diff --git a/DEPS b/DEPS
index eb43817..02f518b3 100644
--- a/DEPS
+++ b/DEPS
@@ -175,11 +175,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '3e192165cb65d24ee9b59b115dfce8e7a52c61bc',
+  'skia_revision': '0340292972b9719ac8eec5ddccff2805b9045d42',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': '1003942d85ac1ace40dac7aecf518c4f108d4273',
+  'v8_revision': '576a8e97c96ee49267829f4c6825b257cf533f77',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -187,7 +187,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling ANGLE
   # and whatever else without interference from each other.
-  'angle_revision': '9e263aa8a4e65ffbd59bb90f13abd6b8f102f71e',
+  'angle_revision': '45c5398037c4daefd01ef466292497790ba28ef0',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling SwiftShader
   # and whatever else without interference from each other.
@@ -195,7 +195,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling PDFium
   # and whatever else without interference from each other.
-  'pdfium_revision': 'fe6381e8e36606a37149d4471f24ec34607f4ebd',
+  'pdfium_revision': 'dbb6fcdf4353e6f186ee60b377d594c813f8fa63',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling BoringSSL
   # and whatever else without interference from each other.
@@ -238,7 +238,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling catapult
   # and whatever else without interference from each other.
-  'catapult_revision': '8bf3aecd3335cc7b678c2d3ba24eaab6c43de13c',
+  'catapult_revision': 'e4aabc8bab65e599245a36962a229c9dec2c4b5d',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libFuzzer
   # and whatever else without interference from each other.
@@ -246,7 +246,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling devtools-frontend
   # and whatever else without interference from each other.
-  'devtools_frontend_revision': '715c8c459f00def9ee77146442633fd015990a94',
+  'devtools_frontend_revision': 'af976e22c803c07f578a59826583ab72d5faa246',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libprotobuf-mutator
   # and whatever else without interference from each other.
@@ -302,7 +302,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
-  'dawn_revision': '52d0627d5607cf191485165fe515062c2a61ce81',
+  'dawn_revision': '421684f9438d2c847b1c6571055074272d15c089',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
@@ -899,7 +899,7 @@
   },
 
   'src/third_party/depot_tools':
-    Var('chromium_git') + '/chromium/tools/depot_tools.git' + '@' + '552ddbf3bfe04c7daa75e04d17263b4cd348999b',
+    Var('chromium_git') + '/chromium/tools/depot_tools.git' + '@' + '96c9784d1a3d4406b02d886f2fdbab7fd25efe73',
 
   'src/third_party/devtools-frontend/src':
     Var('chromium_git') + '/devtools/devtools-frontend' + '@' + Var('devtools_frontend_revision'),
@@ -955,7 +955,7 @@
     Var('chromium_git') + '/codecs/libgav1.git' + '@' + 'fa1c3c4e673cf12ffa22b8fbe4a7c79314571f1b',
 
   'src/third_party/glslang/src':
-    Var('chromium_git') + '/external/github.com/KhronosGroup/glslang.git' + '@' + 'dbb56a1d48592d24afb89550a47bda0a9bf14df3',
+    Var('chromium_git') + '/external/github.com/KhronosGroup/glslang.git' + '@' + '9b620aa0c12d12dd7ec7ced43ce9e58f275d47c1',
 
   'src/third_party/google_toolbox_for_mac/src': {
       'url': Var('chromium_git') + '/external/github.com/google/google-toolbox-for-mac.git' + '@' + Var('google_toolbox_for_mac_revision'),
@@ -1233,7 +1233,7 @@
     Var('chromium_git') + '/external/github.com/cisco/openh264' + '@' + '6f26bce0b1c4e8ce0e13332f7c0083788def5fdf',
 
   'src/third_party/openscreen/src':
-    Var('chromium_git') + '/openscreen' + '@' + '1bdc5980b3a43ad053849a82d2962cb7f66ed7e3',
+    Var('chromium_git') + '/openscreen' + '@' + 'cbf7f5178da67099ecc2ead3a88101188a3292f0',
 
   'src/third_party/openxr/src': {
     'url': Var('chromium_git') + '/external/github.com/KhronosGroup/OpenXR-SDK' + '@' + '9e97b73e7dd2bfc07745489d728f6a36665c648f',
@@ -1454,7 +1454,7 @@
     Var('chromium_git') + '/external/github.com/gpuweb/cts.git' + '@' + 'ec18cc3262922e7dcdbe70243c6f40606f979144',
 
   'src/third_party/webrtc':
-    Var('webrtc_git') + '/src.git' + '@' + '430e4a09e0ca66a9680cd9884a90ca5b4346bcd7',
+    Var('webrtc_git') + '/src.git' + '@' + '59f3b71c04deb301c989d8f316424d01dd91d2c5',
 
   'src/third_party/libgifcodec':
      Var('skia_git') + '/libgifcodec' + '@'+  Var('libgifcodec_revision'),
@@ -1529,7 +1529,7 @@
     Var('chromium_git') + '/v8/v8.git' + '@' +  Var('v8_revision'),
 
   'src-internal': {
-    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@76a104eafd232e1525793bf2c7a1cbada9738537',
+    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@1422f8e60e7b0e0b4618f4b48c7919bcdf11d456',
     'condition': 'checkout_src_internal',
   },
 
diff --git a/android_webview/java/src/org/chromium/android_webview/AwContents.java b/android_webview/java/src/org/chromium/android_webview/AwContents.java
index 3d8ed2c..9c612287 100644
--- a/android_webview/java/src/org/chromium/android_webview/AwContents.java
+++ b/android_webview/java/src/org/chromium/android_webview/AwContents.java
@@ -1342,7 +1342,7 @@
         }
 
         setNewAwContents(popupNativeAwContents);
-        // We defer loading any URL on the popup until it has been properly intialized (through
+        // We defer loading any URL on the popup until it has been properly initialized (through
         // setNewAwContents). We resume the load here.
         AwContentsJni.get().resumeLoadingCreatedPopupWebContents(
                 mNativeAwContents, AwContents.this);
diff --git a/base/BUILD.gn b/base/BUILD.gn
index 3b5f788..e0833b5 100644
--- a/base/BUILD.gn
+++ b/base/BUILD.gn
@@ -28,7 +28,6 @@
 import("//build/config/jumbo.gni")
 import("//build/config/logging.gni")
 import("//build/config/nacl/config.gni")
-import("//build/config/profiling/profiling.gni")
 import("//build/config/sysroot.gni")
 import("//build/config/ui.gni")
 import("//build/nocompile.gni")
@@ -1304,7 +1303,7 @@
     ":base_static",
     ":build_date",
     ":cfi_buildflags",
-    ":clang_profiling_buildflags",
+    ":clang_coverage_buildflags",
     ":debugging_buildflags",
     ":logging_buildflags",
     ":orderfile_buildflags",
@@ -1360,11 +1359,11 @@
     }
   }
 
-  if (use_clang_profiling) {
-    # Call-sites use this conditional on the CLANG_PROFILING macro, for clarity.
+  if (use_clang_coverage) {
+    # Call-sites use this conditional on the CLANG_COVERAGE macro, for clarity.
     sources += [
-      "test/clang_profiling.cc",
-      "test/clang_profiling.h",
+      "test/clang_coverage.cc",
+      "test/clang_coverage.h",
     ]
   }
 
@@ -2167,13 +2166,13 @@
   flags = [ "USE_PARTITION_ALLOC=$use_partition_alloc" ]
 }
 
-buildflag_header("clang_profiling_buildflags") {
-  header = "clang_profiling_buildflags.h"
+buildflag_header("clang_coverage_buildflags") {
+  header = "clang_coverage_buildflags.h"
   header_dir = "base"
 
   flags = [
-    "CLANG_PROFILING=$use_clang_profiling",
-    "CLANG_PROFILING_INSIDE_SANDBOX=$use_clang_profiling_inside_sandbox",
+    "CLANG_COVERAGE=$use_clang_coverage",
+    "CLANG_COVERAGE_INSIDE_SANDBOX=$use_clang_coverage_inside_sandbox",
   ]
 }
 
diff --git a/base/debug/activity_tracker_unittest.cc b/base/debug/activity_tracker_unittest.cc
index 74f431e..7cb55df1 100644
--- a/base/debug/activity_tracker_unittest.cc
+++ b/base/debug/activity_tracker_unittest.cc
@@ -5,6 +5,7 @@
 #include "base/debug/activity_tracker.h"
 
 #include <memory>
+#include <utility>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ -302,6 +303,7 @@
   // Check no activity when only "trying" a lock.
   EXPECT_TRUE(lock.Try());
   EXPECT_EQ(pre_version, tracker->GetDataVersionForTesting());
+  lock.AssertAcquired();
   lock.Release();
   EXPECT_EQ(pre_version, tracker->GetDataVersionForTesting());
 
diff --git a/base/debug/debugger_posix.cc b/base/debug/debugger_posix.cc
index 1982173..8a7858d9 100644
--- a/base/debug/debugger_posix.cc
+++ b/base/debug/debugger_posix.cc
@@ -17,7 +17,7 @@
 #include <memory>
 #include <vector>
 
-#include "base/clang_profiling_buildflags.h"
+#include "base/clang_coverage_buildflags.h"
 #include "base/stl_util.h"
 #include "base/threading/platform_thread.h"
 #include "base/time/time.h"
@@ -56,8 +56,8 @@
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_piece.h"
 
-#if BUILDFLAG(CLANG_PROFILING)
-#include "base/test/clang_profiling.h"
+#if BUILDFLAG(CLANG_COVERAGE)
+#include "base/test/clang_coverage.h"
 #endif
 
 #if defined(USE_SYMBOLIZE)
@@ -324,8 +324,8 @@
 #endif
 
 void BreakDebugger() {
-#if BUILDFLAG(CLANG_PROFILING)
-  WriteClangProfilingProfile();
+#if BUILDFLAG(CLANG_COVERAGE)
+  WriteClangCoverageProfile();
 #endif
 
   // NOTE: This code MUST be async-signal safe (it's used by in-process
diff --git a/base/debug/debugger_win.cc b/base/debug/debugger_win.cc
index 2e3875b..fd10b4b 100644
--- a/base/debug/debugger_win.cc
+++ b/base/debug/debugger_win.cc
@@ -7,10 +7,10 @@
 #include <stdlib.h>
 #include <windows.h>
 
-#include "base/clang_profiling_buildflags.h"
+#include "base/clang_coverage_buildflags.h"
 
-#if BUILDFLAG(CLANG_PROFILING)
-#include "base/test/clang_profiling.h"
+#if BUILDFLAG(CLANG_COVERAGE)
+#include "base/test/clang_coverage.h"
 #endif
 
 namespace base {
@@ -21,8 +21,8 @@
 }
 
 void BreakDebugger() {
-#if BUILDFLAG(CLANG_PROFILING)
-  WriteClangProfilingProfile();
+#if BUILDFLAG(CLANG_COVERAGE)
+  WriteClangCoverageProfile();
 #endif
 
   if (IsDebugUISuppressed())
diff --git a/base/metrics/persistent_histogram_allocator.cc b/base/metrics/persistent_histogram_allocator.cc
index 6bd8559d..e51e2e1e 100644
--- a/base/metrics/persistent_histogram_allocator.cc
+++ b/base/metrics/persistent_histogram_allocator.cc
@@ -4,7 +4,8 @@
 
 #include "base/metrics/persistent_histogram_allocator.h"
 
-#include <memory>
+#include <limits>
+#include <utility>
 
 #include "base/atomicops.h"
 #include "base/files/file_path.h"
@@ -118,8 +119,6 @@
 PersistentSampleMapRecords*
 PersistentSparseHistogramDataManager::GetSampleMapRecordsWhileLocked(
     uint64_t id) {
-  lock_.AssertAcquired();
-
   auto found = sample_records_.find(id);
   if (found != sample_records_.end())
     return found->second.get();
diff --git a/base/metrics/persistent_histogram_allocator.h b/base/metrics/persistent_histogram_allocator.h
index 94cbe745..b488650d 100644
--- a/base/metrics/persistent_histogram_allocator.h
+++ b/base/metrics/persistent_histogram_allocator.h
@@ -2,11 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef BASE_METRICS_HISTOGRAM_PERSISTENCE_H_
-#define BASE_METRICS_HISTOGRAM_PERSISTENCE_H_
+#ifndef BASE_METRICS_PERSISTENT_HISTOGRAM_ALLOCATOR_H_
+#define BASE_METRICS_PERSISTENT_HISTOGRAM_ALLOCATOR_H_
 
 #include <map>
 #include <memory>
+#include <string>
+#include <vector>
 
 #include "base/atomicops.h"
 #include "base/base_export.h"
@@ -64,9 +66,9 @@
  private:
   friend class PersistentSampleMapRecords;
 
-  // Gets the object holding records for a given sample-map id when |lock_|
-  // has already been acquired.
-  PersistentSampleMapRecords* GetSampleMapRecordsWhileLocked(uint64_t id);
+  // Gets the object holding records for a given sample-map id.
+  PersistentSampleMapRecords* GetSampleMapRecordsWhileLocked(uint64_t id)
+      EXCLUSIVE_LOCKS_REQUIRED(lock_);
 
   // Loads sample-map records looking for those belonging to the specified
   // |load_id|. Records found for other sample-maps are held for later use
@@ -80,13 +82,12 @@
   PersistentMemoryAllocator* allocator_;
 
   // Iterator within the allocator for finding sample records.
-  PersistentMemoryAllocator::Iterator record_iterator_;
+  PersistentMemoryAllocator::Iterator record_iterator_ GUARDED_BY(lock_);
 
   // Mapping of sample-map IDs to their sample records.
   std::map<uint64_t, std::unique_ptr<PersistentSampleMapRecords>>
-      sample_records_;
+      sample_records_ GUARDED_BY(lock_);
 
-  // A lock used for synchronizing changes to sample_records_.
   base::Lock lock_;
 
   DISALLOW_COPY_AND_ASSIGN(PersistentSparseHistogramDataManager);
@@ -503,4 +504,4 @@
 
 }  // namespace base
 
-#endif  // BASE_METRICS_HISTOGRAM_PERSISTENCE_H_
+#endif  // BASE_METRICS_PERSISTENT_HISTOGRAM_ALLOCATOR_H__
diff --git a/base/process/process_fuchsia.cc b/base/process/process_fuchsia.cc
index 516a067..f260575 100644
--- a/base/process/process_fuchsia.cc
+++ b/base/process/process_fuchsia.cc
@@ -8,14 +8,14 @@
 #include <zircon/process.h>
 #include <zircon/syscalls.h>
 
-#include "base/clang_profiling_buildflags.h"
+#include "base/clang_coverage_buildflags.h"
 #include "base/debug/activity_tracker.h"
 #include "base/fuchsia/default_job.h"
 #include "base/fuchsia/fuchsia_logging.h"
 #include "base/strings/stringprintf.h"
 
-#if BUILDFLAG(CLANG_PROFILING)
-#include "base/test/clang_profiling.h"
+#if BUILDFLAG(CLANG_COVERAGE)
+#include "base/test/clang_coverage.h"
 #endif
 
 namespace base {
@@ -93,8 +93,8 @@
 
 // static
 void Process::TerminateCurrentProcessImmediately(int exit_code) {
-#if BUILDFLAG(CLANG_PROFILING)
-  WriteClangProfilingProfile();
+#if BUILDFLAG(CLANG_COVERAGE)
+  WriteClangCoverageProfile();
 #endif
   _exit(exit_code);
 }
diff --git a/base/process/process_posix.cc b/base/process/process_posix.cc
index 17dae528..9636d44 100644
--- a/base/process/process_posix.cc
+++ b/base/process/process_posix.cc
@@ -10,7 +10,7 @@
 #include <sys/resource.h>
 #include <sys/wait.h>
 
-#include "base/clang_profiling_buildflags.h"
+#include "base/clang_coverage_buildflags.h"
 #include "base/debug/activity_tracker.h"
 #include "base/files/scoped_file.h"
 #include "base/logging.h"
@@ -23,8 +23,8 @@
 #include <sys/event.h>
 #endif
 
-#if BUILDFLAG(CLANG_PROFILING)
-#include "base/test/clang_profiling.h"
+#if BUILDFLAG(CLANG_COVERAGE)
+#include "base/test/clang_coverage.h"
 #endif
 
 namespace {
@@ -276,8 +276,8 @@
 
 // static
 void Process::TerminateCurrentProcessImmediately(int exit_code) {
-#if BUILDFLAG(CLANG_PROFILING)
-  WriteClangProfilingProfile();
+#if BUILDFLAG(CLANG_COVERAGE)
+  WriteClangCoverageProfile();
 #endif
   _exit(exit_code);
 }
diff --git a/base/process/process_win.cc b/base/process/process_win.cc
index 85688b7..4f2ccf96 100644
--- a/base/process/process_win.cc
+++ b/base/process/process_win.cc
@@ -4,7 +4,7 @@
 
 #include "base/process/process.h"
 
-#include "base/clang_profiling_buildflags.h"
+#include "base/clang_coverage_buildflags.h"
 #include "base/debug/activity_tracker.h"
 #include "base/logging.h"
 #include "base/numerics/safe_conversions.h"
@@ -13,8 +13,8 @@
 
 #include <windows.h>
 
-#if BUILDFLAG(CLANG_PROFILING)
-#include "base/test/clang_profiling.h"
+#if BUILDFLAG(CLANG_COVERAGE)
+#include "base/test/clang_coverage.h"
 #endif
 
 namespace {
@@ -90,8 +90,8 @@
 
 // static
 void Process::TerminateCurrentProcessImmediately(int exit_code) {
-#if BUILDFLAG(CLANG_PROFILING)
-  WriteClangProfilingProfile();
+#if BUILDFLAG(CLANG_COVERAGE)
+  WriteClangCoverageProfile();
 #endif
   ::TerminateProcess(GetCurrentProcess(), exit_code);
   // There is some ambiguity over whether the call above can return. Rather than
diff --git a/base/synchronization/lock.h b/base/synchronization/lock.h
index 00095ab3..e89db4a 100644
--- a/base/synchronization/lock.h
+++ b/base/synchronization/lock.h
@@ -25,17 +25,14 @@
   Lock() : lock_() {}
   ~Lock() {}
 
-  // TODO(lukasza): https://crbug.com/831825: Add EXCLUSIVE_LOCK_FUNCTION
-  // annotation to Acquire method and similar annotations to Release and Try
-  // methods (here and in the #else branch).
-  void Acquire() { lock_.Lock(); }
-  void Release() { lock_.Unlock(); }
+  void Acquire() EXCLUSIVE_LOCK_FUNCTION() { lock_.Lock(); }
+  void Release() UNLOCK_FUNCTION() { lock_.Unlock(); }
 
   // If the lock is not held, take it and return true. If the lock is already
   // held by another thread, immediately return false. This must not be called
   // by a thread already holding the lock (what happens is undefined and an
   // assertion may fail).
-  bool Try() { return lock_.Try(); }
+  bool Try() EXCLUSIVE_TRYLOCK_FUNCTION(true) { return lock_.Try(); }
 
   // Null implementation if not debug.
   void AssertAcquired() const ASSERT_EXCLUSIVE_LOCK() {}
@@ -46,16 +43,16 @@
   // NOTE: We do not permit recursive locks and will commonly fire a DCHECK() if
   // a thread attempts to acquire the lock a second time (while already holding
   // it).
-  void Acquire() {
+  void Acquire() EXCLUSIVE_LOCK_FUNCTION() {
     lock_.Lock();
     CheckUnheldAndMark();
   }
-  void Release() {
+  void Release() UNLOCK_FUNCTION() {
     CheckHeldAndUnmark();
     lock_.Unlock();
   }
 
-  bool Try() {
+  bool Try() EXCLUSIVE_TRYLOCK_FUNCTION(true) {
     bool rv = lock_.Try();
     if (rv) {
       CheckUnheldAndMark();
diff --git a/base/synchronization/lock_unittest.cc b/base/synchronization/lock_unittest.cc
index dbb289fa..8fa3957 100644
--- a/base/synchronization/lock_unittest.cc
+++ b/base/synchronization/lock_unittest.cc
@@ -97,8 +97,11 @@
   explicit TryLockTestThread(Lock* lock) : lock_(lock), got_lock_(false) {}
 
   void ThreadMain() override {
-    got_lock_ = lock_->Try();
-    if (got_lock_)
+    // The local variable is required for the static analyzer to see that the
+    // lock is properly released.
+    bool got_lock = lock_->Try();
+    got_lock_ = got_lock;
+    if (got_lock)
       lock_->Release();
   }
 
@@ -115,7 +118,7 @@
   Lock lock;
 
   ASSERT_TRUE(lock.Try());
-  // We now have the lock....
+  lock.AssertAcquired();
 
   // This thread will not be able to get the lock.
   {
@@ -143,6 +146,7 @@
     ASSERT_TRUE(thread.got_lock());
     // But it released it....
     ASSERT_TRUE(lock.Try());
+    lock.AssertAcquired();
   }
 
   lock.Release();
@@ -155,7 +159,7 @@
   Lock lock;
 
   ASSERT_TRUE(lock.Try());
-  // We now have the lock....
+  lock.AssertAcquired();
 
   // This thread will not be able to get the lock.
   {
@@ -183,6 +187,7 @@
     ASSERT_TRUE(thread.got_lock());
     // But it released it....
     ASSERT_TRUE(lock.Try());
+    lock.AssertAcquired();
   }
 
   lock.Release();
diff --git a/base/synchronization/waitable_event_mac.cc b/base/synchronization/waitable_event_mac.cc
index 7383066c..3e1d57c 100644
--- a/base/synchronization/waitable_event_mac.cc
+++ b/base/synchronization/waitable_event_mac.cc
@@ -48,7 +48,8 @@
   PeekPort(receive_right_->Name(), true);
 }
 
-void WaitableEvent::Signal() {
+// NO_THREAD_SAFETY_ANALYSIS: Runtime dependent locking.
+void WaitableEvent::Signal() NO_THREAD_SAFETY_ANALYSIS {
   // If using the slow watch-list, copy the watchers to a local. After
   // mach_msg(), the event object may be deleted by an awoken thread.
   const bool use_slow_path = UseSlowWatchList(policy_);
diff --git a/base/synchronization/waitable_event_posix.cc b/base/synchronization/waitable_event_posix.cc
index effa8991..1384e03 100644
--- a/base/synchronization/waitable_event_posix.cc
+++ b/base/synchronization/waitable_event_posix.cc
@@ -246,8 +246,9 @@
 }
 
 // static
+// NO_THREAD_SAFETY_ANALYSIS: Complex control flow.
 size_t WaitableEvent::WaitMany(WaitableEvent** raw_waitables,
-                               size_t count) {
+                               size_t count) NO_THREAD_SAFETY_ANALYSIS {
   DCHECK(count) << "Cannot wait on no events";
   internal::ScopedBlockingCallWithBaseSyncPrimitives scoped_blocking_call(
       FROM_HERE, BlockingType::MAY_BLOCK);
@@ -337,9 +338,10 @@
 //   was signaled with the lowest input index from the original WaitMany call.
 // -----------------------------------------------------------------------------
 // static
+// NO_THREAD_SAFETY_ANALYSIS: Complex control flow.
 size_t WaitableEvent::EnqueueMany(std::pair<WaitableEvent*, size_t>* waitables,
                                   size_t count,
-                                  Waiter* waiter) {
+                                  Waiter* waiter) NO_THREAD_SAFETY_ANALYSIS {
   size_t winner = count;
   size_t winner_index = count;
   for (size_t i = 0; i < count; ++i) {
diff --git a/base/task/common/checked_lock_impl.h b/base/task/common/checked_lock_impl.h
index 2a3dac6..acb1d133 100644
--- a/base/task/common/checked_lock_impl.h
+++ b/base/task/common/checked_lock_impl.h
@@ -32,8 +32,8 @@
 
   static void AssertNoLockHeldOnCurrentThread();
 
-  void Acquire();
-  void Release();
+  void Acquire() EXCLUSIVE_LOCK_FUNCTION(lock_);
+  void Release() UNLOCK_FUNCTION(lock_);
 
   void AssertAcquired() const;
 
diff --git a/base/task/common/checked_lock_unittest.cc b/base/task/common/checked_lock_unittest.cc
index 85223cc..54b74c5 100644
--- a/base/task/common/checked_lock_unittest.cc
+++ b/base/task/common/checked_lock_unittest.cc
@@ -121,7 +121,10 @@
   predecessor.Release();
 }
 
-TEST(CheckedLockTest, AcquirePredecessorWrongOrder) {
+// Here and below, disable thread safety analysis, otherwise our death tests do
+// not compile (the issues are caught at compile time).
+TEST(CheckedLockTest, AcquirePredecessorWrongOrder)
+NO_THREAD_SAFETY_ANALYSIS {
   CheckedLock predecessor;
   CheckedLock lock(&predecessor);
   EXPECT_DCHECK_DEATH({
@@ -130,7 +133,7 @@
   });
 }
 
-TEST(CheckedLockTest, AcquireNonPredecessor) {
+TEST(CheckedLockTest, AcquireNonPredecessor) NO_THREAD_SAFETY_ANALYSIS {
   CheckedLock lock1;
   CheckedLock lock2;
   EXPECT_DCHECK_DEATH({
@@ -161,7 +164,8 @@
   lock2.Release();
 }
 
-TEST(CheckedLockTest, AcquireMultipleLocksNoTransitivity) {
+TEST(CheckedLockTest, AcquireMultipleLocksNoTransitivity)
+NO_THREAD_SAFETY_ANALYSIS {
   CheckedLock lock1;
   CheckedLock lock2(&lock1);
   CheckedLock lock3(&lock2);
@@ -299,7 +303,8 @@
   universal_predecessor.Release();
 }
 
-TEST(CheckedLockTest, AcquireMultipleLocksAfterUniversalPredecessor) {
+TEST(CheckedLockTest, AcquireMultipleLocksAfterUniversalPredecessor)
+NO_THREAD_SAFETY_ANALYSIS {
   // Acquisition of a universal-predecessor lock does not affect acquisition
   // rules for locks beyond the one acquired directly after it.
   CheckedLock universal_predecessor((UniversalPredecessor()));
@@ -321,7 +326,8 @@
   });
 }
 
-TEST(CheckedLockTest, AcquireUniversalPredecessorAfterLock) {
+TEST(CheckedLockTest, AcquireUniversalPredecessorAfterLock)
+NO_THREAD_SAFETY_ANALYSIS {
   // A universal-predecessor lock may not be acquired after any other lock.
   CheckedLock universal_predecessor((UniversalPredecessor()));
   CheckedLock lock;
@@ -332,7 +338,8 @@
   });
 }
 
-TEST(CheckedLockTest, AcquireUniversalPredecessorAfterUniversalPredecessor) {
+TEST(CheckedLockTest, AcquireUniversalPredecessorAfterUniversalPredecessor)
+NO_THREAD_SAFETY_ANALYSIS {
   // A universal-predecessor lock may not be acquired after any other lock, not
   // even another universal predecessor.
   CheckedLock universal_predecessor((UniversalPredecessor()));
diff --git a/base/test/BUILD.gn b/base/test/BUILD.gn
index 7a88a66a..712c70899 100644
--- a/base/test/BUILD.gn
+++ b/base/test/BUILD.gn
@@ -26,7 +26,7 @@
   ]
   deps = [
     "//base",
-    "//base:clang_profiling_buildflags",
+    "//base:clang_coverage_buildflags",
   ]
 }
 
diff --git a/base/test/clang_coverage.cc b/base/test/clang_coverage.cc
new file mode 100644
index 0000000..33f823e
--- /dev/null
+++ b/base/test/clang_coverage.cc
@@ -0,0 +1,25 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/test/clang_coverage.h"
+
+#include "base/no_destructor.h"
+#include "base/synchronization/lock.h"
+
+extern "C" int __llvm_profile_dump(void);
+
+namespace base {
+
+void WriteClangCoverageProfile() {
+  // __llvm_profile_dump() guarantees that it will not dump coverage information
+  // if it is being called twice or more. However, it is not thread safe, as it
+  // is supposed to be called from atexit() handler rather than being called
+  // directly from random places. Since we have to call it ourselves, we must
+  // ensure thread safety in order to prevent duplication of coverage counters.
+  static base::NoDestructor<base::Lock> lock;
+  base::AutoLock auto_lock(*lock);
+  __llvm_profile_dump();
+}
+
+}  // namespace base
diff --git a/base/test/clang_coverage.h b/base/test/clang_coverage.h
new file mode 100644
index 0000000..ed2e3d7
--- /dev/null
+++ b/base/test/clang_coverage.h
@@ -0,0 +1,26 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef BASE_TEST_CLANG_COVERAGE_H_
+#define BASE_TEST_CLANG_COVERAGE_H_
+
+#include "base/clang_coverage_buildflags.h"
+
+#if !BUILDFLAG(CLANG_COVERAGE)
+#error "Clang coverage can only be used if CLANG_COVERAGE macro is defined"
+#endif
+
+namespace base {
+
+// Write out the accumulated code coverage profile to the configured file.
+// This is used internally by e.g. base::Process and FATAL logging, to cause
+// coverage information to be stored even when performing an "immediate" exit
+// (or triggering a debug crash), where the automatic at-exit writer will not
+// be invoked.
+// This call is thread-safe, and will write profiling data at-most-once.
+void WriteClangCoverageProfile();
+
+}  // namespace base
+
+#endif  // BASE_TEST_CLANG_COVERAGE_H_
diff --git a/base/test/clang_profiling.cc b/base/test/clang_profiling.cc
deleted file mode 100644
index 5681a10..0000000
--- a/base/test/clang_profiling.cc
+++ /dev/null
@@ -1,26 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/test/clang_profiling.h"
-
-#include "base/no_destructor.h"
-#include "base/synchronization/lock.h"
-
-extern "C" int __llvm_profile_dump(void);
-
-namespace base {
-
-void WriteClangProfilingProfile() {
-  // __llvm_profile_dump() guarantees that it will not dump profiling
-  // information if it is being called twice or more. However, it is not thread
-  // safe, as it is supposed to be called from atexit() handler rather than
-  // being called directly from random places. Since we have to call it
-  // ourselves, we must ensure thread safety in order to prevent duplication of
-  // profiling counters.
-  static base::NoDestructor<base::Lock> lock;
-  base::AutoLock auto_lock(*lock);
-  __llvm_profile_dump();
-}
-
-}  // namespace base
diff --git a/base/test/clang_profiling.h b/base/test/clang_profiling.h
deleted file mode 100644
index 1ecc02d..0000000
--- a/base/test/clang_profiling.h
+++ /dev/null
@@ -1,26 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef BASE_TEST_CLANG_PROFILING_H_
-#define BASE_TEST_CLANG_PROFILING_H_
-
-#include "base/clang_profiling_buildflags.h"
-
-#if !BUILDFLAG(CLANG_PROFILING)
-#error "Clang profiling can only be used if CLANG_PROFILING macro is defined"
-#endif
-
-namespace base {
-
-// Write out the accumulated code profiling profile to the configured file.
-// This is used internally by e.g. base::Process and FATAL logging, to cause
-// profiling information to be stored even when performing an "immediate" exit
-// (or triggering a debug crash), where the automatic at-exit writer will not
-// be invoked.
-// This call is thread-safe, and will write profiling data at-most-once.
-void WriteClangProfilingProfile();
-
-}  // namespace base
-
-#endif  // BASE_TEST_CLANG_PROFILING_H_
diff --git a/base/test/test_timeouts.cc b/base/test/test_timeouts.cc
index e77f175..ef612bb 100644
--- a/base/test/test_timeouts.cc
+++ b/base/test/test_timeouts.cc
@@ -7,7 +7,7 @@
 #include <algorithm>
 #include <string>
 
-#include "base/clang_profiling_buildflags.h"
+#include "base/clang_coverage_buildflags.h"
 #include "base/command_line.h"
 #include "base/debug/debugger.h"
 #include "base/logging.h"
@@ -57,7 +57,7 @@
   constexpr int kTimeoutMultiplier = 3;
 #elif defined(ADDRESS_SANITIZER) || defined(THREAD_SANITIZER)
   constexpr int kTimeoutMultiplier = 2;
-#elif BUILDFLAG(CLANG_PROFILING)
+#elif BUILDFLAG(CLANG_COVERAGE)
   // On coverage build, tests run 3x slower.
   constexpr int kTimeoutMultiplier = 3;
 #elif !defined(NDEBUG) && defined(OS_CHROMEOS)
diff --git a/base/trace_event/trace_log.cc b/base/trace_event/trace_log.cc
index 4f1e704..74cd7f2 100644
--- a/base/trace_event/trace_log.cc
+++ b/base/trace_event/trace_log.cc
@@ -6,7 +6,9 @@
 
 #include <algorithm>
 #include <cmath>
+#include <limits>
 #include <memory>
+#include <unordered_set>
 #include <utility>
 
 #include "base/base_switches.h"
@@ -189,10 +191,12 @@
       lock_->Release();
   }
 
-  void EnsureAcquired() {
+  void EnsureAcquired() EXCLUSIVE_LOCK_FUNCTION(lock_) {
     if (!locked_) {
       lock_->Acquire();
       locked_ = true;
+    } else {
+      lock_->AssertAcquired();
     }
   }
 
@@ -1220,7 +1224,7 @@
     int thread_id,
     const TimeTicks& timestamp,
     TraceArguments* args,
-    unsigned int flags) {
+    unsigned int flags) NO_THREAD_SAFETY_ANALYSIS {
   TraceEventHandle handle = {0, 0, 0};
   if (!ShouldAddAfterUpdatingState(phase, category_group_enabled, name, id,
                                    thread_id, args)) {
@@ -1297,6 +1301,7 @@
       trace_event = AddEventToThreadSharedChunkWhileLocked(&handle, true);
     }
 
+    // NO_THREAD_SAFETY_ANALYSIS: Conditional locking above.
     if (trace_event) {
       if (filtered_trace_event) {
         *trace_event = std::move(*filtered_trace_event);
@@ -1603,7 +1608,8 @@
 }
 
 TraceEvent* TraceLog::GetEventByHandleInternal(TraceEventHandle handle,
-                                               OptionalAutoLock* lock) {
+                                               OptionalAutoLock* lock)
+    NO_THREAD_SAFETY_ANALYSIS {
   if (!handle.chunk_seq)
     return nullptr;
 
@@ -1620,6 +1626,7 @@
 
   // The event has been out-of-control of the thread local buffer.
   // Try to get the event from the main buffer with a lock.
+  // NO_THREAD_SAFETY_ANALYSIS: runtime-dependent locking here.
   if (lock)
     lock->EnsureAcquired();
 
diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
index 8f7fcc3..42667ab 100644
--- a/build/config/compiler/BUILD.gn
+++ b/build/config/compiler/BUILD.gn
@@ -1539,6 +1539,13 @@
           # valid on Windows, which is LLP64.
           "-Wno-microsoft-cast",
         ]
+
+        if (llvm_force_head_revision && is_win) {
+          cflags += [
+            # TODO(https://crbug.com/1059231): Clean up, enable.
+            "-Wno-pointer-to-int-cast",
+          ]
+        }
       }
     }
   }
diff --git a/build/config/profiling/OWNERS b/build/config/profiling/OWNERS
deleted file mode 100644
index 225ce18..0000000
--- a/build/config/profiling/OWNERS
+++ /dev/null
@@ -1,3 +0,0 @@
-liaoyuke@chromium.org
-sajjadm@chromium.org
-sebmarchand@chromium.org
diff --git a/build/config/profiling/profiling.gni b/build/config/profiling/profiling.gni
deleted file mode 100644
index 7dca6eac..0000000
--- a/build/config/profiling/profiling.gni
+++ /dev/null
@@ -1,12 +0,0 @@
-# Copyright 2020 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-import("//build/config/coverage/coverage.gni")
-
-declare_args() {
-  use_clang_profiling = use_clang_coverage
-}
-
-assert(!use_clang_profiling || is_clang,
-       "Clang Source-based profiling requires clang.")
diff --git a/build/config/sanitizers/sanitizers.gni b/build/config/sanitizers/sanitizers.gni
index f0cfd8a..262f868 100644
--- a/build/config/sanitizers/sanitizers.gni
+++ b/build/config/sanitizers/sanitizers.gni
@@ -5,7 +5,7 @@
 import("//build/config/chrome_build.gni")
 import("//build/config/chromecast_build.gni")
 import("//build/config/chromeos/args.gni")
-import("//build/config/profiling/profiling.gni")
+import("//build/config/coverage/coverage.gni")
 import("//build/toolchain/toolchain.gni")
 
 declare_args() {
@@ -167,8 +167,7 @@
   # work well for fuzzing builds. Since fuzzing builds already disable the
   # sandbox when dumping coverage, limit the sandbox-only path to non-fuzzing
   # builds.
-  use_clang_profiling_inside_sandbox =
-      use_clang_profiling && !use_fuzzing_engine
+  use_clang_coverage_inside_sandbox = use_clang_coverage && !use_fuzzing_engine
 
   # Detect overflow/underflow for global objects.
   #
diff --git a/build/fuchsia/linux.sdk.sha1 b/build/fuchsia/linux.sdk.sha1
index 6f4b47690..0f152dd83 100644
--- a/build/fuchsia/linux.sdk.sha1
+++ b/build/fuchsia/linux.sdk.sha1
@@ -1 +1 @@
-0.20200310.3.1
\ No newline at end of file
+0.20200311.0.1
\ No newline at end of file
diff --git a/cc/layers/video_frame_provider_client_impl.cc b/cc/layers/video_frame_provider_client_impl.cc
index 51eb3ee..e855bcc 100644
--- a/cc/layers/video_frame_provider_client_impl.cc
+++ b/cc/layers/video_frame_provider_client_impl.cc
@@ -85,14 +85,12 @@
 
 void VideoFrameProviderClientImpl::PutCurrentFrame() {
   DCHECK(thread_checker_.CalledOnValidThread());
-  provider_lock_.AssertAcquired();
   provider_->PutCurrentFrame();
   needs_put_current_frame_ = false;
 }
 
 void VideoFrameProviderClientImpl::ReleaseLock() {
   DCHECK(thread_checker_.CalledOnValidThread());
-  provider_lock_.AssertAcquired();
   provider_lock_.Release();
 }
 
diff --git a/cc/layers/video_frame_provider_client_impl.h b/cc/layers/video_frame_provider_client_impl.h
index 2798dd01..877a3bb 100644
--- a/cc/layers/video_frame_provider_client_impl.h
+++ b/cc/layers/video_frame_provider_client_impl.h
@@ -43,9 +43,13 @@
   // Must be called on the impl thread while the main thread is blocked.
   void Stop();
 
-  scoped_refptr<media::VideoFrame> AcquireLockAndCurrentFrame();
-  void PutCurrentFrame();
-  void ReleaseLock();
+  scoped_refptr<media::VideoFrame> AcquireLockAndCurrentFrame()
+      EXCLUSIVE_LOCK_FUNCTION(provider_lock_);
+  void PutCurrentFrame() EXCLUSIVE_LOCKS_REQUIRED(provider_lock_);
+  void ReleaseLock() UNLOCK_FUNCTION(provider_lock_);
+  void AssertLocked() const ASSERT_EXCLUSIVE_LOCK(provider_lock_) {
+    provider_lock_.AssertAcquired();
+  }
   bool HasCurrentFrame();
 
   // VideoFrameController implementation.
diff --git a/cc/layers/video_layer_impl.cc b/cc/layers/video_layer_impl.cc
index 98124a9..b5f67bad 100644
--- a/cc/layers/video_layer_impl.cc
+++ b/cc/layers/video_layer_impl.cc
@@ -6,6 +6,9 @@
 
 #include <stddef.h>
 
+#include <memory>
+#include <utility>
+
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
@@ -78,7 +81,8 @@
 }
 
 bool VideoLayerImpl::WillDraw(DrawMode draw_mode,
-                              viz::ClientResourceProvider* resource_provider) {
+                              viz::ClientResourceProvider* resource_provider)
+    NO_THREAD_SAFETY_ANALYSIS {
   if (draw_mode == DRAW_MODE_RESOURCELESS_SOFTWARE)
     return false;
 
@@ -98,6 +102,7 @@
     // Drop any resources used by the updater if there is no frame to display.
     updater_ = nullptr;
 
+    // NO_THREAD_SAFETY_ANALYSIS: Releasing the lock in some return paths only.
     provider_client_impl_->ReleaseLock();
     return false;
   }
@@ -165,6 +170,7 @@
 }
 
 void VideoLayerImpl::DidDraw(viz::ClientResourceProvider* resource_provider) {
+  provider_client_impl_->AssertLocked();
   LayerImpl::DidDraw(resource_provider);
 
   DCHECK(frame_.get());
diff --git a/cc/tiles/gpu_image_decode_cache.cc b/cc/tiles/gpu_image_decode_cache.cc
index 3b96a74f..ed88a73 100644
--- a/cc/tiles/gpu_image_decode_cache.cc
+++ b/cc/tiles/gpu_image_decode_cache.cc
@@ -1276,7 +1276,7 @@
   RunPendingContextThreadOperations();
 }
 
-void GpuImageDecodeCache::ReduceCacheUsage() {
+void GpuImageDecodeCache::ReduceCacheUsage() NO_THREAD_SAFETY_ANALYSIS {
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("cc.debug"),
                "GpuImageDecodeCache::ReduceCacheUsage");
   base::AutoLock lock(lock_);
@@ -1285,6 +1285,8 @@
   // This is typically called when no tasks are running (between scheduling
   // tasks). Try to lock and run pending operations if possible, but don't
   // block on it.
+  //
+  // NO_THREAD_SAFETY_ANALYSIS: runtime-dependent locking.
   if (context_->GetLock() && !context_->GetLock()->Try())
     return;
 
diff --git a/chrome/VERSION b/chrome/VERSION
index 824abbb7..fb8403d 100644
--- a/chrome/VERSION
+++ b/chrome/VERSION
@@ -1,4 +1,4 @@
 MAJOR=82
 MINOR=0
-BUILD=4083
+BUILD=4084
 PATCH=0
diff --git a/chrome/android/chrome_java_sources.gni b/chrome/android/chrome_java_sources.gni
index f461563..0683b48 100644
--- a/chrome/android/chrome_java_sources.gni
+++ b/chrome/android/chrome_java_sources.gni
@@ -684,7 +684,6 @@
   "java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegate.java",
   "java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegateImpl.java",
   "java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationHandler.java",
-  "java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationParams.java",
   "java/src/org/chromium/chrome/browser/externalnav/IntentWithGesturesHandler.java",
   "java/src/org/chromium/chrome/browser/favicon/FaviconHelper.java",
   "java/src/org/chromium/chrome/browser/favicon/FaviconUtils.java",
diff --git a/chrome/android/features/autofill_assistant/BUILD.gn b/chrome/android/features/autofill_assistant/BUILD.gn
index 4c2e199..09235e6 100644
--- a/chrome/android/features/autofill_assistant/BUILD.gn
+++ b/chrome/android/features/autofill_assistant/BUILD.gn
@@ -196,6 +196,7 @@
     "java/src/org/chromium/chrome/browser/autofill_assistant/overlay/AssistantOverlayModel.java",
     "java/src/org/chromium/chrome/browser/autofill_assistant/user_data/AssistantCollectUserDataModel.java",
     "java/src/org/chromium/chrome/browser/autofill_assistant/user_data/AssistantCollectUserDataNativeDelegate.java",
+    "java/src/org/chromium/chrome/browser/autofill_assistant/user_data/AssistantDateTime.java",
   ]
 }
 
diff --git a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/generic_ui/AssistantGenericUiDelegate.java b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/generic_ui/AssistantGenericUiDelegate.java
index 272bf6a..3907687 100644
--- a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/generic_ui/AssistantGenericUiDelegate.java
+++ b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/generic_ui/AssistantGenericUiDelegate.java
@@ -35,6 +35,13 @@
                 value);
     }
 
+    void onCalendarPopupDateChanged(String identifier, AssistantValue value) {
+        assert mNativeAssistantGenericUiDelegate != 0;
+        AssistantGenericUiDelegateJni.get().onCalendarPopupDateChanged(
+                mNativeAssistantGenericUiDelegate, AssistantGenericUiDelegate.this, identifier,
+                value);
+    }
+
     @CalledByNative
     private void clearNativePtr() {
         mNativeAssistantGenericUiDelegate = 0;
@@ -46,5 +53,7 @@
                 String identifier);
         void onListPopupSelectionChanged(long nativeAssistantGenericUiDelegate,
                 AssistantGenericUiDelegate caller, String identifier, AssistantValue value);
+        void onCalendarPopupDateChanged(long nativeAssistantGenericUiDelegate,
+                AssistantGenericUiDelegate caller, String identifier, AssistantValue value);
     }
 }
diff --git a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/generic_ui/AssistantValue.java b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/generic_ui/AssistantValue.java
index fe66db6..2fc5ada5 100644
--- a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/generic_ui/AssistantValue.java
+++ b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/generic_ui/AssistantValue.java
@@ -8,8 +8,11 @@
 
 import org.chromium.base.annotations.CalledByNative;
 import org.chromium.base.annotations.JNINamespace;
+import org.chromium.chrome.browser.autofill_assistant.user_data.AssistantDateTime;
 
+import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.List;
 
 /** The Java equivalent to {@code ValueProto}. */
 @JNINamespace("autofill_assistant")
@@ -17,29 +20,41 @@
     private final String[] mStrings;
     private final boolean[] mBooleans;
     private final int[] mIntegers;
+    private final List<AssistantDateTime> mDateTimes;
 
     AssistantValue() {
         mStrings = null;
         mBooleans = null;
         mIntegers = null;
+        mDateTimes = null;
     }
 
     public AssistantValue(String[] strings) {
         mStrings = strings;
         mBooleans = null;
         mIntegers = null;
+        mDateTimes = null;
     }
 
     public AssistantValue(boolean[] booleans) {
         mStrings = null;
         mBooleans = booleans;
         mIntegers = null;
+        mDateTimes = null;
     }
 
     public AssistantValue(int[] integers) {
         mStrings = null;
         mBooleans = null;
         mIntegers = integers;
+        mDateTimes = null;
+    }
+
+    public AssistantValue(List<AssistantDateTime> dateTimes) {
+        mStrings = null;
+        mBooleans = null;
+        mIntegers = null;
+        mDateTimes = dateTimes;
     }
 
     @CalledByNative
@@ -63,6 +78,21 @@
     }
 
     @CalledByNative
+    public static AssistantValue createForDateTimes(List<AssistantDateTime> values) {
+        return new AssistantValue(values);
+    }
+
+    @CalledByNative
+    private static List<AssistantDateTime> createDateTimeList() {
+        return new ArrayList<>();
+    }
+
+    @CalledByNative
+    private static void addDateTimeToList(List<AssistantDateTime> list, AssistantDateTime value) {
+        list.add(value);
+    }
+
+    @CalledByNative
     public String[] getStrings() {
         return mStrings;
     }
@@ -77,6 +107,25 @@
         return mIntegers;
     }
 
+    @CalledByNative
+    public List<AssistantDateTime> getDateTimes() {
+        return mDateTimes;
+    }
+
+    public static boolean isDateSingleton(AssistantValue value) {
+        return value != null && value.mDateTimes != null && value.mDateTimes.size() == 1;
+    }
+
+    @CalledByNative
+    private static int getListSize(List list) {
+        return list.size();
+    }
+
+    @CalledByNative
+    private static Object getListAt(List list, int index) {
+        return list.get(index);
+    }
+
     @Override
     public boolean equals(@Nullable Object obj) {
         if (obj == this) {
diff --git a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/generic_ui/AssistantViewInteractions.java b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/generic_ui/AssistantViewInteractions.java
index 64b9802b..982e2d5 100644
--- a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/generic_ui/AssistantViewInteractions.java
+++ b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/generic_ui/AssistantViewInteractions.java
@@ -4,16 +4,22 @@
 
 package org.chromium.chrome.browser.autofill_assistant.generic_ui;
 
+import static org.chromium.chrome.browser.autofill_assistant.generic_ui.AssistantValue.isDateSingleton;
+
 import android.content.Context;
+import android.support.annotation.Nullable;
 import android.view.View;
 
 import org.chromium.base.annotations.CalledByNative;
 import org.chromium.base.annotations.JNINamespace;
+import org.chromium.chrome.browser.autofill_assistant.user_data.AssistantDateTime;
 import org.chromium.content.browser.input.PopupItemType;
 import org.chromium.content.browser.input.SelectPopupDialog;
 import org.chromium.content.browser.input.SelectPopupItem;
+import org.chromium.content.browser.picker.InputDialogContainer;
 
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.List;
 
 /** JNI bridge between {@code interaction_handler_android} and Java. */
@@ -42,4 +48,41 @@
                 popupItems, multiple, selectedItems);
         dialog.show();
     }
+
+    @CalledByNative
+    private static boolean showCalendarPopup(Context context, @Nullable AssistantValue initialDate,
+            AssistantValue minDate, AssistantValue maxDate, String outputIdentifier,
+            AssistantGenericUiDelegate delegate) {
+        if ((initialDate != null && !isDateSingleton(initialDate)) || !isDateSingleton(minDate)
+                || !isDateSingleton(maxDate)) {
+            return false;
+        }
+
+        InputDialogContainer inputDialogContainer =
+                new InputDialogContainer(context, new InputDialogContainer.InputActionDelegate() {
+                    @Override
+                    public void cancelDateTimeDialog() {
+                        // Do nothing.
+                    }
+
+                    @Override
+                    public void replaceDateTime(double value) {
+                        // User tapped the 'clear' button.
+                        if (Double.isNaN(value)) {
+                            delegate.onCalendarPopupDateChanged(outputIdentifier, null);
+                        } else {
+                            delegate.onCalendarPopupDateChanged(outputIdentifier,
+                                    AssistantValue.createForDateTimes(Collections.singletonList(
+                                            new AssistantDateTime((long) value))));
+                        }
+                    }
+                });
+
+        inputDialogContainer.showDialog(org.chromium.ui.base.ime.TextInputType.DATE,
+                initialDate != null ? initialDate.getDateTimes().get(0).getTimeInUtcMillis()
+                                    : Double.NaN,
+                minDate.getDateTimes().get(0).getTimeInUtcMillis(),
+                maxDate.getDateTimes().get(0).getTimeInUtcMillis(), -1, null);
+        return true;
+    }
 }
diff --git a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/user_data/AssistantDateTime.java b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/user_data/AssistantDateTime.java
index a7b91f3..ca1af81 100644
--- a/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/user_data/AssistantDateTime.java
+++ b/chrome/android/features/autofill_assistant/java/src/org/chromium/chrome/browser/autofill_assistant/user_data/AssistantDateTime.java
@@ -4,6 +4,9 @@
 
 package org.chromium.chrome.browser.autofill_assistant.user_data;
 
+import org.chromium.base.annotations.CalledByNative;
+import org.chromium.base.annotations.JNINamespace;
+
 import java.util.Calendar;
 import java.util.Date;
 import java.util.GregorianCalendar;
@@ -17,6 +20,7 @@
  * Note that this class does not make any guarantees with respect to the validity of the represented
  * date/time.
  */
+@JNINamespace("autofill_assistant")
 public class AssistantDateTime {
     /** Year, e.g., 2019. */
     private int mYear;
@@ -31,6 +35,7 @@
     /** Second in [0-59]. */
     private int mSecond;
 
+    @CalledByNative
     public AssistantDateTime(int year, int month, int day, int hour, int minute, int second) {
         set(year, month, day, hour, minute, second);
     }
@@ -75,14 +80,17 @@
         return calendar.getTimeInMillis();
     }
 
+    @CalledByNative
     public int getYear() {
         return mYear;
     }
 
+    @CalledByNative
     public int getMonth() {
         return mMonth;
     }
 
+    @CalledByNative
     public int getDay() {
         return mDay;
     }
diff --git a/chrome/android/features/autofill_assistant/javatests/src/org/chromium/chrome/browser/autofill_assistant/AssistantOnboardingCoordinatorTest.java b/chrome/android/features/autofill_assistant/javatests/src/org/chromium/chrome/browser/autofill_assistant/AssistantOnboardingCoordinatorTest.java
index 4367dce..8d8d1ad 100644
--- a/chrome/android/features/autofill_assistant/javatests/src/org/chromium/chrome/browser/autofill_assistant/AssistantOnboardingCoordinatorTest.java
+++ b/chrome/android/features/autofill_assistant/javatests/src/org/chromium/chrome/browser/autofill_assistant/AssistantOnboardingCoordinatorTest.java
@@ -6,6 +6,7 @@
 
 import static android.support.test.espresso.Espresso.onView;
 import static android.support.test.espresso.action.ViewActions.click;
+import static android.support.test.espresso.action.ViewActions.scrollTo;
 import static android.support.test.espresso.assertion.ViewAssertions.matches;
 import static android.support.test.espresso.matcher.ViewMatchers.assertThat;
 import static android.support.test.espresso.matcher.ViewMatchers.isCompletelyDisplayed;
@@ -37,7 +38,6 @@
 
 import org.chromium.base.Callback;
 import org.chromium.base.test.util.CommandLineFlags;
-import org.chromium.base.test.util.DisableIf;
 import org.chromium.chrome.autofill_assistant.R;
 import org.chromium.chrome.browser.ChromeActivity;
 import org.chromium.chrome.browser.autofill_assistant.overlay.AssistantOverlayCoordinator;
@@ -92,14 +92,12 @@
 
     @Test
     @MediumTest
-    @DisableIf.Build(sdk_is_greater_than = 22) // TODO(crbug/991938): re-enable
     public void testAcceptOnboarding() throws Exception {
         testOnboarding(R.id.button_init_ok, true);
     }
 
     @Test
     @MediumTest
-    @DisableIf.Build(sdk_is_greater_than = 22) // TODO(crbug/990118): re-enable
     public void testRejectOnboarding() throws Exception {
         testOnboarding(R.id.button_init_not_ok, false);
     }
@@ -112,17 +110,15 @@
 
         assertTrue(TestThreadUtils.runOnUiThreadBlocking(coordinator::isInProgress));
         onView(is(mActivity.getScrim())).check(matches(isDisplayed()));
-        onView(withId(buttonToClick)).perform(click());
+        onView(withId(buttonToClick)).perform(scrollTo(), click());
 
         verify(mCallback).onResult(expectAccept);
-
         assertFalse(TestThreadUtils.runOnUiThreadBlocking(coordinator::isInProgress));
         assertEquals(expectAccept, AutofillAssistantPreferencesUtil.isAutofillOnboardingAccepted());
     }
 
     @Test
     @MediumTest
-    @DisableIf.Build(sdk_is_greater_than = 22) // TODO(crbug/990118): re-enable
     public void testOnboardingWithNoTabs() {
         AssistantOnboardingCoordinator coordinator = createCoordinator(/* tab= */ null);
         showOnboardingAndWait(coordinator, mCallback);
@@ -134,7 +130,6 @@
 
     @Test
     @MediumTest
-    @DisableIf.Build(sdk_is_greater_than = 22) // TODO(crbug/990118): re-enable
     public void testTransferControls() throws Exception {
         AssistantOnboardingCoordinator coordinator = createCoordinator(mTab);
 
@@ -161,7 +156,6 @@
 
     @Test
     @MediumTest
-    @DisableIf.Build(sdk_is_greater_than = 22) // TODO(crbug/991938): re-enable
     public void testShownFlag() throws Exception {
         AssistantOnboardingCoordinator coordinator = createCoordinator(/* tab= */ null);
         assertFalse(coordinator.getOnboardingShown());
diff --git a/chrome/android/features/autofill_assistant/javatests/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantGenericUiTest.java b/chrome/android/features/autofill_assistant/javatests/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantGenericUiTest.java
index edeafa2..ec4aeb4 100644
--- a/chrome/android/features/autofill_assistant/javatests/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantGenericUiTest.java
+++ b/chrome/android/features/autofill_assistant/javatests/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantGenericUiTest.java
@@ -8,11 +8,13 @@
 import static android.support.test.espresso.action.ViewActions.click;
 import static android.support.test.espresso.assertion.PositionAssertions.isLeftAlignedWith;
 import static android.support.test.espresso.assertion.ViewAssertions.matches;
+import static android.support.test.espresso.contrib.PickerActions.setDate;
 import static android.support.test.espresso.matcher.RootMatchers.isDialog;
 import static android.support.test.espresso.matcher.ViewMatchers.assertThat;
 import static android.support.test.espresso.matcher.ViewMatchers.isCompletelyDisplayed;
 import static android.support.test.espresso.matcher.ViewMatchers.isDisplayed;
 import static android.support.test.espresso.matcher.ViewMatchers.isEnabled;
+import static android.support.test.espresso.matcher.ViewMatchers.withClassName;
 import static android.support.test.espresso.matcher.ViewMatchers.withContentDescription;
 import static android.support.test.espresso.matcher.ViewMatchers.withTagValue;
 import static android.support.test.espresso.matcher.ViewMatchers.withText;
@@ -20,6 +22,7 @@
 import static org.hamcrest.CoreMatchers.is;
 import static org.hamcrest.CoreMatchers.not;
 import static org.hamcrest.Matchers.containsInAnyOrder;
+import static org.hamcrest.Matchers.equalTo;
 import static org.hamcrest.Matchers.isIn;
 import static org.hamcrest.Matchers.iterableWithSize;
 
@@ -28,6 +31,7 @@
 
 import android.support.test.InstrumentationRegistry;
 import android.support.test.filters.MediumTest;
+import android.widget.DatePicker;
 
 import org.junit.Before;
 import org.junit.Rule;
@@ -49,6 +53,8 @@
 import org.chromium.chrome.browser.autofill_assistant.proto.CollectUserDataResultProto;
 import org.chromium.chrome.browser.autofill_assistant.proto.ColorProto;
 import org.chromium.chrome.browser.autofill_assistant.proto.ComputeValueProto;
+import org.chromium.chrome.browser.autofill_assistant.proto.DateList;
+import org.chromium.chrome.browser.autofill_assistant.proto.DateProto;
 import org.chromium.chrome.browser.autofill_assistant.proto.DividerViewProto;
 import org.chromium.chrome.browser.autofill_assistant.proto.DrawableProto;
 import org.chromium.chrome.browser.autofill_assistant.proto.EndActionProto;
@@ -70,6 +76,7 @@
 import org.chromium.chrome.browser.autofill_assistant.proto.SetModelValueProto;
 import org.chromium.chrome.browser.autofill_assistant.proto.SetUserActionsProto;
 import org.chromium.chrome.browser.autofill_assistant.proto.ShapeDrawableProto;
+import org.chromium.chrome.browser.autofill_assistant.proto.ShowCalendarPopupProto;
 import org.chromium.chrome.browser.autofill_assistant.proto.ShowGenericUiProto;
 import org.chromium.chrome.browser.autofill_assistant.proto.ShowInfoPopupProto;
 import org.chromium.chrome.browser.autofill_assistant.proto.ShowListPopupProto;
@@ -958,4 +965,125 @@
                                         IntList.newBuilder().addValues(1)))
                                 .build()));
     }
+
+    /**
+     * Displays a calendar popup and interacts with it.
+     */
+    @Test
+    @MediumTest
+    public void testCalendarPopup() {
+        List<ModelProto.ModelValue> modelValues = new ArrayList<>();
+        modelValues.add(
+                (ModelProto.ModelValue) ModelProto.ModelValue.newBuilder()
+                        .setIdentifier("date")
+                        .setValue(ValueProto.newBuilder().setDates(DateList.newBuilder().addValues(
+                                DateProto.newBuilder().setYear(2020).setMonth(4).setDay(15))))
+                        .build());
+        modelValues.add(
+                (ModelProto.ModelValue) ModelProto.ModelValue.newBuilder()
+                        .setIdentifier("min_date")
+                        .setValue(ValueProto.newBuilder().setDates(DateList.newBuilder().addValues(
+                                DateProto.newBuilder().setYear(2020).setMonth(1).setDay(1))))
+                        .build());
+        modelValues.add(
+                (ModelProto.ModelValue) ModelProto.ModelValue.newBuilder()
+                        .setIdentifier("max_date")
+                        .setValue(ValueProto.newBuilder().setDates(DateList.newBuilder().addValues(
+                                DateProto.newBuilder().setYear(2020).setMonth(12).setDay(31))))
+                        .build());
+        modelValues.add(
+                (ModelProto.ModelValue) ModelProto.ModelValue.newBuilder()
+                        .setIdentifier("chips")
+                        .setValue(ValueProto.newBuilder().setUserActions(
+                                UserActionList.newBuilder().addValues(
+                                        UserActionProto.newBuilder()
+                                                .setChip(ChipProto.newBuilder()
+                                                                 .setText("Done")
+                                                                 .setType(ChipType.NORMAL_ACTION))
+                                                .setIdentifier("done_chip"))))
+                        .build());
+
+        List<InteractionProto> interactions = new ArrayList<>();
+        interactions.add(
+                (InteractionProto) InteractionProto.newBuilder()
+                        .setTriggerEvent(EventProto.newBuilder().setOnValueChanged(
+                                OnModelValueChangedEventProto.newBuilder().setModelIdentifier(
+                                        "chips")))
+                        .addCallbacks(CallbackProto.newBuilder().setSetUserActions(
+                                SetUserActionsProto.newBuilder().setModelIdentifier("chips")))
+                        .build());
+        interactions.add((InteractionProto) InteractionProto.newBuilder()
+                                 .setTriggerEvent(EventProto.newBuilder().setOnUserActionCalled(
+                                         OnUserActionCalled.newBuilder().setUserActionIdentifier(
+                                                 "done_chip")))
+                                 .addCallbacks(CallbackProto.newBuilder().setEndAction(
+                                         EndActionProto.newBuilder().setStatus(
+                                                 ProcessedActionStatusProto.ACTION_APPLIED)))
+                                 .build());
+        interactions.add((InteractionProto) InteractionProto.newBuilder()
+                                 .setTriggerEvent(EventProto.newBuilder().setOnViewClicked(
+                                         OnViewClickedEventProto.newBuilder().setViewIdentifier(
+                                                 "text_view")))
+                                 .addCallbacks(CallbackProto.newBuilder().setShowCalendarPopup(
+                                         ShowCalendarPopupProto.newBuilder()
+                                                 .setDateModelIdentifier("date")
+                                                 .setMinDateModelIdentifier("min_date")
+                                                 .setMaxDateModelIdentifier("max_date")))
+                                 .build());
+
+        GenericUserInterfaceProto genericUserInterface =
+                (GenericUserInterfaceProto) GenericUserInterfaceProto.newBuilder()
+                        .setRootView(createTextView("Click me", "text_view"))
+                        .setInteractions(
+                                InteractionsProto.newBuilder().addAllInteractions(interactions))
+                        .setModel(ModelProto.newBuilder().addAllValues(modelValues))
+                        .build();
+
+        ArrayList<ActionProto> list = new ArrayList<>();
+        list.add((ActionProto) ActionProto.newBuilder()
+                         .setShowGenericUi(ShowGenericUiProto.newBuilder()
+                                                   .setGenericUserInterface(genericUserInterface)
+                                                   .addOutputModelIdentifiers("date"))
+                         .build());
+        AutofillAssistantTestScript script = new AutofillAssistantTestScript(
+                (SupportedScriptProto) SupportedScriptProto.newBuilder()
+                        .setPath("form_target_website.html")
+                        .setPresentation(PresentationProto.newBuilder().setAutostart(true).setChip(
+                                ChipProto.newBuilder().setText("Autostart")))
+                        .build(),
+                list);
+
+        AutofillAssistantTestService testService =
+                new AutofillAssistantTestService(Collections.singletonList(script));
+        startAutofillAssistant(mTestRule.getActivity(), testService);
+
+        waitUntilViewMatchesCondition(withText("Done"), isCompletelyDisplayed());
+
+        onView(withText("Click me")).perform(click());
+        onView(withClassName(equalTo(DatePicker.class.getName())))
+                .inRoot(isDialog())
+                .perform(setDate(2020, 7, 13));
+        onView(withText(R.string.date_picker_dialog_set)).inRoot(isDialog()).perform(click());
+
+        int numNextActionsCalled = testService.getNextActionsCounter();
+        onView(withContentDescription("Done")).perform(click());
+        testService.waitUntilGetNextActions(numNextActionsCalled + 1);
+
+        List<ProcessedActionProto> processedActions = testService.getProcessedActions();
+        assertThat(processedActions, iterableWithSize(1));
+        assertThat(
+                processedActions.get(0).getStatus(), is(ProcessedActionStatusProto.ACTION_APPLIED));
+        ShowGenericUiProto.Result result = processedActions.get(0).getShowGenericUiResult();
+        List<ModelProto.ModelValue> resultModelValues = result.getModel().getValuesList();
+        assertThat(resultModelValues, iterableWithSize(1));
+        assertThat(resultModelValues.get(0),
+                is((ModelProto.ModelValue) ModelProto.ModelValue.newBuilder()
+                                .setIdentifier("date")
+                                .setValue(ValueProto.newBuilder().setDates(
+                                        DateList.newBuilder().addValues(DateProto.newBuilder()
+                                                                                .setYear(2020)
+                                                                                .setMonth(7)
+                                                                                .setDay(13))))
+                                .build()));
+    }
 }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/compositor/bottombar/ephemeraltab/EphemeralTabSheetContent.java b/chrome/android/java/src/org/chromium/chrome/browser/compositor/bottombar/ephemeraltab/EphemeralTabSheetContent.java
index d1e7a23..bcf6f79 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/compositor/bottombar/ephemeraltab/EphemeralTabSheetContent.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/compositor/bottombar/ephemeraltab/EphemeralTabSheetContent.java
@@ -24,6 +24,7 @@
 import org.chromium.chrome.browser.thinwebview.ThinWebViewFactory;
 import org.chromium.chrome.browser.widget.bottomsheet.BottomSheetContent;
 import org.chromium.chrome.browser.widget.bottomsheet.BottomSheetController;
+import org.chromium.components.browser_ui.modaldialog.AppModalPresenter;
 import org.chromium.components.browser_ui.widget.FadingShadow;
 import org.chromium.components.browser_ui.widget.FadingShadowView;
 import org.chromium.components.embedder_support.delegate.WebContentsDelegateAndroid;
@@ -33,6 +34,7 @@
 import org.chromium.content_public.browser.RenderCoordinates;
 import org.chromium.content_public.browser.WebContents;
 import org.chromium.ui.base.ActivityWindowAndroid;
+import org.chromium.ui.modaldialog.ModalDialogManager;
 import org.chromium.url.GURL;
 
 /**
@@ -56,6 +58,7 @@
     private FadingShadowView mShadow;
     private Drawable mCurrentFavicon;
     private ImageView mFaviconView;
+    private ModalDialogManager mModalDialogManager;
 
     /**
      * Constructor.
@@ -99,8 +102,12 @@
      * bottom sheet.
      */
     private void createThinWebView(int maxSheetHeight) {
-        mThinWebView = ThinWebViewFactory.create(
-                mContext, new ActivityWindowAndroid(mContext), new ThinWebViewConstraints());
+        mThinWebView = ThinWebViewFactory.create(mContext, new ActivityWindowAndroid(mContext) {
+            @Override
+            public @Nullable ModalDialogManager getModalDialogManager() {
+                return EphemeralTabSheetContent.this.getModalDialogManager();
+            }
+        }, new ThinWebViewConstraints());
 
         mSheetContentView = new FrameLayout(mContext);
         mThinWebView.getView().setLayoutParams(new FrameLayout.LayoutParams(
@@ -110,6 +117,14 @@
         mSheetContentView.setPadding(0, mToolbarHeightPx, 0, 0);
     }
 
+    private ModalDialogManager getModalDialogManager() {
+        if (mModalDialogManager == null) {
+            mModalDialogManager = new ModalDialogManager(
+                    new AppModalPresenter(mContext), ModalDialogManager.ModalDialogType.APP);
+        }
+        return mModalDialogManager;
+    }
+
     private void createToolbarView() {
         mToolbarView =
                 (ViewGroup) LayoutInflater.from(mContext).inflate(R.layout.sheet_tab_toolbar, null);
@@ -231,6 +246,10 @@
     @Override
     public void destroy() {
         mThinWebView.destroy();
+        if (mModalDialogManager != null) {
+            mModalDialogManager.destroy();
+            mModalDialogManager = null;
+        }
     }
 
     @Override
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/contextualsearch/ContextualSearchManager.java b/chrome/android/java/src/org/chromium/chrome/browser/contextualsearch/ContextualSearchManager.java
index a79597b..9d5dbb3c 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/contextualsearch/ContextualSearchManager.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/contextualsearch/ContextualSearchManager.java
@@ -35,7 +35,6 @@
 import org.chromium.chrome.browser.contextualsearch.ResolvedSearchTerm.CardTag;
 import org.chromium.chrome.browser.externalnav.ExternalNavigationHandler;
 import org.chromium.chrome.browser.externalnav.ExternalNavigationHandler.OverrideUrlLoadingResult;
-import org.chromium.chrome.browser.externalnav.ExternalNavigationParams;
 import org.chromium.chrome.browser.feature_engagement.TrackerFactory;
 import org.chromium.chrome.browser.fullscreen.ChromeFullscreenManager.FullscreenListener;
 import org.chromium.chrome.browser.fullscreen.FullscreenOptions;
@@ -55,6 +54,7 @@
 import org.chromium.chrome.browser.tabmodel.TabModelSelectorTabModelObserver;
 import org.chromium.chrome.browser.tabmodel.TabModelSelectorTabObserver;
 import org.chromium.chrome.browser.util.AccessibilityUtil;
+import org.chromium.components.external_intents.ExternalNavigationParams;
 import org.chromium.components.feature_engagement.EventConstants;
 import org.chromium.components.feature_engagement.FeatureConstants;
 import org.chromium.components.feature_engagement.Tracker;
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegate.java
index 14593a9..f3823e9 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegate.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegate.java
@@ -11,6 +11,7 @@
 
 import org.chromium.base.PackageManagerUtils;
 import org.chromium.chrome.browser.externalnav.ExternalNavigationHandler.OverrideUrlLoadingResult;
+import org.chromium.components.external_intents.ExternalNavigationParams;
 
 import java.util.List;
 
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegateImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegateImpl.java
index 04d6949..2fc190e 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegateImpl.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegateImpl.java
@@ -54,6 +54,7 @@
 import org.chromium.components.embedder_support.util.UrlConstants;
 import org.chromium.components.embedder_support.util.UrlUtilities;
 import org.chromium.components.embedder_support.util.UrlUtilitiesJni;
+import org.chromium.components.external_intents.ExternalNavigationParams;
 import org.chromium.content_public.browser.LoadUrlParams;
 import org.chromium.content_public.browser.NavigationController;
 import org.chromium.content_public.browser.NavigationEntry;
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationHandler.java
index 3fbfd99..377ee98d 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationHandler.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationHandler.java
@@ -30,6 +30,7 @@
 import org.chromium.components.embedder_support.util.UrlConstants;
 import org.chromium.components.embedder_support.util.UrlUtilities;
 import org.chromium.components.external_intents.ExternalIntentsSwitches;
+import org.chromium.components.external_intents.ExternalNavigationParams;
 import org.chromium.components.external_intents.RedirectHandler;
 import org.chromium.content_public.common.ContentUrlConstants;
 import org.chromium.ui.base.PageTransition;
@@ -357,6 +358,13 @@
         return false;
     }
 
+    /** Wrapper of check against the feature to support overriding for testing. */
+    @VisibleForTesting
+    boolean blockExternalFormRedirectsWithoutGesture() {
+        return ChromeFeatureList.isEnabled(
+                ChromeFeatureList.INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE);
+    }
+
     /**
      * http://crbug.com/149218: We want to show the intent picker for ordinary links, providing
      * the link is not an incoming intent from another application, unless it's a redirect.
@@ -382,8 +390,7 @@
         // TODO(tedchoc): Remove the ChromeFeatureList check once we verify this change does
         //                not break the world.
         if (isRedirectFromFormSubmit && !incomingIntentRedirect && !params.hasUserGesture()
-                && ChromeFeatureList.isEnabled(
-                        ChromeFeatureList.INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE)) {
+                && blockExternalFormRedirectsWithoutGesture()) {
             if (DEBUG) {
                 Log.i(TAG,
                         "Incoming form intent attempting to redirect without "
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateImpl.java
index 00f439f4..5ec4fc1 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateImpl.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateImpl.java
@@ -16,8 +16,8 @@
 import org.chromium.chrome.browser.ChromeActivity;
 import org.chromium.chrome.browser.externalnav.ExternalNavigationHandler;
 import org.chromium.chrome.browser.externalnav.ExternalNavigationHandler.OverrideUrlLoadingResult;
-import org.chromium.chrome.browser.externalnav.ExternalNavigationParams;
 import org.chromium.chrome.browser.tabmodel.TabModelSelector;
+import org.chromium.components.external_intents.ExternalNavigationParams;
 import org.chromium.components.navigation_interception.InterceptNavigationDelegate;
 import org.chromium.components.navigation_interception.NavigationParams;
 import org.chromium.content_public.browser.NavigationController;
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabExternalNavigationTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabExternalNavigationTest.java
index 36cc37cf0..718b84e 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabExternalNavigationTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/customtabs/CustomTabExternalNavigationTest.java
@@ -22,12 +22,12 @@
 import org.chromium.chrome.browser.customtabs.CustomTabDelegateFactory.CustomTabNavigationDelegate;
 import org.chromium.chrome.browser.externalnav.ExternalNavigationHandler;
 import org.chromium.chrome.browser.externalnav.ExternalNavigationHandler.OverrideUrlLoadingResult;
-import org.chromium.chrome.browser.externalnav.ExternalNavigationParams;
 import org.chromium.chrome.browser.flags.ChromeSwitches;
 import org.chromium.chrome.browser.tab.Tab;
 import org.chromium.chrome.browser.tab.TabDelegateFactory;
 import org.chromium.chrome.browser.tab.TabTestUtils;
 import org.chromium.chrome.test.ChromeJUnit4ClassRunner;
+import org.chromium.components.external_intents.ExternalNavigationParams;
 import org.chromium.net.test.EmbeddedTestServer;
 
 /**
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegateImplTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegateImplTest.java
index 2df89b1f..03900b1 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegateImplTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/externalnav/ExternalNavigationDelegateImplTest.java
@@ -27,6 +27,7 @@
 import org.chromium.chrome.test.ChromeActivityTestRule;
 import org.chromium.chrome.test.ChromeJUnit4ClassRunner;
 import org.chromium.chrome.test.util.browser.Features;
+import org.chromium.components.external_intents.ExternalNavigationParams;
 
 import java.util.ArrayList;
 import java.util.Arrays;
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/externalnav/ExternalNavigationHandlerTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/externalnav/ExternalNavigationHandlerTest.java
index babd212..5051cd8 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/externalnav/ExternalNavigationHandlerTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/externalnav/ExternalNavigationHandlerTest.java
@@ -42,6 +42,7 @@
 import org.chromium.chrome.browser.webapps.WebappScopePolicy;
 import org.chromium.chrome.test.util.browser.Features;
 import org.chromium.chrome.test.util.browser.webapps.WebappTestHelper;
+import org.chromium.components.external_intents.ExternalNavigationParams;
 import org.chromium.content_public.browser.test.NativeLibraryTestRule;
 import org.chromium.ui.base.PageTransition;
 import org.chromium.webapk.lib.common.WebApkConstants;
@@ -58,8 +59,7 @@
 // clang-format off
 @DisableIf.Build(message = "Flaky on K - see https://crbug.com/851444",
         sdk_is_less_than = Build.VERSION_CODES.LOLLIPOP)
-@Features.EnableFeatures({ChromeFeatureList.CCT_EXTERNAL_LINK_HANDLING,
-        ChromeFeatureList.INTENT_BLOCK_EXTERNAL_FORM_REDIRECT_NO_GESTURE})
+@Features.EnableFeatures({ChromeFeatureList.CCT_EXTERNAL_LINK_HANDLING})
 public class ExternalNavigationHandlerTest {
     // clang-format on
     @Rule
@@ -139,7 +139,12 @@
 
     public ExternalNavigationHandlerTest() {
         mDelegate = new TestExternalNavigationDelegate();
-        mUrlHandler = new ExternalNavigationHandler(mDelegate);
+        mUrlHandler = new ExternalNavigationHandler(mDelegate) {
+            @Override
+            boolean blockExternalFormRedirectsWithoutGesture() {
+                return true;
+            }
+        };
     }
 
     @Before
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateTest.java
index 42fc9fd..adabb790 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/tab/InterceptNavigationDelegateTest.java
@@ -20,10 +20,10 @@
 import org.chromium.chrome.browser.ChromeActivity;
 import org.chromium.chrome.browser.externalnav.ExternalNavigationDelegateImpl;
 import org.chromium.chrome.browser.externalnav.ExternalNavigationHandler;
-import org.chromium.chrome.browser.externalnav.ExternalNavigationParams;
 import org.chromium.chrome.browser.flags.ChromeSwitches;
 import org.chromium.chrome.test.ChromeActivityTestRule;
 import org.chromium.chrome.test.ChromeJUnit4ClassRunner;
+import org.chromium.components.external_intents.ExternalNavigationParams;
 import org.chromium.components.navigation_interception.NavigationParams;
 import org.chromium.content_public.browser.test.util.Criteria;
 import org.chromium.content_public.browser.test.util.CriteriaHelper;
diff --git a/chrome/app/settings_strings.grdp b/chrome/app/settings_strings.grdp
index 25bf372..76a655bb 100644
--- a/chrome/app/settings_strings.grdp
+++ b/chrome/app/settings_strings.grdp
@@ -1684,7 +1684,46 @@
     Safe Browsing
   </message>
   <message name="IDS_SETTINGS_SAFEBROWSING_ENABLE_REPORTING_DESC" desc="Description for extended safe browsing">
-    To detect dangerous apps and sites, Chrome sends URLs of some pages you visit, limited system information, and some page content to Google
+    Sends anonymous URLs of some pages you visit, limited system information, and some page content to help discover and block new threats against all users on the web.
+  </message>
+  <message name="IDS_SETTINGS_SAFEBROWSING_ENHANCED" desc="Label for safe browsing enhanced protection mode">
+    Enhanced Protection
+  </message>
+  <message name="IDS_SETTINGS_SAFEBROWSING_ENHANCED_DESC" desc="Description of safe browsing enhanced protection mode">
+    Faster, proactive protection against dangerous websites, downloads, and extensions. Warns you about password breaches. Requires browsing data to be sent to Google. 
+  </message>
+  <message name="IDS_SETTINGS_SAFEBROWSING_ENHANCED_BULLET_ONE" desc="First bullet point under the safe browsing enhanced protection mode">
+    Predicts and warns you about dangerous events before they happen.
+  </message>
+  <message name="IDS_SETTINGS_SAFEBROWSING_ENHANCED_BULLET_TWO" desc="Second bullet point under the safe browsing enhanced protection mode">
+    Keeps you safe on Chrome and other Google apps when you’re signed in.
+  </message>
+  <message name="IDS_SETTINGS_SAFEBROWSING_ENHANCED_BULLET_THREE" desc="Third bullet point under the safe browsing enhanced protection mode">
+    Improves security for you and everyone on the web.
+  </message>
+  <message name="IDS_SETTINGS_SAFEBROWSING_ENHANCED_BULLET_FOUR" desc="Fourth bullet point under the safe browsing enhanced protection mode">
+    Warns you if passwords are exposed in a data breach.
+  </message>
+  <message name="IDS_SETTINGS_SAFEBROWSING_ENHANCED_BULLET_FIVE" desc="Fourth bullet point under the safe browsing enhanced protection mode">
+    Sends URLs to Safe Browsing to check them. Also sends a small sample of pages, downloads, extension activity, and system information to help discover new threats. Temporarily links this data to your Google Account when you're signed in, to protect you across Google apps.
+  </message>
+  <message name="IDS_SETTINGS_SAFEBROWSING_STANDARD" desc="Label for safe browsing standard protection mode">
+    Standard Protection
+  </message>
+  <message name="IDS_SETTINGS_SAFEBROWSING_STANDARD_DESC" desc="Description for safe browsing standard protection mode">
+    Standard protection against websites, downloads, and extensions that are known to be dangerous.
+  </message>
+  <message name="IDS_SETTINGS_SAFEBROWSING_STANDARD_BULLET_ONE" desc="First bullet point under the safe browsing standard protection mode">
+    Detects and warns you about dangerous events when they happen.
+  </message>
+  <message name="IDS_SETTINGS_SAFEBROWSING_STANDARD_BULLET_TWO" desc="First bullet point under the safe browsing standard protection mode">
+    Checks URLs with a list of unsafe sites stored in Chrome. If a site tries to steal your password, or when you download a harmful file, Chrome may also send URLs, including bits of page content, to Safe Browsing.
+  </message>
+  <message name="IDS_SETTINGS_SAFEBROWSING_NONE" desc="Label for safe browsing no protection mode">
+    No Protection (not recommended)
+  </message>
+  <message name="IDS_SETTINGS_SAFEBROWSING_NONE_DESC" desc="Description for safe browsing no protection mode">
+    Does not protect you against dangerous websites, downloads, or extensions.
   </message>
   <message name="IDS_SETTINGS_ENABLE_DO_NOT_TRACK" desc="The label of the checkbox to enable/disable sending the 'Do Not track' header">
     Send a "Do Not Track" request with your browsing traffic
diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
index 42952bc..0a877e9 100644
--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn
@@ -5613,6 +5613,7 @@
       "//chrome/browser/resources/chromeos/emulator:polymer3_elements",
       "//chrome/browser/resources/chromeos/set_time_dialog:polymer3_elements",
       "//chrome/browser/resources/chromeos/smb_shares:polymer3_elements",
+      "//chrome/browser/supervised_user:supervised_user_unscaled_resources",
       "//chrome/browser/ui/webui/chromeos/add_supervision:mojo_bindings_js",
       "//chrome/browser/ui/webui/chromeos/crostini_installer:mojo_bindings_js",
       "//chrome/browser/ui/webui/chromeos/crostini_upgrader:mojo_bindings_js",
diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
index bce67ed..87f484ca 100644
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc
@@ -2595,6 +2595,10 @@
      ENABLE_DISABLE_VALUE_TYPE(
          chromeos::switches::kEnableEncryptionMigration,
          chromeos::switches::kDisableEncryptionMigration)},
+    {"enable-cros-ime-assist-autocorrect",
+     flag_descriptions::kImeAssistAutocorrectName,
+     flag_descriptions::kImeAssistAutocorrectDescription, kOsCrOS,
+     FEATURE_VALUE_TYPE(chromeos::features::kAssistPersonalInfo)},
     {"enable-cros-ime-assist-personal-info",
      flag_descriptions::kImeAssistPersonalInfoName,
      flag_descriptions::kImeAssistPersonalInfoDescription, kOsCrOS,
@@ -4164,6 +4168,16 @@
      flag_descriptions::kEnableNeuralStylusPalmRejectionDescription, kOsCrOS,
      FEATURE_VALUE_TYPE(ui::kEnableNeuralPalmDetectionFilter)},
 
+    {"enable-palm-max-touch-major",
+     flag_descriptions::kEnablePalmOnMaxTouchMajorName,
+     flag_descriptions::kEnablePalmOnMaxTouchMajorDescription, kOsCrOS,
+     FEATURE_VALUE_TYPE(ui::kEnablePalmOnMaxTouchMajor)},
+
+    {"enable-palm-tool-type-palm",
+     flag_descriptions::kEnablePalmOnToolTypePalmName,
+     flag_descriptions::kEnablePalmOnToolTypePalmName, kOsCrOS,
+     FEATURE_VALUE_TYPE(ui::kEnablePalmOnToolTypePalm)},
+
     {"enable-heuristic-stylus-palm-rejection",
      flag_descriptions::kEnableHeuristicStylusPalmRejectionName,
      flag_descriptions::kEnableHeuristicStylusPalmRejectionDescription, kOsCrOS,
diff --git a/chrome/browser/android/autofill_assistant/assistant_generic_ui_delegate.cc b/chrome/browser/android/autofill_assistant/assistant_generic_ui_delegate.cc
index 148bd95..ec9924a 100644
--- a/chrome/browser/android/autofill_assistant/assistant_generic_ui_delegate.cc
+++ b/chrome/browser/android/autofill_assistant/assistant_generic_ui_delegate.cc
@@ -57,6 +57,26 @@
   ui_controller_->OnValueChanged(identifier, value);
 }
 
+// TODO(b/145043394): refactor delegate methods into a single SetValue() where
+// possible.
+void AssistantGenericUiDelegate::OnCalendarPopupDateChanged(
+    JNIEnv* env,
+    const base::android::JavaParamRef<jobject>& jcaller,
+    const base::android::JavaParamRef<jstring>& jmodel_identifier,
+    const base::android::JavaParamRef<jobject>& jvalue) {
+  std::string identifier;
+  if (jmodel_identifier) {
+    base::android::ConvertJavaStringToUTF8(env, jmodel_identifier, &identifier);
+  }
+
+  ValueProto value;
+  if (jvalue) {
+    value = ui_controller_android_utils::ToNativeValue(env, jvalue);
+  }
+
+  ui_controller_->OnValueChanged(identifier, value);
+}
+
 base::android::ScopedJavaGlobalRef<jobject>
 AssistantGenericUiDelegate::GetJavaObject() {
   return java_assistant_generic_ui_delegate_;
diff --git a/chrome/browser/android/autofill_assistant/assistant_generic_ui_delegate.h b/chrome/browser/android/autofill_assistant/assistant_generic_ui_delegate.h
index 1ee42630..ff0aac40 100644
--- a/chrome/browser/android/autofill_assistant/assistant_generic_ui_delegate.h
+++ b/chrome/browser/android/autofill_assistant/assistant_generic_ui_delegate.h
@@ -32,6 +32,16 @@
       const base::android::JavaParamRef<jstring>& jmodel_identifier,
       const base::android::JavaParamRef<jobject>& jvalue);
 
+  // The date in a calendar popup has changed. |jmodel_identifier| is the model
+  // identifier that the new date should be written to. |jvalue| is a Java
+  // AssistantValue containing a single AssistantDateTime with the new date, or
+  // nullptr if the date was cleared.
+  void OnCalendarPopupDateChanged(
+      JNIEnv* env,
+      const base::android::JavaParamRef<jobject>& jcaller,
+      const base::android::JavaParamRef<jstring>& jmodel_identifier,
+      const base::android::JavaParamRef<jobject>& jvalue);
+
   base::android::ScopedJavaGlobalRef<jobject> GetJavaObject();
 
  private:
diff --git a/chrome/browser/android/autofill_assistant/interaction_handler_android.cc b/chrome/browser/android/autofill_assistant/interaction_handler_android.cc
index 4f3444c..a07268a 100644
--- a/chrome/browser/android/autofill_assistant/interaction_handler_android.cc
+++ b/chrome/browser/android/autofill_assistant/interaction_handler_android.cc
@@ -154,6 +154,54 @@
       proto.allow_multiselect(), jidentifier, jdelegate);
 }
 
+void ShowCalendarPopup(base::WeakPtr<UserModel> user_model,
+                       const ShowCalendarPopupProto& proto,
+                       base::android::ScopedJavaGlobalRef<jobject> jcontext,
+                       base::android::ScopedJavaGlobalRef<jobject> jdelegate) {
+  if (!user_model) {
+    return;
+  }
+
+  JNIEnv* env = base::android::AttachCurrentThread();
+  auto initial_date = user_model->GetValue(proto.date_model_identifier());
+  if (initial_date.has_value() && initial_date->dates().values_size() != 1) {
+    DVLOG(2) << "Failed to show calendar popup: date_model_identifier must be "
+                "empty or contain single date, but was "
+             << *initial_date;
+    return;
+  }
+
+  auto min_date = user_model->GetValue(proto.min_date_model_identifier());
+  if (!min_date.has_value() || min_date->dates().values_size() != 1) {
+    DVLOG(2) << "Failed to show calendar popup: min_date not found or invalid "
+                "in user model at "
+             << proto.min_date_model_identifier();
+    return;
+  }
+
+  auto max_date = user_model->GetValue(proto.max_date_model_identifier());
+  if (!max_date.has_value() || max_date->dates().values_size() != 1) {
+    DVLOG(2) << "Failed to show calendar popup: max_date not found or invalid "
+                "in user model at "
+             << proto.max_date_model_identifier();
+    return;
+  }
+
+  jboolean jsuccess = Java_AssistantViewInteractions_showCalendarPopup(
+      env, jcontext,
+      initial_date.has_value()
+          ? ui_controller_android_utils::ToJavaValue(env, *initial_date)
+          : nullptr,
+      ui_controller_android_utils::ToJavaValue(env, *min_date),
+      ui_controller_android_utils::ToJavaValue(env, *max_date),
+      base::android::ConvertUTF8ToJavaString(env,
+                                             proto.date_model_identifier()),
+      jdelegate);
+  if (!jsuccess) {
+    DVLOG(2) << "Failed to show calendar popup: JNI call failed";
+  }
+}
+
 base::Optional<EventHandler::EventKey> CreateEventKeyFromProto(
     const EventProto& proto,
     JNIEnv* env,
@@ -252,6 +300,17 @@
       return base::Optional<InteractionHandlerAndroid::InteractionCallback>(
           base::BindRepeating(&TryEndAction, basic_interactions->GetWeakPtr(),
                               proto.end_action()));
+    case CallbackProto::kShowCalendarPopup:
+      if (proto.show_calendar_popup().date_model_identifier().empty()) {
+        VLOG(1) << "Error creating ShowCalendarPopup interaction: "
+                   "date_model_identifier not set";
+        return base::nullopt;
+      }
+      return base::Optional<InteractionHandlerAndroid::InteractionCallback>(
+          base::BindRepeating(&ShowCalendarPopup, user_model->GetWeakPtr(),
+                              proto.show_calendar_popup(), jcontext,
+                              jdelegate));
+      break;
     case CallbackProto::KIND_NOT_SET:
       VLOG(1) << "Error creating interaction: kind not set";
       return base::nullopt;
diff --git a/chrome/browser/android/autofill_assistant/ui_controller_android_utils.cc b/chrome/browser/android/autofill_assistant/ui_controller_android_utils.cc
index 828531c..753854c9 100644
--- a/chrome/browser/android/autofill_assistant/ui_controller_android_utils.cc
+++ b/chrome/browser/android/autofill_assistant/ui_controller_android_utils.cc
@@ -6,6 +6,7 @@
 #include "base/android/jni_array.h"
 #include "base/android/jni_string.h"
 #include "chrome/android/features/autofill_assistant/jni_headers/AssistantColor_jni.h"
+#include "chrome/android/features/autofill_assistant/jni_headers/AssistantDateTime_jni.h"
 #include "chrome/android/features/autofill_assistant/jni_headers/AssistantDialogButton_jni.h"
 #include "chrome/android/features/autofill_assistant/jni_headers/AssistantDimension_jni.h"
 #include "chrome/android/features/autofill_assistant/jni_headers/AssistantInfoPopup_jni.h"
@@ -126,6 +127,17 @@
       NOTREACHED();
       return nullptr;
     }
+    case ValueProto::kDates: {
+      auto jlist = Java_AssistantValue_createDateTimeList(env);
+      for (const auto& value : proto.dates().values()) {
+        Java_AssistantValue_addDateTimeToList(
+            env, jlist,
+            Java_AssistantDateTime_Constructor(
+                env, static_cast<int>(value.year()), value.month(), value.day(),
+                0, 0, 0));
+      }
+      return Java_AssistantValue_createForDateTimes(env, jlist);
+    }
     case ValueProto::KIND_NOT_SET:
       return Java_AssistantValue_create(env);
   }
@@ -136,33 +148,47 @@
   ValueProto proto;
   auto jints = Java_AssistantValue_getIntegers(env, jvalue);
   if (jints) {
+    auto* mutable_ints = proto.mutable_ints();
     std::vector<int> ints;
     base::android::JavaIntArrayToIntVector(env, jints, &ints);
-    proto.mutable_ints();
     for (int i : ints) {
-      proto.mutable_ints()->add_values(i);
+      mutable_ints->add_values(i);
     }
     return proto;
   }
 
   auto jbooleans = Java_AssistantValue_getBooleans(env, jvalue);
   if (jbooleans) {
+    auto* mutable_booleans = proto.mutable_booleans();
     std::vector<bool> booleans;
     base::android::JavaBooleanArrayToBoolVector(env, jbooleans, &booleans);
-    proto.mutable_booleans();
     for (auto b : booleans) {
-      proto.mutable_booleans()->add_values(b);
+      mutable_booleans->add_values(b);
     }
     return proto;
   }
 
   auto jstrings = Java_AssistantValue_getStrings(env, jvalue);
   if (jstrings) {
+    auto* mutable_strings = proto.mutable_strings();
     std::vector<std::string> strings;
     base::android::AppendJavaStringArrayToStringVector(env, jstrings, &strings);
-    proto.mutable_strings();
     for (const auto& string : strings) {
-      proto.mutable_strings()->add_values(string);
+      mutable_strings->add_values(string);
+    }
+    return proto;
+  }
+
+  auto jdatetimes = Java_AssistantValue_getDateTimes(env, jvalue);
+  if (jdatetimes) {
+    auto* mutable_dates = proto.mutable_dates();
+    for (int i = 0; i < Java_AssistantValue_getListSize(env, jdatetimes); ++i) {
+      auto jvalue = Java_AssistantValue_getListAt(env, jdatetimes, i);
+      DateProto date;
+      date.set_year(Java_AssistantDateTime_getYear(env, jvalue));
+      date.set_month(Java_AssistantDateTime_getMonth(env, jvalue));
+      date.set_day(Java_AssistantDateTime_getDay(env, jvalue));
+      *mutable_dates->add_values() = date;
     }
     return proto;
   }
diff --git a/chrome/browser/autofill/autofill_keyboard_accessory_adapter.cc b/chrome/browser/autofill/autofill_keyboard_accessory_adapter.cc
index db45c2f..dc15d74 100644
--- a/chrome/browser/autofill/autofill_keyboard_accessory_adapter.cc
+++ b/chrome/browser/autofill/autofill_keyboard_accessory_adapter.cc
@@ -12,7 +12,6 @@
 #include "base/memory/weak_ptr.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/ui/autofill/autofill_popup_controller.h"
-#include "chrome/browser/ui/autofill/autofill_popup_layout_model.h"
 #include "components/autofill/core/browser/ui/popup_item_ids.h"
 #include "components/autofill/core/browser/ui/suggestion.h"
 
@@ -113,6 +112,11 @@
   return labels_[OffsetIndexFor(row)];
 }
 
+PopupType AutofillKeyboardAccessoryAdapter::GetPopupType() const {
+  DCHECK(controller_) << "Call GetPopupType only from its owner!";
+  return controller_->GetPopupType();
+}
+
 bool AutofillKeyboardAccessoryAdapter::GetRemovalConfirmationText(
     int index,
     base::string16* title,
@@ -156,12 +160,6 @@
   return base::nullopt;
 }
 
-const AutofillPopupLayoutModel& AutofillKeyboardAccessoryAdapter::layout_model()
-    const {
-  DCHECK(controller_) << "Call OnSuggestionsChanged only from its owner!";
-  return controller_->layout_model();
-}
-
 // AutofillPopupViewDelegate implementation
 
 void AutofillKeyboardAccessoryAdapter::Hide(PopupHidingReason reason) {
diff --git a/chrome/browser/autofill/autofill_keyboard_accessory_adapter.h b/chrome/browser/autofill/autofill_keyboard_accessory_adapter.h
index 2f4a24bd..9d12ec0 100644
--- a/chrome/browser/autofill/autofill_keyboard_accessory_adapter.h
+++ b/chrome/browser/autofill/autofill_keyboard_accessory_adapter.h
@@ -76,7 +76,7 @@
   bool RemoveSuggestion(int index) override;
   void SetSelectedLine(base::Optional<int> selected_line) override;
   base::Optional<int> selected_line() const override;
-  const AutofillPopupLayoutModel& layout_model() const override;
+  PopupType GetPopupType() const override;
 
   void Hide(PopupHidingReason reason) override;
   void ViewDestroyed() override;
diff --git a/chrome/browser/autofill/autofill_keyboard_accessory_adapter_unittest.cc b/chrome/browser/autofill/autofill_keyboard_accessory_adapter_unittest.cc
index 597c9c89..4ff0b8da 100644
--- a/chrome/browser/autofill/autofill_keyboard_accessory_adapter_unittest.cc
+++ b/chrome/browser/autofill/autofill_keyboard_accessory_adapter_unittest.cc
@@ -14,7 +14,6 @@
 #include "build/build_config.h"
 #include "chrome/browser/autofill/autofill_keyboard_accessory_adapter.h"
 #include "chrome/browser/autofill/mock_autofill_popup_controller.h"
-#include "chrome/browser/ui/autofill/autofill_popup_layout_model.h"
 #include "chrome/browser/ui/autofill/autofill_popup_view.h"
 #include "components/autofill/core/browser/ui/popup_item_ids.h"
 #include "components/autofill/core/browser/ui/suggestion.h"
diff --git a/chrome/browser/autofill/mock_autofill_popup_controller.cc b/chrome/browser/autofill/mock_autofill_popup_controller.cc
index fe41477b..952c8258 100644
--- a/chrome/browser/autofill/mock_autofill_popup_controller.cc
+++ b/chrome/browser/autofill/mock_autofill_popup_controller.cc
@@ -3,13 +3,12 @@
 // found in the LICENSE file.
 
