefault,
diff --git a/content/gpu/BUILD.gn b/content/gpu/BUILD.gn
index 0ba3548..11f25b8 100644
--- a/content/gpu/BUILD.gn
+++ b/content/gpu/BUILD.gn
@@ -63,8 +63,6 @@
     "//media/gpu/ipc/service",
     "//services/service_manager/public/cpp",
     "//services/service_manager/public/interfaces",
-    "//services/shape_detection:lib",
-    "//services/shape_detection/public/interfaces",
     "//services/ui/gpu",
     "//services/ui/gpu/interfaces",
     "//skia",
diff --git a/content/gpu/DEPS b/content/gpu/DEPS
index ffaa6bf2..2abb4042 100644
--- a/content/gpu/DEPS
+++ b/content/gpu/DEPS
@@ -5,7 +5,6 @@
   "+libEGL",
   "+libGLESv2",
   "+services/service_manager",
-  "+services/shape_detection",
   "+services/ui/gpu",
   "+sandbox",
   "+skia",
diff --git a/content/gpu/gpu_service_factory.cc b/content/gpu/gpu_service_factory.cc
index 06b777c7..5625a63 100644
--- a/content/gpu/gpu_service_factory.cc
+++ b/content/gpu/gpu_service_factory.cc
@@ -7,8 +7,6 @@
 #include <memory>
 
 #include "base/threading/thread_task_runner_handle.h"
-#include "services/shape_detection/public/interfaces/constants.mojom.h"
-#include "services/shape_detection/shape_detection_service.h"
 
 #if defined(ENABLE_MOJO_MEDIA_IN_GPU_PROCESS)
 #include "base/bind.h"
@@ -35,12 +33,6 @@
   info.use_own_thread = true;
   services->insert(std::make_pair("media", info));
 #endif
-
-  ServiceInfo shape_detection_info;
-  shape_detection_info.factory =
-      base::Bind(&shape_detection::ShapeDetectionService::Create);
-  services->insert(std::make_pair(shape_detection::mojom::kServiceName,
-                                  shape_detection_info));
 }
 
 }  // namespace content
diff --git a/content/public/android/java/src/org/chromium/content/browser/ScreenOrientationProvider.java b/content/public/android/java/src/org/chromium/content/browser/ScreenOrientationProvider.java
index 5fd2b411..83aa4cd 100644
--- a/content/public/android/java/src/org/chromium/content/browser/ScreenOrientationProvider.java
+++ b/content/public/android/java/src/org/chromium/content/browser/ScreenOrientationProvider.java
@@ -11,7 +11,6 @@
 import android.view.Surface;
 
 import org.chromium.base.Log;
-import org.chromium.base.ThreadUtils;
 import org.chromium.base.annotations.CalledByNative;
 import org.chromium.base.annotations.JNINamespace;
 import org.chromium.content_public.common.ScreenOrientationConstants;
@@ -124,26 +123,6 @@
         }
     }
 
-    @CalledByNative
-    static void startAccurateListening() {
-        ThreadUtils.runOnUiThread(new Runnable() {
-            @Override
-            public void run() {
-                DisplayAndroid.startAccurateListening();
-            }
-        });
-    }
-
-    @CalledByNative
-    static void stopAccurateListening() {
-        ThreadUtils.runOnUiThread(new Runnable() {
-            @Override
-            public void run() {
-                DisplayAndroid.stopAccurateListening();
-            }
-        });
-    }
-
     private ScreenOrientationProvider() {
     }
 }
diff --git a/content/public/app/mojo/content_renderer_manifest.json b/content/public/app/mojo/content_renderer_manifest.json
index 8894861..e747b68 100644
--- a/content/public/app/mojo/content_renderer_manifest.json
+++ b/content/public/app/mojo/content_renderer_manifest.json
@@ -21,6 +21,7 @@
         "content_browser": [ "renderer" ],
         "device": [
           "device:power_monitor",
+          "device:screen_orientation",
           "device:time_zone_monitor"
         ],
         "ui": [
diff --git a/content/renderer/BUILD.gn b/content/renderer/BUILD.gn
index f1ba7fd..f2a9aa5d 100644
--- a/content/renderer/BUILD.gn
+++ b/content/renderer/BUILD.gn
@@ -463,6 +463,7 @@
     "//ppapi/features",
     "//printing/features",
     "//sandbox",
+    "//services/device/public/interfaces",
     "//services/service_manager/public/cpp",
     "//services/service_manager/public/interfaces",
     "//services/ui/public/cpp/gpu",
diff --git a/content/renderer/screen_orientation/screen_orientation_observer.cc b/content/renderer/screen_orientation/screen_orientation_observer.cc
index 4549d98a..92b69fe 100644
--- a/content/renderer/screen_orientation/screen_orientation_observer.cc
+++ b/content/renderer/screen_orientation/screen_orientation_observer.cc
@@ -4,7 +4,10 @@
 
 #include "content/renderer/screen_orientation/screen_orientation_observer.h"
 
+#include "content/public/common/service_manager_connection.h"
 #include "content/renderer/render_thread_impl.h"
+#include "services/device/public/interfaces/constants.mojom.h"
+#include "services/service_manager/public/cpp/connector.h"
 
 namespace content {
 
@@ -33,8 +36,10 @@
 device::mojom::ScreenOrientationListener*
 ScreenOrientationObserver::GetScreenOrientationListener() {
   if (!listener_) {
-    RenderThreadImpl::current()->GetChannel()->GetRemoteAssociatedInterface(
-        &listener_);
+    RenderThreadImpl::current()
+        ->GetServiceManagerConnection()
+        ->GetConnector()
+        ->BindInterface(device::mojom::kServiceName, &listener_);
   }
   return listener_.get();
 }
diff --git a/content/renderer/screen_orientation/screen_orientation_observer.h b/content/renderer/screen_orientation/screen_orientation_observer.h
index 3e39689..be6a9132 100644
--- a/content/renderer/screen_orientation/screen_orientation_observer.h
+++ b/content/renderer/screen_orientation/screen_orientation_observer.h
@@ -32,7 +32,7 @@
  private:
   device::mojom::ScreenOrientationListener* GetScreenOrientationListener();
 
-  device::mojom::ScreenOrientationListenerAssociatedPtr listener_;
+  device::mojom::ScreenOrientationListenerPtr listener_;
 };
 
 }; // namespace content
diff --git a/google_apis/drive/base_requests.cc b/google_apis/drive/base_requests.cc
index 39492d0..93d6cb1 100644
--- a/google_apis/drive/base_requests.cc
+++ b/google_apis/drive/base_requests.cc
@@ -37,6 +37,7 @@
 #include "net/http/http_byte_range.h"
 #include "net/http/http_response_headers.h"
 #include "net/http/http_util.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "net/url_request/url_fetcher.h"
 #include "net/url_request/url_request_status.h"
 
@@ -399,7 +400,8 @@
   DVLOG(1) << "URL: " << url.spec();
 
   URLFetcher::RequestType request_type = GetRequestType();
-  url_fetcher_ = URLFetcher::Create(url, request_type, this);
+  url_fetcher_ = URLFetcher::Create(url, request_type, this,
+                                    sender_->get_traffic_annotation_tag());
   url_fetcher_->SetRequestContext(sender_->url_request_context_getter());
   // Always set flags to neither send nor save cookies.
   url_fetcher_->SetLoadFlags(
diff --git a/google_apis/drive/base_requests_server_unittest.cc b/google_apis/drive/base_requests_server_unittest.cc
index 6f815b99..c1ce4326 100644
--- a/google_apis/drive/base_requests_server_unittest.cc
+++ b/google_apis/drive/base_requests_server_unittest.cc
@@ -19,6 +19,7 @@
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/embedded_test_server/http_request.h"
 #include "net/test/embedded_test_server/http_response.h"
+#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "net/url_request/url_request_test_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -41,11 +42,10 @@
     request_context_getter_ = new net::TestURLRequestContextGetter(
         message_loop_.task_runner());
 
-    request_sender_.reset(new RequestSender(
-        new DummyAuthService,
-        request_context_getter_.get(),
-        message_loop_.task_runner(),
-        kTestUserAgent));
+    request_sender_.reset(
+        new RequestSender(new DummyAuthService, request_context_getter_.get(),
+                          message_loop_.task_runner(), kTestUserAgent,
+                          TRAFFIC_ANNOTATION_FOR_TESTS));
 
     ASSERT_TRUE(test_server_.InitializeAndListen());
     test_server_.RegisterRequestHandler(
diff --git a/google_apis/drive/base_requests_unittest.cc b/google_apis/drive/base_requests_unittest.cc
index bce6b71b..19449aa 100644
--- a/google_apis/drive/base_requests_unittest.cc
+++ b/google_apis/drive/base_requests_unittest.cc
@@ -22,6 +22,7 @@
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/embedded_test_server/http_request.h"
 #include "net/test/embedded_test_server/http_response.h"
+#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "net/url_request/url_request_test_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -115,10 +116,10 @@
     request_context_getter_ = new net::TestURLRequestContextGetter(
         message_loop_.task_runner());
 
-    sender_.reset(new RequestSender(new DummyAuthService,
-                                    request_context_getter_.get(),
-                                    message_loop_.task_runner(),
-                                    std::string() /* custom user agent */));
+    sender_.reset(new RequestSender(
+        new DummyAuthService, request_context_getter_.get(),
+        message_loop_.task_runner(), std::string(), /* custom user agent */
+        TRAFFIC_ANNOTATION_FOR_TESTS));
 
     test_server_.RegisterRequestHandler(
         base::Bind(&BaseRequestsTest::HandleRequest, base::Unretained(this)));
diff --git a/google_apis/drive/drive_api_requests_unittest.cc b/google_apis/drive/drive_api_requests_unittest.cc
index 27cd0eb..8867a976 100644
--- a/google_apis/drive/drive_api_requests_unittest.cc
+++ b/google_apis/drive/drive_api_requests_unittest.cc
@@ -27,6 +27,7 @@
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/embedded_test_server/http_request.h"
 #include "net/test/embedded_test_server/http_response.h"
+#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "net/url_request/url_request_test_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -132,10 +133,10 @@
     request_context_getter_ = new net::TestURLRequestContextGetter(
         message_loop_.task_runner());
 
-    request_sender_.reset(new RequestSender(new DummyAuthService,
-                                            request_context_getter_.get(),
-                                            message_loop_.task_runner(),
-                                            kTestUserAgent));
+    request_sender_.reset(
+        new RequestSender(new DummyAuthService, request_context_getter_.get(),
+                          message_loop_.task_runner(), kTestUserAgent,
+                          TRAFFIC_ANNOTATION_FOR_TESTS));
 
