Google Git
Sign in
chromium / chromium / src / a086f601b6..c1080aff90 / .
diff --git a/DEPS b/DEPS
index 8ca96b29..d6db4f49 100644
--- a/DEPS
+++ b/DEPS

@@ -40,11 +40,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': 'f975b3eb65bb923cde5df6ff154d5c040271c450',
+  'skia_revision': '222958d5cbd46af9e643eb77186efceb176dd95d',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': 'a26d817d0c15c30ff2a9575e97da82dca84a759f',
+  'v8_revision': '8e20b3fc2b78eb04d9315af65547bb2f0bcf18fc',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -64,7 +64,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling PDFium
   # and whatever else without interference from each other.
-  'pdfium_revision': '4b95360b7611aa73f928de2dc47390f78573c6cc',
+  'pdfium_revision': 'e17011dc1f5d046dc60c3347b89c0aad7d674dff',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling openmax_dl
   # and whatever else without interference from each other.

diff --git a/WATCHLISTS b/WATCHLISTS
index e780b80..2c4b470 100644
--- a/WATCHLISTS
+++ b/WATCHLISTS

@@ -1997,7 +1997,7 @@
     'extension': ['chromium-apps-reviews@chromium.org',
                   'extensions-reviews@chromium.org'],
     'feature_policy': ['loonybear@chromium.org',
-                       'iclelland@chromium.org'],
+                       'iclelland+watch@chromium.org'],
     'feedback_ui': ['apacible+watch@chromium.org'],
     'fileapi': ['kinuko+fileapi@chromium.org',
                 'nhiroki@chromium.org',
@@ -2142,7 +2142,7 @@
     'omnibox': ['jdonnelly+watch@chromium.org'],
     'options': ['michaelpg+watch-options@chromium.org'],
     'origin_trials': ['chasej+watch@chromium.org',
-                      'iclelland+watch@chromuim.org'],
+                      'iclelland+watch@chromium.org'],
     'ozone': ['kalyan.kondapally@intel.com',
               'ozone-reviews@chromium.org'],
     'page_info' : ['lgarron+watch@chromium.org',

diff --git a/base/threading/thread_restrictions.h b/base/threading/thread_restrictions.h
index e9f8017..1ef8d6b1 100644
--- a/base/threading/thread_restrictions.h
+++ b/base/threading/thread_restrictions.h

@@ -88,6 +88,10 @@
 class ScreenMus;
 }
 
+namespace viz {
+class ServerGpuMemoryBufferManager;
+}
+
 namespace base {
 
 namespace android {
@@ -238,6 +242,7 @@
   friend class content::SoftwareOutputDeviceMus;  // Interim non-production code
 #endif
   friend class views::ScreenMus;
+  friend class viz::ServerGpuMemoryBufferManager;
 // END USAGE THAT NEEDS TO BE FIXED.
 
 #if DCHECK_IS_ON()

diff --git a/build/android/gyp/proguard.py b/build/android/gyp/proguard.py
index 8cfa27b7..a15e518 100755
--- a/build/android/gyp/proguard.py
+++ b/build/android/gyp/proguard.py

@@ -102,7 +102,8 @@
       options,
       input_paths=input_paths,
       input_strings=proguard.build(),
-      output_paths=[options.output_path])
+      output_paths=[options.output_path],
+      depfile_deps=proguard.GetDepfileDeps())
 
 
 if __name__ == '__main__':

diff --git a/build/android/gyp/util/proguard_util.py b/build/android/gyp/util/proguard_util.py
index be6eae2..dd1f06c 100644
--- a/build/android/gyp/util/proguard_util.py
+++ b/build/android/gyp/util/proguard_util.py

@@ -150,17 +150,23 @@
     self._cmd = cmd
     return self._cmd
 
-  def GetInputs(self):
+  def GetDepfileDeps(self):
+    # The list of inputs that the GN target does not directly know about.
     self.build()
-    inputs = [self._proguard_jar_path] + self._configs + self._injars
-    if self._mapping:
-      inputs.append(self._mapping)
+    inputs = self._configs + self._injars
     if self._libraries:
       inputs += self._libraries
     if self._tested_apk_info_path:
       inputs += [self._tested_apk_info_path]
     return inputs
 
+  def GetInputs(self):
+    inputs = self.GetDepfileDeps()
+    inputs += [self._proguard_jar_path]
+    if self._mapping:
+      inputs.append(self._mapping)
+    return inputs
+
   def _WriteFlagsFile(self, out):
     # Quite useful for auditing proguard flags.
     for config in sorted(self._configs):

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VrShell.java b/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VrShell.java
index b011d0c..ace20d0 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VrShell.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VrShell.java

@@ -37,7 +37,8 @@
     /**
      * Sets whether we're presenting WebVR content or not.
      */
-    void setWebVrModeEnabled(boolean enabled, boolean autoPresented);
+    // TODO: Refactor needed. See crbug.com/735169.
+    void setWebVrModeEnabled(boolean enabled, boolean autoPresented, boolean showToast);
 
     /**
      * Returns true if we're presenting WebVR content.

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VrShellDelegate.java b/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VrShellDelegate.java
index 50855cc..8f5cbecf 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VrShellDelegate.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VrShellDelegate.java

@@ -651,7 +651,7 @@
         boolean webVrMode = mRequestedWebVr || tentativeWebVrMode;
         mVrShell.initializeNative(mActivity.getActivityTab(), webVrMode, mAutopresentWebVr,
                 mActivity instanceof CustomTabActivity);
-        mVrShell.setWebVrModeEnabled(webVrMode, mAutopresentWebVr);
+        mVrShell.setWebVrModeEnabled(webVrMode, mAutopresentWebVr, false);
         mAutopresentWebVr = false;
 
         // We're entering VR, but not in WebVr mode.
@@ -748,7 +748,7 @@
         mRequestedWebVr = true;
         switch (enterVrInternal()) {
             case ENTER_VR_NOT_NECESSARY:
-                mVrShell.setWebVrModeEnabled(true, mAutopresentWebVr);
+                mVrShell.setWebVrModeEnabled(true, mAutopresentWebVr, true);
                 maybeSetPresentResult(true);
                 break;
             case ENTER_VR_CANCELLED:
@@ -803,7 +803,7 @@
         } else {
             mVrBrowserUsed = true;
             mAutopresentWebVr = false;
-            mVrShell.setWebVrModeEnabled(false, false);
+            mVrShell.setWebVrModeEnabled(false, false, false);
         }
         return true;
     }

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VrShellImpl.java b/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VrShellImpl.java
index 53190ec..6b69793 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VrShellImpl.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/vr_shell/VrShellImpl.java

@@ -538,9 +538,9 @@
     }
 
     @Override
-    public void setWebVrModeEnabled(boolean enabled, boolean autoPresented) {
+    public void setWebVrModeEnabled(boolean enabled, boolean autoPresented, boolean showToast) {
         mContentVrWindowAndroid.setVSyncPaused(enabled);
-        nativeSetWebVrMode(mNativeVrShell, enabled, autoPresented);
+        nativeSetWebVrMode(mNativeVrShell, enabled, autoPresented, showToast);
 
         updateWebVrDisplaySize(enabled);
     }
@@ -721,7 +721,7 @@
     private native void nativeContentPhysicalBoundsChanged(long nativeVrShell, int width,
             int height, float dpr);
     private native void nativeSetWebVrMode(
-            long nativeVrShell, boolean enabled, boolean autoPresented);
+            long nativeVrShell, boolean enabled, boolean autoPresented, boolean showToast);
     private native boolean nativeGetWebVrMode(long nativeVrShell);
     private native void nativeOnTabListCreated(long nativeVrShell, Tab[] mainTabs,
             Tab[] incognitoTabs);

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/webapps/WebappLauncherActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/webapps/WebappLauncherActivity.java
index 2faec72f..d39e39e 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/webapps/WebappLauncherActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/webapps/WebappLauncherActivity.java

@@ -194,8 +194,6 @@
         // Activity.
         launchIntent.setAction(Intent.ACTION_VIEW);
         launchIntent.setData(Uri.parse(WebappActivity.WEBAPP_SCHEME + "://" + info.id()));
-        launchIntent.setFlags(
-                Intent.FLAG_ACTIVITY_NEW_TASK | ApiCompatibilityUtils.getActivityNewDocumentFlag());
         // Setting FLAG_ACTIVITY_CLEAR_TOP handles 2 edge cases:
         // - If a legacy PWA is launching from a notification, we want to ensure that the URL being
         // launched is the URL in the intent. If a paused WebappActivity exists for this id,
@@ -206,7 +204,9 @@
         // clicks a link to takes them back to the scope of a WebAPK, we want to destroy the
         // CustomTabActivity activity and go back to the WebAPK activity. It is intentional that
         // Custom Tab will not be reachable with a back button.
-        launchIntent.setFlags(Intent.FLAG_ACTIVITY_CLEAR_TOP);
+        launchIntent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK
+                | ApiCompatibilityUtils.getActivityNewDocumentFlag()
+                | Intent.FLAG_ACTIVITY_CLEAR_TOP);
         return launchIntent;
     }
 

diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index 9d70886..80911310 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd

@@ -12341,6 +12341,13 @@
         Sharing screen
       </message>
     </if>
+
+    <!-- VR specific strings -->
+    <if expr="enable_vr">
+      <message name="IDS_PRESS_APP_TO_EXIT" desc="Text displayed in a transient bubble to tell users how to return from cinema mode (where the page displayed in a cinema like environment) or presentation mode (where the WebVR page occupies the entire screen) to normal mode.">
+        Press App button to exit
+      </message>
+    </if>
   </messages>
  </release>
 </grit>

diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
index affa2ae..452c4ac 100644
--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn

@@ -10,6 +10,7 @@
 import("//chrome/common/features.gni")
 import("//components/offline_pages/features/features.gni")
 import("//components/os_crypt/features.gni")
+import("//components/signin/features.gni")
 import("//components/spellcheck/spellcheck_build_features.gni")
 import("//device/vr/features/features.gni")
 import("//extensions/features/features.gni")
@@ -1573,6 +1574,8 @@
     "//components/security_state/core",
     "//components/sessions",
     "//components/signin/core/browser",
+    "//components/signin/core/common",
+    "//components/signin/core/common:signin_features",
     "//components/spellcheck:build_features",
     "//components/ssl_config",
     "//components/ssl_errors",
@@ -2002,6 +2005,12 @@
       sources -= [ "background/background_mode_manager_aura.cc" ]
     }
   }
+  if (enable_dice_support) {
+    sources += [
+      "signin/dice_response_handler.cc",
+      "signin/dice_response_handler.h",
+    ]
+  }
   if (enable_spellcheck) {
     sources += [
       "spellchecker/spell_check_host_impl.cc",

diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
index 3819af3..b0bc51d 100644
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc

@@ -66,6 +66,7 @@
 #include "components/proximity_auth/switches.h"
 #include "components/security_state/core/security_state.h"
 #include "components/security_state/core/switches.h"
+#include "components/signin/core/common/signin_features.h"
 #include "components/signin/core/common/signin_switches.h"
 #include "components/spellcheck/common/spellcheck_features.h"
 #include "components/spellcheck/common/spellcheck_switches.h"
@@ -305,15 +306,17 @@
     {flag_descriptions::kDefaultTileHeightVenti, switches::kDefaultTileHeight,
      "1024"}};
 
-#if !defined(OS_ANDROID)
+#if !BUILDFLAG(ENABLE_MIRROR)
 const FeatureEntry::Choice kAccountConsistencyChoices[] = {
     {flags_ui::kGenericExperimentChoiceDefault, "", ""},
     {flag_descriptions::kAccountConsistencyChoiceMirror,
      switches::kAccountConsistency, switches ::kAccountConsistencyMirror},
+#if BUILDFLAG(ENABLE_DICE_SUPPORT)
     {flag_descriptions::kAccountConsistencyChoiceDice,
      switches::kAccountConsistency, switches::kAccountConsistencyDice},
+#endif  // BUILDFLAG(ENABLE_DICE_SUPPORT)
 };
-#endif
+#endif  // !BUILDFLAG(ENABLE_MIRROR)
 
 const FeatureEntry::Choice kSimpleCacheBackendChoices[] = {
     {flags_ui::kGenericExperimentChoiceDefault, "", ""},
@@ -1671,10 +1674,10 @@
      flag_descriptions::kWebglDraftExtensionsName,
      flag_descriptions::kWebglDraftExtensionsDescription, kOsAll,
      SINGLE_VALUE_TYPE(switches::kEnableWebGLDraftExtensions)},
-#if !defined(OS_ANDROID)
+#if !BUILDFLAG(ENABLE_MIRROR)
     {"account-consistency", flag_descriptions::kAccountConsistencyName,
-     flag_descriptions::kAccountConsistencyDescription,
-     kOsWin | kOsLinux | kOsMac, MULTI_VALUE_TYPE(kAccountConsistencyChoices)},
+     flag_descriptions::kAccountConsistencyDescription, kOsAll,
+     MULTI_VALUE_TYPE(kAccountConsistencyChoices)},
 #endif
 #if BUILDFLAG(ENABLE_APP_LIST)
     {"reset-app-list-install-state",

diff --git a/chrome/browser/android/vr_shell/BUILD.gn b/chrome/browser/android/vr_shell/BUILD.gn
index ae59fe80..8135050 100644
--- a/chrome/browser/android/vr_shell/BUILD.gn
+++ b/chrome/browser/android/vr_shell/BUILD.gn

@@ -44,6 +44,8 @@
     "textures/insecure_content_transient_texture.h",
     "textures/loading_indicator_texture.cc",
     "textures/loading_indicator_texture.h",
+    "textures/presentation_toast_texture.cc",
+    "textures/presentation_toast_texture.h",
     "textures/render_text_wrapper.cc",
     "textures/render_text_wrapper.h",
     "textures/system_indicator_texture.cc",
@@ -69,6 +71,8 @@
     "ui_elements/location_access_indicator.h",
     "ui_elements/permanent_security_warning.cc",
     "ui_elements/permanent_security_warning.h",
+    "ui_elements/presentation_toast.cc",
+    "ui_elements/presentation_toast.h",
     "ui_elements/screen_capture_indicator.cc",
     "ui_elements/screen_capture_indicator.h",
     "ui_elements/screen_dimmer.cc",

diff --git a/chrome/browser/android/vr_shell/color_scheme.cc b/chrome/browser/android/vr_shell/color_scheme.cc
index ec78f6b..01f1941 100644
--- a/chrome/browser/android/vr_shell/color_scheme.cc
+++ b/chrome/browser/android/vr_shell/color_scheme.cc

@@ -40,6 +40,11 @@
       normal_scheme.exit_warning_foreground;
   normal_scheme.transient_warning_background =
       normal_scheme.exit_warning_background;
+  normal_scheme.presentation_toast_foreground =
+      normal_scheme.exit_warning_foreground;
+  normal_scheme.presentation_toast_background =
+      normal_scheme.exit_warning_background;
+
   normal_scheme.permanent_warning_foreground = 0xFF444444;
   normal_scheme.permanent_warning_background = SK_ColorWHITE;
   normal_scheme.system_indicator_foreground =

diff --git a/chrome/browser/android/vr_shell/color_scheme.h b/chrome/browser/android/vr_shell/color_scheme.h
index 2e86b38..c943841 100644
--- a/chrome/browser/android/vr_shell/color_scheme.h
+++ b/chrome/browser/android/vr_shell/color_scheme.h

@@ -45,6 +45,8 @@
   SkColor exit_warning_background;
   SkColor transient_warning_foreground;
   SkColor transient_warning_background;
+  SkColor presentation_toast_foreground;
+  SkColor presentation_toast_background;
   SkColor permanent_warning_foreground;
   SkColor permanent_warning_background;
   SkColor system_indicator_foreground;

diff --git a/chrome/browser/android/vr_shell/textures/presentation_toast_texture.cc b/chrome/browser/android/vr_shell/textures/presentation_toast_texture.cc
new file mode 100644
index 0000000..2729b85
--- /dev/null
+++ b/chrome/browser/android/vr_shell/textures/presentation_toast_texture.cc

@@ -0,0 +1,73 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/android/vr_shell/textures/presentation_toast_texture.h"
+
+#include "cc/paint/skia_paint_canvas.h"
+#include "chrome/grit/generated_resources.h"
+#include "ui/base/l10n/l10n_util.h"
+#include "ui/gfx/canvas.h"
+#include "ui/gfx/font_list.h"
+#include "ui/gfx/geometry/rect.h"
+#include "ui/gfx/geometry/vector2d.h"
+#include "ui/gfx/render_text.h"
+
+namespace vr_shell {
+
+namespace {
+
+constexpr float kBorderFactor = 0.045;
+constexpr float kFontSizeFactor = 0.048;
+constexpr float kTextWidthFactor = 1.0 - 3 * kBorderFactor;
+
+}  // namespace
+
+PresentationToastTexture::PresentationToastTexture() = default;
+
+PresentationToastTexture::~PresentationToastTexture() = default;
+
+void PresentationToastTexture::Draw(SkCanvas* sk_canvas,
+                                    const gfx::Size& texture_size) {
+  cc::SkiaPaintCanvas paint_canvas(sk_canvas);
+  gfx::Canvas gfx_canvas(&paint_canvas, 1.0f);
+  gfx::Canvas* canvas = &gfx_canvas;
+
+  size_.set_width(texture_size.width());
+  SkPaint paint;
+
+  paint.setColor(color_scheme().presentation_toast_background);
+  auto text = l10n_util::GetStringUTF16(IDS_PRESS_APP_TO_EXIT);
+  gfx::FontList fonts;
+  GetFontList(size_.width() * kFontSizeFactor, text, &fonts);
+  gfx::Rect text_size(size_.width() * kTextWidthFactor, 0);
+
+  std::vector<std::unique_ptr<gfx::RenderText>> lines = PrepareDrawStringRect(
+      text, fonts, color_scheme().presentation_toast_foreground, &text_size,
+      kTextAlignmentCenter, kWrappingBehaviorWrap);
+
+  DCHECK_LE(text_size.height(),
+            static_cast<int>((1.0 - 2 * kBorderFactor) * size_.width()));
+  size_.set_height(size_.width() * 2 * kBorderFactor + text_size.height());
+  float radius = size_.width() * kBorderFactor;
+  sk_canvas->drawRoundRect(SkRect::MakeWH(size_.width(), size_.height()),
+                           radius, radius, paint);
+
+  canvas->Save();
+  canvas->Translate(gfx::Vector2d(size_.width() * kBorderFactor,
+                                  size_.width() * kBorderFactor));
+  for (auto& render_text : lines)
+    render_text->Draw(canvas);
+  canvas->Restore();
+}
+
+gfx::Size PresentationToastTexture::GetPreferredTextureSize(
+    int maximum_width) const {
+  return gfx::Size(maximum_width, maximum_width);
+}
+
+gfx::SizeF PresentationToastTexture::GetDrawnSize() const {
+  return size_;
+}
+
+}  // namespace vr_shell

diff --git a/chrome/browser/android/vr_shell/textures/presentation_toast_texture.h b/chrome/browser/android/vr_shell/textures/presentation_toast_texture.h
new file mode 100644
index 0000000..649b1e6
--- /dev/null
+++ b/chrome/browser/android/vr_shell/textures/presentation_toast_texture.h

@@ -0,0 +1,30 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_ANDROID_VR_SHELL_TEXTURES_PRESENTATION_TOAST_TEXTURE_H_
+#define CHROME_BROWSER_ANDROID_VR_SHELL_TEXTURES_PRESENTATION_TOAST_TEXTURE_H_
+
+#include "base/macros.h"
+#include "chrome/browser/android/vr_shell/textures/ui_texture.h"
+
+namespace vr_shell {
+
+class PresentationToastTexture : public UiTexture {
+ public:
+  PresentationToastTexture();
+  ~PresentationToastTexture() override;
+  gfx::Size GetPreferredTextureSize(int width) const override;
+  gfx::SizeF GetDrawnSize() const override;
+
+ private:
+  void Draw(SkCanvas* canvas, const gfx::Size& texture_size) override;
+
+  gfx::SizeF size_;
+
+  DISALLOW_COPY_AND_ASSIGN(PresentationToastTexture);
+};
+
+}  // namespace vr_shell
+
+#endif  // CHROME_BROWSER_ANDROID_VR_SHELL_TEXTURES_PRESENTATION_TOAST_TEXTURE_H_

diff --git a/chrome/browser/android/vr_shell/ui_elements/presentation_toast.cc b/chrome/browser/android/vr_shell/ui_elements/presentation_toast.cc
new file mode 100644
index 0000000..a2b4a87
--- /dev/null
+++ b/chrome/browser/android/vr_shell/ui_elements/presentation_toast.cc

@@ -0,0 +1,22 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/android/vr_shell/ui_elements/presentation_toast.h"
+
+#include "base/memory/ptr_util.h"
+#include "chrome/browser/android/vr_shell/textures/presentation_toast_texture.h"
+
+namespace vr_shell {
+
+PresentationToast::PresentationToast(int preferred_width)
+    : TexturedElement(preferred_width),
+      texture_(base::MakeUnique<PresentationToastTexture>()) {}
+
+PresentationToast::~PresentationToast() = default;
+
+UiTexture* PresentationToast::GetTexture() const {
+  return texture_.get();
+}
+
+}  // namespace vr_shell

diff --git a/chrome/browser/android/vr_shell/ui_elements/presentation_toast.h b/chrome/browser/android/vr_shell/ui_elements/presentation_toast.h
new file mode 100644
index 0000000..f131798b
--- /dev/null
+++ b/chrome/browser/android/vr_shell/ui_elements/presentation_toast.h

@@ -0,0 +1,34 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_ANDROID_VR_SHELL_UI_ELEMENTS_PRESENTATION_TOAST_H_
+#define CHROME_BROWSER_ANDROID_VR_SHELL_UI_ELEMENTS_PRESENTATION_TOAST_H_
+
+#include <memory>
+
+#include "base/macros.h"
+#include "chrome/browser/android/vr_shell/ui_elements/textured_element.h"
+
+namespace vr_shell {
+
+class UiTexture;
+
+// TODO(bshe): A lot code duplication with exit_warning_texture and
+// insecure_content_transient_texture. Consider refactor(see crbug.com/735166).
+class PresentationToast : public TexturedElement {
+ public:
+  explicit PresentationToast(int preferred_width);
+  ~PresentationToast() override;
+
+ private:
+  UiTexture* GetTexture() const override;
+
+  std::unique_ptr<UiTexture> texture_;
+
+  DISALLOW_COPY_AND_ASSIGN(PresentationToast);
+};
+
+}  // namespace vr_shell
+
+#endif  // CHROME_BROWSER_ANDROID_VR_SHELL_UI_ELEMENTS_PRESENTATION_TOAST_H_

diff --git a/chrome/browser/android/vr_shell/ui_elements/ui_element_debug_id.h b/chrome/browser/android/vr_shell/ui_elements/ui_element_debug_id.h
index 8d82a4ac..9f1a13e 100644
--- a/chrome/browser/android/vr_shell/ui_elements/ui_element_debug_id.h
+++ b/chrome/browser/android/vr_shell/ui_elements/ui_element_debug_id.h

@@ -29,6 +29,7 @@
   kExitPromptBackplane,
   kTransientUrlBar,
   kLocationAccessIndicator,
+  kPresentationToast,
 };
 
 }  // namespace vr_shell

diff --git a/chrome/browser/android/vr_shell/ui_interface.h b/chrome/browser/android/vr_shell/ui_interface.h
index 01ff3ba..1a0f0c6 100644
--- a/chrome/browser/android/vr_shell/ui_interface.h
+++ b/chrome/browser/android/vr_shell/ui_interface.h

@@ -25,7 +25,9 @@
 
   virtual ~UiInterface() {}
 
-  virtual void SetWebVrMode(bool enabled, bool auto_presented) = 0;
+  virtual void SetWebVrMode(bool enabled,
+                            bool auto_presented,
+                            bool show_toast) = 0;
   virtual void SetURL(const GURL& url) = 0;
   virtual void SetFullscreen(bool enabled) = 0;
   virtual void SetSecurityInfo(security_state::SecurityLevel level,

diff --git a/chrome/browser/android/vr_shell/ui_scene_manager.cc b/chrome/browser/android/vr_shell/ui_scene_manager.cc
index 69ffdd5..cac0780 100644
--- a/chrome/browser/android/vr_shell/ui_scene_manager.cc
+++ b/chrome/browser/android/vr_shell/ui_scene_manager.cc

@@ -17,6 +17,7 @@
 #include "chrome/browser/android/vr_shell/ui_elements/loading_indicator.h"
 #include "chrome/browser/android/vr_shell/ui_elements/location_access_indicator.h"
 #include "chrome/browser/android/vr_shell/ui_elements/permanent_security_warning.h"
+#include "chrome/browser/android/vr_shell/ui_elements/presentation_toast.h"
 #include "chrome/browser/android/vr_shell/ui_elements/screen_capture_indicator.h"
 #include "chrome/browser/android/vr_shell/ui_elements/screen_dimmer.h"
 #include "chrome/browser/android/vr_shell/ui_elements/transient_security_warning.h"
@@ -90,6 +91,11 @@
     -0.2 * kTransientUrlBarDistance;
 static constexpr int kTransientUrlBarTimeoutSeconds = 6;
 
+static constexpr float kToastDistance = 1.4;
+static constexpr float kToastWidth = 0.512 * kToastDistance;
+static constexpr float kToastHeight = 0.16 * kToastDistance;
+static constexpr int kToastTimeoutSeconds = kTransientUrlBarTimeoutSeconds;
+
 static constexpr float kCloseButtonDistance = 2.4;
 static constexpr float kCloseButtonHeight =
     kUrlBarHeightDMM * kCloseButtonDistance;
@@ -139,6 +145,7 @@
   CreateCloseButton();
   CreateScreenDimmer();
   CreateExitPrompt();
+  CreateToasts();
 
   ConfigureScene();
   ConfigureSecurityWarnings();
@@ -425,19 +432,39 @@
   scene_->AddUiElement(std::move(element));
 }
 
+void UiSceneManager::CreateToasts() {
+  std::unique_ptr<UiElement> element = base::MakeUnique<PresentationToast>(512);
+  element->set_debug_id(kPresentationToast);
+  element->set_id(AllocateId());
+  element->set_fill(vr_shell::Fill::NONE);
+  element->set_size({kToastWidth, kToastHeight, 1});
+  element->set_translation({0, 0, -kToastDistance});
+  element->set_visible(false);
+  element->set_hit_testable(false);
+  element->set_lock_to_fov(true);
+  presentation_toast_ = element.get();
+  scene_->AddUiElement(std::move(element));
+}
+
 base::WeakPtr<UiSceneManager> UiSceneManager::GetWeakPtr() {
   return weak_ptr_factory_.GetWeakPtr();
 }
 
-void UiSceneManager::SetWebVrMode(bool web_vr, bool auto_presented) {
-  if (web_vr_mode_ == web_vr)
+void UiSceneManager::SetWebVrMode(bool web_vr,
+                                  bool auto_presented,
+                                  bool show_toast) {
+  if (web_vr_mode_ == web_vr && web_vr_autopresented_ == auto_presented &&
+      web_vr_show_toast_ == show_toast) {
     return;
+  }
   web_vr_mode_ = web_vr;
   web_vr_autopresented_ = auto_presented;
+  web_vr_show_toast_ = show_toast;
   ConfigureScene();
   ConfigureSecurityWarnings();
   ConfigureTransientUrlBar();
   ConfigureIndicators();
+  ConfigurePresentationToast();
 }
 
 void UiSceneManager::ConfigureScene() {
@@ -578,6 +605,17 @@
   location_access_indicator_->set_visible(!web_vr_mode_ && location_access_);
 }
 
+void UiSceneManager::ConfigurePresentationToast() {
+  presentation_toast_->set_visible(web_vr_show_toast_);
+  if (web_vr_show_toast_) {
+    presentation_toast_timer_.Start(
+        FROM_HERE, base::TimeDelta::FromSeconds(kToastTimeoutSeconds), this,
+        &UiSceneManager::OnPresentationToastTimer);
+  } else {
+    presentation_toast_timer_.Stop();
+  }
+}
+
 void UiSceneManager::OnSecurityWarningTimer() {
   transient_security_warning_->set_visible(false);
 }
@@ -598,6 +636,10 @@
   transient_url_bar_->set_visible(false);
 }
 
+void UiSceneManager::OnPresentationToastTimer() {
+  presentation_toast_->set_visible(false);
+}
+
 void UiSceneManager::OnBackButtonClicked() {
   browser_->NavigateBack();
 }

diff --git a/chrome/browser/android/vr_shell/ui_scene_manager.h b/chrome/browser/android/vr_shell/ui_scene_manager.h
index e6e1564..8c7c187 100644
--- a/chrome/browser/android/vr_shell/ui_scene_manager.h
+++ b/chrome/browser/android/vr_shell/ui_scene_manager.h

@@ -38,7 +38,7 @@
   void SetIncognito(bool incognito);
   void SetURL(const GURL& gurl);
   void SetWebVrSecureOrigin(bool secure);
-  void SetWebVrMode(bool web_vr, bool auto_presented);
+  void SetWebVrMode(bool web_vr, bool auto_presented, bool show_toast);
   void SetSecurityInfo(security_state::SecurityLevel level, bool malware);
   void SetLoading(bool loading);
   void SetLoadProgress(float progress);
@@ -67,15 +67,18 @@
   void CreateTransientUrlBar();
   void CreateCloseButton();
   void CreateExitPrompt();
+  void CreateToasts();
 
   void ConfigureScene();
   void ConfigureSecurityWarnings();
   void ConfigureTransientUrlBar();
   void ConfigureIndicators();
+  void ConfigurePresentationToast();
   void UpdateBackgroundColor();
   void CloseExitPrompt();
   void OnSecurityWarningTimer();
   void OnTransientUrlBarTimer();
+  void OnPresentationToastTimer();
   void OnBackButtonClicked();
   void OnSecurityIconClicked();
   void OnExitPromptPrimaryButtonClicked();
@@ -93,6 +96,7 @@
   // UI element pointers (not owned by the scene manager).
   UiElement* permanent_security_warning_ = nullptr;
   UiElement* transient_security_warning_ = nullptr;
+  UiElement* presentation_toast_ = nullptr;
   UiElement* exit_prompt_ = nullptr;
   UiElement* exit_prompt_backplane_ = nullptr;
   UiElement* exit_warning_ = nullptr;
@@ -112,6 +116,7 @@
   bool in_cct_;
   bool web_vr_mode_;
   bool web_vr_autopresented_ = false;
+  bool web_vr_show_toast_ = false;
   bool secure_origin_ = false;
   bool fullscreen_ = false;
   bool incognito_ = false;
@@ -128,6 +133,7 @@
 
   base::OneShotTimer security_warning_timer_;
   base::OneShotTimer transient_url_bar_timer_;
+  base::OneShotTimer presentation_toast_timer_;
 
   base::WeakPtrFactory<UiSceneManager> weak_ptr_factory_;
 

diff --git a/chrome/browser/android/vr_shell/ui_scene_manager_unittest.cc b/chrome/browser/android/vr_shell/ui_scene_manager_unittest.cc
index 81f4ca8f..d3af85909 100644
--- a/chrome/browser/android/vr_shell/ui_scene_manager_unittest.cc
+++ b/chrome/browser/android/vr_shell/ui_scene_manager_unittest.cc

