diff --git a/.gn b/.gn
index bed9277b..0644a660 100644
--- a/.gn
+++ b/.gn
@@ -216,6 +216,7 @@
 
   #"//jingle/*",
   "//mandoline/*",
+  "//mash/*",
 
   #"//media/*",  # Lots of errors.
   "mojo/*",
diff --git a/AUTHORS b/AUTHORS
index a1b8ebff..45e7e6d 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -366,6 +366,7 @@
 Mao Yujie <yujie.mao@intel.com>
 Marco Rodrigues <gothicx@gmail.com>
 Mario Sanchez Prada <mario.prada@samsung.com>
+Mariusz Mlynski <marius.mlynski@gmail.com>
 Mark Hahnenberg <mhahnenb@andrew.cmu.edu>
 Mark Seaborn <mrs@mythic-beasts.com>
 Martijn Croonen <martijn@martijnc.be>
diff --git a/BUILD.gn b/BUILD.gn
index edce1e2..f58231f 100644
--- a/BUILD.gn
+++ b/BUILD.gn
@@ -354,6 +354,8 @@
   if (is_linux) {
     # The following are definitely linux-only.
     deps += [
+      "//chrome:manpage",
+      "//chrome:xdg_mime",
       "//dbus:dbus_test_server",
       "//dbus:dbus_unittests",
       "//net:disk_cache_memory_test",
@@ -368,6 +370,11 @@
     if (is_chromeos || use_ash) {
       deps += [ "//components/session_manager/core" ]
     }
+
+    if (is_chrome_branded && is_official_build) {
+      # TODO(dpranke): add the linux_dump_symbols flag?
+      deps += [ "//chrome:linux_symbols" ]
+    }
   }
 
   if (is_ios || is_win || (is_linux && !is_chromeos)) {
@@ -442,6 +449,14 @@
 
     if (enable_nacl) {
       deps += [ "//components/nacl:nacl_loader_unittests" ]
+
+      if (is_linux) {
+        # TODO(dpranke): Figure out what platforms should actually have this.
+        deps += [
+          "//components/nacl:nacl_helper",
+          "//components/nacl:helper_nonsfi",
+        ]
+      }
     }
 
     if (media_use_ffmpeg) {
diff --git a/DEPS b/DEPS
index b02f31e..4b9eb10 100644
--- a/DEPS
+++ b/DEPS
@@ -39,7 +39,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '195fe08421f3a6c52ed621be96dbcc5393b41e69',
+  'skia_revision': 'cbf4fba43933302a846872e4c5ce8f1adb8b325e',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
@@ -59,7 +59,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling PDFium
   # and whatever else without interference from each other.
-  'pdfium_revision': '4274ea205ca2219f6a4cfc54025284c1aa3b14b8',
+  'pdfium_revision': '3f148915d12f54a946a0c0bf526162b79c39d650',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling openmax_dl
   # and whatever else without interference from each other.
@@ -187,10 +187,10 @@
    Var('chromium_git') + '/webm/libvpx.git' + '@' +  '0941ff72a00732cea6750477edfe649348e699de',
 
   'src/third_party/ffmpeg':
-   Var('chromium_git') + '/chromium/third_party/ffmpeg.git' + '@' + '3540f6b0097b03aae1f29e41d8d8433044ee8cdb',
+   Var('chromium_git') + '/chromium/third_party/ffmpeg.git' + '@' + 'd435476f9456ced37c4f7c1d6221fe04c0d6b63d',
 
   'src/third_party/libjingle/source/talk':
-    Var('chromium_git') + '/external/webrtc/trunk/talk.git' + '@' + '4cccfb61750309f0ec44170fcc098297f955f4db', # commit position 10659
+    Var('chromium_git') + '/external/webrtc/trunk/talk.git' + '@' + '3ecea8a7f856b250a0c86d26f7a7d0f284ca5afb', # commit position 10671
 
   'src/third_party/usrsctp/usrsctplib':
     Var('chromium_git') + '/external/usrsctplib.git' + '@' + '36444a999739e9e408f8f587cb4c3ffeef2e50ac', # from svn revision 9215
@@ -214,7 +214,7 @@
    Var('chromium_git') + '/native_client/src/third_party/scons-2.0.1.git' + '@' + '1c1550e17fc26355d08627fbdec13d8291227067',
 
   'src/third_party/webrtc':
-    Var('chromium_git') + '/external/webrtc/trunk/webrtc.git' + '@' + '1b5ad57a60538686c1c8ee2f2122642950182cca', # commit position 10669
+    Var('chromium_git') + '/external/webrtc/trunk/webrtc.git' + '@' + '2f4c471df7c34092e17fbe8ad39c7120d0d8ea2f', # commit position 10679
 
   'src/third_party/openmax_dl':
     Var('chromium_git') + '/external/webrtc/deps/third_party/openmax.git' + '@' +  Var('openmax_dl_revision'),
diff --git a/android_webview/BUILD.gn b/android_webview/BUILD.gn
index f82b35c..729d4ea 100644
--- a/android_webview/BUILD.gn
+++ b/android_webview/BUILD.gn
@@ -6,6 +6,7 @@
 import("//build/config/android/rules.gni")
 import("//build/config/locales.gni")
 import("//tools/grit/repack.gni")
+import("system_webview_apk_tmpl.gni")
 import("webview_repack_locales.gni")
 
 group("android_webview") {
@@ -465,6 +466,7 @@
     ":generate_aw_resources",
     ":generate_aw_strings",
     ":generate_components_strings",
+    "//android_webview/common:version",
     "//android_webview/native:native",
     "//cc/surfaces",
     "//components/auto_login_parser:auto_login_parser",
@@ -641,18 +643,13 @@
   ]
 }
 
-android_apk("system_webview_apk") {
+system_webview_apk_tmpl("system_webview_apk") {
   android_manifest = get_target_outputs(":system_webview_manifest")
   android_manifest = android_manifest[1]
   android_manifest_dep = ":system_webview_manifest"
-  chromium_code = true
   deps = [
     ":system_webview_resources",
-    ":assets",
-    ":libwebviewchromium",
     "//android_webview/glue",
-    "//base:base_java",
   ]
   apk_name = "SystemWebView"
-  native_libs = [ "$root_build_dir/libwebviewchromium.so" ]
 }
diff --git a/android_webview/browser/net/aw_url_request_context_getter.cc b/android_webview/browser/net/aw_url_request_context_getter.cc
index 4de5a33..529bce41 100644
--- a/android_webview/browser/net/aw_url_request_context_getter.cc
+++ b/android_webview/browser/net/aw_url_request_context_getter.cc
@@ -69,7 +69,7 @@
 }
 
 void ApplyCmdlineOverridesToNetworkSessionParams(
-    net::HttpNetworkSession::Params* params) {
+    net::URLRequestContextBuilder::HttpNetworkSessionParams* params) {
   int value;
   const base::CommandLine& command_line =
       *base::CommandLine::ForCurrentProcess();
@@ -88,26 +88,6 @@
   }
 }
 
-void PopulateNetworkSessionParams(
-    net::URLRequestContext* context,
-    net::HttpNetworkSession::Params* params) {
-  params->host_resolver = context->host_resolver();
-  params->cert_verifier = context->cert_verifier();
-  params->channel_id_service = context->channel_id_service();
-  params->transport_security_state = context->transport_security_state();
-  params->proxy_service = context->proxy_service();
-  params->ssl_config_service = context->ssl_config_service();
-  params->http_auth_handler_factory = context->http_auth_handler_factory();
-  params->network_delegate = context->network_delegate();
-  params->http_server_properties = context->http_server_properties();
-  params->net_log = context->net_log();
-  // TODO(sgurun) remove once crbug.com/329681 is fixed.
-  params->next_protos = net::NextProtosSpdy31();
-  params->use_alternative_services = true;
-
-  ApplyCmdlineOverridesToNetworkSessionParams(params);
-}
-
 scoped_ptr<net::URLRequestJobFactory> CreateJobFactory(
     content::ProtocolHandlerMap* protocol_handlers,
     content::URLRequestInterceptorScopedVector request_interceptors) {
@@ -220,32 +200,26 @@
       proxy_config_service_.Pass(), net_log_.get()));
   builder.set_net_log(net_log_.get());
   builder.SetCookieAndChannelIdStores(cookie_store_, NULL);
+
+  net::URLRequestContextBuilder::HttpCacheParams cache_params;
+  cache_params.type =
+      net::URLRequestContextBuilder::HttpCacheParams::DISK_SIMPLE;
+  cache_params.max_size = 20 * 1024 * 1024;  // 20M
+  cache_params.path = cache_path_;
+  builder.EnableHttpCache(cache_params);
+  builder.SetFileTaskRunner(
+      BrowserThread::GetMessageLoopProxyForThread(BrowserThread::CACHE));
+
+  net::URLRequestContextBuilder::HttpNetworkSessionParams
+      network_session_params;
+  ApplyCmdlineOverridesToNetworkSessionParams(&network_session_params);
+  builder.set_http_network_session_params(network_session_params);
+  builder.SetSpdyAndQuicEnabled(true, true);
   ApplyCmdlineOverridesToURLRequestContextBuilder(&builder);
-
   url_request_context_ = builder.Build().Pass();
-  // TODO(mnaganov): Fix URLRequestContextBuilder to use proper threads.
-  net::HttpNetworkSession::Params network_session_params;
-
-  PopulateNetworkSessionParams(url_request_context_.get(),
-                               &network_session_params);
-
-  http_network_session_.reset(
-      new net::HttpNetworkSession(network_session_params));
-  main_http_factory_.reset(new net::HttpCache(
-      http_network_session_.get(),
-      make_scoped_ptr(new net::HttpCache::DefaultBackend(
-          net::DISK_CACHE,
-          net::CACHE_BACKEND_SIMPLE,
-          cache_path_,
-          20 * 1024 * 1024,  // 20M
-          BrowserThread::GetMessageLoopProxyForThread(BrowserThread::CACHE))),
-      true /* set_up_quic_server_info */));
-
-  url_request_context_->set_http_transaction_factory(main_http_factory_.get());
 
   job_factory_ = CreateJobFactory(&protocol_handlers_,
                                   request_interceptors_.Pass());
-
   job_factory_.reset(new net::URLRequestInterceptingJobFactory(
       job_factory_.Pass(),
       browser_context->GetDataReductionProxyIOData()->CreateInterceptor()));
diff --git a/android_webview/browser/net/aw_url_request_context_getter.h b/android_webview/browser/net/aw_url_request_context_getter.h
index 868a670..b7411de1 100644
--- a/android_webview/browser/net/aw_url_request_context_getter.h
+++ b/android_webview/browser/net/aw_url_request_context_getter.h
@@ -10,13 +10,11 @@
 #include "base/files/file_path.h"
 #include "base/memory/scoped_ptr.h"
 #include "content/public/browser/content_browser_client.h"
-#include "net/http/http_network_session.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "net/url_request/url_request_job_factory.h"
 
 namespace net {
 class CookieStore;
-class HttpTransactionFactory;
 class HttpUserAgentSettings;
 class NetLog;
 class ProxyConfigService;
@@ -68,8 +66,6 @@
 
   scoped_ptr<net::NetLog> net_log_;
   scoped_ptr<net::ProxyConfigService> proxy_config_service_;
-  scoped_ptr<net::HttpNetworkSession> http_network_session_;
-  scoped_ptr<net::HttpTransactionFactory> main_http_factory_;
   scoped_refptr<net::CookieStore> cookie_store_;
   scoped_ptr<net::URLRequestJobFactory> job_factory_;
   scoped_ptr<net::HttpUserAgentSettings> http_user_agent_settings_;
diff --git a/android_webview/glue/BUILD.gn b/android_webview/glue/BUILD.gn
index 1a923f94..76e6f51 100644
--- a/android_webview/glue/BUILD.gn
+++ b/android_webview/glue/BUILD.gn
@@ -5,23 +5,11 @@
 import("//build/config/android/config.gni")
 import("//build/config/android/rules.gni")
 import("generate_resource_rewriter.gni")
+import("glue.gni")
 
 webview_framework_ijar =
     "$root_out_dir/lib.java/webview/frameworks.interface.jar"
 
-# This variable shared between 'glue' and 'glue_resource_rewriter' because
-# ResourceRewrite.java need to be generated according 'glue' deps
-glue_library_deps = [
-  "//android_webview:android_webview_java",
-  "//android_webview:resources",
-  "//base:base_java",
-  "//content/public/android:content_java",
-  "//content/public/android:content_java_resources",
-  "//components/web_contents_delegate_android:web_contents_delegate_android_java_resources",
-  "//ui/android:ui_java",
-  "//ui/android:ui_java_resources",
-]
-
 generate_interface_jar("framework_ijar") {
   input_jar = "../../third_party/android_platform/webview/frameworks_6.0.jar"
   output_jar = webview_framework_ijar
diff --git a/android_webview/glue/glue.gni b/android_webview/glue/glue.gni
new file mode 100644
index 0000000..fc9c65ab
--- /dev/null
+++ b/android_webview/glue/glue.gni
@@ -0,0 +1,16 @@
+# Copyright 2015 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# This variable shared between 'glue' and 'glue_resource_rewriter' because
+# ResourceRewrite.java need to be generated according 'glue' deps.
+glue_library_deps = [
+  "//android_webview:android_webview_java",
+  "//android_webview:resources",
+  "//base:base_java",
+  "//content/public/android:content_java",
+  "//content/public/android:content_java_resources",
+  "//components/web_contents_delegate_android:web_contents_delegate_android_java_resources",
+  "//ui/android:ui_java",
+  "//ui/android:ui_java_resources",
+]
diff --git a/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromium.java b/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromium.java
index 866262b0..b9d914e 100644
--- a/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromium.java
+++ b/android_webview/glue/java/src/com/android/webview/chromium/WebViewChromium.java
@@ -1580,7 +1580,11 @@
     private void createAssistStructure(ViewStructure viewNode, AccessibilitySnapshotNode node,
             int parentX, int parentY) {
         viewNode.setClassName(node.className);
-        viewNode.setText(node.text);
+        if (node.hasSelection) {
+            viewNode.setText(node.text, node.startSelection, node.endSelection);
+        } else {
+            viewNode.setText(node.text);
+        }
         // Do not pass scroll information.
         viewNode.setDimens(node.x - parentX, node.y - parentY, 0, 0, node.width, node.height);
         viewNode.setChildCount(node.children.size());
diff --git a/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsTest.java b/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsTest.java
index 83c51bd..6d5bee0 100644
--- a/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsTest.java
+++ b/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsTest.java
@@ -635,13 +635,19 @@
 
     private float mPageScale;
 
-    private AccessibilitySnapshotNode receiveAccessibilitySnapshot(String data) throws Throwable {
+    private AccessibilitySnapshotNode receiveAccessibilitySnapshot(String data, String js)
+            throws Throwable {
         final AwTestContainerView testView = createAwTestContainerViewOnMainSync(mContentsClient);
         final AwContents awContents = testView.getAwContents();
         final CallbackHelper loadHelper = mContentsClient.getOnPageFinishedHelper();
+        AwSettings awSettings = getAwSettingsOnUiThread(awContents);
+        awSettings.setJavaScriptEnabled(true);
         if (data != null) {
             loadDataSync(awContents, loadHelper, data, "text/html", false);
         }
+        if (js != null) {
+            executeJavaScriptAndWaitForResult(awContents, mContentsClient, js);
+        }
 
         final AccessibilityCallbackHelper callbackHelper = new AccessibilityCallbackHelper();
         final AccessibilitySnapshotCallback callback = new AccessibilitySnapshotCallback() {
@@ -671,7 +677,7 @@
     @SmallTest
     public void testRequestAccessibilitySnapshot() throws Throwable {
         final String data = "<button>Click</button>";
-        AccessibilitySnapshotNode root = receiveAccessibilitySnapshot(data);
+        AccessibilitySnapshotNode root = receiveAccessibilitySnapshot(data, null);
         assertEquals(1, root.children.size());
         assertEquals("", root.text);
         AccessibilitySnapshotNode child = root.children.get(0);
@@ -686,7 +692,7 @@
     @SmallTest
     public void testRequestAccessibilitySnapshotColors() throws Throwable {
         final String data = "<p style=\"color:#123456;background:#abcdef\">color</p>";
-        AccessibilitySnapshotNode root = receiveAccessibilitySnapshot(data);
+        AccessibilitySnapshotNode root = receiveAccessibilitySnapshot(data, null);
         assertEquals(1, root.children.size());
         assertEquals("", root.text);
         AccessibilitySnapshotNode child = root.children.get(0);
@@ -703,7 +709,7 @@
                 "<html><head><style> "
                 + "    body { font-size:11px; }"
                 + "    </style></head><body><p>foo</p></body></html>";
-        AccessibilitySnapshotNode root = receiveAccessibilitySnapshot(data);
+        AccessibilitySnapshotNode root = receiveAccessibilitySnapshot(data, null);
         assertEquals(1, root.children.size());
         assertEquals("", root.text);
         AccessibilitySnapshotNode child = root.children.get(0);
@@ -719,7 +725,7 @@
                 "<html><head><style> "
                 + "    body { font: italic bold 12px Courier; }"
                 + "    </style></head><body><p>foo</p></body></html>";
-        AccessibilitySnapshotNode root = receiveAccessibilitySnapshot(data);
+        AccessibilitySnapshotNode root = receiveAccessibilitySnapshot(data, null);
         assertEquals(1, root.children.size());
         assertEquals("", root.text);
         AccessibilitySnapshotNode child = root.children.get(0);
@@ -735,7 +741,7 @@
     @SmallTest
     public void testRequestAccessibilitySnapshotStrongStyle() throws Throwable {
         final String data = "<html><body><p>foo</p><p><strong>bar</strong></p></body></html>";
-        AccessibilitySnapshotNode root = receiveAccessibilitySnapshot(data);
+        AccessibilitySnapshotNode root = receiveAccessibilitySnapshot(data, null);
         assertEquals(2, root.children.size());
         assertEquals("", root.text);
         AccessibilitySnapshotNode child1 = root.children.get(0);
@@ -753,7 +759,7 @@
     @SmallTest
     public void testRequestAccessibilitySnapshotItalicStyle() throws Throwable {
         final String data = "<html><body><i>foo</i></body></html>";
-        AccessibilitySnapshotNode root = receiveAccessibilitySnapshot(data);
+        AccessibilitySnapshotNode root = receiveAccessibilitySnapshot(data, null);
         assertEquals(1, root.children.size());
         assertEquals("", root.text);
         AccessibilitySnapshotNode child = root.children.get(0);
@@ -767,7 +773,7 @@
     @SmallTest
     public void testRequestAccessibilitySnapshotBoldStyle() throws Throwable {
         final String data = "<html><body><b>foo</b></body></html>";
-        AccessibilitySnapshotNode root = receiveAccessibilitySnapshot(data);
+        AccessibilitySnapshotNode root = receiveAccessibilitySnapshot(data, null);
         assertEquals(1, root.children.size());
         assertEquals("", root.text);
         AccessibilitySnapshotNode child = root.children.get(0);
@@ -781,7 +787,7 @@
     @SmallTest
     public void testRequestAccessibilitySnapshotNoStyle() throws Throwable {
         final String data = "<table><thead></thead></table>";
-        AccessibilitySnapshotNode root = receiveAccessibilitySnapshot(data);
+        AccessibilitySnapshotNode root = receiveAccessibilitySnapshot(data, null);
         assertEquals(1, root.children.size());
         assertEquals("", root.text);
         AccessibilitySnapshotNode grandChild = root.children.get(0).children.get(0);
@@ -791,7 +797,116 @@
     @Feature({"AndroidWebView"})
     @SmallTest
     public void testRequestAccessibilitySnapshotAboutBlank() throws Throwable {
-        AccessibilitySnapshotNode root = receiveAccessibilitySnapshot(null);
+        AccessibilitySnapshotNode root = receiveAccessibilitySnapshot(null, null);
         assertEquals(null, root);
     }
+
+    private String getSelectionScript(String node1, int start, String node2, int end) {
+        return "var element1 = document.getElementById('" + node1 + "');"
+                + "var node1 = element1.childNodes.item(0);"
+                + "var range=document.createRange();"
+                + "range.setStart(node1," + start + ");"
+                + "var element2 = document.getElementById('" + node2 + "');"
+                + "var node2 = element2.childNodes.item(0);"
+                + "range.setEnd(node2," + end + ");"
+                + "var selection=window.getSelection();"
+                + "selection.removeAllRanges();"
+                + "selection.addRange(range);";
+    }
+
+    @Feature({"AndroidWebView"})
+    @SmallTest
+    public void testRequestAccessibilitySnapshotOneCharacterSelection() throws Throwable {
+        final String data = "<html><body><b id='node'>foo</b></body></html>";
+
+        AccessibilitySnapshotNode root =
+                receiveAccessibilitySnapshot(data, getSelectionScript("node", 0, "node", 1));
+        assertEquals(1, root.children.size());
+        assertEquals("", root.text);
+        AccessibilitySnapshotNode child = root.children.get(0);
+        AccessibilitySnapshotNode grandchild = child.children.get(0);
+        assertEquals("foo", grandchild.text);
+        assertEquals(0, grandchild.startSelection);
+        assertEquals(1, grandchild.endSelection);
+    }
+
+    @Feature({"AndroidWebView"})
+    @SmallTest
+    public void testRequestAccessibilitySnapshotOneNodeSelection() throws Throwable {
+        final String data = "<html><body><b id='node'>foo</b></body></html>";
+
+        AccessibilitySnapshotNode root =
+                receiveAccessibilitySnapshot(data, getSelectionScript("node", 0, "node", 3));
+        assertEquals(1, root.children.size());
+        assertEquals("", root.text);
+        AccessibilitySnapshotNode child = root.children.get(0);
+        AccessibilitySnapshotNode grandchild = child.children.get(0);
+        assertEquals("foo", grandchild.text);
+        assertEquals(0, grandchild.startSelection);
+        assertEquals(3, grandchild.endSelection);
+    }
+
+    @Feature({"AndroidWebView"})
+    @SmallTest
+    public void testRequestAccessibilitySnapshotSubsequentNodeSelection() throws Throwable {
+        final String data = "<html><body><b id='node1'>foo</b><b id='node2'>bar</b></body></html>";
+
+        AccessibilitySnapshotNode root =
+                receiveAccessibilitySnapshot(data, getSelectionScript("node1", 1, "node2", 1));
+        assertEquals(1, root.children.size());
+        assertEquals("", root.text);
+        AccessibilitySnapshotNode child = root.children.get(0);
+        AccessibilitySnapshotNode grandchild = child.children.get(0);
+        assertEquals("foo", grandchild.text);
+        assertEquals(1, grandchild.startSelection);
+        assertEquals(3, grandchild.endSelection);
+        grandchild = child.children.get(1);
+        assertEquals("bar", grandchild.text);
+        assertEquals(0, grandchild.startSelection);
+        assertEquals(1, grandchild.endSelection);
+    }
+
+    @Feature({"AndroidWebView"})
+    @SmallTest
+    public void testRequestAccessibilitySnapshotMultiNodeSelection() throws Throwable {
+        final String data =
+                "<html><body><b id='node1'>foo</b><b>middle</b><b id='node2'>bar</b></body></html>";
+
+        AccessibilitySnapshotNode root =
+                receiveAccessibilitySnapshot(data, getSelectionScript("node1", 1, "node2", 1));
+        assertEquals(1, root.children.size());
+        assertEquals("", root.text);
+        AccessibilitySnapshotNode child = root.children.get(0);
+        AccessibilitySnapshotNode grandchild = child.children.get(0);
+        assertEquals("foo", grandchild.text);
+        assertEquals(1, grandchild.startSelection);
+        assertEquals(3, grandchild.endSelection);
+        grandchild = child.children.get(1);
+        assertEquals("middle", grandchild.text);
+        assertEquals(0, grandchild.startSelection);
+        assertEquals(6, grandchild.endSelection);
+        grandchild = child.children.get(2);
+        assertEquals("bar", grandchild.text);
+        assertEquals(0, grandchild.startSelection);
+        assertEquals(1, grandchild.endSelection);
+    }
+
+    @Feature({"AndroidWebView"})
+    @SmallTest
+    public void testRequestAccessibilitySnapshotInputSelection() throws Throwable {
+        final String data = "<html><body><input id='input' value='Hello, world'></body></html>";
+        final String js =  "var input = document.getElementById('input');"
+                + "input.select();"
+                + "input.selectionStart = 0;"
+                + "input.selectionEnd = 5;";
+        AccessibilitySnapshotNode root = receiveAccessibilitySnapshot(data, js);
+        assertEquals(1, root.children.size());
+        assertEquals("", root.text);
+        AccessibilitySnapshotNode child = root.children.get(0);
+        AccessibilitySnapshotNode grandchild = child.children.get(0);
+        assertEquals("Hello, world", grandchild.text);
+        assertEquals(0, grandchild.startSelection);
+        assertEquals(5, grandchild.endSelection);
+    }
+
 }
diff --git a/android_webview/native/BUILD.gn b/android_webview/native/BUILD.gn
index 561c1e1..a76af83 100644
--- a/android_webview/native/BUILD.gn
+++ b/android_webview/native/BUILD.gn
@@ -8,7 +8,7 @@
 source_set("native") {
   deps = [
     "//android_webview/common:version",
-    "//base:base_static",
+    "//base",
     "//base/third_party/dynamic_annotations:dynamic_annotations",
     "//cc:cc",
     "//components/autofill/content/browser:browser",
diff --git a/android_webview/system_webview_apk_tmpl.gni b/android_webview/system_webview_apk_tmpl.gni
new file mode 100644
index 0000000..ab49f0a
--- /dev/null
+++ b/android_webview/system_webview_apk_tmpl.gni
@@ -0,0 +1,26 @@
+# Copyright 2015 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+import("//build/config/android/config.gni")
+import("//build/config/android/rules.gni")
+
+template("system_webview_apk_tmpl") {
+  android_apk(target_name) {
+    forward_variables_from(invoker, "*")
+
+    deps += [
+      "//android_webview:assets",
+      "//android_webview:libwebviewchromium",
+      "//base:base_java",
+    ]
+
+    shared_resources = true
+    native_libs = [ "libwebviewchromium.so" ]
+    native_lib_version_rule = "//build/util:chrome_version_json"
+    _native_lib_file =
+        rebase_path("$root_gen_dir/CHROME_VERSION.json", root_out_dir)
+    native_lib_version_arg = "@FileArg($_native_lib_file:full-quoted)"
+    extensions_to_not_compress = ".lpak,.pak,.bin,.dat"
+  }
+}
diff --git a/android_webview/tools/WebViewShell/src/org/chromium/webview_shell/TelemetryActivity.java b/android_webview/tools/WebViewShell/src/org/chromium/webview_shell/TelemetryActivity.java
index 11fa10b..fc50f249 100644
--- a/android_webview/tools/WebViewShell/src/org/chromium/webview_shell/TelemetryActivity.java
+++ b/android_webview/tools/WebViewShell/src/org/chromium/webview_shell/TelemetryActivity.java
@@ -5,8 +5,10 @@
 package org.chromium.webview_shell;
 
 import android.app.Activity;
+import android.content.Intent;
 import android.os.Bundle;
 import android.webkit.CookieManager;
+import android.webkit.WebSettings;
 import android.webkit.WebView;
 import android.webkit.WebViewClient;
 
@@ -24,7 +26,14 @@
 
         WebView webView = (WebView) findViewById(R.id.webview);
         CookieManager.setAcceptFileSchemeCookies(true);
-        webView.getSettings().setJavaScriptEnabled(true);
+        WebSettings settings = webView.getSettings();
+        settings.setJavaScriptEnabled(true);
+
+        Intent intent = getIntent();
+        String userAgentString = intent.getStringExtra("userAgent");
+        if (userAgentString != null) {
+            settings.setUserAgentString(userAgentString);
+        }
 
         webView.setWebViewClient(new WebViewClient() {
                 @Override
diff --git a/android_webview/tools/WebViewShell/test/webexposed/global-interface-listing-expected.txt b/android_webview/tools/WebViewShell/test/webexposed/global-interface-listing-expected.txt
index 35175f6..71a46cc 100644
--- a/android_webview/tools/WebViewShell/test/webexposed/global-interface-listing-expected.txt
+++ b/android_webview/tools/WebViewShell/test/webexposed/global-interface-listing-expected.txt
@@ -3001,7 +3001,6 @@
     method constructor
     method getBattery
     method getGamepads
-    method getStorageUpdates
     method javaEnabled
     method requestMIDIAccess
     method requestMediaKeySystemAccess
diff --git a/ash/ash.gyp b/ash/ash.gyp
index 01e9d9e..bf78086 100644
--- a/ash/ash.gyp
+++ b/ash/ash.gyp
@@ -460,12 +460,8 @@
       'system/tray_accessibility.h',
       'system/tray_update.cc',
       'system/tray_update.h',
-      'system/user/accounts_detailed_view.cc',
-      'system/user/accounts_detailed_view.h',
       'system/user/button_from_view.cc',
       'system/user/button_from_view.h',
-      'system/user/config.cc',
-      'system/user/config.h',
       'system/user/login_status.cc',
       'system/user/login_status.h',
       'system/user/rounded_image_view.cc',
@@ -475,8 +471,6 @@
       'system/user/tray_user_separator.cc',
       'system/user/tray_user_separator.h',
       'system/user/update_observer.h',
-      'system/user/user_accounts_delegate.cc',
-      'system/user/user_accounts_delegate.h',
       'system/user/user_card_view.cc',
       'system/user/user_card_view.h',
       'system/user/user_observer.h',
diff --git a/ash/ash_chromeos_strings.grdp b/ash/ash_chromeos_strings.grdp
index 1643094..c94576a 100644
--- a/ash/ash_chromeos_strings.grdp
+++ b/ash/ash_chromeos_strings.grdp
@@ -63,6 +63,9 @@
   <message name="IDS_ASH_STATUS_TRAY_NETWORK_PROXY_SETTINGS" desc="The label used in the proxy settings entry in the network dialog in the login screen.">
     Proxy...
   </message>
+  <message name="IDS_ASH_STATUS_TRAY_NETWORK_TECHNOLOGY_ENFORCED_BY_POLICY" desc="The label used for tell users that this technology is disabled by the administrator">
+    This network setting is disabled by the administrator.
+  </message>
   <message name="IDS_ASH_STATUS_TRAY_ENABLE_WIFI" desc="The label used for the item to enable wifi.">
     Enable Wi-Fi
   </message>
diff --git a/ash/ash_strings.grd b/ash/ash_strings.grd
index 0bec772..c3ff0c4 100644
--- a/ash/ash_strings.grd
+++ b/ash/ash_strings.grd
@@ -391,18 +391,6 @@
       <message name="IDS_ASH_MOD3_KEY" desc="Name of ISOLevel5 (mod3) key name. Shouldn't be translated in many languages actually. This name should be lower case.">
         mod3
       </message>
-      <message name="IDS_ASH_STATUS_TRAY_ACCOUNTS_TITLE" desc="The footer label of the menu which is used to manage the profile accounts.">
-        Manage accounts
-      </message>
-      <message name="IDS_ASH_STATUS_TRAY_ACCOUNT_LIST_TITLE" desc="The title label for the menu which holds the accounts list.">
-        Accounts
-      </message>
-      <message name="IDS_ASH_STATUS_TRAY_PRIMARY_ACCOUNT_LABEL" desc="The primary user account label in the accounts menu.">
-        <ph name="PRIMARY_ACCOUNT">$1<ex>test@gmail.com</ex></ph> (primary)
-      </message>
-      <message name="IDS_ASH_STATUS_TRAY_ADD_ACCOUNT_LABEL" desc="The label of the button which launches the dialog to add a new account.">
-        Add an account for <ph name="GIVEN_NAME">$1<ex>Jenn</ex></ph>
-      </message>
 
       <!-- Overview Mode -->
       <message name="IDS_ASH_OVERVIEW_BUTTON_ACCESSIBLE_NAME" desc="The accessible name for the Overview button in the system tray.">
diff --git a/ash/resources/ash_resources.grd b/ash/resources/ash_resources.grd
index 5722f8e..c160d5e 100644
--- a/ash/resources/ash_resources.grd
+++ b/ash/resources/ash_resources.grd
@@ -180,11 +180,6 @@
       <structure type="chrome_scaled_image" name="IDR_AURA_UBER_TRAY_VOLUME_LEVELS" file="cros/status/status_volume_dark.png" />
       <structure type="chrome_scaled_image" name="IDR_AURA_UBER_TRAY_VOLUME_MUTE" file="cros/status/status_volume_mute.png" />
 
-      <structure type="chrome_scaled_image" name="IDR_AURA_UBER_TRAY_ADD_PROFILE" file="cros/status/status_add_profile.png" />
-      <structure type="chrome_scaled_image" name="IDR_AURA_UBER_TRAY_ADD_PROFILE_HOVER" file="cros/status/status_add_profile_hover.png" />
-      <structure type="chrome_scaled_image" name="IDR_AURA_UBER_TRAY_REMOVE_ACCOUNT" file="cros/status/status_remove_account.png" />
-      <structure type="chrome_scaled_image" name="IDR_AURA_UBER_TRAY_REMOVE_ACCOUNT_HOVER" file="cros/status/status_remove_account_hover.png" />
-
       <structure type="chrome_scaled_image" name="IDR_AURA_WINDOW_CONTROL_BACKGROUND_H" file="common/window_control_background_hover.png" />
       <structure type="chrome_scaled_image" name="IDR_AURA_WINDOW_CONTROL_BACKGROUND_P" file="common/window_control_background_pressed.png" />
       <structure type="chrome_scaled_image" name="IDR_AURA_WINDOW_CONTROL_ICON_BACK" file="common/window_control_icon_back.png" />
diff --git a/ash/resources/default_100_percent/cros/status/status_add_profile.png b/ash/resources/default_100_percent/cros/status/status_add_profile.png
deleted file mode 100644
index 70629ee3..0000000
--- a/ash/resources/default_100_percent/cros/status/status_add_profile.png
+++ /dev/null
Binary files differ
diff --git a/ash/resources/default_100_percent/cros/status/status_add_profile_hover.png b/ash/resources/default_100_percent/cros/status/status_add_profile_hover.png
deleted file mode 100644
index 1fec1519..0000000
--- a/ash/resources/default_100_percent/cros/status/status_add_profile_hover.png
+++ /dev/null
Binary files differ
diff --git a/ash/resources/default_100_percent/cros/status/status_remove_account.png b/ash/resources/default_100_percent/cros/status/status_remove_account.png
deleted file mode 100644
index b97900b..0000000
--- a/ash/resources/default_100_percent/cros/status/status_remove_account.png
+++ /dev/null
Binary files differ
diff --git a/ash/resources/default_100_percent/cros/status/status_remove_account_hover.png b/ash/resources/default_100_percent/cros/status/status_remove_account_hover.png
deleted file mode 100644
index ba402d5..0000000
--- a/ash/resources/default_100_percent/cros/status/status_remove_account_hover.png
+++ /dev/null
Binary files differ
diff --git a/ash/resources/default_200_percent/cros/status/status_add_profile.png b/ash/resources/default_200_percent/cros/status/status_add_profile.png
deleted file mode 100644
index 59071f82..0000000
--- a/ash/resources/default_200_percent/cros/status/status_add_profile.png
+++ /dev/null
Binary files differ
diff --git a/ash/resources/default_200_percent/cros/status/status_add_profile_hover.png b/ash/resources/default_200_percent/cros/status/status_add_profile_hover.png
deleted file mode 100644
index 5486370..0000000
--- a/ash/resources/default_200_percent/cros/status/status_add_profile_hover.png
+++ /dev/null
Binary files differ
diff --git a/ash/resources/default_200_percent/cros/status/status_remove_account.png b/ash/resources/default_200_percent/cros/status/status_remove_account.png
deleted file mode 100644
index 8a0822cb..0000000
--- a/ash/resources/default_200_percent/cros/status/status_remove_account.png
+++ /dev/null
Binary files differ
diff --git a/ash/resources/default_200_percent/cros/status/status_remove_account_hover.png b/ash/resources/default_200_percent/cros/status/status_remove_account_hover.png
deleted file mode 100644
index b2ef4b6..0000000
--- a/ash/resources/default_200_percent/cros/status/status_remove_account_hover.png
+++ /dev/null
Binary files differ
diff --git a/ash/shell/shell_delegate_impl.cc b/ash/shell/shell_delegate_impl.cc
index 5677b9b..38fbe8e7 100644
--- a/ash/shell/shell_delegate_impl.cc
+++ b/ash/shell/shell_delegate_impl.cc
@@ -165,10 +165,6 @@
   return false;
 }
 
-bool ShellDelegateImpl::IsMultiAccountEnabled() const {
-  return false;
-}
-
 bool ShellDelegateImpl::CanShowWindowForUser(aura::Window* window) const {
   return true;
 }
diff --git a/ash/shell/shell_delegate_impl.h b/ash/shell/shell_delegate_impl.h
index acab404..65577c0f 100644
--- a/ash/shell/shell_delegate_impl.h
+++ b/ash/shell/shell_delegate_impl.h
@@ -31,7 +31,6 @@
   bool IsIncognitoAllowed() const override;
   bool IsMultiProfilesEnabled() const override;
   bool IsRunningInForcedAppMode() const override;
-  bool IsMultiAccountEnabled() const override;
   bool CanShowWindowForUser(aura::Window* window) const override;
   bool IsForceMaximizeOnFirstRun() const override;
   void PreInit() override;
diff --git a/ash/shell_delegate.h b/ash/shell_delegate.h
index e378e77..c66eb15 100644
--- a/ash/shell_delegate.h
+++ b/ash/shell_delegate.h
@@ -84,9 +84,6 @@
   // Returns true if we're running in forced app mode.
   virtual bool IsRunningInForcedAppMode() const = 0;
 
-  // Returns true if multi account is enabled.
-  virtual bool IsMultiAccountEnabled() const = 0;
-
   // Returns true if |window| can be shown for the delegate's concept of current
   // user.
   virtual bool CanShowWindowForUser(aura::Window* window) const = 0;
diff --git a/ash/system/chromeos/network/network_state_list_detailed_view.cc b/ash/system/chromeos/network/network_state_list_detailed_view.cc
index 858690d31..f806dcd8 100644
--- a/ash/system/chromeos/network/network_state_list_detailed_view.cc
+++ b/ash/system/chromeos/network/network_state_list_detailed_view.cc
@@ -389,6 +389,8 @@
   CreateSpecialRow(IDS_ASH_STATUS_TRAY_NETWORK, this);
 
   if (list_type_ != LIST_TYPE_VPN) {
+    NetworkStateHandler* network_state_handler =
+        NetworkHandler::Get()->network_state_handler();
     button_wifi_ = new TrayPopupHeaderButton(
         this, IDR_AURA_UBER_TRAY_WIFI_ENABLED, IDR_AURA_UBER_TRAY_WIFI_DISABLED,
         IDR_AURA_UBER_TRAY_WIFI_ENABLED_HOVER,
@@ -398,6 +400,12 @@
     button_wifi_->SetToggledTooltipText(
         l10n_util::GetStringUTF16(IDS_ASH_STATUS_TRAY_ENABLE_WIFI));
     footer()->AddButton(button_wifi_);
+    if (network_state_handler->IsTechnologyProhibited(
+            NetworkTypePattern::WiFi())) {
+      button_wifi_->SetState(views::Button::STATE_DISABLED);
+      button_wifi_->SetToggledTooltipText(l10n_util::GetStringUTF16(
+          IDS_ASH_STATUS_TRAY_NETWORK_TECHNOLOGY_ENFORCED_BY_POLICY));
+    }
 
     button_mobile_ =
         new TrayPopupHeaderButton(this, IDR_AURA_UBER_TRAY_CELLULAR_ENABLED,
@@ -409,6 +417,12 @@
         l10n_util::GetStringUTF16(IDS_ASH_STATUS_TRAY_DISABLE_MOBILE));
     button_mobile_->SetToggledTooltipText(
         l10n_util::GetStringUTF16(IDS_ASH_STATUS_TRAY_ENABLE_MOBILE));
+    if (network_state_handler->IsTechnologyProhibited(
+            NetworkTypePattern::Cellular())) {
+      button_mobile_->SetState(views::Button::STATE_DISABLED);
+      button_mobile_->SetToggledTooltipText(l10n_util::GetStringUTF16(
+          IDS_ASH_STATUS_TRAY_NETWORK_TECHNOLOGY_ENFORCED_BY_POLICY));
+    }
     footer()->AddButton(button_mobile_);
   }
 