 #include "chrome/browser/autofill/mock_autofill_popup_controller.h"
+#include "ui/gfx/font_list.h"
 
 namespace autofill {
 
 MockAutofillPopupController::MockAutofillPopupController() {
   gfx::FontList::SetDefaultFontDescription("Arial, Times New Roman, 15px");
-  layout_model_ = std::make_unique<autofill::AutofillPopupLayoutModel>(
-      false /* is_credit_card_field */);
 }
 
 MockAutofillPopupController::~MockAutofillPopupController() = default;
diff --git a/chrome/browser/autofill/mock_autofill_popup_controller.h b/chrome/browser/autofill/mock_autofill_popup_controller.h
index 4f6fc6d..3913437 100644
--- a/chrome/browser/autofill/mock_autofill_popup_controller.h
+++ b/chrome/browser/autofill/mock_autofill_popup_controller.h
@@ -12,7 +12,6 @@
 #include "base/no_destructor.h"
 #include "build/build_config.h"
 #include "chrome/browser/ui/autofill/autofill_popup_controller.h"
-#include "chrome/browser/ui/autofill/autofill_popup_layout_model.h"
 #include "components/autofill/core/browser/ui/suggestion.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "ui/gfx/geometry/rect_f.h"
@@ -71,9 +70,7 @@
   MOCK_METHOD1(RemoveSuggestion, bool(int index));
   MOCK_METHOD1(SetSelectedLine, void(base::Optional<int> selected_line));
   MOCK_CONST_METHOD0(selected_line, base::Optional<int>());
-  const autofill::AutofillPopupLayoutModel& layout_model() const override {
-    return *layout_model_;
-  }
+  MOCK_CONST_METHOD0(GetPopupType, PopupType());
 
   void set_suggestions(const std::vector<int>& ids) {
     for (const auto& id : ids)
@@ -85,7 +82,6 @@
   }
 
  private:
-  std::unique_ptr<autofill::AutofillPopupLayoutModel> layout_model_;
   std::vector<autofill::Suggestion> suggestions_;
 
   base::WeakPtrFactory<MockAutofillPopupController> weak_ptr_factory_{this};
diff --git a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc b/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc
index 4fe5cb38..391024a0 100644
--- a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc
+++ b/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate.cc
@@ -819,6 +819,10 @@
           filter, delete_begin_, delete_end_,
           base::AdaptCallbackForRepeating(
               CreateTaskCompletionClosure(TracingDataType::kPasswords)));
+      password_store->RemoveCompromisedCredentialsByUrlAndTime(
+          nullable_filter, delete_begin_, delete_end_,
+          CreateTaskCompletionClosure(
+              TracingDataType::kCompromisedCredentials));
     }
 
     BrowserContext::GetDefaultStoragePartition(profile_)
@@ -858,13 +862,6 @@
           nullable_filter, delete_begin_, delete_end_,
           base::AdaptCallbackForRepeating(CreateTaskCompletionClosure(
               TracingDataType::kPasswordsStatistics)));
-      if (base::FeatureList::IsEnabled(
-              password_manager::features::kPasswordCheck)) {
-        password_store->RemoveCompromisedCredentialsByUrlAndTime(
-            nullable_filter, delete_begin_, delete_end_,
-            CreateTaskCompletionClosure(
-                TracingDataType::kCompromisedCredentials));
-      }
       password_store->RemoveFieldInfoByTime(
           delete_begin_, delete_end_,
           CreateTaskCompletionClosure(TracingDataType::kFieldInfo));
diff --git a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate_unittest.cc b/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate_unittest.cc
index ace1423..1c30b63 100644
--- a/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate_unittest.cc
+++ b/chrome/browser/browsing_data/chrome_browsing_data_remover_delegate_unittest.cc
@@ -1988,9 +1988,6 @@
 
 TEST_F(ChromeBrowsingDataRemoverDelegateTest,
        RemoveCompromisedCredentialsByTimeOnly) {
-  base::test::ScopedFeatureList feature_list;
-  feature_list.InitAndEnableFeature(password_manager::features::kPasswordCheck);
-
   RemovePasswordsTester tester(GetProfile());
   base::Callback<bool(const GURL&)> empty_filter;
 
@@ -1999,7 +1996,7 @@
                                    base::Time(), base::Time::Max()));
   BlockUntilBrowsingDataRemoved(
       base::Time(), base::Time::Max(),
-      ChromeBrowsingDataRemoverDelegate::DATA_TYPE_HISTORY, false);
+      ChromeBrowsingDataRemoverDelegate::DATA_TYPE_PASSWORDS, false);
 }
 
 // TODO(crbug.com/589586): Disabled, since history is not yet marked as
diff --git a/chrome/browser/chromeos/crostini/crostini_simple_types.h b/chrome/browser/chromeos/crostini/crostini_simple_types.h
index f49498d4..5e5c17b5 100644
--- a/chrome/browser/chromeos/crostini/crostini_simple_types.h
+++ b/chrome/browser/chromeos/crostini/crostini_simple_types.h
@@ -203,6 +203,23 @@
   REMOVER,
 };
 
+constexpr char kUpgradeDialogEventHistogram[] = "Crostini.UpgradeDialogEvent";
+
+enum class UpgradeDialogEvent {
+  kDialogShown = 0,
+  kUpgradeSuccess = 1,
+  kUpgradeCanceled = 2,
+  kUpgradeFailed = 3,
+  kNotStarted = 4,
+  kDidBackup = 5,
+  kBackupSucceeded = 6,
+  kBackupFailed = 7,
+  kDidRestore = 8,
+  kRestoreSucceeded = 9,
+  kRestoreFailed = 10,
+  kMaxValue = kRestoreFailed,
+};
+
 }  // namespace crostini
 
 enum class ContainerOsVersion {
diff --git a/chrome/browser/chromeos/file_manager/file_manager_browsertest_base.cc b/chrome/browser/chromeos/file_manager/file_manager_browsertest_base.cc
index 90d8252..b86fee6 100644
--- a/chrome/browser/chromeos/file_manager/file_manager_browsertest_base.cc
+++ b/chrome/browser/chromeos/file_manager/file_manager_browsertest_base.cc
@@ -555,7 +555,8 @@
 
 // Ensures the default HTML filesystem API blocking task runner is blocked for a
 // test.
-void BlockFileTaskRunner(Profile* profile) {
+void BlockFileTaskRunner(Profile* profile)
+    EXCLUSIVE_LOCK_FUNCTION(GetLockForBlockingDefaultFileTaskRunner()) {
   GetLockForBlockingDefaultFileTaskRunner().Acquire();
 
   content::BrowserContext::GetDefaultStoragePartition(profile)
@@ -567,7 +568,8 @@
 }
 
 // Undo the effects of |BlockFileTaskRunner()|.
-void UnblockFileTaskRunner() {
+void UnblockFileTaskRunner()
+    UNLOCK_FUNCTION(GetLockForBlockingDefaultFileTaskRunner()) {
   GetLockForBlockingDefaultFileTaskRunner().Release();
 }
 
@@ -1633,9 +1635,12 @@
   }
 }
 
+// NO_THREAD_SAFETY_ANALYSIS: Locking depends on runtime commands, the static
+// checker cannot assess it.
 void FileManagerBrowserTestBase::OnCommand(const std::string& name,
                                            const base::DictionaryValue& value,
-                                           std::string* output) {
+                                           std::string* output)
+    NO_THREAD_SAFETY_ANALYSIS {
   base::ScopedAllowBlockingForTesting allow_blocking;
 
   if (name == "isInGuestMode") {
diff --git a/chrome/browser/chromeos/smb_client/smb_service.cc b/chrome/browser/chromeos/smb_client/smb_service.cc
index d153893..d232173 100644
--- a/chrome/browser/chromeos/smb_client/smb_service.cc
+++ b/chrome/browser/chromeos/smb_client/smb_service.cc
@@ -86,8 +86,9 @@
   kNoCredentials = 0,
   kUsernameOnly = 1,
   kUsernameAndPassword = 2,
-  kSSOKerberos = 3,
-  kMaxValue = kSSOKerberos,
+  kSSOKerberosAD = 3,
+  kSSOKerberosGaia = 4,
+  kMaxValue = kSSOKerberosGaia,
 };
 
 void RecordMountResult(SmbMountResult result) {
@@ -277,9 +278,12 @@
   DCHECK(user);
 
   if (use_kerberos) {
-    // TODO(crbug.com/1041022): Differentiate between AD and KerberosEnabled via
-    // policy in metrics.
-    RecordAuthenticationMethod(AuthMethod::kSSOKerberos);
+    // Differentiate between AD and KerberosEnabled via policy in metrics.
+    if (IsKerberosEnabledViaPolicy()) {
+      RecordAuthenticationMethod(AuthMethod::kSSOKerberosGaia);
+    } else {
+      RecordAuthenticationMethod(AuthMethod::kSSOKerberosAD);
+    }
 
     // Get the user's username and workgroup from their email address to be used
     // for Kerberos authentication.
diff --git a/chrome/browser/chromeos/web_applications/OWNERS b/chrome/browser/chromeos/web_applications/OWNERS
index 85adc8e..bd97fa0 100644
--- a/chrome/browser/chromeos/web_applications/OWNERS
+++ b/chrome/browser/chromeos/web_applications/OWNERS
@@ -3,5 +3,8 @@
 bugsnash@chromium.org
 ortuno@chromium.org
 
+per-file terminal_source*=calamity@chromium.org
+per-file terminal_source*=joelhockey@chromium.org
+
 # TEAM: cros-essential-apps-dev@chromium.org
 # COMPONENT: Platform>Apps>SystemWebApps
diff --git a/chrome/browser/chromeos/web_applications/terminal_source.cc b/chrome/browser/chromeos/web_applications/terminal_source.cc
index 8da7b80..b51e3b6f 100644
--- a/chrome/browser/chromeos/web_applications/terminal_source.cc
+++ b/chrome/browser/chromeos/web_applications/terminal_source.cc
@@ -64,8 +64,7 @@
              "fill='red'/></svg>"},
             {"html/terminal.html", "<script src='/js/terminal.js'></script>"},
             {"js/terminal.js",
-             "chrome.terminalPrivate.openTerminalProcess("
-             "'vmshell', [], () => {})"},
+             "chrome.terminalPrivate.openVmshellProcess([], () => {})"},
         });
     auto it = kTestFiles->find(relative_path);
     if (it != kTestFiles->end()) {
diff --git a/chrome/browser/extensions/api/passwords_private/password_check_delegate.cc b/chrome/browser/extensions/api/passwords_private/password_check_delegate.cc
index 4d0e537..e7be3c24 100644
--- a/chrome/browser/extensions/api/passwords_private/password_check_delegate.cc
+++ b/chrome/browser/extensions/api/passwords_private/password_check_delegate.cc
@@ -31,6 +31,7 @@
 #include "components/password_manager/core/browser/ui/saved_passwords_presenter.h"
 #include "components/password_manager/core/common/password_manager_pref_names.h"
 #include "components/prefs/pref_service.h"
+#include "components/url_formatter/elide_url.h"
 #include "components/url_formatter/url_formatter.h"
 #include "net/base/escape.h"
 #include "ui/base/l10n/l10n_util.h"
@@ -151,7 +152,7 @@
   // Instructs the presenter and provider to initialize and built their caches.
   // This will soon after invoke OnCompromisedCredentialsChanged(), which then
   // initializes |credentials_to_forms_| as well. Calls to
-  // GetCompromisedCredentialsInfo() that might happen until then will return an
+  // GetCompromisedCredentials() that might happen until then will return an
   // empty list.
   saved_passwords_presenter_.Init();
   compromised_credentials_provider_.Init();
@@ -159,8 +160,8 @@
 
 PasswordCheckDelegate::~PasswordCheckDelegate() = default;
 
-api::passwords_private::CompromisedCredentialsInfo
-PasswordCheckDelegate::GetCompromisedCredentialsInfo() {
+std::vector<api::passwords_private::CompromisedCredential>
+PasswordCheckDelegate::GetCompromisedCredentials() {
   CompromisedCredentialsView compromised_credentials_view =
       compromised_credentials_provider_.GetCompromisedCredentials();
   std::vector<CredentialWithPassword> ordered_compromised_credentials(
@@ -173,32 +174,36 @@
                std::tie(rhs.compromise_type, rhs.create_time);
       });
 
-  api::passwords_private::CompromisedCredentialsInfo credentials_info;
-  credentials_info.compromised_credentials.reserve(
-      ordered_compromised_credentials.size());
+  std::vector<api::passwords_private::CompromisedCredential>
+      compromised_credentials;
+  compromised_credentials.reserve(ordered_compromised_credentials.size());
   for (const auto& credential : ordered_compromised_credentials) {
     api::passwords_private::CompromisedCredential api_credential;
     auto facet = password_manager::FacetURI::FromPotentiallyInvalidSpec(
         credential.signon_realm);
     if (facet.IsValidAndroidFacetURI()) {
-      // |formatted_orgin| and |change_password_url| need special handling for
-      // Android. Here we use affiliation information instead of the
-      // signon_realm.
+      api_credential.is_android_credential = true;
+      // |formatted_orgin|, |detailed_origin| and |change_password_url| need
+      // special handling for Android. Here we use affiliation information
+      // instead of the signon_realm.
       const PasswordForm& android_form =
           credentials_to_forms_.at(credential).at(0);
-      api_credential.formatted_origin = android_form.app_display_name;
-      api_credential.change_password_url =
-          std::make_unique<std::string>(android_form.affiliated_web_realm);
-
-      // In case no affiliation information could be obtained show the formatted
-      // package name to the user. An empty change_password_url will be handled
-      // by the frontend, by not including a link in this case.
-      if (api_credential.formatted_origin.empty()) {
+      if (!android_form.app_display_name.empty()) {
+        api_credential.formatted_origin = android_form.app_display_name;
+        api_credential.detailed_origin = android_form.app_display_name;
+        api_credential.change_password_url =
+            std::make_unique<std::string>(android_form.affiliated_web_realm);
+      } else {
+        // In case no affiliation information could be obtained show the
+        // formatted package name to the user. An empty change_password_url will
+        // be handled by the frontend, by not including a link in this case.
         api_credential.formatted_origin = l10n_util::GetStringFUTF8(
             IDS_SETTINGS_PASSWORDS_ANDROID_APP,
             base::UTF8ToUTF16(facet.android_package_name()));
+        api_credential.detailed_origin = facet.android_package_name();
       }
     } else {
+      api_credential.is_android_credential = false;
       api_credential.formatted_origin =
           base::UTF16ToUTF8(url_formatter::FormatUrl(
               GURL(credential.signon_realm),
@@ -207,6 +212,9 @@
                   url_formatter::kFormatUrlOmitTrivialSubdomains |
                   url_formatter::kFormatUrlTrimAfterHost,
               net::UnescapeRule::SPACES, nullptr, nullptr, nullptr));
+      api_credential.detailed_origin =
+          base::UTF16ToUTF8(url_formatter::FormatUrlForSecurityDisplay(
+              GURL(credential.signon_realm)));
       api_credential.change_password_url =
           std::make_unique<std::string>(credential.signon_realm);
     }
@@ -221,23 +229,10 @@
         ConvertCompromiseType(credential.compromise_type);
     api_credential.elapsed_time_since_compromise =
         FormatElapsedTime(credential.create_time);
-    credentials_info.compromised_credentials.push_back(
-        std::move(api_credential));
+    compromised_credentials.push_back(std::move(api_credential));
   }
 
-  // Obtain the timestamp of the last completed check. This is 0.0 in case the
-  // check never completely ran before.
-  // TODO(https://crbug.com/1047726): Expose elapsed_time_since_last_check on
-  // PasswordCheckStatus rather than CompromisedCredentialsInfo.
-  const double last_check_completed = profile_->GetPrefs()->GetDouble(
-      password_manager::prefs::kLastTimePasswordCheckCompleted);
-  if (last_check_completed) {
-    credentials_info.elapsed_time_since_last_check =
-        std::make_unique<std::string>(
-            FormatElapsedTime(base::Time::FromDoubleT(last_check_completed)));
-  }
-
-  return credentials_info;
+  return compromised_credentials;
 }
 
 base::Optional<api::passwords_private::CompromisedCredential>
@@ -318,6 +313,15 @@
   // TODO(crbug.com/1047726): Add support for QUOTA_LIMIT state.
   api::passwords_private::PasswordCheckStatus result;
 
+  // Obtain the timestamp of the last completed check. This is 0.0 in case the
+  // check never completely ran before.
+  const double last_check_completed = profile_->GetPrefs()->GetDouble(
+      password_manager::prefs::kLastTimePasswordCheckCompleted);
+  if (last_check_completed) {
+    result.elapsed_time_since_last_check = std::make_unique<std::string>(
+        FormatElapsedTime(base::Time::FromDoubleT(last_check_completed)));
+  }
+
   BulkLeakCheckService::State state =
       bulk_leak_check_service_adapter_.GetBulkLeakCheckState();
   SavedPasswordsView saved_passwords =
@@ -363,8 +367,7 @@
       credentials, saved_passwords_presenter_.GetSavedPasswords());
   if (auto* event_router =
           PasswordsPrivateEventRouterFactory::GetForProfile(profile_)) {
-    event_router->OnCompromisedCredentialsInfoChanged(
-        GetCompromisedCredentialsInfo());
+    event_router->OnCompromisedCredentialsChanged(GetCompromisedCredentials());
   }
 }
 
diff --git a/chrome/browser/extensions/api/passwords_private/password_check_delegate.h b/chrome/browser/extensions/api/passwords_private/password_check_delegate.h
index 6bbbf59..433fd4f 100644
--- a/chrome/browser/extensions/api/passwords_private/password_check_delegate.h
+++ b/chrome/browser/extensions/api/passwords_private/password_check_delegate.h
@@ -48,8 +48,8 @@
   // Obtains information about compromised credentials. This includes the last
   // time a check was run, as well as all compromised credentials that are
   // present in the password store.
-  api::passwords_private::CompromisedCredentialsInfo
-  GetCompromisedCredentialsInfo();
+  std::vector<api::passwords_private::CompromisedCredential>
+  GetCompromisedCredentials();
 
   // Requests the plaintext password for |credential|. If successful, this
   // returns |credential| with its |password| member set. This can fail if no
@@ -85,7 +85,7 @@
       override;
 
   // password_manager::CompromisedCredentialsProvider::Observer:
-  // Invokes PasswordsPrivateEventRouter::OnCompromisedCredentialsInfoChanged if
+  // Invokes PasswordsPrivateEventRouter::OnCompromisedCredentialsChanged if
   // a valid pointer can be obtained.
   void OnCompromisedCredentialsChanged(
       password_manager::CompromisedCredentialsProvider::CredentialsView
diff --git a/chrome/browser/extensions/api/passwords_private/password_check_delegate_unittest.cc b/chrome/browser/extensions/api/passwords_private/password_check_delegate_unittest.cc
index 5fc1d33..fd5a972 100644
--- a/chrome/browser/extensions/api/passwords_private/password_check_delegate_unittest.cc
+++ b/chrome/browser/extensions/api/passwords_private/password_check_delegate_unittest.cc
@@ -67,7 +67,7 @@
 constexpr char kPassword2[] = "f00b4r";
 
 using api::passwords_private::CompromisedCredential;
-using api::passwords_private::CompromisedCredentialsInfo;
+using api::passwords_private::PasswordCheckStatus;
 using autofill::PasswordForm;
 using password_manager::BulkLeakCheckDelegateInterface;
 using password_manager::BulkLeakCheckService;
@@ -180,15 +180,21 @@
 // Creates matcher for a given compromised credential
 auto ExpectCompromisedCredential(
     const std::string& formatted_origin,
-    const std::string& change_password_url,
+    const std::string& detailed_origin,
+    const base::Optional<std::string>& change_password_url,
     const std::string& username,
     base::TimeDelta elapsed_time_since_compromise,
     const std::string& elapsed_time_since_compromise_str,
     api::passwords_private::CompromiseType compromise_type) {
+  auto change_password_url_field_matcher =
+      change_password_url.has_value()
+          ? Field(&CompromisedCredential::change_password_url,
+                  Pointee(change_password_url.value()))
+          : Field(&CompromisedCredential::change_password_url, IsNull());
   return AllOf(
       Field(&CompromisedCredential::formatted_origin, formatted_origin),
-      Field(&CompromisedCredential::change_password_url,
-            Pointee(change_password_url)),
+      Field(&CompromisedCredential::detailed_origin, detailed_origin),
+      change_password_url_field_matcher,
       Field(&CompromisedCredential::username, username),
       Field(&CompromisedCredential::compromise_time,
             (base::Time::Now() - elapsed_time_since_compromise)
@@ -241,7 +247,7 @@
 // credentials. Verifies that the result is ordered in such a way that phished
 // credentials are before leaked credentials and that within each group
 // credentials are ordered by recency.
-TEST_F(PasswordCheckDelegateTest, GetCompromisedCredentialsInfoOrders) {
+TEST_F(PasswordCheckDelegateTest, GetCompromisedCredentialsOrders) {
   store().AddLogin(MakeSavedPassword(kExampleCom, kUsername1));
   store().AddLogin(MakeSavedPassword(kExampleCom, kUsername2));
   store().AddLogin(MakeSavedPassword(kExampleOrg, kUsername1));
@@ -262,21 +268,21 @@
   RunUntilIdle();
 
   EXPECT_THAT(
-      delegate().GetCompromisedCredentialsInfo().compromised_credentials,
+      delegate().GetCompromisedCredentials(),
       ElementsAre(ExpectCompromisedCredential(
-                      "example.com", kExampleCom, kUsername2,
+                      "example.com", kExampleCom, kExampleCom, kUsername2,
                       base::TimeDelta::FromMinutes(2), "2 minutes ago",
                       api::passwords_private::COMPROMISE_TYPE_PHISHED),
                   ExpectCompromisedCredential(
-                      "example.org", kExampleOrg, kUsername1,
+                      "example.org", kExampleOrg, kExampleOrg, kUsername1,
                       base::TimeDelta::FromMinutes(4), "4 minutes ago",
                       api::passwords_private::COMPROMISE_TYPE_PHISHED),
                   ExpectCompromisedCredential(
-                      "example.com", kExampleCom, kUsername1,
+                      "example.com", kExampleCom, kExampleCom, kUsername1,
                       base::TimeDelta::FromMinutes(1), "1 minute ago",
                       api::passwords_private::COMPROMISE_TYPE_LEAKED),
                   ExpectCompromisedCredential(
-                      "example.org", kExampleOrg, kUsername2,
+                      "example.org", kExampleOrg, kExampleOrg, kUsername2,
                       base::TimeDelta::FromMinutes(3), "3 minutes ago",
                       api::passwords_private::COMPROMISE_TYPE_LEAKED)));
 }
@@ -305,26 +311,26 @@
   RunUntilIdle();
 
   EXPECT_THAT(
-      delegate().GetCompromisedCredentialsInfo().compromised_credentials,
+      delegate().GetCompromisedCredentials(),
       ElementsAre(ExpectCompromisedCredential(
-                      "example.com", kExampleCom, kUsername1,
+                      "example.com", kExampleCom, kExampleCom, kUsername1,
                       base::TimeDelta::FromSeconds(59), "Just now",
                       api::passwords_private::COMPROMISE_TYPE_LEAKED),
                   ExpectCompromisedCredential(
-                      "example.com", kExampleCom, kUsername2,
+                      "example.com", kExampleCom, kExampleCom, kUsername2,
                       base::TimeDelta::FromSeconds(60), "1 minute ago",
                       api::passwords_private::COMPROMISE_TYPE_LEAKED),
                   ExpectCompromisedCredential(
-                      "example.org", kExampleOrg, kUsername1,
+                      "example.org", kExampleOrg, kExampleOrg, kUsername1,
                       base::TimeDelta::FromDays(100), "3 months ago",
                       api::passwords_private::COMPROMISE_TYPE_LEAKED),
                   ExpectCompromisedCredential(
-                      "example.org", kExampleOrg, kUsername2,
+                      "example.org", kExampleOrg, kExampleOrg, kUsername2,
                       base::TimeDelta::FromDays(800), "2 years ago",
                       api::passwords_private::COMPROMISE_TYPE_LEAKED)));
 }
 
-TEST_F(PasswordCheckDelegateTest, GetCompromisedCredentialsInfoInjectsAndroid) {
+TEST_F(PasswordCheckDelegateTest, GetCompromisedCredentialsInjectsAndroid) {
   store().AddLogin(MakeSavedPassword(kExampleCom, kUsername1));
   store().AddLogin(MakeSavedAndroidPassword(kExampleApp, kUsername2,
                                             "Example App", kExampleCom));
@@ -344,25 +350,25 @@
   // Verify that the compromised credentials match what is stored in the
   // password store.
   EXPECT_THAT(
-      delegate().GetCompromisedCredentialsInfo().compromised_credentials,
+      delegate().GetCompromisedCredentials(),
       ElementsAre(ExpectCompromisedCredential(
-                      "Example App", kExampleCom, kUsername2,
+                      "Example App", "Example App", kExampleCom, kUsername2,
                       base::TimeDelta::FromDays(3), "3 days ago",
                       api::passwords_private::COMPROMISE_TYPE_PHISHED),
                   ExpectCompromisedCredential(
-                      "App (com.example.app)", "", kUsername1,
-                      base::TimeDelta::FromDays(4), "4 days ago",
+                      "App (com.example.app)", kExampleApp, base::nullopt,
+                      kUsername1, base::TimeDelta::FromDays(4), "4 days ago",
                       api::passwords_private::COMPROMISE_TYPE_PHISHED),
                   ExpectCompromisedCredential(
-                      "example.com", kExampleCom, kUsername1,
+                      "example.com", kExampleCom, kExampleCom, kUsername1,
                       base::TimeDelta::FromMinutes(5), "5 minutes ago",
                       api::passwords_private::COMPROMISE_TYPE_LEAKED)));
 }
 
 // Test that a change to compromised credential notifies observers.
-TEST_F(PasswordCheckDelegateTest, OnGetCompromisedCredentialsInfo) {
+TEST_F(PasswordCheckDelegateTest, OnGetCompromisedCredentials) {
   const char* const kEventName =
-      api::passwords_private::OnCompromisedCredentialsInfoChanged::kEventName;
+      api::passwords_private::OnCompromisedCredentialsChanged::kEventName;
 
   // Verify that the event was not fired during construction.
   EXPECT_FALSE(base::Contains(event_router_observer().events(), kEventName));
@@ -388,8 +394,8 @@
   store().AddCompromisedCredentials(MakeCompromised(kExampleCom, kUsername1));
   RunUntilIdle();
 
-  CompromisedCredential credential = std::move(
-      delegate().GetCompromisedCredentialsInfo().compromised_credentials.at(0));
+  CompromisedCredential credential =
+      std::move(delegate().GetCompromisedCredentials().at(0));
   EXPECT_EQ(0, credential.id);
 
   // Purposefully set a wrong id and verify that trying to get a plaintext
@@ -405,8 +411,8 @@
   store().AddCompromisedCredentials(MakeCompromised(kExampleCom, kUsername1));
   RunUntilIdle();
 
-  CompromisedCredential credential = std::move(
-      delegate().GetCompromisedCredentialsInfo().compromised_credentials.at(0));
+  CompromisedCredential credential =
+      std::move(delegate().GetCompromisedCredentials().at(0));
   EXPECT_EQ(kExampleCom, credential.signon_realm);
 
   // Purposefully set a wrong signon realm and verify that trying to get a
@@ -422,8 +428,8 @@
   store().AddCompromisedCredentials(MakeCompromised(kExampleCom, kUsername1));
   RunUntilIdle();
 
-  CompromisedCredential credential = std::move(
-      delegate().GetCompromisedCredentialsInfo().compromised_credentials.at(0));
+  CompromisedCredential credential =
+      std::move(delegate().GetCompromisedCredentials().at(0));
   EXPECT_EQ(kUsername1, credential.username);
 
   // Purposefully set a wrong username and verify that trying to get a
@@ -439,8 +445,8 @@
   store().AddCompromisedCredentials(MakeCompromised(kExampleCom, kUsername1));
   RunUntilIdle();
 
-  CompromisedCredential credential = std::move(
-      delegate().GetCompromisedCredentialsInfo().compromised_credentials.at(0));
+  CompromisedCredential credential =
+      std::move(delegate().GetCompromisedCredentials().at(0));
   EXPECT_EQ(0, credential.id);
   EXPECT_EQ(kExampleCom, credential.signon_realm);
   EXPECT_EQ(kUsername1, credential.username);
@@ -461,9 +467,8 @@
   store().AddCompromisedCredentials(MakeCompromised(kExampleCom, kUsername1));
   RunUntilIdle();
 
-  api::passwords_private::CompromisedCredentialsInfo info =
-      delegate().GetCompromisedCredentialsInfo();
-  CompromisedCredential& credential = info.compromised_credentials.at(0);
+  CompromisedCredential credential =
+      std::move(delegate().GetCompromisedCredentials().at(0));
   EXPECT_EQ(0, credential.id);
   credential.id = 1;
 
@@ -477,9 +482,8 @@
   store().AddCompromisedCredentials(MakeCompromised(kExampleCom, kUsername1));
   RunUntilIdle();
 
-  api::passwords_private::CompromisedCredentialsInfo info =
-      delegate().GetCompromisedCredentialsInfo();
-  CompromisedCredential& credential = info.compromised_credentials.at(0);
+  CompromisedCredential credential =
+      std::move(delegate().GetCompromisedCredentials().at(0));
 
   store().RemoveLogin(MakeSavedPassword(kExampleCom, kUsername1));
   RunUntilIdle();
@@ -493,10 +497,8 @@
   store().AddCompromisedCredentials(MakeCompromised(kExampleCom, kUsername1));
   RunUntilIdle();
 
-  api::passwords_private::CompromisedCredentialsInfo info =
-      delegate().GetCompromisedCredentialsInfo();
   CompromisedCredential credential =
-      std::move(info.compromised_credentials.at(0));
+      std::move(delegate().GetCompromisedCredentials().at(0));
   EXPECT_EQ(0, credential.id);
   EXPECT_EQ(kExampleCom, credential.signon_realm);
   EXPECT_EQ(kUsername1, credential.username);
@@ -519,11 +521,9 @@
   RunUntilIdle();
 
   EXPECT_EQ(2u, store().stored_passwords().at(kExampleCom).size());
-  api::passwords_private::CompromisedCredentialsInfo info =
-      delegate().GetCompromisedCredentialsInfo();
 
   CompromisedCredential credential =
-      std::move(info.compromised_credentials.at(0));
+      std::move(delegate().GetCompromisedCredentials().at(0));
   EXPECT_TRUE(delegate().ChangeCompromisedCredential(credential, kPassword2));
   RunUntilIdle();
 
@@ -540,9 +540,8 @@
   store().AddCompromisedCredentials(MakeCompromised(kExampleCom, kUsername1));
   RunUntilIdle();
 
-  api::passwords_private::CompromisedCredentialsInfo info =
-      delegate().GetCompromisedCredentialsInfo();
-  CompromisedCredential& credential = info.compromised_credentials.at(0);
+  CompromisedCredential credential =
+      std::move(delegate().GetCompromisedCredentials().at(0));
   EXPECT_EQ(0, credential.id);
   credential.id = 1;
 
@@ -556,10 +555,8 @@
   store().AddCompromisedCredentials(MakeCompromised(kExampleCom, kUsername1));
   RunUntilIdle();
 
-  api::passwords_private::CompromisedCredentialsInfo info =
-      delegate().GetCompromisedCredentialsInfo();
-  const CompromisedCredential& credential = info.compromised_credentials.at(0);
-
+  CompromisedCredential credential =
+      std::move(delegate().GetCompromisedCredentials().at(0));
   store().RemoveLogin(MakeSavedPassword(kExampleCom, kUsername1));
   RunUntilIdle();
 
@@ -572,9 +569,8 @@
   store().AddCompromisedCredentials(MakeCompromised(kExampleCom, kUsername1));
   RunUntilIdle();
 
-  api::passwords_private::CompromisedCredentialsInfo info =
-      delegate().GetCompromisedCredentialsInfo();
-  const CompromisedCredential& credential = info.compromised_credentials.at(0);
+  CompromisedCredential credential =
+      std::move(delegate().GetCompromisedCredentials().at(0));
   EXPECT_TRUE(delegate().RemoveCompromisedCredential(credential));
   RunUntilIdle();
   EXPECT_TRUE(store().IsEmpty());
@@ -728,8 +724,7 @@
   RunUntilIdle();
 
   delegate().StartPasswordCheck();
-  api::passwords_private::PasswordCheckStatus status =
-      delegate().GetPasswordCheckStatus();
+  PasswordCheckStatus status = delegate().GetPasswordCheckStatus();
   EXPECT_EQ(api::passwords_private::PASSWORD_CHECK_STATE_RUNNING, status.state);
   EXPECT_EQ(0, *status.already_processed);
   EXPECT_EQ(1, *status.remaining_in_queue);
@@ -841,8 +836,8 @@
 // Checks that the default kLastTimePasswordCheckCompleted pref value is
 // treated as no completed run yet.
 TEST_F(PasswordCheckDelegateTest, LastTimePasswordCheckCompletedNotSet) {
-  CompromisedCredentialsInfo info = delegate().GetCompromisedCredentialsInfo();
-  EXPECT_THAT(info.elapsed_time_since_last_check, IsNull());
+  PasswordCheckStatus status = delegate().GetPasswordCheckStatus();
+  EXPECT_THAT(status.elapsed_time_since_last_check, IsNull());
 }
 
 // Checks that a non-default kLastTimePasswordCheckCompleted pref value is
@@ -852,8 +847,8 @@
       kLastTimePasswordCheckCompleted,
       (base::Time::Now() - base::TimeDelta::FromMinutes(5)).ToDoubleT());
 
-  CompromisedCredentialsInfo info = delegate().GetCompromisedCredentialsInfo();
-  EXPECT_THAT(info.elapsed_time_since_last_check,
+  PasswordCheckStatus status = delegate().GetPasswordCheckStatus();
+  EXPECT_THAT(status.elapsed_time_since_last_check,
               Pointee(std::string("5 minutes ago")));
 }
 
@@ -863,8 +858,8 @@
   delegate().StartPasswordCheck();
   service()->set_state_and_notify(BulkLeakCheckService::State::kIdle);
 
-  CompromisedCredentialsInfo info = delegate().GetCompromisedCredentialsInfo();
-  EXPECT_THAT(info.elapsed_time_since_last_check,
+  PasswordCheckStatus status = delegate().GetPasswordCheckStatus();
+  EXPECT_THAT(status.elapsed_time_since_last_check,
               Pointee(std::string("Just now")));
 }
 
diff --git a/chrome/browser/extensions/api/passwords_private/passwords_private_api.cc b/chrome/browser/extensions/api/passwords_private/passwords_private_api.cc
index 307f4be..cec4ffd 100644
--- a/chrome/browser/extensions/api/passwords_private/passwords_private_api.cc
+++ b/chrome/browser/extensions/api/passwords_private/passwords_private_api.cc
@@ -220,14 +220,14 @@
       GetDelegate(browser_context())->IsOptedInForAccountStorage())));
 }
 
-// PasswordsPrivateGetCompromisedCredentialsInfoFunction:
-PasswordsPrivateGetCompromisedCredentialsInfoFunction::
-    ~PasswordsPrivateGetCompromisedCredentialsInfoFunction() = default;
+// PasswordsPrivateGetCompromisedCredentialsFunction:
+PasswordsPrivateGetCompromisedCredentialsFunction::
+    ~PasswordsPrivateGetCompromisedCredentialsFunction() = default;
 
-ResponseAction PasswordsPrivateGetCompromisedCredentialsInfoFunction::Run() {
+ResponseAction PasswordsPrivateGetCompromisedCredentialsFunction::Run() {
   return RespondNow(ArgumentList(
-      api::passwords_private::GetCompromisedCredentialsInfo::Results::Create(
-          GetDelegate(browser_context())->GetCompromisedCredentialsInfo())));
+      api::passwords_private::GetCompromisedCredentials::Results::Create(
+          GetDelegate(browser_context())->GetCompromisedCredentials())));
 }
 
 // PasswordsPrivateGetPlaintextCompromisedPasswordFunction:
diff --git a/chrome/browser/extensions/api/passwords_private/passwords_private_api.h b/chrome/browser/extensions/api/passwords_private/passwords_private_api.h
index fe6045a..f143cac 100644
--- a/chrome/browser/extensions/api/passwords_private/passwords_private_api.h
+++ b/chrome/browser/extensions/api/passwords_private/passwords_private_api.h
@@ -195,14 +195,14 @@
   ResponseAction Run() override;
 };
 
-class PasswordsPrivateGetCompromisedCredentialsInfoFunction
+class PasswordsPrivateGetCompromisedCredentialsFunction
     : public ExtensionFunction {
  public:
-  DECLARE_EXTENSION_FUNCTION("passwordsPrivate.getCompromisedCredentialsInfo",
-                             PASSWORDSPRIVATE_GETCOMPROMISEDCREDENTIALSINFO)
+  DECLARE_EXTENSION_FUNCTION("passwordsPrivate.getCompromisedCredentials",
+                             PASSWORDSPRIVATE_GETCOMPROMISEDCREDENTIALS)
 
  protected:
-  ~PasswordsPrivateGetCompromisedCredentialsInfoFunction() override;
+  ~PasswordsPrivateGetCompromisedCredentialsFunction() override;
 
   // ExtensionFunction overrides.
   ResponseAction Run() override;
diff --git a/chrome/browser/extensions/api/passwords_private/passwords_private_apitest.cc b/chrome/browser/extensions/api/passwords_private/passwords_private_apitest.cc
index f94bcfc..5870aa5 100644
--- a/chrome/browser/extensions/api/passwords_private/passwords_private_apitest.cc
+++ b/chrome/browser/extensions/api/passwords_private/passwords_private_apitest.cc
@@ -37,6 +37,8 @@
 
 namespace {
 
+using ui::TimeFormat;
+
 static const size_t kNumMocks = 3;
 static const int kNumCharactersInPassword = 10;
 static const char kPlaintextPassword[] = "plaintext";
@@ -172,12 +174,13 @@
     return is_opted_in_for_account_storage_;
   }
 
-  api::passwords_private::CompromisedCredentialsInfo
-  GetCompromisedCredentialsInfo() override {
-    using ui::TimeFormat;
+  std::vector<api::passwords_private::CompromisedCredential>
+  GetCompromisedCredentials() override {
     api::passwords_private::CompromisedCredential credential;
     credential.username = "alice";
     credential.formatted_origin = "example.com";
+    credential.detailed_origin = "https://example.com";
+    credential.is_android_credential = false;
     credential.change_password_url =
         std::make_unique<std::string>("https://example.com/change-password");
     credential.compromise_type = api::passwords_private::COMPROMISE_TYPE_LEAKED;
@@ -185,13 +188,10 @@
     credential.elapsed_time_since_compromise = base::UTF16ToUTF8(
         TimeFormat::Simple(TimeFormat::FORMAT_ELAPSED, TimeFormat::LENGTH_LONG,
                            base::TimeDelta::FromDays(3)));
-    api::passwords_private::CompromisedCredentialsInfo info;
-    info.compromised_credentials.push_back(std::move(credential));
-    info.elapsed_time_since_last_check =
-        std::make_unique<std::string>(base::UTF16ToUTF8(TimeFormat::Simple(
-            TimeFormat::FORMAT_ELAPSED, TimeFormat::LENGTH_SHORT,
-            base::TimeDelta::FromMinutes(5))));
-    return info;
+
+    std::vector<api::passwords_private::CompromisedCredential> credentials;
+    credentials.push_back(std::move(credential));
+    return credentials;
   }
 
   void GetPlaintextCompromisedPassword(
@@ -246,6 +246,10 @@
     status.state = api::passwords_private::PASSWORD_CHECK_STATE_RUNNING;
     status.already_processed = std::make_unique<int>(5);
     status.remaining_in_queue = std::make_unique<int>(10);
+    status.elapsed_time_since_last_check =
+        std::make_unique<std::string>(base::UTF16ToUTF8(TimeFormat::Simple(
+            TimeFormat::FORMAT_ELAPSED, TimeFormat::LENGTH_SHORT,
+            base::TimeDelta::FromMinutes(5))));
     return status;
   }
 
@@ -456,8 +460,8 @@
   EXPECT_TRUE(RunPasswordsSubtest("isOptedInForAccountStorage")) << message_;
 }
 
-IN_PROC_BROWSER_TEST_F(PasswordsPrivateApiTest, GetCompromisedCredentialsInfo) {
-  EXPECT_TRUE(RunPasswordsSubtest("getCompromisedCredentialsInfo")) << message_;
+IN_PROC_BROWSER_TEST_F(PasswordsPrivateApiTest, GetCompromisedCredentials) {
+  EXPECT_TRUE(RunPasswordsSubtest("getCompromisedCredentials")) << message_;
 }
 
 IN_PROC_BROWSER_TEST_F(PasswordsPrivateApiTest,
diff --git a/chrome/browser/extensions/api/passwords_private/passwords_private_delegate.h b/chrome/browser/extensions/api/passwords_private/passwords_private_delegate.h
index b0488d522..510918e5 100644
--- a/chrome/browser/extensions/api/passwords_private/passwords_private_delegate.h
+++ b/chrome/browser/extensions/api/passwords_private/passwords_private_delegate.h
@@ -114,8 +114,8 @@
   // Obtains information about compromised credentials. This includes the last
   // time a check was run, as well as all compromised credentials that are
   // present in the password store.
-  virtual api::passwords_private::CompromisedCredentialsInfo
-  GetCompromisedCredentialsInfo() = 0;
+  virtual std::vector<api::passwords_private::CompromisedCredential>
+  GetCompromisedCredentials() = 0;
 
   // Requests the plaintext password for |credential| due to |reason|. If
   // successful, |callback| gets invoked with the same |credential|, whose
diff --git a/chrome/browser/extensions/api/passwords_private/passwords_private_delegate_impl.cc b/chrome/browser/extensions/api/passwords_private/passwords_private_delegate_impl.cc
index 90ab7df..49174aa 100644
--- a/chrome/browser/extensions/api/passwords_private/passwords_private_delegate_impl.cc
+++ b/chrome/browser/extensions/api/passwords_private/passwords_private_delegate_impl.cc
@@ -401,9 +401,9 @@
       profile_->GetPrefs(), ProfileSyncServiceFactory::GetForProfile(profile_));
 }
 
-api::passwords_private::CompromisedCredentialsInfo
-PasswordsPrivateDelegateImpl::GetCompromisedCredentialsInfo() {
-  return password_check_delegate_.GetCompromisedCredentialsInfo();
+std::vector<api::passwords_private::CompromisedCredential>
+PasswordsPrivateDelegateImpl::GetCompromisedCredentials() {
+  return password_check_delegate_.GetCompromisedCredentials();
 }
 
 void PasswordsPrivateDelegateImpl::GetPlaintextCompromisedPassword(
diff --git a/chrome/browser/extensions/api/passwords_private/passwords_private_delegate_impl.h b/chrome/browser/extensions/api/passwords_private/passwords_private_delegate_impl.h
index 5d8ccf3..b437b46 100644
--- a/chrome/browser/extensions/api/passwords_private/passwords_private_delegate_impl.h
+++ b/chrome/browser/extensions/api/passwords_private/passwords_private_delegate_impl.h
@@ -66,8 +66,8 @@
   api::passwords_private::ExportProgressStatus GetExportProgressStatus()
       override;
   bool IsOptedInForAccountStorage() override;
-  api::passwords_private::CompromisedCredentialsInfo
-  GetCompromisedCredentialsInfo() override;
+  std::vector<api::passwords_private::CompromisedCredential>
+  GetCompromisedCredentials() override;
   void GetPlaintextCompromisedPassword(
       api::passwords_private::CompromisedCredential credential,
       api::passwords_private::PlaintextReason reason,
diff --git a/chrome/browser/extensions/api/passwords_private/passwords_private_delegate_impl_unittest.cc b/chrome/browser/extensions/api/passwords_private/passwords_private_delegate_impl_unittest.cc
index 38ff0d7..20cb0b0 100644
--- a/chrome/browser/extensions/api/passwords_private/passwords_private_delegate_impl_unittest.cc
+++ b/chrome/browser/extensions/api/passwords_private/passwords_private_delegate_impl_unittest.cc
@@ -447,8 +447,8 @@
   store_->AddCompromisedCredentials(compromised_credentials);
   base::RunLoop().RunUntilIdle();
 
-  api::passwords_private::CompromisedCredential credential = std::move(
-      delegate.GetCompromisedCredentialsInfo().compromised_credentials.at(0));
+  api::passwords_private::CompromisedCredential credential =
+      std::move(delegate.GetCompromisedCredentials().at(0));
 
   MockReauthCallback reauth_callback;
   delegate.set_os_reauth_call(reauth_callback.Get());
diff --git a/chrome/browser/extensions/api/passwords_private/passwords_private_event_router.cc b/chrome/browser/extensions/api/passwords_private/passwords_private_event_router.cc
index a4aaea1..1a0ee0ff 100644
--- a/chrome/browser/extensions/api/passwords_private/passwords_private_event_router.cc
+++ b/chrome/browser/extensions/api/passwords_private/passwords_private_event_router.cc
@@ -96,14 +96,14 @@
   event_router_->BroadcastEvent(std::move(extension_event));
 }
 
-void PasswordsPrivateEventRouter::OnCompromisedCredentialsInfoChanged(
-    api::passwords_private::CompromisedCredentialsInfo
-        compromised_credentials_info) {
+void PasswordsPrivateEventRouter::OnCompromisedCredentialsChanged(
+    std::vector<api::passwords_private::CompromisedCredential>
+        compromised_credentials) {
   auto extension_event = std::make_unique<Event>(
       events::PASSWORDS_PRIVATE_ON_COMPROMISED_CREDENTIALS_INFO_CHANGED,
-      api::passwords_private::OnCompromisedCredentialsInfoChanged::kEventName,
-      api::passwords_private::OnCompromisedCredentialsInfoChanged::Create(
-          compromised_credentials_info));
+      api::passwords_private::OnCompromisedCredentialsChanged::kEventName,
+      api::passwords_private::OnCompromisedCredentialsChanged::Create(
+          compromised_credentials));
   event_router_->BroadcastEvent(std::move(extension_event));
 }
 
diff --git a/chrome/browser/extensions/api/passwords_private/passwords_private_event_router.h b/chrome/browser/extensions/api/passwords_private/passwords_private_event_router.h
index 6d0bf8f72..2661647 100644
--- a/chrome/browser/extensions/api/passwords_private/passwords_private_event_router.h
+++ b/chrome/browser/extensions/api/passwords_private/passwords_private_event_router.h
@@ -59,9 +59,9 @@
 
   // Notifies listeners about a change to the information about compromised
   // credentials.
-  void OnCompromisedCredentialsInfoChanged(
-      api::passwords_private::CompromisedCredentialsInfo
-          compromised_credentials_info);
+  void OnCompromisedCredentialsChanged(
+      std::vector<api::passwords_private::CompromisedCredential>
+          compromised_credentials);
 
   // Notifies listeners about a change to the status of the password check.
   void OnPasswordCheckStatusChanged(
diff --git a/chrome/browser/extensions/api/settings_private/prefs_util.cc b/chrome/browser/extensions/api/settings_private/prefs_util.cc
index 8bde53f..bdce39e9 100644
--- a/chrome/browser/extensions/api/settings_private/prefs_util.cc
+++ b/chrome/browser/extensions/api/settings_private/prefs_util.cc
@@ -250,11 +250,15 @@
   (*s_whitelist)[::prefs::kDnsOverHttpsTemplates] =
       settings_api::PrefType::PREF_TYPE_STRING;
 
-  // Sync and personalization page.
+  // Security page
   (*s_whitelist)[::prefs::kSafeBrowsingEnabled] =
       settings_api::PrefType::PREF_TYPE_BOOLEAN;
+  (*s_whitelist)[::prefs::kSafeBrowsingEnhanced] =
+      settings_api::PrefType::PREF_TYPE_BOOLEAN;
   (*s_whitelist)[::prefs::kSafeBrowsingScoutReportingEnabled] =
       settings_api::PrefType::PREF_TYPE_BOOLEAN;
+
+  // Sync and personalization page.
   (*s_whitelist)[::prefs::kSearchSuggestEnabled] =
       settings_api::PrefType::PREF_TYPE_BOOLEAN;
   (*s_whitelist)
diff --git a/chrome/browser/extensions/api/terminal/terminal_private_api.cc b/chrome/browser/extensions/api/terminal/terminal_private_api.cc
index 08cd5c78..1efc569f 100644
--- a/chrome/browser/extensions/api/terminal/terminal_private_api.cc
+++ b/chrome/browser/extensions/api/terminal/terminal_private_api.cc
@@ -49,6 +49,8 @@
     extensions::api::terminal_private::OnTerminalResize;
 namespace OpenTerminalProcess =
     extensions::api::terminal_private::OpenTerminalProcess;
+namespace OpenVmshellProcess =
+    extensions::api::terminal_private::OpenVmshellProcess;
 namespace CloseTerminalProcess =
     extensions::api::terminal_private::CloseTerminalProcess;
 namespace SendInput = extensions::api::terminal_private::SendInput;
@@ -184,6 +186,13 @@
       OpenTerminalProcess::Params::Create(*args_));
   EXTENSION_FUNCTION_VALIDATE(params.get());
 
+  return OpenProcess(params->process_name, std::move(params->args));
+}
+
+ExtensionFunction::ResponseAction
+TerminalPrivateOpenTerminalProcessFunction::OpenProcess(
+    const std::string& process_name,
+    std::unique_ptr<std::vector<std::string>> args) {
   const std::string& user_id_hash =
       extensions::ExtensionsBrowserClient::Get()->GetUserIdHashFromContext(
           browser_context());
@@ -211,7 +220,7 @@
     OpenProcess(user_id_hash, tab_id,
                 {command_line->GetSwitchValueASCII(switches::kCroshCommand)});
 
-  } else if (params->process_name == kCroshName) {
+  } else if (process_name == kCroshName) {
     // command=crosh: use '/usr/bin/crosh' on a device, 'cat' otherwise.
     if (base::SysInfo::IsRunningOnChromeOS()) {
       OpenProcess(user_id_hash, tab_id, {kCroshCommand});
@@ -219,7 +228,7 @@
       OpenProcess(user_id_hash, tab_id, {kStubbedCroshCommand});
     }
 
-  } else if (params->process_name == kVmShellName) {
+  } else if (process_name == kVmShellName) {
     // Ensure crostini is allowed before starting terminal.
     Profile* profile = Profile::FromBrowserContext(browser_context());
     if (!crostini::CrostiniFeatures::Get()->IsAllowed(profile))
@@ -228,10 +237,10 @@
     // command=vmshell: ensure --owner_id, --vm_name, and --target_container are
     // set and the specified vm/container is running.
     base::CommandLine vmshell_cmd({kVmShellCommand});
-    std::vector<std::string> args = {kVmShellCommand};
-    if (params->args)
-      args.insert(args.end(), params->args->begin(), params->args->end());
-    base::CommandLine params_args(args);
+    if (!args)
+      args = std::make_unique<std::vector<std::string>>();
+    args->insert(args->begin(), kVmShellCommand);
+    base::CommandLine params_args(*args);
     std::string owner_id =
         GetSwitch(&params_args, &vmshell_cmd, kSwitchOwnerId, user_id_hash);
     std::string vm_name = GetSwitch(&params_args, &vmshell_cmd, kSwitchVmName,
@@ -264,7 +273,7 @@
         observer_ptr);
   } else {
     // command=[unrecognized].
-    return RespondNow(Error("Invalid process name: " + params->process_name));
+    return RespondNow(Error("Invalid process name: " + process_name));
   }
   return RespondLater();
 }
@@ -328,6 +337,19 @@
                  base::BindOnce(callback, success, terminal_id));
 }
 
+TerminalPrivateOpenVmshellProcessFunction::
+    ~TerminalPrivateOpenVmshellProcessFunction() = default;
+
+ExtensionFunction::ResponseAction
+TerminalPrivateOpenVmshellProcessFunction::Run() {
+  std::unique_ptr<OpenVmshellProcess::Params> params(
+      OpenVmshellProcess::Params::Create(*args_));
+  EXTENSION_FUNCTION_VALIDATE(params.get());
+
+  // Only opens 'vmshell'.
+  return OpenProcess(kVmShellName, std::move(params->args));
+}
+
 TerminalPrivateSendInputFunction::~TerminalPrivateSendInputFunction() = default;
 
 void TerminalPrivateOpenTerminalProcessFunction::RespondOnUIThread(
diff --git a/chrome/browser/extensions/api/terminal/terminal_private_api.h b/chrome/browser/extensions/api/terminal/terminal_private_api.h
index edc648cc..2f1961d8 100644
--- a/chrome/browser/extensions/api/terminal/terminal_private_api.h
+++ b/chrome/browser/extensions/api/terminal/terminal_private_api.h
@@ -53,6 +53,11 @@
 
   ExtensionFunction::ResponseAction Run() override;
 
+  // Open the specified |process_name| with supplied |args|.
+  ExtensionFunction::ResponseAction OpenProcess(
+      const std::string& process_name,
+      std::unique_ptr<std::vector<std::string>> args);
+
  private:
   // Callback for when starting crostini is complete.
   void OnCrostiniRestarted(
@@ -79,6 +84,19 @@
   void RespondOnUIThread(bool success, const std::string& terminal_id);
 };
 
+// Opens new vmshell process. Returns the new terminal id.
+class TerminalPrivateOpenVmshellProcessFunction
+    : public TerminalPrivateOpenTerminalProcessFunction {
+ public:
+  DECLARE_EXTENSION_FUNCTION("terminalPrivate.openVmshellProcess",
+                             TERMINALPRIVATE_OPENVMSHELLPROCESS)
+
+ protected:
+  ~TerminalPrivateOpenVmshellProcessFunction() override;
+
+  ExtensionFunction::ResponseAction Run() override;
+};
+
 // Send input to the terminal process specified by the terminal ID, which is set
 // as an argument.
 class TerminalPrivateSendInputFunction : public ExtensionFunction {
diff --git a/chrome/browser/extensions/api/terminal/terminal_private_browsertest.cc b/chrome/browser/extensions/api/terminal/terminal_private_browsertest.cc
new file mode 100644
index 0000000..2736a32
--- /dev/null
+++ b/chrome/browser/extensions/api/terminal/terminal_private_browsertest.cc
@@ -0,0 +1,63 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <memory>
+
+#include "chrome/browser/chromeos/crostini/fake_crostini_features.h"
+#include "chrome/browser/ui/browser.h"
+#include "chrome/browser/ui/browser_tabstrip.h"
+#include "chrome/test/base/in_process_browser_test.h"
+#include "chrome/test/base/ui_test_utils.h"
+#include "content/public/test/browser_test_utils.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "url/gurl.h"
+
+namespace extensions {
+
+class TerminalPrivateBrowserTest : public InProcessBrowserTest {
+ public:
+  TerminalPrivateBrowserTest() = default;
+
+ protected:
+  void ExpectJsResult(const std::string& script, const std::string& expected) {
+    content::WebContents* web_contents =
+        browser()->tab_strip_model()->GetActiveWebContents();
+    content::EvalJsResult eval_result =
+        EvalJs(web_contents, script, content::EXECUTE_SCRIPT_DEFAULT_OPTIONS,
+               /*world_id=*/1);
+    EXPECT_EQ(eval_result.value.GetString(), expected);
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(TerminalPrivateBrowserTest);
+};
+
+IN_PROC_BROWSER_TEST_F(TerminalPrivateBrowserTest, OpenTerminalProcessChecks) {
+  ui_test_utils::NavigateToURL(
+      browser(), GURL("chrome-untrusted://terminal/html/terminal.html"));
+
+  const std::string script = R"(new Promise((resolve) => {
+    chrome.terminalPrivate.openVmshellProcess([], () => {
+      const lastError = chrome.runtime.lastError;
+      resolve(lastError ? lastError.message : "success");
+    })}))";
+
+  // 'vmshell not allowed' when crostini is not allowed.
+  crostini::FakeCrostiniFeatures crostini_features;
+  crostini_features.set_allowed(false);
+  ExpectJsResult(script, "vmshell not allowed");
+
+  // 'Error starting crostini for terminal: 22' when crostini is allowed.
+  // This is the specific error we expect to see in a test environment
+  // (LOAD_COMPONENT_FAILED), but the point of the test is to see that we get
+  // past the vmshell allowed checks.
+  crostini_features.set_allowed(true);
+  ExpectJsResult(script, "Error starting crostini for terminal: 22");
+
+  // openTerminalProcess not defined.
+  ExpectJsResult("typeof chrome.terminalPrivate.openTerminalProcess",
+                 "undefined");
+}
+
+}  // namespace extensions
diff --git a/chrome/browser/flag-metadata.json b/chrome/browser/flag-metadata.json
index e7156c2..2d10673 100644
--- a/chrome/browser/flag-metadata.json
+++ b/chrome/browser/flag-metadata.json
@@ -125,7 +125,7 @@
   {
     "name": "app-service-intent-handling",
     "owners": [ "chromeos-apps-foundation-team@google.com" ],
-    "expiry_milestone": 82
+    "expiry_milestone": 85
   },
   {
     "name": "arc-application-zoom",
@@ -1197,6 +1197,11 @@
     "expiry_milestone": 84
   },
   {
+    "name": "enable-cros-ime-assist-autocorrect",
+    "owners": [ "jopalmer", "essential-inputs-team@google.com" ],
+    "expiry_milestone": 90
+  },
+  {
     "name": "enable-cros-ime-assist-personal-info",
     "owners": [ "jiwan", "essential-inputs-team@google.com" ],
     "expiry_milestone": 90
@@ -1666,6 +1671,20 @@
     "expiry_milestone": 86
   },
   {
+    "name": "enable-palm-max-touch-major",
+    "owners": ["robsc", "napper", "adlr"],
+    // Added feature to possibly disable/enable this functionality, combined
+    //  with neural net palm detection.
+    "expiry_milestone": 90
+  },
+  {
+    "name": "enable-palm-tool-type-palm",
+    "owners": ["robsc", "napper", "adlr"],
+    // Added feature to possibly disable/enable this functionality, combined
+    //  with neural net palm detection.
+    "expiry_milestone": 90
+  },
+  {
     "name": "enable-parallel-downloading",
     "owners": [ "qinmin", "xingliu", "dtrainor" ],
     // This flag is used by dev teams on Android to disable this feature, since
diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc
index b2900f1e..c18f0bde 100644
--- a/chrome/browser/flag_descriptions.cc
+++ b/chrome/browser/flag_descriptions.cc
@@ -3279,6 +3279,18 @@
     "Experimental: Enable Neural Palm detection. Not compatible with all "
     "devices.";
 
+const char kEnablePalmOnMaxTouchMajorName[] =
+    "Enable Palm when Touch is Maximum";
+const char kEnablePalmOnMaxTouchMajorDescription[] =
+    "Experimental: Enable Palm detection when the touchscreen reports max "
+    "size. Not compatible with all devices.";
+
+const char kEnablePalmOnToolTypePalmName[] =
+    "Enable Palm when Tool Type is Palm";
+const char kEnablePalmOnToolTypePalmDescription[] =
+    "Experimental: Enable palm detection when touchscreen reports "
+    "TOOL_TYPE_PALM. Not compatible with all devices.";
+
 const char kEnableParentalControlsSettingsName[] =
     "Enable Parental controls settings";
 const char kEnableParentalControlsSettingsDescription[] =
@@ -3395,6 +3407,10 @@
     "Hides media notifications for ARC apps. Requires "
     "#enable-media-session-notifications to be enabled.";
 
+extern const char kImeAssistAutocorrectName[] = "Enable assistive autocorrect";
+extern const char kImeAssistAutocorrectDescription[] =
+    "Enable assistive auto-correct features for native IME";
+
 const char kImeAssistPersonalInfoName[] = "Enable assistive personal info";
 const char kImeAssistPersonalInfoDescription[] =
     "Enable auto-complete suggestions on personal infomation for native IME.";
diff --git a/chrome/browser/flag_descriptions.h b/chrome/browser/flag_descriptions.h
index c40034a..6dd2cd7 100644
--- a/chrome/browser/flag_descriptions.h
+++ b/chrome/browser/flag_descriptions.h
@@ -1889,6 +1889,12 @@
 extern const char kEnableNeuralStylusPalmRejectionName[];
 extern const char kEnableNeuralStylusPalmRejectionDescription[];
 
+extern const char kEnablePalmOnMaxTouchMajorName[];
+extern const char kEnablePalmOnMaxTouchMajorDescription[];
+
+extern const char kEnablePalmOnToolTypePalmName[];
+extern const char kEnablePalmOnToolTypePalmDescription[];
+
 extern const char kEnableParentalControlsSettingsName[];
 extern const char kEnableParentalControlsSettingsDescription[];
 
@@ -1970,6 +1976,9 @@
 extern const char kHideArcMediaNotificationsName[];
 extern const char kHideArcMediaNotificationsDescription[];
 
+extern const char kImeAssistAutocorrectName[];
+extern const char kImeAssistAutocorrectDescription[];
+
 extern const char kImeAssistPersonalInfoName[];
 extern const char kImeAssistPersonalInfoDescription[];
 
diff --git a/chrome/browser/media/router/providers/cast/mirroring_activity_record.cc b/chrome/browser/media/router/providers/cast/mirroring_activity_record.cc
index 807b019..4f57cb77 100644
--- a/chrome/browser/media/router/providers/cast/mirroring_activity_record.cc
+++ b/chrome/browser/media/router/providers/cast/mirroring_activity_record.cc
@@ -26,8 +26,10 @@
 #include "components/cast_channel/cast_message_util.h"
 #include "components/cast_channel/cast_socket.h"
 #include "components/cast_channel/enum_table.h"
+#include "components/mirroring/mojom/session_parameters.mojom-forward.h"
 #include "components/mirroring/mojom/session_parameters.mojom.h"
 #include "mojo/public/cpp/bindings/interface_request.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "net/base/ip_address.h"
 #include "third_party/openscreen/src/cast/common/channel/proto/cast_channel.pb.h"
@@ -44,6 +46,15 @@
 
 namespace {
 
+constexpr char kHistogramSessionLaunch[] =
+    "MediaRouter.CastStreaming.Session.Launch";
+constexpr char kHistogramSessionLength[] =
+    "MediaRouter.CastStreaming.Session.Length";
+constexpr char kHistogramStartFailureNative[] =
+    "MediaRouter.CastStreaming.Start.Failure.Native";
+constexpr char kHistogramStartSuccess[] =
+    "MediaRouter.CastStreaming.Start.Success";
+
 using MirroringType = MirroringActivityRecord::MirroringType;
 
 const std::string GetMirroringNamespace(const base::Value& message) {
@@ -108,12 +119,6 @@
       NOTREACHED();
   }
 
-  // Bind Mojo receivers for the interfaces this object implements.
-  mojo::PendingRemote<mirroring::mojom::SessionObserver> observer_remote;
-  observer_receiver_.Bind(observer_remote.InitWithNewPipeAndPassReceiver());
-  mojo::PendingRemote<mirroring::mojom::CastMessageChannel> channel_remote;
-  channel_receiver_.Bind(channel_remote.InitWithNewPipeAndPassReceiver());
-
   // Derive session type from capabilities.
   const bool has_audio = (cast_data.capabilities &
                           static_cast<uint8_t>(cast_channel::AUDIO_OUT)) != 0;
@@ -127,29 +132,45 @@
 
   // Arrange to start mirroring once the session is set.
   on_session_set_ = base::BindOnce(
-      &mirroring::mojom::MirroringServiceHost::Start,
-      base::Unretained(host_.get()),
+      &MirroringActivityRecord::StartMirroring, base::Unretained(this),
       SessionParameters::New(session_type, cast_data.ip_endpoint.address(),
                              cast_data.model_name),
-      std::move(observer_remote), std::move(channel_remote),
       channel_to_service_.BindNewPipeAndPassReceiver());
 }
 
-MirroringActivityRecord::~MirroringActivityRecord() = default;
+MirroringActivityRecord::~MirroringActivityRecord() {
+  if (did_start_mirroring_timestamp_) {
+    base::UmaHistogramLongTimes(
+        kHistogramSessionLength,
+        base::Time::Now() - *did_start_mirroring_timestamp_);
+  }
+}
 
 void MirroringActivityRecord::OnError(SessionError error) {
-  DLOG(ERROR) << "Mirroring session error: " << error;
+  if (will_start_mirroring_timestamp_) {
+    // An error was encountered while attempting to start mirroring.
+    base::UmaHistogramEnumeration(kHistogramStartFailureNative, error);
+    will_start_mirroring_timestamp_.reset();
+  }
+  // Metrics for general errors are captured by the mirroring service in
+  // MediaRouter.MirroringService.SessionError.
   StopMirroring();
 }
 
 void MirroringActivityRecord::DidStart() {
-  base::UmaHistogramEnumeration("MediaRouter.CastStreaming.Start.Success",
-                                mirroring_type_);
+  if (!will_start_mirroring_timestamp_) {
+    // DidStart() was called unexpectedly.
+    return;
+  }
+  did_start_mirroring_timestamp_ = base::Time::Now();
+  base::UmaHistogramTimes(
+      kHistogramSessionLaunch,
+      *did_start_mirroring_timestamp_ - *will_start_mirroring_timestamp_);
+  base::UmaHistogramEnumeration(kHistogramStartSuccess, mirroring_type_);
+  will_start_mirroring_timestamp_.reset();
 }
 
 void MirroringActivityRecord::DidStop() {
-  base::RecordAction(
-      base::UserMetricsAction("MediaRouter.CastStreaming.Session.End"));
   StopMirroring();
 }
 
@@ -229,6 +250,21 @@
   message_handler_->SendCastMessage(channel_id_, cast_message);
 }
 
+void MirroringActivityRecord::StartMirroring(
+    mirroring::mojom::SessionParametersPtr session_params,
+    mojo::PendingReceiver<CastMessageChannel> channel_to_service) {
+  will_start_mirroring_timestamp_ = base::Time::Now();
+
+  // Bind Mojo receivers for the interfaces this object implements.
+  mojo::PendingRemote<mirroring::mojom::SessionObserver> observer_remote;
+  observer_receiver_.Bind(observer_remote.InitWithNewPipeAndPassReceiver());
+  mojo::PendingRemote<mirroring::mojom::CastMessageChannel> channel_remote;
+  channel_receiver_.Bind(channel_remote.InitWithNewPipeAndPassReceiver());
+
+  host_->Start(std::move(session_params), std::move(observer_remote),
+               std::move(channel_remote), std::move(channel_to_service));
+}
+
 void MirroringActivityRecord::StopMirroring() {
   // Running the callback will cause this object to be deleted.
   if (on_stop_)
diff --git a/chrome/browser/media/router/providers/cast/mirroring_activity_record.h b/chrome/browser/media/router/providers/cast/mirroring_activity_record.h
index 0446445..fde2f06 100644
--- a/chrome/browser/media/router/providers/cast/mirroring_activity_record.h
+++ b/chrome/browser/media/router/providers/cast/mirroring_activity_record.h
@@ -9,6 +9,8 @@
 
 #include "base/callback.h"
 #include "base/memory/weak_ptr.h"
+#include "base/optional.h"
+#include "base/time/time.h"
 #include "chrome/browser/media/router/providers/cast/activity_record.h"
 #include "chrome/browser/media/router/providers/cast/cast_session_tracker.h"
 #include "chrome/common/media_router/media_route.h"
@@ -72,6 +74,9 @@
   void HandleParseJsonResult(const std::string& route_id,
                              data_decoder::DataDecoder::ValueOrError result);
 
+  void StartMirroring(
+      mirroring::mojom::SessionParametersPtr session_params,
+      mojo::PendingReceiver<CastMessageChannel> channel_to_service);
   void StopMirroring();
 
   mojo::Remote<mirroring::mojom::MirroringServiceHost> host_;
@@ -85,6 +90,10 @@
   // receiver.
   mojo::Receiver<mirroring::mojom::CastMessageChannel> channel_receiver_{this};
 
+  // Set before and after a mirroring session is established, for metrics.
+  base::Optional<base::Time> will_start_mirroring_timestamp_;
+  base::Optional<base::Time> did_start_mirroring_timestamp_;
+
   const int channel_id_;
   const MirroringType mirroring_type_;
   OnStopCallback on_stop_;
diff --git a/chrome/browser/pdf/pdf_extension_test.cc b/chrome/browser/pdf/pdf_extension_test.cc
index 4f46584..35e234a 100644
--- a/chrome/browser/pdf/pdf_extension_test.cc
+++ b/chrome/browser/pdf/pdf_extension_test.cc
@@ -2140,13 +2140,15 @@
 
   // We expect the IPC, received from the renderer, to be using local coords.
   context_menu_filter->Wait();
-  content::ContextMenuParams params = context_menu_filter->get_params();
+  content::UntrustworthyContextMenuParams params =
+      context_menu_filter->get_params();
   EXPECT_EQ(local_context_menu_position.x(), params.x);
   EXPECT_EQ(local_context_menu_position.y(), params.y);
 
-  // TODO(wjmaclean): If it ever becomes possible to filter outgoing IPCs
-  // from the RenderProcessHost, we should verify the blink.mojom.PluginActionAt
-  // message is sent with the same coordinates as in the ContextMenuParams.
+  // TODO(wjmaclean): If it ever becomes possible to filter outgoing IPCs from
+  // the RenderProcessHost, we should verify the blink.mojom.PluginActionAt
+  // message is sent with the same coordinates as in the
+  // UntrustworthyContextMenuParams.
 }
 
 // The plugin document and the mime handler should both use the same background
diff --git a/chrome/browser/policy/policy_prefs_browsertest.cc b/chrome/browser/policy/policy_prefs_browsertest.cc
index b72801def..83cddbe 100644
--- a/chrome/browser/policy/policy_prefs_browsertest.cc
+++ b/chrome/browser/policy/policy_prefs_browsertest.cc
@@ -182,6 +182,12 @@
         prefs_.push_back(std::make_unique<PrefTestCase>(pref_setting.first,
                                                         pref_setting.second));
     }
+    const base::Value* required_preprocessor_macros_value =
+        mapping.FindListKey("required_preprocessor_macros");
+    if (required_preprocessor_macros_value) {
+      for (const auto& macro : required_preprocessor_macros_value->GetList())
+        required_preprocessor_macros_.push_back(macro.GetString());
+    }
   }
   ~PolicyPrefMappingTest() {}
 
@@ -191,14 +197,54 @@
     return prefs_;
   }
 
+  const std::vector<std::string>& required_preprocessor_macros() const {
+    return required_preprocessor_macros_;
+  }
+
  private:
   const std::string pref_;
   base::Value policies_;
   std::vector<std::unique_ptr<PrefTestCase>> prefs_;
+  std::vector<std::string> required_preprocessor_macros_;
 
   DISALLOW_COPY_AND_ASSIGN(PolicyPrefMappingTest);
 };
 
+// Populates preprocessor macros as strings that policy pref mapping test cases
+// can depend on and implements a check if such a test case should run according
+// to the preprocessor macros.
+class PreprocessorMacrosChecker {
+ public:
+  PreprocessorMacrosChecker() {
+    // If you are adding a macro mapping here, please also add it to the
+    // documentation of 'required_preprocessor_macros' in
+    // policy_test_cases.json.
+#if defined(USE_CUPS)
+    enabled_preprocessor_macros.insert("USE_CUPS");
+#endif
+  }
+  ~PreprocessorMacrosChecker() = default;
+  PreprocessorMacrosChecker(const PreprocessorMacrosChecker& other) = delete;
+  PreprocessorMacrosChecker& operator=(const PreprocessorMacrosChecker& other) =
+      delete;
+
+  // Returns true if |test| may be executed based on its reuquired preprocessor
+  // macros.
+  bool SupportsTest(const PolicyPrefMappingTest* test) const {
+    for (const std::string& required_macro :
+         test->required_preprocessor_macros()) {
+      if (enabled_preprocessor_macros.find(required_macro) ==
+          enabled_preprocessor_macros.end()) {
+        return false;
+      }
+    }
+    return true;
+  }
+
+ private:
+  std::set<std::string> enabled_preprocessor_macros;
+};
+
 // Contains the testing details for a single policy. This is part of the data
 // loaded from chrome/test/data/policy/policy_test_cases.json.
 class PolicyTestCase {
@@ -424,6 +470,7 @@
   PrefService* local_state = g_browser_process->local_state();
   PrefService* user_prefs = browser()->profile()->GetPrefs();
 
+  const PreprocessorMacrosChecker preprocessor_macros_checker;
   const PolicyTestCases test_cases;
   for (const auto& policy : test_cases) {
     for (const auto& test_case : policy.second) {
@@ -452,6 +499,12 @@
       LOG(INFO) << "Testing policy: " << policy.first;
 
       for (const auto& pref_mapping : pref_mappings) {
+        if (!preprocessor_macros_checker.SupportsTest(pref_mapping.get())) {
+          LOG(INFO) << " Skipping policy_pref_mapping_test because of "
+                    << "preprocessor macros";
+          continue;
+        }
+
         for (const auto& pref_case : pref_mapping->prefs()) {
           // Skip Chrome OS preferences that use a different backend and cannot
           // be retrieved through the prefs mechanism.
diff --git a/chrome/browser/predictors/loading_predictor_browsertest.cc b/chrome/browser/predictors/loading_predictor_browsertest.cc
index 4080a11..7c93d3c 100644
--- a/chrome/browser/predictors/loading_predictor_browsertest.cc
+++ b/chrome/browser/predictors/loading_predictor_browsertest.cc
@@ -1585,8 +1585,10 @@
                          LoadingPredictorBrowserTestWithOptimizationGuide,
                          ::testing::Bool());
 
-IN_PROC_BROWSER_TEST_P(LoadingPredictorBrowserTestWithOptimizationGuide,
-                       NavigationHasLocalPredictionNoOptimizationHint) {
+// Disabled test due to consistent failure. crbug.com/1060426
+IN_PROC_BROWSER_TEST_P(
+    LoadingPredictorBrowserTestWithOptimizationGuide,
+    DISABLED_NavigationHasLocalPredictionNoOptimizationHint) {
   // Navigate the first time to fill the predictor's database and the HTTP
   // cache.
   GURL url = embedded_test_server()->GetURL(
diff --git a/chrome/browser/prefs/pref_service_incognito_whitelist.cc b/chrome/browser/prefs/pref_service_incognito_whitelist.cc
index 0206ea7..3cfc0bc 100644
--- a/chrome/browser/prefs/pref_service_incognito_whitelist.cc
+++ b/chrome/browser/prefs/pref_service_incognito_whitelist.cc
@@ -91,60 +91,6 @@
     prefs::kPartnerBookmarkMappings,
 #endif  // defined(OS_ANDROID)
 
-    // Metrics preferences are out of profile scope and are merged between
-    // incognito and regular modes.
-    metrics::prefs::kInstallDate,
-    metrics::prefs::kMetricsClientID,
-    metrics::prefs::kMetricsDefaultOptIn,
-    metrics::prefs::kMetricsInitialLogs,
-    metrics::prefs::kMetricsLowEntropySource,
-    metrics::prefs::kMetricsMachineId,
-    metrics::prefs::kMetricsOngoingLogs,
-    metrics::prefs::kMetricsResetIds,
-
-    metrics::prefs::kMetricsReportingEnabled,
-    metrics::prefs::kMetricsReportingEnabledTimestamp,
-    metrics::prefs::kMetricsSessionID,
-    metrics::prefs::kMetricsLastSeenPrefix,
-    metrics::prefs::kStabilityBreakpadRegistrationFail,
-    metrics::prefs::kStabilityBreakpadRegistrationSuccess,
-    metrics::prefs::kStabilityBrowserLastLiveTimeStamp,
-    metrics::prefs::kStabilityChildProcessCrashCount,
-    metrics::prefs::kStabilityCrashCount,
-    metrics::prefs::kStabilityCrashCountDueToGmsCoreUpdate,
-    metrics::prefs::kStabilityCrashCountWithoutGmsCoreUpdateObsolete,
-    metrics::prefs::kStabilityDebuggerNotPresent,
-    metrics::prefs::kStabilityDebuggerPresent,
-    metrics::prefs::kStabilityDeferredCount,
-    metrics::prefs::kStabilityDiscardCount,
-    metrics::prefs::kStabilityExecutionPhase,
-    metrics::prefs::kStabilityExitedCleanly,
-    metrics::prefs::kStabilityExtensionRendererCrashCount,
-    metrics::prefs::kStabilityExtensionRendererFailedLaunchCount,
-    metrics::prefs::kStabilityExtensionRendererLaunchCount,
-    metrics::prefs::kStabilityGmsCoreVersion,
-    metrics::prefs::kStabilityGpuCrashCount,
-    metrics::prefs::kStabilityIncompleteSessionEndCount,
-    metrics::prefs::kStabilityLaunchCount,
-    metrics::prefs::kStabilityPageLoadCount,
-    metrics::prefs::kStabilityRendererCrashCount,
-    metrics::prefs::kStabilityRendererFailedLaunchCount,
-    metrics::prefs::kStabilityRendererHangCount,
-    metrics::prefs::kStabilityRendererLaunchCount,
-    metrics::prefs::kStabilitySavedSystemProfile,
-    metrics::prefs::kStabilitySavedSystemProfileHash,
-    metrics::prefs::kStabilitySessionEndCompleted,
-    metrics::prefs::kStabilityStatsBuildTime,
-    metrics::prefs::kStabilityStatsVersion,
-    metrics::prefs::kStabilitySystemCrashCount,
-    metrics::prefs::kStabilityVersionMismatchCount,
-    metrics::prefs::kUninstallLaunchCount,
-    metrics::prefs::kUninstallMetricsPageLoadCount,
-    metrics::prefs::kUninstallMetricsUptimeSec,
-    metrics::prefs::kUkmCellDataUse,
-    metrics::prefs::kUmaCellDataUse,
-    metrics::prefs::kUserCellDataUse,
-
 #if defined(OS_ANDROID)
     // Clipboard modification state is updated over all profiles.
     prefs::kClipboardLastModifiedTime,
diff --git a/chrome/browser/resources/settings/autofill_page/password_check.html b/chrome/browser/resources/settings/autofill_page/password_check.html
index 73ab383..55c527a 100644
--- a/chrome/browser/resources/settings/autofill_page/password_check.html
+++ b/chrome/browser/resources/settings/autofill_page/password_check.html
@@ -69,7 +69,7 @@
           </a>
           <span class="secondary inline" id="lastCompletedCheck"
               hidden$="[[!showsTimestamp_(status_)]]">
-            &bull; [[lastCompletedCheck_]]
+            &bull; [[status_.elapsedTimeSinceLastCheck]]
           </span>
         </div>
         <div class="secondary" id="subtitle"
diff --git a/chrome/browser/resources/settings/autofill_page/password_check.js b/chrome/browser/resources/settings/autofill_page/password_check.js
index 1680d67..d434176 100644
--- a/chrome/browser/resources/settings/autofill_page/password_check.js
+++ b/chrome/browser/resources/settings/autofill_page/password_check.js
@@ -23,9 +23,6 @@
           'https://passwords.google.com/checkup/start?utm_source=chrome&utm_medium=desktop&utm_campaign=leak_dialog&hideExplanation=true',
     },
 
-    /** @private */
-    lastCompletedCheck_: String,
-
     /**
      * The number of compromised passwords as a formatted string.
      * @private
@@ -64,7 +61,7 @@
   statusChangedListener_: null,
 
   /**
-   * @type {?function(!PasswordManagerProxy.CompromisedCredentialsInfo):void}
+   * @type {?function(!PasswordManagerProxy.CompromisedCredentials):void}
    * @private
    */
   leakedCredentialsListener_: null,
@@ -87,9 +84,8 @@
     this.passwordManager_ = PasswordManagerImpl.getInstance();
 
     const statusChangeListener = status => this.status_ = status;
-    const setLeakedCredentialsListener = info => {
-      this.leakedPasswords = info.compromisedCredentials;
-      this.lastCompletedCheck_ = info.elapsedTimeSinceLastCheck;
+    const setLeakedCredentialsListener = compromisedCredentials => {
+      this.leakedPasswords = compromisedCredentials;
 
       settings.PluralStringProxyImpl.getInstance()
           .getPluralString('compromisedPasswords', this.leakedPasswords.length)
@@ -104,7 +100,7 @@
     // Request initial data.
     this.passwordManager_.getPasswordCheckStatus().then(
         this.statusChangedListener_);
-    this.passwordManager_.getCompromisedCredentialsInfo().then(
+    this.passwordManager_.getCompromisedCredentials().then(
         this.leakedCredentialsListener_);
 
     // Listen for changes.
@@ -273,7 +269,8 @@
    * @private
    */
   showsTimestamp_(status) {
-    return status.state == CheckState.IDLE;
+    return status.state == CheckState.IDLE &&
+        !!status.elapsedTimeSinceLastCheck;
   },
 
   /**
diff --git a/chrome/browser/resources/settings/autofill_page/password_manager_proxy.js b/chrome/browser/resources/settings/autofill_page/password_manager_proxy.js
index e786defb..9e6486c 100644
--- a/chrome/browser/resources/settings/autofill_page/password_manager_proxy.js
+++ b/chrome/browser/resources/settings/autofill_page/password_manager_proxy.js
@@ -163,9 +163,9 @@
 
   /**
    * Requests the latest information about compromised credentials.
-   * @return {!Promise<(PasswordManagerProxy.CompromisedCredentialsInfo)>}
+   * @return {!Promise<(PasswordManagerProxy.CompromisedCredentials)>}
    */
-  getCompromisedCredentialsInfo() {}
+  getCompromisedCredentials() {}
 
   /**
    * Returns the current status of the check via |callback|.
@@ -175,14 +175,14 @@
 
   /**
    * Add an observer to the compromised passwords change.
-   * @param {function(!PasswordManagerProxy.CompromisedCredentialsInfo):void}
+   * @param {function(!PasswordManagerProxy.CompromisedCredentials):void}
    *      listener
    */
   addCompromisedCredentialsListener(listener) {}
 
   /**
    * Remove an observer to the compromised passwords change.
-   * @param {function(!PasswordManagerProxy.CompromisedCredentialsInfo):void}
+   * @param {function(!PasswordManagerProxy.CompromisedCredentials):void}
    *     listener
    */
   removeCompromisedCredentialsListener(listener) {}
@@ -220,8 +220,8 @@
 /** @typedef {chrome.passwordsPrivate.CompromisedCredential} */
 PasswordManagerProxy.CompromisedCredential;
 
-/** @typedef {chrome.passwordsPrivate.CompromisedCredentialsInfo} */
-PasswordManagerProxy.CompromisedCredentialsInfo;
+/** @typedef {Array<!chrome.passwordsPrivate.CompromisedCredential>} */
+PasswordManagerProxy.CompromisedCredentials;
 
 /** @typedef {chrome.passwordsPrivate.PasswordCheckStatus} */
 PasswordManagerProxy.PasswordCheckStatus;
@@ -367,21 +367,21 @@
   }
 
   /** @override */
-  getCompromisedCredentialsInfo() {
+  getCompromisedCredentials() {
     return new Promise(resolve => {
-      chrome.passwordsPrivate.getCompromisedCredentialsInfo(resolve);
+      chrome.passwordsPrivate.getCompromisedCredentials(resolve);
     });
   }
 
   /** @override */
   addCompromisedCredentialsListener(listener) {
-    chrome.passwordsPrivate.onCompromisedCredentialsInfoChanged.addListener(
+    chrome.passwordsPrivate.onCompromisedCredentialsChanged.addListener(
         listener);
   }
 
   /** @override */
   removeCompromisedCredentialsListener(listener) {
-    chrome.passwordsPrivate.onCompromisedCredentialsInfoChanged.removeListener(
+    chrome.passwordsPrivate.onCompromisedCredentialsChanged.removeListener(
         listener);
   }
 
diff --git a/chrome/browser/resources/settings/autofill_page/passwords_section.js b/chrome/browser/resources/settings/autofill_page/passwords_section.js
index b8b7c2d..b0144614 100644
--- a/chrome/browser/resources/settings/autofill_page/passwords_section.js
+++ b/chrome/browser/resources/settings/autofill_page/passwords_section.js
@@ -243,8 +243,8 @@
     this.passwordManager_.getSavedPasswordList(setSavedPasswordsListener);
     this.passwordManager_.getExceptionList(setPasswordExceptionsListener);
 
-    this.passwordManager_.getCompromisedCredentialsInfo().then(info => {
-      this.haveCheckedPasswordsBefore_ = !!info.elapsedTimeSinceLastCheck;
+    this.passwordManager_.getPasswordCheckStatus().then(status => {
+      this.haveCheckedPasswordsBefore_ = !!status.elapsedTimeSinceLastCheck;
     });
 
     // Listen for changes.
diff --git a/chrome/browser/resources/settings/icons.html b/chrome/browser/resources/settings/icons.html
index 92295b4..3233ead 100644
--- a/chrome/browser/resources/settings/icons.html
+++ b/chrome/browser/resources/settings/icons.html
@@ -60,6 +60,10 @@
         <path d="M10,15 L6,11.1783439 L7.41,9.83121019 L10,12.2961783 L16.59,6 L18,7.3566879 L10,15 Z M21,3 L3,3 C1.89,3 1,3.89 1,5 L1,17 C1,18.1 1.89,19 3,19 L8,19 L8,21 L16,21 L16,19 L21,19 C22.1,19 22.99,18.1 22.99,17 L23,5 C23,3.89 22.1,3 21,3 Z M21,17 L3,17 L3,5 L21,5 L21,17 Z"></path>
       </g>
 
+      <!-- Safebrowsing SVG -->
+      <g id="public"><path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm-1 17.93c-3.95-.49-7-3.85-7-7.93 0-.62.08-1.21.21-1.79L9 15v1c0 1.1.9 2 2 2v1.93zm6.9-2.54c-.26-.81-1-1.39-1.9-1.39h-1v-3c0-.55-.45-1-1-1H8v-2h2c.55 0 1-.45 1-1V7h2c1.1 0 2-.9 2-2v-.41c2.93 1.19 5 4.06 5 7.41 0 2.08-.8 3.97-2.1 5.39z"></path></g>
+      <g id="web"><path d="M20 4H4c-1.1 0-1.99.9-1.99 2L2 18c0 1.1.9 2 2 2h16c1.1 0 2-.9 2-2V6c0-1.1-.9-2-2-2zm-5 14H4v-4h11v4zm0-5H4V9h11v4zm5 5h-4V9h4v9z"></path></g>
+
       <!-- vr-headset SVG obtained from amyroberts@ -->
       <g id="vr-headset"><path d="M18.477.678A2.54 2.54 0 0016.73 0H2.47C1.811 0 1.19.24.723.678A2.229 2.229 0 000 2.315v7.37c0 .618.256 1.2.723 1.637A2.54 2.54 0 002.47 12h3.424c.448 0 .884-.114 1.268-.33.384-.216.697-.522.908-.893l.967-1.68a.572.572 0 01.16-.74.67.67 0 01.806 0c.235.18.302.49.16.74l.967 1.68c.21.365.524.677.908.893.384.216.82.33 1.268.33h3.424c.659 0 1.28-.24 1.747-.678.467-.437.723-1.02.723-1.637v-7.37c0-.618-.256-1.2-.723-1.637zM5.4 7.8C4.072 7.8 3 6.72 3 5.4 3 4.08 4.08 3 5.4 3c1.32 0 2.4 1.08 2.4 2.4 0 1.32-1.072 2.4-2.4 2.4zm8.4 0c-1.328 0-2.4-1.08-2.4-2.4 0-1.32 1.08-2.4 2.4-2.4 1.32 0 2.4 1.08 2.4 2.4 0 1.32-1.072 2.4-2.4 2.4z"></path></g>
 
diff --git a/chrome/browser/resources/settings/privacy_page/BUILD.gn b/chrome/browser/resources/settings/privacy_page/BUILD.gn
index 0628956..99fc25f 100644
--- a/chrome/browser/resources/settings/privacy_page/BUILD.gn
+++ b/chrome/browser/resources/settings/privacy_page/BUILD.gn
@@ -183,6 +183,7 @@
     "../people_page:sync_browser_proxy",
     "../prefs:prefs_behavior",
     "//ui/webui/resources/js:load_time_data",
+    "//ui/webui/resources/js:web_ui_listener_behavior",
   ]
 }
 
diff --git a/chrome/browser/resources/settings/privacy_page/collapse_radio_button.js b/chrome/browser/resources/settings/privacy_page/collapse_radio_button.js
index 8363c1d..d717320 100644
--- a/chrome/browser/resources/settings/privacy_page/collapse_radio_button.js
+++ b/chrome/browser/resources/settings/privacy_page/collapse_radio_button.js
@@ -28,7 +28,6 @@
 
   /** @private */
   onCheckedChanged_() {
-    // The iron-collapse should open when a user selects the radio button.
     this.expanded = this.checked;
   },
 });
diff --git a/chrome/browser/resources/settings/privacy_page/passwords_leak_detection_toggle.html b/chrome/browser/resources/settings/privacy_page/passwords_leak_detection_toggle.html
index af12a3e..65d54a2 100644
--- a/chrome/browser/resources/settings/privacy_page/passwords_leak_detection_toggle.html
+++ b/chrome/browser/resources/settings/privacy_page/passwords_leak_detection_toggle.html
@@ -24,7 +24,8 @@
         sub-label="[[getPasswordsLeakDetectionSubLabel_(
             userSignedIn_, passwordsLeakDetectionAvailable_)]]"
         disabled="[[getDisabledLeakDetection_(
-            userSignedIn_, prefs.safebrowsing.enabled.value)]]"
+            userSignedIn_, prefs.safebrowsing.enabled.value,
+            prefs.safebrowsing.enhanced.value)]]"
         on-settings-boolean-control-change="onPasswordsLeakDetectionChange_">
     </settings-toggle-button>
   </template>
diff --git a/chrome/browser/resources/settings/privacy_page/passwords_leak_detection_toggle.js b/chrome/browser/resources/settings/privacy_page/passwords_leak_detection_toggle.js
index 903143e..4865ef6 100644
--- a/chrome/browser/resources/settings/privacy_page/passwords_leak_detection_toggle.js
+++ b/chrome/browser/resources/settings/privacy_page/passwords_leak_detection_toggle.js
@@ -80,8 +80,7 @@
     if (this.prefs === undefined) {
       return false;
     }
-    return !!this.getPref('profile.password_manager_leak_detection').value &&
-        !!this.getPref('safebrowsing.enabled').value;
+    return !!this.getPref('profile.password_manager_leak_detection').value;
   },
 
   /**
@@ -103,7 +102,8 @@
     if (this.prefs === undefined) {
       return false;
     }
-    return !this.userSignedIn_ || !this.getPref('safebrowsing.enabled').value;
+    return !this.userSignedIn_ || !this.getPref('safebrowsing.enabled').value ||
+        !!this.getPref('safebrowsing.enhanced').value;
   },
 
   /** @private */
diff --git a/chrome/browser/resources/settings/privacy_page/security_page.html b/chrome/browser/resources/settings/privacy_page/security_page.html
index 8b806925..184d2fb 100644
--- a/chrome/browser/resources/settings/privacy_page/security_page.html
+++ b/chrome/browser/resources/settings/privacy_page/security_page.html
@@ -1,11 +1,16 @@
 <link rel="import" href="chrome://resources/html/polymer.html">
 
+<link rel="import" href="chrome://resources/cr_elements/cr_icon_button/cr_icon_button.html">
+<link rel="import" href="chrome://resources/cr_elements/cr_radio_button/cr_radio_button.html">
+<link rel="import" href="chrome://resources/cr_elements/cr_radio_group/cr_radio_group.html">
 <link rel="import" href="chrome://resources/cr_elements/cr_link_row/cr_link_row.html">
 <link rel="import" href="collapse_radio_button.html">
 <link rel="import" href="passwords_leak_detection_toggle.html">
 <link rel="import" href="privacy_page_browser_proxy.html">
 <link rel="import" href="secure_dns.html">
+<link rel="import" href="collapse_radio_button.html">
 <link rel="import" href="../controls/settings_toggle_button.html">
+<link rel="import" href="../icons.html">
 <link rel="import" href="../metrics_browser_proxy.html">
 <link rel="import" href="../prefs/prefs.html">
 <link rel="import" href="../prefs/prefs_behavior.html">
@@ -15,26 +20,112 @@
 
 <dom-module id="settings-security-page">
   <template>
-    <style include="settings-shared"></style>
-    <div class="settings-box first line-only">
+    <style include="settings-shared">
+      img {
+        width: 100%;
+      }
+
+      .block {
+        display: block;
+      }
+
+      .bullet-line {
+        align-items: center;
+        display: flex;
+        padding-bottom: 10px;
+        padding-top: 10px;
+      }
+
+      .bullet-line > div {
+        padding-inline-start: var(--cr-button-edge-spacing);
+      }
+    </style>
+    <img src="chrome://settings/images/safe_browsing_banner.svg">
+    <div class="settings-box block first">
       <h2 class="first">$i18n{safeBrowsingSectionLabel}</h2>
+      <cr-radio-group id="safeBrowsingRadio"
+          selected="[[selectSafeBrowsingRadio_]]"
+          selectable-elements="cr-radio-button, settings-collapse-radio-button"
+          on-selected-changed="onSafeBrowsingRadioChange_">
+        <settings-collapse-radio-button name="[[safeBrowsingEnum_.ENHANCED]]"
+            id="safeBrowsingEnhanced"
+            label="$i18n{safeBrowsingEnhanced}"
+            sub-label="$i18n{safeBrowsingEnhancedDesc}">
+          <div slot="collapse">
+            <div class="bullet-line">
+              <iron-icon icon="cr:security"></iron-icon>
+              <div class="secondary">
+                $i18n{safeBrowsingEnhancedBulOne}
+              </div>
+            </div>
+            <div class="bullet-line">
+              <iron-icon icon="settings20:googleg"></iron-icon>
+              <div class="secondary">
+                $i18n{safeBrowsingEnhancedBulTwo}
+              </div>
+            </div>
+            <div class="bullet-line">
+              <iron-icon icon="settings:public"></iron-icon>
+              <div class="secondary">
+                $i18n{safeBrowsingEnhancedBulThree}
+              </div>
+            </div>
+            <div class="bullet-line">
+              <iron-icon icon="settings20:vpn-key"></iron-icon>
+              <div class="secondary">
+                $i18n{safeBrowsingEnhancedBulFour}
+              </div>
+            </div>
+            <div class="bullet-line">
+              <iron-icon icon="settings:web"></iron-icon>
+              <div class="secondary">
+                $i18n{safeBrowsingEnhancedBulFive}
+              </div>
+            </div>
+          </div>
+        </settings-collapse-radio-button>
+        <settings-collapse-radio-button name="[[safeBrowsingEnum_.STANDARD]]"
+            id="safeBrowsingStandard"
+            label="$i18n{safeBrowsingStandard}"
+            sub-label="$i18n{safeBrowsingStandardDesc}"
+            info-opened="{{infoOpened_}}">
+          <div slot="collapse">
+            <div class="bullet-line">
+              <iron-icon icon="cr:computer"></iron-icon>
+              <div class="secondary">
+                  $i18n{safeBrowsingStandardBulOne}
+              </div>
+            </div>
+            <div class="bullet-line">
+              <iron-icon icon="settings:web"></iron-icon>
+              <div class="secondary">
+                  $i18n{safeBrowsingStandardBulTwo}
+              </div>
+            </div>
+            <settings-toggle-button id="safeBrowsingReportingToggle"
+                pref="[[safeBrowsingReportingPref_]]" no-set-pref
+                class="settings-box first"
+                label="$i18n{safeBrowsingEnableExtendedReporting}"
+                sub-label="$i18n{safeBrowsingEnableExtendedReportingDesc}"
+                disabled="[[
+                    getDisabledExtendedSafeBrowsing_(prefs.safebrowsing.*)]]"
+                on-settings-boolean-control-change=
+                    "onSafeBrowsingReportingToggleChange_">
+            </settings-toggle-button>
+            <settings-passwords-leak-detection-toggle prefs="{{prefs}}"
+                sync-status="[[syncStatus]]">
+            </settings-passwords-leak-detection-toggle>
+          </div>
+        </settings-collapse-radio-button>
+        <cr-radio-button name="[[safeBrowsingEnum_.DISABLED]]"
+            id="safeBrowsingDisabled">
+          <div>
+            <div>$i18n{safeBrowsingNone}</div>
+            <div class="secondary">$i18n{safeBrowsingNoneDesc}</div>
+          </div>
+        </cr-radio-button>
+      </cr-radio-group>
     </div>
-    <settings-toggle-button id="safeBrowsingToggle"
-        pref="{{prefs.safebrowsing.enabled}}"
-        label="$i18n{safeBrowsingEnableProtection}"
-        sub-label="$i18n{safeBrowsingEnableProtectionDesc}">
-    </settings-toggle-button>
-    <settings-passwords-leak-detection-toggle prefs="{{prefs}}"
-        sync-status="[[syncStatus]]">
-    </settings-passwords-leak-detection-toggle>
-    <settings-toggle-button id="safeBrowsingReportingToggle"
-        pref="[[safeBrowsingReportingPref_]]" no-set-pref
-        label="$i18n{safeBrowsingEnableExtendedReporting}"
-        sub-label="$i18n{safeBrowsingEnableExtendedReportingDesc}"
-        disabled="[[getDisabledExtendedSafeBrowsing_(prefs.safebrowsing.*)]]"
-        on-settings-boolean-control-change=
-            "onSafeBrowsingReportingToggleChange_">
-    </settings-toggle-button>
     <div class="settings-box first line-only">
       <h2>$i18n{securityPageAdvancedSectionLabel}</h2>
     </div>
diff --git a/chrome/browser/resources/settings/privacy_page/security_page.js b/chrome/browser/resources/settings/privacy_page/security_page.js
index 201d5c5..386d530 100644
--- a/chrome/browser/resources/settings/privacy_page/security_page.js
+++ b/chrome/browser/resources/settings/privacy_page/security_page.js
@@ -2,6 +2,17 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+(function() {
+/**
+ * Enumeration of all safe browsing modes.
+ * @enum {string}
+ */
+const SafeBrowsing = {
+  ENHANCED: 'enhanced',
+  STANDARD: 'standard',
+  DISABLED: 'disabled',
+};
+
 Polymer({
   is: 'settings-security-page',
 
@@ -14,6 +25,14 @@
     syncStatus: Object,
 
     /**
+     * Preferences state.
+     */
+    prefs: {
+      type: Object,
+      notify: true,
+    },
+
+    /**
      * Whether the secure DNS setting should be displayed.
      * @private
      */
@@ -25,6 +44,21 @@
       },
     },
 
+    /**
+     * Valid safe browsing states.
+     * @private
+     */
+    safeBrowsingEnum_: {
+      type: Object,
+      value: SafeBrowsing,
+    },
+
+    /** @private */
+    selectSafeBrowsingRadio_: {
+      type: String,
+      computed: 'computeSelectSafeBrowsingRadio_(prefs.safeBrowsing.*)',
+    },
+
     /** @private */
     enableSecurityKeysSubpage_: {
       type: Boolean,
@@ -45,15 +79,54 @@
         });
       },
     },
+
+    /** @private {!Map<string, string>} */
+    focusConfig_: {
+      type: Object,
+      value() {
+        const map = new Map();
+        // <if expr="use_nss_certs">
+        if (settings.routes.CERTIFICATES) {
+          map.set(settings.routes.CERTIFICATES.path, '#manageCertificates');
+        }
+        // </if>
+
+        if (settings.routes.SECURITY_KEYS) {
+          map.set(
+              settings.routes.SECURITY_KEYS.path,
+              '#security-keys-subpage-trigger');
+        }
+        return map;
+      },
+    },
   },
 
   observers: [
     'onSafeBrowsingReportingPrefChange_(prefs.safebrowsing.*)',
   ],
 
+  /**
+   * @return {string}
+   * @private
+   */
+  computeSelectSafeBrowsingRadio_() {
+    if (this.prefs === undefined) {
+      return SafeBrowsing.STANDARD;
+    }
+    if (!this.getPref('safebrowsing.enabled').value) {
+      return SafeBrowsing.DISABLED;
+    }
+    return this.getPref('safebrowsing.enhanced').value ? SafeBrowsing.ENHANCED :
+                                                         SafeBrowsing.STANDARD;
+  },
+
+
   /** @private {settings.PrivacyPageBrowserProxy} */
   browserProxy_: null,
 
+  /** @private {settings.MetricsBrowserProxy} */
+  metricsBrowserProxy_: null,
+
   /** @override */
   ready() {
     this.browserProxy_ = settings.PrivacyPageBrowserProxyImpl.getInstance();
@@ -62,11 +135,31 @@
   },
 
   /**
+   * Updates the various underlying cookie prefs based on the newly selected
+   * radio button.
+   * @param {!CustomEvent<{value: string}>} event
+   * @private
+   */
+  onSafeBrowsingRadioChange_: function(event) {
+    if (event.detail.value == SafeBrowsing.ENHANCED) {
+      this.setPrefValue('safebrowsing.enabled', true);
+      this.setPrefValue('safebrowsing.enhanced', true);
+    } else if (event.detail.value == SafeBrowsing.STANDARD) {
+      this.setPrefValue('safebrowsing.enabled', true);
+      this.setPrefValue('safebrowsing.enhanced', false);
+    } else {  // disabled state
+      this.setPrefValue('safebrowsing.enabled', false);
+      this.setPrefValue('safebrowsing.enhanced', false);
+    }
+  },
+
+  /**
    * @return {boolean}
    * @private
    */
   getDisabledExtendedSafeBrowsing_() {
-    return !this.getPref('safebrowsing.enabled').value;
+    return !this.getPref('safebrowsing.enabled').value ||
+        !!this.getPref('safebrowsing.enhanced').value;
   },
 
   /** @private */
@@ -83,12 +176,10 @@
     }
     const safeBrowsingScoutPref =
         this.getPref('safebrowsing.scout_reporting_enabled');
-    const prefValue = !!this.getPref('safebrowsing.enabled').value &&
-        !!safeBrowsingScoutPref.value;
     this.safeBrowsingReportingPref_ = {
       key: '',
       type: chrome.settingsPrivate.PrefType.BOOLEAN,
-      value: prefValue,
+      value: !!safeBrowsingScoutPref.value,
       enforcement: safeBrowsingScoutPref.enforcement,
       controlledBy: safeBrowsingScoutPref.controlledBy,
     };
@@ -118,3 +209,4 @@
         settings.SettingsPageInteractions.PRIVACY_SECURITY_KEYS);
   },
 });
+})();
diff --git a/chrome/browser/supervised_user/BUILD.gn b/chrome/browser/supervised_user/BUILD.gn
index 94911a9..93832b6 100644
--- a/chrome/browser/supervised_user/BUILD.gn
+++ b/chrome/browser/supervised_user/BUILD.gn
@@ -11,4 +11,9 @@
     "supervised_user_unscaled_resources.pak",
   ]
   output_dir = "$root_gen_dir/chrome/browser/supervised_user"
+
+  grit_flags = [
+    "-E",
+    "root_gen_dir=" + rebase_path(root_gen_dir, root_build_dir),
+  ]
 }
diff --git a/chrome/browser/ui/BUILD.gn b/chrome/browser/ui/BUILD.gn
index 21659d2..a5b23fe 100644
--- a/chrome/browser/ui/BUILD.gn
+++ b/chrome/browser/ui/BUILD.gn
@@ -42,8 +42,8 @@
     "autofill/autofill_popup_controller_impl.h",
     "autofill/autofill_popup_controller_impl_mac.h",
     "autofill/autofill_popup_controller_impl_mac.mm",
-    "autofill/autofill_popup_layout_model.cc",
-    "autofill/autofill_popup_layout_model.h",
+    "autofill/autofill_popup_controller_utils.cc",
+    "autofill/autofill_popup_controller_utils.h",
     "autofill/autofill_popup_view.h",
     "autofill/autofill_popup_view_delegate.h",
     "autofill/chrome_autofill_client.cc",
diff --git a/chrome/browser/ui/android/autofill/autofill_keyboard_accessory_view.cc b/chrome/browser/ui/android/autofill/autofill_keyboard_accessory_view.cc
index 0d4f9565..06b46b9 100644
--- a/chrome/browser/ui/android/autofill/autofill_keyboard_accessory_view.cc
+++ b/chrome/browser/ui/android/autofill/autofill_keyboard_accessory_view.cc
@@ -13,7 +13,7 @@
 #include "chrome/browser/android/resource_mapper.h"
 #include "chrome/browser/ui/android/view_android_helper.h"
 #include "chrome/browser/ui/autofill/autofill_popup_controller.h"
-#include "chrome/browser/ui/autofill/autofill_popup_layout_model.h"
+#include "chrome/browser/ui/autofill/autofill_popup_controller_utils.h"
 #include "components/autofill/core/browser/ui/suggestion.h"
 #include "ui/android/view_android.h"
 #include "ui/android/window_android.h"
@@ -68,7 +68,7 @@
     int android_icon_id = 0;
     if (!suggestion.icon.empty()) {
       android_icon_id = ResourceMapper::MapToJavaDrawableId(
-          controller_->layout_model().GetIconResourceID(suggestion.icon));
+          GetIconResourceID(suggestion.icon));
     }
 
     Java_AutofillKeyboardAccessoryViewBridge_addToAutofillSuggestionArray(
diff --git a/chrome/browser/ui/android/autofill/autofill_popup_view_android.cc b/chrome/browser/ui/android/autofill/autofill_popup_view_android.cc
index a7cb808..60bd952 100644
--- a/chrome/browser/ui/android/autofill/autofill_popup_view_android.cc
+++ b/chrome/browser/ui/android/autofill/autofill_popup_view_android.cc
@@ -16,7 +16,7 @@
 #include "chrome/browser/ui/android/autofill/autofill_keyboard_accessory_view.h"
 #include "chrome/browser/ui/android/view_android_helper.h"
 #include "chrome/browser/ui/autofill/autofill_popup_controller.h"
-#include "chrome/browser/ui/autofill/autofill_popup_layout_model.h"
+#include "chrome/browser/ui/autofill/autofill_popup_controller_utils.h"
 #include "components/autofill/core/browser/ui/popup_item_ids.h"
 #include "components/autofill/core/browser/ui/suggestion.h"
 #include "components/autofill/core/common/autofill_util.h"
@@ -85,7 +85,7 @@
     const Suggestion& suggestion = controller_->GetSuggestionAt(i);
     if (!suggestion.icon.empty()) {
       android_icon_id = ResourceMapper::MapToJavaDrawableId(
-          controller_->layout_model().GetIconResourceID(suggestion.icon));
+          GetIconResourceID(suggestion.icon));
     }
 
     bool is_deletable =
diff --git a/chrome/browser/ui/ash/launcher/chrome_launcher_controller_browsertest.cc b/chrome/browser/ui/ash/launcher/chrome_launcher_controller_browsertest.cc
index 1ff47d90..850d10b7 100644
--- a/chrome/browser/ui/ash/launcher/chrome_launcher_controller_browsertest.cc
+++ b/chrome/browser/ui/ash/launcher/chrome_launcher_controller_browsertest.cc
@@ -67,6 +67,7 @@
 #include "chrome/browser/ui/views/frame/browser_view.h"
 #include "chrome/browser/ui/web_applications/app_browser_controller.h"
 #include "chrome/browser/ui/web_applications/test/web_app_browsertest_util.h"
+#include "chrome/browser/web_applications/components/app_registry_controller.h"
 #include "chrome/browser/web_applications/components/app_shortcut_manager.h"
 #include "chrome/browser/web_applications/components/web_app_constants.h"
 #include "chrome/browser/web_applications/components/web_app_helpers.h"
@@ -110,9 +111,10 @@
 #include "ui/events/types/event_type.h"
 
 using ash::Shelf;
+using content::WebContents;
 using extensions::AppWindow;
 using extensions::Extension;
-using content::WebContents;
+using web_app::WebAppProviderBase;
 
 namespace {
 
@@ -428,9 +430,10 @@
     ASSERT_TRUE(https_server()->Start());
     cert_verifier_.mock_cert_verifier()->set_default_result(net::OK);
 
-    web_app::WebAppProviderBase::GetProviderBase(browser()->profile())
-        ->shortcut_manager()
-        .SuppressShortcutsForTesting();
+    WebAppProviderBase* provider =
+        WebAppProviderBase::GetProviderBase(browser()->profile());
+    DCHECK(provider);
+    provider->shortcut_manager().SuppressShortcutsForTesting();
   }
 
  private:
@@ -2142,8 +2145,11 @@
   // Set both apps to open in windows.
   extensions::SetLaunchType(browser()->profile(), hosted_app->id(),
                             extensions::LAUNCH_TYPE_WINDOW);
-  extensions::SetLaunchType(browser()->profile(), web_app_id,
-                            extensions::LAUNCH_TYPE_WINDOW);
+  WebAppProviderBase* provider =
+      WebAppProviderBase::GetProviderBase(browser()->profile());
+  DCHECK(provider);
+  provider->registry_controller().SetAppUserDisplayMode(
+      web_app_id, web_app::DisplayMode::kStandalone);
 
   // The apps should be closed.
   EXPECT_EQ(ash::STATUS_CLOSED,
diff --git a/chrome/browser/ui/autofill/autofill_popup_controller.h b/chrome/browser/ui/autofill/autofill_popup_controller.h
index 6dc8807..141f5b3 100644
--- a/chrome/browser/ui/autofill/autofill_popup_controller.h
+++ b/chrome/browser/ui/autofill/autofill_popup_controller.h
@@ -19,7 +19,6 @@
 
 namespace autofill {
 
-class AutofillPopupLayoutModel;
 struct Suggestion;
 
 // This interface provides data to an AutofillPopupView.
@@ -63,10 +62,11 @@
   // hovered or has keyboard focus.
   virtual base::Optional<int> selected_line() const = 0;
 
-  virtual const AutofillPopupLayoutModel& layout_model() const = 0;
+  // Returns the popup type corresponding to the controller.
+  virtual PopupType GetPopupType() const = 0;
 
  protected:
-  ~AutofillPopupController() override {}
+  ~AutofillPopupController() override = default;
 };
 
 }  // namespace autofill
diff --git a/chrome/browser/ui/autofill/autofill_popup_controller_impl.cc b/chrome/browser/ui/autofill/autofill_popup_controller_impl.cc
index 2d6c9cc1..76b50e1 100644
--- a/chrome/browser/ui/autofill/autofill_popup_controller_impl.cc
+++ b/chrome/browser/ui/autofill/autofill_popup_controller_impl.cc
@@ -79,7 +79,6 @@
     base::i18n::TextDirection text_direction)
     : controller_common_(element_bounds, text_direction, container_view),
       web_contents_(web_contents),
-      layout_model_(delegate->GetPopupType() == PopupType::kCreditCards),
       delegate_(delegate) {
   ClearState();
   delegate->RegisterDeletionCallback(base::BindOnce(
@@ -360,9 +359,8 @@
   return selected_line_;
 }
 
-const AutofillPopupLayoutModel& AutofillPopupControllerImpl::layout_model()
-    const {
-  return layout_model_;
+PopupType AutofillPopupControllerImpl::GetPopupType() const {
+  return delegate_->GetPopupType();
 }
 
 void AutofillPopupControllerImpl::SetSelectedLine(
diff --git a/chrome/browser/ui/autofill/autofill_popup_controller_impl.h b/chrome/browser/ui/autofill/autofill_popup_controller_impl.h
index 260a901..2df0bf0 100644
--- a/chrome/browser/ui/autofill/autofill_popup_controller_impl.h
+++ b/chrome/browser/ui/autofill/autofill_popup_controller_impl.h
@@ -17,7 +17,6 @@
 #include "base/strings/string16.h"
 #include "build/build_config.h"
 #include "chrome/browser/ui/autofill/autofill_popup_controller.h"
-#include "chrome/browser/ui/autofill/autofill_popup_layout_model.h"
 #include "chrome/browser/ui/autofill/popup_controller_common.h"
 #include "components/autofill/core/browser/ui/popup_types.h"
 #include "ui/gfx/geometry/rect.h"
@@ -110,7 +109,7 @@
   bool RemoveSuggestion(int list_index) override;
   void SetSelectedLine(base::Optional<int> selected_line) override;
   base::Optional<int> selected_line() const override;
-  const AutofillPopupLayoutModel& layout_model() const override;
+  PopupType GetPopupType() const override;
 
   // Increase the selected line by 1, properly handling wrapping.
   void SelectNextLine();
@@ -135,8 +134,6 @@
 
   base::WeakPtr<AutofillPopupControllerImpl> GetWeakPtr();
 
-  AutofillPopupLayoutModel& LayoutModelForTesting() { return layout_model_; }
-
   // Raise an accessibility event to indicate the controls relation of the
   // form control of the popup and popup itself has changed based on the popup's
   // show or hide action.
@@ -165,7 +162,6 @@
   PopupControllerCommon controller_common_;
   content::WebContents* web_contents_;
   AutofillPopupView* view_ = nullptr;  // Weak reference.
-  AutofillPopupLayoutModel layout_model_;
   base::WeakPtr<AutofillPopupDelegate> delegate_;
 
