diff --git a/ash/wm/session_state_animator.cc b/ash/wm/session_state_animator.cc
index 04695f6c..7b5c5029 100644
--- a/ash/wm/session_state_animator.cc
+++ b/ash/wm/session_state_animator.cc
@@ -93,7 +93,7 @@
     case ANIMATION_SPEED_UNDO_MOVE_WINDOWS:
       return base::TimeDelta::FromMilliseconds(350);
     case ANIMATION_SPEED_SHUTDOWN:
-      return IsTouchViewEnabled() ? base::TimeDelta::FromMilliseconds(2500)
+      return IsTouchViewEnabled() ? base::TimeDelta::FromMilliseconds(1500)
                                   : base::TimeDelta::FromMilliseconds(1000);
     case ANIMATION_SPEED_REVERT_SHUTDOWN:
       return base::TimeDelta::FromMilliseconds(500);
diff --git a/chrome/browser/extensions/BUILD.gn b/chrome/browser/extensions/BUILD.gn
index 39451a3..ad847741 100644
--- a/chrome/browser/extensions/BUILD.gn
+++ b/chrome/browser/extensions/BUILD.gn
@@ -236,6 +236,8 @@
     "api/identity/gaia_web_auth_flow.h",
     "api/identity/identity_api.cc",
     "api/identity/identity_api.h",
+    "api/identity/identity_launch_web_auth_flow_function.cc",
+    "api/identity/identity_launch_web_auth_flow_function.h",
     "api/identity/identity_mint_queue.cc",
     "api/identity/identity_mint_queue.h",
     "api/identity/identity_signin_flow.cc",
diff --git a/chrome/browser/extensions/api/identity/identity_api.cc b/chrome/browser/extensions/api/identity/identity_api.cc
index f76f95d3..ffd17a9 100644
--- a/chrome/browser/extensions/api/identity/identity_api.cc
+++ b/chrome/browser/extensions/api/identity/identity_api.cc
@@ -75,9 +75,6 @@
 
 namespace {
 
-static const char kChromiumDomainRedirectUrlPattern[] =
-    "https://%s.chromiumapp.org/";
-
 #if defined(OS_CHROMEOS)
 // The list of apps that are allowed to use the Identity API to retrieve the
 // token from the device robot account in a public session.
@@ -942,84 +939,4 @@
   return RespondNow(NoArguments());
 }
 
-IdentityLaunchWebAuthFlowFunction::IdentityLaunchWebAuthFlowFunction() {}
-
-IdentityLaunchWebAuthFlowFunction::~IdentityLaunchWebAuthFlowFunction() {
-  if (auth_flow_)
-    auth_flow_.release()->DetachDelegateAndDelete();
-}
-
-bool IdentityLaunchWebAuthFlowFunction::RunAsync() {
-  if (GetProfile()->IsOffTheRecord()) {
-    error_ = identity_constants::kOffTheRecord;
-    return false;
-  }
-
-  std::unique_ptr<identity::LaunchWebAuthFlow::Params> params(
-      identity::LaunchWebAuthFlow::Params::Create(*args_));
-  EXTENSION_FUNCTION_VALIDATE(params.get());
-
-  GURL auth_url(params->details.url);
-  WebAuthFlow::Mode mode =
-      params->details.interactive && *params->details.interactive ?
-      WebAuthFlow::INTERACTIVE : WebAuthFlow::SILENT;
-
-  // Set up acceptable target URLs. (Does not include chrome-extension
-  // scheme for this version of the API.)
-  InitFinalRedirectURLPrefix(extension()->id());
-
-  AddRef();  // Balanced in OnAuthFlowSuccess/Failure.
-
-  auth_flow_.reset(new WebAuthFlow(this, GetProfile(), auth_url, mode));
-  auth_flow_->Start();
-  return true;
-}
-
-void IdentityLaunchWebAuthFlowFunction::InitFinalRedirectURLPrefixForTest(
-    const std::string& extension_id) {
-  InitFinalRedirectURLPrefix(extension_id);
-}
-
-void IdentityLaunchWebAuthFlowFunction::InitFinalRedirectURLPrefix(
-    const std::string& extension_id) {
-  if (final_url_prefix_.is_empty()) {
-    final_url_prefix_ = GURL(base::StringPrintf(
-        kChromiumDomainRedirectUrlPattern, extension_id.c_str()));
-  }
-}
-
-void IdentityLaunchWebAuthFlowFunction::OnAuthFlowFailure(
-    WebAuthFlow::Failure failure) {
-  switch (failure) {
-    case WebAuthFlow::WINDOW_CLOSED:
-      error_ = identity_constants::kUserRejected;
-      break;
-    case WebAuthFlow::INTERACTION_REQUIRED:
-      error_ = identity_constants::kInteractionRequired;
-      break;
-    case WebAuthFlow::LOAD_FAILED:
-      error_ = identity_constants::kPageLoadFailure;
-      break;
-    default:
-      NOTREACHED() << "Unexpected error from web auth flow: " << failure;
-      error_ = identity_constants::kInvalidRedirect;
-      break;
-  }
-  SendResponse(false);
-  if (auth_flow_)
-    auth_flow_.release()->DetachDelegateAndDelete();
-  Release();  // Balanced in RunAsync.
-}
-
-void IdentityLaunchWebAuthFlowFunction::OnAuthFlowURLChange(
-    const GURL& redirect_url) {
-  if (redirect_url.GetWithEmptyPath() == final_url_prefix_) {
-    SetResult(base::MakeUnique<base::StringValue>(redirect_url.spec()));
-    SendResponse(true);
-    if (auth_flow_)
-      auth_flow_.release()->DetachDelegateAndDelete();
-    Release();  // Balanced in RunAsync.
-  }
-}
-
 }  // namespace extensions
diff --git a/chrome/browser/extensions/api/identity/identity_api.h b/chrome/browser/extensions/api/identity/identity_api.h
index 303885c6..6ee7f61 100644
--- a/chrome/browser/extensions/api/identity/identity_api.h
+++ b/chrome/browser/extensions/api/identity/identity_api.h
@@ -18,6 +18,7 @@
 #include "build/build_config.h"
 #include "chrome/browser/extensions/api/identity/extension_token_key.h"
 #include "chrome/browser/extensions/api/identity/gaia_web_auth_flow.h"
+#include "chrome/browser/extensions/api/identity/identity_launch_web_auth_flow_function.h"
 #include "chrome/browser/extensions/api/identity/identity_mint_queue.h"
 #include "chrome/browser/extensions/api/identity/identity_signin_flow.h"
 #include "chrome/browser/extensions/api/identity/web_auth_flow.h"
@@ -331,33 +332,6 @@
   ResponseAction Run() override;
 };
 
-class IdentityLaunchWebAuthFlowFunction : public ChromeAsyncExtensionFunction,
-                                          public WebAuthFlow::Delegate {
- public:
-  DECLARE_EXTENSION_FUNCTION("identity.launchWebAuthFlow",
-                             EXPERIMENTAL_IDENTITY_LAUNCHWEBAUTHFLOW);
-
-  IdentityLaunchWebAuthFlowFunction();
-
-  // Tests may override extension_id.
-  void InitFinalRedirectURLPrefixForTest(const std::string& extension_id);
-
- private:
-  ~IdentityLaunchWebAuthFlowFunction() override;
-  bool RunAsync() override;
-
-  // WebAuthFlow::Delegate implementation.
-  void OnAuthFlowFailure(WebAuthFlow::Failure failure) override;
-  void OnAuthFlowURLChange(const GURL& redirect_url) override;
-  void OnAuthFlowTitleChange(const std::string& title) override {}
-
-  // Helper to initialize final URL prefix.
-  void InitFinalRedirectURLPrefix(const std::string& extension_id);
-
-  std::unique_ptr<WebAuthFlow> auth_flow_;
-  GURL final_url_prefix_;
-};
-
 }  // namespace extensions
 