@@ -448,6 +462,12 @@
 
     turn_on_wifi_ = new TrayPopupLabelButton(
         this, rb.GetLocalizedString(IDS_ASH_STATUS_TRAY_TURN_ON_WIFI));
+    if (NetworkHandler::Get()->network_state_handler()->IsTechnologyProhibited(
+            NetworkTypePattern::WiFi())) {
+      turn_on_wifi_->SetState(views::Button::STATE_DISABLED);
+      turn_on_wifi_->SetTooltipText(l10n_util::GetStringUTF16(
+          IDS_ASH_STATUS_TRAY_NETWORK_TECHNOLOGY_ENFORCED_BY_POLICY));
+    }
     bottom_row->AddChildView(turn_on_wifi_);
 
     other_mobile_ = new TrayPopupLabelButton(
diff --git a/ash/system/tray/system_tray_delegate.cc b/ash/system/tray/system_tray_delegate.cc
index 15e7304..a5d49b59 100644
--- a/ash/system/tray/system_tray_delegate.cc
+++ b/ash/system/tray/system_tray_delegate.cc
@@ -258,11 +258,6 @@
   return false;
 }
 
-tray::UserAccountsDelegate* SystemTrayDelegate::GetUserAccountsDelegate(
-    const AccountId& account_id) {
-  return nullptr;
-}
-
 void SystemTrayDelegate::AddCustodianInfoTrayObserver(
     CustodianInfoTrayObserver* observer) {
 }
diff --git a/ash/system/tray/system_tray_delegate.h b/ash/system/tray/system_tray_delegate.h
index 9b05286..3f84f4b 100644
--- a/ash/system/tray/system_tray_delegate.h
+++ b/ash/system/tray/system_tray_delegate.h
@@ -106,10 +106,6 @@
 
 using RebootOnShutdownCallback = base::Callback<void(bool)>;
 
-namespace tray {
-class UserAccountsDelegate;
-}  // namespace tray
-
 // SystemTrayDelegate is intended for delegating tasks in the System Tray to the
 // application (e.g. Chrome). These tasks should be limited to application
 // (browser) specific tasks. For non application specific tasks, where possible,
@@ -314,10 +310,6 @@
   // Returns true when the Search key is configured to be treated as Caps Lock.
   virtual bool IsSearchKeyMappedToCapsLock();
 
-  // Returns accounts delegate for given user. May return nullptr.
-  virtual tray::UserAccountsDelegate* GetUserAccountsDelegate(
-      const AccountId& account_id);
-
   // Adding observers that are notified when supervised info is being changed.
   virtual void AddCustodianInfoTrayObserver(
       CustodianInfoTrayObserver* observer);
diff --git a/ash/system/user/accounts_detailed_view.cc b/ash/system/user/accounts_detailed_view.cc
deleted file mode 100644
index fe41fd30..0000000
--- a/ash/system/user/accounts_detailed_view.cc
+++ /dev/null
@@ -1,230 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "ash/system/user/accounts_detailed_view.h"
-
-#include <vector>
-
-#include "ash/multi_profile_uma.h"
-#include "ash/shell.h"
-#include "ash/system/tray/fixed_sized_scroll_view.h"
-#include "ash/system/tray/hover_highlight_view.h"
-#include "ash/system/tray/system_tray.h"
-#include "ash/system/tray/system_tray_delegate.h"
-#include "ash/system/tray/tray_constants.h"
-#include "ash/system/tray/tray_popup_header_button.h"
-#include "ash/system/user/config.h"
-#include "ash/system/user/tray_user.h"
-#include "base/strings/utf_string_conversions.h"
-#include "components/user_manager/user_info.h"
-#include "grit/ash_resources.h"
-#include "grit/ash_strings.h"
-#include "ui/base/l10n/l10n_util.h"
-#include "ui/base/resource/resource_bundle.h"
-#include "ui/views/border.h"
-#include "ui/views/layout/box_layout.h"
-#include "ui/views/layout/grid_layout.h"
-
-namespace ash {
-namespace tray {
-
-namespace {
-
-const int kAccountsViewVerticalPadding = 12;
-const int kPrimaryAccountColumnSetID = 0;
-const int kSecondaryAccountColumnSetID = 1;
-const int kPaddingBetweenAccounts = 20;
-
-}  // namespace
-
-AccountsDetailedView::AccountsDetailedView(TrayUser* owner,
-                                           user::LoginStatus login_status,
-                                           UserAccountsDelegate* delegate)
-    : TrayDetailsView(owner),
-      delegate_(delegate),
-      account_list_(nullptr),
-      add_account_button_(nullptr),
-      add_user_button_(nullptr) {
-  DCHECK(delegate_);
-  delegate_->AddObserver(this);
-  AddHeader(login_status);
-  CreateScrollableList();
-  AddAccountList();
-  AddAddAccountButton();
-  AddFooter();
-}
-
-AccountsDetailedView::~AccountsDetailedView() {
-  delegate_->RemoveObserver(this);
-}
-
-void AccountsDetailedView::OnViewClicked(views::View* sender) {
-  if (sender == footer()->content())
-    TransitionToDefaultView();
-  else if (sender == add_account_button_)
-    delegate_->LaunchAddAccountDialog();
-  else
-    NOTREACHED();
-}
-
-void AccountsDetailedView::ButtonPressed(views::Button* sender,
-                                         const ui::Event& event) {
-  std::map<views::View*, std::string>::iterator it =
-      delete_button_to_account_id_.find(sender);
-  if (it != delete_button_to_account_id_.end()) {
-    delegate_->DeleteAccount(it->second);
-  } else if (add_user_button_ && add_user_button_ == sender) {
-    MultiProfileUMA::RecordSigninUser(MultiProfileUMA::SIGNIN_USER_BY_TRAY);
-    Shell::GetInstance()->system_tray_delegate()->ShowUserLogin();
-    owner()->system_tray()->CloseSystemBubble();
-  } else {
-    NOTREACHED();
-  }
-}
-
-void AccountsDetailedView::AccountListChanged() { UpdateAccountList(); }
-
-void AccountsDetailedView::AddHeader(user::LoginStatus login_status) {
-  views::View* user_view_container = new views::View;
-  user_view_container->SetLayoutManager(
-      new views::BoxLayout(views::BoxLayout::kVertical, 0, 0, 0));
-  user_view_container->SetBorder(
-      views::Border::CreateSolidSidedBorder(0, 0, 1, 0, kBorderLightColor));
-  user_view_container->AddChildView(
-      new tray::UserView(owner(), login_status, 0, true));
-  AddChildView(user_view_container);
-}
-
-void AccountsDetailedView::AddAccountList() {
-  scroll_content()->SetBorder(
-      views::Border::CreateEmptyBorder(kAccountsViewVerticalPadding,
-                                       kTrayPopupPaddingHorizontal,
-                                       kAccountsViewVerticalPadding,
-                                       kTrayPopupPaddingHorizontal));
-  views::Label* account_list_title = new views::Label(
-      l10n_util::GetStringUTF16(IDS_ASH_STATUS_TRAY_ACCOUNT_LIST_TITLE));
-  account_list_title->SetEnabledColor(SkColorSetARGB(0x7f, 0, 0, 0));
-  account_list_title->SetHorizontalAlignment(gfx::ALIGN_LEFT);
-  scroll_content()->AddChildView(account_list_title);
-  account_list_ = new views::View();
-  UpdateAccountList();
-  scroll_content()->AddChildView(account_list_);
-}
-
-void AccountsDetailedView::AddAddAccountButton() {
-  SessionStateDelegate* session_state_delegate =
-      Shell::GetInstance()->session_state_delegate();
-  HoverHighlightView* add_account_button = new HoverHighlightView(this);
-  const user_manager::UserInfo* user_info =
-      session_state_delegate->GetUserInfo(0);
-  base::string16 user_name = user_info->GetGivenName();
-  if (user_name.empty())
-    user_name = user_info->GetDisplayName();
-  if (user_name.empty())
-    user_name = base::ASCIIToUTF16(user_info->GetEmail());
-  add_account_button->AddLabel(
-      l10n_util::GetStringFUTF16(IDS_ASH_STATUS_TRAY_ADD_ACCOUNT_LABEL,
-                                 user_name),
-      gfx::ALIGN_CENTER, false /* highlight */);
-  AddChildView(add_account_button);
-  add_account_button_ = add_account_button;
-}
-
-void AccountsDetailedView::AddFooter() {
-  CreateSpecialRow(IDS_ASH_STATUS_TRAY_ACCOUNTS_TITLE, this);
-  if (!IsMultiProfileSupportedAndUserActive())
-    return;
-  TrayPopupHeaderButton* add_user_button =
-      new TrayPopupHeaderButton(this,
-                                IDR_AURA_UBER_TRAY_ADD_PROFILE,
-                                IDR_AURA_UBER_TRAY_ADD_PROFILE,
-                                IDR_AURA_UBER_TRAY_ADD_PROFILE_HOVER,
-                                IDR_AURA_UBER_TRAY_ADD_PROFILE_HOVER,
-                                IDS_ASH_STATUS_TRAY_SIGN_IN_ANOTHER_ACCOUNT);
-  add_user_button->SetTooltipText(
-      l10n_util::GetStringUTF16(IDS_ASH_STATUS_TRAY_SIGN_IN_ANOTHER_ACCOUNT));
-  footer()->AddButton(add_user_button);
-  add_user_button_ = add_user_button;
-}
-
-void AccountsDetailedView::UpdateAccountList() {
-  // Clear existing view.
-  delete_button_to_account_id_.clear();
-  account_list_->RemoveAllChildViews(true);
-
-  // Configuring layout manager.
-  views::GridLayout* layout = new views::GridLayout(account_list_);
-  account_list_->SetLayoutManager(layout);
-  views::ColumnSet* primary_account_row =
-      layout->AddColumnSet(kPrimaryAccountColumnSetID);
-  primary_account_row->AddColumn(views::GridLayout::LEADING,
-                                 views::GridLayout::CENTER,
-                                 1.0,
-                                 views::GridLayout::USE_PREF,
-                                 0,
-                                 0);
-  views::ColumnSet* secondary_account_row =
-      layout->AddColumnSet(kSecondaryAccountColumnSetID);
-  secondary_account_row->AddColumn(views::GridLayout::FILL,
-                                   views::GridLayout::CENTER,
-                                   1.0,
-                                   views::GridLayout::USE_PREF,
-                                   0,
-                                   0);
-  secondary_account_row->AddPaddingColumn(0.0, kTrayPopupPaddingBetweenItems);
-  secondary_account_row->AddColumn(views::GridLayout::FILL,
-                                   views::GridLayout::CENTER,
-                                   0.0,
-                                   views::GridLayout::USE_PREF,
-                                   0,
-                                   0);
-
-  // Adding primary account.
-  layout->AddPaddingRow(0.0, kPaddingBetweenAccounts);
-  layout->StartRow(0.0, kPrimaryAccountColumnSetID);
-  const std::string& primary_account = delegate_->GetPrimaryAccountId();
-  views::Label* primary_account_label =
-      new views::Label(l10n_util::GetStringFUTF16(
-          IDS_ASH_STATUS_TRAY_PRIMARY_ACCOUNT_LABEL,
-          base::ASCIIToUTF16(
-              delegate_->GetAccountDisplayName(primary_account))));
-  layout->AddView(primary_account_label);
-
-  // Adding secondary accounts.
-  const std::vector<std::string>& secondary_accounts =
-      delegate_->GetSecondaryAccountIds();
-  for (size_t i = 0; i < secondary_accounts.size(); ++i) {
-    layout->AddPaddingRow(0.0, kPaddingBetweenAccounts);
-    layout->StartRow(0.0, kSecondaryAccountColumnSetID);
-    const std::string& account_id = secondary_accounts[i];
-    views::Label* account_label = new views::Label(
-        base::ASCIIToUTF16(delegate_->GetAccountDisplayName(account_id)));
-    account_label->SetHorizontalAlignment(gfx::ALIGN_LEFT);
-    layout->AddView(account_label);
-    views::View* delete_button = CreateDeleteButton();
-    delete_button_to_account_id_[delete_button] = account_id;
-    layout->AddView(delete_button);
-  }
-
-  scroll_content()->SizeToPreferredSize();
-  scroller()->Layout();
-}
-
-views::View* AccountsDetailedView::CreateDeleteButton() {
-  ui::ResourceBundle& rb = ui::ResourceBundle::GetSharedInstance();
-  views::ImageButton* delete_button = new views::ImageButton(this);
-  delete_button->SetImage(
-      views::Button::STATE_NORMAL,
-      rb.GetImageNamed(IDR_AURA_UBER_TRAY_REMOVE_ACCOUNT).ToImageSkia());
-  delete_button->SetImage(
-      views::Button::STATE_HOVERED,
-      rb.GetImageNamed(IDR_AURA_UBER_TRAY_REMOVE_ACCOUNT_HOVER).ToImageSkia());
-  delete_button->SetImage(
-      views::Button::STATE_PRESSED,
-      rb.GetImageNamed(IDR_AURA_UBER_TRAY_REMOVE_ACCOUNT_HOVER).ToImageSkia());
-  return delete_button;
-}
-
-}  // namespace tray
-}  // namespace ash
diff --git a/ash/system/user/accounts_detailed_view.h b/ash/system/user/accounts_detailed_view.h
deleted file mode 100644
index 8b6f8f3..0000000
--- a/ash/system/user/accounts_detailed_view.h
+++ /dev/null
@@ -1,69 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef ASH_SYSTEM_USER_ACCOUNTS_DETAILED_VIEW_H_
-#define ASH_SYSTEM_USER_ACCOUNTS_DETAILED_VIEW_H_
-
-#include <map>
-#include <string>
-
-#include "ash/system/tray/tray_details_view.h"
-#include "ash/system/tray/view_click_listener.h"
-#include "ash/system/user/login_status.h"
-#include "ash/system/user/user_accounts_delegate.h"
-#include "ash/system/user/user_view.h"
-#include "base/macros.h"
-#include "ui/views/controls/button/button.h"
-#include "ui/views/controls/label.h"
-
-namespace ash {
-
-class TrayUser;
-
-namespace tray {
-
-// This detailed view appears after a click on the primary user's card when the
-// new account managment is enabled.
-class AccountsDetailedView : public TrayDetailsView,
-                             public ViewClickListener,
-                             public views::ButtonListener,
-                             public ash::tray::UserAccountsDelegate::Observer {
- public:
-  AccountsDetailedView(TrayUser* owner,
-                       user::LoginStatus login_status,
-                       UserAccountsDelegate* delegate);
-  ~AccountsDetailedView() override;
-
- private:
-  // Overridden from ViewClickListener.
-  void OnViewClicked(views::View* sender) override;
-
-  // Overridden from views::ButtonListener.
-  void ButtonPressed(views::Button* sender, const ui::Event& event) override;
-
-  // Overridden from ash::tray::UserAccountsDelegate::Observer.
-  void AccountListChanged() override;
-
-  void AddHeader(user::LoginStatus login_status);
-  void AddAccountList();
-  void AddAddAccountButton();
-  void AddFooter();
-
-  void UpdateAccountList();
-
-  views::View* CreateDeleteButton();
-
-  UserAccountsDelegate* delegate_;
-  views::View* account_list_;
-  views::View* add_account_button_;
-  views::View* add_user_button_;
-  std::map<views::View*, std::string> delete_button_to_account_id_;
-
-  DISALLOW_COPY_AND_ASSIGN(AccountsDetailedView);
-};
-
-}  // namespace tray
-}  // namespace ash
-
-#endif  // ASH_SYSTEM_USER_ACCOUNTS_DETAILED_VIEW_H_
diff --git a/ash/system/user/config.cc b/ash/system/user/config.cc
deleted file mode 100644
index 1ea6d32d..0000000
--- a/ash/system/user/config.cc
+++ /dev/null
@@ -1,36 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "ash/system/user/config.h"
-
-#include "ash/session/session_state_delegate.h"
-#include "ash/shell.h"
-#include "ash/shell_delegate.h"
-
-namespace ash {
-namespace tray {
-
-namespace {
-
-// Returns true if session is blocked by e.g. the login screen.
-bool IsUserSessionBlocked() {
-  return Shell::GetInstance()
-             ->session_state_delegate()
-             ->IsUserSessionBlocked();
-}
-
-}  // namespace
-
-bool IsMultiProfileSupportedAndUserActive() {
-  return Shell::GetInstance()->delegate()->IsMultiProfilesEnabled() &&
-         !IsUserSessionBlocked();
-}
-
-bool IsMultiAccountSupportedAndUserActive() {
-  return Shell::GetInstance()->delegate()->IsMultiAccountEnabled() &&
-         !IsUserSessionBlocked();
-}
-
-}  // namespace tray
-}  // namespace ash
diff --git a/ash/system/user/config.h b/ash/system/user/config.h
deleted file mode 100644
index c3676e4e..0000000
--- a/ash/system/user/config.h
+++ /dev/null
@@ -1,22 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef ASH_SYSTEM_USER_CONFIG_H_
-#define ASH_SYSTEM_USER_CONFIG_H_
-
-#include "base/macros.h"
-
-namespace ash {
-namespace tray {
-
-// Returns true when multi profile is supported and user is active.
-bool IsMultiProfileSupportedAndUserActive();
-
-// Returns true when multi account is supported and user is active.
-bool IsMultiAccountSupportedAndUserActive();
-
-}  // namespace tray
-}  // namespace ash
-
-#endif  // ASH_SYSTEM_USER_CONFIG_H_
diff --git a/ash/system/user/tray_user.cc b/ash/system/user/tray_user.cc
index e947641..7d988e0 100644
--- a/ash/system/user/tray_user.cc
+++ b/ash/system/user/tray_user.cc
@@ -15,7 +15,6 @@
 #include "ash/system/tray/tray_constants.h"
 #include "ash/system/tray/tray_item_view.h"
 #include "ash/system/tray/tray_utils.h"
-#include "ash/system/user/accounts_detailed_view.h"
 #include "ash/system/user/rounded_image_view.h"
 #include "ash/system/user/user_view.h"
 #include "base/logging.h"
@@ -108,23 +107,10 @@
   if (user_index_ >= logged_in_users)
     return nullptr;
 
-  user_ = new tray::UserView(this, status, user_index_, false);
+  user_ = new tray::UserView(this, status, user_index_);
   return user_;
 }
 
-views::View* TrayUser::CreateDetailedView(user::LoginStatus status) {
-  const AccountId account_id = Shell::GetInstance()
-                                   ->session_state_delegate()
-                                   ->GetUserInfo(0)
-                                   ->GetAccountId();
-  tray::UserAccountsDelegate* delegate =
-      Shell::GetInstance()->system_tray_delegate()->GetUserAccountsDelegate(
-          account_id);
-  if (!delegate)
-    return nullptr;
-  return new tray::AccountsDetailedView(this, status, delegate);
-}
-
 void TrayUser::DestroyTrayView() {
   layout_view_ = nullptr;
   avatar_ = nullptr;
@@ -135,9 +121,6 @@
   user_ = nullptr;
 }
 
-void TrayUser::DestroyDetailedView() {
-}
-
 void TrayUser::UpdateAfterLoginStatusChange(user::LoginStatus status) {
   // Only the active user is represented in the tray.
   if (!layout_view_)
diff --git a/ash/system/user/tray_user.h b/ash/system/user/tray_user.h
index f13005c..bbbb5a7 100644
--- a/ash/system/user/tray_user.h
+++ b/ash/system/user/tray_user.h
@@ -65,10 +65,8 @@
   // Overridden from SystemTrayItem.
   views::View* CreateTrayView(user::LoginStatus status) override;
   views::View* CreateDefaultView(user::LoginStatus status) override;
-  views::View* CreateDetailedView(user::LoginStatus status) override;
   void DestroyTrayView() override;
   void DestroyDefaultView() override;
-  void DestroyDetailedView() override;
   void UpdateAfterLoginStatusChange(user::LoginStatus status) override;
   void UpdateAfterShelfAlignmentChange(ShelfAlignment alignment) override;
 
diff --git a/ash/system/user/user_accounts_delegate.cc b/ash/system/user/user_accounts_delegate.cc
deleted file mode 100644
index 2e29a9b..0000000
--- a/ash/system/user/user_accounts_delegate.cc
+++ /dev/null
@@ -1,27 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "ash/system/user/user_accounts_delegate.h"
-
-namespace ash {
-namespace tray {
-
-UserAccountsDelegate::UserAccountsDelegate() {}
-
-UserAccountsDelegate::~UserAccountsDelegate() {}
-
-void UserAccountsDelegate::AddObserver(Observer* observer) {
-  observers_.AddObserver(observer);
-}
-
-void UserAccountsDelegate::RemoveObserver(Observer* observer) {
-  observers_.RemoveObserver(observer);
-}
-
-void UserAccountsDelegate::NotifyAccountListChanged() {
-  FOR_EACH_OBSERVER(Observer, observers_, AccountListChanged());
-}
-
-}  // namespace tray
-}  // namespace ash
diff --git a/ash/system/user/user_accounts_delegate.h b/ash/system/user/user_accounts_delegate.h
deleted file mode 100644
index e25e2914..0000000
--- a/ash/system/user/user_accounts_delegate.h
+++ /dev/null
@@ -1,66 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef ASH_SYSTEM_USER_USER_ACCOUNTS_DELEGATE_H_
-#define ASH_SYSTEM_USER_USER_ACCOUNTS_DELEGATE_H_
-
-#include <string>
-#include <vector>
-
-#include "ash/ash_export.h"
-#include "base/macros.h"
-#include "base/observer_list.h"
-
-namespace ash {
-namespace tray {
-
-class ASH_EXPORT UserAccountsDelegate {
- public:
-  class Observer {
-   public:
-    Observer() {}
-    virtual ~Observer() {}
-
-    // Called when the account list of user has been changed.
-    virtual void AccountListChanged() = 0;
-
-   private:
-    DISALLOW_COPY_AND_ASSIGN(Observer);
-  };
-
-  UserAccountsDelegate();
-  virtual ~UserAccountsDelegate();
-
-  void AddObserver(Observer* observer);
-  void RemoveObserver(Observer* observer);
-
-  // Returns the user's primary account's ID.
-  virtual std::string GetPrimaryAccountId() = 0;
-
-  // Returns a list of the user's secondary accounts' IDs.
-  virtual std::vector<std::string> GetSecondaryAccountIds() = 0;
-
-  // Returns display name for given |account_id|.
-  virtual std::string GetAccountDisplayName(const std::string& account_id) = 0;
-
-  // Deletes given |account_id| from the list of user's account. Passing
-  // |account_id| that is not from list is no-op.
-  virtual void DeleteAccount(const std::string& account_id) = 0;
-
-  // Launches a dialog which lets the user add a new account.
-  virtual void LaunchAddAccountDialog() = 0;
-
- protected:
-  void NotifyAccountListChanged();
-
- private:
-  base::ObserverList<Observer> observers_;
-
-  DISALLOW_COPY_AND_ASSIGN(UserAccountsDelegate);
-};
-
-}  // namespace tray
-}  // namespace ash
-
-#endif  // ASH_SYSTEM_USER_USER_ACCOUNTS_DELEGATE_H_
diff --git a/ash/system/user/user_card_view.cc b/ash/system/user/user_card_view.cc
index 6ce0c18..a0eaeeb 100644
--- a/ash/system/user/user_card_view.cc
+++ b/ash/system/user/user_card_view.cc
@@ -13,7 +13,6 @@
 #include "ash/system/tray/system_tray_notifier.h"
 #include "ash/system/tray/tray_constants.h"
 #include "ash/system/tray/tray_utils.h"
-#include "ash/system/user/config.h"
 #include "ash/system/user/rounded_image_view.h"
 #include "base/i18n/rtl.h"
 #include "base/memory/scoped_vector.h"
@@ -375,9 +374,6 @@
         login_status == user::LOGGED_IN_GUEST
             ? l10n_util::GetStringUTF16(IDS_ASH_STATUS_TRAY_GUEST_LABEL)
             : delegate->GetUserInfo(user_index)->GetDisplayName();
-    if (user_name_string.empty() && IsMultiAccountSupportedAndUserActive())
-      user_name_string =
-          base::ASCIIToUTF16(delegate->GetUserInfo(user_index)->GetEmail());
     if (!user_name_string.empty()) {
       user_name = new views::Label(user_name_string);
       user_name->SetHorizontalAlignment(gfx::ALIGN_LEFT);
@@ -385,8 +381,7 @@
   }
 
   views::Label* user_email = NULL;
-  if (login_status != user::LOGGED_IN_GUEST &&
-      (user_index || !IsMultiAccountSupportedAndUserActive())) {
+  if (login_status != user::LOGGED_IN_GUEST) {
     SystemTrayDelegate* tray_delegate =
         Shell::GetInstance()->system_tray_delegate();
     base::string16 user_email_string =
diff --git a/ash/system/user/user_view.cc b/ash/system/user/user_view.cc
index 1b65bd5..4d1b538 100644
--- a/ash/system/user/user_view.cc
+++ b/ash/system/user/user_view.cc
@@ -16,7 +16,6 @@
 #include "ash/system/tray/tray_popup_label_button.h"
 #include "ash/system/tray/tray_popup_label_button_border.h"
 #include "ash/system/user/button_from_view.h"
-#include "ash/system/user/config.h"
 #include "ash/system/user/rounded_image_view.h"
 #include "ash/system/user/user_card_view.h"
 #include "components/signin/core/account_id/account_id.h"
@@ -81,24 +80,11 @@
   delegate->SwitchActiveUser(delegate->GetUserInfo(user_index)->GetAccountId());
 }
 
-class LogoutButton : public TrayPopupLabelButton {
- public:
-  // If |placeholder| is true, button is used as placeholder. That means that
-  // button is inactive and is not painted, but consume the same ammount of
-  // space, as if it was painted.
-  LogoutButton(views::ButtonListener* listener,
-               const base::string16& text,
-               bool placeholder)
-      : TrayPopupLabelButton(listener, text), placeholder_(placeholder) {
-    SetVisible(!placeholder_);
-  }
-
-  ~LogoutButton() override {}
-
- private:
-  bool placeholder_;
-  DISALLOW_COPY_AND_ASSIGN(LogoutButton);
-};
+bool IsMultiProfileSupportedAndUserActive() {
+  auto* shell = Shell::GetInstance();
+  return shell->delegate()->IsMultiProfilesEnabled() &&
+         !shell->session_state_delegate()->IsUserSessionBlocked();
+}
 
 class UserViewMouseWatcherHost : public views::MouseWatcherHost {
  public:
@@ -194,15 +180,13 @@
 
 UserView::UserView(SystemTrayItem* owner,
                    user::LoginStatus login,
-                   UserIndex index,
-                   bool for_detailed_view)
+                   UserIndex index)
     : user_index_(index),
       user_card_view_(NULL),
       owner_(owner),
       is_user_card_button_(false),
       logout_button_(NULL),
       add_user_enabled_(true),
-      for_detailed_view_(for_detailed_view),
       focus_manager_(NULL) {
   CHECK_NE(user::LOGGED_IN_NONE, login);
   if (!index) {
@@ -273,10 +257,9 @@
     // Give the remaining space to the user card.
     gfx::Rect user_card_area = contents_area;
     int remaining_width = contents_area.width() - logout_area.width();
-    if (IsMultiProfileSupportedAndUserActive() ||
-        IsMultiAccountSupportedAndUserActive()) {
-      // In multiprofile/multiaccount case |user_card_view_| and
-      // |logout_button_| have to have the same height.
+    if (IsMultiProfileSupportedAndUserActive()) {
+      // In multiprofile case |user_card_view_| and |logout_button_| have to
+      // have the same height.
       int y = std::min(user_card_area.y(), logout_area.y());
       int height = std::max(user_card_area.height(), logout_area.height());
       logout_area.set_y(y);
@@ -314,9 +297,6 @@
         ash::UMA_STATUS_AREA_SIGN_OUT);
     RemoveAddUserMenuOption();
     Shell::GetInstance()->system_tray_delegate()->SignOut();
-  } else if (sender == user_card_view_ && !user_index_ &&
-             IsMultiAccountSupportedAndUserActive()) {
-    owner_->TransitionDetailedView();
   } else if (sender == user_card_view_ &&
              IsMultiProfileSupportedAndUserActive()) {
     if (!user_index_) {
@@ -352,8 +332,7 @@
 void UserView::AddLogoutButton(user::LoginStatus login) {
   const base::string16 title =
       user::GetLocalizedSignOutStringForStatus(login, true);
-  TrayPopupLabelButton* logout_button =
-      new LogoutButton(this, title, for_detailed_view_);
+  auto* logout_button = new TrayPopupLabelButton(this, title);
   logout_button->SetAccessibleName(title);
   logout_button_ = logout_button;
   // In public account mode, the logout button border has a custom color.
@@ -392,11 +371,10 @@
   if (logout_button_)
     max_card_width -= logout_button_->GetPreferredSize().width();
   user_card_view_ = new UserCardView(login, max_card_width, user_index_);
-  // The entry is clickable when no system modal dialog is open and one of the
-  // multi user options is active.
+  // The entry is clickable when no system modal dialog is open and the multi
+  // profile option is active.
   bool clickable = !Shell::GetInstance()->IsSystemModalWindowOpen() &&
-                   (IsMultiProfileSupportedAndUserActive() ||
-                    IsMultiAccountSupportedAndUserActive());
+                   IsMultiProfileSupportedAndUserActive();
   if (clickable) {
     // To allow the border to start before the icon, reduce the size before and
     // add an inset to the icon to get the spacing.
@@ -411,30 +389,21 @@
     }
     gfx::Insets insets = gfx::Insets(1, 1, 1, 1);
     views::View* contents_view = user_card_view_;
-    ButtonFromView* button = NULL;
-    if (!for_detailed_view_) {
-      if (user_index_) {
-        // Since the activation border needs to be drawn around the tile, we
-        // have to put the tile into another view which fills the menu panel,
-        // but keeping the offsets of the content.
-        contents_view = new views::View();
-        contents_view->SetBorder(views::Border::CreateEmptyBorder(
-            kTrayPopupUserCardVerticalPadding,
-            kTrayPopupPaddingHorizontal,
-            kTrayPopupUserCardVerticalPadding,
-            kTrayPopupPaddingHorizontal));
-        contents_view->SetLayoutManager(new views::FillLayout());
-        SetBorder(views::Border::CreateEmptyBorder(0, 0, 0, 0));
-        contents_view->AddChildView(user_card_view_);
-        insets = gfx::Insets(1, 1, 1, 3);
-      }
-      button = new ButtonFromView(contents_view, this, !user_index_, insets);
-    } else {
-      // We want user card for detailed view to have exactly the same look
-      // as user card for default view. That's why we wrap it in a button
-      // without click listener and special hover behavior.
-      button = new ButtonFromView(contents_view, NULL, false, insets);
+    if (user_index_) {
+      // Since the activation border needs to be drawn around the tile, we
+      // have to put the tile into another view which fills the menu panel,
+      // but keeping the offsets of the content.
+      contents_view = new views::View();
+      contents_view->SetBorder(views::Border::CreateEmptyBorder(
+          kTrayPopupUserCardVerticalPadding, kTrayPopupPaddingHorizontal,
+          kTrayPopupUserCardVerticalPadding, kTrayPopupPaddingHorizontal));
+      contents_view->SetLayoutManager(new views::FillLayout());
+      SetBorder(views::Border::CreateEmptyBorder(0, 0, 0, 0));
+      contents_view->AddChildView(user_card_view_);
+      insets = gfx::Insets(1, 1, 1, 3);
     }
+    auto* button =
+        new ButtonFromView(contents_view, this, !user_index_, insets);
     // A click on the button should not trigger a focus change.
     button->set_request_focus_on_press(false);
     user_card_view_ = button;
diff --git a/ash/system/user/user_view.h b/ash/system/user/user_view.h
index 562ce67..b258d03 100644
--- a/ash/system/user/user_view.h
+++ b/ash/system/user/user_view.h
@@ -40,8 +40,7 @@
  public:
   UserView(SystemTrayItem* owner,
            ash::user::LoginStatus login,
-           UserIndex index,
-           bool for_detailed_view);
+           UserIndex index);
   ~UserView() override;
 
   // Overridden from MouseWatcherListener:
@@ -93,9 +92,6 @@
   // False when the add user panel is visible but not activatable.
   bool add_user_enabled_;
 
-  // True if this view will be used inside detailed view.
-  bool for_detailed_view_;
-
   // The mouse watcher which takes care of out of window hover events.
   scoped_ptr<views::MouseWatcher> mouse_watcher_;
 
diff --git a/ash/test/test_shell_delegate.cc b/ash/test/test_shell_delegate.cc
index d601cde0..08c7219 100644
--- a/ash/test/test_shell_delegate.cc
+++ b/ash/test/test_shell_delegate.cc
@@ -108,10 +108,6 @@
   return false;
 }
 
-bool TestShellDelegate::IsMultiAccountEnabled() const {
-  return false;
-}
-
 bool TestShellDelegate::CanShowWindowForUser(aura::Window* window) const {
   return true;
 }
diff --git a/ash/test/test_shell_delegate.h b/ash/test/test_shell_delegate.h
index 3bf7cef2..2377fdf 100644
--- a/ash/test/test_shell_delegate.h
+++ b/ash/test/test_shell_delegate.h
@@ -35,7 +35,6 @@
   bool IsIncognitoAllowed() const override;
   bool IsMultiProfilesEnabled() const override;
   bool IsRunningInForcedAppMode() const override;
-  bool IsMultiAccountEnabled() const override;
   bool CanShowWindowForUser(aura::Window* window) const override;
   bool IsForceMaximizeOnFirstRun() const override;
   void PreInit() override;
diff --git a/base/memory/linked_ptr.h b/base/memory/linked_ptr.h
index 80044ad..649dc10 100644
--- a/base/memory/linked_ptr.h
+++ b/base/memory/linked_ptr.h
@@ -17,10 +17,6 @@
 //   If a linked_ptr<> is converted to a raw pointer and back, BAD THINGS
 //   will happen (double deletion).
 //
-// A good use of this class is storing object references in STL containers.
-// You can safely put linked_ptr<> in a vector<>.
-// Other uses may not be as good.
-//
 // Note: If you use an incomplete type with linked_ptr<>, the class
 // *containing* linked_ptr<> must have a constructor and destructor (even
 // if they do nothing!).
@@ -73,6 +69,8 @@
   mutable linked_ptr_internal const* next_;
 };
 
+// TODO(http://crbug.com/556939): DEPRECATED: Use scoped_ptr instead (now that
+// we have support for moveable types inside STL containers).
 template <typename T>
 class linked_ptr {
  public:
diff --git a/base/memory/shared_memory_mac.cc b/base/memory/shared_memory_mac.cc
index 03c9a6c..61ebf89 100644
--- a/base/memory/shared_memory_mac.cc
+++ b/base/memory/shared_memory_mac.cc
@@ -368,15 +368,17 @@
   switch (mapped_memory_mechanism_) {
     case SharedMemoryHandle::POSIX:
       munmap(memory_, mapped_size_);
-      memory_ = NULL;
-      mapped_size_ = 0;
-      return true;
+      break;
     case SharedMemoryHandle::MACH:
       mach_vm_deallocate(mach_task_self(),
                          reinterpret_cast<mach_vm_address_t>(memory_),
                          mapped_size_);
-      return true;
+      break;
   }
+
+  memory_ = NULL;
+  mapped_size_ = 0;
+  return true;
 }
 
 SharedMemoryHandle SharedMemory::handle() const {
diff --git a/base/memory/shared_memory_mac_unittest.cc b/base/memory/shared_memory_mac_unittest.cc
index 097d1b32..fcc38bf 100644
--- a/base/memory/shared_memory_mac_unittest.cc
+++ b/base/memory/shared_memory_mac_unittest.cc
@@ -337,6 +337,21 @@
   EXPECT_EQ(active_name_count, GetActiveNameCount());
 }
 
+// Tests that Mach shared memory can be mapped and unmapped.
+TEST_F(SharedMemoryMacMultiProcessTest, MachUnmapMap) {
+  // Mach-based SharedMemory isn't support on OSX 10.6.
+  if (mac::IsOSSnowLeopard())
+    return;
+
+  mach_msg_type_number_t active_name_count = GetActiveNameCount();
+
+  scoped_ptr<SharedMemory> shared_memory = CreateSharedMemory(s_memory_size);
+  ASSERT_TRUE(shared_memory->Unmap());
+  ASSERT_TRUE(shared_memory->Map(s_memory_size));
+  shared_memory.reset();
+  EXPECT_EQ(active_name_count, GetActiveNameCount());
+}
+
 // Tests that passing a SharedMemoryHandle to a SharedMemory object also passes
 // ownership, and that destroying the SharedMemory closes the SharedMemoryHandle
 // as well.
diff --git a/base/strings/string_util.cc b/base/strings/string_util.cc
index a978891..731a77d 100644
--- a/base/strings/string_util.cc
+++ b/base/strings/string_util.cc
@@ -99,18 +99,6 @@
 };
 #endif  // WCHAR_T_IS_UTF32
 
-// DO NOT USE. http://crbug.com/24917
-//
-// tolower() will given incorrect results for non-ASCII characters. Use the
-// ASCII version, base::i18n::ToLower, or base::i18n::FoldCase. This is here
-// for backwards-compat for StartsWith until such calls can be updated.
-struct CaseInsensitiveCompareDeprecated {
- public:
-  bool operator()(char16 x, char16 y) const {
-    return tolower(x) == tolower(y);
-  }
-};
-
 }  // namespace
 
 bool IsWprintfFormatPortable(const wchar_t* format) {
diff --git a/base/test/android/javatests/src/org/chromium/base/test/util/parameter/Parameter.java b/base/test/android/javatests/src/org/chromium/base/test/util/parameter/Parameter.java
index 9d27f93..0d122d20 100644
--- a/base/test/android/javatests/src/org/chromium/base/test/util/parameter/Parameter.java
+++ b/base/test/android/javatests/src/org/chromium/base/test/util/parameter/Parameter.java
@@ -6,8 +6,10 @@
 
 import junit.framework.TestCase;
 
+import java.lang.annotation.Annotation;
 import java.lang.reflect.AnnotatedElement;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Collections;
 import java.util.List;
 
@@ -46,7 +48,7 @@
      * The tool to read Parameter related annotations.
      */
     class Reader {
-        private AnnotatedElement mAnnotatedTestClass;
+        private Class mAnnotatedTestClass;
         private AnnotatedElement mAnnotatedTestMethod;
         private ParameterizedTest mParameterizedTest;
 
@@ -65,22 +67,52 @@
          * @return a list of all the {@link ParameterizedTest}s for the current test.
          */
         public List<ParameterizedTest> getParameterizedTests() {
-            List<ParameterizedTest> parameterizedTests = new ArrayList<>();
-            if (mAnnotatedTestClass.isAnnotationPresent(ParameterizedTest.Set.class)) {
-                Collections.addAll(parameterizedTests,
-                        getParameterizedTestSet(mAnnotatedTestClass).tests());
-            } else if (mAnnotatedTestClass.isAnnotationPresent(ParameterizedTest.class)) {
-                parameterizedTests.add(getParameterizedTest(mAnnotatedTestClass));
-            }
-            if (mAnnotatedTestMethod.isAnnotationPresent(ParameterizedTest.Set.class)) {
-                Collections.addAll(parameterizedTests,
-                        getParameterizedTestSet(mAnnotatedTestMethod).tests());
-            } else if (mAnnotatedTestMethod.isAnnotationPresent(ParameterizedTest.class)) {
-                parameterizedTests.add(getParameterizedTest(mAnnotatedTestMethod));
-            }
-            return parameterizedTests;
+            return new ArrayList<ParameterizedTest>(getParameterizedTestsImpl());
         }
 
+        /**
+         * Gets the {@link ParameterizedTest}s for the current test as immutable list.
+         *
+         * @return a list of all the {@link ParameterizedTest}s for the current test.
+         */
+        private List<ParameterizedTest> getParameterizedTestsImpl() {
+            // Note: this must be aligned with Python code in
+            // instrumentation_test_instance.ParseCommandLineFlagParameters (regarding priority of
+            // ParameterizedTest.Set vs. ParameterizedTest) and in test_jar._GetProguardData
+            // (regarding composition of method annotations with class and superclasses
+            // annotations). Composition precedes selecting the annotation to process.
+            if (mAnnotatedTestMethod.isAnnotationPresent(ParameterizedTest.Set.class)) {
+                return Arrays.asList(getParameterizedTestSet(mAnnotatedTestMethod).tests());
+            }
+            AnnotatedElement classWithAnnotation = findClassWithAnnotation(
+                    mAnnotatedTestClass, ParameterizedTest.Set.class);
+            if (classWithAnnotation != null) {
+                return Arrays.asList(getParameterizedTestSet(classWithAnnotation).tests());
+            }
+            if (mAnnotatedTestMethod.isAnnotationPresent(ParameterizedTest.class)) {
+                return Collections.singletonList(getParameterizedTest(mAnnotatedTestMethod));
+            }
+            classWithAnnotation = findClassWithAnnotation(
+                    mAnnotatedTestClass, ParameterizedTest.class);
+            if (classWithAnnotation != null) {
+                return Collections.singletonList(getParameterizedTest(classWithAnnotation));
+            }
+            return Collections.emptyList();
+        }
+
+        /**
+         * Finds a class with the given annotation class starting from the given clazz.
+         *
+         * @return the class as {@link AnnotatedElement} or null if the class is not found.
+         */
+        private AnnotatedElement findClassWithAnnotation(
+                Class<?> clazz, Class<? extends Annotation> annotationClass) {
+            if (clazz == null || clazz.isAnnotationPresent(annotationClass)) {
+                return clazz;
+            } else {
+                return findClassWithAnnotation(clazz.getSuperclass(), annotationClass);
+            }
+        }
 