     ASSERT_TRUE(temp_dir_.CreateUniqueTempDir());
 
diff --git a/google_apis/drive/files_list_request_runner_unittest.cc b/google_apis/drive/files_list_request_runner_unittest.cc
index a6719f45..89e7f3a 100644
--- a/google_apis/drive/files_list_request_runner_unittest.cc
+++ b/google_apis/drive/files_list_request_runner_unittest.cc
@@ -18,6 +18,7 @@
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/embedded_test_server/http_request.h"
 #include "net/test/embedded_test_server/http_response.h"
+#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "net/url_request/url_request_test_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -70,7 +71,8 @@
 
     request_sender_.reset(
         new RequestSender(new DummyAuthService, request_context_getter_.get(),
-                          message_loop_.task_runner(), kTestUserAgent));
+                          message_loop_.task_runner(), kTestUserAgent,
+                          TRAFFIC_ANNOTATION_FOR_TESTS));
 
     test_server_.RegisterRequestHandler(
         base::Bind(&FilesListRequestRunnerTest::OnFilesListRequest,
diff --git a/google_apis/drive/request_sender.cc b/google_apis/drive/request_sender.cc
index dc946881..9681f65 100644
--- a/google_apis/drive/request_sender.cc
+++ b/google_apis/drive/request_sender.cc
@@ -18,13 +18,14 @@
     AuthServiceInterface* auth_service,
     net::URLRequestContextGetter* url_request_context_getter,
     const scoped_refptr<base::SequencedTaskRunner>& blocking_task_runner,
-    const std::string& custom_user_agent)
+    const std::string& custom_user_agent,
+    const net::NetworkTrafficAnnotationTag& traffic_annotation)
     : auth_service_(auth_service),
       url_request_context_getter_(url_request_context_getter),
       blocking_task_runner_(blocking_task_runner),
       custom_user_agent_(custom_user_agent),
-      weak_ptr_factory_(this) {
-}
+      traffic_annotation_(traffic_annotation),
+      weak_ptr_factory_(this) {}
 
 RequestSender::~RequestSender() {
   DCHECK(thread_checker_.CalledOnValidThread());
diff --git a/google_apis/drive/request_sender.h b/google_apis/drive/request_sender.h
index 6fb7437..c5705e6 100644
--- a/google_apis/drive/request_sender.h
+++ b/google_apis/drive/request_sender.h
@@ -15,6 +15,7 @@
 #include "base/memory/weak_ptr.h"
 #include "base/threading/thread_checker.h"
 #include "google_apis/drive/drive_api_error_codes.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 namespace base {
 class SequencedTaskRunner;
@@ -48,7 +49,8 @@
       AuthServiceInterface* auth_service,
       net::URLRequestContextGetter* url_request_context_getter,
       const scoped_refptr<base::SequencedTaskRunner>& blocking_task_runner,
-      const std::string& custom_user_agent);
+      const std::string& custom_user_agent,
+      const net::NetworkTrafficAnnotationTag& traffic_annotation);
   ~RequestSender();
 
   AuthServiceInterface* auth_service() { return auth_service_.get(); }
@@ -74,6 +76,11 @@
   // TODO(kinaba): refactor the life time management and make this at private.
   void RequestFinished(AuthenticatedRequestInterface* request);
 
+  // Returns traffic annotation tag asssigned to this object.
+  const net::NetworkTrafficAnnotationTag& get_traffic_annotation_tag() const {
+    return traffic_annotation_;
+  }
+
  private:
   base::Closure StartRequestWithAuthRetryInternal(
       AuthenticatedRequestInterface* request);
@@ -102,6 +109,8 @@
 
   base::ThreadChecker thread_checker_;
 
+  const net::NetworkTrafficAnnotationTag traffic_annotation_;
+
   // Note: This should remain the last member so it'll be destroyed and
   // invalidate its weak pointers before any other members are destroyed.
   base::WeakPtrFactory<RequestSender> weak_ptr_factory_;
diff --git a/google_apis/drive/request_sender_unittest.cc b/google_apis/drive/request_sender_unittest.cc
index 9783900..6e32eb0 100644
--- a/google_apis/drive/request_sender_unittest.cc
+++ b/google_apis/drive/request_sender_unittest.cc
@@ -9,6 +9,7 @@
 #include "base/strings/string_number_conversions.h"
 #include "google_apis/drive/base_requests.h"
 #include "google_apis/drive/dummy_auth_service.h"
+#include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace google_apis {
@@ -58,8 +59,12 @@
 class RequestSenderTest : public testing::Test {
  protected:
   RequestSenderTest()
-     : auth_service_(new TestAuthService),
-       request_sender_(auth_service_, NULL, NULL, "dummy-user-agent") {
+      : auth_service_(new TestAuthService),
+        request_sender_(auth_service_,
+                        NULL,
+                        NULL,
+                        "dummy-user-agent",
+                        TRAFFIC_ANNOTATION_FOR_TESTS) {
     auth_service_->set_refresh_token(kTestRefreshToken);
     auth_service_->set_access_token(kTestAccessToken);
   }
diff --git a/headless/BUILD.gn b/headless/BUILD.gn
index 19ee88d..887f9b0 100644
--- a/headless/BUILD.gn
+++ b/headless/BUILD.gn
@@ -197,6 +197,7 @@
               "lib/browser/headless_browser_impl.cc",
               "lib/browser/headless_browser_impl.h",
               "lib/browser/headless_browser_impl_mac.mm",
+              "lib/browser/headless_browser_main_parts_mac.mm",
               "lib/browser/headless_browser_main_parts.cc",
               "lib/browser/headless_browser_main_parts.h",
               "lib/browser/headless_content_browser_client.cc",
@@ -212,6 +213,8 @@
               "lib/browser/headless_network_delegate.h",
               "lib/browser/headless_platform_event_source.cc",
               "lib/browser/headless_platform_event_source.h",
+              "lib/browser/headless_shell_application_mac.mm",
+              "lib/browser/headless_shell_application_mac.h",
               "lib/browser/headless_url_request_context_getter.cc",
               "lib/browser/headless_url_request_context_getter.h",
               "lib/browser/headless_web_contents_impl.cc",
diff --git a/headless/lib/browser/headless_browser_main_parts.h b/headless/lib/browser/headless_browser_main_parts.h
index e29b92a..0bf44ee 100644
--- a/headless/lib/browser/headless_browser_main_parts.h
+++ b/headless/lib/browser/headless_browser_main_parts.h
@@ -22,6 +22,9 @@
   // content::BrowserMainParts implementation:
   void PreMainMessageLoopRun() override;
   void PostMainMessageLoopRun() override;
+#if defined(OS_MACOSX)
+  void PreMainMessageLoopStart() override;
+#endif
 
  private:
   HeadlessBrowserImpl* browser_;  // Not owned.
diff --git a/headless/lib/browser/headless_browser_main_parts_mac.mm b/headless/lib/browser/headless_browser_main_parts_mac.mm
new file mode 100644
index 0000000..e8ab0a3
--- /dev/null
+++ b/headless/lib/browser/headless_browser_main_parts_mac.mm
@@ -0,0 +1,18 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "headless/lib/browser/headless_browser_main_parts.h"
+
+#import <Cocoa/Cocoa.h>
+
+#include "headless/lib/browser/headless_shell_application_mac.h"
+
+namespace headless {
+
+void HeadlessBrowserMainParts::PreMainMessageLoopStart() {
+  // Force the NSApplication subclass to be used.
+  [HeadlessShellCrApplication sharedApplication];
+}
+
+}  // namespace headless
diff --git a/headless/lib/browser/headless_shell_application_mac.h b/headless/lib/browser/headless_shell_application_mac.h
new file mode 100644
index 0000000..c69b153
--- /dev/null
+++ b/headless/lib/browser/headless_shell_application_mac.h
@@ -0,0 +1,20 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef HEADLESS_LIB_BROWSER_HEADLESS_SHELL_APPLICATION_MAC_H_
+#define HEADLESS_LIB_BROWSER_HEADLESS_SHELL_APPLICATION_MAC_H_
+
+#include "base/mac/scoped_sending_event.h"
+#include "base/message_loop/message_pump_mac.h"
+
+// Headless shell uses |MessagePumpMac|, so it needs to implement the
+// |CRAppProtocol|.
+@interface HeadlessShellCrApplication : NSApplication<CrAppProtocol>
+
+// CrAppProtocol:
+- (BOOL)isHandlingSendEvent;
+
+@end
+
+#endif  // HEADLESS_LIB_BROWSER_HEADLESS_SHELL_APPLICATION_MAC_H_
diff --git a/headless/lib/browser/headless_shell_application_mac.mm b/headless/lib/browser/headless_shell_application_mac.mm
new file mode 100644
index 0000000..fa8e87a
--- /dev/null
+++ b/headless/lib/browser/headless_shell_application_mac.mm
@@ -0,0 +1,17 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "headless/lib/browser/headless_shell_application_mac.h"
+
+#include "base/auto_reset.h"
+
+@implementation HeadlessShellCrApplication
+
+- (BOOL)isHandlingSendEvent {
+  // The CrAppProtocol must return true if [NSApplication sendEvent:] is
+  // currently on the stack. seee |CrAppProtocol| in |MessagePumpMac|.
+  return true;
+}
+
+@end
diff --git a/ios/shared/chrome/browser/tabs/web_state_list_order_controller_unittest.mm b/ios/shared/chrome/browser/tabs/web_state_list_order_controller_unittest.mm
index 61b9cb5..e3c374b 100644
--- a/ios/shared/chrome/browser/tabs/web_state_list_order_controller_unittest.mm
+++ b/ios/shared/chrome/browser/tabs/web_state_list_order_controller_unittest.mm
@@ -19,15 +19,15 @@
 
 // A fake NavigationManager used to test opener-opened relationship in the
 // WebStateList.
-class FakeNavigationManer : public web::TestNavigationManager {
+class FakeNavigationManager : public web::TestNavigationManager {
  public:
-  FakeNavigationManer() = default;
+  FakeNavigationManager() = default;
 
   // web::NavigationManager implementation.
   int GetCurrentItemIndex() const override { return 0; }
   int GetLastCommittedItemIndex() const override { return 0; }
 
-  DISALLOW_COPY_AND_ASSIGN(FakeNavigationManer);
+  DISALLOW_COPY_AND_ASSIGN(FakeNavigationManager);
 };
 
 }  // namespace
@@ -50,7 +50,7 @@
     auto test_web_state = base::MakeUnique<web::TestWebState>();
     test_web_state->SetCurrentURL(GURL(kURL));
     test_web_state->SetNavigationManager(
-        base::MakeUnique<FakeNavigationManer>());
+        base::MakeUnique<FakeNavigationManager>());
     return test_web_state.release();
   }
 
diff --git a/ios/shared/chrome/browser/tabs/web_state_list_unittest.mm b/ios/shared/chrome/browser/tabs/web_state_list_unittest.mm
index f2e9070..2d2d149 100644
--- a/ios/shared/chrome/browser/tabs/web_state_list_unittest.mm
+++ b/ios/shared/chrome/browser/tabs/web_state_list_unittest.mm
@@ -106,9 +106,9 @@
 
 // A fake NavigationManager used to test opener-opened relationship in the
 // WebStateList.
-class FakeNavigationManer : public web::TestNavigationManager {
+class FakeNavigationManager : public web::TestNavigationManager {
  public:
-  FakeNavigationManer() = default;
+  FakeNavigationManager() = default;
 
   // web::NavigationManager implementation.
   int GetCurrentItemIndex() const override { return current_item_index_; }
@@ -133,7 +133,7 @@
 
   int current_item_index_ = 0;
 