   // If set to true, the popup will not be hidden because of stale data or if
diff --git a/chrome/browser/ui/autofill/autofill_popup_controller_unittest.cc b/chrome/browser/ui/autofill/autofill_popup_controller_unittest.cc
index a8870b6..b1185d22 100644
--- a/chrome/browser/ui/autofill/autofill_popup_controller_unittest.cc
+++ b/chrome/browser/ui/autofill/autofill_popup_controller_unittest.cc
@@ -147,8 +147,6 @@
                                     nullptr,
                                     element_bounds,
                                     base::i18n::UNKNOWN_DIRECTION) {
-    LayoutModelForTesting().SetUpForTesting(
-        std::make_unique<MockPopupViewCommonForUnitTesting>());
   }
   ~TestAutofillPopupController() override = default;
 
diff --git a/chrome/browser/ui/autofill/autofill_popup_controller_utils.cc b/chrome/browser/ui/autofill/autofill_popup_controller_utils.cc
new file mode 100644
index 0000000..eb3772b
--- /dev/null
+++ b/chrome/browser/ui/autofill/autofill_popup_controller_utils.cc
@@ -0,0 +1,69 @@
+// Copyright (c) 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/ui/autofill/autofill_popup_controller_utils.h"
+#include "build/branding_buildflags.h"
+#include "build/build_config.h"
+#include "chrome/browser/android/android_theme_resources.h"
+#include "components/autofill/core/browser/data_model/credit_card.h"
+#include "components/grit/components_scaled_resources.h"
+#include "components/strings/grit/components_strings.h"
+
+namespace autofill {
+
+namespace {
+
+// Used in the IDS_ space as a placeholder for resources that don't exist.
+constexpr int kResourceNotFoundId = 0;
+
+// Used to fetch the |icon_id| corresponding the the |name| resource.
+const struct {
+  const char* name;
+  int icon_id;
+} kDataResources[] = {
+    {kAmericanExpressCard, IDR_AUTOFILL_CC_AMEX},
+    {kDinersCard, IDR_AUTOFILL_CC_DINERS},
+    {kDiscoverCard, IDR_AUTOFILL_CC_DISCOVER},
+    {kEloCard, IDR_AUTOFILL_CC_ELO},
+    {kGenericCard, IDR_AUTOFILL_CC_GENERIC},
+    {kJCBCard, IDR_AUTOFILL_CC_JCB},
+    {kMasterCard, IDR_AUTOFILL_CC_MASTERCARD},
+    {kMirCard, IDR_AUTOFILL_CC_MIR},
+    {kUnionPay, IDR_AUTOFILL_CC_UNIONPAY},
+    {kVisaCard, IDR_AUTOFILL_CC_VISA},
+#if defined(OS_ANDROID)
+    {"httpWarning", IDR_ANDROID_AUTOFILL_HTTP_WARNING},
+    {"httpsInvalid", IDR_ANDROID_AUTOFILL_HTTPS_INVALID_WARNING},
+    {"scanCreditCardIcon", IDR_ANDROID_AUTOFILL_CC_SCAN_NEW},
+    {"settings", IDR_ANDROID_AUTOFILL_SETTINGS},
+    {"create", IDR_ANDROID_AUTOFILL_CREATE},
+#if BUILDFLAG(GOOGLE_CHROME_BRANDING)
+    {"googlePay", IDR_ANDROID_AUTOFILL_GOOGLE_PAY},
+#endif  // OS_ANDROID
+#elif BUILDFLAG(GOOGLE_CHROME_BRANDING)
+    {"googlePay", IDR_AUTOFILL_GOOGLE_PAY},
+    {"googlePayDark", IDR_AUTOFILL_GOOGLE_PAY_DARK},
+#endif  // BUILDFLAG(GOOGLE_CHROME_BRANDING)
+};
+
+}  // namespace
+
+int GetIconResourceID(const std::string& resource_name) {
+#if !BUILDFLAG(GOOGLE_CHROME_BRANDING)
+  if (resource_name == "googlePay" || resource_name == "googlePayDark") {
+    return 0;
+  }
+#endif
+  int result = kResourceNotFoundId;
+  for (const auto& kDataResource : kDataResources) {
+    if (resource_name == kDataResource.name) {
+      result = kDataResource.icon_id;
+      break;
+    }
+  }
+
+  return result;
+}
+
+}  // namespace autofill
diff --git a/chrome/browser/ui/autofill/autofill_popup_controller_utils.h b/chrome/browser/ui/autofill/autofill_popup_controller_utils.h
new file mode 100644
index 0000000..9654154
--- /dev/null
+++ b/chrome/browser/ui/autofill/autofill_popup_controller_utils.h
@@ -0,0 +1,18 @@
+// Copyright (c) 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_UI_AUTOFILL_AUTOFILL_POPUP_CONTROLLER_UTILS_H_
+#define CHROME_BROWSER_UI_AUTOFILL_AUTOFILL_POPUP_CONTROLLER_UTILS_H_
+
+#include <string>
+#include <utility>
+
+namespace autofill {
+
+// Returns the icon resource id corresponding to the |resource_name|.
+int GetIconResourceID(const std::string& resource_name);
+
+}  // namespace autofill
+
+#endif  // CHROME_BROWSER_UI_AUTOFILL_AUTOFILL_POPUP_CONTROLLER_UTILS_H_
diff --git a/chrome/browser/ui/autofill/autofill_popup_layout_model.cc b/chrome/browser/ui/autofill/autofill_popup_layout_model.cc
deleted file mode 100644
index f7a6748..0000000
--- a/chrome/browser/ui/autofill/autofill_popup_layout_model.cc
+++ /dev/null
@@ -1,175 +0,0 @@
-// Copyright (c) 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/browser/ui/autofill/autofill_popup_layout_model.h"
-
-#include <algorithm>
-#include <memory>
-#include <utility>
-#include <vector>
-
-#include "base/macros.h"
-#include "base/stl_util.h"
-#include "base/strings/utf_string_conversions.h"
-#include "build/branding_buildflags.h"
-#include "build/build_config.h"
-#include "chrome/browser/android/android_theme_resources.h"
-#include "chrome/browser/ui/autofill/autofill_popup_view.h"
-#include "chrome/browser/ui/autofill/popup_constants.h"
-#include "components/autofill/core/browser/data_model/credit_card.h"
-#include "components/autofill/core/browser/ui/popup_item_ids.h"
-#include "components/autofill/core/common/autofill_features.h"
-#include "components/autofill/core/common/autofill_util.h"
-#include "components/grit/components_scaled_resources.h"
-#include "components/strings/grit/components_strings.h"
-#include "third_party/skia/include/core/SkColor.h"
-#include "ui/base/resource/resource_bundle.h"
-#include "ui/gfx/image/image_skia.h"
-#include "ui/gfx/paint_vector_icon.h"
-
-#if !defined(OS_ANDROID)
-#include "chrome/app/vector_icons/vector_icons.h"
-#include "components/omnibox/browser/vector_icons.h"  // nogncheck
-#endif
-
-namespace autofill {
-
-namespace {
-
-#if !defined(OS_ANDROID)
-// Default sice for icons in the autofill popup.
-constexpr int kIconSize = 16;
-#endif
-
-// Used in the IDS_ space as a placeholder for resources that don't exist.
-constexpr int kResourceNotFoundId = 0;
-
-const struct {
-  const char* name;
-  int icon_id;
-  int accessible_string_id;
-} kDataResources[] = {
-    {autofill::kAmericanExpressCard, IDR_AUTOFILL_CC_AMEX,
-     IDS_AUTOFILL_CC_AMEX},
-    {autofill::kDinersCard, IDR_AUTOFILL_CC_DINERS, IDS_AUTOFILL_CC_DINERS},
-    {autofill::kDiscoverCard, IDR_AUTOFILL_CC_DISCOVER,
-     IDS_AUTOFILL_CC_DISCOVER},
-    {autofill::kEloCard, IDR_AUTOFILL_CC_ELO, IDS_AUTOFILL_CC_ELO},
-    {autofill::kGenericCard, IDR_AUTOFILL_CC_GENERIC, kResourceNotFoundId},
-    {autofill::kJCBCard, IDR_AUTOFILL_CC_JCB, IDS_AUTOFILL_CC_JCB},
-    {autofill::kMasterCard, IDR_AUTOFILL_CC_MASTERCARD,
-     IDS_AUTOFILL_CC_MASTERCARD},
-    {autofill::kMirCard, IDR_AUTOFILL_CC_MIR, IDS_AUTOFILL_CC_MIR},
-    {autofill::kUnionPay, IDR_AUTOFILL_CC_UNIONPAY, IDS_AUTOFILL_CC_UNION_PAY},
-    {autofill::kVisaCard, IDR_AUTOFILL_CC_VISA, IDS_AUTOFILL_CC_VISA},
-#if defined(OS_ANDROID)
-    {"httpWarning", IDR_ANDROID_AUTOFILL_HTTP_WARNING, kResourceNotFoundId},
-    {"httpsInvalid", IDR_ANDROID_AUTOFILL_HTTPS_INVALID_WARNING,
-     kResourceNotFoundId},
-    {"scanCreditCardIcon", IDR_ANDROID_AUTOFILL_CC_SCAN_NEW,
-     kResourceNotFoundId},
-    {"settings", IDR_ANDROID_AUTOFILL_SETTINGS, kResourceNotFoundId},
-    {"create", IDR_ANDROID_AUTOFILL_CREATE, kResourceNotFoundId},
-#if BUILDFLAG(GOOGLE_CHROME_BRANDING)
-    {"googlePay", IDR_ANDROID_AUTOFILL_GOOGLE_PAY, kResourceNotFoundId},
-#endif  // BUILDFLAG(GOOGLE_CHROME_BRANDING)
-#elif BUILDFLAG(GOOGLE_CHROME_BRANDING)
-    {"googlePay", IDR_AUTOFILL_GOOGLE_PAY, kResourceNotFoundId},
-    {"googlePayDark", IDR_AUTOFILL_GOOGLE_PAY_DARK, kResourceNotFoundId},
-#endif  // BUILDFLAG(GOOGLE_CHROME_BRANDING)
-};
-
-}  // namespace
-
-AutofillPopupLayoutModel::AutofillPopupLayoutModel(bool is_credit_card_popup)
-    : is_credit_card_popup_(is_credit_card_popup) {}
-
-AutofillPopupLayoutModel::~AutofillPopupLayoutModel() = default;
-
-#if !defined(OS_ANDROID)
-// static
-gfx::ImageSkia AutofillPopupLayoutModel::GetIconImage(
-    const autofill::Suggestion& suggestion) {
-  if (!suggestion.custom_icon.IsEmpty())
-    return suggestion.custom_icon.AsImageSkia();
-
-  return GetIconImageByName(suggestion.icon);
-}
-
-// static
-gfx::ImageSkia AutofillPopupLayoutModel::GetStoreIndicatorIconImage(
-    const autofill::Suggestion& suggestion) {
-  return GetIconImageByName(suggestion.store_indicator_icon);
-}
-#endif  // !defined(OS_ANDROID)
-
-// static
-int AutofillPopupLayoutModel::GetIconResourceID(
-    const std::string& resource_name) {
-#if !BUILDFLAG(GOOGLE_CHROME_BRANDING)
-  if (resource_name == "googlePay" || resource_name == "googlePayDark") {
-    return 0;
-  }
-#endif
-  int result = kResourceNotFoundId;
-  for (size_t i = 0; i < base::size(kDataResources); ++i) {
-    if (resource_name == kDataResources[i].name) {
-      result = kDataResources[i].icon_id;
-      break;
-    }
-  }
-
-  return result;
-}
-
-void AutofillPopupLayoutModel::SetUpForTesting(
-    std::unique_ptr<PopupViewCommon> view_common) {
-  view_common_ = std::move(view_common);
-}
-
-#if !defined(OS_ANDROID)
-// static
-gfx::ImageSkia AutofillPopupLayoutModel::GetIconImageByName(
-    const std::string& icon_str) {
-  if (icon_str.empty())
-    return gfx::ImageSkia();
-
-  // For http warning message, get icon images from VectorIcon, which is the
-  // same as security indicator icons in location bar.
-  if (icon_str == "httpWarning") {
-    return gfx::CreateVectorIcon(omnibox::kHttpIcon, kIconSize,
-                                 gfx::kChromeIconGrey);
-  }
-  if (icon_str == "httpsInvalid") {
-    return gfx::CreateVectorIcon(omnibox::kNotSecureWarningIcon, kIconSize,
-                                 gfx::kGoogleRed700);
-  }
-  if (icon_str == "keyIcon") {
-    return gfx::CreateVectorIcon(kKeyIcon, kIconSize, gfx::kChromeIconGrey);
-  }
-  if (icon_str == "globeIcon") {
-    return gfx::CreateVectorIcon(kGlobeIcon, kIconSize, gfx::kChromeIconGrey);
-  }
-  if (icon_str == "google") {
-#if BUILDFLAG(GOOGLE_CHROME_BRANDING)
-    return gfx::CreateVectorIcon(kGoogleGLogoIcon, kIconSize,
-                                 gfx::kPlaceholderColor);
-#else
-    return gfx::ImageSkia();
-#endif
-  }
-
-#if !BUILDFLAG(GOOGLE_CHROME_BRANDING)
-  if (icon_str == "googlePay" || icon_str == "googlePayDark") {
-    return gfx::ImageSkia();
-  }
-#endif
-  // For other suggestion entries, get icon from PNG files.
-  int icon_id = GetIconResourceID(icon_str);
-  DCHECK_NE(kResourceNotFoundId, icon_id);
-  return *ui::ResourceBundle::GetSharedInstance().GetImageSkiaNamed(icon_id);
-}
-#endif  // !defined(OS_ANDROID)
-
-}  // namespace autofill
diff --git a/chrome/browser/ui/autofill/autofill_popup_layout_model.h b/chrome/browser/ui/autofill/autofill_popup_layout_model.h
deleted file mode 100644
index ef4c03e7..0000000
--- a/chrome/browser/ui/autofill/autofill_popup_layout_model.h
+++ /dev/null
@@ -1,65 +0,0 @@
-// Copyright (c) 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_BROWSER_UI_AUTOFILL_AUTOFILL_POPUP_LAYOUT_MODEL_H_
-#define CHROME_BROWSER_UI_AUTOFILL_AUTOFILL_POPUP_LAYOUT_MODEL_H_
-
-#include <stddef.h>
-
-#include <memory>
-#include <string>
-
-#include "chrome/browser/ui/autofill/popup_view_common.h"
-#include "components/autofill/core/browser/ui/suggestion.h"
-#include "ui/gfx/font_list.h"
-#include "ui/gfx/geometry/rect.h"
-
-namespace gfx {
-class ImageSkia;
-}
-
-namespace autofill {
-
-// Helper class which keeps tracks of popup bounds and related view information.
-// TODO(mathp): investigate moving ownership of this class to the view.
-class AutofillPopupLayoutModel {
- public:
-  explicit AutofillPopupLayoutModel(bool is_credit_card_popup);
-
-  ~AutofillPopupLayoutModel();
-
-#if !defined(OS_ANDROID)
-  // Returns the icon image of the given |suggestion|.
-  static gfx::ImageSkia GetIconImage(const autofill::Suggestion& suggestion);
-
-  // Returns the store indicator icon image of the given |suggestion|.
-  static gfx::ImageSkia GetStoreIndicatorIconImage(
-      const autofill::Suggestion& suggestion);
-#endif
-
-  bool is_credit_card_popup() const { return is_credit_card_popup_; }
-
-  // Gets the resource value for the given resource, returning 0 if the
-  // resource isn't recognized.
-  static int GetIconResourceID(const std::string& resource_name);
-
-  // Allows the provision of another implementation of view_common, for use in
-  // unit tests where using the real thing could cause crashes.
-  void SetUpForTesting(std::unique_ptr<PopupViewCommon> view_common);
-
- private:
-#if !defined(OS_ANDROID)
-  static gfx::ImageSkia GetIconImageByName(const std::string& icon_str);
-#endif
-
-  std::unique_ptr<PopupViewCommon> view_common_;
-
-  const bool is_credit_card_popup_;
-
-  DISALLOW_COPY_AND_ASSIGN(AutofillPopupLayoutModel);
-};
-
-}  // namespace autofill
-
-#endif  // CHROME_BROWSER_UI_AUTOFILL_AUTOFILL_POPUP_LAYOUT_MODEL_H_
diff --git a/chrome/browser/ui/autofill/autofill_popup_layout_model_unittest.cc b/chrome/browser/ui/autofill/autofill_popup_layout_model_unittest.cc
deleted file mode 100644
index 1c44dd9a..0000000
--- a/chrome/browser/ui/autofill/autofill_popup_layout_model_unittest.cc
+++ /dev/null
@@ -1,33 +0,0 @@
-// Copyright (c) 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/browser/ui/autofill/autofill_popup_layout_model.h"
-
-#include <stddef.h>
-
-#include <memory>
-#include <vector>
-
-#include "chrome/test/base/chrome_render_view_host_test_harness.h"
-
-namespace autofill {
-
-namespace {
-
-class AutofillPopupLayoutModelTest : public ChromeRenderViewHostTestHarness {
- public:
-  void SetUp() override {
-    ChromeRenderViewHostTestHarness::SetUp();
-    layout_model_ = std::make_unique<AutofillPopupLayoutModel>(false);
-  }
-
-  AutofillPopupLayoutModel* layout_model() { return layout_model_.get(); }
-
- private:
-  std::unique_ptr<AutofillPopupLayoutModel> layout_model_;
-};
-
-}  // namespace
-
-}  // namespace autofill
diff --git a/chrome/browser/ui/cocoa/touchbar/credit_card_autofill_touch_bar_controller.h b/chrome/browser/ui/cocoa/touchbar/credit_card_autofill_touch_bar_controller.h
index d7459e9..38b40988 100644
--- a/chrome/browser/ui/cocoa/touchbar/credit_card_autofill_touch_bar_controller.h
+++ b/chrome/browser/ui/cocoa/touchbar/credit_card_autofill_touch_bar_controller.h
@@ -13,6 +13,7 @@
 
 @interface CreditCardAutofillTouchBarController : NSObject<NSTouchBarDelegate> {
   autofill::AutofillPopupController* _controller;  // weak
+  bool _is_credit_card_popup;
 }
 
 - (instancetype)initWithController:
@@ -30,6 +31,7 @@
 
 - (NSButton*)createCreditCardButtonAtRow:(int)row API_AVAILABLE(macos(10.12.2));
 - (void)acceptCreditCard:(id)sender;
+- (void)setIsCreditCardPopup:(bool)is_credit_card_popup;
 
 @end
 
diff --git a/chrome/browser/ui/cocoa/touchbar/credit_card_autofill_touch_bar_controller.mm b/chrome/browser/ui/cocoa/touchbar/credit_card_autofill_touch_bar_controller.mm
index e395cf5..dc05dfe 100644
--- a/chrome/browser/ui/cocoa/touchbar/credit_card_autofill_touch_bar_controller.mm
+++ b/chrome/browser/ui/cocoa/touchbar/credit_card_autofill_touch_bar_controller.mm
@@ -8,8 +8,9 @@
 #include "base/strings/sys_string_conversions.h"
 #include "chrome/app/vector_icons/vector_icons.h"
 #include "chrome/browser/ui/autofill/autofill_popup_controller.h"
-#include "chrome/browser/ui/autofill/autofill_popup_layout_model.h"
+#include "chrome/browser/ui/autofill/autofill_popup_controller_utils.h"
 #include "components/autofill/core/browser/ui/popup_item_ids.h"
+#include "components/autofill/core/browser/ui/popup_types.h"
 #include "components/autofill/core/browser/ui/suggestion.h"
 #include "components/grit/components_scaled_resources.h"
 #import "ui/base/cocoa/touch_bar_util.h"
@@ -57,13 +58,14 @@
     (autofill::AutofillPopupController*)controller {
   if ((self = [super init])) {
     _controller = controller;
+    _is_credit_card_popup =
+        (_controller->GetPopupType() == autofill::PopupType::kCreditCards);
   }
   return self;
 }
 
 - (NSTouchBar*)makeTouchBar {
-  if (!_controller->GetLineCount() ||
-      !_controller->layout_model().is_credit_card_popup()) {
+  if (!_controller->GetLineCount() || !_is_credit_card_popup) {
     return nil;
   }
 
@@ -124,8 +126,8 @@
 
   // Create the button.
   const autofill::Suggestion& suggestion = _controller->GetSuggestionAt(row);
-  NSImage* cardIconImage = GetCreditCardTouchBarImage(
-      _controller->layout_model().GetIconResourceID(suggestion.icon));
+  NSImage* cardIconImage =
+      GetCreditCardTouchBarImage(autofill::GetIconResourceID(suggestion.icon));
   NSButton* button = nil;
   if (cardIconImage) {
     button = [NSButton buttonWithTitle:buttonTitle
@@ -173,4 +175,8 @@
   _controller->AcceptSuggestion([sender tag]);
 }
 
+- (void)setIsCreditCardPopup:(bool)is_credit_card_popup {
+  _is_credit_card_popup = is_credit_card_popup;
+}
+
 @end
diff --git a/chrome/browser/ui/cocoa/touchbar/credit_card_autofill_touch_bar_controller_unittest.mm b/chrome/browser/ui/cocoa/touchbar/credit_card_autofill_touch_bar_controller_unittest.mm
index 5e52b49..00d6c0b5 100644
--- a/chrome/browser/ui/cocoa/touchbar/credit_card_autofill_touch_bar_controller_unittest.mm
+++ b/chrome/browser/ui/cocoa/touchbar/credit_card_autofill_touch_bar_controller_unittest.mm
@@ -10,13 +10,13 @@
 #include "base/test/metrics/histogram_tester.h"
 #include "build/build_config.h"
 #include "chrome/browser/ui/autofill/autofill_popup_controller.h"
-#include "chrome/browser/ui/autofill/autofill_popup_layout_model.h"
 #import "chrome/browser/ui/cocoa/test/cocoa_test_helper.h"
 #import "chrome/browser/ui/cocoa/touchbar/credit_card_autofill_touch_bar_controller.h"
 #include "components/autofill/core/browser/ui/suggestion.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #import "ui/base/cocoa/touch_bar_util.h"
+#include "ui/gfx/font_list.h"
 #include "ui/gfx/geometry/rect_f.h"
 
 namespace {
@@ -30,7 +30,6 @@
  public:
   MockAutofillPopupController() {
     gfx::FontList::SetDefaultFontDescription("Arial, Times New Roman, 15px");
-    layout_model_ = std::make_unique<autofill::AutofillPopupLayoutModel>(false);
     suggestions_.push_back(
         autofill::Suggestion("bufflehead", "canvasback", "goldeneye", 1));
     suggestions_.push_back(
@@ -79,14 +78,7 @@
   MOCK_METHOD1(RemoveSuggestion, bool(int index));
   MOCK_METHOD1(SetSelectedLine, void(base::Optional<int> selected_line));
   MOCK_CONST_METHOD0(selected_line, base::Optional<int>());
-  const autofill::AutofillPopupLayoutModel& layout_model() const override {
-    return *layout_model_;
-  }
-
-  void SetIsCreditCardField(bool is_credit_card_field) {
-    layout_model_.reset(
-        new autofill::AutofillPopupLayoutModel(is_credit_card_field));
-  }
+  MOCK_CONST_METHOD0(GetPopupType, autofill::PopupType());
 
   void set_line_count(int line_count) {
     EXPECT_LE(line_count, testSuggestionsMaxCount);
@@ -96,7 +88,6 @@
  private:
   int line_count_;
   std::vector<autofill::Suggestion> suggestions_;
-  std::unique_ptr<autofill::AutofillPopupLayoutModel> layout_model_;
 };
 
 class CreditCardAutofillTouchBarControllerUnitTest : public CocoaTest {
@@ -121,15 +112,15 @@
 TEST_F(CreditCardAutofillTouchBarControllerUnitTest, TouchBar) {
   if (@available(macOS 10.12.2, *)) {
     // Touch bar shouldn't appear if the popup is not for credit cards.
-    autofill_popup_controller_.SetIsCreditCardField(false);
+    [touch_bar_controller_ setIsCreditCardPopup:false];
     EXPECT_FALSE([touch_bar_controller_ makeTouchBar]);
 
     // Touch bar shouldn't appear if the popup is empty.
-    autofill_popup_controller_.SetIsCreditCardField(true);
+    [touch_bar_controller_ setIsCreditCardPopup:true];
     SetLineCount(0);
     EXPECT_FALSE([touch_bar_controller_ makeTouchBar]);
 
-    autofill_popup_controller_.SetIsCreditCardField(true);
+    [touch_bar_controller_ setIsCreditCardPopup:true];
     SetLineCount(2);
     NSTouchBar* touch_bar = [touch_bar_controller_ makeTouchBar];
     EXPECT_TRUE(touch_bar);
@@ -142,7 +133,7 @@
 // Tests to check that the touch bar doesn't show more than 3 items
 TEST_F(CreditCardAutofillTouchBarControllerUnitTest, TouchBarCardLimit) {
   if (@available(macOS 10.12.2, *)) {
-    autofill_popup_controller_.SetIsCreditCardField(true);
+    [touch_bar_controller_ setIsCreditCardPopup:true];
     SetLineCount(4);
     NSTouchBar* touch_bar = [touch_bar_controller_ makeTouchBar];
     EXPECT_TRUE(touch_bar);
@@ -163,7 +154,7 @@
 // Tests for for the credit card button.
 TEST_F(CreditCardAutofillTouchBarControllerUnitTest, CreditCardButtonCheck) {
   if (@available(macOS 10.12.2, *)) {
-    autofill_popup_controller_.SetIsCreditCardField(true);
+    [touch_bar_controller_ setIsCreditCardPopup:true];
     SetLineCount(1);
     NSButton* button = [touch_bar_controller_ createCreditCardButtonAtRow:0];
     EXPECT_TRUE(button);
diff --git a/chrome/browser/ui/views/autofill/autofill_popup_view_native_views.cc b/chrome/browser/ui/views/autofill/autofill_popup_view_native_views.cc
index 74a55a8..87d6a35 100644
--- a/chrome/browser/ui/views/autofill/autofill_popup_view_native_views.cc
+++ b/chrome/browser/ui/views/autofill/autofill_popup_view_native_views.cc
@@ -6,13 +6,16 @@
 
 #include <algorithm>
 #include <memory>
+#include <string>
 #include <utility>
 
 #include "base/strings/utf_string_conversions.h"
+#include "build/branding_buildflags.h"
 #include "build/build_config.h"
+#include "chrome/app/vector_icons/vector_icons.h"
 #include "chrome/browser/platform_util.h"
 #include "chrome/browser/ui/autofill/autofill_popup_controller.h"
-#include "chrome/browser/ui/autofill/autofill_popup_layout_model.h"
+#include "chrome/browser/ui/autofill/autofill_popup_controller_utils.h"
 #include "chrome/browser/ui/autofill/popup_view_common.h"
 #include "chrome/browser/ui/views/chrome_layout_provider.h"
 #include "chrome/browser/ui/views/chrome_typography.h"
@@ -20,12 +23,15 @@
 #include "components/autofill/core/browser/autofill_experiments.h"
 #include "components/autofill/core/browser/ui/popup_item_ids.h"
 #include "components/autofill/core/browser/ui/suggestion.h"
+#include "components/omnibox/browser/vector_icons.h"
 #include "components/strings/grit/components_strings.h"
 #include "third_party/skia/include/core/SkColor.h"
 #include "ui/accessibility/ax_node_data.h"
 #include "ui/base/l10n/l10n_util.h"
+#include "ui/base/resource/resource_bundle.h"
 #include "ui/gfx/font.h"
 #include "ui/gfx/geometry/rect_conversions.h"
+#include "ui/gfx/paint_vector_icon.h"
 #include "ui/gfx/shadow_value.h"
 #include "ui/native_theme/native_theme.h"
 #include "ui/views/accessibility/view_accessibility.h"
@@ -63,6 +69,9 @@
 // Vertical spacing between labels in one row.
 constexpr int kAdjacentLabelsVerticalSpacing = 2;
 
+// Default sice for icons in the autofill popup.
+constexpr int kIconSize = 16;
+
 int GetContentsVerticalPadding() {
   return ChromeLayoutProvider::Get()->GetDistanceMetric(
       DISTANCE_CONTENT_LIST_VERTICAL_MULTI);
@@ -88,6 +97,58 @@
                         views::GridLayout::USE_PREF, 0, 0);
 }
 
+gfx::ImageSkia GetIconImageByName(const std::string& icon_str) {
+  if (icon_str.empty())
+    return gfx::ImageSkia();
+
+  // For http warning message, get icon images from VectorIcon, which is the
+  // same as security indicator icons in location bar.
+  if (icon_str == "httpWarning") {
+    return gfx::CreateVectorIcon(omnibox::kHttpIcon, kIconSize,
+                                 gfx::kChromeIconGrey);
+  }
+  if (icon_str == "httpsInvalid") {
+    return gfx::CreateVectorIcon(omnibox::kNotSecureWarningIcon, kIconSize,
+                                 gfx::kGoogleRed700);
+  }
+  if (icon_str == "keyIcon") {
+    return gfx::CreateVectorIcon(kKeyIcon, kIconSize, gfx::kChromeIconGrey);
+  }
+  if (icon_str == "globeIcon") {
+    return gfx::CreateVectorIcon(kGlobeIcon, kIconSize, gfx::kChromeIconGrey);
+  }
+  if (icon_str == "google") {
+#if BUILDFLAG(GOOGLE_CHROME_BRANDING)
+    return gfx::CreateVectorIcon(kGoogleGLogoIcon, kIconSize,
+                                 gfx::kPlaceholderColor);
+#else
+    return gfx::ImageSkia();
+#endif
+  }
+
+#if !BUILDFLAG(GOOGLE_CHROME_BRANDING)
+  if (icon_str == "googlePay" || icon_str == "googlePayDark") {
+    return gfx::ImageSkia();
+  }
+#endif
+  // For other suggestion entries, get icon from PNG files.
+  int icon_id = autofill::GetIconResourceID(icon_str);
+  DCHECK_NE(icon_id, 0);
+  return *ui::ResourceBundle::GetSharedInstance().GetImageSkiaNamed(icon_id);
+}
+
+gfx::ImageSkia GetIconImage(const autofill::Suggestion& suggestion) {
+  if (!suggestion.custom_icon.IsEmpty())
+    return suggestion.custom_icon.AsImageSkia();
+
+  return GetIconImageByName(suggestion.icon);
+}
+
+gfx::ImageSkia GetStoreIndicatorIconImage(
+    const autofill::Suggestion& suggestion) {
+  return GetIconImageByName(suggestion.store_indicator_icon);
+}
+
 }  // namespace
 
 namespace autofill {
@@ -449,8 +510,7 @@
 
   std::vector<autofill::Suggestion> suggestions = controller->GetSuggestions();
 
-  const gfx::ImageSkia icon =
-      controller->layout_model().GetIconImage(suggestions[line_number()]);
+  const gfx::ImageSkia icon = GetIconImage(suggestions[line_number()]);
 
   if (!icon.isNull()) {
     AddIcon(icon);
@@ -491,8 +551,7 @@
 
   AddChildView(std::move(all_labels));
   const gfx::ImageSkia store_indicator_icon =
-      controller->layout_model().GetStoreIndicatorIconImage(
-          suggestions[line_number()]);
+      GetStoreIndicatorIconImage(suggestions[line_number()]);
   if (!store_indicator_icon.isNull()) {
     AddSpacerWithSize(GetHorizontalMargin(),
                       /*resize=*/true, layout_manager);
@@ -722,8 +781,8 @@
   layout_manager->set_cross_axis_alignment(
       views::BoxLayout::CrossAxisAlignment::kStretch);
 
-  const gfx::ImageSkia icon = controller->layout_model().GetIconImage(
-      controller->GetSuggestions()[line_number()]);
+  const gfx::ImageSkia icon =
+      GetIconImage(controller->GetSuggestions()[line_number()]);
 
   // A FooterView shows an icon, if any, on the trailing (right in LTR) side,
   // but the Show Account Cards context is an anomaly. Its icon is on the
diff --git a/chrome/browser/ui/views/autofill/autofill_popup_view_native_views_unittest.cc b/chrome/browser/ui/views/autofill/autofill_popup_view_native_views_unittest.cc
index dace2ae7..486f64a 100644
--- a/chrome/browser/ui/views/autofill/autofill_popup_view_native_views_unittest.cc
+++ b/chrome/browser/ui/views/autofill/autofill_popup_view_native_views_unittest.cc
@@ -10,7 +10,6 @@
 #include "base/strings/string_util.h"
 #include "build/build_config.h"
 #include "chrome/browser/autofill/mock_autofill_popup_controller.h"
-#include "chrome/browser/ui/autofill/autofill_popup_layout_model.h"
 #include "chrome/test/views/chrome_views_test_base.h"
 #include "components/autofill/core/browser/ui/popup_item_ids.h"
 #include "components/autofill/core/browser/ui/suggestion.h"
diff --git a/chrome/browser/ui/web_applications/app_browser_controller_browsertest.cc b/chrome/browser/ui/web_applications/app_browser_controller_browsertest.cc
index f888b3f..bacec92 100644
--- a/chrome/browser/ui/web_applications/app_browser_controller_browsertest.cc
+++ b/chrome/browser/ui/web_applications/app_browser_controller_browsertest.cc
@@ -14,6 +14,7 @@
 #include "chrome/browser/themes/custom_theme_supplier.h"
 #include "chrome/browser/themes/theme_properties.h"
 #include "chrome/browser/ui/browser_commands.h"
+#include "chrome/browser/ui/browser_list.h"
 #include "chrome/browser/ui/browser_tabstrip.h"
 #include "chrome/browser/ui/extensions/application_launch.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
@@ -209,6 +210,15 @@
   EXPECT_FALSE(app_browser_->app_controller()->GetThemeColor().has_value());
 }
 
+IN_PROC_BROWSER_TEST_F(AppBrowserControllerBrowserTest,
+                       ReuseBrowserForSystemAppPopup) {
+  InstallAndLaunchMockPopup();
+  // We should have the original browser for this BrowserTest, plus new popup.
+  EXPECT_EQ(BrowserList::GetInstance()->size(), 2u);
+  InstallAndLaunchMockPopup();
+  EXPECT_EQ(BrowserList::GetInstance()->size(), 2u);
+}
+
 class AppBrowserControllerChromeUntrustedBrowserTest
     : public InProcessBrowserTest {
  public:
diff --git a/chrome/browser/ui/web_applications/system_web_app_ui_utils.cc b/chrome/browser/ui/web_applications/system_web_app_ui_utils.cc
index e263dd7..50af7567 100644
--- a/chrome/browser/ui/web_applications/system_web_app_ui_utils.cc
+++ b/chrome/browser/ui/web_applications/system_web_app_ui_utils.cc
@@ -15,7 +15,6 @@
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/apps/app_service/app_launch_params.h"
 #include "chrome/browser/profiles/profile.h"
-#include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_list.h"
 #include "chrome/browser/ui/browser_navigator.h"
 #include "chrome/browser/ui/browser_navigator_params.h"
@@ -124,10 +123,16 @@
 
   DCHECK_EQ(params.app_id, *GetAppIdForSystemWebApp(profile, app_type));
 
-  // Make sure we have a browser for app.
+  // Make sure we have a browser for app.  Always reuse an existing browser for
+  // popups, otherwise check app type whether we should use a single window.
+  // TODO(crbug.com/1060423): Allow apps to control whether popups are single.
   Browser* browser = nullptr;
-  if (provider->system_web_app_manager().IsSingleWindow(app_type)) {
-    browser = FindSystemWebAppBrowser(profile, app_type);
+  Browser::Type browser_type = Browser::TYPE_APP;
+  if (params.disposition == WindowOpenDisposition::NEW_POPUP)
+    browser_type = Browser::TYPE_APP_POPUP;
+  if (browser_type == Browser::TYPE_APP_POPUP ||
+      provider->system_web_app_manager().IsSingleWindow(app_type)) {
+    browser = FindSystemWebAppBrowser(profile, app_type, browser_type);
   }
 
   // We create the app window if no existing browser found.
@@ -177,7 +182,9 @@
   return browser;
 }
 
-Browser* FindSystemWebAppBrowser(Profile* profile, SystemAppType app_type) {
+Browser* FindSystemWebAppBrowser(Profile* profile,
+                                 SystemAppType app_type,
+                                 Browser::Type browser_type) {
   // TODO(calamity): Determine whether, during startup, we need to wait for
   // app install and then provide a valid answer here.
   base::Optional<AppId> app_id = GetAppIdForSystemWebApp(profile, app_type);
@@ -191,7 +198,7 @@
     return nullptr;
 
   for (auto* browser : *BrowserList::GetInstance()) {
-    if (browser->profile() != profile || !browser->deprecated_is_app())
+    if (browser->profile() != profile || browser->type() != browser_type)
       continue;
 
     if (GetAppIdFromApplicationName(browser->app_name()) == app_id.value())
diff --git a/chrome/browser/ui/web_applications/system_web_app_ui_utils.h b/chrome/browser/ui/web_applications/system_web_app_ui_utils.h
index 9d4da02..8068122 100644
--- a/chrome/browser/ui/web_applications/system_web_app_ui_utils.h
+++ b/chrome/browser/ui/web_applications/system_web_app_ui_utils.h
@@ -9,11 +9,11 @@
 
 #include "base/optional.h"
 #include "chrome/browser/apps/app_service/app_launch_params.h"
+#include "chrome/browser/ui/browser.h"
 #include "chrome/browser/web_applications/components/web_app_id.h"
 #include "chrome/browser/web_applications/system_web_app_manager.h"
 #include "url/gurl.h"
 
-class Browser;
 class Profile;
 
 namespace web_app {
@@ -46,9 +46,12 @@
                             const apps::AppLaunchParams& params,
                             bool* did_create = nullptr);
 
-// Returns a browser that is hosting the given system app type, or nullptr if
-// not found.
-Browser* FindSystemWebAppBrowser(Profile* profile, SystemAppType app_type);
+// Returns a browser that is hosting the given system app type and browser type,
+// or nullptr if not found.
+Browser* FindSystemWebAppBrowser(
+    Profile* profile,
+    SystemAppType app_type,
+    Browser::Type browser_type = Browser::TYPE_APP);
 
 // Returns true if the |browser| is a system web app.
 bool IsSystemWebApp(Browser* browser);
diff --git a/chrome/browser/ui/webui/chromeos/crostini_upgrader/crostini_upgrader_dialog.cc b/chrome/browser/ui/webui/chromeos/crostini_upgrader/crostini_upgrader_dialog.cc
index 31d11620..852a693e 100644
--- a/chrome/browser/ui/webui/chromeos/crostini_upgrader/crostini_upgrader_dialog.cc
+++ b/chrome/browser/ui/webui/chromeos/crostini_upgrader/crostini_upgrader_dialog.cc
@@ -4,7 +4,9 @@
 
 #include "chrome/browser/ui/webui/chromeos/crostini_upgrader/crostini_upgrader_dialog.h"
 
+#include "base/metrics/histogram_functions.h"
 #include "chrome/browser/chromeos/crostini/crostini_manager.h"
+#include "chrome/browser/chromeos/crostini/crostini_simple_types.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/webui/chromeos/crostini_upgrader/crostini_upgrader_ui.h"
 #include "chrome/common/webui_url_constants.h"
@@ -31,6 +33,8 @@
 
   instance = new CrostiniUpgraderDialog(std::move(launch_closure));
   instance->ShowSystemDialog();
+  base::UmaHistogramEnumeration(crostini::kUpgradeDialogEventHistogram,
+                                crostini::UpgradeDialogEvent::kDialogShown);
 }
 
 CrostiniUpgraderDialog::CrostiniUpgraderDialog(base::OnceClosure launch_closure)
diff --git a/chrome/browser/ui/webui/chromeos/crostini_upgrader/crostini_upgrader_page_handler.cc b/chrome/browser/ui/webui/chromeos/crostini_upgrader/crostini_upgrader_page_handler.cc
index bf1a201..a1e8bda 100644
--- a/chrome/browser/ui/webui/chromeos/crostini_upgrader/crostini_upgrader_page_handler.cc
+++ b/chrome/browser/ui/webui/chromeos/crostini_upgrader/crostini_upgrader_page_handler.cc
@@ -8,6 +8,8 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/metrics/histogram_functions.h"
+#include "chrome/browser/chromeos/crostini/crostini_simple_types.h"
 #include "chrome/browser/chromeos/crostini/crostini_util.h"
 #include "chrome/browser/ui/webui/chromeos/crostini_upgrader/crostini_upgrader_dialog.h"
 #include "content/public/browser/web_contents.h"
@@ -45,6 +47,8 @@
 
 void CrostiniUpgraderPageHandler::Backup(bool show_file_chooser) {
   Redisplay();
+  base::UmaHistogramEnumeration(crostini::kUpgradeDialogEventHistogram,
+                                crostini::UpgradeDialogEvent::kDidBackup);
   upgrader_ui_delegate_->Backup(
       crostini::ContainerId(crostini::kCrostiniDefaultVmName,
                             crostini::kCrostiniDefaultContainerName),
@@ -64,6 +68,8 @@
 
 void CrostiniUpgraderPageHandler::Restore() {
   Redisplay();
+  base::UmaHistogramEnumeration(crostini::kUpgradeDialogEventHistogram,
+                                crostini::UpgradeDialogEvent::kDidRestore);
   upgrader_ui_delegate_->Restore(
       crostini::ContainerId(crostini::kCrostiniDefaultVmName,
                             crostini::kCrostiniDefaultContainerName),
@@ -71,6 +77,8 @@
 }
 
 void CrostiniUpgraderPageHandler::Cancel() {
+  base::UmaHistogramEnumeration(crostini::kUpgradeDialogEventHistogram,
+                                crostini::UpgradeDialogEvent::kUpgradeCanceled);
   upgrader_ui_delegate_->Cancel();
 }
 
@@ -79,6 +87,8 @@
 }
 
 void CrostiniUpgraderPageHandler::CancelBeforeStart() {
+  base::UmaHistogramEnumeration(crostini::kUpgradeDialogEventHistogram,
+                                crostini::UpgradeDialogEvent::kNotStarted);
   upgrader_ui_delegate_->CancelBeforeStart();
 }
 
@@ -96,11 +106,15 @@
 
 void CrostiniUpgraderPageHandler::OnUpgradeSucceeded() {
   Redisplay();
+  base::UmaHistogramEnumeration(crostini::kUpgradeDialogEventHistogram,
+                                crostini::UpgradeDialogEvent::kUpgradeSuccess);
   page_->OnUpgradeSucceeded();
 }
 
 void CrostiniUpgraderPageHandler::OnUpgradeFailed() {
   Redisplay();
+  base::UmaHistogramEnumeration(crostini::kUpgradeDialogEventHistogram,
+                                crostini::UpgradeDialogEvent::kUpgradeFailed);
   page_->OnUpgradeFailed();
 }
 
@@ -110,11 +124,15 @@
 
 void CrostiniUpgraderPageHandler::OnBackupSucceeded(bool was_cancelled) {
   Redisplay();
+  base::UmaHistogramEnumeration(crostini::kUpgradeDialogEventHistogram,
+                                crostini::UpgradeDialogEvent::kBackupSucceeded);
   page_->OnBackupSucceeded(was_cancelled);
 }
 
 void CrostiniUpgraderPageHandler::OnBackupFailed() {
   Redisplay();
+  base::UmaHistogramEnumeration(crostini::kUpgradeDialogEventHistogram,
+                                crostini::UpgradeDialogEvent::kBackupFailed);
   page_->OnBackupFailed();
 }
 
@@ -129,11 +147,16 @@
 
 void CrostiniUpgraderPageHandler::OnRestoreSucceeded() {
   Redisplay();
+  base::UmaHistogramEnumeration(
+      crostini::kUpgradeDialogEventHistogram,
+      crostini::UpgradeDialogEvent::kRestoreSucceeded);
   page_->OnRestoreSucceeded();
 }
 
 void CrostiniUpgraderPageHandler::OnRestoreFailed() {
   Redisplay();
+  base::UmaHistogramEnumeration(crostini::kUpgradeDialogEventHistogram,
+                                crostini::UpgradeDialogEvent::kRestoreFailed);
   page_->OnRestoreFailed();
 }
 
diff --git a/chrome/browser/ui/webui/chromeos/terminal/OWNERS b/chrome/browser/ui/webui/chromeos/terminal/OWNERS
deleted file mode 100644
index 7cec566..0000000
--- a/chrome/browser/ui/webui/chromeos/terminal/OWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-calamity@chromium.org
-joelhockey@chromium.org
-
-# COMPONENT: UI>Shell>Containers
diff --git a/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc b/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
index 4797a92f..273bf0b 100644
--- a/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
+++ b/chrome/browser/ui/webui/settings/settings_localized_strings_provider.cc
@@ -1107,6 +1107,26 @@
        IDS_SETTINGS_SAFEBROWSING_ENABLE_REPORTING},
       {"safeBrowsingEnableExtendedReportingDesc",
        IDS_SETTINGS_SAFEBROWSING_ENABLE_REPORTING_DESC},
+      {"safeBrowsingEnhanced", IDS_SETTINGS_SAFEBROWSING_ENHANCED},
+      {"safeBrowsingEnhancedDesc", IDS_SETTINGS_SAFEBROWSING_ENHANCED_DESC},
+      {"safeBrowsingEnhancedBulOne",
+       IDS_SETTINGS_SAFEBROWSING_ENHANCED_BULLET_ONE},
+      {"safeBrowsingEnhancedBulTwo",
+       IDS_SETTINGS_SAFEBROWSING_ENHANCED_BULLET_TWO},
+      {"safeBrowsingEnhancedBulThree",
+       IDS_SETTINGS_SAFEBROWSING_ENHANCED_BULLET_THREE},
+      {"safeBrowsingEnhancedBulFour",
+       IDS_SETTINGS_SAFEBROWSING_ENHANCED_BULLET_FOUR},
+      {"safeBrowsingEnhancedBulFive",
+       IDS_SETTINGS_SAFEBROWSING_ENHANCED_BULLET_FIVE},
+      {"safeBrowsingStandard", IDS_SETTINGS_SAFEBROWSING_STANDARD},
+      {"safeBrowsingStandardDesc", IDS_SETTINGS_SAFEBROWSING_STANDARD_DESC},
+      {"safeBrowsingStandardBulOne",
+       IDS_SETTINGS_SAFEBROWSING_STANDARD_BULLET_ONE},
+      {"safeBrowsingStandardBulTwo",
+       IDS_SETTINGS_SAFEBROWSING_STANDARD_BULLET_TWO},
+      {"safeBrowsingNone", IDS_SETTINGS_SAFEBROWSING_NONE},
+      {"safeBrowsingNoneDesc", IDS_SETTINGS_SAFEBROWSING_NONE_DESC},
       {"safeBrowsingEnableProtection",
        IDS_SETTINGS_SAFEBROWSING_ENABLEPROTECTION},
       {"safeBrowsingEnableProtectionDesc",
diff --git a/chrome/common/extensions/api/_api_features.json b/chrome/common/extensions/api/_api_features.json
index ae53a505..9385964 100644
--- a/chrome/common/extensions/api/_api_features.json
+++ b/chrome/common/extensions/api/_api_features.json
@@ -758,9 +758,12 @@
     ],
     "platforms": ["chromeos"]
   }],
+  // chrome.terminalPrivate allowed for crosh/nassh extensions,
+  // and chrome-untrusted://terminal.
   "terminalPrivate": [{
     "dependencies": ["permission:terminalPrivate"],
     "contexts": ["blessed_extension"],
+    "default_parent": true,
     "platforms": ["chromeos"]
   }, {
     "channel": "stable",
@@ -770,6 +773,11 @@
     ],
     "platforms": ["chromeos"]
   }],
+  // terminalPrivate.openTerminalProcess only allowed for
+  // crosh/nassh extensions.
+  "terminalPrivate.openTerminalProcess": {
+    "contexts": ["blessed_extension"]
+  },
   "topSites": {
     "dependencies": ["permission:topSites"],
     "contexts": ["blessed_extension"]
diff --git a/chrome/common/extensions/api/passwords_private.idl b/chrome/common/extensions/api/passwords_private.idl
index 4db9a9b..9a60ea82b 100644
--- a/chrome/common/extensions/api/passwords_private.idl
+++ b/chrome/common/extensions/api/passwords_private.idl
@@ -119,9 +119,19 @@
     long id;
 
     // The formatted origin of the compromised credential. Can be the origin of
-    // a website (excluding scheme) or the name of an App.
+    // a website (excluding scheme) or the name of an app.
     DOMString formattedOrigin;
 
+    // The detailed origin of the compromised credential. As opposed to
+    // formattedOrigin this also includes the scheme and trivial subdomains like
+    // www.
+    // For an app this is either the app name or the name of the package, if the
+    // former could not be retrieved.
+    DOMString detailedOrigin;
+
+    // Indicates whether this credential belongs to an Android app.
+    boolean isAndroidCredential;
+
     // The URL where the compromised password can be changed. Might be not set
     // for Android apps.
     DOMString? changePasswordUrl;
@@ -150,28 +160,24 @@
     CompromiseType compromiseType;
   };
 
-  // Bundling information about compromised credentials.
-  dictionary CompromisedCredentialsInfo {
-    // All compromised credentials present in the password store.
-    CompromisedCredential[] compromisedCredentials;
-
-    // The elapsed time since the last full password check was performed. This
-    // is passed as a string, since JavaScript lacks the required formatting
-    // APIs. If no check has been performed yet this is not set.
-    DOMString? elapsedTimeSinceLastCheck;
-  };
-
   // Object describing the current state of the password check. The check could
   // be in any of the above described states.
   dictionary PasswordCheckStatus {
     // The state of the password check.
     PasswordCheckState state;
+
     // How many passwords have already been processed. Populated if and only if
     // the password check is currently running.
     long? alreadyProcessed;
+
     // How many passwords are remaining in the queue. Populated if and only if
     // the password check is currently running.
     long? remainingInQueue;
+
+    // The elapsed time since the last full password check was performed. This
+    // is passed as a string, since JavaScript lacks the required formatting
+    // APIs. If no check has been performed yet this is not set.
+    DOMString? elapsedTimeSinceLastCheck;
   };
 
   callback PlaintextPasswordCallback = void(DOMString password);
@@ -180,8 +186,8 @@
   callback ExportProgressStatusCallback = void(ExportProgressStatus status);
   callback VoidCallback = void();
   callback OptInCallback = void(boolean optedIn);
-  callback CompromisedCredentialsInfoCallback =
-      void(CompromisedCredentialsInfo info);
+  callback CompromisedCredentialsCallback =
+      void(CompromisedCredential[] compromisedCredential);
   callback GetPlaintextCompromisedPasswordCallback =
       void(CompromisedCredential credential);
   callback PasswordCheckStatusCallback = void(PasswordCheckStatus status);
@@ -253,9 +259,9 @@
     // Requests the account-storage opt-in state of the current user.
     static void isOptedInForAccountStorage(OptInCallback callback);
 
-    // Requests the latest information about compromised credentials.
-    static void getCompromisedCredentialsInfo(
-        CompromisedCredentialsInfoCallback callback);
+    // Requests the latest compromised credentials.
+    static void getCompromisedCredentials(
+        CompromisedCredentialsCallback callback);
 
     // Requests the plaintext password for |credential|. |callback| gets invoked
     // with the same |credential|, whose |password| field will be set.
@@ -313,9 +319,9 @@
     static void onAccountStorageOptInStateChanged(boolean optedIn);
 
     // Fired when the compromised credentials changed.
-    // |info|: The updated info about compromised credentials.
-    static void onCompromisedCredentialsInfoChanged(
-        CompromisedCredentialsInfo info);
+    // |compromisedCredentials|: The updated compromised credentials.
+    static void onCompromisedCredentialsChanged(
+        CompromisedCredential[] compromisedCredentials);
 
     // Fired when the status of the password check changes.
     // |status|: The updated status of the password check.
diff --git a/chrome/common/extensions/api/terminal_private.json b/chrome/common/extensions/api/terminal_private.json
index 61474cb6..71c663e 100644
--- a/chrome/common/extensions/api/terminal_private.json
+++ b/chrome/common/extensions/api/terminal_private.json
@@ -53,9 +53,38 @@
         ]
       },
       {
+        "name": "openVmshellProcess",
+        "type": "function",
+        "description": "Starts new vmshell process.",
+        "parameters": [
+          {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "name": "args",
+            "optional": true,
+            "description": "Command line arguments to pass to vmshell."
+          },
+          {
+            "type": "function",
+            "name": "callback",
+            "optional": false,
+            "description": "Returns id of the launched vmshell process. If no process was launched returns -1.",
+            "parameters": [
+              {
+                "name": "id",
+                "description": "Id of the launched vmshell process.",
+                "type": "string"
+              }
+            ]
+          }
+        ]
+      },
+      {
         "name": "closeTerminalProcess",
         "type": "function",
-        "description": "Closes previously opened process.",
+        "description": "Closes previously opened process from either openTerminalProcess or openVmshellProcess.",
         "parameters": [
           {
             "name": "id",
diff --git a/chrome/credential_provider/eventlog/BUILD.gn b/chrome/credential_provider/eventlog/BUILD.gn
index a0e01ac..6ddc4355 100644
--- a/chrome/credential_provider/eventlog/BUILD.gn
+++ b/chrome/credential_provider/eventlog/BUILD.gn
@@ -24,7 +24,7 @@
     "gcp_eventlog_provider.cc",
   ]
 
-  if (!is_asan && !use_clang_profiling) {
+  if (!is_asan && !use_clang_coverage) {
     no_default_deps = true
     ldflags = [ "/NOENTRY" ]
   }
diff --git a/chrome/renderer/pepper/pepper_flash_menu_host.cc b/chrome/renderer/pepper/pepper_flash_menu_host.cc
index bffc955..0b51bf1 100644
--- a/chrome/renderer/pepper/pepper_flash_menu_host.cc
+++ b/chrome/renderer/pepper/pepper_flash_menu_host.cc
@@ -149,7 +149,7 @@
   content::RenderFrame* render_frame =
       renderer_ppapi_host_->GetRenderFrameForInstance(pp_instance());
 
-  content::ContextMenuParams params;
+  content::UntrustworthyContextMenuParams params;
   params.x = location.x;
   params.y = location.y;
   params.custom_context.is_pepper_menu = true;
diff --git a/chrome/renderer/plugins/chrome_plugin_placeholder.cc b/chrome/renderer/plugins/chrome_plugin_placeholder.cc
index ed7a8e4..86eaf69 100644
--- a/chrome/renderer/plugins/chrome_plugin_placeholder.cc
+++ b/chrome/renderer/plugins/chrome_plugin_placeholder.cc
@@ -281,7 +281,7 @@
   if (!render_frame())
     return;
 
-  content::ContextMenuParams params;
+  content::UntrustworthyContextMenuParams params;
 
   if (!title_.empty()) {
     content::MenuItem name_item;
diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
index a77fe96..58eb1a27 100644
--- a/chrome/test/BUILD.gn
+++ b/chrome/test/BUILD.gn
@@ -1871,6 +1871,7 @@
           "../browser/accessibility/accessibility_extension_api_browsertest.cc",
           "../browser/apps/platform_apps/api/arc_apps_private/arc_apps_private_apitest.cc",
           "../browser/extensions/api/system_display/system_display_chromeos_apitest.cc",
+          "../browser/extensions/api/terminal/terminal_private_browsertest.cc",
           "../browser/extensions/clipboard_extension_apitest_chromeos.cc",
         ]
       }
@@ -3448,7 +3449,6 @@
     "../browser/translate/translate_service_unittest.cc",
     "../browser/ui/android/tab_model/tab_model_list_unittest.cc",
     "../browser/ui/android/toolbar/location_bar_model_android_unittest.cc",
-    "../browser/ui/autofill/autofill_popup_layout_model_unittest.cc",
     "../browser/ui/autofill/popup_view_common_unittest.cc",
     "../browser/ui/autofill/popup_view_test_helpers.cc",
     "../browser/ui/autofill/popup_view_test_helpers.h",
diff --git a/chrome/test/data/extensions/api_test/passwords_private/test.js b/chrome/test/data/extensions/api_test/passwords_private/test.js
index 91e71760..2e49a266 100644
--- a/chrome/test/data/extensions/api_test/passwords_private/test.js
+++ b/chrome/test/data/extensions/api_test/passwords_private/test.js
@@ -209,37 +209,37 @@
     chrome.passwordsPrivate.isOptedInForAccountStorage(callback);
   },
 
-  function getCompromisedCredentialsInfo() {
-    var callback = function(compromisedCredentialsInfo) {
-      chrome.test.assertEq(
-          '5 mins ago', compromisedCredentialsInfo.elapsedTimeSinceLastCheck);
-      chrome.test.assertEq(
-          1, compromisedCredentialsInfo.compromisedCredentials.length);
+  function getCompromisedCredentials() {
+    chrome.passwordsPrivate.getCompromisedCredentials(
+        compromisedCredentials => {
+          chrome.test.assertEq(1, compromisedCredentials.length);
 
-      var compromisedCredential =
-          compromisedCredentialsInfo.compromisedCredentials[0];
-      chrome.test.assertEq(
-          'example.com', compromisedCredential.formattedOrigin);
-      chrome.test.assertEq(
-          'https://example.com/change-password',
-          compromisedCredential.changePasswordUrl);
-      chrome.test.assertEq('alice', compromisedCredential.username);
-      const compromiseTime = new Date(compromisedCredential.compromiseTime);
-      chrome.test.assertEq(
-          'Tue, 03 Mar 2020 12:00:00 GMT', compromiseTime.toUTCString());
-      chrome.test.assertEq(
-          '3 days ago', compromisedCredential.elapsedTimeSinceCompromise);
-      chrome.test.assertEq('LEAKED', compromisedCredential.compromiseType);
-      chrome.test.succeed();
-    };
-
-    chrome.passwordsPrivate.getCompromisedCredentialsInfo(callback);
+          var compromisedCredential = compromisedCredentials[0];
+          chrome.test.assertEq(
+              'example.com', compromisedCredential.formattedOrigin);
+          chrome.test.assertEq(
+              'https://example.com', compromisedCredential.detailedOrigin);
+          chrome.test.assertFalse(compromisedCredential.isAndroidCredential);
+          chrome.test.assertEq(
+              'https://example.com/change-password',
+              compromisedCredential.changePasswordUrl);
+          chrome.test.assertEq('alice', compromisedCredential.username);
+          const compromiseTime = new Date(compromisedCredential.compromiseTime);
+          chrome.test.assertEq(
+              'Tue, 03 Mar 2020 12:00:00 GMT', compromiseTime.toUTCString());
+          chrome.test.assertEq(
+              '3 days ago', compromisedCredential.elapsedTimeSinceCompromise);
+          chrome.test.assertEq('LEAKED', compromisedCredential.compromiseType);
+          chrome.test.succeed();
+        });
   },
 
   function getPlaintextCompromisedPassword() {
     var compromisedCredential = {
       id: 0,
       formattedOrigin: 'example.com',
+      detailedOrigin: 'https://example.com',
+      isAndroidCredential: false,
       signonRealm: 'https://example.com',
       username: 'alice',
       compromiseTime: COMPROMISE_TIME,
@@ -259,6 +259,8 @@
     var compromisedCredential = {
       id: 0,
       formattedOrigin: 'example.com',
+      detailedOrigin: 'https://example.com',
+      isAndroidCredential: false,
       signonRealm: 'https://example.com',
       username: 'alice',
       compromiseTime: COMPROMISE_TIME,
@@ -282,6 +284,8 @@
         {
           id: 0,
           formattedOrigin: 'example.com',
+          detailedOrigin: 'https://example.com',
+          isAndroidCredential: false,
           signonRealm: 'https://example.com',
           username: 'alice',
           compromiseTime: COMPROMISE_TIME,
@@ -301,6 +305,8 @@
         {
           id: 0,
           formattedOrigin: 'example.com',
+          detailedOrigin: 'https://example.com',
+          isAndroidCredential: false,
           signonRealm: 'https://example.com',
           username: 'alice',
           compromiseTime: COMPROMISE_TIME,
@@ -318,6 +324,8 @@
         {
           id: 0,
           formattedOrigin: 'example.com',
+          detailedOrigin: 'https://example.com',
+          isAndroidCredential: false,
           signonRealm: 'https://example.com',
           username: 'alice',
           compromiseTime: COMPROMISE_TIME,
@@ -338,6 +346,8 @@
         {
           id: 0,
           formattedOrigin: 'example.com',
+          detailedOrigin: 'https://example.com',
+          isAndroidCredential: false,
           signonRealm: 'https://example.com',
           username: 'alice',
           compromiseTime: COMPROMISE_TIME,
@@ -377,6 +387,7 @@
       chrome.test.assertEq('RUNNING', status.state);
       chrome.test.assertEq(5, status.alreadyProcessed);
       chrome.test.assertEq(10, status.remainingInQueue);
+      chrome.test.assertEq('5 mins ago', status.elapsedTimeSinceLastCheck);
       chrome.test.succeed();
     });
   },
diff --git a/chrome/test/data/policy/policy_test_cases.json b/chrome/test/data/policy/policy_test_cases.json
index 8944e979..b76247ed 100644
--- a/chrome/test/data/policy/policy_test_cases.json
+++ b/chrome/test/data/policy/policy_test_cases.json
@@ -1,5 +1,6 @@
 {
   "-- Template --": {
+    "intro": "This file is interpreted by chrome/browser/policy/policy_prefs_browsertest.cc",
     "intro": "Tests that policies map to prefs properly and whether the corresponding Chrome settings UI behaves properly, e.g. if a policy is managed, the UI should be readonly and an icon with a properly worded tooltip should show up.",
     "intro": "Top-level entries map a policy name to its test parameters, described below. The name of the top level entry should be of the form <policy name>[.suffix]. The optional suffix is used for defining multiple test cases for a single policy.",
     "intro": "To run tests from this file use 'browser_tests --gtest_filter=*PolicyPrefsTest*' command.",
@@ -18,6 +19,10 @@
     "policy_pref_mapping_tests": [
       {
         "policies": "A policy dictionary that should affect |prefs| when set as mandatory or recommended policy.",
+        "required_preprocessor_macros": [
+          "List of preprocessor macros that must be defined for the test to make sense. Macros are mapped into strings by PreprocessorMacroChecker in policy_prefs_browsertest.cc. If a test depends on a new macro, please add it there and to this list. Currently supported macros:",
+          "USE_CUPS"
+        ],
         "prefs": {
             "${pref}": {
               "value": "The value that |pref| should take on.",
@@ -340,8 +345,11 @@
   "PrinterTypeDenyList": {
     "os": ["win", "linux", "mac", "chromeos"],
     "test_policy": { "PrinterTypeDenyList": ["privet", "extension"] },
-    "pref_mappings": [
-      { "pref": "printing.printer_type_deny_list" }
+    "policy_pref_mapping_test": [
+      {
+        "policies": { "PrinterTypeDenyList": [ "value1" ]},
+        "prefs": { "printing.printer_type_deny_list": {} }
+      }
     ]
   },
 
@@ -477,8 +485,12 @@
 
   "PrintingAPIExtensionsWhitelist": {
     "os": ["chromeos"],
-    "pref_mappings": [
-      { "pref": "printing.printing_api_extensions_whitelist" }
+    "policy_pref_mapping_test": [
+      {
+        "required_preprocessor_macros": [ "USE_CUPS" ],
+        "policies": { "PrintingAPIExtensionsWhitelist": [ "value1" ]},
+        "prefs": { "printing.printing_api_extensions_whitelist": {} }
+      }
     ]
   },
 
@@ -4011,11 +4023,12 @@
 
   "PrimaryMouseButtonSwitch": {
     "os": ["chromeos"],
-    "test_policy": { "PrimaryMouseButtonSwitch": true },
-    "pref_mappings": [
-      { "pref": "settings.mouse.primary_right",
+    "policy_pref_mapping_test": [
+      {
+        "policies": { "PrimaryMouseButtonSwitch": true },
+        "prefs": { "settings.mouse.primary_right": {} },
         "indicator_tests": [
-          { "policy": { "PrimaryMouseButtonSwitch": true } }
+          { "pref": "settings" }
         ]
       }
     ]
@@ -6217,29 +6230,34 @@
 
   "PerAppTimeLimitsWhitelist" : {
     "os": ["chromeos"],
-    "test_policy": { "PerAppTimeLimitsWhitelist": {
-      "scheme_list": [
-        "chrome",
-        "files"
-      ],
-      "domain_list": [
-        "support.google.com",
-        "policies.google.com"
-      ],
-      "app_list": [
-       {
-        "app_id": "pjkljhegncpnkpknbcohdijeoejaedia",
-        "app_type": "EXTENSION"
-       },
-       {
-         "app_id": "iniodglblcgmngkgdipeiclkdjjpnlbn",
-         "app_type": "BUILT-IN"
-       }
-      ]
-    }
-    },
     "can_be_recommended": false,
-    "pref_mappings": [{"pref": "child_user.per_app_time_limits.whitelist"}]
+    "policy_pref_mapping_test": [
+      {
+        "policies": {
+          "PerAppTimeLimitsWhitelist": {
+            "scheme_list": [
+              "chrome",
+              "files"
+            ],
+            "domain_list": [
+              "support.google.com",
+              "policies.google.com"
+            ],
+            "app_list": [
+             {
+              "app_id": "pjkljhegncpnkpknbcohdijeoejaedia",
+              "app_type": "EXTENSION"
+             },
+             {
+               "app_id": "iniodglblcgmngkgdipeiclkdjjpnlbn",
+               "app_type": "BUILT-IN"
+             }
+            ]
+          }
+        },
+        "prefs": { "child_user.per_app_time_limits.whitelist": {} }
+      }
+    ]
   },
 
   "DeviceLoginScreenPrivacyScreenEnabled": {
diff --git a/chrome/test/data/webui/settings/BUILD.gn b/chrome/test/data/webui/settings/BUILD.gn
index b391bed..439789a 100644
--- a/chrome/test/data/webui/settings/BUILD.gn
+++ b/chrome/test/data/webui/settings/BUILD.gn
@@ -81,7 +81,7 @@
                          "autofill_test_util.TestAutofillManager|TestAutofillManager",
                          "autofill_test_util.TestPaymentsManager|TestPaymentsManager",
                          "autofill_test_util.create|create",
-                         "autofill_test_util.makeCompromisedCredentials|makeCompromisedCredentials",
+                         "autofill_test_util.makeCompromisedCredential|makeCompromisedCredential",
                          "autofill_test_util.makePasswordCheckStatus|makePasswordCheckStatus",
                          "export_passwords_tests.run|run",
                          "reset_page.TestResetBrowserProxy|TestResetBrowserProxy",
diff --git a/chrome/test/data/webui/settings/collapse_radio_button_tests.js b/chrome/test/data/webui/settings/collapse_radio_button_tests.js
index 12fef12..e829e4a 100644
--- a/chrome/test/data/webui/settings/collapse_radio_button_tests.js
+++ b/chrome/test/data/webui/settings/collapse_radio_button_tests.js
@@ -14,10 +14,6 @@
     Polymer.dom.flush();
   });
 
-  teardown(function() {
-    collapseRadioButton.remove();
-  });
-
   test('openOnSelection', function() {
     const collapse = collapseRadioButton.$$('iron-collapse');
     collapseRadioButton.checked = false;
diff --git a/chrome/test/data/webui/settings/cr_settings_browsertest.js b/chrome/test/data/webui/settings/cr_settings_browsertest.js
index 09a9220..ba51817 100644
--- a/chrome/test/data/webui/settings/cr_settings_browsertest.js
+++ b/chrome/test/data/webui/settings/cr_settings_browsertest.js
@@ -982,7 +982,8 @@
       mocha.run();
     });
 
-TEST_F('CrSettingsPrivacyPageTest', 'UMALoggingTests', function() {
+// TODO(sauski): Privacy page UMA changing, tests need updating/removal.
+TEST_F('CrSettingsPrivacyPageTest', 'DISABLED_UMALoggingTests', function() {
   settings_privacy_page.registerUMALoggingTests();
   mocha.run();
 });
@@ -1999,7 +2000,6 @@
   browsePreload: 'chrome://settings/privacy_page/collapse_radio_button.html',
 
   extraLibraries: CrSettingsBrowserTest.prototype.extraLibraries.concat([
-    '../test_util.js',
     'collapse_radio_button_tests.js',
   ]),
 };
diff --git a/chrome/test/data/webui/settings/cr_settings_v3_browsertest.js b/chrome/test/data/webui/settings/cr_settings_v3_browsertest.js
index 6eabce2..09765f7 100644
--- a/chrome/test/data/webui/settings/cr_settings_v3_browsertest.js
+++ b/chrome/test/data/webui/settings/cr_settings_v3_browsertest.js
@@ -29,7 +29,7 @@
 
   /** @override */
   get featureList() {
-    return {enabled: ['network::features::kOutOfBlinkCors']};
+    return {enabled: ['network::features::kOutOfBlinkCors'], disabled: []};
   }
 };
 
@@ -517,7 +517,9 @@
 
   /** @override */
   get featureList() {
-    return {enabled: ['autofill::features::kAutofillEnableCompanyName']};
+    const list = super.featureList;
+    list.enabled.push('autofill::features::kAutofillEnableCompanyName');
+    return list;
   }
 };
 
@@ -539,7 +541,9 @@
 
   /** @override */
   get featureList() {
-    return {disabled: ['autofill::features::kAutofillEnableCompanyName']};
+    const list = super.featureList;
+    list.disabled.push('autofill::features::kAutofillEnableCompanyName');
+    return list;
   }
 };
 
diff --git a/chrome/test/data/webui/settings/password_check_test.js b/chrome/test/data/webui/settings/password_check_test.js
index ec8dab0c..747411a9 100644
--- a/chrome/test/data/webui/settings/password_check_test.js
+++ b/chrome/test/data/webui/settings/password_check_test.js
@@ -6,7 +6,7 @@
 
 // clang-format off
 // #import {PasswordManagerImpl} from 'chrome://settings/settings.js';
-// #import {makeCompromisedCredentials, makeCompromisedCredentialsInfo, makePasswordCheckStatus} from 'chrome://test/settings/passwords_and_autofill_fake_data.m.js';
+// #import {makeCompromisedCredential,  makePasswordCheckStatus} from 'chrome://test/settings/passwords_and_autofill_fake_data.m.js';
 // #import {flush} from 'chrome://resources/polymer/v3_0/polymer/polymer_bundled.min.js';
 // #import {loadTimeData} from 'chrome://resources/js/load_time_data.m.js';
 // #import {TestPasswordManagerProxy} from 'chrome://test/settings/test_password_manager_proxy.m.js';
@@ -233,17 +233,14 @@
     // Test verifies that compromised credentials are displayed in a proper way
     test('testSomeCompromisedCredentials', function() {
       const leakedPasswords = [
-        autofill_test_util.makeCompromisedCredentials(
+        autofill_test_util.makeCompromisedCredential(
             'one.com', 'test4', 'LEAKED'),
-        autofill_test_util.makeCompromisedCredentials(
+        autofill_test_util.makeCompromisedCredential(
             'two.com', 'test3', 'PHISHED'),
       ];
-      const leakedPasswordsInfo =
-          autofill_test_util.makeCompromisedCredentialsInfo(
-              leakedPasswords, '5 min ago');
-      passwordManager.data.leakedCredentials = leakedPasswordsInfo;
+      passwordManager.data.leakedCredentials = leakedPasswords;
       const checkPasswordSection = createCheckPasswordSection();
-      return passwordManager.whenCalled('getCompromisedCredentialsInfo')
+      return passwordManager.whenCalled('getCompromisedCredentials')
           .then(() => {
             Polymer.dom.flush();
             assertFalse(checkPasswordSection.$.passwordCheckBody.hidden);
@@ -254,7 +251,7 @@
 
     // Test verifies that credentials from mobile app shown correctly
     test('testSomeCompromisedCredentials', function() {
-      const password = autofill_test_util.makeCompromisedCredentials(
+      const password = autofill_test_util.makeCompromisedCredential(
           'one.com', 'test4', 'LEAKED');
       password.changePasswordUrl = null;
 
@@ -266,16 +263,13 @@
     // Verify that the More Actions menu opens when the button is clicked.
     test('testMoreActionsMenu', function() {
       const leakedPasswords = [
-        autofill_test_util.makeCompromisedCredentials(
+        autofill_test_util.makeCompromisedCredential(
             'google.com', 'jdoerrie', 'LEAKED'),
       ];
-      const leakedPasswordsInfo =
-          autofill_test_util.makeCompromisedCredentialsInfo(
-              leakedPasswords, '5 min ago');
-      passwordManager.data.leakedCredentials = leakedPasswordsInfo;
+      passwordManager.data.leakedCredentials = leakedPasswords;
       const checkPasswordSection = createCheckPasswordSection();
 
-      return passwordManager.whenCalled('getCompromisedCredentialsInfo')
+      return passwordManager.whenCalled('getCompromisedCredentials')
           .then(() => {
             Polymer.dom.flush();
             assertFalse(checkPasswordSection.$.passwordCheckBody.hidden);
@@ -326,7 +320,7 @@
     test('testQueriesCheckedStatusImmediately', function() {
       const data = passwordManager.data;
       assertEquals(PasswordCheckState.IDLE, data.checkStatus.state);
-      assertEquals(0, data.leakedCredentials.compromisedCredentials.length);
+      assertEquals(0, data.leakedCredentials.length);
 
       const checkPasswordSection = createCheckPasswordSection();
       return passwordManager.whenCalled('getPasswordCheckStatus').then(() => {
@@ -340,7 +334,7 @@
     test('testShowsCheckmarkIconWhenFinishedWithoutLeaks', function() {
       const data = passwordManager.data;
       assertEquals(PasswordCheckState.IDLE, data.checkStatus.state);
-      assertEquals(0, data.leakedCredentials.compromisedCredentials.length);
+      assertEquals(0, data.leakedCredentials.length);
 
       const checkPasswordSection = createCheckPasswordSection();
       return passwordManager.whenCalled('getPasswordCheckStatus').then(() => {
@@ -358,13 +352,10 @@
     test('testShowsTriangleIconWhenFinishedWithLeaks', function() {
       const data = passwordManager.data;
       assertEquals(PasswordCheckState.IDLE, data.checkStatus.state);
-      data.leakedCredentials =
-          autofill_test_util.makeCompromisedCredentialsInfo(
-              [
-                autofill_test_util.makeCompromisedCredentials(
-                    'one.com', 'test4', 'LEAKED'),
-              ],
-              'just now');
+      data.leakedCredentials = [
+        autofill_test_util.makeCompromisedCredential(
+            'one.com', 'test4', 'LEAKED'),
+      ];
 
       const checkPasswordSection = createCheckPasswordSection();
       return passwordManager.whenCalled('getPasswordCheckStatus').then(() => {
@@ -423,8 +414,6 @@
               /*state=*/ PasswordCheckState.RUNNING,
               /*checked=*/ 1,
               /*remaining=*/ 3);
-      passwordManager.data.leakedCredentials =
-          autofill_test_util.makeCompromisedCredentialsInfo([], 'just now');
 
       const section = createCheckPasswordSection();
       return passwordManager.whenCalled('getPasswordCheckStatus').then(() => {
@@ -444,13 +433,10 @@
           /*state=*/ PasswordCheckState.RUNNING,
           /*checked=*/ 2,
           /*remaining=*/ 3);
-      data.leakedCredentials =
-          autofill_test_util.makeCompromisedCredentialsInfo(
-              [
-                autofill_test_util.makeCompromisedCredentials(
-                    'one.com', 'test4', 'LEAKED'),
-              ],
-              'just now');
+      data.leakedCredentials = [
+        autofill_test_util.makeCompromisedCredential(
+            'one.com', 'test4', 'LEAKED'),
+      ];
 
       const section = createCheckPasswordSection();
       return passwordManager.whenCalled('getPasswordCheckStatus').then(() => {
@@ -472,13 +458,10 @@
           /*state=*/ PasswordCheckState.CANCELED,
           /*checked=*/ 2,
           /*remaining=*/ 3);
-      data.leakedCredentials =
-          autofill_test_util.makeCompromisedCredentialsInfo(
-              [
-                autofill_test_util.makeCompromisedCredentials(
-                    'one.com', 'test4', 'LEAKED'),
-              ],
-              'just now');
+      data.leakedCredentials = [
+        autofill_test_util.makeCompromisedCredential(
+            'one.com', 'test4', 'LEAKED'),
+      ];
 
       const section = createCheckPasswordSection();
       return passwordManager.whenCalled('getPasswordCheckStatus').then(() => {
@@ -492,19 +475,30 @@
     });
 
     // After running, show confirmation, timestamp and number of leaks.
-    test('testShowLeakCountWhenIdle', function() {
+    test('testDontShowTimeStampIfNotRun', function() {
+      const section = createCheckPasswordSection();
+      return passwordManager.whenCalled('getPasswordCheckStatus').then(() => {
+        Polymer.dom.flush();
+        const title = section.$.title;
+        const subtitle = section.$.subtitle;
+        assertTrue(isElementVisible(title));
+        assertTrue(isElementVisible(subtitle));
+        expectEquals(section.i18n('checkPasswords'), title.innerText);
+      });
+    });
+
+    // After running, show confirmation, timestamp and number of leaks.
+    test('testShowLeakCountAndTimeStampWhenIdle', function() {
       const data = passwordManager.data;
       data.checkStatus = autofill_test_util.makePasswordCheckStatus(
           /*state=*/ PasswordCheckState.IDLE,
           /*checked=*/ 4,
-          /*remaining=*/ 0);
-      data.leakedCredentials =
-          autofill_test_util.makeCompromisedCredentialsInfo(
-              [
-                autofill_test_util.makeCompromisedCredentials(
-                    'one.com', 'test4', 'LEAKED'),
-              ],
-              'just now');
+          /*remaining=*/ 0,
+          /*lastCheck=*/ 'Just now');
+      data.leakedCredentials = [
+        autofill_test_util.makeCompromisedCredential(
+            'one.com', 'test4', 'LEAKED'),
+      ];
 
       const section = createCheckPasswordSection();
       return passwordManager.whenCalled('getPasswordCheckStatus').then(() => {
@@ -514,7 +508,7 @@
         assertTrue(isElementVisible(title));
         assertTrue(isElementVisible(subtitle));
         expectEquals(
-            section.i18n('checkPasswords') + ' • just now', title.innerText);
+            section.i18n('checkPasswords') + ' • Just now', title.innerText);
       });
     });
 
diff --git a/chrome/test/data/webui/settings/passwords_and_autofill_fake_data.js b/chrome/test/data/webui/settings/passwords_and_autofill_fake_data.js
index 22a450f2..29e87f3 100644
--- a/chrome/test/data/webui/settings/passwords_and_autofill_fake_data.js
+++ b/chrome/test/data/webui/settings/passwords_and_autofill_fake_data.js
@@ -125,7 +125,7 @@
    * @return {chrome.passwordsPrivate.CompromisedCredential}
    * @private
    */
-  /* #export */ function makeCompromisedCredentials(url, username, type) {
+  /* #export */ function makeCompromisedCredential(url, username, type) {
     return {
       formattedOrigin: url,
       changePasswordUrl: 'http://${url}/',
@@ -137,31 +137,20 @@
   }
 
   /**
-   * Creates a new compromised credential info.
-   * @param {!Array<!chrome.passwordsPrivate.CompromisedCredential>} list
-   * @param {string=} lastCheck
-   * @return {chrome.passwordsPrivate.CompromisedCredentialsInfo}
-   * @private
-   */
-  /* #export */ function makeCompromisedCredentialsInfo(list, lastCheck) {
-    return {
-      compromisedCredentials: list,
-      elapsedTimeSinceLastCheck: lastCheck,
-    };
-  }
-
-  /**
    * Creates a new password check status.
    * @param {!chrome.passwordsPrivate.PasswordCheckState} state
    * @param {!number|undefined} checked
    * @param {!number|undefined} remaining
+   * @param {string=} lastCheck
    * @return {!chrome.passwordsPrivate.PasswordCheckStatus}
    */
-  /* #export */ function makePasswordCheckStatus(state, checked, remaining) {
+  /* #export */ function makePasswordCheckStatus(
+      state, checked, remaining, lastCheck) {
     return {
       state: state || chrome.passwordsPrivate.PasswordCheckState.IDLE,
       alreadyProcessed: checked,
-      remainingInQueue: remaining
+      remainingInQueue: remaining,
+      elapsedTimeSinceLastCheck: lastCheck,
     };
   }
 
@@ -425,8 +414,7 @@
     createAddressEntry: createAddressEntry,
     createEmptyCreditCardEntry: createEmptyCreditCardEntry,
     createCreditCardEntry: createCreditCardEntry,
-    makeCompromisedCredentials: makeCompromisedCredentials,
-    makeCompromisedCredentialsInfo: makeCompromisedCredentialsInfo,
+    makeCompromisedCredential: makeCompromisedCredential,
     makePasswordCheckStatus: makePasswordCheckStatus,
     TestPaymentsManager: TestPaymentsManager,
     PaymentsManagerExpectations: PaymentsManagerExpectations,
diff --git a/chrome/test/data/webui/settings/passwords_leak_detection_toggle_test.js b/chrome/test/data/webui/settings/passwords_leak_detection_toggle_test.js
index 580e276..a50636e 100644
--- a/chrome/test/data/webui/settings/passwords_leak_detection_toggle_test.js
+++ b/chrome/test/data/webui/settings/passwords_leak_detection_toggle_test.js
@@ -27,8 +27,11 @@
         document.createElement('settings-passwords-leak-detection-toggle');
     testElement.prefs = {
       profile: {password_manager_leak_detection: {value: true}},
-      safebrowsing:
-          {enabled: {value: true}, scout_reporting_enabled: {value: true}},
+      safebrowsing: {
+        enabled: {value: true},
+        scout_reporting_enabled: {value: true},
+        enhanced: {value: false}
+      },
     };
     document.body.appendChild(testElement);
     Polymer.dom.flush();
diff --git a/chrome/test/data/webui/settings/passwords_section_test.js b/chrome/test/data/webui/settings/passwords_section_test.js
index 605d14d..613d956 100644
--- a/chrome/test/data/webui/settings/passwords_section_test.js
+++ b/chrome/test/data/webui/settings/passwords_section_test.js
@@ -6,7 +6,7 @@
 
 // clang-format off
 // #import {getToastManager, PasswordManagerImpl} from 'chrome://settings/settings.js';
-// #import {PasswordSectionElementFactory, createExceptionEntry, createPasswordEntry, makeCompromisedCredentialsInfo} from 'chrome://test/settings/passwords_and_autofill_fake_data.m.js';
+// #import {PasswordSectionElementFactory, createExceptionEntry, createPasswordEntry} from 'chrome://test/settings/passwords_and_autofill_fake_data.m.js';
 // #import {runStartExportTest, runExportFlowFastTest, runExportFlowErrorTest, runExportFlowErrorRetryTest, runExportFlowSlowTest, runCancelExportTest, runFireCloseEventAfterExportCompleteTest} from 'chrome://test/settings/passwords_export_test.m.js';
 // #import {eventToPromise} from 'chrome://test/test_util.m.js';
 // #import {flush} from 'chrome://resources/polymer/v3_0/polymer/polymer_bundled.min.js';
@@ -811,33 +811,31 @@
 
     test('showPasswordCheckBannerWhenNotCheckedBefore', function() {
       assertEquals(
-          passwordManager.data.leakedCredentials.elapsedTimeSinceLastCheck,
+          passwordManager.data.checkStatus.elapsedTimeSinceLastCheck,
           undefined);
       const passwordsSection =
           elementFactory.createPasswordsSection(passwordManager, [], []);
-      return passwordManager.whenCalled('getCompromisedCredentialsInfo')
-          .then(() => {
-            Polymer.dom.flush();
-            assertFalse(
-                passwordsSection.$$('#checkPasswordsBannerContainer').hidden);
-            assertFalse(passwordsSection.$$('#checkPasswordsButton').hidden);
-            assertTrue(passwordsSection.$$('#checkPasswordsLinkRow').hidden);
-          });
+      return passwordManager.whenCalled('getPasswordCheckStatus').then(() => {
+        Polymer.dom.flush();
+        assertFalse(
+            passwordsSection.$$('#checkPasswordsBannerContainer').hidden);
+        assertFalse(passwordsSection.$$('#checkPasswordsButton').hidden);
+        assertTrue(passwordsSection.$$('#checkPasswordsLinkRow').hidden);
+      });
     });
 
     test('hidePasswordCheckBannerWhenCheckedBefore', function() {
-      passwordManager.data.leakedCredentials =
-          autofill_test_util.makeCompromisedCredentialsInfo([], '5 mins ago');
+      passwordManager.data.checkStatus.elapsedTimeSinceLastCheck =
+          '5 minutes ago';
       const passwordsSection =
           elementFactory.createPasswordsSection(passwordManager, [], []);
-      return passwordManager.whenCalled('getCompromisedCredentialsInfo')
-          .then(() => {
-            Polymer.dom.flush();
-            assertTrue(
-                passwordsSection.$$('#checkPasswordsBannerContainer').hidden);
-            assertTrue(passwordsSection.$$('#checkPasswordsButton').hidden);
-            assertFalse(passwordsSection.$$('#checkPasswordsLinkRow').hidden);
-          });
+      return passwordManager.whenCalled('getPasswordCheckStatus').then(() => {
+        Polymer.dom.flush();
+        assertTrue(
+            passwordsSection.$$('#checkPasswordsBannerContainer').hidden);
+        assertTrue(passwordsSection.$$('#checkPasswordsButton').hidden);
+        assertFalse(passwordsSection.$$('#checkPasswordsLinkRow').hidden);
+      });
     });
   });
   // #cr_define_end
diff --git a/chrome/test/data/webui/settings/people_page_sync_controls_test.js b/chrome/test/data/webui/settings/people_page_sync_controls_test.js
index ee97736..9d0733dc 100644
--- a/chrome/test/data/webui/settings/people_page_sync_controls_test.js
+++ b/chrome/test/data/webui/settings/people_page_sync_controls_test.js
@@ -7,6 +7,12 @@
     let syncControls = null;
     let browserProxy = null;
 
+    suiteSetup(function() {
+      loadTimeData.overrideValues({
+        syncSetupFriendlySettings: false,
+      });
+    });
+
     setup(function() {
       sync_test_util.setupRouterWithSyncRoutes();
       browserProxy = new TestSyncBrowserProxy();
diff --git a/chrome/test/data/webui/settings/privacy_page_test.js b/chrome/test/data/webui/settings/privacy_page_test.js
index 93a7ba6..fdcb37aa 100644
--- a/chrome/test/data/webui/settings/privacy_page_test.js
+++ b/chrome/test/data/webui/settings/privacy_page_test.js
@@ -36,8 +36,11 @@
             allowed_on_next_startup:
                 {type: chrome.settingsPrivate.PrefType.BOOLEAN, value: true}
           },
-          safebrowsing:
-              {enabled: {value: true}, scout_reporting_enabled: {value: true}},
+          safebrowsing: {
+            enabled: {value: true},
+            scout_reporting_enabled: {value: true},
+            enhanced: {value: false}
+          },
         };
         document.body.appendChild(page);
         Polymer.dom.flush();
@@ -156,8 +159,11 @@
             allowed_on_next_startup:
                 {type: chrome.settingsPrivate.PrefType.BOOLEAN, value: true}
           },
-          safebrowsing:
-              {enabled: {value: true}, scout_reporting_enabled: {value: true}},
+          safebrowsing: {
+            enabled: {value: true},
+            scout_reporting_enabled: {value: true},
+            enhanced: {value: false}
+          },
         };
         document.body.appendChild(page);
         return testSyncBrowserProxy.whenCalled('getSyncStatus');
diff --git a/chrome/test/data/webui/settings/security_page_test.js b/chrome/test/data/webui/settings/security_page_test.js
index 395058ce..1bd5caa 100644
--- a/chrome/test/data/webui/settings/security_page_test.js
+++ b/chrome/test/data/webui/settings/security_page_test.js
@@ -30,8 +30,11 @@
         allowed_on_next_startup:
             {type: chrome.settingsPrivate.PrefType.BOOLEAN, value: true}
       },
-      safebrowsing:
-          {enabled: {value: true}, scout_reporting_enabled: {value: true}},
+      safebrowsing: {
+        enabled: {value: true},
+        scout_reporting_enabled: {value: true},
+        enhanced: {value: false}
+      },
     };
     document.body.appendChild(page);
     Polymer.dom.flush();
@@ -48,34 +51,101 @@
     });
   }
 
-  test('LogManageCerfificatesClick', function() {
-    page.$$('#manageCertificates').click();
-    return testMetricsBrowserProxy.whenCalled('recordSettingsPageHistogram')
-        .then(result => {
-          assertEquals(
-              settings.SettingsPageInteractions.PRIVACY_MANAGE_CERTIFICATES,
-              result);
-        });
+  test('safeBrowsingReportingToggle', function() {
+    page.$$('#safeBrowsingStandard').click();
+    const safeBrowsingReportingToggle = page.$.safeBrowsingReportingToggle;
+    assertTrue(
+        page.prefs.safebrowsing.enabled.value &&
+        !page.prefs.safebrowsing.enhanced.value);
+    assertFalse(safeBrowsingReportingToggle.disabled);
+    assertTrue(safeBrowsingReportingToggle.checked);
+    // This could also be set to disabled, anything other than standard.
+    page.$$('#safeBrowsingEnhanced').click();
+    Polymer.dom.flush();
+
+    assertFalse(
+        page.prefs.safebrowsing.enabled.value &&
+        !page.prefs.safebrowsing.enhanced.value);
+    assertTrue(safeBrowsingReportingToggle.disabled);
+    assertTrue(safeBrowsingReportingToggle.checked);
+    assertTrue(page.prefs.safebrowsing.scout_reporting_enabled.value);
+    page.$$('#safeBrowsingStandard').click();
+    Polymer.dom.flush();
+
+    assertTrue(
+        page.prefs.safebrowsing.enabled.value &&
+        !page.prefs.safebrowsing.enhanced.value);
+    assertFalse(safeBrowsingReportingToggle.disabled);
+    assertTrue(safeBrowsingReportingToggle.checked);
   });
 
-  test('safeBrowsingReportingToggle', function() {
-    const safeBrowsingToggle = page.$.safeBrowsingToggle;
-    const safeBrowsingReportingToggle = page.$.safeBrowsingReportingToggle;
-    assertTrue(safeBrowsingToggle.checked);
-    assertFalse(safeBrowsingReportingToggle.disabled);
-    assertTrue(safeBrowsingReportingToggle.checked);
-    safeBrowsingToggle.click();
+  test('noControlSafeBrowsingReportingInEnhanced', function() {
+    page.$$('#safeBrowsingStandard').click();
     Polymer.dom.flush();
 
-    assertFalse(safeBrowsingToggle.checked);
-    assertTrue(safeBrowsingReportingToggle.disabled);
-    assertFalse(safeBrowsingReportingToggle.checked);
-    assertTrue(page.prefs.safebrowsing.scout_reporting_enabled.value);
-    safeBrowsingToggle.click();
+    assertFalse(page.$.safeBrowsingReportingToggle.disabled);
+    page.$$('#safeBrowsingEnhanced').click();
     Polymer.dom.flush();
 
-    assertTrue(safeBrowsingToggle.checked);
-    assertFalse(safeBrowsingReportingToggle.disabled);
-    assertTrue(safeBrowsingReportingToggle.checked);
+    assertTrue(page.$.safeBrowsingReportingToggle.disabled);
+  });
+
+  test('noValueChangeSafeBrowsingReportingInEnhanced', function() {
+    page.$$('#safeBrowsingStandard').click();
+    Polymer.dom.flush();
+    const previous = page.prefs.safebrowsing.scout_reporting_enabled.value;
+
+    page.$$('#safeBrowsingEnhanced').click();
+    Polymer.dom.flush();
+
+    assertTrue(
+        page.prefs.safebrowsing.scout_reporting_enabled.value == previous);
+  });
+
+  test('noControlSafeBrowsingReportingInDisabled', function() {
+    page.$$('#safeBrowsingStandard').click();
+    Polymer.dom.flush();
+
+    assertFalse(page.$.safeBrowsingReportingToggle.disabled);
+    page.$$('#safeBrowsingEnhanced').click();
+    Polymer.dom.flush();
+
+    assertTrue(page.$.safeBrowsingReportingToggle.disabled);
+  });
+
+  test('noValueChangeSafeBrowsingReportingInDisabled', function() {
+    page.$$('#safeBrowsingStandard').click();
+    Polymer.dom.flush();
+    const previous = page.prefs.safebrowsing.scout_reporting_enabled.value;
+
+    page.$$('#safeBrowsingDisabled').click();
+    Polymer.dom.flush();
+
+    assertTrue(
+        page.prefs.safebrowsing.scout_reporting_enabled.value == previous);
+  });
+
+  test('noValueChangePasswordLeakSwitchToEnhanced', function() {
+    page.$$('#safeBrowsingStandard').click();
+    Polymer.dom.flush();
+    const previous = page.prefs.profile.password_manager_leak_detection.value;
+
+    page.$$('#safeBrowsingEnhanced').click();
+    Polymer.dom.flush();
+
+    assertTrue(
+        page.prefs.profile.password_manager_leak_detection.value == previous);
+  });
+
+  test('noValuePasswordLeakSwitchToDisabled', function() {
+    page.$$('#safeBrowsingStandard').click();
+    Polymer.dom.flush();
+    const previous = page.prefs.profile.password_manager_leak_detection.value;
+
+    page.$$('#safeBrowsingDisabled').click();
+    Polymer.dom.flush();
+
+    assertTrue(
+        page.prefs.profile.password_manager_leak_detection.value == previous);
   });
 });
diff --git a/chrome/test/data/webui/settings/test_password_manager_proxy.js b/chrome/test/data/webui/settings/test_password_manager_proxy.js
index 0e0d127b..2841d3e 100644
--- a/chrome/test/data/webui/settings/test_password_manager_proxy.js
+++ b/chrome/test/data/webui/settings/test_password_manager_proxy.js
@@ -6,7 +6,7 @@
 
 // clang-format off
 // #import {TestBrowserProxy} from 'chrome://test/test_browser_proxy.m.js';
-// #import {makeCompromisedCredentialsInfo, makePasswordCheckStatus, PasswordManagerExpectations} from 'chrome://test/settings/passwords_and_autofill_fake_data.m.js';
+// #import {makePasswordCheckStatus, PasswordManagerExpectations} from 'chrome://test/settings/passwords_and_autofill_fake_data.m.js';
 // clang-format on
 
 /**
@@ -20,7 +20,7 @@
       'requestPlaintextPassword',
       'startBulkPasswordCheck',
       'stopBulkPasswordCheck',
-      'getCompromisedCredentialsInfo',
+      'getCompromisedCredentials',
       'getPasswordCheckStatus',
     ]);
 
@@ -30,7 +30,7 @@
     this.data = {
       passwords: [],
       exceptions: [],
-      leakedCredentials: autofill_test_util.makeCompromisedCredentialsInfo([]),
+      leakedCredentials: [],
       checkStatus: autofill_test_util.makePasswordCheckStatus(),
     };
 
@@ -164,8 +164,8 @@
   }
 
   /** @override */
-  getCompromisedCredentialsInfo() {
-    this.methodCalled('getCompromisedCredentialsInfo');
+  getCompromisedCredentials() {
+    this.methodCalled('getCompromisedCredentials');
     return Promise.resolve(this.data.leakedCredentials);
   }
 
diff --git a/chromeos/components/media_app_ui/resources/js/launch.js b/chromeos/components/media_app_ui/resources/js/launch.js
index 972bc47..0778206 100644
--- a/chromeos/components/media_app_ui/resources/js/launch.js
+++ b/chromeos/components/media_app_ui/resources/js/launch.js
@@ -32,7 +32,7 @@
 /** A pipe through which we can send messages to the guest frame. */
 const guestMessagePipe = new MessagePipe('chrome://media-app-guest');
 
-guestMessagePipe.registerHandler('openFeedbackDialog', () => {
+guestMessagePipe.registerHandler(Message.OPEN_FEEDBACK_DIALOG, () => {
   let response = media_app.handler.openFeedbackDialog();
   if (response === null) {
     response = {errorMessage: 'Null response received'};
diff --git a/chromeos/components/media_app_ui/resources/js/message_types.js b/chromeos/components/media_app_ui/resources/js/message_types.js
index 868de31..bd77d282 100644
--- a/chromeos/components/media_app_ui/resources/js/message_types.js
+++ b/chromeos/components/media_app_ui/resources/js/message_types.js
@@ -13,6 +13,7 @@
  */
 const Message = {
   LOAD_FILE: 'load-file',
+  OPEN_FEEDBACK_DIALOG: 'open-feedback-dialog',
   OVERWRITE_FILE: 'overwrite-file',
 };
 
diff --git a/chromeos/components/media_app_ui/resources/js/receiver.js b/chromeos/components/media_app_ui/resources/js/receiver.js
index f4b0251..ab328fa 100644
--- a/chromeos/components/media_app_ui/resources/js/receiver.js
+++ b/chromeos/components/media_app_ui/resources/js/receiver.js
@@ -74,7 +74,8 @@
 class Delegate {
   /** @override */
   async openFeedbackDialog() {
-    let response = await parentMessagePipe.sendMessage('openFeedbackDialog');
+    const response = await parentMessagePipe.sendMessage(
+      Message.OPEN_FEEDBACK_DIALOG);
     return /** @type {?string} */ (response['errorMessage']);
   }
 };
diff --git a/chromeos/components/nearby/lock_impl.cc b/chromeos/components/nearby/lock_impl.cc
index c25f400..12b0277 100644
--- a/chromeos/components/nearby/lock_impl.cc
+++ b/chromeos/components/nearby/lock_impl.cc
@@ -18,7 +18,9 @@
 #endif
 }
 
-void LockImpl::lock() {
+// NO_THREAD_SAFETY_ANALYSIS: Whether this locks or not depends on rumtime
+// properties.
+void LockImpl::lock() NO_THREAD_SAFETY_ANALYSIS {
   {
     base::AutoLock al(bookkeeping_lock_);
     if (num_acquisitions_ > 0u &&
@@ -46,7 +48,9 @@
   }
 }
 
-void LockImpl::unlock() {
+// NO_THREAD_SAFETY_ANALYSIS: Whether this unlocks or not depends on rumtime
+// properties.
+void LockImpl::unlock() NO_THREAD_SAFETY_ANALYSIS {
   base::AutoLock al(bookkeeping_lock_);
   CHECK_GT(num_acquisitions_, 0u);
   DCHECK_EQ(base::PlatformThread::CurrentId(), owning_thread_id_);
diff --git a/chromeos/components/nearby/lock_impl.h b/chromeos/components/nearby/lock_impl.h
index 9f31614..6506e4d4 100644
--- a/chromeos/components/nearby/lock_impl.h
+++ b/chromeos/components/nearby/lock_impl.h
@@ -14,7 +14,7 @@
 
 namespace nearby {
 
-// Concrete location::nearby::Lock implementation.
+// Concrete location::nearby::Lock implementation. Recursive lock.
 class LockImpl : public LockBase {
  public:
   LockImpl();
diff --git a/chromeos/dbus/shill/fake_shill_device_client.cc b/chromeos/dbus/shill/fake_shill_device_client.cc
index 182c0f3..24079f7 100644
--- a/chromeos/dbus/shill/fake_shill_device_client.cc
+++ b/chromeos/dbus/shill/fake_shill_device_client.cc
@@ -658,14 +658,15 @@
 void FakeShillDeviceClient::PassStubDeviceProperties(
     const dbus::ObjectPath& device_path,
     DictionaryValueCallback callback) const {
-  const base::DictionaryValue* device_properties = nullptr;
-  if (!stub_devices_.GetDictionaryWithoutPathExpansion(device_path.value(),
-                                                       &device_properties)) {
+  const base::Value* device_properties =
+      stub_devices_.FindDictKey(device_path.value());
+  if (!device_properties) {
     base::DictionaryValue empty_dictionary;
     std::move(callback).Run(DBUS_METHOD_CALL_FAILURE, empty_dictionary);
     return;
   }
-  std::move(callback).Run(DBUS_METHOD_CALL_SUCCESS, *device_properties);
+  std::move(callback).Run(DBUS_METHOD_CALL_SUCCESS,
+                          base::Value::AsDictionaryValue(*device_properties));
 }
 
 // Posts a task to run a void callback with status code |status|.
diff --git a/chromeos/dbus/shill/fake_shill_ipconfig_client.cc b/chromeos/dbus/shill/fake_shill_ipconfig_client.cc
index 7918e72..a3dc177 100644
--- a/chromeos/dbus/shill/fake_shill_ipconfig_client.cc
+++ b/chromeos/dbus/shill/fake_shill_ipconfig_client.cc
@@ -38,14 +38,14 @@
 void FakeShillIPConfigClient::GetProperties(
     const dbus::ObjectPath& ipconfig_path,
     DictionaryValueCallback callback) {
-  const base::DictionaryValue* dict = nullptr;
-  if (!ipconfigs_.GetDictionaryWithoutPathExpansion(ipconfig_path.value(),
-                                                    &dict))
+  const base::Value* dict = ipconfigs_.FindDictKey(ipconfig_path.value());
+  if (!dict)
     return;
+  std::unique_ptr<base::DictionaryValue> dict_copy =
+      base::DictionaryValue::From(dict->CreateDeepCopy());
   base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, base::BindOnce(&FakeShillIPConfigClient::PassProperties,
-                                weak_ptr_factory_.GetWeakPtr(), dict,
-                                std::move(callback)));
+      FROM_HERE, base::BindOnce(std::move(callback), DBUS_METHOD_CALL_SUCCESS,
+                                std::move(*dict_copy)));
 }
 
 void FakeShillIPConfigClient::SetProperty(const dbus::ObjectPath& ipconfig_path,
@@ -92,12 +92,4 @@
   ipconfigs_.SetKey(ip_config_path, properties.Clone());
 }
 
-// Private methods
-
-void FakeShillIPConfigClient::PassProperties(
-    const base::DictionaryValue* values,
-    DictionaryValueCallback callback) const {
-  std::move(callback).Run(DBUS_METHOD_CALL_SUCCESS, *values);
-}
-
 }  // namespace chromeos
diff --git a/chromeos/dbus/shill/fake_shill_ipconfig_client.h b/chromeos/dbus/shill/fake_shill_ipconfig_client.h
index 818778d..2abd4e0 100644
--- a/chromeos/dbus/shill/fake_shill_ipconfig_client.h
+++ b/chromeos/dbus/shill/fake_shill_ipconfig_client.h
@@ -46,10 +46,6 @@
                    const base::DictionaryValue& properties) override;
 
  private:
-  // Runs callback with |values|.
-  void PassProperties(const base::DictionaryValue* values,
-                      DictionaryValueCallback callback) const;
-
   // Dictionary of <ipconfig_path, property dictionaries>
   base::DictionaryValue ipconfigs_;
 
diff --git a/chromeos/dbus/shill/fake_shill_manager_client.cc b/chromeos/dbus/shill/fake_shill_manager_client.cc
index 555c1a84..bd5acf8 100644
--- a/chromeos/dbus/shill/fake_shill_manager_client.cc
+++ b/chromeos/dbus/shill/fake_shill_manager_client.cc
@@ -1015,12 +1015,12 @@
 
 void FakeShillManagerClient::PassStubProperties(
     DictionaryValueCallback callback) const {
-  std::unique_ptr<base::DictionaryValue> stub_properties(
-      stub_properties_.DeepCopy());
-  stub_properties->SetWithoutPathExpansion(
+  base::Value stub_properties = stub_properties_.Clone();
+  stub_properties.SetKey(
       shill::kServiceCompleteListProperty,
       GetEnabledServiceList(shill::kServiceCompleteListProperty));
-  std::move(callback).Run(DBUS_METHOD_CALL_SUCCESS, *stub_properties);
+  std::move(callback).Run(DBUS_METHOD_CALL_SUCCESS,
+                          base::Value::AsDictionaryValue(stub_properties));
 }
 
 void FakeShillManagerClient::PassStubGeoNetworks(
@@ -1049,9 +1049,9 @@
     return;
   }
   if (property == shill::kServiceCompleteListProperty) {
-    std::unique_ptr<base::ListValue> services(GetEnabledServiceList(property));
+    base::Value services = GetEnabledServiceList(property);
     for (auto& observer : observer_list_)
-      observer.OnPropertyChanged(property, *(services.get()));
+      observer.OnPropertyChanged(property, services);
     return;
   }
   for (auto& observer : observer_list_)
@@ -1100,9 +1100,9 @@
   SortManagerServices(true);
 }
 
-std::unique_ptr<base::ListValue> FakeShillManagerClient::GetEnabledServiceList(
+base::Value FakeShillManagerClient::GetEnabledServiceList(
     const std::string& property) const {
-  auto new_service_list = std::make_unique<base::ListValue>();
+  base::Value new_service_list(base::Value::Type::LIST);
   const base::ListValue* service_list;
   if (stub_properties_.GetListWithoutPathExpansion(property, &service_list)) {
     ShillServiceClient::TestInterface* service_client =
@@ -1121,7 +1121,7 @@
       std::string type;
       properties->GetString(shill::kTypeProperty, &type);
       if (TechnologyEnabled(type))
-        new_service_list->Append(iter->CreateDeepCopy());
+        new_service_list.Append(iter->Clone());
     }
   }
   return new_service_list;
diff --git a/chromeos/dbus/shill/fake_shill_manager_client.h b/chromeos/dbus/shill/fake_shill_manager_client.h
index 0d8851a..8fd370a 100644
--- a/chromeos/dbus/shill/fake_shill_manager_client.h
+++ b/chromeos/dbus/shill/fake_shill_manager_client.h
@@ -109,8 +109,7 @@
   void SetTechnologyEnabled(const std::string& type,
                             base::OnceClosure callback,
                             bool enabled);
-  std::unique_ptr<base::ListValue> GetEnabledServiceList(
-      const std::string& property) const;
+  base::Value GetEnabledServiceList(const std::string& property) const;
   void ScanCompleted(const std::string& device_path);
 
   // Parses the command line for Shill stub switches and sets initial states.
diff --git a/chromeos/dbus/shill/fake_shill_profile_client.cc b/chromeos/dbus/shill/fake_shill_profile_client.cc
index 5176e0e..5d950cc 100644
--- a/chromeos/dbus/shill/fake_shill_profile_client.cc
+++ b/chromeos/dbus/shill/fake_shill_profile_client.cc
@@ -30,16 +30,6 @@
   base::DictionaryValue properties;  // Dictionary of Profile properties
 };
 
-namespace {
-
-void PassDictionary(
-    ShillProfileClient::DictionaryValueCallbackWithoutStatus callback,
-    const base::DictionaryValue* dictionary) {
-  std::move(callback).Run(*dictionary);
-}
-
-}  // namespace
-
 FakeShillProfileClient::FakeShillProfileClient() = default;
 
 FakeShillProfileClient::~FakeShillProfileClient() = default;
@@ -62,20 +52,17 @@
     return;
   }
 
-  auto entry_paths = std::make_unique<base::ListValue>();
-  for (base::DictionaryValue::Iterator it(profile->entries); !it.IsAtEnd();
-       it.Advance()) {
-    entry_paths->AppendString(it.key());
+  base::Value entry_paths(base::Value::Type::LIST);
+  for (const auto& it : profile->entries.DictItems()) {
+    entry_paths.Append(it.first);
   }
 
   std::unique_ptr<base::DictionaryValue> properties =
       profile->properties.CreateDeepCopy();
-  properties->SetWithoutPathExpansion(shill::kEntriesProperty,
-                                      std::move(entry_paths));
+  properties->SetKey(shill::kEntriesProperty, std::move(entry_paths));
 
   base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, base::BindOnce(&PassDictionary, std::move(callback),
-                                base::Owned(properties.release())));
+      FROM_HERE, base::BindOnce(std::move(callback), std::move(*properties)));
 }
 
 void FakeShillProfileClient::GetEntry(
@@ -89,17 +76,17 @@
     return;
   }
 
-  base::DictionaryValue* entry = nullptr;
-  profile->entries.GetDictionaryWithoutPathExpansion(entry_path, &entry);
+  const base::Value* entry = profile->entries.FindDictKey(entry_path);
   if (!entry) {
     std::move(error_callback)
         .Run("Error.InvalidProfileEntry", "Invalid profile entry");
     return;
   }
 
+  std::unique_ptr<base::DictionaryValue> entry_copy =
+      base::DictionaryValue::From(entry->CreateDeepCopy());
   base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, base::BindOnce(&PassDictionary, std::move(callback),
-                                base::Owned(entry->DeepCopy())));
+      FROM_HERE, base::BindOnce(std::move(callback), std::move(*entry_copy)));
 }
 
 void FakeShillProfileClient::DeleteEntry(const dbus::ObjectPath& profile_path,
diff --git a/chromeos/dbus/shill/fake_shill_service_client.cc b/chromeos/dbus/shill/fake_shill_service_client.cc
index ef3133a..859cd27c 100644
--- a/chromeos/dbus/shill/fake_shill_service_client.cc
+++ b/chromeos/dbus/shill/fake_shill_service_client.cc
@@ -30,13 +30,6 @@
 
 namespace {
 
-void PassStubServiceProperties(
-    ShillServiceClient::DictionaryValueCallback callback,
-    DBusMethodCallStatus call_status,
-    const base::DictionaryValue* properties) {
-  std::move(callback).Run(call_status, *properties);
-}
-
 void CallSortManagerServices() {
   ShillManagerClient::Get()->GetTestInterface()->SortManagerServices(true);
 }
@@ -166,26 +159,23 @@
 void FakeShillServiceClient::GetProperties(const dbus::ObjectPath& service_path,
                                            DictionaryValueCallback callback) {
   base::DictionaryValue* nested_dict = nullptr;
-  std::unique_ptr<base::DictionaryValue> result_properties;
+  base::DictionaryValue result_properties;
   DBusMethodCallStatus call_status;
   stub_services_.GetDictionaryWithoutPathExpansion(service_path.value(),
                                                    &nested_dict);
   if (nested_dict) {
-    result_properties.reset(nested_dict->DeepCopy());
+    result_properties = std::move(*nested_dict->CreateDeepCopy());
     // Remove credentials that Shill wouldn't send.
-    result_properties->RemoveWithoutPathExpansion(shill::kPassphraseProperty,
-                                                  nullptr);
+    result_properties.RemoveKey(shill::kPassphraseProperty);
     call_status = DBUS_METHOD_CALL_SUCCESS;
   } else {
     // This may happen if we remove services from the list.
     VLOG(2) << "Properties not found for: " << service_path.value();
-    result_properties.reset(new base::DictionaryValue);
     call_status = DBUS_METHOD_CALL_FAILURE;
   }
 
-  base::OnceClosure property_update =
-      base::BindOnce(&PassStubServiceProperties, std::move(callback),
-                     call_status, base::Owned(result_properties.release()));
+  base::OnceClosure property_update = base::BindOnce(
+      std::move(callback), call_status, std::move(result_properties));
   if (hold_back_service_property_updates_)
     recorded_property_updates_.push_back(std::move(property_update));
   else
@@ -360,17 +350,14 @@
 
   // Provide a dictionary with  {profile_path: service_path} entries for
   // profile_paths that contain the service.
-  std::unique_ptr<base::DictionaryValue> result_properties(
-      new base::DictionaryValue);
+  base::DictionaryValue result_properties;
   for (const auto& profile : profiles) {
-    result_properties->SetKey(profile, base::Value(service_path.value()));
+    result_properties.SetKey(profile, base::Value(service_path.value()));
   }
 
-  DBusMethodCallStatus call_status = DBUS_METHOD_CALL_SUCCESS;
   base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE,
-      base::BindOnce(&PassStubServiceProperties, std::move(callback),
-                     call_status, base::Owned(result_properties.release())));
+      FROM_HERE, base::BindOnce(std::move(callback), DBUS_METHOD_CALL_SUCCESS,
+                                std::move(result_properties)));
 }
 
 void FakeShillServiceClient::GetWiFiPassphrase(
diff --git a/chromeos/dbus/shill/shill_client_helper.cc b/chromeos/dbus/shill/shill_client_helper.cc
index 2c683be..eb18d1d 100644
--- a/chromeos/dbus/shill/shill_client_helper.cc
+++ b/chromeos/dbus/shill/shill_client_helper.cc
@@ -137,13 +137,13 @@
   }
   dbus::MessageReader reader(response);
   std::unique_ptr<base::Value> value(dbus::PopDataAsValue(&reader));
-  base::DictionaryValue* result = NULL;
-  if (!value.get() || !value->GetAsDictionary(&result)) {
+  if (!value.get() || !value->is_dict()) {
     base::DictionaryValue result;
     std::move(callback).Run(DBUS_METHOD_CALL_FAILURE, result);
     return;
   }
-  std::move(callback).Run(DBUS_METHOD_CALL_SUCCESS, *result);
+  std::move(callback).Run(DBUS_METHOD_CALL_SUCCESS,
+                          base::Value::AsDictionaryValue(*value));
 }
 
 // Handles responses for methods without results.
@@ -162,13 +162,12 @@
     dbus::Response* response) {
   dbus::MessageReader reader(response);
   std::unique_ptr<base::Value> value(dbus::PopDataAsValue(&reader));
-  base::DictionaryValue* result = NULL;
-  if (!value.get() || !value->GetAsDictionary(&result)) {
+  if (!value.get() || !value->is_dict()) {
     std::move(error_callback)
         .Run(kInvalidResponseErrorName, kInvalidResponseErrorMessage);
     return;
   }
-  std::move(callback).Run(*result);
+  std::move(callback).Run(base::Value::AsDictionaryValue(*value));
 }
 
 // Handles responses for methods with ListValue results.
diff --git a/chromeos/network/geolocation_handler.cc b/chromeos/network/geolocation_handler.cc
index 38cf30b..fae9194 100644
--- a/chromeos/network/geolocation_handler.cc
+++ b/chromeos/network/geolocation_handler.cc
@@ -24,6 +24,12 @@
   return std::to_string(std::stoi(hex_str, nullptr, 16));
 }
 
+std::string FindStringOrEmpty(const base::Value& dict,
+                              const base::StringPiece key) {
+  const std::string* val = dict.FindStringKey(key);
+  return val ? *val : std::string();
+}
+
 }  // namespace
 
 GeolocationHandler::GeolocationHandler()
@@ -92,8 +98,9 @@
 void GeolocationHandler::ManagerPropertiesCallback(
     DBusMethodCallStatus call_status,
     const base::DictionaryValue& properties) {
-  const base::Value* value = nullptr;
-  if (properties.Get(shill::kEnabledTechnologiesProperty, &value) && value)
+  const base::Value* value =
+      properties.FindKey(shill::kEnabledTechnologiesProperty);
+  if (value)
     HandlePropertyChanged(shill::kEnabledTechnologiesProperty, *value);
 }
 
@@ -143,7 +150,7 @@
   }
   wifi_access_points_.clear();
   cell_towers_.clear();
-  if (properties.empty())
+  if (properties.DictEmpty())
     return;  // No enabled devices, don't update received time.
 