         /**
          * Gets the {@link ParameterizedTest} annotation of the current test.
@@ -101,10 +133,12 @@
         }
 
         public boolean isParameterizedTest() {
-            return mAnnotatedTestClass.isAnnotationPresent(ParameterizedTest.class)
-                    || mAnnotatedTestClass.isAnnotationPresent(ParameterizedTest.Set.class)
+            return mAnnotatedTestMethod.isAnnotationPresent(ParameterizedTest.Set.class)
                     || mAnnotatedTestMethod.isAnnotationPresent(ParameterizedTest.class)
-                    || mAnnotatedTestMethod.isAnnotationPresent(ParameterizedTest.Set.class);
+                    || findClassWithAnnotation(
+                            mAnnotatedTestClass, ParameterizedTest.Set.class) != null
+                    || findClassWithAnnotation(
+                            mAnnotatedTestClass, ParameterizedTest.class) != null;
         }
 
         public void setCurrentParameterizedTest(ParameterizedTest parameterizedTest) {
diff --git a/blimp/net/BUILD.gn b/blimp/net/BUILD.gn
index 4635fe7..cc0263e 100644
--- a/blimp/net/BUILD.gn
+++ b/blimp/net/BUILD.gn
@@ -14,6 +14,8 @@
     "blimp_message_output_buffer.cc",
     "blimp_message_output_buffer.h",
     "blimp_message_processor.h",
+    "blimp_message_pump.cc",
+    "blimp_message_pump.h",
     "blimp_message_receiver.h",
     "blimp_net_export.h",
     "blimp_transport.h",
@@ -21,6 +23,7 @@
     "client_connection_manager.h",
     "common.cc",
     "common.h",
+    "connection_error_observer.h",
     "connection_handler.h",
     "engine_connection_manager.cc",
     "engine_connection_manager.h",
@@ -51,6 +54,7 @@
   sources = [
     "blimp_message_demultiplexer_unittest.cc",
     "blimp_message_multiplexer_unittest.cc",
+    "blimp_message_pump_unittest.cc",
     "stream_packet_reader_unittest.cc",
     "stream_packet_writer_unittest.cc",
     "tcp_transport_unittest.cc",
diff --git a/blimp/net/blimp_connection.cc b/blimp/net/blimp_connection.cc
index 5b9c917..e9fc41ec 100644
--- a/blimp/net/blimp_connection.cc
+++ b/blimp/net/blimp_connection.cc
@@ -5,6 +5,9 @@
 #include "blimp/net/blimp_connection.h"
 
 #include "base/macros.h"
+#include "blimp/net/blimp_message_processor.h"
+#include "blimp/net/blimp_message_pump.h"
+#include "blimp/net/connection_error_observer.h"
 #include "blimp/net/packet_reader.h"
 #include "blimp/net/packet_writer.h"
 
@@ -12,11 +15,22 @@
 
 BlimpConnection::BlimpConnection(scoped_ptr<PacketReader> reader,
                                  scoped_ptr<PacketWriter> writer)
-    : reader_(reader.Pass()), writer_(writer.Pass()) {
-  DCHECK(reader_);
+    : reader_(reader.Pass()),
+      message_pump_(new BlimpMessagePump(reader_.get())),
+      writer_(writer.Pass()) {
   DCHECK(writer_);
 }
 
 BlimpConnection::~BlimpConnection() {}
 
+void BlimpConnection::SetConnectionErrorObserver(
+    ConnectionErrorObserver* observer) {
+  message_pump_->set_error_observer(observer);
+}
+
+void BlimpConnection::SetIncomingMessageProcessor(
+    BlimpMessageProcessor* processor) {
+  message_pump_->SetMessageProcessor(processor);
+}
+
 }  // namespace blimp
diff --git a/blimp/net/blimp_connection.h b/blimp/net/blimp_connection.h
index 38961e6a..a48521ad 100644
--- a/blimp/net/blimp_connection.h
+++ b/blimp/net/blimp_connection.h
@@ -12,6 +12,8 @@
 namespace blimp {
 
 class BlimpMessageProcessor;
+class BlimpMessagePump;
+class ConnectionErrorObserver;
 class PacketReader;
 class PacketWriter;
 
@@ -19,29 +21,25 @@
 // a network connection.
 class BLIMP_NET_EXPORT BlimpConnection {
  public:
-  class DisconnectObserver {
-    // Called when the network connection for |this| is disconnected.
-    virtual void OnDisconnected() = 0;
-  };
-
   BlimpConnection(scoped_ptr<PacketReader> reader,
                   scoped_ptr<PacketWriter> writer);
 
   virtual ~BlimpConnection();
 
-  // Lets |observer| know when the network connection is terminated.
-  void AddDisconnectObserver(DisconnectObserver* observer);
+  // Lets |observer| know when the network connection encounters an error.
+  void SetConnectionErrorObserver(ConnectionErrorObserver* observer);
 
   // Sets the processor which will take incoming messages for this connection.
   // Can be set multiple times, but previously set processors are discarded.
-  void set_incoming_message_processor(
-      scoped_ptr<BlimpMessageProcessor> processor);
+  // Caller retains the ownership of |processor|.
+  void SetIncomingMessageProcessor(BlimpMessageProcessor* processor);
 
   // Gets a processor for BrowserSession->BlimpConnection message routing.
   scoped_ptr<BlimpMessageProcessor> take_outgoing_message_processor() const;
 
  private:
   scoped_ptr<PacketReader> reader_;
+  scoped_ptr<BlimpMessagePump> message_pump_;
   scoped_ptr<PacketWriter> writer_;
 
   DISALLOW_COPY_AND_ASSIGN(BlimpConnection);
diff --git a/blimp/net/blimp_message_pump.cc b/blimp/net/blimp_message_pump.cc
new file mode 100644
index 0000000..14d8d2e
--- /dev/null
+++ b/blimp/net/blimp_message_pump.cc
@@ -0,0 +1,76 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "blimp/net/blimp_message_pump.h"
+
+#include "base/macros.h"
+#include "blimp/common/proto/blimp_message.pb.h"
+#include "blimp/net/blimp_message_processor.h"
+#include "blimp/net/common.h"
+#include "blimp/net/connection_error_observer.h"
+#include "blimp/net/packet_reader.h"
+#include "net/base/io_buffer.h"
+#include "net/base/net_errors.h"
+
+namespace blimp {
+
+BlimpMessagePump::BlimpMessagePump(PacketReader* reader)
+    : reader_(reader),
+      error_observer_(nullptr),
+      processor_(nullptr),
+      buffer_(new net::GrowableIOBuffer) {
+  DCHECK(reader_);
+}
+
+BlimpMessagePump::~BlimpMessagePump() {}
+
+void BlimpMessagePump::SetMessageProcessor(BlimpMessageProcessor* processor) {
+  DCHECK(processor);
+  bool reading_packet = !!processor_;
+  processor_ = processor;
+  if (!reading_packet) {
+    buffer_->SetCapacity(kMaxPacketPayloadSizeBytes);
+    ReadNextPacket();
+  }
+}
+
+void BlimpMessagePump::ReadNextPacket() {
+  DCHECK(processor_);
+  buffer_->set_offset(0);
+  read_packet_callback_.Reset(base::Bind(
+      &BlimpMessagePump::OnReadPacketComplete, base::Unretained(this)));
+  int result =
+      reader_->ReadPacket(buffer_.get(), read_packet_callback_.callback());
+  if (result != net::ERR_IO_PENDING) {
+    // Read completed synchronously.
+    OnReadPacketComplete(result);
+  }
+}
+
+void BlimpMessagePump::OnReadPacketComplete(int result) {
+  if (result > 0) {
+    // The result is the size of the packet in bytes.
+    scoped_ptr<BlimpMessage> message(new BlimpMessage);
+    bool parse_result =
+        message->ParseFromArray(buffer_->StartOfBuffer(), result);
+    if (parse_result) {
+      process_msg_callback_.Reset(base::Bind(
+          &BlimpMessagePump::OnProcessMessageComplete, base::Unretained(this)));
+      processor_->ProcessMessage(message.Pass(),
+                                 process_msg_callback_.callback());
+      return;
+    }
+    result = net::ERR_FAILED;
+  }
+  if (error_observer_)
+    error_observer_->OnConnectionError(result);
+}
+
+void BlimpMessagePump::OnProcessMessageComplete(int result) {
+  // No error is expected from the message receiver.
+  DCHECK_EQ(result, net::OK);
+  ReadNextPacket();
+}
+
+}  // namespace blimp
diff --git a/blimp/net/blimp_message_pump.h b/blimp/net/blimp_message_pump.h
new file mode 100644
index 0000000..e8fc0aa
--- /dev/null
+++ b/blimp/net/blimp_message_pump.h
@@ -0,0 +1,65 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef BLIMP_NET_BLIMP_MESSAGE_PUMP_H_
+#define BLIMP_NET_BLIMP_MESSAGE_PUMP_H_
+
+#include "base/macros.h"
+#include "base/memory/ref_counted.h"
+#include "base/memory/scoped_ptr.h"
+#include "blimp/net/blimp_net_export.h"
+#include "net/base/completion_callback.h"
+
+namespace net {
+class GrowableIOBuffer;
+}
+
+namespace blimp {
+
+class BlimpMessageProcessor;
+class ConnectionErrorObserver;
+class PacketReader;
+
+// Reads and deserializes incoming packets from |reader_|, and forwards parsed
+// BlimpMessages to |processor_|. When |processor_| is ready to take the next
+// message, the BlimpMessagePump reads the next packet.
+class BLIMP_NET_EXPORT BlimpMessagePump {
+ public:
+  // Caller ensures |reader| outlive this object.
+  explicit BlimpMessagePump(PacketReader* reader);
+
+  ~BlimpMessagePump();
+
+  // Sets the processor which will take blimp messages.
+  // Can be set multiple times, but previously set processors are discarded.
+  // Caller retains the ownership of |processor|.
+  void SetMessageProcessor(BlimpMessageProcessor* processor);
+
+  void set_error_observer(ConnectionErrorObserver* observer) {
+    error_observer_ = observer;
+  }
+
+ private:
+  // Read next packet from |reader_|.
+  void ReadNextPacket();
+
+  // Callback when next packet is ready in |buffer_|.
+  void OnReadPacketComplete(int result);
+
+  // Callback when |processor_| finishes processing a blimp message.
+  void OnProcessMessageComplete(int result);
+
+  PacketReader* reader_;
+  ConnectionErrorObserver* error_observer_;
+  BlimpMessageProcessor* processor_;
+  scoped_refptr<net::GrowableIOBuffer> buffer_;
+  net::CancelableCompletionCallback read_packet_callback_;
+  net::CancelableCompletionCallback process_msg_callback_;
+
+  DISALLOW_COPY_AND_ASSIGN(BlimpMessagePump);
+};
+
+}  // namespace blimp
+
+#endif  // BLIMP_NET_BLIMP_MESSAGE_PUMP_H_
diff --git a/blimp/net/blimp_message_pump_unittest.cc b/blimp/net/blimp_message_pump_unittest.cc
new file mode 100644
index 0000000..65aaec9
--- /dev/null
+++ b/blimp/net/blimp_message_pump_unittest.cc
@@ -0,0 +1,163 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <stddef.h>
+#include <string>
+
+#include "blimp/common/proto/blimp_message.pb.h"
+#include "blimp/net/blimp_message_pump.h"
+#include "blimp/net/common.h"
+#include "blimp/net/connection_error_observer.h"
+#include "blimp/net/test_common.h"
+#include "net/base/completion_callback.h"
+#include "net/base/io_buffer.h"
+#include "net/base/net_errors.h"
+#include "net/base/test_completion_callback.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+using testing::_;
+using testing::DoAll;
+using testing::InSequence;
+using testing::NotNull;
+using testing::Return;
+using testing::SaveArg;
+
+namespace blimp {
+namespace {
+
+class MockConnectionErrorObserver : public ConnectionErrorObserver {
+ public:
+  MOCK_METHOD1(OnConnectionError, void(int error));
+};
+
+class BlimpMessagePumpTest : public testing::Test {
+ public:
+  BlimpMessagePumpTest()
+      : message1_(new BlimpMessage), message2_(new BlimpMessage) {
+    message1_->set_type(BlimpMessage::INPUT);
+    message2_->set_type(BlimpMessage::CONTROL);
+    message_pump_.reset(new BlimpMessagePump(&reader_));
+    message_pump_->set_error_observer(&error_observer_);
+  }
+
+  ~BlimpMessagePumpTest() override {}
+
+ protected:
+  scoped_ptr<BlimpMessage> message1_;
+  scoped_ptr<BlimpMessage> message2_;
+
+  testing::StrictMock<MockPacketReader> reader_;
+  MockConnectionErrorObserver error_observer_;
+  MockBlimpMessageProcessor receiver_;
+  scoped_ptr<BlimpMessagePump> message_pump_;
+};
+
+// Reader completes reading one packet synchronously.
+TEST_F(BlimpMessagePumpTest, SyncPacketRead) {
+  EXPECT_CALL(receiver_, MockableProcessMessage(EqualsProto(*message1_), _));
+  EXPECT_CALL(reader_, ReadPacket(NotNull(), _))
+      .WillOnce(DoAll(FillBufferFromMessage<0>(message1_.get()),
+                      Return(message1_->ByteSize())));
+  message_pump_->SetMessageProcessor(&receiver_);
+}
+
+// Reader completes reading two packets synchronously.
+TEST_F(BlimpMessagePumpTest, SyncTwoPacketsRead) {
+  EXPECT_CALL(reader_, ReadPacket(NotNull(), _))
+      .WillOnce(DoAll(FillBufferFromMessage<0>(message1_.get()),
+                      Return(message1_->ByteSize())))
+      .WillOnce(DoAll(FillBufferFromMessage<0>(message2_.get()),
+                      Return(message2_->ByteSize())));
+  net::CompletionCallback process_msg_cb;
+  {
+    InSequence s;
+    EXPECT_CALL(receiver_, MockableProcessMessage(EqualsProto(*message1_), _))
+        .WillOnce(SaveArg<1>(&process_msg_cb))
+        .RetiresOnSaturation();
+    EXPECT_CALL(receiver_, MockableProcessMessage(EqualsProto(*message2_), _));
+  }
+  message_pump_->SetMessageProcessor(&receiver_);
+
+  // Trigger next packet read
+  process_msg_cb.Run(net::OK);
+}
+
+// Reader completes reading one packet asynchronously.
+TEST_F(BlimpMessagePumpTest, AsyncPacketRead) {
+  net::CompletionCallback read_packet_cb;
+  EXPECT_CALL(reader_, ReadPacket(NotNull(), _))
+      .WillOnce(DoAll(FillBufferFromMessage<0>(message1_.get()),
+                      SaveArg<1>(&read_packet_cb), Return(net::ERR_IO_PENDING)))
+      .WillOnce(Return(net::ERR_IO_PENDING));
+  net::CompletionCallback process_msg_cb;
+  EXPECT_CALL(receiver_, MockableProcessMessage(EqualsProto(*message1_), _))
+      .WillOnce(SaveArg<1>(&process_msg_cb));
+  message_pump_->SetMessageProcessor(&receiver_);
+  read_packet_cb.Run(message1_->ByteSize());
+  process_msg_cb.Run(net::OK);
+}
+
+// Reader completes reading two packets asynchronously.
+TEST_F(BlimpMessagePumpTest, AsyncTwoPacketsRead) {
+  net::CompletionCallback read_packet_cb;
+  EXPECT_CALL(reader_, ReadPacket(NotNull(), _))
+      .WillOnce(DoAll(FillBufferFromMessage<0>(message1_.get()),
+                      SaveArg<1>(&read_packet_cb), Return(net::ERR_IO_PENDING)))
+      .WillOnce(DoAll(FillBufferFromMessage<0>(message2_.get()),
+                      SaveArg<1>(&read_packet_cb),
+                      Return(net::ERR_IO_PENDING)));
+  net::CompletionCallback process_msg_cb;
+  {
+    InSequence s;
+    EXPECT_CALL(receiver_, MockableProcessMessage(EqualsProto(*message1_), _))
+        .WillOnce(SaveArg<1>(&process_msg_cb))
+        .RetiresOnSaturation();
+    EXPECT_CALL(receiver_, MockableProcessMessage(EqualsProto(*message2_), _));
+  }
+  message_pump_->SetMessageProcessor(&receiver_);
+  read_packet_cb.Run(message1_->ByteSize());
+
+  // Trigger next packet read
+  process_msg_cb.Run(net::OK);
+  read_packet_cb.Run(message2_->ByteSize());
+}
+
+// Reader completes reading two packets asynchronously.
+// The first read succeeds, and the second fails.
+TEST_F(BlimpMessagePumpTest, AsyncTwoPacketsReadWithError) {
+  net::CompletionCallback read_packet_cb;
+  EXPECT_CALL(reader_, ReadPacket(NotNull(), _))
+      .WillOnce(DoAll(FillBufferFromMessage<0>(message1_.get()),
+                      SaveArg<1>(&read_packet_cb), Return(net::ERR_IO_PENDING)))
+      .WillOnce(DoAll(FillBufferFromMessage<0>(message2_.get()),
+                      SaveArg<1>(&read_packet_cb),
+                      Return(net::ERR_IO_PENDING)));
+  net::CompletionCallback process_msg_cb;
+  {
+    InSequence s;
+    EXPECT_CALL(receiver_, MockableProcessMessage(EqualsProto(*message1_), _))
+        .WillOnce(SaveArg<1>(&process_msg_cb));
+    EXPECT_CALL(error_observer_, OnConnectionError(net::ERR_FAILED));
+  }
+  message_pump_->SetMessageProcessor(&receiver_);
+  read_packet_cb.Run(message1_->ByteSize());
+
+  // Trigger next packet read
+  process_msg_cb.Run(net::OK);
+  read_packet_cb.Run(net::ERR_FAILED);
+}
+
+// Reader completes reading one packet synchronously, but packet is invalid
+TEST_F(BlimpMessagePumpTest, InvalidPacket) {
+  std::string test_msg("msg");
+  EXPECT_CALL(reader_, ReadPacket(NotNull(), _))
+      .WillOnce(DoAll(FillBufferFromString<0>(test_msg), Return(1)));
+  EXPECT_CALL(error_observer_, OnConnectionError(net::ERR_FAILED));
+  message_pump_->SetMessageProcessor(&receiver_);
+}
+
+}  // namespace
+
+}  // namespace blimp
diff --git a/blimp/net/client_connection_manager.cc b/blimp/net/client_connection_manager.cc
index 2654710..659f6a4 100644
--- a/blimp/net/client_connection_manager.cc
+++ b/blimp/net/client_connection_manager.cc
@@ -26,7 +26,7 @@
   NOTIMPLEMENTED();
 }
 
-void ClientConnectionManager::OnDisconnected() {
+void ClientConnectionManager::OnConnectionError(int error) {
   NOTIMPLEMENTED();
 }
 
diff --git a/blimp/net/client_connection_manager.h b/blimp/net/client_connection_manager.h
index 5f9dfd5d..ed9c9a9f 100644
--- a/blimp/net/client_connection_manager.h
+++ b/blimp/net/client_connection_manager.h
@@ -7,6 +7,7 @@
 
 #include "base/macros.h"
 #include "blimp/net/blimp_connection.h"
+#include "blimp/net/connection_error_observer.h"
 #include "blimp/net/connection_handler.h"
 
 namespace blimp {
@@ -16,7 +17,7 @@
 // Attempts to reconnect if an authenticated connection is
 // disconnected.
 class ClientConnectionManager : public ConnectionHandler,
-                                BlimpConnection::DisconnectObserver {
+                                ConnectionErrorObserver {
   // Caller is responsible for ensuring that |client_browser_session|
   // outlives |this|.
   explicit ClientConnectionManager(ConnectionHandler* connection_handler);
@@ -30,9 +31,9 @@
   // the underlying ConnectionHandler.
   void HandleConnection(scoped_ptr<BlimpConnection> connection) override;
 
-  // BlimpConnection::DisconnectObserver implementation.
+  // ConnectionErrorObserver implementation.
   // Used to implement reconnection logic on unexpected disconnections.
-  void OnDisconnected() override;
+  void OnConnectionError(int error) override;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(ClientConnectionManager);
diff --git a/blimp/net/connection_error_observer.h b/blimp/net/connection_error_observer.h
new file mode 100644
index 0000000..da17db6f
--- /dev/null
+++ b/blimp/net/connection_error_observer.h
@@ -0,0 +1,20 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef BLIMP_NET_CONNECTION_ERROR_OBSERVER_H_
+#define BLIMP_NET_CONNECTION_ERROR_OBSERVER_H_
+
+namespace blimp {
+
+class ConnectionErrorObserver {
+ public:
+  virtual ~ConnectionErrorObserver() {}
+
+  // Called when a blimp connection encounters an error.
+  virtual void OnConnectionError(int error) = 0;
+};
+
+}  // namespace blimp
+
+#endif  // BLIMP_NET_CONNECTION_ERROR_OBSERVER_H_
diff --git a/blimp/net/engine_connection_manager.h b/blimp/net/engine_connection_manager.h
index 32a2e38..def115d 100644
--- a/blimp/net/engine_connection_manager.h
+++ b/blimp/net/engine_connection_manager.h
@@ -7,6 +7,7 @@
 
 #include "base/macros.h"
 #include "blimp/net/blimp_connection.h"
+#include "blimp/net/connection_error_observer.h"
 #include "blimp/net/connection_handler.h"
 
 namespace blimp {
@@ -16,7 +17,7 @@
 //
 // TODO(kmarshall): Add rate limiting and abuse handling logic.
 class EngineConnectionManager : public ConnectionHandler,
-                                public BlimpConnection::DisconnectObserver {
+                                public ConnectionErrorObserver {
  public:
   // Caller is responsible for ensuring that |connection_handler| outlives
   // |this|.
diff --git a/blimp/net/packet_reader.h b/blimp/net/packet_reader.h
index 3c6abf8..407e2fd 100644
--- a/blimp/net/packet_reader.h
+++ b/blimp/net/packet_reader.h
@@ -22,7 +22,8 @@
   // successfully.
   // Returns ERR_IO_PENDING if the operation will be executed asynchronously.
   //     |cb| is later invoked with the packet size or an error code.
-  // All other return values indicate errors.
+  // All other return values indicate errors and caller should stop using this
+  // reader.
   virtual int ReadPacket(const scoped_refptr<net::GrowableIOBuffer>& buf,
                          const net::CompletionCallback& cb) = 0;
 };
diff --git a/blimp/net/packet_writer.h b/blimp/net/packet_writer.h
index 1ac2126..e5dbb9a 100644
--- a/blimp/net/packet_writer.h
+++ b/blimp/net/packet_writer.h
@@ -26,6 +26,7 @@
   // Returns net::OK or an error code if the operation executed successfully.
   // Returns ERR_IO_PENDING if the operation will be executed asynchronously.
   //     |cb| is later invoked with net::OK or an error code.
+  // An error code indicates that caller should stop using this writer.
   virtual int WritePacket(scoped_refptr<net::DrainableIOBuffer> data,
                           const net::CompletionCallback& callback) = 0;
 };
diff --git a/blimp/net/test_common.cc b/blimp/net/test_common.cc
index d38042a..a3a73ad8 100644
--- a/blimp/net/test_common.cc
+++ b/blimp/net/test_common.cc
@@ -17,6 +17,10 @@
 
 MockStreamSocket::~MockStreamSocket() {}
 
+MockPacketReader::MockPacketReader() {}
+
+MockPacketReader::~MockPacketReader() {}
+
 MockBlimpMessageProcessor::MockBlimpMessageProcessor() {}
 
 MockBlimpMessageProcessor::~MockBlimpMessageProcessor() {}
diff --git a/blimp/net/test_common.h b/blimp/net/test_common.h
index 3b9f056..eadc1e6 100644
--- a/blimp/net/test_common.h
+++ b/blimp/net/test_common.h
@@ -8,6 +8,7 @@
 #include <string>
 
 #include "blimp/net/blimp_message_processor.h"
+#include "blimp/net/packet_reader.h"
 #include "net/socket/stream_socket.h"
 #include "testing/gmock/include/gmock/gmock.h"
 
@@ -27,6 +28,15 @@
   return expected == std::string(arg->data(), expected.size());
 }
 
+// Checks if two proto messages are the same.
+// TODO(kmarshall): promote to a shared testing library.
+MATCHER_P(EqualsProto, message, "") {
+  std::string expected_serialized, actual_serialized;
+  message.SerializeToString(&expected_serialized);
+  arg.SerializeToString(&actual_serialized);
+  return expected_serialized == actual_serialized;
+}
+
 // GMock action that writes data from a string to an IOBuffer.
 //
 //   buf_idx (template parameter 0): 0-based index of the IOBuffer arg.
@@ -37,6 +47,17 @@
   memcpy(testing::get<buf_idx>(args)->data(), str.data(), str.size());
 }
 
+// GMock action that writes data from a blimp message to an IOBuffer .
+//
+//   buf_idx (template parameter 0): 0-based index of the IOBuffer arg.
+//   message: the blimp message containing data to be written to the IOBuffer
+ACTION_TEMPLATE(FillBufferFromMessage,
+                HAS_1_TEMPLATE_PARAMS(int, buf_idx),
+                AND_1_VALUE_PARAMS(message)) {
+  message->SerializeToArray(testing::get<buf_idx>(args)->data(),
+                            message->ByteSize());
+}
+
 // Formats a string-based representation of a BlimpMessage header.
 std::string EncodeHeader(size_t size);
 
@@ -71,6 +92,16 @@
   MOCK_CONST_METHOD0(GetTotalReceivedBytes, int64_t());
 };
 
+class MockPacketReader : public PacketReader {
+ public:
+  MockPacketReader();
+  virtual ~MockPacketReader();
+
+  MOCK_METHOD2(ReadPacket,
+               int(const scoped_refptr<net::GrowableIOBuffer>&,
+                   const net::CompletionCallback&));
+};
+
 class MockBlimpMessageProcessor : public BlimpMessageProcessor {
  public:
   MockBlimpMessageProcessor();
diff --git a/build/android/adb_system_webview_command_line b/build/android/adb_system_webview_command_line
new file mode 100755
index 0000000..a0658ea
--- /dev/null
+++ b/build/android/adb_system_webview_command_line
@@ -0,0 +1,20 @@
+#!/bin/bash
+#
+# Copyright (c) 2013 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# If no flags are given, prints the current content shell flags.
+#
+# Otherwise, the given flags are used to REPLACE (not modify) the content shell
+# flags. For example:
+#   adb_system_webview_command_line --enable-webgl
+#
+# To remove all content shell flags, pass an empty string for the flags:
+#   adb_android_webview_command_line ""
+
+. $(dirname $0)/adb_command_line_functions.sh
+CMD_LINE_FILE=/data/local/tmp/webview-command-line
+REQUIRES_SU=0
+set_command_line "$@"
+
diff --git a/build/android/emma_instr_action.gypi b/build/android/emma_instr_action.gypi
index fa6d0623..5d22c26 100644
--- a/build/android/emma_instr_action.gypi
+++ b/build/android/emma_instr_action.gypi
@@ -7,7 +7,6 @@
 
 {
   'variables': {
-    'instr_type%': 'jar',
     'input_path%': '',
     'output_path%': '',
     'stamp_path%': '',
@@ -24,13 +23,7 @@
           '--emma-jar=<(emma_jar)',
           '--filter-string=<(emma_filter)',
         ],
-        'conditions': [
-          ['instr_type == "jar"', {
-            'instr_action': 'instrument_jar',
-          }, {
-            'instr_action': 'instrument_classes',
-          }]
-        ],
+        'instr_action': 'instrument_jar',
       }, {
         'instr_action': 'copy',
         'extra_instr_args': [],
diff --git a/build/android/gyp/emma_instr.py b/build/android/gyp/emma_instr.py
index 6f3555a..b6fd2b4 100755
--- a/build/android/gyp/emma_instr.py
+++ b/build/android/gyp/emma_instr.py
@@ -8,12 +8,10 @@
 
 This script corresponds to the 'emma_instr' action in the java build process.
 Depending on whether emma_instrument is set, the 'emma_instr' action will either
-call one of the instrument commands, or the copy command.
+call the instrument command or the copy command.
 
 Possible commands are:
 - instrument_jar: Accepts a jar and instruments it using emma.jar.
-- instrument_classes: Accepts a directory containing java classes and
-      instruments it using emma.jar.
 - copy: Called when EMMA coverage is not enabled. This allows us to make
       this a required step without necessarily instrumenting on every build.
       Also removes any stale coverage files.
@@ -91,11 +89,7 @@
   if os.path.exists(sources_file):
     os.remove(sources_file)
 
-  if os.path.isdir(options.input_path):
-    shutil.rmtree(options.output_path, ignore_errors=True)
-    shutil.copytree(options.input_path, options.output_path)
-  else:
-    shutil.copy(options.input_path, options.output_path)
+  shutil.copy(options.input_path, options.output_path)
 
   if options.stamp:
     build_utils.Touch(options.stamp)
@@ -129,13 +123,12 @@
     json.dump(relative_sources, f)
 
 
-def _RunInstrumentCommand(command, options, _, option_parser):
-  """Instruments the classes/jar files using EMMA.
+def _RunInstrumentCommand(_command, options, _, option_parser):
+  """Instruments jar files using EMMA.
 
   Args:
-    command: 'instrument_jar' or 'instrument_classes'. This distinguishes
-        whether we copy the output from the created lib/ directory, or classes/
-        directory.
+    command: String indicating the command that was received to trigger
+        this function.
     options: optparse options dictionary.
     args: List of extra args from optparse.
     option_parser: optparse.OptionParser object.
@@ -165,15 +158,9 @@
            '-m', 'fullcopy']
     build_utils.CheckOutput(cmd)
 
-    if command == 'instrument_jar':
-      for jar in os.listdir(os.path.join(temp_dir, 'lib')):
-        shutil.copy(os.path.join(temp_dir, 'lib', jar),
+    for jar in os.listdir(os.path.join(temp_dir, 'lib')):
+      shutil.copy(os.path.join(temp_dir, 'lib', jar),
                     options.output_path)
-    else:  # 'instrument_classes'
-      if os.path.isdir(options.output_path):
-        shutil.rmtree(options.output_path, ignore_errors=True)
-      shutil.copytree(os.path.join(temp_dir, 'classes'),
-                      options.output_path)
   finally:
     shutil.rmtree(temp_dir)
 
@@ -192,8 +179,6 @@
                                  _RunCopyCommand),
     'instrument_jar': CommandFunctionTuple(_AddInstrumentOptions,
                                            _RunInstrumentCommand),
-    'instrument_classes': CommandFunctionTuple(_AddInstrumentOptions,
-                                               _RunInstrumentCommand),
 }
 
 
diff --git a/build/android/pylib/instrumentation/instrumentation_test_instance.py b/build/android/pylib/instrumentation/instrumentation_test_instance.py
index f3c3d3c..278ffb2f 100644
--- a/build/android/pylib/instrumentation/instrumentation_test_instance.py
+++ b/build/android/pylib/instrumentation/instrumentation_test_instance.py
@@ -163,12 +163,12 @@
   """
   ParamsTuple = collections.namedtuple('ParamsTuple', ['add', 'remove'])
   parameterized_tests = []
-  if _PARAMETERIZED_TEST_ANNOTATION in annotations:
-    parameterized_tests = [annotations[_PARAMETERIZED_TEST_ANNOTATION]]
-  elif _PARAMETERIZED_TEST_SET_ANNOTATION in annotations:
+  if _PARAMETERIZED_TEST_SET_ANNOTATION in annotations:
     if annotations[_PARAMETERIZED_TEST_SET_ANNOTATION]:
       parameterized_tests = annotations[
         _PARAMETERIZED_TEST_SET_ANNOTATION].get('tests', [])
+  elif _PARAMETERIZED_TEST_ANNOTATION in annotations:
+    parameterized_tests = [annotations[_PARAMETERIZED_TEST_ANNOTATION]]
   else:
     return None
 
diff --git a/build/config/android/rules.gni b/build/config/android/rules.gni
index 6da7fe4..37c7483 100644
--- a/build/config/android/rules.gni
+++ b/build/config/android/rules.gni
@@ -1387,7 +1387,11 @@
   _generated_proguard_config = "$base_path.resources.proguard.txt"
   process_resources_target = "${_template_name}__process_resources"
   process_resources(process_resources_target) {
-    forward_variables_from(invoker, [ "include_all_resources" ])
+    forward_variables_from(invoker,
+                           [
+                             "include_all_resources",
+                             "shared_resources",
+                           ])
     srcjar_path = "${target_gen_dir}/${target_name}.srcjar"
     r_text_path = "${target_gen_dir}/${target_name}_R.txt"
     android_manifest = _android_manifest
@@ -1619,6 +1623,7 @@
                              "deps",
                              "extensions_to_not_compress",
                              "language_splits",
+                             "shared_resources",
                            ])
     apk_path = _final_apk_path
     android_manifest = _android_manifest
diff --git a/build/java.gypi b/build/java.gypi
index 9bc1f4b..f182e8cf 100644
--- a/build/java.gypi
+++ b/build/java.gypi
@@ -331,7 +331,6 @@
         'input_path': '<(jar_path)',
         'output_path': '<(jar_final_path)',
         'stamp_path': '<(emma_instr_stamp)',
-        'instr_type': 'jar',
       },
       'outputs': [
         '<(jar_final_path)',
diff --git a/build/java_apk.gypi b/build/java_apk.gypi
index 658c99fb..6c5e7bbf 100644
--- a/build/java_apk.gypi
+++ b/build/java_apk.gypi
@@ -973,7 +973,6 @@
         'input_path': '<(javac_jar_path)',
         'output_path': '<(jar_path)',
         'stamp_path': '<(emma_instr_stamp)',
-        'instr_type': 'jar',
       },
       'outputs': [
         '<(emma_instr_stamp)',
diff --git a/build/mac/tweak_info_plist.py b/build/mac/tweak_info_plist.py
index 2057bac..a6ffbca 100755
--- a/build/mac/tweak_info_plist.py
+++ b/build/mac/tweak_info_plist.py
@@ -159,7 +159,7 @@
 def _TagSuffixes():
   # Keep this list sorted in the order that tag suffix components are to
   # appear in a tag value. That is to say, it should be sorted per ASCII.
-  components = ('32bit', 'full')
+  components = ('full',)
   assert tuple(sorted(components)) == components
 
   components_len = len(components)
diff --git a/cc/BUILD.gn b/cc/BUILD.gn
index e38e0db..8be7afcf 100644
--- a/cc/BUILD.gn
+++ b/cc/BUILD.gn
@@ -203,6 +203,8 @@
     "output/bsp_tree.h",
     "output/bsp_walk_action.cc",
     "output/bsp_walk_action.h",
+    "output/ca_layer_overlay.cc",
+    "output/ca_layer_overlay.h",
     "output/compositor_frame.cc",
     "output/compositor_frame.h",
     "output/compositor_frame_ack.cc",
@@ -249,8 +251,6 @@
     "output/overlay_candidate_validator.h",
     "output/overlay_processor.cc",
     "output/overlay_processor.h",
-    "output/overlay_strategy_all_or_nothing.cc",
-    "output/overlay_strategy_all_or_nothing.h",
     "output/overlay_strategy_sandwich.cc",
     "output/overlay_strategy_sandwich.h",
     "output/overlay_strategy_single_on_top.cc",
diff --git a/cc/blink/web_content_layer_impl.cc b/cc/blink/web_content_layer_impl.cc
index f5ec32b..2990978 100644
--- a/cc/blink/web_content_layer_impl.cc
+++ b/cc/blink/web_content_layer_impl.cc
@@ -58,10 +58,6 @@
   return layer_.get();
 }
 
-void WebContentLayerImpl::setDoubleSided(bool double_sided) {
-  layer_->layer()->SetDoubleSided(double_sided);
-}
-
 scoped_refptr<cc::DisplayItemList>
 WebContentLayerImpl::PaintContentsToDisplayList(
     const gfx::Rect& clip,
diff --git a/cc/blink/web_content_layer_impl.h b/cc/blink/web_content_layer_impl.h
index 82956b84..1b18664 100644
--- a/cc/blink/web_content_layer_impl.h
+++ b/cc/blink/web_content_layer_impl.h
@@ -29,7 +29,6 @@
 
   // WebContentLayer implementation.
   blink::WebLayer* layer() override;
-  void setDoubleSided(bool double_sided) override;
 
  protected:
   ~WebContentLayerImpl() override;
diff --git a/cc/blink/web_layer_impl.cc b/cc/blink/web_layer_impl.cc
index b372408..829b55e 100644
--- a/cc/blink/web_layer_impl.cc
+++ b/cc/blink/web_layer_impl.cc
@@ -208,6 +208,10 @@
   return layer_->DrawsContent();
 }
 