-  DISALLOW_COPY_AND_ASSIGN(FakeNavigationManer);
+  DISALLOW_COPY_AND_ASSIGN(FakeNavigationManager);
 };
 
 }  // namespace
@@ -160,7 +160,7 @@
     auto test_web_state = base::MakeUnique<web::TestWebState>();
     test_web_state->SetCurrentURL(GURL(url));
     test_web_state->SetNavigationManager(
-        base::MakeUnique<FakeNavigationManer>());
+        base::MakeUnique<FakeNavigationManager>());
     return test_web_state.release();
   }
 
diff --git a/ipc/ipc_message_start.h b/ipc/ipc_message_start.h
index 3c41f04..1a3fb36b 100644
--- a/ipc/ipc_message_start.h
+++ b/ipc/ipc_message_start.h
@@ -81,7 +81,6 @@
   EmbeddedWorkerContextMsgStart,
   CastMsgStart,
   CdmMsgStart,
-  ScreenOrientationMsgStart,
   MediaStreamTrackMetricsHostMsgStart,
   ChromeExtensionMsgStart,
   PushMessagingMsgStart,
diff --git a/net/socket/ssl_server_socket.h b/net/socket/ssl_server_socket.h
index 1258a87..b61e663 100644
--- a/net/socket/ssl_server_socket.h
+++ b/net/socket/ssl_server_socket.h
@@ -32,6 +32,7 @@
 struct SSLServerConfig;
 class X509Certificate;
 
+// A server socket that uses SSL as the transport layer.
 class SSLServerSocket : public SSLSocket {
  public:
   ~SSLServerSocket() override {}
diff --git a/net/socket/tcp_server_socket.h b/net/socket/tcp_server_socket.h
index 546f48d..3b4a961 100644
--- a/net/socket/tcp_server_socket.h
+++ b/net/socket/tcp_server_socket.h
@@ -18,6 +18,7 @@
 class NetLog;
 struct NetLogSource;
 
+// A server socket that uses TCP as the transport layer.
 class NET_EXPORT TCPServerSocket : public ServerSocket {
  public:
   TCPServerSocket(NetLog* net_log, const NetLogSource& source);
diff --git a/net/socket/udp_server_socket.h b/net/socket/udp_server_socket.h
index 65a49e18..5d3cbdb2 100644
--- a/net/socket/udp_server_socket.h
+++ b/net/socket/udp_server_socket.h
@@ -20,7 +20,7 @@
 class NetLog;
 struct NetLogSource;
 
-// A client socket that uses UDP as the transport layer.
+// A server socket that uses UDP as the transport layer.
 class NET_EXPORT UDPServerSocket : public DatagramServerSocket {
  public:
   UDPServerSocket(net::NetLog* net_log, const net::NetLogSource& source);
diff --git a/net/socket/unix_domain_server_socket_posix.h b/net/socket/unix_domain_server_socket_posix.h
index 0d528351..27116ee 100644
--- a/net/socket/unix_domain_server_socket_posix.h
+++ b/net/socket/unix_domain_server_socket_posix.h
@@ -21,8 +21,8 @@
 
 class SocketPosix;
 
-// Unix Domain Server Socket Implementation. Supports abstract namespaces on
-// Linux and Android.
+// A server socket that uses unix domain socket as the transport layer.
+// Supports abstract namespaces on Linux and Android.
 class NET_EXPORT UnixDomainServerSocket : public ServerSocket {
  public:
   // Credentials of a peer process connected to the socket.
diff --git a/services/device/BUILD.gn b/services/device/BUILD.gn
index 3783fed..e261f598 100644
--- a/services/device/BUILD.gn
+++ b/services/device/BUILD.gn
@@ -19,6 +19,7 @@
     "//base",
     "//services/device/fingerprint",
     "//services/device/power_monitor",
+    "//services/device/screen_orientation",
     "//services/device/time_zone_monitor",
     "//services/service_manager/public/cpp",
   ]
@@ -61,9 +62,13 @@
 
 if (is_android) {
   android_library("java") {
-    java_files = [ "time_zone_monitor/android/java/src/org/chromium/device/time_zone_monitor/TimeZoneMonitor.java" ]
+    java_files = [
+      "screen_orientation/android/java/src/org/chromium/device/screen_orientation/ScreenOrientationListener.java",
+      "time_zone_monitor/android/java/src/org/chromium/device/time_zone_monitor/TimeZoneMonitor.java",
+    ]
     deps = [
       "//base:base_java",
+      "//ui/android:ui_java",
     ]
   }
 }
diff --git a/services/device/device_service.cc b/services/device/device_service.cc
index 0044460..f9bd085 100644
--- a/services/device/device_service.cc
+++ b/services/device/device_service.cc
@@ -7,6 +7,7 @@
 #include "base/bind.h"
 #include "base/memory/ptr_util.h"
 #include "base/memory/weak_ptr.h"
+#include "base/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "services/device/fingerprint/fingerprint.h"
 #include "services/device/power_monitor/power_monitor_message_broadcaster.h"
@@ -16,12 +17,14 @@
 
 #if defined(OS_ANDROID)
 #include "services/device/android/register_jni.h"
+#include "services/device/screen_orientation/screen_orientation_listener_android.h"
 #endif
 
 namespace device {
 
 std::unique_ptr<service_manager::Service> CreateDeviceService(
-    scoped_refptr<base::SingleThreadTaskRunner> file_task_runner) {
+    scoped_refptr<base::SingleThreadTaskRunner> file_task_runner,
+    scoped_refptr<base::SingleThreadTaskRunner> io_task_runner) {
 #if defined(OS_ANDROID)
   if (!EnsureJniRegistered()) {
     DLOG(ERROR) << "Failed to register JNI for Device Service";
@@ -29,12 +32,15 @@
   }
 #endif
 
-  return base::MakeUnique<DeviceService>(std::move(file_task_runner));
+  return base::MakeUnique<DeviceService>(std::move(file_task_runner),
+                                         std::move(io_task_runner));
 }
 
 DeviceService::DeviceService(
-    scoped_refptr<base::SingleThreadTaskRunner> file_task_runner)
-    : file_task_runner_(std::move(file_task_runner)) {}
+    scoped_refptr<base::SingleThreadTaskRunner> file_task_runner,
+    scoped_refptr<base::SingleThreadTaskRunner> io_task_runner)
+    : file_task_runner_(std::move(file_task_runner)),
+      io_task_runner_(std::move(io_task_runner)) {}
 
 DeviceService::~DeviceService() {}
 
@@ -44,7 +50,9 @@
                               service_manager::InterfaceRegistry* registry) {
   registry->AddInterface<mojom::Fingerprint>(this);
   registry->AddInterface<mojom::PowerMonitor>(this);
+  registry->AddInterface<mojom::ScreenOrientationListener>(this);
   registry->AddInterface<mojom::TimeZoneMonitor>(this);
+
   return true;
 }
 
@@ -63,9 +71,20 @@
 }
 
 void DeviceService::Create(const service_manager::Identity& remote_identity,
+                           mojom::ScreenOrientationListenerRequest request) {
+#if defined(OS_ANDROID)
+  if (io_task_runner_) {
+    io_task_runner_->PostTask(
+        FROM_HERE, base::Bind(&ScreenOrientationListenerAndroid::Create,
+                              base::Passed(&request)));
+  }
+#endif
+}
+
+void DeviceService::Create(const service_manager::Identity& remote_identity,
                            mojom::TimeZoneMonitorRequest request) {
   if (!time_zone_monitor_)
-    time_zone_monitor_ = device::TimeZoneMonitor::Create(file_task_runner_);
+    time_zone_monitor_ = TimeZoneMonitor::Create(file_task_runner_);
   time_zone_monitor_->Bind(std::move(request));
 }
 
diff --git a/services/device/device_service.h b/services/device/device_service.h
index 69f3283..a86caa55 100644
--- a/services/device/device_service.h
+++ b/services/device/device_service.h
@@ -6,28 +6,36 @@
 #define SERVICES_DEVICE_DEVICE_SERVICE_H_
 
 #include "base/memory/ref_counted.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
+#include "device/screen_orientation/public/interfaces/screen_orientation.mojom.h"
 #include "services/device/public/interfaces/fingerprint.mojom.h"
 #include "services/device/public/interfaces/power_monitor.mojom.h"
 #include "services/device/public/interfaces/time_zone_monitor.mojom.h"
 #include "services/service_manager/public/cpp/interface_factory.h"
 #include "services/service_manager/public/cpp/service.h"
 
+namespace base {
+class SingleThreadTaskRunner;
+}
+
 namespace device {
 
 class PowerMonitorMessageBroadcaster;
 class TimeZoneMonitor;
 
 std::unique_ptr<service_manager::Service> CreateDeviceService(
-    scoped_refptr<base::SingleThreadTaskRunner> file_task_runner);
+    scoped_refptr<base::SingleThreadTaskRunner> file_task_runner,
+    scoped_refptr<base::SingleThreadTaskRunner> io_task_runner);
 
 class DeviceService
     : public service_manager::Service,
       public service_manager::InterfaceFactory<mojom::Fingerprint>,
       public service_manager::InterfaceFactory<mojom::PowerMonitor>,
+      public service_manager::InterfaceFactory<
+          mojom::ScreenOrientationListener>,
       public service_manager::InterfaceFactory<mojom::TimeZoneMonitor> {
  public:
-  DeviceService(scoped_refptr<base::SingleThreadTaskRunner> file_task_runner);
+  DeviceService(scoped_refptr<base::SingleThreadTaskRunner> file_task_runner,
+                scoped_refptr<base::SingleThreadTaskRunner> io_task_runner);
   ~DeviceService() override;
 
  private:
@@ -44,15 +52,20 @@
   void Create(const service_manager::Identity& remote_identity,
               mojom::PowerMonitorRequest request) override;
 
+  // InterfaceFactory<mojom::ScreenOrientationListener>:
+  void Create(const service_manager::Identity& remote_identity,
+              mojom::ScreenOrientationListenerRequest request) override;
+
   // InterfaceFactory<mojom::TimeZoneMonitor>:
   void Create(const service_manager::Identity& remote_identity,
               mojom::TimeZoneMonitorRequest request) override;
 
-  std::unique_ptr<device::PowerMonitorMessageBroadcaster>
+  std::unique_ptr<PowerMonitorMessageBroadcaster>
       power_monitor_message_broadcaster_;
-  std::unique_ptr<device::TimeZoneMonitor> time_zone_monitor_;
+  std::unique_ptr<TimeZoneMonitor> time_zone_monitor_;
 
   scoped_refptr<base::SingleThreadTaskRunner> file_task_runner_;
+  scoped_refptr<base::SingleThreadTaskRunner> io_task_runner_;
 