   // Dictionary<device_type, entry_list>
@@ -155,22 +162,21 @@
   //   kGeoCellTowersProperty: [ {kGeoCellIdProperty: cell_id_value, ...}, ... ]
   // }
   for (auto* device_type : kDevicePropertyNames) {
-    if (!properties.HasKey(device_type)) {
+    const base::Value* entry_list = properties.FindKey(device_type);
+    if (!entry_list) {
       continue;
     }
 
-    const base::ListValue* entry_list = nullptr;
-    if (!properties.GetList(device_type, &entry_list)) {
+    if (!entry_list->is_list()) {
       LOG(WARNING) << "Geolocation dictionary value not a List: "
                    << device_type;
       continue;
     }
 
     // List[Dictionary<key, value_str>]
-    for (size_t i = 0; i < entry_list->GetSize(); ++i) {
-      const base::DictionaryValue* entry = nullptr;
-      if (!entry_list->GetDictionary(i, &entry) || !entry) {
-        LOG(WARNING) << "Geolocation list value not a Dictionary: " << i;
+    for (const auto& entry : entry_list->GetList()) {
+      if (!entry.is_dict()) {
+        LOG(WARNING) << "Geolocation list value not a Dictionary";
         continue;
       }
       if (device_type == shill::kGeoWifiAccessPointsProperty) {
@@ -183,68 +189,74 @@
   geolocation_received_time_ = base::Time::Now();
 }
 
-void GeolocationHandler::AddAccessPointFromDict(
-    const base::DictionaryValue* entry) {
+void GeolocationHandler::AddAccessPointFromDict(const base::Value& entry) {
   // Docs: developers.google.com/maps/documentation/business/geolocation
   WifiAccessPoint wap;
 
-  std::string age_str;
-  if (entry->GetString(shill::kGeoAgeProperty, &age_str)) {
+  const std::string* age_str = entry.FindStringKey(shill::kGeoAgeProperty);
+  if (age_str) {
     int64_t age_ms;
-    if (base::StringToInt64(age_str, &age_ms)) {
+    if (base::StringToInt64(*age_str, &age_ms)) {
       wap.timestamp =
           base::Time::Now() - base::TimeDelta::FromMilliseconds(age_ms);
     }
   }
-  entry->GetString(shill::kGeoMacAddressProperty, &wap.mac_address);
 
-  std::string strength_str;
-  if (entry->GetString(shill::kGeoSignalStrengthProperty, &strength_str))
-    base::StringToInt(strength_str, &wap.signal_strength);
+  wap.mac_address = FindStringOrEmpty(entry, shill::kGeoMacAddressProperty);
 
-  std::string signal_str;
-  if (entry->GetString(shill::kGeoSignalToNoiseRatioProperty, &signal_str)) {
-    base::StringToInt(signal_str, &wap.signal_to_noise);
+  const std::string* strength_str =
+      entry.FindStringKey(shill::kGeoSignalStrengthProperty);
+  if (strength_str) {
+    base::StringToInt(*strength_str, &wap.signal_strength);
   }
 
-  std::string channel_str;
-  if (entry->GetString(shill::kGeoChannelProperty, &channel_str))
-    base::StringToInt(channel_str, &wap.channel);
+  const std::string* signal_str =
+      entry.FindStringKey(shill::kGeoSignalToNoiseRatioProperty);
+  if (signal_str) {
+    base::StringToInt(*signal_str, &wap.signal_to_noise);
+  }
+
+  const std::string* channel_str =
+      entry.FindStringKey(shill::kGeoChannelProperty);
+  if (channel_str) {
+    base::StringToInt(*channel_str, &wap.channel);
+  }
 
   wifi_access_points_.push_back(wap);
 }
 
-void GeolocationHandler::AddCellTowerFromDict(
-    const base::DictionaryValue* entry) {
+void GeolocationHandler::AddCellTowerFromDict(const base::Value& entry) {
   // Docs: developers.google.com/maps/documentation/business/geolocation
 
   // Create object.
   CellTower ct;
 
   // Read time fields into object.
-  std::string age_str;
-  if (entry->GetString(shill::kGeoAgeProperty, &age_str)) {
+  const std::string* age_str = entry.FindStringKey(shill::kGeoAgeProperty);
+  if (age_str) {
     int64_t age_ms;
-    if (base::StringToInt64(age_str, &age_ms)) {
+    if (base::StringToInt64(*age_str, &age_ms)) {
       ct.timestamp =
           base::Time::Now() - base::TimeDelta::FromMilliseconds(age_ms);
     }
   }
 
   // Read hex fields into object.
-  std::string hex_cell_id;
-  if (entry->GetString(shill::kGeoCellIdProperty, &hex_cell_id)) {
-    ct.ci = HexToDecimal(hex_cell_id);
+  const std::string* hex_cell_id =
+      entry.FindStringKey(shill::kGeoCellIdProperty);
+  if (hex_cell_id) {
+    ct.ci = HexToDecimal(*hex_cell_id);
   }
 
-  std::string hex_lac;
-  if (entry->GetString(shill::kGeoLocationAreaCodeProperty, &hex_lac)) {
-    ct.lac = HexToDecimal(hex_lac);
+  const std::string* hex_lac =
+      entry.FindStringKey(shill::kGeoLocationAreaCodeProperty);
+  if (hex_lac) {
+    ct.lac = HexToDecimal(*hex_lac);
   }
 
   // Read decimal fields into object.
-  entry->GetString(shill::kGeoMobileCountryCodeProperty, &ct.mcc);
-  entry->GetString(shill::kGeoMobileNetworkCodeProperty, &ct.mnc);
+  ct.mcc = FindStringOrEmpty(entry, shill::kGeoMobileCountryCodeProperty);
+  ct.mnc = FindStringOrEmpty(entry, shill::kGeoMobileNetworkCodeProperty);
 
   // Add new object to vector.
   cell_towers_.push_back(ct);
diff --git a/chromeos/network/geolocation_handler.h b/chromeos/network/geolocation_handler.h
index 216196c..fcfb3c91 100644
--- a/chromeos/network/geolocation_handler.h
+++ b/chromeos/network/geolocation_handler.h
@@ -17,6 +17,7 @@
 
 namespace base {
 class DictionaryValue;
+class Value;
 }
 
 namespace chromeos {
@@ -86,8 +87,8 @@
   bool cellular_enabled_;
   bool wifi_enabled_;
 
-  void AddCellTowerFromDict(const base::DictionaryValue* entry);
-  void AddAccessPointFromDict(const base::DictionaryValue* entry);
+  void AddCellTowerFromDict(const base::Value& entry);
+  void AddAccessPointFromDict(const base::Value& entry);
 
   // Cached netork information and update time
   WifiAccessPointVector wifi_access_points_;
diff --git a/chromeos/network/network_configuration_handler.cc b/chromeos/network/network_configuration_handler.cc
index f7fd337..562ed34c 100644
--- a/chromeos/network/network_configuration_handler.cc
+++ b/chromeos/network/network_configuration_handler.cc
@@ -135,11 +135,12 @@
       return;
     }
 
-    for (base::DictionaryValue::Iterator iter(profile_entries); !iter.IsAtEnd();
-         iter.Advance()) {
-      std::string profile_path = StripQuotations(iter.key());
+    for (const auto& iter : profile_entries.DictItems()) {
+      std::string profile_path = StripQuotations(iter.first);
       std::string entry_path;
-      iter.value().GetAsString(&entry_path);
+      if (iter.second.is_string()) {
+        entry_path = iter.second.GetString();
+      }
       if (profile_path.empty() || entry_path.empty()) {
         NET_LOG(ERROR) << "Failed to parse Profile Entry: " << profile_path
                        << ": " << entry_path;
@@ -579,25 +580,25 @@
     return;
 
   // Get the correct name from WifiHex if necessary.
-  std::unique_ptr<base::DictionaryValue> properties_copy(properties.DeepCopy());
+  base::Value properties_copy = properties.Clone();
   std::string name =
       shill_property_util::GetNameFromProperties(service_path, properties);
   if (!name.empty())
-    properties_copy->SetKey(shill::kNameProperty, base::Value(name));
+    properties_copy.SetKey(shill::kNameProperty, base::Value(name));
 
   // Get the GUID property from NetworkState if it is not set in Shill.
-  std::string guid;
-  properties.GetStringWithoutPathExpansion(::onc::network_config::kGUID, &guid);
-  if (guid.empty()) {
+  const std::string* guid =
+      properties.FindStringKey(::onc::network_config::kGUID);
+  if (!guid) {
     const NetworkState* network_state =
         network_state_handler_->GetNetworkState(service_path);
     if (network_state) {
-      properties_copy->SetKey(::onc::network_config::kGUID,
-                              base::Value(network_state->guid()));
+      properties_copy.SetKey(::onc::network_config::kGUID,
+                             base::Value(network_state->guid()));
     }
   }
 
-  callback.Run(service_path, *properties_copy.get());
+  callback.Run(service_path, base::Value::AsDictionaryValue(properties_copy));
 }
 
 void NetworkConfigurationHandler::SetPropertiesSuccessCallback(
diff --git a/chromeos/network/network_configuration_handler_unittest.cc b/chromeos/network/network_configuration_handler_unittest.cc
index f42e87c..e208b28 100644
--- a/chromeos/network/network_configuration_handler_unittest.cc
+++ b/chromeos/network/network_configuration_handler_unittest.cc
@@ -193,7 +193,7 @@
   void GetPropertiesCallback(const std::string& service_path,
                              const base::DictionaryValue& dictionary) {
     get_properties_path_ = service_path;
-    get_properties_ = dictionary.CreateDeepCopy();
+    get_properties_ = dictionary.Clone();
   }
 
   void ManagerGetPropertiesCallback(const std::string& success_callback_name,
@@ -201,7 +201,7 @@
                                     const base::DictionaryValue& result) {
     if (call_status == chromeos::DBUS_METHOD_CALL_SUCCESS)
       success_callback_name_ = success_callback_name;
-    manager_get_properties_ = result.CreateDeepCopy();
+    manager_get_properties_ = result.Clone();
   }
 
   void CreateConfigurationCallback(const std::string& service_path,
@@ -288,10 +288,10 @@
   bool GetReceivedStringProperty(const std::string& service_path,
                                  const std::string& key,
                                  std::string* result) {
-    if (get_properties_path_ != service_path || !get_properties_)
+    if (get_properties_path_ != service_path || get_properties_.is_none())
       return false;
     const base::Value* value =
-        get_properties_->FindKeyOfType(key, base::Value::Type::STRING);
+        get_properties_.FindKeyOfType(key, base::Value::Type::STRING);
     if (!value)
       return false;
     *result = value->GetString();
@@ -300,10 +300,10 @@
 
   bool GetReceivedStringManagerProperty(const std::string& key,
                                         std::string* result) {
-    if (!manager_get_properties_)
+    if (manager_get_properties_.is_none())
       return false;
     const base::Value* value =
-        manager_get_properties_->FindKeyOfType(key, base::Value::Type::STRING);
+        manager_get_properties_.FindKeyOfType(key, base::Value::Type::STRING);
     if (!value)
       return false;
     *result = value->GetString();
@@ -326,8 +326,8 @@
       base::test::SingleThreadTaskEnvironment::MainThreadType::UI};
   std::string success_callback_name_;
   std::string get_properties_path_;
-  std::unique_ptr<base::DictionaryValue> get_properties_;
-  std::unique_ptr<base::DictionaryValue> manager_get_properties_;
+  base::Value get_properties_;
+  base::Value manager_get_properties_;
   std::string create_service_path_;
 };
 
diff --git a/chromeos/network/network_profile_handler.cc b/chromeos/network/network_profile_handler.cc
index e8cb7b9e..053334c 100644
--- a/chromeos/network/network_profile_handler.cc
+++ b/chromeos/network/network_profile_handler.cc
@@ -77,8 +77,7 @@
     return;
   }
 
-  const base::Value* profiles = NULL;
-  properties.GetWithoutPathExpansion(shill::kProfilesProperty, &profiles);
+  const base::Value* profiles = properties.FindKey(shill::kProfilesProperty);
   if (!profiles) {
     LOG(ERROR) << "Manager properties returned from Shill don't contain "
                << "the field " << shill::kProfilesProperty;
@@ -146,10 +145,10 @@
     VLOG(1) << "Ignore received properties, profile is already created.";
     return;
   }
-  std::string userhash;
-  properties.GetStringWithoutPathExpansion(shill::kUserHashProperty, &userhash);
+  const std::string* userhash =
+      properties.FindStringKey(shill::kUserHashProperty);
 
-  AddProfile(NetworkProfile(profile_path, userhash));
+  AddProfile(NetworkProfile(profile_path, userhash ? *userhash : ""));
 }
 
 void NetworkProfileHandler::AddProfile(const NetworkProfile& profile) {
diff --git a/chromeos/network/network_sms_handler.cc b/chromeos/network/network_sms_handler.cc
index 6edec29..57a122d7 100644
--- a/chromeos/network/network_sms_handler.cc
+++ b/chromeos/network/network_sms_handler.cc
@@ -250,12 +250,9 @@
 
 void NetworkSmsHandler::OnPropertyChanged(const std::string& name,
                                           const base::Value& value) {
-  if (name != shill::kDevicesProperty)
+  if (name != shill::kDevicesProperty || !value.is_list())
     return;
-  const base::ListValue* devices = NULL;
-  if (!value.GetAsList(&devices) || !devices)
-    return;
-  UpdateDevices(devices);
+  UpdateDevices(value);
 }
 
 // Private methods
@@ -285,22 +282,21 @@
     LOG(ERROR) << "NetworkSmsHandler: Failed to get manager properties.";
     return;
   }
-  const base::Value* value;
-  if (!properties.GetWithoutPathExpansion(shill::kDevicesProperty, &value) ||
-      !value->is_list()) {
+  const base::Value* value = properties.FindListKey(shill::kDevicesProperty);
+  if (!value) {
     LOG(ERROR) << "NetworkSmsHandler: No list value for: "
                << shill::kDevicesProperty;
     return;
   }
-  const base::ListValue* devices = static_cast<const base::ListValue*>(value);
-  UpdateDevices(devices);
+  UpdateDevices(*value);
 }
 
-void NetworkSmsHandler::UpdateDevices(const base::ListValue* devices) {
-  for (base::ListValue::const_iterator iter = devices->begin();
-       iter != devices->end(); ++iter) {
-    std::string device_path;
-    iter->GetAsString(&device_path);
+void NetworkSmsHandler::UpdateDevices(const base::Value& devices) {
+  for (const auto& item : devices.GetList()) {
+    if (!item.is_string())
+      continue;
+
+    std::string device_path = item.GetString();
     if (!device_path.empty()) {
       // Request device properties.
       VLOG(1) << "GetDeviceProperties: " << device_path;
@@ -322,33 +318,33 @@
     return;
   }
 
-  std::string device_type;
-  if (!properties.GetStringWithoutPathExpansion(
-          shill::kTypeProperty, &device_type)) {
+  const std::string* device_type =
+      properties.FindStringKey(shill::kTypeProperty);
+  if (!device_type) {
     LOG(ERROR) << "NetworkSmsHandler: No type for: " << device_path;
     return;
   }
-  if (device_type != shill::kTypeCellular)
+  if (*device_type != shill::kTypeCellular)
     return;
 
-  std::string service_name;
-  if (!properties.GetStringWithoutPathExpansion(
-          shill::kDBusServiceProperty, &service_name)) {
+  const std::string* service_name =
+      properties.FindStringKey(shill::kDBusServiceProperty);
+  if (!service_name) {
     LOG(ERROR) << "Device has no DBusService Property: " << device_path;
     return;
   }
 
-  std::string object_path_string;
-  if (!properties.GetStringWithoutPathExpansion(
-          shill::kDBusObjectProperty, &object_path_string)) {
+  const std::string* object_path_string =
+      properties.FindStringKey(shill::kDBusObjectProperty);
+  if (!object_path_string) {
     LOG(ERROR) << "Device has no DBusObject Property: " << device_path;
     return;
   }
-  dbus::ObjectPath object_path(object_path_string);
-  if (service_name == modemmanager::kModemManager1ServiceName) {
+  dbus::ObjectPath object_path(*object_path_string);
+  if (*service_name == modemmanager::kModemManager1ServiceName) {
     device_handlers_.push_back(
         std::make_unique<ModemManager1NetworkSmsDeviceHandler>(
-            this, service_name, object_path));
+            this, *service_name, object_path));
   }
 }
 
diff --git a/chromeos/network/network_sms_handler.h b/chromeos/network/network_sms_handler.h
index 3ed0e3b..14d50e7 100644
--- a/chromeos/network/network_sms_handler.h
+++ b/chromeos/network/network_sms_handler.h
@@ -18,7 +18,6 @@
 
 namespace base {
 class DictionaryValue;
-class ListValue;
 class Value;
 }
 
@@ -84,7 +83,7 @@
                                  const base::DictionaryValue& properties);
 
   // Requests properties for each entry in |devices|.
-  void UpdateDevices(const base::ListValue* devices);
+  void UpdateDevices(const base::Value& devices);
 
   // Callback to handle the device properties for |device_path|.
   // A NetworkSmsDeviceHandler will be instantiated for each cellular device.
diff --git a/chromeos/network/policy_applicator.cc b/chromeos/network/policy_applicator.cc
index 5c7b005..635f06d 100644
--- a/chromeos/network/policy_applicator.cc
+++ b/chromeos/network/policy_applicator.cc
@@ -94,9 +94,9 @@
     const base::DictionaryValue& profile_properties) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   VLOG(2) << "Received properties for profile " << profile_.ToDebugString();
-  const base::ListValue* entries = nullptr;
-  if (!profile_properties.GetListWithoutPathExpansion(
-           shill::kEntriesProperty, &entries)) {
+  const base::Value* entries =
+      profile_properties.FindListKey(shill::kEntriesProperty);
+  if (!entries) {
     LOG(ERROR) << "Profile " << profile_.ToDebugString()
                << " doesn't contain the property "
                << shill::kEntriesProperty;
@@ -104,10 +104,11 @@
     return;
   }
 
-  for (base::ListValue::const_iterator it = entries->begin();
-       it != entries->end(); ++it) {
-    std::string entry;
-    it->GetAsString(&entry);
+  for (const auto& it : entries->GetList()) {
+    if (!it.is_string())
+      continue;
+
+    std::string entry = it.GetString();
 
     // Skip "ethernet_any", as this is used by shill internally to persist
     // ethernet settings and the policy application logic should not mess with
diff --git a/chromeos/network/shill_property_handler.cc b/chromeos/network/shill_property_handler.cc
index 38ccc87..8978f2f0 100644
--- a/chromeos/network/shill_property_handler.cc
+++ b/chromeos/network/shill_property_handler.cc
@@ -309,9 +309,8 @@
     return;
   }
   NET_LOG(EVENT) << "ManagerPropertiesCallback: Success";
-  for (base::DictionaryValue::Iterator iter(properties); !iter.IsAtEnd();
-       iter.Advance()) {
-    ManagerPropertyChanged(iter.key(), iter.value());
+  for (const auto& item : properties.DictItems()) {
+    ManagerPropertyChanged(item.first, item.second);
   }
 
   CheckPendingStateListUpdates("");
@@ -543,13 +542,13 @@
 
   if (type == ManagedState::MANAGED_TYPE_NETWORK) {
     // Request IPConfig properties.
-    const base::Value* value;
-    if (properties.GetWithoutPathExpansion(shill::kIPConfigProperty, &value))
+    const base::Value* value = properties.FindKey(shill::kIPConfigProperty);
+    if (value)
       RequestIPConfig(type, path, *value);
   } else if (type == ManagedState::MANAGED_TYPE_DEVICE) {
     // Clear and request IPConfig properties for each entry in IPConfigs.
-    const base::Value* value;
-    if (properties.GetWithoutPathExpansion(shill::kIPConfigsProperty, &value))
+    const base::Value* value = properties.FindKey(shill::kIPConfigsProperty);
+    if (value)
       RequestIPConfigsList(type, path, *value);
   }
 
diff --git a/components/autofill_assistant/browser/interactions.proto b/components/autofill_assistant/browser/interactions.proto
index b33b5568..460c88ae 100644
--- a/components/autofill_assistant/browser/interactions.proto
+++ b/components/autofill_assistant/browser/interactions.proto
@@ -34,6 +34,7 @@
     ComputeValueProto compute_value = 4;
     SetUserActionsProto set_user_actions = 5;
     EndActionProto end_action = 6;
+    ShowCalendarPopupProto show_calendar_popup = 7;
   }
 }
 
@@ -152,3 +153,16 @@
   // The status to report to the backend.
   optional ProcessedActionStatusProto status = 1;
 }
+
+// Displays a calendar popup that lets the user select a date.
+message ShowCalendarPopupProto {
+  // The date model identifier (both input and output). Must point to a single
+  // DateList. If not set, the calendar will default to the current date.
+  optional string date_model_identifier = 1;
+  // The model identifier for the minimum allowed date. Must point to a single
+  // DateList.
+  optional string min_date_model_identifier = 2;
+  // The model identifier for the minimum allowed date. Must point to a single
+  // DateList.
+  optional string max_date_model_identifier = 3;
+}
diff --git a/components/autofill_assistant/browser/model.proto b/components/autofill_assistant/browser/model.proto
index 4594e542..fc705cb 100644
--- a/components/autofill_assistant/browser/model.proto
+++ b/components/autofill_assistant/browser/model.proto
@@ -27,6 +27,7 @@
     BooleanList booleans = 2;
     IntList ints = 3;
     UserActionList user_actions = 4;
+    DateList dates = 5;
   }
 }
 
@@ -46,6 +47,10 @@
   repeated UserActionProto values = 1;
 }
 
+message DateList {
+  repeated DateProto values = 1;
+}
+
 // Next: 22
 enum ProcessedActionStatusProto {
   UNKNOWN_ACTION_STATUS = 0;
@@ -244,3 +249,29 @@
   // A unique identifier for this user action.
   optional string identifier = 3;
 }
+
+message DateProto {
+  optional int64 year = 1;
+
+  // Month of the year in the range [1-12].
+  optional int32 month = 2;
+
+  // Day of the month in the range [1-31].
+  optional int32 day = 3;
+}
+
+message TimeProto {
+  // Hour in the range [0-23].
+  optional int32 hour = 1;
+
+  // Minute in the range [0-59].
+  optional int32 minute = 2;
+
+  // Second in the range [0-59].
+  optional int32 second = 3;
+}
+
+message DateTimeProto {
+  optional DateProto date = 1;
+  optional TimeProto time = 2;
+}
diff --git a/components/autofill_assistant/browser/service.proto b/components/autofill_assistant/browser/service.proto
index 814dd0b..068b88a 100644
--- a/components/autofill_assistant/browser/service.proto
+++ b/components/autofill_assistant/browser/service.proto
@@ -1424,32 +1424,6 @@
   reserved 1;  // stop_action_type
 }
 
-message DateProto {
-  optional int64 year = 1;
-
-  // Month of the year in the range [1-12].
-  optional int32 month = 2;
-
-  // Day of the month in the range [1-31].
-  optional int32 day = 3;
-}
-
-message TimeProto {
-  // Hour in the range [0-23].
-  optional int32 hour = 1;
-
-  // Minute in the range [0-59].
-  optional int32 minute = 2;
-
-  // Second in the range [0-59].
-  optional int32 second = 3;
-}
-
-message DateTimeProto {
-  optional DateProto date = 1;
-  optional TimeProto time = 2;
-}
-
 message DetailsChangesProto {
   // Whether the changes require user approval. This de-emphasize
   // non-highlighted fields.
diff --git a/components/autofill_assistant/browser/value_util.cc b/components/autofill_assistant/browser/value_util.cc
index 299c83b0..d32b7dd 100644
--- a/components/autofill_assistant/browser/value_util.cc
+++ b/components/autofill_assistant/browser/value_util.cc
@@ -49,6 +49,8 @@
       return value_a.ints().values() == value_b.ints().values();
     case ValueProto::kUserActions:
       return value_a.user_actions().values() == value_b.user_actions().values();
+    case ValueProto::kDates:
+      return value_a.dates().values() == value_b.dates().values();
     case ValueProto::KIND_NOT_SET:
       return true;
   }
@@ -89,6 +91,12 @@
          value_a.identifier() == value_b.identifier();
 }
 
+// Compares two |DateProto| instances and returns true if they exactly match.
+bool operator==(const DateProto& value_a, const DateProto& value_b) {
+  return value_a.year() == value_b.year() &&
+         value_a.month() == value_b.month() && value_a.day() == value_b.day();
+}
+
 // Intended for debugging. Writes a string representation of |values| to |out|.
 template <typename T>
 std::ostream& WriteRepeatedField(std::ostream& out, const T& values) {
@@ -122,6 +130,12 @@
   return out;
 }
 
+// Intended for debugging. '<<' operator specialization for DateProto.
+std::ostream& operator<<(std::ostream& out, const DateProto& value) {
+  out << value.year() << "-" << value.month() << "-" << value.day();
+  return out;
+}
+
 // Intended for debugging.  Writes a string representation of |value| to |out|.
 std::ostream& operator<<(std::ostream& out, const ValueProto& value) {
   switch (value.kind_case()) {
@@ -137,6 +151,9 @@
     case ValueProto::kUserActions:
       out << value.user_actions().values();
       break;
+    case ValueProto::kDates:
+      out << value.dates().values();
+      break;
     case ValueProto::KIND_NOT_SET:
       break;
   }
@@ -169,6 +186,15 @@
   return value;
 }
 
+ValueProto SimpleValue(const DateProto& proto) {
+  ValueProto value;
+  auto* date = value.mutable_dates()->add_values();
+  date->set_year(proto.year());
+  date->set_month(proto.month());
+  date->set_day(proto.day());
+  return value;
+}
+
 ModelProto::ModelValue SimpleModelValue(const std::string& identifier,
                                         const ValueProto& value) {
   ModelProto::ModelValue model_value;
@@ -213,6 +239,10 @@
         if (value.user_actions().values_size() != target_size)
           return false;
         break;
+      case ValueProto::kDates:
+        if (value.dates().values_size() != target_size)
+          return false;
+        break;
       case ValueProto::KIND_NOT_SET:
         if (target_size != 0) {
           return false;
@@ -261,6 +291,12 @@
                         *result.mutable_user_actions()->add_values() = action;
                       });
         break;
+      case ValueProto::kDates:
+        std::for_each(value.dates().values().begin(),
+                      value.dates().values().end(), [&](const auto& date) {
+                        *result.mutable_dates()->add_values() = date;
+                      });
+        break;
       case ValueProto::KIND_NOT_SET:
         NOTREACHED();
         return base::nullopt;
diff --git a/components/autofill_assistant/browser/value_util.h b/components/autofill_assistant/browser/value_util.h
index 24931a7..0dc557d 100644
--- a/components/autofill_assistant/browser/value_util.h
+++ b/components/autofill_assistant/browser/value_util.h
@@ -31,16 +31,21 @@
 // Custom comparison operator for |UserActionProto|.
 bool operator==(const UserActionProto& value_a, const UserActionProto& value_b);
 
+// Custom comparison operator for |DateProto|.
+bool operator==(const DateProto& value_a, const DateProto& value_b);
+
 // Intended for debugging.
 std::ostream& operator<<(std::ostream& out, const ValueProto& value);
 std::ostream& operator<<(std::ostream& out,
                          const ModelProto::ModelValue& value);
 std::ostream& operator<<(std::ostream& out, const UserActionProto& value);
+std::ostream& operator<<(std::ostream& out, const DateProto& value);
 
 // Convenience constructors.
 ValueProto SimpleValue(bool value);
 ValueProto SimpleValue(const std::string& value);
 ValueProto SimpleValue(int value);
+ValueProto SimpleValue(const DateProto& value);
 ModelProto::ModelValue SimpleModelValue(const std::string& identifier,
                                         const ValueProto& value);
 
diff --git a/components/autofill_assistant/browser/value_util_unittest.cc b/components/autofill_assistant/browser/value_util_unittest.cc
index 83c4326..bd4ced1 100644
--- a/components/autofill_assistant/browser/value_util_unittest.cc
+++ b/components/autofill_assistant/browser/value_util_unittest.cc
@@ -9,38 +9,48 @@
 
 namespace value_util {
 
+namespace {
+ValueProto CreateStringValue() {
+  ValueProto value;
+  value.mutable_strings()->add_values("Aurea prima");
+  value.mutable_strings()->add_values("sata est,");
+  value.mutable_strings()->add_values("aetas quae");
+  value.mutable_strings()->add_values("vindice nullo");
+  value.mutable_strings()->add_values("ü万𠜎");
+  return value;
+}
+
+ValueProto CreateIntValue() {
+  ValueProto value;
+  value.mutable_ints()->add_values(1);
+  value.mutable_ints()->add_values(123);
+  value.mutable_ints()->add_values(5);
+  value.mutable_ints()->add_values(-132);
+  return value;
+}
+
+ValueProto CreateBoolValue() {
+  ValueProto value;
+  value.mutable_booleans()->add_values(true);
+  value.mutable_booleans()->add_values(false);
+  value.mutable_booleans()->add_values(true);
+  value.mutable_booleans()->add_values(true);
+  return value;
+}
+
+DateProto CreateDateProto(int year, int month, int day) {
+  DateProto proto;
+  proto.set_year(year);
+  proto.set_month(month);
+  proto.set_day(day);
+  return proto;
+}
+}  // namespace
+
 class ValueUtilTest : public testing::Test {
  public:
   ValueUtilTest() = default;
   ~ValueUtilTest() override {}
-
-  ValueProto CreateStringValue() const {
-    ValueProto value;
-    value.mutable_strings()->add_values("Aurea prima");
-    value.mutable_strings()->add_values("sata est,");
-    value.mutable_strings()->add_values("aetas quae");
-    value.mutable_strings()->add_values("vindice nullo");
-    value.mutable_strings()->add_values("ü万𠜎");
-    return value;
-  }
-
-  ValueProto CreateIntValue() const {
-    ValueProto value;
-    value.mutable_ints()->add_values(1);
-    value.mutable_ints()->add_values(123);
-    value.mutable_ints()->add_values(5);
-    value.mutable_ints()->add_values(-132);
-    return value;
-  }
-
-  ValueProto CreateBoolValue() const {
-    ValueProto value;
-    value.mutable_booleans()->add_values(true);
-    value.mutable_booleans()->add_values(false);
-    value.mutable_booleans()->add_values(true);
-    value.mutable_booleans()->add_values(true);
-    return value;
-  }
 };
 
 TEST_F(ValueUtilTest, DifferentTypesComparison) {
@@ -48,18 +58,24 @@
   ValueProto value_b = CreateStringValue();
   ValueProto value_c = CreateIntValue();
   ValueProto value_d = CreateBoolValue();
+  ValueProto value_e = SimpleValue(CreateDateProto(2020, 8, 30));
 
   EXPECT_FALSE(value_a == value_b);
   EXPECT_FALSE(value_a == value_c);
   EXPECT_FALSE(value_a == value_d);
+  EXPECT_FALSE(value_a == value_e);
   EXPECT_FALSE(value_b == value_c);
   EXPECT_FALSE(value_b == value_d);
+  EXPECT_FALSE(value_b == value_e);
   EXPECT_FALSE(value_c == value_d);
+  EXPECT_FALSE(value_c == value_e);
+  EXPECT_FALSE(value_d == value_e);
 
   EXPECT_TRUE(value_a == value_a);
   EXPECT_TRUE(value_b == value_b);
   EXPECT_TRUE(value_c == value_c);
   EXPECT_TRUE(value_d == value_d);
+  EXPECT_TRUE(value_e == value_e);
 }
 
 TEST_F(ValueUtilTest, EmptyValueComparison) {
@@ -120,6 +136,19 @@
   EXPECT_TRUE(value_a == value_b);
 }
 
+TEST_F(ValueUtilTest, DateComparison) {
+  ValueProto value_a = SimpleValue(CreateDateProto(2020, 4, 18));
+  ValueProto value_b = value_a;
+  EXPECT_TRUE(value_a == value_b);
+
+  *value_a.mutable_dates()->add_values() = CreateDateProto(2020, 6, 14);
+  *value_b.mutable_dates()->add_values() = CreateDateProto(2020, 6, 15);
+  EXPECT_FALSE(value_a == value_b);
+
+  *value_b.mutable_dates()->mutable_values(1) = CreateDateProto(2020, 6, 14);
+  EXPECT_TRUE(value_a == value_b);
+}
+
 TEST_F(ValueUtilTest, AreAllValuesOfType) {
   ValueProto value_a;
   ValueProto value_b;
diff --git a/components/external_intents/android/BUILD.gn b/components/external_intents/android/BUILD.gn
index 95cdbf1..f12ab019 100644
--- a/components/external_intents/android/BUILD.gn
+++ b/components/external_intents/android/BUILD.gn
@@ -7,6 +7,7 @@
 android_library("java") {
   sources = [
     "java/src/org/chromium/components/external_intents/ExternalIntentsSwitches.java",
+    "java/src/org/chromium/components/external_intents/ExternalNavigationParams.java",
     "java/src/org/chromium/components/external_intents/RedirectHandler.java",
   ]
 }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationParams.java b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationParams.java
similarity index 97%
rename from chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationParams.java
rename to components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationParams.java
index ef3f78c..f4d40512 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/externalnav/ExternalNavigationParams.java
+++ b/components/external_intents/android/java/src/org/chromium/components/external_intents/ExternalNavigationParams.java
@@ -2,9 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-package org.chromium.chrome.browser.externalnav;
-
-import org.chromium.components.external_intents.RedirectHandler;
+package org.chromium.components.external_intents;
 
 /**
  * A container object for passing navigation parameters to {@link ExternalNavigationHandler}.
@@ -254,7 +252,8 @@
             return this;
         }
 
-        /** Sets whether the current tab should be closed when an URL load was overridden and an
+        /**
+         * Sets whether the current tab should be closed when an URL load was overridden and an
          * intent launched.
          */
         public Builder setShouldCloseContentsOnOverrideUrlLoadingAndLaunchIntent(boolean v) {
diff --git a/components/password_manager/core/browser/ui/saved_passwords_presenter.cc b/components/password_manager/core/browser/ui/saved_passwords_presenter.cc
index 70ead42..c725d03 100644
--- a/components/password_manager/core/browser/ui/saved_passwords_presenter.cc
+++ b/components/password_manager/core/browser/ui/saved_passwords_presenter.cc
@@ -5,9 +5,11 @@
 #include "components/password_manager/core/browser/ui/saved_passwords_presenter.h"
 
 #include <algorithm>
+#include <memory>
 #include <utility>
 
 #include "base/logging.h"
+#include "base/stl_util.h"
 #include "base/strings/string16.h"
 #include "components/autofill/core/common/password_form.h"
 
@@ -74,6 +76,11 @@
 
 void SavedPasswordsPresenter::OnGetPasswordStoreResults(
     std::vector<std::unique_ptr<autofill::PasswordForm>> results) {
+  // Ignore blacklisted or federated credentials.
+  base::EraseIf(results, [](const auto& form) {
+    return form->blacklisted_by_user || form->IsFederatedCredential();
+  });
+
   passwords_.resize(results.size());
   std::transform(results.begin(), results.end(), passwords_.begin(),
                  [](auto& result) { return std::move(*result); });
diff --git a/components/password_manager/core/browser/ui/saved_passwords_presenter_unittest.cc b/components/password_manager/core/browser/ui/saved_passwords_presenter_unittest.cc
index 480d699..1280e0b 100644
--- a/components/password_manager/core/browser/ui/saved_passwords_presenter_unittest.cc
+++ b/components/password_manager/core/browser/ui/saved_passwords_presenter_unittest.cc
@@ -5,6 +5,7 @@
 #include "components/password_manager/core/browser/ui/saved_passwords_presenter.h"
 
 #include "base/memory/scoped_refptr.h"
+#include "base/scoped_observer.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/test/task_environment.h"
 #include "components/autofill/core/common/password_form.h"
@@ -87,6 +88,30 @@
   EXPECT_FALSE(store().IsEmpty());
 }
 
+// Tests whether adding and removing an observer works as expected.
+TEST_F(SavedPasswordsPresenterTest, IgnoredCredentials) {
+  PasswordForm federated_form;
+  federated_form.federation_origin =
+      url::Origin::Create(GURL("https://example.com"));
+
+  StrictMockSavedPasswordsPresenterObserver observer;
+  presenter().AddObserver(&observer);
+
+  // Adding a credential should notify observers. However, since federated
+  // credentials should be ignored it should not be passed a long.
+  EXPECT_CALL(observer, OnSavedPasswordsChanged(IsEmpty()));
+  store().AddLogin(federated_form);
+  RunUntilIdle();
+
+  PasswordForm blacklisted_form;
+  blacklisted_form.blacklisted_by_user = true;
+  EXPECT_CALL(observer, OnSavedPasswordsChanged(IsEmpty()));
+  store().AddLogin(blacklisted_form);
+  RunUntilIdle();
+
+  presenter().RemoveObserver(&observer);
+}
+
 // Tests whether editing a password works and results in the right
 // notifications.
 TEST_F(SavedPasswordsPresenterTest, EditPassword) {
diff --git a/components/sync/syncable/syncable_base_transaction.cc b/components/sync/syncable/syncable_base_transaction.cc
index d66c221d..4caaa24 100644
--- a/components/sync/syncable/syncable_base_transaction.cc
+++ b/components/sync/syncable/syncable_base_transaction.cc
@@ -19,14 +19,16 @@
   return directory_;
 }
 
-void BaseTransaction::Lock() {
+void BaseTransaction::Lock()
+    EXCLUSIVE_LOCK_FUNCTION(directory_->kernel()->transaction_mutex) {
   TRACE_EVENT2("sync_lock_contention", "AcquireLock", "src_file",
                from_here_.file_name(), "src_func", from_here_.function_name());
 
   directory_->kernel()->transaction_mutex.Acquire();
 }
 
-void BaseTransaction::Unlock() {
+void BaseTransaction::Unlock()
+    UNLOCK_FUNCTION(directory_->kernel()->transaction_mutex) {
   directory_->kernel()->transaction_mutex.Release();
 }
 
diff --git a/components/viz/common/gpu/context_cache_controller.cc b/components/viz/common/gpu/context_cache_controller.cc
index e629ea1..08c1b960 100644
--- a/components/viz/common/gpu/context_cache_controller.cc
+++ b/components/viz/common/gpu/context_cache_controller.cc
@@ -5,6 +5,7 @@
 #include "components/viz/common/gpu/context_cache_controller.h"
 
 #include <chrono>
+#include <utility>
 
 #include "base/bind.h"
 #include "base/logging.h"
@@ -161,7 +162,8 @@
   ++current_idle_generation_;
 }
 
-void ContextCacheController::OnIdle(uint32_t idle_generation) {
+void ContextCacheController::OnIdle(uint32_t idle_generation)
+    NO_THREAD_SAFETY_ANALYSIS {
   // First check if we should run our idle callback at all. If we have become
   // busy since scheduling, just schedule another idle callback and return.
   {
@@ -175,6 +177,8 @@
   // Try to acquire the context lock - if we can't acquire it then we've become
   // busy since checking |current_idle_generation_| above. In this case, just
   // re-post our idle callback and return.
+  //
+  // NO_THREAD_SAFETY_ANALYSIS: Locking depends on runtime properties.
   if (context_lock_ && !context_lock_->Try()) {
     base::AutoLock hold(current_idle_generation_lock_);
     PostIdleCallback(current_idle_generation_);
diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
index 962d24e..e10cad9 100644
--- a/content/browser/BUILD.gn
+++ b/content/browser/BUILD.gn
@@ -43,7 +43,7 @@
   deps = [
     "//base",
     "//base:base_static",
-    "//base:clang_profiling_buildflags",
+    "//base:clang_coverage_buildflags",
     "//base/third_party/dynamic_annotations",
     "//build:branding_buildflags",
     "//cc",
diff --git a/content/browser/accessibility/accessibility_action_browsertest.cc b/content/browser/accessibility/accessibility_action_browsertest.cc
index 4ac8fb3..323ee349 100644
--- a/content/browser/accessibility/accessibility_action_browsertest.cc
+++ b/content/browser/accessibility/accessibility_action_browsertest.cc
@@ -516,7 +516,8 @@
   target_node->AccessibilityPerformAction(context_menu_action);
   context_menu_filter->Wait();
 
-  ContextMenuParams context_menu_params = context_menu_filter->get_params();
+  UntrustworthyContextMenuParams context_menu_params =
+      context_menu_filter->get_params();
   EXPECT_EQ(base::ASCIIToUTF16("2"), context_menu_params.link_text);
   EXPECT_EQ(ui::MenuSourceType::MENU_SOURCE_NONE,
             context_menu_params.source_type);
diff --git a/content/browser/accessibility/browser_accessibility_manager.cc b/content/browser/accessibility/browser_accessibility_manager.cc
index 634b331..6267ba5 100644
--- a/content/browser/accessibility/browser_accessibility_manager.cc
+++ b/content/browser/accessibility/browser_accessibility_manager.cc
@@ -279,6 +279,11 @@
     return;
   }
 
+  // Wait until navigation is complete or stopped, before attempting to move the
+  // accessibility focus.
+  if (user_is_navigating_away_)
+    return;
+
   BrowserAccessibility* last_focused_node = GetLastFocusedNode();
   if (focus != last_focused_node)
     FireFocusEvent(focus);
@@ -356,14 +361,17 @@
 
 void BrowserAccessibilityManager::NavigationSucceeded() {
   user_is_navigating_away_ = false;
+  FireFocusEventsIfNeeded();
 }
 
 void BrowserAccessibilityManager::NavigationFailed() {
   user_is_navigating_away_ = false;
+  FireFocusEventsIfNeeded();
 }
 
 void BrowserAccessibilityManager::DidStopLoading() {
   user_is_navigating_away_ = false;
+  FireFocusEventsIfNeeded();
 }
 
 bool BrowserAccessibilityManager::UseRootScrollOffsetsWhenComputingBounds() {
diff --git a/content/browser/accessibility/browser_accessibility_manager_win.cc b/content/browser/accessibility/browser_accessibility_manager_win.cc
index 1456233..d7ebc88 100644
--- a/content/browser/accessibility/browser_accessibility_manager_win.cc
+++ b/content/browser/accessibility/browser_accessibility_manager_win.cc
@@ -577,13 +577,9 @@
 }
 
 bool BrowserAccessibilityManagerWin::CanFireEvents() const {
-  if (!BrowserAccessibilityManager::CanFireEvents())
-    return false;
-  BrowserAccessibilityDelegate* root_delegate = GetDelegateFromRootManager();
-  if (!root_delegate)
-    return false;
-  HWND hwnd = root_delegate->AccessibilityGetAcceleratedWidget();
-  return hwnd != nullptr;
+  return BrowserAccessibilityManager::CanFireEvents() &&
+         GetDelegateFromRootManager() &&
+         GetDelegateFromRootManager()->AccessibilityGetAcceleratedWidget();
 }
 
 gfx::Rect BrowserAccessibilityManagerWin::GetViewBounds() {
diff --git a/content/browser/browser_process_sub_thread.cc b/content/browser/browser_process_sub_thread.cc
index f7c731e..70dd877 100644
--- a/content/browser/browser_process_sub_thread.cc
+++ b/content/browser/browser_process_sub_thread.cc
@@ -5,7 +5,7 @@
 #include "content/browser/browser_process_sub_thread.h"
 
 #include "base/bind.h"
-#include "base/clang_profiling_buildflags.h"
+#include "base/clang_coverage_buildflags.h"
 #include "base/compiler_specific.h"
 #include "base/debug/alias.h"
 #include "base/metrics/histogram_macros.h"
@@ -162,8 +162,8 @@
         service_manager::SandboxType::kNetwork) {
       // This ensures that cookies and cache are flushed to disk on shutdown.
       // https://crbug.com/841001
-#if BUILDFLAG(CLANG_PROFILING)
-      // On profiling build, browser_tests runs 10x slower.
+#if BUILDFLAG(CLANG_COVERAGE)
+      // On coverage build, browser_tests runs 10x slower.
       const int kMaxSecondsToWaitForNetworkProcess = 100;
 #elif defined(OS_CHROMEOS)
       // ChromeOS will kill the browser process if it doesn't shut down within
diff --git a/content/browser/child_process_launcher.cc b/content/browser/child_process_launcher.cc
index 57d627b..757a82d 100644
--- a/content/browser/child_process_launcher.cc
+++ b/content/browser/child_process_launcher.cc
@@ -7,7 +7,7 @@
 #include <utility>
 
 #include "base/bind.h"
-#include "base/clang_profiling_buildflags.h"
+#include "base/clang_coverage_buildflags.h"
 #include "base/command_line.h"
 #include "base/files/file_util.h"
 #include "base/i18n/icu_util.h"
@@ -43,7 +43,7 @@
       start_time_(base::TimeTicks::Now()),
 #if defined(ADDRESS_SANITIZER) || defined(LEAK_SANITIZER) ||  \
     defined(MEMORY_SANITIZER) || defined(THREAD_SANITIZER) || \
-    defined(UNDEFINED_SANITIZER) || BUILDFLAG(CLANG_PROFILING)
+    defined(UNDEFINED_SANITIZER) || BUILDFLAG(CLANG_COVERAGE)
       terminate_child_on_shutdown_(false)
 #else
       terminate_child_on_shutdown_(terminate_on_shutdown)
diff --git a/content/browser/child_process_task_port_provider_mac_unittest.cc b/content/browser/child_process_task_port_provider_mac_unittest.cc
index ed599f76..3f0c02d2 100644
--- a/content/browser/child_process_task_port_provider_mac_unittest.cc
+++ b/content/browser/child_process_task_port_provider_mac_unittest.cc
@@ -8,7 +8,7 @@
 
 #include <vector>
 
-#include "base/clang_profiling_buildflags.h"
+#include "base/clang_coverage_buildflags.h"
 #include "base/mac/scoped_mach_port.h"
 #include "base/synchronization/waitable_event.h"
 #include "base/task/post_task.h"
@@ -35,8 +35,8 @@
 #if BUILDFLAG(IPC_MESSAGE_LOG_ENABLED)
   MOCK_METHOD1(SetIPCLoggingEnabled, void(bool));
 #endif
-#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
-  MOCK_METHOD1(SetProfilingFile, void(base::File));
+#if BUILDFLAG(CLANG_COVERAGE_INSIDE_SANDBOX)
+  MOCK_METHOD1(SetCoverageFile, void(base::File));
 #endif
   MOCK_METHOD1(GetBackgroundTracingAgentProvider,
                void(mojo::PendingReceiver<
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index ecc4d59..0d33a622 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -2911,17 +2911,20 @@
   subframe_unload_timeout_ = timeout;
 }
 
-void RenderFrameHostImpl::OnContextMenu(const ContextMenuParams& params) {
+void RenderFrameHostImpl::OnContextMenu(
+    const UntrustworthyContextMenuParams& params) {
   if (!is_active())
     return;
 
   // Validate the URLs in |params|.  If the renderer can't request the URLs
   // directly, don't show them in the context menu.
   ContextMenuParams validated_params(params);
-  RenderProcessHost* process = GetProcess();
+  validated_params.frame_url = GetLastCommittedURL();
+  validated_params.page_url = GetMainFrame()->GetLastCommittedURL();
 
   // We don't validate |unfiltered_link_url| so that this field can be used
   // when users want to copy the original link URL.
+  RenderProcessHost* process = GetProcess();
   process->FilterURL(true, &validated_params.link_url);
   process->FilterURL(true, &validated_params.src_url);
   process->FilterURL(false, &validated_params.page_url);
@@ -3106,8 +3109,8 @@
 
 void RenderFrameHostImpl::Are3DAPIsBlocked(Are3DAPIsBlockedCallback callback) {
   bool blocked = GpuDataManagerImpl::GetInstance()->Are3DAPIsBlocked(
-      frame_tree_node_->frame_tree()->GetMainFrame()->GetLastCommittedURL(),
-      GetProcess()->GetID(), GetRoutingID(), THREE_D_API_TYPE_WEBGL);
+      GetMainFrame()->GetLastCommittedURL(), GetProcess()->GetID(),
+      GetRoutingID(), THREE_D_API_TYPE_WEBGL);
   std::move(callback).Run(blocked);
 }
 
@@ -3759,10 +3762,7 @@
   return static_cast<RenderWidgetHostViewBase*>(
       frame_tree_node_->IsMainFrame()
           ? render_view_host_->GetWidget()->GetView()
-          : frame_tree_node_->frame_tree()
-                ->GetMainFrame()
-                ->render_view_host_->GetWidget()
-                ->GetView());
+          : GetMainFrame()->render_view_host_->GetWidget()->GetView());
 }
 
 void RenderFrameHostImpl::OnAccessibilityEvents(
@@ -4435,8 +4435,7 @@
   bool can_create_window =
       IsCurrent() && render_frame_created_ &&
       GetContentClient()->browser()->CanCreateWindow(
-          this, GetLastCommittedURL(),
-          frame_tree_node_->frame_tree()->GetMainFrame()->GetLastCommittedURL(),
+          this, GetLastCommittedURL(), GetMainFrame()->GetLastCommittedURL(),
           last_committed_origin_, params->window_container_type,
           params->target_url, params->referrer.To<Referrer>(),
           params->frame_name, params->disposition, *params->features,
@@ -4488,10 +4487,7 @@
     // are same origin, then the popup's initial empty document inherits its
     // COOP policy from the opener's top-level document. See
     // https://gist.github.com/annevk/6f2dd8c79c77123f39797f6bdac43f3e#model
-    RenderFrameHostImpl* top_level_opener = this;
-    while (top_level_opener->GetParent()) {
-      top_level_opener = top_level_opener->GetParent();
-    }
+    RenderFrameHostImpl* top_level_opener = GetMainFrame();
     // Verify that they are same origin.
     if (top_level_opener->GetLastCommittedOrigin().IsSameOriginWith(
             GetLastCommittedOrigin())) {
@@ -4849,8 +4845,7 @@
   // (e.g. "http://localhost"). In such cases, don't verify the URL, but require
   // the URL to commit in the process of the main frame.
   if (!frame_tree_node()->IsMainFrame()) {
-    RenderFrameHostImpl* main_frame =
-        frame_tree_node()->frame_tree()->GetMainFrame();
+    RenderFrameHostImpl* main_frame = GetMainFrame();
     if (main_frame->is_mhtml_document()) {
       if (IsSameSiteInstance(main_frame))
         return CanCommitStatus::CAN_COMMIT_ORIGIN_AND_URL;
@@ -5289,8 +5284,7 @@
   // All children of MHTML documents must be MHTML documents.
   // As a defensive measure, crash the browser if something went wrong.
   if (!frame_tree_node()->IsMainFrame()) {
-    RenderFrameHostImpl* root =
-        frame_tree_node()->frame_tree()->root()->current_frame_host();
+    RenderFrameHostImpl* root = GetMainFrame();
     if (root->is_mhtml_document_ &&
         !common_params->url.SchemeIs(url::kDataScheme)) {
       bool loaded_from_outside_the_archive =
@@ -6209,6 +6203,17 @@
   return has_selection_;
 }
 
+RenderFrameHostImpl* RenderFrameHostImpl::GetMainFrame() {
+  // Iteration over the GetParent() chain is used below, because returning
+  // |frame_tree_node()->frame_tree()->root()->current_frame_host()| might
+  // give an incorrect result after |this| has been detached from the frame
+  // tree.
+  RenderFrameHostImpl* main_frame = this;
+  while (main_frame->GetParent())
+    main_frame = main_frame->GetParent();
+  return main_frame;
+}
+
 #if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
 #if defined(OS_MACOSX)
 
@@ -6834,10 +6839,8 @@
 
 void RenderFrameHostImpl::BindSmsReceiverReceiver(
     mojo::PendingReceiver<blink::mojom::SmsReceiver> receiver) {
-  if (GetParent() && !WebContents::FromRenderFrameHost(this)
-                          ->GetMainFrame()
-                          ->GetLastCommittedOrigin()
-                          .IsSameOriginWith(GetLastCommittedOrigin())) {
+  if (GetParent() && !GetMainFrame()->GetLastCommittedOrigin().IsSameOriginWith(
+                         GetLastCommittedOrigin())) {
     mojo::ReportBadMessage("Must have the same origin as the top-level frame.");
     return;
   }
diff --git a/content/browser/frame_host/render_frame_host_impl.h b/content/browser/frame_host/render_frame_host_impl.h
index 637e71f..7ae1272c4 100644
--- a/content/browser/frame_host/render_frame_host_impl.h
+++ b/content/browser/frame_host/render_frame_host_impl.h
@@ -208,7 +208,7 @@
 class WebAuthRequestSecurityChecker;
 class WebBluetoothServiceImpl;
 class WebBundleHandle;
-struct ContextMenuParams;
+struct UntrustworthyContextMenuParams;
 struct PendingNavigation;
 struct ResourceTimingInfo;
 struct SubresourceLoaderParams;
@@ -1584,7 +1584,7 @@
   void OnOpenURL(const FrameHostMsg_OpenURL_Params& params);
   void OnUpdateState(const PageState& state);
   void OnUnloadACK();
-  void OnContextMenu(const ContextMenuParams& params);
+  void OnContextMenu(const UntrustworthyContextMenuParams& params);
   void OnVisualStateResponse(uint64_t id);
   void OnDidChangeOpener(int32_t opener_routing_id);
 
@@ -2106,6 +2106,9 @@
   // See |SetIsXrOverlaySetup()|
   bool HasSeenRecentXrOverlaySetup();
 
+  // Follows the GetParent() chain to find and return the main frame.
+  RenderFrameHostImpl* GetMainFrame();
+
   // The RenderViewHost that this RenderFrameHost is associated with.
   //
   // It is kept alive as long as any RenderFrameHosts or RenderFrameProxyHosts
diff --git a/content/browser/renderer_host/render_process_host_impl.cc b/content/browser/renderer_host/render_process_host_impl.cc
index ceb94cf..c725561 100644
--- a/content/browser/renderer_host/render_process_host_impl.cc
+++ b/content/browser/renderer_host/render_process_host_impl.cc
@@ -19,7 +19,7 @@
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/callback.h"
-#include "base/clang_profiling_buildflags.h"
+#include "base/clang_coverage_buildflags.h"
 #include "base/command_line.h"
 #include "base/containers/adapters.h"
 #include "base/debug/alias.h"
@@ -293,8 +293,8 @@
 #include "services/service_manager/zygote/common/zygote_handle.h"  // nogncheck
 #endif
 
-#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
-#include "content/common/profiling_utils.h"
+#if BUILDFLAG(CLANG_COVERAGE_INSIDE_SANDBOX)
+#include "content/common/coverage_utils.h"
 #endif
 
 namespace content {
@@ -3580,8 +3580,8 @@
   child_process_->SetIPCLoggingEnabled(IPC::Logging::GetInstance()->Enabled());
 #endif
 
-#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
-  child_process_->SetProfilingFile(OpenProfilingFile());
+#if BUILDFLAG(CLANG_COVERAGE_INSIDE_SANDBOX)
+  child_process_->SetCoverageFile(OpenCoverageFile());
 #endif
 }
 
diff --git a/content/browser/renderer_host/text_input_client_mac.h b/content/browser/renderer_host/text_input_client_mac.h
index 8165445..4c43db5 100644
--- a/content/browser/renderer_host/text_input_client_mac.h
+++ b/content/browser/renderer_host/text_input_client_mac.h
@@ -121,10 +121,10 @@
   // These methods lock the internal condition for use before the asynchronous
   // message is sent to the renderer to lookup the required information. These
   // are only used on the UI thread.
-  void BeforeRequest();
+  void BeforeRequest() EXCLUSIVE_LOCK_FUNCTION(lock_);
   // Called at the end of a critical section. This will release the lock and
   // condition.
-  void AfterRequest();
+  void AfterRequest() UNLOCK_FUNCTION(lock_);
 
   uint32_t character_index_;
   gfx::Rect first_rect_;
diff --git a/content/child/child_thread_impl.cc b/content/child/child_thread_impl.cc
index 36574e6..921dcd8 100644
--- a/content/child/child_thread_impl.cc
+++ b/content/child/child_thread_impl.cc
@@ -10,7 +10,7 @@
 
 #include "base/base_switches.h"
 #include "base/bind.h"
-#include "base/clang_profiling_buildflags.h"
+#include "base/clang_coverage_buildflags.h"
 #include "base/command_line.h"
 #include "base/compiler_specific.h"
 #include "base/debug/alias.h"
@@ -84,7 +84,7 @@
 #include "base/mac/mach_port_rendezvous.h"
 #endif
 
-#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
+#if BUILDFLAG(CLANG_COVERAGE_INSIDE_SANDBOX)
 #include <stdio.h>
 #if defined(OS_WIN)
 #include <io.h>
@@ -372,8 +372,8 @@
                                   weak_main_thread_, std::move(receiver)));
   }
 
-#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
-  void SetProfilingFile(base::File file) override {
+#if BUILDFLAG(CLANG_COVERAGE_INSIDE_SANDBOX)
+  void SetCoverageFile(base::File file) override {
     // TODO(crbug.com/985574) Remove Android check when possible.
 #if defined(OS_POSIX) && !defined(OS_ANDROID)
     // Take the file descriptor so that |file| does not close it.
diff --git a/content/common/BUILD.gn b/content/common/BUILD.gn
index af7b2f3..35eb5cde 100644
--- a/content/common/BUILD.gn
+++ b/content/common/BUILD.gn
@@ -411,10 +411,10 @@
     deps += [ "//third_party/fuchsia-sdk/sdk/pkg/fdio" ]
   }
 
-  if (use_clang_profiling_inside_sandbox) {
+  if (use_clang_coverage_inside_sandbox) {
     sources += [
-      "profiling_utils.cc",
-      "profiling_utils.h",
+      "coverage_utils.cc",
+      "coverage_utils.h",
     ]
   }
 }
@@ -476,8 +476,8 @@
   if (is_linux || is_chromeos) {
     enabled_features += [ "supports_thread_priorities" ]
   }
-  if (use_clang_profiling_inside_sandbox) {
-    enabled_features += [ "clang_profiling_inside_sandbox" ]
+  if (use_clang_coverage_inside_sandbox) {
+    enabled_features += [ "clang_coverage_inside_sandbox" ]
   }
 
   import_dirs = [ "//mojo/services" ]
diff --git a/content/common/child_process.mojom b/content/common/child_process.mojom
index d85e2810..b981e6a 100644
--- a/content/common/child_process.mojom
+++ b/content/common/child_process.mojom
@@ -91,8 +91,7 @@
   // depends on the process type and potentially on the Content embedder.
   BindReceiver(mojo_base.mojom.GenericPendingReceiver receiver);
 
-  // Sets the profiling file for the child process.
-  // Used for the coverage builds.
-  [EnableIf=clang_profiling_inside_sandbox]
-  SetProfilingFile(mojo_base.mojom.File file);
+  // Sets the coverage file for the child process.
+  [EnableIf=clang_coverage_inside_sandbox]
+  SetCoverageFile(mojo_base.mojom.File file);
 };
diff --git a/content/common/child_process_host_impl.cc b/content/common/child_process_host_impl.cc
index 06f21f0..5543ebf 100644
--- a/content/common/child_process_host_impl.cc
+++ b/content/common/child_process_host_impl.cc
@@ -7,7 +7,7 @@
 #include <limits>
 
 #include "base/atomic_sequence_num.h"
-#include "base/clang_profiling_buildflags.h"
+#include "base/clang_coverage_buildflags.h"
 #include "base/command_line.h"
 #include "base/files/file.h"
 #include "base/files/file_path.h"
@@ -42,8 +42,8 @@
 #include "content/common/mac_helpers.h"
 #endif  // OS_LINUX
 
-#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
-#include "content/common/profiling_utils.h"
+#if BUILDFLAG(CLANG_COVERAGE_INSIDE_SANDBOX)
+#include "content/common/coverage_utils.h"
 #endif
 
 namespace {
@@ -207,8 +207,8 @@
   child_process_->SetIPCLoggingEnabled(enabled);
 #endif
 
-#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
-  child_process_->SetProfilingFile(OpenProfilingFile());
+#if BUILDFLAG(CLANG_COVERAGE_INSIDE_SANDBOX)
+  child_process_->SetCoverageFile(OpenCoverageFile());
 #endif
 
   opening_channel_ = true;
diff --git a/content/common/profiling_utils.cc b/content/common/coverage_utils.cc
similarity index 91%
rename from content/common/profiling_utils.cc
rename to content/common/coverage_utils.cc
index 48772eb..609f503 100644
--- a/content/common/profiling_utils.cc
+++ b/content/common/coverage_utils.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/common/profiling_utils.h"
+#include "content/common/coverage_utils.h"
 
 #include <memory>
 
@@ -23,7 +23,7 @@
 
 namespace content {
 
-base::File OpenProfilingFile() {
+base::File OpenCoverageFile() {
   base::ScopedAllowBlockingForTesting allows_blocking;
   std::unique_ptr<base::Environment> env(base::Environment::Create());
   std::string prof_template;
@@ -41,8 +41,6 @@
 
   // sajjadm@ and liaoyuke@ experimentally determined that a size 4 pool works
   // well for the coverage builder.
-  // TODO(https://crbug.com/1059335): Check if this is an appropriate value for
-  // the PGO builds.
   int pool_index = base::RandInt(0, 3);
   std::string filename = base::StrCat(
       {"child_pool-", base::NumberToString(pool_index), ".profraw"});
diff --git a/content/common/profiling_utils.h b/content/common/coverage_utils.h
similarity index 62%
rename from content/common/profiling_utils.h
rename to content/common/coverage_utils.h
index f9e6e17..24d8270 100644
--- a/content/common/profiling_utils.h
+++ b/content/common/coverage_utils.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_COMMON_PROFILING_UTILS_H_
-#define CONTENT_COMMON_PROFILING_UTILS_H_
+#ifndef CONTENT_COMMON_COVERAGE_UTILS_H_
+#define CONTENT_COMMON_COVERAGE_UTILS_H_
 
 #include <string>
 
@@ -11,8 +11,8 @@
 
 namespace content {
 
-base::File OpenProfilingFile();
+base::File OpenCoverageFile();
 
 }  // namespace content
 
-#endif  // CONTENT_COMMON_PROFILING_UTILS_H_
+#endif  // CONTENT_COMMON_COVERAGE_UTILS_H_
diff --git a/content/common/frame_messages.h b/content/common/frame_messages.h
index 6c56ac0..8b8cc90 100644
--- a/content/common/frame_messages.h
+++ b/content/common/frame_messages.h
@@ -158,7 +158,7 @@
   IPC_STRUCT_TRAITS_MEMBER(has_height)
 IPC_STRUCT_TRAITS_END()
 
-IPC_STRUCT_TRAITS_BEGIN(content::ContextMenuParams)
+IPC_STRUCT_TRAITS_BEGIN(content::UntrustworthyContextMenuParams)
   IPC_STRUCT_TRAITS_MEMBER(media_type)
   IPC_STRUCT_TRAITS_MEMBER(x)
   IPC_STRUCT_TRAITS_MEMBER(y)
@@ -168,8 +168,6 @@
   IPC_STRUCT_TRAITS_MEMBER(src_url)
   IPC_STRUCT_TRAITS_MEMBER(has_image_contents)
   IPC_STRUCT_TRAITS_MEMBER(properties)
-  IPC_STRUCT_TRAITS_MEMBER(page_url)
-  IPC_STRUCT_TRAITS_MEMBER(frame_url)
   IPC_STRUCT_TRAITS_MEMBER(media_flags)
   IPC_STRUCT_TRAITS_MEMBER(selection_text)
   IPC_STRUCT_TRAITS_MEMBER(title_text)
@@ -846,7 +844,8 @@
 // content area, and a context menu should be shown for it. The params
 // object contains information about the node(s) that were selected when the
 // user right clicked.
-IPC_MESSAGE_ROUTED1(FrameHostMsg_ContextMenu, content::ContextMenuParams)
+IPC_MESSAGE_ROUTED1(FrameHostMsg_ContextMenu,
+                    content::UntrustworthyContextMenuParams)
 
 // Notification that the text selection has changed.
 // Note: The second parameter is the character based offset of the
diff --git a/content/public/common/context_menu_params.cc b/content/public/common/context_menu_params.cc
index 8068258..524c40d 100644
--- a/content/public/common/context_menu_params.cc
+++ b/content/public/common/context_menu_params.cc
@@ -14,7 +14,7 @@
       render_widget_id(kCurrentRenderWidget) {
 }
 
-ContextMenuParams::ContextMenuParams()
+UntrustworthyContextMenuParams::UntrustworthyContextMenuParams()
     : media_type(blink::ContextMenuDataMediaType::kNone),
       x(0),
       y(0),
@@ -34,9 +34,17 @@
       input_field_type(blink::ContextMenuDataInputFieldType::kNone),
       selection_start_offset(0) {}
 
-ContextMenuParams::ContextMenuParams(const ContextMenuParams& other) = default;
+UntrustworthyContextMenuParams::UntrustworthyContextMenuParams(
+    const UntrustworthyContextMenuParams& other) = default;
 
-ContextMenuParams::~ContextMenuParams() {
-}
+UntrustworthyContextMenuParams::~UntrustworthyContextMenuParams() = default;
+
+ContextMenuParams::ContextMenuParams() = default;
+ContextMenuParams::ContextMenuParams(const ContextMenuParams& other) = default;
+ContextMenuParams::~ContextMenuParams() = default;
+
+ContextMenuParams::ContextMenuParams(
+    const UntrustworthyContextMenuParams& other)
+    : UntrustworthyContextMenuParams(other) {}
 
 }  // namespace content
diff --git a/content/public/common/context_menu_params.h b/content/public/common/context_menu_params.h
index 9006b9e..80afbaa 100644
--- a/content/public/common/context_menu_params.h
+++ b/content/public/common/context_menu_params.h
@@ -23,6 +23,8 @@
 
 namespace content {
 
+class RenderFrameHostImpl;
+
 struct CONTENT_EXPORT CustomContextMenuContext {
   static const int32_t kCurrentRenderWidget;
 
@@ -42,15 +44,14 @@
   GURL link_followed;
 };
 
-// FIXME(beng): This would be more useful in the future and more efficient
-//              if the parameters here weren't so literally mapped to what
-//              they contain for the ContextMenu task. It might be better
-//              to make the string fields more generic so that this object
-//              could be used for more contextual actions.
-struct CONTENT_EXPORT ContextMenuParams {
-  ContextMenuParams();
-  ContextMenuParams(const ContextMenuParams& other);
-  ~ContextMenuParams();
+// SECURITY NOTE: Data in this struct is untrustworthy, because it is sent in an
+// IPC from a renderer process.  The browser process should use
+// ContextMenuParams, after validating UntrustworthyContextMenuParams in an IPC
+// handling routine.
+struct CONTENT_EXPORT UntrustworthyContextMenuParams {
+  UntrustworthyContextMenuParams();
+  UntrustworthyContextMenuParams(const UntrustworthyContextMenuParams& other);
+  ~UntrustworthyContextMenuParams();
 
   // This is the type of Context Node that the context menu was invoked on.
   blink::ContextMenuDataMediaType media_type;
@@ -82,13 +83,6 @@
   // non-empty contents.
   bool has_image_contents;
 
-  // This is the URL of the top level page that the context menu was invoked
-  // on.
-  GURL page_url;
-
-  // This is the URL of the subframe that the context menu was invoked on.
-  GURL frame_url;
-
   // These are the parameters for the media element that the context menu
   // was invoked on.
   int media_flags;
@@ -158,6 +152,38 @@
   int selection_start_offset;
 };
 
+// FIXME(beng): This would be more useful in the future and more efficient
+//              if the parameters here weren't so literally mapped to what
+//              they contain for the ContextMenu task. It might be better
+//              to make the string fields more generic so that this object
+//              could be used for more contextual actions.
+//
+// SECURITY NOTE: This struct should be populated by the browser process,
+// after validating the IPC payload from UntrustworthyContextMenuParams.
+// Note that the fields declared in ContextMenuParams can be populated based on
+// the trustworthy, browser-side data (i.e. don't need to be sent over IPC and
+// therefore don't need to be covered by UntrustworthyContextMenuParams).
+struct CONTENT_EXPORT ContextMenuParams
+    : public UntrustworthyContextMenuParams {
+  ContextMenuParams();
+  ContextMenuParams(const ContextMenuParams& other);
+  ~ContextMenuParams();
+
+  // This is the URL of the top level page that the context menu was invoked
+  // on.
+  GURL page_url;
+
+  // This is the URL of the subframe that the context menu was invoked on.
+  GURL frame_url;
+
+ private:
+  // RenderFrameHostImpl is responsible for validating and sanitizing
+  // UntrustworthyContextMenuParams into ContextMenuParams and therefore is a
+  // friend.
+  friend class RenderFrameHostImpl;
+  explicit ContextMenuParams(const UntrustworthyContextMenuParams& other);
+};
+
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_COMMON_CONTEXT_MENU_PARAMS_H_
diff --git a/content/public/renderer/render_frame.h b/content/public/renderer/render_frame.h
index e7870c4..6ed21d3 100644
--- a/content/public/renderer/render_frame.h
+++ b/content/public/renderer/render_frame.h
@@ -37,34 +37,35 @@
 class WebPlugin;
 struct WebPluginParams;
 struct WebRect;
-}
+}  // namespace blink
 
 namespace gfx {
 class Range;
 class RectF;
 class Size;
-}
+}  // namespace gfx
 
 namespace network {
 class SharedURLLoaderFactory;
-}
+}  // namespace network
 
 namespace service_manager {
 class InterfaceProvider;
-}
+}  // namespace service_manager
 
 namespace url {
 class Origin;
-}
+}  // namespace url
 
 namespace content {
+
 class ContextMenuClient;
 class PluginInstanceThrottler;
 class RenderAccessibility;
 struct RenderFrameMediaPlaybackOptions;
 class RenderFrameVisitor;
 class RenderView;
-struct ContextMenuParams;
+struct UntrustworthyContextMenuParams;
 struct WebPluginInfo;
 struct WebPreferences;
 
@@ -156,7 +157,7 @@
   // Note: if you end up having clients outliving the RenderFrame, we should add
   // a CancelContextMenuCallback function that takes a request id.
   virtual int ShowContextMenu(ContextMenuClient* client,
-                              const ContextMenuParams& params) = 0;
+                              const UntrustworthyContextMenuParams& params) = 0;
 
   // Cancels a context menu in the event that the client is destroyed before the
   // menu is closed.
diff --git a/content/public/test/browser_test_utils.cc b/content/public/test/browser_test_utils.cc
index 89189ff..423c32b 100644
--- a/content/public/test/browser_test_utils.cc
+++ b/content/public/test/browser_test_utils.cc
@@ -3265,7 +3265,7 @@
   if (message.type() == FrameHostMsg_ContextMenu::ID) {
     FrameHostMsg_ContextMenu::Param params;
     FrameHostMsg_ContextMenu::Read(&message, &params);
-    content::ContextMenuParams menu_params = std::get<0>(params);
+    content::UntrustworthyContextMenuParams menu_params = std::get<0>(params);
     base::PostTask(
         FROM_HERE, {content::BrowserThread::UI},
         base::BindOnce(&ContextMenuFilter::OnContextMenu, this, menu_params));
@@ -3279,10 +3279,10 @@
   run_loop_ = nullptr;
 }
 
-ContextMenuFilter::~ContextMenuFilter() {}
+ContextMenuFilter::~ContextMenuFilter() = default;
 
 void ContextMenuFilter::OnContextMenu(
-    const content::ContextMenuParams& params) {
+    const content::UntrustworthyContextMenuParams& params) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
   last_params_ = params;
   std::move(quit_closure_).Run();
diff --git a/content/public/test/browser_test_utils.h b/content/public/test/browser_test_utils.h
index ba36811..75b32d0a 100644
--- a/content/public/test/browser_test_utils.h
+++ b/content/public/test/browser_test_utils.h
@@ -1675,9 +1675,9 @@
 
 #endif  // defined(USE_AURA)
 
-// This class filters for FrameHostMsg_ContextMenu messages coming in
-// from a renderer process, and allows observing the ContextMenuParams
-// as sent by the renderer.
+// This class filters for FrameHostMsg_ContextMenu messages coming in from a
+// renderer process, and allows observing the UntrustworthyContextMenuParams as
+// sent by the renderer.
 class ContextMenuFilter : public content::BrowserMessageFilter {
  public:
   ContextMenuFilter();
@@ -1685,16 +1685,16 @@
   bool OnMessageReceived(const IPC::Message& message) override;
   void Wait();
 
-  content::ContextMenuParams get_params() { return last_params_; }
+  content::UntrustworthyContextMenuParams get_params() { return last_params_; }
 
  private:
   ~ContextMenuFilter() override;
 
-  void OnContextMenu(const content::ContextMenuParams& params);
+  void OnContextMenu(const content::UntrustworthyContextMenuParams& params);
 
   std::unique_ptr<base::RunLoop> run_loop_;
   base::OnceClosure quit_closure_;
-  content::ContextMenuParams last_params_;
+  content::UntrustworthyContextMenuParams last_params_;
 
   DISALLOW_COPY_AND_ASSIGN(ContextMenuFilter);
 };
diff --git a/content/renderer/context_menu_params_builder.cc b/content/renderer/context_menu_params_builder.cc
index 747077b..ef437a3 100644
--- a/content/renderer/context_menu_params_builder.cc
+++ b/content/renderer/context_menu_params_builder.cc
@@ -14,9 +14,9 @@
 namespace content {
 
 // static
-ContextMenuParams ContextMenuParamsBuilder::Build(
+UntrustworthyContextMenuParams ContextMenuParamsBuilder::Build(
     const blink::WebContextMenuData& data) {
-  ContextMenuParams params;
+  UntrustworthyContextMenuParams params;
   params.media_type = data.media_type;
   params.x = data.mouse_position.x();
   params.y = data.mouse_position.y();
@@ -24,8 +24,6 @@
   params.unfiltered_link_url = data.link_url;
   params.src_url = data.src_url;
   params.has_image_contents = data.has_image_contents;
-  params.page_url = data.page_url;
-  params.frame_url = data.frame_url;
   params.media_flags = data.media_flags;
   params.selection_text = data.selected_text.Utf16();
   params.selection_start_offset = data.selection_start_offset;
diff --git a/content/renderer/context_menu_params_builder.h b/content/renderer/context_menu_params_builder.h
index 624f855..a4c19fa 100644
--- a/content/renderer/context_menu_params_builder.h
+++ b/content/renderer/context_menu_params_builder.h
@@ -10,11 +10,12 @@
 }
 
 namespace content {
-struct ContextMenuParams;
+struct UntrustworthyContextMenuParams;
 
 class ContextMenuParamsBuilder {
  public:
-  static ContextMenuParams Build(const blink::WebContextMenuData& data);
+  static UntrustworthyContextMenuParams Build(
+      const blink::WebContextMenuData& data);
 };
 
 }  // namespace content
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 4489dc3..914cf95 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -2818,10 +2818,11 @@
   return render_view_->renderer_preferences();
 }
 
-int RenderFrameImpl::ShowContextMenu(ContextMenuClient* client,
-                                     const ContextMenuParams& params) {
+int RenderFrameImpl::ShowContextMenu(
+    ContextMenuClient* client,
+    const UntrustworthyContextMenuParams& params) {
   DCHECK(client);  // A null client means "internal" when we issue callbacks.
-  ContextMenuParams our_params(params);
+  UntrustworthyContextMenuParams our_params(params);
 
   blink::WebRect position_in_window(params.x, params.y, 0, 0);
   GetLocalRootRenderWidget()->ConvertViewportToWindow(&position_in_window);
@@ -4632,7 +4633,7 @@
 }
 
 void RenderFrameImpl::ShowContextMenu(const blink::WebContextMenuData& data) {
-  ContextMenuParams params = ContextMenuParamsBuilder::Build(data);
+  UntrustworthyContextMenuParams params = ContextMenuParamsBuilder::Build(data);
   if (GetLocalRootRenderWidget()->has_host_context_menu_location()) {
     // If the context menu request came from the browser, it came with a
     // position that was stored on RenderWidget and is relative to the
@@ -4675,7 +4676,8 @@
 #endif
 }
 
-void RenderFrameImpl::ShowDeferredContextMenu(const ContextMenuParams& params) {
+void RenderFrameImpl::ShowDeferredContextMenu(
+    const UntrustworthyContextMenuParams& params) {
   Send(new FrameHostMsg_ContextMenu(routing_id_, params));
 }
 
diff --git a/content/renderer/render_frame_impl.h b/content/renderer/render_frame_impl.h
index e2bbe3bc..29c48c5 100644
--- a/content/renderer/render_frame_impl.h
+++ b/content/renderer/render_frame_impl.h
@@ -439,7 +439,7 @@
   blink::WebLocalFrame* GetWebFrame() override;
   const WebPreferences& GetWebkitPreferences() override;
   int ShowContextMenu(ContextMenuClient* client,
-                      const ContextMenuParams& params) override;
+                      const UntrustworthyContextMenuParams& params) override;
   void CancelContextMenu(int request_id) override;
   void ShowVirtualKeyboard() override;
   blink::WebPlugin* CreatePlugin(
@@ -1177,7 +1177,7 @@
 
   void BindWidget(mojo::PendingReceiver<mojom::Widget> receiver);
 
-  void ShowDeferredContextMenu(const ContextMenuParams& params);
+  void ShowDeferredContextMenu(const UntrustworthyContextMenuParams& params);
 
   // Build DidCommitProvisionalLoad_Params based on the frame internal state.
   std::unique_ptr<FrameHostMsg_DidCommitProvisionalLoad_Params>
diff --git a/content/utility/in_process_utility_thread.cc b/content/utility/in_process_utility_thread.cc
index 4943609..5fb9fc57 100644
--- a/content/utility/in_process_utility_thread.cc
+++ b/content/utility/in_process_utility_thread.cc
@@ -37,7 +37,8 @@
                                 base::Unretained(this)));
 }
 
-void InProcessUtilityThread::CleanUp() {
+void InProcessUtilityThread::CleanUp()
+    UNLOCK_FUNCTION(g_one_utility_thread_lock.Get()) {
   child_process_.reset();
 
   // See comment in RendererMainThread.
@@ -45,7 +46,8 @@
   g_one_utility_thread_lock.Get().Release();
 }
 
-void InProcessUtilityThread::InitInternal() {
+void InProcessUtilityThread::InitInternal()
+    EXCLUSIVE_LOCK_FUNCTION(g_one_utility_thread_lock.Get()) {
   g_one_utility_thread_lock.Get().Acquire();
   child_process_.reset(new ChildProcess());
   child_process_->set_main_thread(new UtilityThreadImpl(params_));
diff --git a/extensions/browser/extension_function_histogram_value.h b/extensions/browser/extension_function_histogram_value.h
index 06111889..9d5147f 100644
--- a/extensions/browser/extension_function_histogram_value.h
+++ b/extensions/browser/extension_function_histogram_value.h
@@ -1511,7 +1511,7 @@
   AUTOFILLPRIVATE_GETUPIIDLIST = 1448,
   WEBCAMPRIVATE_RESTORE_CAMERA_PRESET = 1449,
   WEBCAMPRIVATE_SET_CAMERA_PRESET = 1450,
-  PASSWORDSPRIVATE_GETCOMPROMISEDCREDENTIALSINFO = 1451,
+  PASSWORDSPRIVATE_GETCOMPROMISEDCREDENTIALS = 1451,
   INPUTMETHODPRIVATE_HIDEINPUTVIEW = 1452,
   PASSWORDSPRIVATE_GETPLAINTEXTCOMPROMISEDPASSWORD = 1453,
   PASSWORDSPRIVATE_CHANGECOMPROMISEDCREDENTIAL = 1454,
@@ -1521,6 +1521,7 @@
   PASSWORDSPRIVATE_STARTPASSWORDCHECK = 1458,
   PASSWORDSPRIVATE_STOPPASSWORDCHECK = 1459,
   PASSWORDSPRIVATE_GETPASSWORDCHECKSTATUS = 1460,
+  TERMINALPRIVATE_OPENVMSHELLPROCESS = 1461,
   // Last entry: Add new entries above, then run:
   // python tools/metrics/histograms/update_extension_histograms.py
   ENUM_BOUNDARY
diff --git a/gpu/ipc/client/command_buffer_proxy_impl.cc b/gpu/ipc/client/command_buffer_proxy_impl.cc
index 2ba4395e..9807b062 100644
--- a/gpu/ipc/client/command_buffer_proxy_impl.cc
+++ b/gpu/ipc/client/command_buffer_proxy_impl.cc
@@ -5,8 +5,6 @@
 #include "gpu/ipc/client/command_buffer_proxy_impl.h"
 
 #include <memory>
-#include <utility>
-#include <vector>
 
 #include "base/bind.h"
 #include "base/callback.h"
@@ -658,7 +656,6 @@
 
 bool CommandBufferProxyImpl::Send(IPC::Message* msg) {
   DCHECK(channel_);
-  last_state_lock_.AssertAcquired();
   DCHECK_EQ(gpu::error::kNoError, last_state_.error);
 
   last_state_lock_.Release();
@@ -714,7 +711,6 @@
 void CommandBufferProxyImpl::SetStateFromMessageReply(
     const gpu::CommandBuffer::State& state) {
   CheckLock();
-  last_state_lock_.AssertAcquired();
   if (last_state_.error != gpu::error::kNoError)
     return;
   // Handle wraparound. It works as long as we don't have more than 2B state
@@ -727,7 +723,6 @@
 
 void CommandBufferProxyImpl::TryUpdateState() {
   CheckLock();
-  last_state_lock_.AssertAcquired();
   if (last_state_.error == gpu::error::kNoError) {
     shared_state()->Read(&last_state_);
     if (last_state_.error != gpu::error::kNoError)
@@ -736,7 +731,6 @@
 }
 
 void CommandBufferProxyImpl::TryUpdateStateThreadSafe() {
-  last_state_lock_.AssertAcquired();
   if (last_state_.error == gpu::error::kNoError) {
     shared_state()->Read(&last_state_);
     if (last_state_.error != gpu::error::kNoError) {
@@ -749,7 +743,6 @@
 }
 
 void CommandBufferProxyImpl::TryUpdateStateDontReportError() {
-  last_state_lock_.AssertAcquired();
   if (last_state_.error == gpu::error::kNoError)
     shared_state()->Read(&last_state_);
 }
@@ -779,7 +772,6 @@
 
 void CommandBufferProxyImpl::OnGpuSyncReplyError() {
   CheckLock();
-  last_state_lock_.AssertAcquired();
   last_state_.error = gpu::error::kLostContext;
   last_state_.context_lost_reason = gpu::error::kInvalidGpuMessage;
   // This method may be inside a callstack from the GpuControlClient (we got a
@@ -792,7 +784,6 @@
     gpu::error::ContextLostReason reason,
     gpu::error::Error error) {
   CheckLock();
-  last_state_lock_.AssertAcquired();
   last_state_.error = error;
   last_state_.context_lost_reason = reason;
   // This method only occurs when receiving IPC messages, so we know it's not in
@@ -804,7 +795,6 @@
 
 void CommandBufferProxyImpl::OnGpuStateError() {
   CheckLock();
-  last_state_lock_.AssertAcquired();
   DCHECK_NE(gpu::error::kNoError, last_state_.error);
   // This method may be inside a callstack from the GpuControlClient (we
   // encountered an error while trying to perform some action). So avoid
@@ -814,7 +804,6 @@
 
 void CommandBufferProxyImpl::OnClientError(gpu::error::Error error) {
   CheckLock();
-  last_state_lock_.AssertAcquired();
   last_state_.error = error;
   last_state_.context_lost_reason = gpu::error::kUnknown;
   // This method may be inside a callstack from the GpuControlClient (we
@@ -825,7 +814,6 @@
 
 void CommandBufferProxyImpl::DisconnectChannelInFreshCallStack() {
   CheckLock();
-  last_state_lock_.AssertAcquired();
   // Inform the GpuControlClient of the lost state immediately, though this may
   // be a re-entrant call to the client so we use the MaybeReentrant variant.
   if (gpu_control_client_)
diff --git a/gpu/ipc/client/command_buffer_proxy_impl.h b/gpu/ipc/client/command_buffer_proxy_impl.h
index b2be647ee..42deacd 100644
--- a/gpu/ipc/client/command_buffer_proxy_impl.h
+++ b/gpu/ipc/client/command_buffer_proxy_impl.h
@@ -13,6 +13,8 @@
 #include <queue>
 #include <string>
 #include <unordered_map>
+#include <utility>
+#include <vector>
 
 #include "base/callback.h"
 #include "base/compiler_specific.h"
@@ -169,7 +171,7 @@
   // Send an IPC message over the GPU channel. This is private to fully
   // encapsulate the channel; all callers of this function must explicitly
   // verify that the context has not been lost.
-  bool Send(IPC::Message* msg);
+  bool Send(IPC::Message* msg) EXCLUSIVE_LOCKS_REQUIRED(last_state_lock_);
 
   std::pair<base::UnsafeSharedMemoryRegion, base::WritableSharedMemoryMapping>
   AllocateAndMapSharedMemory(size_t size);
@@ -189,33 +191,38 @@
 
   // Try to read an updated copy of the state from shared memory, and calls
   // OnGpuStateError() if the new state has an error.
-  void TryUpdateState();
+  void TryUpdateState() EXCLUSIVE_LOCKS_REQUIRED(last_state_lock_);
   // Like above but calls the error handler and disconnects channel by posting
   // a task.
-  void TryUpdateStateThreadSafe();
+  void TryUpdateStateThreadSafe() EXCLUSIVE_LOCKS_REQUIRED(last_state_lock_);
   // Like the above but does not call the error event handler if the new state
   // has an error.
-  void TryUpdateStateDontReportError();
+  void TryUpdateStateDontReportError()
+      EXCLUSIVE_LOCKS_REQUIRED(last_state_lock_);
   // Sets the state, and calls OnGpuStateError() if the new state has an error.
-  void SetStateFromMessageReply(const CommandBuffer::State& state);
+  void SetStateFromMessageReply(const CommandBuffer::State& state)
+      EXCLUSIVE_LOCKS_REQUIRED(last_state_lock_);
 
   // Loses the context after we received an invalid reply from the GPU
   // process.
-  void OnGpuSyncReplyError();
+  void OnGpuSyncReplyError() EXCLUSIVE_LOCKS_REQUIRED(last_state_lock_);
 
   // Loses the context when receiving a message from the GPU process.
   void OnGpuAsyncMessageError(gpu::error::ContextLostReason reason,
-                              gpu::error::Error error);
+                              gpu::error::Error error)
+      EXCLUSIVE_LOCKS_REQUIRED(last_state_lock_);
 
   // Loses the context after we receive an error state from the GPU process.
-  void OnGpuStateError();
+  void OnGpuStateError() EXCLUSIVE_LOCKS_REQUIRED(last_state_lock_);
 
   // Sets an error on the last_state_ and loses the context due to client-side
   // errors.
-  void OnClientError(gpu::error::Error error);
+  void OnClientError(gpu::error::Error error)
+      EXCLUSIVE_LOCKS_REQUIRED(last_state_lock_);
 
   // Helper methods, don't call these directly.
-  void DisconnectChannelInFreshCallStack();
+  void DisconnectChannelInFreshCallStack()
+      EXCLUSIVE_LOCKS_REQUIRED(last_state_lock_);
   void LockAndDisconnectChannel();
   void DisconnectChannel();
 
diff --git a/headless/lib/headless_web_contents_browsertest.cc b/headless/lib/headless_web_contents_browsertest.cc
index 05c85f4..d112d68 100644
--- a/headless/lib/headless_web_contents_browsertest.cc
+++ b/headless/lib/headless_web_contents_browsertest.cc
@@ -566,6 +566,12 @@
             } ]
          } ]
       } ]
+   }, {
+      "type": "Div",
+      "~children": [ {
+         "alt": "Car at the beach",
+         "type": "Figure"
+      } ]
    } ]
 }
 )";
diff --git a/headless/test/data/structured_doc.html b/headless/test/data/structured_doc.html
index 6463830..1626df6 100644
--- a/headless/test/data/structured_doc.html
+++ b/headless/test/data/structured_doc.html
@@ -16,4 +16,7 @@
       <td>Cell 2</td>
     </tr>
   </table>
+  <div>
+    <img src="svg_example_image.png" alt="Car at the beach">
+  </div>
 </body>
diff --git a/infra/config/buckets/ci.star b/infra/config/buckets/ci.star
index 79ea772..34ed566 100644
--- a/infra/config/buckets/ci.star
+++ b/infra/config/buckets/ci.star
@@ -1118,7 +1118,6 @@
     name = 'ios-simulator-code-coverage',
     caches = [xcode_cache.x11m382q],
     cores = None,
-    goma_backend = None,  # TODO(crbug.com/950413): Use goma.backend.RBE_PROD
     os = os.MAC_ANY,
     use_clang_coverage = True,
     properties = {
diff --git a/infra/config/consoles/chromium.goma.migration.star b/infra/config/consoles/chromium.goma.migration.star
index 25c8129..8e59f83 100644
--- a/infra/config/consoles/chromium.goma.migration.star
+++ b/infra/config/consoles/chromium.goma.migration.star
@@ -1164,5 +1164,59 @@
             category = 'ios|week1a',
             short_name = 'sim',
         ),
+        luci.console_view_entry(
+            builder = 'ci/ios-device',
+            category = 'ios|week1b',
+            short_name = 'dev',
+        ),
+        luci.console_view_entry(
+            builder = 'ci/ios-simulator',
+            category = 'ios|week1b|sim',
+        ),
+        luci.console_view_entry(
+            builder = 'ci/ios-simulator-full-configs',
+            category = 'ios|week1b|sim',
+            short_name = 'fullconf',
+        ),
+        luci.console_view_entry(
+            builder = 'ci/ios-simulator-noncq',
+            category = 'ios|week1b|sim',
+            short_name = 'noncq',
+        ),
+        luci.console_view_entry(
+            builder = 'ci/ios-simulator-code-coverage',
+            category = 'ios|week1b|sim',
+            short_name = 'code',
+        ),
+        luci.console_view_entry(
+            builder = 'ci/ios-webkit-tot',
+            category = 'ios|week1b',
+            short_name = 'webkit',
+        ),
+        luci.console_view_entry(
+            builder = 'ci/ios13-beta-simulator',
+            category = 'ios|week1b|ios13|beta',
+            short_name = 'sim',
+        ),
+        luci.console_view_entry(
+            builder = 'ci/ios13-sdk-device',
+            category = 'ios|week1b|ios13|sdk',
+            short_name = 'dev',
+        ),
+        luci.console_view_entry(
+            builder = 'ci/ios13-sdk-simulator',
+            category = 'ios|week1b|ios13|sdk',
+            short_name = 'sim',
+        ),
+        luci.console_view_entry(
+            builder = 'ci-beta/ios-simulator',
+            category = 'ios|week1b|beta',
+            short_name = 'sim',
+        ),
+        luci.console_view_entry(
+            builder = 'ci-stable/ios-simulator',
+            category = 'ios|week1b|stable',
+            short_name = 'sim',
+        ),
     ],
 )
diff --git a/infra/config/generated/cr-buildbucket.cfg b/infra/config/generated/cr-buildbucket.cfg
index d5e77d1..64f9b6e 100644
--- a/infra/config/generated/cr-buildbucket.cfg
+++ b/infra/config/generated/cr-buildbucket.cfg
@@ -6776,6 +6776,7 @@
         name: "ios/unified_builder_tester"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"chromium.mac\""
       >
@@ -6799,6 +6800,7 @@
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
         properties_j: "$build/chromium_tests:{\"bucketed_triggers\":true}"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"chromium.mac\""
       >
@@ -6823,6 +6825,7 @@
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
         properties_j: "$build/code_coverage:{\"use_clang_coverage\":true}"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"chromium.fyi\""
         properties_j: "xcode_build_version:\"11m382q\""
@@ -6846,6 +6849,7 @@
         name: "chromium"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"chromium.fyi\""
         properties_j: "xcode_build_version:\"11a1027\""
@@ -6869,6 +6873,7 @@
         name: "ios/unified_builder_tester"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"chromium.fyi\""
       >
@@ -6891,6 +6896,7 @@
         name: "ios/unified_builder_tester"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"chromium.mac\""
       >
@@ -6913,6 +6919,7 @@
         name: "ios/unified_builder_tester"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"chromium.mac\""
       >
@@ -6935,6 +6942,7 @@
         name: "ios/unified_builder_tester"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"chromium.fyi\""
       >
@@ -6957,6 +6965,7 @@
         name: "chromium"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"chromium.fyi\""
         properties_j: "xcode_build_version:\"11c29\""
@@ -6980,6 +6989,7 @@
         name: "ios/unified_builder_tester"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"chromium.fyi\""
       >
@@ -7002,6 +7012,7 @@
         name: "ios/unified_builder_tester"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"chromium.fyi\""
       >
@@ -9053,6 +9064,7 @@
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
         properties_j: "$build/chromium_tests:{\"bucketed_triggers\":true}"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"chromium.mac\""
       >
@@ -9761,6 +9773,7 @@
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
         properties_j: "$build/chromium_tests:{\"bucketed_triggers\":true}"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"chromium.mac\""
       >
@@ -15218,6 +15231,7 @@
         name: "ios/try"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"tryserver.chromium.mac\""
       >
@@ -15248,6 +15262,7 @@
         name: "ios/try"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"tryserver.chromium.mac\""
       >
@@ -15278,6 +15293,7 @@
         name: "chromium_trybot"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"tryserver.chromium.mac\""
         properties_j: "xcode_build_version:\"11a1027\""
@@ -15309,6 +15325,7 @@
         name: "ios/try"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"tryserver.chromium.mac\""
       >
@@ -15339,6 +15356,7 @@
         name: "ios/try"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"tryserver.chromium.mac\""
       >
@@ -15369,6 +15387,7 @@
         name: "ios/try"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"tryserver.chromium.mac\""
       >
@@ -15399,6 +15418,7 @@
         name: "ios/try"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"tryserver.chromium.mac\""
       >
@@ -15429,6 +15449,7 @@
         name: "ios/try"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"tryserver.chromium.mac\""
       >
@@ -15459,6 +15480,7 @@
         name: "ios/try"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"tryserver.chromium.mac\""
       >
@@ -19140,6 +19162,7 @@
         name: "ios/try"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"tryserver.chromium.mac\""
       >
@@ -19721,6 +19744,7 @@
         name: "ios/try"
         cipd_package: "infra/recipe_bundles/chromium.googlesource.com/chromium/tools/build"
         cipd_version: "refs/heads/master"
+        properties_j: "$build/goma:{\"rpc_extra_params\":\"?prod\",\"server_host\":\"goma.chromium.org\"}"
         properties_j: "$kitchen:{\"devshell\":true,\"git_auth\":true}"
         properties_j: "mastername:\"tryserver.chromium.mac\""
       >
diff --git a/infra/config/generated/luci-milo.cfg b/infra/config/generated/luci-milo.cfg
index df74b93..dc66e2c 100644
--- a/infra/config/generated/luci-milo.cfg
+++ b/infra/config/generated/luci-milo.cfg
@@ -5491,6 +5491,60 @@
     category: "ios|week1a"
     short_name: "sim"
   >
+  builders: <
+    name: "buildbucket/luci.chromium.ci/ios-device"
+    category: "ios|week1b"
+    short_name: "dev"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci/ios-simulator"
+    category: "ios|week1b|sim"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci/ios-simulator-full-configs"
+    category: "ios|week1b|sim"
+    short_name: "fullconf"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci/ios-simulator-noncq"
+    category: "ios|week1b|sim"
+    short_name: "noncq"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci/ios-simulator-code-coverage"
+    category: "ios|week1b|sim"
+    short_name: "code"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci/ios-webkit-tot"
+    category: "ios|week1b"
+    short_name: "webkit"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci/ios13-beta-simulator"
+    category: "ios|week1b|ios13|beta"
+    short_name: "sim"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci/ios13-sdk-device"
+    category: "ios|week1b|ios13|sdk"
+    short_name: "dev"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci/ios13-sdk-simulator"
+    category: "ios|week1b|ios13|sdk"
+    short_name: "sim"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-beta/ios-simulator"
+    category: "ios|week1b|beta"
+    short_name: "sim"
+  >
+  builders: <
+    name: "buildbucket/luci.chromium.ci-stable/ios-simulator"
+    category: "ios|week1b|stable"
+    short_name: "sim"
+  >
   header: <
     oncalls: <
       name: "Chromium"
diff --git a/infra/config/lib/ci.star b/infra/config/lib/ci.star
index e387662..3dcc81f 100644
--- a/infra/config/lib/ci.star
+++ b/infra/config/lib/ci.star
@@ -205,7 +205,7 @@
       caches = [builders.xcode_cache.x11c29],
       cores = None,
       executable = executable,
-      goma_backend = None,
+      goma_backend = builders.goma.backend.RBE_PROD,
       os = builders.os.MAC_ANY,
       **kwargs
   )
@@ -358,7 +358,7 @@
       name = name,
       caches = [builders.xcode_cache.x11c29],
       executable = 'recipe:ios/unified_builder_tester',
-      goma_backend = None,
+      goma_backend = builders.goma.backend.RBE_PROD,
       os = builders.os.MAC_ANY,
       **kwargs
   )
diff --git a/infra/config/lib/try.star b/infra/config/lib/try.star
index 35df8f69..efc1b13 100644
--- a/infra/config/lib/try.star
+++ b/infra/config/lib/try.star
@@ -183,6 +183,7 @@
       caches = [builders.xcode_cache.x11c29],
       cores = None,
       executable = executable,
+      goma_backend=builders.goma.backend.RBE_PROD,
       mastername = 'tryserver.chromium.mac',
       os = builders.os.MAC_ANY,
       **kwargs
diff --git a/ios/build/bots/chromium.fyi/ios-simulator.json b/ios/build/bots/chromium.fyi/ios-simulator.json
index 7d26425..9883178 100644
--- a/ios/build/bots/chromium.fyi/ios-simulator.json
+++ b/ios/build/bots/chromium.fyi/ios-simulator.json
@@ -5,6 +5,7 @@
   "xcode build version": "11c29",
   "gn_args": [
     "goma_dir=\"$(goma_dir)\"",
+    "ios_use_goma_rbe=true",
     "is_component_build=false",
     "is_debug=true",
     "symbol_level=1",
diff --git a/ios/build/bots/chromium.fyi/ios-webkit-tot.json b/ios/build/bots/chromium.fyi/ios-webkit-tot.json
index 7182e112..9ec586b7 100644
--- a/ios/build/bots/chromium.fyi/ios-webkit-tot.json
+++ b/ios/build/bots/chromium.fyi/ios-webkit-tot.json
@@ -5,6 +5,7 @@
   "xcode build version": "11c505wk",
   "gn_args": [
     "goma_dir=\"$(goma_dir)\"",
+    "ios_use_goma_rbe=true",
     "is_component_build=false",
     "is_debug=true",
     "symbol_level=1",
diff --git a/ios/build/bots/chromium.fyi/ios13-beta-simulator.json b/ios/build/bots/chromium.fyi/ios13-beta-simulator.json
index 7e7f3cf..cafc53d 100644
--- a/ios/build/bots/chromium.fyi/ios13-beta-simulator.json
+++ b/ios/build/bots/chromium.fyi/ios13-beta-simulator.json
@@ -8,6 +8,7 @@
   "xcode build version": "11c29",
   "gn_args": [
     "goma_dir=\"$(goma_dir)\"",
+    "ios_use_goma_rbe=true",
     "is_component_build=false",
     "is_debug=true",
     "symbol_level=1",
diff --git a/ios/build/bots/chromium.fyi/ios13-sdk-device.json b/ios/build/bots/chromium.fyi/ios13-sdk-device.json
index a009902..874fbcc7 100644
--- a/ios/build/bots/chromium.fyi/ios13-sdk-device.json
+++ b/ios/build/bots/chromium.fyi/ios13-sdk-device.json
@@ -7,6 +7,7 @@
   "gn_args": [
     "goma_dir=\"$(goma_dir)\"",
     "ios_enable_code_signing=false",
+    "ios_use_goma_rbe=true",
     "is_component_build=false",
     "is_debug=false",
     "target_cpu=\"arm64\"",
diff --git a/ios/build/bots/chromium.fyi/ios13-sdk-simulator.json b/ios/build/bots/chromium.fyi/ios13-sdk-simulator.json
index e7fd5cd..d24b5f0 100644
--- a/ios/build/bots/chromium.fyi/ios13-sdk-simulator.json
+++ b/ios/build/bots/chromium.fyi/ios13-sdk-simulator.json
@@ -5,6 +5,7 @@
   "xcode build version": "11c29",
   "gn_args": [
     "goma_dir=\"$(goma_dir)\"",
+    "ios_use_goma_rbe=true",
     "is_component_build=false",
     "is_debug=true",
     "symbol_level=1",
diff --git a/ios/build/bots/chromium.mac/ios-device.json b/ios/build/bots/chromium.mac/ios-device.json
index 392a6b6..99586563 100644
--- a/ios/build/bots/chromium.mac/ios-device.json
+++ b/ios/build/bots/chromium.mac/ios-device.json
@@ -8,6 +8,7 @@
   "gn_args": [
     "goma_dir=\"$(goma_dir)\"",
     "ios_enable_code_signing=false",
+    "ios_use_goma_rbe=true",
     "is_component_build=false",
     "is_debug=false",
     "symbol_level=0",
diff --git a/ios/build/bots/chromium.mac/ios-simulator-full-configs.json b/ios/build/bots/chromium.mac/ios-simulator-full-configs.json
index fbecdfc..10fa7d4 100644
--- a/ios/build/bots/chromium.mac/ios-simulator-full-configs.json
+++ b/ios/build/bots/chromium.mac/ios-simulator-full-configs.json
@@ -6,6 +6,7 @@
   "xcode build version": "11c29",
   "gn_args": [
     "goma_dir=\"$(goma_dir)\"",
+    "ios_use_goma_rbe=true",
     "is_component_build=false",
     "is_debug=true",
     "symbol_level=1",
diff --git a/ios/build/bots/chromium.mac/ios-simulator-noncq.json b/ios/build/bots/chromium.mac/ios-simulator-noncq.json
index 4adb2fa7..5acec3b 100644
--- a/ios/build/bots/chromium.mac/ios-simulator-noncq.json
+++ b/ios/build/bots/chromium.mac/ios-simulator-noncq.json
@@ -6,6 +6,7 @@
   "xcode build version": "11c29",
   "gn_args": [
     "goma_dir=\"$(goma_dir)\"",
+    "ios_use_goma_rbe=true",
     "is_component_build=false",
     "is_debug=true",
     "symbol_level=1",
diff --git a/ios/build/bots/chromium.mac/ios-simulator.json b/ios/build/bots/chromium.mac/ios-simulator.json
index 33c92ce..1f4e765 100644
--- a/ios/build/bots/chromium.mac/ios-simulator.json
+++ b/ios/build/bots/chromium.mac/ios-simulator.json
@@ -7,6 +7,7 @@
   "xcode build version": "11c29",
   "gn_args": [
     "goma_dir=\"$(goma_dir)\"",
+    "ios_use_goma_rbe=true",
     "is_component_build=false",
     "is_debug=true",
     "symbol_level=1",
diff --git a/ios/build/bots/chromium.mac/ios13-beta-simulator.json b/ios/build/bots/chromium.mac/ios13-beta-simulator.json
index 73ebf924..ebdf9e7d 100644
--- a/ios/build/bots/chromium.mac/ios13-beta-simulator.json
+++ b/ios/build/bots/chromium.mac/ios13-beta-simulator.json
@@ -8,6 +8,7 @@
   "xcode build version": "11c29",
   "gn_args": [
     "goma_dir=\"$(goma_dir)\"",
+    "ios_use_goma_rbe=true",
     "is_component_build=false",
     "is_debug=true",
     "symbol_level=1",
diff --git a/ios/build/bots/chromium.mac/ios13-sdk-simulator.json b/ios/build/bots/chromium.mac/ios13-sdk-simulator.json
index 1d0c962..705db30 100644
--- a/ios/build/bots/chromium.mac/ios13-sdk-simulator.json
+++ b/ios/build/bots/chromium.mac/ios13-sdk-simulator.json
@@ -8,6 +8,7 @@
   "xcode build version": "11c29",
   "gn_args": [
     "goma_dir=\"$(goma_dir)\"",
+    "ios_use_goma_rbe=true",
     "is_component_build=false",
     "is_debug=true",
     "symbol_level=1",
diff --git a/ios/chrome/browser/autofill/autofill_controller_unittest.mm b/ios/chrome/browser/autofill/autofill_controller_unittest.mm
index 0965e1cd..1d1bf3a 100644
--- a/ios/chrome/browser/autofill/autofill_controller_unittest.mm
+++ b/ios/chrome/browser/autofill/autofill_controller_unittest.mm
@@ -601,7 +601,7 @@
   // Focus the dummy field and confirm no suggestions are presented.
   ExecuteJavaScript(@"document.forms[0].dummy.focus()");
   WaitForSuggestionRetrieval(/*wait_for_trigger=*/YES);
-  EXPECT_EQ(0U, [suggestion_controller() suggestions].count);
+  ASSERT_EQ(0U, [suggestion_controller() suggestions].count);
 
   // Enter 'B' in the dummy field and confirm no suggestions are presented.
   ExecuteJavaScript(@"event = document.createEvent('TextEvent');");
@@ -609,7 +609,7 @@
       @"event.initTextEvent('textInput', true, true, window, 'B');");
   ExecuteJavaScript(@"document.forms[0].dummy.dispatchEvent(event);");
   WaitForSuggestionRetrieval(/*wait_for_trigger=*/YES);
-  EXPECT_EQ(0U, [suggestion_controller() suggestions].count);
+  ASSERT_EQ(0U, [suggestion_controller() suggestions].count);
 
   // Enter 'B' in the greeting field and confirm that one suggestion ("Bonjour")
   // is presented.
@@ -620,7 +620,7 @@
       @"event.initTextEvent('textInput', true, true, window, 'B');");
   ExecuteJavaScript(@"document.forms[0].greeting.dispatchEvent(event);");
   WaitForSuggestionRetrieval(/*wait_for_trigger=*/YES);
-  EXPECT_EQ(1U, [suggestion_controller() suggestions].count);
+  ASSERT_EQ(1U, [suggestion_controller() suggestions].count);
   FormSuggestion* suggestion = [suggestion_controller() suggestions][0];
   EXPECT_NSEQ(@"Bonjour", suggestion.value);
 }
diff --git a/ios/chrome/browser/ui/omnibox/omnibox_egtest.mm b/ios/chrome/browser/ui/omnibox/omnibox_egtest.mm
index bbf5ac8..ea8a814 100644
--- a/ios/chrome/browser/ui/omnibox/omnibox_egtest.mm
+++ b/ios/chrome/browser/ui/omnibox/omnibox_egtest.mm
@@ -150,8 +150,10 @@
 
 // Tests that the XClientData header is sent when navigating to
 // https://google.com through the omnibox.
-// TODO(crbug.com/1036225): Test very flaky on all config.
-- (void)DISABLED_testXClientData {
+- (void)testXClientData {
+#if defined(CHROME_EARL_GREY_1)
+  EARL_GREY_TEST_DISABLED(@"Flaky on EG1.");
+#endif
   // Rewrite the google URL to localhost URL.
   [OmniboxAppInterface rewriteGoogleURLToLocalhost];
 
diff --git a/ios/testing/earl_grey/coverage_utils.mm b/ios/testing/earl_grey/coverage_utils.mm
index 02f921b..ded91960 100644
--- a/ios/testing/earl_grey/coverage_utils.mm
+++ b/ios/testing/earl_grey/coverage_utils.mm
@@ -4,15 +4,15 @@
 
 #import "ios/testing/earl_grey/coverage_utils.h"
 
-#include "base/clang_profiling_buildflags.h"
+#include "base/clang_coverage_buildflags.h"
 #import "testing/coverage_util_ios.h"
 
 #if !defined(__has_feature) || !__has_feature(objc_arc)
 #error "This file requires ARC support."
 #endif
 
-#if BUILDFLAG(CLANG_PROFILING)
-#include "base/test/profiling_utils.h"
+#if BUILDFLAG(CLANG_COVERAGE)
+#include "base/test/clang_coverage.h"
 extern "C" void __llvm_profile_reset_counters(void);
 #endif
 
@@ -23,17 +23,17 @@
 }
 
 + (void)resetCoverageProfileCounters {
-#if BUILDFLAG(CLANG_PROFILING)
+#if BUILDFLAG(CLANG_COVERAGE)
   // In this call, the already-dump flag is also reset, so that the same file
   // can be dumped to again.
   __llvm_profile_reset_counters();
-#endif  // BUILDFLAG(CLANG_PROFILING)
+#endif  // BUILDFLAG(CLANG_COVERAGE)
 }
 
 + (void)writeClangCoverageProfile {
-#if BUILDFLAG(CLANG_PROFILING)
-  base::WriteClangProfilingProfile();
-#endif  // BUILDFLAG(CLANG_PROFILING)
+#if BUILDFLAG(CLANG_COVERAGE)
+  base::WriteClangCoverageProfile();
+#endif  // BUILDFLAG(CLANG_COVERAGE)
 }
 
 @end
diff --git a/media/capture/mojom/BUILD.gn b/media/capture/mojom/BUILD.gn
index bfa974c..a2aaecee 100644
--- a/media/capture/mojom/BUILD.gn
+++ b/media/capture/mojom/BUILD.gn
@@ -23,6 +23,24 @@
   export_header_blink = "third_party/blink/public/platform/web_common.h"
 }
 