 #endif  // CHROME_BROWSER_EXTENSIONS_API_IDENTITY_IDENTITY_API_H_
diff --git a/chrome/browser/extensions/api/identity/identity_apitest.cc b/chrome/browser/extensions/api/identity/identity_apitest.cc
index d0f8fcb..cb0f21c 100644
--- a/chrome/browser/extensions/api/identity/identity_apitest.cc
+++ b/chrome/browser/extensions/api/identity/identity_apitest.cc
@@ -22,6 +22,7 @@
 #include "extensions/common/extension_builder.h"
 #endif
 #include "chrome/browser/extensions/api/identity/identity_api.h"
+#include "chrome/browser/extensions/api/identity/identity_launch_web_auth_flow_function.h"
 #include "chrome/browser/extensions/component_loader.h"
 #include "chrome/browser/extensions/extension_apitest.h"
 #include "chrome/browser/extensions/extension_browsertest.h"
diff --git a/chrome/browser/extensions/api/identity/identity_launch_web_auth_flow_function.cc b/chrome/browser/extensions/api/identity/identity_launch_web_auth_flow_function.cc
new file mode 100644
index 0000000..ca9beb7a8
--- /dev/null
+++ b/chrome/browser/extensions/api/identity/identity_launch_web_auth_flow_function.cc
@@ -0,0 +1,102 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/extensions/api/identity/identity_launch_web_auth_flow_function.h"
+
+#include "chrome/browser/extensions/api/identity/identity_api.h"
+#include "chrome/browser/profiles/profile.h"
+#include "chrome/common/extensions/api/identity.h"
+
+namespace extensions {
+
+namespace {
+
+static const char kChromiumDomainRedirectUrlPattern[] =
+    "https://%s.chromiumapp.org/";
+
+}  // namespace
+
+namespace identity = api::identity;
+
+IdentityLaunchWebAuthFlowFunction::IdentityLaunchWebAuthFlowFunction() {}
+
+IdentityLaunchWebAuthFlowFunction::~IdentityLaunchWebAuthFlowFunction() {
+  if (auth_flow_)
+    auth_flow_.release()->DetachDelegateAndDelete();
+}
+
+bool IdentityLaunchWebAuthFlowFunction::RunAsync() {
+  if (GetProfile()->IsOffTheRecord()) {
+    error_ = identity_constants::kOffTheRecord;
+    return false;
+  }
+
+  std::unique_ptr<identity::LaunchWebAuthFlow::Params> params(
+      identity::LaunchWebAuthFlow::Params::Create(*args_));
+  EXTENSION_FUNCTION_VALIDATE(params.get());
+
+  GURL auth_url(params->details.url);
+  WebAuthFlow::Mode mode =
+      params->details.interactive && *params->details.interactive ?
+      WebAuthFlow::INTERACTIVE : WebAuthFlow::SILENT;
+
+  // Set up acceptable target URLs. (Does not include chrome-extension
+  // scheme for this version of the API.)
+  InitFinalRedirectURLPrefix(extension()->id());
+
+  AddRef();  // Balanced in OnAuthFlowSuccess/Failure.
+
+  auth_flow_.reset(new WebAuthFlow(this, GetProfile(), auth_url, mode));
+  auth_flow_->Start();
+  return true;
+}
+
+void IdentityLaunchWebAuthFlowFunction::InitFinalRedirectURLPrefixForTest(
+    const std::string& extension_id) {
+  InitFinalRedirectURLPrefix(extension_id);
+}
+
+void IdentityLaunchWebAuthFlowFunction::InitFinalRedirectURLPrefix(
+    const std::string& extension_id) {
+  if (final_url_prefix_.is_empty()) {
+    final_url_prefix_ = GURL(base::StringPrintf(
+        kChromiumDomainRedirectUrlPattern, extension_id.c_str()));
+  }
+}
+
+void IdentityLaunchWebAuthFlowFunction::OnAuthFlowFailure(
+    WebAuthFlow::Failure failure) {
+  switch (failure) {
+    case WebAuthFlow::WINDOW_CLOSED:
+      error_ = identity_constants::kUserRejected;
+      break;
+    case WebAuthFlow::INTERACTION_REQUIRED:
+      error_ = identity_constants::kInteractionRequired;
+      break;
+    case WebAuthFlow::LOAD_FAILED:
+      error_ = identity_constants::kPageLoadFailure;
+      break;
+    default:
+      NOTREACHED() << "Unexpected error from web auth flow: " << failure;
+      error_ = identity_constants::kInvalidRedirect;
+      break;
+  }
+  SendResponse(false);
+  if (auth_flow_)
+    auth_flow_.release()->DetachDelegateAndDelete();
+  Release();  // Balanced in RunAsync.
+}
+
+void IdentityLaunchWebAuthFlowFunction::OnAuthFlowURLChange(
+    const GURL& redirect_url) {
+  if (redirect_url.GetWithEmptyPath() == final_url_prefix_) {
+    SetResult(base::MakeUnique<base::StringValue>(redirect_url.spec()));
+    SendResponse(true);
+    if (auth_flow_)
+      auth_flow_.release()->DetachDelegateAndDelete();
+    Release();  // Balanced in RunAsync.
+  }
+}
+
+}  // namespace extensions
diff --git a/chrome/browser/extensions/api/identity/identity_launch_web_auth_flow_function.h b/chrome/browser/extensions/api/identity/identity_launch_web_auth_flow_function.h
new file mode 100644
index 0000000..a975f2eb
--- /dev/null
+++ b/chrome/browser/extensions/api/identity/identity_launch_web_auth_flow_function.h
@@ -0,0 +1,45 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_EXTENSIONS_API_IDENTITY_IDENTITY_LAUNCH_WEB_AUTH_FLOW_FUNCTION_H_
+#define CHROME_BROWSER_EXTENSIONS_API_IDENTITY_IDENTITY_LAUNCH_WEB_AUTH_FLOW_FUNCTION_H_
+
+#include <string>
+
+#include "chrome/browser/extensions/api/identity/web_auth_flow.h"
+#include "chrome/browser/extensions/chrome_extension_function.h"
+#include "extensions/browser/extension_function_histogram_value.h"
+
+namespace extensions {
+
+class IdentityLaunchWebAuthFlowFunction : public ChromeAsyncExtensionFunction,
+                                          public WebAuthFlow::Delegate {
+ public:
+  DECLARE_EXTENSION_FUNCTION("identity.launchWebAuthFlow",
+                             EXPERIMENTAL_IDENTITY_LAUNCHWEBAUTHFLOW);
+
+  IdentityLaunchWebAuthFlowFunction();
+
+  // Tests may override extension_id.
+  void InitFinalRedirectURLPrefixForTest(const std::string& extension_id);
+
+ private:
+  ~IdentityLaunchWebAuthFlowFunction() override;
+  bool RunAsync() override;
+
+  // WebAuthFlow::Delegate implementation.
+  void OnAuthFlowFailure(WebAuthFlow::Failure failure) override;
+  void OnAuthFlowURLChange(const GURL& redirect_url) override;
+  void OnAuthFlowTitleChange(const std::string& title) override {}
+
+  // Helper to initialize final URL prefix.
+  void InitFinalRedirectURLPrefix(const std::string& extension_id);
+
+  std::unique_ptr<WebAuthFlow> auth_flow_;
+  GURL final_url_prefix_;
+};
+
+}  // namespace extensions
+
+#endif  // CHROME_BROWSER_EXTENSIONS_API_IDENTITY_IDENTITY_LAUNCH_WEB_AUTH_FLOW_FUNCTION_H_
diff --git a/chrome/browser/net/chrome_network_delegate.cc b/chrome/browser/net/chrome_network_delegate.cc
index 7022b37..644fbd5 100644
--- a/chrome/browser/net/chrome_network_delegate.cc
+++ b/chrome/browser/net/chrome_network_delegate.cc
@@ -451,17 +451,27 @@
 
 bool ChromeNetworkDelegate::OnCanAccessFile(const net::URLRequest& request,
                                             const base::FilePath& path) const {
-#if !defined(OS_CHROMEOS) && !defined(OS_ANDROID)
-  return true;
-#else
 #if defined(OS_CHROMEOS)
   // If we're running Chrome for ChromeOS on Linux, we want to allow file
-  // access.
+  // access. This is checked here to make IsAccessAllowed() unit-testable.
   if (!base::SysInfo::IsRunningOnChromeOS() ||
       base::CommandLine::ForCurrentProcess()->HasSwitch(switches::kTestType)) {
     return true;
   }
+#endif
 
+  return IsAccessAllowed(path, profile_path_);
+}
+
+// static
+bool ChromeNetworkDelegate::IsAccessAllowed(
+    const base::FilePath& path,
+    const base::FilePath& profile_path) {
+#if !defined(OS_CHROMEOS) && !defined(OS_ANDROID)
+  return true;
+#else
+
+#if defined(OS_CHROMEOS)
   // Use a whitelist to only allow access to files residing in the list of
   // directories below.
   static const char* const kLocalAccessWhiteList[] = {
@@ -480,11 +490,11 @@
   // logged in profile.) For the support of multi-profile sessions, we are
   // switching to use explicit "$PROFILE_PATH/Xyz" path and here whitelist such
   // access.
-  if (!profile_path_.empty()) {
-    const base::FilePath downloads = profile_path_.AppendASCII("Downloads");
+  if (!profile_path.empty()) {
+    const base::FilePath downloads = profile_path.AppendASCII("Downloads");
     if (downloads == path.StripTrailingSeparators() || downloads.IsParent(path))
       return true;
-    const base::FilePath webrtc_logs = profile_path_.AppendASCII("WebRTC Logs");
+    const base::FilePath webrtc_logs = profile_path.AppendASCII("WebRTC Logs");
     if (webrtc_logs == path.StripTrailingSeparators() ||
         webrtc_logs.IsParent(path)) {
       return true;
diff --git a/chrome/browser/net/chrome_network_delegate.h b/chrome/browser/net/chrome_network_delegate.h
index 759a0e5..e3636c07 100644
--- a/chrome/browser/net/chrome_network_delegate.h
+++ b/chrome/browser/net/chrome_network_delegate.h
@@ -77,9 +77,9 @@
   // Also pass through to ChromeExtensionsNetworkDelegate::set_profile().
   void set_profile(void* profile);
 
-  // |profile_path| is used to locate the "Downloads" folder on Chrome OS. If it
-  // is set, the location of the Downloads folder for the profile is added to
-  // the whitelist for accesses via file: scheme.
+  // |profile_path| is used to locate profile specific paths such as the
+  // "Downloads" folder on Chrome OS. If it is set, folders like Downloads
+  // for the profile are added to the whitelist for accesses via file: scheme.
   void set_profile_path(const base::FilePath& profile_path) {
     profile_path_ = profile_path;
   }
@@ -129,6 +129,11 @@
       StringPrefMember* allowed_domains_for_apps,
       PrefService* pref_service);
 
+  // Returns true if access to |path| is allowed. |profile_path| is used to
+  // locate certain paths on Chrome OS. See set_profile_path() for details.
+  static bool IsAccessAllowed(const base::FilePath& path,
+                              const base::FilePath& profile_path);
+
  private:
   // NetworkDelegate implementation.
   int OnBeforeURLRequest(net::URLRequest* request,
diff --git a/chrome/browser/net/chrome_network_delegate_unittest.cc b/chrome/browser/net/chrome_network_delegate_unittest.cc
index 59cbf69..edecbe6a 100644
--- a/chrome/browser/net/chrome_network_delegate_unittest.cc
+++ b/chrome/browser/net/chrome_network_delegate_unittest.cc
@@ -123,6 +123,14 @@
   int64_t off_the_record_rx_bytes_;
 };
 