   DISALLOW_COPY_AND_ASSIGN(DeviceService);
 };
diff --git a/services/device/manifest.json b/services/device/manifest.json
index 0ec13e5..28b91404 100644
--- a/services/device/manifest.json
+++ b/services/device/manifest.json
@@ -5,6 +5,7 @@
     "service_manager:connector": {
       "provides": {
         "device:power_monitor": [ "device::mojom::PowerMonitor" ],
+        "device:screen_orientation": [ "device::mojom::ScreenOrientationListener" ],
         "device:time_zone_monitor": [ "device::mojom::TimeZoneMonitor" ],
 	"device:fingerprint": [ "device::mojom::Fingerprint" ]
       },
diff --git a/services/device/screen_orientation/BUILD.gn b/services/device/screen_orientation/BUILD.gn
new file mode 100644
index 0000000..be91f8d
--- /dev/null
+++ b/services/device/screen_orientation/BUILD.gn
@@ -0,0 +1,41 @@
+# Copyright 2017 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//build/config/features.gni")
+
+if (is_android) {
+  import("//build/config/android/rules.gni")  # For generate_jni().
+}
+
+source_set("screen_orientation") {
+  visibility = [ "//services/device:lib" ]
+
+  sources = [
+    "screen_orientation_listener_android.cc",
+    "screen_orientation_listener_android.h",
+  ]
+
+  deps = [
+    "//base",
+    "//mojo/public/cpp/bindings",
+  ]
+
+  public_deps = [
+    "//device/screen_orientation/public/interfaces",
+  ]
+
+  if (is_android) {
+    deps += [ ":screen_orientation_jni_headers" ]
+  }
+}
+
+if (is_android) {
+  generate_jni("screen_orientation_jni_headers") {
+    visibility = [ ":screen_orientation" ]
+    sources = [
+      "android/java/src/org/chromium/device/screen_orientation/ScreenOrientationListener.java",
+    ]
+    jni_package = "screen_orientation"
+  }
+}
diff --git a/services/device/screen_orientation/DEPS b/services/device/screen_orientation/DEPS
new file mode 100644
index 0000000..dbaf051
--- /dev/null
+++ b/services/device/screen_orientation/DEPS
@@ -0,0 +1,4 @@
+include_rules = [
+  "+jni",
+  "+mojo/public/cpp/bindings",
+]
diff --git a/services/device/screen_orientation/OWNERS b/services/device/screen_orientation/OWNERS
new file mode 100644
index 0000000..88b3579
--- /dev/null
+++ b/services/device/screen_orientation/OWNERS
@@ -0,0 +1,2 @@
+blundell@chromium.org
+mlamouri@chromium.org
diff --git a/services/device/screen_orientation/android/java/DEPS b/services/device/screen_orientation/android/java/DEPS
new file mode 100644
index 0000000..05f395ef
--- /dev/null
+++ b/services/device/screen_orientation/android/java/DEPS
@@ -0,0 +1,3 @@
+include_rules = [
+  "+ui/android/java",
+]
diff --git a/services/device/screen_orientation/android/java/src/org/chromium/device/screen_orientation/ScreenOrientationListener.java b/services/device/screen_orientation/android/java/src/org/chromium/device/screen_orientation/ScreenOrientationListener.java
new file mode 100644
index 0000000..6d878a98
--- /dev/null
+++ b/services/device/screen_orientation/android/java/src/org/chromium/device/screen_orientation/ScreenOrientationListener.java
@@ -0,0 +1,36 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.device.screen_orientation;
+
+import org.chromium.base.ThreadUtils;
+import org.chromium.base.annotations.CalledByNative;
+import org.chromium.base.annotations.JNINamespace;
+import org.chromium.ui.display.DisplayAndroid;
+
+/**
+ * Android implementation details for device::ScreenOrientationListenerAndroid.
+ */
+@JNINamespace("device")
+class ScreenOrientationListener {
+    @CalledByNative
+    static void startAccurateListening() {
+        ThreadUtils.runOnUiThread(new Runnable() {
+            @Override
+            public void run() {
+                DisplayAndroid.startAccurateListening();
+            }
+        });
+    }
+
+    @CalledByNative
+    static void stopAccurateListening() {
+        ThreadUtils.runOnUiThread(new Runnable() {
+            @Override
+            public void run() {
+                DisplayAndroid.stopAccurateListening();
+            }
+        });
+    }
+}
diff --git a/services/device/screen_orientation/screen_orientation_listener_android.cc b/services/device/screen_orientation/screen_orientation_listener_android.cc
new file mode 100644
index 0000000..0c863d8
--- /dev/null
+++ b/services/device/screen_orientation/screen_orientation_listener_android.cc
@@ -0,0 +1,58 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "services/device/screen_orientation/screen_orientation_listener_android.h"
+
+#include "base/android/jni_android.h"
+#include "base/message_loop/message_loop.h"
+#include "jni/ScreenOrientationListener_jni.h"
+#include "mojo/public/cpp/bindings/strong_binding.h"
+
+namespace device {
+
+// static
+void ScreenOrientationListenerAndroid::Create(
+    mojom::ScreenOrientationListenerRequest request) {
+  mojo::MakeStrongBinding(
+      base::WrapUnique(new ScreenOrientationListenerAndroid()),
+      std::move(request));
+}
+
+ScreenOrientationListenerAndroid::ScreenOrientationListenerAndroid()
+    : listeners_count_(0) {}
+
+ScreenOrientationListenerAndroid::~ScreenOrientationListenerAndroid() {
+  DCHECK(base::MessageLoopForIO::IsCurrent());
+  if (listeners_count_ > 0) {
+    Java_ScreenOrientationListener_startAccurateListening(
+        base::android::AttachCurrentThread());
+  }
+}
+
+void ScreenOrientationListenerAndroid::Start() {
+  DCHECK(base::MessageLoopForIO::IsCurrent());
+  ++listeners_count_;
+  if (listeners_count_ == 1) {
+    // Ask the ScreenOrientationListener (Java) to start accurately listening to
+    // the screen orientation. It keep track of the number of start request if
+    // it is already running an accurate listening.
+    Java_ScreenOrientationListener_startAccurateListening(
+        base::android::AttachCurrentThread());
+  }
+}
+
+void ScreenOrientationListenerAndroid::Stop() {
+  DCHECK(base::MessageLoopForIO::IsCurrent());
+  DCHECK(listeners_count_ > 0);
+  --listeners_count_;
+  if (listeners_count_ == 0) {
+    // Ask the ScreenOrientationListener (Java) to stop accurately listening to
+    // the screen orientation. It will actually stop only if the number of stop
+    // requests matches the number of start requests.
+    Java_ScreenOrientationListener_stopAccurateListening(
+        base::android::AttachCurrentThread());
+  }
+}
+
+}  // namespace device
diff --git a/services/device/screen_orientation/screen_orientation_listener_android.h b/services/device/screen_orientation/screen_orientation_listener_android.h
new file mode 100644
index 0000000..4df873a
--- /dev/null
+++ b/services/device/screen_orientation/screen_orientation_listener_android.h
@@ -0,0 +1,34 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef SERVICES_DEVICE_SCREEN_ORIENTATION_SCREEN_ORIENTATION_LISTENER_ANDROID_H_
+#define SERVICES_DEVICE_SCREEN_ORIENTATION_SCREEN_ORIENTATION_LISTENER_ANDROID_H_
+
+#include "base/macros.h"
+#include "device/screen_orientation/public/interfaces/screen_orientation.mojom.h"
+
+namespace device {
+
+class ScreenOrientationListenerAndroid
+    : public mojom::ScreenOrientationListener {
+ public:
+  static void Create(mojom::ScreenOrientationListenerRequest request);
+
+  ~ScreenOrientationListenerAndroid() override;
+
+ private:
+  ScreenOrientationListenerAndroid();
+
+  // mojom::ScreenOrientationListener:
+  void Start() override;
+  void Stop() override;
+
+  int listeners_count_;
+
+  DISALLOW_COPY_AND_ASSIGN(ScreenOrientationListenerAndroid);
+};
+
+}  // namespace device
+
+#endif  // SERVICES_DEVICE_SCREEN_ORIENTATION_SCREEN_ORIENTATION_LISTENER_ANDROID_H_
diff --git a/third_party/WebKit/LayoutTests/FlagExpectations/enable-slimming-paint-v2 b/third_party/WebKit/LayoutTests/FlagExpectations/enable-slimming-paint-v2
index 0c37b7d..7aaed15 100644
--- a/third_party/WebKit/LayoutTests/FlagExpectations/enable-slimming-paint-v2
+++ b/third_party/WebKit/LayoutTests/FlagExpectations/enable-slimming-paint-v2
@@ -3,7 +3,6 @@
 # We are focused on fast/, compositing/, and svg/ with all other directories skipped (for now).
 
 Bug(none) accessibility/ [ Skip ]
-Bug(none) animations/ [ Skip ]
 Bug(none) app_banner/ [ Skip ]
 Bug(none) battery-status/ [ Skip ]
 Bug(none) bindings/ [ Skip ]
@@ -66,7 +65,6 @@
 Bug(none) third_party/ [ Skip ]
 Bug(none) touchadjustment/ [ Skip ]
 Bug(none) transforms/ [ Skip ]
-Bug(none) transitions/ [ Skip ]
 Bug(none) traversal/ [ Skip ]
 Bug(none) typedcssom/ [ Skip ]
 Bug(none) usb/ [ Skip ]
@@ -1412,16 +1410,13 @@
 Bug(none) compositing/overflow/do-not-paint-outline-into-composited-scrolling-contents.html [ Failure ]
 
 # Some work remains to fully support composited animation and scrolling.
+crbug.com/674317 transitions/opacity-transform-transitions-inside-iframe.html [ Timeout ]
+crbug.com/674317 transitions/transition-end-event-destroy-iframe.html [ Timeout ]
 crbug.com/674317 virtual/threaded/animations/composited-filter-webkit-filter.html [ Failure ]
 crbug.com/674317 virtual/threaded/animations/compositor-independent-transform-cancel.html [ Failure ]
 crbug.com/692310 virtual/threaded/animations/sample-on-last-keyframe.html [ Timeout ]
 crbug.com/674317 virtual/threaded/animations/skew-notsequential-compositor.html [ Failure ]
 crbug.com/674317 virtual/threaded/animations/zoom-responsive-transform-animation.html [ Timeout ]
-crbug.com/674317 virtual/threaded/fast/scroll-behavior/first-scroll-runs-on-compositor.html [ Timeout ]
-crbug.com/674317 virtual/threaded/fast/scroll-behavior/smooth-scroll/fixed-background-in-iframe.html [ Crash Failure ]
-crbug.com/674317 virtual/threaded/fast/scroll-behavior/smooth-scroll/main-thread-scrolling-reason-added.html [ Timeout ]
-crbug.com/674317 virtual/threaded/fast/scroll-behavior/smooth-scroll/main-thread-scrolling-reason-correctness.html [ Timeout ]
-crbug.com/674317 virtual/threaded/fast/scroll-behavior/smooth-scroll/mousewheel-scroll-interrupted.html [ Timeout ]
 crbug.com/674317 virtual/threaded/transitions/extra-transition.html [ Timeout ]
 crbug.com/674317 virtual/threaded/transitions/opacity-transform-transitions-inside-iframe.html [ Timeout ]
 crbug.com/674317 virtual/threaded/transitions/opacity-transition-zindex.html [ Timeout ]
diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index 378757b..ccaa8063 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations
@@ -2976,3 +2976,6 @@
 