@@ -118,7 +118,7 @@
   EXPECT_TRUE(IsVisible(kWebVrPermanentHttpSecurityWarning));
   EXPECT_TRUE(IsVisible(kWebVrTransientHttpSecurityWarning));
 
-  manager_->SetWebVrMode(false, false);
+  manager_->SetWebVrMode(false, false, false);
   EXPECT_FALSE(IsVisible(kWebVrPermanentHttpSecurityWarning));
   EXPECT_FALSE(IsVisible(kWebVrTransientHttpSecurityWarning));
 }
@@ -129,11 +129,35 @@
   EXPECT_FALSE(IsVisible(kWebVrPermanentHttpSecurityWarning));
   EXPECT_FALSE(IsVisible(kWebVrTransientHttpSecurityWarning));
 
-  manager_->SetWebVrMode(true, false);
+  manager_->SetWebVrMode(true, false, false);
   EXPECT_TRUE(IsVisible(kWebVrPermanentHttpSecurityWarning));
   EXPECT_TRUE(IsVisible(kWebVrTransientHttpSecurityWarning));
 }
 
+// Tests toast not showing when directly entering VR though WebVR presentation.
+TEST_F(UiSceneManagerTest, WebVrToastNotShowingWhenInitiallyInWebVr) {
+  MakeManager(kNotInCct, kInWebVr);
+  EXPECT_FALSE(IsVisible(kPresentationToast));
+}
+
+// Tests toast visibility is controlled by show_toast parameter.
+TEST_F(UiSceneManagerTest, WebVrToastShowAndHide) {
+  MakeManager(kNotInCct, kNotInWebVr);
+  EXPECT_FALSE(IsVisible(kPresentationToast));
+
+  manager_->SetWebVrMode(true, false, true);
+  EXPECT_TRUE(IsVisible(kPresentationToast));
+
+  manager_->SetWebVrMode(true, false, false);
+  EXPECT_FALSE(IsVisible(kPresentationToast));
+
+  manager_->SetWebVrMode(false, false, true);
+  EXPECT_TRUE(IsVisible(kPresentationToast));
+
+  manager_->SetWebVrMode(false, false, false);
+  EXPECT_FALSE(IsVisible(kPresentationToast));
+}
+
 TEST_F(UiSceneManagerTest, CloseButtonVisibleInCctFullscreen) {
   // Button should be visible in cct.
   MakeManager(kInCct, kNotInWebVr);
@@ -152,7 +176,7 @@
   // Button should not be visible when in WebVR.
   MakeManager(kInCct, kInWebVr);
   EXPECT_FALSE(IsVisible(kCloseButton));
-  manager_->SetWebVrMode(false, false);
+  manager_->SetWebVrMode(false, false, false);
   EXPECT_TRUE(IsVisible(kCloseButton));
 
   // Button should be visible in Cct across transistions in fullscreen.
@@ -235,7 +259,8 @@
   VerifyElementsVisible("Initial", kElementsVisibleInBrowsing);
 
   // Enter WebVR with autopresentation.
-  manager_->SetWebVrMode(true, true);
+  manager_->SetWebVrMode(true, true, false);
+
   VerifyElementsVisible("Autopresented",
                         std::set<UiElementDebugId>{kTransientUrlBar});
 }
@@ -325,7 +350,7 @@
   manager_->SetLocationAccessIndicator(true);
 
   // Transition to WebVR mode
-  manager_->SetWebVrMode(true, false);
+  manager_->SetWebVrMode(true, false, false);
   manager_->SetWebVrSecureOrigin(true);
 
   // All elements should be hidden.
@@ -349,13 +374,13 @@
   EXPECT_TRUE(IsVisible(kScreenCaptureIndicator));
   EXPECT_TRUE(IsVisible(kLocationAccessIndicator));
 
-  manager_->SetWebVrMode(true, false);
+  manager_->SetWebVrMode(true, false, false);
   EXPECT_FALSE(IsVisible(kAudioCaptureIndicator));
   EXPECT_FALSE(IsVisible(kVideoCaptureIndicator));
   EXPECT_FALSE(IsVisible(kScreenCaptureIndicator));
   EXPECT_FALSE(IsVisible(kLocationAccessIndicator));
 
-  manager_->SetWebVrMode(false, false);
+  manager_->SetWebVrMode(false, false, false);
   EXPECT_TRUE(IsVisible(kAudioCaptureIndicator));
   EXPECT_TRUE(IsVisible(kVideoCaptureIndicator));
   EXPECT_TRUE(IsVisible(kScreenCaptureIndicator));

diff --git a/chrome/browser/android/vr_shell/vr_gl_thread.cc b/chrome/browser/android/vr_shell/vr_gl_thread.cc
index ecfce2b..be1bf47 100644
--- a/chrome/browser/android/vr_shell/vr_gl_thread.cc
+++ b/chrome/browser/android/vr_shell/vr_gl_thread.cc

@@ -185,11 +185,13 @@
                                                 weak_scene_manager_, gurl));
 }
 
-void VrGLThread::SetWebVrMode(bool enabled, bool auto_presented) {
+void VrGLThread::SetWebVrMode(bool enabled,
+                              bool auto_presented,
+                              bool show_toast) {
   WaitUntilThreadStarted();
   task_runner()->PostTask(
       FROM_HERE, base::Bind(&UiSceneManager::SetWebVrMode, weak_scene_manager_,
-                            enabled, auto_presented));
+                            enabled, auto_presented, show_toast));
 }
 
 void VrGLThread::SetWebVrSecureOrigin(bool secure) {

diff --git a/chrome/browser/android/vr_shell/vr_gl_thread.h b/chrome/browser/android/vr_shell/vr_gl_thread.h
index 51ee8bd..61b9a0e 100644
--- a/chrome/browser/android/vr_shell/vr_gl_thread.h
+++ b/chrome/browser/android/vr_shell/vr_gl_thread.h

@@ -77,7 +77,9 @@
   void SetSecurityInfo(security_state::SecurityLevel level,
                        bool malware) override;
   void SetURL(const GURL& gurl) override;
-  void SetWebVrMode(bool enabled, bool auto_presented) override;
+  void SetWebVrMode(bool enabled,
+                    bool auto_presented,
+                    bool show_toast) override;
   void SetWebVrSecureOrigin(bool secure) override;
   void SetVideoCapturingIndicator(bool enabled) override;
   void SetScreenCapturingIndicator(bool enabled) override;

diff --git a/chrome/browser/android/vr_shell/vr_shell.cc b/chrome/browser/android/vr_shell/vr_shell.cc
index 61ef878..b881c09 100644
--- a/chrome/browser/android/vr_shell/vr_shell.cc
+++ b/chrome/browser/android/vr_shell/vr_shell.cc

@@ -337,14 +337,15 @@
 void VrShell::SetWebVrMode(JNIEnv* env,
                            const JavaParamRef<jobject>& obj,
                            bool enabled,
-                           bool auto_presented) {
+                           bool auto_presented,
+                           bool show_toast) {
   webvr_mode_ = enabled;
   if (metrics_helper_)
     metrics_helper_->SetWebVREnabled(enabled);
   WaitForGlThread();
   PostToGlThread(FROM_HERE, base::Bind(&VrShellGl::SetWebVrMode,
                                        gl_thread_->GetVrShellGl(), enabled));
-  ui_->SetWebVrMode(enabled, auto_presented);
+  ui_->SetWebVrMode(enabled, auto_presented, show_toast);
 }
 
 void VrShell::OnFullscreenChanged(bool enabled) {

diff --git a/chrome/browser/android/vr_shell/vr_shell.h b/chrome/browser/android/vr_shell/vr_shell.h
index 2453c45..c675a37 100644
--- a/chrome/browser/android/vr_shell/vr_shell.h
+++ b/chrome/browser/android/vr_shell/vr_shell.h

@@ -92,7 +92,8 @@
   void SetWebVrMode(JNIEnv* env,
                     const base::android::JavaParamRef<jobject>& obj,
                     bool enabled,
-                    bool auto_presented);
+                    bool auto_presented,
+                    bool show_toast);
   bool GetWebVrMode(JNIEnv* env,
                     const base::android::JavaParamRef<jobject>& obj);
   void OnFullscreenChanged(bool enabled);

diff --git a/chrome/browser/apps/guest_view/web_view_browsertest.cc b/chrome/browser/apps/guest_view/web_view_browsertest.cc
index 9fc8b96..b8c6cc5 100644
--- a/chrome/browser/apps/guest_view/web_view_browsertest.cc
+++ b/chrome/browser/apps/guest_view/web_view_browsertest.cc

@@ -3930,7 +3930,7 @@
                         WebViewScrollGuestContentTest,
                         testing::Values(false));
 
-#if defined(OS_WIN)
+#if defined(OS_WIN) || defined(OS_LINUX)
 #define MAYBE_ScrollGuestContent DISABLED_ScrollGuestContent
 #else
 #define MAYBE_ScrollGuestContent ScrollGuestContent

diff --git a/chrome/browser/chromeos/power/freezer_cgroup_process_manager.cc b/chrome/browser/chromeos/power/freezer_cgroup_process_manager.cc
index 9ce82d6..ab50c344 100644
--- a/chrome/browser/chromeos/power/freezer_cgroup_process_manager.cc
+++ b/chrome/browser/chromeos/power/freezer_cgroup_process_manager.cc

@@ -13,6 +13,7 @@
 #include "base/macros.h"
 #include "base/sequenced_task_runner.h"
 #include "base/strings/string_number_conversions.h"
+#include "base/task_scheduler/post_task.h"
 #include "content/public/browser/browser_thread.h"
 
 namespace chromeos {
@@ -146,8 +147,8 @@
 };
 
 FreezerCgroupProcessManager::FreezerCgroupProcessManager()
-    : file_thread_(content::BrowserThread::GetTaskRunnerForThread(
-          content::BrowserThread::FILE)),
+    : file_thread_(base::CreateSequencedTaskRunnerWithTraits(
+          {base::TaskPriority::BACKGROUND, base::MayBlock()})),
       file_worker_(new FileWorker(file_thread_)) {
   file_thread_->PostTask(FROM_HERE,
                          base::Bind(&FileWorker::Start,

diff --git a/chrome/browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.cc b/chrome/browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.cc
index 8f3fc4cc..bc5a07c 100644
--- a/chrome/browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.cc
+++ b/chrome/browser/extensions/api/webrtc_audio_private/webrtc_audio_private_api.cc

@@ -302,6 +302,7 @@
     ~WebrtcAudioPrivateSetAudioExperimentsFunction() {}
 
 bool WebrtcAudioPrivateSetAudioExperimentsFunction::RunAsync() {
+#if BUILDFLAG(ENABLE_WEBRTC)
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   std::unique_ptr<wap::SetAudioExperiments::Params> params(
       wap::SetAudioExperiments::Params::Create(*args_));
@@ -320,6 +321,11 @@
 
   SendResponse(true);
   return true;
+#else
+  SetError("Not supported");
+  SendResponse(false);
+  return false;
+#endif
 }
 
 }  // namespace extensions

diff --git a/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc b/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc
index dfa1d52..5f3c17c5 100644
--- a/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc
+++ b/chrome/browser/ntp_snippets/content_suggestions_service_factory.cc

@@ -38,8 +38,8 @@
 #include "components/keyed_service/content/browser_context_dependency_manager.h"
 #include "components/keyed_service/core/service_access_type.h"
 #include "components/ntp_snippets/bookmarks/bookmark_suggestions_provider.h"
+#include "components/ntp_snippets/breaking_news/breaking_news_gcm_app_handler.h"
 #include "components/ntp_snippets/breaking_news/breaking_news_suggestions_provider.h"
-#include "components/ntp_snippets/breaking_news/content_suggestions_gcm_app_handler.h"
 #include "components/ntp_snippets/breaking_news/subscription_manager.h"
 #include "components/ntp_snippets/category_rankers/category_ranker.h"
 #include "components/ntp_snippets/content_suggestions_service.h"
@@ -96,9 +96,9 @@
 using history::HistoryService;
 using image_fetcher::ImageFetcherImpl;
 using ntp_snippets::BookmarkSuggestionsProvider;
+using ntp_snippets::BreakingNewsGCMAppHandler;
 using ntp_snippets::BreakingNewsSuggestionsProvider;
 using ntp_snippets::CategoryRanker;
-using ntp_snippets::ContentSuggestionsGCMAppHandler;
 using ntp_snippets::ContentSuggestionsService;
 using ntp_snippets::ForeignSessionsSuggestionsProvider;
 using ntp_snippets::GetFetchEndpoint;
@@ -398,7 +398,7 @@
   DCHECK(instance_id_profile_service);
   DCHECK(instance_id_profile_service->driver());
 
-  auto handler = base::MakeUnique<ContentSuggestionsGCMAppHandler>(
+  auto handler = base::MakeUnique<BreakingNewsGCMAppHandler>(
       gcm_driver, instance_id_profile_service->driver(), pref_service,
       std::move(subscription_manager),
       base::Bind(&safe_json::SafeJsonParser::Parse));

diff --git a/chrome/browser/prefs/browser_prefs.cc b/chrome/browser/prefs/browser_prefs.cc
index ca84ba77..a769ab0f 100644
--- a/chrome/browser/prefs/browser_prefs.cc
+++ b/chrome/browser/prefs/browser_prefs.cc

@@ -77,7 +77,7 @@
 #include "components/flags_ui/pref_service_flags_storage.h"
 #include "components/gcm_driver/gcm_channel_status_syncer.h"
 #include "components/network_time/network_time_tracker.h"
-#include "components/ntp_snippets/breaking_news/content_suggestions_gcm_app_handler.h"
+#include "components/ntp_snippets/breaking_news/breaking_news_gcm_app_handler.h"
 #include "components/ntp_snippets/breaking_news/subscription_manager.h"
 #include "components/ntp_snippets/content_suggestions_service.h"
 #include "components/ntp_snippets/remote/remote_suggestions_provider_impl.h"
@@ -463,7 +463,7 @@
   MediaStreamDevicesController::RegisterProfilePrefs(registry);
   NetHttpSessionParamsObserver::RegisterProfilePrefs(registry);
   NotifierStateTracker::RegisterProfilePrefs(registry);
-  ntp_snippets::ContentSuggestionsGCMAppHandler::RegisterProfilePrefs(registry);
+  ntp_snippets::BreakingNewsGCMAppHandler::RegisterProfilePrefs(registry);
   ntp_snippets::ContentSuggestionsService::RegisterProfilePrefs(registry);
   ntp_snippets::ForeignSessionsSuggestionsProvider::RegisterProfilePrefs(
       registry);

diff --git a/chrome/browser/resources/predictors/autocomplete_action_predictor.js b/chrome/browser/resources/predictors/autocomplete_action_predictor.js
index 80fe506..cae254f 100644
--- a/chrome/browser/resources/predictors/autocomplete_action_predictor.js
+++ b/chrome/browser/resources/predictors/autocomplete_action_predictor.js

@@ -12,7 +12,7 @@
 /**
  * Callback from backend with the database contents. Sets up some globals and
  * calls to create the UI.
- * @param {Dictionary} database Information about AutocompleteActionPredictor
+ * @param {Object} database Information about AutocompleteActionPredictor
  *     including the database as a flattened list, a boolean indicating if the
  *     system is enabled and the current hit weight.
  */
@@ -30,7 +30,7 @@
 
 /**
  * Updates the table from the database.
- * @param {Dictionary} database Information about AutocompleteActionPredictor
+ * @param {Object} database Information about AutocompleteActionPredictor
  *     including the database as a flattened list, a boolean indicating if the
  *     system is enabled and the current hit weight.
  */

diff --git a/chrome/browser/resources/predictors/resource_prefetch_predictor.html b/chrome/browser/resources/predictors/resource_prefetch_predictor.html
index ed9eed3..ad8c3a7 100644
--- a/chrome/browser/resources/predictors/resource_prefetch_predictor.html
+++ b/chrome/browser/resources/predictors/resource_prefetch_predictor.html

@@ -3,10 +3,11 @@
     <tabs>
       <tab>URL Table Cache</tab>
       <tab>Host Table Cache</tab>
+      <tab>Origin Table Cache</tab>
     </tabs>
     <tabpanels>
       <tabpanel>
-        <table id="">
+        <table>
           <thead>
             <tr>
               <th>Main Frame Url</th>
@@ -25,7 +26,7 @@
         </table>
       </tabpanel>
       <tabpanel>
-        <table id="">
+        <table>
           <thead>
             <tr>
               <th>Host</th>
@@ -43,9 +44,28 @@
           </tbody>
         </table>
       </tabpanel>
+      <tabpanel>
+        <table>
+          <thead>
+            <tr>
+              <th>Host</th>
+              <th>Origin</th>
+              <th>Num Hits</th>
+              <th>Num Misses</th>
+              <th>Consec Misses</th>
+              <th>Average Position</th>
+              <th>Always Access Net</th>
+              <th>Accessed Net</th>
+              <th>Score</th>
+            </tr>
+          </thead>
+          <tbody id="rpp_origin_body">
+          </tbody>
+        </table>
+      </tabpanel>
     </tabpanels>
   </tabbox>
 </div>
 <div id='rpp_disabled'>
   Resource prefetch prediction is disabled.
-</div>
\ No newline at end of file
+</div>

diff --git a/chrome/browser/resources/predictors/resource_prefetch_predictor.js b/chrome/browser/resources/predictors/resource_prefetch_predictor.js
index cc318433..a00b7d5 100644
--- a/chrome/browser/resources/predictors/resource_prefetch_predictor.js
+++ b/chrome/browser/resources/predictors/resource_prefetch_predictor.js

@@ -12,7 +12,7 @@
 /**
  * Callback from backend with the database contents. Sets up some globals and
  * calls to create the UI.
- * @param {Dictionary} database Information about ResourcePrefetchPredictor
+ * @param {Object} database Information about ResourcePrefetchPredictor
  *     including the database as a flattened list, a boolean indicating if the
  *     system is enabled.
  */
@@ -31,7 +31,7 @@
 
 /**
  * Updates the table from the database.
- * @param {Dictionary} database Information about ResourcePrefetchPredictor
+ * @param {Object} database Information about ResourcePrefetchPredictor
  *     including the database as a flattened list, a boolean indicating if the
  *     system is enabled and the current hit weight.
  */
@@ -40,30 +40,31 @@
     $('rpp_enabled').style.display = 'none';
     $('rpp_disabled').style.display = 'block';
     return;
-  } else {
-    $('rpp_enabled').style.display = 'block';
-    $('rpp_disabled').style.display = 'none';
   }
 
+  $('rpp_enabled').style.display = 'block';
+  $('rpp_disabled').style.display = 'none';
+
   var hasUrlData = database.url_db && database.url_db.length > 0;
   var hasHostData = database.host_db && database.host_db.length > 0;
+  var hasOriginData = database.origin_db && database.origin_db.length > 0;
 
   if (hasUrlData)
     renderCacheData($('rpp_url_body'), database.url_db);
   if (hasHostData)
     renderCacheData($('rpp_host_body'), database.host_db);
+  if (hasOriginData)
+    renderOriginData($('rpp_origin_body'), database.origin_db);
 }
 
 /**
  * Renders cache data for URL or host based data.
  * @param {HTMLElement} body element of table to render into.
- * @param {Dictionary} database to render.
+ * @param {Object} database to render.
  */
 function renderCacheData(body, database) {
   body.textContent = '';
-  for (var i = 0; i < database.length; ++i) {
-    var main = database[i];
-
+  for (let main of database) {
     for (var j = 0; j < main.resources.length; ++j) {
       var resource = main.resources[j];
       var row = document.createElement('tr');
@@ -99,5 +100,46 @@
   }
 }
 
+/**
+ * Renders the content of the predictor origin table.
+ * @param {HTMLElement} body element of table to render into.
+ * @param {Object} database to render.
+ */
+function renderOriginData(body, database) {
+  body.textContent = '';
+  for (let main of database) {
+    for (var j = 0; j < main.origins.length; ++j) {
+      var origin = main.origins[j];
+      var row = document.createElement('tr');
+
+      if (j == 0) {
+        var t = document.createElement('td');
+        t.rowSpan = main.origins.length;
+        t.textContent = truncateString(main.main_frame_host);
+        row.appendChild(t);
+      }
+
+      row.className = 'action-none';
+      row.appendChild(document.createElement('td')).textContent =
+          truncateString(origin.origin);
+      row.appendChild(document.createElement('td')).textContent =
+          origin.number_of_hits;
+      row.appendChild(document.createElement('td')).textContent =
+          origin.number_of_misses;
+      row.appendChild(document.createElement('td')).textContent =
+          origin.consecutive_misses;
+      row.appendChild(document.createElement('td')).textContent =
+          origin.position;
+      row.appendChild(document.createElement('td')).textContent =
+          origin.always_access_network;
+      row.appendChild(document.createElement('td')).textContent =
+          origin.accessed_network;
+      row.appendChild(document.createElement('td')).textContent =
+          origin.score;
+      body.appendChild(row);
+    }
+  }
+}
+
 document.addEventListener(
     'DOMContentLoaded', requestResourcePrefetchPredictorDb);

diff --git a/chrome/browser/signin/chrome_signin_helper.cc b/chrome/browser/signin/chrome_signin_helper.cc
index a0b599c..aa73bab 100644
--- a/chrome/browser/signin/chrome_signin_helper.cc
+++ b/chrome/browser/signin/chrome_signin_helper.cc

@@ -11,6 +11,8 @@
 #include "chrome/browser/profiles/profile_io_data.h"
 #include "chrome/browser/signin/account_reconcilor_factory.h"
 #include "chrome/browser/signin/chrome_signin_client.h"
+#include "chrome/browser/signin/chrome_signin_client_factory.h"
+#include "chrome/browser/signin/dice_response_handler.h"
 #include "chrome/browser/tab_contents/tab_util.h"
 #include "chrome/browser/ui/browser_window.h"
 #include "chrome/common/url_constants.h"
@@ -18,6 +20,7 @@
 #include "components/signin/core/browser/chrome_connected_header_helper.h"
 #include "components/signin/core/browser/signin_header_helper.h"
 #include "components/signin/core/common/profile_management_switches.h"
+#include "components/signin/core/common/signin_features.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/web_contents.h"
 #include "google_apis/gaia/gaia_auth_util.h"
@@ -38,7 +41,7 @@
 
 const char kChromeManageAccountsHeader[] = "X-Chrome-Manage-Accounts";
 
-#if !defined(OS_ANDROID)
+#if BUILDFLAG(ENABLE_DICE_SUPPORT)
 const char kDiceResponseHeader[] = "X-Chrome-ID-Consistency-Response";
 #endif
 
@@ -105,6 +108,29 @@
 #endif  // !defined(OS_ANDROID)
 }
 
+#if BUILDFLAG(ENABLE_DICE_SUPPORT)
+void ProcessDiceHeaderUIThread(
+    const DiceResponseParams& dice_params,
+    const content::ResourceRequestInfo::WebContentsGetter&
+        web_contents_getter) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
+  DCHECK_EQ(switches::AccountConsistencyMethod::kDice,
+            switches::GetAccountConsistencyMethod());
+
+  content::WebContents* web_contents = web_contents_getter.Run();
+  if (!web_contents)
+    return;
+
+  Profile* profile =
+      Profile::FromBrowserContext(web_contents->GetBrowserContext());
+  DCHECK(!profile->IsOffTheRecord());
+
+  DiceResponseHandler* dice_response_handler =
+      DiceResponseHandler::GetForProfile(profile);
+  dice_response_handler->ProcessDiceHeader(dice_params);
+}
+#endif  // BUILDFLAG(ENABLE_DICE_SUPPORT)
+
 // Looks for the X-Chrome-Manage-Accounts response header, and if found,
 // tries to show the avatar bubble in the browser identified by the
 // child/route id. Must be called on IO thread.
@@ -157,9 +183,12 @@
       base::Bind(ProcessMirrorHeaderUIThread, params, web_contents_getter));
 }
 
-#if !defined(OS_ANDROID)
-void ProcessDiceResponseHeaderIfExists(net::URLRequest* request,
-                                       ProfileIOData* io_data) {
+#if BUILDFLAG(ENABLE_DICE_SUPPORT)
+void ProcessDiceResponseHeaderIfExists(
+    net::URLRequest* request,
+    ProfileIOData* io_data,
+    const content::ResourceRequestInfo::WebContentsGetter&
+        web_contents_getter) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
 
   if (io_data->IsOffTheRecord())
@@ -194,11 +223,11 @@
   if (params.user_intention == DiceAction::NONE)
     return;
 
-  // TODO(droger): Process the Dice header: on sign-in, exchange the
-  // authorization code for a refresh token, on sign-out just follow the
-  // sign-out URL.
+  content::BrowserThread::PostTask(
+      content::BrowserThread::UI, FROM_HERE,
+      base::Bind(ProcessDiceHeaderUIThread, params, web_contents_getter));
 }
-#endif  // !defined(OS_ANDROID)
+#endif  // BUILDFLAG(ENABLE_DICE_SUPPORT)
 
 }  // namespace
 
@@ -252,16 +281,15 @@
     // See if the response contains the X-Chrome-Manage-Accounts header. If so
     // show the profile avatar bubble so that user can complete signin/out
     // action the native UI.
-    signin::ProcessMirrorResponseHeaderIfExists(request, io_data,
-                                                web_contents_getter);
+    ProcessMirrorResponseHeaderIfExists(request, io_data, web_contents_getter);
   } else {
-// This is a redirect.
+    // This is a redirect.
 
-#if !defined(OS_ANDROID)
+#if BUILDFLAG(ENABLE_DICE_SUPPORT)
     // Process the Dice header: on sign-in, exchange the authorization code for
     // a refresh token, on sign-out just follow the sign-out URL.
-    signin::ProcessDiceResponseHeaderIfExists(request, io_data);
-#endif
+    ProcessDiceResponseHeaderIfExists(request, io_data, web_contents_getter);
+#endif  // BUILDFLAG(ENABLE_DICE_SUPPORT)
   }
 }
 

diff --git a/chrome/browser/signin/dice_response_handler.cc b/chrome/browser/signin/dice_response_handler.cc
new file mode 100644
index 0000000..2912fc37
--- /dev/null
+++ b/chrome/browser/signin/dice_response_handler.cc

@@ -0,0 +1,148 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/signin/dice_response_handler.h"
+
+#include "base/memory/singleton.h"
+#include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/signin/account_tracker_service_factory.h"
+#include "chrome/browser/signin/chrome_signin_client_factory.h"
+#include "chrome/browser/signin/profile_oauth2_token_service_factory.h"
+#include "components/keyed_service/content/browser_context_dependency_manager.h"
+#include "components/keyed_service/content/browser_context_keyed_service_factory.h"
+#include "components/signin/core/browser/account_tracker_service.h"
+#include "components/signin/core/browser/profile_oauth2_token_service.h"
+#include "components/signin/core/browser/signin_client.h"
+#include "components/signin/core/browser/signin_header_helper.h"
+#include "components/signin/core/common/profile_management_switches.h"
+#include "google_apis/gaia/gaia_auth_fetcher.h"
+#include "google_apis/gaia/gaia_constants.h"
+#include "google_apis/gaia/google_service_auth_error.h"
+
+namespace {
+
+class DiceResponseHandlerFactory : public BrowserContextKeyedServiceFactory {
+ public:
+  // Returns an instance of the factory singleton.
+  static DiceResponseHandlerFactory* GetInstance() {
+    return base::Singleton<DiceResponseHandlerFactory>::get();
+  }
+
+  static DiceResponseHandler* GetForProfile(Profile* profile) {
+    return static_cast<DiceResponseHandler*>(
+        GetInstance()->GetServiceForBrowserContext(profile, true));
+  }
+
+ private:
+  friend struct base::DefaultSingletonTraits<DiceResponseHandlerFactory>;
+
+  DiceResponseHandlerFactory()
+      : BrowserContextKeyedServiceFactory(
+            "DiceResponseHandler",
+            BrowserContextDependencyManager::GetInstance()) {
+    DependsOn(AccountTrackerServiceFactory::GetInstance());
+    DependsOn(ChromeSigninClientFactory::GetInstance());
+    DependsOn(ProfileOAuth2TokenServiceFactory::GetInstance());
+  }
+
+  ~DiceResponseHandlerFactory() override {}
+
+  // BrowserContextKeyedServiceFactory:
+  KeyedService* BuildServiceInstanceFor(
+      content::BrowserContext* context) const override {
+    if (context->IsOffTheRecord())
+      return nullptr;
+
+    Profile* profile = static_cast<Profile*>(context);
+    return new DiceResponseHandler(
+        ChromeSigninClientFactory::GetForProfile(profile),
+        ProfileOAuth2TokenServiceFactory::GetForProfile(profile),
+        AccountTrackerServiceFactory::GetForProfile(profile));
+  }
+};
+
+}  // namespace
+
+// static
+DiceResponseHandler* DiceResponseHandler::GetForProfile(Profile* profile) {
+  return DiceResponseHandlerFactory::GetForProfile(profile);
+}
+
+DiceResponseHandler::DiceResponseHandler(
+    SigninClient* signin_client,
+    ProfileOAuth2TokenService* profile_oauth2_token_service,
+    AccountTrackerService* account_tracker_service)
+    : signin_client_(signin_client),
+      token_service_(profile_oauth2_token_service),
+      account_tracker_service_(account_tracker_service) {
+  DCHECK(signin_client_);
+  DCHECK(token_service_);
+  DCHECK(account_tracker_service_);
+}
+
+DiceResponseHandler::~DiceResponseHandler() {}
+
+void DiceResponseHandler::ProcessDiceHeader(
+    const signin::DiceResponseParams& dice_params) {
+  DCHECK_EQ(switches::AccountConsistencyMethod::kDice,
+            switches::GetAccountConsistencyMethod());
+
+  switch (dice_params.user_intention) {
+    case signin::DiceAction::SIGNIN:
+      ProcessDiceSigninHeader(dice_params.obfuscated_gaia_id, dice_params.email,
+                              dice_params.authorization_code);
+      return;
+    case signin::DiceAction::SIGNOUT:
+    case signin::DiceAction::SINGLE_SESSION_SIGNOUT:
+      LOG(ERROR) << "Signout through Dice is not implemented.";
+      return;
+    case signin::DiceAction::NONE:
+      NOTREACHED() << "Invalid Dice response parameters.";
+      return;
+  }
+
+  NOTREACHED();
+  return;
+}
+
+void DiceResponseHandler::ProcessDiceSigninHeader(
+    const std::string& gaia_id,
+    const std::string& email,
+    const std::string& authorization_code) {
+  DCHECK(!gaia_id.empty());
+  DCHECK(!email.empty());
+  DCHECK(!authorization_code.empty());
+  DCHECK(!gaia_auth_fetcher_);
+  DCHECK(gaia_id_.empty());
+  DCHECK(email_.empty());
+  gaia_id_ = gaia_id;
+  email_ = email;
+  gaia_auth_fetcher_ = signin_client_->CreateGaiaAuthFetcher(
+      this, GaiaConstants::kChromeSource,
+      signin_client_->GetURLRequestContext());
+  gaia_auth_fetcher_->StartAuthCodeForOAuth2TokenExchange(authorization_code);
+
+  // TODO(droger): The token exchange must complete quickly or be cancelled. Add
+  // a timeout logic.
+}
+
+void DiceResponseHandler::OnClientOAuthSuccess(
+    const ClientOAuthResult& result) {
+  std::string account_id =
+      account_tracker_service_->SeedAccountInfo(gaia_id_, email_);
+  VLOG(1) << "Dice OAuth success for account: " << account_id;
+  token_service_->UpdateCredentials(account_id, result.refresh_token);
+  gaia_id_.clear();
+  email_.clear();
+  gaia_auth_fetcher_.reset();
+}
+
+void DiceResponseHandler::OnClientOAuthFailure(
+    const GoogleServiceAuthError& error) {
+  // TODO(droger): Handle authentication errors.
+  VLOG(1) << "Dice OAuth failed with error: " << error.ToString();
+  gaia_id_.clear();
+  email_.clear();
+  gaia_auth_fetcher_.reset();
+}

diff --git a/chrome/browser/signin/dice_response_handler.h b/chrome/browser/signin/dice_response_handler.h
new file mode 100644
index 0000000..10ae5b5
--- /dev/null
+++ b/chrome/browser/signin/dice_response_handler.h