+// Helper function to make the IsAccessAllowed test concise.
+bool IsAccessAllowed(const std::string& path,
+                     const std::string& profile_path) {
+  return ChromeNetworkDelegate::IsAccessAllowed(
+      base::FilePath::FromUTF8Unsafe(path),
+      base::FilePath::FromUTF8Unsafe(profile_path));
+}
+
 }  // namespace
 
 class ChromeNetworkDelegateTest : public testing::Test {
@@ -528,3 +536,57 @@
   EXPECT_FALSE(network_delegate_->CanEnablePrivacyMode(kAllowedSite,
                                                        kBlockedFirstPartySite));
 }
+
+TEST(ChromeNetworkDelegateStaticTest, IsAccessAllowed) {
+#if !defined(OS_CHROMEOS) && !defined(OS_ANDROID)
+  // Platforms other than Chrome OS and Android have access to any files.
+  EXPECT_TRUE(IsAccessAllowed("/", ""));
+  EXPECT_TRUE(IsAccessAllowed("/foo.txt", ""));
+#endif
+
+#if defined(OS_CHROMEOS) || defined(OS_ANDROID)
+  // Chrome OS and Android don't have access to random files.
+  EXPECT_FALSE(IsAccessAllowed("/", ""));
+  EXPECT_FALSE(IsAccessAllowed("/foo.txt", ""));
+#endif
+
+#if defined(OS_CHROMEOS)
+  // Chrome OS allows the following directories.
+  EXPECT_TRUE(IsAccessAllowed("/home/chronos/user/Downloads", ""));
+  EXPECT_TRUE(IsAccessAllowed("/home/chronos/user/log", ""));
+  EXPECT_TRUE(IsAccessAllowed("/home/chronos/user/WebRTC Logs", ""));
+  EXPECT_TRUE(IsAccessAllowed("/media", ""));
+  EXPECT_TRUE(IsAccessAllowed("/opt/oem", ""));
+  EXPECT_TRUE(IsAccessAllowed("/usr/share/chromeos-assets", ""));
+  EXPECT_TRUE(IsAccessAllowed("/tmp", ""));
+  EXPECT_TRUE(IsAccessAllowed("/var/log", ""));
+  // Files under the directories are allowed.
+  EXPECT_TRUE(IsAccessAllowed("/tmp/foo.txt", ""));
+  // Make sure similar paths are not allowed.
+  EXPECT_FALSE(IsAccessAllowed("/home/chronos/user/log.txt", ""));
+  EXPECT_FALSE(IsAccessAllowed("/home/chronos/user", ""));
+  EXPECT_FALSE(IsAccessAllowed("/home/chronos", ""));
+
+  // If profile path is given, the following additional paths are allowed.
+  EXPECT_TRUE(IsAccessAllowed("/profile/Downloads", "/profile"));
+  EXPECT_TRUE(IsAccessAllowed("/profile/WebRTC Logs", "/profile"));
+
+#elif defined(OS_ANDROID)
+  // Android allows the following directories.
+  EXPECT_TRUE(IsAccessAllowed("/sdcard", ""));
+  EXPECT_TRUE(IsAccessAllowed("/mnt/sdcard", ""));
+  // Files under the directories are allowed.
+  EXPECT_TRUE(IsAccessAllowed("/sdcard/foo.txt", ""));
+  // Make sure similar paths are not allowed.
+  EXPECT_FALSE(IsAccessAllowed("/mnt/sdcard.txt", ""));
+  EXPECT_FALSE(IsAccessAllowed("/mnt", ""));
+
+  // Files in external storage are allowed.
+  base::FilePath external_storage_path;
+  PathService::Get(base::DIR_ANDROID_EXTERNAL_STORAGE, &external_storage_path);
+  EXPECT_TRUE(IsAccessAllowed(
+      external_storage_path.AppendASCII("foo.txt").AsUTF8Unsafe(), ""));
+  // The external storage root itself is not allowed.
+  EXPECT_FALSE(IsAccessAllowed(external_storage_path.AsUTF8Unsafe(), ""));
+#endif
+}
diff --git a/chromeos/CHROMEOS_LKGM b/chromeos/CHROMEOS_LKGM
index 03bfd289..19f980b 100644
--- a/chromeos/CHROMEOS_LKGM
+++ b/chromeos/CHROMEOS_LKGM
@@ -1 +1 @@
-9221.0.0
\ No newline at end of file
+9224.0.0
\ No newline at end of file
diff --git a/content/browser/service_worker/service_worker_metrics.cc b/content/browser/service_worker/service_worker_metrics.cc
index 363d219..aa0aa08 100644
--- a/content/browser/service_worker/service_worker_metrics.cc
+++ b/content/browser/service_worker/service_worker_metrics.cc
@@ -211,6 +211,14 @@
       "ServiceWorker.ControlledPageUrl", url);
 }
 
+// Returns true when the event is for a navigation hint.
+bool IsNavigationHintEvent(ServiceWorkerMetrics::EventType event_type) {
+  using EventType = ServiceWorkerMetrics::EventType;
+  return event_type == EventType::NAVIGATION_HINT_LINK_MOUSE_DOWN ||
+         event_type == EventType::NAVIGATION_HINT_LINK_TAP_UNCONFIRMED ||
+         event_type == EventType::NAVIGATION_HINT_LINK_TAP_DOWN;
+}
+
 enum EventHandledRatioType {
   EVENT_HANDLED_NONE,
   EVENT_HANDLED_SOME,
@@ -220,6 +228,93 @@
 
 }  // namespace
 
+using ScopedEventRecorder = ServiceWorkerMetrics::ScopedEventRecorder;
+
+ScopedEventRecorder::ScopedEventRecorder(
+    ServiceWorkerMetrics::EventType start_worker_purpose)
+    : start_worker_purpose_(start_worker_purpose) {}
+
+ScopedEventRecorder::~ScopedEventRecorder() {
+  for (const auto& ev : event_stats_) {
+    RecordEventHandledRatio(ev.first, ev.second.handled_events,
+                            ev.second.fired_events);
+  }
+  if (IsNavigationHintEvent(start_worker_purpose_)) {
+    RecordNavigationHintPrecision(
+        start_worker_purpose_,
+        event_stats_[EventType::FETCH_MAIN_FRAME].fired_events != 0 ||
+            event_stats_[EventType::FETCH_SUB_FRAME].fired_events != 0);
+  }
+}
+
+void ScopedEventRecorder::RecordEventHandledStatus(
+    ServiceWorkerMetrics::EventType event,
+    bool handled) {
+  event_stats_[event].fired_events++;
+  if (handled)
+    event_stats_[event].handled_events++;
+}
+
+void ScopedEventRecorder::RecordEventHandledRatio(
+    ServiceWorkerMetrics::EventType event,
+    size_t handled_events,
+    size_t fired_events) {
+  if (!fired_events)
+    return;
+  EventHandledRatioType type = EVENT_HANDLED_SOME;
+  if (fired_events == handled_events)
+    type = EVENT_HANDLED_ALL;
+  else if (handled_events == 0)
+    type = EVENT_HANDLED_NONE;
+
+  // For now Fetch and Foreign Fetch are the only types that are recorded.
+  switch (event) {
+    case EventType::FETCH_MAIN_FRAME:
+    case EventType::FETCH_SUB_FRAME:
+    case EventType::FETCH_SHARED_WORKER:
+    case EventType::FETCH_SUB_RESOURCE:
+      UMA_HISTOGRAM_ENUMERATION("ServiceWorker.EventHandledRatioType.Fetch",
+                                type, NUM_EVENT_HANDLED_RATIO_TYPE);
+      break;
+    case EventType::FOREIGN_FETCH:
+      UMA_HISTOGRAM_ENUMERATION(
+          "ServiceWorker.EventHandledRatioType.ForeignFetch", type,
+          NUM_EVENT_HANDLED_RATIO_TYPE);
+      break;
+    default:
+      // Do nothing.
+      break;
+  }
+}
+
+void ScopedEventRecorder::RecordNavigationHintPrecision(
+    ServiceWorkerMetrics::EventType start_worker_purpose,
+    bool frame_fetch_event_fired) {
+  DCHECK(IsNavigationHintEvent(start_worker_purpose));
+  UMA_HISTOGRAM_BOOLEAN("ServiceWorker.NavigationHintPrecision",
+                        frame_fetch_event_fired);
+  switch (start_worker_purpose) {
+    case EventType::NAVIGATION_HINT_LINK_MOUSE_DOWN:
+      UMA_HISTOGRAM_BOOLEAN(
+          "ServiceWorker.NavigationHintPrecision.LINK_MOUSE_DOWN",
+          frame_fetch_event_fired);
+      break;
+    case EventType::NAVIGATION_HINT_LINK_TAP_UNCONFIRMED:
+      UMA_HISTOGRAM_BOOLEAN(
+          "ServiceWorker.NavigationHintPrecision.LINK_TAP_UNCONFIRMED",
+          frame_fetch_event_fired);
+      break;
+    case EventType::NAVIGATION_HINT_LINK_TAP_DOWN:
+      UMA_HISTOGRAM_BOOLEAN(
+          "ServiceWorker.NavigationHintPrecision.LINK_TAP_DOWN",
+          frame_fetch_event_fired);
+      break;
+    default:
+      NOTREACHED();
+      break;
+  }
+}
+
 const char* ServiceWorkerMetrics::EventTypeToString(EventType event_type) {
   switch (event_type) {
     case EventType::ACTIVATE:
@@ -291,12 +386,6 @@
   return ServiceWorkerMetrics::Site::OTHER;
 }
 
-bool ServiceWorkerMetrics::IsNavigationHintEvent(EventType event_type) {
-  return event_type == EventType::NAVIGATION_HINT_LINK_MOUSE_DOWN ||
-         event_type == EventType::NAVIGATION_HINT_LINK_TAP_UNCONFIRMED ||
-         event_type == EventType::NAVIGATION_HINT_LINK_TAP_DOWN;
-}
-
 bool ServiceWorkerMetrics::ShouldExcludeSiteFromHistogram(Site site) {
   return site == ServiceWorkerMetrics::Site::NEW_TAB_PAGE;
 }
@@ -517,37 +606,6 @@
   }
 }
 
-void ServiceWorkerMetrics::RecordEventHandledRatio(EventType event,
-                                                   size_t handled_events,
-                                                   size_t fired_events) {
-  if (!fired_events)
-    return;
-  EventHandledRatioType type = EVENT_HANDLED_SOME;
-  if (fired_events == handled_events)
-    type = EVENT_HANDLED_ALL;
-  else if (handled_events == 0)
-    type = EVENT_HANDLED_NONE;
-
-  // For now Fetch and Foreign Fetch are the only types that are recorded.
-  switch (event) {
-    case EventType::FETCH_MAIN_FRAME:
-    case EventType::FETCH_SUB_FRAME:
-    case EventType::FETCH_SHARED_WORKER:
-    case EventType::FETCH_SUB_RESOURCE:
-      UMA_HISTOGRAM_ENUMERATION("ServiceWorker.EventHandledRatioType.Fetch",
-                                type, NUM_EVENT_HANDLED_RATIO_TYPE);
-      break;
-    case EventType::FOREIGN_FETCH:
-      UMA_HISTOGRAM_ENUMERATION(
-          "ServiceWorker.EventHandledRatioType.ForeignFetch", type,
-          NUM_EVENT_HANDLED_RATIO_TYPE);
-      break;
-    default:
-      // Do nothing.
-      break;
-  }
-}
-
 void ServiceWorkerMetrics::RecordEventDispatchingDelay(EventType event_type,
                                                        base::TimeDelta time,
                                                        Site site_for_metrics) {
@@ -558,34 +616,6 @@
   RecordSuffixedTimeHistogram(name, event_type_suffix + site_suffix, time);
 }
 