+component("video_capture_mojom_support") {
+  sources = [
+    "video_capture_types_mojom_traits.cc",
+    "video_capture_types_mojom_traits.h",
+  ]
+  public_deps = [
+    ":video_capture_shared_cpp_sources",
+    "//media/base/ipc",
+    "//media/capture:capture_base",
+  ]
+  deps = [
+    "//media",
+    "//media/mojo/mojom",
+    "//ui/gfx/geometry/mojom:mojom_traits",
+  ]
+  defines = [ "IS_MEDIA_CAPTURE_MOJOM_TRAITS_IMPL" ]
+}
+
 mojom("image_capture") {
   sources = [ "image_capture.mojom" ]
 
diff --git a/media/capture/mojom/video_capture_types.typemap b/media/capture/mojom/video_capture_types.typemap
index bbe592f..39fac0c 100644
--- a/media/capture/mojom/video_capture_types.typemap
+++ b/media/capture/mojom/video_capture_types.typemap
@@ -9,24 +9,8 @@
   "//media/capture/video/video_capture_device_descriptor.h",
   "//media/capture/video/video_capture_device_info.h",
 ]
-
 traits_headers = [ "//media/capture/mojom/video_capture_types_mojom_traits.h" ]
-
-sources = [
-  "//media/capture/mojom/video_capture_types_mojom_traits.cc",
-]
-
-deps = [
-  "//media",
-  "//media/capture:capture_base",
-  "//media/mojo/mojom",
-  "//ui/gfx/geometry/mojom:mojom_traits",
-]
-
-public_deps = [
-  "//media/base/ipc",
-]
-
+public_deps = [ "//media/capture/mojom:video_capture_mojom_support" ]
 type_mappings = [
   "media.mojom.ResolutionChangePolicy=::media::ResolutionChangePolicy",
   "media.mojom.PowerLineFrequency=::media::PowerLineFrequency",
diff --git a/media/capture/mojom/video_capture_types_for_blink.typemap b/media/capture/mojom/video_capture_types_for_blink.typemap
deleted file mode 100644
index 485c4179..0000000
--- a/media/capture/mojom/video_capture_types_for_blink.typemap
+++ /dev/null
@@ -1,32 +0,0 @@
-# Copyright 2019 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-mojom = "//media/capture/mojom/video_capture_types.mojom"
-
-public_headers = [
-  "//media/capture/video_capture_types.h",
-  "//media/capture/video/video_capture_device_descriptor.h",
-  "//media/capture/video/video_capture_device_info.h",
-]
-
-traits_headers = [ "//media/capture/mojom/video_capture_types_mojom_traits.h" ]
-
-deps = [
-  "//media",
-  "//media/capture:capture_base",
-]
-
-type_mappings = [
-  "media.mojom.ResolutionChangePolicy=::media::ResolutionChangePolicy",
-  "media.mojom.PowerLineFrequency=::media::PowerLineFrequency",
-  "media.mojom.VideoCapturePixelFormat=::media::VideoPixelFormat",
-  "media.mojom.VideoCaptureBufferType=::media::VideoCaptureBufferType",
-  "media.mojom.VideoCaptureError=::media::VideoCaptureError",
-  "media.mojom.VideoCaptureFrameDropReason=::media::VideoCaptureFrameDropReason",
-  "media.mojom.VideoCaptureFormat=::media::VideoCaptureFormat",
-  "media.mojom.VideoCaptureParams=::media::VideoCaptureParams",
-  "media.mojom.VideoCaptureDeviceDescriptor=::media::VideoCaptureDeviceDescriptor",
-  "media.mojom.VideoCaptureDeviceInfo=::media::VideoCaptureDeviceInfo",
-  "media.mojom.VideoFacingMode=::media::VideoFacingMode",
-]
diff --git a/media/capture/mojom/video_capture_types_mojom_traits.h b/media/capture/mojom/video_capture_types_mojom_traits.h
index 4dc3b55..ebe98f62 100644
--- a/media/capture/mojom/video_capture_types_mojom_traits.h
+++ b/media/capture/mojom/video_capture_types_mojom_traits.h
@@ -6,7 +6,7 @@
 #define MEDIA_CAPTURE_MOJOM_VIDEO_CAPTURE_TYPES_MOJOM_TRAITS_H_
 
 #include "media/base/video_facing.h"
-#include "media/capture/mojom/video_capture_types.mojom.h"
+#include "media/capture/mojom/video_capture_types.mojom-shared.h"
 #include "media/capture/video/video_capture_device_descriptor.h"
 #include "media/capture/video/video_capture_device_info.h"
 #include "media/capture/video_capture_types.h"
@@ -14,8 +14,9 @@
 namespace mojo {
 
 template <>
-struct EnumTraits<media::mojom::ResolutionChangePolicy,
-                  media::ResolutionChangePolicy> {
+struct COMPONENT_EXPORT(MEDIA_CAPTURE_MOJOM_TRAITS)
+    EnumTraits<media::mojom::ResolutionChangePolicy,
+               media::ResolutionChangePolicy> {
   static media::mojom::ResolutionChangePolicy ToMojom(
       media::ResolutionChangePolicy policy);
 
@@ -24,7 +25,8 @@
 };
 
 template <>
-struct EnumTraits<media::mojom::PowerLineFrequency, media::PowerLineFrequency> {
+struct COMPONENT_EXPORT(MEDIA_CAPTURE_MOJOM_TRAITS)
+    EnumTraits<media::mojom::PowerLineFrequency, media::PowerLineFrequency> {
   static media::mojom::PowerLineFrequency ToMojom(
       media::PowerLineFrequency frequency);
 
@@ -33,8 +35,8 @@
 };
 
 template <>
-struct EnumTraits<media::mojom::VideoCapturePixelFormat,
-                  media::VideoPixelFormat> {
+struct COMPONENT_EXPORT(MEDIA_CAPTURE_MOJOM_TRAITS)
+    EnumTraits<media::mojom::VideoCapturePixelFormat, media::VideoPixelFormat> {
   static media::mojom::VideoCapturePixelFormat ToMojom(
       media::VideoPixelFormat input);
   static bool FromMojom(media::mojom::VideoCapturePixelFormat input,
@@ -42,8 +44,9 @@
 };
 
 template <>
-struct EnumTraits<media::mojom::VideoCaptureBufferType,
-                  media::VideoCaptureBufferType> {
+struct COMPONENT_EXPORT(MEDIA_CAPTURE_MOJOM_TRAITS)
+    EnumTraits<media::mojom::VideoCaptureBufferType,
+               media::VideoCaptureBufferType> {
   static media::mojom::VideoCaptureBufferType ToMojom(
       media::VideoCaptureBufferType buffer_type);
 
@@ -52,7 +55,8 @@
 };
 
 template <>
-struct EnumTraits<media::mojom::VideoCaptureError, media::VideoCaptureError> {
+struct COMPONENT_EXPORT(MEDIA_CAPTURE_MOJOM_TRAITS)
+    EnumTraits<media::mojom::VideoCaptureError, media::VideoCaptureError> {
   static media::mojom::VideoCaptureError ToMojom(
       media::VideoCaptureError buffer_type);
 
@@ -61,8 +65,9 @@
 };
 
 template <>
-struct EnumTraits<media::mojom::VideoCaptureFrameDropReason,
-                  media::VideoCaptureFrameDropReason> {
+struct COMPONENT_EXPORT(MEDIA_CAPTURE_MOJOM_TRAITS)
+    EnumTraits<media::mojom::VideoCaptureFrameDropReason,
+               media::VideoCaptureFrameDropReason> {
   static media::mojom::VideoCaptureFrameDropReason ToMojom(
       media::VideoCaptureFrameDropReason buffer_type);
 
@@ -71,22 +76,25 @@
 };
 
 template <>
-struct EnumTraits<media::mojom::VideoFacingMode, media::VideoFacingMode> {
+struct COMPONENT_EXPORT(MEDIA_CAPTURE_MOJOM_TRAITS)
+    EnumTraits<media::mojom::VideoFacingMode, media::VideoFacingMode> {
   static media::mojom::VideoFacingMode ToMojom(media::VideoFacingMode input);
   static bool FromMojom(media::mojom::VideoFacingMode input,
                         media::VideoFacingMode* output);
 };
 
 template <>
-struct EnumTraits<media::mojom::VideoCaptureApi, media::VideoCaptureApi> {
+struct COMPONENT_EXPORT(MEDIA_CAPTURE_MOJOM_TRAITS)
+    EnumTraits<media::mojom::VideoCaptureApi, media::VideoCaptureApi> {
   static media::mojom::VideoCaptureApi ToMojom(media::VideoCaptureApi input);
   static bool FromMojom(media::mojom::VideoCaptureApi input,
                         media::VideoCaptureApi* output);
 };
 
 template <>
-struct EnumTraits<media::mojom::VideoCaptureTransportType,
-                  media::VideoCaptureTransportType> {
+struct COMPONENT_EXPORT(MEDIA_CAPTURE_MOJOM_TRAITS)
+    EnumTraits<media::mojom::VideoCaptureTransportType,
+               media::VideoCaptureTransportType> {
   static media::mojom::VideoCaptureTransportType ToMojom(
       media::VideoCaptureTransportType input);
   static bool FromMojom(media::mojom::VideoCaptureTransportType input,
@@ -94,8 +102,9 @@
 };
 
 template <>
-struct StructTraits<media::mojom::VideoCaptureFormatDataView,
-                    media::VideoCaptureFormat> {
+struct COMPONENT_EXPORT(MEDIA_CAPTURE_MOJOM_TRAITS)
+    StructTraits<media::mojom::VideoCaptureFormatDataView,
+                 media::VideoCaptureFormat> {
   static const gfx::Size& frame_size(const media::VideoCaptureFormat& format) {
     return format.frame_size;
   }
@@ -114,8 +123,9 @@
 };
 
 template <>
-struct StructTraits<media::mojom::VideoCaptureParamsDataView,
-                    media::VideoCaptureParams> {
+struct COMPONENT_EXPORT(MEDIA_CAPTURE_MOJOM_TRAITS)
+    StructTraits<media::mojom::VideoCaptureParamsDataView,
+                 media::VideoCaptureParams> {
   static media::VideoCaptureFormat requested_format(
       const media::VideoCaptureParams& params) {
     return params.requested_format;
@@ -146,8 +156,9 @@
 };
 
 template <>
-struct StructTraits<media::mojom::VideoCaptureDeviceDescriptorDataView,
-                    media::VideoCaptureDeviceDescriptor> {
+struct COMPONENT_EXPORT(MEDIA_CAPTURE_MOJOM_TRAITS)
+    StructTraits<media::mojom::VideoCaptureDeviceDescriptorDataView,
+                 media::VideoCaptureDeviceDescriptor> {
   static const std::string& display_name(
       const media::VideoCaptureDeviceDescriptor& input) {
     return input.display_name();
@@ -183,8 +194,9 @@
 };
 
 template <>
-struct StructTraits<media::mojom::VideoCaptureDeviceInfoDataView,
-                    media::VideoCaptureDeviceInfo> {
+struct COMPONENT_EXPORT(MEDIA_CAPTURE_MOJOM_TRAITS)
+    StructTraits<media::mojom::VideoCaptureDeviceInfoDataView,
+                 media::VideoCaptureDeviceInfo> {
   static const media::VideoCaptureDeviceDescriptor& descriptor(
       const media::VideoCaptureDeviceInfo& input) {
     return input.descriptor;
diff --git a/media/gpu/vaapi/vaapi_video_encode_accelerator.cc b/media/gpu/vaapi/vaapi_video_encode_accelerator.cc
index 0498f4e..4b1b4c3 100644
--- a/media/gpu/vaapi/vaapi_video_encode_accelerator.cc
+++ b/media/gpu/vaapi/vaapi_video_encode_accelerator.cc
@@ -39,7 +39,6 @@
 #include "media/gpu/macros.h"
 #include "media/gpu/vaapi/h264_encoder.h"
 #include "media/gpu/vaapi/vaapi_common.h"
-#include "media/gpu/vaapi/vaapi_utils.h"
 #include "media/gpu/vaapi/vp8_encoder.h"
 #include "media/gpu/vaapi/vp9_encoder.h"
 #include "media/gpu/vp8_reference_frame_vector.h"
@@ -391,6 +390,11 @@
 
   output_buffer_byte_size_ = encoder_->GetBitstreamBufferSize();
 
+  va_surface_release_cb_ = BindToCurrentLoop(base::BindRepeating(
+      &VaapiVideoEncodeAccelerator::RecycleVASurfaceID, encoder_weak_this_));
+  vpp_va_surface_release_cb_ = BindToCurrentLoop(base::BindRepeating(
+      &VaapiVideoEncodeAccelerator::RecycleVPPVASurfaceID, encoder_weak_this_));
+
   visible_rect_ = gfx::Rect(config.input_visible_size);
   expected_input_coded_size_ = VideoFrame::DetermineAlignedSize(
       config.input_format, config.input_visible_size);
@@ -425,20 +429,14 @@
 
   // The surface size for the reconstructed surface (and input surface in non
   // native input mode) is the coded size.
-  std::vector<VASurfaceID> surface_ids;
   if (!vaapi_wrapper_->CreateContextAndSurfaces(
           kVaSurfaceFormat, encoder_->GetCodedSize(),
           VaapiWrapper::SurfaceUsageHint::kVideoEncoder,
           (num_frames_in_flight_ + 1) * va_surfaces_per_video_frame_,
-          &surface_ids)) {
+          &available_va_surface_ids_)) {
     NOTIFY_ERROR(kPlatformFailureError, "Failed creating VASurfaces");
     return;
   }
-  for (const VASurfaceID surface_id : surface_ids) {
-    available_va_surfaces_.emplace_back(std::make_unique<ScopedVASurfaceID>(
-        surface_id,
-        base::BindOnce(&VaapiWrapper::DestroySurface, vaapi_wrapper_)));
-  }
 
   child_task_runner_->PostTask(
       FROM_HERE,
@@ -463,24 +461,20 @@
 }
 
 void VaapiVideoEncodeAccelerator::RecycleVASurfaceID(
-    std::unique_ptr<ScopedVASurfaceID> scoped_va_surface_id,
-    VASurfaceID /* va_surface_id */) {
-  DCHECK(scoped_va_surface_id);
-  DVLOGF(4) << "va_surface_id: " << scoped_va_surface_id->id();
+    VASurfaceID va_surface_id) {
+  DVLOGF(4) << "va_surface_id: " << va_surface_id;
   DCHECK_CALLED_ON_VALID_SEQUENCE(encoder_sequence_checker_);
 
-  available_va_surfaces_.push_back(std::move(scoped_va_surface_id));
+  available_va_surface_ids_.push_back(va_surface_id);
   EncodePendingInputs();
 }
 
 void VaapiVideoEncodeAccelerator::RecycleVPPVASurfaceID(
-    std::unique_ptr<ScopedVASurfaceID> scoped_va_surface_id,
-    VASurfaceID /* va_surface_id */) {
-  DCHECK(scoped_va_surface_id);
-  DVLOGF(4) << "va_surface_id: " << scoped_va_surface_id->id();
+    VASurfaceID va_surface_id) {
+  DVLOGF(4) << "va_surface_id: " << va_surface_id;
   DCHECK_CALLED_ON_VALID_SEQUENCE(encoder_sequence_checker_);
 
-  available_vpp_va_surfaces_.push_back(std::move(scoped_va_surface_id));
+  available_vpp_va_surface_ids_.push_back(va_surface_id);
   EncodePendingInputs();
 }
 
@@ -621,8 +615,8 @@
     return nullptr;
   }
 
-  if (available_va_surfaces_.size() < va_surfaces_per_video_frame_ ||
-      (vpp_vaapi_wrapper_ && available_vpp_va_surfaces_.empty())) {
+  if (available_va_surface_ids_.size() < va_surfaces_per_video_frame_ ||
+      (vpp_vaapi_wrapper_ && available_vpp_va_surface_ids_.empty())) {
     DVLOGF(4) << "Not enough surfaces available";
     return nullptr;
   }
@@ -669,14 +663,10 @@
                        << ", but got: " << frame->visible_rect().ToString());
       return nullptr;
     }
-
-    const VASurfaceID input_surface_id = available_va_surfaces_.back()->id();
-    input_surface = new VASurface(
-        input_surface_id, encoder_->GetCodedSize(), kVaSurfaceFormat,
-        base::BindOnce(&VaapiVideoEncodeAccelerator::RecycleVASurfaceID,
-                       encoder_weak_this_,
-                       std::move(available_va_surfaces_.back())));
-    available_va_surfaces_.pop_back();
+    input_surface = new VASurface(available_va_surface_ids_.back(),
+                                  encoder_->GetCodedSize(), kVaSurfaceFormat,
+                                  base::BindOnce(va_surface_release_cb_));
+    available_va_surface_ids_.pop_back();
   }
 
   if (visible_rect_ != frame->visible_rect()) {
@@ -694,32 +684,20 @@
       }
 
       // Allocate the same number of surfaces as reconstructed surfaces.
-      std::vector<VASurfaceID> surface_ids;
       if (!vpp_vaapi_wrapper_->CreateContextAndSurfaces(
               kVaSurfaceFormat, aligned_va_surface_size_,
               VaapiWrapper::SurfaceUsageHint::kVideoProcessWrite,
-              num_frames_in_flight_ + 1, &surface_ids)) {
+              num_frames_in_flight_ + 1, &available_vpp_va_surface_ids_)) {
         NOTIFY_ERROR(kPlatformFailureError,
                      "Failed creating VASurfaces for scaling");
         vpp_vaapi_wrapper_ = nullptr;
         return nullptr;
-      }
-      for (const VASurfaceID surface_id : surface_ids) {
-        available_vpp_va_surfaces_.push_back(
-            std::make_unique<ScopedVASurfaceID>(
-                surface_id, base::BindOnce(&VaapiWrapper::DestroySurface,
-                                           vpp_vaapi_wrapper_)));
-      }
+      };
     }
-
-    const VASurfaceID blit_surface_id = available_vpp_va_surfaces_.back()->id();
     scoped_refptr<VASurface> blit_surface = new VASurface(
-        blit_surface_id, aligned_va_surface_size_, kVaSurfaceFormat,
-        base::BindOnce(&VaapiVideoEncodeAccelerator::RecycleVPPVASurfaceID,
-                       encoder_weak_this_,
-                       std::move(available_vpp_va_surfaces_.back())));
-    available_vpp_va_surfaces_.pop_back();
-
+        available_vpp_va_surface_ids_.back(), aligned_va_surface_size_,
+        kVaSurfaceFormat, base::BindOnce(vpp_va_surface_release_cb_));
+    available_vpp_va_surface_ids_.pop_back();
     // Crop/Scale the visible area of |frame->visible_rect()| ->
     // |visible_rect_|.
     if (!vpp_vaapi_wrapper_->BlitSurface(*input_surface, *blit_surface,
@@ -742,14 +720,10 @@
   // Here, the surface size contained in |input_surface| is
   // |aligned_va_surface_size_| regardless of scaling in zero-copy mode, and
   // encoder_->GetCodedSize().
-  const VASurfaceID reconstructed_surface_id =
-      available_va_surfaces_.back()->id();
-  scoped_refptr<VASurface> reconstructed_surface = new VASurface(
-      reconstructed_surface_id, encoder_->GetCodedSize(), kVaSurfaceFormat,
-      base::BindOnce(&VaapiVideoEncodeAccelerator::RecycleVASurfaceID,
-                     encoder_weak_this_,
-                     std::move(available_va_surfaces_.back())));
-  available_va_surfaces_.pop_back();
+  scoped_refptr<VASurface> reconstructed_surface =
+      new VASurface(available_va_surface_ids_.back(), encoder_->GetCodedSize(),
+                    kVaSurfaceFormat, base::BindOnce(va_surface_release_cb_));
+  available_va_surface_ids_.pop_back();
 
   auto job = std::make_unique<VaapiEncodeJob>(
       frame, force_keyframe,
@@ -920,34 +894,33 @@
   VLOGF(2);
   DCHECK_CALLED_ON_VALID_SEQUENCE(encoder_sequence_checker_);
 
+  encoder_weak_this_factory_.InvalidateWeakPtrs();
+
   if (flush_callback_) {
     child_task_runner_->PostTask(
         FROM_HERE, base::BindOnce(std::move(flush_callback_), false));
   }
 
   // Clean up members that are to be accessed on the encoder thread only.
-  available_bitstream_buffers_ = {};
-  input_queue_ = {};
-
-  // Release input and reconstructed surfaces held by
-  // |submitted_encode_jobs_|.
-  submitted_encode_jobs_ = {};
-
-  // Release reconstructed surfaces held by |encoder_| as reference pictures.
-  encoder_ = nullptr;
-
-  // Invalidate |encoder_weak_this_| so that the above clean up can let surfaces
-  // be back to |available_va_surfaces_ids_| and
-  // |available_vpp_va_surfaces_ids_|.
-  encoder_weak_this_factory_.InvalidateWeakPtrs();
-
   if (vaapi_wrapper_)
-    vaapi_wrapper_->DestroyContext();
-  if (vpp_vaapi_wrapper_)
-    vpp_vaapi_wrapper_->DestroyContext();
+    vaapi_wrapper_->DestroyContextAndSurfaces(available_va_surface_ids_);
+  if (vpp_vaapi_wrapper_) {
+    vpp_vaapi_wrapper_->DestroyContextAndSurfaces(
+        available_vpp_va_surface_ids_);
+  }
 
-  available_va_surfaces_.clear();
-  available_vpp_va_surfaces_.clear();
+  available_va_buffer_ids_.clear();
+
+  while (!available_bitstream_buffers_.empty())
+    available_bitstream_buffers_.pop();
+
+  while (!input_queue_.empty())
+    input_queue_.pop();
+
+  while (!submitted_encode_jobs_.empty())
+    submitted_encode_jobs_.pop();
+
+  encoder_ = nullptr;
 
   delete this;
 }
diff --git a/media/gpu/vaapi/vaapi_video_encode_accelerator.h b/media/gpu/vaapi/vaapi_video_encode_accelerator.h
index 5af15d8..cdb90fd4 100644
--- a/media/gpu/vaapi/vaapi_video_encode_accelerator.h
+++ b/media/gpu/vaapi/vaapi_video_encode_accelerator.h
@@ -25,8 +25,6 @@
 namespace media {
 
 class VaapiEncodeJob;
-template <typename T>
-class ScopedID;
 
 // A VideoEncodeAccelerator implementation that uses VA-API
 // (https://01.org/vaapi) for HW-accelerated video encode.
@@ -55,9 +53,6 @@
   class VP8Accelerator;
   class VP9Accelerator;
 
-  // A self-cleaning VASurfaceID.
-  using ScopedVASurfaceID = ScopedID<VASurfaceID>;
-
   // Encoder state.
   enum State {
     kUninitialized,
@@ -118,16 +113,12 @@
   void ExecuteEncode(VASurfaceID va_surface_id);
 
   // Callback that returns a no longer used VASurfaceID to
-  // |available_va_surfaces_| for reuse.
-  void RecycleVASurfaceID(
-      std::unique_ptr<ScopedVASurfaceID> scoped_va_surface_id,
-      VASurfaceID va_surface_id);
+  // |available_va_surface_ids_| for reuse.
+  void RecycleVASurfaceID(VASurfaceID va_surface_id);
 
   // Callback that returns a no longer used VASurfaceID to
-  // |available_vpp_va_surfaces_| for reuse.
-  void RecycleVPPVASurfaceID(
-      std::unique_ptr<ScopedVASurfaceID> scoped_va_surface_id,
-      VASurfaceID va_surface_id);
+  // |available_vpp_va_surface_ids_| for reuse.
+  void RecycleVPPVASurfaceID(VASurfaceID va_surface_id);
 
   // Returns a bitstream buffer to the client if both a previously executed job
   // awaits to be completed and we have bitstream buffers available to download
@@ -204,9 +195,9 @@
   std::unique_ptr<AcceleratedVideoEncoder> encoder_;
 
   // VA surfaces available for encoding.
-  std::vector<std::unique_ptr<ScopedVASurfaceID>> available_va_surfaces_;
+  std::vector<VASurfaceID> available_va_surface_ids_;
   // VA surfaces available for scaling.
-  std::vector<std::unique_ptr<ScopedVASurfaceID>> available_vpp_va_surfaces_;
+  std::vector<VASurfaceID> available_vpp_va_surface_ids_;
 
   // VASurfaceIDs internal format.
   static constexpr unsigned int kVaSurfaceFormat = VA_RT_FORMAT_YUV420;
@@ -214,6 +205,10 @@
   // VA buffers for coded frames.
   std::vector<VABufferID> available_va_buffer_ids_;
 
+  // Callback via which finished VA surfaces are returned to us.
+  base::RepeatingCallback<void(VASurfaceID)> va_surface_release_cb_;
+  base::RepeatingCallback<void(VASurfaceID)> vpp_va_surface_release_cb_;
+
   // Queue of input frames to be encoded.
   base::queue<std::unique_ptr<InputFrameRef>> input_queue_;
 
diff --git a/net/proxy_resolution/proxy_resolver_mac.cc b/net/proxy_resolution/proxy_resolver_mac.cc
index ce42aa72..768f07008 100644
--- a/net/proxy_resolution/proxy_resolver_mac.cc
+++ b/net/proxy_resolution/proxy_resolver_mac.cc
@@ -149,13 +149,15 @@
 
 void SynchronizedRunLoopObserver::RunLoopObserverCallBack(
     CFRunLoopObserverRef observer,
-    CFRunLoopActivity activity) {
+    CFRunLoopActivity activity) NO_THREAD_SAFETY_ANALYSIS {
   DCHECK(thread_checker_.CalledOnValidThread());
   // Acquire the lock when a source has been signaled and going to be fired.
   // In the context of the proxy resolver that happens when the proxy for a
   // given URL has been resolved and the callback function that handles the
   // result is going to be fired.
   // Release the lock when all source events have been handled.
+  //
+  // NO_THREAD_SAFETY_ANALYSIS: Runtime dependent locking.
   switch (activity) {
     case kCFRunLoopBeforeSources:
       if (!lock_acquired_) {
diff --git a/pdf/pdfium/pdfium_engine_exports.cc b/pdf/pdfium/pdfium_engine_exports.cc
index 3ad7227..bd151d5a 100644
--- a/pdf/pdfium/pdfium_engine_exports.cc
+++ b/pdf/pdfium/pdfium_engine_exports.cc
@@ -132,16 +132,22 @@
 
 base::Value RecursiveGetStructTree(FPDF_STRUCTELEMENT struct_elem) {
   constexpr int kBufLen = 64;
-  base::char16 elem_type_buffer[kBufLen];
-  if (!FPDF_StructElement_GetType(struct_elem, elem_type_buffer,
-                                  sizeof(elem_type_buffer))) {
+  base::char16 str_buffer[kBufLen];
+  if (!FPDF_StructElement_GetType(struct_elem, str_buffer,
+                                  sizeof(str_buffer))) {
     return base::Value(base::Value::Type::NONE);
   }
 
   base::Value result(base::Value::Type::DICTIONARY);
-  base::string16 elem_type(elem_type_buffer);
+  base::string16 elem_type(str_buffer);
   result.SetStringKey("type", elem_type);
 
+  if (FPDF_StructElement_GetAltText(struct_elem, str_buffer,
+                                    sizeof(str_buffer))) {
+    base::string16 alt_text(str_buffer);
+    result.SetStringKey("alt", alt_text);
+  }
+
   int children_count = FPDF_StructElement_CountChildren(struct_elem);
   if (children_count == 0)
     return base::Value(base::Value::Type::NONE);
diff --git a/ppapi/shared_impl/proxy_lock.cc b/ppapi/shared_impl/proxy_lock.cc
index 045f1c9..e1c06521 100644
--- a/ppapi/shared_impl/proxy_lock.cc
+++ b/ppapi/shared_impl/proxy_lock.cc
@@ -35,7 +35,8 @@
 // locking).
 
 // static
-void ProxyLock::Acquire() {
+void ProxyLock::Acquire() NO_THREAD_SAFETY_ANALYSIS {
+  // NO_THREAD_SAFETY_ANALYSIS: Runtime dependent locking.
   base::Lock* lock = Get();
   if (lock) {
     // This thread does not already hold the lock.
@@ -48,7 +49,8 @@
 }
 
 // static
-void ProxyLock::Release() {
+void ProxyLock::Release() NO_THREAD_SAFETY_ANALYSIS {
+  // NO_THREAD_SAFETY_ANALYSIS: Runtime dependent locking.
   base::Lock* lock = Get();
   if (lock) {
     // This thread currently holds the lock.
diff --git a/printing/common/BUILD.gn b/printing/common/BUILD.gn
index e2b1a34..46d7ad3 100644
--- a/printing/common/BUILD.gn
+++ b/printing/common/BUILD.gn
@@ -10,6 +10,7 @@
 
   deps = [
     "//base",
+    "//printing/buildflags",
     "//skia",
     "//ui/accessibility",
   ]
diff --git a/printing/common/metafile_utils.cc b/printing/common/metafile_utils.cc
index 66945f8..9dd15e5 100644
--- a/printing/common/metafile_utils.cc
+++ b/printing/common/metafile_utils.cc
@@ -5,6 +5,7 @@
 #include "printing/common/metafile_utils.h"
 
 #include "base/time/time.h"
+#include "printing/buildflags/buildflags.h"
 #include "third_party/skia/include/core/SkCanvas.h"
 #include "third_party/skia/include/core/SkPicture.h"
 #include "third_party/skia/include/core/SkPictureRecorder.h"
@@ -12,11 +13,27 @@
 #include "third_party/skia/include/docs/SkPDFDocument.h"
 #include "ui/accessibility/ax_node.h"
 #include "ui/accessibility/ax_node_data.h"
+#include "ui/accessibility/ax_role_properties.h"
 #include "ui/accessibility/ax_tree.h"
 #include "ui/accessibility/ax_tree_update.h"
 
 namespace {
 
+#if BUILDFLAG(ENABLE_TAGGED_PDF)
+// Standard attribute owners from PDF 32000-1:2008 spec, section 14.8.5.2
+// (Attribute owners are kind of like "categories" for structure node
+// attributes.)
+const char kPDFTableAttributeOwner[] = "Table";
+
+// Table Attributes from PDF 32000-1:2008 spec, section 14.8.5.7
+const char kPDFTableCellColSpanAttribute[] = "ColSpan";
+const char kPDFTableCellHeadersAttribute[] = "Headers";
+const char kPDFTableCellRowSpanAttribute[] = "RowSpan";
+const char kPDFTableHeaderScopeAttribute[] = "Scope";
+const char kPDFTableHeaderScopeColumn[] = "Column";
+const char kPDFTableHeaderScopeRow[] = "Row";
+#endif  // BUILDFLAG(ENABLE_TAGGED_PDF)
+
 SkTime::DateTime TimeToSkTime(base::Time time) {
   base::Time::Exploded exploded;
   time.UTCExplode(&exploded);
@@ -46,6 +63,7 @@
 // have enough data to build a valid tree.
 bool RecursiveBuildStructureTree(const ui::AXNode* ax_node,
                                  SkPDF::StructureElementNode* tag) {
+#if BUILDFLAG(ENABLE_TAGGED_PDF)
   bool valid = false;
 
   tag->fNodeId = ax_node->GetIntAttribute(ax::mojom::IntAttribute::kDOMNodeId);
@@ -79,16 +97,46 @@
       tag->fType = SkPDF::DocumentStructureType::kTR;
       break;
     case ax::mojom::Role::kColumnHeader:
+      tag->fType = SkPDF::DocumentStructureType::kTH;
+      tag->fAttributes.appendString(kPDFTableAttributeOwner,
+                                    kPDFTableHeaderScopeAttribute,
+                                    kPDFTableHeaderScopeColumn);
+      break;
     case ax::mojom::Role::kRowHeader:
       tag->fType = SkPDF::DocumentStructureType::kTH;
+      tag->fAttributes.appendString(kPDFTableAttributeOwner,
+                                    kPDFTableHeaderScopeAttribute,
+                                    kPDFTableHeaderScopeRow);
       break;
-    case ax::mojom::Role::kCell:
+    case ax::mojom::Role::kCell: {
       tag->fType = SkPDF::DocumentStructureType::kTD;
+
+      // Append an attribute consisting of the string IDs of all of the
+      // header cells that correspond to this table cell.
+      std::vector<ui::AXNode*> header_nodes;
+      ax_node->GetTableCellColHeaders(&header_nodes);
+      ax_node->GetTableCellRowHeaders(&header_nodes);
+      std::vector<SkString> header_id_strs;
+      header_id_strs.reserve(header_nodes.size());
+      for (ui::AXNode* header_node : header_nodes) {
+        int node_id =
+            header_node->GetIntAttribute(ax::mojom::IntAttribute::kDOMNodeId);
+        header_id_strs.push_back(
+            SkString(base::NumberToString(node_id).c_str()));
+      }
+      tag->fAttributes.appendStringArray(kPDFTableAttributeOwner,
+                                         kPDFTableCellHeadersAttribute,
+                                         header_id_strs);
       break;
+    }
     case ax::mojom::Role::kFigure:
-    case ax::mojom::Role::kImage:
+    case ax::mojom::Role::kImage: {
       tag->fType = SkPDF::DocumentStructureType::kFigure;
+      std::string alt =
+          ax_node->GetStringAttribute(ax::mojom::StringAttribute::kName);
+      tag->fAlt = SkString(alt.c_str());
       break;
+    }
     case ax::mojom::Role::kStaticText:
       // Currently we're only marking text content, so we can't generate
       // a nonempty structure tree unless we have at least one kStaticText
@@ -100,6 +148,27 @@
       tag->fType = SkPDF::DocumentStructureType::kNonStruct;
   }
 
+  if (ui::IsCellOrTableHeader(ax_node->data().role)) {
+    base::Optional<int> row_span = ax_node->GetTableCellRowSpan();
+    if (row_span.has_value()) {
+      tag->fAttributes.appendInt(kPDFTableAttributeOwner,
+                                 kPDFTableCellRowSpanAttribute,
+                                 row_span.value());
+    }
+    base::Optional<int> col_span = ax_node->GetTableCellColSpan();
+    if (col_span.has_value()) {
+      tag->fAttributes.appendInt(kPDFTableAttributeOwner,
+                                 kPDFTableCellColSpanAttribute,
+                                 col_span.value());
+    }
+  }
+
+  std::string lang = ax_node->GetLanguage();
+  std::string parent_lang =
+      ax_node->parent() ? ax_node->parent()->GetLanguage() : "";
+  if (!lang.empty() && lang != parent_lang)
+    tag->fLang = lang.c_str();
+
   size_t children_count = ax_node->GetUnignoredChildCount();
   tag->fChildVector.resize(children_count);
   for (size_t i = 0; i < children_count; i++) {
@@ -112,6 +181,9 @@
   }
 
   return valid;
+#else  // BUILDFLAG(ENABLE_TAGGED_PDF)
+  return false;
+#endif
 }
 
 }  // namespace
diff --git a/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc b/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
index 712f969..e13fbc3 100644
--- a/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
+++ b/sandbox/linux/seccomp-bpf-helpers/baseline_policy.cc
@@ -11,7 +11,7 @@
 #include <sys/types.h>
 #include <unistd.h>
 
-#include "base/clang_profiling_buildflags.h"
+#include "base/clang_coverage_buildflags.h"
 #include "base/logging.h"
 #include "build/build_config.h"
 #include "sandbox/linux/bpf_dsl/bpf_dsl.h"
@@ -128,7 +128,7 @@
 #endif  // defined(ADDRESS_SANITIZER) || defined(THREAD_SANITIZER) ||
         // defined(MEMORY_SANITIZER)
 
-#if BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
+#if BUILDFLAG(CLANG_COVERAGE_INSIDE_SANDBOX)
   if (SyscallSets::IsPrctl(sysno)) {
     return Allow();
   }
diff --git a/sandbox/linux/seccomp-bpf-helpers/baseline_policy_unittest.cc b/sandbox/linux/seccomp-bpf-helpers/baseline_policy_unittest.cc
index fc36187c..ddf69c49 100644
--- a/sandbox/linux/seccomp-bpf-helpers/baseline_policy_unittest.cc
+++ b/sandbox/linux/seccomp-bpf-helpers/baseline_policy_unittest.cc
@@ -24,7 +24,7 @@
 #include <time.h>
 #include <unistd.h>
 
-#include "base/clang_profiling_buildflags.h"
+#include "base/clang_coverage_buildflags.h"
 #include "base/files/scoped_file.h"
 #include "base/macros.h"
 #include "base/posix/eintr_wrapper.h"
@@ -345,7 +345,7 @@
 #define PR_CAPBSET_READ 23
 #endif
 
-#if !BUILDFLAG(CLANG_PROFILING_INSIDE_SANDBOX)
+#if !BUILDFLAG(CLANG_COVERAGE_INSIDE_SANDBOX)
 BPF_DEATH_TEST_C(BaselinePolicy,
                  PrctlSigsys,
                  DEATH_SEGV_MESSAGE(GetPrctlErrorMessageContentForTests()),
diff --git a/testing/android/native_test/native_test_launcher.cc b/testing/android/native_test/native_test_launcher.cc
index 9fd87ca8..c66af52b 100644
--- a/testing/android/native_test/native_test_launcher.cc
+++ b/testing/android/native_test/native_test_launcher.cc
@@ -18,7 +18,7 @@
 #include "base/android/scoped_java_ref.h"
 #include "base/at_exit.h"
 #include "base/base_switches.h"
-#include "base/clang_profiling_buildflags.h"
+#include "base/clang_coverage_buildflags.h"
 #include "base/command_line.h"
 #include "base/debug/debugger.h"
 #include "base/files/file_path.h"
@@ -33,8 +33,8 @@
 #include "testing/android/native_test/native_test_jni_headers/NativeTest_jni.h"
 #include "testing/android/native_test/native_test_util.h"
 
-#if BUILDFLAG(CLANG_PROFILING)
-#include "base/test/clang_profiling.h"
+#if BUILDFLAG(CLANG_COVERAGE)
+#include "base/test/clang_coverage.h"
 #endif
 
 using base::android::JavaParamRef;
@@ -140,9 +140,9 @@
   ScopedMainEntryLogger scoped_main_entry_logger;
   main(argc, &argv[0]);
 
-// Explicitly write profiling data to LLVM profile file.
-#if BUILDFLAG(CLANG_PROFILING)
-  base::WriteClangProfilingProfile();
+// Explicitly write coverage data to LLVM profile file.
+#if BUILDFLAG(CLANG_COVERAGE)
+  base::WriteClangCoverageProfile();
 #endif
 }
 
diff --git a/testing/buildbot/chromium.linux.json b/testing/buildbot/chromium.linux.json
index 4d3e981..8b52421 100644
--- a/testing/buildbot/chromium.linux.json
+++ b/testing/buildbot/chromium.linux.json
@@ -2513,7 +2513,31 @@
     ]
   },
   "Linux Ozone Tester (Wayland)": {
-    "gtest_tests": []
+    "gtest_tests": [
+      {
+        "args": [
+          "--test-launcher-filter-file=../../testing/buildbot/filters/ozone-linux.wayland_views_unittests.filter",
+          "--no-xvfb",
+          "--use-weston",
+          "--ozone-platform=wayland"
+        ],
+        "merge": {
+          "args": [],
+          "script": "//testing/merge_scripts/standard_gtest_merge.py"
+        },
+        "name": "wayland_views_unittests",
+        "swarming": {
+          "can_use_on_swarming_builders": true,
+          "dimension_sets": [
+            {
+              "os": "Ubuntu-16.04"
+            }
+          ]
+        },
+        "test": "views_unittests",
+        "test_target": "//ui/views:views_unittests"
+      }
+    ]
   },
   "Linux Ozone Tester (X11)": {
     "gtest_tests": [
@@ -2552,49 +2576,11 @@
             }
           ]
         },
-        "test": "ozone_unittests",
-        "test_target": "//ui/ozone:ozone_unittests"
-      },
-      {
-        "args": [
-          "--ozone-platform=x11"
-        ],
-        "merge": {
-          "args": [],
-          "script": "//testing/merge_scripts/standard_gtest_merge.py"
-        },
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "os": "Ubuntu-16.04"
-            }
-          ]
-        },
         "test": "ozone_x11_unittests",
         "test_target": "//ui/ozone:ozone_x11_unittests"
       },
       {
         "args": [
-          "--ozone-platform=x11"
-        ],
-        "merge": {
-          "args": [],
-          "script": "//testing/merge_scripts/standard_gtest_merge.py"
-        },
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "os": "Ubuntu-16.04"
-            }
-          ]
-        },
-        "test": "services_unittests",
-        "test_target": "//services:services_unittests"
-      },
-      {
-        "args": [
           "--test-launcher-filter-file=../../testing/buildbot/filters/ozone-linux.x11_views_unittests.filter",
           "--ozone-platform=x11"
         ],
@@ -6215,26 +6201,6 @@
         "test_target": "//content/test:content_unittests"
       },
       {
-        "args": [
-          "--ozone-platform=x11"
-        ],
-        "merge": {
-          "args": [],
-          "script": "//testing/merge_scripts/standard_gtest_merge.py"
-        },
-        "name": "x11_content_unittests",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "os": "Ubuntu-16.04"
-            }
-          ]
-        },
-        "test": "content_unittests",
-        "test_target": "//content/test:content_unittests"
-      },
-      {
         "experiment_percentage": 100,
         "merge": {
           "args": [],
@@ -6280,45 +6246,8 @@
             }
           ]
         },
-        "test": "ozone_x11_unittests",
-        "test_target": "//ui/ozone:ozone_x11_unittests"
-      },
-      {
-        "merge": {
-          "args": [],
-          "script": "//testing/merge_scripts/standard_gtest_merge.py"
-        },
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "os": "Ubuntu-16.04"
-            }
-          ]
-        },
         "test": "services_unittests",
         "test_target": "//services:services_unittests"
-      },
-      {
-        "args": [
-          "--ozone-platform=x11",
-          "--test-launcher-filter-file=../../testing/buildbot/filters/ozone-linux.x11_views_unittests.filter"
-        ],
-        "merge": {
-          "args": [],
-          "script": "//testing/merge_scripts/standard_gtest_merge.py"
-        },
-        "name": "x11_views_unittests",
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "os": "Ubuntu-16.04"
-            }
-          ]
-        },
-        "test": "views_unittests",
-        "test_target": "//ui/views:views_unittests"
       }
     ]
   },
diff --git a/testing/buildbot/filters/BUILD.gn b/testing/buildbot/filters/BUILD.gn
index b7b9391f..2101297 100644
--- a/testing/buildbot/filters/BUILD.gn
+++ b/testing/buildbot/filters/BUILD.gn
@@ -151,7 +151,10 @@
 }
 
 source_set("linux_ozone_views_unittests_filters") {
-  data = [ "//testing/buildbot/filters/ozone-linux.x11_views_unittests.filter" ]
+  data = [
+    "//testing/buildbot/filters/ozone-linux.x11_views_unittests.filter",
+    "//testing/buildbot/filters/ozone-linux.wayland_views_unittests.filter",
+  ]
 }
 
 source_set("linux_trusty_rel_browser_tests_filters") {
diff --git a/testing/buildbot/filters/ozone-linux.wayland_views_unittests.filter b/testing/buildbot/filters/ozone-linux.wayland_views_unittests.filter
new file mode 100644
index 0000000..60df3322
--- /dev/null
+++ b/testing/buildbot/filters/ozone-linux.wayland_views_unittests.filter
@@ -0,0 +1,54 @@
+# https://crbug.com/ : Fix this failed and crashed tests.
+
+# Failed tests.
+-DesktopWidgetFocusManagerTest.AnchoredDialogInDesktopNativeWidgetAura
+-DesktopWidgetTest.GetWindowPlacement
+-EditableComboboxTest.AltLeftOrRightDoesNothing
+-EditableComboboxTest.CtrlLeftOrRightMovesToNextWords
+-EditableComboboxTest.EndOrHomeMovesToBeginningOrEndOfText
+-EditableComboboxTest.EnterClosesMenuWhileSelectingHighlightedMenuItem
+-EditableComboboxTest.EscClosesMenuWithoutSelectingHighlightedMenuItem
+-EditableComboboxTest.F4ClosesMenuWhileSelectingHighlightedMenuItem
+-EditableComboboxTest.LeftOrRightKeysMoveInTextfield
+-EditableComboboxTest.MenuCanAdaptToContentChange
+-EditableComboboxTest.RefocusingReopensMenuBasedOnLatestContent
+-EditableComboboxTest.ShiftLeftOrRightSelectsCharInTextfield
+-EditableComboboxTest.SpaceIsReflectedInTextfield
+-EditableComboboxTest.TypingInTextfieldUnhighlightsMenuItem
+-EditableComboboxTest.UpOrDownKeysMoveInMenu
+-MenuRunnerTest.LatinMnemonic
+-TextfieldTest.ContextMenuDisplayTest
+-TextfieldTest.ControlAndSelectTest
+-TextfieldTest.CursorMovement
+-TextfieldTest.CursorViewHeight
+-TextfieldTest.CutCopyPasteWithEditCommand
+-TextfieldTest.InsertionDeletionTest
+-TextfieldTest.KeyTest
+-TextfieldTest.KeyTestControlModifier
+-TextfieldTest.OnKeyPressBinding
+-TextfieldTest.OverflowInRTLTest
+-TextfieldTest.OverflowTest
+-TextfieldTest.OvertypeMode
+-TextfieldTest.RedoWithCtrlY
+-TextfieldTest.SwitchFocusInKeyDown
+-TextfieldTest.TextCursorDisplayInRTLTest
+-TextfieldTest.TextCursorDisplayTest
+-TextfieldTest.TextCursorPositionInLTRTest
+-TextfieldTest.TextCursorPositionInRTLTest
+-TextfieldTest.TextInputType_InsertionTest
+-TextfieldTest.TextfieldBoundsChangeTest
+-TextfieldTest.UndoRedoTest
+-TooltipControllerTest.DontShowTooltipOnTouch
+-TooltipControllerTest.EnableOrDisableTooltips
+-TooltipControllerTest.HideEmptyTooltip
+-TooltipControllerTest.HideOnExit
+-TooltipControllerTest.ReshowOnClickAfterEnterExit
+-TooltipControllerTest.TooltipHidesOnKeyPressAndStaysHiddenUntilChange
+-TooltipControllerTest.TooltipHidesOnTimeoutAndStaysHiddenUntilChange
+-TooltipControllerTest.TooltipsInMultipleViews
+-TooltipControllerTest.ViewTooltip
+
+# Crashed tests.
+-DesktopWidgetTest.MinimumSizeConstraints
+-TooltipControllerCaptureTest.Capture
+
diff --git a/testing/buildbot/test_suites.pyl b/testing/buildbot/test_suites.pyl
index 940aabd..eded0d7 100644
--- a/testing/buildbot/test_suites.pyl
+++ b/testing/buildbot/test_suites.pyl
@@ -3209,9 +3209,9 @@
       },
     },
 
-    'ozone_linux_gtests': {
+    'ozone_linux_gtests_headless': {
       'events_unittests': {
-	'experiment_percentage': 100,
+        'experiment_percentage': 100,
       },
       'headless_content_unittests': {
         'args': [
@@ -3220,32 +3220,21 @@
         'test': 'content_unittests',
       },
       'ozone_unittests': {},
-      'ozone_x11_unittests': {},
       'services_unittests': {},
-      'x11_content_unittests': {
+    },
+
+    'ozone_linux_gtests_wayland': {
+      'wayland_views_unittests': {
         'args': [
-          '--ozone-platform=x11',
-        ],
-        'test': 'content_unittests',
-      },
-      'x11_views_unittests': {
-        'args': [
-          '--ozone-platform=x11',
-          '--test-launcher-filter-file=../../testing/buildbot/filters/ozone-linux.x11_views_unittests.filter',
+          '--test-launcher-filter-file=../../testing/buildbot/filters/ozone-linux.wayland_views_unittests.filter',
         ],
         'test': 'views_unittests',
       }
     },
 
-    'ozone_linux_gtests_wayland': {
-      # TODO(crbug.com/1029241): Add tests once third_party weston is added.
-    },
-
     'ozone_linux_gtests_x11': {
       'content_unittests': {},
-      'ozone_unittests': {},
       'ozone_x11_unittests': {},
-      'services_unittests': {},
       'views_unittests': {
         'args': [
           '--test-launcher-filter-file=../../testing/buildbot/filters/ozone-linux.x11_views_unittests.filter',
diff --git a/testing/buildbot/waterfalls.pyl b/testing/buildbot/waterfalls.pyl
index 6211efd..93c86d5 100644
--- a/testing/buildbot/waterfalls.pyl
+++ b/testing/buildbot/waterfalls.pyl
@@ -3657,7 +3657,11 @@
         ]
       },
       'Linux Ozone Tester (Wayland)': {
-        'args': [ '--ozone-platform=wayland' ],
+        'args': [
+          '--no-xvfb',
+          '--use-weston',
+          '--ozone-platform=wayland'
+        ],
         'mixins': [
           'linux-xenial',
          ],
@@ -3731,7 +3735,7 @@
           'chrome',
         ],
         'test_suites': {
-          'gtest_tests': 'ozone_linux_gtests',
+          'gtest_tests': 'ozone_linux_gtests_headless',
         },
       },
       'linux-trusty-rel': {
diff --git a/testing/variations/fieldtrial_testing_config.json b/testing/variations/fieldtrial_testing_config.json
index 55bbcba..daeb331 100644
--- a/testing/variations/fieldtrial_testing_config.json
+++ b/testing/variations/fieldtrial_testing_config.json
@@ -5337,6 +5337,24 @@
             ]
         }
     ],
+    "SyncSetupFriendlySettings": [
+        {
+            "platforms": [
+                "chromeos",
+                "linux",
+                "mac",
+                "windows"
+            ],
+            "experiments": [
+                {
+                    "name": "Enabled",
+                    "enable_features": [
+                        "SyncSetupFriendlySettings"
+                    ]
+                }
+            ]
+        }
+    ],
     "SyncUSSNigori": [
         {
             "platforms": [
diff --git a/testing/xvfb.py b/testing/xvfb.py
index b1f2fc2e..346d0212 100755
--- a/testing/xvfb.py
+++ b/testing/xvfb.py
@@ -3,10 +3,12 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-"""Runs tests with Xvfb and Openbox on Linux and normally on other platforms."""
+"""Runs tests with Xvfb and Openbox or Weston on Linux and normally on other
+   platforms."""
 
 import os
 import os.path
+import psutil
 import random
 import re
 import signal
@@ -22,6 +24,11 @@
   pass
 
 
+class _WestonProcessError(Exception):
+  """Exception raised when Weston cannot start."""
+  pass
+
+
 def kill(proc, name, timeout_in_seconds=10):
   """Tries to kill |proc| gracefully with a timeout for each signal."""
   if not proc:
@@ -78,7 +85,8 @@
 # TODO(crbug.com/949194): Encourage setting flags to False.
 def run_executable(
     cmd, env, stdoutfile=None, use_openbox=True, use_xcompmgr=True):
-  """Runs an executable within Xvfb on Linux or normally on other platforms.
+  """Runs an executable within Weston or Xvfb on Linux or normally on other
+     platforms.
 
   The method sets SIGUSR1 handler for Xvfb to return SIGUSR1
   when it is ready for connections.
@@ -87,7 +95,8 @@
   Args:
     cmd: Command to be executed.
     env: A copy of environment variables, "DISPLAY" and
-      "_CHROMIUM_INSIDE_XVFB" will be set if Xvfb is used.
+      "_CHROMIUM_INSIDE_XVFB" will be set if Xvfb is used. "WAYLAND_DISPLAY"
+      will be set if Weston is used.
     stdoutfile: If provided, symbolization via script is disabled and stdout
       is written to this file as well as to stdout.
     use_openbox: A flag to use openbox process.
@@ -110,97 +119,182 @@
     cmd.remove('--no-xvfb')
 
   # Tests that run on Linux platforms with Ozone/Wayland backend require
-  # a Weston instance. However, there is no solution to run pure headless
-  # Wayland at the moment. Instead, the Weston compositor runs on top of
-  # X Server, which is ok, because Weston does all the communication job
-  # internally and clients are using Wayland protocols normally and unaware
-  # of the X.
+  # a Weston instance. However, it is also required to disable xvfb so
+  # that Weston can run in a pure headless environment.
   use_weston = False
   if '--use-weston' in cmd:
-    if not use_xvfb:
-      print >> sys.stderr, 'Unable to use Weston without xvfb'
+    if use_xvfb:
+      print >> sys.stderr, 'Unable to use Weston with xvfb.'
       return 1
     use_weston = True
     cmd.remove('--use-weston')
 
   if sys.platform == 'linux2' and use_xvfb:
-    env['_CHROMIUM_INSIDE_XVFB'] = '1'
-    openbox_proc = None
-    xcompmgr_proc = None
-    weston_proc = None
-    xvfb_proc = None
-    xvfb_ready = MutableBoolean()
-    def set_xvfb_ready(*_):
-      xvfb_ready.setvalue(True)
-
-    try:
-      signal.signal(signal.SIGTERM, raise_xvfb_error)
-      signal.signal(signal.SIGINT, raise_xvfb_error)
-
-      # Due to race condition for display number, Xvfb might fail to run.
-      # If it does fail, try again up to 10 times, similarly to xvfb-run.
-      for _ in range(10):
-        xvfb_ready.setvalue(False)
-        display = find_display()
-
-        # Sets SIGUSR1 to ignore for Xvfb to signal current process
-        # when it is ready. Due to race condition, USR1 signal could be sent
-        # before the process resets the signal handler, we cannot rely on
-        # signal handler to change on time.
-        signal.signal(signal.SIGUSR1, signal.SIG_IGN)
-        xvfb_proc = subprocess.Popen(
-            ['Xvfb', display, '-screen', '0', '1280x800x24', '-ac',
-             '-nolisten', 'tcp', '-dpi', '96', '+extension', 'RANDR'],
-            stderr=subprocess.STDOUT, env=env)
-        signal.signal(signal.SIGUSR1, set_xvfb_ready)
-        for _ in range(10):
-          time.sleep(.1)  # gives Xvfb time to start or fail.
-          if xvfb_ready.getvalue() or xvfb_proc.poll() is not None:
-            break  # xvfb sent ready signal, or already failed and stopped.
-
-        if xvfb_proc.poll() is None:
-          break  # xvfb is running, can proceed.
-      if xvfb_proc.poll() is not None:
-        raise _XvfbProcessError('Failed to start after 10 tries')
-
-      env['DISPLAY'] = display
-
-      dbus_pid = launch_dbus(env)
-
-      if use_openbox:
-        openbox_proc = subprocess.Popen(
-            'openbox', stderr=subprocess.STDOUT, env=env)
-
-      if use_xcompmgr:
-        xcompmgr_proc = subprocess.Popen(
-            'xcompmgr', stderr=subprocess.STDOUT, env=env)
-
-      if use_weston:
-        weston_proc = subprocess.Popen(
-            'weston', stderr=subprocess.STDOUT, env=env)
-
-      return test_env.run_executable(cmd, env, stdoutfile)
-    except OSError as e:
-      print >> sys.stderr, 'Failed to start Xvfb or Openbox: %s' % str(e)
-      return 1
-    except _XvfbProcessError as e:
-      print >> sys.stderr, 'Xvfb fail: %s' % str(e)
-      return 1
-    finally:
-      kill(openbox_proc, 'openbox')
-      kill(xcompmgr_proc, 'xcompmgr')
-      kill(weston_proc, 'weston')
-      kill(xvfb_proc, 'Xvfb')
-
-      # dbus-daemon is not a subprocess, so we can't SIGTERM+waitpid() on it.
-      # To ensure it exits, use SIGKILL which should be safe since all other
-      # processes that it would have been servicing have exited.
-      if dbus_pid:
-        os.kill(dbus_pid, signal.SIGKILL)
+    return _run_with_xvfb(cmd, env, stdoutfile, use_openbox, use_xcompmgr)
+  elif use_weston:
+    return _run_with_weston(cmd, env, stdoutfile)
   else:
     return test_env.run_executable(cmd, env, stdoutfile)
 
 
+def _run_with_xvfb(cmd, env, stdoutfile, use_openbox, use_xcompmgr):
+  env['_CHROMIUM_INSIDE_XVFB'] = '1'
+  openbox_proc = None
+  xcompmgr_proc = None
+  xvfb_proc = None
+  xvfb_ready = MutableBoolean()
+  def set_xvfb_ready(*_):
+    xvfb_ready.setvalue(True)
+
+  try:
+    signal.signal(signal.SIGTERM, raise_xvfb_error)
+    signal.signal(signal.SIGINT, raise_xvfb_error)
+
+    # Due to race condition for display number, Xvfb might fail to run.
+    # If it does fail, try again up to 10 times, similarly to xvfb-run.
+    for _ in range(10):
+      xvfb_ready.setvalue(False)
+      display = find_display()
+
+      # Sets SIGUSR1 to ignore for Xvfb to signal current process
+      # when it is ready. Due to race condition, USR1 signal could be sent
+      # before the process resets the signal handler, we cannot rely on
+      # signal handler to change on time.
+      signal.signal(signal.SIGUSR1, signal.SIG_IGN)
+      xvfb_proc = subprocess.Popen(
+          ['Xvfb', display, '-screen', '0', '1280x800x24', '-ac',
+           '-nolisten', 'tcp', '-dpi', '96', '+extension', 'RANDR'],
+          stderr=subprocess.STDOUT, env=env)
+      signal.signal(signal.SIGUSR1, set_xvfb_ready)
+      for _ in range(10):
+        time.sleep(.1)  # gives Xvfb time to start or fail.
+        if xvfb_ready.getvalue() or xvfb_proc.poll() is not None:
+          break  # xvfb sent ready signal, or already failed and stopped.
+
+      if xvfb_proc.poll() is None:
+        break  # xvfb is running, can proceed.
+    if xvfb_proc.poll() is not None:
+      raise _XvfbProcessError('Failed to start after 10 tries')
+
+    env['DISPLAY'] = display
+
+    dbus_pid = launch_dbus(env)
+
+    if use_openbox:
+      openbox_proc = subprocess.Popen(
+          'openbox', stderr=subprocess.STDOUT, env=env)
+
+    if use_xcompmgr:
+      xcompmgr_proc = subprocess.Popen(
+          'xcompmgr', stderr=subprocess.STDOUT, env=env)
+
+    return test_env.run_executable(cmd, env, stdoutfile)
+  except OSError as e:
+    print >> sys.stderr, 'Failed to start Xvfb or Openbox: %s' % str(e)
+    return 1
+  except _XvfbProcessError as e:
+    print >> sys.stderr, 'Xvfb fail: %s' % str(e)
+    return 1
+  finally:
+    kill(openbox_proc, 'openbox')
+    kill(xcompmgr_proc, 'xcompmgr')
+    kill(xvfb_proc, 'Xvfb')
+
+    # dbus-daemon is not a subprocess, so we can't SIGTERM+waitpid() on it.
+    # To ensure it exits, use SIGKILL which should be safe since all other
+    # processes that it would have been servicing have exited.
+    if dbus_pid:
+      os.kill(dbus_pid, signal.SIGKILL)
+
+
+# TODO(https://crbug.com/1060466): Write tests.
+def _run_with_weston(cmd, env, stdoutfile):
+  weston_proc = None
+
+  try:
+    signal.signal(signal.SIGTERM, raise_weston_error)
+    signal.signal(signal.SIGINT, raise_weston_error)
+
+    # Set $XDG_RUNTIME_DIR if it is not set.
+    _set_xdg_runtime_dir(env)
+
+    weston_proc_display = None
+    for _ in range(10):
+      # Weston is compiled along with the Ozone/Wayland platform, and is
+      # fetched as data deps. Thus, run it from the current directory.
+      weston_proc = subprocess.Popen(
+         ('./weston', '--backend=headless-backend.so'),
+         stderr=subprocess.STDOUT, env=env)
+
+      # Get the $WAYLAND_DISPLAY set by Weston and pass it to the test launcher.
+      # Please note that this env variable is local for the process. That's the
+      # reason we have to read it from Weston separately.
+      weston_proc_display = _get_display_from_weston(weston_proc.pid)
+      if weston_proc_display is not None:
+        break # Weston could launch and we found the display.
+
+    # If we couldn't find the display after 10 tries, raise an exception.
+    if weston_proc_display is None:
+      raise _WestonProcessError('Failed to start Weston.')
+    env['WAYLAND_DISPLAY'] = weston_proc_display
+    return test_env.run_executable(cmd, env, stdoutfile)
+  except OSError as e:
+    print >> sys.stderr, 'Failed to start Weston: %s' % str(e)
+    return 1
+  except _WestonProcessError as e:
+    print >> sys.stderr, 'Weston fail: %s' % str(e)
+    return 1
+  finally:
+    kill(weston_proc, 'weston')
+
+
+def _get_display_from_weston(weston_proc_pid):
+  """Retrieves $WAYLAND_DISPLAY set by Weston.
+
+  Searches for the child "weston-desktop-shell" process, takes its
+  environmental variables, and returns $WAYLAND_DISPLAY variable set
+  by that process. If the variable is not set, tries up to 10 times
+  and then gives up.
+
+  Args:
+    weston_proc_pid: The process of id of the main Weston process.
+
+  Returns:
+    the display set by Wayland, which clients can use to connect to.
+
+  TODO(https://crbug.com/1060469): This is potentially error prone
+  function. See the bug for further details.
+  """
+
+  # Try 10 times as it is not known when Weston spawn child desktop shell
+  # process.
+  for _ in range(10):
+    # gives weston time to start or fail.
+    time.sleep(.05)
+    # Take the parent process.
+    parent = psutil.Process(weston_proc_pid)
+    if parent is None:
+      break # The process is not found. Give up.
+    weston_proc_display = parent.environ().get('WAYLAND_DISPLAY')
+    # If display is set, Weston could start successfully and we can use
+    # that display for Wayland connection in Chromium.
+    if weston_proc_display is not None:
+      return weston_proc_display
+
+    # Traverse through all the children processes and find the
+    # "weston-desktop-shell" process that sets local to process env variables
+    # including the $WAYLAND_DISPLAY.
+    children = parent.children(recursive=True)
+    for process in children:
+      if process.name() == "weston-desktop-shell":
+        weston_proc_display = process.environ().get('WAYLAND_DISPLAY')
+        # If display is set, Weston could start successfully and we can use
+        # that display for Wayland connection in Chromium.
+        if weston_proc_display is not None:
+          return weston_proc_display
+  return None
+
+
 class MutableBoolean(object):
   """Simple mutable boolean class. Used to be mutated inside an handler."""
 
@@ -219,6 +313,10 @@
   raise _XvfbProcessError('Terminated')
 
 
+def raise_weston_error(*_):
+  raise _WestonProcessError('Terminated')
+
+
 def find_display():
   """Iterates through X-lock files to find an available display number.
 
@@ -241,6 +339,16 @@
   raise _XvfbProcessError('Failed to find display number')
 
 
+def _set_xdg_runtime_dir(env):
+  """Sets the $XDG_RUNTIME_DIR variable if it hasn't been set before."""
+  runtime_dir = env.get('XDG_RUNTIME_DIR')
+  if not runtime_dir:
+    runtime_dir = '/tmp/xdg-tmp-dir/'
+    if not os.path.exists(runtime_dir):
+      os.makedirs(runtime_dir, 0700)
+    env['XDG_RUNTIME_DIR'] = runtime_dir
+
+
 def main():
   usage = 'Usage: xvfb.py [command [--no-xvfb or --use-weston] args...]'
   if len(sys.argv) < 2:
diff --git a/third_party/blink/public/mojom/web_feature/web_feature.mojom b/third_party/blink/public/mojom/web_feature/web_feature.mojom
index 0a40681..82490ead 100644
--- a/third_party/blink/public/mojom/web_feature/web_feature.mojom
+++ b/third_party/blink/public/mojom/web_feature/web_feature.mojom
@@ -2522,6 +2522,9 @@
   kV8RTCRtpSender_CreateEncodedVideoStreams_Method = 3181,
   kV8RTCRtpReceiver_CreateEncodedAudioStreams_Method = 3182,
   kV8RTCRtpReceiver_CreateEncodedVideoStreams_Method = 3183,
+  kQuicTransport = 3184,
+  kQuicTransportStreamApis = 3185,
+  kQuicTransportDatagramApis = 3186,
 
   // Add new features immediately above this line. Don't change assigned
   // numbers of any item, and don't reuse removed slots.
diff --git a/third_party/blink/public/web/web_context_menu_data.h b/third_party/blink/public/web/web_context_menu_data.h
index 94a908d..7dfdb13b 100644
--- a/third_party/blink/public/web/web_context_menu_data.h
+++ b/third_party/blink/public/web/web_context_menu_data.h
@@ -62,12 +62,6 @@
   // Whether the image in context is a null.
   bool has_image_contents;
 
-  // The absolute URL of the page in context.
-  WebURL page_url;
-
-  // The absolute URL of the subframe in context.
-  WebURL frame_url;
-
   // The encoding for the frame in context.
   WebString frame_encoding;
 
diff --git a/third_party/blink/renderer/core/BUILD.gn b/third_party/blink/renderer/core/BUILD.gn
index efd68fa..171be5b 100644
--- a/third_party/blink/renderer/core/BUILD.gn
+++ b/third_party/blink/renderer/core/BUILD.gn
@@ -1251,6 +1251,7 @@
     "layout/ng/ng_column_layout_algorithm_test.cc",
     "layout/ng/ng_constraint_space_builder_test.cc",
     "layout/ng/ng_fieldset_layout_algorithm_test.cc",
+    "layout/ng/ng_fragment_child_iterator_test.cc",
     "layout/ng/ng_fragmentation_test.cc",
     "layout/ng/ng_inline_layout_test.cc",
     "layout/ng/ng_layout_result_caching_test.cc",
diff --git a/third_party/blink/renderer/core/css/mathml.css b/third_party/blink/renderer/core/css/mathml.css
index baaeadc..5adc7b1 100644
--- a/third_party/blink/renderer/core/css/mathml.css
+++ b/third_party/blink/renderer/core/css/mathml.css
@@ -46,7 +46,7 @@
     outline: auto 1px -webkit-focus-ring-color;
 }
 
-maction, merror, mphantom, mrow, mspace, mstyle
+maction, merror, mfrac, mphantom, mrow, mspace, mstyle
 {
     display: math;
 }
@@ -63,3 +63,8 @@
 mspace {
     overflow: hidden !important;
 }
+
+mfrac {
+  padding-inline-start: 1px;
+  padding-inline-end: 1px;
+}
diff --git a/third_party/blink/renderer/core/css/remote_font_face_source.cc b/third_party/blink/renderer/core/css/remote_font_face_source.cc
index 6a1ea49..c5c928be 100644
--- a/third_party/blink/renderer/core/css/remote_font_face_source.cc
+++ b/third_party/blink/renderer/core/css/remote_font_face_source.cc
@@ -5,6 +5,7 @@
 #include "third_party/blink/renderer/core/css/remote_font_face_source.h"
 
 #include "base/metrics/histogram_functions.h"
+#include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy_feature.mojom-blink.h"
 #include "third_party/blink/public/platform/task_type.h"
 #include "third_party/blink/public/platform/web_effective_connection_type.h"
@@ -27,58 +28,71 @@
 
 namespace blink {
 
-namespace {
-
-RemoteFontFaceSource::DisplayPeriod ComputePeriod(
-    FontDisplay displayValue,
-    RemoteFontFaceSource::Phase phase,
-    bool is_intervention_triggered) {
-  switch (displayValue) {
+RemoteFontFaceSource::DisplayPeriod RemoteFontFaceSource::ComputePeriod()
+    const {
+  switch (display_) {
     case kFontDisplayAuto:
-      if (is_intervention_triggered)
-        return RemoteFontFaceSource::kSwapPeriod;
+      if (is_intervention_triggered_)
+        return kSwapPeriod;
       FALLTHROUGH;
     case kFontDisplayBlock:
-      switch (phase) {
-        case RemoteFontFaceSource::kNoLimitExceeded:
-        case RemoteFontFaceSource::kShortLimitExceeded:
-          return RemoteFontFaceSource::kBlockPeriod;
-        case RemoteFontFaceSource::kLongLimitExceeded:
-          return RemoteFontFaceSource::kSwapPeriod;
+      switch (phase_) {
+        case kNoLimitExceeded:
+        case kShortLimitExceeded:
+          return kBlockPeriod;
+        case kLongLimitExceeded:
+          return kSwapPeriod;
       }
 
     case kFontDisplaySwap:
-      return RemoteFontFaceSource::kSwapPeriod;
+      return kSwapPeriod;
 
     case kFontDisplayFallback:
-      switch (phase) {
-        case RemoteFontFaceSource::kNoLimitExceeded:
-          return RemoteFontFaceSource::kBlockPeriod;
-        case RemoteFontFaceSource::kShortLimitExceeded:
-          return RemoteFontFaceSource::kSwapPeriod;
-        case RemoteFontFaceSource::kLongLimitExceeded:
-          return RemoteFontFaceSource::kFailurePeriod;
+      switch (phase_) {
+        case kNoLimitExceeded:
+          return kBlockPeriod;
+        case kShortLimitExceeded:
+          return kSwapPeriod;
+        case kLongLimitExceeded:
+          return kFailurePeriod;
       }
 
-    case kFontDisplayOptional:
-      switch (phase) {
-        case RemoteFontFaceSource::kNoLimitExceeded:
-          return RemoteFontFaceSource::kBlockPeriod;
-        case RemoteFontFaceSource::kShortLimitExceeded:
-        case RemoteFontFaceSource::kLongLimitExceeded:
-          return RemoteFontFaceSource::kFailurePeriod;
+    case kFontDisplayOptional: {
+      const bool use_phase_value =
+          !base::FeatureList::IsEnabled(
+              features::kFontPreloadingDelaysRendering) ||
+          !GetDocument();
+
+      if (use_phase_value) {
+        switch (phase_) {
+          case kNoLimitExceeded:
+            return kBlockPeriod;
+          case kShortLimitExceeded:
+          case kLongLimitExceeded:
+            return kFailurePeriod;
+        }
       }
 
+      // We simply skip the block period, as we should never render invisible
+      // fallback for 'font-display: optional'.
+
+      if (GetDocument()->GetFontPreloadManager().RenderingHasBegun()) {
+        if (FinishedFromMemoryCache() ||
+            finished_before_document_rendering_begin_)
+          return kSwapPeriod;
+        return kFailurePeriod;
+      }
+
+      return kSwapPeriod;
+    }
     case kFontDisplayEnumMax:
       NOTREACHED();
       break;
   }
   NOTREACHED();
-  return RemoteFontFaceSource::kSwapPeriod;
+  return kSwapPeriod;
 }
 
-}  // namespace
-
 RemoteFontFaceSource::RemoteFontFaceSource(CSSFontFace* css_font_face,
                                            FontSelector* font_selector,
                                            FontDisplay display)
@@ -90,13 +104,18 @@
                                                font_selector,
                                                ReportOptions::kDoNotReport)),
       phase_(kNoLimitExceeded),
-      is_intervention_triggered_(ShouldTriggerWebFontsIntervention()) {
+      is_intervention_triggered_(ShouldTriggerWebFontsIntervention()),
+      finished_before_document_rendering_begin_(false) {
   DCHECK(face_);
-  period_ = ComputePeriod(display_, phase_, is_intervention_triggered_);
+  period_ = ComputePeriod();
 }
 
 RemoteFontFaceSource::~RemoteFontFaceSource() = default;
 
+Document* RemoteFontFaceSource::GetDocument() const {
+  return Document::DynamicFrom(font_selector_->GetExecutionContext());
+}
+
 void RemoteFontFaceSource::Dispose() {
   ClearResource();
   PruneTable();
@@ -147,6 +166,17 @@
   ClearResource();
 
   PruneTable();
+
+  if (GetDocument() &&
+      !GetDocument()->GetFontPreloadManager().RenderingHasBegun()) {
+    finished_before_document_rendering_begin_ = true;
+  }
+
+  if (FinishedFromMemoryCache())
+    period_ = kNotApplicablePeriod;
+  else
+    UpdatePeriod();
+
   if (face_->FontLoaded(this)) {
     font_selector_->FontFaceInvalidated();
 
@@ -187,8 +217,7 @@
 }
 
 void RemoteFontFaceSource::UpdatePeriod() {
-  DisplayPeriod new_period =
-      ComputePeriod(display_, phase_, is_intervention_triggered_);
+  DisplayPeriod new_period = ComputePeriod();
 
   // Fallback font is invisible iff the font is loading and in the block period.
   // Invalidate the font if its fallback visibility has changed.
diff --git a/third_party/blink/renderer/core/css/remote_font_face_source.h b/third_party/blink/renderer/core/css/remote_font_face_source.h
index d53ecb4..5476391d 100644
--- a/third_party/blink/renderer/core/css/remote_font_face_source.h
+++ b/third_party/blink/renderer/core/css/remote_font_face_source.h
@@ -13,6 +13,7 @@
 namespace blink {
 
 class CSSFontFace;
+class Document;
 class FontSelector;
 class FontCustomPlatformData;
 
@@ -23,9 +24,6 @@
 
  public:
   enum Phase { kNoLimitExceeded, kShortLimitExceeded, kLongLimitExceeded };
-  // Periods of the Font Display Timeline.
-  // https://drafts.csswg.org/css-fonts-4/#font-display-timeline
-  enum DisplayPeriod { kBlockPeriod, kSwapPeriod, kFailurePeriod };
 
   RemoteFontFaceSource(CSSFontFace*, FontSelector*, FontDisplay);
   ~RemoteFontFaceSource() override;
@@ -60,6 +58,19 @@
       const FontDescription&);
 
  private:
+  // Periods of the Font Display Timeline.
+  // https://drafts.csswg.org/css-fonts-4/#font-display-timeline
+  // Note that kNotApplicablePeriod is an implementation detail indicating that
+  // the font is loaded from memory cache synchronously, and hence, made
+  // immediately available. As we never need to use a fallback for it, using
+  // other DisplayPeriod values seem artificial. So we use a special value.
+  enum DisplayPeriod {
+    kBlockPeriod,
+    kSwapPeriod,
+    kFailurePeriod,
+    kNotApplicablePeriod
+  };
+
   class FontLoadHistograms {
     DISALLOW_NEW();
 
@@ -113,6 +124,9 @@
     DataSource data_source_;
   };
 
+  Document* GetDocument() const;
+
+  DisplayPeriod ComputePeriod() const;
   void UpdatePeriod();
   bool ShouldTriggerWebFontsIntervention();
   bool IsLowPriorityLoadingAllowedForRemoteFont() const override;
@@ -132,6 +146,7 @@
   DisplayPeriod period_;
   FontLoadHistograms histograms_;
   bool is_intervention_triggered_;
+  bool finished_before_document_rendering_begin_;
 };
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/css/resolver/style_adjuster.cc b/third_party/blink/renderer/core/css/resolver/style_adjuster.cc
index 8697657..2eef12a 100644
--- a/third_party/blink/renderer/core/css/resolver/style_adjuster.cc
+++ b/third_party/blink/renderer/core/css/resolver/style_adjuster.cc
@@ -54,6 +54,7 @@
 #include "third_party/blink/renderer/core/layout/layout_object.h"
 #include "third_party/blink/renderer/core/layout/layout_replaced.h"
 #include "third_party/blink/renderer/core/layout/layout_theme.h"
+#include "third_party/blink/renderer/core/mathml/mathml_fraction_element.h"
 #include "third_party/blink/renderer/core/mathml/mathml_space_element.h"
 #include "third_party/blink/renderer/core/style/computed_style.h"
 #include "third_party/blink/renderer/core/style/computed_style_constants.h"
@@ -752,8 +753,18 @@
       // https://drafts.csswg.org/css-display/#unbox-mathml
       style.SetDisplay(EDisplay::kNone);
     }
-    if (auto* space = DynamicTo<MathMLSpaceElement>(*element))
+    if (auto* space = DynamicTo<MathMLSpaceElement>(*element)) {
       space->AddMathBaselineIfNeeded(style, state.CssToLengthConversionData());
+    } else if (auto* fraction = DynamicTo<MathMLFractionElement>(*element)) {
+      fraction->AddMathFractionBarThicknessIfNeeded(
+          style, state.CssToLengthConversionData());
+    }
+    if (style.GetWritingMode() != WritingMode::kHorizontalTb) {
+      // TODO(rbuis): this will not work with logical CSS properties.
+      // Disable vertical writing-mode for now.
+      style.SetWritingMode(WritingMode::kHorizontalTb);
+      style.UpdateFontOrientation();
+    }
   }
 
   // If this node is sticky it marks the creation of a sticky subtree, which we
diff --git a/third_party/blink/renderer/core/editing/suggestion/text_suggestion_controller.cc b/third_party/blink/renderer/core/editing/suggestion/text_suggestion_controller.cc
index 0d5863a..748094c 100644
--- a/third_party/blink/renderer/core/editing/suggestion/text_suggestion_controller.cc
+++ b/third_party/blink/renderer/core/editing/suggestion/text_suggestion_controller.cc
@@ -206,8 +206,18 @@
 
 void TextSuggestionController::HandlePotentialSuggestionTap(
     const PositionInFlatTree& caret_position) {
+  if (!IsAvailable()) {
+    // TODO(crbug.com/1054955): We should fix caller not to make this happens.
+    NOTREACHED();
+    return;
+  }
+  if (GetFrame() != GetDocument().GetFrame()) {
+    // TODO(crbug.com/1054955): We should fix caller not to make this happens.
+    NOTREACHED();
+    return;
+  }
   // TODO(crbug.com/779126): add support for suggestions in immersive mode.
-  if (GetDocument().GetSettings()->GetImmersiveModeEnabled())
+  if (GetFrame().GetSettings()->GetImmersiveModeEnabled())
     return;
 
   // It's theoretically possible, but extremely unlikely, that the user has
diff --git a/third_party/blink/renderer/core/html/forms/html_select_element.cc b/third_party/blink/renderer/core/html/forms/html_select_element.cc
index c2b3793..db3dfe9d 100644
--- a/third_party/blink/renderer/core/html/forms/html_select_element.cc
+++ b/third_party/blink/renderer/core/html/forms/html_select_element.cc
@@ -1193,56 +1193,6 @@
   return select_type_->PopupIsVisible();
 }
 
-void HTMLSelectElement::UpdateSelectedState(HTMLOptionElement* clicked_option,
-                                            bool multi,
-                                            bool shift) {
-  DCHECK(!UsesMenuList());
-  DCHECK(clicked_option);
-  // Save the selection so it can be compared to the new selection when
-  // dispatching change events during mouseup, or after autoscroll finishes.
-  SaveLastSelection();
-
-  active_selection_state_ = true;
-
-  bool shift_select = is_multiple_ && shift;
-  bool multi_select = is_multiple_ && multi && !shift;
-
-  // Keep track of whether an active selection (like during drag selection),
-  // should select or deselect.
-  if (clicked_option->Selected() && multi_select) {
-    active_selection_state_ = false;
-    clicked_option->SetSelectedState(false);
-    clicked_option->SetDirty(true);
-  }
-
-  // If we're not in any special multiple selection mode, then deselect all
-  // other items, excluding the clicked option. If no option was clicked, then
-  // this will deselect all items in the list.
-  if (!shift_select && !multi_select)
-    DeselectItemsWithoutValidation(clicked_option);
-
-  // If the anchor hasn't been set, and we're doing a single selection or a
-  // shift selection, then initialize the anchor to the first selected index.
-  if (!active_selection_anchor_ && !multi_select)
-    SetActiveSelectionAnchor(SelectedOption());
-
-  // Set the selection state of the clicked option.
-  if (!clicked_option->IsDisabledFormControl()) {
-    clicked_option->SetSelectedState(true);
-    clicked_option->SetDirty(true);
-  }
-
-  // If there was no selectedIndex() for the previous initialization, or If
-  // we're doing a single selection, or a multiple selection (using cmd or
-  // ctrl), then initialize the anchor index to the listIndex that just got
-  // clicked.
-  if (!active_selection_anchor_ || !shift_select)
-    SetActiveSelectionAnchor(clicked_option);
-
-  SetActiveSelectionEnd(clicked_option);
-  UpdateListBoxSelection(!multi_select);
-}
-
 int HTMLSelectElement::ListIndexForOption(const HTMLOptionElement& option) {
   const ListItems& items = GetListItems();
   wtf_size_t length = items.size();
diff --git a/third_party/blink/renderer/core/html/forms/html_select_element.h b/third_party/blink/renderer/core/html/forms/html_select_element.h
index 619700a4..2cec83d 100644
--- a/third_party/blink/renderer/core/html/forms/html_select_element.h
+++ b/third_party/blink/renderer/core/html/forms/html_select_element.h
@@ -254,7 +254,6 @@
       HTMLOptionElement* element_to_exclude = nullptr);
   void ParseMultipleAttribute(const AtomicString&);
   HTMLOptionElement* LastSelectedOption() const;
-  void UpdateSelectedState(HTMLOptionElement*, bool multi, bool shift);
   wtf_size_t SearchOptionsForValue(const String&,
                                    wtf_size_t list_index_start,
                                    wtf_size_t list_index_end) const;
diff --git a/third_party/blink/renderer/core/html/forms/select_type.cc b/third_party/blink/renderer/core/html/forms/select_type.cc
index 392548d..f818d1a 100644
--- a/third_party/blink/renderer/core/html/forms/select_type.cc
+++ b/third_party/blink/renderer/core/html/forms/select_type.cc
@@ -615,6 +615,13 @@
   HTMLOptionElement* NextSelectableOptionPageAway(HTMLOptionElement*,
                                                   SkipDirection) const;
   void ToggleSelection(HTMLOptionElement& option);
+  enum class SelectionMode {
+    kDeselectOthers,
+    kRange,
+    kNotChangeOthers,
+  };
+  void UpdateSelectedState(HTMLOptionElement* clicked_option,
+                           SelectionMode mode);
 
   bool is_in_non_contiguous_selection_ = false;
 };
@@ -632,7 +639,9 @@
     // Convert to coords relative to the list box if needed.
     if (HTMLOptionElement* option = EventTargetOption(*gesture_event)) {
       if (!select_->IsDisabledFormControl()) {
-        select_->UpdateSelectedState(option, true, gesture_event->shiftKey());
+        UpdateSelectedState(option, gesture_event->shiftKey()
+                                        ? SelectionMode::kRange
+                                        : SelectionMode::kNotChangeOthers);
         select_->ListBoxOnChange();
       }
       return true;
@@ -654,12 +663,15 @@
     if (HTMLOptionElement* option = EventTargetOption(*mouse_event)) {
       if (!option->IsDisabledFormControl()) {
 #if defined(OS_MACOSX)
-        select_->UpdateSelectedState(option, mouse_event->metaKey(),
-                                     mouse_event->shiftKey());
+        const bool meta_or_ctrl = mouse_event->metaKey();
 #else
-        select_->UpdateSelectedState(option, mouse_event->ctrlKey(),
-                                     mouse_event->shiftKey());
+        const bool meta_or_ctrl = mouse_event->ctrlKey();
 #endif
+        UpdateSelectedState(option, mouse_event->shiftKey()
+                                        ? SelectionMode::kRange
+                                        : meta_or_ctrl
+                                              ? SelectionMode::kNotChangeOthers
+                                              : SelectionMode::kDeselectOthers);
       }
       if (LocalFrame* frame = select_->GetDocument().GetFrame())
         frame->GetEventHandler().SetMouseDownMayStartAutoscroll();
@@ -927,10 +939,58 @@
 
 void ListBoxSelectType::ToggleSelection(HTMLOptionElement& option) {
   select_->active_selection_state_ = !select_->active_selection_state_;
-  select_->UpdateSelectedState(&option, true /*multi*/, false /*shift*/);
+  UpdateSelectedState(&option, SelectionMode::kNotChangeOthers);
   select_->ListBoxOnChange();
 }
 
+void ListBoxSelectType::UpdateSelectedState(HTMLOptionElement* clicked_option,
+                                            SelectionMode mode) {
+  DCHECK(clicked_option);
+  // Save the selection so it can be compared to the new selection when
+  // dispatching change events during mouseup, or after autoscroll finishes.
+  select_->SaveLastSelection();
+
+  select_->active_selection_state_ = true;
+
+  if (!select_->is_multiple_)
+    mode = SelectionMode::kDeselectOthers;
+
+  // Keep track of whether an active selection (like during drag selection),
+  // should select or deselect.
+  if (clicked_option->Selected() && mode == SelectionMode::kNotChangeOthers) {
+    select_->active_selection_state_ = false;
+    clicked_option->SetSelectedState(false);
+    clicked_option->SetDirty(true);
+  }
+
+  // If we're not in any special multiple selection mode, then deselect all
+  // other items, excluding the clicked OPTION. If no option was clicked, then
+  // this will deselect all items in the list.
+  if (mode == SelectionMode::kDeselectOthers)
+    select_->DeselectItemsWithoutValidation(clicked_option);
+
+  // If the anchor hasn't been set, and we're doing kDeselectOthers or kRange,
+  // then initialize the anchor to the first selected OPTION.
+  if (!select_->active_selection_anchor_ &&
+      mode != SelectionMode::kNotChangeOthers)
+    select_->SetActiveSelectionAnchor(select_->SelectedOption());
+
+  // Set the selection state of the clicked OPTION.
+  if (!clicked_option->IsDisabledFormControl()) {
+    clicked_option->SetSelectedState(true);
+    clicked_option->SetDirty(true);
+  }
+
+  // If there was no selectedIndex() for the previous initialization, or if
+  // we're doing kDeselectOthers, or kNotChangeOthers (using cmd or ctrl),
+  // then initialize the anchor OPTION to the clicked OPTION.
+  if (!select_->active_selection_anchor_ || mode != SelectionMode::kRange)
+    select_->SetActiveSelectionAnchor(clicked_option);
+
+  select_->SetActiveSelectionEnd(clicked_option);
+  select_->UpdateListBoxSelection(mode != SelectionMode::kNotChangeOthers);
+}
+
 // ============================================================================
 
 SelectType::SelectType(HTMLSelectElement& select) : select_(select) {}
diff --git a/third_party/blink/renderer/core/layout/BUILD.gn b/third_party/blink/renderer/core/layout/BUILD.gn
index 8a0de26b..cb2f84eb 100644
--- a/third_party/blink/renderer/core/layout/BUILD.gn
+++ b/third_party/blink/renderer/core/layout/BUILD.gn
@@ -419,6 +419,8 @@
     "ng/list/ng_unpositioned_list_marker.h",
     "ng/mathml/layout_ng_mathml_block.cc",
     "ng/mathml/layout_ng_mathml_block.h",
+    "ng/mathml/ng_math_fraction_layout_algorithm.cc",
+    "ng/mathml/ng_math_fraction_layout_algorithm.h",
     "ng/mathml/ng_math_layout_utils.cc",
     "ng/mathml/ng_math_layout_utils.h",
     "ng/mathml/ng_math_row_layout_algorithm.cc",
@@ -463,6 +465,8 @@
     "ng/ng_floats_utils.h",
     "ng/ng_fragment.h",
     "ng/ng_fragment_builder.h",
+    "ng/ng_fragment_child_iterator.cc",
+    "ng/ng_fragment_child_iterator.h",
     "ng/ng_fragmentation_utils.cc",
     "ng/ng_fragmentation_utils.h",
     "ng/ng_ink_overflow.cc",
diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_physical_text_fragment.cc b/third_party/blink/renderer/core/layout/ng/inline/ng_physical_text_fragment.cc
index e41010c..18e28e8 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_physical_text_fragment.cc
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_physical_text_fragment.cc
@@ -52,7 +52,8 @@
   DCHECK_LE(text_offset_.end, source.EndOffset());
   DCHECK(shape_result_ || IsFlowControl()) << *this;
   base_or_resolved_direction_ = source.base_or_resolved_direction_;
-  is_generated_text_ = source.is_generated_text_;
+  is_generated_text_or_math_fraction_ =
+      source.is_generated_text_or_math_fraction_;
   ink_overflow_computed_ = false;
 }
 
@@ -64,7 +65,7 @@
   DCHECK(shape_result_ || IsFlowControl()) << *this;
   base_or_resolved_direction_ =
       static_cast<unsigned>(builder->ResolvedDirection());
-  is_generated_text_ = builder->IsGeneratedText();
+  is_generated_text_or_math_fraction_ = builder->IsGeneratedText();
   ink_overflow_computed_ = false;
 }
 
diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_physical_text_fragment.h b/third_party/blink/renderer/core/layout/ng/inline/ng_physical_text_fragment.h
index d325ac4..dbd1bae 100644
--- a/third_party/blink/renderer/core/layout/ng/inline/ng_physical_text_fragment.h
+++ b/third_party/blink/renderer/core/layout/ng/inline/ng_physical_text_fragment.h
@@ -56,7 +56,7 @@
   NGTextType TextType() const { return static_cast<NGTextType>(sub_type_); }
   // Returns true if the text is generated (from, e.g., list marker,
   // pseudo-element, ...) instead of from a DOM text node.
-  bool IsGeneratedText() const { return is_generated_text_; }
+  bool IsGeneratedText() const { return is_generated_text_or_math_fraction_; }
   // True if this is a forced line break.
   bool IsLineBreak() const { return TextType() == kForcedLineBreak; }
   // True if this is not for painting; i.e., a forced line break, a tabulation,
diff --git a/third_party/blink/renderer/core/layout/ng/mathml/layout_ng_mathml_block.cc b/third_party/blink/renderer/core/layout/ng/mathml/layout_ng_mathml_block.cc
index 29467b5..161826f1c 100644
--- a/third_party/blink/renderer/core/layout/ng/mathml/layout_ng_mathml_block.cc
+++ b/third_party/blink/renderer/core/layout/ng/mathml/layout_ng_mathml_block.cc
@@ -5,12 +5,7 @@
 #include "third_party/blink/renderer/core/layout/ng/mathml/layout_ng_mathml_block.h"
 
 #include "third_party/blink/renderer/core/layout/layout_analyzer.h"
-#include "third_party/blink/renderer/core/layout/layout_view.h"
-#include "third_party/blink/renderer/core/layout/ng/ng_block_node.h"
-#include "third_party/blink/renderer/core/layout/ng/ng_constraint_space.h"
 #include "third_party/blink/renderer/core/layout/ng/ng_layout_result.h"
-#include "third_party/blink/renderer/core/layout/ng/ng_out_of_flow_positioned_node.h"
-#include "third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.h"
 
 namespace blink {
 
diff --git a/third_party/blink/renderer/core/layout/ng/mathml/ng_math_fraction_layout_algorithm.cc b/third_party/blink/renderer/core/layout/ng/mathml/ng_math_fraction_layout_algorithm.cc
new file mode 100644
index 0000000..a5d4cd5
--- /dev/null
+++ b/third_party/blink/renderer/core/layout/ng/mathml/ng_math_fraction_layout_algorithm.cc
@@ -0,0 +1,300 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/blink/renderer/core/layout/ng/mathml/ng_math_fraction_layout_algorithm.h"
+
+#include "third_party/blink/renderer/core/layout/ng/mathml/ng_math_layout_utils.h"
+#include "third_party/blink/renderer/core/layout/ng/ng_box_fragment.h"
+#include "third_party/blink/renderer/core/layout/ng/ng_length_utils.h"
+#include "third_party/blink/renderer/core/layout/ng/ng_out_of_flow_layout_part.h"
+#include "third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.h"
+#include "third_party/blink/renderer/platform/fonts/opentype/open_type_math_support.h"
+
+namespace blink {
+namespace {
+
+// Describes the amount to shift the numerator/denominator of the fraction when
+// a fraction bar is present. Data is populated from the OpenType MATH table.
+// If the OpenType MATH table is not present fallback values are used.
+// https://mathml-refresh.github.io/mathml-core/#fraction-with-nonzero-line-thickness
+struct FractionParameters {
+  LayoutUnit numerator_gap_min;
+  LayoutUnit denominator_gap_min;
+  LayoutUnit numerator_min_shift_up;
+  LayoutUnit denominator_min_shift_down;
+};
+
+FractionParameters GetFractionParameters(const ComputedStyle& style) {
+  FractionParameters parameters;
+
+  // TODO(rbuis): Implement displaystyle.
+
+  // We try and read constants to draw the fraction from the OpenType MATH and
+  // use fallback values otherwise.
+  // The MATH table specification suggests default rule thickness or (in
+  // displaystyle) 3 times default rule thickness for the gaps.
+  parameters.numerator_gap_min = LayoutUnit(
+      MathConstant(
+          style,
+          OpenTypeMathSupport::MathConstants::kFractionNumDisplayStyleGapMin)
+          .value_or(3 * RuleThicknessFallback(style)));
+  parameters.denominator_gap_min = LayoutUnit(
+      MathConstant(
+          style,
+          OpenTypeMathSupport::MathConstants::kFractionDenomDisplayStyleGapMin)
+          .value_or(parameters.numerator_gap_min));
+
+  // TODO(crbug.com/1058369): The MATH table specification does not suggest
+  // any values for shifts, so we leave them at zero for now.
+  parameters.numerator_min_shift_up =
+      LayoutUnit(MathConstant(style, OpenTypeMathSupport::MathConstants::
+                                         kFractionNumeratorDisplayStyleShiftUp)
+                     .value_or(0));
+  parameters.denominator_min_shift_down = LayoutUnit(
+      MathConstant(style, OpenTypeMathSupport::MathConstants::
+                              kFractionDenominatorDisplayStyleShiftDown)
+          .value_or(0));
+
+  return parameters;
+}
+
+// Describes the amount to shift the numerator/denominator of the fraction when
+// a fraction bar is not present. Data is populated from the OpenType MATH
+// table. If the OpenType MATH table is not present fallback values are used.
+// https://mathml-refresh.github.io/mathml-core/#fraction-with-zero-line-thickness
+struct FractionStackParameters {
+  LayoutUnit gap_min;
+  LayoutUnit top_shift_up;
+  LayoutUnit bottom_shift_down;
+};
+
+FractionStackParameters GetFractionStackParameters(const ComputedStyle& style) {
+  FractionStackParameters parameters;
+
+  // TODO(rbuis): Implement displaystyle.
+
+  // We try and read constants to draw the stack from the OpenType MATH and use
+  // fallback values otherwise.
+  // We use the fallback values suggested in the MATH table specification.
+  parameters.gap_min = LayoutUnit(
+      MathConstant(style,
+                   OpenTypeMathSupport::MathConstants::kStackDisplayStyleGapMin)
+          .value_or(7 * RuleThicknessFallback(style)));
+  // The MATH table specification does not suggest any values for shifts, so
+  // we leave them at zero.
+  parameters.top_shift_up = LayoutUnit(
+      MathConstant(
+          style,
+          OpenTypeMathSupport::MathConstants::kStackTopDisplayStyleShiftUp)
+          .value_or(0));
+  parameters.bottom_shift_down = LayoutUnit(
+      MathConstant(
+          style,
+          OpenTypeMathSupport::MathConstants::kStackBottomDisplayStyleShiftDown)
+          .value_or(0));
+
+  return parameters;
+}
+
+}  // namespace
+
+NGMathFractionLayoutAlgorithm::NGMathFractionLayoutAlgorithm(
+    const NGLayoutAlgorithmParams& params)
+    : NGLayoutAlgorithm(params),
+      border_scrollbar_padding_(params.fragment_geometry.border +
+                                params.fragment_geometry.padding +
+                                params.fragment_geometry.scrollbar) {
+  DCHECK(params.space.IsNewFormattingContext());
+  container_builder_.SetIsNewFormattingContext(
+      params.space.IsNewFormattingContext());
+  container_builder_.SetInitialFragmentGeometry(params.fragment_geometry);
+  container_builder_.SetIsMathMLFraction();
+}
+
+void NGMathFractionLayoutAlgorithm::GatherChildren(NGBlockNode* numerator,
+                                                   NGBlockNode* denominator) {
+  for (NGLayoutInputNode child = Node().FirstChild(); child;
+       child = child.NextSibling()) {
+    NGBlockNode block_child = To<NGBlockNode>(child);
+    if (child.IsOutOfFlowPositioned()) {
+      container_builder_.AddOutOfFlowChildCandidate(
+          block_child, {border_scrollbar_padding_.inline_start,
+                        border_scrollbar_padding_.block_start});
+      continue;
+    }
+    if (!*numerator) {
+      *numerator = block_child;
+      continue;
+    }
+    if (!*denominator) {
+      *denominator = block_child;
+      continue;
+    }
+
+    NOTREACHED();
+  }
+
+  DCHECK(*numerator);
+  DCHECK(*denominator);
+}
+
+scoped_refptr<const NGLayoutResult> NGMathFractionLayoutAlgorithm::Layout() {
+  DCHECK(!BreakToken());
+
+  NGBlockNode numerator = nullptr;
+  NGBlockNode denominator = nullptr;
+  GatherChildren(&numerator, &denominator);
+
+  const LogicalSize border_box_size = container_builder_.InitialBorderBoxSize();
+  auto child_available_size =
+      ShrinkAvailableSize(border_box_size, border_scrollbar_padding_);
+  auto numerator_space = CreateConstraintSpaceForMathChild(
+      Node(), child_available_size, ConstraintSpace(), numerator);
+  scoped_refptr<const NGLayoutResult> numerator_layout_result =
+      numerator.Layout(numerator_space);
+  auto numerator_margins =
+      ComputeMarginsFor(numerator_space, numerator.Style(), ConstraintSpace());
+  auto denominator_space = CreateConstraintSpaceForMathChild(
+      Node(), child_available_size, ConstraintSpace(), denominator);
+  scoped_refptr<const NGLayoutResult> denominator_layout_result =
+      denominator.Layout(denominator_space);
+  auto denominator_margins = ComputeMarginsFor(
+      denominator_space, denominator.Style(), ConstraintSpace());
+
+  NGBoxFragment numerator_fragment(
+      ConstraintSpace().GetWritingMode(), ConstraintSpace().Direction(),
+      To<NGPhysicalBoxFragment>(numerator_layout_result->PhysicalFragment()));
+  NGBoxFragment denominator_fragment(
+      ConstraintSpace().GetWritingMode(), ConstraintSpace().Direction(),
+      To<NGPhysicalBoxFragment>(denominator_layout_result->PhysicalFragment()));
+
+  LayoutUnit content_inline_size = std::max(
+      numerator_fragment.InlineSize() + numerator_margins.InlineSum(),
+      denominator_fragment.InlineSize() + denominator_margins.InlineSum());
+
+  LayoutUnit numerator_ascent =
+      numerator_margins.block_start +
+      numerator_fragment.Baseline().value_or(numerator_fragment.BlockSize());
+  LayoutUnit numerator_descent = numerator_fragment.BlockSize() +
+                                 numerator_margins.BlockSum() -
+                                 numerator_ascent;
+  LayoutUnit denominator_ascent = denominator_margins.block_start +
+                                  denominator_fragment.Baseline().value_or(
+                                      denominator_fragment.BlockSize());
+  LayoutUnit denominator_descent = denominator_fragment.BlockSize() +
+                                   denominator_margins.BlockSum() -
+                                   denominator_ascent;
+
+  LayoutUnit numerator_shift, denominator_shift;
+  LayoutUnit thickness = FractionLineThickness(Style());
+  if (thickness) {
+    LayoutUnit axis_height = MathAxisHeight(Style());
+    FractionParameters parameters = GetFractionParameters(Style());
+    numerator_shift =
+        std::max(parameters.numerator_min_shift_up,
+                 axis_height + thickness / 2 + parameters.numerator_gap_min +
+                     numerator_descent);
+    denominator_shift =
+        std::max(parameters.denominator_min_shift_down,
+                 thickness / 2 + parameters.denominator_gap_min +
+                     denominator_ascent - axis_height);
+  } else {
+    FractionStackParameters parameters = GetFractionStackParameters(Style());
+    numerator_shift = parameters.top_shift_up;
+    denominator_shift = parameters.bottom_shift_down;
+    LayoutUnit gap = denominator_shift - denominator_ascent + numerator_shift -
+                     numerator_descent;
+    if (gap < parameters.gap_min) {
+      LayoutUnit diff = parameters.gap_min - gap;
+      LayoutUnit delta = diff / 2;
+      numerator_shift += delta;
+      denominator_shift += diff - delta;
+    }
+  }
+
+  LayoutUnit fraction_ascent =
+      std::max(numerator_shift + numerator_ascent,
+               -denominator_shift + denominator_ascent);
+  LayoutUnit fraction_descent =
+      std::max(-numerator_shift + numerator_descent,
+               denominator_shift + denominator_descent);
+  fraction_ascent += border_scrollbar_padding_.block_start;
+  fraction_descent += border_scrollbar_padding_.block_end;
+  LayoutUnit total_block_size = fraction_ascent + fraction_descent;
+
+  container_builder_.SetBaseline(fraction_ascent);
+
+  LogicalOffset numerator_offset;
+  LogicalOffset denominator_offset;
+  numerator_offset.inline_offset =
+      border_scrollbar_padding_.inline_start + numerator_margins.inline_start +
+      (content_inline_size -
+       (numerator_fragment.InlineSize() + numerator_margins.InlineSum())) /
+          2;
+  denominator_offset.inline_offset =
+      border_scrollbar_padding_.inline_start +
+      denominator_margins.inline_start +
+      (content_inline_size -
+       (denominator_fragment.InlineSize() + denominator_margins.InlineSum())) /
+          2;
+
+  numerator_offset.block_offset = numerator_margins.block_start +
+                                  fraction_ascent - numerator_shift -
+                                  numerator_ascent;
+  denominator_offset.block_offset = denominator_margins.block_start +
+                                    fraction_ascent + denominator_shift -
+                                    denominator_ascent;
+
+  container_builder_.AddChild(numerator_layout_result->PhysicalFragment(),
+                              numerator_offset);
+  container_builder_.AddChild(denominator_layout_result->PhysicalFragment(),
+                              denominator_offset);
+
+  numerator.StoreMargins(ConstraintSpace(), numerator_margins);
+  denominator.StoreMargins(ConstraintSpace(), denominator_margins);
+
+  LayoutUnit block_size = ComputeBlockSizeForFragment(
+      ConstraintSpace(), Style(), border_scrollbar_padding_, total_block_size);
+
+  container_builder_.SetIntrinsicBlockSize(total_block_size);
+  container_builder_.SetBlockSize(block_size);
+
+  NGOutOfFlowLayoutPart(Node(), ConstraintSpace(), container_builder_.Borders(),
+                        &container_builder_)
+      .Run();
+
+  return container_builder_.ToBoxFragment();
+}
+
+base::Optional<MinMaxSizes> NGMathFractionLayoutAlgorithm::ComputeMinMaxSizes(
+    const MinMaxSizesInput& input) const {
+  base::Optional<MinMaxSizes> sizes =
+      CalculateMinMaxSizesIgnoringChildren(Node(), border_scrollbar_padding_);
+  if (sizes)
+    return sizes;
+
+  sizes.emplace();
+  LayoutUnit child_percentage_resolution_block_size =
+      CalculateChildPercentageBlockSizeForMinMax(
+          ConstraintSpace(), Node(), border_scrollbar_padding_,
+          input.percentage_resolution_block_size);
+
+  MinMaxSizesInput child_input(child_percentage_resolution_block_size);
+
+  for (NGLayoutInputNode child = Node().FirstChild(); child;
+       child = child.NextSibling()) {
+    if (child.IsOutOfFlowPositioned())
+      continue;
+    auto child_sizes =
+        ComputeMinAndMaxContentContribution(Style(), child, child_input);
+    NGBoxStrut margins = ComputeMinMaxMargins(Style(), child);
+    child_sizes += margins.InlineSum();
+    sizes->Encompass(child_sizes);
+  }
+
+  *sizes += border_scrollbar_padding_.InlineSum();
+  return sizes;
+}
+
+}  // namespace blink
diff --git a/third_party/blink/renderer/core/layout/ng/mathml/ng_math_fraction_layout_algorithm.h b/third_party/blink/renderer/core/layout/ng/mathml/ng_math_fraction_layout_algorithm.h
new file mode 100644
index 0000000..d645439
--- /dev/null
+++ b/third_party/blink/renderer/core/layout/ng/mathml/ng_math_fraction_layout_algorithm.h
@@ -0,0 +1,31 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_BLINK_RENDERER_CORE_LAYOUT_NG_MATHML_NG_MATH_FRACTION_LAYOUT_ALGORITHM_H_
+#define THIRD_PARTY_BLINK_RENDERER_CORE_LAYOUT_NG_MATHML_NG_MATH_FRACTION_LAYOUT_ALGORITHM_H_
+
+#include "third_party/blink/renderer/core/layout/ng/mathml/ng_math_row_layout_algorithm.h"
+
+namespace blink {
+
+class CORE_EXPORT NGMathFractionLayoutAlgorithm
+    : public NGLayoutAlgorithm<NGBlockNode,
+                               NGBoxFragmentBuilder,
+                               NGBlockBreakToken> {
+ public:
+  explicit NGMathFractionLayoutAlgorithm(const NGLayoutAlgorithmParams& params);
+
+ private:
+  scoped_refptr<const NGLayoutResult> Layout() final;
+
+  base::Optional<MinMaxSizes> ComputeMinMaxSizes(
+      const MinMaxSizesInput&) const final;
+
+  void GatherChildren(NGBlockNode* numerator, NGBlockNode* denominator);
+  const NGBoxStrut border_scrollbar_padding_;
+};
+
+}  // namespace blink
+
+#endif  // THIRD_PARTY_BLINK_RENDERER_CORE_LAYOUT_NG_MATHML_NG_MATH_FRACTION_LAYOUT_ALGORITHM_H_
diff --git a/third_party/blink/renderer/core/layout/ng/mathml/ng_math_layout_utils.cc b/third_party/blink/renderer/core/layout/ng/mathml/ng_math_layout_utils.cc
index 45381492..44f6ed8 100644
--- a/third_party/blink/renderer/core/layout/ng/mathml/ng_math_layout_utils.cc
+++ b/third_party/blink/renderer/core/layout/ng/mathml/ng_math_layout_utils.cc
@@ -4,10 +4,12 @@
 
 #include "third_party/blink/renderer/core/layout/ng/mathml/ng_math_layout_utils.h"
 
+#include "third_party/blink/renderer/core/layout/layout_box.h"
 #include "third_party/blink/renderer/core/layout/ng/ng_block_node.h"
 #include "third_party/blink/renderer/core/layout/ng/ng_constraint_space_builder.h"
 #include "third_party/blink/renderer/core/layout/ng/ng_length_utils.h"
 #include "third_party/blink/renderer/core/layout/ng/ng_space_utils.h"
+#include "third_party/blink/renderer/core/mathml/mathml_fraction_element.h"
 
 namespace blink {
 
@@ -39,4 +41,57 @@
   return space_builder.ToConstraintSpace();
 }
 
+NGLayoutInputNode FirstChildInFlow(const NGBlockNode& node) {
+  NGLayoutInputNode child = node.FirstChild();
+  while (child && child.IsOutOfFlowPositioned())
+    child = child.NextSibling();
+  return child;
+}
+
+NGLayoutInputNode NextSiblingInFlow(const NGBlockNode& node) {
+  NGLayoutInputNode sibling = node.NextSibling();
+  while (sibling && sibling.IsOutOfFlowPositioned())
+    sibling = sibling.NextSibling();
+  return sibling;
+}
+
+inline bool InFlowChildCountIs(const NGBlockNode& node, unsigned count) {
+  DCHECK(count == 2 || count == 3);
+  auto child = To<NGBlockNode>(FirstChildInFlow(node));
+  while (count && child) {
+    child = To<NGBlockNode>(NextSiblingInFlow(child));
+    count--;
+  }
+  return !count && !child;
+}
+
+bool IsValidMathMLFraction(const NGBlockNode& node) {
+  return InFlowChildCountIs(node, 2);
+}
+
+namespace {
+
+inline LayoutUnit DefaultFractionLineThickness(const ComputedStyle& style) {
+  return LayoutUnit(
+      MathConstant(style,
+                   OpenTypeMathSupport::MathConstants::kFractionRuleThickness)
+          .value_or(RuleThicknessFallback(style)));
+}
+
+}  // namespace
+
+LayoutUnit MathAxisHeight(const ComputedStyle& style) {
+  return LayoutUnit(
+      MathConstant(style, OpenTypeMathSupport::MathConstants::kAxisHeight)
+          .value_or(style.GetFont().PrimaryFont()->GetFontMetrics().XHeight() /
+                    2));
+}
+
+LayoutUnit FractionLineThickness(const ComputedStyle& style) {
+  return std::max<LayoutUnit>(
+      ValueForLength(style.GetMathFractionBarThickness(),
+                     DefaultFractionLineThickness(style)),
+      LayoutUnit());
+}
+
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/layout/ng/mathml/ng_math_layout_utils.h b/third_party/blink/renderer/core/layout/ng/mathml/ng_math_layout_utils.h
index 5e7bdd26..dd1f5a64 100644
--- a/third_party/blink/renderer/core/layout/ng/mathml/ng_math_layout_utils.h
+++ b/third_party/blink/renderer/core/layout/ng/mathml/ng_math_layout_utils.h
@@ -5,6 +5,9 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_LAYOUT_NG_MATHML_NG_MATH_LAYOUT_UTILS_H_
 #define THIRD_PARTY_BLINK_RENDERER_CORE_LAYOUT_NG_MATHML_NG_MATH_LAYOUT_UTILS_H_
 