@@ -0,0 +1,57 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_SIGNIN_DICE_RESPONSE_HANDLER_H_
+#define CHROME_BROWSER_SIGNIN_DICE_RESPONSE_HANDLER_H_
+
+#include <memory>
+#include <string>
+
+#include "components/keyed_service/core/keyed_service.h"
+#include "google_apis/gaia/gaia_auth_consumer.h"
+
+namespace signin {
+struct DiceResponseParams;
+}
+
+class AccountTrackerService;
+class GaiaAuthFetcher;
+class SigninClient;
+class ProfileOAuth2TokenService;
+class Profile;
+
+// Processes the Dice responses from Gaia.
+class DiceResponseHandler : public GaiaAuthConsumer, public KeyedService {
+ public:
+  // Returns the DiceResponseHandler associated with this profile.
+  // May return nullptr if there is none (e.g. in incognito).
+  static DiceResponseHandler* GetForProfile(Profile* profile);
+
+  DiceResponseHandler(SigninClient* signin_client,
+                      ProfileOAuth2TokenService* profile_oauth2_token_service,
+                      AccountTrackerService* account_tracker_service);
+  ~DiceResponseHandler() override;
+
+  // Must be called when receiving a Dice response header.
+  void ProcessDiceHeader(const signin::DiceResponseParams& dice_params);
+
+ private:
+  // Process the Dice signin action.
+  void ProcessDiceSigninHeader(const std::string& gaia_id,
+                               const std::string& email,
+                               const std::string& authorization_code);
+
+  // GaiaAuthConsumer implementation:
+  void OnClientOAuthSuccess(const ClientOAuthResult& result) override;
+  void OnClientOAuthFailure(const GoogleServiceAuthError& error) override;
+
+  std::unique_ptr<GaiaAuthFetcher> gaia_auth_fetcher_;
+  std::string gaia_id_;
+  std::string email_;
+  SigninClient* signin_client_;
+  ProfileOAuth2TokenService* token_service_;
+  AccountTrackerService* account_tracker_service_;
+};
+
+#endif  // CHROME_BROWSER_SIGNIN_DICE_RESPONSE_HANDLER_H_

diff --git a/chrome/browser/signin/mutable_profile_oauth2_token_service_delegate_unittest.cc b/chrome/browser/signin/mutable_profile_oauth2_token_service_delegate_unittest.cc
index 72fa7b4..a70eedf0 100644
--- a/chrome/browser/signin/mutable_profile_oauth2_token_service_delegate_unittest.cc
+++ b/chrome/browser/signin/mutable_profile_oauth2_token_service_delegate_unittest.cc

@@ -24,6 +24,7 @@
 #include "components/signin/core/browser/test_signin_client.h"
 #include "components/signin/core/browser/webdata/token_web_data.h"
 #include "components/signin/core/common/profile_management_switches.h"
+#include "components/signin/core/common/signin_features.h"
 #include "components/signin/core/common/signin_pref_names.h"
 #include "google_apis/gaia/gaia_constants.h"
 #include "google_apis/gaia/gaia_urls.h"
@@ -353,6 +354,7 @@
   ResetObserverCounts();
 }
 
+#if BUILDFLAG(ENABLE_DICE_SUPPORT)
 TEST_F(MutableProfileOAuth2TokenServiceDelegateTest,
        PersistenceLoadCredentialsEmptyPrimaryAccountId_DiceEnabled) {
   switches::EnableAccountConsistencyDiceForTesting(
@@ -410,6 +412,7 @@
   EXPECT_EQ(1, end_batch_changes_);
   ResetObserverCounts();
 }
+#endif  // BUILDFLAG(ENABLE_DICE_SUPPORT)
 
 TEST_F(MutableProfileOAuth2TokenServiceDelegateTest, PersistanceNotifications) {
   oauth2_service_delegate_->UpdateCredentials("account_id", "refresh_token");

diff --git a/chrome/browser/ui/BUILD.gn b/chrome/browser/ui/BUILD.gn
index 894c60f..4619783e 100644
--- a/chrome/browser/ui/BUILD.gn
+++ b/chrome/browser/ui/BUILD.gn

@@ -8,6 +8,7 @@
 import("//build/config/ui.gni")
 import("//build/split_static_library.gni")
 import("//chrome/common/features.gni")
+import("//components/signin/features.gni")
 import("//extensions/features/features.gni")
 import("//media/media_options.gni")
 import("//ppapi/features/features.gni")
@@ -551,6 +552,8 @@
     "//components/sessions",
     "//components/signin/core/account_id",
     "//components/signin/core/browser",
+    "//components/signin/core/common",
+    "//components/signin/core/common:signin_features",
     "//components/spellcheck/browser",
     "//components/ssl_errors",
     "//components/startup_metric_utils/browser:lib",
@@ -2065,10 +2068,6 @@
       "webui/signin/md_user_manager_ui.h",
       "webui/signin/signin_create_profile_handler.cc",
       "webui/signin/signin_create_profile_handler.h",
-      "webui/signin/signin_dice_internals_handler.cc",
-      "webui/signin/signin_dice_internals_handler.h",
-      "webui/signin/signin_dice_internals_ui.cc",
-      "webui/signin/signin_dice_internals_ui.h",
       "webui/signin/signin_email_confirmation_dialog.cc",
       "webui/signin/signin_email_confirmation_dialog.h",
       "webui/signin/signin_email_confirmation_ui.cc",
@@ -2092,6 +2091,14 @@
       "webui/welcome_ui.cc",
       "webui/welcome_ui.h",
     ]
+    if (enable_dice_support) {
+      sources += [
+        "webui/signin/signin_dice_internals_handler.cc",
+        "webui/signin/signin_dice_internals_handler.h",
+        "webui/signin/signin_dice_internals_ui.cc",
+        "webui/signin/signin_dice_internals_ui.h",
+      ]
+    }
     if (is_mac && !mac_views_browser) {
       sources -= [
         # This is not explicitly excluded in GYP, but I think the static

diff --git a/chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc b/chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc
index fbdc0bc..cb9cb951 100644
--- a/chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc
+++ b/chrome/browser/ui/webui/chrome_web_ui_controller_factory.cc

@@ -75,6 +75,7 @@
 #include "components/history/core/browser/history_types.h"
 #include "components/prefs/pref_service.h"
 #include "components/signin/core/common/profile_management_switches.h"
+#include "components/signin/core/common/signin_features.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_ui.h"
 #include "content/public/common/content_client.h"
@@ -162,7 +163,6 @@
 #include "chrome/browser/ui/sync/sync_promo_ui.h"
 #include "chrome/browser/ui/webui/signin/inline_login_ui.h"
 #include "chrome/browser/ui/webui/signin/md_user_manager_ui.h"
-#include "chrome/browser/ui/webui/signin/signin_dice_internals_ui.h"
 #include "chrome/browser/ui/webui/signin/signin_email_confirmation_ui.h"
 #include "chrome/browser/ui/webui/signin/signin_error_ui.h"
 #include "chrome/browser/ui/webui/signin/sync_confirmation_ui.h"
@@ -191,6 +191,10 @@
 #include "chrome/browser/ui/webui/app_list/start_page_ui.h"
 #endif
 
+#if BUILDFLAG(ENABLE_DICE_SUPPORT)
+#include "chrome/browser/ui/webui/signin/signin_dice_internals_ui.h"
+#endif
+
 #if BUILDFLAG(ENABLE_EXTENSIONS)
 #include "chrome/browser/extensions/extension_web_ui.h"
 #include "chrome/browser/ui/webui/extensions/extensions_ui.h"
@@ -397,12 +401,6 @@
       extensions::ExtensionSystem::Get(profile)->extension_service()) {
     return &NewWebUI<AppLauncherPageUI>;
   }
-  // Desktop Identity Consistency is only available on Windows, Linux and macOS.
-  if (url.host() == chrome::kChromeUISigninDiceInternalsHost &&
-      !profile->IsOffTheRecord() &&
-      switches::IsAccountConsistencyDiceEnabled()) {
-    return &NewWebUI<SigninDiceInternalsUI>;
-  }
 #endif  // defined(OS_CHROMEOS)
 
   // Bookmarks are part of NTP on Android.
@@ -567,6 +565,13 @@
   if (url.host_piece() == chrome::kChromeUIAppListStartPageHost)
     return &NewWebUI<app_list::StartPageUI>;
 #endif
+#if BUILDFLAG(ENABLE_DICE_SUPPORT)
+  if (url.host() == chrome::kChromeUISigninDiceInternalsHost &&
+      !profile->IsOffTheRecord() &&
+      switches::IsAccountConsistencyDiceEnabled()) {
+    return &NewWebUI<SigninDiceInternalsUI>;
+  }
+#endif
 #if BUILDFLAG(ENABLE_EXTENSIONS)
   if (url.host_piece() == chrome::kChromeUIExtensionsFrameHost)
     return &NewWebUI<extensions::ExtensionsUI>;

diff --git a/chrome/browser/ui/webui/predictors/predictors_handler.cc b/chrome/browser/ui/webui/predictors/predictors_handler.cc
index b28b00a..6156657d 100644
--- a/chrome/browser/ui/webui/predictors/predictors_handler.cc
+++ b/chrome/browser/ui/webui/predictors/predictors_handler.cc

@@ -97,20 +97,27 @@
   dict.SetBoolean("enabled", enabled);
 
   if (enabled) {
-    // Url Database cache.
-    auto db = base::MakeUnique<base::ListValue>();
     auto* resource_prefetch_predictor =
         loading_predictor_->resource_prefetch_predictor();
+    // URL table cache.
+    auto db = base::MakeUnique<base::ListValue>();
     AddPrefetchDataMapToListValue(
         *resource_prefetch_predictor->url_resource_data_->data_cache_,
         db.get());
     dict.Set("url_db", std::move(db));
 
+    // Host table cache.
     db = base::MakeUnique<base::ListValue>();
     AddPrefetchDataMapToListValue(
         *resource_prefetch_predictor->host_resource_data_->data_cache_,
         db.get());
     dict.Set("host_db", std::move(db));
+
+    // Origin table cache.
+    db = base::MakeUnique<base::ListValue>();
+    AddOriginDataMapToListValue(
+        *resource_prefetch_predictor->origin_data_->data_cache_, db.get());
+    dict.Set("origin_db", std::move(db));
   }
 
   web_ui()->CallJavascriptFunctionUnsafe("updateResourcePrefetchPredictorDb",
@@ -121,12 +128,11 @@
     const std::map<std::string, predictors::PrefetchData>& data_map,
     base::ListValue* db) const {
   for (const auto& p : data_map) {
-    std::unique_ptr<base::DictionaryValue> main(new base::DictionaryValue());
+    auto main = base::MakeUnique<base::DictionaryValue>();
     main->SetString("main_frame_url", p.first);
     auto resources = base::MakeUnique<base::ListValue>();
     for (const predictors::ResourceData& r : p.second.resources()) {
-      std::unique_ptr<base::DictionaryValue> resource(
-          new base::DictionaryValue());
+      auto resource = base::MakeUnique<base::DictionaryValue>();
       resource->SetString("resource_url", r.resource_url());
       resource->SetString("resource_type",
                           ConvertResourceType(r.resource_type()));
@@ -149,3 +155,28 @@
     db->Append(std::move(main));
   }
 }
+
+void PredictorsHandler::AddOriginDataMapToListValue(
+    const std::map<std::string, predictors::OriginData>& data_map,
+    base::ListValue* db) const {
+  for (const auto& p : data_map) {
+    auto main = base::MakeUnique<base::DictionaryValue>();
+    main->SetString("main_frame_host", p.first);
+    auto origins = base::MakeUnique<base::ListValue>();
+    for (const predictors::OriginStat& o : p.second.origins()) {
+      auto origin = base::MakeUnique<base::DictionaryValue>();
+      origin->SetString("origin", o.origin());
+      origin->SetInteger("number_of_hits", o.number_of_hits());
+      origin->SetInteger("number_of_misses", o.number_of_misses());
+      origin->SetInteger("consecutive_misses", o.consecutive_misses());
+      origin->SetDouble("position", o.average_position());
+      origin->SetBoolean("always_access_network", o.always_access_network());
+      origin->SetBoolean("accessed_network", o.accessed_network());
+      origin->SetDouble("score",
+                        ResourcePrefetchPredictorTables::ComputeOriginScore(o));
+      origins->Append(std::move(origin));
+    }
+    main->Set("origins", std::move(origins));
+    db->Append(std::move(main));
+  }
+}

diff --git a/chrome/browser/ui/webui/predictors/predictors_handler.h b/chrome/browser/ui/webui/predictors/predictors_handler.h
index 4f601ff..e9a4e086 100644
--- a/chrome/browser/ui/webui/predictors/predictors_handler.h
+++ b/chrome/browser/ui/webui/predictors/predictors_handler.h

@@ -39,10 +39,13 @@
   // DictionaryValue to the JS.
   void RequestResourcePrefetchPredictorDb(const base::ListValue* args);
 
-  // Helper for RequestResourcePrefetchPredictorDb.
+  // Helpers for RequestResourcePrefetchPredictorDb.
   void AddPrefetchDataMapToListValue(
       const std::map<std::string, predictors::PrefetchData>& data_map,
       base::ListValue* db) const;
+  void AddOriginDataMapToListValue(
+      const std::map<std::string, predictors::OriginData>& data_map,
+      base::ListValue* db) const;
 
   predictors::AutocompleteActionPredictor* autocomplete_action_predictor_;
   predictors::LoadingPredictor* loading_predictor_;

diff --git a/chrome/common/BUILD.gn b/chrome/common/BUILD.gn
index f6a7719..03da473 100644
--- a/chrome/common/BUILD.gn
+++ b/chrome/common/BUILD.gn

@@ -243,6 +243,7 @@
     "//components/policy/core/common",
     "//components/prefs",
     "//components/signin/core/common",
+    "//components/signin/core/common:signin_features",
     "//components/strings",
     "//components/translate/content/common",
     "//components/translate/core/common",

diff --git a/chrome/common/url_constants.cc b/chrome/common/url_constants.cc
index 86be9bc..43f5492 100644
--- a/chrome/common/url_constants.cc
+++ b/chrome/common/url_constants.cc

@@ -273,9 +273,12 @@
 const char kChromeUIPrintHost[] = "print";
 #endif  // ENABLE_PRINT_PREVIEW
 
+#if BUILDFLAG(ENABLE_DICE_SUPPORT)
+const char kChromeUISigninDiceInternalsHost[] = "signin-dice-internals";
+#endif
+
 #if defined(OS_WIN) || defined(OS_MACOSX) || defined(OS_LINUX)
 const char kChromeUIDiscardsHost[] = "discards";
-const char kChromeUISigninDiceInternalsHost[] = "signin-dice-internals";
 #endif
 
 #if defined(OS_POSIX) && !defined(OS_MACOSX) && !defined(OS_ANDROID)

diff --git a/chrome/common/url_constants.h b/chrome/common/url_constants.h
index 17e539b..8df1386 100644
--- a/chrome/common/url_constants.h
+++ b/chrome/common/url_constants.h

@@ -14,6 +14,7 @@
 
 #include "build/build_config.h"
 #include "chrome/common/features.h"
+#include "components/signin/core/common/signin_features.h"
 #include "content/public/common/url_constants.h"
 #include "media/media_features.h"
 #include "ppapi/features/features.h"
@@ -257,8 +258,11 @@
 extern const char kChromeUIPrintHost[];
 #endif  // ENABLE_PRINT_PREVIEW
 
-#if defined(OS_WIN) || defined(OS_MACOSX) || defined(OS_LINUX)
+#if BUILDFLAG(ENABLE_DICE_SUPPORT)
 extern const char kChromeUISigninDiceInternalsHost[];
+#endif
+
+#if defined(OS_WIN) || defined(OS_MACOSX) || defined(OS_LINUX)
 extern const char kChromeUIDiscardsHost[];
 #endif
 

diff --git a/chrome/test/BUILD.gn b/chrome/test/BUILD.gn
index af90168..d802aff 100644
--- a/chrome/test/BUILD.gn
+++ b/chrome/test/BUILD.gn

@@ -3722,6 +3722,7 @@
     sources -=
         [ "../browser/download/download_request_infobar_delegate_unittest.cc" ]
     deps += [
+      "//components/signin/core/common:signin_features",
       "//ipc",
       "//third_party/libaddressinput",
     ]

diff --git a/components/BUILD.gn b/components/BUILD.gn
index 97bb414..c61ae0ad 100644
--- a/components/BUILD.gn
+++ b/components/BUILD.gn

@@ -225,6 +225,8 @@
       "//components/subresource_filter/content/renderer:unit_tests",
       "//components/tracing:unit_tests",
       "//components/visitedlink/test:unit_tests",
+      "//components/viz/common:unit_tests",
+      "//components/viz/host:unit_tests",
       "//components/viz/service:unit_tests",
       "//components/wallpaper:unit_tests",
       "//components/web_cache/browser:unit_tests",

diff --git a/components/ntp_snippets/BUILD.gn b/components/ntp_snippets/BUILD.gn
index a7a6e3f1..a719f54f 100644
--- a/components/ntp_snippets/BUILD.gn
+++ b/components/ntp_snippets/BUILD.gn

@@ -15,10 +15,10 @@
     "bookmarks/bookmark_last_visit_utils.h",
     "bookmarks/bookmark_suggestions_provider.cc",
     "bookmarks/bookmark_suggestions_provider.h",
+    "breaking_news/breaking_news_gcm_app_handler.cc",
+    "breaking_news/breaking_news_gcm_app_handler.h",
     "breaking_news/breaking_news_suggestions_provider.cc",
     "breaking_news/breaking_news_suggestions_provider.h",
-    "breaking_news/content_suggestions_gcm_app_handler.cc",
-    "breaking_news/content_suggestions_gcm_app_handler.h",
     "breaking_news/subscription_json_request.cc",
     "breaking_news/subscription_json_request.h",
     "breaking_news/subscription_manager.cc",

diff --git a/components/ntp_snippets/breaking_news/content_suggestions_gcm_app_handler.cc b/components/ntp_snippets/breaking_news/breaking_news_gcm_app_handler.cc
similarity index 71%
rename from components/ntp_snippets/breaking_news/content_suggestions_gcm_app_handler.cc
rename to components/ntp_snippets/breaking_news/breaking_news_gcm_app_handler.cc
index 17009fa..d25f967 100644
--- a/components/ntp_snippets/breaking_news/content_suggestions_gcm_app_handler.cc
+++ b/components/ntp_snippets/breaking_news/breaking_news_gcm_app_handler.cc

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "components/ntp_snippets/breaking_news/content_suggestions_gcm_app_handler.h"
+#include "components/ntp_snippets/breaking_news/breaking_news_gcm_app_handler.h"
 
 #include "base/strings/string_util.h"
 #include "components/gcm_driver/gcm_driver.h"
@@ -29,7 +29,7 @@
 // Key of the suggestion json in the data in the pushed content suggestion.
 const char kPushedSuggestionKey[] = "payload";
 
-ContentSuggestionsGCMAppHandler::ContentSuggestionsGCMAppHandler(
+BreakingNewsGCMAppHandler::BreakingNewsGCMAppHandler(
     gcm::GCMDriver* gcm_driver,
     instance_id::InstanceIDDriver* instance_id_driver,
     PrefService* pref_service,
@@ -42,22 +42,22 @@
       parse_json_callback_(parse_json_callback),
       weak_factory_(this) {}
 
-ContentSuggestionsGCMAppHandler::~ContentSuggestionsGCMAppHandler() {
+BreakingNewsGCMAppHandler::~BreakingNewsGCMAppHandler() {
   StopListening();
 }
 
-void ContentSuggestionsGCMAppHandler::StartListening(
+void BreakingNewsGCMAppHandler::StartListening(
     OnNewContentCallback on_new_content_callback) {
 #if !defined(OS_ANDROID)
   NOTREACHED()
-      << "The ContentSuggestionsGCMAppHandler should only be used on Android.";
+      << "The BreakingNewsGCMAppHandler should only be used on Android.";
 #endif
   Subscribe();
   on_new_content_callback_ = std::move(on_new_content_callback);
   gcm_driver_->AddAppHandler(kContentSuggestionsGCMAppID, this);
 }
 
-void ContentSuggestionsGCMAppHandler::StopListening() {
+void BreakingNewsGCMAppHandler::StopListening() {
   DCHECK_EQ(gcm_driver_->GetAppHandler(kContentSuggestionsGCMAppID), this);
   gcm_driver_->RemoveAppHandler(kContentSuggestionsGCMAppID);
   on_new_content_callback_ = OnNewContentCallback();
@@ -68,7 +68,7 @@
   subscription_manager_->Unsubscribe(token);
 }
 
-void ContentSuggestionsGCMAppHandler::Subscribe() {
+void BreakingNewsGCMAppHandler::Subscribe() {
   std::string token = pref_service_->GetString(
       ntp_snippets::prefs::kContentSuggestionsGCMSubscriptionTokenCache);
   // If a token has been already obtained, subscribe directly at the content
@@ -83,13 +83,12 @@
   instance_id_driver_->GetInstanceID(kContentSuggestionsGCMAppID)
       ->GetToken(kContentSuggestionsGCMSenderId, kGCMScope,
                  std::map<std::string, std::string>() /* options */,
-                 base::Bind(&ContentSuggestionsGCMAppHandler::DidSubscribe,
+                 base::Bind(&BreakingNewsGCMAppHandler::DidSubscribe,
                             weak_factory_.GetWeakPtr()));
 }
 
-void ContentSuggestionsGCMAppHandler::DidSubscribe(
-    const std::string& subscription_id,
-    InstanceID::Result result) {
+void BreakingNewsGCMAppHandler::DidSubscribe(const std::string& subscription_id,
+                                             InstanceID::Result result) {
   switch (result) {
     case InstanceID::SUCCESS:
       pref_service_->SetString(
@@ -111,16 +110,15 @@
   }
 }
 
-void ContentSuggestionsGCMAppHandler::ShutdownHandler() {}
+void BreakingNewsGCMAppHandler::ShutdownHandler() {}
 
-void ContentSuggestionsGCMAppHandler::OnStoreReset() {
+void BreakingNewsGCMAppHandler::OnStoreReset() {
   pref_service_->ClearPref(
       ntp_snippets::prefs::kContentSuggestionsGCMSubscriptionTokenCache);
 }
 
-void ContentSuggestionsGCMAppHandler::OnMessage(
-    const std::string& app_id,
-    const gcm::IncomingMessage& message) {
+void BreakingNewsGCMAppHandler::OnMessage(const std::string& app_id,
+                                          const gcm::IncomingMessage& message) {
   DCHECK_EQ(app_id, kContentSuggestionsGCMAppID);
 
   gcm::MessageData::const_iterator it = message.data.find(kPushedSuggestionKey);
@@ -132,49 +130,47 @@
 
   std::string suggestions = it->second;
 
-  parse_json_callback_.Run(
-      suggestions,
-      base::Bind(&ContentSuggestionsGCMAppHandler::OnJsonSuccess,
-                 weak_factory_.GetWeakPtr()),
-      base::Bind(&ContentSuggestionsGCMAppHandler::OnJsonError,
-                 weak_factory_.GetWeakPtr(), suggestions));
+  parse_json_callback_.Run(suggestions,
+                           base::Bind(&BreakingNewsGCMAppHandler::OnJsonSuccess,
+                                      weak_factory_.GetWeakPtr()),
+                           base::Bind(&BreakingNewsGCMAppHandler::OnJsonError,
+                                      weak_factory_.GetWeakPtr(), suggestions));
 }
 
-void ContentSuggestionsGCMAppHandler::OnMessagesDeleted(
-    const std::string& app_id) {
+void BreakingNewsGCMAppHandler::OnMessagesDeleted(const std::string& app_id) {
   // Messages don't get deleted.
-  NOTREACHED() << "ContentSuggestionsGCMAppHandler messages don't get deleted.";
+  NOTREACHED() << "BreakingNewsGCMAppHandler messages don't get deleted.";
 }
 
-void ContentSuggestionsGCMAppHandler::OnSendError(
+void BreakingNewsGCMAppHandler::OnSendError(
     const std::string& app_id,
     const gcm::GCMClient::SendErrorDetails& details) {
   // Should never be called because we don't send GCM messages to
   // the server.
-  NOTREACHED() << "ContentSuggestionsGCMAppHandler doesn't send GCM messages.";
+  NOTREACHED() << "BreakingNewsGCMAppHandler doesn't send GCM messages.";
 }
 
-void ContentSuggestionsGCMAppHandler::OnSendAcknowledged(
+void BreakingNewsGCMAppHandler::OnSendAcknowledged(
     const std::string& app_id,
     const std::string& message_id) {
   // Should never be called because we don't send GCM messages to
   // the server.
-  NOTREACHED() << "ContentSuggestionsGCMAppHandler doesn't send GCM messages.";
+  NOTREACHED() << "BreakingNewsGCMAppHandler doesn't send GCM messages.";
 }
 
-void ContentSuggestionsGCMAppHandler::RegisterProfilePrefs(
+void BreakingNewsGCMAppHandler::RegisterProfilePrefs(
     PrefRegistrySimple* registry) {
   registry->RegisterStringPref(
       prefs::kContentSuggestionsGCMSubscriptionTokenCache, std::string());
 }
 
-void ContentSuggestionsGCMAppHandler::OnJsonSuccess(
+void BreakingNewsGCMAppHandler::OnJsonSuccess(
     std::unique_ptr<base::Value> content) {
   on_new_content_callback_.Run(std::move(content));
 }
 
-void ContentSuggestionsGCMAppHandler::OnJsonError(const std::string& json_str,
-                                                  const std::string& error) {
+void BreakingNewsGCMAppHandler::OnJsonError(const std::string& json_str,
+                                            const std::string& error) {
   LOG(WARNING) << "Error parsing JSON:" << error
                << " when parsing:" << json_str;
 }

diff --git a/components/ntp_snippets/breaking_news/content_suggestions_gcm_app_handler.h b/components/ntp_snippets/breaking_news/breaking_news_gcm_app_handler.h
similarity index 84%
rename from components/ntp_snippets/breaking_news/content_suggestions_gcm_app_handler.h
rename to components/ntp_snippets/breaking_news/breaking_news_gcm_app_handler.h
index 2f415be..c21a05b 100644
--- a/components/ntp_snippets/breaking_news/content_suggestions_gcm_app_handler.h
+++ b/components/ntp_snippets/breaking_news/breaking_news_gcm_app_handler.h

@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef COMPONENTS_NTP_SNIPPETS_BREAKING_NEWS_CONTENT_SUGGESTIONS_GCM_APP_HANDLER_H_
-#define COMPONENTS_NTP_SNIPPETS_BREAKING_NEWS_CONTENT_SUGGESTIONS_GCM_APP_HANDLER_H_
+#ifndef COMPONENTS_NTP_SNIPPETS_BREAKING_NEWS_BREAKING_NEWS_GCM_APP_HANDLER_H_
+#define COMPONENTS_NTP_SNIPPETS_BREAKING_NEWS_BREAKING_NEWS_GCM_APP_HANDLER_H_
 
 #include "base/memory/weak_ptr.h"
 #include "components/gcm_driver/gcm_app_handler.h"
@@ -24,10 +24,10 @@
 
 namespace ntp_snippets {
 
-// Handler for pushed GCM content suggestions. It retrieves a subscription token
+// Handler for pushed GCM breaking news. It retrieves a subscription token
 // from the GCM server and registers/unregisters itself with the GCM service to
-// be called upon received push content suggestions.
-class ContentSuggestionsGCMAppHandler : public gcm::GCMAppHandler {
+// be called upon received push breaking news.
+class BreakingNewsGCMAppHandler : public gcm::GCMAppHandler {
  public:
   // Callbacks for JSON parsing to allow injecting platform-dependent code.
   using SuccessCallback =
@@ -41,7 +41,7 @@
   using OnNewContentCallback =
       base::Callback<void(std::unique_ptr<base::Value> content)>;
 
-  ContentSuggestionsGCMAppHandler(
+  BreakingNewsGCMAppHandler(
       gcm::GCMDriver* gcm_driver,
       instance_id::InstanceIDDriver* instance_id_driver,
       PrefService* pref_service_,
@@ -49,7 +49,7 @@
       const ParseJSONCallback& parse_json_callback);
 
   // If still listening, calls StopListening()
-  ~ContentSuggestionsGCMAppHandler() override;
+  ~BreakingNewsGCMAppHandler() override;
 