-void ServiceWorkerMetrics::RecordNavigationHintPrecision(
-    EventType start_worker_purpose,
-    bool frame_fetch_event_fired) {
-  DCHECK(IsNavigationHintEvent(start_worker_purpose));
-  UMA_HISTOGRAM_BOOLEAN("ServiceWorker.NavigationHintPrecision",
-                        frame_fetch_event_fired);
-  switch (start_worker_purpose) {
-    case EventType::NAVIGATION_HINT_LINK_MOUSE_DOWN:
-      UMA_HISTOGRAM_BOOLEAN(
-          "ServiceWorker.NavigationHintPrecision.LINK_MOUSE_DOWN",
-          frame_fetch_event_fired);
-      break;
-    case EventType::NAVIGATION_HINT_LINK_TAP_UNCONFIRMED:
-      UMA_HISTOGRAM_BOOLEAN(
-          "ServiceWorker.NavigationHintPrecision.LINK_TAP_UNCONFIRMED",
-          frame_fetch_event_fired);
-      break;
-    case EventType::NAVIGATION_HINT_LINK_TAP_DOWN:
-      UMA_HISTOGRAM_BOOLEAN(
-          "ServiceWorker.NavigationHintPrecision.LINK_TAP_DOWN",
-          frame_fetch_event_fired);
-      break;
-    default:
-      NOTREACHED();
-      break;
-  }
-}
-
 void ServiceWorkerMetrics::RecordEventTimeout(EventType event) {
   UMA_HISTOGRAM_ENUMERATION("ServiceWorker.RequestTimeouts.Count",
                             static_cast<int>(event),
diff --git a/content/browser/service_worker/service_worker_metrics.h b/content/browser/service_worker/service_worker_metrics.h
index 934e4ee..7603183 100644
--- a/content/browser/service_worker/service_worker_metrics.h
+++ b/content/browser/service_worker/service_worker_metrics.h
@@ -6,6 +6,8 @@
 #define CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_METRICS_H_
 
 #include <stddef.h>
+#include <map>
+#include <set>
 
 #include "base/macros.h"
 #include "base/time/time.h"
@@ -169,15 +171,43 @@
   // Not used for UMA.
   enum class LoadSource { NETWORK, HTTP_CACHE, SERVICE_WORKER_STORAGE };
 
+  class ScopedEventRecorder {
+   public:
+    explicit ScopedEventRecorder(EventType start_worker_purpose);
+    ~ScopedEventRecorder();
+
+    void RecordEventHandledStatus(EventType event, bool handled);
+
+   private:
+    struct EventStat {
+      size_t fired_events = 0;
+      size_t handled_events = 0;
+    };
+
+    // Records how much of dispatched events are handled.
+    static void RecordEventHandledRatio(EventType event,
+                                        size_t handled_events,
+                                        size_t fired_events);
+
+    // Records the precision of the speculative launch of Service Workers for
+    // each navigation hint type. If there was no main/sub frame fetch event
+    // fired on the worker, |frame_fetch_event_fired| is false. This means that
+    // the speculative launch wasn't helpful.
+    static void RecordNavigationHintPrecision(EventType start_worker_purpose,
+                                              bool frame_fetch_event_fired);
+
+    std::map<EventType, EventStat> event_stats_;
+    const EventType start_worker_purpose_;
+
+    DISALLOW_COPY_AND_ASSIGN(ScopedEventRecorder);
+  };
+
   // Converts an event type to a string. Used for tracing.
   static const char* EventTypeToString(EventType event_type);
 
   // If the |url| is not a special site, returns Site::OTHER.
   static Site SiteFromURL(const GURL& url);
 
-  // Returns true when the event is for a navigation hint.
-  static bool IsNavigationHintEvent(EventType event_type);
-
   // Excludes NTP scope from UMA for now as it tends to dominate the stats and
   // makes the results largely skewed. Some metrics don't follow this policy
   // and hence don't call this function.
@@ -239,19 +269,6 @@
   static void RecordForeignFetchRegistrationCount(size_t scope_count,
                                                   size_t origin_count);
 
-  // Records how much of dispatched events are handled while a Service
-  // Worker is awake (i.e. after it is woken up until it gets stopped).
-  static void RecordEventHandledRatio(EventType event,
-                                      size_t handled_events,
-                                      size_t fired_events);
-
-  // Records the precision of the speculative launch of Service Workers for
-  // each navigation hint type when the worker is stopped. If there was no
-  // main/sub frame fetch event fired on the worker, |frame_fetch_event_fired|
-  // is false. This means that the speculative launch wasn't helpful.
-  static void RecordNavigationHintPrecision(EventType start_worker_purpose,
-                                            bool frame_fetch_event_fired);
-
   // Records how often a dispatched event times out.
   static void RecordEventTimeout(EventType event);
 
diff --git a/content/browser/service_worker/service_worker_url_request_job.cc b/content/browser/service_worker/service_worker_url_request_job.cc
index afa3704..952400f 100644
--- a/content/browser/service_worker/service_worker_url_request_job.cc
+++ b/content/browser/service_worker/service_worker_url_request_job.cc
@@ -553,8 +553,10 @@
       initial_worker_status_ != EmbeddedWorkerStatus::RUNNING) {
     return;
   }
-  if (version->should_exclude_from_uma())
+  if (ServiceWorkerMetrics::ShouldExcludeSiteFromHistogram(
+          version->site_for_uma())) {
     return;
+  }
   worker_start_situation_ = version->embedded_worker()->start_situation();
   ServiceWorkerMetrics::RecordActivatedWorkerPreparationForMainFrame(
       worker_ready_time_ - request()->creation_time(), initial_worker_status_,
diff --git a/content/browser/service_worker/service_worker_version.cc b/content/browser/service_worker/service_worker_version.cc
index e6921650..470addbd 100644
--- a/content/browser/service_worker/service_worker_version.cc
+++ b/content/browser/service_worker/service_worker_version.cc
@@ -211,45 +211,6 @@
   return tick_clock_->NowTicks() - time;
 }
 
-class ServiceWorkerVersion::Metrics {
- public:
-  using EventType = ServiceWorkerMetrics::EventType;
-  explicit Metrics(ServiceWorkerVersion* owner, EventType start_worker_purpose)
-      : owner_(owner), start_worker_purpose_(start_worker_purpose) {}
-  ~Metrics() {
-    if (owner_->should_exclude_from_uma_)
-      return;
-    for (const auto& ev : event_stats_) {
-      ServiceWorkerMetrics::RecordEventHandledRatio(
-          ev.first, ev.second.handled_events, ev.second.fired_events);
-    }
-    if (ServiceWorkerMetrics::IsNavigationHintEvent(start_worker_purpose_)) {
-      ServiceWorkerMetrics::RecordNavigationHintPrecision(
-          start_worker_purpose_,
-          event_stats_[EventType::FETCH_MAIN_FRAME].fired_events != 0 ||
-              event_stats_[EventType::FETCH_SUB_FRAME].fired_events != 0);
-    }
-  }
-
-  void RecordEventHandledStatus(EventType event, bool handled) {
-    event_stats_[event].fired_events++;
-    if (handled)
-      event_stats_[event].handled_events++;
-  }
-
- private:
-  struct EventStat {
-    size_t fired_events = 0;
-    size_t handled_events = 0;
-  };
-
-  ServiceWorkerVersion* owner_;
-  std::map<EventType, EventStat> event_stats_;
-  const EventType start_worker_purpose_;
-
-  DISALLOW_COPY_AND_ASSIGN(Metrics);
-};
-
 // A controller for periodically sending a ping to the worker to see
 // if the worker is not stalling.
 class ServiceWorkerVersion::PingController {
@@ -322,8 +283,6 @@
       script_cache_map_(this, context),
       tick_clock_(base::WrapUnique(new base::DefaultTickClock)),
       ping_controller_(new PingController(this)),
-      should_exclude_from_uma_(
-          ServiceWorkerMetrics::ShouldExcludeSiteFromHistogram(site_for_uma_)),
       weak_factory_(this) {
   DCHECK_NE(kInvalidServiceWorkerVersionId, version_id);
   DCHECK(context_);
@@ -617,8 +576,8 @@
   PendingRequest* request = pending_requests_.Lookup(request_id);
   if (!request)
     return false;
-  // TODO(kinuko): Record other event statuses too.
-  metrics_->RecordEventHandledStatus(request->event_type, was_handled);
+  if (event_recorder_)
+    event_recorder_->RecordEventHandledStatus(request->event_type, was_handled);
   ServiceWorkerMetrics::RecordEventDuration(
       request->event_type, tick_clock_->NowTicks() - request->start_time_ticks,
       was_handled);
@@ -1523,10 +1482,14 @@
 
 void ServiceWorkerVersion::StartWorkerInternal() {
   DCHECK_EQ(EmbeddedWorkerStatus::STOPPED, running_status());
-
-  DCHECK(!metrics_);
   DCHECK(start_worker_first_purpose_);
-  metrics_.reset(new Metrics(this, start_worker_first_purpose_.value()));
+
+  if (!ServiceWorkerMetrics::ShouldExcludeSiteFromHistogram(site_for_uma_)) {
+    DCHECK(!event_recorder_);
+    event_recorder_ =
+        base::MakeUnique<ServiceWorkerMetrics::ScopedEventRecorder>(
+            start_worker_first_purpose_.value());
+  }
 
   // We don't clear |start_worker_first_purpose_| here but clear in
   // FinishStartWorker. This is because StartWorkerInternal may be called
@@ -1856,8 +1819,7 @@
   if (!in_dtor_)
     protect = this;
 