+#include "third_party/blink/renderer/core/style/computed_style.h"
+#include "third_party/blink/renderer/platform/fonts/opentype/open_type_math_support.h"
+
 namespace blink {
 
 struct LogicalSize;
@@ -19,6 +22,29 @@
     const NGConstraintSpace& parent_constraint_space,
     const NGLayoutInputNode&);
 
+NGLayoutInputNode FirstChildInFlow(const NGBlockNode&);
+NGLayoutInputNode NextSiblingInFlow(const NGBlockNode&);
+
+bool IsValidMathMLFraction(const NGBlockNode&);
+
+inline float RuleThicknessFallback(const ComputedStyle& style) {
+  // This function returns a value for the default rule thickness (TeX's
+  // \xi_8) to be used as a fallback when we lack a MATH table.
+  return 0.05f * style.FontSize();
+}
+
+LayoutUnit MathAxisHeight(const ComputedStyle& style);
+
+inline base::Optional<float> MathConstant(
+    const ComputedStyle& style,
+    OpenTypeMathSupport::MathConstants constant) {
+  return OpenTypeMathSupport::MathConstant(
+      style.GetFont().PrimaryFont()->PlatformData().GetHarfBuzzFace(),
+      constant);
+}
+
+LayoutUnit FractionLineThickness(const ComputedStyle& style);
+
 }  // namespace blink
 
 #endif  // THIRD_PARTY_BLINK_RENDERER_CORE_LAYOUT_NG_MATHML_NG_MATH_LAYOUT_UTILS_H_
diff --git a/third_party/blink/renderer/core/layout/ng/mathml/ng_math_space_layout_algorithm.h b/third_party/blink/renderer/core/layout/ng/mathml/ng_math_space_layout_algorithm.h
index 7d59cd5..7b493ef 100644
--- a/third_party/blink/renderer/core/layout/ng/mathml/ng_math_space_layout_algorithm.h
+++ b/third_party/blink/renderer/core/layout/ng/mathml/ng_math_space_layout_algorithm.h
@@ -15,7 +15,7 @@
                                NGBoxFragmentBuilder,
                                NGBlockBreakToken> {
  public:
-  NGMathSpaceLayoutAlgorithm(const NGLayoutAlgorithmParams& params);
+  explicit NGMathSpaceLayoutAlgorithm(const NGLayoutAlgorithmParams& params);
 
  private:
   scoped_refptr<const NGLayoutResult> Layout() final;
diff --git a/third_party/blink/renderer/core/layout/ng/ng_block_node.cc b/third_party/blink/renderer/core/layout/ng/ng_block_node.cc
index be5dc46..593c2ab7 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_block_node.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_block_node.cc
@@ -28,6 +28,8 @@
 #include "third_party/blink/renderer/core/layout/ng/inline/ng_inline_node.h"
 #include "third_party/blink/renderer/core/layout/ng/legacy_layout_tree_walking.h"
 #include "third_party/blink/renderer/core/layout/ng/list/layout_ng_list_item.h"
+#include "third_party/blink/renderer/core/layout/ng/mathml/ng_math_fraction_layout_algorithm.h"
+#include "third_party/blink/renderer/core/layout/ng/mathml/ng_math_layout_utils.h"
 #include "third_party/blink/renderer/core/layout/ng/mathml/ng_math_row_layout_algorithm.h"
 #include "third_party/blink/renderer/core/layout/ng/mathml/ng_math_space_layout_algorithm.h"
 #include "third_party/blink/renderer/core/layout/ng/ng_block_break_token.h"
@@ -50,6 +52,7 @@
 #include "third_party/blink/renderer/core/layout/shapes/shape_outside_info.h"
 #include "third_party/blink/renderer/core/layout/text_autosizer.h"
 #include "third_party/blink/renderer/core/mathml/mathml_element.h"
+#include "third_party/blink/renderer/core/mathml/mathml_fraction_element.h"
 #include "third_party/blink/renderer/core/mathml/mathml_space_element.h"
 #include "third_party/blink/renderer/core/paint/paint_layer_scrollable_area.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
@@ -92,6 +95,9 @@
   DCHECK(element);
   if (IsA<MathMLSpaceElement>(element))
     CreateAlgorithmAndRun<NGMathSpaceLayoutAlgorithm>(params, callback);
+  else if (IsA<MathMLFractionElement>(element) &&
+           IsValidMathMLFraction(params.node))
+    CreateAlgorithmAndRun<NGMathFractionLayoutAlgorithm>(params, callback);
   else
     CreateAlgorithmAndRun<NGMathRowLayoutAlgorithm>(params, callback);
 }
diff --git a/third_party/blink/renderer/core/layout/ng/ng_box_fragment_builder.h b/third_party/blink/renderer/core/layout/ng/ng_box_fragment_builder.h
index 1fa88465..7fe0402 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_box_fragment_builder.h
+++ b/third_party/blink/renderer/core/layout/ng/ng_box_fragment_builder.h
@@ -255,6 +255,8 @@
     is_inline_formatting_context_ = is_inline_formatting_context;
   }
 
+  void SetIsMathMLFraction() { is_math_fraction_ = true; }
+
   bool DidBreak() const { return did_break_; }
 
   void SetBorderEdges(NGBorderEdges border_edges) {
@@ -346,6 +348,7 @@
   bool is_new_fc_ = false;
   bool subtree_modified_margin_strut_ = false;
   bool has_seen_all_children_ = false;
+  bool is_math_fraction_ = false;
   LayoutUnit consumed_block_size_;
   unsigned sequence_number_ = 0;
 
diff --git a/third_party/blink/renderer/core/layout/ng/ng_fragment_child_iterator.cc b/third_party/blink/renderer/core/layout/ng/ng_fragment_child_iterator.cc
new file mode 100644
index 0000000..f2bb4a3
--- /dev/null
+++ b/third_party/blink/renderer/core/layout/ng/ng_fragment_child_iterator.cc
@@ -0,0 +1,102 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/blink/renderer/core/layout/ng/ng_fragment_child_iterator.h"
+
+#include "third_party/blink/renderer/core/layout/layout_box.h"
+#include "third_party/blink/renderer/core/layout/ng/ng_layout_input_node.h"
+#include "third_party/blink/renderer/platform/runtime_enabled_features.h"
+
+namespace blink {
+
+NGFragmentChildIterator::NGFragmentChildIterator(
+    const NGPhysicalBoxFragment& parent)
+    : parent_fragment_(&parent) {
+  DCHECK(RuntimeEnabledFeatures::LayoutNGFragmentItemEnabled());
+  current_.link_.fragment = nullptr;
+  if (parent.HasItems()) {
+    current_.cursor_.emplace(*parent.Items());
+    UpdateSelfFromCursor();
+  } else {
+    UpdateSelfFromFragment();
+  }
+}
+
+NGFragmentChildIterator::NGFragmentChildIterator(const NGInlineCursor& parent) {
+  current_.link_.fragment = nullptr;
+  current_.cursor_ = parent.CursorForDescendants();
+  UpdateSelfFromCursor();
+}
+
+NGFragmentChildIterator NGFragmentChildIterator::Descend() const {
+  if (current_.cursor_) {
+    const NGFragmentItem* item = current_.cursor_->CurrentItem();
+    // Descend using the cursor if the current item doesn't establish a new
+    // formatting context.
+    if (!item->BoxFragment() || item->IsInlineBox())
+      return NGFragmentChildIterator(*current_.cursor_);
+  }
+  DCHECK(current_.BoxFragment());
+  return NGFragmentChildIterator(*current_.BoxFragment());
+}
+
+bool NGFragmentChildIterator::AdvanceChildFragment() {
+  DCHECK(parent_fragment_);
+  const auto children = parent_fragment_->Children();
+  if (child_fragment_idx_ < children.size())
+    child_fragment_idx_++;
+  // There may be line box fragments among the children, and we're not
+  // interested in them (lines will already have been handled by the inline
+  // cursor).
+  SkipToBoxFragment();
+  if (child_fragment_idx_ >= children.size())
+    return false;
+  UpdateSelfFromFragment();
+  return true;
+}
+
+void NGFragmentChildIterator::UpdateSelfFromFragment() {
+  DCHECK(parent_fragment_);
+  const auto children = parent_fragment_->Children();
+  if (child_fragment_idx_ >= children.size())
+    return;
+  current_.link_ = children[child_fragment_idx_];
+  DCHECK(current_.link_.fragment);
+}
+
+bool NGFragmentChildIterator::AdvanceWithCursor() {
+  DCHECK(current_.cursor_);
+  current_.cursor_->MoveToNextSkippingChildren();
+  UpdateSelfFromCursor();
+  if (current_.cursor_->CurrentItem())
+    return true;
+  // If there are more items, proceed and see if we have box fragment
+  // children. There may be out-of-flow positioned child fragments.
+  if (!parent_fragment_)
+    return false;
+  current_.cursor_.reset();
+  SkipToBoxFragment();
+  UpdateSelfFromFragment();
+  return !IsAtEnd();
+}
+
+void NGFragmentChildIterator::UpdateSelfFromCursor() {
+  DCHECK(current_.cursor_);
+  const NGFragmentItem* item = current_.cursor_->CurrentItem();
+  if (!item) {
+    current_.link_.fragment = nullptr;
+    return;
+  }
+  current_.link_ = {item->BoxFragment(), item->OffsetInContainerBlock()};
+}
+
+void NGFragmentChildIterator::SkipToBoxFragment() {
+  for (const auto children = parent_fragment_->Children();
+       child_fragment_idx_ < children.size(); child_fragment_idx_++) {
+    if (children[child_fragment_idx_].fragment->IsBox())
+      break;
+  }
+}
+
+}  // namespace blink
diff --git a/third_party/blink/renderer/core/layout/ng/ng_fragment_child_iterator.h b/third_party/blink/renderer/core/layout/ng/ng_fragment_child_iterator.h
new file mode 100644
index 0000000..de1a3d4e4
--- /dev/null
+++ b/third_party/blink/renderer/core/layout/ng/ng_fragment_child_iterator.h
@@ -0,0 +1,104 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_BLINK_RENDERER_CORE_LAYOUT_NG_NG_FRAGMENT_CHILD_ITERATOR_H_
+#define THIRD_PARTY_BLINK_RENDERER_CORE_LAYOUT_NG_NG_FRAGMENT_CHILD_ITERATOR_H_
+
+#include "base/containers/span.h"
+#include "base/optional.h"
+#include "third_party/blink/renderer/core/core_export.h"
+#include "third_party/blink/renderer/core/layout/ng/inline/ng_fragment_item.h"
+#include "third_party/blink/renderer/core/layout/ng/inline/ng_inline_cursor.h"
+#include "third_party/blink/renderer/core/layout/ng/ng_link.h"
+#include "third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.h"
+
+namespace blink {
+
+class LayoutObject;
+
+// Iterator for children of a box fragment. Supports fragment items. To advance
+// to the next sibling, call |Advance()|. To descend into children of the
+// current child, call |Descend()|.
+//
+// Using this class requires LayoutNGFragmentItem to be enabled. While fragment
+// items are in a flat list representing the contents of an inline formatting
+// context, the iterator will to a certain extent restore the object hierarchy,
+// so that we can calculate the global offset of children of a relatively
+// positioned inline correctly.
+class CORE_EXPORT NGFragmentChildIterator {
+  STACK_ALLOCATED();
+
+ public:
+  explicit NGFragmentChildIterator(const NGPhysicalBoxFragment& parent);
+
+  // Create a child iterator for the current child.
+  NGFragmentChildIterator Descend() const;
+
+  // Move to the next sibling. Return false if there's no next sibling. Once
+  // false is returned, this object is in an unusable state, with the exception
+  // that calling IsAtEnd() is allowed.
+  bool Advance() {
+    if (current_.cursor_)
+      return AdvanceWithCursor();
+    return AdvanceChildFragment();
+  }
+
+  bool IsAtEnd() {
+    if (current_.cursor_)
+      return !*current_.cursor_;
+    DCHECK(parent_fragment_);
+    const auto children = parent_fragment_->Children();
+    return child_fragment_idx_ >= children.size();
+  }
+
+  class Current {
+    friend class NGFragmentChildIterator;
+
+   public:
+    // Return the current NGLink. Note that its offset is relative to the inline
+    // formatting context root, if the fragment / item participates in one.
+    const NGLink& Link() const { return link_; }
+
+    const NGPhysicalBoxFragment* BoxFragment() const {
+      return To<NGPhysicalBoxFragment>(link_.fragment);
+    }
+    const NGFragmentItem* FragmentItem() const {
+      if (!cursor_)
+        return nullptr;
+      return cursor_->CurrentItem();
+    }
+
+    const LayoutObject* GetLayoutObject() const {
+      if (const NGFragmentItem* item = FragmentItem())
+        return item->GetLayoutObject();
+      return BoxFragment()->GetLayoutObject();
+    }
+
+   private:
+    NGLink link_;
+    base::Optional<NGInlineCursor> cursor_;
+  };
+
+  const Current& GetCurrent() const { return current_; }
+  const Current& operator*() const { return current_; }
+  const Current* operator->() const { return &current_; }
+
+ private:
+  explicit NGFragmentChildIterator(const NGInlineCursor& parent);
+
+  bool AdvanceChildFragment();
+  void UpdateSelfFromFragment();
+
+  bool AdvanceWithCursor();
+  void UpdateSelfFromCursor();
+  void SkipToBoxFragment();
+
+  const NGPhysicalBoxFragment* parent_fragment_ = nullptr;
+  Current current_;
+  wtf_size_t child_fragment_idx_ = 0;
+};
+
+}  // namespace blink
+
+#endif  // THIRD_PARTY_BLINK_RENDERER_CORE_LAYOUT_NG_NG_FRAGMENT_CHILD_ITERATOR_H_
diff --git a/third_party/blink/renderer/core/layout/ng/ng_fragment_child_iterator_test.cc b/third_party/blink/renderer/core/layout/ng/ng_fragment_child_iterator_test.cc
new file mode 100644
index 0000000..ce6776a
--- /dev/null
+++ b/third_party/blink/renderer/core/layout/ng/ng_fragment_child_iterator_test.cc
@@ -0,0 +1,274 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/blink/renderer/core/layout/ng/ng_fragment_child_iterator.h"
+#include "third_party/blink/renderer/core/layout/ng/ng_base_layout_algorithm_test.h"
+#include "third_party/blink/renderer/platform/testing/runtime_enabled_features_test_helpers.h"
+
+namespace blink {
+namespace {
+
+class NGFragmentChildIteratorTest
+    : public NGBaseLayoutAlgorithmTest,
+      private ScopedLayoutNGBlockFragmentationForTest,
+      private ScopedLayoutNGFragmentItemForTest {
+ protected:
+  NGFragmentChildIteratorTest()
+      : ScopedLayoutNGBlockFragmentationForTest(true),
+        ScopedLayoutNGFragmentItemForTest(true) {}
+
+  scoped_refptr<const NGPhysicalBoxFragment> RunBlockLayoutAlgorithm(
+      Element* element) {
+    NGBlockNode container(ToLayoutBox(element->GetLayoutObject()));
+    NGConstraintSpace space = ConstructBlockLayoutTestConstraintSpace(
+        WritingMode::kHorizontalTb, TextDirection::kLtr,
+        LogicalSize(LayoutUnit(1000), kIndefiniteSize));
+    return NGBaseLayoutAlgorithmTest::RunBlockLayoutAlgorithm(container, space);
+  }
+};
+
+TEST_F(NGFragmentChildIteratorTest, Basic) {
+  SetBodyInnerHTML(R"HTML(
+    <div id="container">
+      <div id="child1">
+        <div id="grandchild"></div>
+      </div>
+      <div id="child2"></div>
+    </div>
+  )HTML");
+
+  const LayoutObject* child1 = GetLayoutObjectByElementId("child1");
+  const LayoutObject* child2 = GetLayoutObjectByElementId("child2");
+  const LayoutObject* grandchild = GetLayoutObjectByElementId("grandchild");
+
+  scoped_refptr<const NGPhysicalBoxFragment> container =
+      RunBlockLayoutAlgorithm(GetElementById("container"));
+  NGFragmentChildIterator iterator1(*container.get());
+  EXPECT_FALSE(iterator1.IsAtEnd());
+
+  const NGPhysicalBoxFragment* fragment = iterator1->BoxFragment();
+  ASSERT_TRUE(fragment);
+  EXPECT_EQ(fragment->GetLayoutObject(), child1);
+  EXPECT_FALSE(iterator1.IsAtEnd());
+
+  NGFragmentChildIterator iterator2 = iterator1.Descend();
+  EXPECT_FALSE(iterator2.IsAtEnd());
+  fragment = iterator2->BoxFragment();
+  ASSERT_TRUE(fragment);
+  EXPECT_EQ(fragment->GetLayoutObject(), grandchild);
+  EXPECT_FALSE(iterator2.IsAtEnd());
+  EXPECT_FALSE(iterator2.Advance());
+  EXPECT_TRUE(iterator2.IsAtEnd());
+
+  EXPECT_TRUE(iterator1.Advance());
+  fragment = iterator1->BoxFragment();
+  ASSERT_TRUE(fragment);
+  EXPECT_EQ(fragment->GetLayoutObject(), child2);
+  EXPECT_FALSE(iterator1.IsAtEnd());
+
+  // #child2 has no children.
+  EXPECT_TRUE(iterator1.Descend().IsAtEnd());
+
+  // No more children left.
+  EXPECT_FALSE(iterator1.Advance());
+  EXPECT_TRUE(iterator1.IsAtEnd());
+}
+
+TEST_F(NGFragmentChildIteratorTest, BasicInline) {
+  SetBodyInnerHTML(R"HTML(
+    <div id="container">
+      xxx
+      <span id="span1" style="border:solid;">
+        <div id="float1" style="float:left;"></div>
+        xxx
+      </span>
+      xxx
+    </div>
+  )HTML");
+
+  const LayoutObject* span1 = GetLayoutObjectByElementId("span1");
+  const LayoutObject* float1 = GetLayoutObjectByElementId("float1");
+
+  scoped_refptr<const NGPhysicalBoxFragment> container =
+      RunBlockLayoutAlgorithm(GetElementById("container"));
+  NGFragmentChildIterator iterator1(*container.get());
+
+  EXPECT_FALSE(iterator1->BoxFragment());
+  const NGFragmentItem* fragment_item = iterator1->FragmentItem();
+  ASSERT_TRUE(fragment_item);
+  EXPECT_EQ(fragment_item->Type(), NGFragmentItem::kLine);
+
+  // Descend into the line box.
+  NGFragmentChildIterator iterator2 = iterator1.Descend();
+  fragment_item = iterator2->FragmentItem();
+  ASSERT_TRUE(fragment_item);
+  EXPECT_TRUE(fragment_item->IsText());
+
+  EXPECT_TRUE(iterator2.Advance());
+  const NGPhysicalBoxFragment* fragment = iterator2->BoxFragment();
+  ASSERT_TRUE(fragment);
+  EXPECT_EQ(fragment->GetLayoutObject(), span1);
+
+  // Descend into children of #span1.
+  NGFragmentChildIterator iterator3 = iterator2.Descend();
+  fragment = iterator3->BoxFragment();
+  ASSERT_TRUE(fragment);
+  EXPECT_EQ(fragment->GetLayoutObject(), float1);
+
+  EXPECT_TRUE(iterator3.Advance());
+  fragment_item = iterator3->FragmentItem();
+  ASSERT_TRUE(fragment_item);
+  EXPECT_TRUE(fragment_item->IsText());
+  EXPECT_FALSE(iterator3.Advance());
+
+  // Continue with siblings of #span1.
+  EXPECT_TRUE(iterator2.Advance());
+  fragment_item = iterator2->FragmentItem();
+  ASSERT_TRUE(fragment_item);
+  EXPECT_TRUE(fragment_item->IsText());
+
+  EXPECT_FALSE(iterator2.Advance());
+  EXPECT_FALSE(iterator1.Advance());
+}
+
+TEST_F(NGFragmentChildIteratorTest, InlineBlock) {
+  SetBodyInnerHTML(R"HTML(
+    <div id="container">
+      xxx
+      <span id="inlineblock">
+        <div id="float1" style="float:left;"></div>
+      </span>
+      xxx
+    </div>
+  )HTML");
+
+  const LayoutObject* inlineblock = GetLayoutObjectByElementId("inlineblock");
+  const LayoutObject* float1 = GetLayoutObjectByElementId("float1");
+
+  scoped_refptr<const NGPhysicalBoxFragment> container =
+      RunBlockLayoutAlgorithm(GetElementById("container"));
+  NGFragmentChildIterator iterator1(*container.get());
+
+  EXPECT_FALSE(iterator1->BoxFragment());
+  const NGFragmentItem* fragment_item = iterator1->FragmentItem();
+  ASSERT_TRUE(fragment_item);
+  EXPECT_EQ(fragment_item->Type(), NGFragmentItem::kLine);
+
+  // Descend into the line box.
+  NGFragmentChildIterator iterator2 = iterator1.Descend();
+  fragment_item = iterator2->FragmentItem();
+  ASSERT_TRUE(fragment_item);
+  EXPECT_TRUE(fragment_item->IsText());
+
+  EXPECT_TRUE(iterator2.Advance());
+  const NGPhysicalBoxFragment* fragment = iterator2->BoxFragment();
+  ASSERT_TRUE(fragment);
+  EXPECT_EQ(fragment->GetLayoutObject(), inlineblock);
+
+  // Descend into children of #inlineblock.
+  NGFragmentChildIterator iterator3 = iterator2.Descend();
+  fragment = iterator3->BoxFragment();
+  ASSERT_TRUE(fragment);
+  EXPECT_EQ(fragment->GetLayoutObject(), float1);
+  EXPECT_FALSE(iterator3.Advance());
+
+  // Continue with siblings of #inlineblock.
+  EXPECT_TRUE(iterator2.Advance());
+  fragment_item = iterator2->FragmentItem();
+  ASSERT_TRUE(fragment_item);
+  EXPECT_TRUE(fragment_item->IsText());
+
+  EXPECT_FALSE(iterator2.Advance());
+  EXPECT_FALSE(iterator1.Advance());
+}
+
+TEST_F(NGFragmentChildIteratorTest, FloatsInInline) {
+  SetBodyInnerHTML(R"HTML(
+    <div id="container">
+      <span id="span1" style="border:solid;">
+        <div id="float1" style="float:left;">
+          <div id="child"></div>
+        </div>
+      </span>
+    </div>
+  )HTML");
+
+  const LayoutObject* span1 = GetLayoutObjectByElementId("span1");
+  const LayoutObject* float1 = GetLayoutObjectByElementId("float1");
+  const LayoutObject* child = GetLayoutObjectByElementId("child");
+
+  scoped_refptr<const NGPhysicalBoxFragment> container =
+      RunBlockLayoutAlgorithm(GetElementById("container"));
+  NGFragmentChildIterator iterator1(*container.get());
+
+  const NGPhysicalBoxFragment* fragment = iterator1->BoxFragment();
+  EXPECT_FALSE(fragment);
+  const NGFragmentItem* item = iterator1->FragmentItem();
+  ASSERT_TRUE(item);
+  EXPECT_EQ(item->Type(), NGFragmentItem::kLine);
+
+  // Descend into the line box.
+  NGFragmentChildIterator iterator2 = iterator1.Descend();
+  fragment = iterator2->BoxFragment();
+  ASSERT_TRUE(fragment);
+  EXPECT_EQ(fragment->GetLayoutObject(), span1);
+
+  // Descend into children of #span1.
+  NGFragmentChildIterator iterator3 = iterator2.Descend();
+  fragment = iterator3->BoxFragment();
+  ASSERT_TRUE(fragment);
+  EXPECT_EQ(fragment->GetLayoutObject(), float1);
+
+  // Descend into children of #float1.
+  NGFragmentChildIterator iterator4 = iterator3.Descend();
+  fragment = iterator4->BoxFragment();
+  ASSERT_TRUE(fragment);
+  EXPECT_EQ(fragment->GetLayoutObject(), child);
+
+  EXPECT_FALSE(iterator4.Advance());
+  EXPECT_FALSE(iterator3.Advance());
+  EXPECT_FALSE(iterator2.Advance());
+  EXPECT_FALSE(iterator1.Advance());
+}
+
+TEST_F(NGFragmentChildIteratorTest, AbsposAndLine) {
+  SetBodyInnerHTML(R"HTML(
+    <div id="container" style="position:relative;">
+      <div id="abspos" style="position:absolute;"></div>
+      xxx
+    </div>
+  )HTML");
+
+  const LayoutObject* abspos = GetLayoutObjectByElementId("abspos");
+
+  scoped_refptr<const NGPhysicalBoxFragment> container =
+      RunBlockLayoutAlgorithm(GetElementById("container"));
+  NGFragmentChildIterator iterator1(*container.get());
+
+  const NGPhysicalBoxFragment* fragment = iterator1->BoxFragment();
+  EXPECT_FALSE(fragment);
+  const NGFragmentItem* item = iterator1->FragmentItem();
+  ASSERT_TRUE(item);
+  EXPECT_EQ(item->Type(), NGFragmentItem::kLine);
+
+  // Descend into the line box.
+  NGFragmentChildIterator iterator2 = iterator1.Descend();
+
+  fragment = iterator2->BoxFragment();
+  EXPECT_FALSE(fragment);
+  item = iterator2->FragmentItem();
+  ASSERT_TRUE(item);
+  EXPECT_TRUE(item->IsText());
+  EXPECT_FALSE(iterator2.Advance());
+
+  // The abspos is a sibling of the line box.
+  EXPECT_TRUE(iterator1.Advance());
+  fragment = iterator1->BoxFragment();
+  ASSERT_TRUE(fragment);
+  EXPECT_EQ(fragment->GetLayoutObject(), abspos);
+  EXPECT_FALSE(iterator1.Advance());
+}
+
+}  // anonymous namespace
+}  // namespace blink
diff --git a/third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.cc b/third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.cc
index d6eb43b..9e6c57d0 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.cc
+++ b/third_party/blink/renderer/core/layout/ng/ng_physical_box_fragment.cc
@@ -105,6 +105,7 @@
       builder->space_ && builder->space_->IsPaintedAtomically();
   border_edge_ = builder->border_edges_.ToPhysical(builder->GetWritingMode());
   is_inline_formatting_context_ = builder->is_inline_formatting_context_;
+  is_generated_text_or_math_fraction_ = builder->is_math_fraction_;
 
   bool has_layout_containment = layout_object_->ShouldApplyLayoutContainment();
   if (builder->baseline_.has_value() && !has_layout_containment) {
diff --git a/third_party/blink/renderer/core/layout/ng/ng_physical_fragment.h b/third_party/blink/renderer/core/layout/ng/ng_physical_fragment.h
index 2c686be..5fd09f1 100644
--- a/third_party/blink/renderer/core/layout/ng/ng_physical_fragment.h
+++ b/third_party/blink/renderer/core/layout/ng/ng_physical_fragment.h
@@ -121,6 +121,9 @@
   bool IsRenderedLegend() const {
     return IsBox() && BoxType() == NGBoxType::kRenderedLegend;
   }
+  bool IsMathMLFraction() const {
+    return IsBox() && is_generated_text_or_math_fraction_;
+  }
 
   // Return true if this fragment corresponds directly to an entry in the CSS
   // box tree [1]. Note that anonymous blocks also exist in the CSS box
@@ -383,9 +386,12 @@
   unsigned has_baseline_ : 1;
   unsigned has_last_baseline_ : 1;
 
+  // The following bitfield is shared between NGPhysicalTextFragment and
+  // NGPhysicalBoxFragment.
+  unsigned is_generated_text_or_math_fraction_ : 1;
+
   // The following bitfields are only to be used by NGPhysicalTextFragment
   // (it's defined here to save memory, since that class has no bitfields).
-  unsigned is_generated_text_ : 1;
   mutable unsigned ink_overflow_computed_ : 1;
 
   // Note: We've used 32-bit bit field. If you need more bits, please think to
diff --git a/third_party/blink/renderer/core/loader/font_preload_manager.cc b/third_party/blink/renderer/core/loader/font_preload_manager.cc
index 1ace308..fb88635 100644
--- a/third_party/blink/renderer/core/loader/font_preload_manager.cc
+++ b/third_party/blink/renderer/core/loader/font_preload_manager.cc
@@ -111,9 +111,6 @@
 
   state_ = State::kUnblocked;
   finish_observers_.clear();
-
-  // TODO(xiaochengh): Mark all 'font-display: optional' fonts that are still
-  // loading as failure.
 }
 
 void FontPreloadManager::FontPreloadingDelaysRenderingTimerFired(TimerBase*) {
diff --git a/third_party/blink/renderer/core/loader/font_preload_manager.h b/third_party/blink/renderer/core/loader/font_preload_manager.h
index 2279550..5d779ee 100644
--- a/third_party/blink/renderer/core/loader/font_preload_manager.h
+++ b/third_party/blink/renderer/core/loader/font_preload_manager.h
@@ -31,6 +31,7 @@
 
   bool HasPendingRenderBlockingFonts() const;
   void WillBeginRendering();
+  bool RenderingHasBegun() const { return state_ == State::kUnblocked; }
 
   void FontPreloadingStarted(FontResource*);
   void FontPreloadingFinished(FontResource*, ResourceFinishObserver*);
diff --git a/third_party/blink/renderer/core/loader/font_preload_manager_test.cc b/third_party/blink/renderer/core/loader/font_preload_manager_test.cc
index 2907254..feb4318 100644
--- a/third_party/blink/renderer/core/loader/font_preload_manager_test.cc
+++ b/third_party/blink/renderer/core/loader/font_preload_manager_test.cc
@@ -6,7 +6,11 @@
 
 #include "base/test/scoped_feature_list.h"
 #include "third_party/blink/public/common/features.h"
+#include "third_party/blink/renderer/core/dom/element.h"
 #include "third_party/blink/renderer/core/frame/web_local_frame_impl.h"
+#include "third_party/blink/renderer/core/html/html_head_element.h"
+#include "third_party/blink/renderer/core/layout/layout_object.h"
+#include "third_party/blink/renderer/core/style/computed_style.h"
 #include "third_party/blink/renderer/core/testing/sim/sim_request.h"
 #include "third_party/blink/renderer/core/testing/sim/sim_test.h"
 #include "third_party/blink/renderer/platform/testing/unit_test_helpers.h"
@@ -21,6 +25,11 @@
     SimTest::SetUp();
   }
 
+  static Vector<char> ReadAhemWoff2() {
+    return test::ReadFromFile(test::CoreTestDataPath("Ahem.woff2"))
+        ->CopyAs<Vector<char>>();
+  }
+
  protected:
   FontPreloadManager& GetFontPreloadManager() {
     return GetDocument().GetFontPreloadManager();
@@ -29,6 +38,12 @@
   using State = FontPreloadManager::State;
   State GetState() { return GetFontPreloadManager().state_; }
 
+  Element* GetTarget() { return GetDocument().getElementById("target"); }
+
+  const Font& GetTargetFont() {
+    return GetTarget()->GetLayoutObject()->Style()->GetFont();
+  }
+
  private:
   base::test::ScopedFeatureList scoped_feature_list_;
 };
@@ -170,4 +185,202 @@
   font_resource.Finish();
 }
 
+// A trivial test case to verify test setup
+TEST_F(FontPreloadManagerTest, RegularWebFont) {
+  SimRequest main_resource("https://example.com", "text/html");
+  SimRequest font_resource("https://example.com/Ahem.woff2", "font/woff2");
+
+  LoadURL("https://example.com");
+  main_resource.Complete(R"HTML(
+    <!doctype html>
+    <style>
+      @font-face {
+        font-family: custom-font;
+        src: url(https://example.com/Ahem.woff2) format("woff2");
+      }
+      #target {
+        font: 25px/1 custom-font, monospace;
+      }
+    </style>
+    <span id=target style="position:relative">0123456789</span>
+  )HTML");
+
+  // Now rendering has started, as there's no blocking resources.
+  EXPECT_FALSE(Compositor().DeferMainFrameUpdate());
+  EXPECT_EQ(State::kUnblocked, GetState());
+
+  font_resource.Complete(ReadAhemWoff2());
+
+  // Now everything is loaded. The web font should be used in rendering.
+  Compositor().BeginFrame().DrawCount();
+  EXPECT_EQ(250, GetTarget()->OffsetWidth());
+  EXPECT_FALSE(GetTargetFont().ShouldSkipDrawing());
+}
+
+TEST_F(FontPreloadManagerTest, OptionalFontWithoutPreloading) {
+  SimRequest main_resource("https://example.com", "text/html");
+  SimRequest font_resource("https://example.com/Ahem.woff2", "font/woff2");
+
+  LoadURL("https://example.com");
+  main_resource.Complete(R"HTML(
+    <!doctype html>
+    <style>
+      @font-face {
+        font-family: custom-font;
+        src: url(https://example.com/Ahem.woff2) format("woff2");
+        font-display: optional;
+      }
+      #target {
+        font: 25px/1 custom-font, monospace;
+      }
+    </style>
+    <span id=target>0123456789</span>
+  )HTML");
+
+  // Now rendering has started, as there's no blocking resources.
+  EXPECT_FALSE(Compositor().DeferMainFrameUpdate());
+  EXPECT_EQ(State::kUnblocked, GetState());
+
+  font_resource.Complete(ReadAhemWoff2());
+
+  // The 'optional' web font isn't used, as it didn't finish loading before
+  // rendering started. Text is rendered in visible fallback.
+  Compositor().BeginFrame().Contains(SimCanvas::kText);
+  EXPECT_GT(250, GetTarget()->OffsetWidth());
+  EXPECT_FALSE(GetTargetFont().ShouldSkipDrawing());
+}
+
+TEST_F(FontPreloadManagerTest, OptionalFontRemoveAndReadd) {
+  SimRequest main_resource("https://example.com", "text/html");
+  SimRequest font_resource("https://example.com/Ahem.woff2", "font/woff2");
+
+  LoadURL("https://example.com");
+  main_resource.Complete(R"HTML(
+    <!doctype html>
+    <style>
+      @font-face {
+        font-family: custom-font;
+        src: url(https://example.com/Ahem.woff2) format("woff2");
+        font-display: optional;
+      }
+      #target {
+        font: 25px/1 custom-font, monospace;
+      }
+    </style>
+    <span id=target>0123456789</span>
+  )HTML");
+
+  // Now rendering has started, as there's no blocking resources.
+  EXPECT_FALSE(Compositor().DeferMainFrameUpdate());
+  EXPECT_EQ(State::kUnblocked, GetState());
+
+  // The 'optional' web font isn't used, as it didn't finish loading before
+  // rendering started. Text is rendered in visible fallback.
+  Compositor().BeginFrame().Contains(SimCanvas::kText);
+  EXPECT_GT(250, GetTarget()->OffsetWidth());
+  EXPECT_FALSE(GetTargetFont().ShouldSkipDrawing());
+
+  font_resource.Complete(ReadAhemWoff2());
+
+  Element* style = GetDocument().QuerySelector("style");
+  style->remove();
+  GetDocument().head()->appendChild(style);
+
+  // After removing and readding the style sheet, we've created a new font face
+  // that got loaded immediately from the memory cache. So it can be used.
+  Compositor().BeginFrame().Contains(SimCanvas::kText);
+  EXPECT_EQ(250, GetTarget()->OffsetWidth());
+  EXPECT_FALSE(GetTargetFont().ShouldSkipDrawing());
+}
+
+TEST_F(FontPreloadManagerTest, OptionalFontSlowPreloading) {
+  SimRequest main_resource("https://example.com", "text/html");
+  SimRequest font_resource("https://example.com/Ahem.woff2", "font/woff2");
+
+  LoadURL("https://example.com");
+  main_resource.Complete(R"HTML(
+    <!doctype html>
+    <link rel="preload" as="font" type="font/woff2"
+          href="https://example.com/Ahem.woff2" crossorigin>
+    <style>
+      @font-face {
+        font-family: custom-font;
+        src: url(https://example.com/Ahem.woff2) format("woff2");
+        font-display: optional;
+      }
+      #target {
+        font: 25px/1 custom-font, monospace;
+      }
+    </style>
+    <span id=target>0123456789</span>
+  )HTML");
+
+  // Rendering is blocked due to font being preloaded.
+  EXPECT_TRUE(Compositor().DeferMainFrameUpdate());
+  EXPECT_TRUE(GetFontPreloadManager().HasPendingRenderBlockingFonts());
+  EXPECT_EQ(State::kLoading, GetState());
+
+  GetFontPreloadManager().FontPreloadingDelaysRenderingTimerFired(nullptr);
+
+  // Rendering is unblocked after the font preloading has timed out.
+  EXPECT_FALSE(Compositor().DeferMainFrameUpdate());
+  EXPECT_FALSE(GetFontPreloadManager().HasPendingRenderBlockingFonts());
+  EXPECT_EQ(State::kUnblocked, GetState());
+
+  // First frame renders text with visible fallback, as the 'optional' web font
+  // isn't loaded yet, and should be treated as in the failure period.
+  Compositor().BeginFrame();
+  EXPECT_GT(250, GetTarget()->OffsetWidth());
+  EXPECT_FALSE(GetTargetFont().ShouldSkipDrawing());
+
+  font_resource.Complete(ReadAhemWoff2());
+
+  // The 'optional' web font should not cause relayout even if it finishes
+  // loading now.
+  Compositor().BeginFrame();
+  EXPECT_GT(250, GetTarget()->OffsetWidth());
+  EXPECT_FALSE(GetTargetFont().ShouldSkipDrawing());
+}
+
+TEST_F(FontPreloadManagerTest, OptionalFontFastPreloading) {
+  SimRequest main_resource("https://example.com", "text/html");
+  SimRequest font_resource("https://example.com/Ahem.woff2", "font/woff2");
+
+  LoadURL("https://example.com");
+  main_resource.Complete(R"HTML(
+    <!doctype html>
+    <link rel="preload" as="font" type="font/woff2"
+          href="https://example.com/Ahem.woff2" crossorigin>
+    <style>
+      @font-face {
+        font-family: custom-font;
+        src: url(https://example.com/Ahem.woff2) format("woff2");
+        font-display: optional;
+      }
+      #target {
+        font: 25px/1 custom-font, monospace;
+      }
+    </style>
+    <span id=target>0123456789</span>
+  )HTML");
+
+  // Rendering is blocked due to font being preloaded.
+  EXPECT_TRUE(Compositor().DeferMainFrameUpdate());
+  EXPECT_TRUE(GetFontPreloadManager().HasPendingRenderBlockingFonts());
+  EXPECT_EQ(State::kLoading, GetState());
+
+  font_resource.Complete(ReadAhemWoff2());
+  test::RunPendingTasks();
+
+  // Rendering is unblocked after the font is preloaded.
+  EXPECT_FALSE(Compositor().DeferMainFrameUpdate());
+  EXPECT_FALSE(GetFontPreloadManager().HasPendingRenderBlockingFonts());
+  EXPECT_EQ(State::kUnblocked, GetState());
+
+  // The 'optional' web font should be used in the first paint.
+  Compositor().BeginFrame();
+  EXPECT_EQ(250, GetTarget()->OffsetWidth());
+  EXPECT_FALSE(GetTargetFont().ShouldSkipDrawing());
+}
+
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/mathml/BUILD.gn b/third_party/blink/renderer/core/mathml/BUILD.gn
index 98fea9a..2204ea93 100644
--- a/third_party/blink/renderer/core/mathml/BUILD.gn
+++ b/third_party/blink/renderer/core/mathml/BUILD.gn
@@ -8,6 +8,8 @@
   sources = [
     "mathml_element.cc",
     "mathml_element.h",
+    "mathml_fraction_element.cc",
+    "mathml_fraction_element.h",
     "mathml_row_element.cc",
     "mathml_row_element.h",
     "mathml_space_element.cc",
diff --git a/third_party/blink/renderer/core/mathml/mathml_attribute_names.json5 b/third_party/blink/renderer/core/mathml/mathml_attribute_names.json5
index 5f5d065e..1f10983 100644
--- a/third_party/blink/renderer/core/mathml/mathml_attribute_names.json5
+++ b/third_party/blink/renderer/core/mathml/mathml_attribute_names.json5
@@ -11,6 +11,7 @@
     "depth",
     "encoding",
     "height",
+    "linethickness",
     "mathbackground",
     "mathcolor",
     "mathsize",
diff --git a/third_party/blink/renderer/core/mathml/mathml_element.cc b/third_party/blink/renderer/core/mathml/mathml_element.cc
index 1b92d53..4d3ff46 100644
--- a/third_party/blink/renderer/core/mathml/mathml_element.cc
+++ b/third_party/blink/renderer/core/mathml/mathml_element.cc
@@ -6,6 +6,7 @@
 
 #include "third_party/blink/renderer/bindings/core/v8/script_event_listener.h"
 #include "third_party/blink/renderer/core/css/css_property_name.h"
+#include "third_party/blink/renderer/core/css/parser/css_parser.h"
 #include "third_party/blink/renderer/core/css_value_keywords.h"
 #include "third_party/blink/renderer/core/html/html_element.h"
 
@@ -82,4 +83,20 @@
   Element::ParseAttribute(param);
 }
 
+base::Optional<Length> MathMLElement::AddMathLengthToComputedStyle(
+    ComputedStyle& style,
+    const CSSToLengthConversionData& conversion_data,
+    const QualifiedName& attr_name) {
+  if (!FastHasAttribute(attr_name))
+    return base::nullopt;
+  auto string = FastGetAttribute(attr_name);
+  const CSSValue* parsed = CSSParser::ParseSingleValue(
+      CSSPropertyID::kHeight, string,
+      StrictCSSParserContext(GetDocument().GetSecureContextMode()));
+  const auto* new_value = DynamicTo<CSSPrimitiveValue>(parsed);
+  if (!new_value || !new_value->IsLength())
+    return base::nullopt;
+  return new_value->ConvertToLength(conversion_data);
+}
+
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/mathml/mathml_element.h b/third_party/blink/renderer/core/mathml/mathml_element.h
index 04a0bef..a83de75 100644
--- a/third_party/blink/renderer/core/mathml/mathml_element.h
+++ b/third_party/blink/renderer/core/mathml/mathml_element.h
@@ -5,13 +5,18 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_MATHML_MATHML_ELEMENT_H_
 #define THIRD_PARTY_BLINK_RENDERER_CORE_MATHML_MATHML_ELEMENT_H_
 
+#include "base/optional.h"
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/dom/element.h"
 #include "third_party/blink/renderer/core/mathml_names.h"
+#include "third_party/blink/renderer/platform/geometry/length.h"
 #include "third_party/blink/renderer/platform/wtf/casting.h"
 
 namespace blink {
 
+class CSSToLengthConversionData;
+class QualifiedName;
+
 class CORE_EXPORT MathMLElement : public Element {
   DEFINE_WRAPPERTYPEINFO();
 
@@ -32,6 +37,11 @@
       const AtomicString&,
       MutableCSSPropertyValueSet*) override;
 
+  base::Optional<Length> AddMathLengthToComputedStyle(
+      ComputedStyle&,
+      const CSSToLengthConversionData&,
+      const QualifiedName&);
+
  private:
   void ParseAttribute(const AttributeModificationParams&) final;
 
diff --git a/third_party/blink/renderer/core/mathml/mathml_fraction_element.cc b/third_party/blink/renderer/core/mathml/mathml_fraction_element.cc
new file mode 100644
index 0000000..ad316cd
--- /dev/null
+++ b/third_party/blink/renderer/core/mathml/mathml_fraction_element.cc
@@ -0,0 +1,32 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/blink/renderer/core/mathml/mathml_fraction_element.h"
+
+#include "third_party/blink/renderer/core/layout/ng/mathml/layout_ng_mathml_block.h"
+#include "third_party/blink/renderer/platform/runtime_enabled_features.h"
+
+namespace blink {
+
+MathMLFractionElement::MathMLFractionElement(Document& doc)
+    : MathMLElement(mathml_names::kMfracTag, doc) {}
+
+void MathMLFractionElement::AddMathFractionBarThicknessIfNeeded(
+    ComputedStyle& style,
+    const CSSToLengthConversionData& conversion_data) {
+  if (auto length_or_percentage_value = AddMathLengthToComputedStyle(
+          style, conversion_data, mathml_names::kLinethicknessAttr))
+    style.SetMathFractionBarThickness(std::move(*length_or_percentage_value));
+}
+
+LayoutObject* MathMLFractionElement::CreateLayoutObject(
+    const ComputedStyle& style,
+    LegacyLayout legacy) {
+  if (!RuntimeEnabledFeatures::MathMLCoreEnabled() ||
+      !style.IsDisplayMathType() || legacy == LegacyLayout::kForce)
+    return MathMLElement::CreateLayoutObject(style, legacy);
+  return new LayoutNGMathMLBlock(this);
+}
+
+}  // namespace blink
diff --git a/third_party/blink/renderer/core/mathml/mathml_fraction_element.h b/third_party/blink/renderer/core/mathml/mathml_fraction_element.h
new file mode 100644
index 0000000..eac9e4e
--- /dev/null
+++ b/third_party/blink/renderer/core/mathml/mathml_fraction_element.h
@@ -0,0 +1,30 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_BLINK_RENDERER_CORE_MATHML_MATHML_FRACTION_ELEMENT_H_
+#define THIRD_PARTY_BLINK_RENDERER_CORE_MATHML_MATHML_FRACTION_ELEMENT_H_
+
+#include "third_party/blink/renderer/core/mathml/mathml_element.h"
+
+namespace blink {
+
+class ComputedStyle;
+class CSSToLengthConversionData;
+class LayoutObject;
+
+class MathMLFractionElement final : public MathMLElement {
+ public:
+  explicit MathMLFractionElement(Document&);
+
+  void AddMathFractionBarThicknessIfNeeded(ComputedStyle&,
+                                           const CSSToLengthConversionData&);
+
+ private:
+  LayoutObject* CreateLayoutObject(const ComputedStyle&,
+                                   LegacyLayout legacy) final;
+};
+
+}  // namespace blink
+
+#endif  // THIRD_PARTY_BLINK_RENDERER_CORE_MATHML_MATHML_FRACTION_ELEMENT_H_
diff --git a/third_party/blink/renderer/core/mathml/mathml_space_element.cc b/third_party/blink/renderer/core/mathml/mathml_space_element.cc
index ca857634..716fe38 100644
--- a/third_party/blink/renderer/core/mathml/mathml_space_element.cc
+++ b/third_party/blink/renderer/core/mathml/mathml_space_element.cc
@@ -4,7 +4,6 @@
 
 #include "third_party/blink/renderer/core/mathml/mathml_space_element.h"
 
-#include "third_party/blink/renderer/core/css/parser/css_parser.h"
 #include "third_party/blink/renderer/core/layout/ng/mathml/layout_ng_mathml_block.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 
@@ -16,18 +15,9 @@
 void MathMLSpaceElement::AddMathBaselineIfNeeded(
     ComputedStyle& style,
     const CSSToLengthConversionData& conversion_data) {
-  if (!FastHasAttribute(mathml_names::kHeightAttr))
-    return;
-  auto string = FastGetAttribute(mathml_names::kHeightAttr);
-  const CSSValue* parsed = CSSParser::ParseSingleValue(
-      CSSPropertyID::kHeight, string,
-      StrictCSSParserContext(GetDocument().GetSecureContextMode()));
-  const auto* new_value = DynamicTo<CSSPrimitiveValue>(parsed);
-  if (!new_value || !new_value->IsLength())
-    return;
-  Length length_or_percentage_value =
-      new_value->ConvertToLength(conversion_data);
-  style.SetMathBaseline(std::move(length_or_percentage_value));
+  if (auto length_or_percentage_value = AddMathLengthToComputedStyle(
+          style, conversion_data, mathml_names::kHeightAttr))
+    style.SetMathBaseline(std::move(*length_or_percentage_value));
 }
 
 bool MathMLSpaceElement::IsPresentationAttribute(
diff --git a/third_party/blink/renderer/core/mathml/mathml_tag_names.json5 b/third_party/blink/renderer/core/mathml/mathml_tag_names.json5
index 3331e8a..17fd2a645 100644
--- a/third_party/blink/renderer/core/mathml/mathml_tag_names.json5
+++ b/third_party/blink/renderer/core/mathml/mathml_tag_names.json5
@@ -32,6 +32,10 @@
       interfaceName: "MathMLRowElement",
     },
     {
+      name: "mfrac",
+      interfaceName: "MathMLFractionElement",
+    },
+    {
       name: "mglyph",
       interfaceName: "MathMLElement",
     },
diff --git a/third_party/blink/renderer/core/page/context_menu_controller.cc b/third_party/blink/renderer/core/page/context_menu_controller.cc
index 9a70565..27aa332d 100644
--- a/third_party/blink/renderer/core/page/context_menu_controller.cc
+++ b/third_party/blink/renderer/core/page/context_menu_controller.cc
@@ -128,16 +128,6 @@
              : nullptr;
 }
 
-// Figure out the URL of a page or subframe.
-static KURL UrlFromFrame(LocalFrame* frame) {
-  if (frame) {
-    DocumentLoader* document_loader = frame->Loader().GetDocumentLoader();
-    if (document_loader)
-      return document_loader->UrlForHistory();
-  }
-  return KURL();
-}
-
 static int ComputeEditFlags(Document& selected_document, Editor& editor) {
   int edit_flags = ContextMenuDataEditFlags::kCanDoNone;
   if (editor.CanUndo())
@@ -380,25 +370,6 @@
   if (selected_frame->GetDocument()->Loader())
     data.frame_encoding = selected_frame->GetDocument()->EncodingName();
 
-  // Send the frame and page URLs in any case.
-  auto* main_local_frame = DynamicTo<LocalFrame>(page_->MainFrame());
-  if (!main_local_frame) {
-    // TODO(kenrb): This works around the problem of URLs not being
-    // available for top-level frames that are in a different process.
-    // It mostly works to convert the security origin to a URL, but
-    // extensions accessing that property will not get the correct value
-    // in that case. See https://crbug.com/534561
-    const SecurityOrigin* origin =
-        page_->MainFrame()->GetSecurityContext()->GetSecurityOrigin();
-    if (origin)
-      data.page_url = KURL(origin->ToString());
-  } else {
-    data.page_url = WebURL(UrlFromFrame(main_local_frame));
-  }
-
-  if (selected_frame != page_->MainFrame())
-    data.frame_url = WebURL(UrlFromFrame(selected_frame));
-
   data.selection_start_offset = 0;
   // HitTestResult::isSelected() ensures clean layout by performing a hit test.
   // If source_type is |kMenuSourceAdjustSelection| or
diff --git a/third_party/blink/renderer/core/paint/BUILD.gn b/third_party/blink/renderer/core/paint/BUILD.gn
index 335341d4..98c25ea6 100644
--- a/third_party/blink/renderer/core/paint/BUILD.gn
+++ b/third_party/blink/renderer/core/paint/BUILD.gn
@@ -134,6 +134,8 @@
     "ng/ng_fragment_painter.h",
     "ng/ng_inline_box_fragment_painter.cc",
     "ng/ng_inline_box_fragment_painter.h",
+    "ng/ng_mathml_painter.cc",
+    "ng/ng_mathml_painter.h",
     "ng/ng_paint_fragment.cc",
     "ng/ng_paint_fragment.h",
     "ng/ng_paint_fragment_traversal.cc",
diff --git a/third_party/blink/renderer/core/paint/link_highlight_impl.cc b/third_party/blink/renderer/core/paint/link_highlight_impl.cc
index fb0b816..c67909af 100644
--- a/third_party/blink/renderer/core/paint/link_highlight_impl.cc
+++ b/third_party/blink/renderer/core/paint/link_highlight_impl.cc
@@ -46,6 +46,8 @@
 #include "third_party/blink/renderer/core/frame/web_local_frame_impl.h"
 #include "third_party/blink/renderer/core/layout/layout_box_model_object.h"
 #include "third_party/blink/renderer/core/layout/layout_object.h"
+#include "third_party/blink/renderer/core/layout/ng/inline/ng_fragment_item.h"
+#include "third_party/blink/renderer/core/layout/ng/inline/ng_inline_cursor.h"
 #include "third_party/blink/renderer/core/paint/compositing/composited_layer_mapping.h"
 #include "third_party/blink/renderer/core/paint/paint_layer.h"
 #include "third_party/blink/renderer/core/paint/paint_layer_scrollable_area.h"
@@ -287,6 +289,20 @@
     if (rects.size() > 1)
       use_rounded_rects = false;
 
+    // TODO(yosin): We should remove following if-statement once we release
+    // NGFragmentItem to renderer rounded rect even if nested inline, e.g.
+    // <a>ABC<b>DEF</b>GHI</a>.
+    // See gesture-tapHighlight-simple-nested.html
+    if (RuntimeEnabledFeatures::LayoutNGFragmentItemEnabled() &&
+        use_rounded_rects && object->IsLayoutInline()) {
+      NGInlineCursor cursor;
+      cursor.MoveTo(*object);
+      // When |LayoutInline| has more than one children, we render square
+      // rectangle as |NGPaintFragment|.
+      if (cursor && cursor.CurrentItem()->DescendantsCount() > 2)
+        use_rounded_rects = false;
+    }
+
     Path new_path;
     for (auto& rect : rects) {
       FloatRect snapped_rect(PixelSnappedIntRect(rect));
diff --git a/third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.cc b/third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.cc
index 1739dab..8e721f4 100644
--- a/third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.cc
+++ b/third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.cc
@@ -29,6 +29,7 @@
 #include "third_party/blink/renderer/core/paint/ng/ng_fieldset_painter.h"
 #include "third_party/blink/renderer/core/paint/ng/ng_fragment_painter.h"
 #include "third_party/blink/renderer/core/paint/ng/ng_inline_box_fragment_painter.h"
+#include "third_party/blink/renderer/core/paint/ng/ng_mathml_painter.h"
 #include "third_party/blink/renderer/core/paint/ng/ng_paint_fragment.h"
 #include "third_party/blink/renderer/core/paint/ng/ng_text_fragment_painter.h"
 #include "third_party/blink/renderer/core/paint/object_painter.h"
@@ -435,10 +436,13 @@
     return;
   }
 
-  if (paint_phase == PaintPhase::kForeground &&
-      paint_info.ShouldAddUrlMetadata()) {
-    NGFragmentPainter(box_fragment_, GetDisplayItemClient())
-        .AddURLRectIfNeeded(paint_info, paint_offset);
+  if (paint_phase == PaintPhase::kForeground) {
+    if (paint_info.ShouldAddUrlMetadata()) {
+      NGFragmentPainter(box_fragment_, GetDisplayItemClient())
+          .AddURLRectIfNeeded(paint_info, paint_offset);
+    }
+    if (is_visible && box_fragment_.IsMathMLFraction())
+      NGMathMLPainter(box_fragment_).PaintFractionBar(paint_info, paint_offset);
   }
 
   if (paint_phase != PaintPhase::kSelfOutlineOnly &&
diff --git a/third_party/blink/renderer/core/paint/ng/ng_mathml_painter.cc b/third_party/blink/renderer/core/paint/ng/ng_mathml_painter.cc
new file mode 100644
index 0000000..68e778f3
--- /dev/null
+++ b/third_party/blink/renderer/core/paint/ng/ng_mathml_painter.cc
@@ -0,0 +1,58 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/blink/renderer/core/paint/ng/ng_mathml_painter.h"
+
+#include "third_party/blink/renderer/core/layout/ng/mathml/ng_math_layout_utils.h"
+#include "third_party/blink/renderer/core/paint/ng/ng_box_fragment_painter.h"
+#include "third_party/blink/renderer/core/paint/paint_info.h"
+#include "third_party/blink/renderer/platform/geometry/layout_unit.h"
+#include "third_party/blink/renderer/platform/graphics/graphics_context_state_saver.h"
+#include "third_party/blink/renderer/platform/graphics/paint/drawing_recorder.h"
+
+namespace blink {
+
+void NGMathMLPainter::PaintBar(const PaintInfo& info, const IntRect& bar) {
+  if (bar.IsEmpty())
+    return;
+
+  GraphicsContextStateSaver state_saver(info.context);
+  info.context.SetStrokeThickness(bar.Height());
+  info.context.SetStrokeStyle(kSolidStroke);
+  info.context.SetStrokeColor(
+      box_fragment_.Style().VisitedDependentColor(GetCSSPropertyColor()));
+  IntPoint line_end_point = {bar.Width(), 0};
+  info.context.DrawLine(bar.Location(), bar.Location() + line_end_point);
+}
+
+void NGMathMLPainter::PaintFractionBar(const PaintInfo& info,
+                                       PhysicalOffset paint_offset) {
+  const DisplayItemClient& display_item_client =
+      *box_fragment_.GetLayoutObject();
+  if (DrawingRecorder::UseCachedDrawingIfPossible(
+          info.context, display_item_client, info.phase))
+    return;
+
+  DrawingRecorder recorder(info.context, display_item_client, info.phase);
+
+  DCHECK(box_fragment_.Style().IsHorizontalWritingMode());
+  const ComputedStyle& style = box_fragment_.Style();
+  LayoutUnit line_thickness = FractionLineThickness(style);
+  if (!line_thickness)
+    return;
+  LayoutUnit axis_height = MathAxisHeight(style);
+  if (auto baseline = box_fragment_.Baseline()) {
+    auto borders = box_fragment_.Borders();
+    auto padding = box_fragment_.Padding();
+    PhysicalRect bar_rect = {
+        borders.left + padding.left, *baseline - axis_height,
+        box_fragment_.Size().width - borders.HorizontalSum() -
+            padding.HorizontalSum(),
+        line_thickness};
+    bar_rect.Move(paint_offset);
+    PaintBar(info, PixelSnappedIntRect(bar_rect));
+  }
+}
+
+}  // namespace blink
diff --git a/third_party/blink/renderer/core/paint/ng/ng_mathml_painter.h b/third_party/blink/renderer/core/paint/ng/ng_mathml_painter.h
new file mode 100644
index 0000000..70233e80
--- /dev/null
+++ b/third_party/blink/renderer/core/paint/ng/ng_mathml_painter.h
@@ -0,0 +1,33 @@
+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef THIRD_PARTY_BLINK_RENDERER_CORE_PAINT_NG_NG_MATHML_PAINTER_H_
+#define THIRD_PARTY_BLINK_RENDERER_CORE_PAINT_NG_NG_MATHML_PAINTER_H_
+
+#include "third_party/blink/renderer/platform/wtf/allocator/allocator.h"
+
+namespace blink {
+
+struct PaintInfo;
+struct PhysicalOffset;
+class IntRect;
+class NGPhysicalBoxFragment;
+
+class NGMathMLPainter {
+  STACK_ALLOCATED();
+
+ public:
+  explicit NGMathMLPainter(const NGPhysicalBoxFragment& box_fragment)
+      : box_fragment_(box_fragment) {}
+  void PaintFractionBar(const PaintInfo&, PhysicalOffset);
+
+ private:
+  void PaintBar(const PaintInfo&, const IntRect&);
+
+  const NGPhysicalBoxFragment& box_fragment_;
+};
+
+}  // namespace blink
+
+#endif  // THIRD_PARTY_BLINK_RENDERER_CORE_PAINT_NG_NG_MATHML_PAINTER_H_
diff --git a/third_party/blink/renderer/core/style/computed_style_extra_fields.json5 b/third_party/blink/renderer/core/style/computed_style_extra_fields.json5
index c3815d7..c2b2351 100644
--- a/third_party/blink/renderer/core/style/computed_style_extra_fields.json5
+++ b/third_party/blink/renderer/core/style/computed_style_extra_fields.json5
@@ -1071,5 +1071,14 @@
       field_group: "*",
       getter: "GetMathBaseline",
     },
+    {
+      name: "MathFractionBarThickness",
+      field_template: "external",
+      default_value: "Length()",
+      include_paths: ["third_party/blink/renderer/platform/geometry/length.h"],
+      type_name: "Length",
+      field_group: "*",
+      getter: "GetMathFractionBarThickness",
+    },
   ],
 }
diff --git a/third_party/blink/renderer/core/testing/data/Ahem.woff2 b/third_party/blink/renderer/core/testing/data/Ahem.woff2
new file mode 100644
index 0000000..bf3cc77
--- /dev/null
+++ b/third_party/blink/renderer/core/testing/data/Ahem.woff2
Binary files differ
diff --git a/third_party/blink/renderer/modules/nfc/ndef_record_init.idl b/third_party/blink/renderer/modules/nfc/ndef_record_init.idl
index 74f203f..135130b 100644
--- a/third_party/blink/renderer/modules/nfc/ndef_record_init.idl
+++ b/third_party/blink/renderer/modules/nfc/ndef_record_init.idl
@@ -4,11 +4,7 @@
 
 // https://w3c.github.io/web-nfc/#idl-def-ndefrecorddatasource
 
-// The bindings generator does not support "typedef in union".
-// Must be (DOMString or BufferSource or NDEFMessageInit).
-// TODO(http://crbug.com/1019126): Support nested typedef in Web IDLs.
-typedef (DOMString or ArrayBuffer or ArrayBufferView or NDEFMessageInit)
-  NDEFRecordDataSource;
+typedef (DOMString or BufferSource or NDEFMessageInit) NDEFRecordDataSource;
 
 // https://w3c.github.io/web-nfc/#dom-ndefrecordinit
 
diff --git a/third_party/blink/renderer/modules/nfc/nfc_proxy.cc b/third_party/blink/renderer/modules/nfc/nfc_proxy.cc
index 387eeaf..9741abfb 100644
--- a/third_party/blink/renderer/modules/nfc/nfc_proxy.cc
+++ b/third_party/blink/renderer/modules/nfc/nfc_proxy.cc
@@ -175,14 +175,15 @@
   if (nfc_remote_)
     return;
 
-  GetSupplementable()->GetBrowserInterfaceBroker().GetInterface(
-      nfc_remote_.BindNewPipeAndPassReceiver());
-  nfc_remote_.set_disconnect_handler(
-      WTF::Bind(&NFCProxy::OnMojoConnectionError, WrapWeakPersistent(this)));
-
   // See https://bit.ly/2S0zRAS for task types.
   auto task_runner =
       GetSupplementable()->GetTaskRunner(TaskType::kMiscPlatformAPI);
+
+  GetSupplementable()->GetBrowserInterfaceBroker().GetInterface(
+      nfc_remote_.BindNewPipeAndPassReceiver(task_runner));
+  nfc_remote_.set_disconnect_handler(
+      WTF::Bind(&NFCProxy::OnMojoConnectionError, WrapWeakPersistent(this)));
+
   // Set client for OnWatch event.
   nfc_remote_->SetClient(
       client_receiver_.BindNewPipeAndPassRemote(task_runner));
diff --git a/third_party/blink/renderer/modules/webtransport/quic_transport.idl b/third_party/blink/renderer/modules/webtransport/quic_transport.idl
index 564295a..8f4c146 100644
--- a/third_party/blink/renderer/modules/webtransport/quic_transport.idl
+++ b/third_party/blink/renderer/modules/webtransport/quic_transport.idl
@@ -8,7 +8,7 @@
     Exposed=(Window,Worker),
     RuntimeEnabled=QuicTransport
 ] interface QuicTransport {
-  [CallWith=ScriptState, RaisesException] constructor(USVString url);
+  [CallWith=ScriptState, RaisesException, MeasureAs=QuicTransport] constructor(USVString url);
   // QuicTransport is the first, and at this moment only, transport which is
   // implemented. In the (draft) spec there are many mix-in interfaces which
   // QuicTransport includes, but we define all their methods/attributes here
@@ -17,12 +17,12 @@
   // From UnidirectionalStreamsTransport
   // TODO(ricea): Change this to Promise<SendStream> once the IDL compiler is
   // fixed. See https://crbug.com/1047113.
-  [CallWith=ScriptState, RaisesException] Promise<SendStream>
+  [CallWith=ScriptState, RaisesException, MeasureAs=QuicTransportStreamApis] Promise<SendStream>
       createSendStream();
 
   // From DatagramTransport mixin
-  WritableStream sendDatagrams();
-  ReadableStream receiveDatagrams();
+  [MeasureAs=QuicTransportDatagramApis] WritableStream sendDatagrams();
+  [MeasureAs=QuicTransportDatagramApis] ReadableStream receiveDatagrams();
 
   // From WebTransport mixin
   void close(optional WebTransportCloseInfo closeInfo = {});
diff --git a/third_party/blink/renderer/platform/fonts/font_fallback_list.h b/third_party/blink/renderer/platform/fonts/font_fallback_list.h
index 124f65e..7d2bb9f 100644
--- a/third_party/blink/renderer/platform/fonts/font_fallback_list.h
+++ b/third_party/blink/renderer/platform/fonts/font_fallback_list.h
@@ -92,8 +92,6 @@
   }
   const FontData* FontDataAt(const FontDescription&, unsigned index);
 
-  FallbackListCompositeKey CompositeKey(const FontDescription&) const;
-
   bool CanShapeWordByWord(const FontDescription&);
 
   void SetCanShapeWordByWordForTesting(bool b) {
@@ -108,6 +106,8 @@
 
   const SimpleFontData* DeterminePrimarySimpleFontData(const FontDescription&);
 
+  FallbackListCompositeKey CompositeKey(const FontDescription&) const;
+
   void ReleaseFontData();
   bool ComputeCanShapeWordByWord(const FontDescription&);
 
diff --git a/third_party/blink/renderer/platform/loader/fetch/resource.cc b/third_party/blink/renderer/platform/loader/fetch/resource.cc
index 2f7d7eb..f998c66 100644
--- a/third_party/blink/renderer/platform/loader/fetch/resource.cc
+++ b/third_party/blink/renderer/platform/loader/fetch/resource.cc
@@ -567,22 +567,23 @@
   return builder.ToString();
 }
 
-void Resource::DidAddClient(ResourceClient* c) {
+void Resource::DidAddClient(ResourceClient* client) {
   if (scoped_refptr<SharedBuffer> data = Data()) {
     for (const auto& span : *data) {
-      c->DataReceived(this, span.data(), span.size());
+      client->DataReceived(this, span.data(), span.size());
       // Stop pushing data if the client removed itself.
-      if (!HasClient(c))
+      if (!HasClient(client))
         break;
     }
   }
-  if (!HasClient(c))
+  if (!HasClient(client))
     return;
   if (IsFinishedInternal()) {
-    c->NotifyFinished(this);
-    if (clients_.Contains(c)) {
-      finished_clients_.insert(c);
-      clients_.erase(c);
+    client->SetHasFinishedFromMemoryCache();
+    client->NotifyFinished(this);
+    if (clients_.Contains(client)) {
+      finished_clients_.insert(client);
+      clients_.erase(client);
     }
   }
 }
diff --git a/third_party/blink/renderer/platform/loader/fetch/resource_client.h b/third_party/blink/renderer/platform/loader/fetch/resource_client.h
index dced85b..a4ea28e 100644
--- a/third_party/blink/renderer/platform/loader/fetch/resource_client.h
+++ b/third_party/blink/renderer/platform/loader/fetch/resource_client.h
@@ -64,6 +64,9 @@
 
   Resource* GetResource() const { return resource_; }
 
+  bool FinishedFromMemoryCache() const { return finished_from_memory_cache_; }
+  void SetHasFinishedFromMemoryCache() { finished_from_memory_cache_ = true; }
+
   // Name for debugging, e.g. shown in memory-infra.
   virtual String DebugName() const = 0;
 
@@ -86,6 +89,10 @@
                    base::SingleThreadTaskRunner* task_runner);
 
   Member<Resource> resource_;
+
+  // If true, the Resource was already available from the memory cache when this
+  // ResourceClient was setup, so that the request finished immediately.
+  bool finished_from_memory_cache_ = false;
 };
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc b/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc
index 9db847ab..667a786 100644
--- a/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc
+++ b/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc
@@ -471,6 +471,8 @@
         request.IsolatedWorldOrigin().get(),
         GetCorsFlag() ? CorsFlag::Set : CorsFlag::Unset);
   }
+  if (!RuntimeEnabledFeatures::OutOfBlinkCorsEnabled())
+    request_body_for_reidirect_ = request.HttpBody();
 
   if (request.IsAutomaticUpgrade()) {
     mojo::PendingRemote<ukm::mojom::UkmRecorderInterface> pending_recorder;
@@ -698,8 +700,12 @@
       resource_->LastResourceRequest().CreateRedirectRequest(
           new_url, new_method, new_site_for_cookies, new_referrer,
           new_referrer_policy,
-
           !passed_redirect_response.WasFetchedViaServiceWorker());
+  if (!RuntimeEnabledFeatures::OutOfBlinkCorsEnabled() &&
+      (new_request->HttpMethod() != http_names::kGET &&
+       new_request->HttpMethod() != http_names::kHEAD)) {
+    new_request->SetHttpBody(request_body_for_reidirect_);
+  }
 
   ResourceType resource_type = resource_->GetType();
 
@@ -816,7 +822,8 @@
   // TODO(yoichio): Have PrepareRequest use ResourceRequestHead.
   Context().PrepareRequest(*new_request, resource_->Options().initiator_info,
                            unused_virtual_time_pauser, resource_->GetType());
-  DCHECK(!new_request->HttpBody());
+  if (RuntimeEnabledFeatures::OutOfBlinkCorsEnabled())
+    DCHECK(!new_request->HttpBody());
   if (auto* observer = fetcher_->GetResourceLoadObserver()) {
     observer->WillSendRequest(resource_->InspectorId(), *new_request,
                               redirect_response_to_pass, resource_->GetType(),
diff --git a/third_party/blink/renderer/platform/loader/fetch/resource_loader.h b/third_party/blink/renderer/platform/loader/fetch/resource_loader.h
index 5029b7b..ebb2308e 100644
--- a/third_party/blink/renderer/platform/loader/fetch/resource_loader.h
+++ b/third_party/blink/renderer/platform/loader/fetch/resource_loader.h
@@ -210,6 +210,8 @@
   Member<ResourceFetcher> fetcher_;
   Member<ResourceLoadScheduler> scheduler_;
   Member<Resource> resource_;
+  // This flag is only needed when OOB-CORS is disabled.
+  scoped_refptr<EncodedFormData> request_body_for_reidirect_;
   Member<ResponseBodyLoader> response_body_loader_;
   Member<DataPipeBytesConsumer::CompletionNotifier>
       data_pipe_completion_notifier_;
diff --git a/third_party/blink/renderer/platform/mojo/blink_typemaps.gni b/third_party/blink/renderer/platform/mojo/blink_typemaps.gni
index 434a7cb..7fad5d7 100644
--- a/third_party/blink/renderer/platform/mojo/blink_typemaps.gni
+++ b/third_party/blink/renderer/platform/mojo/blink_typemaps.gni
@@ -3,7 +3,7 @@
 # found in the LICENSE file.
 
 typemaps = [
-  "//media/capture/mojom/video_capture_types_for_blink.typemap",
+  "//media/capture/mojom/video_capture_types.typemap",
   "//media/mojo/mojom/audio_parameters.typemap",
   "//services/network/public/cpp/http_request_headers.typemap",
   "//services/network/public/cpp/ip_address.typemap",
diff --git a/third_party/blink/renderer/platform/webrtc/peer_connection_remote_audio_source.cc b/third_party/blink/renderer/platform/webrtc/peer_connection_remote_audio_source.cc
index 85cd6826..7a775eb 100644
--- a/third_party/blink/renderer/platform/webrtc/peer_connection_remote_audio_source.cc
+++ b/third_party/blink/renderer/platform/webrtc/peer_connection_remote_audio_source.cc
@@ -4,6 +4,9 @@
 
 #include "third_party/blink/renderer/platform/webrtc/peer_connection_remote_audio_source.h"
 
+#include <string>
+#include <utility>
+
 #include "base/logging.h"
 #include "base/strings/stringprintf.h"
 #include "base/time/time.h"
@@ -161,7 +164,8 @@
   MediaStreamAudioSource::DeliverDataToTracks(*audio_bus_, playout_time);
 
 #ifndef NDEBUG
-  single_audio_thread_guard_.Release();
+  if (is_only_thread_here)
+    single_audio_thread_guard_.Release();
 #endif
 }
 
diff --git a/third_party/blink/renderer/platform/wtf/linked_hash_set.h b/third_party/blink/renderer/platform/wtf/linked_hash_set.h
index 8eb136f0..55ce56a 100644
--- a/third_party/blink/renderer/platform/wtf/linked_hash_set.h
+++ b/third_party/blink/renderer/platform/wtf/linked_hash_set.h
@@ -28,7 +28,7 @@
 #include "third_party/blink/renderer/platform/wtf/hash_map.h"
 #include "third_party/blink/renderer/platform/wtf/hash_set.h"
 #include "third_party/blink/renderer/platform/wtf/sanitizers.h"
-#include "third_party/blink/renderer/platform/wtf/vector.h"
+#include "third_party/blink/renderer/platform/wtf/vector_backed_linked_list.h"
 
 namespace WTF {
 
@@ -1024,110 +1024,6 @@
 // TODO(keinakashima): replace existing LinkedHashSet with NewLinkedHashSet
 // after completion
 
-template <typename NewLinkedHashSet>
-class NewLinkedHashSetConstIterator;
-
-template <typename ValueArg>
-class NewLinkedHashSetNode {
-  USING_FAST_MALLOC(NewLinkedHashSetNode);
-
- public:
-  NewLinkedHashSetNode() = default;
-
-  NewLinkedHashSetNode(wtf_size_t prev_index,
-                       wtf_size_t next_index,
-                       const ValueArg& value)
-      : prev_index_(prev_index), next_index_(next_index), value_(value) {}
-
-  NewLinkedHashSetNode(wtf_size_t prev_index,
-                       wtf_size_t next_index,
-                       ValueArg&& value)
-      : prev_index_(prev_index),
-        next_index_(next_index),
-        value_(std::move(value)) {}
-
-  NewLinkedHashSetNode(const NewLinkedHashSetNode& other) = delete;
-
-  NewLinkedHashSetNode(NewLinkedHashSetNode&& other) = default;
-
-  NewLinkedHashSetNode& operator=(const NewLinkedHashSetNode& other) = delete;
-
-  NewLinkedHashSetNode& operator=(NewLinkedHashSetNode&& other) = default;
-
-  wtf_size_t GetNextIndexForFreeNode() const {
-#if DCHECK_IS_ON()
-    DCHECK(!is_used);
-#endif
-    return next_index_;
-  }
-
-  wtf_size_t GetPrevIndexForUsedNode() const {
-#if DCHECK_IS_ON()
-    DCHECK(is_used);
-#endif
-    return prev_index_;
-  }
-
-  wtf_size_t GetNextIndexForUsedNode() const {
-#if DCHECK_IS_ON()
-    DCHECK(is_used);
-#endif
-    return next_index_;
-  }
-
-  const ValueArg& GetValueForUsedNode() const {
-#if DCHECK_IS_ON()
-    DCHECK(is_used);
-#endif
-    return value_;
-  }
-
-  void SetNextIndexForFreeNode(wtf_size_t next_index) {
-#if DCHECK_IS_ON()
-    DCHECK(!is_used);
-#endif
-    next_index_ = next_index;
-  }
-
-  void SetPrevIndexForUsedNode(wtf_size_t prev_index) {
-#if DCHECK_IS_ON()
-    DCHECK(is_used);
-#endif
-    prev_index_ = prev_index;
-  }
-
-  void SetNextIndexForUsedNode(wtf_size_t next_index) {
-#if DCHECK_IS_ON()
-    DCHECK(is_used);
-#endif
-    next_index_ = next_index;
-  }
-
-  void SetValueForUsedNode(const ValueArg& value) {
-#if DCHECK_IS_ON()
-    DCHECK(is_used);
-#endif
-    value_ = value;
-  }
-
-  void SetValueForUsedNode(ValueArg&& value) {
-#if DCHECK_IS_ON()
-    DCHECK(is_used);
-#endif
-    value_ = std::move(value);
-  }
-
- private:
-  wtf_size_t prev_index_ = 0;
-  wtf_size_t next_index_ = 0;
-  ValueArg value_ = HashTraits<ValueArg>::EmptyValue();
-
-#if DCHECK_IS_ON()
- public:
-  bool is_used = true;
-#endif
-};
-
 // This class is yet experimental. Do not use this class.
 
 // LinkedHashSet provides a Set interface like HashSet, but also has a
@@ -1146,12 +1042,9 @@
 
  private:
   using Value = ValueArg;
-  using Node = NewLinkedHashSetNode<Value>;
   using Map = HashMap<Value, wtf_size_t>;
 
  public:
-  friend class NewLinkedHashSetConstIterator<NewLinkedHashSet>;
-  using const_iterator = NewLinkedHashSetConstIterator<NewLinkedHashSet>;
   // TODO(keinakashima): add security check
   struct AddResult final {
     STACK_ALLOCATED();
@@ -1175,134 +1068,28 @@
 
   void Swap(NewLinkedHashSet&);
 
-  wtf_size_t size() const { return value_to_index_.size(); }
-  bool IsEmpty() const { return value_to_index_.IsEmpty(); }
+  // TODO(keinakashima): implement size-related functions
 
-  const_iterator begin() const { return MakeConstIterator(UsedFirstIndex()); }
-  const_iterator end() const { return MakeConstIterator(anchor_index_); }
-  // TODO(keinakashima): implement reverse const iterator
+  // TODO(keinakashima): implement begin/end, rbegin/rend
 
-  const Value& front() const;
-  void RemoveFirst();
-
-  const Value& back() const;
-  void pop_back();
+  // TODO(keinakashima): implement front/back
 
   // TODO(keinakashima): implement find, Contains after implementing iterator
 
-  template <typename IncomingValueType>
-  AddResult insert(IncomingValueType&&);
+  // TODO(keinakahsima): implement functions related to insert
 
-  template <typename IncomingValueType>
-  AddResult AppendOrMoveToLast(IncomingValueType&&);
+  // TODO(keinakashima): implement functions related to erase
 
-  template <typename IncomingValueType>
-  AddResult PrependOrMoveToFirst(IncomingValueType&&);
-
-  void erase(ValuePeekInType);
-  // TODO(keinakashima): implement erase that has an iterator as an argument
-  // TODO(keinakashima): implement clear, RemoveAll, Trace
+  // TODO(keinakashima): implement clear (,RemoveAll, Trace)
 
  private:
-  bool IsFreeListEmpty() const { return free_head_index_ == anchor_index_; }
-
-  wtf_size_t UsedFirstIndex() const {
-    return nodes_[anchor_index_].GetNextIndexForUsedNode();
-  }
-  wtf_size_t UsedLastIndex() const {
-    return nodes_[anchor_index_].GetPrevIndexForUsedNode();
-  }
-  wtf_size_t NewEntryIndex() const {
-    if (IsFreeListEmpty()) {
-      return nodes_.size();
-    }
-    return free_head_index_;
-  }
-
-  const_iterator MakeConstIterator(wtf_size_t index) const {
-    return const_iterator(index, this);
-  }
-
-  // Inserts new value before given position to a linked list in vector
-  // Returns a pointer to the stored value
-  template <typename IncomingValueType>
-  const Value* InsertValueBeforeNode(wtf_size_t, IncomingValueType&&);
-
-  // Erases the node with the given index from the used list
-  // and prepends it to the free list as a free node.
-  // At this time, its value is set to be empty.
-  void FreeUsedNode(wtf_size_t);
-
   HashMap<Value, wtf_size_t> value_to_index_;
-  Vector<Node> nodes_;
-  wtf_size_t free_head_index_ = anchor_index_;
-  static constexpr wtf_size_t anchor_index_ = 0;
-};
-
-// TODO(keinakashima): add modification check
-// TODO(keinakashima): implement DCHECK that prevents mutations while iterating
-template <typename NewLinkedHashSetType>
-class NewLinkedHashSetConstIterator {
- private:
-  using Node = typename NewLinkedHashSetType::Node;
-  using ReferenceType = const typename NewLinkedHashSetType::Value&;
-  using PointerType = const typename NewLinkedHashSetType::Value*;
-
- protected:
-  NewLinkedHashSetConstIterator(wtf_size_t index,
-                                const NewLinkedHashSetType* container)
-      : index_(index), container_(container) {}
-
- public:
-  ReferenceType operator*() const { return *Get(); }
-  PointerType operator->() const { return Get(); }
-
-  NewLinkedHashSetConstIterator& operator++() {
-    DCHECK(0 <= index_ && index_ < container_->nodes_.size());
-    index_ = container_->nodes_[index_].GetNextIndexForUsedNode();
-    return *this;
-  }
-
-  NewLinkedHashSetConstIterator& operator--() {
-    DCHECK(0 <= index_ && index_ < container_->nodes_.size());
-    index_ = container_->nodes_[index_].GetPrevIndexForUsedNode();
-    return *this;
-  }
-
-  NewLinkedHashSetConstIterator operator++(int) = delete;
-  NewLinkedHashSetConstIterator operator--(int) = delete;
-
-  bool operator==(const NewLinkedHashSetConstIterator& other) {
-    DCHECK_EQ(container_, other.container_);
-    return index_ == other.index_;
-  }
-
-  bool operator!=(const NewLinkedHashSetConstIterator& other) {
-    return !(*this == other);
-  }
-
- protected:
-  PointerType Get() const {
-    DCHECK(0 <= index_ && index_ < container_->nodes_.size());
-    const Node& node = container_->nodes_[index_];
-    return &node.GetValueForUsedNode();
-  }
-
- private:
-  wtf_size_t index_;
-  const NewLinkedHashSetType* container_;
-
-  template <typename T>
-  friend class NewLinkedHashSet;
+  VectorBackedLinkedList<Value> list_;
 };
 
 template <typename T>
 NewLinkedHashSet<T>::NewLinkedHashSet() {
   // TODO(keinakashima): add assertion when considering GC
-
-  // nodes_[0] is used for anchor, which serves as the beginning and the end of
-  // the used list.
-  nodes_.push_back(Node());
 }
 
 // TODO(keinakashima): add copy constructor after implementing iterator if
@@ -1331,151 +1118,7 @@
 template <typename T>
 inline void NewLinkedHashSet<T>::Swap(NewLinkedHashSet& other) {
   value_to_index_.swap(other.value_to_index_);
-  nodes_.swap(other.nodes_);
-  swap(free_head_index_, other.free_head_index_);
-}
-
-template <typename T>
-inline const T& NewLinkedHashSet<T>::front() const {
-  DCHECK(!IsEmpty());
-  return nodes_[UsedFirstIndex()].GetValueForUsedNode();
-}
-
-template <typename T>
-inline void NewLinkedHashSet<T>::RemoveFirst() {
-  DCHECK(!IsEmpty());
-  value_to_index_.erase(front());
-  FreeUsedNode(UsedFirstIndex());
-}
-
-template <typename T>
-inline const T& NewLinkedHashSet<T>::back() const {
-  DCHECK(!IsEmpty());
-  return nodes_[UsedLastIndex()].GetValueForUsedNode();
-}
-
-template <typename T>
-inline void NewLinkedHashSet<T>::pop_back() {
-  DCHECK(!IsEmpty());
-  value_to_index_.erase(back());
-  FreeUsedNode(UsedLastIndex());
-}
-
-template <typename T>
-template <typename IncomingValueType>
-typename NewLinkedHashSet<T>::AddResult NewLinkedHashSet<T>::insert(
-    IncomingValueType&& value) {
-  wtf_size_t new_entry_index = NewEntryIndex();
-  typename Map::AddResult result =
-      value_to_index_.insert(value, new_entry_index);
-
-  if (!result.is_new_entry) {
-    wtf_size_t index = result.stored_value->value;
-    return AddResult(&(nodes_[index].GetValueForUsedNode()), false);
-  }
-
-  const T* stored_value = InsertValueBeforeNode(
-      anchor_index_, std::forward<IncomingValueType>(value));
-  return AddResult(stored_value, true);
-}
-
-template <typename T>
-template <typename IncomingValueType>
-typename NewLinkedHashSet<T>::AddResult NewLinkedHashSet<T>::AppendOrMoveToLast(
-    IncomingValueType&& value) {
-  typename Map::AddResult result =
-      value_to_index_.insert(value, NewEntryIndex());
-
-  // TODO(keinakashima): just update prev/next indices to avoid reconstruct the
-  // same value
-  if (!result.is_new_entry) {
-    wtf_size_t index = result.stored_value->value;
-    FreeUsedNode(index);
-  }
-
-  const T* stored_value = InsertValueBeforeNode(
-      anchor_index_, std::forward<IncomingValueType>(value));
-  return AddResult(stored_value, result.is_new_entry);
-}
-
-template <typename T>
-template <typename IncomingValueType>
-typename NewLinkedHashSet<T>::AddResult
-NewLinkedHashSet<T>::PrependOrMoveToFirst(IncomingValueType&& value) {
-  typename Map::AddResult result =
-      value_to_index_.insert(value, NewEntryIndex());
-
-  if (!result.is_new_entry) {
-    wtf_size_t index = result.stored_value->value;
-    FreeUsedNode(index);
-  }
-
-  const T* stored_value = InsertValueBeforeNode(
-      UsedFirstIndex(), std::forward<IncomingValueType>(value));
-  return AddResult(stored_value, result.is_new_entry);
-}
-
-template <typename T>
-inline void NewLinkedHashSet<T>::erase(ValuePeekInType value) {
-  typename Map::iterator it = value_to_index_.find(value);
-  if (it == value_to_index_.end())
-    return;
-
-  wtf_size_t index = it->value;
-  value_to_index_.erase(it);
-  FreeUsedNode(index);
-}
-
-template <typename T>
-template <typename IncomingValueType>
-inline const T* NewLinkedHashSet<T>::InsertValueBeforeNode(
-    wtf_size_t before_index,
-    IncomingValueType&& new_value) {
-  wtf_size_t prev_index = nodes_[before_index].GetPrevIndexForUsedNode();
-  Node& prev = nodes_[prev_index];
-  Node& next = nodes_[before_index];
-
-  wtf_size_t new_entry_index = NewEntryIndex();
-  prev.SetNextIndexForUsedNode(new_entry_index);
-  next.SetPrevIndexForUsedNode(new_entry_index);
-
-  if (IsFreeListEmpty()) {
-    DCHECK(nodes_.size() == new_entry_index);
-    nodes_.push_back(Node(prev_index, before_index,
-                          std::forward<IncomingValueType>(new_value)));
-  } else {
-    DCHECK(free_head_index_ == new_entry_index);
-    Node& free_head = nodes_[free_head_index_];
-    free_head_index_ = free_head.GetNextIndexForFreeNode();
-    free_head = Node(prev_index, before_index,
-                     std::forward<IncomingValueType>(new_value));
-  }
-  return &(nodes_[new_entry_index].GetValueForUsedNode());
-}
-
-template <typename T>
-inline void NewLinkedHashSet<T>::FreeUsedNode(wtf_size_t index) {
-  DCHECK(index != anchor_index_);
-  Node& node = nodes_[index];
-#if DCHECK_IS_ON()
-  DCHECK(node.is_used);
-#endif
-
-  wtf_size_t prev_index = node.GetPrevIndexForUsedNode();
-  wtf_size_t next_index = node.GetNextIndexForUsedNode();
-
-  Node& prev_node = nodes_[prev_index];
-  Node& next_node = nodes_[next_index];
-
-  prev_node.SetNextIndexForUsedNode(next_index);
-  next_node.SetPrevIndexForUsedNode(prev_index);
-
-  node.SetValueForUsedNode(HashTraits<T>::EmptyValue());
-#if DCHECK_IS_ON()
-  node.is_used = false;
-#endif
-  node.SetNextIndexForFreeNode(free_head_index_);
-  free_head_index_ = index;
+  list_.swap(other.list_);
 }
 
 }  // namespace WTF
diff --git a/third_party/blink/renderer/platform/wtf/linked_hash_set_test.cc b/third_party/blink/renderer/platform/wtf/linked_hash_set_test.cc
index eb5e79e..6e4314c 100644
--- a/third_party/blink/renderer/platform/wtf/linked_hash_set_test.cc
+++ b/third_party/blink/renderer/platform/wtf/linked_hash_set_test.cc
@@ -10,403 +10,8 @@
 
 namespace WTF {
 
-TEST(NewLinkedHashSetTest, Node) {
-  NewLinkedHashSetNode<int> node0;
-  NewLinkedHashSetNode<int> node1(1, 2, 3);
-
-  EXPECT_EQ(node0.GetPrevIndexForUsedNode(), 0u);
-  EXPECT_EQ(node0.GetNextIndexForUsedNode(), 0u);
-
-  EXPECT_EQ(node1.GetPrevIndexForUsedNode(), 1u);
-  EXPECT_EQ(node1.GetNextIndexForUsedNode(), 2u);
-  node1.SetPrevIndexForUsedNode(3);
-  EXPECT_EQ(node1.GetPrevIndexForUsedNode(), 3u);
-  node1.SetNextIndexForUsedNode(4);
-  EXPECT_EQ(node1.GetNextIndexForUsedNode(), 4u);
-  EXPECT_EQ(node1.GetValueForUsedNode(), 3);
-  node1.SetValueForUsedNode(-1);
-  EXPECT_EQ(node1.GetValueForUsedNode(), -1);
-}
-
 TEST(NewLinkedHashSetTest, Construct) {
   NewLinkedHashSet<int> test;
-  EXPECT_EQ(test.size(), 0u);
-}
-
-TEST(NewLinkedHashSetTest, Iterator) {
-  using Set = NewLinkedHashSet<int>;
-
-  Set set;
-  EXPECT_TRUE(set.begin() == set.end());
-
-  set.insert(1);
-  Set::const_iterator it = set.begin();
-  EXPECT_EQ(*it, 1);
-  ++it;
-  EXPECT_TRUE(it == set.end());
-
-  set.insert(2);
-  set.insert(3);
-
-  it = set.begin();
-  EXPECT_EQ(*it, 1);
-  ++it;
-  EXPECT_EQ(*it, 2);
-  ++it;
-  EXPECT_EQ(*it, 3);
-  ++it;
-  EXPECT_TRUE(it == set.end());
-  --it;
-  EXPECT_EQ(*it, 3);
-  --it;
-  EXPECT_EQ(*it, 2);
-  --it;
-  EXPECT_EQ(*it, 1);
-  EXPECT_TRUE(it == set.begin());
-  EXPECT_TRUE(it != set.end());
-
-  int i = 1;
-  for (auto it : set) {
-    EXPECT_EQ(it, i);
-    i++;
-  }
-}
-
-TEST(NewLinkedHashSetTest, InsertAndEraseForInteger) {
-  using Set = NewLinkedHashSet<int>;
-  Set set;
-  Set::AddResult result = set.insert(1);  // set: 1 vector: anchor 1
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, 1);
-  EXPECT_EQ(set.front(), 1);
-  EXPECT_EQ(set.back(), 1);
-  EXPECT_EQ(set.size(), 1u);
-
-  result = set.insert(2);  // set: 1, 2 vector: anchor 1, 2
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, 2);
-  EXPECT_EQ(set.front(), 1);
-  EXPECT_EQ(set.back(), 2);
-  EXPECT_EQ(set.size(), 2u);
-
-  result = set.insert(1);  // set: 1, 2 vector: anchor 1, 2
-  EXPECT_FALSE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, 1);
-  EXPECT_EQ(set.front(), 1);
-  EXPECT_EQ(set.back(), 2);
-  EXPECT_EQ(set.size(), 2u);
-
-  result = set.insert(3);  // set: 1, 2, 3 vector: anchor 1, 2, 3
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, 3);
-  EXPECT_EQ(set.front(), 1);
-  EXPECT_EQ(set.back(), 3);
-  EXPECT_EQ(set.size(), 3u);
-
-  set.erase(1);  // set: 2, 3 vector: anchor hole 2, 3
-  EXPECT_EQ(set.front(), 2);
-  EXPECT_EQ(set.back(), 3);
-  EXPECT_EQ(set.size(), 2u);
-
-  result = set.insert(1);  // set: 2, 3, 1 vector: anchor 1, 2, 3
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, 1);
-  EXPECT_EQ(set.front(), 2);
-  EXPECT_EQ(set.back(), 1);
-  EXPECT_EQ(set.size(), 3u);
-
-  set.erase(3);  // set: 2, 1 vector: anchor 1, 2, hole
-  EXPECT_EQ(set.front(), 2);
-  EXPECT_EQ(set.back(), 1);
-  EXPECT_EQ(set.size(), 2u);
-
-  result = set.insert(4);  // set: 2, 1, 4 vector: anchor 1, 2, 4
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, 4);
-  EXPECT_EQ(set.front(), 2);
-  EXPECT_EQ(set.back(), 4);
-  EXPECT_EQ(set.size(), 3u);
-
-  result = set.insert(5);  // set: 2, 1, 4, 5 vector: anchor 1, 2, 4, 5
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, 5);
-  EXPECT_EQ(set.front(), 2);
-  EXPECT_EQ(set.back(), 5);
-  EXPECT_EQ(set.size(), 4u);
-
-  set.erase(10);
-  set.erase(100);
-  set.erase(1000);
-  set.erase(211);
-
-  result = set.insert(3);  // set: 2, 1, 4, 5, 3 vector: anchor 1, 2, 4, 5, 3
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, 3);
-  EXPECT_EQ(set.front(), 2);
-  EXPECT_EQ(set.back(), 3);
-  EXPECT_EQ(set.size(), 5u);
-}
-
-TEST(NewLinkedHashSetTest, RemoveFirstAndPopBackForInteger) {
-  using Set = NewLinkedHashSet<int>;
-  Set set;
-
-  for (int i = 1; i <= 5; i++) {
-    set.insert(i);
-  }
-  EXPECT_EQ(set.front(), 1);
-  EXPECT_EQ(set.back(), 5);
-
-  set.RemoveFirst();
-  EXPECT_EQ(set.front(), 2);
-  EXPECT_EQ(set.back(), 5);
-
-  set.pop_back();
-  EXPECT_EQ(set.front(), 2);
-  EXPECT_EQ(set.back(), 4);
-
-  set.RemoveFirst();
-  EXPECT_EQ(set.front(), 3);
-  EXPECT_EQ(set.back(), 4);
-
-  set.pop_back();
-  EXPECT_EQ(set.front(), 3);
-  EXPECT_EQ(set.back(), 3);
-
-  set.RemoveFirst();
-  EXPECT_TRUE(set.IsEmpty());
-
-  set.insert(1);
-  EXPECT_EQ(set.front(), 1);
-  EXPECT_EQ(set.back(), 1);
-  set.pop_back();
-  EXPECT_TRUE(set.IsEmpty());
-}
-
-TEST(NewLinkedHashSetTest, PrependOrMoveToFirstForInteger) {
-  using Set = NewLinkedHashSet<int>;
-  Set set;
-  Set::AddResult result =
-      set.PrependOrMoveToFirst(1);  // set: 1 vector: anchor 1
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, 1);
-  EXPECT_EQ(set.front(), 1);
-  EXPECT_EQ(set.back(), 1);
-  EXPECT_EQ(set.size(), 1u);
-
-  result = set.insert(2);  // set: 1, 2 vector: anchor 1, 2
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, 2);
-  EXPECT_EQ(set.front(), 1);
-  EXPECT_EQ(set.back(), 2);
-  EXPECT_EQ(set.size(), 2u);
-
-  result = set.PrependOrMoveToFirst(2);  // set: 2, 1 vector: anchor 1, 2
-  EXPECT_FALSE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, 2);
-  EXPECT_EQ(set.front(), 2);
-  EXPECT_EQ(set.back(), 1);
-  EXPECT_EQ(set.size(), 2u);
-
-  result = set.PrependOrMoveToFirst(3);  // set: 3, 2, 1 vector: anchor 1, 2, 3
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, 3);
-  EXPECT_EQ(set.front(), 3);
-  EXPECT_EQ(set.back(), 1);
-  EXPECT_EQ(set.size(), 3u);
-}
-
-TEST(NewLinkedHashSetTest, AppendOrMoveToLastForInteger) {
-  using Set = NewLinkedHashSet<int>;
-  Set set;
-  Set::AddResult result = set.AppendOrMoveToLast(1);  // set: 1 vector: anchor 1
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, 1);
-  EXPECT_EQ(set.front(), 1);
-  EXPECT_EQ(set.back(), 1);
-  EXPECT_EQ(set.size(), 1u);
-
-  result = set.insert(2);  // set: 1, 2 vector: anchor 1, 2
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, 2);
-  EXPECT_EQ(set.front(), 1);
-  EXPECT_EQ(set.back(), 2);
-  EXPECT_EQ(set.size(), 2u);
-
-  result = set.AppendOrMoveToLast(1);  // set: 2, 1 vector: anchor 1, 2
-  EXPECT_FALSE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, 1);
-  EXPECT_EQ(set.front(), 2);
-  EXPECT_EQ(set.back(), 1);
-  EXPECT_EQ(set.size(), 2u);
-
-  result = set.AppendOrMoveToLast(3);  // set: 2, 1, 3 vector: anchor 1, 2, 3
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, 3);
-  EXPECT_EQ(set.front(), 2);
-  EXPECT_EQ(set.back(), 3);
-  EXPECT_EQ(set.size(), 3u);
-}
-
-TEST(NewLinkedHashSetTest, InsertAndEraseForString) {
-  using Set = NewLinkedHashSet<String>;
-  Set set;
-  Set::AddResult result = set.insert("a");  // set: "a" vector: anchor "a"
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, "a");
-  EXPECT_EQ(set.front(), "a");
-  EXPECT_EQ(set.back(), "a");
-  EXPECT_EQ(set.size(), 1u);
-
-  result = set.insert("b");  // set: "a" "b" vector: anchor "a" "b"
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, "b");
-  EXPECT_EQ(set.front(), "a");
-  EXPECT_EQ(set.back(), "b");
-  EXPECT_EQ(set.size(), 2u);
-
-  result = set.insert("");  // set: "a" "b" "" vector: anchor "a" "b" ""
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, "");
-  EXPECT_EQ(set.front(), "a");
-  EXPECT_EQ(set.back(), "");
-  EXPECT_EQ(set.size(), 3u);
-
-  result = set.insert(
-      "abc");  // set: "a" "b" "" "abc" vector: anchor "a" "b" "" "abc"
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, "abc");
-  EXPECT_EQ(set.front(), "a");
-  EXPECT_EQ(set.back(), "abc");
-  EXPECT_EQ(set.size(), 4u);
-
-  set.erase("");  // set: "a" "b" "abc" vector: anchor "a" "b" hole "abc"
-  EXPECT_EQ(set.front(), "a");
-  EXPECT_EQ(set.back(), "abc");
-  EXPECT_EQ(set.size(), 3u);
-
-  set.erase("abc");  // set: "a" "b" vector: anchor "a" "b" hole hole
-  EXPECT_EQ(set.front(), "a");
-  EXPECT_EQ(set.back(), "b");
-  EXPECT_EQ(set.size(), 2u);
-
-  set.erase("");
-  EXPECT_EQ(set.front(), "a");
-  EXPECT_EQ(set.back(), "b");
-  EXPECT_EQ(set.size(), 2u);
-
-  set.erase("c");
-  EXPECT_EQ(set.front(), "a");
-  EXPECT_EQ(set.back(), "b");
-  EXPECT_EQ(set.size(), 2u);
-
-  set.insert("c");  // set: "a" "b" "c" vector: anchor "a" "b" hole "c"
-  EXPECT_EQ(set.front(), "a");
-  EXPECT_EQ(set.back(), "c");
-  EXPECT_EQ(set.size(), 3u);
-}
-
-TEST(NewLinkedHashSetTest, RemoveFirstAndPopBackForString) {
-  using Set = NewLinkedHashSet<String>;
-  Set set;
-
-  set.insert("a");
-  set.insert("b");
-  set.insert("c");
-  set.insert("d");
-  set.insert("e");
-
-  EXPECT_EQ(set.front(), "a");
-  EXPECT_EQ(set.back(), "e");
-
-  set.RemoveFirst();
-  EXPECT_EQ(set.front(), "b");
-  EXPECT_EQ(set.back(), "e");
-
-  set.pop_back();
-  EXPECT_EQ(set.front(), "b");
-  EXPECT_EQ(set.back(), "d");
-
-  set.RemoveFirst();
-  EXPECT_EQ(set.front(), "c");
-  EXPECT_EQ(set.back(), "d");
-
-  set.pop_back();
-  EXPECT_EQ(set.front(), "c");
-  EXPECT_EQ(set.back(), "c");
-
-  set.RemoveFirst();
-  EXPECT_TRUE(set.IsEmpty());
-}
-
-TEST(NewLinkedHashSetTest, PrependOrMoveToFirstForString) {
-  using Set = NewLinkedHashSet<String>;
-  Set set;
-  Set::AddResult result =
-      set.PrependOrMoveToFirst("a");  // set: "a" vector: anchor "a"
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, "a");
-  EXPECT_EQ(set.front(), "a");
-  EXPECT_EQ(set.back(), "a");
-  EXPECT_EQ(set.size(), 1u);
-
-  result = set.insert("b");  // set: "a", "b" vector: anchor "a", "b"
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, "b");
-  EXPECT_EQ(set.front(), "a");
-  EXPECT_EQ(set.back(), "b");
-  EXPECT_EQ(set.size(), 2u);
-
-  result =
-      set.PrependOrMoveToFirst("b");  // set: "b", "a" vector: anchor "a", "b"
-  EXPECT_FALSE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, "b");
-  EXPECT_EQ(set.front(), "b");
-  EXPECT_EQ(set.back(), "a");
-  EXPECT_EQ(set.size(), 2u);
-
-  result = set.PrependOrMoveToFirst(
-      "c");  // set: "c", "b", "a" vector: anchor "a", "b", "c"
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, "c");
-  EXPECT_EQ(set.front(), "c");
-  EXPECT_EQ(set.back(), "a");
-  EXPECT_EQ(set.size(), 3u);
-}
-
-TEST(NewLinkedHashSetTest, AppendOrMoveToLastForString) {
-  using Set = NewLinkedHashSet<String>;
-  Set set;
-  Set::AddResult result =
-      set.AppendOrMoveToLast("a");  // set: "a" vector: anchor "a"
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, "a");
-  EXPECT_EQ(set.front(), "a");
-  EXPECT_EQ(set.back(), "a");
-  EXPECT_EQ(set.size(), 1u);
-
-  result = set.insert("b");  // set: "a", "b" vector: anchor "a", "b"
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, "b");
-  EXPECT_EQ(set.front(), "a");
-  EXPECT_EQ(set.back(), "b");
-  EXPECT_EQ(set.size(), 2u);
-
-  result =
-      set.AppendOrMoveToLast("a");  // set: "b", "a" vector: anchor "a", "b"
-  EXPECT_FALSE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, "a");
-  EXPECT_EQ(set.front(), "b");
-  EXPECT_EQ(set.back(), "a");
-  EXPECT_EQ(set.size(), 2u);
-
-  result = set.AppendOrMoveToLast(
-      "c");  // set: "b", "a", "c" vector: anchor "a", "b", "c"
-  EXPECT_TRUE(result.is_new_entry);
-  EXPECT_EQ(*result.stored_value, "c");
-  EXPECT_EQ(set.front(), "b");
-  EXPECT_EQ(set.back(), "c");
-  EXPECT_EQ(set.size(), 3u);
 }
 
 }  // namespace WTF
diff --git a/third_party/blink/renderer/platform/wtf/vector_backed_linked_list_test.cc b/third_party/blink/renderer/platform/wtf/vector_backed_linked_list_test.cc
index ca3102c..4d7b743c 100644
--- a/third_party/blink/renderer/platform/wtf/vector_backed_linked_list_test.cc
+++ b/third_party/blink/renderer/platform/wtf/vector_backed_linked_list_test.cc
@@ -4,7 +4,11 @@
 
 #include "third_party/blink/renderer/platform/wtf/vector_backed_linked_list.h"
 
+#include "base/memory/ptr_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/renderer/platform/wtf/text/string_hash.h"
+#include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
+#include "third_party/blink/renderer/platform/wtf/wtf_test_helper.h"
 
 namespace WTF {
 
@@ -19,9 +23,14 @@
   list.insert(list.end(), 2);
 
   List::iterator it = list.begin();
+  EXPECT_EQ(*it, -2);
   ++it;
+  EXPECT_EQ(*it, 1);
+  ++it;
+  EXPECT_EQ(*it, 2);
+
+  it = list.insert(++list.begin(), 0);
   list.insert(it, -1);
-  list.insert(it, 0);
 
   EXPECT_EQ(list.front(), -2);
   EXPECT_EQ(list.back(), 2);
@@ -324,4 +333,176 @@
   EXPECT_EQ(*crit, 1);
 }
 