   // Subscribe to the GCM service if necessary and start listening for pushed
   // content suggestions. Must not be called if already listening.
@@ -100,10 +100,10 @@
   // the content provider.
   OnNewContentCallback on_new_content_callback_;
 
-  base::WeakPtrFactory<ContentSuggestionsGCMAppHandler> weak_factory_;
+  base::WeakPtrFactory<BreakingNewsGCMAppHandler> weak_factory_;
 
-  DISALLOW_COPY_AND_ASSIGN(ContentSuggestionsGCMAppHandler);
+  DISALLOW_COPY_AND_ASSIGN(BreakingNewsGCMAppHandler);
 };
 }  // namespace ntp_snippets
 
-#endif  // COMPONENTS_NTP_SNIPPETS_BREAKING_NEWS_CONTENT_SUGGESTIONS_GCM_APP_HANDLER_H_
+#endif  // COMPONENTS_NTP_SNIPPETS_BREAKING_NEWS_BREAKING_NEWS_GCM_APP_HANDLER_H_

diff --git a/components/ntp_snippets/breaking_news/breaking_news_suggestions_provider.cc b/components/ntp_snippets/breaking_news/breaking_news_suggestions_provider.cc
index 305f650..0d57a2d 100644
--- a/components/ntp_snippets/breaking_news/breaking_news_suggestions_provider.cc
+++ b/components/ntp_snippets/breaking_news/breaking_news_suggestions_provider.cc

@@ -7,7 +7,7 @@
 #include "base/bind.h"
 #include "base/json/json_writer.h"
 #include "base/time/clock.h"
-#include "components/ntp_snippets/breaking_news/content_suggestions_gcm_app_handler.h"
+#include "components/ntp_snippets/breaking_news/breaking_news_gcm_app_handler.h"
 #include "components/ntp_snippets/category.h"
 #include "components/ntp_snippets/pref_names.h"
 #include "components/ntp_snippets/remote/json_to_categories.h"
@@ -17,7 +17,7 @@
 
 BreakingNewsSuggestionsProvider::BreakingNewsSuggestionsProvider(
     ContentSuggestionsProvider::Observer* observer,
-    std::unique_ptr<ContentSuggestionsGCMAppHandler> gcm_app_handler,
+    std::unique_ptr<BreakingNewsGCMAppHandler> gcm_app_handler,
     std::unique_ptr<base::Clock> clock,
     std::unique_ptr<RemoteSuggestionsDatabase> database)
     : ContentSuggestionsProvider(observer),

diff --git a/components/ntp_snippets/breaking_news/breaking_news_suggestions_provider.h b/components/ntp_snippets/breaking_news/breaking_news_suggestions_provider.h
index 0db1f78..df316a9 100644
--- a/components/ntp_snippets/breaking_news/breaking_news_suggestions_provider.h
+++ b/components/ntp_snippets/breaking_news/breaking_news_suggestions_provider.h

@@ -11,7 +11,7 @@
 #include "components/prefs/pref_registry_simple.h"
 
 namespace ntp_snippets {
-class ContentSuggestionsGCMAppHandler;
+class BreakingNewsGCMAppHandler;
 }
 
 namespace base {
@@ -26,7 +26,7 @@
  public:
   BreakingNewsSuggestionsProvider(
       ContentSuggestionsProvider::Observer* observer,
-      std::unique_ptr<ContentSuggestionsGCMAppHandler> gcm_app_handler,
+      std::unique_ptr<BreakingNewsGCMAppHandler> gcm_app_handler,
       std::unique_ptr<base::Clock> clock,
       std::unique_ptr<RemoteSuggestionsDatabase> database);
   ~BreakingNewsSuggestionsProvider() override;
@@ -67,7 +67,7 @@
   void NotifyNewSuggestions(
       std::vector<std::unique_ptr<RemoteSuggestion>> suggestions);
 
-  std::unique_ptr<ContentSuggestionsGCMAppHandler> gcm_app_handler_;
+  std::unique_ptr<BreakingNewsGCMAppHandler> gcm_app_handler_;
   std::unique_ptr<base::Clock> clock_;
 
   // The database for persisting suggestions.

diff --git a/components/ntp_snippets/features.cc b/components/ntp_snippets/features.cc
index e9539a6..d080397 100644
--- a/components/ntp_snippets/features.cc
+++ b/components/ntp_snippets/features.cc

@@ -70,6 +70,9 @@
                                                   kCategoryRankerParameter);
 
   if (category_ranker_value.empty()) {
+    // TODO(crbug.com/735066): Remove the experiment configurations from
+    // fieldtrial_testing_config.json when enabling ClickBasedRanker by default.
+
     // Default, Enabled or Disabled.
     return CategoryRankerChoice::CONSTANT;
   }

diff --git a/components/signin/core/browser/BUILD.gn b/components/signin/core/browser/BUILD.gn
index 8120e2a..ec35efad7 100644
--- a/components/signin/core/browser/BUILD.gn
+++ b/components/signin/core/browser/BUILD.gn

@@ -2,6 +2,8 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+import("//components/signin/features.gni")
+
 if (is_android) {
   import("//build/config/android/rules.gni")
 }
@@ -89,26 +91,28 @@
 
   public_deps = [
     ":account_info",
-    "//components/signin/core/account_id",
-    "//components/signin/core/common",
-  ]
-  deps = [
     "//base",
-    "//base:i18n",
     "//components/content_settings/core/browser",
     "//components/content_settings/core/common",
-    "//components/data_use_measurement/core",
-    "//components/google/core/browser",
     "//components/invalidation/public",
     "//components/keyed_service/core",
+    "//components/prefs",
+    "//components/signin/core/account_id",
+    "//components/signin/core/common",
+    "//components/signin/core/common:signin_features",
+    "//google_apis",
+    "//net",
+    "//url",
+  ]
+  deps = [
+    "//base:i18n",
+    "//components/data_use_measurement/core",
+    "//components/google/core/browser",
     "//components/metrics",
     "//components/os_crypt",
     "//components/pref_registry",
-    "//components/prefs",
     "//components/webdata/common",
     "//crypto",
-    "//google_apis",
-    "//net",
     "//sql",
     "//third_party/icu",
   ]
@@ -121,7 +125,7 @@
     ]
   }
 
-  if (is_android || is_ios) {
+  if (!enable_dice_support) {
     sources -= [
       "dice_header_helper.cc",
       "dice_header_helper.h",
@@ -188,6 +192,7 @@
     "//components/os_crypt:test_support",
     "//components/pref_registry:pref_registry",
     "//components/signin/core/common",
+    "//components/signin/core/common:signin_features",
     "//components/sync_preferences:test_support",
     "//testing/gmock",
   ]

diff --git a/components/signin/core/browser/signin_header_helper.cc b/components/signin/core/browser/signin_header_helper.cc
index 0331f65..1c1bbc86 100644
--- a/components/signin/core/browser/signin_header_helper.cc
+++ b/components/signin/core/browser/signin_header_helper.cc

@@ -18,7 +18,7 @@
 #include "net/base/escape.h"
 #include "net/url_request/url_request.h"
 
-#if !defined(OS_IOS) && !defined(OS_ANDROID)
+#if BUILDFLAG(ENABLE_DICE_SUPPORT)
 #include "components/signin/core/browser/dice_header_helper.h"
 #endif
 
@@ -127,8 +127,7 @@
     const content_settings::CookieSettings* cookie_settings,
     int profile_mode_mask) {
   const GURL& url = redirect_url.is_empty() ? request->url() : redirect_url;
-// Dice is not enabled on mobile.
-#if !defined(OS_IOS) && !defined(OS_ANDROID)
+#if BUILDFLAG(ENABLE_DICE_SUPPORT)
   DiceHeaderHelper dice_helper;
   std::string dice_header_value;
   if (dice_helper.ShouldBuildRequestHeader(url, cookie_settings)) {
@@ -155,7 +154,7 @@
   return ChromeConnectedHeaderHelper::BuildManageAccountsParams(header_value);
 }
 
-#if !defined(OS_IOS) && !defined(OS_ANDROID)
+#if BUILDFLAG(ENABLE_DICE_SUPPORT)
 DiceResponseParams BuildDiceResponseParams(const std::string& header_value) {
   return DiceHeaderHelper::BuildDiceResponseParams(header_value);
 }

diff --git a/components/signin/core/browser/signin_header_helper.h b/components/signin/core/browser/signin_header_helper.h
index c7249b2..28c57b0b 100644
--- a/components/signin/core/browser/signin_header_helper.h
+++ b/components/signin/core/browser/signin_header_helper.h

@@ -8,7 +8,7 @@
 #include <map>
 #include <string>
 
-#include "build/build_config.h"
+#include "components/signin/core/common/signin_features.h"
 #include "url/gurl.h"
 
 namespace content_settings {
@@ -155,7 +155,7 @@
 // header.
 ManageAccountsParams BuildManageAccountsParams(const std::string& header_value);
 
-#if !defined(OS_IOS) && !defined(OS_ANDROID)
+#if BUILDFLAG(ENABLE_DICE_SUPPORT)
 // Returns the parameters contained in the X-Chrome-ID-Consistency-Response
 // response header.
 // Returns DiceAction::NONE in case of error (such as missing or malformed

diff --git a/components/signin/core/browser/signin_header_helper_unittest.cc b/components/signin/core/browser/signin_header_helper_unittest.cc
index ed9f17b..8246c21 100644
--- a/components/signin/core/browser/signin_header_helper_unittest.cc
+++ b/components/signin/core/browser/signin_header_helper_unittest.cc

@@ -10,10 +10,10 @@
 #include "base/command_line.h"
 #include "base/message_loop/message_loop.h"
 #include "base/strings/stringprintf.h"
-#include "build/build_config.h"
 #include "components/content_settings/core/browser/cookie_settings.h"
 #include "components/signin/core/browser/chrome_connected_header_helper.h"
 #include "components/signin/core/common/profile_management_switches.h"
+#include "components/signin/core/common/signin_features.h"
 #include "components/sync_preferences/testing_pref_service_syncable.h"
 #include "google_apis/gaia/gaia_urls.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
@@ -21,7 +21,7 @@
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
 
-#if !defined(OS_IOS) && !defined(OS_ANDROID)
+#if BUILDFLAG(ENABLE_DICE_SUPPORT)
 #include "components/signin/core/browser/dice_header_helper.h"
 #endif
 
@@ -86,7 +86,7 @@
         url_request.get(), kChromeConnectedHeader, expected_request);
   }
 
-#if !defined(OS_IOS) && !defined(OS_ANDROID)
+#if BUILDFLAG(ENABLE_DICE_SUPPORT)
   void CheckDiceHeaderRequest(const GURL& url,
                               const std::string& account_id,
                               bool sync_enabled,
@@ -162,7 +162,7 @@
 
 // Mirror is always enabled on Android and iOS, so these tests are only relevant
 // on Desktop.
-#if !defined(OS_ANDROID) && !defined(OS_IOS)
+#if BUILDFLAG(ENABLE_DICE_SUPPORT)
 
 // Tests that the Mirror request is returned when the target is a Gaia URL, even
 // if account consistency is disabled.
@@ -287,7 +287,7 @@
   }
 }
 
-#endif  // !defined(OS_ANDROID) && !defined(OS_IOS)
+#endif  // BUILDFLAG(ENABLE_DICE_SUPPORT)
 
 // Tests that the Mirror header request is returned normally when the redirect
 // URL is eligible.

diff --git a/components/signin/core/common/BUILD.gn b/components/signin/core/common/BUILD.gn
index 670bde9c..c1a5c09b 100644
--- a/components/signin/core/common/BUILD.gn
+++ b/components/signin/core/common/BUILD.gn

@@ -2,6 +2,17 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+import("//build/buildflag_header.gni")
+import("//components/signin/features.gni")
+
+buildflag_header("signin_features") {
+  header = "signin_features.h"
+  flags = [
+    "ENABLE_DICE_SUPPORT=$enable_dice_support",
+    "ENABLE_MIRROR=$enable_mirror",
+  ]
+}
+
 static_library("common") {
   sources = [
     "profile_management_switches.cc",
@@ -15,4 +26,8 @@
   deps = [
     "//base",
   ]
+
+  public_deps = [
+    ":signin_features",
+  ]
 }

diff --git a/components/signin/core/common/profile_management_switches.cc b/components/signin/core/common/profile_management_switches.cc
index ad3303d..61dd356 100644
--- a/components/signin/core/common/profile_management_switches.cc
+++ b/components/signin/core/common/profile_management_switches.cc

@@ -9,12 +9,13 @@
 #include "base/command_line.h"
 #include "base/feature_list.h"
 #include "base/metrics/field_trial.h"
+#include "build/build_config.h"
 #include "components/signin/core/common/signin_switches.h"
 
 namespace switches {
 
 AccountConsistencyMethod GetAccountConsistencyMethod() {
-#if defined(OS_ANDROID) || defined(OS_IOS)
+#if BUILDFLAG(ENABLE_MIRROR)
   // Mirror is enabled on Android and iOS.
   return AccountConsistencyMethod::kMirror;
 #else
@@ -22,10 +23,14 @@
   std::string method = cmd->GetSwitchValueASCII(switches::kAccountConsistency);
   if (method == switches::kAccountConsistencyMirror)
     return AccountConsistencyMethod::kMirror;
+
+#if BUILDFLAG(ENABLE_DICE_SUPPORT)
   if (method == switches::kAccountConsistencyDice)
     return AccountConsistencyMethod::kDice;
+#endif
+
   return AccountConsistencyMethod::kDisabled;
-#endif  // defined(OS_ANDROID) || defined(OS_IOS)
+#endif  // BUILDFLAG(ENABLE_MIRROR)
 }
 
 bool IsAccountConsistencyMirrorEnabled() {
@@ -49,13 +54,13 @@
 }
 
 void EnableAccountConsistencyMirrorForTesting(base::CommandLine* command_line) {
-#if !defined(OS_ANDROID) && !defined(OS_IOS)
+#if !BUILDFLAG(ENABLE_MIRROR)
   command_line->AppendSwitchASCII(switches::kAccountConsistency,
                                   switches::kAccountConsistencyMirror);
 #endif
 }
 
-#if !defined(OS_ANDROID) && !defined(OS_IOS)
+#if BUILDFLAG(ENABLE_DICE_SUPPORT)
 void EnableAccountConsistencyDiceForTesting(base::CommandLine* command_line) {
   command_line->AppendSwitchASCII(switches::kAccountConsistency,
                                   switches::kAccountConsistencyDice);

diff --git a/components/signin/core/common/profile_management_switches.h b/components/signin/core/common/profile_management_switches.h
index ed6487d3..9642ef5 100644
--- a/components/signin/core/common/profile_management_switches.h
+++ b/components/signin/core/common/profile_management_switches.h

@@ -9,7 +9,7 @@
 #ifndef COMPONENTS_SIGNIN_CORE_COMMON_PROFILE_MANAGEMENT_SWITCHES_H_
 #define COMPONENTS_SIGNIN_CORE_COMMON_PROFILE_MANAGEMENT_SWITCHES_H_
 
-#include "build/build_config.h"
+#include "components/signin/core/common/signin_features.h"
 
 namespace base {
 class CommandLine;
@@ -40,8 +40,7 @@
 // Called in tests to force enable Mirror account consistency.
 void EnableAccountConsistencyMirrorForTesting(base::CommandLine* command_line);
 
-// Dice is only supported on desktop.
-#if !defined(OS_ANDROID) && !defined(OS_IOS)
+#if BUILDFLAG(ENABLE_DICE_SUPPORT)
 // Called in tests to force enable Dice account consistency.
 void EnableAccountConsistencyDiceForTesting(base::CommandLine* command_line);
 #endif

diff --git a/components/signin/core/common/signin_switches.cc b/components/signin/core/common/signin_switches.cc
index 1ed3686..5ef25b7 100644
--- a/components/signin/core/common/signin_switches.cc
+++ b/components/signin/core/common/signin_switches.cc

@@ -16,7 +16,7 @@
 // Disables sending signin scoped device id to LSO with refresh token request.
 const char kDisableSigninScopedDeviceId[] = "disable-signin-scoped-device-id";
 
-#if !defined(OS_ANDROID) && !defined(OS_IOS)
+#if !BUILDFLAG(ENABLE_MIRROR)
 // Command line flag for enabling account consistency. Default mode is disabled.
 // Mirror is a legacy mode in which Google accounts are always addded to Chrome,
 // and Chrome then adds them to the Google authentication cookies.

diff --git a/components/signin/core/common/signin_switches.h b/components/signin/core/common/signin_switches.h
index 213e0e92..5038a1e 100644
--- a/components/signin/core/common/signin_switches.h
+++ b/components/signin/core/common/signin_switches.h

@@ -5,8 +5,7 @@
 #ifndef COMPONENTS_SIGNIN_CORE_COMMON_SIGNIN_SWITCHES_H_
 #define COMPONENTS_SIGNIN_CORE_COMMON_SIGNIN_SWITCHES_H_
 
-#include "base/feature_list.h"
-#include "build/build_config.h"
+#include "components/signin/core/common/signin_features.h"
 
 namespace switches {
 
@@ -23,7 +22,7 @@
 extern const char kEnableSigninPromo[];
 extern const char kExtensionsMultiAccount[];
 
-#if !defined(OS_ANDROID) && !defined(OS_IOS)
+#if !BUILDFLAG(ENABLE_MIRROR)
 // Note: Account consistency (Mirror) is already enabled on mobile platforms, so
 // this switch only exist on desktop platforms.
 extern const char kAccountConsistency[];

diff --git a/components/signin/features.gni b/components/signin/features.gni
new file mode 100644
index 0000000..f4636ab
--- /dev/null
+++ b/components/signin/features.gni

@@ -0,0 +1,9 @@
+# Copyright 2017 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Dice is supported on the platform (but not necessarily enabled).
+enable_dice_support = (is_linux && !is_chromeos) || is_mac || is_win
+
+# Mirror is enabled and other account consistency mechanisms are not available.
+enable_mirror = is_android || is_ios

diff --git a/components/storage_monitor/portable_device_watcher_win.cc b/components/storage_monitor/portable_device_watcher_win.cc
index 62a08a0..d6911e2 100644
--- a/components/storage_monitor/portable_device_watcher_win.cc
+++ b/components/storage_monitor/portable_device_watcher_win.cc

@@ -17,7 +17,8 @@
 #include "base/stl_util.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
-#include "base/threading/sequenced_worker_pool.h"
+#include "base/task_scheduler/post_task.h"
+#include "base/threading/thread_restrictions.h"
 #include "base/win/scoped_co_mem.h"
 #include "base/win/scoped_comptr.h"
 #include "base/win/scoped_propvariant.h"
@@ -32,9 +33,6 @@
 // Name of the client application that communicates with the MTP device.
 const base::char16 kClientName[] = L"Chromium";
 
-// Name of the sequenced task runner.
-const char kMediaTaskRunnerName[] = "media-task-runner";
-
 // Returns true if |data| represents a class of portable devices.
 bool IsPortableDeviceStructure(LPARAM data) {
   DEV_BROADCAST_HDR* broadcast_hdr =
@@ -317,8 +315,8 @@
 base::string16 GetDeviceNameOnBlockingThread(
     IPortableDeviceManager* portable_device_manager,
     const base::string16& pnp_device_id) {
-  DCHECK(content::BrowserThread::GetBlockingPool()->RunsTasksOnCurrentThread());
   DCHECK(portable_device_manager);
+  base::ThreadRestrictions::AssertIOAllowed();
   base::string16 name;
   GetFriendlyName(pnp_device_id, portable_device_manager, &name) ||
       GetDeviceDescription(pnp_device_id, portable_device_manager, &name) ||
@@ -331,8 +329,8 @@
 bool GetDeviceStorageObjectsOnBlockingThread(
     const base::string16& pnp_device_id,
     PortableDeviceWatcherWin::StorageObjects* storage_objects) {
-  DCHECK(content::BrowserThread::GetBlockingPool()->RunsTasksOnCurrentThread());
   DCHECK(storage_objects);
+  base::ThreadRestrictions::AssertIOAllowed();
   base::win::ScopedComPtr<IPortableDevice> device;
   if (!SetUp(pnp_device_id, &device))
     return false;
@@ -369,10 +367,10 @@
     IPortableDeviceManager* portable_device_manager,
     const base::string16& pnp_device_id,
     PortableDeviceWatcherWin::DeviceDetails* device_details) {
-  DCHECK(content::BrowserThread::GetBlockingPool()->RunsTasksOnCurrentThread());
   DCHECK(portable_device_manager);
   DCHECK(device_details);
   DCHECK(!pnp_device_id.empty());
+  base::ThreadRestrictions::AssertIOAllowed();
   device_details->name = GetDeviceNameOnBlockingThread(portable_device_manager,
                                                        pnp_device_id);
   if (IsMassStoragePortableDevice(pnp_device_id, device_details->name))
@@ -388,7 +386,7 @@
 // returns true and fills in |portable_device_mgr|. On failure, returns false.
 bool GetPortableDeviceManager(
   base::win::ScopedComPtr<IPortableDeviceManager>* portable_device_mgr) {
-  DCHECK(content::BrowserThread::GetBlockingPool()->RunsTasksOnCurrentThread());
+  base::ThreadRestrictions::AssertIOAllowed();
   HRESULT hr = ::CoCreateInstance(
       __uuidof(PortableDeviceManager), NULL, CLSCTX_INPROC_SERVER,
       IID_PPV_ARGS(portable_device_mgr->GetAddressOf()));
@@ -406,8 +404,8 @@
 // false.
 bool EnumerateAttachedDevicesOnBlockingThread(
     PortableDeviceWatcherWin::Devices* devices) {
-  DCHECK(content::BrowserThread::GetBlockingPool()->RunsTasksOnCurrentThread());
   DCHECK(devices);
+  base::ThreadRestrictions::AssertIOAllowed();
   base::win::ScopedComPtr<IPortableDeviceManager> portable_device_mgr;
   if (!GetPortableDeviceManager(&portable_device_mgr))
     return false;
@@ -441,8 +439,8 @@
 bool HandleDeviceAttachedEventOnBlockingThread(
     const base::string16& pnp_device_id,
     PortableDeviceWatcherWin::DeviceDetails* device_details) {
-  DCHECK(content::BrowserThread::GetBlockingPool()->RunsTasksOnCurrentThread());
   DCHECK(device_details);
+  base::ThreadRestrictions::AssertIOAllowed();
   base::win::ScopedComPtr<IPortableDeviceManager> portable_device_mgr;
   if (!GetPortableDeviceManager(&portable_device_mgr))
     return false;
@@ -503,10 +501,9 @@
 void PortableDeviceWatcherWin::Init(HWND hwnd) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
   notifications_ = RegisterPortableDeviceNotification(hwnd);
-  base::SequencedWorkerPool* pool = content::BrowserThread::GetBlockingPool();
-  media_task_runner_ = pool->GetSequencedTaskRunnerWithShutdownBehavior(
-      pool->GetNamedSequenceToken(kMediaTaskRunnerName),
-      base::SequencedWorkerPool::CONTINUE_ON_SHUTDOWN);
+  media_task_runner_ = base::CreateSequencedTaskRunnerWithTraits(
+      {base::MayBlock(), base::TaskPriority::BACKGROUND,
+       base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN});
   EnumerateAttachedDevices();
 }
 

diff --git a/components/viz/common/BUILD.gn b/components/viz/common/BUILD.gn
index 01f96cb..e703006 100644
--- a/components/viz/common/BUILD.gn
+++ b/components/viz/common/BUILD.gn

@@ -20,3 +20,17 @@
     "//ui/gfx",
   ]
 }
+
+source_set("unit_tests") {
+  testonly = true
+  sources = [
+    "server_gpu_memory_buffer_manager_unittest.cc",
+  ]
+
+  deps = [
+    ":common",
+    "//base/test:test_support",
+    "//services/ui/gpu/interfaces",
+    "//testing/gtest",
+  ]
+}

diff --git a/components/viz/common/DEPS b/components/viz/common/DEPS
index 9b455745..f3d7ee5 100644
--- a/components/viz/common/DEPS
+++ b/components/viz/common/DEPS

@@ -1,3 +1,9 @@
 include_rules = [
   "+services/ui/gpu/interfaces",
 ]
+
+specific_include_rules = {
+  "server_gpu_memory_buffer_manager_unittest\.cc": [
+    "+ui/gfx",
+  ]
+}

diff --git a/components/viz/common/server_gpu_memory_buffer_manager.cc b/components/viz/common/server_gpu_memory_buffer_manager.cc
index 23fe894..7690382 100644
--- a/components/viz/common/server_gpu_memory_buffer_manager.cc
+++ b/components/viz/common/server_gpu_memory_buffer_manager.cc

@@ -5,6 +5,7 @@
 #include "components/viz/common/server_gpu_memory_buffer_manager.h"
 
 #include "base/logging.h"
+#include "base/threading/sequenced_task_runner_handle.h"
 #include "gpu/ipc/client/gpu_memory_buffer_impl.h"
 #include "gpu/ipc/client/gpu_memory_buffer_impl_shared_memory.h"
 #include "gpu/ipc/common/gpu_memory_buffer_support.h"
@@ -18,36 +19,42 @@
     : gpu_service_(gpu_service),
       client_id_(client_id),
       native_configurations_(gpu::GetNativeGpuMemoryBufferConfigurations()),
+      task_runner_(base::SequencedTaskRunnerHandle::Get()),
       weak_factory_(this) {}
 
 ServerGpuMemoryBufferManager::~ServerGpuMemoryBufferManager() {}
 
-gfx::GpuMemoryBufferHandle
-ServerGpuMemoryBufferManager::CreateGpuMemoryBufferHandle(
+void ServerGpuMemoryBufferManager::AllocateGpuMemoryBuffer(
     gfx::GpuMemoryBufferId id,
     int client_id,
     const gfx::Size& size,
     gfx::BufferFormat format,
     gfx::BufferUsage usage,
-    gpu::SurfaceHandle surface_handle) {
-  DCHECK(CalledOnValidThread());
+    gpu::SurfaceHandle surface_handle,
+    base::OnceCallback<void(const gfx::GpuMemoryBufferHandle&)> callback) {
+  DCHECK(task_runner_->RunsTasksInCurrentSequence());
   if (gpu::GetNativeGpuMemoryBufferType() != gfx::EMPTY_BUFFER) {
     const bool is_native = native_configurations_.find(std::make_pair(
                                format, usage)) != native_configurations_.end();
     if (is_native) {
-      gfx::GpuMemoryBufferHandle handle;
-      gpu_service_->CreateGpuMemoryBuffer(id, size, format, usage, client_id,
-                                          surface_handle, &handle);
-      if (!handle.is_null())
-        native_buffers_[client_id].insert(handle.id);
-      return handle;
+      pending_buffers_.insert(client_id);
+      gpu_service_->CreateGpuMemoryBuffer(
+          id, size, format, usage, client_id, surface_handle,
+          base::Bind(&ServerGpuMemoryBufferManager::OnGpuMemoryBufferAllocated,
+                     weak_factory_.GetWeakPtr(), client_id,
+                     base::Passed(std::move(callback))));
+      return;
     }
   }
 
   DCHECK(gpu::GpuMemoryBufferImplSharedMemory::IsUsageSupported(usage))
       << static_cast<int>(usage);
-  return gpu::GpuMemoryBufferImplSharedMemory::CreateGpuMemoryBuffer(id, size,
-                                                                     format);
+  task_runner_->PostTask(
+      FROM_HERE,
+      base::BindOnce(
+          std::move(callback),
+          gpu::GpuMemoryBufferImplSharedMemory::CreateGpuMemoryBuffer(id, size,
+                                                                      format)));
 }
 
 std::unique_ptr<gfx::GpuMemoryBuffer>
@@ -57,8 +64,27 @@
     gfx::BufferUsage usage,
     gpu::SurfaceHandle surface_handle) {
   gfx::GpuMemoryBufferId id(next_gpu_memory_id_++);
-  gfx::GpuMemoryBufferHandle handle = CreateGpuMemoryBufferHandle(
-      id, client_id_, size, format, usage, surface_handle);
+  gfx::GpuMemoryBufferHandle handle;
+  base::WaitableEvent wait_event(
+      base::WaitableEvent::ResetPolicy::MANUAL,
+      base::WaitableEvent::InitialState::NOT_SIGNALED);
+  DCHECK(!task_runner_->RunsTasksInCurrentSequence());
+  auto reply_callback = base::BindOnce(
+      [](gfx::GpuMemoryBufferHandle* handle, base::WaitableEvent* wait_event,
+         const gfx::GpuMemoryBufferHandle& allocated_buffer_handle) {
+        *handle = allocated_buffer_handle;
+        wait_event->Signal();
+      },
+      &handle, &wait_event);
+  // We block with a WaitableEvent until the callback is run. So using
+  // base::Unretained() is safe here.
+  auto allocate_callback =
+      base::BindOnce(&ServerGpuMemoryBufferManager::AllocateGpuMemoryBuffer,
+                     base::Unretained(this), id, client_id_, size, format,
+                     usage, surface_handle, std::move(reply_callback));
+  task_runner_->PostTask(FROM_HERE, std::move(allocate_callback));
+  base::ThreadRestrictions::ScopedAllowWait allow_wait;
+  wait_event.Wait();
   if (handle.is_null())
     return nullptr;
   return gpu::GpuMemoryBufferImpl::CreateFromHandle(
@@ -70,7 +96,6 @@
 void ServerGpuMemoryBufferManager::SetDestructionSyncToken(
     gfx::GpuMemoryBuffer* buffer,
     const gpu::SyncToken& sync_token) {
-  DCHECK(CalledOnValidThread());
   static_cast<gpu::GpuMemoryBufferImpl*>(buffer)->set_destruction_sync_token(
       sync_token);
 }
@@ -79,17 +104,37 @@
     gfx::GpuMemoryBufferId id,
     int client_id,
     const gpu::SyncToken& sync_token) {
-  DCHECK(CalledOnValidThread());
+  DCHECK(task_runner_->RunsTasksInCurrentSequence());
   if (native_buffers_[client_id].erase(id))
     gpu_service_->DestroyGpuMemoryBuffer(id, client_id, sync_token);
 }
 
 void ServerGpuMemoryBufferManager::DestroyAllGpuMemoryBufferForClient(
     int client_id) {
-  DCHECK(CalledOnValidThread());
+  DCHECK(task_runner_->RunsTasksInCurrentSequence());
   for (gfx::GpuMemoryBufferId id : native_buffers_[client_id])
     gpu_service_->DestroyGpuMemoryBuffer(id, client_id, gpu::SyncToken());
   native_buffers_.erase(client_id);
+  pending_buffers_.erase(client_id);
+}
+
+void ServerGpuMemoryBufferManager::OnGpuMemoryBufferAllocated(
+    int client_id,
+    base::OnceCallback<void(const gfx::GpuMemoryBufferHandle&)> callback,
+    const gfx::GpuMemoryBufferHandle& handle) {
+  DCHECK(task_runner_->RunsTasksInCurrentSequence());
+  if (pending_buffers_.find(client_id) == pending_buffers_.end()) {
+    // The client has been destroyed since the allocation request was made.
+    if (!handle.is_null()) {
+      gpu_service_->DestroyGpuMemoryBuffer(handle.id, client_id,
+                                           gpu::SyncToken());
+    }
+    std::move(callback).Run(gfx::GpuMemoryBufferHandle());
+    return;
+  }
+  if (!handle.is_null())
+    native_buffers_[client_id].insert(handle.id);
+  std::move(callback).Run(handle);
 }
 