+void WebLayerImpl::setDoubleSided(bool double_sided) {
+  layer_->SetDoubleSided(double_sided);
+}
+
 void WebLayerImpl::setShouldFlattenTransform(bool flatten) {
   layer_->SetShouldFlattenTransform(flatten);
 }
diff --git a/cc/blink/web_layer_impl.h b/cc/blink/web_layer_impl.h
index 44ef02e..e9f79c0 100644
--- a/cc/blink/web_layer_impl.h
+++ b/cc/blink/web_layer_impl.h
@@ -95,6 +95,7 @@
   SkMatrix44 transform() const override;
   void setDrawsContent(bool draws_content) override;
   bool drawsContent() const override;
+  void setDoubleSided(bool double_sided) override;
   void setShouldFlattenTransform(bool flatten) override;
   void setRenderingContext(int context) override;
   void setUseParentBackfaceVisibility(bool visible) override;
diff --git a/cc/cc.gyp b/cc/cc.gyp
index 5a8143f..92f8616 100644
--- a/cc/cc.gyp
+++ b/cc/cc.gyp
@@ -265,6 +265,8 @@
         'output/bsp_tree.h',
         'output/bsp_walk_action.cc',
         'output/bsp_walk_action.h',
+        'output/ca_layer_overlay.cc',
+        'output/ca_layer_overlay.h',
         'output/compositor_frame.cc',
         'output/compositor_frame.h',
         'output/compositor_frame_ack.cc',
@@ -311,8 +313,6 @@
         'output/overlay_candidate_validator.h',
         'output/overlay_processor.cc',
         'output/overlay_processor.h',
-        'output/overlay_strategy_all_or_nothing.cc',
-        'output/overlay_strategy_all_or_nothing.h',
         'output/overlay_strategy_sandwich.cc',
         'output/overlay_strategy_sandwich.h',
         'output/overlay_strategy_single_on_top.cc',
diff --git a/cc/output/ca_layer_overlay.cc b/cc/output/ca_layer_overlay.cc
new file mode 100644
index 0000000..f51c8ff
--- /dev/null
+++ b/cc/output/ca_layer_overlay.cc
@@ -0,0 +1,187 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "cc/output/ca_layer_overlay.h"
+
+#include "cc/quads/io_surface_draw_quad.h"
+#include "cc/quads/solid_color_draw_quad.h"
+#include "cc/quads/stream_video_draw_quad.h"
+#include "cc/quads/texture_draw_quad.h"
+#include "cc/quads/tile_draw_quad.h"
+#include "cc/resources/resource_provider.h"
+
+namespace cc {
+
+namespace {
+
+bool FromIOSurfaceQuad(ResourceProvider* resource_provider,
+                       const IOSurfaceDrawQuad* quad,
+                       CALayerOverlay* ca_layer_overlay) {
+  unsigned resource_id = quad->io_surface_resource_id();
+  if (!resource_provider->IsOverlayCandidate(resource_id))
+    return false;
+  ca_layer_overlay->contents_resource_id = resource_id;
+  ca_layer_overlay->contents_rect = gfx::RectF(0, 0, 1, 1);
+  return true;
+}
+
+bool FromStreamVideoQuad(ResourceProvider* resource_provider,
+                         const StreamVideoDrawQuad* quad,
+                         CALayerOverlay* ca_layer_overlay) {
+  unsigned resource_id = quad->resource_id();
+  if (!resource_provider->IsOverlayCandidate(resource_id))
+    return false;
+  ca_layer_overlay->contents_resource_id = resource_id;
+  // TODO(ccameron): Support merging at least some basic transforms into the
+  // layer transform.
+  if (!quad->matrix.IsIdentity())
+    return false;
+  ca_layer_overlay->contents_rect = gfx::RectF(0, 0, 1, 1);
+  return true;
+}
+
+bool FromSolidColorDrawQuad(const SolidColorDrawQuad* quad,
+                            CALayerOverlay* ca_layer_overlay,
+                            bool* skip) {
+  // Do not generate quads that are completely transparent.
+  if (SkColorGetA(quad->color) == 0) {
+    *skip = true;
+    return true;
+  }
+  ca_layer_overlay->background_color = quad->color;
+  return true;
+}
+
+bool FromTextureQuad(ResourceProvider* resource_provider,
+                     const TextureDrawQuad* quad,
+                     CALayerOverlay* ca_layer_overlay) {
+  unsigned resource_id = quad->resource_id();
+  if (!resource_provider->IsOverlayCandidate(resource_id))
+    return false;
+  // TODO(ccameron): Merge the y flip into the layer transform.
+  if (quad->y_flipped)
+    return false;
+  ca_layer_overlay->contents_resource_id = resource_id;
+  ca_layer_overlay->contents_rect =
+      BoundingRect(quad->uv_top_left, quad->uv_bottom_right);
+  ca_layer_overlay->background_color = quad->background_color;
+  return true;
+}
+
+bool FromTileQuad(ResourceProvider* resource_provider,
+                  const TileDrawQuad* quad,
+                  CALayerOverlay* ca_layer_overlay) {
+  unsigned resource_id = quad->resource_id();
+  if (!resource_provider->IsOverlayCandidate(resource_id))
+    return false;
+  ca_layer_overlay->contents_resource_id = resource_id;
+  ca_layer_overlay->contents_rect = quad->tex_coord_rect;
+  ca_layer_overlay->contents_rect.Scale(1.f / quad->texture_size.width(),
+                                        1.f / quad->texture_size.height());
+  return true;
+}
+
+bool FromDrawQuad(ResourceProvider* resource_provider,
+                  const gfx::RectF& display_rect,
+                  const DrawQuad* quad,
+                  CALayerOverlay* ca_layer_overlay,
+                  bool* skip) {
+  if (quad->shared_quad_state->blend_mode != SkXfermode::kSrcOver_Mode)
+    return false;
+
+  // TODO(ccameron): Handle 3D transforms.
+  if (!quad->shared_quad_state->quad_to_target_transform.IsFlat())
+    return false;
+
+  // Early-out for invisible quads.
+  if (quad->shared_quad_state->opacity == 0.f) {
+    *skip = true;
+    return true;
+  }
+
+  // Check rect clipping.
+  gfx::RectF quad_rect(quad->rect);
+  if (quad->shared_quad_state->is_clipped) {
+    gfx::RectF clip_rect = gfx::RectF(quad->shared_quad_state->clip_rect);
+    gfx::RectF quad_rect_in_clip_space = gfx::RectF(quad->rect);
+    quad->shared_quad_state->quad_to_target_transform.TransformRect(
+        &quad_rect_in_clip_space);
+    quad_rect_in_clip_space.Intersect(display_rect);
+    // Skip quads that are entirely clipped.
+    if (!quad_rect_in_clip_space.Intersects(clip_rect)) {
+      *skip = true;
+      return true;
+    }
+    // Fall back if the clip rect actually has an effect.
+    // TODO(ccameron): Handle more clip rects.
+    if (!clip_rect.Contains(quad_rect_in_clip_space)) {
+      return false;
+    }
+  }
+
+  ca_layer_overlay->opacity = quad->shared_quad_state->opacity;
+  ca_layer_overlay->bounds_size = gfx::SizeF(quad->rect.size());
+  ca_layer_overlay->transform.setTranslate(quad->rect.x(), quad->rect.y(), 0);
+  ca_layer_overlay->transform.postConcat(
+      quad->shared_quad_state->quad_to_target_transform.matrix());
+
+  switch (quad->material) {
+    case DrawQuad::IO_SURFACE_CONTENT:
+      return FromIOSurfaceQuad(resource_provider,
+                               IOSurfaceDrawQuad::MaterialCast(quad),
+                               ca_layer_overlay);
+    case DrawQuad::TEXTURE_CONTENT:
+      return FromTextureQuad(resource_provider,
+                             TextureDrawQuad::MaterialCast(quad),
+                             ca_layer_overlay);
+    case DrawQuad::TILED_CONTENT:
+      return FromTileQuad(resource_provider, TileDrawQuad::MaterialCast(quad),
+                          ca_layer_overlay);
+    case DrawQuad::SOLID_COLOR:
+      return FromSolidColorDrawQuad(SolidColorDrawQuad::MaterialCast(quad),
+                                    ca_layer_overlay, skip);
+    case DrawQuad::STREAM_VIDEO_CONTENT:
+      return FromStreamVideoQuad(resource_provider,
+                                 StreamVideoDrawQuad::MaterialCast(quad),
+                                 ca_layer_overlay);
+    default:
+      return false;
+      break;
+  }
+
+  return true;
+}
+
+}  // namespace
+
+CALayerOverlay::CALayerOverlay()
+    : contents_resource_id(0),
+      opacity(1),
+      background_color(SK_ColorTRANSPARENT),
+      transform(SkMatrix44::kIdentity_Constructor) {}
+
+CALayerOverlay::~CALayerOverlay() {}
+
+bool ProcessForCALayerOverlays(ResourceProvider* resource_provider,
+                               const gfx::RectF& display_rect,
+                               const QuadList& quad_list,
+                               CALayerOverlayList* ca_layer_overlays) {
+  for (auto it = quad_list.BackToFrontBegin(); it != quad_list.BackToFrontEnd();
+       ++it) {
+    const DrawQuad* quad = *it;
+    CALayerOverlay ca_layer_overlay;
+    bool skip = false;
+    if (!FromDrawQuad(resource_provider, display_rect, quad, &ca_layer_overlay,
+                      &skip)) {
+      ca_layer_overlays->clear();
+      return false;
+    }
+    if (skip)
+      continue;
+    ca_layer_overlays->push_back(ca_layer_overlay);
+  }
+  return true;
+}
+
+}  // namespace cc
diff --git a/cc/output/ca_layer_overlay.h b/cc/output/ca_layer_overlay.h
new file mode 100644
index 0000000..fd7d68f
--- /dev/null
+++ b/cc/output/ca_layer_overlay.h
@@ -0,0 +1,49 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CC_OUTPUT_CA_LAYER_OVERLAY_H_
+#define CC_OUTPUT_CA_LAYER_OVERLAY_H_
+
+#include "cc/quads/render_pass.h"
+#include "third_party/skia/include/core/SkColor.h"
+#include "third_party/skia/include/utils/SkMatrix44.h"
+#include "ui/gfx/geometry/rect_f.h"
+
+namespace cc {
+
+class DrawQuad;
+class ResourceProvider;
+
+class CC_EXPORT CALayerOverlay {
+ public:
+  CALayerOverlay();
+  ~CALayerOverlay();
+
+  // Texture that corresponds to an IOSurface to set as the content of the
+  // CALayer. If this is 0 then the CALayer is a solid color.
+  unsigned contents_resource_id;
+  // The contents rect property for the CALayer.
+  gfx::RectF contents_rect;
+  // The opacity property for the CAayer.
+  float opacity;
+  // The background color property for the CALayer.
+  SkColor background_color;
+  // The bounds for the CALayer in pixels.
+  gfx::SizeF bounds_size;
+  // The transform to apply to the CALayer.
+  SkMatrix44 transform;
+};
+
+typedef std::vector<CALayerOverlay> CALayerOverlayList;
+
+// Returns true if all quads in the root render pass have been replaced by
+// CALayerOverlays.
+bool ProcessForCALayerOverlays(ResourceProvider* resource_provider,
+                               const gfx::RectF& display_rect,
+                               const QuadList& quad_list,
+                               CALayerOverlayList* ca_layer_overlays);
+
+}  // namespace cc
+
+#endif  // CC_OUTPUT_CA_LAYER_OVERLAY_H_
diff --git a/cc/output/direct_renderer.cc b/cc/output/direct_renderer.cc
index 16dcd5a3..a1d3a65a 100644
--- a/cc/output/direct_renderer.cc
+++ b/cc/output/direct_renderer.cc
@@ -207,6 +207,8 @@
   frame.root_damage_rect = Capabilities().using_partial_swap
                                ? root_render_pass->damage_rect
                                : root_render_pass->output_rect;
+  frame.root_damage_rect.Union(next_root_damage_rect_);
+  next_root_damage_rect_ = gfx::Rect();
   frame.root_damage_rect.Intersect(gfx::Rect(device_viewport_rect.size()));
   frame.device_viewport_rect = device_viewport_rect;
   frame.device_clip_rect = device_clip_rect;
@@ -239,26 +241,37 @@
   // If we have any copy requests, we can't remove any quads for overlays,
   // otherwise the framebuffer will be missing the overlay contents.
   if (root_render_pass->copy_requests.empty()) {
-    overlay_processor_->ProcessForOverlays(
-        resource_provider_, render_passes_in_draw_order, &frame.overlay_list,
-        &frame.root_damage_rect);
+    if (overlay_processor_->ProcessForCALayers(
+            resource_provider_, render_passes_in_draw_order,
+            &frame.ca_layer_overlay_list, &frame.overlay_list)) {
+      // Ensure that the next frame to use the backbuffer will do a full redraw.
+      next_root_damage_rect_.Union(root_render_pass->output_rect);
+    } else {
+      overlay_processor_->ProcessForOverlays(
+          resource_provider_, render_passes_in_draw_order, &frame.overlay_list,
+          &frame.root_damage_rect);
 
-    // No need to render in case the damage rect is completely composited using
-    // overlays and dont have any copy requests.
-    if (frame.root_damage_rect.IsEmpty()) {
-      bool handle_copy_requests = false;
-      for (auto* pass : *render_passes_in_draw_order) {
-        if (!pass->copy_requests.empty()) {
-          handle_copy_requests = true;
-          break;
+      // No need to render in case the damage rect is completely composited
+      // using
+      // overlays and dont have any copy requests.
+      if (frame.root_damage_rect.IsEmpty()) {
+        bool handle_copy_requests = false;
+        for (auto* pass : *render_passes_in_draw_order) {
+          if (!pass->copy_requests.empty()) {
+            handle_copy_requests = true;
+            break;
+          }
         }
-      }
 
-      if (!handle_copy_requests) {
-        BindFramebufferToOutputSurface(&frame);
-        FinishDrawingFrame(&frame);
-        render_passes_in_draw_order->clear();
-        return;
+        if (!handle_copy_requests) {
+          BindFramebufferToOutputSurface(&frame);
+          FinishDrawingFrame(&frame);
+          render_passes_in_draw_order->clear();
+          return;
+        }
+        overlay_processor_->ProcessForOverlays(
+            resource_provider_, render_passes_in_draw_order,
+            &frame.overlay_list, &frame.root_damage_rect);
       }
     }
   }
diff --git a/cc/output/direct_renderer.h b/cc/output/direct_renderer.h
index be72632..6721e24e 100644
--- a/cc/output/direct_renderer.h
+++ b/cc/output/direct_renderer.h
@@ -9,6 +9,7 @@
 #include "base/callback.h"
 #include "base/containers/scoped_ptr_hash_map.h"
 #include "cc/base/cc_export.h"
+#include "cc/output/ca_layer_overlay.h"
 #include "cc/output/overlay_processor.h"
 #include "cc/output/renderer.h"
 #include "cc/raster/task_graph_runner.h"
@@ -56,6 +57,7 @@
     bool disable_picture_quad_image_filtering;
 
     OverlayCandidateList overlay_list;
+    CALayerOverlayList ca_layer_overlay_list;
   };
 
   void SetEnlargePassTextureAmountForTesting(const gfx::Vector2d& amount);
@@ -158,6 +160,10 @@
  private:
   gfx::Vector2d enlarge_pass_texture_amount_;
 
+  // Regions that must be drawn in the next frame because they were represented
+  // as CALayers in the current frame.
+  gfx::Rect next_root_damage_rect_;
+
   DISALLOW_COPY_AND_ASSIGN(DirectRenderer);
 };
 
diff --git a/cc/output/gl_renderer.cc b/cc/output/gl_renderer.cc
index 22e2cb81..1677de1c 100644
--- a/cc/output/gl_renderer.cc
+++ b/cc/output/gl_renderer.cc
@@ -2452,6 +2452,7 @@
   gl_->Disable(GL_BLEND);
   blend_shadow_ = false;
 
+  ScheduleCALayers(frame);
   ScheduleOverlays(frame);
 }
 
@@ -3527,6 +3528,32 @@
   return gl_->GetGraphicsResetStatusKHR() != GL_NO_ERROR;
 }
 
+void GLRenderer::ScheduleCALayers(DrawingFrame* frame) {
+  for (const CALayerOverlay& ca_layer_overlay : frame->ca_layer_overlay_list) {
+    unsigned texture_id = 0;
+    if (ca_layer_overlay.contents_resource_id) {
+      pending_overlay_resources_.push_back(
+          make_scoped_ptr(new ResourceProvider::ScopedReadLockGL(
+              resource_provider_, ca_layer_overlay.contents_resource_id)));
+      texture_id = pending_overlay_resources_.back()->texture_id();
+    }
+    GLfloat contents_rect[4] = {
+        ca_layer_overlay.contents_rect.x(), ca_layer_overlay.contents_rect.y(),
+        ca_layer_overlay.contents_rect.width(),
+        ca_layer_overlay.contents_rect.height(),
+    };
+    GLfloat bounds_size[2] = {
+        ca_layer_overlay.bounds_size.width(),
+        ca_layer_overlay.bounds_size.height(),
+    };
+    GLfloat transform[16];
+    ca_layer_overlay.transform.asColMajorf(transform);
+    gl_->ScheduleCALayerCHROMIUM(
+        texture_id, contents_rect, ca_layer_overlay.opacity,
+        ca_layer_overlay.background_color, bounds_size, transform);
+  }
+}
+
 void GLRenderer::ScheduleOverlays(DrawingFrame* frame) {
   if (!frame->overlay_list.size())
     return;
diff --git a/cc/output/gl_renderer.h b/cc/output/gl_renderer.h
index 0aa4e8f..25fae99 100644
--- a/cc/output/gl_renderer.h
+++ b/cc/output/gl_renderer.h
@@ -257,6 +257,7 @@
   void EnsureBackbuffer() override;
   void EnforceMemoryPolicy();
 
+  void ScheduleCALayers(DrawingFrame* frame);
   void ScheduleOverlays(DrawingFrame* frame);
 
   typedef ScopedPtrVector<ResourceProvider::ScopedReadLockGL>
diff --git a/cc/output/gl_renderer_unittest.cc b/cc/output/gl_renderer_unittest.cc
index 92fcd3c..bd9d6b37 100644
--- a/cc/output/gl_renderer_unittest.cc
+++ b/cc/output/gl_renderer_unittest.cc
@@ -1935,7 +1935,7 @@
 
 class GLRendererTestSyncPoint : public GLRendererPixelTest {
  protected:
-  static void SyncPointCallback(int* callback_count) {
+  static void SyncTokenCallback(int* callback_count) {
     ++(*callback_count);
     base::MessageLoop::current()->QuitWhenIdle();
   }
@@ -1948,21 +1948,25 @@
 
 #if !defined(OS_ANDROID)
 TEST_F(GLRendererTestSyncPoint, SignalSyncPointOnLostContext) {
-  int sync_point_callback_count = 0;
+  int sync_token_callback_count = 0;
   int other_callback_count = 0;
   gpu::gles2::GLES2Interface* gl =
       output_surface_->context_provider()->ContextGL();
   gpu::ContextSupport* context_support =
       output_surface_->context_provider()->ContextSupport();
 
-  uint32 sync_point = gl->InsertSyncPointCHROMIUM();
+  const uint64_t fence_sync = gl->InsertFenceSyncCHROMIUM();
+  gl->ShallowFlushCHROMIUM();
+
+  gpu::SyncToken sync_token;
+  gl->GenSyncTokenCHROMIUM(fence_sync, sync_token.GetData());
 
   gl->LoseContextCHROMIUM(GL_GUILTY_CONTEXT_RESET_ARB,
                           GL_INNOCENT_CONTEXT_RESET_ARB);
 
-  context_support->SignalSyncPoint(
-      sync_point, base::Bind(&SyncPointCallback, &sync_point_callback_count));
-  EXPECT_EQ(0, sync_point_callback_count);
+  context_support->SignalSyncToken(
+      sync_token, base::Bind(&SyncTokenCallback, &sync_token_callback_count));
+  EXPECT_EQ(0, sync_token_callback_count);
   EXPECT_EQ(0, other_callback_count);
 
   // Make the sync point happen.
@@ -1974,12 +1978,12 @@
   base::MessageLoop::current()->Run();
 
   // The sync point shouldn't have happened since the context was lost.
-  EXPECT_EQ(0, sync_point_callback_count);
+  EXPECT_EQ(0, sync_token_callback_count);
   EXPECT_EQ(1, other_callback_count);
 }
 
 TEST_F(GLRendererTestSyncPoint, SignalSyncPoint) {
-  int sync_point_callback_count = 0;
+  int sync_token_callback_count = 0;
   int other_callback_count = 0;
 
   gpu::gles2::GLES2Interface* gl =
@@ -1987,11 +1991,15 @@
   gpu::ContextSupport* context_support =
       output_surface_->context_provider()->ContextSupport();
 
-  uint32 sync_point = gl->InsertSyncPointCHROMIUM();
+  const uint64_t fence_sync = gl->InsertFenceSyncCHROMIUM();
+  gl->ShallowFlushCHROMIUM();
 
-  context_support->SignalSyncPoint(
-      sync_point, base::Bind(&SyncPointCallback, &sync_point_callback_count));
-  EXPECT_EQ(0, sync_point_callback_count);
+  gpu::SyncToken sync_token;
+  gl->GenSyncTokenCHROMIUM(fence_sync, sync_token.GetData());
+
+  context_support->SignalSyncToken(
+      sync_token, base::Bind(&SyncTokenCallback, &sync_token_callback_count));
+  EXPECT_EQ(0, sync_token_callback_count);
   EXPECT_EQ(0, other_callback_count);
 
   // Make the sync point happen.
@@ -2003,7 +2011,7 @@
   base::MessageLoop::current()->Run();
 
   // The sync point should have happened.
-  EXPECT_EQ(1, sync_point_callback_count);
+  EXPECT_EQ(1, sync_token_callback_count);
   EXPECT_EQ(1, other_callback_count);
 }
 #endif  // OS_ANDROID
@@ -2021,6 +2029,22 @@
                       gfx::Rect* damage_rect));
   };
 
+  class Validator : public OverlayCandidateValidator {
+   public:
+    void GetStrategies(OverlayProcessor::StrategyList* strategies) override {}
+
+    // Returns true if draw quads can be represented as CALayers (Mac only).
+    MOCK_METHOD0(AllowCALayerOverlays, bool());
+
+    // A list of possible overlay candidates is presented to this function.
+    // The expected result is that those candidates that can be in a separate
+    // plane are marked with |overlay_handled| set to true, otherwise they are
+    // to be traditionally composited. Candidates with |overlay_handled| set to
+    // true must also have their |display_rect| converted to integer
+    // coordinates if necessary.
+    void CheckOverlaySupport(OverlayCandidateList* surfaces) {}
+  };
+
   explicit TestOverlayProcessor(OutputSurface* surface)
       : OverlayProcessor(surface) {}
   ~TestOverlayProcessor() override {}
@@ -2042,7 +2066,7 @@
 TEST_F(GLRendererTest, DontOverlayWithCopyRequests) {
   scoped_ptr<DiscardCheckingContext> context_owned(new DiscardCheckingContext);
   FakeOutputSurfaceClient output_surface_client;
-  scoped_ptr<OutputSurface> output_surface(
+  scoped_ptr<FakeOutputSurface> output_surface(
       FakeOutputSurface::Create3d(context_owned.Pass()));
   CHECK(output_surface->BindToClient(&output_surface_client));
 
@@ -2062,6 +2086,9 @@
       new TestOverlayProcessor(output_surface.get());
   processor->Initialize();
   renderer.SetOverlayProcessor(processor);
+  scoped_ptr<TestOverlayProcessor::Validator> validator(
+      new TestOverlayProcessor::Validator);
+  output_surface->SetOverlayCandidateValidator(validator.get());
 
   gfx::Rect viewport_rect(1, 1);
   RenderPass* root_pass =
@@ -2097,9 +2124,11 @@
   // any attempt to overlay, which there shouldn't be. We can't use the quad
   // list because the render pass is cleaned up by DrawFrame.
   EXPECT_CALL(*processor->strategy_, Attempt(_, _, _, _)).Times(0);
+  EXPECT_CALL(*validator, AllowCALayerOverlays()).Times(0);
   renderer.DrawFrame(&render_passes_in_draw_order_, 1.f, viewport_rect,
                      viewport_rect, false);
   Mock::VerifyAndClearExpectations(processor->strategy_);
+  Mock::VerifyAndClearExpectations(validator.get());
 
   // Without a copy request Attempt() should be called once.
   root_pass = AddRenderPass(&render_passes_in_draw_order_, RenderPassId(1, 0),
@@ -2112,10 +2141,31 @@
                        premultiplied_alpha, gfx::PointF(0, 0),
                        gfx::PointF(1, 1), SK_ColorTRANSPARENT, vertex_opacity,
                        flipped, nearest_neighbor);
-
+  EXPECT_CALL(*validator, AllowCALayerOverlays())
+      .Times(1)
+      .WillOnce(::testing::Return(false));
   EXPECT_CALL(*processor->strategy_, Attempt(_, _, _, _)).Times(1);
   renderer.DrawFrame(&render_passes_in_draw_order_, 1.f, viewport_rect,
                      viewport_rect, false);
+
+  // If the CALayerOverlay path is taken, then the ordinary overlay path should
+  // not be called.
+  root_pass = AddRenderPass(&render_passes_in_draw_order_, RenderPassId(1, 0),
+                            viewport_rect, gfx::Transform());
+  root_pass->has_transparent_background = false;
+
+  overlay_quad = root_pass->CreateAndAppendDrawQuad<TextureDrawQuad>();
+  overlay_quad->SetNew(root_pass->CreateAndAppendSharedQuadState(),
+                       viewport_rect, viewport_rect, viewport_rect, resource_id,
+                       premultiplied_alpha, gfx::PointF(0, 0),
+                       gfx::PointF(1, 1), SK_ColorTRANSPARENT, vertex_opacity,
+                       flipped, nearest_neighbor);
+  EXPECT_CALL(*validator, AllowCALayerOverlays())
+      .Times(1)
+      .WillOnce(::testing::Return(true));
+  EXPECT_CALL(*processor->strategy_, Attempt(_, _, _, _)).Times(0);
+  renderer.DrawFrame(&render_passes_in_draw_order_, 1.f, viewport_rect,
+                     viewport_rect, false);
 }
 
 class SingleOverlayOnTopProcessor : public OverlayProcessor {
@@ -2128,6 +2178,8 @@
       strategies->push_back(make_scoped_ptr(new OverlayStrategyUnderlay(this)));
     }
 
+    bool AllowCALayerOverlays() override { return false; }
+
     void CheckOverlaySupport(OverlayCandidateList* surfaces) override {
       ASSERT_EQ(1U, surfaces->size());
       OverlayCandidate& candidate = surfaces->back();
diff --git a/cc/output/overlay_candidate_validator.h b/cc/output/overlay_candidate_validator.h
index 8586b4d..09d380b 100644
--- a/cc/output/overlay_candidate_validator.h
+++ b/cc/output/overlay_candidate_validator.h
@@ -20,6 +20,9 @@
   // Populates a list of strategies that may work with this validator.
   virtual void GetStrategies(OverlayProcessor::StrategyList* strategies) = 0;
 
+  // Returns true if draw quads can be represented as CALayers (Mac only).
+  virtual bool AllowCALayerOverlays() = 0;
+
   // A list of possible overlay candidates is presented to this function.
   // The expected result is that those candidates that can be in a separate
   // plane are marked with |overlay_handled| set to true, otherwise they are
diff --git a/cc/output/overlay_processor.cc b/cc/output/overlay_processor.cc
index a97623a..2eea63b 100644
--- a/cc/output/overlay_processor.cc
+++ b/cc/output/overlay_processor.cc
@@ -7,6 +7,7 @@
 #include "cc/output/output_surface.h"
 #include "cc/output/overlay_strategy_single_on_top.h"
 #include "cc/output/overlay_strategy_underlay.h"
+#include "cc/quads/draw_quad.h"
 #include "ui/gfx/geometry/rect_conversions.h"
 #include "ui/gfx/transform.h"
 
@@ -25,6 +26,31 @@
 
 OverlayProcessor::~OverlayProcessor() {}
 
+bool OverlayProcessor::ProcessForCALayers(
+    ResourceProvider* resource_provider,
+    RenderPassList* render_passes,
+    CALayerOverlayList* ca_layer_overlays,
+    OverlayCandidateList* overlay_candidates) {
+  RenderPass* root_render_pass = render_passes->back();
+
+  OverlayCandidateValidator* overlay_validator =
+      surface_->GetOverlayCandidateValidator();
+  if (!overlay_validator || !overlay_validator->AllowCALayerOverlays())
+    return false;
+
+  if (!ProcessForCALayerOverlays(
+          resource_provider, gfx::RectF(root_render_pass->output_rect),
+          root_render_pass->quad_list, ca_layer_overlays))
+    return false;
+
+  // CALayer overlays are all-or-nothing. If all quads were replaced with
+  // layers then clear the list and remove the backbuffer from the overcandidate
+  // list.
+  overlay_candidates->clear();
+  render_passes->back()->quad_list.clear();
+  return true;
+}
+
 void OverlayProcessor::ProcessForOverlays(ResourceProvider* resource_provider,
                                           RenderPassList* render_passes,
                                           OverlayCandidateList* candidates,
diff --git a/cc/output/overlay_processor.h b/cc/output/overlay_processor.h
index 26bfe16..fbdfd263 100644
--- a/cc/output/overlay_processor.h
+++ b/cc/output/overlay_processor.h
@@ -8,6 +8,7 @@
 #include "base/basictypes.h"
 #include "base/memory/scoped_ptr.h"
 #include "cc/base/cc_export.h"
+#include "cc/output/ca_layer_overlay.h"
 #include "cc/output/overlay_candidate.h"
 #include "cc/quads/render_pass.h"
 
@@ -38,6 +39,11 @@
   // Virtual to allow testing different strategies.
   virtual void Initialize();
 
+  bool ProcessForCALayers(ResourceProvider* resource_provider,
+                          RenderPassList* render_passes,
+                          CALayerOverlayList* ca_layer_overlays,
+                          OverlayCandidateList* overlay_candidates);
+
   void ProcessForOverlays(ResourceProvider* resource_provider,
                           RenderPassList* render_passes,
                           OverlayCandidateList* candidates,
diff --git a/cc/output/overlay_strategy_all_or_nothing.cc b/cc/output/overlay_strategy_all_or_nothing.cc
deleted file mode 100644
index 8181e29..0000000
--- a/cc/output/overlay_strategy_all_or_nothing.cc
+++ /dev/null
@@ -1,47 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "cc/output/overlay_strategy_all_or_nothing.h"
-
-#include "cc/output/overlay_candidate_validator.h"
-#include "cc/quads/draw_quad.h"
-
-namespace cc {
-
-OverlayStrategyAllOrNothing::OverlayStrategyAllOrNothing(
-    OverlayCandidateValidator* capability_checker)
-    : capability_checker_(capability_checker) {
-  DCHECK(capability_checker);
-}
-
-OverlayStrategyAllOrNothing::~OverlayStrategyAllOrNothing() {}
-
-bool OverlayStrategyAllOrNothing::Attempt(ResourceProvider* resource_provider,
-                                          RenderPassList* render_passes,
-                                          OverlayCandidateList* candidates,
-                                          gfx::Rect* damage_rect) {
-  QuadList& quad_list = render_passes->back()->quad_list;
-  OverlayCandidateList new_candidates;
-  int next_z_order = -1;
-
-  for (const DrawQuad* quad : quad_list) {
-    OverlayCandidate candidate;
-    if (!OverlayCandidate::FromDrawQuad(resource_provider, quad, &candidate))
-      return false;
-    candidate.plane_z_order = next_z_order--;
-    new_candidates.push_back(candidate);
-  }
-
-  capability_checker_->CheckOverlaySupport(&new_candidates);
-  for (const OverlayCandidate& candidate : new_candidates) {
-    if (!candidate.overlay_handled)
-      return false;
-  }
-
-  quad_list.clear();
-  candidates->swap(new_candidates);
-  return true;
-}
-
-}  // namespace cc
diff --git a/cc/output/overlay_strategy_all_or_nothing.h b/cc/output/overlay_strategy_all_or_nothing.h
deleted file mode 100644
index 23d2aa3..0000000
--- a/cc/output/overlay_strategy_all_or_nothing.h
+++ /dev/null
@@ -1,36 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CC_OUTPUT_OVERLAY_STRATEGY_ALL_OR_NOTHING_H_
-#define CC_OUTPUT_OVERLAY_STRATEGY_ALL_OR_NOTHING_H_
-
-#include "cc/output/overlay_processor.h"
-
-namespace cc {
-
-class OverlayCandidateValidator;
-
-// This strategy attempts to promote all quads into overlays.
-// If any quad can't be promoted, it returns false and no quads are promoted.
-class CC_EXPORT OverlayStrategyAllOrNothing
-    : public OverlayProcessor::Strategy {
- public:
-  explicit OverlayStrategyAllOrNothing(
-      OverlayCandidateValidator* capability_checker);
-  ~OverlayStrategyAllOrNothing() override;
-
-  bool Attempt(ResourceProvider* resource_provider,
-               RenderPassList* render_passes,
-               OverlayCandidateList* candidate_list,
-               gfx::Rect* damage_rect) override;
-
- private:
-  OverlayCandidateValidator* capability_checker_;  // Weak.
-
-  DISALLOW_COPY_AND_ASSIGN(OverlayStrategyAllOrNothing);
-};
-
-}  // namespace cc
-
-#endif  // CC_OUTPUT_OVERLAY_STRATEGY_ALL_OR_NOTHING_H_
diff --git a/cc/output/overlay_unittest.cc b/cc/output/overlay_unittest.cc
index dd325bd..29403ee 100644
--- a/cc/output/overlay_unittest.cc
+++ b/cc/output/overlay_unittest.cc
@@ -10,7 +10,6 @@
 #include "cc/output/output_surface_client.h"
 #include "cc/output/overlay_candidate_validator.h"
 #include "cc/output/overlay_processor.h"
-#include "cc/output/overlay_strategy_all_or_nothing.h"
 #include "cc/output/overlay_strategy_sandwich.h"
 #include "cc/output/overlay_strategy_single_on_top.h"
 #include "cc/output/overlay_strategy_underlay.h"
@@ -64,6 +63,7 @@
         make_scoped_ptr(new OverlayStrategySingleOnTop(this)));
     strategies->push_back(make_scoped_ptr(new OverlayStrategyUnderlay(this)));
   }
+  bool AllowCALayerOverlays() override { return false; }
   void CheckOverlaySupport(OverlayCandidateList* surfaces) override {
     // We may have 1 or 2 surfaces depending on whether this ran through the
     // full renderer and picked up the output surface, or not.
@@ -91,6 +91,13 @@
   }
 };
 
+class CALayerValidator : public OverlayCandidateValidator {
+ public:
+  void GetStrategies(OverlayProcessor::StrategyList* strategies) override {}
+  bool AllowCALayerOverlays() override { return true; }
+  void CheckOverlaySupport(OverlayCandidateList* surfaces) override {}
+};
+
 class SingleOnTopOverlayValidator : public SingleOverlayValidator {
  public:
   void GetStrategies(OverlayProcessor::StrategyList* strategies) override {
@@ -111,18 +118,7 @@
   void GetStrategies(OverlayProcessor::StrategyList* strategies) override {
     strategies->push_back(make_scoped_ptr(new OverlayStrategySandwich(this)));
   }
-  void CheckOverlaySupport(OverlayCandidateList* surfaces) override {
-    for (OverlayCandidate& candidate : *surfaces)
-      candidate.overlay_handled = true;
-  }
-};
-
-class AllOrNothingOverlayValidator : public OverlayCandidateValidator {
- public:
-  void GetStrategies(OverlayProcessor::StrategyList* strategies) override {
-    strategies->push_back(
-        make_scoped_ptr(new OverlayStrategyAllOrNothing(this)));
-  }
+  bool AllowCALayerOverlays() override { return false; }
   void CheckOverlaySupport(OverlayCandidateList* surfaces) override {
     for (OverlayCandidate& candidate : *surfaces)
       candidate.overlay_handled = true;
@@ -370,7 +366,7 @@
 typedef OverlayTest<SingleOnTopOverlayValidator> SingleOverlayOnTopTest;
 typedef OverlayTest<UnderlayOverlayValidator> UnderlayTest;
 typedef OverlayTest<SandwichOverlayValidator> SandwichTest;
-typedef OverlayTest<AllOrNothingOverlayValidator> AllOrNothingOverlayTest;
+typedef OverlayTest<CALayerValidator> CALayerOverlayTest;
 
 TEST(OverlayTest, NoOverlaysByDefault) {
   scoped_refptr<TestContextProvider> provider = TestContextProvider::Create();
@@ -1327,90 +1323,137 @@
   DCHECK(!damage_rect_.IsEmpty());
 }
 
-TEST_F(AllOrNothingOverlayTest, SuccessfulOverlappingOverlays) {
-  scoped_ptr<RenderPass> pass = CreateRenderPass();
-
-  // Add two overlapping candidates.
-  CreateCandidateQuadAt(resource_provider_.get(),
-                        pass->shared_quad_state_list.back(), pass.get(),
-                        kOverlayTopLeftRect);
-  CreateCandidateQuadAt(resource_provider_.get(),
-                        pass->shared_quad_state_list.back(), pass.get(),
-                        kOverlayRect);
-
-  RenderPassList pass_list;
-  pass_list.push_back(pass.Pass());
-  OverlayCandidateList candidates;
-  overlay_processor_->ProcessForOverlays(resource_provider_.get(), &pass_list,
-                                         &candidates, &damage_rect_);
-
-  // Both quads should become overlays.
-  EXPECT_EQ(2u, candidates.size());
-  EXPECT_EQ(-1, candidates[0].plane_z_order);
-  EXPECT_EQ(-2, candidates[1].plane_z_order);
-  EXPECT_EQ(gfx::RectF(kOverlayTopLeftRect), candidates[0].display_rect);
-  EXPECT_EQ(gfx::RectF(kOverlayRect), candidates[1].display_rect);
-
-  // All quads should be gone.
-  EXPECT_TRUE(pass_list.back()->quad_list.empty());
+OverlayCandidateList BackbufferOverlayList(const RenderPass* root_render_pass) {
+  OverlayCandidateList list;
+  OverlayCandidate output_surface_plane;
+  output_surface_plane.display_rect = gfx::RectF(root_render_pass->output_rect);
+  output_surface_plane.quad_rect_in_target_space =
+      root_render_pass->output_rect;
+  output_surface_plane.use_output_surface_for_resource = true;
+  output_surface_plane.overlay_handled = true;
+  list.push_back(output_surface_plane);
+  return list;
 }
 
-TEST_F(AllOrNothingOverlayTest, RejectQuadWithTransform) {
-  scoped_ptr<RenderPass> pass = CreateRenderPass();
-
-  CreateCandidateQuadAt(resource_provider_.get(),
-                        pass->shared_quad_state_list.back(), pass.get(),
-                        kOverlayTopLeftRect);
-
-  // Add a rotated quad that can't be promoted into overlay.
-  SharedQuadState* shared_state = pass->CreateAndAppendSharedQuadState();
-  shared_state->opacity = 1.f;
-  shared_state->quad_to_target_transform.Rotate(90);
-  CreateSolidColorQuadAt(shared_state, SK_ColorBLACK, pass.get(),
-                         kOverlayBottomRightRect);
-
-  RenderPassList pass_list;
-  pass_list.push_back(pass.Pass());
-  OverlayCandidateList candidates;
-  overlay_processor_->ProcessForOverlays(resource_provider_.get(), &pass_list,
-                                         &candidates, &damage_rect_);
-
-  // No quads should become overlays.
-  EXPECT_EQ(0u, candidates.size());
-  EXPECT_EQ(2u, pass_list.back()->quad_list.size());
-}
-
-TEST_F(AllOrNothingOverlayTest, DamageRect) {
+TEST_F(CALayerOverlayTest, AllowNonAxisAlignedTransform) {
   scoped_ptr<RenderPass> pass = CreateRenderPass();
   CreateFullscreenCandidateQuad(resource_provider_.get(),
                                 pass->shared_quad_state_list.back(),
                                 pass.get());
-
-  damage_rect_ = kOverlayRect;
-
-  // Add something behind it.
-  CreateFullscreenOpaqueQuad(resource_provider_.get(),
-                             pass->shared_quad_state_list.back(), pass.get());
-  CreateFullscreenOpaqueQuad(resource_provider_.get(),
-                             pass->shared_quad_state_list.back(), pass.get());
+  pass->shared_quad_state_list.back()
+      ->quad_to_target_transform.RotateAboutZAxis(45.f);
 
   RenderPassList pass_list;
   pass_list.push_back(pass.Pass());
+  CALayerOverlayList ca_layer_list;
+  OverlayCandidateList overlay_list(BackbufferOverlayList(pass_list.back()));
+  overlay_processor_->ProcessForCALayers(resource_provider_.get(), &pass_list,
+                                         &ca_layer_list, &overlay_list);
+  ASSERT_EQ(1U, pass_list.size());
+  EXPECT_EQ(0U, pass_list.back()->quad_list.size());
+  EXPECT_EQ(0U, overlay_list.size());
+  EXPECT_EQ(1U, ca_layer_list.size());
+}
 
-  // Check for potential candidates.
-  OverlayCandidateList candidate_list;
+TEST_F(CALayerOverlayTest, Disallow3DTransform) {
+  scoped_ptr<RenderPass> pass = CreateRenderPass();
+  CreateFullscreenCandidateQuad(resource_provider_.get(),
+                                pass->shared_quad_state_list.back(),
+                                pass.get());
+  pass->shared_quad_state_list.back()
+      ->quad_to_target_transform.RotateAboutXAxis(45.f);
 
-  // Primary plane.
-  OverlayCandidate output_surface_plane;
-  output_surface_plane.display_rect = gfx::RectF(kOverlayRect);
-  output_surface_plane.quad_rect_in_target_space = kOverlayRect;
-  output_surface_plane.use_output_surface_for_resource = true;
-  output_surface_plane.overlay_handled = true;
-  candidate_list.push_back(output_surface_plane);
+  RenderPassList pass_list;
+  pass_list.push_back(pass.Pass());
+  CALayerOverlayList ca_layer_list;
+  OverlayCandidateList overlay_list(BackbufferOverlayList(pass_list.back()));
+  overlay_processor_->ProcessForCALayers(resource_provider_.get(), &pass_list,
+                                         &ca_layer_list, &overlay_list);
+  ASSERT_EQ(1U, pass_list.size());
+  EXPECT_EQ(1U, pass_list.back()->quad_list.size());
+  EXPECT_EQ(1U, overlay_list.size());
+  EXPECT_EQ(0U, ca_layer_list.size());
+}
 