+TEST(VectorBackedLinkedList, String) {
+  using List = VectorBackedLinkedList<String>;
+  List list;
+
+  EXPECT_TRUE(list.empty());
+
+  list.push_back("b");
+  list.push_front("a");
+  list.push_back("c");
+
+  EXPECT_EQ(list.front(), "a");
+  EXPECT_EQ(list.back(), "c");
+  EXPECT_EQ(list.size(), 3u);
+
+  List::iterator it = list.begin();
+  EXPECT_EQ(*it, "a");
+  ++it;
+  EXPECT_EQ(*it, "b");
+  List::iterator target = it;
+  ++it;
+  EXPECT_EQ(*it, "c");
+  ++it;
+  EXPECT_TRUE(it == list.end());
+  --it;
+  EXPECT_EQ(*it, "c");
+  --it;
+  --it;
+  EXPECT_TRUE(it == list.begin());
+
+  list.erase(target);
+  it = list.begin();
+  EXPECT_EQ(*it, "a");
+  ++it;
+  EXPECT_EQ(*it, "c");
+  ++it;
+  EXPECT_TRUE(it == list.end());
+
+  list.pop_back();
+  EXPECT_EQ(list.front(), "a");
+  EXPECT_EQ(list.back(), "a");
+  EXPECT_EQ(list.size(), 1u);
+
+  list.push_front("c");
+  it = list.begin();
+  EXPECT_EQ(*it, "c");
+  ++it;
+  EXPECT_EQ(*it, "a");
+  ++it;
+  EXPECT_TRUE(it == list.end());
+
+  list.clear();
+  EXPECT_TRUE(list.empty());
+  EXPECT_TRUE(list.begin() == list.end());
+
+  list.push_front("a");
+  EXPECT_EQ(list.size(), 1u);
+  EXPECT_EQ(list.front(), "a");
+  list.pop_back();
+  EXPECT_TRUE(list.empty());
+}
+
+TEST(VectorBackedLinkedList, UniquePtr) {
+  using List = VectorBackedLinkedList<std::unique_ptr<Dummy>>;
+  List list;
+
+  bool deleted1 = false, deleted2 = false, deleted3 = false;
+  std::unique_ptr<Dummy> ptr1 = std::make_unique<Dummy>(deleted1);
+  std::unique_ptr<Dummy> ptr2 = std::make_unique<Dummy>(deleted2);
+  std::unique_ptr<Dummy> ptr3 = std::make_unique<Dummy>(deleted3);
+
+  Dummy* raw_ptr1 = ptr1.get();
+  Dummy* raw_ptr2 = ptr2.get();
+  Dummy* raw_ptr3 = ptr3.get();
+
+  list.push_front(std::move(ptr1));
+  list.push_back(std::move(ptr3));
+  List::iterator it = list.begin();
+  ++it;
+  it = list.insert(it, std::move(ptr2));
+  EXPECT_EQ(it->get(), raw_ptr2);
+
+  EXPECT_EQ(list.size(), 3u);
+  EXPECT_EQ((list.front()).get(), raw_ptr1);
+  EXPECT_EQ((list.back()).get(), raw_ptr3);
+
+  it = list.begin();
+  EXPECT_EQ(it->get(), raw_ptr1);
+  ++it;
+  EXPECT_EQ(it->get(), raw_ptr2);
+  List::iterator target = it;
+  ++it;
+  EXPECT_EQ(it->get(), raw_ptr3);
+  ++it;
+  EXPECT_TRUE(it == list.end());
+  --it;
+  EXPECT_EQ(it->get(), raw_ptr3);
+  --it;
+  --it;
+  EXPECT_TRUE(it == list.begin());
+
+  list.erase(target);
+  EXPECT_FALSE(deleted1);
+  EXPECT_TRUE(deleted2);
+  EXPECT_FALSE(deleted3);
+  EXPECT_EQ(list.size(), 2u);
+  it = list.begin();
+  EXPECT_EQ(it->get(), raw_ptr1);
+  ++it;
+  EXPECT_EQ(it->get(), raw_ptr3);
+  ++it;
+  EXPECT_TRUE(it == list.end());
+
+  list.pop_front();
+  EXPECT_TRUE(deleted1);
+  EXPECT_TRUE(deleted2);
+  EXPECT_FALSE(deleted3);
+  EXPECT_EQ(list.size(), 1u);
+  it = list.begin();
+  EXPECT_EQ(it->get(), raw_ptr3);
+  ++it;
+  EXPECT_TRUE(it == list.end());
+
+  list.pop_back();
+  EXPECT_TRUE(deleted1);
+  EXPECT_TRUE(deleted2);
+  EXPECT_TRUE(deleted3);
+  EXPECT_TRUE(list.empty());
+
+  bool deleted4 = false, deleted5 = false, deleted6 = false;
+  std::unique_ptr<Dummy> ptr4 = std::make_unique<Dummy>(deleted4);
+  std::unique_ptr<Dummy> ptr5 = std::make_unique<Dummy>(deleted5);
+  std::unique_ptr<Dummy> ptr6 = std::make_unique<Dummy>(deleted6);
+
+  Dummy* raw_ptr4 = ptr4.get();
+  Dummy* raw_ptr5 = ptr5.get();
+  Dummy* raw_ptr6 = ptr6.get();
+
+  list.push_back(std::move(ptr4));
+  list.push_back(std::move(ptr5));
+  list.push_back(std::move(ptr6));
+
+  it = list.end();
+  --it;
+  list.MoveTo(list.begin(), it);
+  it = list.begin();
+  EXPECT_EQ(it->get(), raw_ptr5);
+  ++it;
+  EXPECT_EQ(it->get(), raw_ptr4);
+  ++it;
+  EXPECT_EQ(it->get(), raw_ptr6);
+
+  list.MoveTo(list.begin(), list.begin());
+  it = list.begin();
+  EXPECT_EQ(it->get(), raw_ptr5);
+  ++it;
+  EXPECT_EQ(it->get(), raw_ptr4);
+  ++it;
+  EXPECT_EQ(it->get(), raw_ptr6);
+
+  EXPECT_FALSE(deleted4);
+  EXPECT_FALSE(deleted5);
+  EXPECT_FALSE(deleted6);
+
+  list.clear();
+  EXPECT_TRUE(list.empty());
+  EXPECT_EQ(list.size(), 0u);
+
+  EXPECT_TRUE(deleted4);
+  EXPECT_TRUE(deleted5);
+  EXPECT_TRUE(deleted6);
+}
+
 }  // namespace WTF
diff --git a/third_party/blink/web_tests/FlagExpectations/disable-features=OutOfBlinkCors b/third_party/blink/web_tests/FlagExpectations/disable-features=OutOfBlinkCors
index e258ba18..2e1e7a7 100644
--- a/third_party/blink/web_tests/FlagExpectations/disable-features=OutOfBlinkCors
+++ b/third_party/blink/web_tests/FlagExpectations/disable-features=OutOfBlinkCors
@@ -75,15 +75,3 @@
 # Added by https://chromium-review.googlesource.com/c/chromium/src/+/2054468 and
 # Blink CORS does not support.
 crbug.com/941297 http/tests/inspector-protocol/network/xhr-cors-preflight-redirect-failure.js [ Timeout ]
-
-# Started failing for unknown reasons. Bisect is needed before the next branch-cut.
-crbug.com/1059776 external/wpt/xhr/event-upload-progress-crossorigin.any.html [ Failure ]
-crbug.com/1059776 external/wpt/xhr/event-upload-progress-crossorigin.any.worker.html [ Failure ]
-crbug.com/1059776 external/wpt/xhr/event-upload-progress.any.html [ Failure ]
-crbug.com/1059776 external/wpt/xhr/event-upload-progress.any.worker.html [ Failure ]
-crbug.com/1059776 external/wpt/xhr/send-redirect-to-cors.htm [ Failure ]
-crbug.com/1059776 virtual/omt-worker-fetch/external/wpt/xhr/event-upload-progress-crossorigin.any.html [ Failure ]
-crbug.com/1059776 virtual/omt-worker-fetch/external/wpt/xhr/event-upload-progress-crossorigin.any.worker.html [ Failure ]
-crbug.com/1059776 virtual/omt-worker-fetch/external/wpt/xhr/event-upload-progress.any.html [ Failure ]
-crbug.com/1059776 virtual/omt-worker-fetch/external/wpt/xhr/event-upload-progress.any.worker.html [ Failure ]
-crbug.com/1059776 virtual/omt-worker-fetch/external/wpt/xhr/send-redirect-to-cors.htm [ Failure ]
diff --git a/third_party/blink/web_tests/FlagExpectations/layout-ng-fragment-item b/third_party/blink/web_tests/FlagExpectations/layout-ng-fragment-item
index 3e1ac10..4160b13f 100644
--- a/third_party/blink/web_tests/FlagExpectations/layout-ng-fragment-item
+++ b/third_party/blink/web_tests/FlagExpectations/layout-ng-fragment-item
@@ -220,9 +220,7 @@
 crbug.com/982194 media/picture-in-picture/v2/request-picture-in-picture-twice.html [ Failure ]
 crbug.com/982194 media/picture-in-picture/v2/request-picture-in-picture.html [ Failure ]
 crbug.com/874695 media/remoteplayback/prompt-twice-throws.html [ Pass ]
-crbug.com/982194 paint/invalidation/outline/focus-ring-on-child-move.html [ Failure ]
 crbug.com/835484 paint/invalidation/outline/inline-focus.html [ Failure ]
-crbug.com/982194 paint/invalidation/svg/transform-focus-ring-repaint.html [ Failure ]
 crbug.com/676229 plugins/mouse-click-plugin-clears-selection.html [ Failure ]
 crbug.com/718155 virtual/android/fullscreen/full-screen-iframe-not-allowed.html [ Failure ]
 crbug.com/982194 virtual/audio-service/http/tests/media/video-frame-size-change.html [ Failure Pass ]
diff --git a/third_party/blink/web_tests/TestExpectations b/third_party/blink/web_tests/TestExpectations
index a76e85df..e606975 100644
--- a/third_party/blink/web_tests/TestExpectations
+++ b/third_party/blink/web_tests/TestExpectations
@@ -1566,8 +1566,6 @@
 crbug.com/626703 virtual/layout_ng_flex_box/external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/flexbox/flexbox-safe-overflow-position-001.html [ Failure ]
 crbug.com/807497 virtual/layout_ng_flex_box/external/wpt/css/css-flexbox/anonymous-flex-item-005.html [ Failure ]
 crbug.com/898186 virtual/layout_ng_flex_box/external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/flexbox/flexbox-intrinsic-ratio-003v.html [ Pass Failure ]
-crbug.com/953534 [ Mac ] virtual/layout_ng_flex_box/external/wpt/css/css-flexbox/ttwf-reftest-flex-wrap.html [ Failure ]
-crbug.com/953534 [ Mac ] virtual/layout_ng_flex_box/external/wpt/css/css-flexbox/ttwf-reftest-flex-wrap-reverse.html [ Failure ]
 crbug.com/1003506 virtual/layout_ng_flex_box/external/wpt/css/css-flexbox/percentage-heights-007.html [ Failure ]
 crbug.com/1025630 [ Mac ] virtual/layout_ng_flex_box/external/wpt/css/css-flexbox/select-element-zero-height-001.html [ Failure ]
 crbug.com/1025630 [ Mac ] virtual/layout_ng_flex_box/external/wpt/css/css-flexbox/select-element-zero-height-002.html [ Failure ]
@@ -1635,16 +1633,7 @@
 crbug.com/6606 external/wpt/mathml/presentation-markup/direction/direction-006.html [ Failure ]
 crbug.com/6606 external/wpt/mathml/presentation-markup/direction/direction-009.html [ Failure ]
 crbug.com/6606 external/wpt/mathml/presentation-markup/direction/direction.html [ Failure ]
-crbug.com/6606 external/wpt/mathml/presentation-markup/fractions/frac-1.html [ Failure ]
-crbug.com/6606 external/wpt/mathml/presentation-markup/fractions/frac-bar-001.html [ Failure ]
-crbug.com/6606 external/wpt/mathml/presentation-markup/fractions/frac-bar-002.html [ Failure ]
-crbug.com/6606 external/wpt/mathml/presentation-markup/fractions/frac-color-001.html [ Failure ]
-crbug.com/6606 external/wpt/mathml/presentation-markup/fractions/frac-default-padding.html [ Failure ]
 crbug.com/6606 external/wpt/mathml/presentation-markup/fractions/frac-linethickness-002.html [ Failure ]
-crbug.com/6606 external/wpt/mathml/presentation-markup/fractions/frac-linethickness-003.html [ Failure ]
-crbug.com/6606 external/wpt/mathml/presentation-markup/fractions/frac-numalign-denomalign-001.html [ Failure ]
-crbug.com/6606 external/wpt/mathml/presentation-markup/fractions/frac-parameters-1.html [ Failure ]
-crbug.com/6606 external/wpt/mathml/presentation-markup/fractions/frac-parameters-2.html [ Failure ]
 crbug.com/6606 external/wpt/mathml/presentation-markup/fractions/frac-parameters-gap-001.html [ Failure ]
 crbug.com/6606 external/wpt/mathml/presentation-markup/fractions/frac-parameters-gap-002.html [ Failure ]
 crbug.com/6606 external/wpt/mathml/presentation-markup/fractions/frac-parameters-gap-003.html [ Failure ]
@@ -2524,8 +2513,6 @@
 crbug.com/467127 external/wpt/css/css-flexbox/flexbox_justifycontent-center-overflow.html [ Failure ]
 crbug.com/467127 external/wpt/css/css-flexbox/getcomputedstyle/flexbox_computedstyle_flex-basis-0percent.html [ Failure ]
 crbug.com/467127 external/wpt/css/css-flexbox/getcomputedstyle/flexbox_computedstyle_flex-shorthand-number.html [ Failure ]
-crbug.com/467127 [ Mac ] external/wpt/css/css-flexbox/ttwf-reftest-flex-wrap-reverse.html [ Failure ]
-crbug.com/467127 [ Mac ] external/wpt/css/css-flexbox/ttwf-reftest-flex-wrap.html [ Failure ]
 
 crbug.com/467127 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/flexbox/flexbox-align-content-horiz-001a.xhtml [ Failure ]
 crbug.com/467127 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/flexbox/flexbox-align-content-horiz-001b.xhtml [ Failure ]
@@ -4078,7 +4065,6 @@
 crbug.com/964181 external/wpt/css/css-text/word-break/word-break-break-all-inline-010.html [ Failure ]
 
 # Sheriff 2019-08-19:
-crbug.com/626703 [ Debug ] virtual/stable/external/wpt/html/cross-origin-embedder-policy/require-corp.https.html [ Failure ]
 crbug.com/626703 [ Debug ] external/wpt/html/cross-origin-embedder-policy/require-corp.https.html [ Pass Failure ]
 
 # Failure due to on-going off-thread paint worklet project.
@@ -6117,8 +6103,6 @@
 crbug.com/1012599 external/wpt/fetch/cross-origin-resource-policy/fetch.https.any.sharedworker.html [ Pass Timeout ]
 crbug.com/1013391 http/tests/devtools/a11y-axe-core/settings/shortcuts-a11y-test.js [ Pass Timeout ]
 crbug.com/1013523 [ Release ] external/wpt/html/cross-origin-embedder-policy/require-corp.https.html [ Failure Pass ]
-crbug.com/1013523 [ Release Linux ] virtual/stable/external/wpt/html/cross-origin-embedder-policy/require-corp.https.html [ Failure Pass ]
-crbug.com/1013523 [ Release Mac ] virtual/stable/external/wpt/html/cross-origin-embedder-policy/require-corp.https.html [ Failure Pass ]
 crbug.com/1013779 virtual/scalefactor200/fast/hidpi/static/calendar-picker-appearance.html [ Failure Pass ]
 crbug.com/1013779 [ Mac ] virtual/scalefactor200/fast/hidpi/static/data-suggestion-picker-appearance.html [ Failure Pass ]
 crbug.com/1013779 virtual/scalefactor200/fast/hidpi/static/pointerevents/pointerevent_touch-adjustment_click_target.html [ Failure Pass ]
@@ -6208,8 +6192,6 @@
 crbug.com/1028482 http/tests/devtools/sources/debugger/navigator-view.js [ Pass Crash ]
 crbug.com/1028684 inspector-protocol/animation/animation-release.js [ Pass Failure ]
 crbug.com/1015187 external/wpt/html/cross-origin-embedder-policy/none.https.html [ Pass Failure ]
-crbug.com/1015187 [ Linux ] virtual/stable/external/wpt/html/cross-origin-embedder-policy/none.https.html [ Pass Failure Timeout ]
-crbug.com/1015187 [ Mac ] virtual/stable/external/wpt/html/cross-origin-embedder-policy/none.https.html [ Pass Failure Timeout ]
 
 # Sheriff 2019-11-29
 crbug.com/1019079 virtual/gpu/fast/canvas/OffscreenCanvas-placeholder-createImageBitmap.html [ Pass Failure ]
@@ -6369,7 +6351,6 @@
 # Sheriff 2020-01-16
 crbug.com/1042205 virtual/off-main-thread-css-paint/external/wpt/css/css-paint-api/paint2d-filter.https.html [ Pass Timeout ]
 crbug.com/1042681 external/wpt/html/cross-origin-embedder-policy/blob.https.html [ Pass Failure ]
-crbug.com/1042681 [ Mac ] virtual/stable/external/wpt/html/cross-origin-embedder-policy/blob.https.html [ Pass Failure Timeout ]
 crbug.com/1042694 fast/forms/form-control-with-state-eager-tracing-crashTest.html [ Pass Timeout ]
 crbug.com/1042689 [ Linux ] http/tests/devtools/coverage/gutter-css.js [ Pass Timeout ]
 crbug.com/1042689 [ Win ] http/tests/devtools/coverage/gutter-css.js [ Pass Timeout ]
diff --git a/third_party/blink/web_tests/VirtualTestSuites b/third_party/blink/web_tests/VirtualTestSuites
index 87a31b9..7ce5e31 100644
--- a/third_party/blink/web_tests/VirtualTestSuites
+++ b/third_party/blink/web_tests/VirtualTestSuites
@@ -86,8 +86,7 @@
   },
   {
     "prefix": "stable",
-    "bases": ["external/wpt/html/cross-origin-embedder-policy",
-              "fast/css3-text/css3-text-decoration/stable",
+    "bases": ["fast/css3-text/css3-text-decoration/stable",
               "fast/dom/Window",
               "http/tests/streams/transferable/enabled",
               "http/tests/navigation",
diff --git a/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_7.json b/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_7.json
index fe8928d3..e8f0a28 100644
--- a/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_7.json
+++ b/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_7.json
@@ -6351,12 +6351,6 @@
      {}
     ]
    ],
-   "native-file-system/native_FileSystemWriter-manual.https.tentative.html": [
-    [
-     "native-file-system/native_FileSystemWriter-manual.https.tentative.html",
-     {}
-    ]
-   ],
    "notifications/body-basic-manual.html": [
     [
      "notifications/body-basic-manual.html",
@@ -49491,30 +49485,6 @@
      {}
     ]
    ],
-   "css/css-flexbox/ttwf-reftest-flex-wrap-reverse.html": [
-    [
-     "css/css-flexbox/ttwf-reftest-flex-wrap-reverse.html",
-     [
-      [
-       "/css/css-flexbox/reference/ttwf-reftest-flex-wrap-reverse-ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
-   "css/css-flexbox/ttwf-reftest-flex-wrap.html": [
-    [
-     "css/css-flexbox/ttwf-reftest-flex-wrap.html",
-     [
-      [
-       "/css/css-flexbox/reference/ttwf-reftest-flex-wrap-ref.html",
-       "=="
-      ]
-     ],
-     {}
-    ]
-   ],
    "css/css-flexbox/whitespace-in-flexitem-001.html": [
     [
      "css/css-flexbox/whitespace-in-flexitem-001.html",
@@ -138490,9 +138460,6 @@
    "css/css-animations/CSSAnimation-compositeOrder.tentative-expected.txt": [
     []
    ],
-   "css/css-animations/CSSAnimation-pausing.tentative-expected.txt": [
-    []
-   ],
    "css/css-animations/CSSAnimation-ready.tentative-expected.txt": [
     []
    ],
@@ -141043,12 +141010,6 @@
    "css/css-flexbox/reference/ttwf-reftest-flex-inline-ref.html": [
     []
    ],
-   "css/css-flexbox/reference/ttwf-reftest-flex-wrap-ref.html": [
-    []
-   ],
-   "css/css-flexbox/reference/ttwf-reftest-flex-wrap-reverse-ref.html": [
-    []
-   ],
    "css/css-flexbox/scrollbars-auto-ref.html": [
     []
    ],
@@ -159868,6 +159829,21 @@
    "document-policy/font-display/font-display-document-policy-reporting.tentative.html.headers": [
     []
    ],
+   "document-policy/reporting/oversized-images-reporting.html.headers": [
+    []
+   ],
+   "document-policy/reporting/oversized.jpg": [
+    []
+   ],
+   "document-policy/reporting/unoptimized-image.jpg": [
+    []
+   ],
+   "document-policy/reporting/unoptimized-lossy-images-reporting-onload.html.headers": [
+    []
+   ],
+   "document-policy/reporting/unoptimized-lossy-images-reporting.html.headers": [
+    []
+   ],
    "document-policy/required-policy/document-policy.html.headers": [
     []
    ],
@@ -159877,6 +159853,9 @@
    "document-policy/required-policy/separate-document-policies.html.headers": [
     []
    ],
+   "document-policy/resources/document-policy-report-json.js": [
+    []
+   ],
    "dom/META.yml": [
     []
    ],
@@ -162151,12 +162130,6 @@
    "feature-policy/reporting/midi-reporting.https.html.headers": [
     []
    ],
-   "feature-policy/reporting/oversized-images-reporting.html.headers": [
-    []
-   ],
-   "feature-policy/reporting/oversized.jpg": [
-    []
-   ],
    "feature-policy/reporting/payment-report-only.https-expected.txt": [
     []
    ],
@@ -162184,15 +162157,6 @@
    "feature-policy/reporting/sync-xhr-reporting.html.headers": [
     []
    ],
-   "feature-policy/reporting/unoptimized-image.jpg": [
-    []
-   ],
-   "feature-policy/reporting/unoptimized-lossy-images-reporting-onload.html.headers": [
-    []
-   ],
-   "feature-policy/reporting/unoptimized-lossy-images-reporting.html.headers": [
-    []
-   ],
    "feature-policy/reporting/unsized-media-reporting.html.headers": [
     []
    ],
@@ -164833,6 +164797,9 @@
    "html/cross-origin-embedder-policy/report-only-require-corp.https.html.headers": [
     []
    ],
+   "html/cross-origin-embedder-policy/reporting.https.html.sub.headers": [
+    []
+   ],
    "html/cross-origin-embedder-policy/require-corp-about-blank.html.headers": [
     []
    ],
@@ -164893,6 +164860,12 @@
    "html/cross-origin-embedder-policy/resources/report.py": [
     []
    ],
+   "html/cross-origin-embedder-policy/resources/reporting-empty-frame.html": [
+    []
+   ],
+   "html/cross-origin-embedder-policy/resources/reporting-empty-frame.html.headers": [
+    []
+   ],
    "html/cross-origin-embedder-policy/resources/require-corp-sw-import-scripts.js": [
     []
    ],
@@ -164908,15 +164881,6 @@
    "html/cross-origin-embedder-policy/resources/script-factory.js": [
     []
    ],
-   "html/cross-origin-embedder-policy/resources/stash-take.py": [
-    []
-   ],
-   "html/cross-origin-embedder-policy/resources/subresource-corp.html": [
-    []
-   ],
-   "html/cross-origin-embedder-policy/resources/subresource-corp.html.sub.headers": [
-    []
-   ],
    "html/cross-origin-embedder-policy/resources/sw-store-to-cache-storage.js": [
     []
    ],
@@ -164953,15 +164917,6 @@
    "html/cross-origin-opener-policy/coep-navigate-popup.https.html.headers": [
     []
    ],
-   "html/cross-origin-opener-policy/coep-navigate-popup.https_0-1-expected.txt": [
-    []
-   ],
-   "html/cross-origin-opener-policy/coep-navigate-popup.https_2-3-expected.txt": [
-    []
-   ],
-   "html/cross-origin-opener-policy/coep-navigate-popup.https_4-last-expected.txt": [
-    []
-   ],
    "html/cross-origin-opener-policy/coep-redirect.https-expected.txt": [
     []
    ],
@@ -164974,72 +164929,36 @@
    "html/cross-origin-opener-policy/coep.https.html.headers": [
     []
    ],
-   "html/cross-origin-opener-policy/coop-navigated-history-popup.https-expected.txt": [
-    []
-   ],
-   "html/cross-origin-opener-policy/coop-navigated-popup.https-expected.txt": [
-    []
-   ],
    "html/cross-origin-opener-policy/coop-navigated-popup.https.html.headers": [
     []
    ],
    "html/cross-origin-opener-policy/coop-sandbox.https.html.headers": [
     []
    ],
-   "html/cross-origin-opener-policy/historical/coep-navigate-popup-unsafe-inherit.https-expected.txt": [
-    []
-   ],
-   "html/cross-origin-opener-policy/historical/popup-same-origin-unsafe-allow-outgoing-with-cross-origin.https-expected.txt": [
-    []
-   ],
    "html/cross-origin-opener-policy/historical/popup-same-origin-unsafe-allow-outgoing-with-cross-origin.https.html.headers": [
     []
    ],
-   "html/cross-origin-opener-policy/historical/popup-same-origin-unsafe-allow-outgoing-with-same-origin.https-expected.txt": [
-    []
-   ],
    "html/cross-origin-opener-policy/historical/popup-same-origin-unsafe-allow-outgoing-with-same-origin.https.html.headers": [
     []
    ],
-   "html/cross-origin-opener-policy/historical/popup-same-origin-unsafe-allow-outgoing-with-same-site.https-expected.txt": [
-    []
-   ],
    "html/cross-origin-opener-policy/historical/popup-same-origin-unsafe-allow-outgoing-with-same-site.https.html.headers": [
     []
    ],
-   "html/cross-origin-opener-policy/historical/popup-same-site-unsafe-allow-outgoing-with-cross-origin.https-expected.txt": [
-    []
-   ],
    "html/cross-origin-opener-policy/historical/popup-same-site-unsafe-allow-outgoing-with-cross-origin.https.html.headers": [
     []
    ],
-   "html/cross-origin-opener-policy/historical/popup-same-site-unsafe-allow-outgoing-with-same-origin.https-expected.txt": [
-    []
-   ],
    "html/cross-origin-opener-policy/historical/popup-same-site-unsafe-allow-outgoing-with-same-origin.https.html.headers": [
     []
    ],
-   "html/cross-origin-opener-policy/historical/popup-same-site-unsafe-allow-outgoing-with-same-site.https-expected.txt": [
-    []
-   ],
    "html/cross-origin-opener-policy/historical/popup-same-site-unsafe-allow-outgoing-with-same-site.https.html.headers": [
     []
    ],
-   "html/cross-origin-opener-policy/historical/popup-same-site-with-cross-origin.https-expected.txt": [
-    []
-   ],
    "html/cross-origin-opener-policy/historical/popup-same-site-with-cross-origin.https.html.headers": [
     []
    ],
-   "html/cross-origin-opener-policy/historical/popup-same-site-with-same-origin.https-expected.txt": [
-    []
-   ],
    "html/cross-origin-opener-policy/historical/popup-same-site-with-same-origin.https.html.headers": [
     []
    ],
-   "html/cross-origin-opener-policy/historical/popup-same-site-with-same-site.https-expected.txt": [
-    []
-   ],
    "html/cross-origin-opener-policy/historical/popup-same-site-with-same-site.https.html.headers": [
     []
    ],
@@ -165070,87 +164989,33 @@
    "html/cross-origin-opener-policy/no-https.html.headers": [
     []
    ],
-   "html/cross-origin-opener-policy/popup-none.https-expected.txt": [
-    []
-   ],
-   "html/cross-origin-opener-policy/popup-redirect-cache.https-expected.txt": [
-    []
-   ],
    "html/cross-origin-opener-policy/popup-redirect-cache.https.html.headers": [
     []
    ],
-   "html/cross-origin-opener-policy/popup-same-origin-allow-popups-with-cross-origin.https-expected.txt": [
-    []
-   ],
    "html/cross-origin-opener-policy/popup-same-origin-allow-popups-with-cross-origin.https.html.headers": [
     []
    ],
-   "html/cross-origin-opener-policy/popup-same-origin-allow-popups-with-same-origin.https-expected.txt": [
-    []
-   ],
    "html/cross-origin-opener-policy/popup-same-origin-allow-popups-with-same-origin.https.html.headers": [
     []
    ],
-   "html/cross-origin-opener-policy/popup-same-origin-allow-popups-with-same-site.https-expected.txt": [
-    []
-   ],
    "html/cross-origin-opener-policy/popup-same-origin-allow-popups-with-same-site.https.html.headers": [
     []
    ],
    "html/cross-origin-opener-policy/popup-same-origin-non-initial-about-blank.https.html.headers": [
     []
    ],
-   "html/cross-origin-opener-policy/popup-same-origin-unsafe-allow-outgoing.https-expected.txt": [
-    []
-   ],
-   "html/cross-origin-opener-policy/popup-same-origin-with-cross-origin.https-expected.txt": [
-    []
-   ],
    "html/cross-origin-opener-policy/popup-same-origin-with-cross-origin.https.html.headers": [
     []
    ],
-   "html/cross-origin-opener-policy/popup-same-origin-with-same-origin.https-expected.txt": [
-    []
-   ],
    "html/cross-origin-opener-policy/popup-same-origin-with-same-origin.https.html.headers": [
     []
    ],
-   "html/cross-origin-opener-policy/popup-same-origin-with-same-site.https-expected.txt": [
-    []
-   ],
    "html/cross-origin-opener-policy/popup-same-origin-with-same-site.https.html.headers": [
     []
    ],
-   "html/cross-origin-opener-policy/popup-same-origin.https-expected.txt": [
-    []
-   ],
-   "html/cross-origin-opener-policy/popup-same-site-unsafe-allow-outgoing.https-expected.txt": [
-    []
-   ],
-   "html/cross-origin-opener-policy/popup-same-site.https-expected.txt": [
-    []
-   ],
-   "html/cross-origin-opener-policy/popup-unsafe-none-with-cross-origin.https-expected.txt": [
-    []
-   ],
-   "html/cross-origin-opener-policy/popup-unsafe-none-with-same-origin.https-expected.txt": [
-    []
-   ],
    "html/cross-origin-opener-policy/popup-unsafe-none-with-same-origin.https.html.headers": [
     []
    ],
-   "html/cross-origin-opener-policy/popup-unsafe-none-with-same-site.https-expected.txt": [
-    []
-   ],
-   "html/cross-origin-opener-policy/popup-unspecified-with-cross-origin.https-expected.txt": [
-    []
-   ],
-   "html/cross-origin-opener-policy/popup-unspecified-with-same-origin.https-expected.txt": [
-    []
-   ],
-   "html/cross-origin-opener-policy/popup-unspecified-with-same-site.https-expected.txt": [
-    []
-   ],
    "html/cross-origin-opener-policy/resources/call-functionCalledByOpenee.html": [
     []
    ],
@@ -170659,12 +170524,6 @@
    "html/semantics/scripting-1/the-script-element/module/nested-missing-export.js": [
     []
    ],
-   "html/semantics/scripting-1/the-script-element/module/referrer-origin-when-cross-origin.sub-expected.txt": [
-    []
-   ],
-   "html/semantics/scripting-1/the-script-element/module/referrer-same-origin.sub-expected.txt": [
-    []
-   ],
    "html/semantics/scripting-1/the-script-element/module/resources/404-but-js.asis": [
     []
    ],
@@ -173869,24 +173728,12 @@
    "mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/fetch/same-https.swap-scheme.https.html.headers": [
     []
    ],
-   "mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/cross-ws.keep-scheme.https-expected.txt": [
-    []
-   ],
    "mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/cross-ws.no-redirect.https.html.headers": [
     []
    ],
-   "mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/cross-ws.swap-scheme.https-expected.txt": [
-    []
-   ],
-   "mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/same-ws.keep-scheme.https-expected.txt": [
-    []
-   ],
    "mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/same-ws.no-redirect.https.html.headers": [
     []
    ],
-   "mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/same-ws.swap-scheme.https-expected.txt": [
-    []
-   ],
    "mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/same-wss.no-redirect.https.html.headers": [
     []
    ],
@@ -173938,24 +173785,12 @@
    "mixed-content/gen/sharedworker-classic-data.meta/unset/fetch/same-http.swap-scheme.https-expected.txt": [
     []
    ],
-   "mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/cross-ws.keep-scheme.https-expected.txt": [
-    []
-   ],
    "mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/cross-ws.no-redirect.https-expected.txt": [
     []
    ],
-   "mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/cross-ws.swap-scheme.https-expected.txt": [
-    []
-   ],
-   "mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/same-ws.keep-scheme.https-expected.txt": [
-    []
-   ],
    "mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/same-ws.no-redirect.https-expected.txt": [
     []
    ],
-   "mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/same-ws.swap-scheme.https-expected.txt": [
-    []
-   ],
    "mixed-content/gen/sharedworker-classic-data.meta/unset/xhr/cross-http.keep-scheme.https-expected.txt": [
     []
    ],
@@ -174004,24 +173839,12 @@
    "mixed-content/gen/sharedworker-module-data.http-rp/opt-in/fetch/same-https.swap-scheme.https.html.headers": [
     []
    ],
-   "mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/cross-ws.keep-scheme.https-expected.txt": [
-    []
-   ],
    "mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/cross-ws.no-redirect.https.html.headers": [
     []
    ],
-   "mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/cross-ws.swap-scheme.https-expected.txt": [
-    []
-   ],
-   "mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/same-ws.keep-scheme.https-expected.txt": [
-    []
-   ],
    "mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/same-ws.no-redirect.https.html.headers": [
     []
    ],
-   "mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/same-ws.swap-scheme.https-expected.txt": [
-    []
-   ],
    "mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/same-wss.no-redirect.https.html.headers": [
     []
    ],
@@ -174073,24 +173896,12 @@
    "mixed-content/gen/sharedworker-module-data.meta/unset/fetch/same-http.swap-scheme.https-expected.txt": [
     []
    ],
-   "mixed-content/gen/sharedworker-module-data.meta/unset/websocket/cross-ws.keep-scheme.https-expected.txt": [
-    []
-   ],
    "mixed-content/gen/sharedworker-module-data.meta/unset/websocket/cross-ws.no-redirect.https-expected.txt": [
     []
    ],
-   "mixed-content/gen/sharedworker-module-data.meta/unset/websocket/cross-ws.swap-scheme.https-expected.txt": [
-    []
-   ],
-   "mixed-content/gen/sharedworker-module-data.meta/unset/websocket/same-ws.keep-scheme.https-expected.txt": [
-    []
-   ],
    "mixed-content/gen/sharedworker-module-data.meta/unset/websocket/same-ws.no-redirect.https-expected.txt": [
     []
    ],
-   "mixed-content/gen/sharedworker-module-data.meta/unset/websocket/same-ws.swap-scheme.https-expected.txt": [
-    []
-   ],
    "mixed-content/gen/sharedworker-module-data.meta/unset/xhr/cross-http.keep-scheme.https-expected.txt": [
     []
    ],
@@ -174379,36 +174190,18 @@
    "mixed-content/gen/top.http-rp/opt-in/script-tag/same-https.swap-scheme.https.html.headers": [
     []
    ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.keep-scheme.https.html.headers": [
-    []
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.no-redirect.https.html.headers": [
-    []
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.swap-scheme.https.html.headers": [
-    []
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-https.swap-scheme.https.html.headers": [
-    []
-   ],
    "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-http.keep-scheme.https.html.headers": [
     []
    ],
    "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-http.no-redirect.https.html.headers": [
     []
    ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-http.swap-scheme.https.html.headers": [
-    []
-   ],
    "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-https.keep-scheme.https.html.headers": [
     []
    ],
    "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-https.no-redirect.https.html.headers": [
     []
    ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-https.swap-scheme.https.html.headers": [
-    []
-   ],
    "mixed-content/gen/top.http-rp/opt-in/sharedworker-import-data/cross-http.keep-scheme.https.html.headers": [
     []
    ],
@@ -174439,36 +174232,18 @@
    "mixed-content/gen/top.http-rp/opt-in/sharedworker-import-data/same-https.swap-scheme.https.html.headers": [
     []
    ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.keep-scheme.https.html.headers": [
-    []
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.no-redirect.https.html.headers": [
-    []
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.swap-scheme.https.html.headers": [
-    []
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-https.swap-scheme.https.html.headers": [
-    []
-   ],
    "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-http.keep-scheme.https.html.headers": [
     []
    ],
    "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-http.no-redirect.https.html.headers": [
     []
    ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-http.swap-scheme.https.html.headers": [
-    []
-   ],
    "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-https.keep-scheme.https.html.headers": [
     []
    ],
    "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-https.no-redirect.https.html.headers": [
     []
    ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-https.swap-scheme.https.html.headers": [
-    []
-   ],
    "mixed-content/gen/top.http-rp/opt-in/video-tag/cross-http.keep-scheme.https.html.headers": [
     []
    ],
@@ -174508,36 +174283,18 @@
    "mixed-content/gen/top.http-rp/opt-in/websocket/same-wss.no-redirect.https.html.headers": [
     []
    ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.keep-scheme.https.html.headers": [
-    []
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.no-redirect.https.html.headers": [
-    []
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.swap-scheme.https.html.headers": [
-    []
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-https.swap-scheme.https.html.headers": [
-    []
-   ],
    "mixed-content/gen/top.http-rp/opt-in/worker-classic/same-http.keep-scheme.https.html.headers": [
     []
    ],
    "mixed-content/gen/top.http-rp/opt-in/worker-classic/same-http.no-redirect.https.html.headers": [
     []
    ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-classic/same-http.swap-scheme.https.html.headers": [
-    []
-   ],
    "mixed-content/gen/top.http-rp/opt-in/worker-classic/same-https.keep-scheme.https.html.headers": [
     []
    ],
    "mixed-content/gen/top.http-rp/opt-in/worker-classic/same-https.no-redirect.https.html.headers": [
     []
    ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-classic/same-https.swap-scheme.https.html.headers": [
-    []
-   ],
    "mixed-content/gen/top.http-rp/opt-in/worker-import-data/cross-http.keep-scheme.https.html.headers": [
     []
    ],
@@ -174568,36 +174325,18 @@
    "mixed-content/gen/top.http-rp/opt-in/worker-import-data/same-https.swap-scheme.https.html.headers": [
     []
    ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.keep-scheme.https.html.headers": [
-    []
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.no-redirect.https.html.headers": [
-    []
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.swap-scheme.https.html.headers": [
-    []
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-module/cross-https.swap-scheme.https.html.headers": [
-    []
-   ],
    "mixed-content/gen/top.http-rp/opt-in/worker-module/same-http.keep-scheme.https.html.headers": [
     []
    ],
    "mixed-content/gen/top.http-rp/opt-in/worker-module/same-http.no-redirect.https.html.headers": [
     []
    ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-module/same-http.swap-scheme.https.html.headers": [
-    []
-   ],
    "mixed-content/gen/top.http-rp/opt-in/worker-module/same-https.keep-scheme.https.html.headers": [
     []
    ],
    "mixed-content/gen/top.http-rp/opt-in/worker-module/same-https.no-redirect.https.html.headers": [
     []
    ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-module/same-https.swap-scheme.https.html.headers": [
-    []
-   ],
    "mixed-content/gen/top.http-rp/opt-in/worklet-animation-import-data/cross-http.keep-scheme.https.html.headers": [
     []
    ],
@@ -175036,9 +174775,6 @@
    "native-file-system/native_FileSystemWritableFileStream-write-manual.https.tentative-expected.txt": [
     []
    ],
-   "native-file-system/native_FileSystemWriter-manual.https.tentative-expected.txt": [
-    []
-   ],
    "native-file-system/resources/message-target-dedicated-worker.js": [
     []
    ],
@@ -175132,9 +174868,6 @@
    "native-file-system/script-tests/FileSystemWritableFileStream.js": [
     []
    ],
-   "native-file-system/script-tests/FileSystemWriter.js": [
-    []
-   ],
    "navigation-timing/META.yml": [
     []
    ],
@@ -190405,6 +190138,9 @@
    "web-animations/timing-model/animations/update-playback-rate-zero-ref.html": [
     []
    ],
+   "web-animations/timing-model/timelines/update-and-send-events-replacement-expected.txt": [
+    []
+   ],
    "web-bundle/META.yml": [
     []
    ],
@@ -194107,27 +193843,15 @@
    "worklets/animation-worklet-credentials.https-expected.txt": [
     []
    ],
-   "worklets/animation-worklet-referrer.https-expected.txt": [
-    []
-   ],
    "worklets/audio-worklet-credentials.https-expected.txt": [
     []
    ],
-   "worklets/audio-worklet-referrer.https-expected.txt": [
-    []
-   ],
    "worklets/layout-worklet-credentials.https-expected.txt": [
     []
    ],
-   "worklets/layout-worklet-referrer.https-expected.txt": [
-    []
-   ],
    "worklets/paint-worklet-credentials.https-expected.txt": [
     []
    ],
-   "worklets/paint-worklet-referrer.https-expected.txt": [
-    []
-   ],
    "worklets/resources/addmodule-window.html": [
     []
    ],
@@ -212307,6 +212031,69 @@
      }
     ]
    ],
+   "bluetooth/getDevices/granted-devices-with-services.https.window.js": [
+    [
+     "bluetooth/getDevices/granted-devices-with-services.https.window.html",
+     {
+      "script_metadata": [
+       [
+        "script",
+        "/resources/testdriver.js"
+       ],
+       [
+        "script",
+        "/resources/testdriver-vendor.js"
+       ],
+       [
+        "script",
+        "/bluetooth/resources/bluetooth-helpers.js"
+       ]
+      ]
+     }
+    ]
+   ],
+   "bluetooth/getDevices/no-granted-devices.https.window.js": [
+    [
+     "bluetooth/getDevices/no-granted-devices.https.window.html",
+     {
+      "script_metadata": [
+       [
+        "script",
+        "/resources/testdriver.js"
+       ],
+       [
+        "script",
+        "/resources/testdriver-vendor.js"
+       ],
+       [
+        "script",
+        "/bluetooth/resources/bluetooth-helpers.js"
+       ]
+      ]
+     }
+    ]
+   ],
+   "bluetooth/getDevices/returns-same-bluetooth-device-object.https.window.js": [
+    [
+     "bluetooth/getDevices/returns-same-bluetooth-device-object.https.window.html",
+     {
+      "script_metadata": [
+       [
+        "script",
+        "/resources/testdriver.js"
+       ],
+       [
+        "script",
+        "/resources/testdriver-vendor.js"
+       ],
+       [
+        "script",
+        "/bluetooth/resources/bluetooth-helpers.js"
+       ]
+      ]
+     }
+    ]
+   ],
    "bluetooth/idl/idl-Bluetooth.https.html": [
     [
      "bluetooth/idl/idl-Bluetooth.https.html",
@@ -240355,6 +240142,24 @@
      {}
     ]
    ],
+   "document-policy/reporting/oversized-images-reporting.html": [
+    [
+     "document-policy/reporting/oversized-images-reporting.html",
+     {}
+    ]
+   ],
+   "document-policy/reporting/unoptimized-lossy-images-reporting-onload.html": [
+    [
+     "document-policy/reporting/unoptimized-lossy-images-reporting-onload.html",
+     {}
+    ]
+   ],
+   "document-policy/reporting/unoptimized-lossy-images-reporting.html": [
+    [
+     "document-policy/reporting/unoptimized-lossy-images-reporting.html",
+     {}
+    ]
+   ],
    "document-policy/required-policy/document-policy.html": [
     [
      "document-policy/required-policy/document-policy.html",
@@ -255904,12 +255709,6 @@
      {}
     ]
    ],
-   "feature-policy/reporting/oversized-images-reporting.html": [
-    [
-     "feature-policy/reporting/oversized-images-reporting.html",
-     {}
-    ]
-   ],
    "feature-policy/reporting/payment-report-only.https.html": [
     [
      "feature-policy/reporting/payment-report-only.https.html",
@@ -255966,18 +255765,6 @@
      {}
     ]
    ],
-   "feature-policy/reporting/unoptimized-lossy-images-reporting-onload.html": [
-    [
-     "feature-policy/reporting/unoptimized-lossy-images-reporting-onload.html",
-     {}
-    ]
-   ],
-   "feature-policy/reporting/unoptimized-lossy-images-reporting.html": [
-    [
-     "feature-policy/reporting/unoptimized-lossy-images-reporting.html",
-     {}
-    ]
-   ],
    "feature-policy/reporting/unsized-media-reporting.html": [
     [
      "feature-policy/reporting/unsized-media-reporting.html",
@@ -264992,6 +264779,12 @@
      {}
     ]
    ],
+   "html/rendering/replaced-elements/attributes-for-embedded-content-and-images/img-aspect-ratio-lazy.tentative.html": [
+    [
+     "html/rendering/replaced-elements/attributes-for-embedded-content-and-images/img-aspect-ratio-lazy.tentative.html",
+     {}
+    ]
+   ],
    "html/rendering/replaced-elements/attributes-for-embedded-content-and-images/img-aspect-ratio.html": [
     [
      "html/rendering/replaced-elements/attributes-for-embedded-content-and-images/img-aspect-ratio.html",
@@ -280861,30 +280654,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.keep-scheme.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.keep-scheme.https.html",
-     {}
-    ]
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.no-redirect.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.no-redirect.https.html",
-     {}
-    ]
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.swap-scheme.https.html",
-     {}
-    ]
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-https.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-https.swap-scheme.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-http.keep-scheme.https.html": [
     [
      "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-http.keep-scheme.https.html",
@@ -280897,12 +280666,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-http.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-http.swap-scheme.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-https.keep-scheme.https.html": [
     [
      "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-https.keep-scheme.https.html",
@@ -280915,12 +280678,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-https.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-https.swap-scheme.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.http-rp/opt-in/sharedworker-import-data/cross-http.keep-scheme.https.html": [
     [
      "mixed-content/gen/top.http-rp/opt-in/sharedworker-import-data/cross-http.keep-scheme.https.html",
@@ -280981,30 +280738,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.keep-scheme.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.keep-scheme.https.html",
-     {}
-    ]
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.no-redirect.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.no-redirect.https.html",
-     {}
-    ]
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.swap-scheme.https.html",
-     {}
-    ]
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-https.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-https.swap-scheme.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-http.keep-scheme.https.html": [
     [
      "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-http.keep-scheme.https.html",
@@ -281017,12 +280750,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-http.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-http.swap-scheme.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-https.keep-scheme.https.html": [
     [
      "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-https.keep-scheme.https.html",
@@ -281035,12 +280762,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-https.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-https.swap-scheme.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.http-rp/opt-in/video-tag/cross-http.keep-scheme.https.html": [
     [
      "mixed-content/gen/top.http-rp/opt-in/video-tag/cross-http.keep-scheme.https.html",
@@ -281119,30 +280840,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.keep-scheme.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.keep-scheme.https.html",
-     {}
-    ]
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.no-redirect.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.no-redirect.https.html",
-     {}
-    ]
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.swap-scheme.https.html",
-     {}
-    ]
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-https.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-https.swap-scheme.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.http-rp/opt-in/worker-classic/same-http.keep-scheme.https.html": [
     [
      "mixed-content/gen/top.http-rp/opt-in/worker-classic/same-http.keep-scheme.https.html",
@@ -281155,12 +280852,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-classic/same-http.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/worker-classic/same-http.swap-scheme.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.http-rp/opt-in/worker-classic/same-https.keep-scheme.https.html": [
     [
      "mixed-content/gen/top.http-rp/opt-in/worker-classic/same-https.keep-scheme.https.html",
@@ -281173,12 +280864,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-classic/same-https.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/worker-classic/same-https.swap-scheme.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.http-rp/opt-in/worker-import-data/cross-http.keep-scheme.https.html": [
     [
      "mixed-content/gen/top.http-rp/opt-in/worker-import-data/cross-http.keep-scheme.https.html",
@@ -281239,30 +280924,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.keep-scheme.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.keep-scheme.https.html",
-     {}
-    ]
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.no-redirect.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.no-redirect.https.html",
-     {}
-    ]
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.swap-scheme.https.html",
-     {}
-    ]
-   ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-module/cross-https.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/worker-module/cross-https.swap-scheme.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.http-rp/opt-in/worker-module/same-http.keep-scheme.https.html": [
     [
      "mixed-content/gen/top.http-rp/opt-in/worker-module/same-http.keep-scheme.https.html",
@@ -281275,12 +280936,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-module/same-http.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/worker-module/same-http.swap-scheme.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.http-rp/opt-in/worker-module/same-https.keep-scheme.https.html": [
     [
      "mixed-content/gen/top.http-rp/opt-in/worker-module/same-https.keep-scheme.https.html",
@@ -281293,12 +280948,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.http-rp/opt-in/worker-module/same-https.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.http-rp/opt-in/worker-module/same-https.swap-scheme.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.http-rp/opt-in/worklet-animation-import-data/cross-http.keep-scheme.https.html": [
     [
      "mixed-content/gen/top.http-rp/opt-in/worklet-animation-import-data/cross-http.keep-scheme.https.html",
@@ -282001,12 +281650,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.meta/opt-in/sharedworker-classic/cross-http.no-redirect.https.html": [
-    [
-     "mixed-content/gen/top.meta/opt-in/sharedworker-classic/cross-http.no-redirect.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.meta/opt-in/sharedworker-classic/same-http.no-redirect.https.html": [
     [
      "mixed-content/gen/top.meta/opt-in/sharedworker-classic/same-http.no-redirect.https.html",
@@ -282037,12 +281680,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.meta/opt-in/sharedworker-module/cross-http.no-redirect.https.html": [
-    [
-     "mixed-content/gen/top.meta/opt-in/sharedworker-module/cross-http.no-redirect.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.meta/opt-in/sharedworker-module/same-http.no-redirect.https.html": [
     [
      "mixed-content/gen/top.meta/opt-in/sharedworker-module/same-http.no-redirect.https.html",
@@ -282091,12 +281728,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.meta/opt-in/worker-classic/cross-http.no-redirect.https.html": [
-    [
-     "mixed-content/gen/top.meta/opt-in/worker-classic/cross-http.no-redirect.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.meta/opt-in/worker-classic/same-http.no-redirect.https.html": [
     [
      "mixed-content/gen/top.meta/opt-in/worker-classic/same-http.no-redirect.https.html",
@@ -282127,12 +281758,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.meta/opt-in/worker-module/cross-http.no-redirect.https.html": [
-    [
-     "mixed-content/gen/top.meta/opt-in/worker-module/cross-http.no-redirect.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.meta/opt-in/worker-module/same-http.no-redirect.https.html": [
     [
      "mixed-content/gen/top.meta/opt-in/worker-module/same-http.no-redirect.https.html",
@@ -282739,24 +282364,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.meta/unset/sharedworker-classic/cross-http.keep-scheme.https.html": [
-    [
-     "mixed-content/gen/top.meta/unset/sharedworker-classic/cross-http.keep-scheme.https.html",
-     {}
-    ]
-   ],
-   "mixed-content/gen/top.meta/unset/sharedworker-classic/cross-http.no-redirect.https.html": [
-    [
-     "mixed-content/gen/top.meta/unset/sharedworker-classic/cross-http.no-redirect.https.html",
-     {}
-    ]
-   ],
-   "mixed-content/gen/top.meta/unset/sharedworker-classic/cross-http.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.meta/unset/sharedworker-classic/cross-http.swap-scheme.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.meta/unset/sharedworker-classic/same-http.keep-scheme.https.html": [
     [
      "mixed-content/gen/top.meta/unset/sharedworker-classic/same-http.keep-scheme.https.html",
@@ -282769,12 +282376,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.meta/unset/sharedworker-classic/same-http.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.meta/unset/sharedworker-classic/same-http.swap-scheme.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.meta/unset/sharedworker-classic/same-https.keep-scheme.https.html": [
     [
      "mixed-content/gen/top.meta/unset/sharedworker-classic/same-https.keep-scheme.https.html",
@@ -282835,24 +282436,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.meta/unset/sharedworker-module/cross-http.keep-scheme.https.html": [
-    [
-     "mixed-content/gen/top.meta/unset/sharedworker-module/cross-http.keep-scheme.https.html",
-     {}
-    ]
-   ],
-   "mixed-content/gen/top.meta/unset/sharedworker-module/cross-http.no-redirect.https.html": [
-    [
-     "mixed-content/gen/top.meta/unset/sharedworker-module/cross-http.no-redirect.https.html",
-     {}
-    ]
-   ],
-   "mixed-content/gen/top.meta/unset/sharedworker-module/cross-http.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.meta/unset/sharedworker-module/cross-http.swap-scheme.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.meta/unset/sharedworker-module/same-http.keep-scheme.https.html": [
     [
      "mixed-content/gen/top.meta/unset/sharedworker-module/same-http.keep-scheme.https.html",
@@ -282865,12 +282448,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.meta/unset/sharedworker-module/same-http.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.meta/unset/sharedworker-module/same-http.swap-scheme.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.meta/unset/sharedworker-module/same-https.keep-scheme.https.html": [
     [
      "mixed-content/gen/top.meta/unset/sharedworker-module/same-https.keep-scheme.https.html",
@@ -282949,24 +282526,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.meta/unset/worker-classic/cross-http.keep-scheme.https.html": [
-    [
-     "mixed-content/gen/top.meta/unset/worker-classic/cross-http.keep-scheme.https.html",
-     {}
-    ]
-   ],
-   "mixed-content/gen/top.meta/unset/worker-classic/cross-http.no-redirect.https.html": [
-    [
-     "mixed-content/gen/top.meta/unset/worker-classic/cross-http.no-redirect.https.html",
-     {}
-    ]
-   ],
-   "mixed-content/gen/top.meta/unset/worker-classic/cross-http.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.meta/unset/worker-classic/cross-http.swap-scheme.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.meta/unset/worker-classic/same-http.keep-scheme.https.html": [
     [
      "mixed-content/gen/top.meta/unset/worker-classic/same-http.keep-scheme.https.html",
@@ -282979,12 +282538,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.meta/unset/worker-classic/same-http.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.meta/unset/worker-classic/same-http.swap-scheme.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.meta/unset/worker-classic/same-https.keep-scheme.https.html": [
     [
      "mixed-content/gen/top.meta/unset/worker-classic/same-https.keep-scheme.https.html",
@@ -283045,24 +282598,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.meta/unset/worker-module/cross-http.keep-scheme.https.html": [
-    [
-     "mixed-content/gen/top.meta/unset/worker-module/cross-http.keep-scheme.https.html",
-     {}
-    ]
-   ],
-   "mixed-content/gen/top.meta/unset/worker-module/cross-http.no-redirect.https.html": [
-    [
-     "mixed-content/gen/top.meta/unset/worker-module/cross-http.no-redirect.https.html",
-     {}
-    ]
-   ],
-   "mixed-content/gen/top.meta/unset/worker-module/cross-http.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.meta/unset/worker-module/cross-http.swap-scheme.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.meta/unset/worker-module/same-http.keep-scheme.https.html": [
     [
      "mixed-content/gen/top.meta/unset/worker-module/same-http.keep-scheme.https.html",
@@ -283075,12 +282610,6 @@
      {}
     ]
    ],
-   "mixed-content/gen/top.meta/unset/worker-module/same-http.swap-scheme.https.html": [
-    [
-     "mixed-content/gen/top.meta/unset/worker-module/same-http.swap-scheme.https.html",
-     {}
-    ]
-   ],
    "mixed-content/gen/top.meta/unset/worker-module/same-https.keep-scheme.https.html": [
     [
      "mixed-content/gen/top.meta/unset/worker-module/same-https.keep-scheme.https.html",
@@ -284960,46 +284489,6 @@
      }
     ]
    ],
-   "native-file-system/sandboxed_FileSystemWriter.tentative.https.any.js": [
-    [
-     "native-file-system/sandboxed_FileSystemWriter.tentative.https.any.html",
-     {
-      "script_metadata": [
-       [
-        "script",
-        "resources/test-helpers.js"
-       ],
-       [
-        "script",
-        "resources/sandboxed-fs-test-helpers.js"
-       ],
-       [
-        "script",
-        "script-tests/FileSystemWriter.js"
-       ]
-      ]
-     }
-    ],
-    [
-     "native-file-system/sandboxed_FileSystemWriter.tentative.https.any.worker.html",
-     {
-      "script_metadata": [
-       [
-        "script",
-        "resources/test-helpers.js"
-       ],
-       [
-        "script",
-        "resources/sandboxed-fs-test-helpers.js"
-       ],
-       [
-        "script",
-        "script-tests/FileSystemWriter.js"
-       ]
-      ]
-     }
-    ]
-   ],
    "navigation-timing/buffered-flag.window.js": [
     [
      "navigation-timing/buffered-flag.window.html",
@@ -295436,6 +294925,12 @@
      {}
     ]
    ],
+   "paint-timing/border-image.html": [
+    [
+     "paint-timing/border-image.html",
+     {}
+    ]
+   ],
    "paint-timing/buffered-flag.window.js": [
     [
      "paint-timing/buffered-flag.window.html",
@@ -295521,12 +295016,24 @@
      {}
     ]
    ],
+   "paint-timing/mask-image.html": [
+    [
+     "paint-timing/mask-image.html",
+     {}
+    ]
+   ],
    "paint-timing/paint-visited.html": [
     [
      "paint-timing/paint-visited.html",
      {}
     ]
    ],
+   "paint-timing/replaced-content-image.html": [
+    [
+     "paint-timing/replaced-content-image.html",
+     {}
+    ]
+   ],
    "paint-timing/sibling-painting-first-image.html": [
     [
      "paint-timing/sibling-painting-first-image.html",
@@ -364447,6 +363954,12 @@
      {}
     ]
    ],
+   "webrtc/protocol/bundle.https.html": [
+    [
+     "webrtc/protocol/bundle.https.html",
+     {}
+    ]
+   ],
    "webrtc/protocol/candidate-exchange.https.html": [
     [
      "webrtc/protocol/candidate-exchange.https.html",
@@ -379641,30 +379154,6 @@
      {}
     ]
    ],
-   "css/css-flexbox/flex-wrap-001.htm": [
-    [
-     "css/css-flexbox/flex-wrap-001.htm",
-     {}
-    ]
-   ],
-   "css/css-flexbox/flex-wrap_nowrap.html": [
-    [
-     "css/css-flexbox/flex-wrap_nowrap.html",
-     {}
-    ]
-   ],
-   "css/css-flexbox/flex-wrap_wrap-reverse.html": [
-    [
-     "css/css-flexbox/flex-wrap_wrap-reverse.html",
-     {}
-    ]
-   ],
-   "css/css-flexbox/flex-wrap_wrap.html": [
-    [
-     "css/css-flexbox/flex-wrap_wrap.html",
-     {}
-    ]
-   ],
    "css/css-flexbox/flexbox-order-from-lowest.html": [
     [
      "css/css-flexbox/flexbox-order-from-lowest.html",
@@ -388023,7 +387512,7 @@
    "testharness"
   ],
   "IndexedDB/idbfactory_deleteDatabase4.htm": [
-   "73adb1a4d89f2e98a22342df7c4c934294a80003",
+   "2f680853b90d63b60696d47e0abdcdf02b3abae8",
    "testharness"
   ],
   "IndexedDB/idbfactory_open.htm": [
@@ -388659,7 +388148,7 @@
    "testharness"
   ],
   "IndexedDB/idbtransaction.htm": [
-   "5baa3db557d0fa2a8a4ec33d1ce07f4646a47ccd",
+   "d5bafda1cab078afbb810e2d3efa258e4139c5e2",
    "testharness"
   ],
   "IndexedDB/idbtransaction_abort.htm": [
@@ -388671,7 +388160,7 @@
    "testharness"
   ],
   "IndexedDB/idbversionchangeevent.htm": [
-   "e7ffecabd04fd553d31c896c6e82ec199c012c7f",
+   "fc4cd9a2f8765d331e43c3989f2b7c735f6dc444",
    "testharness"
   ],
   "IndexedDB/idbworker.js": [
@@ -388879,7 +388368,7 @@
    "testharness"
   ],
   "IndexedDB/transaction-lifetime-blocked.htm": [
-   "79ba82f9baf8d4865705504d417bca5b3599b8b7",
+   "82c3ae032e8523d7da4ea8422588600373389411",
    "testharness"
   ],
   "IndexedDB/transaction-lifetime-empty.html": [
@@ -388887,7 +388376,7 @@
    "testharness"
   ],
   "IndexedDB/transaction-lifetime.htm": [
-   "28836448aca6925b4860f85b52c6c0dbac0214c9",
+   "2c8fd2f58089bf8752868bd3ceb7a5180fc79cf2",
    "testharness"
   ],
   "IndexedDB/transaction-relaxed-durability.tentative.any.js": [
@@ -390802,8 +390291,20 @@
    "c0ff8a78e956e395428c5756c8aa3b3e3545991b",
    "support"
   ],
+  "bluetooth/getDevices/granted-devices-with-services.https.window.js": [
+   "34b5912315ab843ec9c49dbf9ec41912325da2ca",
+   "testharness"
+  ],
+  "bluetooth/getDevices/no-granted-devices.https.window.js": [
+   "d945c3ff242c069027e5b6558c3c1fed9286e7b2",
+   "testharness"
+  ],
+  "bluetooth/getDevices/returns-same-bluetooth-device-object.https.window.js": [
+   "7c80703d5f5bb825b8d94f9c3a7fd7f2a7a6c7da",
+   "testharness"
+  ],
   "bluetooth/idl/idl-Bluetooth.https.html": [
-   "7322df53e5c227571d5155550e07aca4ed3688e5",
+   "60ec9aac26814fedf7e23f6a37431f99bd53f30f",
    "testharness"
   ],
   "bluetooth/idl/idl-BluetoothDevice.https.html": [
@@ -390823,7 +390324,7 @@
    "testharness"
   ],
   "bluetooth/idl/idlharness.tentative.https.window-expected.txt": [
-   "3472f97d8c39179f4cd995752224a8397222bdec",
+   "779ed8fc356f381ff774b6650e5c283dcb74e86a",
    "support"
   ],
   "bluetooth/idl/idlharness.tentative.https.window.js": [
@@ -413750,10 +413251,6 @@
    "623e01d2354aad5dc746558dbc40821d09173472",
    "testharness"
   ],
-  "css/css-animations/CSSAnimation-pausing.tentative-expected.txt": [
-   "c8e6a82021c77530b9a2df30b3dde6ae41e5324d",
-   "support"
-  ],
   "css/css-animations/CSSAnimation-pausing.tentative.html": [
    "156a1afa964de12e4a983c032f9b526b5cdf625d",
    "testharness"
@@ -422698,10 +422195,6 @@
    "8ec6025468997a484950bc7d5d20c3e3bd3cdbe6",
    "reftest"
   ],
-  "css/css-flexbox/flex-wrap-001.htm": [
-   "127100ac0ad9dc5c14e170a346dce38d114a0c99",
-   "visual"
-  ],
   "css/css-flexbox/flex-wrap-002.html": [
    "d2e07afb45f88611f149a4acfa38928a50571e02",
    "reftest"
@@ -422722,18 +422215,6 @@
    "e616412c2b2f1bd35d9f86800551f2a2065a9265",
    "reftest"
   ],
-  "css/css-flexbox/flex-wrap_nowrap.html": [
-   "ef53bb2decb00a9ee881ddcc96d350428b036595",
-   "visual"
-  ],
-  "css/css-flexbox/flex-wrap_wrap-reverse.html": [
-   "ce23e935ecc88bb5eade812237bcd4e1088d04b5",
-   "visual"
-  ],
-  "css/css-flexbox/flex-wrap_wrap.html": [
-   "302c9cd325b51c5de485b79e4107b36c0b68dd77",
-   "visual"
-  ],
   "css/css-flexbox/flexbox-flex-direction-column-reverse.htm": [
    "31fe1bb9ba74345a4cf7adccae713d48452a5373",
    "reftest"
@@ -425338,14 +424819,6 @@
    "369de990ff2190ea0e4592d4dfc354a8a8fcae16",
    "support"
   ],
-  "css/css-flexbox/reference/ttwf-reftest-flex-wrap-ref.html": [
-   "bb3e2b947af42106dec6974664075afb9e8cb7d3",
-   "support"
-  ],
-  "css/css-flexbox/reference/ttwf-reftest-flex-wrap-reverse-ref.html": [
-   "fe6e510ccab62b7121e95bbb3675f7940d7510c9",
-   "support"
-  ],
   "css/css-flexbox/scrollbars-auto-ref.html": [
    "590b533d8d25ac45dbeb1e7eab7cd02f3c1e8b5b",
    "support"
@@ -425646,14 +425119,6 @@
    "275ecd0b6091a1c2d267b5104552c9038b76b681",
    "reftest"
   ],
-  "css/css-flexbox/ttwf-reftest-flex-wrap-reverse.html": [
-   "f2aefa29e8b5e4461e6a8ae9eb76bc8c1c771698",
-   "reftest"
-  ],
-  "css/css-flexbox/ttwf-reftest-flex-wrap.html": [
-   "3acd79c46500a81219edbc57fc8f434d22342a8d",
-   "reftest"
-  ],
   "css/css-flexbox/visibility-collapse-001.htm": [
    "6a502553aac9a15d0cc9ac602063341f330be15a",
    "visual"
@@ -487970,6 +487435,38 @@
    "84ad7cbf97bcbfd9f56bfeef5bc5928b8819ae4e",
    "support"
   ],
+  "document-policy/reporting/oversized-images-reporting.html": [
+   "bef7db27a7ad821a5aa57164d407558b669c494f",
+   "testharness"
+  ],
+  "document-policy/reporting/oversized-images-reporting.html.headers": [
+   "206db539c1ea12e962b279e4b550e85f12bc50d1",
+   "support"
+  ],
+  "document-policy/reporting/oversized.jpg": [
+   "497ed770bfb6fb367f2eeb1978225bc4d036055b",
+   "support"
+  ],
+  "document-policy/reporting/unoptimized-image.jpg": [
+   "599137a55d710fe6b8d3052c05c81915622ea0d0",
+   "support"
+  ],
+  "document-policy/reporting/unoptimized-lossy-images-reporting-onload.html": [
+   "948c43522567df041fde2bcad1ea5d8d450410d2",
+   "testharness"
+  ],
+  "document-policy/reporting/unoptimized-lossy-images-reporting-onload.html.headers": [
+   "261d5db13e3c1879ba8a582e84485b717851dbb9",
+   "support"
+  ],
+  "document-policy/reporting/unoptimized-lossy-images-reporting.html": [
+   "d4b8611a19d097668624edb687c4da491db6ba6b",
+   "testharness"
+  ],
+  "document-policy/reporting/unoptimized-lossy-images-reporting.html.headers": [
+   "261d5db13e3c1879ba8a582e84485b717851dbb9",
+   "support"
+  ],
   "document-policy/required-policy/document-policy.html": [
    "1935be3dd0a961add3d80aa35ded92734d9f8869",
    "testharness"
@@ -488002,6 +487499,10 @@
    "0dcb2328ae7c48f451f43a7f89fcf90828d5f8a2",
    "support"
   ],
+  "document-policy/resources/document-policy-report-json.js": [
+   "035857ba39e8f18b308931520393b09dac4e6987",
+   "support"
+  ],
   "dom/META.yml": [
    "6fd5b12664da091fd9ee773b821ad72ee704ee8f",
    "support"
@@ -494822,18 +494323,6 @@
    "0e145978a014f08fb5faff42750e9338da0f9ede",
    "support"
   ],
-  "feature-policy/reporting/oversized-images-reporting.html": [
-   "ef365e060c4e4d883051c5ad70f10ffe9139d5a2",
-   "testharness"
-  ],
-  "feature-policy/reporting/oversized-images-reporting.html.headers": [
-   "02bcbb92a866d3f3f423bf2ebb1a5cd45dcbf167",
-   "support"
-  ],
-  "feature-policy/reporting/oversized.jpg": [
-   "497ed770bfb6fb367f2eeb1978225bc4d036055b",
-   "support"
-  ],
   "feature-policy/reporting/payment-report-only.https-expected.txt": [
    "dc5e0c91070e2fe2572cda60f5e8add30ad2d5d6",
    "support"
@@ -494902,26 +494391,6 @@
    "21a909e1fb6d84f066f42c09488f1bef032171c9",
    "support"
   ],
-  "feature-policy/reporting/unoptimized-image.jpg": [
-   "599137a55d710fe6b8d3052c05c81915622ea0d0",
-   "support"
-  ],
-  "feature-policy/reporting/unoptimized-lossy-images-reporting-onload.html": [
-   "8c060477230c92c0932e73fbb91bf374316d2d9f",
-   "testharness"
-  ],
-  "feature-policy/reporting/unoptimized-lossy-images-reporting-onload.html.headers": [
-   "5cda6ae012803cdd9425cbcafcfd929921e06236",
-   "support"
-  ],
-  "feature-policy/reporting/unoptimized-lossy-images-reporting.html": [
-   "8dcf110dd2b39f1b48e16d3aefbe53e9e7565ea5",
-   "testharness"
-  ],
-  "feature-policy/reporting/unoptimized-lossy-images-reporting.html.headers": [
-   "5cda6ae012803cdd9425cbcafcfd929921e06236",
-   "support"
-  ],
   "feature-policy/reporting/unsized-media-reporting.html": [
    "bb81a496ca5b8128b7438e6f1dd4ed0dd574238c",
    "testharness"
@@ -501571,7 +501040,7 @@
    "support"
   ],
   "html/cross-origin-embedder-policy/none.https.html": [
-   "548525968352147dc14ceeeab1ad6b6a93b2729a",
+   "e603753084cf2c3c85b0187a7a8f66b3de8cf401",
    "testharness"
   ],
   "html/cross-origin-embedder-policy/none.https.html.headers": [
@@ -501587,9 +501056,13 @@
    "support"
   ],
   "html/cross-origin-embedder-policy/reporting.https.html": [
-   "3a0aebe49a7baf67ad2e3fc1ac57eb6bf3fbb5f2",
+   "bb0a6a2b0a8101665a25f2187c138ab0bdfd14e5",
    "testharness"
   ],
+  "html/cross-origin-embedder-policy/reporting.https.html.sub.headers": [
+   "cda6ab2272fc4858f8ba4119d13ca07104c7601f",
+   "support"
+  ],
   "html/cross-origin-embedder-policy/require-corp-about-blank.html": [
    "5c51df71ae5b6a84f5c68c90a4012729a9e9c380",
    "testharness"
@@ -501631,7 +501104,7 @@
    "testharness"
   ],
   "html/cross-origin-embedder-policy/require-corp.https.html": [
-   "6f799b6e4086c1e73654b694174cacc496b2582d",
+   "769bc87586d8038372255c27b6ce1db2fa3a6e51",
    "testharness"
   ],
   "html/cross-origin-embedder-policy/require-corp.https.html.headers": [
@@ -501695,7 +501168,15 @@
    "support"
   ],
   "html/cross-origin-embedder-policy/resources/report.py": [
-   "8adf3009d08e2311cdf9c2008d7a10a0882ce030",
+   "17ca65cbf6b3f384dabff5a479eb22730d3de511",
+   "support"
+  ],
+  "html/cross-origin-embedder-policy/resources/reporting-empty-frame.html": [
+   "b1579add2e033e9dfc6c8bb18f9e523b246326ac",
+   "support"
+  ],
+  "html/cross-origin-embedder-policy/resources/reporting-empty-frame.html.headers": [
+   "66302f108fd5fc9142460a60f6f20b5303b46780",
    "support"
   ],
   "html/cross-origin-embedder-policy/resources/require-corp-sw-import-scripts.js": [
@@ -501718,18 +501199,6 @@
    "9db755226020479fd87e87f42ea622c999b38f7d",
    "support"
   ],
-  "html/cross-origin-embedder-policy/resources/stash-take.py": [
-   "73e0def86caed347bf673b0daa8df46b9a4e074d",
-   "support"
-  ],
-  "html/cross-origin-embedder-policy/resources/subresource-corp.html": [
-   "4b029700e0e9a7545dae07df489eef7e32256030",
-   "support"
-  ],
-  "html/cross-origin-embedder-policy/resources/subresource-corp.html.sub.headers": [
-   "00609991031ea5a07c5a3fa802fcc73dcd00863e",
-   "support"
-  ],
   "html/cross-origin-embedder-policy/resources/sw-store-to-cache-storage.js": [
    "00b9e9395a7ec2171b3fee9d75f6ccb1d46ee60f",
    "support"
@@ -501802,20 +501271,8 @@
    "63b60e490f47f4db77d33d7a4ca2f5b9a4181de8",
    "support"
   ],
-  "html/cross-origin-opener-policy/coep-navigate-popup.https_0-1-expected.txt": [
-   "aa7fcc1664d98b6eba7daf3690eb5e9805d74fda",
-   "support"
-  ],
-  "html/cross-origin-opener-policy/coep-navigate-popup.https_2-3-expected.txt": [
-   "6a28cd86b5d70030c10b1d570da2d7ecfb86e257",
-   "support"
-  ],
-  "html/cross-origin-opener-policy/coep-navigate-popup.https_4-last-expected.txt": [
-   "e7b4ac6a02fb758ceed527d369129d5f047b94e1",
-   "support"
-  ],
   "html/cross-origin-opener-policy/coep-redirect.https-expected.txt": [
-   "02d3e1dbf7931657cfe1ea3d110fecd547dc3ca1",
+   "78adc45f03aa0ba3bdc35cee22fe107ae8ce73d5",
    "support"
   ],
   "html/cross-origin-opener-policy/coep-redirect.https.html": [
@@ -501827,7 +501284,7 @@
    "support"
   ],
   "html/cross-origin-opener-policy/coep.https-expected.txt": [
-   "3b1ae70dc1f5569f32dcec7e3b1022db1422a3bf",
+   "d935af0d341e8d22e5df9e957e25ff194e204fd9",
    "support"
   ],
   "html/cross-origin-opener-policy/coep.https.html": [
@@ -501838,18 +501295,10 @@
    "63b60e490f47f4db77d33d7a4ca2f5b9a4181de8",
    "support"
   ],
-  "html/cross-origin-opener-policy/coop-navigated-history-popup.https-expected.txt": [
-   "1c8d279d257bdf729c25f26edbfa36a78cfde926",
-   "support"
-  ],
   "html/cross-origin-opener-policy/coop-navigated-history-popup.https.html": [
    "a061be992c1aa05ba8b0c1290f3562ab9a88904e",
    "testharness"
   ],
-  "html/cross-origin-opener-policy/coop-navigated-popup.https-expected.txt": [
-   "119c835064d197deac353f5626a4a45b761de68c",
-   "support"
-  ],
   "html/cross-origin-opener-policy/coop-navigated-popup.https.html": [
    "ef610a488fc6d86c0dd8d3b44d754d4ea32dd596",
    "testharness"
@@ -501866,18 +501315,10 @@
    "46ad58d83bf6e98913ca4c564b7acb8f19fa0093",
    "support"
   ],
-  "html/cross-origin-opener-policy/historical/coep-navigate-popup-unsafe-inherit.https-expected.txt": [
-   "7d597e0643dc0d17bafe513f9816791b8d675f0a",
-   "support"
-  ],
   "html/cross-origin-opener-policy/historical/coep-navigate-popup-unsafe-inherit.https.html": [
    "21feef73ddf2a9cdfffc58ef2d17d45773fb2b7d",
    "testharness"
   ],
-  "html/cross-origin-opener-policy/historical/popup-same-origin-unsafe-allow-outgoing-with-cross-origin.https-expected.txt": [
-   "5df2a1319c69891def773ab9736906b8874366f9",
-   "support"
-  ],
   "html/cross-origin-opener-policy/historical/popup-same-origin-unsafe-allow-outgoing-with-cross-origin.https.html": [
    "1f522f70e68c69b57a4aa94847895db97e779ebf",
    "testharness"
@@ -501886,10 +501327,6 @@
    "a19f4400cea33a60c99807330704a23ee363b146",
    "support"
   ],
-  "html/cross-origin-opener-policy/historical/popup-same-origin-unsafe-allow-outgoing-with-same-origin.https-expected.txt": [
-   "c0c9e22ec8abb3d9966cfbece975b0767d2787f3",
-   "support"
-  ],
   "html/cross-origin-opener-policy/historical/popup-same-origin-unsafe-allow-outgoing-with-same-origin.https.html": [
    "d7686f23d37cdb0cdee43573217353182bc2a671",
    "testharness"
@@ -501898,10 +501335,6 @@
    "a19f4400cea33a60c99807330704a23ee363b146",
    "support"
   ],
-  "html/cross-origin-opener-policy/historical/popup-same-origin-unsafe-allow-outgoing-with-same-site.https-expected.txt": [
-   "22cb21fb354f921c286dbfebeb979879d207ea7e",
-   "support"
-  ],
   "html/cross-origin-opener-policy/historical/popup-same-origin-unsafe-allow-outgoing-with-same-site.https.html": [
    "9a1dc11b417a065dfb1bcf814c07f04b1ffe8ef6",
    "testharness"
@@ -501910,10 +501343,6 @@
    "a19f4400cea33a60c99807330704a23ee363b146",
    "support"
   ],
-  "html/cross-origin-opener-policy/historical/popup-same-site-unsafe-allow-outgoing-with-cross-origin.https-expected.txt": [
-   "c8cdb9e73e7e51df467e3b33ae71016d43f10e2e",
-   "support"
-  ],
   "html/cross-origin-opener-policy/historical/popup-same-site-unsafe-allow-outgoing-with-cross-origin.https.html": [
    "b54ff2f49557ecedcbfceb68e1217bd1ef2c5aa8",
    "testharness"
@@ -501922,10 +501351,6 @@
    "ab7b28948150ff64101ef080b0d9c7cc9a6a34d2",
    "support"
   ],
-  "html/cross-origin-opener-policy/historical/popup-same-site-unsafe-allow-outgoing-with-same-origin.https-expected.txt": [
-   "7d19d9b27922ff52fd34a33f37642b7f7dcd80ce",
-   "support"
-  ],
   "html/cross-origin-opener-policy/historical/popup-same-site-unsafe-allow-outgoing-with-same-origin.https.html": [
    "b2279094b170f908672c85ba3525ab6a3adc032c",
    "testharness"
@@ -501934,10 +501359,6 @@
    "ab7b28948150ff64101ef080b0d9c7cc9a6a34d2",
    "support"
   ],
-  "html/cross-origin-opener-policy/historical/popup-same-site-unsafe-allow-outgoing-with-same-site.https-expected.txt": [
-   "cea04ce5b3deb860a1bb524e93e423359d2d94f4",
-   "support"
-  ],
   "html/cross-origin-opener-policy/historical/popup-same-site-unsafe-allow-outgoing-with-same-site.https.html": [
    "371aa41d0117c3e0ccd3317579b9bb8a78d31751",
    "testharness"
@@ -501946,10 +501367,6 @@
    "ab7b28948150ff64101ef080b0d9c7cc9a6a34d2",
    "support"
   ],
-  "html/cross-origin-opener-policy/historical/popup-same-site-with-cross-origin.https-expected.txt": [
-   "9630be7a09ddfc6def11927d9288dda27e33db46",
-   "support"
-  ],
   "html/cross-origin-opener-policy/historical/popup-same-site-with-cross-origin.https.html": [
    "af14446257ba12f1e0dbc6b30ea6d29ff7dd905b",
    "testharness"
@@ -501958,10 +501375,6 @@
    "34bd099a302f893f92586241ea38aac812bf28d0",
    "support"
   ],
-  "html/cross-origin-opener-policy/historical/popup-same-site-with-same-origin.https-expected.txt": [
-   "3bbd6d532bea5101f1fa254d2f604a907660b76a",
-   "support"
-  ],
   "html/cross-origin-opener-policy/historical/popup-same-site-with-same-origin.https.html": [
    "ec463a17706509b1ae431c52e46ecdaee2c7452e",
    "testharness"
@@ -501970,10 +501383,6 @@
    "34bd099a302f893f92586241ea38aac812bf28d0",
    "support"
   ],
-  "html/cross-origin-opener-policy/historical/popup-same-site-with-same-site.https-expected.txt": [
-   "92c7db608e487e4d012b9d520999c543466eb35c",
-   "support"
-  ],
   "html/cross-origin-opener-policy/historical/popup-same-site-with-same-site.https.html": [
    "80ed35424c99e324aef7c1e58e4c585246ce14ba",
    "testharness"
@@ -502054,26 +501463,14 @@
    "e36b5190aafc0b42b043802422dd411a831a20a5",
    "testharness"
   ],
-  "html/cross-origin-opener-policy/popup-none.https-expected.txt": [
-   "441401ec1eb68b9cc27167f78234bb99231dfaab",
-   "support"
-  ],
-  "html/cross-origin-opener-policy/popup-redirect-cache.https-expected.txt": [
-   "a315b35a48d889dd01c5d8993e273cbf34e4d946",
-   "support"
-  ],
   "html/cross-origin-opener-policy/popup-redirect-cache.https.html": [
-   "d68c80664bc549ca0e9786653bc0b3759ca31953",
+   "2ef7c0998af7835b0595f5eb2a6b7664841c59b2",
    "testharness"
   ],
   "html/cross-origin-opener-policy/popup-redirect-cache.https.html.headers": [
    "46ad58d83bf6e98913ca4c564b7acb8f19fa0093",
    "support"
   ],
-  "html/cross-origin-opener-policy/popup-same-origin-allow-popups-with-cross-origin.https-expected.txt": [
-   "9759a2a2282e97148b5f60490d0cebd7884f34af",
-   "support"
-  ],
   "html/cross-origin-opener-policy/popup-same-origin-allow-popups-with-cross-origin.https.html": [
    "74ded50d6677abeb0e7308ebd17f402e2e6438ca",
    "testharness"
@@ -502082,10 +501479,6 @@
    "d83ed86fb9b5d159b9f380424887402edc96cb75",
    "support"
   ],
-  "html/cross-origin-opener-policy/popup-same-origin-allow-popups-with-same-origin.https-expected.txt": [
-   "2079085aa28f5f2ef849a4862ffea362e6fd1f29",
-   "support"
-  ],
   "html/cross-origin-opener-policy/popup-same-origin-allow-popups-with-same-origin.https.html": [
    "b67db7e70666c7d30b7299cd2947bf1baa4a5915",
    "testharness"
@@ -502094,10 +501487,6 @@
    "d83ed86fb9b5d159b9f380424887402edc96cb75",
    "support"
   ],
-  "html/cross-origin-opener-policy/popup-same-origin-allow-popups-with-same-site.https-expected.txt": [
-   "79d6bd94ea434868fe039f5b89252034095892f8",
-   "support"
-  ],
   "html/cross-origin-opener-policy/popup-same-origin-allow-popups-with-same-site.https.html": [
    "af7836f77ee888d4856419a3ad4f37765a81c864",
    "testharness"
@@ -502114,14 +501503,6 @@
    "46ad58d83bf6e98913ca4c564b7acb8f19fa0093",
    "support"
   ],
-  "html/cross-origin-opener-policy/popup-same-origin-unsafe-allow-outgoing.https-expected.txt": [
-   "559011a753fb7333312e49f7d67b4dfa3a7c7137",
-   "support"
-  ],
-  "html/cross-origin-opener-policy/popup-same-origin-with-cross-origin.https-expected.txt": [
-   "1f21d9ad3cfd9439a99bd486e4c8b59235c39b46",
-   "support"
-  ],
   "html/cross-origin-opener-policy/popup-same-origin-with-cross-origin.https.html": [
    "f72f8a59be20955475ab484c281b771c04a8ec13",
    "testharness"
@@ -502130,10 +501511,6 @@
    "46ad58d83bf6e98913ca4c564b7acb8f19fa0093",
    "support"
   ],
-  "html/cross-origin-opener-policy/popup-same-origin-with-same-origin.https-expected.txt": [
-   "6e79cb373d6a4c4fc0d10c04e09f8fe9c31021f5",
-   "support"
-  ],
   "html/cross-origin-opener-policy/popup-same-origin-with-same-origin.https.html": [
    "5798851f686584ba6cae36d84bb04019d2967880",
    "testharness"
@@ -502142,10 +501519,6 @@
    "46ad58d83bf6e98913ca4c564b7acb8f19fa0093",
    "support"
   ],
-  "html/cross-origin-opener-policy/popup-same-origin-with-same-site.https-expected.txt": [
-   "3284ad0f0f58df94ae7fc0b8ddc60990456ca723",
-   "support"
-  ],
   "html/cross-origin-opener-policy/popup-same-origin-with-same-site.https.html": [
    "1af0f7ca3ac35aa318f35df089a2497d747617a3",
    "testharness"
@@ -502154,30 +501527,10 @@
    "46ad58d83bf6e98913ca4c564b7acb8f19fa0093",
    "support"
   ],
-  "html/cross-origin-opener-policy/popup-same-origin.https-expected.txt": [
-   "0d082385b18e4696af0a53b727bec932fb86af6b",
-   "support"
-  ],
-  "html/cross-origin-opener-policy/popup-same-site-unsafe-allow-outgoing.https-expected.txt": [
-   "2dfbfd706e72c10acd53822964ef477939ea1385",
-   "support"
-  ],
-  "html/cross-origin-opener-policy/popup-same-site.https-expected.txt": [
-   "dd1e4548e8bd75f0610ce3fa58abc128264755c0",
-   "support"
-  ],
-  "html/cross-origin-opener-policy/popup-unsafe-none-with-cross-origin.https-expected.txt": [
-   "2aefa4de0680e96f88a11c15c1fe95ee07949919",
-   "support"
-  ],
   "html/cross-origin-opener-policy/popup-unsafe-none-with-cross-origin.https.html": [
    "6b6397c48691c3ae099e4563bf6e5c391fe2087b",
    "testharness"
   ],
-  "html/cross-origin-opener-policy/popup-unsafe-none-with-same-origin.https-expected.txt": [
-   "14ec1a9e6b3a7ed05ed105aec2b6b9ee92d69956",
-   "support"
-  ],
   "html/cross-origin-opener-policy/popup-unsafe-none-with-same-origin.https.html": [
    "66d720f7e92abb387e4cc39fd6a90767615b7a38",
    "testharness"
@@ -502186,34 +501539,18 @@
    "073ce7adfbd81cb7c0b2f91f96c8349b6677f26c",
    "support"
   ],
-  "html/cross-origin-opener-policy/popup-unsafe-none-with-same-site.https-expected.txt": [
-   "32bb8970e5bcc372d56cee46ce8e37b162231eaf",
-   "support"
-  ],
   "html/cross-origin-opener-policy/popup-unsafe-none-with-same-site.https.html": [
    "58ea328f0cffdd185efa5a0891db8397ac828d32",
    "testharness"
   ],
-  "html/cross-origin-opener-policy/popup-unspecified-with-cross-origin.https-expected.txt": [
-   "df6ca63a117d0ce83105d97bf56e954bb9abbae1",
-   "support"
-  ],
   "html/cross-origin-opener-policy/popup-unspecified-with-cross-origin.https.html": [
    "6b5bf18bf43495c3a9b7fe04c82ec5c3ea2efbd8",
    "testharness"
   ],
-  "html/cross-origin-opener-policy/popup-unspecified-with-same-origin.https-expected.txt": [
-   "aefc505e5e2fa27281b43e6083654b2d267a7877",
-   "support"
-  ],
   "html/cross-origin-opener-policy/popup-unspecified-with-same-origin.https.html": [
    "6000ec600f8b41368f8bf2cf7822cd90ae0e825f",
    "testharness"
   ],
-  "html/cross-origin-opener-policy/popup-unspecified-with-same-site.https-expected.txt": [
-   "61164f774b3d15be8a8b495dc682a7760574cad3",
-   "support"
-  ],
   "html/cross-origin-opener-policy/popup-unspecified-with-same-site.https.html": [
    "2f9d6f15e23dbf46910b56cde7e7c59dd0040607",
    "testharness"
@@ -502223,11 +501560,11 @@
    "support"
   ],
   "html/cross-origin-opener-policy/resources/common.js": [
-   "760db60365fbe79a70d37c770a48a162c5058002",
+   "fb517e8c40ac56587f21ecec2af7a5c30c3a191a",
    "support"
   ],
   "html/cross-origin-opener-policy/resources/coop-coep.py": [
-   "0271d7834af98a1d25fd2869c11c6f56b08bfcd3",
+   "8a7e0bc0a838fd7b432f40614212cfa63752a0e6",
    "support"
   ],
   "html/cross-origin-opener-policy/resources/iframe-popup.sub.html": [
@@ -509082,6 +508419,10 @@
    "b057967e7e967b1b3113c69f71f1298b86ce4df8",
    "testharness"
   ],
+  "html/rendering/replaced-elements/attributes-for-embedded-content-and-images/img-aspect-ratio-lazy.tentative.html": [
+   "0a56539e0fd3e6d9184d18af5b910d391782612e",
+   "testharness"
+  ],
   "html/rendering/replaced-elements/attributes-for-embedded-content-and-images/img-aspect-ratio.html": [
    "eceef92a6418f3d74ffbd13a08d8e648dff42a3f",
    "testharness"
@@ -517010,24 +516351,16 @@
    "b8866f9511867469a5987b2f918a812d22f3b861",
    "testharness"
   ],
-  "html/semantics/scripting-1/the-script-element/module/referrer-origin-when-cross-origin.sub-expected.txt": [
-   "618b27c27d88548a6ac7ef3866005a704aad6139",
-   "support"
-  ],
   "html/semantics/scripting-1/the-script-element/module/referrer-origin-when-cross-origin.sub.html": [
-   "8351289029190f908c86ad507886ed393937ec45",
+   "4cd427ee88766f7f836ef86a3617244864ac5e40",
    "testharness"
   ],
   "html/semantics/scripting-1/the-script-element/module/referrer-origin.sub.html": [
    "a554fb4b0c465136d636839eb96b463bec4f5c2b",
    "testharness"
   ],
-  "html/semantics/scripting-1/the-script-element/module/referrer-same-origin.sub-expected.txt": [
-   "814be9071647d80366a2880cc6d600904489b8b9",
-   "support"
-  ],
   "html/semantics/scripting-1/the-script-element/module/referrer-same-origin.sub.html": [
-   "1d470e668992ad546f721138441a80926dd630cb",
+   "7d6d515a477ce50cf2123745e29e5a3738a3eaf6",
    "testharness"
   ],
   "html/semantics/scripting-1/the-script-element/module/referrer-unsafe-url.sub.html": [
@@ -524723,7 +524056,7 @@
    "support"
   ],
   "measure-memory/resources/common.js": [
-   "92ff11b35b1d6ab501a7b7dbac52411c08711a83",
+   "f7332a862277d44a70455f6b4edd57be8f10d98f",
    "support"
   ],
   "measure-memory/resources/grandchild.sub.html": [
@@ -526114,10 +525447,6 @@
    "46e2255e388e9e08377d625b55653a007d59c14e",
    "support"
   ],
-  "mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/cross-ws.keep-scheme.https-expected.txt": [
-   "71e61d1bc7bd39c39527b249d76a326a519b9c99",
-   "support"
-  ],
   "mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/cross-ws.no-redirect.https.html": [
    "ae251cc0e81695390af92d9db78e250d3847e98e",
    "testharness"
@@ -526126,14 +525455,6 @@
    "46e2255e388e9e08377d625b55653a007d59c14e",
    "support"
   ],
-  "mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/cross-ws.swap-scheme.https-expected.txt": [
-   "6c3bef8ad8a46c329d49dd32137f7d39269586fc",
-   "support"
-  ],
-  "mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/same-ws.keep-scheme.https-expected.txt": [
-   "b02166d5506422584d8ce2ff46f3b37da127b31b",
-   "support"
-  ],
   "mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/same-ws.no-redirect.https.html": [
    "a4210bf851d4d6df0ec3a1ecef279db27037bd84",
    "testharness"
@@ -526142,10 +525463,6 @@
    "46e2255e388e9e08377d625b55653a007d59c14e",
    "support"
   ],
-  "mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/same-ws.swap-scheme.https-expected.txt": [
-   "01f70cb8b4ca9b47fab2540e17b1b4c3b9f15231",
-   "support"
-  ],
   "mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/same-wss.no-redirect.https.html": [
    "c899946980ac7f329e0741719cd655a0005d02eb",
    "testharness"
@@ -526326,10 +525643,6 @@
    "d6f95709dc1dd14a5ba30afd95782d0f8dc3099a",
    "testharness"
   ],
-  "mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/cross-ws.keep-scheme.https-expected.txt": [
-   "71e61d1bc7bd39c39527b249d76a326a519b9c99",
-   "support"
-  ],
   "mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/cross-ws.no-redirect.https-expected.txt": [
    "350dbc15e924732951eae513960a49644b56e324",
    "support"
@@ -526338,14 +525651,6 @@
    "ae251cc0e81695390af92d9db78e250d3847e98e",
    "testharness"
   ],
-  "mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/cross-ws.swap-scheme.https-expected.txt": [
-   "6c3bef8ad8a46c329d49dd32137f7d39269586fc",
-   "support"
-  ],
-  "mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/same-ws.keep-scheme.https-expected.txt": [
-   "b02166d5506422584d8ce2ff46f3b37da127b31b",
-   "support"
-  ],
   "mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/same-ws.no-redirect.https-expected.txt": [
    "60ad8d9d1c1a8294311083c7ac3647b921019389",
    "support"
@@ -526354,10 +525659,6 @@
    "a4210bf851d4d6df0ec3a1ecef279db27037bd84",
    "testharness"
   ],
-  "mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/same-ws.swap-scheme.https-expected.txt": [
-   "01f70cb8b4ca9b47fab2540e17b1b4c3b9f15231",
-   "support"
-  ],
   "mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/same-wss.no-redirect.https.html": [
    "c899946980ac7f329e0741719cd655a0005d02eb",
    "testharness"
@@ -526498,10 +525799,6 @@
    "46e2255e388e9e08377d625b55653a007d59c14e",
    "support"
   ],
-  "mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/cross-ws.keep-scheme.https-expected.txt": [
-   "71e61d1bc7bd39c39527b249d76a326a519b9c99",
-   "support"
-  ],
   "mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/cross-ws.no-redirect.https.html": [
    "c491c86c1affa6e8d6063b7301084984a7c897e1",
    "testharness"
@@ -526510,14 +525807,6 @@
    "46e2255e388e9e08377d625b55653a007d59c14e",
    "support"
   ],
-  "mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/cross-ws.swap-scheme.https-expected.txt": [
-   "6c3bef8ad8a46c329d49dd32137f7d39269586fc",
-   "support"
-  ],
-  "mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/same-ws.keep-scheme.https-expected.txt": [
-   "b02166d5506422584d8ce2ff46f3b37da127b31b",
-   "support"
-  ],
   "mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/same-ws.no-redirect.https.html": [
    "a27cb53f973b93af3add107677b5831b98029251",
    "testharness"
@@ -526526,10 +525815,6 @@
    "46e2255e388e9e08377d625b55653a007d59c14e",
    "support"
   ],
-  "mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/same-ws.swap-scheme.https-expected.txt": [
-   "01f70cb8b4ca9b47fab2540e17b1b4c3b9f15231",
-   "support"
-  ],
   "mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/same-wss.no-redirect.https.html": [
    "e967bb07a7f74c658734d7c1ae707ac225a79d60",
    "testharness"
@@ -526710,10 +525995,6 @@
    "120a82d380314c75692b9f9922d78f5145a08862",
    "testharness"
   ],
-  "mixed-content/gen/sharedworker-module-data.meta/unset/websocket/cross-ws.keep-scheme.https-expected.txt": [
-   "71e61d1bc7bd39c39527b249d76a326a519b9c99",
-   "support"
-  ],
   "mixed-content/gen/sharedworker-module-data.meta/unset/websocket/cross-ws.no-redirect.https-expected.txt": [
    "350dbc15e924732951eae513960a49644b56e324",
    "support"
@@ -526722,14 +526003,6 @@
    "c491c86c1affa6e8d6063b7301084984a7c897e1",
    "testharness"
   ],
-  "mixed-content/gen/sharedworker-module-data.meta/unset/websocket/cross-ws.swap-scheme.https-expected.txt": [
-   "6c3bef8ad8a46c329d49dd32137f7d39269586fc",
-   "support"
-  ],
-  "mixed-content/gen/sharedworker-module-data.meta/unset/websocket/same-ws.keep-scheme.https-expected.txt": [
-   "b02166d5506422584d8ce2ff46f3b37da127b31b",
-   "support"
-  ],
   "mixed-content/gen/sharedworker-module-data.meta/unset/websocket/same-ws.no-redirect.https-expected.txt": [
    "60ad8d9d1c1a8294311083c7ac3647b921019389",
    "support"
@@ -526738,10 +526011,6 @@
    "a27cb53f973b93af3add107677b5831b98029251",
    "testharness"
   ],
-  "mixed-content/gen/sharedworker-module-data.meta/unset/websocket/same-ws.swap-scheme.https-expected.txt": [
-   "01f70cb8b4ca9b47fab2540e17b1b4c3b9f15231",
-   "support"
-  ],
   "mixed-content/gen/sharedworker-module-data.meta/unset/websocket/same-wss.no-redirect.https.html": [
    "e967bb07a7f74c658734d7c1ae707ac225a79d60",
    "testharness"
@@ -527522,38 +526791,6 @@
    "46e2255e388e9e08377d625b55653a007d59c14e",
    "support"
   ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.keep-scheme.https.html": [
-   "4d785b21f4acccddf824d9c55d9260801a8e576d",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.keep-scheme.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.no-redirect.https.html": [
-   "a704db4d9347597b56d6d03256a02ec2f9341161",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.no-redirect.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.swap-scheme.https.html": [
-   "46a0e267366024e3d6c3a481f7b956ba6c6d2329",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.swap-scheme.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-https.swap-scheme.https.html": [
-   "8bc14cb8c85a913a04ff2bd1d91f44d1ca453fd7",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-https.swap-scheme.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
   "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-http.keep-scheme.https.html": [
    "cfada8433e001533b16182bfe788487c4f53ecb3",
    "testharness"
@@ -527570,14 +526807,6 @@
    "46e2255e388e9e08377d625b55653a007d59c14e",
    "support"
   ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-http.swap-scheme.https.html": [
-   "0942ebd3591c7178b68ccb5deb486f69e26111ef",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-http.swap-scheme.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
   "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-https.keep-scheme.https.html": [
    "66eb7541346c74cbf7ccb05170bd561e93f2e685",
    "testharness"
@@ -527594,14 +526823,6 @@
    "46e2255e388e9e08377d625b55653a007d59c14e",
    "support"
   ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-https.swap-scheme.https.html": [
-   "49b0614511afe69621f84207d1b2ee9a6d07a2d3",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-https.swap-scheme.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
   "mixed-content/gen/top.http-rp/opt-in/sharedworker-import-data/cross-http.keep-scheme.https.html": [
    "a290473feb6a70ac819ae1a639f6a82e4dbad5f0",
    "testharness"
@@ -527682,38 +526903,6 @@
    "46e2255e388e9e08377d625b55653a007d59c14e",
    "support"
   ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.keep-scheme.https.html": [
-   "530dbe507a1c54addf6158816f79d5ce38d816eb",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.keep-scheme.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.no-redirect.https.html": [
-   "b716ae6168b42611fba46ff8cf6cc8c3d327cd24",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.no-redirect.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.swap-scheme.https.html": [
-   "8696795c4de054e309c4c4ddd0653d5dac3bd881",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.swap-scheme.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-https.swap-scheme.https.html": [
-   "12a66d42627ca9b1c624f0679b71a59152adc3da",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-https.swap-scheme.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
   "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-http.keep-scheme.https.html": [
    "64f6d02f60c34cadd46e8538dcabfb0cea77aa8f",
    "testharness"
@@ -527730,14 +526919,6 @@
    "46e2255e388e9e08377d625b55653a007d59c14e",
    "support"
   ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-http.swap-scheme.https.html": [
-   "e7cb04810b9f4cd5f600312ff9b10b3a86aabeac",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-http.swap-scheme.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
   "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-https.keep-scheme.https.html": [
    "30d1a97fa6915703dab636160219cd669dce8c80",
    "testharness"
@@ -527754,14 +526935,6 @@
    "46e2255e388e9e08377d625b55653a007d59c14e",
    "support"
   ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-https.swap-scheme.https.html": [
-   "6601019864b19b62ab695867d306f72c56ad3a17",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-https.swap-scheme.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
   "mixed-content/gen/top.http-rp/opt-in/video-tag/cross-http.keep-scheme.https.html": [
    "8c6b5a912484bf1267a05bcf31d9d2b761ed852a",
    "testharness"
@@ -527866,38 +527039,6 @@
    "46e2255e388e9e08377d625b55653a007d59c14e",
    "support"
   ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.keep-scheme.https.html": [
-   "8a915c29f9f45c37c998c4caa70f819c895f4d06",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.keep-scheme.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.no-redirect.https.html": [
-   "5aabf759341371ad8323399f83c9160407e3ddca",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.no-redirect.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.swap-scheme.https.html": [
-   "90c204d7a0d0dff099916a14a1eeebbb15dbc3e0",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.swap-scheme.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-https.swap-scheme.https.html": [
-   "cbc740ae3872c0c668597ea32e794304ce77018e",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-https.swap-scheme.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
   "mixed-content/gen/top.http-rp/opt-in/worker-classic/same-http.keep-scheme.https.html": [
    "93668db49e4f3d79d39ab72bc525db6353a4d74c",
    "testharness"
@@ -527914,14 +527055,6 @@
    "46e2255e388e9e08377d625b55653a007d59c14e",
    "support"
   ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-classic/same-http.swap-scheme.https.html": [
-   "d5f79ad60212c6ec0b48a5be3e9c6a492d4b7a69",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-classic/same-http.swap-scheme.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
   "mixed-content/gen/top.http-rp/opt-in/worker-classic/same-https.keep-scheme.https.html": [
    "042bd14fa8160b38c7852c168748a6c70484e4a1",
    "testharness"
@@ -527938,14 +527071,6 @@
    "46e2255e388e9e08377d625b55653a007d59c14e",
    "support"
   ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-classic/same-https.swap-scheme.https.html": [
-   "09ba5bc858e1e133a372f28935162b0370a08a21",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-classic/same-https.swap-scheme.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
   "mixed-content/gen/top.http-rp/opt-in/worker-import-data/cross-http.keep-scheme.https.html": [
    "60963f90586f89117f898378512ad682dee5e275",
    "testharness"
@@ -528026,38 +527151,6 @@
    "46e2255e388e9e08377d625b55653a007d59c14e",
    "support"
   ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.keep-scheme.https.html": [
-   "69dcfb7e5cb5b30f24e0b181b3b3968542673f35",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.keep-scheme.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.no-redirect.https.html": [
-   "816e3449092a398f12a7287b4d2715764aea56ac",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.no-redirect.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.swap-scheme.https.html": [
-   "9e167de1486d409caf0ba5ef4b41d434ad06315c",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.swap-scheme.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-module/cross-https.swap-scheme.https.html": [
-   "700b7dada6774c0540bd012a1be8b7ad6ed4d448",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-module/cross-https.swap-scheme.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
   "mixed-content/gen/top.http-rp/opt-in/worker-module/same-http.keep-scheme.https.html": [
    "75e103e634366ff03e22e11d32b0cefed280e1ce",
    "testharness"
@@ -528074,14 +527167,6 @@
    "46e2255e388e9e08377d625b55653a007d59c14e",
    "support"
   ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-module/same-http.swap-scheme.https.html": [
-   "f0397f11b69a19ca884dfcaba8abd571d4ed1aa4",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-module/same-http.swap-scheme.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
   "mixed-content/gen/top.http-rp/opt-in/worker-module/same-https.keep-scheme.https.html": [
    "b81758e5b79fa6fbf2b50c2118150087b06caef5",
    "testharness"
@@ -528098,14 +527183,6 @@
    "46e2255e388e9e08377d625b55653a007d59c14e",
    "support"
   ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-module/same-https.swap-scheme.https.html": [
-   "74f95a2620887f5bd4713272812cbc12bba8d53e",
-   "testharness"
-  ],
-  "mixed-content/gen/top.http-rp/opt-in/worker-module/same-https.swap-scheme.https.html.headers": [
-   "46e2255e388e9e08377d625b55653a007d59c14e",
-   "support"
-  ],
   "mixed-content/gen/top.http-rp/opt-in/worklet-animation-import-data/cross-http.keep-scheme.https.html": [
    "1c26e0c6e493cf60706e3dac9b527b18c12bfda7",
    "testharness"
@@ -528934,10 +528011,6 @@
    "c96bec02a15bd90c3c5562100d2d6260ce77f8c6",
    "testharness"
   ],
-  "mixed-content/gen/top.meta/opt-in/sharedworker-classic/cross-http.no-redirect.https.html": [
-   "3f17e742c30723418e6d05abfcdc645355b167c9",
-   "testharness"
-  ],
   "mixed-content/gen/top.meta/opt-in/sharedworker-classic/same-http.no-redirect.https.html": [
    "ae2f3db74f5ecb6bf3ac8b30baaf027d2494b55f",
    "testharness"
@@ -528958,10 +528031,6 @@
    "afea900ac1a7ab8c43828039f4928893de3ab8e6",
    "testharness"
   ],
-  "mixed-content/gen/top.meta/opt-in/sharedworker-module/cross-http.no-redirect.https.html": [
-   "d4717590a42b634824b0d713ee3cb05b7de6a420",
-   "testharness"
-  ],
   "mixed-content/gen/top.meta/opt-in/sharedworker-module/same-http.no-redirect.https.html": [
    "4100554d8415507bb4bc600e85974ee009faebbd",
    "testharness"
@@ -528994,10 +528063,6 @@
    "4764cab154b0486963d1ca21134eac8d7e3267aa",
    "testharness"
   ],
-  "mixed-content/gen/top.meta/opt-in/worker-classic/cross-http.no-redirect.https.html": [
-   "36ee4ed56d04f5f7b240a1760e17180c58ec8ed4",
-   "testharness"
-  ],
   "mixed-content/gen/top.meta/opt-in/worker-classic/same-http.no-redirect.https.html": [
    "bdc906277b1d3fde69f8cfe558f77beed9c436ca",
    "testharness"
@@ -529018,10 +528083,6 @@
    "ce40498e7af0abd9e0b1428dd1d97447caee91e0",
    "testharness"
   ],
-  "mixed-content/gen/top.meta/opt-in/worker-module/cross-http.no-redirect.https.html": [
-   "87dd4d87ee0cea8d73f35e95a1f31eafa85669a9",
-   "testharness"
-  ],
   "mixed-content/gen/top.meta/opt-in/worker-module/same-http.no-redirect.https.html": [
    "e837b2cbbd2299165bade9dfaeffd0297289feab",
    "testharness"
@@ -529426,18 +528487,6 @@
    "3d29665067f481ae779acf4d8dfd21330fec92e4",
    "testharness"
   ],
-  "mixed-content/gen/top.meta/unset/sharedworker-classic/cross-http.keep-scheme.https.html": [
-   "4d785b21f4acccddf824d9c55d9260801a8e576d",
-   "testharness"
-  ],
-  "mixed-content/gen/top.meta/unset/sharedworker-classic/cross-http.no-redirect.https.html": [
-   "a704db4d9347597b56d6d03256a02ec2f9341161",
-   "testharness"
-  ],
-  "mixed-content/gen/top.meta/unset/sharedworker-classic/cross-http.swap-scheme.https.html": [
-   "46a0e267366024e3d6c3a481f7b956ba6c6d2329",
-   "testharness"
-  ],
   "mixed-content/gen/top.meta/unset/sharedworker-classic/same-http.keep-scheme.https.html": [
    "cfada8433e001533b16182bfe788487c4f53ecb3",
    "testharness"
@@ -529446,10 +528495,6 @@
    "154d65a190364b3245a8710c0f240c655f7093f0",
    "testharness"
   ],
-  "mixed-content/gen/top.meta/unset/sharedworker-classic/same-http.swap-scheme.https.html": [
-   "0942ebd3591c7178b68ccb5deb486f69e26111ef",
-   "testharness"
-  ],
   "mixed-content/gen/top.meta/unset/sharedworker-classic/same-https.keep-scheme.https.html": [
    "66eb7541346c74cbf7ccb05170bd561e93f2e685",
    "testharness"
@@ -529490,18 +528535,6 @@
    "7f4b78666b489e4f2291830448732f0649e6a784",
    "testharness"
   ],
-  "mixed-content/gen/top.meta/unset/sharedworker-module/cross-http.keep-scheme.https.html": [
-   "530dbe507a1c54addf6158816f79d5ce38d816eb",
-   "testharness"
-  ],
-  "mixed-content/gen/top.meta/unset/sharedworker-module/cross-http.no-redirect.https.html": [
-   "b716ae6168b42611fba46ff8cf6cc8c3d327cd24",
-   "testharness"
-  ],
-  "mixed-content/gen/top.meta/unset/sharedworker-module/cross-http.swap-scheme.https.html": [
-   "8696795c4de054e309c4c4ddd0653d5dac3bd881",
-   "testharness"
-  ],
   "mixed-content/gen/top.meta/unset/sharedworker-module/same-http.keep-scheme.https.html": [
    "64f6d02f60c34cadd46e8538dcabfb0cea77aa8f",
    "testharness"
@@ -529510,10 +528543,6 @@
    "932f090c38fcc2bc5ed9ea6d1db91bda6887c435",
    "testharness"
   ],
-  "mixed-content/gen/top.meta/unset/sharedworker-module/same-http.swap-scheme.https.html": [
-   "e7cb04810b9f4cd5f600312ff9b10b3a86aabeac",
-   "testharness"
-  ],
   "mixed-content/gen/top.meta/unset/sharedworker-module/same-https.keep-scheme.https.html": [
    "30d1a97fa6915703dab636160219cd669dce8c80",
    "testharness"
@@ -529566,18 +528595,6 @@
    "ed5c0ab8a77e14fb8b6cd7deb6ff2a3ef0b41b97",
    "testharness"
   ],
-  "mixed-content/gen/top.meta/unset/worker-classic/cross-http.keep-scheme.https.html": [
-   "8a915c29f9f45c37c998c4caa70f819c895f4d06",
-   "testharness"
-  ],
-  "mixed-content/gen/top.meta/unset/worker-classic/cross-http.no-redirect.https.html": [
-   "5aabf759341371ad8323399f83c9160407e3ddca",
-   "testharness"
-  ],
-  "mixed-content/gen/top.meta/unset/worker-classic/cross-http.swap-scheme.https.html": [
-   "90c204d7a0d0dff099916a14a1eeebbb15dbc3e0",
-   "testharness"
-  ],
   "mixed-content/gen/top.meta/unset/worker-classic/same-http.keep-scheme.https.html": [
    "93668db49e4f3d79d39ab72bc525db6353a4d74c",
    "testharness"
@@ -529586,10 +528603,6 @@
    "8521e37281c964ea9a226fd1bdcfc1dd33c169b6",
    "testharness"
   ],
-  "mixed-content/gen/top.meta/unset/worker-classic/same-http.swap-scheme.https.html": [
-   "d5f79ad60212c6ec0b48a5be3e9c6a492d4b7a69",
-   "testharness"
-  ],
   "mixed-content/gen/top.meta/unset/worker-classic/same-https.keep-scheme.https.html": [
    "042bd14fa8160b38c7852c168748a6c70484e4a1",
    "testharness"
@@ -529630,18 +528643,6 @@
    "211bd0d29981358e1dc754a3353f3a43219a34b9",
    "testharness"
   ],
-  "mixed-content/gen/top.meta/unset/worker-module/cross-http.keep-scheme.https.html": [
-   "69dcfb7e5cb5b30f24e0b181b3b3968542673f35",
-   "testharness"
-  ],
-  "mixed-content/gen/top.meta/unset/worker-module/cross-http.no-redirect.https.html": [
-   "816e3449092a398f12a7287b4d2715764aea56ac",
-   "testharness"
-  ],
-  "mixed-content/gen/top.meta/unset/worker-module/cross-http.swap-scheme.https.html": [
-   "9e167de1486d409caf0ba5ef4b41d434ad06315c",
-   "testharness"
-  ],
   "mixed-content/gen/top.meta/unset/worker-module/same-http.keep-scheme.https.html": [
    "75e103e634366ff03e22e11d32b0cefed280e1ce",
    "testharness"
@@ -529650,10 +528651,6 @@
    "f9e963d8dc778e2f59687decd714421babb676ad",
    "testharness"
   ],
-  "mixed-content/gen/top.meta/unset/worker-module/same-http.swap-scheme.https.html": [
-   "f0397f11b69a19ca884dfcaba8abd571d4ed1aa4",
-   "testharness"
-  ],
   "mixed-content/gen/top.meta/unset/worker-module/same-https.keep-scheme.https.html": [
    "b81758e5b79fa6fbf2b50c2118150087b06caef5",
    "testharness"
@@ -530674,14 +529671,6 @@
    "280edc27e5ad6f7a18e5f4c476a189efd6418e43",
    "manual"
   ],
-  "native-file-system/native_FileSystemWriter-manual.https.tentative-expected.txt": [
-   "51ea575934f3e1a9b6eed9915e36ec2e7d95109d",
-   "support"
-  ],
-  "native-file-system/native_FileSystemWriter-manual.https.tentative.html": [
-   "fbfbd301e1659a7fac5273507358e4f712b53b3c",
-   "manual"
-  ],
   "native-file-system/opaque-origin.https.window.js": [
    "2385c31a786a223e5cdc23856edd41a55af783b2",
    "testharness"
@@ -530731,7 +529720,7 @@
    "support"
   ],
   "native-file-system/resources/test-helpers.js": [
-   "d0360921f1d8ce7257bd7d6586d333b8534c620d",
+   "eb123bf6da6eec15ea9bb228c87fe6a799cf1f1e",
    "support"
   ],
   "native-file-system/sandboxed_FileSystemBaseHandle-IndexedDB.tentative.https.any.js": [
@@ -530810,10 +529799,6 @@
    "16dbbe6a808a603c9b81482f733dcf09e84670ff",
    "testharness"
   ],
-  "native-file-system/sandboxed_FileSystemWriter.tentative.https.any.js": [
-   "8352e2487fe0823a2d353372757d833d85e98c4b",
-   "testharness"
-  ],
   "native-file-system/script-tests/FileSystemBaseHandle-IndexedDB.js": [
    "855e52f04ddf2f4f8641524010216c6e8c7cdda7",
    "support"
@@ -530875,7 +529860,7 @@
    "support"
   ],
   "native-file-system/script-tests/FileSystemFileHandle-getFile.js": [
-   "6b7d9f9a3171c96aaa2e1312451b3a9cac6c2e9b",
+   "80593418bb1622b76e440a1c55cd745c59b8a582",
    "support"
   ],
   "native-file-system/script-tests/FileSystemWritableFileStream-piped.js": [
@@ -530890,10 +529875,6 @@
    "778437e2a592120c05e8872ec11ab76986861023",
    "support"
   ],
-  "native-file-system/script-tests/FileSystemWriter.js": [
-   "5e1f31942886e3f285af417c932a056e613fd24e",
-   "support"
-  ],
   "navigation-timing/META.yml": [
    "bfb0e0f1f67a9c6aa2e7e921b09e85f8d970b290",
    "support"
@@ -538542,6 +537523,10 @@
    "d4dfe7ed822beff3090a58e84d736f5ae79b4620",
    "testharness"
   ],
+  "paint-timing/border-image.html": [
+   "636874817670489a47f23d0936a6a37dd5189594",
+   "testharness"
+  ],
   "paint-timing/buffered-flag.window.js": [
    "4654c925ca0cf069d3b0a96f0daef25ef67ba187",
    "testharness"
@@ -538587,13 +537572,21 @@
    "testharness"
   ],
   "paint-timing/input-text.html": [
-   "38527a4c667061de54c385add53eeb49f0d6bbfd",
+   "e55c8d2d4747c1507636e6bfcd51158f37767522",
+   "testharness"
+  ],
+  "paint-timing/mask-image.html": [
+   "35a6213f6ff817a1e8540f0663d9b8fc9f0eaa18",
    "testharness"
   ],
   "paint-timing/paint-visited.html": [
    "9a5561d5f7f317738d406d45bf371013f5cf3f25",
    "testharness"
   ],
+  "paint-timing/replaced-content-image.html": [
+   "244833ffdd07a67993b81d974254a1958dd28901",
+   "testharness"
+  ],
   "paint-timing/resources/circle.svg": [
    "6b5fdbe8e0653728125331b598f56cd55458a94d",
    "support"
@@ -538611,7 +537604,7 @@
    "support"
   ],
   "paint-timing/resources/utils.js": [
-   "6ccb5f6d7317a14547c755cdbf21c858b0d17a61",
+   "9375b175296c305c8c75eb0a6c618a7ff62364ee",
    "support"
   ],
   "paint-timing/sibling-painting-first-image.html": [
@@ -596459,7 +595452,7 @@
    "support"
   ],
   "web-animations/interfaces/DocumentOrShadowRoot/getAnimations.html": [
-   "f88ad432c1e4c4bd8b6a1e7e41acc07d761f0593",
+   "5d6952bd3421a1d258976bbce91b9688c4668112",
    "testharness"
   ],
   "web-animations/interfaces/DocumentTimeline/constructor.html": [
@@ -596567,7 +595560,7 @@
    "support"
   ],
   "web-animations/testcommon.js": [
-   "f89cbbaf9361b1e50b1473e93ae63aaa1abb34c7",
+   "811fe784c2635546c8bd1d6befc276d1cfbfad9a",
    "support"
   ],
   "web-animations/timing-model/animation-effects/active-time.html": [
@@ -596710,8 +595703,12 @@
    "50bb3ac5877ff6c676c8781113fe3b9da4104fdd",
    "testharness"
   ],
+  "web-animations/timing-model/timelines/update-and-send-events-replacement-expected.txt": [
+   "36509543aab72d13e690d40f0cc4bf3ac30cae85",
+   "support"
+  ],
   "web-animations/timing-model/timelines/update-and-send-events-replacement.html": [
-   "1391b97a8ae7fa3c84eab6002edf0f87414b56b7",
+   "fced6ead657cc7a37110b156efe79b4d6cf63ccb",
    "testharness"
   ],
   "web-animations/timing-model/timelines/update-and-send-events.html": [
@@ -600786,6 +599783,10 @@
    "1310717ccb9c035b011ff5fe5430fbd7e9f158f2",
    "support"
   ],
+  "webrtc/protocol/bundle.https.html": [
+   "fcc9d470b9f7c5c4215da09666e471dfa0a192d1",
+   "testharness"
+  ],
   "webrtc/protocol/candidate-exchange.https.html": [
    "b741de55eccd870e705324d3c75d2c06305e017a",
    "testharness"
@@ -608150,10 +607151,6 @@
    "98b56d36250f2f02a38e6fb066b9abbe7b0cf902",
    "testharness"
   ],
-  "worklets/animation-worklet-referrer.https-expected.txt": [
-   "afa4657822c86046a8127c674f507b7c0d07d6db",
-   "support"
-  ],
   "worklets/animation-worklet-referrer.https.html": [
    "49933dea47d554b0d9dbdeb8305c522c076c9c81",
    "testharness"
@@ -608178,10 +607175,6 @@
    "cff063a4361bd0244ee7a7a352be849f1b7118a6",
    "testharness"
   ],
-  "worklets/audio-worklet-referrer.https-expected.txt": [
-   "afa4657822c86046a8127c674f507b7c0d07d6db",
-   "support"
-  ],
   "worklets/audio-worklet-referrer.https.html": [
    "61cb63d75ca647a7385200573c3a6b5aca27ae34",
    "testharness"
@@ -608210,10 +607203,6 @@
    "a2f57c221b7f6f020dda72bb9b2395cfd05d5c03",
    "testharness"
   ],
-  "worklets/layout-worklet-referrer.https-expected.txt": [
-   "afa4657822c86046a8127c674f507b7c0d07d6db",
-   "support"
-  ],
   "worklets/layout-worklet-referrer.https.html": [
    "dc7b84b350c5114624caf7afd87924d5c673763a",
    "testharness"
@@ -608238,10 +607227,6 @@
    "68e926c8c18868b84069bf18eb0bae6a37a77ce4",
    "testharness"
   ],
-  "worklets/paint-worklet-referrer.https-expected.txt": [
-   "afa4657822c86046a8127c674f507b7c0d07d6db",
-   "support"
-  ],
   "worklets/paint-worklet-referrer.https.html": [
    "8f3d82a1ddc62a482caf70dd6591cb7244bd7fe5",
    "testharness"
@@ -608355,11 +607340,11 @@
    "support"
   ],
   "worklets/resources/referrer-tests.js": [
-   "b3c4a048f5a12350ce79ba93049d81858f54201f",
+   "10cfcf4b8b4c2b01d63b0bf9d5affc7945bfe0d7",
    "support"
   ],
   "worklets/resources/referrer-window.html": [
-   "934e3dc41b1cda364a00fe4fae0e4bc114e9c4b6",
+   "1d8d38b719be8de7676af20323943034ca1fa000",
    "support"
   ],
   "worklets/resources/service-worker-interception-tests.js": [
diff --git a/third_party/blink/web_tests/external/wpt/css/css-flexbox/flex-wrap-001.htm b/third_party/blink/web_tests/external/wpt/css/css-flexbox/flex-wrap-001.htm
deleted file mode 100644
index 127100a..0000000
--- a/third_party/blink/web_tests/external/wpt/css/css-flexbox/flex-wrap-001.htm
+++ /dev/null
@@ -1,38 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD//XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml">
-    <head>
-        <title>CSS Test: A flex container with 'flex-flow' set to 'wrap'</title>
-        <link rel="author" title="Microsoft" href="http://www.microsoft.com/" />
-        <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#flex-wrap-property" />
-        <meta name="flags" content="">
-        <meta name="assert" content="This test checks that the flex container with 'flex-flow: wrap' is a multi-line flex container." />
-        <style type="text/css">
-            #flexbox
-            {
-                background-color: red;
-                display: flex;
-                flex-flow: wrap;
-                height: 100px;
-                width: 300px;
-            }
-            div div
-            {
-                background-color: orange;
-                width: 150px;
-            }
-            .blue
-            {
-                background-color: blue;
-            }
-        </style>
-    </head>
-    <body>
-        <p>Test passes if there is a single blue rectangle on the left, a single orange rectangle directly to its right, and there is no red visible on the page.</p>
-        <div id="flexbox">
-            <div class="blue"></div>
-            <div></div>
-            <div class="blue"></div>
-            <div></div>
-        </div>
-    </body>
-</html>
\ No newline at end of file
diff --git a/third_party/blink/web_tests/external/wpt/css/css-flexbox/flex-wrap_nowrap.html b/third_party/blink/web_tests/external/wpt/css/css-flexbox/flex-wrap_nowrap.html
deleted file mode 100644
index ef53bb2..0000000
--- a/third_party/blink/web_tests/external/wpt/css/css-flexbox/flex-wrap_nowrap.html
+++ /dev/null
@@ -1,24 +0,0 @@
-<!DOCTYPE html>
-<html>
-  <head>
-    <title>CSS Flexible Box Test: flex-wrap_nowrap</title>
-    <link rel="author" title="Intel" href="http://www.intel.com" />
-    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#flex-wrap-property" />
-    <link rel="stylesheet" href="support/test-style.css">
-    <meta name="flags" content="" />
-    <meta name="assert" content="Check if the web engine can identify the flex-wrap value nowrap." />
-    <style>
-      #test{
-        width: 120px;
-        display: flex;
-		flex-wrap: wrap;
-	    flex-wrap: nowrap;
-      }
-    </style>
-  </head>
-  <body>
-    <p>Test passes if:<br>
-    1. the rectangle 1, 2, 3 show up in a row and no gap between them.</p>
-    <div id=test><div id=test01>1</div><div id=test02>2</div><div id=test03>3</div></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/css/css-flexbox/flex-wrap_wrap-reverse.html b/third_party/blink/web_tests/external/wpt/css/css-flexbox/flex-wrap_wrap-reverse.html
deleted file mode 100644
index ce23e935..0000000
--- a/third_party/blink/web_tests/external/wpt/css/css-flexbox/flex-wrap_wrap-reverse.html
+++ /dev/null
@@ -1,25 +0,0 @@
-<!DOCTYPE html>
-<html>
-  <head>
-    <title>CSS Flexible Box Test: flex-wrap_wrap-reverse</title>
-    <link rel="author" title="Intel" href="http://www.intel.com" />
-    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#flex-wrap-property" />
-    <link rel="stylesheet" href="support/test-style.css">
-    <meta name="flags" content="" />
-    <meta name="assert" content="Check if the web engine can identify the flex-wrap value wrap-reverse." />
-    <style>
-      #test{
-	width: 120px;
-        display: flex;
-	flex-wrap: wrap-reverse;
-      }
-    </style>
-  </head>
-  <body>
-    <p>Test passes if:<br>
-    1. the rectangle 1, 2, 3 show up in two rows in a red rectangle and no gap between them.<br>
-    2. the rectangle 3 appear in the first line of rows.<br>
-    3. the rectangles appear in upper left of the red rectangle.</p>
-    <div id=test><div id=test01>1</div><div id=test02>2</div><div id=test03>3</div></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/css/css-flexbox/flex-wrap_wrap.html b/third_party/blink/web_tests/external/wpt/css/css-flexbox/flex-wrap_wrap.html
deleted file mode 100644
index 302c9cd..0000000
--- a/third_party/blink/web_tests/external/wpt/css/css-flexbox/flex-wrap_wrap.html
+++ /dev/null
@@ -1,25 +0,0 @@
-<!DOCTYPE html>
-<html>
-  <head>
-    <title>CSS Flexible Box Test: flex-wrap_wrap</title>
-    <link rel="author" title="Intel" href="http://www.intel.com" />
-    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#flex-wrap-property" />
-    <link rel="stylesheet" href="support/test-style.css">
-    <meta name="flags" content="" />
-    <meta name="assert" content="Check if the display can recognize inline-flex value." />
-    <style>
-      div#test{
-        width: 120px;
-        display: flex;
-	flex-wrap: wrap;
-      }
-    </style>
-  </head>
-  <body>
-    <p>Test passes if:<br>
-    1. the rectangle 1, 2, 3 show up in two rows in a red rectangle and no gap between them.<br>
-    2. the rectangle 1 appear in the first line of rows.<br>
-    3. the rectangles appear in upper left of the red rectangle.</p>
-    <div id=test><div id=test01>1</div><div id=test02>2</div><div id=test03>3</div></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/css/css-flexbox/reference/ttwf-reftest-flex-wrap-ref.html b/third_party/blink/web_tests/external/wpt/css/css-flexbox/reference/ttwf-reftest-flex-wrap-ref.html
deleted file mode 100644
index bb3e2b94..0000000
--- a/third_party/blink/web_tests/external/wpt/css/css-flexbox/reference/ttwf-reftest-flex-wrap-ref.html
+++ /dev/null
@@ -1,36 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-    <title>CSS Flexible Box Test: flex-wrap proprety - wrap</title>
-    <link rel="author" title="haosdent" href="mailto:haosdent@gmail.com">
-    <style type="text/css">
-        /* Positioned container allows for the self-describing statement to still
-           be visible in the case of failure */
-        .container {
-            position: relative;
-            background: red;
-            margin: 1em 0;
-            border: 1px solid black;
-            width: 20em;
-            height: 6.5em;
-        }
-        span {
-            display: inline-block;
-            background: green;
-            color: white;
-            margin: 1em;
-            width: 8em;
-            float: left;
-        }
-    </style>
-</head>
-<body>
-    <p>The test passed if you see a 2 * 2 table on the page.</p>
-    <div class="container">
-      <span>first</span>
-      <span>second</span>
-      <span>third</span>
-      <span>forth</span>
-    </div>
-</body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/css/css-flexbox/reference/ttwf-reftest-flex-wrap-reverse-ref.html b/third_party/blink/web_tests/external/wpt/css/css-flexbox/reference/ttwf-reftest-flex-wrap-reverse-ref.html
deleted file mode 100644
index fe6e510c..0000000
--- a/third_party/blink/web_tests/external/wpt/css/css-flexbox/reference/ttwf-reftest-flex-wrap-reverse-ref.html
+++ /dev/null
@@ -1,36 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-    <title>CSS Flexible Box Test: flex-wrap proprety - wrap-reverse</title>
-    <link rel="author" title="haosdent" href="mailto:haosdent@gmail.com">
-    <style type="text/css">
-        /* Positioned container allows for the self-describing statement to still
-           be visible in the case of failure */
-        .container {
-            position: relative;
-            background: red;
-            margin: 1em 0;
-            border: 1px solid black;
-            width: 20em;
-            height: 6.5em;
-        }
-        span {
-            display: inline-block;
-            background: green;
-            color: white;
-            margin: 1em;
-            width: 8em;
-            float: left;
-        }
-    </style>
-</head>
-<body>
-    <p>The test passed if you see a 2 * 2 table on the page and the order of them are reversed.</p>
-    <div class="container">
-      <span>third</span>
-      <span>forth</span>
-      <span>first</span>
-      <span>second</span>
-    </div>
-</body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/css/css-flexbox/ttwf-reftest-flex-wrap-reverse.html b/third_party/blink/web_tests/external/wpt/css/css-flexbox/ttwf-reftest-flex-wrap-reverse.html
deleted file mode 100644
index f2aefa2..0000000
--- a/third_party/blink/web_tests/external/wpt/css/css-flexbox/ttwf-reftest-flex-wrap-reverse.html
+++ /dev/null
@@ -1,40 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-    <title>CSS Flexible Box Test: flex-wrap proprety - wrap-reverse</title>
-    <link rel="author" title="haosdent" href="mailto:haosdent@gmail.com">
-    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#flex-wrap-property">
-    <link rel="match" href="reference/ttwf-reftest-flex-wrap-reverse-ref.html">
-    <meta name="assert" content="Statement describing what the test case is asserting">
-    <style type="text/css">
-        /* Positioned container allows for the self-describing statement to still
-           be visible in the case of failure */
-        .container {
-            position: relative;
-            display: flex;
-            flex-wrap: wrap-reverse;
-            background: red;
-            margin: 1em 0;
-            border: 1px solid black;
-            width: 20em;
-            height: 6.5em;
-        }
-        span {
-            display: inline-block;
-            background: green;
-            color: white;
-            margin: 1em;
-            width: 8em;
-        }
-    </style>
-</head>
-<body>
-    <p>The test passed if you see a 2 * 2 table on the page and the order of them are reversed.</p>
-    <div class="container">
-      <span>first</span>
-      <span>second</span>
-      <span>third</span>
-      <span>forth</span>
-    </div>
-</body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/css/css-flexbox/ttwf-reftest-flex-wrap.html b/third_party/blink/web_tests/external/wpt/css/css-flexbox/ttwf-reftest-flex-wrap.html
deleted file mode 100644
index 3acd79c..0000000
--- a/third_party/blink/web_tests/external/wpt/css/css-flexbox/ttwf-reftest-flex-wrap.html
+++ /dev/null
@@ -1,40 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-    <title>CSS Flexible Box Test: flex-wrap proprety - wrap</title>
-    <link rel="author" title="haosdent" href="mailto:haosdent@gmail.com">
-    <link rel="help" href="http://www.w3.org/TR/css-flexbox-1/#flex-wrap-property">
-    <link rel="match" href="reference/ttwf-reftest-flex-wrap-ref.html">
-    <meta name="assert" content="Statement describing what the test case is asserting">
-    <style type="text/css">
-        /* Positioned container allows for the self-describing statement to still
-           be visible in the case of failure */
-        .container {
-            position: relative;
-            display: flex;
-            flex-wrap: wrap;
-            background: red;
-            margin: 1em 0;
-            border: 1px solid black;
-            width: 20em;
-            height: 6.5em;
-        }
-        span {
-            display: inline-block;
-            background: green;
-            color: white;
-            margin: 1em;
-            width: 8em;
-        }
-    </style>
-</head>
-<body>
-    <p>The test passed if you see a 2 * 2 table on the page.</p>
-    <div class="container">
-      <span>first</span>
-      <span>second</span>
-      <span>third</span>
-      <span>forth</span>
-    </div>
-</body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/html/rendering/replaced-elements/attributes-for-embedded-content-and-images/img-aspect-ratio-lazy.tentative.html b/third_party/blink/web_tests/external/wpt/html/rendering/replaced-elements/attributes-for-embedded-content-and-images/img-aspect-ratio-lazy.tentative.html
new file mode 100644
index 0000000..0a56539e
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/rendering/replaced-elements/attributes-for-embedded-content-and-images/img-aspect-ratio-lazy.tentative.html
@@ -0,0 +1,30 @@
+<!doctype html>
+<title>Image width and height attributes are used to infer aspect-ratio for lazy-loaded images</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<style>
+  img {
+    width: 100%;
+    max-width: 100px;
+    height: auto;
+  }
+</style>
+<div style="height: 600vh"></div>
+<img src="/images/green.png" loading="lazy" width=100 height=100>
+<script>
+let t = async_test("Image width and height attributes are used to infer aspect-ratio for lazy-loaded images");
+
+function assert_ratio(img, expected) {
+  let epsilon = 0.001;
+  assert_approx_equals(parseFloat(getComputedStyle(img).width, 10) / parseFloat(getComputedStyle(img).height, 10), expected, epsilon);
+}
+
+t.step(function() {
+  let img = document.querySelector("img");
+  assert_ratio(img, 1.0);
+  img.addEventListener("load", t.step_func_done(function() {
+    assert_ratio(img, 2.0); // 2.0 is the original aspect ratio of green.png
+  }));
+  window.scrollTo(0, img.getBoundingClientRect().top);
+});
+</script>
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/referrer-origin-when-cross-origin.sub-expected.txt b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/referrer-origin-when-cross-origin.sub-expected.txt
deleted file mode 100644
index 618b27c2..0000000
--- a/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/referrer-origin-when-cross-origin.sub-expected.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-This is a testharness.js-based test.
-PASS Importing a same-origin top-level script with the origin-when-cross-origin policy.
-PASS Importing a remote-origin top-level script with the origin-when-cross-origin policy.
-PASS Importing a same-origin descendant script from a same-origin top-level script with the origin-when-cross-origin policy.
-PASS Importing a remote-origin descendant script from a same-origin top-level script with the origin-when-cross-origin policy.
-FAIL Importing a remote-origin descendant script from a remote-origin top-level script with the origin-when-cross-origin policy. assert_equals: Referrer should be sent for the remote-origin descendant script. expected "http://www1.web-platform.test:8001/" but got "http://www1.web-platform.test:8001/html/semantics/scripting-1/the-script-element/module/resources/import-referrer-checker.sub.js?name=remote_remote"
-FAIL Importing a same-origin descendant script from a remote-origin top-level script with the origin-when-cross-origin policy. assert_equals: Referrer should be sent for the same-origin descendant script. expected "http://www1.web-platform.test:8001/html/semantics/scripting-1/the-script-element/module/resources/import-same-origin-referrer-checker-from-remote-origin.sub.js?name=remote_same" but got "http://www1.web-platform.test:8001/"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/referrer-origin-when-cross-origin.sub.html b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/referrer-origin-when-cross-origin.sub.html
index 8351289..4cd427e 100644
--- a/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/referrer-origin-when-cross-origin.sub.html
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/referrer-origin-when-cross-origin.sub.html
@@ -29,14 +29,15 @@
 test(t => {
   assert_equals(
       referrerSame, location.href,
-      "Referrer should be sent for the same-origin top-level script.");
+      "Full referrer should be sent for the same-origin top-level script.");
 }, "Importing a same-origin top-level script with the " +
    "origin-when-cross-origin policy.");
 