-  DCHECK(metrics_);
-  metrics_.reset();
+  event_recorder_.reset();
 
   bool should_restart = !is_redundant() && !start_callbacks_.empty() &&
                         (old_status != EmbeddedWorkerStatus::STARTING) &&
@@ -1908,11 +1870,12 @@
 }
 
 void ServiceWorkerVersion::OnBeginEvent() {
-  if (should_exclude_from_uma_ ||
-      running_status() != EmbeddedWorkerStatus::RUNNING ||
+  if (running_status() != EmbeddedWorkerStatus::RUNNING ||
       idle_time_.is_null()) {
     return;
   }
+  if (ServiceWorkerMetrics::ShouldExcludeSiteFromHistogram(site_for_uma_))
+    return;
   ServiceWorkerMetrics::RecordTimeBetweenEvents(tick_clock_->NowTicks() -
                                                 idle_time_);
 }
diff --git a/content/browser/service_worker/service_worker_version.h b/content/browser/service_worker/service_worker_version.h
index 1823106..f8f95ef 100644
--- a/content/browser/service_worker/service_worker_version.h
+++ b/content/browser/service_worker/service_worker_version.h
@@ -163,8 +163,6 @@
   // This also updates |site_for_uma_| when it was Site::OTHER.
   void set_fetch_handler_existence(FetchHandlerExistence existence);
 
-  bool should_exclude_from_uma() const { return should_exclude_from_uma_; }
-
   const std::vector<GURL>& foreign_fetch_scopes() const {
     return foreign_fetch_scopes_;
   }
@@ -834,8 +832,11 @@
   std::unique_ptr<base::TickClock> tick_clock_;
 
   std::unique_ptr<PingController> ping_controller_;
-  std::unique_ptr<Metrics> metrics_;
-  const bool should_exclude_from_uma_ = false;
+
+  // Used for recording worker activities (e.g., a ratio of handled events)
+  // while this service worker is running (i.e., after it starts up until it
+  // stops).
+  std::unique_ptr<ServiceWorkerMetrics::ScopedEventRecorder> event_recorder_;
 
   bool stop_when_devtools_detached_ = false;
 
diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index 878c791..b627fb9c 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations
@@ -768,53 +768,6 @@
 
 crbug.com/659123 [ Mac ] fast/css/text-overflow-ellipsis-button.html [ Pass Failure ]
 
-crbug.com/685851 [ Win7 ] fast/table/backgr_border-table-cell-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_border-table-cell.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_border-table-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_border-table-column-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_border-table-column-group-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_border-table-column-group.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_border-table-column.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_border-table-quirks-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_border-table-quirks.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_border-table-row-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_border-table-row-group-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_border-table-row-group.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_border-table-row.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_border-table.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_layers-hide-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_layers-hide.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_layers-opacity-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_layers-opacity.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_layers-show-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_layers-show.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_position-table-cell-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_position-table-cell.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_position-table-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_position-table-column-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_position-table-column-group-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_position-table-column-group.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_position-table-column.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_position-table-row-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_position-table-row-group-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_position-table-row-group.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_position-table-row.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_position-table.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_simple-table-cell-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_simple-table-cell.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_simple-table-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_simple-table-column-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_simple-table-column-group-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_simple-table-column-group.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_simple-table-column.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_simple-table-row-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_simple-table-row-group-collapsed-border.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_simple-table-row-group.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_simple-table-row.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/backgr_simple-table.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] fast/table/tbody-background-image.html [ NeedsRebaseline ]
-crbug.com/685851 [ Win7 ] tables/mozilla_expected_failures/marvin/backgr_fixed-bg.html [ NeedsRebaseline ]
-
 # TODO(oshima): Mac Android are currently not supported.
 crbug.com/567837 [ Mac Android ] virtual/scalefactor200withzoom/fast/hidpi/static [ Skip ]
 
@@ -2347,3 +2300,5 @@
 crbug.com/659139 [ Mac ] shapedetection/detection-ImageBitmap.html [ Skip ]
 crbug.com/659139 [ Mac ] shapedetection/detection-ImageData.html [ Skip ]
 crbug.com/659139 [ Mac ] shapedetection/detection-options.html [ Skip ]
+
+crbug.com/685951 css2.1/t040304-c64-uri-00-a-g.html [ Failure Pass ]
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/table/backgr_position-table-cell-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/table/backgr_position-table-cell-expected.png
index 27e8f86..7a7810d 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/table/backgr_position-table-cell-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/table/backgr_position-table-cell-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/table/backgr_simple-table-row-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/table/backgr_simple-table-row-expected.png
index 4aa50b2c..c59ff9b 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/table/backgr_simple-table-row-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/table/backgr_simple-table-row-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/table/backgr_simple-table-row-group-collapsed-border-expected.png b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/table/backgr_simple-table-row-group-collapsed-border-expected.png
index 9f77de4..9aa9152 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/table/backgr_simple-table-row-group-collapsed-border-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac-mac10.9/fast/table/backgr_simple-table-row-group-collapsed-border-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac-retina/virtual/mojo-loading/http/tests/security/xss-DENIED-window-name-navigator-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-retina/virtual/mojo-loading/http/tests/security/xss-DENIED-window-name-navigator-expected.txt
index 315a063..de743387 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-retina/virtual/mojo-loading/http/tests/security/xss-DENIED-window-name-navigator-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-retina/virtual/mojo-loading/http/tests/security/xss-DENIED-window-name-navigator-expected.txt
@@ -1,4 +1,4 @@
 CONSOLE MESSAGE: line 7: SecurityError: Blocked a frame with origin "null" from accessing a cross-origin frame.
-CONSOLE MESSAGE: line 15: SecurityError: Blocked a frame with origin "null" from accessing a cross-origin frame.
 CONSOLE MESSAGE: line 7: SecurityError: Blocked a frame with origin "null" from accessing a cross-origin frame.
+CONSOLE MESSAGE: line 15: SecurityError: Blocked a frame with origin "null" from accessing a cross-origin frame.
  