 # Sheriff failures 2017-03-13
 crbug.com/701140 inspector-protocol/css/css-get-rule-list.html [ Failure Pass ]
+
+crbug.com/349985 [ Win7 ] fast/table/border-collapsing/001-vertical.html [ NeedsRebaseline ]
+crbug.com/349985 [ Win7 ] fast/table/border-collapsing/001.html [ NeedsRebaseline ]
diff --git a/third_party/WebKit/LayoutTests/fast/css/fontface-cssText.html b/third_party/WebKit/LayoutTests/fast/css/fontface-cssText.html
new file mode 100644
index 0000000..57e89ea
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/css/fontface-cssText.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<style>
+@font-face {
+  font-family: 'Ahem';
+  src: url(../../resources/Ahem.ttf);
+  font-style: italic;
+  font-weight: 300;
+  unicode-range: U+0-3FF;
+  font-variant: small-caps;
+  font-display: block;
+  font-stretch: expanded;
+}
+</style>
+<script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharnessreport.js"></script>
+<script>
+test(() => {
+  var fontFace = document.styleSheets[0].rules[0];
+  assert_true(fontFace instanceof CSSFontFaceRule);
+  var cssText = 'font-family: Ahem; src: url("../../resources/Ahem.ttf"); font-style: italic; font-weight: 300; unicode-range: U+0-3FF; font-variant: small-caps; font-display: block; font-stretch: expanded;';
+  assert_equals(fontFace.cssText, '@font-face { ' + cssText + ' }', 'Rule cssText');
+  assert_equals(fontFace.style.cssText, cssText, 'style cssText');
+}, 'Calling cssText() on an @font-face rule serializes the contents.');
+</script>
diff --git a/third_party/WebKit/Source/build/scripts/templates/CSSPropertyMetadata.cpp.tmpl b/third_party/WebKit/Source/build/scripts/templates/CSSPropertyMetadata.cpp.tmpl
index 299bbcd..d834f54 100644
--- a/third_party/WebKit/Source/build/scripts/templates/CSSPropertyMetadata.cpp.tmpl
+++ b/third_party/WebKit/Source/build/scripts/templates/CSSPropertyMetadata.cpp.tmpl
@@ -17,9 +17,12 @@
     {% for property in properties_including_aliases if property[flag] %}
     case {{property.property_id}}:
     {% endfor %}
-    {% if function_name == "isInheritedProperty" %}
+    {% if function_name in ("isInheritedProperty", "isProperty") %}
     case CSSPropertyVariable:
     {% endif %}
+    {% if function_name == "isProperty" %}
+    case CSSPropertyApplyAtRule:
+    {% endif %}
       return true;
     default:
       return false;
diff --git a/third_party/WebKit/Source/core/css/CSSValue.h b/third_party/WebKit/Source/core/css/CSSValue.h
index 8ac3077e..015cdb1 100644
--- a/third_party/WebKit/Source/core/css/CSSValue.h
+++ b/third_party/WebKit/Source/core/css/CSSValue.h
@@ -40,7 +40,7 @@
   static void* allocateObject(size_t size, bool isEager) {
     ThreadState* state =
         ThreadStateFor<ThreadingTrait<CSSValue>::Affinity>::state();
-    const char typeName[] = "blink::CSSValue";
+    const char* typeName = "blink::CSSValue";
     return ThreadHeap::allocateOnArenaIndex(
         state, size,
         isEager ? BlinkGC::EagerSweepArenaIndex : BlinkGC::CSSValueArenaIndex,
diff --git a/third_party/WebKit/Source/core/css/StylePropertySerializer.cpp b/third_party/WebKit/Source/core/css/StylePropertySerializer.cpp
index 7ad9a76..b27f99d 100644
--- a/third_party/WebKit/Source/core/css/StylePropertySerializer.cpp
+++ b/third_party/WebKit/Source/core/css/StylePropertySerializer.cpp
@@ -153,6 +153,12 @@
   return value.value();
 }
 
+bool StylePropertySerializer::StylePropertySetForSerializer::
+    isDescriptorContext() const {
+  return m_propertySet->cssParserMode() == CSSViewportRuleMode ||
+         m_propertySet->cssParserMode() == CSSFontFaceRuleMode;
+}
+
 StylePropertySerializer::StylePropertySerializer(
     const StylePropertySet& properties)
     : m_propertySet(properties) {}
@@ -220,10 +226,12 @@
     CSSPropertyID propertyID = property.id();
     // Only enabled properties should be part of the style.
     DCHECK(CSSPropertyMetadata::isEnabledProperty(propertyID));
-    // Shorthands with variable references are not expanded at parse time
-    // and hence may still be observed during serialization.
-    DCHECK(!isShorthandProperty(propertyID) ||
-           property.value()->isVariableReferenceValue());
+    // All shorthand properties should have been expanded at parse time.
+    DCHECK(m_propertySet.isDescriptorContext() ||
+           (CSSPropertyMetadata::isProperty(propertyID) &&
+            !isShorthandProperty(propertyID)));
+    DCHECK(!m_propertySet.isDescriptorContext() ||
+           CSSPropertyMetadata::isDescriptor(propertyID));
 
     switch (propertyID) {
       case CSSPropertyVariable:
diff --git a/third_party/WebKit/Source/core/css/StylePropertySerializer.h b/third_party/WebKit/Source/core/css/StylePropertySerializer.h
index baf4267..cf9d079 100644
--- a/third_party/WebKit/Source/core/css/StylePropertySerializer.h
+++ b/third_party/WebKit/Source/core/css/StylePropertySerializer.h
@@ -122,6 +122,7 @@
     bool shouldProcessPropertyAt(unsigned index) const;
     int findPropertyIndex(CSSPropertyID) const;
     const CSSValue* getPropertyCSSValue(CSSPropertyID) const;
+    bool isDescriptorContext() const;
 
     DECLARE_TRACE();
 
diff --git a/third_party/WebKit/Source/core/dom/Node.h b/third_party/WebKit/Source/core/dom/Node.h
index 48be800b..870742f 100644
--- a/third_party/WebKit/Source/core/dom/Node.h
+++ b/third_party/WebKit/Source/core/dom/Node.h
@@ -164,7 +164,7 @@
   static void* allocateObject(size_t size, bool isEager) {
     ThreadState* state =
         ThreadStateFor<ThreadingTrait<Node>::Affinity>::state();
-    const char typeName[] = "blink::Node";
+    const char* typeName = "blink::Node";
     return ThreadHeap::allocateOnArenaIndex(
         state, size,
         isEager ? BlinkGC::EagerSweepArenaIndex : BlinkGC::NodeArenaIndex,
diff --git a/third_party/WebKit/Source/core/editing/VisibleSelection.cpp b/third_party/WebKit/Source/core/editing/VisibleSelection.cpp
index 0fe46f85..16e1ebd7 100644
--- a/third_party/WebKit/Source/core/editing/VisibleSelection.cpp
+++ b/third_party/WebKit/Source/core/editing/VisibleSelection.cpp
@@ -182,7 +182,7 @@
 template <typename Strategy>
 static EphemeralRangeTemplate<Strategy> makeSearchRange(
     const PositionTemplate<Strategy>& pos) {
-  Node* node = pos.anchorNode();
+  Node* node = pos.computeContainerNode();
   if (!node)
     return EphemeralRangeTemplate<Strategy>();
   Document& document = node->document();
diff --git a/third_party/WebKit/Source/core/editing/VisibleSelectionTest.cpp b/third_party/WebKit/Source/core/editing/VisibleSelectionTest.cpp
index e0c1ebcc..4dfa9fd4 100644
--- a/third_party/WebKit/Source/core/editing/VisibleSelectionTest.cpp
+++ b/third_party/WebKit/Source/core/editing/VisibleSelectionTest.cpp
@@ -70,6 +70,29 @@
           .build());
 }
 
+// For http://crbug.com/700368
+TEST_F(VisibleSelectionTest, appendTrailingWhitespaceWithAfterAnchor) {
+  setBodyContent(
+      "<input type=checkbox>"
+      "<div style='user-select:none'>abc</div>");
+  Element* const input = document().querySelector("input");
+
+  // Simulate double-clicking "abc".
+  // TODO(editing-dev): We should remove above comment once we fix [1].
+  // [1] http://crbug.com/701657 double-click on user-select:none should not
+  // compute selection.
+  VisibleSelection selection =
+      createVisibleSelection(SelectionInDOMTree::Builder()
+                                 .collapse(Position::beforeNode(input))
+                                 .extend(Position::afterNode(input))
+                                 .setGranularity(WordGranularity)
+                                 .build());
+  selection.appendTrailingWhitespace();
+
+  EXPECT_EQ(Position::beforeNode(input), selection.start());
+  EXPECT_EQ(Position::afterNode(input), selection.end());
+}
+
 TEST_F(VisibleSelectionTest, expandUsingGranularity) {
   const char* bodyContent =
       "<span id=host><a id=one>1</a><a id=two>22</a></span>";
diff --git a/third_party/WebKit/Source/core/frame/FrameHost.cpp b/third_party/WebKit/Source/core/frame/FrameHost.cpp
index 079454a..226ca913 100644
--- a/third_party/WebKit/Source/core/frame/FrameHost.cpp
+++ b/third_party/WebKit/Source/core/frame/FrameHost.cpp
@@ -44,9 +44,6 @@
 
 FrameHost::FrameHost(Page& page)
     : m_page(&page),
-      m_overscrollController(
-          OverscrollController::create(m_page->visualViewport(),
-                                       m_page->chromeClient())),
       m_subframeCount(0) {}
 
 // Explicitly in the .cpp to avoid default constructor in .h
@@ -69,11 +66,11 @@
 }
 
 OverscrollController& FrameHost::overscrollController() {
-  return *m_overscrollController;
+  return page().overscrollController();
 }
 
 const OverscrollController& FrameHost::overscrollController() const {
-  return *m_overscrollController;
+  return page().overscrollController();
 }
 
 ConsoleMessageStorage& FrameHost::consoleMessageStorage() {
@@ -86,7 +83,6 @@
 
 DEFINE_TRACE(FrameHost) {
   visitor->trace(m_page);
-  visitor->trace(m_overscrollController);
 }
 