-  overlay_processor_->ProcessForOverlays(resource_provider_.get(), &pass_list,
-                                         &candidate_list, &damage_rect_);
-  DCHECK(!damage_rect_.IsEmpty());
+TEST_F(CALayerOverlayTest, AllowContainingClip) {
+  scoped_ptr<RenderPass> pass = CreateRenderPass();
+  CreateFullscreenCandidateQuad(resource_provider_.get(),
+                                pass->shared_quad_state_list.back(),
+                                pass.get());
+  pass->shared_quad_state_list.back()->is_clipped = true;
+  pass->shared_quad_state_list.back()->clip_rect = kOverlayRect;
+
+  RenderPassList pass_list;
+  pass_list.push_back(pass.Pass());
+  CALayerOverlayList ca_layer_list;
+  OverlayCandidateList overlay_list(BackbufferOverlayList(pass_list.back()));
+  overlay_processor_->ProcessForCALayers(resource_provider_.get(), &pass_list,
+                                         &ca_layer_list, &overlay_list);
+  ASSERT_EQ(1U, pass_list.size());
+  EXPECT_EQ(0U, pass_list.back()->quad_list.size());
+  EXPECT_EQ(0U, overlay_list.size());
+  EXPECT_EQ(1U, ca_layer_list.size());
+}
+
+TEST_F(CALayerOverlayTest, SkipDisjointClip) {
+  scoped_ptr<RenderPass> pass = CreateRenderPass();
+  CreateFullscreenCandidateQuad(resource_provider_.get(),
+                                pass->shared_quad_state_list.back(),
+                                pass.get());
+  pass->shared_quad_state_list.back()->is_clipped = true;
+  pass->shared_quad_state_list.back()->clip_rect =
+      gfx::Rect(128, 128, 128, 128);
+
+  RenderPassList pass_list;
+  pass_list.push_back(pass.Pass());
+  CALayerOverlayList ca_layer_list;
+  OverlayCandidateList overlay_list(BackbufferOverlayList(pass_list.back()));
+  overlay_processor_->ProcessForCALayers(resource_provider_.get(), &pass_list,
+                                         &ca_layer_list, &overlay_list);
+  ASSERT_EQ(1U, pass_list.size());
+  EXPECT_EQ(0U, pass_list.back()->quad_list.size());
+  EXPECT_EQ(0U, overlay_list.size());
+  EXPECT_EQ(0U, ca_layer_list.size());
+}
+
+TEST_F(CALayerOverlayTest, DisallowNontrivialClip) {
+  scoped_ptr<RenderPass> pass = CreateRenderPass();
+  CreateFullscreenCandidateQuad(resource_provider_.get(),
+                                pass->shared_quad_state_list.back(),
+                                pass.get());
+  pass->shared_quad_state_list.back()->is_clipped = true;
+  pass->shared_quad_state_list.back()->clip_rect = gfx::Rect(64, 64, 128, 128);
+
+  RenderPassList pass_list;
+  pass_list.push_back(pass.Pass());
+  CALayerOverlayList ca_layer_list;
+  OverlayCandidateList overlay_list(BackbufferOverlayList(pass_list.back()));
+  overlay_processor_->ProcessForCALayers(resource_provider_.get(), &pass_list,
+                                         &ca_layer_list, &overlay_list);
+
+  ASSERT_EQ(1U, pass_list.size());
+  EXPECT_EQ(1U, pass_list.back()->quad_list.size());
+  EXPECT_EQ(1U, overlay_list.size());
+  EXPECT_EQ(0U, ca_layer_list.size());
+}
+
+TEST_F(CALayerOverlayTest, SkipTransparent) {
+  scoped_ptr<RenderPass> pass = CreateRenderPass();
+  CreateFullscreenCandidateQuad(resource_provider_.get(),
+                                pass->shared_quad_state_list.back(),
+                                pass.get());
+  pass->shared_quad_state_list.back()->opacity = 0;
+
+  RenderPassList pass_list;
+  pass_list.push_back(pass.Pass());
+  CALayerOverlayList ca_layer_list;
+  OverlayCandidateList overlay_list(BackbufferOverlayList(pass_list.back()));
+  overlay_processor_->ProcessForCALayers(resource_provider_.get(), &pass_list,
+                                         &ca_layer_list, &overlay_list);
+  ASSERT_EQ(1U, pass_list.size());
+  EXPECT_EQ(0U, pass_list.back()->quad_list.size());
+  EXPECT_EQ(0U, overlay_list.size());
+  EXPECT_EQ(0U, ca_layer_list.size());
 }
 
 class OverlayInfoRendererGL : public GLRenderer {
diff --git a/cc/playback/display_item_list.cc b/cc/playback/display_item_list.cc
index 6d0edc65..6dd3778 100644
--- a/cc/playback/display_item_list.cc
+++ b/cc/playback/display_item_list.cc
@@ -60,7 +60,7 @@
   for (int i = 0; i < proto.items_size(); i++) {
     const proto::DisplayItem& item_proto = proto.items(i);
     DisplayItem* item =
-        DisplayItemProtoFactory::AllocateAndConstruct(list, item_proto);
+        DisplayItemProtoFactory::AllocateAndConstruct(list.get(), item_proto);
     if (item)
       item->FromProtobuf(item_proto);
   }
diff --git a/cc/playback/display_item_proto_factory.cc b/cc/playback/display_item_proto_factory.cc
index b71fc9ae..fae2b27 100644
--- a/cc/playback/display_item_proto_factory.cc
+++ b/cc/playback/display_item_proto_factory.cc
@@ -17,7 +17,7 @@
 
 // static
 DisplayItem* DisplayItemProtoFactory::AllocateAndConstruct(
-    scoped_refptr<DisplayItemList> list,
+    DisplayItemList* list,
     const proto::DisplayItem& proto) {
   switch (proto.type()) {
     case proto::DisplayItem::Type_Clip:
diff --git a/cc/playback/display_item_proto_factory.h b/cc/playback/display_item_proto_factory.h
index 43325df9..3db3b7eb 100644
--- a/cc/playback/display_item_proto_factory.h
+++ b/cc/playback/display_item_proto_factory.h
@@ -18,7 +18,7 @@
 
 class DisplayItemProtoFactory {
  public:
-  static DisplayItem* AllocateAndConstruct(scoped_refptr<DisplayItemList> list,
+  static DisplayItem* AllocateAndConstruct(DisplayItemList* list,
                                            const proto::DisplayItem& proto);
 
  private:
diff --git a/cc/test/fake_output_surface.cc b/cc/test/fake_output_surface.cc
index 4ba4971..e30806ec 100644
--- a/cc/test/fake_output_surface.cc
+++ b/cc/test/fake_output_surface.cc
@@ -23,7 +23,8 @@
       num_sent_frames_(0),
       has_external_stencil_test_(false),
       suspended_for_recycle_(false),
-      framebuffer_(0) {
+      framebuffer_(0),
+      overlay_candidate_validator_(nullptr) {
   if (delegated_rendering) {
     capabilities_.delegated_rendering = true;
     capabilities_.max_frames_pending = 1;
@@ -38,7 +39,8 @@
       num_sent_frames_(0),
       has_external_stencil_test_(false),
       suspended_for_recycle_(false),
-      framebuffer_(0) {
+      framebuffer_(0),
+      overlay_candidate_validator_(nullptr) {
   if (delegated_rendering) {
     capabilities_.delegated_rendering = true;
     capabilities_.max_frames_pending = 1;
@@ -53,7 +55,8 @@
       num_sent_frames_(0),
       has_external_stencil_test_(false),
       suspended_for_recycle_(false),
-      framebuffer_(0) {
+      framebuffer_(0),
+      overlay_candidate_validator_(nullptr) {
   if (delegated_rendering) {
     capabilities_.delegated_rendering = true;
     capabilities_.max_frames_pending = 1;
@@ -69,7 +72,8 @@
       num_sent_frames_(0),
       has_external_stencil_test_(false),
       suspended_for_recycle_(false),
-      framebuffer_(0) {
+      framebuffer_(0),
+      overlay_candidate_validator_(nullptr) {
   if (delegated_rendering) {
     capabilities_.delegated_rendering = true;
     capabilities_.max_frames_pending = 1;
@@ -147,6 +151,11 @@
   return suspended_for_recycle_;
 }
 
+OverlayCandidateValidator* FakeOutputSurface::GetOverlayCandidateValidator()
+    const {
+  return overlay_candidate_validator_;
+}
+
 void FakeOutputSurface::SetMemoryPolicyToSetAtBind(
     scoped_ptr<ManagedMemoryPolicy> memory_policy_to_set_at_bind) {
   memory_policy_to_set_at_bind_.swap(memory_policy_to_set_at_bind);
diff --git a/cc/test/fake_output_surface.h b/cc/test/fake_output_surface.h
index 7819848a..34274d85 100644
--- a/cc/test/fake_output_surface.h
+++ b/cc/test/fake_output_surface.h
@@ -117,6 +117,11 @@
 
   bool SurfaceIsSuspendForRecycle() const override;
 
+  OverlayCandidateValidator* GetOverlayCandidateValidator() const override;
+  void SetOverlayCandidateValidator(OverlayCandidateValidator* validator) {
+    overlay_candidate_validator_ = validator;
+  }
+
   void set_has_external_stencil_test(bool has_test) {
     has_external_stencil_test_ = has_test;
   }
@@ -157,6 +162,7 @@
   unsigned framebuffer_;
   TransferableResourceArray resources_held_by_parent_;
   scoped_ptr<ManagedMemoryPolicy> memory_policy_to_set_at_bind_;
+  OverlayCandidateValidator* overlay_candidate_validator_;
   gfx::Rect last_swap_rect_;
 };
 
diff --git a/cc/trees/layer_tree_host_common_unittest.cc b/cc/trees/layer_tree_host_common_unittest.cc
index 758040a..53a804cf 100644
--- a/cc/trees/layer_tree_host_common_unittest.cc
+++ b/cc/trees/layer_tree_host_common_unittest.cc
@@ -5951,6 +5951,55 @@
   EXPECT_EQ(0u, render_surface2->num_unclipped_descendants());
 }
 
+TEST_F(LayerTreeHostCommonTest,
+       CreateRenderSurfaceWhenFlattenInsideRenderingContext) {
+  // Verifies that Render Surfaces are created at the edge of rendering context.
+
+  scoped_refptr<LayerWithForcedDrawsContent> parent =
+      make_scoped_refptr(new LayerWithForcedDrawsContent(layer_settings()));
+  Layer* root = parent.get();
+  scoped_refptr<LayerWithForcedDrawsContent> child_1 =
+      make_scoped_refptr(new LayerWithForcedDrawsContent(layer_settings()));
+  Layer* child1 = child_1.get();
+  scoped_refptr<LayerWithForcedDrawsContent> child_2 =
+      make_scoped_refptr(new LayerWithForcedDrawsContent(layer_settings()));
+  Layer* child2 = child_2.get();
+  scoped_refptr<LayerWithForcedDrawsContent> child_3 =
+      make_scoped_refptr(new LayerWithForcedDrawsContent(layer_settings()));
+  Layer* child3 = child_3.get();
+
+  parent->AddChild(child_1.Pass());
+  child1->AddChild(child_2.Pass());
+  child2->AddChild(child_3.Pass());
+
+  host()->SetRootLayer(root);
+
+  const gfx::Transform identity_matrix;
+  gfx::Point3F transform_origin;
+  gfx::PointF position;
+  gfx::Size bounds(100, 100);
+
+  SetLayerPropertiesForTesting(root, identity_matrix, transform_origin,
+                               position, bounds, true, false);
+  SetLayerPropertiesForTesting(child1, identity_matrix, transform_origin,
+                               position, bounds, false, true);
+  SetLayerPropertiesForTesting(child2, identity_matrix, transform_origin,
+                               position, bounds, true, false);
+  SetLayerPropertiesForTesting(child3, identity_matrix, transform_origin,
+                               position, bounds, true, false);
+
+  child2->Set3dSortingContextId(1);
+  child3->Set3dSortingContextId(1);
+
+  ExecuteCalculateDrawPropertiesWithPropertyTrees(parent.get());
+
+  // Verify which render surfaces were created.
+  EXPECT_TRUE(root->has_render_surface());
+  EXPECT_FALSE(child1->has_render_surface());
+  EXPECT_TRUE(child2->has_render_surface());
+  EXPECT_FALSE(child3->has_render_surface());
+}
+
 TEST_F(LayerTreeHostCommonTest, CanRenderToSeparateSurface) {
   FakeImplTaskRunnerProvider task_runner_provider;
   TestSharedBitmapManager shared_bitmap_manager;
@@ -5977,10 +6026,10 @@
   // This layer structure normally forces render surface due to preserves3d
   // behavior.
   SetLayerPropertiesForTesting(child1.get(), identity_matrix, transform_origin,
-                               position, bounds, false, true, true);
+                               position, bounds, false, true, false);
   child1->SetDrawsContent(true);
   SetLayerPropertiesForTesting(child2.get(), identity_matrix, transform_origin,
-                               position, bounds, true, false, false);
+                               position, bounds, true, false, true);
   child2->SetDrawsContent(true);
   SetLayerPropertiesForTesting(child3.get(), identity_matrix, transform_origin,
                                position, bounds, true, false, false);
diff --git a/chrome/android/java/AndroidManifest.xml b/chrome/android/java/AndroidManifest.xml
index 6d932553..30c1bf0 100644
--- a/chrome/android/java/AndroidManifest.xml
+++ b/chrome/android/java/AndroidManifest.xml
@@ -261,12 +261,6 @@
             android:windowSoftInputMode="stateHidden|adjustPan"
             android:configChanges="orientation|keyboardHidden|keyboard|screenSize|mcc|mnc">
             <intent-filter>
-                <action android:name="android.intent.action.VIEW" />
-                <category android:name="android.intent.category.DEFAULT" />
-                <category android:name="android.intent.category.BROWSABLE" />
-                <data android:scheme="chrome" android:host="editbookmark" />
-            </intent-filter>
-            <intent-filter>
                 <!-- This is sent by the BrowserProviderProxy as a result of
                      calls to android.provider.Browser.saveBookmark(). -->
                 <action android:name="{{ manifest_package }}.ADDBOOKMARK" />
diff --git a/chrome/android/java/res/layout/contextual_search_peek_promo_text_view.xml b/chrome/android/java/res/layout/contextual_search_peek_promo_text_view.xml
index a1fa7b2..5632773 100644
--- a/chrome/android/java/res/layout/contextual_search_peek_promo_text_view.xml
+++ b/chrome/android/java/res/layout/contextual_search_peek_promo_text_view.xml
@@ -18,6 +18,7 @@
         android:layout_height="wrap_content"
         android:layout_marginEnd="@dimen/contextual_search_peek_promo_padding"
         android:background="@drawable/contextual_search_peek_promo_new_background"
+        android:fontFamily="sans-serif-medium"
         android:text="@string/contextual_search_peek_promo_new"
         android:textAllCaps="true"
         android:textColor="@color/light_active_color"
@@ -28,6 +29,7 @@
         android:id="@+id/contextual_search_peek_promo_text"
         android:layout_width="wrap_content"
         android:layout_height="wrap_content"
+        android:fontFamily="sans-serif"
         android:text="@string/contextual_search_peek_promo_text"
         android:textColor="#FFF"
         android:textSize="14sp"
diff --git a/chrome/android/java/res/layout/snackbar.xml b/chrome/android/java/res/layout/snackbar.xml
index 1199160..c3a57b4 100644
--- a/chrome/android/java/res/layout/snackbar.xml
+++ b/chrome/android/java/res/layout/snackbar.xml
@@ -3,7 +3,8 @@
      Use of this source code is governed by a BSD-style license that can be
      found in the LICENSE file. -->
 
-<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
+<view xmlns:android="http://schemas.android.com/apk/res/android"
+    class="org.chromium.chrome.browser.snackbar.SnackbarManager$WindowDismissalAwareLayout"
     android:layout_width="match_parent"
     android:layout_height="wrap_content"
     android:minHeight="@dimen/snackbar_min_height"
@@ -35,4 +36,4 @@
         android:textSize="14sp"
         style="@style/ButtonCompatBorderless" />
 
-</LinearLayout>
+</view>
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/ChromeActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/ChromeActivity.java
index 837ce237..9863806 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/ChromeActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/ChromeActivity.java
@@ -259,7 +259,7 @@
         mWindowAndroid = ((ChromeApplication) getApplicationContext())
                 .createActivityWindowAndroid(this);
         mWindowAndroid.restoreInstanceState(getSavedInstanceState());
-        mSnackbarManager = new SnackbarManager(getWindow());
+        mSnackbarManager = new SnackbarManager(this);
         mLoFiBarPopupController = new LoFiBarPopupController(this, getSnackbarManager());
         mDataUseSnackbarController = new DataUseSnackbarController(this, getSnackbarManager());
 
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/bookmark/ManageBookmarkActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/bookmark/ManageBookmarkActivity.java
index 04ac2863..f04aba1 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/bookmark/ManageBookmarkActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/bookmark/ManageBookmarkActivity.java
@@ -11,7 +11,6 @@
 import android.content.Intent;
 import android.content.pm.PackageManager;
 import android.content.res.Configuration;
-import android.net.Uri;
 import android.nfc.NfcAdapter;
 import android.os.Bundle;
 import android.os.Process;
@@ -23,6 +22,8 @@
 import org.chromium.base.annotations.SuppressFBWarnings;
 import org.chromium.base.library_loader.ProcessInitException;
 import org.chromium.chrome.browser.ChromeApplication;
+import org.chromium.chrome.browser.ChromeBrowserProviderClient;
+import org.chromium.chrome.browser.util.IntentUtils;
 import org.chromium.components.dom_distiller.core.DomDistillerUrlUtils;
 import org.chromium.ui.UiUtils;
 import org.chromium.ui.base.DeviceFormFactor;
@@ -33,9 +34,6 @@
  */
 public class ManageBookmarkActivity extends FragmentActivity {
 
-    private static final String BOOKMARK_ID_URI_PARAM = "id";
-    private static final String BOOKMARK_IS_FOLDER_URI_PARAM = "isfolder";
-
     private static final String TAG = "ManageBookmarkActivity";
 
     /* TODO(gb-deprecation): Use android.provider.BrowserContract.Bookmarks.IS_FOLDER */
@@ -197,36 +195,18 @@
             throw new IllegalArgumentException("intent can not be null");
         }
         Intent intent = getIntent();
-        Uri intentUri = intent.getData();
 
-        Long bookmarkId = null;
-        boolean isFolder = false;
-        AddEditBookmarkFragment addEditFragment;
-        if (intentUri != null && intentUri.getHost().equals("editbookmark")) {
-            isFolder = intentUri.getBooleanQueryParameter(BOOKMARK_IS_FOLDER_URI_PARAM, false);
-            String bookmarkIdParam = intentUri.getQueryParameter(BOOKMARK_ID_URI_PARAM);
-            if (bookmarkIdParam != null) bookmarkId = Long.parseLong(bookmarkIdParam);
-            addEditFragment = AddEditBookmarkFragment.newEditInstance(isFolder, bookmarkId);
-        } else {
-            Bundle extras = intent.getExtras();
-            String url = null;
-            String name = null;
-            if (extras != null) {
-                isFolder = extras.getBoolean(BOOKMARK_INTENT_IS_FOLDER, false);
+        boolean isFolder = IntentUtils.safeGetBooleanExtra(
+                intent, BOOKMARK_INTENT_IS_FOLDER, false);
+        String name = IntentUtils.safeGetStringExtra(intent, BOOKMARK_INTENT_TITLE);
+        String url = IntentUtils.safeGetStringExtra(intent, BOOKMARK_INTENT_URL);
+        if (url != null) url = DomDistillerUrlUtils.getOriginalUrlFromDistillerUrl(url);
+        long bookmarkId = IntentUtils.safeGetLongExtra(
+                intent, BOOKMARK_INTENT_ID, ChromeBrowserProviderClient.INVALID_BOOKMARK_ID);
 
-                if (extras.containsKey(BOOKMARK_INTENT_TITLE)) {
-                    name = extras.getString(BOOKMARK_INTENT_TITLE);
-                }
-                if (extras.containsKey(BOOKMARK_INTENT_URL)) {
-                    url = extras.getString(BOOKMARK_INTENT_URL);
-                    url = DomDistillerUrlUtils.getOriginalUrlFromDistillerUrl(url);
-                }
-                if (extras.containsKey(BOOKMARK_INTENT_ID)) {
-                    bookmarkId = extras.getLong(BOOKMARK_INTENT_ID);
-                }
-            }
-            addEditFragment = AddEditBookmarkFragment.newInstance(isFolder, bookmarkId, name, url);
-        }
+        AddEditBookmarkFragment addEditFragment = AddEditBookmarkFragment.newInstance(
+                isFolder, bookmarkId, name, url);
+
         setActionListenerOnAddEdit(addEditFragment);
         return addEditFragment;
     }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/crash/MinidumpUploadCallable.java b/chrome/android/java/src/org/chromium/chrome/browser/crash/MinidumpUploadCallable.java
index 730589f..24ac9c2 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/crash/MinidumpUploadCallable.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/crash/MinidumpUploadCallable.java
@@ -38,7 +38,7 @@
  * and false otherwise.
  */
 public class MinidumpUploadCallable implements Callable<Integer> {
-    private static final String TAG = "cr.MDUploadCallable";
+    private static final String TAG = "MDUploadCallable";
 
     // These preferences are obsolete and are kept only for removing from user preferences.
     protected static final String PREF_DAY_UPLOAD_COUNT = "crash_day_dump_upload_count";
@@ -84,13 +84,15 @@
 
     @Override
     public Integer call() {
-        if (!mPermManager.isUploadPermitted()) {
-            Log.i(TAG, "Minidump upload is not permitted");
+        if (!mPermManager.isUploadUserPermitted()) {
+            Log.i(TAG, "Minidump upload is not permitted by user. Marking file as uploaded for "
+                    + "cleanup to prevent future uploads.");
+            cleanupMinidumpFile();
             return UPLOAD_DISABLED;
         }
 
         boolean isLimited = mPermManager.isUploadLimited();
-        if (isLimited) {
+        if (isLimited || !mPermManager.isUploadPermitted()) {
             Log.i(TAG, "Minidump cannot currently be uploaded due to constraints.");
             return UPLOAD_FAILURE;
         }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/download/DownloadManagerService.java b/chrome/android/java/src/org/chromium/chrome/browser/download/DownloadManagerService.java
index 9a605ee..b82177b 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/download/DownloadManagerService.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/download/DownloadManagerService.java
@@ -962,7 +962,8 @@
      * @param reason Reason of failure reported by android DownloadManager
      */
     protected void onDownloadFailed(String fileName, int reason) {
-        String reasonString = mContext.getString(R.string.download_failed_reason_unknown_error);
+        String reasonString = mContext.getString(
+                R.string.download_failed_reason_unknown_error, fileName);
         switch (reason) {
             case DownloadManager.ERROR_FILE_ALREADY_EXISTS:
                 reasonString = mContext.getString(
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/enhancedbookmarks/EnhancedBookmarkActivity.java b/chrome/android/java/src/org/chromium/chrome/browser/enhancedbookmarks/EnhancedBookmarkActivity.java
index 26d922f..f4975e3 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/enhancedbookmarks/EnhancedBookmarkActivity.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/enhancedbookmarks/EnhancedBookmarkActivity.java
@@ -33,7 +33,7 @@
     protected void onCreate(Bundle savedInstanceState) {
         super.onCreate(savedInstanceState);
         getWindow().clearFlags(WindowManager.LayoutParams.FLAG_DRAWS_SYSTEM_BAR_BACKGROUNDS);
-        mSnackbarManager = new SnackbarManager(getWindow());
+        mSnackbarManager = new SnackbarManager(this);
         mBookmarkManager = new EnhancedBookmarkManager(this);
         setContentView(mBookmarkManager.getView());
         EnhancedBookmarkUtils.setTaskDescriptionInDocumentMode(this, getString(
@@ -45,6 +45,12 @@
     }
 
     @Override
+    protected void onStop() {
+        super.onStop();
+        mSnackbarManager.dismissAllSnackbars(false);
+    }
+
+    @Override
     protected void onDestroy() {
         super.onDestroy();
         mBookmarkManager.destroy();
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/preferences/privacy/CrashReportingPermissionManager.java b/chrome/android/java/src/org/chromium/chrome/browser/preferences/privacy/CrashReportingPermissionManager.java
index 35ef39d8..4675f809 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/preferences/privacy/CrashReportingPermissionManager.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/preferences/privacy/CrashReportingPermissionManager.java
@@ -16,6 +16,13 @@
     public boolean isUploadPermitted();
 
     /**
+     * Check whether to allow uploading crash dump now based on user consent only.
+     *
+     * @return whether user allows uploading crash dump.
+     */
+    public boolean isUploadUserPermitted();
+
+    /**
      * Check whether uploading crash dump should be in constrained mode based on user experiments
      * and current connection type. This function shows whether in general uploads should be limited
      * for this user and does not determine whether crash uploads are currently possible or not. Use
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/preferences/privacy/PrivacyPreferencesManager.java b/chrome/android/java/src/org/chromium/chrome/browser/preferences/privacy/PrivacyPreferencesManager.java
index b1af0eaa..48de3256 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/preferences/privacy/PrivacyPreferencesManager.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/preferences/privacy/PrivacyPreferencesManager.java
@@ -246,6 +246,26 @@
     }
 
     /**
+     * Check whether the user allows uploading.
+     * This doesn't take network condition into consideration.
+     * A crash dump may be retried if this check passes.
+     *
+     * @return whether user's preference allows uploading crash dump.
+     */
+    @Override
+    public boolean isUploadUserPermitted() {
+        if (!mCrashUploadingEnabled) return false;
+        if (isCellularExperimentEnabled()) return isUsageAndCrashReportingEnabled();
+
+        if (isMobileNetworkCapable()) {
+            String option =
+                    mSharedPreferences.getString(PREF_CRASH_DUMP_UPLOAD, mCrashDumpNeverUpload);
+            return option.equals(mCrashDumpAlwaysUpload) || option.equals(mCrashDumpWifiOnlyUpload);
+        }
+        return mSharedPreferences.getBoolean(PREF_CRASH_DUMP_UPLOAD_NO_CELLULAR, false);
+    }
+
+    /**
      * Check whether uploading crash dump should be in constrained mode based on user experiments
      * and current connection type. This function shows whether in general uploads should be limited
      * for this user and does not determine whether crash uploads are currently possible or not. Use
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/snackbar/SnackbarManager.java b/chrome/android/java/src/org/chromium/chrome/browser/snackbar/SnackbarManager.java
index 79bd120..885c8d8 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/snackbar/SnackbarManager.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/snackbar/SnackbarManager.java
@@ -4,13 +4,18 @@
 
 package org.chromium.chrome.browser.snackbar;
 
+import android.annotation.TargetApi;
+import android.app.Activity;
+import android.content.Context;
 import android.graphics.Rect;
+import android.os.Build;
 import android.os.Handler;
+import android.util.AttributeSet;
 import android.view.Gravity;
 import android.view.View;
 import android.view.View.OnClickListener;
 import android.view.ViewTreeObserver.OnGlobalLayoutListener;
-import android.view.Window;
+import android.widget.LinearLayout;
 
 import org.chromium.base.ApiCompatibilityUtils;
 import org.chromium.base.VisibleForTesting;
@@ -38,6 +43,29 @@
  */
 public class SnackbarManager implements OnClickListener, OnGlobalLayoutListener {
 
+    private static RuntimeException sWindowDetachTrace;
+
+    /**
+     * A {@link LinearLayout} that logs the stack trace when {@link #onDetachedFromWindow()} is
+     * called.
+     */
+    public static class WindowDismissalAwareLayout extends LinearLayout {
+        // TODO(ianwen): remove this class after crbug.com/553569 is fixed.
+        /**
+         * Constructor for XML inflation.
+         */
+        public WindowDismissalAwareLayout(Context context, AttributeSet attrs) {
+            super(context, attrs);
+        }
+
+        @Override
+        protected void onDetachedFromWindow() {
+            super.onDetachedFromWindow();
+            sWindowDetachTrace = new RuntimeException(
+                    "Stacktrace for Snackbar view to be detached from window");
+        }
+    }
+
     /**
      * Interface that shows the ability to provide a unified snackbar manager.
      */
@@ -82,6 +110,7 @@
 
     private static final int DEFAULT_SNACKBAR_DURATION_MS = 3000;
     private static final int ACCESSIBILITY_MODE_SNACKBAR_DURATION_MS = 6000;
+    private static final String TAG = "cr_snackbar";
 
     // Used instead of the constant so tests can override the value.
     private static int sSnackbarDurationMs = DEFAULT_SNACKBAR_DURATION_MS;
@@ -89,6 +118,7 @@
 
     private final boolean mIsTablet;
 
+    private Activity mActivity;
     private View mDecor;
     private final Handler mUIThreadHandler;
     private Stack<Snackbar> mStack = new Stack<Snackbar>();
@@ -107,8 +137,9 @@
     /**
      * Constructs a SnackbarManager to show snackbars in the given window.
      */
-    public SnackbarManager(Window window) {
-        mDecor = window.getDecorView();
+    public SnackbarManager(Activity activity) {
+        mActivity = activity;
+        mDecor = activity.getWindow().getDecorView();
         mUIThreadHandler = new Handler();
         mIsTablet = DeviceFormFactor.isTablet(mDecor.getContext());
     }
@@ -150,11 +181,28 @@
      *
      * @param isTimeout Whether dismissal was triggered by timeout.
      */
+    @TargetApi(Build.VERSION_CODES.JELLY_BEAN_MR1)
     public void dismissAllSnackbars(boolean isTimeout) {
         mUIThreadHandler.removeCallbacks(mHideRunnable);
 
         if (mPopup != null) {
-            mPopup.dismiss();
+            // TODO(ianwen): remove the try catch after crbug.com/553569 is fixed.
+            try {
+                mPopup.dismiss();
+            } catch (IllegalArgumentException ex) {
+                if (mActivity != null) {
+                    android.util.Log.d(TAG, "Activity.toString()? " + mActivity);
+                    android.util.Log.d(TAG, "Activity is finishing? " + mActivity.isFinishing());
+                    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.JELLY_BEAN_MR1) {
+                        android.util.Log.d(TAG, "Activity is destroyed?" + mActivity.isDestroyed());
+                    }
+                }
+                if (sWindowDetachTrace != null) {
+                    android.util.Log.d(TAG, "Window detach stack trace", sWindowDetachTrace);
+                }
+                throw ex;
+            }
+
             mPopup = null;
         }
 
diff --git a/chrome/android/java/strings/android_chrome_strings.grd b/chrome/android/java/strings/android_chrome_strings.grd
index 291fdb49..7790bf3 100644
--- a/chrome/android/java/strings/android_chrome_strings.grd
+++ b/chrome/android/java/strings/android_chrome_strings.grd
@@ -1471,7 +1471,7 @@
         <ph name="FILE_NAME">%1$s<ex>http://abc.com/test.pdf</ex></ph> download failed due to missing SD Card.
       </message>
       <message name="IDS_DOWNLOAD_FAILED_REASON_UNKNOWN_ERROR" desc="Message to explain that the download failed because unkown error.">
-        <ph name="FILE_NAME">%1$s<ex>http://abc.com/test.pdf</ex></ph> download failed due to an unknwon error.
+        <ph name="FILE_NAME">%1$s<ex>http://abc.com/test.pdf</ex></ph> download failed due to an unknown error.
       </message>
       <message name="IDS_DOWNLOAD_PENDING" desc="Message in the list of items which have received download requests telling their status. This message states that the download has not yet begun [CHAR LIMIT=30]">
         Downloading…
@@ -1829,10 +1829,10 @@
 
       <!-- Enhanced bookmark strings -->
       <message name="IDS_ENHANCED_BOOKMARK_SIGN_IN_PROMO_TITLE" desc="Promo title encouraging the user to sign in to Chrome to improve their bookmarks experience. It means that after signing-in, bookmarks will become synced across devices and possible to search.">
-        Back up and sync your bookmarks
+        Sync your bookmarks
       </message>
       <message name="IDS_ENHANCED_BOOKMARK_SIGN_IN_PROMO_DESCRIPTION" desc="Description for enhanced bookmark UI sign-in promotion.">
-        Sign in to Chrome to access your bookmarks from any device
+        To get your bookmarks on all your devices, sign in to Chrome
       </message>
       <message name="IDS_ENHANCED_BOOKMARK_SIGN_IN_PROMO_NO_THANKS" desc="Text for the decline button in the enhanced bookmark UI">
         No, thanks
diff --git a/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestAnnotationTest.java b/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestAnnotationTest.java
index 0b37bada..2dedfad 100644
--- a/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestAnnotationTest.java
+++ b/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestAnnotationTest.java
@@ -190,6 +190,22 @@
     }
 
     @SmallTest
+    @ParameterizedTest(parameters = {
+            @Parameter(tag = MethodParameter.PARAMETER_TAG,
+                    arguments = {@Parameter.Argument(name = "string", stringVar = "t_val")})})
+    @ParameterizedTest.Set(tests = {
+            @ParameterizedTest(parameters = {
+                    @Parameter(
+                            tag = MethodParameter.PARAMETER_TAG,
+                            arguments = {
+                                    @Parameter.Argument(name = "string", stringVar = "s_val")})})})
+    public void testParameterizedSetOverridesParameterizedTest() {
+        String expected = "s_val";
+        String actual = getArgument("string").stringVar();
+        assertEquals("Expected the value set via @ParameterizedTest.Set", expected, actual);
+    }
+
+    @SmallTest
     @ParameterizedTest.Set(tests = {
             @ParameterizedTest(parameters = {
                     @Parameter(
diff --git a/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestClassAnnotationInheritanceTest.java b/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestClassAnnotationInheritanceTest.java
new file mode 100644
index 0000000..07d1981
--- /dev/null
+++ b/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestClassAnnotationInheritanceTest.java
@@ -0,0 +1,50 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.base.test.util.parameter;
+
+import android.test.suitebuilder.annotation.SmallTest;
+
+import org.chromium.base.test.util.parameter.parameters.MethodParameter;
+
+/**
+ * Tester class for inheritance of the {@link ParameterizedTest} annotation applied to a TestCase
+ * class.
+ */
+public class ParameterizedTestClassAnnotationInheritanceTest extends
+        ParameterizedTestClassAnnotationTest {
+    public ParameterizedTestClassAnnotationInheritanceTest() {
+        super();
+    }
+
+    @SmallTest
+    public void testNoParameterizedTestAnnotation() {
+        super.testNoParameterizedTestAnnotation();
+    }
+
+    @SmallTest
+    @ParameterizedTest()
+    public void testEmptyParameterizedTestAnnotation() {
+        super.testEmptyParameterizedTestAnnotation();
+    }
+
+    @SmallTest
+    @ParameterizedTest(parameters = {
+            @Parameter(tag = MethodParameter.PARAMETER_TAG,
+                    arguments = {@Parameter.Argument(name = "string", stringVar = "value")})})
+    public void testMethodParametersWithOneStringValue() {
+        super.testMethodParametersWithOneStringValue();
+    }
+
+    @SmallTest
+    @ParameterizedTest.Set(tests = {
+            @ParameterizedTest(parameters = {
+                    @Parameter(
+                            tag = MethodParameter.PARAMETER_TAG,
+                            arguments = {
+                                    @Parameter.Argument(name = "string", stringVar = "s_val")})})})
+    public void testParameterizedSetOverridesParameterizedTest() {
+        super.testParameterizedSetOverridesParameterizedTest();
+    }
+}
diff --git a/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestClassAnnotationParameterSetAndTest.java b/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestClassAnnotationParameterSetAndTest.java
new file mode 100644
index 0000000..f8f4abf4
--- /dev/null
+++ b/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestClassAnnotationParameterSetAndTest.java
@@ -0,0 +1,42 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.base.test.util.parameter;
+
+import android.app.Activity;
+import android.test.suitebuilder.annotation.SmallTest;
+
+import org.chromium.base.test.BaseActivityInstrumentationTestCase;
+import org.chromium.base.test.util.parameter.parameters.MethodParameter;
+
+/**
+ * Tester class for priority of {@link ParameterizedTest} and {@link ParameterizedTest.Set}
+ * annotations applied to a TestCase class.
+ */
+@ParameterizedTest(parameters = {
+        @Parameter(tag = MethodParameter.PARAMETER_TAG,
+                arguments = {@Parameter.Argument(name = "string", stringVar = "t_val")})})
+@ParameterizedTest.Set(tests = {
+        @ParameterizedTest(parameters = {
+                @Parameter(
+                        tag = MethodParameter.PARAMETER_TAG,
+                        arguments = {
+                                @Parameter.Argument(name = "string", stringVar = "s_val")})})})
+public class ParameterizedTestClassAnnotationParameterSetAndTest extends
+        BaseActivityInstrumentationTestCase<Activity> {
+    public ParameterizedTestClassAnnotationParameterSetAndTest() {
+        super(Activity.class);
+    }
+
+    @SmallTest
+    public void testParameterizedSetOverridesParameterizedTest() {
+        String expected = "s_val";
+        String actual = getArgument("string").stringVar();
+        assertEquals("Expected the value set via @ParameterizedTest.Set", expected, actual);
+    }
+
+    private Parameter.Argument getArgument(String name) {
+        return getParameterReader().getParameterArgument(MethodParameter.PARAMETER_TAG, name);
+    }
+}
diff --git a/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestClassAnnotationParametersTest.java b/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestClassAnnotationParametersTest.java
index 1bbb425..d69f7c0 100644
--- a/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestClassAnnotationParametersTest.java
+++ b/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestClassAnnotationParametersTest.java
@@ -40,21 +40,13 @@
             @Parameter(tag = MethodParameter.PARAMETER_TAG,
                     arguments = {@Parameter.Argument(name = "m_string", stringVar = "value")})})
     public void testMethodParametersWithOneStringValue() {
-        if (getArgument("m_string") != null) {
-            // An invocation with a test method parameter.
-            String expected = "value";
-            String actual = getArgument("m_string").stringVar();
-            assertEquals(mismatchMessage("m_string"), expected, actual);
-            assertNull("c_string parameter should not exist", getArgument("c_string"));
-            assertNull("c_int parameter should not exist", getArgument("c_int"));
-        } else {
-            String expectedString = "value";
-            String actualString = getArgument("c_string").stringVar();
-            assertEquals(mismatchMessage("c_string"), expectedString, actualString);
-            int expectedInt = 0;
-            int actualInt = getArgument("c_int").intVar();
-            assertEquals(mismatchMessage("c_int"), expectedInt, actualInt);
-        }
+        // Method parameter overrides class parameter.
+        assertNotNull("m_string parameter should exist", getArgument("m_string"));
+        String expected = "value";
+        String actual = getArgument("m_string").stringVar();
+        assertEquals(mismatchMessage("m_string"), expected, actual);
+        assertNull("c_string parameter should not exist", getArgument("c_string"));
+        assertNull("c_int parameter should not exist", getArgument("c_int"));
     }
 
     private static String mismatchMessage(String name) {
diff --git a/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestClassAnnotationParametersTestSetInheritanceTest.java b/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestClassAnnotationParametersTestSetInheritanceTest.java
new file mode 100644
index 0000000..2e08fe1
--- /dev/null
+++ b/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestClassAnnotationParametersTestSetInheritanceTest.java
@@ -0,0 +1,45 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.base.test.util.parameter;
+
+import android.test.suitebuilder.annotation.SmallTest;
+
+import org.chromium.base.test.util.parameter.parameters.MethodParameter;
+
+/**
+ * Tester class for inheritance of the {@link ParameterizedTest.Set} annotation applied to a
+ * TestCase class.
+ */
+public class ParameterizedTestClassAnnotationParametersTestSetInheritanceTest extends
+        ParameterizedTestClassAnnotationParametersTestSetTest {
+    public ParameterizedTestClassAnnotationParametersTestSetInheritanceTest() {
+        super();
+    }
+
+    @SmallTest
+    public void testMethodParametersFromClassAnnotation() {
+        super.testMethodParametersFromClassAnnotation();
+    }
+
+    @SmallTest
+    @ParameterizedTest.Set(tests = {
+            @ParameterizedTest(parameters = {
+                    @Parameter(
+                            tag = MethodParameter.PARAMETER_TAG,
+                            arguments = {
+                                    @Parameter.Argument(name = "m_string", stringVar = "value"),
+                                    @Parameter.Argument(name = "m_int", intVar = 0)})})})
+    public void testClassAndMethodParameterSets() {
+        super.testClassAndMethodParameterSets();
+    }
+
+    @SmallTest
+    @ParameterizedTest(parameters = {
+            @Parameter(tag = MethodParameter.PARAMETER_TAG,
+                    arguments = {@Parameter.Argument(name = "c_string1", stringVar = "t_val")})})
+    public void testParameterizedSetOverridesParameterizedTest() {
+        super.testParameterizedSetOverridesParameterizedTest();
+    }
+}
diff --git a/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestClassAnnotationParametersTestSetTest.java b/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestClassAnnotationParametersTestSetTest.java
index 93efc71..01e23b94 100644
--- a/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestClassAnnotationParametersTestSetTest.java
+++ b/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestClassAnnotationParametersTestSetTest.java
@@ -47,26 +47,28 @@
                                     @Parameter.Argument(name = "m_string", stringVar = "value"),
                                     @Parameter.Argument(name = "m_int", intVar = 0)})})})
     public void testClassAndMethodParameterSets() {
-        if (getArgument("m_string") != null) {
-            // An invocation with a test method parameter.
-            String expectedString = "value";
-            String actualString = getArgument("m_string").stringVar();
-            assertEquals(mismatchMessage("m_string"), expectedString, actualString);
-            int expectedInt = 0;
-            int actualInt = getArgument("m_int").intVar();
-            assertEquals(mismatchMessage("m_int"), expectedInt, actualInt);
-            assertNull("c_string1 parameter should not exist", getArgument("c_string1"));
-            assertNull("c_string2 parameter should not exist", getArgument("c_string2"));
-            assertNull("c_int1 parameter should not exist", getArgument("c_int1"));
-            assertNull("c_int2 parameter should not exist", getArgument("c_int2"));
-        } else {
-            assertEquals("c_string1 variable should equals \"testvalue\"", "testvalue",
-                    getArgument("c_string1").stringVar());
-            assertEquals("c_string2 variable should equals \"blahblah\"", "blahblah",
-                    getArgument("c_string2").stringVar());
-            assertEquals("c_int1 variable should equals 4", 4, getArgument("c_int1").intVar());
-            assertEquals("c_int2 variable should equals 0", 0, getArgument("c_int2").intVar());
-        }
+        // Method parameter overrides class parameter.
+        assertNotNull("m_string parameter should exist", getArgument("m_string"));
+        String expectedString = "value";
+        String actualString = getArgument("m_string").stringVar();
+        assertEquals(mismatchMessage("m_string"), expectedString, actualString);
+        int expectedInt = 0;
+        int actualInt = getArgument("m_int").intVar();
+        assertEquals(mismatchMessage("m_int"), expectedInt, actualInt);
+        assertNull("c_string1 parameter should not exist", getArgument("c_string1"));
+        assertNull("c_string2 parameter should not exist", getArgument("c_string2"));
+        assertNull("c_int1 parameter should not exist", getArgument("c_int1"));
+        assertNull("c_int2 parameter should not exist", getArgument("c_int2"));
+    }
+
+    @SmallTest
+    @ParameterizedTest(parameters = {
+            @Parameter(tag = MethodParameter.PARAMETER_TAG,
+                    arguments = {@Parameter.Argument(name = "c_string1", stringVar = "t_val")})})
+    public void testParameterizedSetOverridesParameterizedTest() {
+        String expected = "testvalue";
+        String actual = getArgument("c_string1").stringVar();
+        assertEquals("Expected the value set via @ParameterizedTest.Set", expected, actual);
     }
 
     private static String mismatchMessage(String name) {
diff --git a/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestClassAnnotationTest.java b/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestClassAnnotationTest.java
index 65b9fb4..59208a5db 100644
--- a/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestClassAnnotationTest.java
+++ b/chrome/android/javatests/src/org/chromium/base/test/util/parameter/ParameterizedTestClassAnnotationTest.java
@@ -50,22 +50,30 @@
             @Parameter(tag = MethodParameter.PARAMETER_TAG,
                     arguments = {@Parameter.Argument(name = "string", stringVar = "value")})})
     public void testMethodParametersWithOneStringValue() {
-        if (getArgument("string") != null) {
-            // An invocation with a test method parameter.
-            String expected = "value";
-            String actual = getArgument("string").stringVar();
-            assertEquals(mismatchMessage("string"), expected, actual);
-        } else {
-            assertEquals(0,
-                    getParameterReader().getParameter(
-                            MethodParameter.PARAMETER_TAG).arguments().length);
-        }
+        // Method parameter overrides class parameter.
+        assertNotNull("string parameter should exist.", getArgument("string"));
+        String expected = "value";
+        String actual = getArgument("string").stringVar();
+        assertEquals(mismatchMessage("string"), expected, actual);
         assertNull("someParameter should not exist.", getParameterReader()
                 .getParameter("someParameter"));
         assertNull("someParameterArgument should not exist.", getParameterReader()
                 .getParameterArgument("someParameter", "someParameterArgument"));
     }
 