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/table/backgr_layers-show-collapsed-border-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/table/backgr_layers-show-collapsed-border-expected.txt
new file mode 100644
index 0000000..95ded6e
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/table/backgr_layers-show-collapsed-border-expected.txt
@@ -0,0 +1,159 @@
+layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 768
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 785x768 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
+  LayoutBlockFlow {HTML} at (0,0) size 785x768.44
+    LayoutBlockFlow {BODY} at (8,18.72) size 769x741.72
+      LayoutBlockFlow {H3} at (0,0) size 769x22
+        LayoutText {#text} at (0,0) size 290x22
+          text run at (0,0) width 290: "crbug.com/35679: empty-cells: show"
+      LayoutTable {TABLE} at (0,40.72) size 171x126 [bgcolor=#0000FF]
+        LayoutBlockFlow {CAPTION} at (0,0) size 171x36
+          LayoutText {#text} at (14,0) size 143x36
+            text run at (14,0) width 143: "With 'border-collapse:"
+            text run at (57,18) width 57: "collapse'"
+        LayoutTableCol {COLGROUP} at (0,0) size 0x0
+          LayoutTableCol {COL} at (0,0) size 0x0
+          LayoutTableCol {COL} at (0,0) size 0x0
+          LayoutTableCol {COL} at (0,0) size 0x0
+        LayoutTableCol {COLGROUP} at (0,0) size 0x0
+          LayoutTableCol {COL} at (0,0) size 0x0
+        LayoutTableSection {THEAD} at (0,36) size 171x24
+          LayoutTableRow {TR} at (0,2) size 171x20
+            LayoutTableCell {TH} at (2,2) size 41x20 [r=0 c=0 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 39x18
+                text run at (1,1) width 39: "TH A"
+            LayoutTableCell {TH} at (45,2) size 40x20 [r=0 c=1 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 38x18
+                text run at (1,1) width 38: "TH B"
+            LayoutTableCell {TH} at (87,11) size 39x2 [r=0 c=2 rs=1 cs=1]
+            LayoutTableCell {TH} at (128,2) size 41x20 [r=0 c=3 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 39x18
+                text run at (1,1) width 39: "TH D"
+        LayoutTableSection {TFOOT} at (0,104) size 171x22
+          LayoutTableRow {TR} at (0,0) size 171x20
+            LayoutTableCell {TD} at (2,0) size 83x20 [r=0 c=0 rs=1 cs=2]
+              LayoutText {#text} at (1,1) size 40x18
+                text run at (1,1) width 40: "TD M"
+            LayoutTableCell {TD} at (87,0) size 39x20 [r=0 c=2 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 37x18
+                text run at (1,1) width 37: "TD O"
+            LayoutTableCell {TD} at (128,0) size 41x20 [r=0 c=3 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 35x18
+                text run at (1,1) width 35: "TD P"
+        LayoutTableSection {TBODY} at (0,60) size 171x44
+          LayoutTableRow {TR} at (0,0) size 171x20
+            LayoutTableCell {TD} at (2,11) size 41x20 [r=0 c=0 rs=2 cs=1]
+              LayoutText {#text} at (1,1) size 36x18
+                text run at (1,1) width 36: "TD E"
+            LayoutTableCell {TD} at (45,0) size 40x20 [r=0 c=1 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 35x18
+                text run at (1,1) width 35: "TD F"
+            LayoutTableCell {TD} at (87,0) size 39x20 [r=0 c=2 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 37x18
+                text run at (1,1) width 37: "TD G"
+            LayoutTableCell {TD} at (128,0) size 41x20 [r=0 c=3 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 37x18
+                text run at (1,1) width 37: "TD H"
+          LayoutTableRow {TR} at (0,22) size 171x20
+            LayoutTableCell {TD} at (45,22) size 40x20 [r=1 c=1 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 32x18
+                text run at (1,1) width 32: "TD J"
+            LayoutTableCell {TD} at (87,22) size 39x20 [r=1 c=2 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 37x18
+                text run at (1,1) width 37: "TD K"
+            LayoutTableCell {TD} at (128,22) size 41x20 [r=1 c=3 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 36x18
+                text run at (1,1) width 36: "TD L"
+      LayoutBlockFlow {P} at (0,182.72) size 769x18
+        LayoutText {#text} at (0,0) size 371x18
+          text run at (0,0) width 371: "In table cell C (third cell in the first row), which is empty:"
+      LayoutBlockFlow {UL} at (0,216.72) size 769x108
+        LayoutListItem {LI} at (40,0) size 729x18
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 682x18
+            text run at (0,0) width 682: "Four sets of horizontal double violet stripes surrounded by aqua should run just inside the top border edge."
+        LayoutListItem {LI} at (40,18) size 729x18
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 684x18
+            text run at (0,0) width 684: "One set of aqua-backed double violet stripes should run just inside the left, right, and bottom border edges."
+        LayoutListItem {LI} at (40,36) size 729x36
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 713x36
+            text run at (0,0) width 713: "The third set along the top should turn down at the right edge and go under the fourth set to form the right-edge"
+            text run at (0,18) width 22: "set."
+        LayoutListItem {LI} at (40,72) size 729x18
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 431x18
+            text run at (0,0) width 431: "The fourth set should turn down at the left edge to form the left set."
+        LayoutListItem {LI} at (40,90) size 729x18
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 331x18
+            text run at (0,0) width 331: "The bottom stripe should be straight and cut across "
+          LayoutInline {EM} at (0,0) size 29x18
+            LayoutText {#text} at (330,0) size 29x18
+              text run at (330,0) width 29: "over"
+          LayoutText {#text} at (358,0) size 86x18
+            text run at (358,0) width 86: " the side sets."
+      LayoutBlockFlow {P} at (0,340.72) size 769x18
+        LayoutText {#text} at (0,0) size 264x18
+          text run at (0,0) width 264: "In table cell A, (first cell in the first row):"
+      LayoutBlockFlow {UL} at (0,374.72) size 769x72
+        LayoutListItem {LI} at (40,0) size 729x18
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 644x18
+            text run at (0,0) width 644: "Three sets of horizontal aqua-backed double violet stripes should run just inside the top border edge."
+        LayoutListItem {LI} at (40,18) size 729x18
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 196x18
+            text run at (0,0) width 196: "The first set should run across."
+        LayoutListItem {LI} at (40,36) size 729x36
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 721x36
+            text run at (0,0) width 721: "The second set should turn down at the left edge, going over the third set to form another set that runs just inside"
+            text run at (0,18) width 129: "the left border edge."
+      LayoutBlockFlow {P} at (0,462.72) size 769x18
+        LayoutText {#text} at (0,0) size 262x18
+          text run at (0,0) width 262: "In table cell D, (last cell in the first row):"
+      LayoutBlockFlow {UL} at (0,496.72) size 769x54
+        LayoutListItem {LI} at (40,0) size 729x18
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 628x18
+            text run at (0,0) width 628: "Two sets of horizontal aqua-backed double violet strips should run just inside the top border edge."
+        LayoutListItem {LI} at (40,18) size 729x36
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 723x36
+            text run at (0,0) width 723: "The first set should turn down at the right edge, going under the second horizontal set to run vertically just inside"
+            text run at (0,18) width 138: "the right border edge."
+      LayoutBlockFlow {P} at (0,566.72) size 769x18
+        LayoutText {#text} at (0,0) size 289x18
+          text run at (0,0) width 289: "In table cell G, (third cell in the second row):"
+      LayoutBlockFlow {UL} at (0,600.72) size 769x72
+        LayoutListItem {LI} at (40,0) size 729x18
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 635x18
+            text run at (0,0) width 635: "Two sets of horizontal aqua-backed double violet stripes should run just inside the top border edge."
+        LayoutListItem {LI} at (40,18) size 729x18
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 695x18
+            text run at (0,0) width 695: "A set of vertical stripes should run down just inside the left border edge, going under both horizontal stripes."
+        LayoutListItem {LI} at (40,36) size 729x36
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 724x36
+            text run at (0,0) width 724: "Another set of vertical stripes should run down just inside the right border edge, also going under both horizontal"
+            text run at (0,18) width 46: "stripes."
+      LayoutBlockFlow {DIV} at (0,688.72) size 769x35
+        LayoutInline {A} at (0,0) size 88x18 [color=#0000EE]
+          LayoutBlockFlow {IMG} at (0,0) size 88x31
+        LayoutText {#text} at (0,0) size 0x0
+      LayoutBlockFlow {ADDRESS} at (0,723.72) size 769x18
+        LayoutText {#text} at (0,0) size 606x18
+          text run at (0,0) width 606: "CSS2 Table Backgrounds Test Suite designed and written by fantasai <fantasai@escape.com>"
+layer at (8,707) size 88x31 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollHeight 56
+  LayoutBlockFlow {DIV} at (0,0) size 88x31 [border: (1px solid #C0C0C0)]
+    LayoutImage (floating) {IMG} at (2,2) size 16x16
+layer at (26,709) size 68x54 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutBlockFlow {DIV} at (18,2) size 68x54
+    LayoutText {#text} at (0,0) size 46x54
+      text run at (0,0) width 34: "Valid"
+      text run at (0,18) width 46: "HTML"
+      text run at (0,36) width 34: "4.01!"
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/table/backgr_layers-show-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/table/backgr_layers-show-expected.txt
new file mode 100644
index 0000000..8cca62dd
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/table/backgr_layers-show-expected.txt
@@ -0,0 +1,159 @@
+layer at (0,0) size 800x600 clip at (0,0) size 785x600 scrollHeight 768
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 785x768 backgroundClip at (0,0) size 785x600 clip at (0,0) size 785x600
+  LayoutBlockFlow {HTML} at (0,0) size 785x768.44
+    LayoutBlockFlow {BODY} at (8,18.72) size 769x741.72
+      LayoutBlockFlow {H3} at (0,0) size 769x22
+        LayoutText {#text} at (0,0) size 290x22
+          text run at (0,0) width 290: "crbug.com/35679: empty-cells: show"
+      LayoutTable {TABLE} at (0,40.72) size 171x126 [bgcolor=#0000FF]
+        LayoutBlockFlow {CAPTION} at (0,0) size 171x36
+          LayoutText {#text} at (14,0) size 143x36
+            text run at (14,0) width 143: "With 'border-collapse:"
+            text run at (57,18) width 57: "separate'"
+        LayoutTableCol {COLGROUP} at (0,0) size 0x0
+          LayoutTableCol {COL} at (0,0) size 0x0
+          LayoutTableCol {COL} at (0,0) size 0x0
+          LayoutTableCol {COL} at (0,0) size 0x0
+        LayoutTableCol {COLGROUP} at (0,0) size 0x0
+          LayoutTableCol {COL} at (0,0) size 0x0
+        LayoutTableSection {THEAD} at (0,36) size 171x24
+          LayoutTableRow {TR} at (0,2) size 171x20
+            LayoutTableCell {TH} at (2,2) size 41x20 [r=0 c=0 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 39x18
+                text run at (1,1) width 39: "TH A"
+            LayoutTableCell {TH} at (45,2) size 40x20 [r=0 c=1 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 38x18
+                text run at (1,1) width 38: "TH B"
+            LayoutTableCell {TH} at (87,11) size 39x2 [r=0 c=2 rs=1 cs=1]
+            LayoutTableCell {TH} at (128,2) size 41x20 [r=0 c=3 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 39x18
+                text run at (1,1) width 39: "TH D"
+        LayoutTableSection {TFOOT} at (0,104) size 171x22
+          LayoutTableRow {TR} at (0,0) size 171x20
+            LayoutTableCell {TD} at (2,0) size 83x20 [r=0 c=0 rs=1 cs=2]
+              LayoutText {#text} at (1,1) size 40x18
+                text run at (1,1) width 40: "TD M"
+            LayoutTableCell {TD} at (87,0) size 39x20 [r=0 c=2 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 37x18
+                text run at (1,1) width 37: "TD O"
+            LayoutTableCell {TD} at (128,0) size 41x20 [r=0 c=3 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 35x18
+                text run at (1,1) width 35: "TD P"
+        LayoutTableSection {TBODY} at (0,60) size 171x44
+          LayoutTableRow {TR} at (0,0) size 171x20
+            LayoutTableCell {TD} at (2,11) size 41x20 [r=0 c=0 rs=2 cs=1]
+              LayoutText {#text} at (1,1) size 36x18
+                text run at (1,1) width 36: "TD E"
+            LayoutTableCell {TD} at (45,0) size 40x20 [r=0 c=1 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 35x18
+                text run at (1,1) width 35: "TD F"
+            LayoutTableCell {TD} at (87,0) size 39x20 [r=0 c=2 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 37x18
+                text run at (1,1) width 37: "TD G"
+            LayoutTableCell {TD} at (128,0) size 41x20 [r=0 c=3 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 37x18
+                text run at (1,1) width 37: "TD H"
+          LayoutTableRow {TR} at (0,22) size 171x20
+            LayoutTableCell {TD} at (45,22) size 40x20 [r=1 c=1 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 32x18
+                text run at (1,1) width 32: "TD J"
+            LayoutTableCell {TD} at (87,22) size 39x20 [r=1 c=2 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 37x18
+                text run at (1,1) width 37: "TD K"
+            LayoutTableCell {TD} at (128,22) size 41x20 [r=1 c=3 rs=1 cs=1]
+              LayoutText {#text} at (1,1) size 36x18
+                text run at (1,1) width 36: "TD L"
+      LayoutBlockFlow {P} at (0,182.72) size 769x18
+        LayoutText {#text} at (0,0) size 371x18
+          text run at (0,0) width 371: "In table cell C (third cell in the first row), which is empty:"
+      LayoutBlockFlow {UL} at (0,216.72) size 769x108
+        LayoutListItem {LI} at (40,0) size 729x18
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 682x18
+            text run at (0,0) width 682: "Four sets of horizontal double violet stripes surrounded by aqua should run just inside the top border edge."
+        LayoutListItem {LI} at (40,18) size 729x18
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 684x18
+            text run at (0,0) width 684: "One set of aqua-backed double violet stripes should run just inside the left, right, and bottom border edges."
+        LayoutListItem {LI} at (40,36) size 729x36
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 713x36
+            text run at (0,0) width 713: "The third set along the top should turn down at the right edge and go under the fourth set to form the right-edge"
+            text run at (0,18) width 22: "set."
+        LayoutListItem {LI} at (40,72) size 729x18
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 431x18
+            text run at (0,0) width 431: "The fourth set should turn down at the left edge to form the left set."
+        LayoutListItem {LI} at (40,90) size 729x18
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 331x18
+            text run at (0,0) width 331: "The bottom stripe should be straight and cut across "
+          LayoutInline {EM} at (0,0) size 29x18
+            LayoutText {#text} at (330,0) size 29x18
+              text run at (330,0) width 29: "over"
+          LayoutText {#text} at (358,0) size 86x18
+            text run at (358,0) width 86: " the side sets."
+      LayoutBlockFlow {P} at (0,340.72) size 769x18
+        LayoutText {#text} at (0,0) size 264x18
+          text run at (0,0) width 264: "In table cell A, (first cell in the first row):"
+      LayoutBlockFlow {UL} at (0,374.72) size 769x72
+        LayoutListItem {LI} at (40,0) size 729x18
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 644x18
+            text run at (0,0) width 644: "Three sets of horizontal aqua-backed double violet stripes should run just inside the top border edge."
+        LayoutListItem {LI} at (40,18) size 729x18
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 196x18
+            text run at (0,0) width 196: "The first set should run across."
+        LayoutListItem {LI} at (40,36) size 729x36
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 721x36
+            text run at (0,0) width 721: "The second set should turn down at the left edge, going over the third set to form another set that runs just inside"
+            text run at (0,18) width 129: "the left border edge."
+      LayoutBlockFlow {P} at (0,462.72) size 769x18
+        LayoutText {#text} at (0,0) size 262x18
+          text run at (0,0) width 262: "In table cell D, (last cell in the first row):"
+      LayoutBlockFlow {UL} at (0,496.72) size 769x54
+        LayoutListItem {LI} at (40,0) size 729x18
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 628x18
+            text run at (0,0) width 628: "Two sets of horizontal aqua-backed double violet strips should run just inside the top border edge."
+        LayoutListItem {LI} at (40,18) size 729x36
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 723x36
+            text run at (0,0) width 723: "The first set should turn down at the right edge, going under the second horizontal set to run vertically just inside"
+            text run at (0,18) width 138: "the right border edge."
+      LayoutBlockFlow {P} at (0,566.72) size 769x18
+        LayoutText {#text} at (0,0) size 289x18
+          text run at (0,0) width 289: "In table cell G, (third cell in the second row):"
+      LayoutBlockFlow {UL} at (0,600.72) size 769x72
+        LayoutListItem {LI} at (40,0) size 729x18
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 635x18
+            text run at (0,0) width 635: "Two sets of horizontal aqua-backed double violet stripes should run just inside the top border edge."
+        LayoutListItem {LI} at (40,18) size 729x18
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 695x18
+            text run at (0,0) width 695: "A set of vertical stripes should run down just inside the left border edge, going under both horizontal stripes."
+        LayoutListItem {LI} at (40,36) size 729x36
+          LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
+          LayoutText {#text} at (0,0) size 724x36
+            text run at (0,0) width 724: "Another set of vertical stripes should run down just inside the right border edge, also going under both horizontal"
+            text run at (0,18) width 46: "stripes."
+      LayoutBlockFlow {DIV} at (0,688.72) size 769x35
+        LayoutInline {A} at (0,0) size 88x18 [color=#0000EE]
+          LayoutBlockFlow {IMG} at (0,0) size 88x31
+        LayoutText {#text} at (0,0) size 0x0
+      LayoutBlockFlow {ADDRESS} at (0,723.72) size 769x18
+        LayoutText {#text} at (0,0) size 606x18
+          text run at (0,0) width 606: "CSS2 Table Backgrounds Test Suite designed and written by fantasai <fantasai@escape.com>"
+layer at (8,707) size 88x31 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0 scrollHeight 56
+  LayoutBlockFlow {DIV} at (0,0) size 88x31 [border: (1px solid #C0C0C0)]
+    LayoutImage (floating) {IMG} at (2,2) size 16x16
+layer at (26,709) size 68x54 backgroundClip at (0,0) size 0x0 clip at (0,0) size 0x0
+  LayoutBlockFlow {DIV} at (18,2) size 68x54
+    LayoutText {#text} at (0,0) size 46x54
+      text run at (0,0) width 34: "Valid"
+      text run at (0,18) width 46: "HTML"
+      text run at (0,36) width 34: "4.01!"
diff --git a/third_party/WebKit/LayoutTests/platform/mac/http/tests/security/xss-DENIED-window-name-navigator-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/http/tests/security/xss-DENIED-window-name-navigator-expected.txt
new file mode 100644
index 0000000..315a063
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac/http/tests/security/xss-DENIED-window-name-navigator-expected.txt
@@ -0,0 +1,4 @@
+CONSOLE MESSAGE: line 7: SecurityError: Blocked a frame with origin "null" from accessing a cross-origin frame.
+CONSOLE MESSAGE: line 15: SecurityError: Blocked a frame with origin "null" from accessing a cross-origin frame.
+CONSOLE MESSAGE: line 7: SecurityError: Blocked a frame with origin "null" from accessing a cross-origin frame.
+ 
diff --git a/third_party/WebKit/LayoutTests/platform/mac/virtual/stable/webexposed/global-interface-listing-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/stable/webexposed/global-interface-listing-expected.txt
index 1d17b9c..672701d 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/virtual/stable/webexposed/global-interface-listing-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/stable/webexposed/global-interface-listing-expected.txt
@@ -254,7 +254,7 @@
     getter data
     getter timecode
     method constructor
-interface Bluetooth : EventTarget
+interface Bluetooth
     attribute @@toStringTag
     method constructor
     method requestDevice
diff --git a/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt b/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
index 403ea21..e9f4688 100644
--- a/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
+++ b/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
@@ -354,7 +354,7 @@
     getter data
     getter timecode
     method constructor
-interface Bluetooth : EventTarget
+interface Bluetooth
     attribute @@toStringTag
     method constructor
     method requestDevice
diff --git a/third_party/WebKit/Source/core/editing/BUILD.gn b/third_party/WebKit/Source/core/editing/BUILD.gn
index 6f8cd005..b3441fd 100644
--- a/third_party/WebKit/Source/core/editing/BUILD.gn
+++ b/third_party/WebKit/Source/core/editing/BUILD.gn
@@ -7,8 +7,8 @@
 blink_core_sources("editing") {
   split_count = 5
   sources = [
-    "CaretBase.cpp",
-    "CaretBase.h",
+    "CaretDisplayItemClient.cpp",
+    "CaretDisplayItemClient.h",
     "CompositionUnderline.cpp",
     "CompositionUnderline.h",
     "DOMSelection.cpp",
diff --git a/third_party/WebKit/Source/core/editing/CaretBase.cpp b/third_party/WebKit/Source/core/editing/CaretDisplayItemClient.cpp
similarity index 86%
rename from third_party/WebKit/Source/core/editing/CaretBase.cpp
rename to third_party/WebKit/Source/core/editing/CaretDisplayItemClient.cpp
index b9e97eb..88ef35c 100644
--- a/third_party/WebKit/Source/core/editing/CaretBase.cpp
+++ b/third_party/WebKit/Source/core/editing/CaretDisplayItemClient.cpp
@@ -23,7 +23,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "core/editing/CaretBase.h"
+#include "core/editing/CaretDisplayItemClient.h"
 