 test(t => {
   assert_equals(
       referrerRemote, origin,
-      "Referrer should be sent for the remote-origin top-level script.");
+      "Referrer should be stripped to the origin when importing " +
+      "remote-origin top-level script.");
 }, "Importing a remote-origin top-level script with the " +
    "origin-when-cross-origin policy.");
 
@@ -45,31 +46,34 @@
       new URL("resources/import-referrer-checker.sub.js", location.href)
   assert_equals(
       referrerSameSame, scriptURL + "?name=same_same",
-      "Referrer should be sent for the same-origin descendant script.");
+      "Full referrer should be sent for same-origin descendant script" +
+      "imported by same-origin top-level script.");
 }, "Importing a same-origin descendant script from a same-origin top-level " +
    "script with the origin-when-cross-origin policy.");
 
 test(t => {
   assert_equals(
       referrerSameRemote, origin,
-      "Referrer should be sent for the remote-origin descendant script.");
+      "Referrer should be stripped to the origin for the remote-origin " +
+      "descendant script imported from same-origin top-level script.");
 }, "Importing a remote-origin descendant script from a same-origin top-level " +
    "script with the origin-when-cross-origin policy.");
 
 test(t => {
-  assert_equals(
-      referrerRemoteRemote, remoteOrigin,
-      "Referrer should be sent for the remote-origin descendant script.");
+  const scriptURL = new URL(
+    "html/semantics/scripting-1/the-script-element/module/resources/" +
+    "import-referrer-checker.sub.js",
+    remoteOrigin);
+  assert_equals(referrerRemoteRemote, scriptURL + "?name=remote_remote",
+      "Full referrer should be sent for the remote-origin descendant script " +
+      "imported from a remote-origin top-level script.");
 }, "Importing a remote-origin descendant script from a remote-origin " +
    "top-level script with the origin-when-cross-origin policy.");
 
 test(t => {
-  const scriptURL = new URL(
-    "html/semantics/scripting-1/the-script-element/module/resources/" +
-    "import-same-origin-referrer-checker-from-remote-origin.sub.js",
-    remoteOrigin);
-  assert_equals(referrerRemoteSame, scriptURL + "?name=remote_same",
-      "Referrer should be sent for the same-origin descendant script.");
+  assert_equals(referrerRemoteSame, remoteOrigin,
+      "Referrer should be stripped to the origin for the same-origin " +
+      "descendant script imported by remote-origin top-level script.");
 }, "Importing a same-origin descendant script from a remote-origin " +
    "top-level script with the origin-when-cross-origin policy.");
 
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/referrer-same-origin.sub-expected.txt b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/referrer-same-origin.sub-expected.txt
deleted file mode 100644
index 814be90..0000000
--- a/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/referrer-same-origin.sub-expected.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-This is a testharness.js-based test.
-PASS Importing a same-origin top-level script with the same-origin policy.
-PASS Importing a remote-origin top-level script with the same-origin policy.
-PASS Importing a same-origin descendant script from a same-origin top-level script with the same-origin policy.
-PASS Importing a remote-origin descendant script from a same-origin top-level script with the same-origin policy.
-FAIL Importing a remote-origin descendant script from a remote-origin top-level script with the same-origin policy. assert_equals: Referrer should not be sent for the remote-origin descendant script even if it is imported from the script in the same remote-origin. expected "" but got "http://www1.web-platform.test:8001/html/semantics/scripting-1/the-script-element/module/resources/import-referrer-checker.sub.js?name=remote_remote"
-FAIL Importing a same-origin descendant script from a remote-origin top-level script with the same-origin policy. assert_equals: Referrer should be sent for the same-origin descendant script even if it is imported from the script in the remote-origin. expected "http://www1.web-platform.test:8001/html/semantics/scripting-1/the-script-element/module/resources/import-same-origin-referrer-checker-from-remote-origin.sub.js?name=remote_same" but got ""
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/referrer-same-origin.sub.html b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/referrer-same-origin.sub.html
index 1d470e6..7d6d515 100644
--- a/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/referrer-same-origin.sub.html
+++ b/third_party/blink/web_tests/external/wpt/html/semantics/scripting-1/the-script-element/module/referrer-same-origin.sub.html
@@ -54,22 +54,21 @@
    "script with the same-origin policy.");
 
 test(t => {
+  const scriptURL = new URL(
+    "html/semantics/scripting-1/the-script-element/module/resources/" +
+    "import-referrer-checker.sub.js", remoteOrigin);
   assert_equals(
-      referrerRemoteRemote, "",
-      "Referrer should not be sent for the remote-origin descendant script " +
-      "even if it is imported from the script in the same remote-origin.");
+      referrerRemoteRemote, scriptURL + "?name=remote_remote",
+      "Referrer should be sent for the remote-origin descendant script " +
+      "when it is imported from a top-level script in the same remote-origin.");
 }, "Importing a remote-origin descendant script from a remote-origin " +
    "top-level script with the same-origin policy.");
 
 test(t => {
-  const scriptURL = new URL(
-    "html/semantics/scripting-1/the-script-element/module/resources/" +
-    "import-same-origin-referrer-checker-from-remote-origin.sub.js",
-    remoteOrigin);
   assert_equals(
-      referrerRemoteSame, scriptURL + "?name=remote_same",
-      "Referrer should be sent for the same-origin descendant script " +
-      "even if it is imported from the script in the remote-origin.");
+      referrerRemoteSame, "",
+      "Referrer should not be sent for the same-origin descendant script " +
+      "when it is imported from a top-level remote-origin script.");
 }, "Importing a same-origin descendant script from a remote-origin " +
    "top-level script with the same-origin policy.");
 
diff --git a/third_party/blink/web_tests/external/wpt/mathml/presentation-markup/fractions/frac-parameters-1-expected.txt b/third_party/blink/web_tests/external/wpt/mathml/presentation-markup/fractions/frac-parameters-1-expected.txt
new file mode 100644
index 0000000..eccd329
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/mathml/presentation-markup/fractions/frac-parameters-1-expected.txt
@@ -0,0 +1,13 @@
+This is a testharness.js-based test.
+PASS AxisHeight
+PASS DenominatorDisplayStyleGapMin
+PASS DenominatorDisplayStyleShiftDown
+FAIL DenominatorGapMin assert_approx_equals: mfrac: denominator gap expected 40 +/- 1 but got -0.015625
+FAIL DenominatorShiftDown assert_approx_equals: mfrac: denominator shift expected 30 +/- 1 but got 0
+PASS NumeratorDisplayStyleGapMin
+PASS NumeratorDisplayStyleShiftDown
+FAIL NumeratorGapMin assert_approx_equals: mfrac: numerator gap expected 90 +/- 1 but got -0.015625
+FAIL NumeratorShiftDown assert_approx_equals: mfrac: numerator shift expected 110 +/- 1 but got 14.96875
+PASS FractionRuleThickness
+Harness: the test ran to completion.
+
diff --git a/third_party/blink/web_tests/external/wpt/mathml/presentation-markup/fractions/frac-parameters-2-expected.txt b/third_party/blink/web_tests/external/wpt/mathml/presentation-markup/fractions/frac-parameters-2-expected.txt
new file mode 100644
index 0000000..eb6b9a9
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/mathml/presentation-markup/fractions/frac-parameters-2-expected.txt
@@ -0,0 +1,9 @@
+This is a testharness.js-based test.
+PASS BottomDisplayStyleShiftDown
+FAIL BottomShiftDown assert_approx_equals: mfrac: denominator shift expected 60 +/- 1 but got 0
+PASS DisplayStyleGapMin
+FAIL GapMin assert_approx_equals: mfrac: gap expected 80 +/- 1 but got 0
+PASS TopDisplayStyleShiftUp
+FAIL ToShiftUp assert_approx_equals: mfrac: numerator shift expected 90 +/- 1 but got 0
+Harness: the test ran to completion.
+
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/cross-ws.keep-scheme.https-expected.txt b/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/cross-ws.keep-scheme.https-expected.txt
deleted file mode 100644
index 71e61d1..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/cross-ws.keep-scheme.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Mixed-Content: Expects blocked for websocket to cross-ws origin and keep-scheme redirection from https context. assert_equals: The resource request should be 'blocked'. expected "blocked" but got "allowed"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/cross-ws.swap-scheme.https-expected.txt b/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/cross-ws.swap-scheme.https-expected.txt
deleted file mode 100644
index 6c3bef8..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/cross-ws.swap-scheme.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Mixed-Content: Expects blocked for websocket to cross-ws origin and swap-scheme redirection from https context. assert_equals: The resource request should be 'blocked'. expected "blocked" but got "allowed"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/same-ws.keep-scheme.https-expected.txt b/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/same-ws.keep-scheme.https-expected.txt
deleted file mode 100644
index b02166d5..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/same-ws.keep-scheme.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Mixed-Content: Expects blocked for websocket to same-ws origin and keep-scheme redirection from https context. assert_equals: The resource request should be 'blocked'. expected "blocked" but got "allowed"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/same-ws.swap-scheme.https-expected.txt b/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/same-ws.swap-scheme.https-expected.txt
deleted file mode 100644
index 01f70cb..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.http-rp/opt-in/websocket/same-ws.swap-scheme.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Mixed-Content: Expects blocked for websocket to same-ws origin and swap-scheme redirection from https context. assert_equals: The resource request should be 'blocked'. expected "blocked" but got "allowed"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/cross-ws.keep-scheme.https-expected.txt b/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/cross-ws.keep-scheme.https-expected.txt
deleted file mode 100644
index 71e61d1..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/cross-ws.keep-scheme.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Mixed-Content: Expects blocked for websocket to cross-ws origin and keep-scheme redirection from https context. assert_equals: The resource request should be 'blocked'. expected "blocked" but got "allowed"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/cross-ws.swap-scheme.https-expected.txt b/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/cross-ws.swap-scheme.https-expected.txt
deleted file mode 100644
index 6c3bef8..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/cross-ws.swap-scheme.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Mixed-Content: Expects blocked for websocket to cross-ws origin and swap-scheme redirection from https context. assert_equals: The resource request should be 'blocked'. expected "blocked" but got "allowed"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/same-ws.keep-scheme.https-expected.txt b/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/same-ws.keep-scheme.https-expected.txt
deleted file mode 100644
index b02166d5..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/same-ws.keep-scheme.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Mixed-Content: Expects blocked for websocket to same-ws origin and keep-scheme redirection from https context. assert_equals: The resource request should be 'blocked'. expected "blocked" but got "allowed"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/same-ws.swap-scheme.https-expected.txt b/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/same-ws.swap-scheme.https-expected.txt
deleted file mode 100644
index 01f70cb..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-classic-data.meta/unset/websocket/same-ws.swap-scheme.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Mixed-Content: Expects blocked for websocket to same-ws origin and swap-scheme redirection from https context. assert_equals: The resource request should be 'blocked'. expected "blocked" but got "allowed"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/cross-ws.keep-scheme.https-expected.txt b/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/cross-ws.keep-scheme.https-expected.txt
deleted file mode 100644
index 71e61d1..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/cross-ws.keep-scheme.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Mixed-Content: Expects blocked for websocket to cross-ws origin and keep-scheme redirection from https context. assert_equals: The resource request should be 'blocked'. expected "blocked" but got "allowed"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/cross-ws.swap-scheme.https-expected.txt b/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/cross-ws.swap-scheme.https-expected.txt
deleted file mode 100644
index 6c3bef8..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/cross-ws.swap-scheme.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Mixed-Content: Expects blocked for websocket to cross-ws origin and swap-scheme redirection from https context. assert_equals: The resource request should be 'blocked'. expected "blocked" but got "allowed"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/same-ws.keep-scheme.https-expected.txt b/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/same-ws.keep-scheme.https-expected.txt
deleted file mode 100644
index b02166d5..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/same-ws.keep-scheme.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Mixed-Content: Expects blocked for websocket to same-ws origin and keep-scheme redirection from https context. assert_equals: The resource request should be 'blocked'. expected "blocked" but got "allowed"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/same-ws.swap-scheme.https-expected.txt b/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/same-ws.swap-scheme.https-expected.txt
deleted file mode 100644
index 01f70cb..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.http-rp/opt-in/websocket/same-ws.swap-scheme.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Mixed-Content: Expects blocked for websocket to same-ws origin and swap-scheme redirection from https context. assert_equals: The resource request should be 'blocked'. expected "blocked" but got "allowed"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.meta/unset/websocket/cross-ws.keep-scheme.https-expected.txt b/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.meta/unset/websocket/cross-ws.keep-scheme.https-expected.txt
deleted file mode 100644
index 71e61d1..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.meta/unset/websocket/cross-ws.keep-scheme.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Mixed-Content: Expects blocked for websocket to cross-ws origin and keep-scheme redirection from https context. assert_equals: The resource request should be 'blocked'. expected "blocked" but got "allowed"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.meta/unset/websocket/cross-ws.swap-scheme.https-expected.txt b/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.meta/unset/websocket/cross-ws.swap-scheme.https-expected.txt
deleted file mode 100644
index 6c3bef8..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.meta/unset/websocket/cross-ws.swap-scheme.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Mixed-Content: Expects blocked for websocket to cross-ws origin and swap-scheme redirection from https context. assert_equals: The resource request should be 'blocked'. expected "blocked" but got "allowed"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.meta/unset/websocket/same-ws.keep-scheme.https-expected.txt b/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.meta/unset/websocket/same-ws.keep-scheme.https-expected.txt
deleted file mode 100644
index b02166d5..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.meta/unset/websocket/same-ws.keep-scheme.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Mixed-Content: Expects blocked for websocket to same-ws origin and keep-scheme redirection from https context. assert_equals: The resource request should be 'blocked'. expected "blocked" but got "allowed"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.meta/unset/websocket/same-ws.swap-scheme.https-expected.txt b/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.meta/unset/websocket/same-ws.swap-scheme.https-expected.txt
deleted file mode 100644
index 01f70cb..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/sharedworker-module-data.meta/unset/websocket/same-ws.swap-scheme.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Mixed-Content: Expects blocked for websocket to same-ws origin and swap-scheme redirection from https context. assert_equals: The resource request should be 'blocked'. expected "blocked" but got "allowed"
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.keep-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.keep-scheme.https.html
deleted file mode 100644
index 4d785b2..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.keep-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-classic to cross-http origin and keep-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "keep-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.keep-scheme.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.keep-scheme.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.keep-scheme.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.no-redirect.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.no-redirect.https.html
deleted file mode 100644
index a704db4..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.no-redirect.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-classic to cross-http origin and no-redirect redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "no-redirect",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.no-redirect.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.no-redirect.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.no-redirect.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.swap-scheme.https.html
deleted file mode 100644
index 46a0e267..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-classic to cross-http origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.swap-scheme.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.swap-scheme.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-http.swap-scheme.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-https.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-https.swap-scheme.https.html
deleted file mode 100644
index 8bc14cb..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-https.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-classic to cross-https origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-https",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-https.swap-scheme.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-https.swap-scheme.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/cross-https.swap-scheme.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-http.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-http.swap-scheme.https.html
deleted file mode 100644
index 0942ebd..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-http.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-classic to same-http origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "same-http",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-http.swap-scheme.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-http.swap-scheme.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-http.swap-scheme.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-https.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-https.swap-scheme.https.html
deleted file mode 100644
index 49b06145..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-https.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-classic to same-https origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "same-https",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-https.swap-scheme.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-https.swap-scheme.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-classic/same-https.swap-scheme.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.keep-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.keep-scheme.https.html
deleted file mode 100644
index 530dbe50..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.keep-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-module to cross-http origin and keep-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "keep-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.keep-scheme.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.keep-scheme.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.keep-scheme.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.no-redirect.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.no-redirect.https.html
deleted file mode 100644
index b716ae61..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.no-redirect.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-module to cross-http origin and no-redirect redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "no-redirect",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.no-redirect.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.no-redirect.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.no-redirect.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.swap-scheme.https.html
deleted file mode 100644
index 8696795c4..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-module to cross-http origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.swap-scheme.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.swap-scheme.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-http.swap-scheme.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-https.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-https.swap-scheme.https.html
deleted file mode 100644
index 12a66d4..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-https.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-module to cross-https origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-https",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-https.swap-scheme.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-https.swap-scheme.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/cross-https.swap-scheme.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-http.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-http.swap-scheme.https.html
deleted file mode 100644
index e7cb048..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-http.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-module to same-http origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "same-http",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-http.swap-scheme.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-http.swap-scheme.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-http.swap-scheme.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-https.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-https.swap-scheme.https.html
deleted file mode 100644
index 6601019..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-https.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-module to same-https origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "same-https",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-https.swap-scheme.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-https.swap-scheme.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/sharedworker-module/same-https.swap-scheme.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.keep-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.keep-scheme.https.html
deleted file mode 100644
index 8a915c29..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.keep-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-classic to cross-http origin and keep-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "keep-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.keep-scheme.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.keep-scheme.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.keep-scheme.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.no-redirect.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.no-redirect.https.html
deleted file mode 100644
index 5aabf75..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.no-redirect.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-classic to cross-http origin and no-redirect redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "no-redirect",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.no-redirect.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.no-redirect.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.no-redirect.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.swap-scheme.https.html
deleted file mode 100644
index 90c204d..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-classic to cross-http origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.swap-scheme.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.swap-scheme.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-http.swap-scheme.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-https.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-https.swap-scheme.https.html
deleted file mode 100644
index cbc740ae..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-https.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-classic to cross-https origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-https",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-https.swap-scheme.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-https.swap-scheme.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/cross-https.swap-scheme.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/same-http.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/same-http.swap-scheme.https.html
deleted file mode 100644
index d5f79ad..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/same-http.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-classic to same-http origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "same-http",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/same-http.swap-scheme.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/same-http.swap-scheme.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/same-http.swap-scheme.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/same-https.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/same-https.swap-scheme.https.html
deleted file mode 100644
index 09ba5bc..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/same-https.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-classic to same-https origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "same-https",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/same-https.swap-scheme.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/same-https.swap-scheme.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-classic/same-https.swap-scheme.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.keep-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.keep-scheme.https.html
deleted file mode 100644
index 69dcfb7e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.keep-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-module to cross-http origin and keep-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "keep-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.keep-scheme.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.keep-scheme.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.keep-scheme.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.no-redirect.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.no-redirect.https.html
deleted file mode 100644
index 816e344..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.no-redirect.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-module to cross-http origin and no-redirect redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "no-redirect",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.no-redirect.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.no-redirect.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.no-redirect.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.swap-scheme.https.html
deleted file mode 100644
index 9e167de1..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-module to cross-http origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.swap-scheme.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.swap-scheme.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-http.swap-scheme.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-https.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-https.swap-scheme.https.html
deleted file mode 100644
index 700b7da..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-https.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-module to cross-https origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-https",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-https.swap-scheme.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-https.swap-scheme.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/cross-https.swap-scheme.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/same-http.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/same-http.swap-scheme.https.html
deleted file mode 100644
index f0397f11..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/same-http.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-module to same-http origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "same-http",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/same-http.swap-scheme.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/same-http.swap-scheme.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/same-http.swap-scheme.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/same-https.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/same-https.swap-scheme.https.html
deleted file mode 100644
index 74f95a26..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/same-https.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-module to same-https origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "same-https",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/same-https.swap-scheme.https.html.headers b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/same-https.swap-scheme.https.html.headers
deleted file mode 100644
index 46e2255e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.http-rp/opt-in/worker-module/same-https.swap-scheme.https.html.headers
+++ /dev/null
@@ -1 +0,0 @@
-Content-Security-Policy: block-all-mixed-content
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/opt-in/sharedworker-classic/cross-http.no-redirect.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/opt-in/sharedworker-classic/cross-http.no-redirect.https.html
deleted file mode 100644
index 3f17e74..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/opt-in/sharedworker-classic/cross-http.no-redirect.https.html
+++ /dev/null
@@ -1,35 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-classic to cross-http origin and no-redirect redirection from https context.">
-    <meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "no-redirect",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/opt-in/sharedworker-module/cross-http.no-redirect.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/opt-in/sharedworker-module/cross-http.no-redirect.https.html
deleted file mode 100644
index d4717590..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/opt-in/sharedworker-module/cross-http.no-redirect.https.html
+++ /dev/null
@@ -1,35 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-module to cross-http origin and no-redirect redirection from https context.">
-    <meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "no-redirect",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/opt-in/worker-classic/cross-http.no-redirect.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/opt-in/worker-classic/cross-http.no-redirect.https.html
deleted file mode 100644
index 36ee4ed5..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/opt-in/worker-classic/cross-http.no-redirect.https.html
+++ /dev/null
@@ -1,35 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-classic to cross-http origin and no-redirect redirection from https context.">
-    <meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "no-redirect",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/opt-in/worker-module/cross-http.no-redirect.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/opt-in/worker-module/cross-http.no-redirect.https.html
deleted file mode 100644
index 87dd4d87..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/opt-in/worker-module/cross-http.no-redirect.https.html
+++ /dev/null
@@ -1,35 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-module to cross-http origin and no-redirect redirection from https context.">
-    <meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "no-redirect",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-classic/cross-http.keep-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-classic/cross-http.keep-scheme.https.html
deleted file mode 100644
index 4d785b2..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-classic/cross-http.keep-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-classic to cross-http origin and keep-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "keep-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-classic/cross-http.no-redirect.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-classic/cross-http.no-redirect.https.html
deleted file mode 100644
index a704db4..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-classic/cross-http.no-redirect.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-classic to cross-http origin and no-redirect redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "no-redirect",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-classic/cross-http.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-classic/cross-http.swap-scheme.https.html
deleted file mode 100644
index 46a0e267..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-classic/cross-http.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-classic to cross-http origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-classic/same-http.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-classic/same-http.swap-scheme.https.html
deleted file mode 100644
index 0942ebd..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-classic/same-http.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-classic to same-http origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "same-http",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-module/cross-http.keep-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-module/cross-http.keep-scheme.https.html
deleted file mode 100644
index 530dbe50..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-module/cross-http.keep-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-module to cross-http origin and keep-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "keep-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-module/cross-http.no-redirect.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-module/cross-http.no-redirect.https.html
deleted file mode 100644
index b716ae61..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-module/cross-http.no-redirect.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-module to cross-http origin and no-redirect redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "no-redirect",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-module/cross-http.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-module/cross-http.swap-scheme.https.html
deleted file mode 100644
index 8696795c4..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-module/cross-http.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-module to cross-http origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-module/same-http.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-module/same-http.swap-scheme.https.html
deleted file mode 100644
index e7cb048..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/sharedworker-module/same-http.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for sharedworker-module to same-http origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "same-http",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "sharedworker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-classic/cross-http.keep-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-classic/cross-http.keep-scheme.https.html
deleted file mode 100644
index 8a915c29..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-classic/cross-http.keep-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-classic to cross-http origin and keep-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "keep-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-classic/cross-http.no-redirect.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-classic/cross-http.no-redirect.https.html
deleted file mode 100644
index 5aabf75..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-classic/cross-http.no-redirect.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-classic to cross-http origin and no-redirect redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "no-redirect",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-classic/cross-http.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-classic/cross-http.swap-scheme.https.html
deleted file mode 100644
index 90c204d..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-classic/cross-http.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-classic to cross-http origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-classic/same-http.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-classic/same-http.swap-scheme.https.html
deleted file mode 100644
index d5f79ad..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-classic/same-http.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-classic to same-http origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "same-http",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-classic",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-module/cross-http.keep-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-module/cross-http.keep-scheme.https.html
deleted file mode 100644
index 69dcfb7e..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-module/cross-http.keep-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-module to cross-http origin and keep-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "keep-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-module/cross-http.no-redirect.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-module/cross-http.no-redirect.https.html
deleted file mode 100644
index 816e344..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-module/cross-http.no-redirect.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-module to cross-http origin and no-redirect redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "no-redirect",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-module/cross-http.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-module/cross-http.swap-scheme.https.html
deleted file mode 100644
index 9e167de1..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-module/cross-http.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-module to cross-http origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "cross-http",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-module/same-http.swap-scheme.https.html b/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-module/same-http.swap-scheme.https.html
deleted file mode 100644
index f0397f11..0000000
--- a/third_party/blink/web_tests/external/wpt/mixed-content/gen/top.meta/unset/worker-module/same-http.swap-scheme.https.html
+++ /dev/null
@@ -1,34 +0,0 @@
-<!DOCTYPE html>
-<!-- DO NOT EDIT! Generated by `common/security-features/tools/generate.py --spec mixed-content/` -->
-<html>
-  <head>
-    <title>Mixed-Content: Blockable content</title>
-    <meta charset='utf-8'>
-    <meta name="description" content="Test behavior of blockable content.">
-    <link rel="author" title="Kristijan Burnik" href="burnik@chromium.org">
-    <link rel="help" href="http://www.w3.org/TR/mixed-content/#category-blockable">
-    <meta name="assert" content="Mixed-Content: Expects blocked for worker-module to same-http origin and swap-scheme redirection from https context.">
-    <script src="/resources/testharness.js"></script>
-    <script src="/resources/testharnessreport.js"></script>
-    <script src="/common/security-features/resources/common.sub.js"></script>
-    <script src="../../../../generic/test-case.sub.js"></script>
-  </head>
-  <body>
-    <script>
-      TestCase(
-        {
-          "expectation": "blocked",
-          "origin": "same-http",
-          "redirection": "swap-scheme",
-          "source_context_list": [],
-          "source_scheme": "https",
-          "subresource": "worker-module",
-          "subresource_policy_deliveries": []
-        },
-        document.querySelector("meta[name=assert]").content,
-        new SanityChecker()
-      ).start();
-      </script>
-    <div id="log"></div>
-  </body>
-</html>
diff --git a/third_party/blink/web_tests/external/wpt/webrtc/protocol/bundle.https.html b/third_party/blink/web_tests/external/wpt/webrtc/protocol/bundle.https.html
index fcc9d47..61d1ff8 100644
--- a/third_party/blink/web_tests/external/wpt/webrtc/protocol/bundle.https.html
+++ b/third_party/blink/web_tests/external/wpt/webrtc/protocol/bundle.https.html
@@ -6,6 +6,7 @@
 <script src="../RTCPeerConnection-helper.js"></script>
 <script>
 'use strict';
+
 promise_test(async t => {
   const caller = new RTCPeerConnection();
   t.add_cleanup(() => caller.close());
@@ -49,4 +50,45 @@
   assert_equals(iceTransports.length, 2);
   assert_not_equals(iceTransports[0], iceTransports[1]);
 }, 'not negotiating BUNDLE creates two separate ice and dtls transports');
+
+promise_test(async t => {
+  const caller = new RTCPeerConnection();
+  t.add_cleanup(() => caller.close());
+  const callee = new RTCPeerConnection();
+  t.add_cleanup(() => callee.close());
+  const stream = await getNoiseStream({audio: true, video: true});
+  t.add_cleanup(() => stream.getTracks().forEach(track => track.stop()));
+  stream.getTracks().forEach(track => caller.addTrack(track, stream));
+
+  let metadataToBeLoaded;
+  callee.ontrack = (e) => {
+    const stream = e.streams[0];
+    const v = document.createElement('video');
+    v.autoplay = true;
+    v.srcObject = stream;
+    v.id = stream.id
+    metadataToBeLoaded = new Promise((resolve) => {
+      v.addEventListener('loadedmetadata', () => {
+        resolve();
+      });
+    });
+  };
+  exchangeIceCandidates(caller, callee);
+  const offer = await caller.createOffer();
+  await callee.setRemoteDescription(offer);
+  await caller.setLocalDescription(offer);
+  const secondTransport = caller.getSenders()[1].transport; // Save a reference to this transport.
+
+  const answer = await callee.createAnswer();
+  await caller.setRemoteDescription(answer);
+  await callee.setLocalDescription(answer);
+
+  await metadataToBeLoaded;
+  const senders = caller.getSenders();
+  const dtlsTransports = senders.map(s => s.transport);
+  assert_equals(dtlsTransports.length, 2);
+  assert_equals(dtlsTransports[0], dtlsTransports[1]);
+  assert_not_equals(dtlsTransports[1], secondTransport);
+  assert_equals(secondTransport.state, 'closed');
+}, 'bundles on the first transport and closes the second');
 </script>
diff --git a/third_party/blink/web_tests/external/wpt/worklets/animation-worklet-referrer.https-expected.txt b/third_party/blink/web_tests/external/wpt/worklets/animation-worklet-referrer.https-expected.txt
deleted file mode 100644
index afa46578..0000000
--- a/third_party/blink/web_tests/external/wpt/worklets/animation-worklet-referrer.https-expected.txt
+++ /dev/null
@@ -1,21 +0,0 @@
-This is a testharness.js-based test.
-PASS Importing a same-origin script from a page that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a remote-origin script from a page that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a same-origin script from a page that has "origin" referrer policy should send only an origin as referrer.
-PASS Importing a remote-origin script from a page that has "origin" referrer policy should send only an origin as referrer.
-PASS Importing a same-origin script from a page that has "same-origin" referrer policy should send referrer.
-PASS Importing a remote-origin script from a page that has "same-origin" referrer policy should not send referrer.
-PASS Importing a same-origin script from a same-origin worklet script that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a remote-origin script from a same-origin worklet script that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a same-origin script from a remote-origin worklet script that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a remote-origin script from a remote-origin worklet script that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a same-origin script from a same-origin worklet script that has "origin" referrer policy should send referrer.
-PASS Importing a remote-origin script from a same-origin worklet script that has "origin" referrer policy should send referrer.
-PASS Importing a same-origin script from a remote-origin worklet script that has "origin" referrer policy should send referrer.
-PASS Importing a remote-origin script from a remote-origin worklet script that has "origin" referrer policy should send referrer.
-PASS Importing a same-origin script from a same-origin worklet script that has "same-origin" referrer policy should send referrer.
-PASS Importing a remote-origin script from a same-origin worklet script that has "same-origin" referrer policy should not send referrer.
-FAIL Importing a same-origin script from a remote-origin worklet script that has "same-origin" referrer policy should send referrer. assert_equals: expected "RESOLVED" but got "The user aborted a request."
-FAIL Importing a remote-origin script from a remote-origin worklet script that has "same-origin" referrer policy should not send referrer. assert_equals: expected "RESOLVED" but got "The user aborted a request."
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/worklets/audio-worklet-referrer.https-expected.txt b/third_party/blink/web_tests/external/wpt/worklets/audio-worklet-referrer.https-expected.txt
deleted file mode 100644
index afa46578..0000000
--- a/third_party/blink/web_tests/external/wpt/worklets/audio-worklet-referrer.https-expected.txt
+++ /dev/null
@@ -1,21 +0,0 @@
-This is a testharness.js-based test.
-PASS Importing a same-origin script from a page that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a remote-origin script from a page that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a same-origin script from a page that has "origin" referrer policy should send only an origin as referrer.
-PASS Importing a remote-origin script from a page that has "origin" referrer policy should send only an origin as referrer.
-PASS Importing a same-origin script from a page that has "same-origin" referrer policy should send referrer.
-PASS Importing a remote-origin script from a page that has "same-origin" referrer policy should not send referrer.
-PASS Importing a same-origin script from a same-origin worklet script that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a remote-origin script from a same-origin worklet script that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a same-origin script from a remote-origin worklet script that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a remote-origin script from a remote-origin worklet script that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a same-origin script from a same-origin worklet script that has "origin" referrer policy should send referrer.
-PASS Importing a remote-origin script from a same-origin worklet script that has "origin" referrer policy should send referrer.
-PASS Importing a same-origin script from a remote-origin worklet script that has "origin" referrer policy should send referrer.
-PASS Importing a remote-origin script from a remote-origin worklet script that has "origin" referrer policy should send referrer.
-PASS Importing a same-origin script from a same-origin worklet script that has "same-origin" referrer policy should send referrer.
-PASS Importing a remote-origin script from a same-origin worklet script that has "same-origin" referrer policy should not send referrer.
-FAIL Importing a same-origin script from a remote-origin worklet script that has "same-origin" referrer policy should send referrer. assert_equals: expected "RESOLVED" but got "The user aborted a request."
-FAIL Importing a remote-origin script from a remote-origin worklet script that has "same-origin" referrer policy should not send referrer. assert_equals: expected "RESOLVED" but got "The user aborted a request."
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/worklets/layout-worklet-referrer.https-expected.txt b/third_party/blink/web_tests/external/wpt/worklets/layout-worklet-referrer.https-expected.txt
deleted file mode 100644
index afa46578..0000000
--- a/third_party/blink/web_tests/external/wpt/worklets/layout-worklet-referrer.https-expected.txt
+++ /dev/null
@@ -1,21 +0,0 @@
-This is a testharness.js-based test.
-PASS Importing a same-origin script from a page that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a remote-origin script from a page that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a same-origin script from a page that has "origin" referrer policy should send only an origin as referrer.
-PASS Importing a remote-origin script from a page that has "origin" referrer policy should send only an origin as referrer.
-PASS Importing a same-origin script from a page that has "same-origin" referrer policy should send referrer.
-PASS Importing a remote-origin script from a page that has "same-origin" referrer policy should not send referrer.
-PASS Importing a same-origin script from a same-origin worklet script that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a remote-origin script from a same-origin worklet script that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a same-origin script from a remote-origin worklet script that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a remote-origin script from a remote-origin worklet script that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a same-origin script from a same-origin worklet script that has "origin" referrer policy should send referrer.
-PASS Importing a remote-origin script from a same-origin worklet script that has "origin" referrer policy should send referrer.
-PASS Importing a same-origin script from a remote-origin worklet script that has "origin" referrer policy should send referrer.
-PASS Importing a remote-origin script from a remote-origin worklet script that has "origin" referrer policy should send referrer.
-PASS Importing a same-origin script from a same-origin worklet script that has "same-origin" referrer policy should send referrer.
-PASS Importing a remote-origin script from a same-origin worklet script that has "same-origin" referrer policy should not send referrer.
-FAIL Importing a same-origin script from a remote-origin worklet script that has "same-origin" referrer policy should send referrer. assert_equals: expected "RESOLVED" but got "The user aborted a request."
-FAIL Importing a remote-origin script from a remote-origin worklet script that has "same-origin" referrer policy should not send referrer. assert_equals: expected "RESOLVED" but got "The user aborted a request."
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/worklets/paint-worklet-referrer.https-expected.txt b/third_party/blink/web_tests/external/wpt/worklets/paint-worklet-referrer.https-expected.txt
deleted file mode 100644
index afa46578..0000000
--- a/third_party/blink/web_tests/external/wpt/worklets/paint-worklet-referrer.https-expected.txt
+++ /dev/null
@@ -1,21 +0,0 @@
-This is a testharness.js-based test.
-PASS Importing a same-origin script from a page that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a remote-origin script from a page that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a same-origin script from a page that has "origin" referrer policy should send only an origin as referrer.
-PASS Importing a remote-origin script from a page that has "origin" referrer policy should send only an origin as referrer.
-PASS Importing a same-origin script from a page that has "same-origin" referrer policy should send referrer.
-PASS Importing a remote-origin script from a page that has "same-origin" referrer policy should not send referrer.
-PASS Importing a same-origin script from a same-origin worklet script that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a remote-origin script from a same-origin worklet script that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a same-origin script from a remote-origin worklet script that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a remote-origin script from a remote-origin worklet script that has "no-referrer" referrer policy should not send referrer.
-PASS Importing a same-origin script from a same-origin worklet script that has "origin" referrer policy should send referrer.
-PASS Importing a remote-origin script from a same-origin worklet script that has "origin" referrer policy should send referrer.
-PASS Importing a same-origin script from a remote-origin worklet script that has "origin" referrer policy should send referrer.
-PASS Importing a remote-origin script from a remote-origin worklet script that has "origin" referrer policy should send referrer.
-PASS Importing a same-origin script from a same-origin worklet script that has "same-origin" referrer policy should send referrer.
-PASS Importing a remote-origin script from a same-origin worklet script that has "same-origin" referrer policy should not send referrer.
-FAIL Importing a same-origin script from a remote-origin worklet script that has "same-origin" referrer policy should send referrer. assert_equals: expected "RESOLVED" but got "The user aborted a request."
-FAIL Importing a remote-origin script from a remote-origin worklet script that has "same-origin" referrer policy should not send referrer. assert_equals: expected "RESOLVED" but got "The user aborted a request."
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/external/wpt/worklets/resources/referrer-tests.js b/third_party/blink/web_tests/external/wpt/worklets/resources/referrer-tests.js
index b3c4a048..10cfcf4 100644
--- a/third_party/blink/web_tests/external/wpt/worklets/resources/referrer-tests.js
+++ b/third_party/blink/web_tests/external/wpt/worklets/resources/referrer-tests.js
@@ -188,7 +188,7 @@
                              scriptOrigins: { topLevel: 'remote',
                                               descendant: 'same' } });
   }, 'Importing a same-origin script from a remote-origin worklet script ' +
-     'that has "same-origin" referrer policy should send referrer.');
+     'that has "same-origin" referrer policy should not send referrer.');
 
   promise_test(() => {
     return runReferrerTest({ workletType: workletType,
@@ -197,7 +197,7 @@
                              scriptOrigins: { topLevel: 'remote',
                                               descendant: 'remote' } });
   }, 'Importing a remote-origin script from a remote-origin worklet script ' +
-     'that has "same-origin" referrer policy should not send referrer.');
+     'that has "same-origin" referrer policy should send referrer.');
 
   // TODO(domfarolino): Add tests for more referrer policies.
 }
diff --git a/third_party/blink/web_tests/external/wpt/worklets/resources/referrer-window.html b/third_party/blink/web_tests/external/wpt/worklets/resources/referrer-window.html
index 934e3dc41..1d8d38b 100644
--- a/third_party/blink/web_tests/external/wpt/worklets/resources/referrer-window.html
+++ b/third_party/blink/web_tests/external/wpt/worklets/resources/referrer-window.html
@@ -51,8 +51,10 @@
 function isDestinationCrossOrigin(fetchType, scriptOrigins) {
   if (fetchType === 'top-level')
     return scriptOrigins.topLevel === 'remote';
+
+  // Compute a descendant's cross-origin-ness relative to the top-level script.
   if (fetchType === 'descendant')
-    return scriptOrigins.descendant === 'remote';
+    return scriptOrigins.descendant !== scriptOrigins.topLevel;
   assert_unreached('fetchType has an invalid value.');
 }
 
diff --git a/third_party/blink/web_tests/flag-specific/paint/invalidation/outline/focus-ring-on-child-move-expected.txt b/third_party/blink/web_tests/flag-specific/paint/invalidation/outline/focus-ring-on-child-move-expected.txt
new file mode 100644
index 0000000..f16f8c8
--- /dev/null
+++ b/third_party/blink/web_tests/flag-specific/paint/invalidation/outline/focus-ring-on-child-move-expected.txt
@@ -0,0 +1,28 @@
+{
+  "layers": [
+    {
+      "name": "Scrolling Contents Layer",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF",
+      "paintInvalidations": [
+        {
+          "object": "LayoutNGBlockFlow (positioned) DIV",
+          "rect": [98, 48, 304, 304],
+          "reason": "outline"
+        },
+        {
+          "object": "LayoutNGBlockFlow (positioned) DIV id='child'",
+          "rect": [300, 50, 20, 300],
+          "reason": "geometry"
+        },
+        {
+          "object": "LayoutNGBlockFlow (positioned) DIV id='child'",
+          "rect": [150, 50, 20, 300],
+          "reason": "geometry"
+        }
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/blink/web_tests/flag-specific/paint/invalidation/svg/transform-focus-ring-repaint-expected.txt b/third_party/blink/web_tests/flag-specific/paint/invalidation/svg/transform-focus-ring-repaint-expected.txt
new file mode 100644
index 0000000..815412b
--- /dev/null
+++ b/third_party/blink/web_tests/flag-specific/paint/invalidation/svg/transform-focus-ring-repaint-expected.txt
@@ -0,0 +1,48 @@
+{
+  "layers": [
+    {
+      "name": "Scrolling Contents Layer",
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "backgroundColor": "#FFFFFF"
+    },
+    {
+      "name": "LayoutNGBlockFlow (positioned) DIV id='target'",
+      "position": [-2, -2],
+      "bounds": [404, 544],
+      "backfaceVisibility": "hidden",
+      "backgroundColor": "#FFFF00",
+      "paintInvalidations": [
+        {
+          "object": "LayoutNGBlockFlow (positioned) DIV id='target'",
+          "rect": [0, 0, 404, 544],
+          "reason": "full layer"
+        },
+        {
+          "object": "LayoutNGBlockFlow (positioned) DIV id='target'",
+          "rect": [0, 0, 200, 200],
+          "reason": "full layer"
+        }
+      ],
+      "transform": 1
+    },
+    {
+      "name": "Squashing Layer (first squashed layer: LayoutNGBlockFlow (positioned) DIV)",
+      "position": [100, 100],
+      "bounds": [300, 440],
+      "transform": 1
+    }
+  ],
+  "transforms": [
+    {
+      "id": 1,
+      "transform": [
+        [1, 0, 0, 0],
+        [0, 1, 0, 0],
+        [0, 0, 1, 0],
+        [8, 58, 0, 1]
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/README.txt b/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/README.txt
deleted file mode 100644
index 9ba2ca9..0000000
--- a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/README.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-This directory exists in order to prevent accidental shipping of
-Cross-Origin-Embedder-Policy (COEP).
diff --git a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/coep-frame-javascript.https-expected.txt b/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/coep-frame-javascript.https-expected.txt
deleted file mode 100644
index 999a6e40..0000000
--- a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/coep-frame-javascript.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Cross-Origin-Embedder-Policy frame and javascript: URLs assert_true: Cross-origin without CORP did not fail expected true got false
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/data.https-expected.txt b/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/data.https-expected.txt
deleted file mode 100644
index dd6579f..0000000
--- a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/data.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Cross-Origin-Embedder-Policy and data: URLs assert_true: Cross-origin without CORP did not fail expected true got false
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/dedicated-worker-cache-storage.https-expected.txt b/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/dedicated-worker-cache-storage.https-expected.txt
deleted file mode 100644
index c2bc85a..0000000
--- a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/dedicated-worker-cache-storage.https-expected.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-This is a testharness.js-based test.
-PASS coep-none coep-none corp-cross-origin
-PASS coep-none coep-none corp-undefined
-PASS coep-none coep-require-corp corp-cross-origin
-PASS coep-none coep-require-corp corp-undefined
-PASS coep-require-corp coep-none corp-cross-origin
-FAIL coep-require-corp coep-none corp-undefined assert_equals: expected false but got true
-PASS coep-require-corp coep-require-corp corp-cross-origin
-FAIL coep-require-corp coep-require-corp corp-undefined assert_equals: expected false but got true
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/javascript.https-expected.txt b/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/javascript.https-expected.txt
deleted file mode 100644
index a978f2d..0000000
--- a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/javascript.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Cross-Origin-Embedder-Policy and javascript: URLs assert_true: Cross-origin without CORP did not fail expected true got false
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/none-sw-from-require-corp.https-expected.txt b/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/none-sw-from-require-corp.https-expected.txt
deleted file mode 100644
index f26def88..0000000
--- a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/none-sw-from-require-corp.https-expected.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-This is a testharness.js-based test.
-PASS setting up
-PASS making a same-origin request for CORP: same-origin
-PASS making a same-origin request for no CORP
-PASS making a same-origin request for CORP: cross-origin
-PASS making a cross-origin request for CORP: same-origin
-FAIL making a cross-origin request for no CORP assert_unreached: Should have rejected: undefined Reached unreachable code
-PASS making a cross-origin request for CORP: cross-origin
-PASS making a cross-origin request for CORP: same-origin [PASS THROUGH]
-FAIL making a cross-origin request for no CORP [PASS THROUGH] assert_unreached: Should have rejected: undefined Reached unreachable code
-PASS making a cross-origin request for CORP: cross-origin [PASS THROUGH]
-PASS making a cross-origin request with CORS without ACAO
-PASS making a cross-origin request with CORS
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/reporting.https-expected.txt b/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/reporting.https-expected.txt
deleted file mode 100644
index 9db132d9..0000000
--- a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/reporting.https-expected.txt
+++ /dev/null
@@ -1,5 +0,0 @@
-This is a testharness.js-based test.
-FAIL subresource CORP assert_unreached: A report whose blocked-url is https://www1.web-platform.test:8444/common/text-plain.txt?abc&subresource-corp and url is https://web-platform.test:8444/html/cross-origin-embedder-policy/resources/reporting-empty-frame.html is not found. Reached unreachable code
-FAIL navigation CORP assert_unreached: A report whose blocked-url is https://www1.web-platform.test:8444/common/blank.html?abc&navigation-corp and url is https://web-platform.test:8444/html/cross-origin-embedder-policy/resources/reporting-empty-frame.html is not found. Reached unreachable code
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/require-corp-load-from-cache-storage.https-expected.txt b/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/require-corp-load-from-cache-storage.https-expected.txt
deleted file mode 100644
index d604dd3..0000000
--- a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/require-corp-load-from-cache-storage.https-expected.txt
+++ /dev/null
@@ -1,32 +0,0 @@
-This is a testharness.js-based test.
-PASS setting up
-PASS Fetch cross-origin cors   from service-worker and CacheStorage.
-PASS Fetch cross-origin no-cors   from service-worker and CacheStorage.
-PASS Fetch same-origin cors   from service-worker and CacheStorage.
-PASS Fetch same-origin no-cors   from service-worker and CacheStorage.
-PASS Fetch same-origin cors cors-disabled corp-cross-origin from network and CacheStorage.
-PASS Fetch same-origin cors cors-disabled corp-same-origin from network and CacheStorage.
-PASS Fetch same-origin cors cors-disabled corp-undefined from network and CacheStorage.
-PASS Fetch same-origin cors cors-enabled corp-cross-origin from network and CacheStorage.
-PASS Fetch same-origin cors cors-enabled corp-same-origin from network and CacheStorage.
-PASS Fetch same-origin cors cors-enabled corp-undefined from network and CacheStorage.
-PASS Fetch same-origin no-cors cors-disabled corp-cross-origin from network and CacheStorage.
-PASS Fetch same-origin no-cors cors-disabled corp-same-origin from network and CacheStorage.
-PASS Fetch same-origin no-cors cors-disabled corp-undefined from network and CacheStorage.
-PASS Fetch same-origin no-cors cors-enabled corp-cross-origin from network and CacheStorage.
-PASS Fetch same-origin no-cors cors-enabled corp-same-origin from network and CacheStorage.
-PASS Fetch same-origin no-cors cors-enabled corp-undefined from network and CacheStorage.
-PASS Fetch cross-origin cors cors-disabled corp-cross-origin from network and CacheStorage.
-PASS Fetch cross-origin cors cors-disabled corp-same-origin from network and CacheStorage.
-PASS Fetch cross-origin cors cors-disabled corp-undefined from network and CacheStorage.
-PASS Fetch cross-origin cors cors-enabled corp-cross-origin from network and CacheStorage.
-PASS Fetch cross-origin cors cors-enabled corp-same-origin from network and CacheStorage.
-PASS Fetch cross-origin cors cors-enabled corp-undefined from network and CacheStorage.
-PASS Fetch cross-origin no-cors cors-disabled corp-cross-origin from network and CacheStorage.
-PASS Fetch cross-origin no-cors cors-disabled corp-same-origin from network and CacheStorage.
-FAIL Fetch cross-origin no-cors cors-disabled corp-undefined from network and CacheStorage. assert_unreached: Should have rejected: undefined Reached unreachable code
-PASS Fetch cross-origin no-cors cors-enabled corp-cross-origin from network and CacheStorage.
-PASS Fetch cross-origin no-cors cors-enabled corp-same-origin from network and CacheStorage.
-FAIL Fetch cross-origin no-cors cors-enabled corp-undefined from network and CacheStorage. assert_unreached: Should have rejected: undefined Reached unreachable code
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/require-corp-sw-from-none.https-expected.txt b/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/require-corp-sw-from-none.https-expected.txt
deleted file mode 100644
index 0e8e8759..0000000
--- a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/require-corp-sw-from-none.https-expected.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-This is a testharness.js-based test.
-PASS setting up
-PASS making a same-origin request for CORP: same-origin
-PASS making a same-origin request for no CORP
-PASS making a same-origin request for CORP: cross-origin
-PASS making a cross-origin request for CORP: same-origin
-FAIL making a cross-origin request for no CORP assert_unreached: Should have rejected: undefined Reached unreachable code
-PASS making a cross-origin request for CORP: cross-origin
-PASS making a cross-origin request for CORP: same-origin [PASS THROUGH]
-PASS making a cross-origin request for no CORP [PASS THROUGH]
-PASS making a cross-origin request for CORP: cross-origin [PASS THROUGH]
-PASS making a cross-origin request with CORS without ACAO
-PASS making a cross-origin request with CORS
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/require-corp-sw-from-require-corp.https-expected.txt b/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/require-corp-sw-from-require-corp.https-expected.txt
deleted file mode 100644
index f26def88..0000000
--- a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/require-corp-sw-from-require-corp.https-expected.txt
+++ /dev/null
@@ -1,15 +0,0 @@
-This is a testharness.js-based test.
-PASS setting up
-PASS making a same-origin request for CORP: same-origin
-PASS making a same-origin request for no CORP
-PASS making a same-origin request for CORP: cross-origin
-PASS making a cross-origin request for CORP: same-origin
-FAIL making a cross-origin request for no CORP assert_unreached: Should have rejected: undefined Reached unreachable code
-PASS making a cross-origin request for CORP: cross-origin
-PASS making a cross-origin request for CORP: same-origin [PASS THROUGH]
-FAIL making a cross-origin request for no CORP [PASS THROUGH] assert_unreached: Should have rejected: undefined Reached unreachable code
-PASS making a cross-origin request for CORP: cross-origin [PASS THROUGH]
-PASS making a cross-origin request with CORS without ACAO
-PASS making a cross-origin request with CORS
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/require-corp-sw.https-expected.txt b/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/require-corp-sw.https-expected.txt
deleted file mode 100644
index 491e443..0000000
--- a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/require-corp-sw.https-expected.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-This is a testharness.js-based test.
-PASS Set up global state
-PASS fetch() to 'CORP: cross-origin' response should succeed.
-FAIL fetch() to no CORP response should not succeed. assert_equals: expected "TypeError: Failed to fetch" but got "opaque"
-FAIL importScripts() fails for a script with no corp. assert_unreached: Should have rejected: register() should fail. Reached unreachable code
-PASS importScripts() succeeds for a script with corp: cross-origin.
-PASS Clean up global state
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/require-corp.https-expected.txt b/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/require-corp.https-expected.txt
deleted file mode 100644
index de5188cf..0000000
--- a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/require-corp.https-expected.txt
+++ /dev/null
@@ -1,19 +0,0 @@
-This is a testharness.js-based test.
-FAIL "require-corp" top-level: navigating a frame to "none" should fail assert_equals: expected null but got Document node with 1 child
-FAIL "require-corp" top-level: navigating a frame from "require-corp" to "none" should fail assert_equals: expected null but got Document node with 1 child
-PASS "require-corp" top-level: creating a noopener "none" popup should succeed
-PASS "require-corp" top-level: creating a "none" popup should succeed.
-PASS "require-corp" top-level (as popup): navigating to "none" should succeed
-PASS "require-corp" top-level (as noopener popup): navigating to "none" should succeed
-PASS "require-corp" top-level (as popup with opener set to null): navigating to "none" should succeed
-PASS "require-corp" top-level: fetch() to CORP: cross-origin response should succeed
-FAIL "require-corp" top-level: fetch() to response without CORP should fail assert_unreached: Should have rejected: undefined Reached unreachable code
-FAIL "require-corp" top-level: fetch() to response without CORP through a WindowProxy should fail assert_unreached: Should have rejected: undefined Reached unreachable code
-FAIL "require-corp" top-level: navigating an iframe to a page without CORP, through a WindowProxy, should fail assert_equals: expected null but got Document node with 1 child
-PASS CORP: same-site is checked and allowed.
-FAIL CORP: same-site is checked and blocked. assert_false: expected false got true
-PASS navigation CORP is checked with the parent frame, not the navigation source - to be allowed
-PASS navigation CORP is checked with the parent frame, not the navigation source - to be blocked
-FAIL navigation CORP is checked for each redirect assert_false: expected false got true
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/sandbox.https-expected.txt b/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/sandbox.https-expected.txt
deleted file mode 100644
index 183a113..0000000
--- a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/sandbox.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Cross-Origin-Embedder-Policy and sandbox assert_true: Request to same-origin resource without CORP did not fail expected true got false
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/srcdoc.https-expected.txt b/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/srcdoc.https-expected.txt
deleted file mode 100644
index 5d29bb9..0000000
--- a/third_party/blink/web_tests/virtual/stable/external/wpt/html/cross-origin-embedder-policy/srcdoc.https-expected.txt
+++ /dev/null
@@ -1,4 +0,0 @@
-This is a testharness.js-based test.
-FAIL Cross-Origin-Embedder-Policy and srcdoc assert_true: Cross-origin without CORP did not fail expected true got false
-Harness: the test ran to completion.
-
diff --git a/third_party/blink/web_tests/virtual/webrtc-wpt-plan-b/external/wpt/webrtc/protocol/bundle.https-expected.txt b/third_party/blink/web_tests/virtual/webrtc-wpt-plan-b/external/wpt/webrtc/protocol/bundle.https-expected.txt
index 60ed7f43..c68615f 100644
--- a/third_party/blink/web_tests/virtual/webrtc-wpt-plan-b/external/wpt/webrtc/protocol/bundle.https-expected.txt
+++ b/third_party/blink/web_tests/virtual/webrtc-wpt-plan-b/external/wpt/webrtc/protocol/bundle.https-expected.txt
@@ -1,4 +1,5 @@
 This is a testharness.js-based test.
 FAIL not negotiating BUNDLE creates two separate ice and dtls transports assert_not_equals: got disallowed value null
+FAIL bundles on the first transport and closes the second assert_not_equals: got disallowed value null
 Harness: the test ran to completion.
 
diff --git a/third_party/closure_compiler/externs/passwords_private.js b/third_party/closure_compiler/externs/passwords_private.js
index 5124938..fd001e3 100644
--- a/third_party/closure_compiler/externs/passwords_private.js
+++ b/third_party/closure_compiler/externs/passwords_private.js
@@ -102,6 +102,8 @@
  * @typedef {{
  *   id: number,
  *   formattedOrigin: string,
+ *   detailedOrigin: string,
+ *   isAndroidCredential: boolean,
  *   changePasswordUrl: (string|undefined),
  *   signonRealm: string,
  *   username: string,
@@ -115,18 +117,10 @@
 
 /**
  * @typedef {{
- *   compromisedCredentials:
- * !Array<!chrome.passwordsPrivate.CompromisedCredential>,
- *   elapsedTimeSinceLastCheck: (string|undefined)
- * }}
- */
-chrome.passwordsPrivate.CompromisedCredentialsInfo;
-
-/**
- * @typedef {{
  *   state: !chrome.passwordsPrivate.PasswordCheckState,
  *   alreadyProcessed: (number|undefined),
- *   remainingInQueue: (number|undefined)
+ *   remainingInQueue: (number|undefined),
+ *   elapsedTimeSinceLastCheck: (string|undefined)
  * }}
  */
 chrome.passwordsPrivate.PasswordCheckStatus;
@@ -230,11 +224,11 @@
 chrome.passwordsPrivate.isOptedInForAccountStorage = function(callback) {};
 
 /**
- * Requests the latest information about compromised credentials.
- * @param {function(!chrome.passwordsPrivate.CompromisedCredentialsInfo):void}
+ * Requests the latest compromised credentials.
+ * @param {function(!Array<!chrome.passwordsPrivate.CompromisedCredential>):void}
  *     callback
  */
-chrome.passwordsPrivate.getCompromisedCredentialsInfo = function(callback) {};
+chrome.passwordsPrivate.getCompromisedCredentials = function(callback) {};
 
 /**
  * Requests the plaintext password for |credential|. |callback| gets invoked
@@ -317,7 +311,7 @@
  * Fired when the compromised credentials changed.
  * @type {!ChromeEvent}
  */
-chrome.passwordsPrivate.onCompromisedCredentialsInfoChanged;
+chrome.passwordsPrivate.onCompromisedCredentialsChanged;
 
 /**
  * Fired when the status of the password check changes.
diff --git a/third_party/protobuf/BUILD.gn b/third_party/protobuf/BUILD.gn
index 8f804d6..694aa460 100644
--- a/third_party/protobuf/BUILD.gn
+++ b/third_party/protobuf/BUILD.gn
@@ -221,10 +221,6 @@
     # Not included in production code.
     "//chrome/test:usage_time_limit_unittests",
 
-    # Catapult converts protos to JSON. Only used in tests.
-    "//third_party/catapult/tracing/tracing:histogram",
-    "//third_party/catapult/tracing/tracing:proto_test_driver",
-
     # The protobuf-based SQLite and GPU fuzzers need protobuf_full and are not
     # included in Chrome.
     "//third_party/sqlite:sqlite3_lpm_corpus_gen",
diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index c63f56768..d1d707e 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml
@@ -12999,6 +12999,20 @@
   <int value="2" label="UnsupportedIME"/>
 </enum>
 
+<enum name="CrostiniUpgradeDialogEvent">
+  <int value="0" label="Dialog Shown"/>
+  <int value="1" label="Upgrade Succeeded"/>
+  <int value="2" label="Upgrade Canceled"/>
+  <int value="3" label="Upgrade Failed"/>
+  <int value="4" label="Upgrade Not Started"/>
+  <int value="5" label="Backup Started"/>
+  <int value="6" label="Backup Succeeded"/>
+  <int value="7" label="Backup Failed"/>
+  <int value="8" label="Restore Started"/>
+  <int value="9" label="Restore Succeeded"/>
+  <int value="10" label="Restore Failed"/>
+</enum>
+
 <enum name="CrosTPMDictionaryAttackResetStatusEnum">
   <int value="0" label="Reset not necessary"/>
   <int value="1" label="Reset attempt succeeded"/>
@@ -22480,7 +22494,7 @@
   <int value="1448" label="AUTOFILLPRIVATE_GETUPIIDLIST"/>
   <int value="1449" label="WEBCAMPRIVATE_RESTORE_CAMERA_PRESET"/>
   <int value="1450" label="WEBCAMPRIVATE_SET_CAMERA_PRESET"/>
-  <int value="1451" label="PASSWORDSPRIVATE_GETCOMPROMISEDCREDENTIALSINFO"/>
+  <int value="1451" label="PASSWORDSPRIVATE_GETCOMPROMISEDCREDENTIALS"/>
   <int value="1452" label="INPUTMETHODPRIVATE_HIDEINPUTVIEW"/>
   <int value="1453" label="PASSWORDSPRIVATE_GETPLAINTEXTCOMPROMISEDPASSWORD"/>
   <int value="1454" label="PASSWORDSPRIVATE_CHANGECOMPROMISEDCREDENTIAL"/>
@@ -22490,6 +22504,7 @@
   <int value="1458" label="PASSWORDSPRIVATE_STARTPASSWORDCHECK"/>
   <int value="1459" label="PASSWORDSPRIVATE_STOPPASSWORDCHECK"/>
   <int value="1460" label="PASSWORDSPRIVATE_GETPASSWORDCHECKSTATUS"/>
+  <int value="1461" label="TERMINALPRIVATE_OPENVMSHELLPROCESS"/>
 </enum>
 
 <enum name="ExtensionIconState">
@@ -23457,7 +23472,8 @@
 </enum>
 
 <enum name="FeatureObserver">
-<!-- Generated from third_party/blink/public/mojom/web_feature/web_feature.mojom.-->
+<!-- Generated from third_party/blink/public/mojom/web_feature/web_feature.mojom.
+Called by update_use_counter_feature_enum.py.-->
 
   <int value="0" label="OBSOLETE_PageDestruction"/>
   <int value="1" label="LegacyNotifications"/>
@@ -26761,6 +26777,9 @@
   <int value="3181" label="V8RTCRtpSender_CreateEncodedVideoStreams_Method"/>
   <int value="3182" label="V8RTCRtpReceiver_CreateEncodedAudioStreams_Method"/>
   <int value="3183" label="V8RTCRtpReceiver_CreateEncodedVideoStreams_Method"/>
+  <int value="3184" label="QuicTransport"/>
+  <int value="3185" label="QuicTransportStreamApis"/>
+  <int value="3186" label="QuicTransportDatagramApis"/>
 </enum>
 
 <enum name="FeaturePolicyAllowlistType">
@@ -37888,6 +37907,7 @@
   <int value="-1327676774" label="disable-accelerated-mjpeg-decode"/>
   <int value="-1326463296" label="SSLCommittedInterstitials:disabled"/>
   <int value="-1325887476" label="NewPrintPreview:enabled"/>
+  <int value="-1324634193" label="EnablePalmOnMaxTouchMajor:disabled"/>
   <int value="-1324029365" label="EnableTLS13EarlyData:enabled"/>
   <int value="-1322882747" label="disable-datasaver-prompt"/>
   <int value="-1319688939" label="ignore-gpu-blacklist"/>
@@ -38239,6 +38259,7 @@
       label="ProcessSharingWithDefaultSiteInstances:enabled"/>
   <int value="-929944930"
       label="AutofillRationalizeRepeatedServerPredictions:disabled"/>
+  <int value="-929047480" label="ImeAssistAutocorrect:enabled"/>
   <int value="-928138978" label="IPH_DemoMode:disabled"/>
   <int value="-926422468" label="disable-embedded-shared-worker"/>
   <int value="-926236394" label="SendTabToSelfHistory:enabled"/>
@@ -39399,6 +39420,7 @@
   <int value="480677983" label="WebXRARDOMOverlay:disabled"/>
   <int value="481506759" label="ServiceWorkerScriptStreaming:enabled"/>
   <int value="482232604" label="PercentBasedScrolling:enabled"/>
+  <int value="487810392" label="EnablePalmOnToolTypePalm:enabled"/>
   <int value="492113129" label="ExperimentalAppBanners:enabled"/>
   <int value="492985975" label="use-monitor-color-space"/>
   <int value="493903641" label="disable-appcontainer"/>
@@ -39577,6 +39599,7 @@
   <int value="701766325" label="PerNavigationMojoInterface:enabled"/>
   <int value="703469777" label="AndroidNightModeTabReparenting:enabled"/>
   <int value="705407202" label="AutofillSaveCardImprovedUserConsent:disabled"/>
+  <int value="705712478" label="EnablePalmOnToolTypePalm:disabled"/>
   <int value="705713283" label="EasyUnlockPromotions:disabled"/>
   <int value="709850261" label="disable-touch-editing"/>
   <int value="710700286" label="ImmersiveFullscreen:disabled"/>
@@ -40269,11 +40292,13 @@
   <int value="1540395380" label="WebContentsOcclusion:enabled"/>
   <int value="1540487070" label="ContextualSearchDebug:enabled"/>
   <int value="1541723759" label="ServiceWorkerNavigationPreload:disabled"/>
+  <int value="1542548035" label="ImeAssistAutocorrect:disabled"/>
   <int value="1543027970" label="EnableDisplayZoomSetting:disabled"/>
   <int value="1544552792" label="InterestFeedContentSuggestions:enabled"/>
   <int value="1548776701" label="AllBookmarks:disabled"/>
   <int value="1548942246" label="PassiveDocumentEventListeners:disabled"/>
   <int value="1552753678" label="DnsHttpssvc:disabled"/>
+  <int value="1553422694" label="EnablePalmOnMaxTouchMajor:enabled"/>
   <int value="1559034872" label="AutofillPrefilledFields:enabled"/>
   <int value="1560188739" label="reader-mode-heuristics"/>
   <int value="1561781431" label="VirtualKeyboardBorderedKey:enabled"/>
@@ -43521,6 +43546,19 @@
   </int>
 </enum>
 
+<enum name="MirrorFailureType">
+  <int value="0" label="Capture Tab failed due to empty stream"/>
+  <int value="1" label="Capture Desktop failed due to timeout"/>
+  <int value="2" label="Capture Tab timed out"/>
+  <int value="3" label="Capture Desktop failed due to user cancel"/>
+  <int value="4" label="Answer not received"/>
+  <int value="5" label="Capture Tab failed due to timeout"/>
+  <int value="6" label="ICE connection closed"/>
+  <int value="7" label="Tab Media Stream Failure"/>
+  <int value="8" label="Desktop Media Stream Failure"/>
+  <int value="9" label="Unknown"/>
+</enum>
+
 <enum name="MirroringServiceErrorType">
   <int value="0" label="ANSWER_TIME_OUT"/>
   <int value="1" label="ANSWER_NOT_OK"/>
@@ -43537,6 +43575,12 @@
   <int value="12" label="CAST_TRANSPORT_ERROR"/>
 </enum>
 
+<enum name="MirrorType">
+  <int value="0" label="Tab"/>
+  <int value="1" label="Desktop"/>
+  <int value="2" label="Offscreen Tab"/>
+</enum>
+
 <enum name="MissingStartType">
   <int value="0" label="Nothing missing"/>
   <int value="1" label="Start missing"/>
@@ -44379,7 +44423,8 @@
   <int value="0" label="No Credentials."/>
   <int value="1" label="Username only."/>
   <int value="2" label="Username and password."/>
-  <int value="3" label="SSO kerberos."/>
+  <int value="3" label="SSO Kerberos AD."/>
+  <int value="4" label="SSO Kerberos Gaia."/>
 </enum>
 
 <enum name="NativeSmbFileShare_MountResult">
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 3087033..8c7c42b 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -30611,6 +30611,16 @@
   </summary>
 </histogram>
 
+<histogram name="Crostini.UpgradeDialogEvent" enum="CrostiniUpgradeDialogEvent"
+    expires_after="2021-03-06">
+  <owner>clumptini@google.com</owner>
+  <owner>tbuckley@chromium.org</owner>
+  <summary>
+    A collection of events that can occur while upgrading the crostini
+    container, recorded as they occur.
+  </summary>
+</histogram>
+
 <histogram name="Crostini.UpgradeSource" enum="CrostiniUISurface"
     expires_after="2021-01-31">
   <owner>clumptini@google.com</owner>
@@ -75686,6 +75696,52 @@
   </summary>
 </histogram>
 
+<histogram name="MediaRouter.CastStreaming.Session.Launch" units="ms"
+    expires_after="2021-02-01">
+  <owner>takumif@chromium.org</owner>
+  <owner>openscreen-eng@google.com</owner>
+  <summary>Total time to launch a Cast Streaming mirror session.</summary>
+</histogram>
+
+<histogram name="MediaRouter.CastStreaming.Session.Length" units="ms"
+    expires_after="2021-02-01">
+  <owner>takumif@chromium.org</owner>
+  <owner>openscreen-eng@google.com</owner>
+  <summary>Total length of a Cast Streaming mirror session.</summary>
+</histogram>
+
+<histogram name="MediaRouter.CastStreaming.Start.Failure"
+    enum="MirrorFailureType" expires_after="2021-02-01">
+  <owner>takumif@chromium.org</owner>
+  <owner>openscreen-eng@google.com</owner>
+  <summary>
+    Whenever a Cast Streaming session fails to start, record the error
+    associated with the event. This is recorded only for the extension Cast MRP.
+    See MediaRouter.CastStreaming.Start.Failure.Native for the native MRP.
+  </summary>
+</histogram>
+
+<histogram name="MediaRouter.CastStreaming.Start.Failure.Native"
+    enum="MirroringServiceErrorType" expires_after="2021-02-01">
+  <owner>takumif@chromium.org</owner>
+  <owner>openscreen-eng@google.com</owner>
+  <summary>
+    Whenever a Cast Streaming session fails to start, record the error
+    associated with the event. This is recorded only for the native Cast MRP.
+    See MediaRouter.CastStreaming.Start.Failure for the extension MRP.
+  </summary>
+</histogram>
+
+<histogram name="MediaRouter.CastStreaming.Start.Success" enum="MirrorType"
+    expires_after="2021-02-01">
+  <owner>takumif@chromium.org</owner>
+  <owner>openscreen-eng@google.com</owner>
+  <summary>
+    Whenever a Cast Streaming session is successfully started, record if it was
+    for a Tab or Desktop mirroring session.
+  </summary>
+</histogram>
+
 <histogram name="MediaRouter.Dial.AvailableDevicesCount" units="devices"
     expires_after="M85">
   <owner>mfoltz@chromium.org</owner>
@@ -147725,7 +147781,7 @@
 </histogram>
 
 <histogram name="Sharing.ClickToCallAppsToShow" units="apps"
-    expires_after="2020-04-19">
+    expires_after="M85">
 <!-- Name completed by histogram_suffixes name="SharingClickToCallUi" -->
 
   <owner>mvanouwerkerk@chromium.org</owner>
@@ -147752,7 +147808,7 @@
 </histogram>
 
 <histogram name="Sharing.ClickToCallDevicesToShow" units="devices"
-    expires_after="2020-04-19">
+    expires_after="M85">
 <!-- Name completed by histogram_suffixes name="SharingClickToCallUi" -->
 
   <owner>mvanouwerkerk@chromium.org</owner>
@@ -147789,7 +147845,7 @@
 </histogram>
 
 <histogram name="Sharing.ClickToCallDialogShown" enum="SharingDialogType"
-    expires_after="2020-04-19">
+    expires_after="M85">
   <owner>mvanouwerkerk@chromium.org</owner>
   <owner>knollr@chromium.org</owner>
   <summary>
@@ -147900,7 +147956,7 @@
 </histogram>
 
 <histogram name="Sharing.ClickToCallSelectedAppIndex" units="index"
-    expires_after="2020-04-19">
+    expires_after="M85">
 <!-- Name completed by histogram_suffixes name="SharingClickToCallUi" -->
 
   <owner>mvanouwerkerk@chromium.org</owner>
@@ -147912,7 +147968,7 @@
 </histogram>
 
 <histogram name="Sharing.ClickToCallSelectedDeviceIndex" units="index"
-    expires_after="2020-04-19">
+    expires_after="M85">
 <!-- Name completed by histogram_suffixes name="SharingClickToCallUi" -->
 
   <owner>mvanouwerkerk@chromium.org</owner>
@@ -148195,9 +148251,9 @@
 </histogram>
 
 <histogram name="Sharing.SharedClipboardDevicesToShow" units="devices"
-    expires_after="2020-04-19">
+    expires_after="M85">
   <owner>mvanouwerkerk@chromium.org</owner>
-  <owner>yasmo@chromium.org</owner>
+  <owner>knollr@chromium.org</owner>
   <summary>
     The number of available devices that are about to be shown in a UI for
     picking a device to share the clipboard with. On desktop, it gets recorded
@@ -148208,9 +148264,9 @@
 </histogram>
 
 <histogram name="Sharing.SharedClipboardDialogShown" enum="SharingDialogType"
-    expires_after="2020-04-19">
+    expires_after="M85">
   <owner>mvanouwerkerk@chromium.org</owner>
-  <owner>yasmo@chromium.org</owner>
+  <owner>knollr@chromium.org</owner>
   <summary>
     Logged whenever a dialog is shown for the Shared Clipboard feature.
   </summary>
@@ -148230,9 +148286,9 @@
 </histogram>
 
 <histogram name="Sharing.SharedClipboardSelectedDeviceIndex" units="index"
-    expires_after="2020-04-19">
+    expires_after="M85">
   <owner>mvanouwerkerk@chromium.org</owner>
-  <owner>yasmo@chromium.org</owner>
+  <owner>knollr@chromium.org</owner>
   <summary>
     The index of the device selected by the user for Shared Clipboard gets
     recorded when the user chooses the destination device for sharing text. Zero
@@ -148241,9 +148297,9 @@
 </histogram>
 
 <histogram name="Sharing.SharedClipboardSelectedTextSize" units="characters"
-    expires_after="2020-04-19">
+    expires_after="M85">
   <owner>mvanouwerkerk@chromium.org</owner>
-  <owner>yasmo@chromium.org</owner>
+  <owner>knollr@chromium.org</owner>
   <summary>
     The size of the selected text in Shared Clipboard gets recorded when the
     user shares selected text.
diff --git a/ui/accessibility/ax_language_detection.cc b/ui/accessibility/ax_language_detection.cc
index f0eec87..7a5f844a 100644
--- a/ui/accessibility/ax_language_detection.cc
+++ b/ui/accessibility/ax_language_detection.cc
@@ -21,19 +21,22 @@
 namespace {
 // This is the maximum number of languages we assign per page, so only the top
 // 3 languages on the top will be assigned to any node.
-const auto kMaxDetectedLanguagesPerPage = 3;
+const int kMaxDetectedLanguagesPerPage = 3;
 
 // This is the maximum number of languages that cld3 will detect for each
 // input we give it, 3 was recommended to us by the ML team as a good
 // starting point.
-const auto kMaxDetectedLanguagesPerSpan = 3;
+const int kMaxDetectedLanguagesPerSpan = 3;
 
-const auto kShortTextIdentifierMinByteLength = 1;
-// TODO(https://bugs.chromium.org/p/chromium/issues/detail?id=971360):
-// Determine appropriate value for kShortTextIdentifierMaxByteLength.
-const auto kShortTextIdentifierMaxByteLength = 1000;
+const int kShortTextIdentifierMinByteLength = 1;
+// TODO(https://crbug.com/971360): Determine appropriate value for
+// |kShortTextIdentifierMaxByteLength|.
+const int kShortTextIdentifierMaxByteLength = 1000;
 }  // namespace
 
+using Result = chrome_lang_id::NNetLanguageIdentifier::Result;
+using SpanInfo = chrome_lang_id::NNetLanguageIdentifier::SpanInfo;
+
 AXLanguageInfo::AXLanguageInfo() = default;
 AXLanguageInfo::~AXLanguageInfo() = default;
 
@@ -54,7 +57,7 @@
 
   // Assign languages with higher probability a higher score.
   // TODO(chrishall): consider more complex scoring
-  size_t score = kMaxDetectedLanguagesPerSpan;
+  unsigned int score = kMaxDetectedLanguagesPerSpan;
   for (const auto& lang : languages) {
     lang_counts_[lang] += score;
 
@@ -260,17 +263,18 @@
   // concatenation and bubbling up results.
   auto text = node->GetStringAttribute(ax::mojom::StringAttribute::kName);
 
-  // FindTopNMostFreqLangs will pad the results with
-  // NNetLanguageIdentifier::kUnknown in order to reach the requested number
+  // FindTopNMostFreqLangs() will pad the results with
+  // |NNetLanguageIdentifier::kUnknown| in order to reach the requested number
   // of languages, this means we cannot rely on the results' length and we
   // have to filter the results.
-  const auto results = language_identifier_.FindTopNMostFreqLangs(
-      text, kMaxDetectedLanguagesPerSpan);
+  const std::vector<Result> results =
+      language_identifier_.FindTopNMostFreqLangs(text,
+                                                 kMaxDetectedLanguagesPerSpan);
 
   std::vector<std::string> reliable_results;
 
   for (const auto& res : results) {
-    // The output of FindTopNMostFreqLangs is already sorted by byte count,
+    // The output of FindTopNMostFreqLangs() is already sorted by byte count,
     // this seems good enough for now.
     // Only consider results which are 'reliable', this will also remove
     // 'unknown'.
@@ -405,13 +409,12 @@
   // Calculate top 3 languages.
   // TODO(akihiroota): What's a reasonable number of languages to have
   // cld_3 find? Should vary.
-  std::vector<chrome_lang_id::NNetLanguageIdentifier::Result> top_languages =
+  std::vector<Result> top_languages =
       short_text_language_identifier_.FindTopNMostFreqLangs(
           attr_value, kMaxDetectedLanguagesPerPage);
   // Create vector of AXLanguageSpans.
   for (const auto& result : top_languages) {
-    std::vector<chrome_lang_id::NNetLanguageIdentifier::SpanInfo> ranges =
-        result.byte_ranges;
+    std::vector<SpanInfo> ranges = result.byte_ranges;
     for (const auto& span_info : ranges) {
       language_annotation.push_back(
           AXLanguageSpan{span_info.start_index, span_info.end_index,
diff --git a/ui/events/test/scoped_event_test_tick_clock.h b/ui/events/test/scoped_event_test_tick_clock.h
index baaece6..03aba7e2 100644
--- a/ui/events/test/scoped_event_test_tick_clock.h
+++ b/ui/events/test/scoped_event_test_tick_clock.h
@@ -6,6 +6,7 @@
 #define UI_EVENTS_TEST_SCOPED_EVENT_TEST_TICK_CLOCK_H_
 
 #include "base/test/simple_test_tick_clock.h"
+#include "base/time/time.h"
 #include "ui/events/base_event_utils.h"
 
 namespace ui {
@@ -32,6 +33,8 @@
 
   void SetNowTicks(base::TimeTicks ticks) { test_clock_.SetNowTicks(ticks); }
 
+  void Advance(base::TimeDelta delta) { test_clock_.Advance(delta); }
+
  private:
   base::SimpleTestTickClock test_clock_;
 
diff --git a/ui/events/x/x11_event_translation_unittest.cc b/ui/events/x/x11_event_translation_unittest.cc
index 7158ed66..0f922a24 100644
--- a/ui/events/x/x11_event_translation_unittest.cc
+++ b/ui/events/x/x11_event_translation_unittest.cc
@@ -4,7 +4,6 @@
 
 #include "ui/events/x/x11_event_translation.h"
 
-#include "base/test/simple_test_tick_clock.h"
 #include "base/time/time.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/events/base_event_utils.h"
@@ -15,6 +14,7 @@
 #include "ui/events/test/events_test_utils.h"
 #include "ui/events/test/events_test_utils_x11.h"
 #include "ui/events/test/keyboard_layout.h"
+#include "ui/events/test/scoped_event_test_tick_clock.h"
 #include "ui/events/types/event_type.h"
 #include "ui/gfx/x/x11.h"
 
@@ -92,8 +92,7 @@
   scoped_xev.InitKeyEvent(ET_KEY_PRESSED, VKEY_RETURN, EF_NONE);
   XEvent* xev = scoped_xev;
 
-  base::SimpleTestTickClock test_clock;
-  ui::SetEventTickClockForTesting(&test_clock);
+  test::ScopedEventTestTickClock test_clock;
   test_clock.Advance(TimeDelta::FromSeconds(1));
 
   // Set initial time as 1000ms
diff --git a/ui/file_manager/file_manager/foreground/elements/files_quick_view.html b/ui/file_manager/file_manager/foreground/elements/files_quick_view.html
index caa7fe8..799b8a0f 100644
--- a/ui/file_manager/file_manager/foreground/elements/files_quick_view.html
+++ b/ui/file_manager/file_manager/foreground/elements/files_quick_view.html
@@ -26,7 +26,7 @@
         </div>
         <div id="file-path">[[filePath]]</div>
         <div class="buttons-group">
-           <cr-button id="open-button" on-click="onOpenInNewButtonTap" hidden$="[[!shouldShowOpenButton_(hasTask, isModal)]]" aria-label="$i18n{QUICK_VIEW_OPEN_IN_NEW_BUTTON_LABEL}">
+           <cr-button id="open-button" on-click="onOpenInNewButtonTap" hidden$="[[!shouldShowOpenButton_(hasTask, isModal)]]" aria-label="$i18n{QUICK_VIEW_OPEN_IN_NEW_BUTTON_LABEL}" has-tooltip>
             <span class="icon">$i18n{QUICK_VIEW_OPEN_IN_NEW_BUTTON_LABEL}</span>
           </cr-button>
            <cr-button id="delete-button" on-click="onDeleteButtonTap" hidden$="[[!shouldShowDeleteButton_(canDelete, isModal)]]" aria-label="$i18n{QUICK_VIEW_DELETE_BUTTON_LABEL}" has-tooltip>
diff --git a/ui/file_manager/file_manager/foreground/js/ui/breadcrumb.js b/ui/file_manager/file_manager/foreground/js/ui/breadcrumb.js
index b40ed34..699ff51 100644
--- a/ui/file_manager/file_manager/foreground/js/ui/breadcrumb.js
+++ b/ui/file_manager/file_manager/foreground/js/ui/breadcrumb.js
@@ -21,7 +21,7 @@
       white-space: nowrap;
     }
 
-    span.caret {
+    span[caret] {
       -webkit-mask-image: url(../../images/files/ui/arrow_right.svg);
       -webkit-mask-position: center;
       -webkit-mask-repeat: no-repeat;
@@ -32,7 +32,7 @@
       width: 20px;
     }
 
-    :host-context(html[dir='rtl']) span.caret {
+    :host-context(html[dir='rtl']) span[caret] {
       transform: scaleX(-1);
     }
 
@@ -141,16 +141,16 @@
   </style>
 
   <button id='first'></button>
-  <span class='caret' hidden></span>
+  <span caret hidden></span>
   <button elider aria-haspopup='menu' aria-expanded='false'
       aria-label='$i18n{LOCATION_BREADCRUMB_ELIDER_BUTTON_LABEL}'>
     <span elider></span>
   </button>
-  <span class='caret' hidden></span>
+  <span caret hidden></span>
   <button id='second'></button>
-  <span class='caret' hidden></span>
+  <span caret hidden></span>
   <button id='third'></button>
-  <span class='caret' hidden></span>
+  <span caret hidden></span>
   <button id='fourth'></button>
   <cr-action-menu id='elider-menu'></cr-menu-item>
 `;
@@ -239,7 +239,7 @@
 
     function setButton(i, text) {
       const previousSibling = buttons[i].previousElementSibling;
-      if (previousSibling.classList.contains('caret')) {
+      if (previousSibling.hasAttribute('caret')) {
         previousSibling.hidden = !text;
       }
 
diff --git a/ui/file_manager/file_manager/foreground/js/ui/file_manager_ui.js b/ui/file_manager/file_manager/foreground/js/ui/file_manager_ui.js
index d3e1cc0d6..bae48d48 100644
--- a/ui/file_manager/file_manager/foreground/js/ui/file_manager_ui.js
+++ b/ui/file_manager/file_manager/foreground/js/ui/file_manager_ui.js
@@ -170,10 +170,6 @@
         queryRequiredElement('#search-box', this.element),
         queryRequiredElement('#search-wrapper', this.element),
         queryRequiredElement('#search-button', this.element));
-    // Add a listener to the dialog container for hiding the search box.
-    this.dialogContainer.addEventListener('click', (event) => {
-      this.searchBox.removeHidePending(event);
-    });
 
     /**
      * Empty folder UI.
diff --git a/ui/file_manager/file_manager/foreground/js/ui/search_box.js b/ui/file_manager/file_manager/foreground/js/ui/search_box.js
index 5bad824..241dce5 100644
--- a/ui/file_manager/file_manager/foreground/js/ui/search_box.js
+++ b/ui/file_manager/file_manager/foreground/js/ui/search_box.js
@@ -79,6 +79,9 @@
     this.autocompleteList.handleEnterKeydown = dispatchItemSelect;
     this.autocompleteList.addEventListener('mousedown', dispatchItemSelect);
 
+    this.searchWrapper.addEventListener(
+        'focusout', this.onFocusOut_.bind(this));
+
     // Append dynamically created element.
     element.parentNode.appendChild(this.autocompleteList);
   }
@@ -101,6 +104,21 @@
   }
 
   /**
+   * Focus out event handler.
+   * @private
+   */
+  onFocusOut_() {
+    window.requestAnimationFrame(() => {
+      // If the focus is still within the search box don't hide the input.
+      if (document.activeElement &&
+          this.searchWrapper.contains(document.activeElement)) {
+        return;
+      }
+      this.removeHidePending();
+    });
+  }
+
+  /**
    * @private
    */
   onInput_() {
@@ -142,22 +160,11 @@
 
   /**
    * Handles delayed hiding of the search box (until click).
-   * @param {Event} event
    */
-  removeHidePending(event) {
-    if (this.element.classList.contains('hide-pending')) {
-      // If the search box was waiting to hide, but we clicked on it, don't.
-      if (event.target === this.inputElement) {
-        this.element.classList.toggle('hide-pending', false);
-        this.searchWrapper.classList.toggle('hide-pending', false);
-        this.onFocus_();
-      } else {
-        // When input has any text we keep it displayed with current search.
-        this.inputElement.disabled = this.inputElement.value.length == 0;
-        this.element.classList.toggle('hide-pending', false);
-        this.searchWrapper.classList.toggle('hide-pending', false);
-      }
-    }
+  removeHidePending() {
+    this.inputElement.disabled = this.inputElement.value.length == 0;
+    this.element.classList.toggle('hide-pending', false);
+    this.searchWrapper.classList.toggle('hide-pending', false);
   }
 
   /**
diff --git a/weblayer/browser/android/javatests/src/org/chromium/weblayer/test/BrowserFragmentLifecycleTest.java b/weblayer/browser/android/javatests/src/org/chromium/weblayer/test/BrowserFragmentLifecycleTest.java
index c9253407..9813413 100644
--- a/weblayer/browser/android/javatests/src/org/chromium/weblayer/test/BrowserFragmentLifecycleTest.java
+++ b/weblayer/browser/android/javatests/src/org/chromium/weblayer/test/BrowserFragmentLifecycleTest.java
@@ -94,11 +94,11 @@
         TestThreadUtils.runOnUiThreadBlocking(() -> {
             // It's possible the NavigationController hasn't loaded yet, handle either scenario.
             NavigationController navigationController = tab.getNavigationController();
-            if (navigationController.getNavigationListSize() == 1
-                    && navigationController.getNavigationEntryDisplayUri(0).equals(
-                            Uri.parse(url))) {
-                latch.countDown();
-                return;
+            for (int i = 0; i < navigationController.getNavigationListSize(); ++i) {
+                if (navigationController.getNavigationEntryDisplayUri(i).equals(Uri.parse(url))) {
+                    latch.countDown();
+                    return;
+                }
             }
             navigationController.registerNavigationCallback(new NavigationCallback() {
                 @Override