+    @SmallTest
+    @ParameterizedTest.Set(tests = {
+            @ParameterizedTest(parameters = {
+                    @Parameter(
+                            tag = MethodParameter.PARAMETER_TAG,
+                            arguments = {
+                                    @Parameter.Argument(name = "string", stringVar = "s_val")})})})
+    public void testParameterizedSetOverridesParameterizedTest() {
+        String expected = "s_val";
+        String actual = getArgument("string").stringVar();
+        assertEquals("Expected the value set via @ParameterizedTest.Set", expected, actual);
+    }
+
     private static String mismatchMessage(String name) {
         return String.format("The ParameterArgument %s does not match expected value.", name);
     }
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/crash/MinidumpUploadCallableTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/crash/MinidumpUploadCallableTest.java
index 70682c8..818b2abc 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/crash/MinidumpUploadCallableTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/crash/MinidumpUploadCallableTest.java
@@ -114,10 +114,13 @@
     private static class MockCrashReportingPermissionManager
             implements CrashReportingPermissionManager {
         private final boolean mIsPermitted;
+        private final boolean mIsUserPermitted;
         private final boolean mIsLimited;
 
-        MockCrashReportingPermissionManager(boolean isPermitted, boolean isLimited) {
+        MockCrashReportingPermissionManager(boolean isPermitted,
+                boolean isUserPermitted, boolean isLimited) {
             mIsPermitted = isPermitted;
+            mIsUserPermitted = isUserPermitted;
             mIsLimited = isLimited;
         }
 
@@ -127,6 +130,11 @@
         }
 
         @Override
+        public boolean isUploadUserPermitted() {
+            return mIsUserPermitted;
+        }
+
+        @Override
         public boolean isUploadLimited() {
             return mIsLimited;
         }
@@ -173,7 +181,7 @@
     @Feature({"Android-AppBase"})
     public void testCallWhenCurrentlyPermitted() throws Exception {
         CrashReportingPermissionManager testPermManager =
-                new MockCrashReportingPermissionManager(true, false);
+                new MockCrashReportingPermissionManager(true, true, false);
 
         HttpURLConnectionFactory httpURLConnectionFactory = new TestHttpURLConnectionFactory();
 
@@ -187,9 +195,9 @@
 
     @SmallTest
     @Feature({"Android-AppBase"})
-    public void testCallPermittedButNotUnderCurrentCircumstances() throws Exception {
+    public void testCallNotPermittedByUser() throws Exception {
         CrashReportingPermissionManager testPermManager =
-                new MockCrashReportingPermissionManager(false, false);
+                new MockCrashReportingPermissionManager(false, false, false);
 
         HttpURLConnectionFactory httpURLConnectionFactory = new FailHttpURLConnectionFactory();
 
@@ -197,6 +205,21 @@
                 new MockMinidumpUploadCallable(httpURLConnectionFactory, testPermManager);
         assertEquals(MinidumpUploadCallable.UPLOAD_DISABLED,
                 minidumpUploadCallable.call().intValue());
+        assertTrue(mExpectedFileAfterUpload.exists());
+    }
+
+    @SmallTest
+    @Feature({"Android-AppBase"})
+    public void testCallPermittedButNotUnderCurrentCircumstances() throws Exception {
+        CrashReportingPermissionManager testPermManager =
+                new MockCrashReportingPermissionManager(false, true, false);
+
+        HttpURLConnectionFactory httpURLConnectionFactory = new FailHttpURLConnectionFactory();
+
+        MinidumpUploadCallable minidumpUploadCallable =
+                new MockMinidumpUploadCallable(httpURLConnectionFactory, testPermManager);
+        assertEquals(MinidumpUploadCallable.UPLOAD_FAILURE,
+                minidumpUploadCallable.call().intValue());
         assertFalse(mExpectedFileAfterUpload.exists());
     }
 
@@ -204,7 +227,7 @@
     @Feature({"Android-AppBase"})
     public void testCrashUploadConstrainted() throws Exception {
         CrashReportingPermissionManager testPermManager =
-                new MockCrashReportingPermissionManager(true, true);
+                new MockCrashReportingPermissionManager(true, true, true);
 
         HttpURLConnectionFactory httpURLConnectionFactory = new TestHttpURLConnectionFactory();
 
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/webapps/WebappActivityTestBase.java b/chrome/android/javatests/src/org/chromium/chrome/browser/webapps/WebappActivityTestBase.java
index 7101ed4..29318bcf 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/webapps/WebappActivityTestBase.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/webapps/WebappActivityTestBase.java
@@ -10,6 +10,7 @@
 import org.chromium.base.ThreadUtils;
 import org.chromium.chrome.browser.ShortcutHelper;
 import org.chromium.chrome.test.ChromeActivityTestCaseBase;
+import org.chromium.chrome.test.MultiActivityTestBase;
 import org.chromium.content.browser.test.util.CallbackHelper;
 import org.chromium.content.browser.test.util.Criteria;
 import org.chromium.content.browser.test.util.CriteriaHelper;
@@ -131,7 +132,9 @@
                         return getActivity().getActivityTab() != null
                                 && !getActivity().getActivityTab().isLoading();
                     }
-                }));
+                },
+                MultiActivityTestBase.DEFAULT_MAX_TIME_TO_POLL_FOR_ACTIVITY_MS,
+                CriteriaHelper.DEFAULT_POLLING_INTERVAL));
         } catch (InterruptedException exception) {
             fail();
         }
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/webapps/WebappModeTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/webapps/WebappModeTest.java
index f6f8fde08..d6d7d40 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/webapps/WebappModeTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/webapps/WebappModeTest.java
@@ -300,7 +300,8 @@
 
         // Load up the test page.
         assertTrue(CriteriaHelper.pollForCriteria(
-                new TabLoadObserver(webappActivity.getActivityTab(), linkHtml)));
+                new TabLoadObserver(webappActivity.getActivityTab(), linkHtml),
+                DEFAULT_MAX_TIME_TO_POLL_FOR_ACTIVITY_MS, CriteriaHelper.DEFAULT_POLLING_INTERVAL));
 
         // Do a plain click to make the link open in the main browser via a window.open().
         // If the window is opened successfully, javascript on the first page triggers and changes
diff --git a/chrome/app/chromeos_strings.grdp b/chrome/app/chromeos_strings.grdp
index 16c29469..981180c 100644
--- a/chrome/app/chromeos_strings.grdp
+++ b/chrome/app/chromeos_strings.grdp
@@ -1925,6 +1925,9 @@
   <message name="IDS_OPTIONS_SETTINGS_NETWORK_DISABLED" desc="Message displayed when a type of network connection is disabled">
     Disabled
   </message>
+  <message name="IDS_OPTIONS_SETTINGS_NETWORK_PROHIBITED" desc="Message displayed when a type of network connection is prohibited">
+    Disabled by administrator
+  </message>
   <message name="IDS_OPTIONS_SETTINGS_NETWORK_OTHER" desc="Menu option for connecting to a network that is not listed in the menu.">
     Join other...
   </message>
diff --git a/chrome/app/settings_strings.grdp b/chrome/app/settings_strings.grdp
index 5c97da9..ce3f6bf87 100644
--- a/chrome/app/settings_strings.grdp
+++ b/chrome/app/settings_strings.grdp
@@ -14,7 +14,7 @@
     <message name="IDS_SETTINGS_MORE_FEATURES_LINK" desc="Link which opens page where users can install extensions which provide additional accessibility features.">
       Add additional accessibility features
     </message>
-    <message name="IDS_SETTINGS_OPTIONS_IN_MENU_LABEL" desc="Label for checkbox which enables showing accessibilitly options in the system menu.">
+    <message name="IDS_SETTINGS_OPTIONS_IN_MENU_LABEL" desc="Label for checkbox which enables showing accessibility options in the system menu.">
       Show accessibility options in the system menu
     </message>
     <message name="IDS_SETTINGS_LARGE_MOUSE_CURSOR_LABEL" desc="Label for checkbox which enables showing a larger mouse cursor than normal.">
@@ -234,6 +234,12 @@
   <message name="IDS_SETTINGS_CLEAR_DATA_EVERYTHING" desc="deletion period combo box: everything. In English this finishes the sentence that starts with 'Delete the following items from'.">
     the beginning of time
   </message>
+  <message name="IDS_SETTINGS_CLEAR_DATA_SOME_STUFF_REMAINS" desc="A text shown at the bottom of the Clear Browsing Data dialog, informing the user that some data types will not be cleared.">
+    Some settings that may reflect browsing habits will not be cleared.
+  </message>
+  <message name="IDS_SETTINGS_CLEAR_DATA_CLEARS_SYNCED_DATA" desc="Information that data which is synced across user's devices will be deleted from all those devices.">
+    This clears synced data from all devices.
+  </message>
 
   <!-- Downloads Page -->
   <message name="IDS_SETTINGS_DOWNLOADS" desc="Name of the settings page which displays download preferences.">
diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
index ed49486..7950009e 100644
--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn
@@ -589,7 +589,7 @@
       "//ui/views/mus:for_component",
     ]
     defines += [ "MOJO_SHELL_CLIENT" ]
-    data_deps += [ "//components/mus/example/wm:example_wm" ]
+    data_deps += [ "//mash/wm:example_wm" ]
   }
   if (ui_compositor_image_transport) {
     deps += [ "//ui/gl" ]
diff --git a/chrome/browser/after_startup_task_utils.h b/chrome/browser/after_startup_task_utils.h
index 3c8f8de0..967de140 100644
--- a/chrome/browser/after_startup_task_utils.h
+++ b/chrome/browser/after_startup_task_utils.h
@@ -10,6 +10,8 @@
 #include "base/gtest_prod_util.h"
 #include "base/memory/ref_counted.h"
 
+class ExtensionServiceTest;
+
 namespace android {
 class AfterStartupTaskUtilsJNI;
 }
@@ -41,6 +43,7 @@
  private:
   friend class AfterStartupTaskTest;
   friend class android::AfterStartupTaskUtilsJNI;
+  friend class ::ExtensionServiceTest;
   friend class InProcessBrowserTest;
   FRIEND_TEST_ALL_PREFIXES(AfterStartupTaskTest, IsStartupComplete);
   FRIEND_TEST_ALL_PREFIXES(AfterStartupTaskTest, PostTask);
diff --git a/chrome/browser/android/data_usage/data_use_tab_model.cc b/chrome/browser/android/data_usage/data_use_tab_model.cc
index c4d8e36..724f890 100644
--- a/chrome/browser/android/data_usage/data_use_tab_model.cc
+++ b/chrome/browser/android/data_usage/data_use_tab_model.cc
@@ -4,36 +4,49 @@
 
 #include "chrome/browser/android/data_usage/data_use_tab_model.h"
 
+#include "base/strings/string_number_conversions.h"
 #include "base/time/time.h"
 #include "chrome/browser/android/data_usage/external_data_use_observer.h"
 #include "chrome/browser/android/data_usage/tab_data_use_entry.h"
+#include "components/variations/variations_associated_data.h"
 
 namespace {
 
-// TODO(rajendrant): To be changeable via field trial.
-// Indicates the maximum number of tabs to maintain session information about.
-const size_t kMaxTabEntries = 200;
+// Indicates the default maximum number of tabs to maintain session information
+// about. May be overridden by the field trial.
+const size_t kDefaultMaxTabEntries = 200;
 
 // Returns true if |tab_id| is a valid tab ID.
 bool IsValidTabID(int32_t tab_id) {
   return tab_id >= 0;
 }
 
+// Returns various parameters from the values specified in the field trial.
+size_t GetMaxTabEntries() {
+  size_t max_tab_entries = -1;
+  std::string variation_value = variations::GetVariationParamValue(
+      chrome::android::ExternalDataUseObserver::
+          kExternalDataUseObserverFieldTrial,
+      "max_tab_entries");
+  if (!variation_value.empty() &&
+      base::StringToSizeT(variation_value, &max_tab_entries)) {
+    return max_tab_entries;
+  }
+  return kDefaultMaxTabEntries;
+}
+
 }  // namespace
 
 namespace chrome {
 
 namespace android {
 
-size_t DataUseTabModel::GetMaxTabEntriesForTests() {
-  return kMaxTabEntries;
-}
-
 DataUseTabModel::DataUseTabModel(
     const ExternalDataUseObserver* data_use_observer,
     scoped_refptr<base::SingleThreadTaskRunner> ui_task_runner)
     : data_use_observer_(data_use_observer),
       observer_list_(new base::ObserverListThreadSafe<TabDataUseObserver>),
+      max_tab_entries_(GetMaxTabEntries()),
       weak_factory_(this) {}
 
 DataUseTabModel::~DataUseTabModel() {
@@ -58,6 +71,12 @@
     case TRANSITION_FROM_EXTERNAL_APP: {
       // Enter events.
       std::string label;
+      TabEntryMap::const_iterator tab_entry_iterator =
+          active_tabs_.find(tab_id);
+      if (tab_entry_iterator != active_tabs_.end() &&
+          tab_entry_iterator->second.IsTrackingDataUse()) {
+        break;
+      }
       if (data_use_observer_->Matches(url, &label)) {
         // TODO(rajendrant): Need to handle scenarios where these labels change
         // in the middle of a tab session. Should |data_use_observer_| notify us
@@ -97,6 +116,13 @@
   tab_entry.OnTabCloseEvent();
 }
 
+void DataUseTabModel::OnTrackingLabelRemoved(std::string label) {
+  for (auto& tab_entry : active_tabs_) {
+    if (tab_entry.second.EndTrackingWithLabel(label))
+      NotifyObserversOfTrackingEnding(tab_entry.first);
+  }
+}
+
 bool DataUseTabModel::GetLabelForDataUse(const data_usage::DataUse& data_use,
                                          std::string* output_label) const {
   DCHECK(thread_checker_.CalledOnValidThread());
@@ -174,11 +200,11 @@
       ++tab_entry_iterator;
   }
 
-  if (active_tabs_.size() <= kMaxTabEntries)
+  if (active_tabs_.size() <= max_tab_entries_)
     return;
 
   // Remove oldest unexpired tab entries.
-  while (active_tabs_.size() > kMaxTabEntries) {
+  while (active_tabs_.size() > max_tab_entries_) {
     // Find oldest tab entry.
     TabEntryMap::iterator oldest_tab_entry_iterator = active_tabs_.begin();
     for (TabEntryMap::iterator tab_entry_iterator = active_tabs_.begin();
diff --git a/chrome/browser/android/data_usage/data_use_tab_model.h b/chrome/browser/android/data_usage/data_use_tab_model.h
index 43a07bd..d5635e1 100644
--- a/chrome/browser/android/data_usage/data_use_tab_model.h
+++ b/chrome/browser/android/data_usage/data_use_tab_model.h
@@ -77,7 +77,7 @@
   DataUseTabModel(const ExternalDataUseObserver* data_use_observer,
                   scoped_refptr<base::SingleThreadTaskRunner> ui_task_runner);
 
-  ~DataUseTabModel();
+  virtual ~DataUseTabModel();
 
   base::WeakPtr<DataUseTabModel> GetWeakPtr();
 
@@ -95,12 +95,16 @@
   // closed.
   void OnTabCloseEvent(int32_t tab_id);
 
+  // Notifies the DataUseTabModel that tracking label |label| is removed. Any
+  // active tracking sessions with the label are ended.
+  virtual void OnTrackingLabelRemoved(std::string label);
+
   // Gets the label for the |data_use| object. |output_label| must not be null.
   // If a tab tracking session is found that was active at the time of request
   // start of |data_use|, returns true and |output_label| is populated with its
   // label. Otherwise returns false and |output_label| is set to empty string.
-  bool GetLabelForDataUse(const data_usage::DataUse& data_use,
-                          std::string* output_label) const;
+  virtual bool GetLabelForDataUse(const data_usage::DataUse& data_use,
+                                  std::string* output_label) const;
 
   // Adds or removes observers from the observer list. These functions are
   // thread-safe and can be called from any thread.
@@ -110,6 +114,7 @@
  private:
   friend class DataUseTabModelTest;
   friend class MockTabDataUseEntryTest;
+  friend class TestDataUseTabModel;
   FRIEND_TEST_ALL_PREFIXES(DataUseTabModelTest, SingleTabTracking);
   FRIEND_TEST_ALL_PREFIXES(DataUseTabModelTest, MultipleTabTracking);
   FRIEND_TEST_ALL_PREFIXES(DataUseTabModelTest, ObserverStartEndEvents);
@@ -118,15 +123,12 @@
                            MultipleObserverMultipleStartEndEvents);
   FRIEND_TEST_ALL_PREFIXES(DataUseTabModelTest, TabCloseEvent);
   FRIEND_TEST_ALL_PREFIXES(DataUseTabModelTest, TabCloseEventEndsTracking);
+  FRIEND_TEST_ALL_PREFIXES(DataUseTabModelTest, OnTrackingLabelRemoved);
   FRIEND_TEST_ALL_PREFIXES(DataUseTabModelTest,
                            CompactTabEntriesWithinMaxLimit);
 
   typedef base::hash_map<int32_t, TabDataUseEntry> TabEntryMap;
 
-  // Returns the maximum number of tab entries to maintain session information
-  // about.
-  static size_t GetMaxTabEntriesForTests();
-
   // Notifies the observers that a data usage tracking session started for
   // |tab_id|.
   void NotifyObserversOfTrackingStarting(int32_t tab_id);
@@ -158,6 +160,9 @@
   // Maintains the tracking sessions of multiple tabs.
   TabEntryMap active_tabs_;
 
+  // Maximum number of tab entries to maintain session information about.
+  const size_t max_tab_entries_;
+
   base::ThreadChecker thread_checker_;
 
   // |weak_factory_| is used for generating weak pointers to be passed to
diff --git a/chrome/browser/android/data_usage/data_use_tab_model_test_utils.cc b/chrome/browser/android/data_usage/data_use_tab_model_test_utils.cc
new file mode 100644
index 0000000..2ee925e
--- /dev/null
+++ b/chrome/browser/android/data_usage/data_use_tab_model_test_utils.cc
@@ -0,0 +1,33 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/android/data_usage/data_use_tab_model_test_utils.h"
+
+#include "base/memory/ref_counted.h"
+#include "base/single_thread_task_runner.h"
+#include "chrome/browser/android/data_usage/data_use_tab_model.h"
+#include "chrome/browser/android/data_usage/external_data_use_observer.h"
+#include "components/data_usage/core/data_use.h"
+#include "url/gurl.h"
+
+namespace chrome {
+
+namespace android {
+
+TestDataUseTabModel::TestDataUseTabModel(
+    const ExternalDataUseObserver* data_use_observer,
+    scoped_refptr<base::SingleThreadTaskRunner> ui_task_runner)
+    : DataUseTabModel(data_use_observer, ui_task_runner.get()) {}
+
+TestDataUseTabModel::~TestDataUseTabModel() {}
+
+bool TestDataUseTabModel::GetLabelForDataUse(
+    const data_usage::DataUse& data_use,
+    std::string* output_label) const {
+  return data_use_observer_->Matches(data_use.url, output_label);
+}
+
+}  // namespace android
+
+}  // namespace chrome
diff --git a/chrome/browser/android/data_usage/data_use_tab_model_test_utils.h b/chrome/browser/android/data_usage/data_use_tab_model_test_utils.h
new file mode 100644
index 0000000..da932d62
--- /dev/null
+++ b/chrome/browser/android/data_usage/data_use_tab_model_test_utils.h
@@ -0,0 +1,41 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_ANDROID_DATA_USAGE_DATA_USE_TAB_MODEL_TEST_UTILS_H_
+#define CHROME_BROWSER_ANDROID_DATA_USAGE_DATA_USE_TAB_MODEL_TEST_UTILS_H_
+
+#include "base/memory/ref_counted.h"
+#include "chrome/browser/android/data_usage/data_use_tab_model.h"
+#include "components/data_usage/core/data_use.h"
+#include "testing/gmock/include/gmock/gmock.h"
+
+namespace base {
+class SingleThreadTaskRunner;
+}
+
+namespace chrome {
+
+namespace android {
+
+class ExternalDataUseObserver;
+
+class TestDataUseTabModel : public DataUseTabModel {
+ public:
+  TestDataUseTabModel(
+      const ExternalDataUseObserver* data_use_observer,
+      scoped_refptr<base::SingleThreadTaskRunner> ui_task_runner);
+
+  ~TestDataUseTabModel() override;
+
+  bool GetLabelForDataUse(const data_usage::DataUse& data_use,
+                          std::string* output_label) const override;
+
+  MOCK_METHOD1(OnTrackingLabelRemoved, void(std::string label));
+};
+
+}  // namespace android
+
+}  // namespace chrome
+
+#endif  // CHROME_BROWSER_ANDROID_DATA_USAGE_DATA_USE_TAB_MODEL_TEST_UTILS_H_
diff --git a/chrome/browser/android/data_usage/data_use_tab_model_unittest.cc b/chrome/browser/android/data_usage/data_use_tab_model_unittest.cc
index f2bf800..ebe702ab 100644
--- a/chrome/browser/android/data_usage/data_use_tab_model_unittest.cc
+++ b/chrome/browser/android/data_usage/data_use_tab_model_unittest.cc
@@ -284,10 +284,44 @@
       kTabID1, base::TimeTicks::Now() + base::TimeDelta::FromMilliseconds(20));
 }
 
+// Checks that end tracking for specific labels closes those active sessions.
+TEST_F(DataUseTabModelTest, OnTrackingLabelRemoved) {
+  MockTabDataUseObserver mock_observer;
+
+  data_use_tab_model_.StartTrackingDataUse(kTabID1, kTestLabel1);
+  data_use_tab_model_.StartTrackingDataUse(kTabID2, kTestLabel2);
+  data_use_tab_model_.StartTrackingDataUse(kTabID3, kTestLabel3);
+  data_use_tab_model_.AddObserver(&mock_observer);
+  ExpectTabEntrySize(TabEntrySize::THREE);
+
+  EXPECT_TRUE(IsTrackingDataUse(kTabID1));
+  EXPECT_TRUE(IsTrackingDataUse(kTabID2));
+  EXPECT_TRUE(IsTrackingDataUse(kTabID3));
+
+  // Observer notified of end tracking.
+  EXPECT_CALL(mock_observer, NotifyTrackingEnding(kTabID2)).Times(1);
+
+  data_use_tab_model_.OnTrackingLabelRemoved(kTestLabel2);
+  message_loop_.RunUntilIdle();
+
+  EXPECT_TRUE(IsTrackingDataUse(kTabID1));
+  EXPECT_FALSE(IsTrackingDataUse(kTabID2));
+  EXPECT_TRUE(IsTrackingDataUse(kTabID3));
+
+  EXPECT_CALL(mock_observer, NotifyTrackingEnding(kTabID3)).Times(1);
+
+  data_use_tab_model_.OnTrackingLabelRemoved(kTestLabel3);
+  message_loop_.RunUntilIdle();
+
+  EXPECT_TRUE(IsTrackingDataUse(kTabID1));
+  EXPECT_FALSE(IsTrackingDataUse(kTabID2));
+  EXPECT_FALSE(IsTrackingDataUse(kTabID3));
+}
+
 // Checks that |active_tabs_| does not grow beyond GetMaxTabEntriesForTests tab
 // entries.
 TEST_F(DataUseTabModelTest, CompactTabEntriesWithinMaxLimit) {
-  const size_t max_tab_entries = DataUseTabModel::GetMaxTabEntriesForTests();
+  const size_t max_tab_entries = data_use_tab_model_.max_tab_entries_;
   uint32_t tab_id = 1;
 
   ExpectTabEntrySize(TabEntrySize::ZERO);
diff --git a/chrome/browser/android/data_usage/external_data_use_observer.cc b/chrome/browser/android/data_usage/external_data_use_observer.cc
index 9546296..23ecc6dd 100644
--- a/chrome/browser/android/data_usage/external_data_use_observer.cc
+++ b/chrome/browser/android/data_usage/external_data_use_observer.cc
@@ -7,6 +7,7 @@
 #include <utility>
 
 #include "base/android/jni_string.h"
+#include "base/containers/hash_tables.h"
 #include "base/message_loop/message_loop.h"
 #include "base/metrics/field_trial.h"
 #include "base/strings/string_number_conversions.h"
@@ -230,7 +231,7 @@
   std::string label;
 
   for (const data_usage::DataUse* data_use : data_use_sequence) {
-    if (!Matches(data_use->url, &label))
+    if (!data_use_tab_model_->GetLabelForDataUse(*data_use, &label))
       continue;
 
     BufferDataUseReport(data_use, label, previous_report_time_,
@@ -340,6 +341,11 @@
   DCHECK_EQ(app_package_name.size(), domain_path_regex.size());
   DCHECK_EQ(app_package_name.size(), label.size());
 
+  base::hash_set<std::string> removed_matching_rule_labels;
+
+  for (const auto& matching_rule : matching_rules_)
+    removed_matching_rule_labels.insert(matching_rule->label());
+
   matching_rules_.clear();
   re2::RE2::Options options(re2::RE2::DefaultOptions);
   options.set_case_sensitive(false);
@@ -354,8 +360,13 @@
     DCHECK(!label[i].empty());
     matching_rules_.push_back(
         new MatchingRule(app_package_name[i], pattern.Pass(), label[i]));
+
+    removed_matching_rule_labels.erase(label[i]);
   }
 
+  for (std::string label : removed_matching_rule_labels)
+    data_use_tab_model_->OnTrackingLabelRemoved(label);
+
   if (matching_rules_.size() == 0 && registered_as_observer_) {
     // Unregister as an observer if no regular expressions were received.
     data_use_aggregator_->RemoveObserver(this);
diff --git a/chrome/browser/android/data_usage/external_data_use_observer.h b/chrome/browser/android/data_usage/external_data_use_observer.h
index 6a9c838..86706c5 100644
--- a/chrome/browser/android/data_usage/external_data_use_observer.h
+++ b/chrome/browser/android/data_usage/external_data_use_observer.h
@@ -96,10 +96,12 @@
   }
 
  private:
+  friend class ExternalDataUseObserverTest;
   FRIEND_TEST_ALL_PREFIXES(ExternalDataUseObserverTest, SingleRegex);
   FRIEND_TEST_ALL_PREFIXES(ExternalDataUseObserverTest, TwoRegex);
   FRIEND_TEST_ALL_PREFIXES(ExternalDataUseObserverTest, MultipleRegex);
   FRIEND_TEST_ALL_PREFIXES(ExternalDataUseObserverTest, ChangeRegex);
+  FRIEND_TEST_ALL_PREFIXES(ExternalDataUseObserverTest, LabelRemoved);
   FRIEND_TEST_ALL_PREFIXES(ExternalDataUseObserverTest,
                            AtMostOneDataUseSubmitRequest);
   FRIEND_TEST_ALL_PREFIXES(ExternalDataUseObserverTest, MultipleMatchingRules);
diff --git a/chrome/browser/android/data_usage/external_data_use_observer_unittest.cc b/chrome/browser/android/data_usage/external_data_use_observer_unittest.cc
index 92b3d67e..844a260 100644
--- a/chrome/browser/android/data_usage/external_data_use_observer_unittest.cc
+++ b/chrome/browser/android/data_usage/external_data_use_observer_unittest.cc
@@ -13,6 +13,7 @@
 #include "base/run_loop.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/thread_task_runner_handle.h"
+#include "chrome/browser/android/data_usage/data_use_tab_model_test_utils.h"
 #include "components/data_usage/core/data_use.h"
 #include "components/data_usage/core/data_use_aggregator.h"
 #include "components/data_usage/core/data_use_amortizer.h"
@@ -21,6 +22,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/test/test_browser_thread_bundle.h"
 #include "net/base/network_change_notifier.h"
+#include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
 
@@ -43,6 +45,10 @@
     external_data_use_observer_.reset(new ExternalDataUseObserver(
         data_use_aggregator_.get(), io_task_runner_.get(),
         ui_task_runner_.get()));
+    test_data_use_tab_model_ = new TestDataUseTabModel(
+        external_data_use_observer_.get(), ui_task_runner_.get());
+    external_data_use_observer_->data_use_tab_model_.reset(
+        test_data_use_tab_model_);
   }
 
   scoped_ptr<ExternalDataUseObserver> Create() const {
@@ -55,11 +61,16 @@
     return external_data_use_observer_.get();
   }
 
+  TestDataUseTabModel* test_data_use_tab_model() const {
+    return test_data_use_tab_model_;
+  }
+
  private:
   // Required for creating multiple threads for unit testing.
   scoped_ptr<content::TestBrowserThreadBundle> thread_bundle_;
   scoped_ptr<data_usage::DataUseAggregator> data_use_aggregator_;
   scoped_ptr<ExternalDataUseObserver> external_data_use_observer_;
+  TestDataUseTabModel* test_data_use_tab_model_;
   scoped_refptr<base::SingleThreadTaskRunner> io_task_runner_;
   scoped_refptr<base::SingleThreadTaskRunner> ui_task_runner_;
 };
@@ -241,6 +252,31 @@
       GURL("http://www.google.co.in#q=abc"), &label));
 }
 
+// Tests that tab model is notified when tracking labels are removed.
+TEST_F(ExternalDataUseObserverTest, LabelRemoved) {
+  std::vector<std::string> labels;
+
+  labels.push_back("label_1");
+  labels.push_back("label_2");
+  labels.push_back("label_3");
+  external_data_use_observer()->RegisterURLRegexes(
+      std::vector<std::string>(labels.size(), std::string()),
+      std::vector<std::string>(labels.size(), "http://foobar.com"), labels);
+
+  EXPECT_CALL(*test_data_use_tab_model(), OnTrackingLabelRemoved("label_3"))
+      .Times(1);
+  EXPECT_CALL(*test_data_use_tab_model(), OnTrackingLabelRemoved("label_2"))
+      .Times(1);
+
+  labels.clear();
+  labels.push_back("label_1");
+  labels.push_back("label_4");
+  labels.push_back("label_5");
+  external_data_use_observer()->RegisterURLRegexes(
+      std::vector<std::string>(labels.size(), std::string()),
+      std::vector<std::string>(labels.size(), "http://foobar.com"), labels);
+}
+
 // Tests that at most one data use request is submitted.
 TEST_F(ExternalDataUseObserverTest, AtMostOneDataUseSubmitRequest) {
   const std::string label("label");
diff --git a/chrome/browser/android/data_usage/tab_data_use_entry.cc b/chrome/browser/android/data_usage/tab_data_use_entry.cc
index 041fe4df..a6e0cc5 100644
--- a/chrome/browser/android/data_usage/tab_data_use_entry.cc
+++ b/chrome/browser/android/data_usage/tab_data_use_entry.cc
@@ -6,40 +6,75 @@
 
 #include "base/gtest_prod_util.h"
 #include "base/macros.h"
+#include "base/strings/string_number_conversions.h"
+#include "chrome/browser/android/data_usage/external_data_use_observer.h"
+#include "components/variations/variations_associated_data.h"
 
 namespace {
 
-// Indicates the maximum number of tracking session history to maintain per tab.
-const size_t kMaxSessionsPerTab = 5;
+// Indicates the default maximum number of tracking session history to maintain
+// per tab. May be overridden by the field trial.
+const size_t kDefaultMaxSessionsPerTab = 5;
 
-// Indicates the expiration duration in seconds for a closed tab entry, after
-// which it can be sweeped from history.
-const unsigned int kClosedTabExpirationDurationSeconds = 30;  // 30 seconds.
-
-// Indicates the expiration duration in seconds for an open tab entry, after
-// which it can be sweeped from history.
-const unsigned int kOpenTabExpirationDurationSeconds =
+// Indicates the default expiration duration in seconds, after which it can be
+// sweeped from history for a closed tab entry and an open tab entry
+// respectively. May be overridden by the field trial.
+const unsigned int kDefaultClosedTabExpirationDurationSeconds =
+    30;  // 30 seconds.
+const unsigned int kDefaultOpenTabExpirationDurationSeconds =
     60 * 60 * 24 * 5;  // 5 days.
 