 #include "core/editing/EditingUtilities.h"
 #include "core/editing/VisibleUnits.h"
@@ -42,14 +42,14 @@
 
 namespace blink {
 
-CaretBase::CaretBase() = default;
-CaretBase::~CaretBase() = default;
+CaretDisplayItemClient::CaretDisplayItemClient() = default;
+CaretDisplayItemClient::~CaretDisplayItemClient() = default;
 
 static inline bool caretRendersInsideNode(Node* node) {
   return node && !isDisplayInsideTable(node) && !editingIgnoresContent(*node);
 }
 
-LayoutBlock* CaretBase::caretLayoutObject(Node* node) {
+LayoutBlock* CaretDisplayItemClient::caretLayoutObject(Node* node) {
   if (!node)
     return nullptr;
 
@@ -92,7 +92,7 @@
   return caretRect;
 }
 
-LayoutRect CaretBase::computeCaretRect(
+LayoutRect CaretDisplayItemClient::computeCaretRect(
     const PositionWithAffinity& caretPosition) {
   if (caretPosition.isNull())
     return LayoutRect();
@@ -116,7 +116,8 @@
 // TODO(yoichio): |node| is FrameSelection::m_previousCaretNode and this is bad
 // design. We should use only previous layoutObject or Rectangle to invalidate
 // old caret.
-void CaretBase::invalidateLocalCaretRect(Node* node, const LayoutRect& rect) {
+void CaretDisplayItemClient::invalidateLocalCaretRect(Node* node,
+                                                      const LayoutRect& rect) {
   LayoutBlock* caretLayoutBlock = caretLayoutObject(node);
   if (!caretLayoutBlock)
     return;
@@ -134,11 +135,11 @@
       node->layoutObject()->invalidatePaintRectangle(inflatedRect, this);
 }
 
-void CaretBase::paintCaret(Node* node,
-                           GraphicsContext& context,
-                           const LayoutRect& caretLocalRect,
-                           const LayoutPoint& paintOffset,
-                           DisplayItem::Type displayItemType) {
+void CaretDisplayItemClient::paintCaret(Node* node,
+                                        GraphicsContext& context,
+                                        const LayoutRect& caretLocalRect,
+                                        const LayoutPoint& paintOffset,
+                                        DisplayItem::Type displayItemType) {
   if (DrawingRecorder::useCachedDrawingIfPossible(context, *this,
                                                   displayItemType))
     return;
@@ -156,11 +157,11 @@
   context.fillRect(paintRect, caretColor);
 }
 
-String CaretBase::debugName() const {
+String CaretDisplayItemClient::debugName() const {
   return "Caret";
 }
 
-LayoutRect CaretBase::visualRect() const {
+LayoutRect CaretDisplayItemClient::visualRect() const {
   return m_visualRect;
 }
 
diff --git a/third_party/WebKit/Source/core/editing/CaretBase.h b/third_party/WebKit/Source/core/editing/CaretDisplayItemClient.h
similarity index 89%
rename from third_party/WebKit/Source/core/editing/CaretBase.h
rename to third_party/WebKit/Source/core/editing/CaretDisplayItemClient.h
index 2b46b5b3..042a3e5 100644
--- a/third_party/WebKit/Source/core/editing/CaretBase.h
+++ b/third_party/WebKit/Source/core/editing/CaretDisplayItemClient.h
@@ -24,8 +24,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef CaretBase_h
-#define CaretBase_h
+#ifndef CaretDisplayItemClient_h
+#define CaretDisplayItemClient_h
 