 #if DCHECK_IS_ON()
diff --git a/third_party/WebKit/Source/core/frame/FrameHost.h b/third_party/WebKit/Source/core/frame/FrameHost.h
index 24a1bb8..593a01da 100644
--- a/third_party/WebKit/Source/core/frame/FrameHost.h
+++ b/third_party/WebKit/Source/core/frame/FrameHost.h
@@ -93,7 +93,6 @@
   explicit FrameHost(Page&);
 
   const Member<Page> m_page;
-  const Member<OverscrollController> m_overscrollController;
 
   int m_subframeCount;
 };
diff --git a/third_party/WebKit/Source/core/input/KeyboardEventManager.cpp b/third_party/WebKit/Source/core/input/KeyboardEventManager.cpp
index 72f23ef..f45894a8 100644
--- a/third_party/WebKit/Source/core/input/KeyboardEventManager.cpp
+++ b/third_party/WebKit/Source/core/input/KeyboardEventManager.cpp
@@ -437,7 +437,8 @@
 #elif OS(MACOSX)
       return GetCurrentKeyModifiers() & alphaLock;
 #else
-      NOTIMPLEMENTED();
+      // Caps lock state use is limited to Mac password input
+      // fields, so just return false. See http://crbug.com/618739.
       return false;
 #endif
     case OverrideCapsLockState::On:
diff --git a/third_party/WebKit/Source/core/loader/FrameLoader.cpp b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
index fd31c7bb..180f731 100644
--- a/third_party/WebKit/Source/core/loader/FrameLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
@@ -676,7 +676,7 @@
     return false;
   if (!document->haveImportsLoaded())
     return false;
-  if (document->fetcher()->requestCount())
+  if (document->fetcher()->blockingRequestCount())
     return false;
   if (document->isDelayingLoadEvent())
     return false;
diff --git a/third_party/WebKit/Source/core/page/FocusController.cpp b/third_party/WebKit/Source/core/page/FocusController.cpp
index 110d8bf1..0b5aa333 100644
--- a/third_party/WebKit/Source/core/page/FocusController.cpp
+++ b/third_party/WebKit/Source/core/page/FocusController.cpp
@@ -1161,11 +1161,15 @@
 
   Frame* frame = focusedOrMainFrame();
   if (frame->isLocalFrame()) {
+    Document* const document =
+        toLocalFrame(frame)->localFrameRoot()->document();
+    DCHECK(document);
+    if (!document->isActive())
+      return;
     // Invalidate all custom scrollbars because they support the CSS
     // window-active attribute. This should be applied to the entire page so
     // we invalidate from the root FrameView instead of just the focused.
-    if (FrameView* view =
-            toLocalFrame(frame)->localFrameRoot()->document()->view())
+    if (FrameView* view = document->view())
       view->invalidateAllCustomScrollbarsOnActiveChanged();
     toLocalFrame(frame)->selection().pageActivationChanged();
   }
diff --git a/third_party/WebKit/Source/core/page/FocusControllerTest.cpp b/third_party/WebKit/Source/core/page/FocusControllerTest.cpp
index c028829..2d5ec7b 100644
--- a/third_party/WebKit/Source/core/page/FocusControllerTest.cpp
+++ b/third_party/WebKit/Source/core/page/FocusControllerTest.cpp
@@ -18,6 +18,7 @@
   FocusController& focusController() const {
     return document().page()->focusController();
   }
+  DummyPageHolder* pageHolder() const { return m_pageHolder.get(); }
 
  private:
   void SetUp() override { m_pageHolder = DummyPageHolder::create(); }
@@ -83,4 +84,13 @@
       << "This should not hit assertion and finish properly.";
 }
 
+TEST_F(FocusControllerTest, SetActiveOnInactiveDocument) {
+  // Test for crbug.com/700334
+  document().shutdown();
+  // Document::shutdown() detaches document from its frame, and thus
+  // document().page() becomes nullptr.
+  // Use DummyPageHolder's page to retrieve FocusController.
+  pageHolder()->page().focusController().setActive(true);
+}
+
 }  // namespace blink
diff --git a/third_party/WebKit/Source/core/page/Page.cpp b/third_party/WebKit/Source/core/page/Page.cpp
index 77ab44c..c270afe 100644
--- a/third_party/WebKit/Source/core/page/Page.cpp
+++ b/third_party/WebKit/Source/core/page/Page.cpp
@@ -54,6 +54,7 @@
 #include "core/page/PointerLockController.h"
 #include "core/page/ScopedPageSuspender.h"
 #include "core/page/ValidationMessageClient.h"
+#include "core/page/scrolling/OverscrollController.h"
 #include "core/page/scrolling/ScrollingCoordinator.h"
 #include "core/page/scrolling/TopDocumentRootScrollerController.h"
 #include "core/paint/PaintLayer.h"
@@ -112,6 +113,8 @@
       m_globalRootScrollerController(
           TopDocumentRootScrollerController::create(*this)),
       m_visualViewport(VisualViewport::create(*this)),
+      m_overscrollController(
+          OverscrollController::create(visualViewport(), chromeClient())),
       m_mainFrame(nullptr),
       m_editorClient(pageClients.editorClient),
       m_spellCheckerClient(pageClients.spellCheckerClient),
@@ -206,6 +209,14 @@
   return *m_visualViewport;
 }
 
+OverscrollController& Page::overscrollController() {
+  return *m_overscrollController;
+}
+
+const OverscrollController& Page::overscrollController() const {
+  return *m_overscrollController;
+}
+
 ClientRectList* Page::nonFastScrollableRects(const LocalFrame* frame) {
   DisableCompositingQueryAsserts disabler;
   if (ScrollingCoordinator* scrollingCoordinator =
@@ -588,6 +599,7 @@
   visitor->trace(m_eventHandlerRegistry);
   visitor->trace(m_globalRootScrollerController);
   visitor->trace(m_visualViewport);
+  visitor->trace(m_overscrollController);
   visitor->trace(m_mainFrame);
   visitor->trace(m_validationMessageClient);
   visitor->trace(m_useCounter);
diff --git a/third_party/WebKit/Source/core/page/Page.h b/third_party/WebKit/Source/core/page/Page.h
index 97a9f8c..d427c88 100644
--- a/third_party/WebKit/Source/core/page/Page.h
+++ b/third_party/WebKit/Source/core/page/Page.h
@@ -60,6 +60,7 @@
 class FocusController;
 class Frame;
 class FrameHost;
+class OverscrollController;
 struct PageScaleConstraints;
 class PageScaleConstraintsSet;
 class PluginData;
@@ -204,6 +205,9 @@
   VisualViewport& visualViewport();
   const VisualViewport& visualViewport() const;
 
+  OverscrollController& overscrollController();
+  const OverscrollController& overscrollController() const;
+
   void setTabKeyCyclesThroughElements(bool b) {
     m_tabKeyCyclesThroughElements = b;
   }
@@ -295,6 +299,7 @@
   const Member<TopDocumentRootScrollerController>
       m_globalRootScrollerController;
   const Member<VisualViewport> m_visualViewport;
+  const Member<OverscrollController> m_overscrollController;
 
   // Typically, the main frame and Page should both be owned by the embedder,
   // which must call Page::willBeDestroyed() prior to destroying Page. This
diff --git a/third_party/WebKit/Source/core/paint/FirstMeaningfulPaintDetector.cpp b/third_party/WebKit/Source/core/paint/FirstMeaningfulPaintDetector.cpp
index 9fca413..5b75dec 100644
--- a/third_party/WebKit/Source/core/paint/FirstMeaningfulPaintDetector.cpp
+++ b/third_party/WebKit/Source/core/paint/FirstMeaningfulPaintDetector.cpp
@@ -7,6 +7,7 @@
 #include "core/css/FontFaceSet.h"
 #include "core/dom/TaskRunnerHelper.h"
 #include "core/paint/PaintTiming.h"
+#include "platform/Histogram.h"
 #include "platform/instrumentation/tracing/TraceEvent.h"
 #include "platform/loader/fetch/ResourceFetcher.h"
 
@@ -18,9 +19,10 @@
 // Meaningful Paint.
 const int kBlankCharactersThreshold = 200;
 
-// FirstMeaningfulPaintDetector stops observing layouts and reports First
-// Meaningful Paint when this duration passed from last network activity.
-const double kSecondsWithoutNetworkActivityThreshold = 0.5;
+// The page is n-quiet if there are no more than n active network requests for
+// this duration of time.
+const double kNetwork2QuietWindowSeconds = 3;
+const double kNetwork0QuietWindowSeconds = 0.5;
 
 }  // namespace
 
@@ -33,10 +35,14 @@
     PaintTiming* paintTiming,
     Document& document)
     : m_paintTiming(paintTiming),
-      m_networkStableTimer(
+      m_network0QuietTimer(
           TaskRunnerHelper::get(TaskType::UnspecedTimer, &document),
           this,
-          &FirstMeaningfulPaintDetector::networkStableTimerFired) {}
+          &FirstMeaningfulPaintDetector::network0QuietTimerFired),
+      m_network2QuietTimer(
+          TaskRunnerHelper::get(TaskType::UnspecedTimer, &document),
+          this,
+          &FirstMeaningfulPaintDetector::network2QuietTimerFired) {}
 
 Document* FirstMeaningfulPaintDetector::document() {
   return m_paintTiming->supplementable();
@@ -52,7 +58,7 @@
     int contentsHeightBeforeLayout,
     int contentsHeightAfterLayout,
     int visibleHeight) {
-  if (m_state == Reported)
+  if (m_network0QuietReached && m_network2QuietReached)
     return;
 
   unsigned delta = counter.count() - m_prevLayoutObjectCount;
@@ -77,14 +83,14 @@
     significance += m_accumulatedSignificanceWhileHavingBlankText;
     m_accumulatedSignificanceWhileHavingBlankText = 0;
     if (significance > m_maxSignificanceSoFar) {
-      m_state = NextPaintIsMeaningful;
+      m_nextPaintIsMeaningful = true;
       m_maxSignificanceSoFar = significance;
     }
   }
 }
 
 void FirstMeaningfulPaintDetector::notifyPaint() {
-  if (m_state != NextPaintIsMeaningful)
+  if (!m_nextPaintIsMeaningful)
     return;
 
   // Skip document background-only paints.
@@ -92,7 +98,10 @@
     return;
 
   m_provisionalFirstMeaningfulPaint = monotonicallyIncreasingTime();
-  m_state = NextPaintIsNotMeaningful;
+  m_nextPaintIsMeaningful = false;
+
+  if (m_network2QuietReached)
+    return;
 
   TRACE_EVENT_MARK_WITH_TIMESTAMP1(
       "loading", "firstMeaningfulPaintCandidate",
@@ -107,28 +116,110 @@
   m_paintTiming->markFirstMeaningfulPaintCandidate();
 }
 
-void FirstMeaningfulPaintDetector::checkNetworkStable() {
+int FirstMeaningfulPaintDetector::activeConnections() {
   DCHECK(document());
-  if (m_state == Reported || document()->fetcher()->hasPendingRequest())
-    return;
-
-  m_networkStableTimer.startOneShot(kSecondsWithoutNetworkActivityThreshold,
-                                    BLINK_FROM_HERE);
+  ResourceFetcher* fetcher = document()->fetcher();
+  return fetcher->blockingRequestCount() + fetcher->nonblockingRequestCount();
 }
 