+// Returns various parameters from the values specified in the field trial.
+size_t GetMaxSessionsPerTab() {
+  size_t max_sessions_per_tab = -1;
+  std::string variation_value = variations::GetVariationParamValue(
+      chrome::android::ExternalDataUseObserver::
+          kExternalDataUseObserverFieldTrial,
+      "max_sessions_per_tab");
+  if (!variation_value.empty() &&
+      base::StringToSizeT(variation_value, &max_sessions_per_tab)) {
+    return max_sessions_per_tab;
+  }
+  return kDefaultMaxSessionsPerTab;
+}
+
+base::TimeDelta GetClosedTabExpirationDuration() {
+  uint32_t duration_seconds = -1;
+  std::string variation_value = variations::GetVariationParamValue(
+      chrome::android::ExternalDataUseObserver::
+          kExternalDataUseObserverFieldTrial,
+      "closed_tab_expiration_duration_seconds");
+  if (!variation_value.empty() &&
+      base::StringToUint(variation_value, &duration_seconds)) {
+    return base::TimeDelta::FromSeconds(duration_seconds);
+  }
+  return base::TimeDelta::FromSeconds(
+      kDefaultClosedTabExpirationDurationSeconds);
+}
+
+base::TimeDelta GetOpenTabExpirationDuration() {
+  uint32_t duration_seconds = -1;
+  std::string variation_value = variations::GetVariationParamValue(
+      chrome::android::ExternalDataUseObserver::
+          kExternalDataUseObserverFieldTrial,
+      "open_tab_expiration_duration_seconds");
+  if (!variation_value.empty() &&
+      base::StringToUint(variation_value, &duration_seconds)) {
+    return base::TimeDelta::FromSeconds(duration_seconds);
+  }
+  return base::TimeDelta::FromSeconds(kDefaultOpenTabExpirationDurationSeconds);
+}
+
 }  // namespace
 
 namespace chrome {
 
 namespace android {
 
-size_t TabDataUseEntry::GetMaxSessionsPerTabForTests() {
-  return kMaxSessionsPerTab;
-}
-
-unsigned int TabDataUseEntry::GetClosedTabExpirationDurationSecondsForTests() {
-  return kClosedTabExpirationDurationSeconds;
-}
-
-unsigned int TabDataUseEntry::GetOpenTabExpirationDurationSecondsForTests() {
-  return kOpenTabExpirationDurationSeconds;
-}
-
-TabDataUseEntry::TabDataUseEntry() {}
+TabDataUseEntry::TabDataUseEntry()
+    : max_sessions_per_tab_(GetMaxSessionsPerTab()),
+      closed_tab_expiration_duration_(GetClosedTabExpirationDuration()),
+      open_tab_expiration_duration_(GetOpenTabExpirationDuration()) {}
 
 TabDataUseEntry::TabDataUseEntry(const TabDataUseEntry& other) = default;
 
@@ -78,6 +113,12 @@
   return true;
 }
 
+bool TabDataUseEntry::EndTrackingWithLabel(const std::string& label) {
+  if (!sessions_.empty() && sessions_.back().label == label)
+    return EndTracking();
+  return false;
+}
+
 void TabDataUseEntry::OnTabCloseEvent() {
   DCHECK(!IsTrackingDataUse());
   tab_close_time_ = Now();
@@ -88,14 +129,12 @@
 
   if (!tab_close_time_.is_null()) {
     // Closed tab entry.
-    return ((now - tab_close_time_) >
-            base::TimeDelta::FromSeconds(kClosedTabExpirationDurationSeconds));
+    return ((now - tab_close_time_) > closed_tab_expiration_duration_);
   }
 
   const base::TimeTicks latest_session_time = GetLatestStartOrEndTime();
   if (latest_session_time.is_null() ||
-      ((now - latest_session_time) >
-       base::TimeDelta::FromSeconds(kOpenTabExpirationDurationSeconds))) {
+      ((now - latest_session_time) > open_tab_expiration_duration_)) {
     // TODO(rajendrant): Add UMA to track deletion of entries corresponding to
     // existing tabs.
     return true;
@@ -147,7 +186,7 @@
 
 void TabDataUseEntry::CompactSessionHistory() {
   // TODO(rajendrant): Add UMA to track how often old sessions are lost.
-  while (sessions_.size() > kMaxSessionsPerTab)
+  while (sessions_.size() > max_sessions_per_tab_)
     sessions_.pop_front();
 }
 
diff --git a/chrome/browser/android/data_usage/tab_data_use_entry.h b/chrome/browser/android/data_usage/tab_data_use_entry.h
index 86dbf5a..c3dd60f 100644
--- a/chrome/browser/android/data_usage/tab_data_use_entry.h
+++ b/chrome/browser/android/data_usage/tab_data_use_entry.h
@@ -54,6 +54,10 @@
   // tracking session, and true otherwise.
   bool EndTracking();
 
+  // Ends the active tracking session if it is labeled with |label| and returns
+  // true.
+  bool EndTrackingWithLabel(const std::string& label);
+
   // Records that the tab has been closed, in preparation for deletion.
   void OnTabCloseEvent();
 
@@ -82,20 +86,12 @@
   friend class MockTabDataUseEntryTest;
   FRIEND_TEST_ALL_PREFIXES(TabDataUseEntryTest, SingleTabSessionCloseEvent);
   FRIEND_TEST_ALL_PREFIXES(TabDataUseEntryTest, MultipleTabSessionCloseEvent);
+  FRIEND_TEST_ALL_PREFIXES(TabDataUseEntryTest, EndTrackingWithLabel);
   FRIEND_TEST_ALL_PREFIXES(DataUseTabModelTest, TabCloseEvent);
   FRIEND_TEST_ALL_PREFIXES(MockTabDataUseEntryTest, CompactTabSessionHistory);
 
   typedef std::deque<TabDataUseTrackingSession> TabSessions;
 
-  // Returns the maximum number of tracking sessions to maintain per tab, for
-  // testing purposes.
-  static size_t GetMaxSessionsPerTabForTests();
-
-  // Returns the expiration duration in seconds for a closed tab entry and an
-  // open tab entry respectively, for testing purposes.
-  static unsigned int GetClosedTabExpirationDurationSecondsForTests();
-  static unsigned int GetOpenTabExpirationDurationSecondsForTests();
-
   // Virtualized for unit test support.
   virtual base::TimeTicks Now() const;
 
@@ -111,6 +107,14 @@
   // Indicates the time the tab was closed. |tab_close_time_| will be null if
   // the tab is still open.
   base::TimeTicks tab_close_time_;
+
+  // Maximum number of tracking sessions to maintain per tab.
+  const size_t max_sessions_per_tab_;
+
+  // Expiration duration for a closed tab entry and an open tab entry
+  // respectively.
+  const base::TimeDelta closed_tab_expiration_duration_;
+  const base::TimeDelta open_tab_expiration_duration_;
 };
 
 }  // namespace android
diff --git a/chrome/browser/android/data_usage/tab_data_use_entry_unittest.cc b/chrome/browser/android/data_usage/tab_data_use_entry_unittest.cc
index cba4c83..5cf09cb4 100644
--- a/chrome/browser/android/data_usage/tab_data_use_entry_unittest.cc
+++ b/chrome/browser/android/data_usage/tab_data_use_entry_unittest.cc
@@ -146,6 +146,16 @@
   EXPECT_FALSE(tab_entry_->IsTrackingDataUse());
 }
 
+// Tests that active tracking session ends with EndTrackingWithLabel.
+TEST_F(TabDataUseEntryTest, EndTrackingWithLabel) {
+  EXPECT_TRUE(tab_entry_->StartTracking(kTestLabel1));
+  EXPECT_TRUE(tab_entry_->IsTrackingDataUse());
+
+  EXPECT_TRUE(tab_entry_->EndTrackingWithLabel(kTestLabel1));
+  EXPECT_FALSE(tab_entry_->IsTrackingDataUse());
+  ExpectTabEntrySessionsSize(TabEntrySessionSize::ONE);
+}
+
 // Test version of |TabDataUseEntry|, which permits mocking of calls to Now.
 class MockTabDataUseEntry : public TabDataUseEntry {
  public:
@@ -179,12 +189,16 @@
  public:
   MockTabDataUseEntryTest() { tab_entry_.reset(new MockTabDataUseEntry()); }
 
-  static unsigned int GetClosedTabExpirationDurationSecondsForTests() {
-    return TabDataUseEntry::GetClosedTabExpirationDurationSecondsForTests();
+  const size_t GetMaxSessionsPerTab() const {
+    return tab_entry_->max_sessions_per_tab_;
   }
 
-  static unsigned int GetOpenTabExpirationDurationSecondsForTests() {
-    return TabDataUseEntry::GetOpenTabExpirationDurationSecondsForTests();
+  const base::TimeDelta& GetClosedTabExpirationDuration() const {
+    return tab_entry_->closed_tab_expiration_duration_;
+  }
+
+  const base::TimeDelta& GetOpenTabExpirationDuration() const {
+    return tab_entry_->open_tab_expiration_duration_;
   }
 
   // Checks if there are |expected_size| tracking session entries in
@@ -317,12 +331,11 @@
   ExpectEmptyDataUseLabelAtOffsetTime(41);
 }
 
-// Checks that open tab entries expire after
-// GetOpenTabExpirationDurationSecondsForTests seconds from their latest
-// tracking session start time.
+// Checks that open tab entries expire after open tab expiration duration from
+// their latest tracking session start time.
 TEST_F(MockTabDataUseEntryTest, OpenTabSessionExpiryFromLatestSessionStart) {
   const unsigned int open_tab_expiration_seconds =
-      GetOpenTabExpirationDurationSecondsForTests();
+      GetOpenTabExpirationDuration().InSeconds();
 
   // Initial tab entry with no sessions is considered expired.
   EXPECT_TRUE(tab_entry_->IsExpired());
@@ -343,12 +356,11 @@
   EXPECT_TRUE(tab_entry_->IsExpired());
 }
 
-// Checks that open tab entries expire after
-// GetOpenTabExpirationDurationSecondsForTests seconds from their latest
-// tracking session end time.
+// Checks that open tab entries expire after open tab expiration duration from
+// their latest tracking session end time.
 TEST_F(MockTabDataUseEntryTest, OpenTabSessionExpiryFromLatestSessionEnd) {
   const unsigned int open_tab_expiration_seconds =
-      GetOpenTabExpirationDurationSecondsForTests();
+      GetOpenTabExpirationDuration().InSeconds();
 
   // Initial tab entry with no sessions is considered expired.
   EXPECT_TRUE(tab_entry_->IsExpired());
@@ -371,12 +383,11 @@
   EXPECT_TRUE(tab_entry_->IsExpired());
 }
 
-// Checks that closed tab entries expire after
-// GetClosedTabExpirationDurationSecondsForTests seconds from their closing
-// time.
+// Checks that closed tab entries expire after closed tab expiration duration
+// from their closing time.
 TEST_F(MockTabDataUseEntryTest, ClosedTabSessionExpiry) {
   const unsigned int closed_tab_expiration_seconds =
-      GetClosedTabExpirationDurationSecondsForTests();
+      GetClosedTabExpirationDuration().InSeconds();
 
   // Initial tab entry with no sessions is considered expired.
   EXPECT_TRUE(tab_entry_->IsExpired());
@@ -407,8 +418,6 @@
 // GetMaxSessionsPerTabForTests entries, and automatically compacts itself by
 // removing the oldest tracking sessions.
 TEST_F(MockTabDataUseEntryTest, CompactTabSessionHistory) {
-  const size_t max_sessions_per_tab =
-      TabDataUseEntry::GetMaxSessionsPerTabForTests();
   const uint32_t per_session_duration = 10;
   const uint32_t next_session_start_gap = 10;
   uint32_t session_start_time = 10;
@@ -416,7 +425,7 @@
 
   ExpectTabEntrySessionsSize(TabEntrySessionSize::ZERO);
 
-  while (num_sessions <= max_sessions_per_tab) {
+  while (num_sessions <= GetMaxSessionsPerTab()) {
     // Start tracking session at time=|session_start_time| and end after
     // time=|per_session_duration|.
     std::string session_label = base::StringPrintf("label_%d", num_sessions);
@@ -435,9 +444,9 @@
 
   int oldest_session = 1;  // Oldest session ID that will be removed first.
 
-  // Check if session history size stays at |max_sessions_per_tab|, when more
+  // Check if session history size stays at GetMaxSessionsPerTab, when more
   // sessions are added.
-  while (num_sessions < max_sessions_per_tab + 10) {
+  while (num_sessions < GetMaxSessionsPerTab() + 10) {
     std::string oldest_session_label =
         base::StringPrintf("label_%d", oldest_session);
     EXPECT_TRUE(IsTabEntrySessionExists(oldest_session_label));
@@ -453,7 +462,7 @@
 
     // Oldest entry got removed.
     EXPECT_FALSE(IsTabEntrySessionExists(oldest_session_label));
-    ExpectTabEntrySessionsSize(max_sessions_per_tab);
+    ExpectTabEntrySessionsSize(GetMaxSessionsPerTab());
 
     // Update next session start time.
     session_start_time += per_session_duration + next_session_start_gap;
diff --git a/chrome/browser/app_icon_win.cc b/chrome/browser/app_icon_win.cc
index 6f1424e..33b66f4 100644
--- a/chrome/browser/app_icon_win.cc
+++ b/chrome/browser/app_icon_win.cc
@@ -7,7 +7,9 @@
 #include "chrome/app/chrome_dll_resource.h"
 #include "chrome/common/chrome_constants.h"
 #include "third_party/skia/include/core/SkBitmap.h"
+#include "ui/gfx/geometry/size.h"
 #include "ui/gfx/icon_util.h"
+#include "ui/gfx/image/image_family.h"
 
 #if defined(GOOGLE_CHROME_BUILD)
 #include "chrome/installer/util/install_util.h"
@@ -28,6 +30,8 @@
 }  // namespace
 
 HICON GetAppIcon() {
+  // TODO(mgiuca): Use GetAppIconImageFamily/CreateExact instead of LoadIcon, to
+  // get correct scaling. (See http://crbug.com/551256)
   const int icon_id = GetAppIconResourceId();
   // HICON returned from LoadIcon do not leak and do not have to be destroyed.
   return LoadIcon(GetModuleHandle(chrome::kBrowserResourcesDll),
@@ -35,16 +39,35 @@
 }
 
 HICON GetSmallAppIcon() {
+  // TODO(mgiuca): Use GetAppIconImageFamily/CreateExact instead of LoadIcon, to
+  // get correct scaling. (See http://crbug.com/551256)
   const int icon_id = GetAppIconResourceId();
+  gfx::Size size = GetSmallAppIconSize();
   // HICON returned from LoadImage must be released using DestroyIcon.
   return static_cast<HICON>(LoadImage(
       GetModuleHandle(chrome::kBrowserResourcesDll), MAKEINTRESOURCE(icon_id),
-      IMAGE_ICON, GetSystemMetrics(SM_CXSMICON), GetSystemMetrics(SM_CYSMICON),
-      LR_DEFAULTCOLOR | LR_SHARED));
+      IMAGE_ICON, size.width(), size.height(), LR_DEFAULTCOLOR | LR_SHARED));
 }
 
-scoped_ptr<SkBitmap> GetAppIconForSize(int size) {
+gfx::Size GetAppIconSize() {
+  return gfx::Size(GetSystemMetrics(SM_CXICON), GetSystemMetrics(SM_CYICON));
+}
+
+gfx::Size GetSmallAppIconSize() {
+  return gfx::Size(GetSystemMetrics(SM_CXSMICON),
+                   GetSystemMetrics(SM_CYSMICON));
+}
+
+scoped_ptr<gfx::ImageFamily> GetAppIconImageFamily() {
   const int icon_id = GetAppIconResourceId();
-  return IconUtil::CreateSkBitmapFromIconResource(
-      GetModuleHandle(chrome::kBrowserResourcesDll), icon_id, size);
+  // Get the icon from chrome.dll (not chrome.exe, which has different resource
+  // IDs). If chrome.dll is not loaded, we are probably in a unit test, so fall
+  // back to getting the icon from the current module (assuming it is
+  // unit_tests.exe, that has the same resource IDs as chrome.dll).
+  HMODULE module = GetModuleHandle(chrome::kBrowserResourcesDll);
+  if (!module)
+    module = GetModuleHandle(nullptr);
+  DCHECK(module);
+
+  return IconUtil::CreateImageFamilyFromIconResource(module, icon_id);
 }
diff --git a/chrome/browser/app_icon_win.h b/chrome/browser/app_icon_win.h
index 7a29d1f3..c3e6308 100644
--- a/chrome/browser/app_icon_win.h
+++ b/chrome/browser/app_icon_win.h
@@ -9,14 +9,21 @@
 
 #include "base/memory/scoped_ptr.h"
 
+namespace gfx {
+class ImageFamily;
+class Size;
+}
+
 class SkBitmap;
 
 HICON GetAppIcon();
 HICON GetSmallAppIcon();
 
-// Retrieve the application icon for the given size. Note that if you specify a
-// size other than what is contained in chrome.dll (16x16, 32x32, 48x48), this
-// might return a poorly resized icon.
-scoped_ptr<SkBitmap> GetAppIconForSize(int size);
+gfx::Size GetAppIconSize();
+gfx::Size GetSmallAppIconSize();
+
+// Retrieve the application icon for the current process. This returns all of
+// the different sizes of the icon as an ImageFamily.
+scoped_ptr<gfx::ImageFamily> GetAppIconImageFamily();
 
 #endif  // CHROME_BROWSER_APP_ICON_WIN_H_
diff --git a/chrome/browser/chromeos/app_mode/kiosk_app_manager.cc b/chrome/browser/chromeos/app_mode/kiosk_app_manager.cc
index 7bca13ed..b51f66b 100644
--- a/chrome/browser/chromeos/app_mode/kiosk_app_manager.cc
+++ b/chrome/browser/chromeos/app_mode/kiosk_app_manager.cc
@@ -562,6 +562,7 @@
                         this,
                         true /* always_check_updates */,
                         false /* wait_for_cache_initialization */));
+  external_cache_->set_flush_on_put(true);
   UpdateAppData();
   local_accounts_subscription_ =
       CrosSettings::Get()->AddSettingsObserver(
diff --git a/chrome/browser/chromeos/app_mode/startup_app_launcher.cc b/chrome/browser/chromeos/app_mode/startup_app_launcher.cc
index 01e9c9f..15156245 100644
--- a/chrome/browser/chromeos/app_mode/startup_app_launcher.cc
+++ b/chrome/browser/chromeos/app_mode/startup_app_launcher.cc
@@ -34,6 +34,7 @@
 #include "extensions/browser/extension_system.h"
 #include "extensions/common/constants.h"
 #include "extensions/common/extension.h"
+#include "extensions/common/file_util.h"
 #include "extensions/common/manifest_handlers/kiosk_mode_info.h"
 #include "extensions/common/manifest_handlers/offline_enabled_info.h"
 #include "extensions/common/manifest_url_handlers.h"
@@ -435,6 +436,7 @@
 }
 
 void StartupAppLauncher::BeginInstall() {
+  extensions::file_util::SetUseSafeInstallation(true);
   KioskAppManager::Get()->InstallFromCache(app_id_);
   if (extensions::ExtensionSystem::Get(profile_)
           ->extension_service()
diff --git a/chrome/browser/chromeos/certificate_provider/certificate_requests.cc b/chrome/browser/chromeos/certificate_provider/certificate_requests.cc
index f24552a..8804c2f 100644
--- a/chrome/browser/chromeos/certificate_provider/certificate_requests.cc
+++ b/chrome/browser/chromeos/certificate_provider/certificate_requests.cc
@@ -58,7 +58,8 @@
       FROM_HERE, base::TimeDelta::FromMinutes(kGetCertificatesTimeoutInMinutes),
       base::Bind(timeout_callback, request_id));
 
-  const auto insert_result = requests_.insert(request_id, state.Pass());
+  const auto insert_result =
+      requests_.insert(std::make_pair(request_id, state.Pass()));
   DCHECK(insert_result.second) << "request id already in use.";
   return request_id;
 }
@@ -101,11 +102,11 @@
 std::vector<int> CertificateRequests::DropExtension(
     const std::string& extension_id) {
   std::vector<int> completed_requests;
-  for (auto& entry : requests_) {
+  for (const auto& entry : requests_) {
     DVLOG(2) << "Remove extension " << extension_id
              << " from certificate request " << entry.first;
 
-    CertificateRequestState& state = *entry.second;
+    CertificateRequestState& state = *entry.second.get();
     state.pending_extensions.erase(extension_id);
     if (state.pending_extensions.empty())
       completed_requests.push_back(entry.first);
diff --git a/chrome/browser/chromeos/certificate_provider/certificate_requests.h b/chrome/browser/chromeos/certificate_provider/certificate_requests.h
index aaa8375..a2b0d3b 100644
--- a/chrome/browser/chromeos/certificate_provider/certificate_requests.h
+++ b/chrome/browser/chromeos/certificate_provider/certificate_requests.h
@@ -10,7 +10,6 @@
 #include <vector>
 
 #include "base/callback_forward.h"
-#include "base/containers/scoped_ptr_map.h"
 #include "base/macros.h"
 #include "chrome/browser/chromeos/certificate_provider/certificate_info.h"
 #include "net/cert/x509_certificate.h"
@@ -56,7 +55,7 @@
  private:
   struct CertificateRequestState;
 
-  base::ScopedPtrMap<int, scoped_ptr<CertificateRequestState>> requests_;
+  std::map<int, scoped_ptr<CertificateRequestState>> requests_;
   int next_free_request_id_ = 0;
 
   DISALLOW_COPY_AND_ASSIGN(CertificateRequests);
diff --git a/chrome/browser/chromeos/certificate_provider/thread_safe_certificate_map.cc b/chrome/browser/chromeos/certificate_provider/thread_safe_certificate_map.cc
index 3c020e9f0..52be4255 100644
--- a/chrome/browser/chromeos/certificate_provider/thread_safe_certificate_map.cc
+++ b/chrome/browser/chromeos/certificate_provider/thread_safe_certificate_map.cc
@@ -22,9 +22,9 @@
       const net::SHA256HashValue fingerprint =
           net::X509Certificate::CalculateFingerprint256(
               cert_info.certificate->os_cert_handle());
-      fingerprint_to_cert->insert(
+      fingerprint_to_cert->insert(std::make_pair(
           fingerprint, make_scoped_ptr(new ThreadSafeCertificateMap::MapValue(
-                           cert_info, extension_id)));
+                           cert_info, extension_id))));
     }
   }
 }
@@ -53,7 +53,7 @@
   for (const auto& entry : fingerprint_to_cert_and_extension_) {
     const net::SHA256HashValue& fingerprint = entry.first;
     // This doesn't modify the map if it already contains the key |fingerprint|.
-    new_fingerprint_map.insert(fingerprint, nullptr);
+    new_fingerprint_map.insert(std::make_pair(fingerprint, nullptr));
   }
   fingerprint_to_cert_and_extension_.swap(new_fingerprint_map);
 }
@@ -72,7 +72,7 @@
   if (it == fingerprint_to_cert_and_extension_.end())
     return false;
 
-  MapValue* const value = it->second;
+  MapValue* const value = it->second.get();
   if (value) {
     *is_currently_provided = true;
     *info = value->cert_info;
@@ -85,11 +85,11 @@
     const std::string& extension_id) {
   base::AutoLock auto_lock(lock_);
   for (auto& entry : fingerprint_to_cert_and_extension_) {
-    MapValue* const value = entry.second;
+    MapValue* const value = entry.second.get();
     // Only remove the association of the fingerprint to the extension, but keep
     // the fingerprint.
     if (value && value->extension_id == extension_id)
-      fingerprint_to_cert_and_extension_.set(entry.first, nullptr);
+      fingerprint_to_cert_and_extension_[entry.first] = nullptr;
   }
 }
 
diff --git a/chrome/browser/chromeos/certificate_provider/thread_safe_certificate_map.h b/chrome/browser/chromeos/certificate_provider/thread_safe_certificate_map.h
index e9d5a99..a3556211 100644
--- a/chrome/browser/chromeos/certificate_provider/thread_safe_certificate_map.h
+++ b/chrome/browser/chromeos/certificate_provider/thread_safe_certificate_map.h
@@ -8,7 +8,6 @@
 #include <map>
 #include <string>
 
-#include "base/containers/scoped_ptr_map.h"
 #include "base/macros.h"
 #include "base/synchronization/lock.h"
 #include "chrome/browser/chromeos/certificate_provider/certificate_info.h"
@@ -32,9 +31,9 @@
     std::string extension_id;
   };
   using FingerprintToCertAndExtensionMap =
-      base::ScopedPtrMap<net::SHA256HashValue,
-                         scoped_ptr<MapValue>,
-                         net::SHA256HashValueLessThan>;
+      std::map<net::SHA256HashValue,
+               scoped_ptr<MapValue>,
+               net::SHA256HashValueLessThan>;
 
   ThreadSafeCertificateMap();
   ~ThreadSafeCertificateMap();
diff --git a/chrome/browser/chromeos/extensions/external_cache.cc b/chrome/browser/chromeos/extensions/external_cache.cc
index df59b97..04433b1 100644
--- a/chrome/browser/chromeos/extensions/external_cache.cc
+++ b/chrome/browser/chromeos/extensions/external_cache.cc
@@ -28,6 +28,16 @@
 
 namespace chromeos {
 
+namespace {
+
+void FlushFile(const base::FilePath& path) {
+  base::File file(path, base::File::FLAG_OPEN | base::File::FLAG_WRITE);
+  file.Flush();
+  file.Close();
+}
+
+}  // namespace
+
 ExternalCache::ExternalCache(const base::FilePath& cache_dir,
                              net::URLRequestContextGetter* request_context,
                              const scoped_refptr<base::SequencedTaskRunner>&
@@ -320,6 +330,11 @@
     return;
   }
 
+  if (flush_on_put_) {
+    backend_task_runner_->PostTask(FROM_HERE,
+                                   base::Bind(&FlushFile, file_path));
+  }
+
   std::string update_url;
   if (entry->GetString(extensions::ExternalProviderImpl::kExternalUpdateUrl,
                        &update_url) &&
diff --git a/chrome/browser/chromeos/extensions/external_cache.h b/chrome/browser/chromeos/extensions/external_cache.h
index 9da6d1f..c57ddf3 100644
--- a/chrome/browser/chromeos/extensions/external_cache.h
+++ b/chrome/browser/chromeos/extensions/external_cache.h
@@ -134,6 +134,8 @@
                             const std::string& version,
                             const PutExternalExtensionCallback& callback);
 
+  void set_flush_on_put(bool flush_on_put) { flush_on_put_ = flush_on_put; }
+
  private:
   // Notifies the that the cache has been updated, providing
   // extensions loader with an updated list of extensions.
@@ -171,6 +173,9 @@
   // Set to true if cache should wait for initialization flag file.
   bool wait_for_cache_initialization_;
 
+  // Whether to flush the crx file after putting into |local_cache_|.
+  bool flush_on_put_ = false;
+
   // This is the list of extensions currently configured.
   scoped_ptr<base::DictionaryValue> extensions_;
 
diff --git a/chrome/browser/extensions/api/preferences_private/preferences_private_apitest.cc b/chrome/browser/extensions/api/preferences_private/preferences_private_apitest.cc
index 8393421..57c7350 100644
--- a/chrome/browser/extensions/api/preferences_private/preferences_private_apitest.cc
+++ b/chrome/browser/extensions/api/preferences_private/preferences_private_apitest.cc
@@ -49,9 +49,7 @@
  public:
   explicit FakeProfileSyncService(Profile* profile)
       : ProfileSyncService(
-            make_scoped_ptr(new browser_sync::ChromeSyncClient(
-                profile,
-                make_scoped_ptr(new SyncApiComponentFactoryMock()))),
+            make_scoped_ptr(new browser_sync::ChromeSyncClient(profile)),
             make_scoped_ptr<SigninManagerWrapper>(NULL),
             ProfileOAuth2TokenServiceFactory::GetForProfile(profile),
             browser_sync::MANUAL_START,
@@ -66,7 +64,11 @@
                 content::BrowserThread::FILE),
             content::BrowserThread::GetBlockingPool()),
         sync_initialized_(true),
-        initialized_state_violation_(false) {}
+        initialized_state_violation_(false) {
+    static_cast<browser_sync::ChromeSyncClient*>(GetSyncClient())
+        ->SetSyncApiComponentFactoryForTesting(
+            make_scoped_ptr(new SyncApiComponentFactoryMock()));
+  }
 
   ~FakeProfileSyncService() override {}
 
diff --git a/chrome/browser/extensions/api/sessions/sessions_apitest.cc b/chrome/browser/extensions/api/sessions/sessions_apitest.cc
index 2999003..c53b02b 100644
--- a/chrome/browser/extensions/api/sessions/sessions_apitest.cc
+++ b/chrome/browser/extensions/api/sessions/sessions_apitest.cc
@@ -137,10 +137,12 @@
               sync_pb::SyncEnums_DeviceType_TYPE_LINUX,
               "device_id")));
 
-  return make_scoped_ptr(new ProfileSyncServiceMock(
-      make_scoped_ptr(new browser_sync::ChromeSyncClient(
-          static_cast<Profile*>(context), factory.Pass())),
-      static_cast<Profile*>(context)));
+  Profile* profile = static_cast<Profile*>(context);
+  ProfileSyncServiceMock* sync_service = new ProfileSyncServiceMock(
+      make_scoped_ptr(new browser_sync::ChromeSyncClient(profile)), profile);
+  static_cast<browser_sync::ChromeSyncClient*>(sync_service->GetSyncClient())
+      ->SetSyncApiComponentFactoryForTesting(factory.Pass());
+  return make_scoped_ptr(sync_service);
 }
 
 void ExtensionSessionsTest::CreateTestProfileSyncService() {
diff --git a/chrome/browser/extensions/extension_service_test_base.h b/chrome/browser/extensions/extension_service_test_base.h
index e59e854..7f25036 100644
--- a/chrome/browser/extensions/extension_service_test_base.h
+++ b/chrome/browser/extensions/extension_service_test_base.h
@@ -122,9 +122,14 @@
   const base::ScopedTempDir& temp_dir() const { return temp_dir_; }
 
  private:
+  // Must be declared before anything that may make use of the
+  // directory so as to ensure files are closed before cleanup.
+  base::ScopedTempDir temp_dir_;
+
   // Destroying at_exit_manager_ will delete all LazyInstances, so it must come
   // after thread_bundle_ in the destruction order.
   base::ShadowingAtExitManager at_exit_manager_;
+
   scoped_ptr<content::TestBrowserThreadBundle> thread_bundle_;
 
  protected:
@@ -143,10 +148,6 @@
  private:
   void CreateExtensionService(const ExtensionServiceInitParams& params);
 
-  // Destroy temp_dir_ after thread_bundle_ so clean-up tasks can still use the
-  // directory.
-  base::ScopedTempDir temp_dir_;
-
   // Whether or not the thread bundle was reset in the test.
   bool did_reset_thread_bundle_;
 
diff --git a/chrome/browser/extensions/extension_service_unittest.cc b/chrome/browser/extensions/extension_service_unittest.cc
index b28702fa..5c90551c 100644
--- a/chrome/browser/extensions/extension_service_unittest.cc
+++ b/chrome/browser/extensions/extension_service_unittest.cc
@@ -31,6 +31,7 @@
 #include "base/strings/utf_string_conversions.h"
 #include "base/thread_task_runner_handle.h"
 #include "base/version.h"
+#include "chrome/browser/after_startup_task_utils.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/extensions/blacklist.h"
@@ -432,6 +433,14 @@
 class ExtensionServiceTest
     : public extensions::ExtensionServiceTestWithInstall {
  public:
+  ExtensionServiceTest() {
+    // The extension subsystem posts logging tasks to be done after
+    // browser startup. There's no StartupObserver as there normally
+    // would be since we're in a unit test, so we have to explicitly
+    // note tasks should be processed.
+    AfterStartupTaskUtils::SetBrowserStartupIsComplete();
+  }
+
   void AddMockExternalProvider(
       extensions::ExternalProviderInterface* provider) {
     service()->AddProviderForTesting(provider);
diff --git a/chrome/browser/mac/keystone_glue.mm b/chrome/browser/mac/keystone_glue.mm
index 9dc61f8..c6333e7 100644
--- a/chrome/browser/mac/keystone_glue.mm
+++ b/chrome/browser/mac/keystone_glue.mm
@@ -197,12 +197,10 @@
 // which does not depend on applying a patch to existing files.
 - (BOOL)wantsFullInstaller;
 
-// Returns an NSString* suitable for appending to a Chrome Keystone tag value
-// or tag key. If the system has a 32-bit-only CPU, the tag suffix will
-// contain the string "-32bit". If a full installer (as opposed to a binary
-// diff/delta patch) is required, the tag suffix will contain the string
-// "-full". If no special treatment is required, the tag suffix will be an
-// empty string.
+// Returns an NSString* suitable for appending to a Chrome Keystone tag value or
+// tag key.  If a full installer (as opposed to a binary diff/delta patch) is
+// required, the tag suffix will contain the string "-full". If no special
+// treatment is required, the tag suffix will be an empty string.
 - (NSString*)tagSuffix;
 
 @end  // @interface KeystoneGlue (Private)
diff --git a/chrome/browser/media/media_stream_devices_controller.cc b/chrome/browser/media/media_stream_devices_controller.cc
index 9dc47941..7ef1064 100644
--- a/chrome/browser/media/media_stream_devices_controller.cc
+++ b/chrome/browser/media/media_stream_devices_controller.cc
@@ -4,9 +4,10 @@
 
 #include "chrome/browser/media/media_stream_devices_controller.h"
 
+#include <map>
+
 #include "base/auto_reset.h"
 #include "base/callback_helpers.h"
-#include "base/containers/scoped_ptr_map.h"
 #include "base/metrics/histogram.h"
 #include "base/prefs/scoped_user_pref_update.h"
 #include "base/strings/utf_string_conversions.h"
@@ -89,8 +90,7 @@
   // Map of <render process id, render frame id> ->
   // MediaPermissionRequestLogger.
   using RequestMap =
-      base::ScopedPtrMap<std::pair<int, int>,
-                         scoped_ptr<MediaPermissionRequestLogger>>;
+      std::map<std::pair<int, int>, scoped_ptr<MediaPermissionRequestLogger>>;
 
  public:
   static void LogRequest(content::WebContents* contents,
@@ -102,8 +102,8 @@
     if (!ContainsKey(GetRequestMap(), key)) {
       UMA_HISTOGRAM_BOOLEAN("Pepper.SecureOrigin.MediaStreamRequest",
                             is_secure);
-      GetRequestMap().set(key, make_scoped_ptr(new MediaPermissionRequestLogger(
-                                   contents, key)));
+      GetRequestMap()[key] =
+          make_scoped_ptr(new MediaPermissionRequestLogger(contents, key));
     }
   }
 
diff --git a/chrome/browser/media/router/media_router_dialog_controller.cc b/chrome/browser/media/router/media_router_dialog_controller.cc
index 2f0583d..195a838 100644
--- a/chrome/browser/media/router/media_router_dialog_controller.cc
+++ b/chrome/browser/media/router/media_router_dialog_controller.cc
@@ -65,7 +65,6 @@
     : initiator_(initiator) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
   DCHECK(initiator_);
-  initiator_observer_.reset(new InitiatorWebContentsObserver(initiator_, this));
 }
 
 MediaRouterDialogController::~MediaRouterDialogController() {
@@ -81,6 +80,7 @@
     return false;
 
   create_connection_request_ = request.Pass();
+  initiator_observer_.reset(new InitiatorWebContentsObserver(initiator_, this));
   CreateMediaRouterDialog();
 
   // Show the initiator holding the existing media router dialog.
@@ -97,8 +97,11 @@
 
   // Don't create dialog if it already exists.
   bool dialog_needs_creation = !IsShowingMediaRouterDialog();
-  if (dialog_needs_creation)
+  if (dialog_needs_creation) {
+    initiator_observer_.reset(
+        new InitiatorWebContentsObserver(initiator_, this));
     CreateMediaRouterDialog();
+  }
 
   ActivateInitiatorWebContents();
   return dialog_needs_creation;
diff --git a/chrome/browser/media_galleries/gallery_watch_manager.cc b/chrome/browser/media_galleries/gallery_watch_manager.cc
index d579706..4368fae47 100644
--- a/chrome/browser/media_galleries/gallery_watch_manager.cc
+++ b/chrome/browser/media_galleries/gallery_watch_manager.cc
@@ -344,12 +344,11 @@
     BrowserContext* browser_context) {
   auto it = browser_context_subscription_map_.find(browser_context);
   if (it == browser_context_subscription_map_.end()) {
-    browser_context_subscription_map_.set(
-        browser_context,
+    browser_context_subscription_map_[browser_context] =
         ShutdownNotifierFactory::GetInstance()
             ->Get(browser_context)
             ->Subscribe(base::Bind(&GalleryWatchManager::ShutdownBrowserContext,
-                                   base::Unretained(this), browser_context)));
+                                   base::Unretained(this), browser_context));
   }
 }
 
diff --git a/chrome/browser/media_galleries/gallery_watch_manager.h b/chrome/browser/media_galleries/gallery_watch_manager.h
index a87a2e2..bdb08c4 100644
--- a/chrome/browser/media_galleries/gallery_watch_manager.h
+++ b/chrome/browser/media_galleries/gallery_watch_manager.h
@@ -10,7 +10,6 @@
 
 #include "base/basictypes.h"
 #include "base/callback_forward.h"
-#include "base/containers/scoped_ptr_map.h"
 #include "base/files/file_path.h"
 #include "base/files/file_path_watcher.h"
 #include "base/memory/linked_ptr.h"
@@ -109,9 +108,8 @@
   typedef std::map<base::FilePath, NotificationInfo> WatchedPaths;
   typedef std::map<content::BrowserContext*, GalleryWatchManagerObserver*>
       ObserverMap;
-  typedef base::ScopedPtrMap<
-      content::BrowserContext*,
-      scoped_ptr<KeyedServiceShutdownNotifier::Subscription>>
+  typedef std::map<content::BrowserContext*,
+                   scoped_ptr<KeyedServiceShutdownNotifier::Subscription>>
       BrowserContextSubscriptionMap;
 
   // Ensure there is a subscription to shutdown notifications for
diff --git a/chrome/browser/media_galleries/media_file_system_registry.cc b/chrome/browser/media_galleries/media_file_system_registry.cc
index 7b2ac40..f16b9ac 100644
--- a/chrome/browser/media_galleries/media_file_system_registry.cc
+++ b/chrome/browser/media_galleries/media_file_system_registry.cc
@@ -580,11 +580,10 @@
   if (!ContainsKey(extension_hosts_map_, profile)) {
     extension_hosts_map_[profile] = ExtensionHostMap();
     DCHECK(!ContainsKey(profile_subscription_map_, profile));
-    profile_subscription_map_.set(
-        profile,
+    profile_subscription_map_[profile] =
         ShutdownNotifierFactory::GetInstance()->Get(profile)->Subscribe(
             base::Bind(&MediaFileSystemRegistry::OnProfileShutdown,
-                       base::Unretained(this), profile)));
+                       base::Unretained(this), profile));
     media_galleries::UsageCount(media_galleries::PROFILES_WITH_USAGE);
   }
 
diff --git a/chrome/browser/media_galleries/media_file_system_registry.h b/chrome/browser/media_galleries/media_file_system_registry.h
index ced36ad..082f76b 100644
--- a/chrome/browser/media_galleries/media_file_system_registry.h
+++ b/chrome/browser/media_galleries/media_file_system_registry.h
@@ -14,7 +14,6 @@
 #include <vector>
 
 #include "base/basictypes.h"
-#include "base/containers/scoped_ptr_map.h"
 #include "base/files/file.h"
 #include "base/files/file_path.h"
 #include "base/memory/ref_counted.h"
@@ -117,9 +116,8 @@
   // Map a profile and extension to the ExtensionGalleriesHost.
   typedef std::map<Profile*, ExtensionHostMap> ExtensionGalleriesHostMap;
   // Map a profile to a shutdown notification subscription.
-  typedef base::ScopedPtrMap<
-      Profile*,
-      scoped_ptr<KeyedServiceShutdownNotifier::Subscription>>
+  typedef std::map<Profile*,
+                   scoped_ptr<KeyedServiceShutdownNotifier::Subscription>>
       ProfileSubscriptionMap;
 
   void OnPermissionRemoved(MediaGalleriesPreferences* pref,
diff --git a/chrome/browser/predictors/resource_prefetch_predictor.cc b/chrome/browser/predictors/resource_prefetch_predictor.cc
index 16beb8a1..cba29d6 100644
--- a/chrome/browser/predictors/resource_prefetch_predictor.cc
+++ b/chrome/browser/predictors/resource_prefetch_predictor.cc
@@ -424,7 +424,7 @@
 
   scoped_ptr<Result> result(new Result(key_type, requests));
   // Add the results to the results map.
-  if (!results_map_.insert(navigation_id, result.Pass()).second)
+  if (!results_map_.insert(std::make_pair(navigation_id, result.Pass())).second)
     DLOG(FATAL) << "Returning results for existing navigation.";
 }
 
diff --git a/chrome/browser/predictors/resource_prefetch_predictor.h b/chrome/browser/predictors/resource_prefetch_predictor.h
index 7f6aca4..7152735 100644
--- a/chrome/browser/predictors/resource_prefetch_predictor.h
+++ b/chrome/browser/predictors/resource_prefetch_predictor.h
@@ -9,7 +9,6 @@
 #include <string>
 #include <vector>
 
-#include "base/containers/scoped_ptr_map.h"
 #include "base/gtest_prod_util.h"
 #include "base/memory/linked_ptr.h"
 #include "base/memory/scoped_ptr.h"
@@ -170,7 +169,7 @@
   typedef ResourcePrefetchPredictorTables::PrefetchDataMap PrefetchDataMap;
   typedef std::map<NavigationID, linked_ptr<std::vector<URLRequestSummary> > >
       NavigationMap;
-  typedef base::ScopedPtrMap<NavigationID, scoped_ptr<Result>> ResultsMap;
+  typedef std::map<NavigationID, scoped_ptr<Result>> ResultsMap;
 
   // Returns true if the main page request is supported for prediction.
   static bool IsHandledMainPage(net::URLRequest* request);
diff --git a/chrome/browser/profiles/profile_shortcut_manager_win.cc b/chrome/browser/profiles/profile_shortcut_manager_win.cc
index 3b009ed..0061b4c 100644
--- a/chrome/browser/profiles/profile_shortcut_manager_win.cc
+++ b/chrome/browser/profiles/profile_shortcut_manager_win.cc
@@ -174,29 +174,38 @@
     return base::FilePath();
   }
 
-  scoped_ptr<SkBitmap> app_icon_bitmap(GetAppIconForSize(kShortcutIconSize));
-  if (!app_icon_bitmap)
+  scoped_ptr<gfx::ImageFamily> family = GetAppIconImageFamily();
+  if (!family)
+    return base::FilePath();
+
+  // TODO(mgiuca): A better approach would be to badge each image in the
+  // ImageFamily (scaling the badge to the correct size), and then re-export the
+  // family (as opposed to making a family with just 48 and 256, then scaling
+  // those images to about a dozen different sizes).
+  SkBitmap app_icon_bitmap =
+      family->CreateExact(kShortcutIconSize, kShortcutIconSize).AsBitmap();
+  if (app_icon_bitmap.isNull())
     return base::FilePath();
 
   gfx::ImageFamily badged_bitmaps;
   if (!avatar_bitmap_1x.empty()) {
     badged_bitmaps.Add(gfx::Image::CreateFrom1xBitmap(
-        BadgeIcon(*app_icon_bitmap, avatar_bitmap_1x, 1)));
+        BadgeIcon(app_icon_bitmap, avatar_bitmap_1x, 1)));
   }
 
-  scoped_ptr<SkBitmap> large_app_icon_bitmap(
-      GetAppIconForSize(IconUtil::kLargeIconSize));
-  if (large_app_icon_bitmap && !avatar_bitmap_2x.empty()) {
+  SkBitmap large_app_icon_bitmap =
+      family->CreateExact(IconUtil::kLargeIconSize, IconUtil::kLargeIconSize)
+          .AsBitmap();
+  if (!large_app_icon_bitmap.isNull() && !avatar_bitmap_2x.empty()) {
     badged_bitmaps.Add(gfx::Image::CreateFrom1xBitmap(
-        BadgeIcon(*large_app_icon_bitmap, avatar_bitmap_2x, 2)));
+        BadgeIcon(large_app_icon_bitmap, avatar_bitmap_2x, 2)));
   }
 
   // If we have no badged bitmaps, we should just use the default chrome icon.
   if (badged_bitmaps.empty()) {
-    badged_bitmaps.Add(gfx::Image::CreateFrom1xBitmap(*app_icon_bitmap));
-    if (large_app_icon_bitmap) {
-      badged_bitmaps.Add(
-          gfx::Image::CreateFrom1xBitmap(*large_app_icon_bitmap));
+    badged_bitmaps.Add(gfx::Image::CreateFrom1xBitmap(app_icon_bitmap));
+    if (!large_app_icon_bitmap.isNull()) {
+      badged_bitmaps.Add(gfx::Image::CreateFrom1xBitmap(large_app_icon_bitmap));
     }
   }
   // Finally, write the .ico file containing this new bitmap.
diff --git a/chrome/browser/resources/chromeos/chromevox/cvox2/background/automation_util.js b/chrome/browser/resources/chromeos/chromevox/cvox2/background/automation_util.js
index e907c0cd..c7c743a 100644
--- a/chrome/browser/resources/chromeos/chromevox/cvox2/background/automation_util.js
+++ b/chrome/browser/resources/chromeos/chromevox/cvox2/background/automation_util.js
@@ -96,7 +96,7 @@
     if (!AutomationUtil.isInSameTree(cur, cur.parent))
       return null;
     cur = cur.parent;
-    if (AutomationUtil.isTraversalRoot(cur))
+    if (!cur || AutomationUtil.isTraversalRoot(cur))
       return null;
   }
 };
diff --git a/chrome/browser/resources/chromeos/chromevox/cvox2/background/background.js b/chrome/browser/resources/chromeos/chromevox/cvox2/background/background.js
index 05b2009..4c04953 100644
--- a/chrome/browser/resources/chromeos/chromevox/cvox2/background/background.js
+++ b/chrome/browser/resources/chromeos/chromevox/cvox2/background/background.js
@@ -119,8 +119,7 @@
 
   cvox.ExtensionBridge.addMessageListener(this.onMessage_);
 