 }  // namespace viz

diff --git a/components/viz/common/server_gpu_memory_buffer_manager.h b/components/viz/common/server_gpu_memory_buffer_manager.h
index c34eda825..f546bc7 100644
--- a/components/viz/common/server_gpu_memory_buffer_manager.h
+++ b/components/viz/common/server_gpu_memory_buffer_manager.h

@@ -9,7 +9,8 @@
 
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
-#include "base/threading/thread_checker.h"
+#include "base/sequenced_task_runner.h"
+#include "base/synchronization/waitable_event.h"
 #include "gpu/command_buffer/client/gpu_memory_buffer_manager.h"
 #include "gpu/ipc/host/gpu_memory_buffer_support.h"
 
@@ -23,8 +24,9 @@
 
 // This GpuMemoryBufferManager implementation is for [de]allocating gpu memory
 // from the gpu process over the mojom.GpuService api.
-class ServerGpuMemoryBufferManager : public gpu::GpuMemoryBufferManager,
-                                     public base::ThreadChecker {
+// Note that |CreateGpuMemoryBuffer()| can be called on any thread. All the rest
+// of the functions must be called on the thread this object is created on.
+class ServerGpuMemoryBufferManager : public gpu::GpuMemoryBufferManager {
  public:
   ServerGpuMemoryBufferManager(ui::mojom::GpuService* gpu_service,
                                int client_id);
@@ -36,13 +38,14 @@
 
   void DestroyAllGpuMemoryBufferForClient(int client_id);
 
-  gfx::GpuMemoryBufferHandle CreateGpuMemoryBufferHandle(
+  void AllocateGpuMemoryBuffer(
       gfx::GpuMemoryBufferId id,
       int client_id,
       const gfx::Size& size,
       gfx::BufferFormat format,
       gfx::BufferUsage usage,
-      gpu::SurfaceHandle surface_handle);
+      gpu::SurfaceHandle surface_handle,
+      base::OnceCallback<void(const gfx::GpuMemoryBufferHandle&)> callback);
 
   // Overridden from gpu::GpuMemoryBufferManager:
   std::unique_ptr<gfx::GpuMemoryBuffer> CreateGpuMemoryBuffer(
@@ -54,6 +57,11 @@
                                const gpu::SyncToken& sync_token) override;
 
  private:
+  void OnGpuMemoryBufferAllocated(
+      int client_id,
+      base::OnceCallback<void(const gfx::GpuMemoryBufferHandle&)> callback,
+      const gfx::GpuMemoryBufferHandle& handle);
+
   ui::mojom::GpuService* gpu_service_;
   const int client_id_;
   int next_gpu_memory_id_ = 1;
@@ -62,8 +70,10 @@
       std::unordered_set<gfx::GpuMemoryBufferId,
                          BASE_HASH_NAMESPACE::hash<gfx::GpuMemoryBufferId>>;
   std::unordered_map<int, NativeBuffers> native_buffers_;
+  std::unordered_set<int> pending_buffers_;
 
   const gpu::GpuMemoryBufferConfigurationSet native_configurations_;
+  scoped_refptr<base::SequencedTaskRunner> task_runner_;
   base::WeakPtrFactory<ServerGpuMemoryBufferManager> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(ServerGpuMemoryBufferManager);

diff --git a/components/viz/common/server_gpu_memory_buffer_manager_unittest.cc b/components/viz/common/server_gpu_memory_buffer_manager_unittest.cc
new file mode 100644
index 0000000..7668529
--- /dev/null
+++ b/components/viz/common/server_gpu_memory_buffer_manager_unittest.cc

@@ -0,0 +1,211 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/viz/common/server_gpu_memory_buffer_manager.h"
+
+#include "base/test/scoped_task_environment.h"
+#include "gpu/ipc/host/gpu_memory_buffer_support.h"
+#include "services/ui/gpu/interfaces/gpu_service.mojom.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "ui/gfx/client_native_pixmap_factory.h"
+
+namespace viz {
+
+namespace {
+
+class TestGpuService : public ui::mojom::GpuService {
+ public:
+  TestGpuService() {}
+  ~TestGpuService() override {}
+
+  bool HasAllocationRequest(gfx::GpuMemoryBufferId id, int client_id) const {
+    for (const auto& req : allocation_requests_) {
+      if (req.id == id && req.client_id == client_id)
+        return true;
+    }
+    return false;
+  }
+
+  bool HasDestructionRequest(gfx::GpuMemoryBufferId id, int client_id) const {
+    for (const auto& req : destruction_requests_) {
+      if (req.id == id && req.client_id == client_id)
+        return true;
+    }
+    return false;
+  }
+
+  void SatisfyAllocationRequest(gfx::GpuMemoryBufferId id, int client_id) {
+    for (const auto& req : allocation_requests_) {
+      if (req.id == id && req.client_id == client_id) {
+        gfx::GpuMemoryBufferHandle handle;
+        handle.id = id;
+        handle.type = gfx::SHARED_MEMORY_BUFFER;
+        req.callback.Run(handle);
+        return;
+      }
+    }
+    NOTREACHED();
+  }
+
+  // ui::mojom::GpuService:
+  void EstablishGpuChannel(
+      int32_t client_id,
+      uint64_t client_tracing_id,
+      bool is_gpu_host,
+      const EstablishGpuChannelCallback& callback) override {}
+
+  void CloseChannel(int32_t client_id) override {}
+
+  void CreateGpuMemoryBuffer(
+      gfx::GpuMemoryBufferId id,
+      const gfx::Size& size,
+      gfx::BufferFormat format,
+      gfx::BufferUsage usage,
+      int client_id,
+      gpu::SurfaceHandle surface_handle,
+      const CreateGpuMemoryBufferCallback& callback) override {
+    allocation_requests_.push_back(
+        {id, size, format, usage, client_id, callback});
+  }
+
+  void DestroyGpuMemoryBuffer(gfx::GpuMemoryBufferId id,
+                              int client_id,
+                              const gpu::SyncToken& sync_token) override {
+    destruction_requests_.push_back({id, client_id});
+  }
+
+  void GetVideoMemoryUsageStats(
+      const GetVideoMemoryUsageStatsCallback& callback) override {}
+
+  void RequestCompleteGpuInfo(
+      const RequestCompleteGpuInfoCallback& callback) override {}
+
+  void LoadedShader(const std::string& data) override {}
+
+  void DestroyingVideoSurface(
+      int32_t surface_id,
+      const DestroyingVideoSurfaceCallback& callback) override {}
+
+  void WakeUpGpu() override {}
+
+  void GpuSwitched() override {}
+
+  void DestroyAllChannels() override {}
+
+  void Crash() override {}
+
+  void Hang() override {}
+
+  void ThrowJavaException() override {}
+
+  void Stop(const StopCallback& callback) override {}
+
+ private:
+  struct AllocationRequest {
+    const gfx::GpuMemoryBufferId id;
+    const gfx::Size size;
+    const gfx::BufferFormat format;
+    const gfx::BufferUsage usage;
+    const int client_id;
+    const CreateGpuMemoryBufferCallback callback;
+  };
+  std::vector<AllocationRequest> allocation_requests_;
+
+  struct DestructionRequest {
+    const gfx::GpuMemoryBufferId id;
+    const int client_id;
+  };
+  std::vector<DestructionRequest> destruction_requests_;
+
+  DISALLOW_COPY_AND_ASSIGN(TestGpuService);
+};
+
+// It is necessary to install a custom pixmap factory which claims to support
+// all native configurations, so that code that deals with this can be tested
+// correctly.
+class FakeClientNativePixmapFactory : public gfx::ClientNativePixmapFactory {
+ public:
+  FakeClientNativePixmapFactory() {}
+  ~FakeClientNativePixmapFactory() override {}
+
+  // gfx::ClientNativePixmapFactory:
+  bool IsConfigurationSupported(gfx::BufferFormat format,
+                                gfx::BufferUsage usage) const override {
+    return true;
+  }
+  std::unique_ptr<gfx::ClientNativePixmap> ImportFromHandle(
+      const gfx::NativePixmapHandle& handle,
+      const gfx::Size& size,
+      gfx::BufferUsage usage) override {
+    NOTREACHED();
+    return nullptr;
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(FakeClientNativePixmapFactory);
+};
+
+}  // namespace
+
+class ServerGpuMemoryBufferManagerTest : public ::testing::Test {
+ public:
+  ServerGpuMemoryBufferManagerTest() = default;
+  ~ServerGpuMemoryBufferManagerTest() override = default;
+
+  // ::testing::Test:
+  void SetUp() override {
+    gfx::ClientNativePixmapFactory::ResetInstance();
+    gfx::ClientNativePixmapFactory::SetInstance(&pixmap_factory_);
+  }
+
+  void TearDown() override { gfx::ClientNativePixmapFactory::ResetInstance(); }
+
+ private:
+  base::test::ScopedTaskEnvironment env_;
+  FakeClientNativePixmapFactory pixmap_factory_;
+
+  DISALLOW_COPY_AND_ASSIGN(ServerGpuMemoryBufferManagerTest);
+};
+
+// Tests that allocation requests from a client that goes away before allocation
+// completes are cleaned up correctly.
+TEST_F(ServerGpuMemoryBufferManagerTest, AllocationRequestsForDestroyedClient) {
+#if !defined(USE_OZONE) && !defined(OS_MACOSX)
+  // Not all platforms support native configurations (currently only ozone and
+  // mac support it). Abort the test in those platforms.
+  DCHECK(gpu::GetNativeGpuMemoryBufferConfigurations().empty());
+  return;
+#else
+  // Note: ServerGpuMemoryBufferManager normally operates on a mojom::GpuService
+  // implementation over mojo. Which means the communication from SGMBManager to
+  // GpuService is asynchronous. In this test, the mojom::GpuService is not
+  // bound to a mojo pipe, which means those calls are all synchronous.
+  TestGpuService gpu_service;
+  ServerGpuMemoryBufferManager manager(&gpu_service, 1);
+
+  const auto buffer_id = static_cast<gfx::GpuMemoryBufferId>(1);
+  const int client_id = 2;
+  const gfx::Size size(10, 20);
+  const gfx::BufferFormat format = gfx::BufferFormat::RGBA_8888;
+  const gfx::BufferUsage usage = gfx::BufferUsage::GPU_READ;
+  manager.AllocateGpuMemoryBuffer(
+      buffer_id, client_id, size, format, usage, gpu::kNullSurfaceHandle,
+      base::BindOnce([](const gfx::GpuMemoryBufferHandle& handle) {}));
+  EXPECT_TRUE(gpu_service.HasAllocationRequest(buffer_id, client_id));
+  EXPECT_FALSE(gpu_service.HasDestructionRequest(buffer_id, client_id));
+
+  // Destroy the client. Since no memory has been allocated yet, there will be
+  // no request for freeing memory.
+  manager.DestroyAllGpuMemoryBufferForClient(client_id);
+  EXPECT_TRUE(gpu_service.HasAllocationRequest(buffer_id, client_id));
+  EXPECT_FALSE(gpu_service.HasDestructionRequest(buffer_id, client_id));
+
+  // When the host receives the allocated memory for the destroyed client, it
+  // should request the allocated memory to be freed.
+  gpu_service.SatisfyAllocationRequest(buffer_id, client_id);
+  EXPECT_TRUE(gpu_service.HasDestructionRequest(buffer_id, client_id));
+#endif
+}
+
+}  // namespace viz

diff --git a/components/viz/host/BUILD.gn b/components/viz/host/BUILD.gn
index 06d7982e..cfc7f81 100644
--- a/components/viz/host/BUILD.gn
+++ b/components/viz/host/BUILD.gn

@@ -18,3 +18,22 @@
     "//cc/surfaces",
   ]
 }
+
+source_set("unit_tests") {
+  testonly = true
+
+  sources = [
+    "frame_sink_manager_host_unittests.cc",
+  ]
+
+  deps = [
+    "//base",
+    "//base/test:test_support",
+    "//cc/ipc:interfaces",
+    "//cc/surfaces",
+    "//components/viz/host",
+    "//mojo/public/cpp/bindings",
+    "//testing/gmock",
+    "//testing/gtest",
+  ]
+}

diff --git a/components/viz/host/frame_sink_manager_host_unittests.cc b/components/viz/host/frame_sink_manager_host_unittests.cc
new file mode 100644
index 0000000..bb5643b
--- /dev/null
+++ b/components/viz/host/frame_sink_manager_host_unittests.cc

@@ -0,0 +1,159 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/viz/host/frame_sink_manager_host.h"
+
+#include <memory>
+#include <utility>
+
+#include "base/macros.h"
+#include "base/message_loop/message_loop.h"
+#include "base/run_loop.h"
+#include "cc/ipc/frame_sink_manager.mojom.h"
+#include "cc/surfaces/frame_sink_id.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace viz {
+namespace test {
+namespace {
+
+constexpr cc::FrameSinkId kFrameSinkId1(1, 1);
+constexpr cc::FrameSinkId kFrameSinkId2(1, 1);
+
+ACTION_P(InvokeClosure, closure) {
+  closure.Run();
+}
+
+// A stub MojoCompositorFrameSinkClient that does nothing.
+class StubClientCompositorFrameSink
+    : public cc::mojom::MojoCompositorFrameSinkClient {
+ public:
+  StubClientCompositorFrameSink() : binding_(this) {}
+  ~StubClientCompositorFrameSink() override = default;
+
+  cc::mojom::MojoCompositorFrameSinkClientPtr GetInterfacePtr() {
+    cc::mojom::MojoCompositorFrameSinkClientPtr client;
+    binding_.Bind(mojo::MakeRequest(&client));
+    return client;
+  }
+
+ private:
+  // cc::mojom::MojoCompositorFrameSinkClient:
+  void DidReceiveCompositorFrameAck(
+      const cc::ReturnedResourceArray& resources) override {}
+  void OnBeginFrame(const cc::BeginFrameArgs& begin_frame_args) override {}
+  void ReclaimResources(const cc::ReturnedResourceArray& resources) override {}
+
+  mojo::Binding<cc::mojom::MojoCompositorFrameSinkClient> binding_;
+
+  DISALLOW_COPY_AND_ASSIGN(StubClientCompositorFrameSink);
+};
+
+// A mock implementation of mojom::FrameSinkManager.
+class MockFrameSinkManagerImpl : public cc::mojom::FrameSinkManager {
+ public:
+  MockFrameSinkManagerImpl() : binding_(this) {}
+  ~MockFrameSinkManagerImpl() override = default;
+
+  void BindAndSetClient(cc::mojom::FrameSinkManagerRequest request,
+                        cc::mojom::FrameSinkManagerClientPtr client) {
+    binding_.Bind(std::move(request));
+    client_ = std::move(client);
+  }
+
+  // cc::mojom::FrameSinkManager:
+  // TODO(kylechar): See if we can mock functions with InterfacePtrs parameters.
+  void CreateRootCompositorFrameSink(
+      const cc::FrameSinkId& frame_sink_id,
+      gpu::SurfaceHandle surface_handle,
+      cc::mojom::MojoCompositorFrameSinkAssociatedRequest request,
+      cc::mojom::MojoCompositorFrameSinkPrivateRequest private_request,
+      cc::mojom::MojoCompositorFrameSinkClientPtr client,
+      cc::mojom::DisplayPrivateAssociatedRequest display_private_request)
+      override {}
+  void CreateCompositorFrameSink(
+      const cc::FrameSinkId& frame_sink_id,
+      cc::mojom::MojoCompositorFrameSinkRequest request,
+      cc::mojom::MojoCompositorFrameSinkPrivateRequest private_request,
+      cc::mojom::MojoCompositorFrameSinkClientPtr client) override {}
+  MOCK_METHOD2(RegisterFrameSinkHierarchy,
+               void(const cc::FrameSinkId& parent,
+                    const cc::FrameSinkId& child));
+  MOCK_METHOD2(UnregisterFrameSinkHierarchy,
+               void(const cc::FrameSinkId& parent,
+                    const cc::FrameSinkId& child));
+  MOCK_METHOD1(DropTemporaryReference, void(const cc::SurfaceId& surface_id));
+
+ private:
+  mojo::Binding<cc::mojom::FrameSinkManager> binding_;
+  cc::mojom::FrameSinkManagerClientPtr client_;
+
+  DISALLOW_COPY_AND_ASSIGN(MockFrameSinkManagerImpl);
+};
+
+}  // namespace
+
+class FrameSinkManagerHostTest : public testing::Test {
+ public:
+  FrameSinkManagerHostTest() = default;
+  ~FrameSinkManagerHostTest() override = default;
+
+  FrameSinkManagerHost& manager_host() { return *manager_host_; }
+
+  MockFrameSinkManagerImpl& manager_impl() { return *manager_impl_; }
+
+  // testing::Test:
+  void SetUp() override {
+    manager_impl_ = base::MakeUnique<MockFrameSinkManagerImpl>();
+    manager_host_ = base::MakeUnique<FrameSinkManagerHost>();
+
+    // Connect FrameSinkManagerHost and MojoFrameSinkManager.
+    cc::mojom::FrameSinkManagerClientPtr host_mojo;
+    cc::mojom::FrameSinkManagerClientRequest host_mojo_request =
+        mojo::MakeRequest(&host_mojo);
+    cc::mojom::FrameSinkManagerPtr manager_mojo;
+    cc::mojom::FrameSinkManagerRequest manager_impl_request =
+        mojo::MakeRequest(&manager_mojo);
+    manager_impl_->BindAndSetClient(std::move(manager_impl_request),
+                                    std::move(host_mojo));
+    manager_host_->BindManagerClientAndSetManagerPtr(
+        std::move(host_mojo_request), std::move(manager_mojo));
+  }
+
+ private:
+  base::MessageLoop message_loop_;
+  std::unique_ptr<FrameSinkManagerHost> manager_host_;
+  std::unique_ptr<MockFrameSinkManagerImpl> manager_impl_;
+
+  DISALLOW_COPY_AND_ASSIGN(FrameSinkManagerHostTest);
+};
+
+// Verify that when destroying a CompositorFrameSink with registered FrameSink
+// hierarchy, the hierarchy is automatically unregistered.
+TEST_F(FrameSinkManagerHostTest, UnregisterHierarchyOnDestroy) {
+  base::RunLoop run_loop;
+
+  cc::mojom::MojoCompositorFrameSinkPtr frame_sink;
+  StubClientCompositorFrameSink frame_sink_client;
+  manager_host().CreateCompositorFrameSink(kFrameSinkId1,
+                                           mojo::MakeRequest(&frame_sink),
+                                           frame_sink_client.GetInterfacePtr());
+  manager_host().RegisterFrameSinkHierarchy(kFrameSinkId2, kFrameSinkId1);
+  manager_host().DestroyCompositorFrameSink(kFrameSinkId1);
+
+  // Register is called explicitly.
+  EXPECT_CALL(manager_impl(),
+              RegisterFrameSinkHierarchy(kFrameSinkId2, kFrameSinkId1));
+
+  // Unregister should be called when DestroyCompositorFrameSink() is called.
+  EXPECT_CALL(manager_impl(),
+              UnregisterFrameSinkHierarchy(kFrameSinkId2, kFrameSinkId1))
+      .WillOnce(InvokeClosure(run_loop.QuitClosure()));
+
+  run_loop.Run();
+}
+
+}  // namespace test
+}  // namespace viz

diff --git a/content/browser/accessibility/accessibility_tree_formatter_blink.cc b/content/browser/accessibility/accessibility_tree_formatter_blink.cc
index 0885ca5..71f1ea1 100644
--- a/content/browser/accessibility/accessibility_tree_formatter_blink.cc
+++ b/content/browser/accessibility/accessibility_tree_formatter_blink.cc

@@ -25,6 +25,9 @@
 AccessibilityTreeFormatterBlink::~AccessibilityTreeFormatterBlink() {
 }
 
+const char* const TREE_DATA_ATTRIBUTES[] = {"TreeData.textSelStartOffset",
+                                            "TreeData.textSelEndOffset"};
+
 uint32_t AccessibilityTreeFormatterBlink::ChildCount(
     const BrowserAccessibility& node) const {
   if (node.HasIntAttribute(ui::AX_ATTR_CHILD_TREE_ID))
@@ -45,7 +48,8 @@
 void AccessibilityTreeFormatterBlink::AddProperties(
     const BrowserAccessibility& node,
     base::DictionaryValue* dict) {
-  dict->SetInteger("id", node.GetId());
+  int id = node.GetId();
+  dict->SetInteger("id", id);
 
   dict->SetString("internalRole", ui::ToString(node.GetData().role));
 
@@ -140,6 +144,18 @@
     }
   }
 
+  //  Check for relevant rich text selection info in AXTreeData
+  int anchor_id = node.manager()->GetTreeData().sel_anchor_object_id;
+  if (id == anchor_id) {
+    int anchor_offset = node.manager()->GetTreeData().sel_anchor_offset;
+    dict->SetInteger("TreeData.textSelStartOffset", anchor_offset);
+  }
+  int focus_id = node.manager()->GetTreeData().sel_focus_object_id;
+  if (id == focus_id) {
+    int focus_offset = node.manager()->GetTreeData().sel_focus_offset;
+    dict->SetInteger("TreeData.textSelEndOffset", focus_offset);
+  }
+
   std::vector<std::string> actions_strings;
   for (int action_index = ui::AX_ACTION_NONE + 1;
        action_index <= ui::AX_ACTION_LAST; ++action_index) {
@@ -296,6 +312,43 @@
                    &line);
   }
 
+  for (const char* attribute_name : TREE_DATA_ATTRIBUTES) {
+    const base::Value* value;
+    if (!dict.Get(attribute_name, &value))
+      continue;
+
+    switch (value->GetType()) {
+      case base::Value::Type::STRING: {
+        std::string string_value;
+        value->GetAsString(&string_value);
+        WriteAttribute(
+            false,
+            base::StringPrintf("%s=%s", attribute_name, string_value.c_str()),
+            &line);
+        break;
+      }
+      case base::Value::Type::INTEGER: {
+        int int_value = 0;
+        value->GetAsInteger(&int_value);
+        WriteAttribute(false,
+                       base::StringPrintf("%s=%d", attribute_name, int_value),
+                       &line);
+        break;
+      }
+      case base::Value::Type::DOUBLE: {
+        double double_value = 0.0;
+        value->GetAsDouble(&double_value);
+        WriteAttribute(
+            false, base::StringPrintf("%s=%.2f", attribute_name, double_value),
+            &line);
+        break;
+      }
+      default:
+        NOTREACHED();
+        break;
+    }
+  }
+
   return line;
 }
 

diff --git a/content/browser/background_fetch/background_fetch_context.cc b/content/browser/background_fetch/background_fetch_context.cc
index 0527c2e..4facffe 100644
--- a/content/browser/background_fetch/background_fetch_context.cc
+++ b/content/browser/background_fetch/background_fetch_context.cc

@@ -149,18 +149,45 @@
     const BackgroundFetchRegistrationId& registration_id,
     const BackgroundFetchOptions& options,
     std::vector<scoped_refptr<BackgroundFetchRequestInfo>> initial_requests) {
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("background_fetch_context", R"(
+        semantics {
+          sender: "Background Fetch API"
+          description:
+            "The Background Fetch API enables developers to upload or download "
+            "files on behalf of the user. Such fetches will yield a user "
+            "visible notification to inform the user of the operation, through "
+            "which it can be suspended, resumed and/or cancelled. The "
+            "developer retains control of the file once the fetch is "
+            "completed,  similar to XMLHttpRequest and other mechanisms for "
+            "fetching resources using JavaScript."
+          trigger:
+            "When the website uses the Background Fetch API to request "
+            "fetching a file and/or a list of files. This is a Web Platform "
+            "API for which no express user permission is required."
+          data:
+            "The request headers and data as set by the website's developer."
+          destination: WEBSITE
+        }
+        policy {
+          cookies_allowed: true
+          cookies_store: "user"
+          setting: "This feature cannot be disabled in settings."
+          policy_exception_justification: "Not implemented."
+        })");
   std::unique_ptr<BackgroundFetchJobController> controller =
       base::MakeUnique<BackgroundFetchJobController>(
           registration_id, options, data_manager_.get(), browser_context_,
           request_context_getter_,
-          base::BindOnce(&BackgroundFetchContext::DidCompleteJob, this));
+          base::BindOnce(&BackgroundFetchContext::DidCompleteJob, this),
+          traffic_annotation);
 
   // TODO(peter): We should actually be able to use Background Fetch in layout
   // tests. That requires a download manager and a request context.
   if (request_context_getter_) {
     // Start fetching the |initial_requests| immediately. At some point in the
     // future we may want a more elaborate scheduling mechanism here.
-    controller->Start(std::move(initial_requests), NO_TRAFFIC_ANNOTATION_YET);
+    controller->Start(std::move(initial_requests));
   }
 
   active_fetches_.insert(

diff --git a/content/browser/background_fetch/background_fetch_job_controller.cc b/content/browser/background_fetch/background_fetch_job_controller.cc
index 1e12960..87508cbe 100644
--- a/content/browser/background_fetch/background_fetch_job_controller.cc
+++ b/content/browser/background_fetch/background_fetch_job_controller.cc

@@ -218,11 +218,13 @@
     BackgroundFetchDataManager* data_manager,
     BrowserContext* browser_context,
     scoped_refptr<net::URLRequestContextGetter> request_context,
-    CompletedCallback completed_callback)
+    CompletedCallback completed_callback,
+    const net::NetworkTrafficAnnotationTag& traffic_annotation)
     : registration_id_(registration_id),
       options_(options),
       data_manager_(data_manager),
       completed_callback_(std::move(completed_callback)),
+      traffic_annotation_(traffic_annotation),
       weak_ptr_factory_(this) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
@@ -238,8 +240,7 @@
 BackgroundFetchJobController::~BackgroundFetchJobController() = default;
 
 void BackgroundFetchJobController::Start(
-    std::vector<scoped_refptr<BackgroundFetchRequestInfo>> initial_requests,
-    const net::NetworkTrafficAnnotationTag& traffic_annotation) {
+    std::vector<scoped_refptr<BackgroundFetchRequestInfo>> initial_requests) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   DCHECK_LE(initial_requests.size(), kMaximumBackgroundFetchParallelRequests);
   DCHECK_EQ(state_, State::INITIALIZED);
@@ -247,17 +248,16 @@
   state_ = State::FETCHING;
 
   for (const auto& request : initial_requests)
-    StartRequest(request, traffic_annotation);
+    StartRequest(request);
 }
 
 void BackgroundFetchJobController::StartRequest(
-    scoped_refptr<BackgroundFetchRequestInfo> request,
-    const net::NetworkTrafficAnnotationTag& traffic_annotation) {
+    scoped_refptr<BackgroundFetchRequestInfo> request) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   DCHECK_EQ(state_, State::FETCHING);
   BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
                           base::Bind(&Core::StartRequest, ui_core_ptr_,
-                                     std::move(request), traffic_annotation));
+                                     std::move(request), traffic_annotation_));
 }
 
 void BackgroundFetchJobController::DidStartRequest(
@@ -289,7 +289,7 @@
 
   // If a |request| has been given, start downloading the file and bail.
   if (request) {
-    StartRequest(std::move(request), NO_TRAFFIC_ANNOTATION_YET);
+    StartRequest(std::move(request));
     return;
   }
 

diff --git a/content/browser/background_fetch/background_fetch_job_controller.h b/content/browser/background_fetch/background_fetch_job_controller.h
index a6e598c..3698664 100644
--- a/content/browser/background_fetch/background_fetch_job_controller.h
+++ b/content/browser/background_fetch/background_fetch_job_controller.h

@@ -44,14 +44,14 @@
       BackgroundFetchDataManager* data_manager,
       BrowserContext* browser_context,
       scoped_refptr<net::URLRequestContextGetter> request_context,
-      CompletedCallback completed_callback);
+      CompletedCallback completed_callback,
+      const net::NetworkTrafficAnnotationTag& traffic_annotation);
   ~BackgroundFetchJobController();
 
   // Starts fetching the |initial_fetches|. The controller will continue to
   // fetch new content until all requests have been handled.
   void Start(
-      std::vector<scoped_refptr<BackgroundFetchRequestInfo>> initial_requests,
-      const net::NetworkTrafficAnnotationTag& traffic_annotation);
+      std::vector<scoped_refptr<BackgroundFetchRequestInfo>> initial_requests);
 
   // Updates the representation of this Background Fetch in the user interface
   // to match the given |title|.
@@ -75,8 +75,7 @@
   class Core;
 
   // Requests the download manager to start fetching |request|.
-  void StartRequest(scoped_refptr<BackgroundFetchRequestInfo> request,
-                    const net::NetworkTrafficAnnotationTag& traffic_annotation);
+  void StartRequest(scoped_refptr<BackgroundFetchRequestInfo> request);
 
   // Called when the given |request| has started fetching, after having been
   // assigned the |download_guid| by the download system.
@@ -113,6 +112,9 @@
   // Callback for when all fetches have been completed.
   CompletedCallback completed_callback_;
 
+  // Traffic annotation for network request.
+  const net::NetworkTrafficAnnotationTag traffic_annotation_;
+
   base::WeakPtrFactory<BackgroundFetchJobController> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(BackgroundFetchJobController);

diff --git a/content/browser/background_fetch/background_fetch_job_controller_unittest.cc b/content/browser/background_fetch/background_fetch_job_controller_unittest.cc
index 55853a3..2f0527f7 100644
--- a/content/browser/background_fetch/background_fetch_job_controller_unittest.cc
+++ b/content/browser/background_fetch/background_fetch_job_controller_unittest.cc

@@ -92,7 +92,8 @@
         browser_context(),
         make_scoped_refptr(storage_partition->GetURLRequestContext()),
         base::BindOnce(&BackgroundFetchJobControllerTest::DidCompleteJob,
-                       base::Unretained(this)));
+                       base::Unretained(this)),
+        TRAFFIC_ANNOTATION_FOR_TESTS);
   }
 
  protected:
@@ -149,8 +150,7 @@
   EXPECT_EQ(controller->state(),
             BackgroundFetchJobController::State::INITIALIZED);
 