 #include "core/editing/PositionWithAffinity.h"
 #include "platform/geometry/IntRect.h"
@@ -38,12 +38,12 @@
 class GraphicsContext;
 class LayoutBlock;
 
-class CaretBase final : public DisplayItemClient {
-  WTF_MAKE_NONCOPYABLE(CaretBase);
+class CaretDisplayItemClient final : public DisplayItemClient {
+  WTF_MAKE_NONCOPYABLE(CaretDisplayItemClient);
 
  public:
-  CaretBase();
-  virtual ~CaretBase();
+  CaretDisplayItemClient();
+  virtual ~CaretDisplayItemClient();
 
   // Creating VisiblePosition causes synchronous layout so we should use the
   // PositionWithAffinity version if possible.
@@ -69,4 +69,4 @@
 
 }  // namespace blink
 
-#endif  // CaretBase_h
+#endif  // CaretDisplayItemClient_h
diff --git a/third_party/WebKit/Source/core/editing/DragCaret.cpp b/third_party/WebKit/Source/core/editing/DragCaret.cpp
index 75480d7b..dbf4fe99 100644
--- a/third_party/WebKit/Source/core/editing/DragCaret.cpp
+++ b/third_party/WebKit/Source/core/editing/DragCaret.cpp
@@ -32,7 +32,7 @@
 
 namespace blink {
 
-DragCaret::DragCaret() : m_caretBase(new CaretBase()) {}
+DragCaret::DragCaret() : m_caretBase(new CaretDisplayItemClient()) {}
 
 DragCaret::~DragCaret() = default;
 
@@ -44,7 +44,7 @@
   Node* node = m_position.anchorNode();
   if (!node)
     return false;
-  if (layoutBlock != CaretBase::caretLayoutObject(node))
+  if (layoutBlock != CaretDisplayItemClient::caretLayoutObject(node))
     return false;
   return rootEditableElementOf(m_position.position());
 }
@@ -85,7 +85,7 @@
   } else {
     DCHECK(!m_position.isOrphan());
     document->updateStyleAndLayoutTree();
-    m_caretLocalRect = CaretBase::computeCaretRect(m_position);
+    m_caretLocalRect = CaretDisplayItemClient::computeCaretRect(m_position);
   }
 }
 
diff --git a/third_party/WebKit/Source/core/editing/DragCaret.h b/third_party/WebKit/Source/core/editing/DragCaret.h
index ccb47f5..a4a5597 100644
--- a/third_party/WebKit/Source/core/editing/DragCaret.h
+++ b/third_party/WebKit/Source/core/editing/DragCaret.h
@@ -28,7 +28,7 @@
 #define DragCaret_h
 
 #include "core/dom/SynchronousMutationObserver.h"
-#include "core/editing/CaretBase.h"
+#include "core/editing/CaretDisplayItemClient.h"
 #include <memory>
 
 namespace blink {
@@ -68,7 +68,7 @@
   // caret rect in coords local to the layoutObject responsible for painting the
   // caret
   LayoutRect m_caretLocalRect;
-  const std::unique_ptr<CaretBase> m_caretBase;
+  const std::unique_ptr<CaretDisplayItemClient> m_caretBase;
 };
 
 }  // namespace blink
diff --git a/third_party/WebKit/Source/core/editing/FrameCaret.cpp b/third_party/WebKit/Source/core/editing/FrameCaret.cpp
index b8b958e..2c1d4f3 100644
--- a/third_party/WebKit/Source/core/editing/FrameCaret.cpp
+++ b/third_party/WebKit/Source/core/editing/FrameCaret.cpp
@@ -26,7 +26,7 @@
 #include "core/editing/FrameCaret.h"
 
 #include "core/dom/TaskRunnerHelper.h"
-#include "core/editing/CaretBase.h"
+#include "core/editing/CaretDisplayItemClient.h"
 #include "core/editing/EditingUtilities.h"
 #include "core/editing/Editor.h"
 #include "core/editing/SelectionEditor.h"
@@ -48,7 +48,7 @@
                        const SelectionEditor& selectionEditor)
     : m_selectionEditor(&selectionEditor),
       m_frame(frame),
-      m_caretBase(new CaretBase()),
+      m_caretBase(new CaretDisplayItemClient()),
       m_caretVisibility(CaretVisibility::Hidden),
       m_previousCaretVisibility(CaretVisibility::Hidden),
       m_caretBlinkTimer(TaskRunnerHelper::get(TaskType::UnspecedTimer, &frame),
@@ -230,7 +230,7 @@
 }
 
 static IntRect absoluteBoundsForLocalRect(Node* node, const LayoutRect& rect) {
-  LayoutBlock* caretPainter = CaretBase::caretLayoutObject(node);
+  LayoutBlock* caretPainter = CaretDisplayItemClient::caretLayoutObject(node);
   if (!caretPainter)
     return IntRect();
 
@@ -255,11 +255,11 @@
   if (enclosingTextControl(caretPosition().position()) &&
       isVisuallyEquivalentCandidate(caretPosition().position())) {
     return absoluteBoundsForLocalRect(
-        caretNode, CaretBase::computeCaretRect(caretPosition()));
+        caretNode, CaretDisplayItemClient::computeCaretRect(caretPosition()));
   }
   return absoluteBoundsForLocalRect(
       caretNode,
-      CaretBase::computeCaretRect(
+      CaretDisplayItemClient::computeCaretRect(
           createVisiblePosition(caretPosition()).toPositionWithAffinity()));
 }
 
@@ -280,7 +280,7 @@
     return;
 
   const LayoutRect caretLocalRect =
-      CaretBase::computeCaretRect(caretPosition());
+      CaretDisplayItemClient::computeCaretRect(caretPosition());
   m_caretBase->paintCaret(caretPosition().anchorNode(), context, caretLocalRect,
                           paintOffset, DisplayItem::kCaret);
 }
diff --git a/third_party/WebKit/Source/core/editing/FrameCaret.h b/third_party/WebKit/Source/core/editing/FrameCaret.h
index e49a641..cbe7ead 100644
--- a/third_party/WebKit/Source/core/editing/FrameCaret.h
+++ b/third_party/WebKit/Source/core/editing/FrameCaret.h
@@ -37,7 +37,7 @@
 
 namespace blink {
 
-class CaretBase;
+class CaretDisplayItemClient;
 class CharacterData;
 class DisplayItemClient;
 class Document;
@@ -106,7 +106,7 @@
 
   const Member<const SelectionEditor> m_selectionEditor;
   const Member<LocalFrame> m_frame;
-  const std::unique_ptr<CaretBase> m_caretBase;
+  const std::unique_ptr<CaretDisplayItemClient> m_caretBase;
   // The last node which painted the caret. Retained for clearing the old
   // caret when it moves.
   Member<Node> m_previousCaretNode;
diff --git a/third_party/WebKit/Source/core/editing/FrameSelection.cpp b/third_party/WebKit/Source/core/editing/FrameSelection.cpp
index 4d5dac1..f7678ec 100644
--- a/third_party/WebKit/Source/core/editing/FrameSelection.cpp
+++ b/third_party/WebKit/Source/core/editing/FrameSelection.cpp
@@ -37,7 +37,7 @@
 #include "core/dom/NodeTraversal.h"
 #include "core/dom/NodeWithIndex.h"
 #include "core/dom/Text.h"
-#include "core/editing/CaretBase.h"
+#include "core/editing/CaretDisplayItemClient.h"
 #include "core/editing/EditingUtilities.h"
 #include "core/editing/Editor.h"
 #include "core/editing/FrameCaret.h"
@@ -731,8 +731,8 @@
   DCHECK(selection().isValidFor(document()));
   if (!isCaret())
     return false;
-  return CaretBase::caretLayoutObject(selection().start().anchorNode()) ==
-             layoubBlock &&
+  return CaretDisplayItemClient::caretLayoutObject(
+             selection().start().anchorNode()) == layoubBlock &&
          hasEditableStyle();
 }
 
diff --git a/third_party/WebKit/Source/modules/bluetooth/Bluetooth.idl b/third_party/WebKit/Source/modules/bluetooth/Bluetooth.idl
index 180af8c..550d196 100644
--- a/third_party/WebKit/Source/modules/bluetooth/Bluetooth.idl
+++ b/third_party/WebKit/Source/modules/bluetooth/Bluetooth.idl
@@ -6,7 +6,7 @@
 
 [
     RuntimeEnabled=WebBluetooth,
-] interface Bluetooth : EventTarget {
+] interface Bluetooth {
     [CallWith=ScriptState, RaisesException, MeasureAs=WebBluetoothRequestDevice] Promise<BluetoothDevice> requestDevice (
         RequestDeviceOptions options
         );
diff --git a/tools/perf/benchmarks/system_health_smoke_test.py b/tools/perf/benchmarks/system_health_smoke_test.py
index f3f08f9..1039121 100644
--- a/tools/perf/benchmarks/system_health_smoke_test.py
+++ b/tools/perf/benchmarks/system_health_smoke_test.py
@@ -51,6 +51,9 @@
 
   # crbug.com/
   'benchmarks.system_health_smoke_test.SystemHealthBenchmarkSmokeTest.system_health.memory_desktop.browse:news:nytimes',  # pylint: disable=line-too-long
+
+  # crbug.com/685967
+  'benchmarks.system_health_smoke_test.SystemHealthBenchmarkSmokeTest.system_health.memory_desktop.browse:media:imgur',  # pylint: disable=line-too-long
 })
 
 
diff --git a/ui/aura/demo/demo_main.cc b/ui/aura/demo/demo_main.cc
index 6f398cf..0df44ba 100644
--- a/ui/aura/demo/demo_main.cc
+++ b/ui/aura/demo/demo_main.cc
@@ -154,6 +154,7 @@
 
   std::unique_ptr<aura::Env> env = aura::Env::CreateInstance();
   env->set_context_factory(context_factory.get());
+  env->set_context_factory_private(context_factory.get());
   std::unique_ptr<aura::TestScreen> test_screen(
       aura::TestScreen::Create(gfx::Size()));
   display::Screen::SetScreenInstance(test_screen.get());