-void FirstMeaningfulPaintDetector::networkStableTimerFired(TimerBase*) {
-  if (m_state == Reported || !document() ||
-      document()->fetcher()->hasPendingRequest() ||
+// This function is called when the number of active connections is decreased.
+void FirstMeaningfulPaintDetector::checkNetworkStable() {
+  DCHECK(document());
+  if (!document()->hasFinishedParsing())
+    return;
+
+  setNetworkQuietTimers(activeConnections());
+}
+
+void FirstMeaningfulPaintDetector::setNetworkQuietTimers(
+    int activeConnections) {
+  if (!m_network0QuietReached && activeConnections == 0) {
+    // This restarts 0-quiet timer if it's already running.
+    m_network0QuietTimer.startOneShot(kNetwork0QuietWindowSeconds,
+                                      BLINK_FROM_HERE);
+  }
+  if (!m_network2QuietReached && activeConnections <= 2) {
+    // If activeConnections < 2 and the timer is already running, current
+    // 2-quiet window continues; the timer shouldn't be restarted.
+    if (activeConnections == 2 || !m_network2QuietTimer.isActive()) {
+      m_network2QuietTimer.startOneShot(kNetwork2QuietWindowSeconds,
+                                        BLINK_FROM_HERE);
+    }
+  }
+}
+
+void FirstMeaningfulPaintDetector::network0QuietTimerFired(TimerBase*) {
+  if (!document() || m_network0QuietReached || activeConnections() > 0 ||
       !m_paintTiming->firstContentfulPaint())
     return;
+  m_network0QuietReached = true;
 
   if (m_provisionalFirstMeaningfulPaint) {
     // Enforce FirstContentfulPaint <= FirstMeaningfulPaint.
-    double timestamp = std::max(m_provisionalFirstMeaningfulPaint,
-                                m_paintTiming->firstContentfulPaint());
-    m_paintTiming->setFirstMeaningfulPaint(timestamp);
+    m_firstMeaningfulPaint0Quiet =
+        std::max(m_provisionalFirstMeaningfulPaint,
+                 m_paintTiming->firstContentfulPaint());
   }
-  m_state = Reported;
+  reportHistograms();
+}
+
+void FirstMeaningfulPaintDetector::network2QuietTimerFired(TimerBase*) {
+  if (!document() || m_network2QuietReached || activeConnections() > 2 ||
+      !m_paintTiming->firstContentfulPaint())
+    return;
+  m_network2QuietReached = true;
+
+  if (m_provisionalFirstMeaningfulPaint) {
+    // Enforce FirstContentfulPaint <= FirstMeaningfulPaint.
+    m_firstMeaningfulPaint2Quiet =
+        std::max(m_provisionalFirstMeaningfulPaint,
+                 m_paintTiming->firstContentfulPaint());
+    // Report FirstMeaningfulPaint when the page reached network 2-quiet.
+    m_paintTiming->setFirstMeaningfulPaint(m_firstMeaningfulPaint2Quiet);
+  }
+  reportHistograms();
+}
+
+void FirstMeaningfulPaintDetector::reportHistograms() {
+  // This enum backs an UMA histogram, and should be treated as append-only.
+  enum HadNetworkQuiet {
+    HadNetwork0Quiet,
+    HadNetwork2Quiet,
+    HadNetworkQuietEnumMax
+  };
+  DEFINE_STATIC_LOCAL(EnumerationHistogram, hadNetworkQuietHistogram,
+                      ("PageLoad.Experimental.Renderer."
+                       "FirstMeaningfulPaintDetector.HadNetworkQuiet",
+                       HadNetworkQuietEnumMax));
+
+  // This enum backs an UMA histogram, and should be treated as append-only.
+  enum FMPOrderingEnum {
+    FMP0QuietFirst,
+    FMP2QuietFirst,
+    FMP0QuietEqualFMP2Quiet,
+    FMPOrderingEnumMax
+  };
+  DEFINE_STATIC_LOCAL(
+      EnumerationHistogram, firstMeaningfulPaintOrderingHistogram,
+      ("PageLoad.Experimental.Renderer.FirstMeaningfulPaintDetector."
+       "FirstMeaningfulPaintOrdering",
+       FMPOrderingEnumMax));
+
+  if (m_firstMeaningfulPaint0Quiet && m_firstMeaningfulPaint2Quiet) {
+    int sample;
+    if (m_firstMeaningfulPaint2Quiet < m_firstMeaningfulPaint0Quiet) {
+      sample = FMP0QuietFirst;
+    } else if (m_firstMeaningfulPaint2Quiet > m_firstMeaningfulPaint0Quiet) {
+      sample = FMP2QuietFirst;
+    } else {
+      sample = FMP0QuietEqualFMP2Quiet;
+    }
+    firstMeaningfulPaintOrderingHistogram.count(sample);
+  } else if (m_firstMeaningfulPaint0Quiet) {
+    hadNetworkQuietHistogram.count(HadNetwork0Quiet);
+  } else if (m_firstMeaningfulPaint2Quiet) {
+    hadNetworkQuietHistogram.count(HadNetwork2Quiet);
+  }
 }
 
 DEFINE_TRACE(FirstMeaningfulPaintDetector) {
diff --git a/third_party/WebKit/Source/core/paint/FirstMeaningfulPaintDetector.h b/third_party/WebKit/Source/core/paint/FirstMeaningfulPaintDetector.h
index 6053c29..c04d9da 100644
--- a/third_party/WebKit/Source/core/paint/FirstMeaningfulPaintDetector.h
+++ b/third_party/WebKit/Source/core/paint/FirstMeaningfulPaintDetector.h
@@ -54,10 +54,13 @@
   friend class FirstMeaningfulPaintDetectorTest;
 
   Document* document();
-  void networkStableTimerFired(TimerBase*);
+  int activeConnections();
+  void setNetworkQuietTimers(int activeConnections);
+  void network0QuietTimerFired(TimerBase*);
+  void network2QuietTimerFired(TimerBase*);
+  void reportHistograms();
 
-  enum State { NextPaintIsNotMeaningful, NextPaintIsMeaningful, Reported };
-  State m_state = NextPaintIsNotMeaningful;
+  bool m_nextPaintIsMeaningful = false;
 
   Member<PaintTiming> m_paintTiming;
   double m_provisionalFirstMeaningfulPaint = 0.0;
@@ -65,7 +68,12 @@
   double m_accumulatedSignificanceWhileHavingBlankText = 0.0;
   unsigned m_prevLayoutObjectCount = 0;
   bool m_seenFirstMeaningfulPaintCandidate = false;
-  TaskRunnerTimer<FirstMeaningfulPaintDetector> m_networkStableTimer;
+  bool m_network0QuietReached = false;
+  bool m_network2QuietReached = false;
+  double m_firstMeaningfulPaint0Quiet = 0.0;
+  double m_firstMeaningfulPaint2Quiet = 0.0;
+  TaskRunnerTimer<FirstMeaningfulPaintDetector> m_network0QuietTimer;
+  TaskRunnerTimer<FirstMeaningfulPaintDetector> m_network2QuietTimer;
 };
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/core/paint/FirstMeaningfulPaintDetectorTest.cpp b/third_party/WebKit/Source/core/paint/FirstMeaningfulPaintDetectorTest.cpp
index b5ee403..49236227 100644
--- a/third_party/WebKit/Source/core/paint/FirstMeaningfulPaintDetectorTest.cpp
+++ b/third_party/WebKit/Source/core/paint/FirstMeaningfulPaintDetectorTest.cpp
@@ -6,6 +6,7 @@
 
 #include "core/paint/PaintTiming.h"
 #include "core/testing/DummyPageHolder.h"
+#include "platform/scheduler/test/fake_web_task_runner.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/text/StringBuilder.h"
 
@@ -17,6 +18,9 @@
     m_dummyPageHolder = DummyPageHolder::create(IntSize(800, 600));
     s_timeElapsed = 0.0;
     m_originalTimeFunction = setTimeFunctionsForTesting(returnMockTime);
+    m_taskRunner = adoptRef(new scheduler::FakeWebTaskRunner);
+    detector().m_network0QuietTimer.moveToNewTaskRunner(m_taskRunner);
+    detector().m_network2QuietTimer.moveToNewTaskRunner(m_taskRunner);
   }
 
   void TearDown() override {
@@ -38,7 +42,51 @@
     detector().notifyPaint();
   }
 
-  void simulateNetworkStable() { detector().networkStableTimerFired(nullptr); }
+  void simulateNetworkStable() {
+    document().setParsingState(Document::FinishedParsing);
+    detector().network0QuietTimerFired(nullptr);
+    detector().network2QuietTimerFired(nullptr);
+  }
+
+  void simulateNetwork0Quiet() {
+    document().setParsingState(Document::FinishedParsing);
+    detector().network0QuietTimerFired(nullptr);
+  }
+
+  void simulateNetwork2Quiet() {
+    document().setParsingState(Document::FinishedParsing);
+    detector().network2QuietTimerFired(nullptr);
+  }
+
+  void setActiveConnections(int connections) {
+    double time0 = 0.0;
+    double time2 = 0.0;
+    m_taskRunner->setTime(returnMockTime());
+    if (isNetwork0QuietTimerActive())
+      time0 = detector().m_network0QuietTimer.nextFireInterval();
+    if (isNetwork2QuietTimerActive())
+      time2 = detector().m_network2QuietTimer.nextFireInterval();
+
+    detector().setNetworkQuietTimers(connections);
+
+    m_0QuietTimerRestarted =
+        isNetwork0QuietTimerActive() &&
+        detector().m_network0QuietTimer.nextFireInterval() != time0;
+    m_2QuietTimerRestarted =
+        isNetwork2QuietTimerActive() &&
+        detector().m_network2QuietTimer.nextFireInterval() != time2;
+  }
+
+  bool isNetwork0QuietTimerActive() {
+    return detector().m_network0QuietTimer.isActive();
+  }
+
+  bool isNetwork2QuietTimerActive() {
+    return detector().m_network2QuietTimer.isActive();
+  }
+
+  bool isNetwork0QuietTimerRestarted() { return m_0QuietTimerRestarted; }
+  bool isNetwork2QuietTimerRestarted() { return m_2QuietTimerRestarted; }
 
  private:
   static double returnMockTime() {
@@ -47,7 +95,10 @@
   }
 
   std::unique_ptr<DummyPageHolder> m_dummyPageHolder;
+  RefPtr<scheduler::FakeWebTaskRunner> m_taskRunner;
   TimeFunction m_originalTimeFunction;
+  bool m_0QuietTimerRestarted;
+  bool m_2QuietTimerRestarted;
   static double s_timeElapsed;
 };
 