-  controller->Start(initial_requests /* deliberate copy */,
-                    TRAFFIC_ANNOTATION_FOR_TESTS);
+  controller->Start(initial_requests /* deliberate copy */);
   EXPECT_EQ(controller->state(), BackgroundFetchJobController::State::FETCHING);
 
   // Mark the single download item as finished, completing the job.
@@ -194,8 +194,7 @@
     base::RunLoop run_loop;
     job_completed_closure_ = run_loop.QuitClosure();
 
-    controller->Start(initial_requests /* deliberate copy */,
-                      TRAFFIC_ANNOTATION_FOR_TESTS);
+    controller->Start(initial_requests /* deliberate copy */);
     EXPECT_EQ(controller->state(),
               BackgroundFetchJobController::State::FETCHING);
 
@@ -226,8 +225,7 @@
     base::RunLoop run_loop;
     job_completed_closure_ = run_loop.QuitClosure();
 
-    controller->Start(initial_requests /* deliberate copy */,
-                      TRAFFIC_ANNOTATION_FOR_TESTS);
+    controller->Start(initial_requests /* deliberate copy */);
     EXPECT_EQ(controller->state(),
               BackgroundFetchJobController::State::FETCHING);
 

diff --git a/content/browser/tracing/power_tracing_agent.cc b/content/browser/tracing/power_tracing_agent.cc
index b4887fc..6276c09 100644
--- a/content/browser/tracing/power_tracing_agent.cc
+++ b/content/browser/tracing/power_tracing_agent.cc

@@ -69,8 +69,7 @@
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   battor_agent_.reset(new battor::BattOrAgent(
-      path, this, BrowserThread::GetTaskRunnerForThread(BrowserThread::FILE),
-      BrowserThread::GetTaskRunnerForThread(BrowserThread::UI)));
+      path, this, BrowserThread::GetTaskRunnerForThread(BrowserThread::UI)));
 
   start_tracing_callback_ = callback;
   battor_agent_->StartTracing();

diff --git a/content/renderer/accessibility/blink_ax_tree_source.cc b/content/renderer/accessibility/blink_ax_tree_source.cc
index 580b7826..69a9e86 100644
--- a/content/renderer/accessibility/blink_ax_tree_source.cc
+++ b/content/renderer/accessibility/blink_ax_tree_source.cc

@@ -794,8 +794,11 @@
     }
 
     if (src.IsEditable()) {
-      dst->AddIntAttribute(ui::AX_ATTR_TEXT_SEL_START, src.SelectionStart());
-      dst->AddIntAttribute(ui::AX_ATTR_TEXT_SEL_END, src.SelectionEnd());
+      if (src.IsControl() && !src.IsRichlyEditable()) {
+        // Only for simple input controls -- rich editable areas use AXTreeData
+        dst->AddIntAttribute(ui::AX_ATTR_TEXT_SEL_START, src.SelectionStart());
+        dst->AddIntAttribute(ui::AX_ATTR_TEXT_SEL_END, src.SelectionEnd());
+      }
 
 #if defined(OS_CHROMEOS)
       // This attribute will soon be deprecated; see crbug.com/669134.

diff --git a/content/test/data/accessibility/html/contenteditable-descendants-with-selection-expected-blink.txt b/content/test/data/accessibility/html/contenteditable-descendants-with-selection-expected-blink.txt
new file mode 100644
index 0000000..ea1a5dc
--- /dev/null
+++ b/content/test/data/accessibility/html/contenteditable-descendants-with-selection-expected-blink.txt

@@ -0,0 +1,28 @@
+rootWebArea
+++genericContainer editable richlyEditable
+++++paragraph editable richlyEditable
+++++++staticText editable richlyEditable name='A contenteditable with a ' TreeData.textSelStartOffset=0
+++++++++inlineTextBox name='A contenteditable with a '
+++++++link editable richlyEditable name='link'
+++++++++staticText editable richlyEditable name='link'
+++++++++++inlineTextBox name='link'
+++++++staticText editable richlyEditable name=' and an '
+++++++++inlineTextBox name=' and an '
+++++++image editable richlyEditable name='Image'
+++++++staticText editable richlyEditable name=' and a '
+++++++++inlineTextBox name=' and a '
+++++++button editable richlyEditable name='Button'
+++++++staticText editable richlyEditable name='.'
+++++++++inlineTextBox name='.'
+++++table editable richlyEditable
+++++++row editable richlyEditable
+++++++++cell editable richlyEditable name='Always expose editable tables as tables.'
+++++++++++staticText editable richlyEditable name='Always expose editable tables as tables.'
+++++++++++++inlineTextBox name='Always expose editable tables as tables.'
+++++++column
+++++++tableHeaderContainer
+++++list editable richlyEditable
+++++++listItem editable richlyEditable
+++++++++listMarker name='1'
+++++++++staticText editable richlyEditable name='Editable list item.' TreeData.textSelEndOffset=19
+++++++++++inlineTextBox name='Editable list item.'

diff --git a/content/test/data/accessibility/html/contenteditable-descendants-with-selection.html b/content/test/data/accessibility/html/contenteditable-descendants-with-selection.html
index d9268e53..7249361 100644
--- a/content/test/data/accessibility/html/contenteditable-descendants-with-selection.html
+++ b/content/test/data/accessibility/html/contenteditable-descendants-with-selection.html

@@ -8,6 +8,7 @@
 @WIN-ALLOW:selection_end*
 @BLINK-ALLOW:editable*
 @BLINK-ALLOW:richlyEditable*
+@BLINK-ALLOW:*textSel*
 -->
 <div id="contenteditable" tabindex="0" contenteditable>
   <p>A contenteditable with a

diff --git a/content/test/data/accessibility/html/contenteditable-descendants.html b/content/test/data/accessibility/html/contenteditable-descendants.html
index 1d973259..2b678a3 100644
--- a/content/test/data/accessibility/html/contenteditable-descendants.html
+++ b/content/test/data/accessibility/html/contenteditable-descendants.html

@@ -8,6 +8,7 @@
 @WIN-ALLOW:selection_end*
 @BLINK-ALLOW:editable*
 @BLINK-ALLOW:richlyEditable*
+@BLINK-ALLOW:textSel*
 -->
 <div contenteditable>
   <p>A contenteditable with a

diff --git a/content/test/data/accessibility/html/contenteditable-with-embedded-contenteditables.html b/content/test/data/accessibility/html/contenteditable-with-embedded-contenteditables.html
index da1067c8..47a9ff5 100644
--- a/content/test/data/accessibility/html/contenteditable-with-embedded-contenteditables.html
+++ b/content/test/data/accessibility/html/contenteditable-with-embedded-contenteditables.html

@@ -7,6 +7,7 @@
 @WIN-ALLOW:selection_end*
 @BLINK-ALLOW:editable*
 @BLINK-ALLOW:richlyEditable*
+@BLINK-ALLOW:textSel*
 -->
 <div contenteditable>
   <p>This is editable.</p>

diff --git a/content/test/data/accessibility/html/input-email-expected-blink.txt b/content/test/data/accessibility/html/input-email-expected-blink.txt
new file mode 100644
index 0000000..032c081
--- /dev/null
+++ b/content/test/data/accessibility/html/input-email-expected-blink.txt

@@ -0,0 +1,6 @@
+rootWebArea
+++genericContainer
+++++textField value='someone@example.com' textSelStart=0 textSelEnd=0
+++++++genericContainer
+++++++++staticText name='someone@example.com'
+++++++++++inlineTextBox name='someone@example.com'

diff --git a/content/test/data/accessibility/html/input-email.html b/content/test/data/accessibility/html/input-email.html
index b46b229..dfa7e2b 100644
--- a/content/test/data/accessibility/html/input-email.html
+++ b/content/test/data/accessibility/html/input-email.html

@@ -9,6 +9,7 @@
 @WIN-ALLOW:value*
 @WIN-DENY:value='http://*'
 @BLINK-ALLOW:value*
+@BLINK-ALLOW:textSel*
 -->
 <!DOCTYPE html>
 <html>

diff --git a/content/test/data/accessibility/html/input-password-expected-blink.txt b/content/test/data/accessibility/html/input-password-expected-blink.txt
new file mode 100644
index 0000000..b87c9a2
--- /dev/null
+++ b/content/test/data/accessibility/html/input-password-expected-blink.txt

@@ -0,0 +1,6 @@
+rootWebArea
+++genericContainer
+++++textField protected value='••••••' textSelStart=6 textSelEnd=6
+++++++genericContainer
+++++++++staticText name='••••••'
+++++++++++inlineTextBox name='••••••'

diff --git a/content/test/data/accessibility/html/input-password.html b/content/test/data/accessibility/html/input-password.html
index c8be7bf..2d45421 100644
--- a/content/test/data/accessibility/html/input-password.html
+++ b/content/test/data/accessibility/html/input-password.html

@@ -10,6 +10,8 @@
 @WIN-ALLOW:n_selections*
 @WIN-ALLOW:selection_start*
 @WIN-ALLOW:selection_end*
+@BLINK-ALLOW:textSel*
+@BLINK-ALLOW:value='•*
 -->
 <!DOCTYPE html>
 <html>

diff --git a/content/test/data/accessibility/html/input-search.html b/content/test/data/accessibility/html/input-search.html
index 0f3019b..8f1cadb9 100644
--- a/content/test/data/accessibility/html/input-search.html
+++ b/content/test/data/accessibility/html/input-search.html

@@ -6,6 +6,7 @@
 @WIN-ALLOW:n_selections*
 @WIN-ALLOW:selection_start*
 @WIN-ALLOW:selection_end*
+@WIN-ALLOW:textSel*
 -->
 <!DOCTYPE html>
 <html>

diff --git a/content/test/data/accessibility/html/input-tel-expected-blink.txt b/content/test/data/accessibility/html/input-tel-expected-blink.txt
new file mode 100644
index 0000000..aab317c
--- /dev/null
+++ b/content/test/data/accessibility/html/input-tel-expected-blink.txt

@@ -0,0 +1,6 @@
+rootWebArea
+++genericContainer
+++++textField value='123-456-7890'
+++++++genericContainer
+++++++++staticText name='123-456-7890'
+++++++++++inlineTextBox name='123-456-7890'

diff --git a/content/test/data/accessibility/html/input-tel.html b/content/test/data/accessibility/html/input-tel.html
index dddf5c6a..d970ba2 100644
--- a/content/test/data/accessibility/html/input-tel.html
+++ b/content/test/data/accessibility/html/input-tel.html

@@ -9,6 +9,7 @@
 @WIN-DENY:value='http://*
 @BLINK-ALLOW:value*
 @BLINK-DENY:value='http://*
+@WIN-ALLOW:textSel*
 -->
 <!DOCTYPE html>
 <html>

diff --git a/content/test/data/accessibility/html/input-text-expected-blink.txt b/content/test/data/accessibility/html/input-text-expected-blink.txt
new file mode 100644
index 0000000..202410a
--- /dev/null
+++ b/content/test/data/accessibility/html/input-text-expected-blink.txt

@@ -0,0 +1,6 @@
+rootWebArea
+++genericContainer
+++++textField name='Name' textSelStart=0 textSelEnd=0
+++++++genericContainer
+++++++++staticText name='Name'
+++++++++++inlineTextBox name='Name'

diff --git a/content/test/data/accessibility/html/input-text-read-only-expected-blink.txt b/content/test/data/accessibility/html/input-text-read-only-expected-blink.txt
new file mode 100644
index 0000000..f364beb
--- /dev/null
+++ b/content/test/data/accessibility/html/input-text-read-only-expected-blink.txt

@@ -0,0 +1,6 @@
+rootWebArea readOnly
+++genericContainer readOnly
+++++textField readOnly name='Name' textSelStart=0 textSelEnd=0
+++++++genericContainer readOnly
+++++++++staticText readOnly name='Name'
+++++++++++inlineTextBox name='Name'

diff --git a/content/test/data/accessibility/html/input-text-read-only.html b/content/test/data/accessibility/html/input-text-read-only.html
index 6de7935..c072ea2 100644
--- a/content/test/data/accessibility/html/input-text-read-only.html
+++ b/content/test/data/accessibility/html/input-text-read-only.html

@@ -12,6 +12,8 @@
 @WIN-DENY:value='http://*'
 @BLINK-ALLOW:value*
 @BLINK-DENY:value='http://*
+@BLINK-ALLOW:textSel*
+@BLINK-ALLOW:read*
 -->
 <!DOCTYPE html>
 <html>

diff --git a/content/test/data/accessibility/html/input-text-with-selection.html b/content/test/data/accessibility/html/input-text-with-selection.html
index b458a07..60bcfb66 100644
--- a/content/test/data/accessibility/html/input-text-with-selection.html
+++ b/content/test/data/accessibility/html/input-text-with-selection.html

@@ -8,6 +8,7 @@
 @WIN-ALLOW:selection_start*
 @WIN-ALLOW:selection_end*
 @WIN-ALLOW:text-input-type*
+@BLINK-ALLOW:textSel*
 -->
 <!DOCTYPE html>
 <html>

diff --git a/content/test/data/accessibility/html/input-text.html b/content/test/data/accessibility/html/input-text.html
index 59871ff..92a37e0 100644
--- a/content/test/data/accessibility/html/input-text.html
+++ b/content/test/data/accessibility/html/input-text.html

@@ -12,6 +12,7 @@
 @WIN-DENY:value='http://*'
 @BLINK-ALLOW:value*
 @BLINK-DENY:value='http://*
+@BLINK-ALLOW:textSel*
 -->
 <!DOCTYPE html>
 <html>

diff --git a/content/test/data/accessibility/html/input-url.html b/content/test/data/accessibility/html/input-url.html
index 54fe565c..e8d6b59 100644
--- a/content/test/data/accessibility/html/input-url.html
+++ b/content/test/data/accessibility/html/input-url.html

@@ -6,6 +6,7 @@
 @WIN-ALLOW:selection_start*
 @WIN-ALLOW:selection_end*
 @WIN-ALLOW:text-input-type*
+@BLINK-ALLOW:textSel*
 -->
 <!DOCTYPE html>
 <html>

diff --git a/content/test/data/accessibility/html/textarea-expected-blink.txt b/content/test/data/accessibility/html/textarea-expected-blink.txt
new file mode 100644
index 0000000..909da1525
--- /dev/null
+++ b/content/test/data/accessibility/html/textarea-expected-blink.txt

@@ -0,0 +1,11 @@
+rootWebArea
+++genericContainer
+++++textField textSelStart=0 textSelEnd=0
+++++++genericContainer
+++++++++staticText name='The textarea tag defines a multi-line text input control.<newline>'
+++++++++++inlineTextBox name='The textarea tag defines a multi-line text input'
+++++++++++inlineTextBox name=' '
+++++++++++inlineTextBox name='control.'
+++++++++++inlineTextBox name='<newline>'
+++++++++lineBreak name='<newline>'
+++++++++++inlineTextBox name='<newline>'

diff --git a/content/test/data/accessibility/html/textarea-read-only-expected-blink.txt b/content/test/data/accessibility/html/textarea-read-only-expected-blink.txt
new file mode 100644
index 0000000..b1d7ba46
--- /dev/null
+++ b/content/test/data/accessibility/html/textarea-read-only-expected-blink.txt

@@ -0,0 +1,11 @@
+rootWebArea
+++genericContainer
+++++textField textSelStart=0 textSelEnd=0
+++++++genericContainer
+++++++++staticText name='The textarea tag defines a multi-line text input control.<newline>'
+++++++++++inlineTextBox name='The textarea tag defines a multi-line text input'
+++++++++++inlineTextBox name=' '
+++++++++++inlineTextBox name='control.'
+++++++++++inlineTextBox name='<newline>'
+++++++++lineBreak name='<newline>'
+++++++++++inlineTextBox name='<newline>'
\ No newline at end of file

diff --git a/content/test/data/accessibility/html/textarea-read-only.html b/content/test/data/accessibility/html/textarea-read-only.html
index 1b61b059..ffa31da 100644
--- a/content/test/data/accessibility/html/textarea-read-only.html
+++ b/content/test/data/accessibility/html/textarea-read-only.html

@@ -6,12 +6,13 @@
 @WIN-ALLOW:n_selections*
 @WIN-ALLOW:selection_start*
 @WIN-ALLOW:selection_end*
+@BLINK-ALLOW:textSel*
 -->
 <!DOCTYPE html>
 <html>
 <body>
 
-<textarea readonly rows="4" cols="50">
+<textarea readonly rows="4" cols="50" style="font-family: monospace">
 The textarea tag defines a multi-line text input control.
 </textarea>
 

diff --git a/content/test/data/accessibility/html/textarea-with-selection-expected-blink.txt b/content/test/data/accessibility/html/textarea-with-selection-expected-blink.txt
new file mode 100644
index 0000000..f12d086
--- /dev/null
+++ b/content/test/data/accessibility/html/textarea-with-selection-expected-blink.txt

@@ -0,0 +1,11 @@
+rootWebArea
+++genericContainer
+++++textField textSelStart=0 textSelEnd=58
+++++++genericContainer
+++++++++staticText name='The textarea tag defines a multi-line text input control.<newline>'
+++++++++++inlineTextBox name='The textarea tag defines a multi-line text input'
+++++++++++inlineTextBox name=' '
+++++++++++inlineTextBox name='control.'
+++++++++++inlineTextBox name='<newline>'
+++++++++lineBreak name='<newline>'
+++++++++++inlineTextBox name='<newline>'

diff --git a/content/test/data/accessibility/html/textarea-with-selection.html b/content/test/data/accessibility/html/textarea-with-selection.html
index a35707e..07b6e82 100644
--- a/content/test/data/accessibility/html/textarea-with-selection.html
+++ b/content/test/data/accessibility/html/textarea-with-selection.html

@@ -6,12 +6,13 @@
 @WIN-ALLOW:n_selections*
 @WIN-ALLOW:selection_start*
 @WIN-ALLOW:selection_end*
+@BLINK-ALLOW:textSel*
 -->
 <!DOCTYPE html>
 <html>
 <body>
 
-<textarea rows="4" cols="50" autofocus>
+<textarea rows="4" cols="50" autofocus style="font-family: monospace">
 The textarea tag defines a multi-line text input control.
 </textarea>
 

diff --git a/content/test/data/accessibility/html/textarea.html b/content/test/data/accessibility/html/textarea.html
index 195890a6..e2f7540 100644
--- a/content/test/data/accessibility/html/textarea.html
+++ b/content/test/data/accessibility/html/textarea.html

@@ -6,12 +6,13 @@
 @WIN-ALLOW:n_selections*
 @WIN-ALLOW:selection_start*
 @WIN-ALLOW:selection_end*
+@BLINK-ALLOW:textSel*
 -->
 <!DOCTYPE html>
 <html>
 <body>
 
-<textarea rows="4" cols="50">
+<textarea rows="4" cols="50" style="font-family: monospace">
 The textarea tag defines a multi-line text input control.
 </textarea>
 

diff --git a/device/serial/serial_io_handler.cc b/device/serial/serial_io_handler.cc
index b73d532..70f90a6 100644
--- a/device/serial/serial_io_handler.cc
+++ b/device/serial/serial_io_handler.cc

@@ -11,6 +11,8 @@
 #include "base/files/file_path.h"
 #include "base/location.h"
 #include "base/strings/string_util.h"
+#include "base/task_scheduler/post_task.h"
+#include "base/task_scheduler/task_traits.h"
 #include "build/build_config.h"
 
 #if defined(OS_CHROMEOS)
@@ -21,10 +23,8 @@
 namespace device {
 
 SerialIoHandler::SerialIoHandler(
-    scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner,
     scoped_refptr<base::SingleThreadTaskRunner> ui_thread_task_runner)
-    : file_thread_task_runner_(file_thread_task_runner),
-      ui_thread_task_runner_(ui_thread_task_runner) {
+    : ui_thread_task_runner_(ui_thread_task_runner) {
   options_.bitrate = 9600;
   options_.data_bits = serial::DataBits::EIGHT;
   options_.parity_bit = serial::ParityBit::NO_PARITY;
@@ -44,7 +44,6 @@
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK(open_complete_.is_null());
   open_complete_ = callback;
-  DCHECK(file_thread_task_runner_.get());
   DCHECK(ui_thread_task_runner_.get());
   MergeConnectionOptions(options);
   port_ = port;
@@ -63,9 +62,11 @@
           port, base::Bind(&SerialIoHandler::OnPathOpened, this, task_runner),
           base::Bind(&SerialIoHandler::OnPathOpenError, this, task_runner)));
 #else
-  file_thread_task_runner_->PostTask(
-      FROM_HERE, base::Bind(&SerialIoHandler::StartOpen, this, port,
-                            base::ThreadTaskRunnerHandle::Get()));
+  base::PostTaskWithTraits(
+      FROM_HERE,
+      {base::MayBlock(), base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
+      base::Bind(&SerialIoHandler::StartOpen, this, port,
+                 base::ThreadTaskRunnerHandle::Get()));
 #endif  // defined(OS_CHROMEOS)
 }
 
@@ -126,7 +127,6 @@
     const std::string& port,
     scoped_refptr<base::SingleThreadTaskRunner> io_task_runner) {
   DCHECK(!open_complete_.is_null());
-  DCHECK(file_thread_task_runner_->RunsTasksInCurrentSequence());
   DCHECK(!file_.IsValid());
   // It's the responsibility of the API wrapper around SerialIoHandler to
   // validate the supplied path against the set of valid port names, and
@@ -170,9 +170,9 @@
 
 void SerialIoHandler::Close() {
   if (file_.IsValid()) {
-    DCHECK(file_thread_task_runner_.get());
-    file_thread_task_runner_->PostTask(
+    base::PostTaskWithTraits(
         FROM_HERE,
+        {base::MayBlock(), base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
         base::Bind(&SerialIoHandler::DoClose, Passed(std::move(file_))));
   }
 }

diff --git a/device/serial/serial_io_handler.h b/device/serial/serial_io_handler.h
index 856965a..c0adb5e 100644
--- a/device/serial/serial_io_handler.h
+++ b/device/serial/serial_io_handler.h

@@ -30,7 +30,6 @@
  public:
   // Constructs an instance of some platform-specific subclass.
   static scoped_refptr<SerialIoHandler> Create(
-      scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner,
       scoped_refptr<base::SingleThreadTaskRunner> ui_thread_task_runner);
 
   typedef base::Callback<void(bool success)> OpenCompleteCallback;
@@ -112,7 +111,6 @@
 
  protected:
   explicit SerialIoHandler(
-      scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner,
       scoped_refptr<base::SingleThreadTaskRunner> ui_thread_task_runner);
   virtual ~SerialIoHandler();
 
@@ -195,10 +193,6 @@
   // Possibly fixes up a serial port path name in a platform-specific manner.
   static std::string MaybeFixUpPortName(const std::string& port_name);
 
-  base::SingleThreadTaskRunner* file_thread_task_runner() const {
-    return file_thread_task_runner_.get();
-  }
-
   base::SingleThreadTaskRunner* ui_thread_task_runner() const {
     return ui_thread_task_runner_.get();
   }
@@ -242,7 +236,6 @@
   // Callback to handle the completion of a pending Open() request.
   OpenCompleteCallback open_complete_;
 
-  scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner_;
   // On Chrome OS, PermissionBrokerClient should be called on the UI thread.
   scoped_refptr<base::SingleThreadTaskRunner> ui_thread_task_runner_;
 

diff --git a/device/serial/serial_io_handler_posix.cc b/device/serial/serial_io_handler_posix.cc
index bf5b808..8ffba121 100644
--- a/device/serial/serial_io_handler_posix.cc
+++ b/device/serial/serial_io_handler_posix.cc

@@ -113,10 +113,8 @@
 
 // static
 scoped_refptr<SerialIoHandler> SerialIoHandler::Create(
-    scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner,
     scoped_refptr<base::SingleThreadTaskRunner> ui_thread_task_runner) {
-  return new SerialIoHandlerPosix(file_thread_task_runner,
-                                  ui_thread_task_runner);
+  return new SerialIoHandlerPosix(ui_thread_task_runner);
 }
 
 void SerialIoHandlerPosix::ReadImpl() {
@@ -292,9 +290,8 @@
 }
 
 SerialIoHandlerPosix::SerialIoHandlerPosix(
-    scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner,
     scoped_refptr<base::SingleThreadTaskRunner> ui_thread_task_runner)
-    : SerialIoHandler(file_thread_task_runner, ui_thread_task_runner) {}
+    : SerialIoHandler(ui_thread_task_runner) {}
 
 SerialIoHandlerPosix::~SerialIoHandlerPosix() {
 }

diff --git a/device/serial/serial_io_handler_posix.h b/device/serial/serial_io_handler_posix.h
index 69c924b2..ee5d129 100644
--- a/device/serial/serial_io_handler_posix.h
+++ b/device/serial/serial_io_handler_posix.h

@@ -47,7 +47,6 @@
   friend class SerialIoHandlerPosixTest;
 
   SerialIoHandlerPosix(
-      scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner,
       scoped_refptr<base::SingleThreadTaskRunner> ui_thread_task_runner);
   ~SerialIoHandlerPosix() override;
 

diff --git a/device/serial/serial_io_handler_posix_unittest.cc b/device/serial/serial_io_handler_posix_unittest.cc
index 75e11d2..a5a5391 100644
--- a/device/serial/serial_io_handler_posix_unittest.cc
+++ b/device/serial/serial_io_handler_posix_unittest.cc

@@ -13,7 +13,7 @@
   SerialIoHandlerPosixTest() {}
 
   void SetUp() override {
-    serial_io_handler_posix_ = new SerialIoHandlerPosix(nullptr, nullptr);
+    serial_io_handler_posix_ = new SerialIoHandlerPosix(nullptr);
   }
 
   void Initialize(bool parity_check_enabled,

diff --git a/device/serial/serial_io_handler_win.cc b/device/serial/serial_io_handler_win.cc
index 75461fe..9a25e9a 100644
--- a/device/serial/serial_io_handler_win.cc
+++ b/device/serial/serial_io_handler_win.cc

@@ -151,9 +151,8 @@
 
 // static
 scoped_refptr<SerialIoHandler> SerialIoHandler::Create(
-    scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner,
     scoped_refptr<base::SingleThreadTaskRunner> ui_thread_task_runner) {
-  return new SerialIoHandlerWin(file_thread_task_runner, ui_thread_task_runner);
+  return new SerialIoHandlerWin(ui_thread_task_runner);
 }
 
 class SerialIoHandlerWin::UiThreadHelper final
@@ -359,9 +358,8 @@
 }
 
 SerialIoHandlerWin::SerialIoHandlerWin(
-    scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner,
     scoped_refptr<base::SingleThreadTaskRunner> ui_thread_task_runner)
-    : SerialIoHandler(file_thread_task_runner, ui_thread_task_runner),
+    : SerialIoHandler(ui_thread_task_runner),
       event_mask_(0),
       is_comm_pending_(false),
       helper_(nullptr),

diff --git a/device/serial/serial_io_handler_win.h b/device/serial/serial_io_handler_win.h
index 33ae7b8..bb31bea 100644
--- a/device/serial/serial_io_handler_win.h
+++ b/device/serial/serial_io_handler_win.h

@@ -38,7 +38,6 @@
   friend class SerialIoHandler;
 
   explicit SerialIoHandlerWin(
-      scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner,
       scoped_refptr<base::SingleThreadTaskRunner> ui_thread_task_runner);
   ~SerialIoHandlerWin() override;
 

diff --git a/device/serial/test_serial_io_handler.cc b/device/serial/test_serial_io_handler.cc
index d0b4ee6..50c38db 100644
--- a/device/serial/test_serial_io_handler.cc
+++ b/device/serial/test_serial_io_handler.cc

@@ -15,12 +15,11 @@
 namespace device {
 
 TestSerialIoHandler::TestSerialIoHandler()
-    : SerialIoHandler(NULL, NULL),
+    : SerialIoHandler(NULL),
       opened_(false),
       dtr_(false),
       rts_(false),
-      flushes_(0) {
-}
+      flushes_(0) {}
 
 scoped_refptr<SerialIoHandler> TestSerialIoHandler::Create() {
   return scoped_refptr<SerialIoHandler>(new TestSerialIoHandler);

diff --git a/extensions/browser/api/serial/serial_connection.cc b/extensions/browser/api/serial/serial_connection.cc
index f6a5eb1..488669b 100644
--- a/extensions/browser/api/serial/serial_connection.cc
+++ b/extensions/browser/api/serial/serial_connection.cc

@@ -168,8 +168,6 @@
       paused_(false),
       io_handler_(device::SerialIoHandler::Create(
           content::BrowserThread::GetTaskRunnerForThread(
-              content::BrowserThread::FILE),
-          content::BrowserThread::GetTaskRunnerForThread(
               content::BrowserThread::UI))) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 }

diff --git a/gpu/command_buffer/client/gpu_memory_buffer_manager.h b/gpu/command_buffer/client/gpu_memory_buffer_manager.h
index b75780bb..de0f4e7 100644
--- a/gpu/command_buffer/client/gpu_memory_buffer_manager.h
+++ b/gpu/command_buffer/client/gpu_memory_buffer_manager.h

@@ -21,14 +21,16 @@
   GpuMemoryBufferManager();
   virtual ~GpuMemoryBufferManager();
 
-  // Creates a GpuMemoryBuffer that can be shared with another process.
+  // Creates a GpuMemoryBuffer that can be shared with another process. It can
+  // be called on any thread.
   virtual std::unique_ptr<gfx::GpuMemoryBuffer> CreateGpuMemoryBuffer(
       const gfx::Size& size,
       gfx::BufferFormat format,
       gfx::BufferUsage usage,
       gpu::SurfaceHandle surface_handle) = 0;
 
-  // Associates destruction sync point with |buffer|.
+  // Associates destruction sync point with |buffer|. It can be called on any
+  // thread.
   virtual void SetDestructionSyncToken(gfx::GpuMemoryBuffer* buffer,
                                        const gpu::SyncToken& sync_token) = 0;
 };

diff --git a/ios/chrome/browser/ui/BUILD.gn b/ios/chrome/browser/ui/BUILD.gn
index b5acc1d..809cd7ad 100644
--- a/ios/chrome/browser/ui/BUILD.gn
+++ b/ios/chrome/browser/ui/BUILD.gn

@@ -103,7 +103,7 @@
     "//ios/chrome/browser/ui/activity_services",
     "//ios/chrome/browser/ui/alert_coordinator",
     "//ios/chrome/browser/ui/commands",
-    "//ios/chrome/browser/ui/ntp:ntp_internal",
+    "//ios/chrome/browser/ui/ntp:ntp_controller",
     "//ios/chrome/browser/ui/toolbar",
     "//ios/chrome/browser/ui/toolbar:test_support",
     "//ios/chrome/browser/web:web_internal",
@@ -284,7 +284,6 @@
     "//ios/chrome/browser/ui/history",
     "//ios/chrome/browser/ui/keyboard",
     "//ios/chrome/browser/ui/ntp",
-    "//ios/chrome/browser/ui/ntp:ntp_internal",
     "//ios/chrome/browser/ui/ntp/recent_tabs",
     "//ios/chrome/browser/ui/omnibox:omnibox_internal",
     "//ios/chrome/browser/ui/overscroll_actions",
@@ -329,7 +328,6 @@
     "//ios/chrome/browser/ui/overscroll_actions",
     "//ios/chrome/browser/snapshots:snapshots_internal",
     "//ios/chrome/browser/web:web_internal",
-    "//ios/chrome/browser/ui/ntp:ntp_internal",
     "//ios/chrome/browser/ui/stack_view",
   ]
   libs = [
@@ -408,6 +406,7 @@
     "//ios/chrome/browser/ui/history",
     "//ios/chrome/browser/ui/keyboard",
     "//ios/chrome/browser/ui/ntp",
+    "//ios/chrome/browser/ui/ntp:ntp_controller",
     "//ios/chrome/browser/ui/ntp:ntp_internal",
     "//ios/chrome/browser/ui/ntp/recent_tabs",
     "//ios/chrome/browser/ui/omnibox:omnibox_internal",
@@ -534,7 +533,7 @@
     "//components/strings",
     "//ios/chrome/app/strings",
     "//ios/chrome/browser/ui/commands",
-    "//ios/chrome/browser/ui/ntp:ntp_internal",
+    "//ios/chrome/browser/ui/ntp:ntp_controller",
     "//ios/chrome/browser/ui/toolbar",
     "//ios/chrome/browser/ui/tools_menu",
     "//ios/chrome/test/app:test_support",

diff --git a/ios/chrome/browser/ui/ntp/BUILD.gn b/ios/chrome/browser/ui/ntp/BUILD.gn
index 0cf4b664..6a184ca3 100644
--- a/ios/chrome/browser/ui/ntp/BUILD.gn
+++ b/ios/chrome/browser/ui/ntp/BUILD.gn

@@ -137,6 +137,35 @@
   ]
 }
 
+source_set("ntp_controller") {
+  sources = [
+    "new_tab_page_controller.h",
+    "new_tab_page_controller.mm",
+  ]
+  deps = [
+    ":ntp",
+    ":ntp_internal",
+    "//base",
+    "//components/prefs",
+    "//components/search_engines",
+    "//components/strings",
+    "//components/sync_sessions",
+    "//ios/chrome/app/strings",
+    "//ios/chrome/browser",
+    "//ios/chrome/browser/browser_state",
+    "//ios/chrome/browser/search_engines",
+    "//ios/chrome/browser/sync",
+    "//ios/chrome/browser/tabs",
+    "//ios/chrome/browser/ui",
+    "//ios/chrome/browser/ui/bookmarks",
+    "//ios/chrome/browser/ui/commands",
+    "//ios/chrome/browser/ui/ntp/recent_tabs",
+    "//ios/chrome/browser/ui/toolbar",
+    "//ios/public/provider/chrome/browser/voice",
+    "//ui/base",
+  ]
+}
+
 source_set("ntp_internal") {
   sources = [
     "centering_scrollview.h",
@@ -158,8 +187,6 @@
     "new_tab_page_bar_button.mm",
     "new_tab_page_bar_item.h",
     "new_tab_page_bar_item.mm",
-    "new_tab_page_controller.h",
-    "new_tab_page_controller.mm",
     "new_tab_page_panel_protocol.mm",
     "new_tab_page_view.h",
     "new_tab_page_view.mm",
@@ -183,12 +210,10 @@
     "//components/keyed_service/core",
     "//components/metrics",
     "//components/ntp_tiles",
-    "//components/prefs",
     "//components/rappor",
     "//components/search_engines",
     "//components/strings",
     "//components/suggestions",
-    "//components/sync_sessions",
     "//ios/chrome/app/strings",
     "//ios/chrome/browser",
     "//ios/chrome/browser/browser_state",
@@ -199,7 +224,6 @@
     "//ios/chrome/browser/reading_list",
     "//ios/chrome/browser/search_engines",
     "//ios/chrome/browser/suggestions",
-    "//ios/chrome/browser/sync",
     "//ios/chrome/browser/tabs",
     "//ios/chrome/browser/ui",
     "//ios/chrome/browser/ui/bookmarks",
@@ -208,7 +232,6 @@
     "//ios/chrome/browser/ui/content_suggestions:content_suggestions_util",
     "//ios/chrome/browser/ui/content_suggestions/cells",
     "//ios/chrome/browser/ui/context_menu",
-    "//ios/chrome/browser/ui/ntp/recent_tabs",
     "//ios/chrome/browser/ui/overscroll_actions",
     "//ios/chrome/browser/ui/toolbar",
     "//ios/chrome/browser/web_state_list",
@@ -247,6 +270,7 @@
   ]
   deps = [
     ":ntp",
+    ":ntp_controller",
     ":ntp_internal",
     "//base",
     "//base/test:test_support",
@@ -285,6 +309,7 @@
     "new_tab_page_egtest.mm",
   ]
   deps = [
+    ":ntp_controller",
     ":ntp_internal",
     "//components/strings",
     "//ios/chrome/app/strings",

diff --git a/ios/chrome/browser/ui/ntp/google_landing_view_controller.mm b/ios/chrome/browser/ui/ntp/google_landing_view_controller.mm
index 8d476fb..5157527d 100644
--- a/ios/chrome/browser/ui/ntp/google_landing_view_controller.mm
+++ b/ios/chrome/browser/ui/ntp/google_landing_view_controller.mm

@@ -290,7 +290,12 @@
 }
 
 - (void)viewDidLayoutSubviews {
+  self.leftMargin =
+      content_suggestions::centeredTilesMarginForWidth([self viewWidth]);
   [self updateConstraintsForWidth:[self viewWidth]];
+  // Invalidate layout to handle the cases where the layout is changed when the
+  // NTP is not presented (e.g. tab backgrounded).
+  [[_mostVisitedView collectionViewLayout] invalidateLayout];
 }
 
 - (void)dealloc {

diff --git a/ios/chrome/browser/ui/payments/billing_address_selection_coordinator.mm b/ios/chrome/browser/ui/payments/billing_address_selection_coordinator.mm
index ca2f6e1..fbd18da 100644
--- a/ios/chrome/browser/ui/payments/billing_address_selection_coordinator.mm
+++ b/ios/chrome/browser/ui/payments/billing_address_selection_coordinator.mm

@@ -128,7 +128,7 @@
   [self.addressEditCoordinator stop];
   self.addressEditCoordinator = nil;
 
-  if (self.mediator.state != PaymentRequestSelectorStateEdit) {
+  if (![self.viewController isEditing]) {
     // Inform |self.delegate| that |address| has been selected.
     [self.delegate billingAddressSelectionCoordinator:self
                               didSelectBillingAddress:address];

diff --git a/ios/chrome/browser/ui/payments/contact_info_selection_coordinator.mm b/ios/chrome/browser/ui/payments/contact_info_selection_coordinator.mm
index 84890e63..b4e6c31 100644
--- a/ios/chrome/browser/ui/payments/contact_info_selection_coordinator.mm
+++ b/ios/chrome/browser/ui/payments/contact_info_selection_coordinator.mm

@@ -131,7 +131,7 @@
   [self.contactInfoEditCoordinator stop];
   self.contactInfoEditCoordinator = nil;
 
-  if (self.mediator.state != PaymentRequestSelectorStateEdit) {
+  if (![self.viewController isEditing]) {
     // Inform |self.delegate| that |profile| has been selected.
     [self.delegate contactInfoSelectionCoordinator:self
                            didSelectContactProfile:profile];

diff --git a/ios/chrome/browser/ui/payments/contact_info_selection_mediator.mm b/ios/chrome/browser/ui/payments/contact_info_selection_mediator.mm
index c58365c9..ebf3fa4f 100644
--- a/ios/chrome/browser/ui/payments/contact_info_selection_mediator.mm
+++ b/ios/chrome/browser/ui/payments/contact_info_selection_mediator.mm

@@ -85,13 +85,21 @@
       _paymentRequest->contact_profiles();
 
   _items = [NSMutableArray arrayWithCapacity:contactProfiles.size()];
+  DCHECK(self.paymentRequest->request_payer_name() ||
+         self.paymentRequest->request_payer_email() ||
+         self.paymentRequest->request_payer_phone());
   for (size_t index = 0; index < contactProfiles.size(); ++index) {
     autofill::AutofillProfile* contactProfile = contactProfiles[index];
     DCHECK(contactProfile);
     AutofillProfileItem* item = [[AutofillProfileItem alloc] init];
-    item.name = GetNameLabelFromAutofillProfile(*contactProfile);
-    item.email = GetEmailLabelFromAutofillProfile(*contactProfile);
-    item.phoneNumber = GetPhoneNumberLabelFromAutofillProfile(*contactProfile);
+    if (self.paymentRequest->request_payer_name())
+      item.name = GetNameLabelFromAutofillProfile(*contactProfile);
+    if (self.paymentRequest->request_payer_email())
+      item.email = GetEmailLabelFromAutofillProfile(*contactProfile);
+    if (self.paymentRequest->request_payer_phone()) {
+      item.phoneNumber =
+          GetPhoneNumberLabelFromAutofillProfile(*contactProfile);
+    }
     if (_paymentRequest->selected_contact_profile() == contactProfile)
       _selectedItemIndex = index;
 

diff --git a/ios/chrome/browser/ui/payments/contact_info_selection_mediator_unittest.mm b/ios/chrome/browser/ui/payments/contact_info_selection_mediator_unittest.mm
index 9e67cad..5e511604 100644
--- a/ios/chrome/browser/ui/payments/contact_info_selection_mediator_unittest.mm
+++ b/ios/chrome/browser/ui/payments/contact_info_selection_mediator_unittest.mm

@@ -70,8 +70,7 @@
   // The second item must be selected.
   EXPECT_EQ(1U, GetMediator().selectedItemIndex);
 
-  CollectionViewItem* item_1 =
-      [[GetMediator() selectableItems] objectAtIndex:0];
+  CollectionViewItem* item_1 = [selectable_items objectAtIndex:0];
   DCHECK([item_1 isKindOfClass:[AutofillProfileItem class]]);
   AutofillProfileItem* profile_item_1 =
       base::mac::ObjCCastStrict<AutofillProfileItem>(item_1);
@@ -87,8 +86,7 @@
   EXPECT_EQ(nil, profile_item_1.address);
   EXPECT_EQ(nil, profile_item_1.notification);
 
-  CollectionViewItem* item_2 =
-      [[GetMediator() selectableItems] objectAtIndex:1];
+  CollectionViewItem* item_2 = [selectable_items objectAtIndex:1];
   DCHECK([item_2 isKindOfClass:[AutofillProfileItem class]]);
   AutofillProfileItem* profile_item_2 =
       base::mac::ObjCCastStrict<AutofillProfileItem>(item_2);
@@ -122,3 +120,55 @@
   // The selected item index must be invalid.
   EXPECT_EQ(NSUIntegerMax, GetMediator().selectedItemIndex);
 }
+
+// Tests that only the requested fields are displayed.
+TEST_F(PaymentRequestContactInfoSelectionMediatorTest, TestOnlyRequestedData) {
+  // Update the web_payment_request and reload the items.
+  payment_request_->web_payment_request().options.request_payer_name = false;
+  [GetMediator() loadItems];
+
+  NSArray<CollectionViewItem*>* selectable_items =
+      [GetMediator() selectableItems];
+
+  CollectionViewItem* item = [selectable_items objectAtIndex:0];
+  DCHECK([item isKindOfClass:[AutofillProfileItem class]]);
+  AutofillProfileItem* profile_item =
+      base::mac::ObjCCastStrict<AutofillProfileItem>(item);
+  EXPECT_EQ(nil, profile_item.name);
+  EXPECT_NE(nil, profile_item.email);
+  EXPECT_NE(nil, profile_item.phoneNumber);
+  EXPECT_EQ(nil, profile_item.address);
+  EXPECT_EQ(nil, profile_item.notification);
+
+  // Update the web_payment_request and reload the items.
+  payment_request_->web_payment_request().options.request_payer_email = false;
+  [GetMediator() loadItems];
+
+  selectable_items = [GetMediator() selectableItems];
+
+  item = [selectable_items objectAtIndex:0];
+  DCHECK([item isKindOfClass:[AutofillProfileItem class]]);
+  profile_item = base::mac::ObjCCastStrict<AutofillProfileItem>(item);
+  EXPECT_EQ(nil, profile_item.name);
+  EXPECT_EQ(nil, profile_item.email);
+  EXPECT_NE(nil, profile_item.phoneNumber);
+  EXPECT_EQ(nil, profile_item.address);
+  EXPECT_EQ(nil, profile_item.notification);
+
+  // Update the web_payment_request and reload the items.
+  payment_request_->web_payment_request().options.request_payer_name = true;
+  payment_request_->web_payment_request().options.request_payer_email = true;
+  payment_request_->web_payment_request().options.request_payer_phone = false;
+  [GetMediator() loadItems];
+
+  selectable_items = [GetMediator() selectableItems];
+
+  item = [selectable_items objectAtIndex:0];
+  DCHECK([item isKindOfClass:[AutofillProfileItem class]]);
+  profile_item = base::mac::ObjCCastStrict<AutofillProfileItem>(item);
+  EXPECT_NE(nil, profile_item.name);
+  EXPECT_NE(nil, profile_item.email);
+  EXPECT_EQ(nil, profile_item.phoneNumber);
+  EXPECT_EQ(nil, profile_item.address);
+  EXPECT_EQ(nil, profile_item.notification);
+}

diff --git a/ios/chrome/browser/ui/payments/payment_method_selection_coordinator.mm b/ios/chrome/browser/ui/payments/payment_method_selection_coordinator.mm
index 30b10ff..b3a1508 100644
--- a/ios/chrome/browser/ui/payments/payment_method_selection_coordinator.mm
+++ b/ios/chrome/browser/ui/payments/payment_method_selection_coordinator.mm

@@ -125,7 +125,7 @@
   [self.creditCardEditCoordinator stop];
   self.creditCardEditCoordinator = nil;
 
-  if (self.mediator.state != PaymentRequestSelectorStateEdit) {
+  if (![self.viewController isEditing]) {
     // Inform |self.delegate| that this card has been selected.
     [self.delegate paymentMethodSelectionCoordinator:self
                               didSelectPaymentMethod:creditCard];

diff --git a/ios/chrome/browser/ui/payments/payment_request_mediator.mm b/ios/chrome/browser/ui/payments/payment_request_mediator.mm
index 494729a0..f88a660c 100644
--- a/ios/chrome/browser/ui/payments/payment_request_mediator.mm
+++ b/ios/chrome/browser/ui/payments/payment_request_mediator.mm

@@ -229,10 +229,17 @@
   const autofill::AutofillProfile* profile =
       self.paymentRequest->selected_contact_profile();
   if (profile) {
+    DCHECK(self.paymentRequest->request_payer_name() ||
+           self.paymentRequest->request_payer_email() ||
+           self.paymentRequest->request_payer_phone());
+
     AutofillProfileItem* item = [[AutofillProfileItem alloc] init];
-    item.name = GetNameLabelFromAutofillProfile(*profile);
-    item.phoneNumber = GetPhoneNumberLabelFromAutofillProfile(*profile);
-    item.email = GetEmailLabelFromAutofillProfile(*profile);
+    if (self.paymentRequest->request_payer_name())
+      item.name = GetNameLabelFromAutofillProfile(*profile);
+    if (self.paymentRequest->request_payer_phone())
+      item.phoneNumber = GetPhoneNumberLabelFromAutofillProfile(*profile);
+    if (self.paymentRequest->request_payer_email())
+      item.email = GetEmailLabelFromAutofillProfile(*profile);
     item.accessoryType = MDCCollectionViewCellAccessoryDisclosureIndicator;
     return item;
   }

diff --git a/ios/chrome/browser/ui/payments/payment_request_mediator_unittest.mm b/ios/chrome/browser/ui/payments/payment_request_mediator_unittest.mm
index 3bbd1d6..18ba0099 100644
--- a/ios/chrome/browser/ui/payments/payment_request_mediator_unittest.mm
+++ b/ios/chrome/browser/ui/payments/payment_request_mediator_unittest.mm

@@ -358,6 +358,33 @@
   EXPECT_EQ(MDCCollectionViewCellAccessoryDisclosureIndicator,
             contact_info_item.accessoryType);
 
+  // Contact Info item should only show requested fields.
+  payment_request_->web_payment_request().options.request_payer_name = false;
+  item = [GetPaymentRequestMediator() contactInfoItem];
+  ASSERT_TRUE([item isMemberOfClass:[AutofillProfileItem class]]);
+  contact_info_item = base::mac::ObjCCastStrict<AutofillProfileItem>(item);
+  EXPECT_EQ(nil, contact_info_item.name);
+  EXPECT_NE(nil, contact_info_item.phoneNumber);
+  EXPECT_NE(nil, contact_info_item.email);
+
+  payment_request_->web_payment_request().options.request_payer_phone = false;
+  item = [GetPaymentRequestMediator() contactInfoItem];
+  ASSERT_TRUE([item isMemberOfClass:[AutofillProfileItem class]]);
+  contact_info_item = base::mac::ObjCCastStrict<AutofillProfileItem>(item);
+  EXPECT_EQ(nil, contact_info_item.name);
+  EXPECT_EQ(nil, contact_info_item.phoneNumber);
+  EXPECT_NE(nil, contact_info_item.email);
+
+  payment_request_->web_payment_request().options.request_payer_name = true;
+  payment_request_->web_payment_request().options.request_payer_phone = false;
+  payment_request_->web_payment_request().options.request_payer_email = false;
+  item = [GetPaymentRequestMediator() contactInfoItem];
+  ASSERT_TRUE([item isMemberOfClass:[AutofillProfileItem class]]);
+  contact_info_item = base::mac::ObjCCastStrict<AutofillProfileItem>(item);
+  EXPECT_NE(nil, contact_info_item.name);
+  EXPECT_EQ(nil, contact_info_item.phoneNumber);
+  EXPECT_EQ(nil, contact_info_item.email);
+
   // Reset the selected contact profile.
   payment_request_->set_selected_contact_profile(nullptr);
 

diff --git a/ios/chrome/browser/ui/payments/payment_request_selector_view_controller.h b/ios/chrome/browser/ui/payments/payment_request_selector_view_controller.h
index 8194e68b..9132c960 100644
--- a/ios/chrome/browser/ui/payments/payment_request_selector_view_controller.h
+++ b/ios/chrome/browser/ui/payments/payment_request_selector_view_controller.h

@@ -58,6 +58,9 @@
 @property(nonatomic, weak) id<PaymentRequestSelectorViewControllerDataSource>
     dataSource;
 
+// Whether or not the editor is in the editing mode.
+@property(nonatomic, assign, getter=isEditing) BOOL editing;
+
 // Convenience initializer. Initializes this object with the
 // CollectionViewControllerStyleAppBar style and sets up the leading (back)
 // button.

diff --git a/ios/chrome/browser/ui/payments/payment_request_selector_view_controller.mm b/ios/chrome/browser/ui/payments/payment_request_selector_view_controller.mm
index ef945c76..b1f5d0a 100644
--- a/ios/chrome/browser/ui/payments/payment_request_selector_view_controller.mm
+++ b/ios/chrome/browser/ui/payments/payment_request_selector_view_controller.mm

@@ -48,9 +48,6 @@
 @interface PaymentRequestSelectorViewController ()<
     PaymentRequestSelectorViewControllerActions>
 
-// Whether or not the editor is in the editing mode.
-@property(nonatomic, assign, getter=isEditing) BOOL editing;
-
 @end
 
 @implementation PaymentRequestSelectorViewController

diff --git a/ios/chrome/browser/ui/payments/payment_request_selector_view_controller_data_source.h b/ios/chrome/browser/ui/payments/payment_request_selector_view_controller_data_source.h
index 5c0a6f6..d370f45 100644
--- a/ios/chrome/browser/ui/payments/payment_request_selector_view_controller_data_source.h
+++ b/ios/chrome/browser/ui/payments/payment_request_selector_view_controller_data_source.h

@@ -15,8 +15,6 @@
 typedef NS_ENUM(NSUInteger, PaymentRequestSelectorState) {
   // The view controller is in normal state.
   PaymentRequestSelectorStateNormal,
-  // The view controller is in edit state.
-  PaymentRequestSelectorStateEdit,
   // The view controller is in pending state.
   PaymentRequestSelectorStatePending,
   // The view controller is in error state.

diff --git a/ios/chrome/browser/ui/payments/shipping_address_selection_coordinator.mm b/ios/chrome/browser/ui/payments/shipping_address_selection_coordinator.mm
index 710a81c8..4266b8f 100644
--- a/ios/chrome/browser/ui/payments/shipping_address_selection_coordinator.mm
+++ b/ios/chrome/browser/ui/payments/shipping_address_selection_coordinator.mm

@@ -150,7 +150,7 @@
   [self.addressEditCoordinator stop];
   self.addressEditCoordinator = nil;
 
-  if (self.mediator.state != PaymentRequestSelectorStateEdit) {
+  if (![self.viewController isEditing]) {
     // Inform |self.delegate| that |address| has been selected.
     [self.delegate shippingAddressSelectionCoordinator:self
                               didSelectShippingAddress:address];

diff --git a/ios/chrome/browser/ui/toolbar/BUILD.gn b/ios/chrome/browser/ui/toolbar/BUILD.gn
index cf7a0b0..7700320 100644
--- a/ios/chrome/browser/ui/toolbar/BUILD.gn
+++ b/ios/chrome/browser/ui/toolbar/BUILD.gn

@@ -210,6 +210,7 @@
     "//ios/chrome/app/strings",
     "//ios/chrome/browser/ui",
     "//ios/chrome/browser/ui/commands",
+    "//ios/chrome/browser/ui/ntp:ntp_controller",
     "//ios/chrome/browser/ui/ntp:ntp_internal",
     "//ios/chrome/browser/ui/omnibox:omnibox_internal",
     "//ios/chrome/browser/ui/tools_menu",

diff --git a/ios/chrome/test/app/BUILD.gn b/ios/chrome/test/app/BUILD.gn
index a6ea7d8..1c13ffa1 100644
--- a/ios/chrome/test/app/BUILD.gn
+++ b/ios/chrome/test/app/BUILD.gn

@@ -68,7 +68,7 @@
     "//ios/chrome/browser/ui:ui_internal",
     "//ios/chrome/browser/ui/commands",
     "//ios/chrome/browser/ui/main",
-    "//ios/chrome/browser/ui/ntp:ntp_internal",
+    "//ios/chrome/browser/ui/ntp:ntp_controller",
     "//ios/chrome/browser/ui/stack_view",
     "//ios/chrome/browser/ui/static_content",
     "//ios/chrome/browser/ui/tabs",

diff --git a/ios/clean/chrome/browser/ui/ntp/BUILD.gn b/ios/clean/chrome/browser/ui/ntp/BUILD.gn
index c8a871d..1f11d55 100644
--- a/ios/clean/chrome/browser/ui/ntp/BUILD.gn
+++ b/ios/clean/chrome/browser/ui/ntp/BUILD.gn

@@ -20,6 +20,7 @@
     ":ntp_ui",
     "//ios/chrome/app/strings:ios_strings_grit",
     "//ios/chrome/browser/ui",
+    "//ios/chrome/browser/ui/ntp:ntp_controller",
     "//ios/chrome/browser/ui/ntp:ntp_internal",
     "//ios/chrome/browser/ui/toolbar",
     "//ios/clean/chrome/browser/ui/bookmarks",
@@ -48,6 +49,7 @@
     "//components/strings:components_strings_grit",
     "//ios/chrome/app/strings:ios_strings_grit",
     "//ios/chrome/browser/ui:ui",
+    "//ios/chrome/browser/ui/ntp:ntp_controller",
     "//ios/chrome/browser/ui/ntp:ntp_internal",
     "//ios/clean/chrome/browser/ui",
     "//ios/clean/chrome/browser/ui/commands:commands",

diff --git a/services/ui/gpu/interfaces/gpu_service.mojom b/services/ui/gpu/interfaces/gpu_service.mojom
index c4bbea22..27fe4df 100644
--- a/services/ui/gpu/interfaces/gpu_service.mojom
+++ b/services/ui/gpu/interfaces/gpu_service.mojom

@@ -23,7 +23,6 @@
   // If no channel can be identified, do nothing.
   CloseChannel(int32 client_id);
 
-  [Sync]
   CreateGpuMemoryBuffer(gfx.mojom.GpuMemoryBufferId id,
                         gfx.mojom.Size size,
                         gfx.mojom.BufferFormat format,

diff --git a/services/ui/ws/gpu_client.cc b/services/ui/ws/gpu_client.cc
index f5508b3..72e1e4a 100644
--- a/services/ui/ws/gpu_client.cc
+++ b/services/ui/ws/gpu_client.cc

@@ -7,6 +7,15 @@
 #include "components/viz/common/server_gpu_memory_buffer_manager.h"
 #include "services/ui/gpu/interfaces/gpu_service.mojom.h"
 
+namespace {
+
+void RunCallback(const ui::mojom::Gpu::CreateGpuMemoryBufferCallback& callback,
+                 const gfx::GpuMemoryBufferHandle& handle) {
+  callback.Run(handle);
+}
+
+}  // namespace
+
 namespace ui {
 namespace ws {
 
@@ -53,9 +62,9 @@
     gfx::BufferFormat format,
     gfx::BufferUsage usage,
     const mojom::Gpu::CreateGpuMemoryBufferCallback& callback) {
-  auto handle = gpu_memory_buffer_manager_->CreateGpuMemoryBufferHandle(
-      id, client_id_, size, format, usage, gpu::kNullSurfaceHandle);
-  callback.Run(handle);
+  gpu_memory_buffer_manager_->AllocateGpuMemoryBuffer(
+      id, client_id_, size, format, usage, gpu::kNullSurfaceHandle,
+      base::BindOnce(&RunCallback, callback));
 }
 
 void GpuClient::DestroyGpuMemoryBuffer(gfx::GpuMemoryBufferId id,

diff --git a/testing/variations/fieldtrial_testing_config.json b/testing/variations/fieldtrial_testing_config.json
index 3b38916a..719845a 100644
--- a/testing/variations/fieldtrial_testing_config.json
+++ b/testing/variations/fieldtrial_testing_config.json

@@ -1595,11 +1595,13 @@
             ],
             "experiments": [
                 {
-                    "name": "Enabled-ClickBasedRanker",
+                    "name": "Enabled-ClickBasedRanker-InitialOrderGeneral",
                     "params": {
+                        "category_order": "general",
                         "category_ranker": "click_based"
                     },
                     "enable_features": [
+                        "ContentSuggestionsCategoryOrder",
                         "ContentSuggestionsCategoryRanker"
                     ]
                 }

diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index 6999bd10..663ce56 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations

@@ -880,6 +880,8 @@
 
 crbug.com/596968 [ Win ] inspector-protocol/input/eventTimestamp.html [ Failure Pass ]
 
+crbug.com/734762 [ Linux ] inspector-protocol/stylesheet-tracking-restart.js [ Failure Pass ]
+
 crbug.com/487281 [ Mac ] fast/forms/select/menulist-narrow-width.html [ Failure ]
 
 crbug.com/543110 [ Mac ] fast/text/international/text-shaping-arabic.html [ Failure ]

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-position-3/position-sticky-get-bounding-client-rect.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-position-3/position-sticky-get-bounding-client-rect.html
index a664ab3..18b2acfe 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-position-3/position-sticky-get-bounding-client-rect.html
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-position-3/position-sticky-get-bounding-client-rect.html

@@ -19,6 +19,7 @@
 }
 
 .spacer {
+  width: 2000px;
   height: 2000px;
 }
 
@@ -26,29 +27,73 @@
   width: 100px;
   height: 100px;
   background-color: green;
-  top: 50px;
 }
 
 .sticky {
   position: sticky;
+  top: 50px;
+  left: 20px;
 }
 </style>
 
-<div id="scroller" class="container">
-  <div id="sticky" class="sticky box"></div>
+<div id="scroller1" class="container">
+  <div id="sticky1" class="sticky box"></div>
   <div class="spacer"></div>
 </div>
 
 <script>
 test(() => {
-  var element = document.getElementById('sticky');
-  assert_equals(element.getBoundingClientRect().top, 50);
-  document.getElementById('scroller').scrollTop = 100;
-  assert_equals(element.getBoundingClientRect().top, 50);
+  var sticky = document.getElementById('sticky1');
+  assert_equals(sticky.getBoundingClientRect().top, 50);
+  document.getElementById('scroller1').scrollTop = 100;
+  assert_equals(sticky.getBoundingClientRect().top, 50);
   sticky.style.position = 'relative';
-  assert_equals(element.getBoundingClientRect().top, -50);
+  assert_equals(sticky.getBoundingClientRect().top, -50);
   sticky.style.position = 'sticky';
-  assert_equals(element.getBoundingClientRect().top, 50);
+  assert_equals(sticky.getBoundingClientRect().top, 50);
 }, 'sticky positioned element should be observable by getBoundingClientRect.');
 </script>
 
+<div id="scroller2" class="container">
+  <div class="spacer"></div>
+</div>
+
+<script>
+test(() => {
+  var scroller = document.getElementById('scroller2');
+  scroller.scrollTop = 100;
+  scroller.scrollLeft = 75;
+
+  var sticky = document.createElement('div');
+  sticky.className = 'sticky box';
+  scroller.insertBefore(sticky, scroller.querySelector('.spacer'));
+
+  var sticky_bounds = sticky.getBoundingClientRect();
+  var scroller_bounds = scroller.getBoundingClientRect();
+  assert_equals(sticky_bounds.top, scroller_bounds.top + 50);
+  assert_equals(sticky_bounds.left, scroller_bounds.left + 20);
+}, 'getBoundingClientRect should be correct for sticky after script insertion');
+</script>
+
+<div id="scroller3" class="container">
+  <div id="sticky3" class="sticky box"></div>
+  <div class="spacer"></div>
+</div>
+
+<script>
+test(() => {
+  var scroller = document.getElementById('scroller3');
+  var sticky = document.getElementById('sticky3');
+  scroller.scrollTop = 100;
+  scroller.scrollLeft = 75;
+
+  var div = document.createElement('div');
+  div.style.height = '65px';
+  scroller.insertBefore(div, sticky);
+
+  var sticky_bounds = sticky.getBoundingClientRect();
+  var scroller_bounds = scroller.getBoundingClientRect();
+  assert_equals(sticky_bounds.top, scroller_bounds.top + 50);
+  assert_equals(sticky_bounds.left, scroller_bounds.left + 20);
+}, 'getBoundingClientRect should be correct for sticky after script-caused layout');
+</script>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-position-3/position-sticky-offset-top-left.html b/third_party/WebKit/LayoutTests/external/wpt/css/css-position-3/position-sticky-offset-top-left.html
new file mode 100644
index 0000000..ade9e10
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-position-3/position-sticky-offset-top-left.html