@@ -127,4 +178,64 @@
             paintTiming().firstContentfulPaint());
 }
 
+TEST_F(FirstMeaningfulPaintDetectorTest, Network2QuietThen0Quiet) {
+  paintTiming().markFirstContentfulPaint();
+
+  simulateLayoutAndPaint(1);
+  double afterFirstPaint = monotonicallyIncreasingTime();
+  simulateNetwork2Quiet();
+
+  simulateLayoutAndPaint(10);
+  simulateNetwork0Quiet();
+
+  // The first paint is FirstMeaningfulPaint.
+  EXPECT_GT(paintTiming().firstMeaningfulPaint(), 0.0);
+  EXPECT_LT(paintTiming().firstMeaningfulPaint(), afterFirstPaint);
+}
+
+TEST_F(FirstMeaningfulPaintDetectorTest, Network0QuietThen2Quiet) {
+  paintTiming().markFirstContentfulPaint();
+
+  simulateLayoutAndPaint(1);
+  double afterFirstPaint = monotonicallyIncreasingTime();
+  simulateNetwork0Quiet();
+
+  simulateLayoutAndPaint(10);
+  double afterSecondPaint = monotonicallyIncreasingTime();
+  simulateNetwork2Quiet();
+
+  // The second paint is FirstMeaningfulPaint.
+  EXPECT_GT(paintTiming().firstMeaningfulPaint(), afterFirstPaint);
+  EXPECT_LT(paintTiming().firstMeaningfulPaint(), afterSecondPaint);
+}
+
+TEST_F(FirstMeaningfulPaintDetectorTest, NetworkQuietTimers) {
+  setActiveConnections(3);
+  EXPECT_FALSE(isNetwork0QuietTimerActive());
+  EXPECT_FALSE(isNetwork2QuietTimerActive());
+
+  setActiveConnections(2);
+  EXPECT_FALSE(isNetwork0QuietTimerActive());
+  EXPECT_TRUE(isNetwork2QuietTimerActive());
+
+  setActiveConnections(1);
+  EXPECT_FALSE(isNetwork0QuietTimerActive());
+  EXPECT_TRUE(isNetwork2QuietTimerActive());
+  EXPECT_FALSE(isNetwork2QuietTimerRestarted());
+
+  setActiveConnections(2);
+  EXPECT_TRUE(isNetwork2QuietTimerRestarted());
+
+  setActiveConnections(0);
+  EXPECT_TRUE(isNetwork0QuietTimerActive());
+  EXPECT_TRUE(isNetwork2QuietTimerActive());
+  EXPECT_FALSE(isNetwork2QuietTimerRestarted());
+
+  setActiveConnections(0);
+  EXPECT_TRUE(isNetwork0QuietTimerActive());
+  EXPECT_TRUE(isNetwork0QuietTimerRestarted());
+  EXPECT_TRUE(isNetwork2QuietTimerActive());
+  EXPECT_FALSE(isNetwork2QuietTimerRestarted());
+}
+
 }  // namespace blink
diff --git a/third_party/WebKit/Source/devtools/front_end/sources/FilteredUISourceCodeListProvider.js b/third_party/WebKit/Source/devtools/front_end/sources/FilteredUISourceCodeListProvider.js
index 038e8d8a..e16ddcd 100644
--- a/third_party/WebKit/Source/devtools/front_end/sources/FilteredUISourceCodeListProvider.js
+++ b/third_party/WebKit/Source/devtools/front_end/sources/FilteredUISourceCodeListProvider.js
@@ -122,6 +122,8 @@
     new Sources.FilePathScoreFunction(query).score(fullDisplayName, indexes);
     var fileNameIndex = fullDisplayName.lastIndexOf('/');
 
+    titleElement.classList.add('monospace');
+    subtitleElement.classList.add('monospace');
     titleElement.textContent = uiSourceCode.displayName() + (this._queryLineNumberAndColumnNumber || '');
     this._renderSubtitleElement(subtitleElement, fullDisplayName);
     subtitleElement.title = fullDisplayName;
diff --git a/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.cpp b/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.cpp
index 987e0fd..c9fb59c2 100644
--- a/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.cpp
+++ b/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.cpp
@@ -1054,12 +1054,12 @@
   m_context.clear();
 }
 
-int ResourceFetcher::requestCount() const {
+int ResourceFetcher::blockingRequestCount() const {
   return m_loaders.size();
 }
 
-bool ResourceFetcher::hasPendingRequest() const {
-  return m_loaders.size() > 0 || m_nonBlockingLoaders.size() > 0;
+int ResourceFetcher::nonblockingRequestCount() const {
+  return m_nonBlockingLoaders.size();
 }
 
 void ResourceFetcher::preloadStarted(Resource* resource) {
diff --git a/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.h b/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.h
index c4b83ef..424c52b3 100644
--- a/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.h
+++ b/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.h
@@ -93,8 +93,8 @@
   }
   void clearContext();
 
-  int requestCount() const;
-  bool hasPendingRequest() const;
+  int blockingRequestCount() const;
+  int nonblockingRequestCount() const;
 
   enum ClearPreloadsPolicy { ClearAllPreloads, ClearSpeculativeMarkupPreloads };
 
diff --git a/third_party/polymer/v1_0/chromium.patch b/third_party/polymer/v1_0/chromium.patch
index f9d5a15..8b99b23 100644
--- a/third_party/polymer/v1_0/chromium.patch
+++ b/third_party/polymer/v1_0/chromium.patch
@@ -9,3 +9,18 @@
 -<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:400,300,300italic,400italic,500,500italic,700,700italic">
 -<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto+Mono:400,700">
 +<link rel="stylesheet" href="chrome://resources/css/roboto.css">
+diff --git a/components-chromium/paper-input/paper-textarea-extracted.js b/components-chromium/paper-input/paper-textarea-extracted.js
+index 78a2a9ec621c..8b776dd790ea 100644
+--- a/components-chromium/paper-input/paper-textarea-extracted.js
++++ b/components-chromium/paper-input/paper-textarea-extracted.js
+@@ -43,8 +43,8 @@ Polymer({
+       }
+     },
+ 
+-    _ariaLabelledByChanged: function(ariaLabelledBy) {
+-      this.$.input.textarea.setAttribute('aria-labelledby', ariaLabelledBy);
++    _ariaLabelledByChanged: function() {
++      this.$.input.textarea.setAttribute('aria-label', this.label);
+     },
+ 
+     _ariaDescribedByChanged: function(ariaDescribedBy) {
diff --git a/third_party/polymer/v1_0/components-chromium/paper-input/paper-textarea-extracted.js b/third_party/polymer/v1_0/components-chromium/paper-input/paper-textarea-extracted.js
index 78a2a9e..49eeb91 100644
--- a/third_party/polymer/v1_0/components-chromium/paper-input/paper-textarea-extracted.js
+++ b/third_party/polymer/v1_0/components-chromium/paper-input/paper-textarea-extracted.js
@@ -43,8 +43,8 @@
       }
     },
 
-    _ariaLabelledByChanged: function(ariaLabelledBy) {
-      this.$.input.textarea.setAttribute('aria-labelledby', ariaLabelledBy);
+    _ariaLabelledByChanged: function() {
+      this.$.input.textarea.setAttribute('aria-label', this.label);
     },
 
     _ariaDescribedByChanged: function(ariaDescribedBy) {
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index feda2df..540d233 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -45463,6 +45463,30 @@
   </summary>
 </histogram>
 
+<histogram
+    name="PageLoad.Experimental.Renderer.FirstMeaningfulPaintDetector.FirstMeaningfulPaintOrdering"
+    enum="FirstMeaningfulPaintOrdering">
+  <owner>ksakamoto@chromium.org</owner>
+  <summary>
+    Whether the two variants of First Meaningful Paint reported different
+    values, and if so, which one was reported first.
+  </summary>
+</histogram>
+
+<histogram
+    name="PageLoad.Experimental.Renderer.FirstMeaningfulPaintDetector.HadNetworkQuiet"
+    enum="NetworkQuietStatus">
+  <owner>ksakamoto@chromium.org</owner>
+  <summary>
+    Recorded when the page load reached network 0-quiet (no active network
+    connection for 0.5 seconds), or network 2-quiet (no more than 2 active
+    network connections for 2 seconds).
+    PageLoad.Experimental.PaintTiming.FirstMeaningfulPaintSignalStatus2
+    histogram gives the fraction of page loads that had network 2-quiet, so it
+    can be used as a baseline.
+  </summary>
+</histogram>
+
 <histogram name="PageLoad.Experimental.TotalRequests.ParseStop"
     units="requests">
   <owner>csharrison@chromium.org</owner>
@@ -94234,6 +94258,12 @@
   <int value="20" label=".log"/>
 </enum>
 
+<enum name="FirstMeaningfulPaintOrdering" type="int">
+  <int value="0" label="FMP 0-quiet &lt; FMP 2-quiet"/>
+  <int value="1" label="FMP 0-quiet &gt; FMP 2-quiet"/>
+  <int value="2" label="FMP 0-quiet = FMP 2-quiet"/>
+</enum>
+
 <enum name="FirstMeaningfulPaintSignalStatus" type="int">
   <int value="0" label="No input, network active"/>
   <int value="1" label="Had input, network active"/>
@@ -102655,6 +102685,11 @@
   <int value="6" label="Channel Type Change"/>
 </enum>
 
+<enum name="NetworkQuietStatus" type="int">
+  <int value="0" label="Had network 0-quiet for 0.5 seconds"/>
+  <int value="1" label="Had network 2-quiet for 2 seconds"/>
+</enum>
+
 <enum name="NetworkSecurityType" type="int">
   <summary>
     The security types come from the connman_service_security enum in
diff --git a/ui/keyboard/resources/locales/en.js b/ui/keyboard/resources/locales/en.js
index dbb7ca7..67ac6fc 100644
--- a/ui/keyboard/resources/locales/en.js
+++ b/ui/keyboard/resources/locales/en.js
@@ -1,6 +1,11 @@
 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
+
+// Note: this <include> is not behind a single-line comment because the first
+// line of the file is source code (so the first line would be skipped) instead
+// of a licence header. Also, the result is used in an assignment.
+// clang-format off
 i18n.input.chrome.inputview.TranslationTable =
 <include src="../../../../third_party/google_input_tools/src/chrome/os/inputview/_locales/en/messages.json">
-
+// clang-format on
diff --git a/ui/webui/resources/.clang-format b/ui/webui/resources/.clang-format
deleted file mode 100644
index 2baaa8d..0000000
--- a/ui/webui/resources/.clang-format
+++ /dev/null
@@ -1,8 +0,0 @@
-# Please keep this file the same as chrome/browser/resources/.clang-format.
-BasedOnStyle: Chromium
-
-# Renaming quotes in <include> and <if> break things.
-# For normal JS code, please prefer ' to ".
-JavaScriptQuotes: Leave
-
-AllowShortFunctionsOnASingleLine: Empty
diff --git a/ui/webui/resources/js/analytics.js b/ui/webui/resources/js/analytics.js
index 6a467d37..c8bda26d 100644
--- a/ui/webui/resources/js/analytics.js
+++ b/ui/webui/resources/js/analytics.js
@@ -5,4 +5,10 @@
 // This file serves as a proxy to bring the included js file from /third_party
 // into its correct location under the resources directory tree, whence it is
 // delivered via a chrome://resources URL.  See ../webui_resources.grd.
+
+// Note: this <include> is not behind a single-line comment because the first
+// line of the file is source code (so the first line would be skipped) instead
+// of a licence header.
+// clang-format off
 <include src="../../../../third_party/analytics/google-analytics-bundle.js">
+// clang-format on
diff --git a/ui/webui/resources/js/jstemplate_compiled.js b/ui/webui/resources/js/jstemplate_compiled.js
index 6a79748..a1344c7 100644
--- a/ui/webui/resources/js/jstemplate_compiled.js
+++ b/ui/webui/resources/js/jstemplate_compiled.js
@@ -5,4 +5,10 @@
 // This file serves as a proxy to bring the included js file from /third_party
 // into its correct location under the resources directory tree, whence it is
 // delivered via a chrome://resources URL.  See ../webui_resources.grd.
+
+// Note: this <include> is not behind a single-line comment because the first
+// line of the file is source code (so the first line would be skipped) instead
+// of a licence header.
+// clang-format off
 <include src="../../../../third_party/jstemplate/jstemplate_compiled.js">
+// clang-format on