@@ -0,0 +1,78 @@
+<!DOCTYPE html>
+<title>Sticky positioned element should be observable by offsetTop and offsetLeft</title>
+<link rel="help" href="https://www.w3.org/TR/css-position-3/#sticky-pos" />
+<meta name="assert" content="This test checks that a sticky positioned element
+should be observable by offsetTop/offsetLeft." />
+
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<style>
+body {
+  margin: 0;
+}
+
+.container {
+  position: relative; /* Required for offsetTop/offsetLeft tests. */
+  overflow: scroll;
+  width: 200px;
+  height: 200px;
+}
+
+.spacer {
+  width: 2000px;
+  height: 2000px;
+}
+
+.box {
+  width: 100px;
+  height: 100px;
+  background-color: green;
+}
+
+.sticky {
+  position: sticky;
+  top: 50px;
+  left: 20px;
+}
+</style>
+
+<div id="scroller1" class="container">
+  <div class="spacer"></div>
+</div>
+
+<script>
+test(() => {
+    var scroller = document.getElementById('scroller1');
+    scroller.scrollTop = 100;
+    scroller.scrollLeft = 75;
+
+    var sticky = document.createElement('div');
+    sticky.className = 'sticky box';
+    scroller.insertBefore(sticky, scroller.querySelector('.spacer'));
+
+    assert_equals(sticky.offsetTop, scroller.scrollTop + 50);
+    assert_equals(sticky.offsetLeft, scroller.scrollLeft + 20);
+}, 'offsetTop/offsetLeft should be correct for sticky after script insertion');
+</script>
+
+<div id="scroller2" class="container">
+  <div id="sticky2" class="sticky box"></div>
+  <div class="spacer"></div>
+</div>
+
+<script>
+test(function() {
+    var scroller = document.getElementById('scroller2');
+    var sticky = document.getElementById('sticky2');
+    scroller.scrollTop = 100;
+    scroller.scrollLeft = 75;
+
+    var div = document.createElement('div');
+    div.style.height = '65px';
+    scroller.insertBefore(div, sticky);
+
+    assert_equals(sticky.offsetTop, scroller.scrollTop + 50);
+    assert_equals(sticky.offsetLeft, scroller.scrollLeft + 20);
+}, 'offsetTop/offsetLeft should be correct for sticky after script-caused layout');
+</script>

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/contiguous-floated-table-vlr-007.xht b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/contiguous-floated-table-vlr-007.xht
index 34faf64..a02689e 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/contiguous-floated-table-vlr-007.xht
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/contiguous-floated-table-vlr-007.xht

@@ -16,7 +16,7 @@
   <link rel="match" href="../reference/ref-filled-green-100px-square.xht" />
 
   <meta content="image" name="flags" />
-  <meta content="This test checks that horizontal margins existing between contiguous floated tables with writing-mode set to 'vertical-lr' are not substracted by the amount of their borders. In this test, there should be an horizontal gap of 50px separating both tables. Margins between 2 floated boxes do not collapse." name="assert" />
+  <meta content="This test checks that horizontal margins existing between contiguous floated tables with writing-mode set to 'vertical-lr' are not subtracted by the amount of their borders. In this test, there should be an horizontal gap of 50px separating both tables. Margins between 2 floated boxes do not collapse." name="assert" />
 
   <style type="text/css"><![CDATA[
   table

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/contiguous-floated-table-vlr-009.xht b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/contiguous-floated-table-vlr-009.xht
index 39fd43e0..1679dae 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/contiguous-floated-table-vlr-009.xht
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/contiguous-floated-table-vlr-009.xht

@@ -16,7 +16,7 @@
   <link rel="match" href="../reference/ref-filled-green-100px-square.xht" />
 
   <meta content="image" name="flags" />
-  <meta content="This test checks that horizontal margins existing between contiguous floated tables with writing-mode set to 'vertical-lr' are not substracted by the amount of their horizontal padding. In this test, there should be an horizontal gap of 50px separating both tables. Margins between 2 floated boxes do not collapse." name="assert" />
+  <meta content="This test checks that horizontal margins existing between contiguous floated tables with writing-mode set to 'vertical-lr' are not subtracted by the amount of their horizontal padding. In this test, there should be an horizontal gap of 50px separating both tables. Margins between 2 floated boxes do not collapse." name="assert" />
 
   <style type="text/css"><![CDATA[
   table

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/contiguous-floated-table-vrl-006.xht b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/contiguous-floated-table-vrl-006.xht
index d973517..52ecdebc 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/contiguous-floated-table-vrl-006.xht
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/contiguous-floated-table-vrl-006.xht

@@ -16,7 +16,7 @@
   <link rel="match" href="../reference/ref-filled-green-100px-square.xht" />
 
   <meta content="image" name="flags" />
-  <meta content="This test checks that horizontal margins existing between contiguous floated tables with writing-mode set to 'vertical-rl' are not substracted by the amount of their borders. In this test, there should be an horizontal gap of 50px separating both tables. Margins between 2 floated boxes do not collapse." name="assert" />
+  <meta content="This test checks that horizontal margins existing between contiguous floated tables with writing-mode set to 'vertical-rl' are not subtracted by the amount of their borders. In this test, there should be an horizontal gap of 50px separating both tables. Margins between 2 floated boxes do not collapse." name="assert" />
 
   <style type="text/css"><![CDATA[
   table

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/contiguous-floated-table-vrl-008.xht b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/contiguous-floated-table-vrl-008.xht
index 625f2c4..24c10092 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/contiguous-floated-table-vrl-008.xht
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/contiguous-floated-table-vrl-008.xht

@@ -16,7 +16,7 @@
   <link rel="match" href="../reference/ref-filled-green-100px-square.xht" />
 
   <meta content="image" name="flags" />
-  <meta content="This test checks that horizontal margins existing between contiguous floated tables with writing-mode set to 'vertical-rl' are not substracted by the amount of their horizontal padding. In this test, there should be an horizontal gap of 50px separating both tables. Margins between 2 floated boxes do not collapse." name="assert" />
+  <meta content="This test checks that horizontal margins existing between contiguous floated tables with writing-mode set to 'vertical-rl' are not subtracted by the amount of their horizontal padding. In this test, there should be an horizontal gap of 50px separating both tables. Margins between 2 floated boxes do not collapse." name="assert" />
 
   <style type="text/css"><![CDATA[
   table

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-003.xht b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-003.xht
index 263d55d..2dda421 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-003.xht
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-003.xht

@@ -17,7 +17,7 @@
   <link rel="match" href="line-box-height-vlr-003-ref.xht" />
 
   <meta content="" name="flags" />
-  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a border. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accomodate transparent 'border-left' of inline box and transparent 'border-right' of inline box." name="assert" />
+  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a border. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accommodate transparent 'border-left' of inline box and transparent 'border-right' of inline box." name="assert" />
 
   <style type="text/css"><![CDATA[
   body

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-005.xht b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-005.xht
index 32e2ddca..a0e8943 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-005.xht
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-005.xht

@@ -17,7 +17,7 @@
   <link rel="match" href="line-box-height-vlr-003-ref.xht" />
 
   <meta content="" name="flags" />
-  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a padding. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accomodate transparent 'padding-left' of inline box and transparent 'padding-right' of inline box." name="assert" />
+  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a padding. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accommodate transparent 'padding-left' of inline box and transparent 'padding-right' of inline box." name="assert" />
 
   <style type="text/css"><![CDATA[
   body

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-007.xht b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-007.xht
index c1f3e12..c43d7d2 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-007.xht
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-007.xht

@@ -17,7 +17,7 @@
   <link rel="match" href="line-box-height-vlr-007-ref.xht" />
 
   <meta content="" name="flags" />
-  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a border. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accomodate transparent 'border-left' of inline box and transparent 'border-right' of inline box." name="assert" />
+  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a border. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accommodate transparent 'border-left' of inline box and transparent 'border-right' of inline box." name="assert" />
 
   <style type="text/css"><![CDATA[
   body

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-009.xht b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-009.xht
index 1c63169..746fab5 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-009.xht
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-009.xht

@@ -17,7 +17,7 @@
   <link rel="match" href="line-box-height-vlr-007-ref.xht" />
 
   <meta content="" name="flags" />
-  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a padding. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accomodate transparent 'padding-left' of inline box and transparent 'padding-right' of inline box." name="assert" />
+  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a padding. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accommodate transparent 'padding-left' of inline box and transparent 'padding-right' of inline box." name="assert" />
 
   <style type="text/css"><![CDATA[
   body

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-011.xht b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-011.xht
index 953c7f0..db8eb01 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-011.xht
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-011.xht

@@ -17,7 +17,7 @@
   <link rel="match" href="line-box-height-vlr-011-ref.xht" />
 
   <meta content="" name="flags" />
-  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a border. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accomodate transparent 'border-left' of inline box and transparent 'border-right' of inline box." name="assert" />
+  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a border. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accommodate transparent 'border-left' of inline box and transparent 'border-right' of inline box." name="assert" />
 
   <style type="text/css"><![CDATA[
   body

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-013.xht b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-013.xht
index b4c56d52..7721919 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-013.xht
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-013.xht

@@ -17,7 +17,7 @@
   <link rel="match" href="line-box-height-vlr-011-ref.xht" />
 
   <meta content="" name="flags" />
-  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a padding. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accomodate transparent 'padding-left' of inline box and transparent 'padding-right' of inline box." name="assert" />
+  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a padding. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accommodate transparent 'padding-left' of inline box and transparent 'padding-right' of inline box." name="assert" />
 
   <style type="text/css"><![CDATA[
   body

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-021.xht b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-021.xht
index 8f1b60c7..4da9a5f 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-021.xht
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-021.xht

@@ -17,7 +17,7 @@
   <link rel="match" href="line-box-height-vlr-021-ref.xht" />
 
   <meta content="" name="flags" />
-  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a border. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accomodate transparent 'border-left' of inline box and transparent 'border-right' of inline box." name="assert" />
+  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a border. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accommodate transparent 'border-left' of inline box and transparent 'border-right' of inline box." name="assert" />
   <meta name="DC.date.created" content="2015-07-22T09:54:03+11:00" scheme=
   "W3CDTF" />
   <meta name="DC.date.modified" content="2016-07-22T09:54:03+11:00" scheme=

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-023.xht b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-023.xht
index 802a3fd..ae5a2f53 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-023.xht
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vlr-023.xht

@@ -17,7 +17,7 @@
   <link rel="match" href="line-box-height-vlr-023-ref.xht" />
 
   <meta content="" name="flags" />
-  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a border. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accomodate transparent 'border-left' of inline box and transparent 'border-right' of inline box." name="assert" />
+  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a border. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accommodate transparent 'border-left' of inline box and transparent 'border-right' of inline box." name="assert" />
   <meta name="DC.date.created" content="2015-07-22T09:54:03+11:00" scheme="W3CDTF" />
   <meta name="DC.date.modified" content="2016-07-22T09:54:03+11:00" scheme="W3CDTF" />
 

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-002.xht b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-002.xht
index 1c57284..422f7d7 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-002.xht
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-002.xht

@@ -17,7 +17,7 @@
   <link rel="match" href="line-box-height-vrl-002-ref.xht" />
 
   <meta content="" name="flags" />
-  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a border. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accomodate transparent 'border-left' of inline box and transparent 'border-right' of inline box." name="assert" />
+  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a border. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accommodate transparent 'border-left' of inline box and transparent 'border-right' of inline box." name="assert" />
 
   <style type="text/css"><![CDATA[
   body

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-004.xht b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-004.xht
index 558d7a2..4f3f06f 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-004.xht
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-004.xht

@@ -17,7 +17,7 @@
   <link rel="match" href="line-box-height-vrl-002-ref.xht" />
 
   <meta content="" name="flags" />
-  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a padding. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accomodate transparent 'padding-left' of inline box and transparent 'padding-right' of inline box." name="assert" />
+  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a padding. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accommodate transparent 'padding-left' of inline box and transparent 'padding-right' of inline box." name="assert" />
 
   <style type="text/css"><![CDATA[
   body

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-006.xht b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-006.xht
index f49258d..0776ff92 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-006.xht
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-006.xht

@@ -17,7 +17,7 @@
   <link rel="match" href="line-box-height-vrl-006-ref.xht" />
 
   <meta content="" name="flags" />
-  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a border. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accomodate transparent 'border-left' of inline box and transparent 'border-right' of inline box." name="assert" />
+  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a border. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accommodate transparent 'border-left' of inline box and transparent 'border-right' of inline box." name="assert" />
 
   <style type="text/css"><![CDATA[
   body

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-008.xht b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-008.xht
index c273333..69485d7 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-008.xht
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-008.xht

@@ -17,7 +17,7 @@
   <link rel="match" href="line-box-height-vrl-006-ref.xht" />
 
   <meta content="" name="flags" />
-  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a padding. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accomodate transparent 'padding-left' of inline box and transparent 'padding-right' of inline box." name="assert" />
+  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a padding. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accommodate transparent 'padding-left' of inline box and transparent 'padding-right' of inline box." name="assert" />
 
   <style type="text/css"><![CDATA[
   body

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-010.xht b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-010.xht
index db85b1d3..ca6f77d8 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-010.xht
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-010.xht

@@ -17,7 +17,7 @@
   <link rel="match" href="line-box-height-vrl-010-ref.xht" />
 
   <meta content="" name="flags" />
-  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a border. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accomodate transparent 'border-left' of inline box and transparent 'border-right' of inline box." name="assert" />
+  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a border. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accommodate transparent 'border-left' of inline box and transparent 'border-right' of inline box." name="assert" />
 
   <style type="text/css"><![CDATA[
   body

diff --git a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-012.xht b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-012.xht
index dac6eef..9376aee0 100644
--- a/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-012.xht
+++ b/third_party/WebKit/LayoutTests/external/wpt/css/css-writing-modes-3/line-box-height-vrl-012.xht

@@ -17,7 +17,7 @@
   <link rel="match" href="line-box-height-vrl-010-ref.xht" />
 
   <meta content="" name="flags" />
-  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a padding. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accomodate transparent 'padding-left' of inline box and transparent 'padding-right' of inline box." name="assert" />
+  <meta content="This test checks that a line box height does not increase because an inline non-replaced box has a padding. In this test, the '34' inline box and the '56' inline box should be lined up with its inline '12' sibling. The line box height, enclosed by the blue border should not grow to accommodate transparent 'padding-left' of inline box and transparent 'padding-right' of inline box." name="assert" />
 
   <style type="text/css"><![CDATA[
   body

diff --git a/third_party/WebKit/LayoutTests/fast/css/sticky/sticky-position-valid-after-insertion.html b/third_party/WebKit/LayoutTests/fast/css/sticky/sticky-position-valid-after-insertion.html
deleted file mode 100644
index ce4dd6b24..0000000
--- a/third_party/WebKit/LayoutTests/fast/css/sticky/sticky-position-valid-after-insertion.html
+++ /dev/null

@@ -1,70 +0,0 @@
-<!DOCTYPE html>
-<script src="../../../resources/testharness.js"></script>
-<script src="../../../resources/testharnessreport.js"></script>
-<style>
-body {
-    margin: 0;
-}
-
-.scroller {
-    height: 100px;
-    width: 200px;
-    overflow: scroll;
-}
-
-.padding {
-    width: 400px;
-    height: 500px;
-}
-
-.sticky {
-    width: 25px;
-    height: 25px;
-    position: sticky;
-    top: 20px;
-    left: 50px;
-}
-</style>
-
-<div class="scroller" id="scroller1">
-  <div class="padding" id="padding1"></div>
-</div>
-
-<div class="scroller" id="scroller2">
-  <div class="padding" id="padding2"></div>
-</div>
-
-<script>
-if (window.internals) {
-  internals.settings.setCSSStickyPositionEnabled(true);
-}
-
-test(function() {
-    var scroller = document.getElementById('scroller1');
-    scroller.scrollTop = 100;
-    scroller.scrollLeft = 75;
-
-    var sticky = document.createElement('div');
-    sticky.className = 'sticky';
-    scroller.insertBefore(sticky, document.getElementById('padding1'));
-
-    assert_equals(sticky.offsetTop, scroller.scrollTop + 20);
-    assert_equals(sticky.offsetLeft, scroller.scrollLeft + 50);
-}, "offsetTop/offsetLeft should be correct for sticky after insertion");
-
-test(function() {
-    var scroller = document.getElementById('scroller2');
-    scroller.scrollTop = 100;
-    scroller.scrollLeft = 75;
-
-    var sticky = document.createElement('div');
-    sticky.className = 'sticky';
-    scroller.insertBefore(sticky, document.getElementById('padding2'));
-
-    var sticky_bounds = sticky.getBoundingClientRect();
-    var scroller_bounds = scroller.getBoundingClientRect();
-    assert_equals(sticky_bounds.top, scroller_bounds.top + 20);
-    assert_equals(sticky_bounds.left, scroller_bounds.left + 50);
-}, "getBoundingClientRect should be correct for sticky after insertion");
-
-</script>

diff --git a/third_party/WebKit/LayoutTests/fast/css/sticky/sticky-position-valid-after-layout.html b/third_party/WebKit/LayoutTests/fast/css/sticky/sticky-position-valid-after-layout.html
deleted file mode 100644
index 4801ab23..0000000
--- a/third_party/WebKit/LayoutTests/fast/css/sticky/sticky-position-valid-after-layout.html
+++ /dev/null

@@ -1,58 +0,0 @@
-<!DOCTYPE html>
-<script src="../../../resources/testharness.js"></script>
-<script src="../../../resources/testharnessreport.js"></script>
-<style>
-body {
-    margin: 0;
-}
-
-#scroller {
-    height: 100px;
-    width: 200px;
-    overflow: scroll;
-}
-
-.padding {
-    width: 400px;
-    height: 500px;
-}
-
-#sticky {
-    width: 25px;
-    height: 25px;
-    position: sticky;
-    top: 20px;
-    left: 50px;
-}
-</style>
-
-<div id="scroller">
-  <div id="sticky"></div>
-  <div class="padding"></div>
-</div>
-
-<script>
-if (window.internals) {
-  internals.settings.setCSSStickyPositionEnabled(true);
-}
-
-test(function() {
-    var scroller = document.getElementById('scroller');
-    var sticky = document.getElementById('sticky');
-    scroller.scrollTop = 100;
-    scroller.scrollLeft = 75;
-    scroller.append(document.createElement('div'));
-    assert_equals(sticky.getBoundingClientRect().top, 20);
-    assert_equals(sticky.getBoundingClientRect().left, 50);
-}, "getBoundingClientRect should be correct for sticky after script-caused layout");
-
-test(function() {
-    var scroller = document.getElementById('scroller');
-    var sticky = document.getElementById('sticky');
-    scroller.scrollTop = 100;
-    scroller.scrollLeft = 75;
-    scroller.append(document.createElement('div'));
-    assert_equals(sticky.offsetTop, scroller.scrollTop + 20);
-    assert_equals(sticky.offsetLeft, scroller.scrollLeft + 50);
-}, "offsetTop/offsetLeft should be correct for sticky after script-caused layout");
-</script>

diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptPromisePropertyBase.cpp b/third_party/WebKit/Source/bindings/core/v8/ScriptPromisePropertyBase.cpp
index 81f92fb..83adc4a 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptPromisePropertyBase.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptPromisePropertyBase.cpp

@@ -22,6 +22,8 @@
       state_(kPending) {}
 
 ScriptPromisePropertyBase::~ScriptPromisePropertyBase() {
+  // TODO(haraken): Stop calling ClearWrappers here, as the dtor is invoked
+  // during oilpan GC, but ClearWrappers potentially runs user script.
   ClearWrappers();
 }
 
@@ -160,6 +162,7 @@
        ++i) {
     v8::Local<v8::Object> wrapper = (*i)->NewLocal(isolate_);
     if (!wrapper.IsEmpty()) {
+      v8::Context::Scope scope(wrapper->CreationContext());
       // TODO(peria): Use deleteProperty() if http://crbug.com/v8/6227 is fixed.
       ResolverSymbol().Set(wrapper, v8::Undefined(isolate_));
       PromiseSymbol().Set(wrapper, v8::Undefined(isolate_));

diff --git a/third_party/WebKit/Source/core/layout/ng/inline/ng_line_breaker_test.cc b/third_party/WebKit/Source/core/layout/ng/inline/ng_line_breaker_test.cc
index 25cf38f..4761ba3f 100644
--- a/third_party/WebKit/Source/core/layout/ng/inline/ng_line_breaker_test.cc
+++ b/third_party/WebKit/Source/core/layout/ng/inline/ng_line_breaker_test.cc

@@ -109,7 +109,14 @@
   EXPECT_EQ("678", ToString(lines[1], node));
 }
 
-TEST_F(NGLineBreakerTest, OverflowAtomicInline) {
+// The test leaks memory in CopyFragmentDataToLayoutBox. Re-enable when
+// LayoutNGPaintFragments is ready. crbug.com/732574
+#if defined(ADDRESS_SANITIZER)
+#define MAYBE_OverflowAtomicInline DISABLED_OverflowAtomicInline
+#else
+#define MAYBE_OverflowAtomicInline OverflowAtomicInline
+#endif
+TEST_F(NGLineBreakerTest, MAYBE_OverflowAtomicInline) {
   LoadAhem();
   NGInlineNode node = CreateInlineNode(R"HTML(
     <!DOCTYPE html>

diff --git a/tools/battor_agent/battor_agent.cc b/tools/battor_agent/battor_agent.cc
index 45a4d542..3319713 100644
--- a/tools/battor_agent/battor_agent.cc
+++ b/tools/battor_agent/battor_agent.cc

@@ -108,11 +108,9 @@
 BattOrAgent::BattOrAgent(
     const std::string& path,
     Listener* listener,
-    scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner,
     scoped_refptr<base::SingleThreadTaskRunner> ui_thread_task_runner)
     : connection_(new BattOrConnectionImpl(path,
                                            this,
-                                           file_thread_task_runner,
                                            ui_thread_task_runner)),
       listener_(listener),
       last_action_(Action::INVALID),

diff --git a/tools/battor_agent/battor_agent.h b/tools/battor_agent/battor_agent.h
index 176cb70..fa39fee 100644
--- a/tools/battor_agent/battor_agent.h
+++ b/tools/battor_agent/battor_agent.h

@@ -51,7 +51,6 @@
   BattOrAgent(
       const std::string& path,
       Listener* listener,
-      scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner,
       scoped_refptr<base::SingleThreadTaskRunner> ui_thread_task_runner);
   virtual ~BattOrAgent();
 

diff --git a/tools/battor_agent/battor_agent_bin.cc b/tools/battor_agent/battor_agent_bin.cc
index e1b2461..78d13ad 100644
--- a/tools/battor_agent/battor_agent_bin.cc
+++ b/tools/battor_agent/battor_agent_bin.cc

@@ -47,6 +47,7 @@
 #include "base/single_thread_task_runner.h"
 #include "base/strings/string_tokenizer.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/task_scheduler/task_scheduler.h"
 #include "base/threading/thread.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "tools/battor_agent/battor_agent.h"
@@ -60,7 +61,6 @@
 namespace {
 
 const char kIoThreadName[] = "BattOr IO Thread";
-const char kFileThreadName[] = "BattOr File Thread";
 
 const char kUsage[] =
     "Start the battor_agent shell with:\n"
@@ -111,7 +111,7 @@
 // use a BattOrAgent to communicate with a BattOr.
 class BattOrAgentBin : public BattOrAgent::Listener {
  public:
-  BattOrAgentBin() : io_thread_(kIoThreadName), file_thread_(kFileThreadName) {}
+  BattOrAgentBin() : io_thread_(kIoThreadName) {}
 
   ~BattOrAgentBin() { DCHECK(!agent_); }
 
@@ -305,13 +305,7 @@
       const std::string& path,
       scoped_refptr<base::SingleThreadTaskRunner> ui_thread_task_runner,
       base::WaitableEvent* done) {
-    // In Chrome, we already have a file thread running. Because the Chrome
-    // serial library relies on having it available, we have to spin up our own.
-    if (!file_thread_.Start())
-      ExitFromThreadStartFailure(kFileThreadName);
-
-    agent_.reset(new BattOrAgent(path, this, file_thread_.task_runner(),
-                                 ui_thread_task_runner));
+    agent_.reset(new BattOrAgent(path, this, ui_thread_task_runner));
     done->Signal();
   }
 
@@ -331,7 +325,6 @@
 
   // Threads needed for serial communication.
   base::Thread io_thread_;
-  base::Thread file_thread_;
 
   // The agent capable of asynchronously communicating with the BattOr.
   std::unique_ptr<BattOrAgent> agent_;
@@ -345,5 +338,6 @@
   base::AtExitManager exit_manager;
   base::CommandLine::Init(argc, argv);
   battor::BattOrAgentBin bin;
+  base::TaskScheduler::CreateAndStartWithDefaultParams("battor_agent");
   return bin.Run(argc, argv);
 }

diff --git a/tools/battor_agent/battor_agent_unittest.cc b/tools/battor_agent/battor_agent_unittest.cc
index 1bb9a9f..d5f882b 100644
--- a/tools/battor_agent/battor_agent_unittest.cc
+++ b/tools/battor_agent/battor_agent_unittest.cc

@@ -82,7 +82,7 @@
 class TestableBattOrAgent : public BattOrAgent {
  public:
   TestableBattOrAgent(BattOrAgent::Listener* listener)
-      : BattOrAgent("/dev/test", listener, nullptr, nullptr) {
+      : BattOrAgent("/dev/test", listener, nullptr) {
     connection_ =
         std::unique_ptr<BattOrConnection>(new MockBattOrConnection(this));
   }

diff --git a/tools/battor_agent/battor_connection_impl.cc b/tools/battor_agent/battor_connection_impl.cc
index a6b86187..8e494e1 100644
--- a/tools/battor_agent/battor_connection_impl.cc
+++ b/tools/battor_agent/battor_connection_impl.cc

@@ -61,11 +61,9 @@
 BattOrConnectionImpl::BattOrConnectionImpl(
     const std::string& path,
     BattOrConnection::Listener* listener,
-    scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner,
     scoped_refptr<base::SingleThreadTaskRunner> ui_thread_task_runner)
     : BattOrConnection(listener),
       path_(path),
-      file_thread_task_runner_(file_thread_task_runner),
       ui_thread_task_runner_(ui_thread_task_runner) {
   std::string serial_log_path =
       base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
@@ -193,8 +191,7 @@
 }
 
 scoped_refptr<device::SerialIoHandler> BattOrConnectionImpl::CreateIoHandler() {
-  return device::SerialIoHandler::Create(file_thread_task_runner_,
-                                         ui_thread_task_runner_);
+  return device::SerialIoHandler::Create(ui_thread_task_runner_);
 }
 
 void BattOrConnectionImpl::BeginReadBytes(size_t max_bytes_to_read) {

diff --git a/tools/battor_agent/battor_connection_impl.h b/tools/battor_agent/battor_connection_impl.h
index 3b32e2a..78ae11ea 100644
--- a/tools/battor_agent/battor_connection_impl.h
+++ b/tools/battor_agent/battor_connection_impl.h

@@ -35,7 +35,6 @@
   BattOrConnectionImpl(
       const std::string& path,
       BattOrConnection::Listener* listener,
-      scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner,
       scoped_refptr<base::SingleThreadTaskRunner> ui_thread_task_runner);
   ~BattOrConnectionImpl() override;
 
@@ -105,7 +104,6 @@
   size_t pending_write_length_;
 
   // Threads needed for serial communication.
-  scoped_refptr<base::SingleThreadTaskRunner> file_thread_task_runner_;
   scoped_refptr<base::SingleThreadTaskRunner> ui_thread_task_runner_;
 
   std::fstream serial_log_;

diff --git a/tools/battor_agent/battor_connection_impl_unittest.cc b/tools/battor_agent/battor_connection_impl_unittest.cc
index d77ff7d..99561b5 100644
--- a/tools/battor_agent/battor_connection_impl_unittest.cc
+++ b/tools/battor_agent/battor_connection_impl_unittest.cc

@@ -28,7 +28,7 @@
 class TestableBattOrConnection : public BattOrConnectionImpl {
  public:
   TestableBattOrConnection(BattOrConnection::Listener* listener)
-      : BattOrConnectionImpl("/dev/test", listener, nullptr, nullptr) {}
+      : BattOrConnectionImpl("/dev/test", listener, nullptr) {}
   scoped_refptr<device::SerialIoHandler> CreateIoHandler() override {
     return device::TestSerialIoHandler::Create();
   }

diff --git a/tools/perf/benchmarks/v8.py b/tools/perf/benchmarks/v8.py
index 66cacb2e..78f93a61 100644
--- a/tools/perf/benchmarks/v8.py
+++ b/tools/perf/benchmarks/v8.py

@@ -106,18 +106,7 @@
   def GetExpectations(self):
     class StoryExpectations(story.expectations.StoryExpectations):
       def SetExpectations(self):
-        self.DisableStory(
-            'discourse',
-            [story.expectations.ALL_LINUX],
-            'crbug.com/732577')
-        self.DisableStory(
-            'facebook',
-            [story.expectations.ALL_LINUX],
-            'crbug.com/732577')
-        self.DisableStory(
-            'twitter',
-            [story.expectations.ALL_DESKTOP],
-            'crbug.com/732577')
+         pass # blank_page.html not disabled.
     return StoryExpectations()
 
 

diff --git a/tools/perf/page_sets/infinite_scroll_cases.py b/tools/perf/page_sets/infinite_scroll_cases.py
index 25221f0..680fefc5 100644
--- a/tools/perf/page_sets/infinite_scroll_cases.py
+++ b/tools/perf/page_sets/infinite_scroll_cases.py

@@ -20,8 +20,8 @@
 
   SCROLL_DISTANCE = 25000
   SCROLL_STEP = 1000
-  MAX_SCROLL_RETRIES = 3
-  TIME_BEFORE_SCROLL_RETRY_IN_SECONDS = 1
+  MAX_SCROLL_RETRIES = 5
+  TIME_BEFORE_SCROLL_RETRY_IN_SECONDS = 2
   TIME_TO_WAIT_BEFORE_STARTING_IN_SECONDS = 5
 
   def __init__(self, story_set):