-  document.addEventListener(
-      'keydown', cvox.ChromeVoxKbHandler.basicKeyDownActionsListener, true);
+  document.addEventListener('keydown', this.onKeyDown.bind(this), true);
   cvox.ChromeVoxKbHandler.commandHandler = this.onGotCommand.bind(this);
 
   // Classic keymap.
@@ -413,6 +412,18 @@
   },
 
   /**
+   * Handles key down events.
+   * @param {Event} evt The key down event to process.
+   * @return {boolean} True if the default action should be performed.
+   */
+  onKeyDown: function(evt) {
+    if (!cvox.ChromeVoxKbHandler.basicKeyDownActionsListener(evt)) {
+      evt.preventDefault();
+      evt.stopPropagation();
+    }
+  },
+
+  /**
    * Open the options page in a new tab.
    */
   showOptionsPage: function() {
diff --git a/chrome/browser/resources/chromeos/chromevox/cvox2/background/cursors.js b/chrome/browser/resources/chromeos/chromevox/cvox2/background/cursors.js
index 03799cf4..349e008 100644
--- a/chrome/browser/resources/chromeos/chromevox/cvox2/background/cursors.js
+++ b/chrome/browser/resources/chromeos/chromevox/cvox2/background/cursors.js
@@ -112,16 +112,13 @@
   /**
    * Gets the accessible text of the node associated with this cursor.
    *
-   * Note that only one of |name| or |value| attribute is ever nonempty on an
-   * automation node. If either contains whitespace, we still treat it as we do
-   * for a nonempty string.
    * @param {!AutomationNode=} opt_node Use this node rather than this cursor's
    * node.
    * @return {string}
    */
   getText: function(opt_node) {
     var node = opt_node || this.node_;
-    return node.name || node.value || '';
+    return node.name || '';
   },
 
   /**
diff --git a/chrome/browser/resources/chromeos/chromevox/cvox2/background/cursors_test.extjs b/chrome/browser/resources/chromeos/chromevox/cvox2/background/cursors_test.extjs
index 0044aee..a50f159 100644
--- a/chrome/browser/resources/chromeos/chromevox/cvox2/background/cursors_test.extjs
+++ b/chrome/browser/resources/chromeos/chromevox/cvox2/background/cursors_test.extjs
@@ -88,7 +88,7 @@
     if (goog.isDef(expected.index))
       assertEquals(expected.index, cursor.index);
     if (goog.isDef(expected.value))
-      assertEquals(expected.value, cursor.node.value);
+      assertEquals(expected.value, cursor.node.name);
   },
 
   /**
@@ -280,16 +280,16 @@
     var cursor = new cursors.Cursor(para, 0);
     cursor = cursor.move(DOM_NODE, DIRECTIONAL, FORWARD);
     assertEquals('staticText', cursor.node.role);
-    assertEquals('end', cursor.node.value);
+    assertEquals('end', cursor.node.name);
 
     cursor = cursor.move(DOM_NODE, DIRECTIONAL, BACKWARD);
     assertEquals('staticText', cursor.node.role);
-    assertEquals('start diff line', cursor.node.value);
+    assertEquals('start diff line', cursor.node.name);
     
     assertEquals('inlineTextBox', cursor.node.firstChild.role);
-    assertEquals('start ', cursor.node.firstChild.value);
-    assertEquals('diff ', cursor.node.firstChild.nextSibling.value);
-    assertEquals('line', cursor.node.lastChild.value);
+    assertEquals('start ', cursor.node.firstChild.name);
+    assertEquals('diff ', cursor.node.firstChild.nextSibling.name);
+    assertEquals('line', cursor.node.lastChild.name);
   });
 });
 
diff --git a/chrome/browser/resources/chromeos/chromevox/cvox2/background/output.js b/chrome/browser/resources/chromeos/chromevox/cvox2/background/output.js
index 16006e7..a10454c 100644
--- a/chrome/browser/resources/chromeos/chromevox/cvox2/background/output.js
+++ b/chrome/browser/resources/chromeos/chromevox/cvox2/background/output.js
@@ -377,84 +377,89 @@
 Output.RULES = {
   navigate: {
     'default': {
-      speak: '$name $value $help $role',
+      speak: '$name $value $role $description',
       braille: ''
     },
     abstractContainer: {
-      enter: '$name $role',
+      enter: '$name $role $description',
       leave: '@exited_container($role)'
     },
     alert: {
       speak: '!doNotInterrupt $role $descendants'
     },
     alertDialog: {
-      enter: '$name $role $descendants'
+      enter: '$name $role $description $descendants'
     },
     cell: {
       enter: '@column_granularity $tableCellColumnIndex'
     },
     checkBox: {
       speak: '$if($checked, $earcon(CHECK_ON), $earcon(CHECK_OFF)) ' +
-             '$name $role $checked'
+             '$name $role $checked $description'
     },
     dialog: {
-      enter: '$name $role'
+      enter: '$name $role $description'
     },
     div: {
       enter: '$name',
-      speak: '$name'
+      speak: '$name $description'
     },
     grid: {
-      enter: '$name $role'
+      enter: '$name $role $description'
     },
     heading: {
       enter: '@tag_h+$hierarchicalLevel',
       speak: '@tag_h+$hierarchicalLevel $nameOrDescendants='
     },
     inlineTextBox: {
-      speak: '$value='
+      speak: '$name='
     },
     link: {
       enter: '$name $if($visited, @visited_link, $role)',
       stay: '$name= $if($visited, @visited_link, $role)',
-      speak: '$name= $if($visited, @visited_link, $role)'
+      speak: '$name= $if($visited, @visited_link, $role) $description'
     },
     list: {
       enter: '$role @@list_with_items($countChildren(listItem))'
     },
     listBox: {
-      enter: '$name $role @@list_with_items($countChildren(listBoxOption))'
+      enter: '$name $role @@list_with_items($countChildren(listBoxOption)) ' +
+          '$description'
     },
     listBoxOption: {
-      speak: '$name $role @describe_index($indexInParent, $parentChildCount)'
+      speak: '$name $role @describe_index($indexInParent, $parentChildCount) ' +
+          '$description'
     },
     listItem: {
       enter: '$role'
     },
     menu: {
-      enter: '$name $role @@list_with_items($countChildren(menuItem))'
+      enter: '$name $role @@list_with_items($countChildren(menuItem)) ' +
+          '$description'
     },
     menuItem: {
       speak: '$name $role $if($haspopup, @has_submenu) ' +
-          '@describe_index($indexInParent, $parentChildCount)'
+          '@describe_index($indexInParent, $parentChildCount) ' +
+          '$description'
     },
     menuListOption: {
-      speak: '$name $value @role_menuitem ' +
-          '@describe_index($indexInParent, $parentChildCount)'
+      speak: '$name @role_menuitem ' +
+          '@describe_index($indexInParent, $parentChildCount) $description'
     },
     paragraph: {
       speak: '$descendants'
     },
     popUpButton: {
       speak: '$earcon(POP_UP_BUTTON) $value $name $role @aria_has_popup ' +
-          '$if($collapsed, @aria_expanded_false, @aria_expanded_true)'
+          '$if($collapsed, @aria_expanded_false, @aria_expanded_true) ' +
+          '$description'
     },
     radioButton: {
       speak: '$if($checked, @describe_radio_selected($name), ' +
-          '@describe_radio_unselected($name))'
+          '@describe_radio_unselected($name)) $description'
     },
     radioGroup: {
-      enter: '$name $role'
+      enter: '$name $role $description'
     },
     rootWebArea: {
       enter: '$name'
@@ -463,21 +468,21 @@
       enter: '@row_granularity $tableRowIndex'
     },
     slider: {
-      speak: '$earcon(SLIDER) @describe_slider($value, $name) $help'
+      speak: '$earcon(SLIDER) @describe_slider($value, $name) $description'
     },
     staticText: {
-      speak: '$value='
+      speak: '$name='
     },
     tab: {
       speak: '@describe_tab($name)'
     },
     textField: {
       speak: '$name $value $if(' +
-          '$inputType, $inputType, $role)',
+          '$inputType, $inputType, $role) $description',
       braille: ''
     },
     toolbar: {
-      enter: '$name $role'
+      enter: '$name $role $description'
     },
     tree: {
       enter: '$name $role @@list_with_items($countChildren(treeItem))'
@@ -512,7 +517,7 @@
   alert: {
     default: {
       speak: '!doNotInterrupt ' +
-          '@role_alert $name $earcon(ALERT_NONMODAL) $descendants'
+          '@role_alert $name $earcon(ALERT_NONMODAL) $description $descendants'
     }
   }
 };
@@ -842,11 +847,7 @@
               earconFinder = earconFinder.parent;
             }
           }
-
-          // Pending finalization of name calculation; we must use the
-          // description property to access aria-label. See crbug.com/473220.
-          var resolvedName = node.description || node.name;
-          this.append_(buff, resolvedName, options);
+          this.append_(buff, node.name, options);
         } else if (token == 'nameOrDescendants') {
           options.annotation.push(token);
           if (node.name)
diff --git a/chrome/browser/resources/chromeos/chromevox/cvox2/background/output_test.extjs b/chrome/browser/resources/chromeos/chromevox/cvox2/background/output_test.extjs
index a6940a7..4f191bd 100644
--- a/chrome/browser/resources/chromeos/chromevox/cvox2/background/output_test.extjs
+++ b/chrome/browser/resources/chromeos/chromevox/cvox2/background/output_test.extjs
@@ -178,16 +178,12 @@
 
       range = cursors.Range.fromNode(el);
       o = new Output().withSpeechAndBraille(range, null, 'navigate');
-      assertEqualsJSON({string_: 'Heading 1|b|Link', 'spans_': [
-        // Link.
-        {value: 'name', start: 10, end: 11},
-        {value: {earconId: "LINK"}, start: 10, end: 11},
-        {value: 'role', start: 12, end: 16}
+      assertEqualsJSON({string_: 'Heading 1|b', 'spans_': [
+        {value: 'nameOrDescendants', start: 10, end: 11}
       ]}, o.speechOutputForTest);
       checkBrailleOutput(
-          'h1 b lnk',
-          [{value: new Output.NodeSpan(el), start: 0, end: 2},
-           {value: new Output.NodeSpan(el.firstChild), start: 3, end: 8}],
+          'h1 b',
+          [{value: new Output.NodeSpan(el), start: 0, end: 4}],
           o);
   });
 });
@@ -199,24 +195,24 @@
       var range = cursors.Range.fromNode(el);
       var o = new Output().withSpeechAndBraille(range, null, 'navigate');
       assertEqualsJSON(
-          {string_: 'audio|Tool bar|play||begin playback|Button',
+          {string_: 'audio|Tool bar|audio|play||Button|begin playback',
            spans_:
               // Entered container toolbar.
 
               // Button.
-              [{value: 'name', start: 15, end: 19},
+              [{value: 'name', start: 21, end: 25},
 
               // Button earcon.
-              {value: {earconId: "BUTTON"}, start: 15, end: 19},
+              {value: {earconId: "BUTTON"}, start: 21, end: 25},
 
-              {value: 'value', start: 20, end: 20},
-              {value: 'help', start: 21, end: 35},
-              {value: 'role', start: 36, end: 42}]
+              {value: 'value', start: 26, end: 26},
+              {value: 'role', start: 27, end: 33},
+              {value: 'description', start: 34, end: 48}],
           }, o.speechOutputForTest);
       checkBrailleOutput(
-          'audio tlbar play begin playback btn',
-          [{value: new Output.NodeSpan(el.parent), start: 0, end: 11},
-           {value: new Output.NodeSpan(el), start: 12, end: 35}],
+          'audio tlbar audio play btn begin playback',
+          [{value: new Output.NodeSpan(el.parent), start: 0, end: 17},
+           {value: new Output.NodeSpan(el), start: 18, end: 41}],
           o);
 
       el = el.nextSibling;
@@ -226,7 +222,7 @@
       assertEqualsJSON({string_: '|0, , slider|audio time scrubber',
           spans_:
               [{value: {'earconId': 'SLIDER'}, start: 0, end: 0},
-               {value: 'help', start: 13, end: 32}]
+               {value: 'description', start: 13, end: 32}]
           }, o.speechOutputForTest);
       // TODO(plundblad): Investigate this.
       checkBrailleOutput(
@@ -476,23 +472,23 @@
     var el = root.firstChild.firstChild.firstChild;
     var range = cursors.Range.fromNode(el);
     var o = new Output().withSpeechAndBraille(range, null, 'navigate');
-    assertEqualsJSON({string_: '|List box|with 2 items||List item| 1 of 2 ',
+    assertEqualsJSON({string_: '|List box|with 2 items|1|List item| 1 of 2 ',
         spans_: [
           // ListBox.
           // Earcon.
           {value: {earconId:'LISTBOX'}, start: 0, end: 0},
 
-          {value: 'name', start: 23, end: 23},
+          {value: 'name', start: 23, end: 24},
 
           // Earcon.
-          {value: {earconId: 'LIST_ITEM'}, start: 23, end: 23},
+          {value: {earconId: 'LIST_ITEM'}, start: 23, end: 24},
 
-          {value: 'role', start:24, end: 33}
+          {value: 'role', start:25, end: 34}
     ]}, o.speechOutputForTest);
     checkBrailleOutput(
-        'lstbx +2 lstitm 1/2',
+        'lstbx +2 1 lstitm 1/2',
         [{value: new Output.NodeSpan(el.parent), start: 0, end: 8},
-         {value: new Output.NodeSpan(el), start: 9, end: 19}],
+         {value: new Output.NodeSpan(el), start: 9, end: 21}],
         o);
   });
 });
diff --git a/chrome/browser/resources/chromeos/chromevox/cvox2/background/tabs_automation_handler.js b/chrome/browser/resources/chromeos/chromevox/cvox2/background/tabs_automation_handler.js
index fef2f0a3..ae9fa82 100644
--- a/chrome/browser/resources/chromeos/chromevox/cvox2/background/tabs_automation_handler.js
+++ b/chrome/browser/resources/chromeos/chromevox/cvox2/background/tabs_automation_handler.js
@@ -20,6 +20,8 @@
 };
 
 TabsAutomationHandler.prototype = {
+  __proto__: DesktopAutomationHandler.prototype,
+
   /** @override */
   didHandleEvent_: function(evt) {
     evt.stopPropagation();
diff --git a/chrome/browser/resources/options/chromeos/network_list.js b/chrome/browser/resources/options/chromeos/network_list.js
index 3d81804..c366b07 100644
--- a/chrome/browser/resources/options/chromeos/network_list.js
+++ b/chrome/browser/resources/options/chromeos/network_list.js
@@ -1283,6 +1283,9 @@
 
       if (wifiDeviceState_ == 'Enabled')
         loadData_('WiFi', networkStates);
+      else if (wifiDeviceState_ ==
+          chrome.networkingPrivate.DeviceStateType.PROHIBITED)
+        setTechnologiesProhibited_(chrome.networkingPrivate.NetworkType.WI_FI);
       else
         addEnableNetworkButton_(chrome.networkingPrivate.NetworkType.WI_FI);
 
@@ -1292,6 +1295,10 @@
             !isCellularSimAbsent(cellularDevice_) &&
             !isCellularSimLocked(cellularDevice_)) {
           loadData_('Cellular', networkStates);
+        } else if (cellularDevice_.State ==
+            chrome.networkingPrivate.DeviceStateType.PROHIBITED) {
+          setTechnologiesProhibited_(
+              chrome.networkingPrivate.NetworkType.CELLULAR);
         } else {
           addEnableNetworkButton_(
               chrome.networkingPrivate.NetworkType.CELLULAR);
@@ -1302,10 +1309,15 @@
 
       // Only show wimax control if available. Uses cellular icons.
       if (wimaxDeviceState_) {
-        if (wimaxDeviceState_ == 'Enabled')
+        if (wimaxDeviceState_ == 'Enabled') {
           loadData_('WiMAX', networkStates);
-        else
+        } else if (wimaxDeviceState_ ==
+            chrome.networkingPrivate.DeviceStateType.PROHIBITED) {
+          setTechnologiesProhibited_(
+              chrome.networkingPrivate.NetworkType.WI_MAX);
+        } else {
           addEnableNetworkButton_(chrome.networkingPrivate.NetworkType.WI_MAX);
+        }
       } else {
         this.deleteItem('WiMAX');
       }
@@ -1346,6 +1358,24 @@
   }
 
   /**
+   * Replaces a network menu with a button with nothing to do.
+   * @param {!chrome.networkingPrivate.NetworkType} type
+   * @private
+   */
+  function setTechnologiesProhibited_(type) {
+    var subtitle = loadTimeData.getString('networkProhibited');
+    var doNothingButRemoveClickShadow = function() {
+      this.removeAttribute('lead');
+      this.removeAttribute('selected');
+      this.parentNode.removeAttribute('has-element-focus');
+    };
+    $('network-list').update({key: type,
+                              subtitle: subtitle,
+                              iconType: type,
+                              command: doNothingButRemoveClickShadow});
+  }
+
+  /**
    * Element for indicating a policy managed network.
    * @constructor
    * @extends {options.ControlledSettingIndicator}
diff --git a/chrome/browser/resources/settings/clear_browsing_data_page/clear_browsing_data_page.html b/chrome/browser/resources/settings/clear_browsing_data_page/clear_browsing_data_page.html
index 398eb62..9bb75b19 100644
--- a/chrome/browser/resources/settings/clear_browsing_data_page/clear_browsing_data_page.html
+++ b/chrome/browser/resources/settings/clear_browsing_data_page/clear_browsing_data_page.html
@@ -67,6 +67,10 @@
       </settings-checkbox>
     </div>
     <div class="settings-row">
+      <span i18n-content="warnAboutNonClearedData"></span>
+      <span i18n-content="clearsSyncedData"></span>
+    </div>
+    <div class="settings-row">
       <paper-button id="clearDataButton"
           on-tap="onPerformClearBrowsingDataTap_"
           raised i18n-content="clearBrowsingData">
diff --git a/chrome/browser/resources/settings/controls/compiled_resources.gyp b/chrome/browser/resources/settings/controls/compiled_resources.gyp
index 75cbbb5..2f5bc5a 100644
--- a/chrome/browser/resources/settings/controls/compiled_resources.gyp
+++ b/chrome/browser/resources/settings/controls/compiled_resources.gyp
@@ -38,6 +38,8 @@
       'variables': {
         'depends': [
           '../../../../../ui/webui/resources/js/compiled_resources.gyp:assert',
+          '../../../../../ui/webui/resources/js/compiled_resources.gyp:cr',
+          '../prefs/pref_util.js',
         ],
         'externs': [
           '../../../../../third_party/closure_compiler/externs/settings_private.js'
diff --git a/chrome/browser/resources/settings/controls/settings_radio_group.html b/chrome/browser/resources/settings/controls/settings_radio_group.html
index 59214bf..d1697a94 100644
--- a/chrome/browser/resources/settings/controls/settings_radio_group.html
+++ b/chrome/browser/resources/settings/controls/settings_radio_group.html
@@ -1,6 +1,7 @@
 <link rel="import" href="chrome://resources/polymer/v1_0/polymer/polymer.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-radio-group/paper-radio-group.html">
 <link rel="import" href="chrome://resources/polymer/v1_0/paper-radio-button/paper-radio-button.html">
+<link rel="import" href="chrome://md-settings/prefs/pref_util.html">
 
 <dom-module id="settings-radio-group">
   <link rel="import" type="css" href="settings_radio_group.css">
diff --git a/chrome/browser/resources/settings/controls/settings_radio_group.js b/chrome/browser/resources/settings/controls/settings_radio_group.js
index 11c224b..4f36118 100644
--- a/chrome/browser/resources/settings/controls/settings_radio_group.js
+++ b/chrome/browser/resources/settings/controls/settings_radio_group.js
@@ -20,52 +20,38 @@
   properties: {
     /**
      * The preference object to control.
-     * @type {chrome.settingsPrivate.PrefObject|undefined}
+     * @type {!chrome.settingsPrivate.PrefObject|undefined}
      */
     pref: {
       type: Object,
       notify: true,
-      observer: 'prefChanged_'
     },
 
     /**
-     * IronSelectableBehavior selected attribute
+     * IronSelectableBehavior selected attribute.
      */
     selected: {
       type: String,
+      notify: true,
       observer: 'selectedChanged_'
     },
   },
 
+  observers: [
+    'prefChanged_(pref.*)',
+  ],
+
   /** @private */
   prefChanged_: function() {
-    if (!this.pref)
-      return;
-    if (this.pref.type == chrome.settingsPrivate.PrefType.NUMBER ||
-        this.pref.type == chrome.settingsPrivate.PrefType.BOOLEAN) {
-      this.selected = this.pref.value.toString();
-    } else {
-      assert(this.pref.type != chrome.settingsPrivate.PrefType.LIST);
-      this.selected = /** @type {string} */(this.pref.value);
-    }
+    this.selected = Settings.PrefUtil.prefToString(
+        /** @type {!chrome.settingsPrivate.PrefObject} */(this.pref));
   },
 
   /** @private */
-  selectedChanged_: function() {
+  selectedChanged_: function(selected) {
     if (!this.pref)
       return;
-    if (this.pref.type == chrome.settingsPrivate.PrefType.NUMBER) {
-      var n = parseInt(this.selected, 10);
-      if (isNaN(n)) {
-        console.error('Bad selected name for numerical pref: ' + this.selected);
-        return;
-      }
-      this.set('pref.value', n);
-    } else if (this.pref.type == chrome.settingsPrivate.PrefType.BOOLEAN) {
-      this.set('pref.value', this.selected == 'true');
-    } else {
-      assert(this.pref.type != chrome.settingsPrivate.PrefType.LIST);
-      this.set('pref.value', this.selected);
-    }
+    this.set('pref.value',
+             Settings.PrefUtil.stringToPrefValue(selected, this.pref));
   },
 });
diff --git a/chrome/browser/resources/settings/prefs/compiled_resources.gyp b/chrome/browser/resources/settings/prefs/compiled_resources.gyp
index 30642137e..3e15967b 100644
--- a/chrome/browser/resources/settings/prefs/compiled_resources.gyp
+++ b/chrome/browser/resources/settings/prefs/compiled_resources.gyp
@@ -9,6 +9,7 @@
         'depends': [
           '../../../../../ui/webui/resources/js/compiled_resources.gyp:assert',
           '../../../../../ui/webui/resources/js/compiled_resources.gyp:cr',
+          'pref_util.js',
           'prefs_behavior.js',
           'prefs_types.js',
         ],
diff --git a/chrome/browser/resources/settings/prefs/pref_util.html b/chrome/browser/resources/settings/prefs/pref_util.html
new file mode 100644
index 0000000..8ebccbc
--- /dev/null
+++ b/chrome/browser/resources/settings/prefs/pref_util.html
@@ -0,0 +1,2 @@
+<link rel="import" href="chrome://resources/html/cr.html">
+<script src="pref_util.js"></script>
diff --git a/chrome/browser/resources/settings/prefs/pref_util.js b/chrome/browser/resources/settings/prefs/pref_util.js
new file mode 100644
index 0000000..d18395e
--- /dev/null
+++ b/chrome/browser/resources/settings/prefs/pref_util.js
@@ -0,0 +1,57 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/** @fileoverview Utility functions to help use prefs in Polymer controls. */
+
+// TODO(michaelpg): converge with other WebUI on capitalization. This is
+// consistent with Settings, but WebUI uses lower.underscore_case.
+cr.define('Settings.PrefUtil', function() {
+  /**
+   * Converts a string value to a type corresponding to the given preference.
+   * @param {string} value
+   * @param {!chrome.settingsPrivate.PrefObject} pref
+   * @return {boolean|number|string|undefined}
+   */
+  function stringToPrefValue(value, pref) {
+    switch (pref.type) {
+      case chrome.settingsPrivate.PrefType.BOOLEAN:
+        return value == 'true';
+      case chrome.settingsPrivate.PrefType.NUMBER:
+        var n = parseInt(value, 10);
+        if (isNaN(n)) {
+          console.error('Argument to stringToPrefValue for number pref ' +
+                        'was unparsable: ' + value);
+          return undefined;
+        }
+        return n;
+      case chrome.settingsPrivate.PrefType.STRING:
+      case chrome.settingsPrivate.PrefType.URL:
+        return value;
+      default:
+        assertNotReached('No conversion from string to ' + pref.type + ' pref');
+    }
+  }
+
+  /**
+   * Returns the value of the pref as a string.
+   * @param {!chrome.settingsPrivate.PrefObject} pref
+   * @return {string}
+   */
+  function prefToString(pref) {
+    switch (pref.type) {
+      case chrome.settingsPrivate.PrefType.BOOLEAN:
+      case chrome.settingsPrivate.PrefType.NUMBER:
+        return pref.value.toString();
+      case chrome.settingsPrivate.PrefType.STRING:
+      case chrome.settingsPrivate.PrefType.URL:
+        return /** @type {string} */(pref.value);
+      default:
+        assertNotReached('No conversion from ' + pref.type + ' pref to string');
+    }
+  }
+  return {
+    stringToPrefValue: stringToPrefValue,
+    prefToString: prefToString,
+  };
+});
diff --git a/chrome/browser/resources/settings/settings_resources.grd b/chrome/browser/resources/settings/settings_resources.grd
index 4d9c1c3..106137a 100644
--- a/chrome/browser/resources/settings/settings_resources.grd
+++ b/chrome/browser/resources/settings/settings_resources.grd
@@ -304,6 +304,12 @@
       <structure name="IDR_SETTINGS_PASSWORDS_AND_FORMS_PAGE_JS"
                  file="passwords_and_forms_page/passwords_and_forms_page.js"
                  type="chrome_html" />
+      <structure name="IDR_SETTINGS_PREF_UTIL_HTML"
+                 file="prefs/pref_util.html"
+                 type="chrome_html" />
+      <structure name="IDR_SETTINGS_PREF_UTIL_JS"
+                 file="prefs/pref_util.js"
+                 type="chrome_html" />
       <structure name="IDR_SETTINGS_PREFS_HTML"
                  file="prefs/prefs.html"
                  type="chrome_html" />
diff --git a/chrome/browser/sync/chrome_sync_client.cc b/chrome/browser/sync/chrome_sync_client.cc
index 78e18831..7c5e70d2 100644
--- a/chrome/browser/sync/chrome_sync_client.cc
+++ b/chrome/browser/sync/chrome_sync_client.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/sync/chrome_sync_client.h"
 
 #include "base/bind.h"
+#include "base/command_line.h"
 #include "chrome/browser/autofill/personal_data_manager_factory.h"
 #include "chrome/browser/bookmarks/bookmark_model_factory.h"
 #include "chrome/browser/browsing_data/browsing_data_helper.h"
@@ -16,7 +17,9 @@
 #include "chrome/browser/prefs/pref_service_syncable_util.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/search_engines/template_url_service_factory.h"
+#include "chrome/browser/signin/profile_oauth2_token_service_factory.h"
 #include "chrome/browser/sync/glue/sync_start_util.h"
+#include "chrome/browser/sync/glue/theme_data_type_controller.h"
 #include "chrome/browser/sync/profile_sync_service_factory.h"
 #include "chrome/browser/sync/sessions/notification_service_sessions_router.h"
 #include "chrome/browser/themes/theme_service.h"
@@ -25,26 +28,36 @@
 #include "chrome/browser/ui/sync/browser_synced_window_delegates_getter.h"
 #include "chrome/browser/undo/bookmark_undo_service_factory.h"
 #include "chrome/browser/web_data_service_factory.h"
+#include "chrome/common/channel_info.h"
+#include "chrome/common/pref_names.h"
 #include "chrome/common/url_constants.h"
 #include "components/autofill/core/browser/webdata/autocomplete_syncable_service.h"
 #include "components/autofill/core/browser/webdata/autofill_profile_syncable_service.h"
 #include "components/autofill/core/browser/webdata/autofill_wallet_metadata_syncable_service.h"
 #include "components/autofill/core/browser/webdata/autofill_wallet_syncable_service.h"
 #include "components/autofill/core/browser/webdata/autofill_webdata_service.h"
+#include "components/browser_sync/browser/profile_sync_components_factory_impl.h"
 #include "components/browser_sync/browser/profile_sync_service.h"
+#include "components/browser_sync/common/browser_sync_switches.h"
 #include "components/dom_distiller/core/dom_distiller_service.h"
 #include "components/history/core/browser/history_model_worker.h"
 #include "components/history/core/browser/history_service.h"
 #include "components/invalidation/impl/profile_invalidation_provider.h"
 #include "components/password_manager/core/browser/password_store.h"
 #include "components/password_manager/sync/browser/password_model_worker.h"
+#include "components/search_engines/search_engine_data_type_controller.h"
+#include "components/signin/core/browser/profile_oauth2_token_service.h"
 #include "components/sync_driver/glue/browser_thread_model_worker.h"
+#include "components/sync_driver/glue/chrome_report_unrecoverable_error.h"
 #include "components/sync_driver/glue/ui_model_worker.h"
 #include "components/sync_driver/sync_api_component_factory.h"
+#include "components/sync_driver/sync_util.h"
+#include "components/sync_driver/ui_data_type_controller.h"
 #include "components/sync_sessions/sync_sessions_client.h"
 #include "components/syncable_prefs/pref_service_syncable.h"
 #include "content/public/browser/browser_thread.h"
 #include "sync/internal_api/public/engine/passive_model_worker.h"
+#include "ui/base/device_form_factor.h"
 
 #if defined(ENABLE_APP_LIST)
 #include "chrome/browser/ui/app_list/app_list_syncable_service.h"
@@ -87,6 +100,12 @@
 #endif
 
 using content::BrowserThread;
+#if defined(ENABLE_EXTENSIONS)
+using browser_sync::ExtensionDataTypeController;
+using browser_sync::ExtensionSettingDataTypeController;
+#endif
+using browser_sync::SearchEngineDataTypeController;
+using sync_driver::UIDataTypeController;
 
 namespace browser_sync {
 
@@ -151,23 +170,40 @@
   DISALLOW_COPY_AND_ASSIGN(SyncSessionsClientImpl);
 };
 
-ChromeSyncClient::ChromeSyncClient(
-    Profile* profile,
-    scoped_ptr<sync_driver::SyncApiComponentFactory> component_factory)
+ChromeSyncClient::ChromeSyncClient(Profile* profile)
     : profile_(profile),
-      component_factory_(component_factory.Pass()),
       sync_sessions_client_(new SyncSessionsClientImpl(profile)),
-      browsing_data_remover_observer_(NULL) {}
+      browsing_data_remover_observer_(NULL),
+      weak_ptr_factory_(this) {}
 
 ChromeSyncClient::~ChromeSyncClient() {
 }
 
 void ChromeSyncClient::Initialize(sync_driver::SyncService* sync_service) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  // Component factory may already be set in tests.
+  if (!GetSyncApiComponentFactory()) {
+    const GURL sync_service_url = GetSyncServiceURL(
+        *base::CommandLine::ForCurrentProcess(), chrome::GetChannel());
+    ProfileOAuth2TokenService* token_service =
+        ProfileOAuth2TokenServiceFactory::GetForProfile(profile_);
+    net::URLRequestContextGetter* url_request_context_getter =
+        profile_->GetRequestContext();
+
+    component_factory_.reset(new ProfileSyncComponentsFactoryImpl(
+        this, chrome::GetChannel(), chrome::GetVersionString(),
+        ui::GetDeviceFormFactor() == ui::DEVICE_FORM_FACTOR_TABLET,
+        *base::CommandLine::ForCurrentProcess(),
+        prefs::kSavingBrowserHistoryDisabled, sync_service_url,
+        content::BrowserThread::GetMessageLoopProxyForThread(
+            content::BrowserThread::UI),
+        content::BrowserThread::GetMessageLoopProxyForThread(
+            content::BrowserThread::DB),
+        token_service, url_request_context_getter));
+  }
   sync_service_ = sync_service;
   web_data_service_ = GetWebDataService();
   password_store_ = GetPasswordStore();
-  component_factory_->RegisterDataTypes(this);
 }
 
 sync_driver::SyncService* ChromeSyncClient::GetSyncService() {
@@ -223,6 +259,17 @@
       base::Unretained(profile_));
 }
 
+sync_driver::SyncApiComponentFactory::RegisterDataTypesMethod
+ChromeSyncClient::GetRegisterPlatformTypesCallback() {
+  return base::Bind(
+#ifdef OS_ANDROID
+      &ChromeSyncClient::RegisterAndroidDataTypes,
+#else
+      &ChromeSyncClient::RegisterDesktopDataTypes,
+#endif  // OS_ANDROID
+      weak_ptr_factory_.GetWeakPtr());
+}
+
 scoped_refptr<autofill::AutofillWebDataService>
 ChromeSyncClient::GetWebDataService() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -441,4 +488,132 @@
   browsing_data_remover_observer_ = observer;
 }
 
+void ChromeSyncClient::SetSyncApiComponentFactoryForTesting(
+    scoped_ptr<sync_driver::SyncApiComponentFactory> component_factory) {
+  component_factory_ = component_factory.Pass();
+}
+
+void ChromeSyncClient::RegisterDesktopDataTypes(
+    syncer::ModelTypeSet disabled_types,
+    syncer::ModelTypeSet enabled_types) {
+  sync_driver::SyncService* sync_service = GetSyncService();
+  base::Closure error_callback =
+      base::Bind(&ChromeReportUnrecoverableError, chrome::GetChannel());
+  const scoped_refptr<base::SingleThreadTaskRunner> ui_thread =
+      BrowserThread::GetMessageLoopProxyForThread(BrowserThread::UI);
+
+#if defined(ENABLE_EXTENSIONS)
+  // App sync is enabled by default.  Register unless explicitly
+  // disabled.
+  if (!disabled_types.Has(syncer::APPS)) {
+    sync_service->RegisterDataTypeController(new ExtensionDataTypeController(
+        syncer::APPS, error_callback, this, profile_));
+  }
+
+  // Extension sync is enabled by default.  Register unless explicitly
+  // disabled.
+  if (!disabled_types.Has(syncer::EXTENSIONS)) {
+    sync_service->RegisterDataTypeController(new ExtensionDataTypeController(
+        syncer::EXTENSIONS, error_callback, this, profile_));
+  }
+#endif
+
+  // Preference sync is enabled by default.  Register unless explicitly
+  // disabled.
+  if (!disabled_types.Has(syncer::PREFERENCES)) {
+    sync_service->RegisterDataTypeController(new UIDataTypeController(
+        ui_thread, error_callback, syncer::PREFERENCES, this));
+  }
+
+#if defined(ENABLE_THEMES)
+  // Theme sync is enabled by default.  Register unless explicitly disabled.
+  if (!disabled_types.Has(syncer::THEMES)) {
+    sync_service->RegisterDataTypeController(
+        new ThemeDataTypeController(error_callback, this, profile_));
+  }
+#endif
+
+  // Search Engine sync is enabled by default.  Register unless explicitly
+  // disabled.
+  if (!disabled_types.Has(syncer::SEARCH_ENGINES)) {
+    sync_service->RegisterDataTypeController(new SearchEngineDataTypeController(
+        ui_thread, error_callback, this,
+        TemplateURLServiceFactory::GetForProfile(profile_)));
+  }
+
+#if defined(ENABLE_EXTENSIONS)
+  // Extension setting sync is enabled by default.  Register unless explicitly
+  // disabled.
+  if (!disabled_types.Has(syncer::EXTENSION_SETTINGS)) {
+    sync_service->RegisterDataTypeController(
+        new ExtensionSettingDataTypeController(syncer::EXTENSION_SETTINGS,
+                                               error_callback, this, profile_));
+  }
+
+  // App setting sync is enabled by default.  Register unless explicitly
+  // disabled.
+  if (!disabled_types.Has(syncer::APP_SETTINGS)) {
+    sync_service->RegisterDataTypeController(
+        new ExtensionSettingDataTypeController(syncer::APP_SETTINGS,
+                                               error_callback, this, profile_));
+  }
+#endif
+
+#if defined(ENABLE_APP_LIST)
+  if (app_list::switches::IsAppListSyncEnabled()) {
+    sync_service->RegisterDataTypeController(new UIDataTypeController(
+        ui_thread, error_callback, syncer::APP_LIST, this));
+  }
+#endif
+
+#if defined(OS_LINUX) || defined(OS_WIN) || defined(OS_CHROMEOS)
+  // Dictionary sync is enabled by default.
+  if (!disabled_types.Has(syncer::DICTIONARY)) {
+    sync_service->RegisterDataTypeController(new UIDataTypeController(
+        ui_thread, error_callback, syncer::DICTIONARY, this));
+  }
+#endif
+
+#if defined(ENABLE_SUPERVISED_USERS)
+  sync_service->RegisterDataTypeController(
+      new SupervisedUserSyncDataTypeController(syncer::SUPERVISED_USER_SETTINGS,
+                                               error_callback, this, profile_));
+  sync_service->RegisterDataTypeController(
+      new SupervisedUserSyncDataTypeController(
+          syncer::SUPERVISED_USER_WHITELISTS, error_callback, this, profile_));
+  sync_service->RegisterDataTypeController(
+      new SupervisedUserSyncDataTypeController(syncer::SUPERVISED_USERS,
+                                               error_callback, this, profile_));
+  sync_service->RegisterDataTypeController(
+      new SupervisedUserSyncDataTypeController(
+          syncer::SUPERVISED_USER_SHARED_SETTINGS, error_callback, this,
+          profile_));
+#endif
+
+#if defined(OS_CHROMEOS)
+  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableWifiCredentialSync) &&
+      !disabled_types.Has(syncer::WIFI_CREDENTIALS)) {
+    sync_service->RegisterDataTypeController(new UIDataTypeController(
+        ui_thread, error_callback, syncer::WIFI_CREDENTIALS, this));
+  }
+#endif
+}
+
+void ChromeSyncClient::RegisterAndroidDataTypes(
+    syncer::ModelTypeSet disabled_types,
+    syncer::ModelTypeSet enabled_types) {
+  sync_driver::SyncService* sync_service = GetSyncService();
+  base::Closure error_callback =
+      base::Bind(&ChromeReportUnrecoverableError, chrome::GetChannel());
+#if defined(ENABLE_SUPERVISED_USERS)
+  sync_service->RegisterDataTypeController(
+      new SupervisedUserSyncDataTypeController(syncer::SUPERVISED_USER_SETTINGS,
+                                               error_callback, this, profile_));
+  sync_service->RegisterDataTypeController(
+      new SupervisedUserSyncDataTypeController(
+          syncer::SUPERVISED_USER_WHITELISTS, error_callback, this, profile_));
+#endif
+}
+
 }  // namespace browser_sync
diff --git a/chrome/browser/sync/chrome_sync_client.h b/chrome/browser/sync/chrome_sync_client.h
index 7d16e8a..f43249e 100644
--- a/chrome/browser/sync/chrome_sync_client.h
+++ b/chrome/browser/sync/chrome_sync_client.h
@@ -21,9 +21,7 @@
 
 class ChromeSyncClient : public sync_driver::SyncClient {
  public:
-  ChromeSyncClient(
-      Profile* profile,
-      scoped_ptr<sync_driver::SyncApiComponentFactory> component_factory);
+  explicit ChromeSyncClient(Profile* profile);
   ~ChromeSyncClient() override;
 
   // SyncClient implementation.
@@ -37,6 +35,8 @@
   sync_driver::ClearBrowsingDataCallback GetClearBrowsingDataCallback()
       override;
   base::Closure GetPasswordStateChangedCallback() override;
+  sync_driver::SyncApiComponentFactory::RegisterDataTypesMethod
+  GetRegisterPlatformTypesCallback() override;
   autofill::PersonalDataManager* GetPersonalDataManager() override;
   invalidation::InvalidationService* GetInvalidationService() override;
   scoped_refptr<autofill::AutofillWebDataService> GetWebDataService() override;
@@ -50,15 +50,29 @@
       syncer::WorkerLoopDestructionObserver* observer) override;
   sync_driver::SyncApiComponentFactory* GetSyncApiComponentFactory() override;
 
-  // Helper for testing rollback.
+  // Helpers for overriding getters in tests.
   void SetBrowsingDataRemoverObserverForTesting(
       BrowsingDataRemover::Observer* observer);
+  void SetSyncApiComponentFactoryForTesting(
+      scoped_ptr<sync_driver::SyncApiComponentFactory> component_factory);
 
  private:
-  Profile* const profile_;
+  // Register data types which are enabled on desktop platforms only.
+  // |disabled_types| and |enabled_types| correspond only to those types
+  // being explicitly disabled/enabled by the command line.
+  void RegisterDesktopDataTypes(syncer::ModelTypeSet disabled_types,
+                                syncer::ModelTypeSet enabled_types);
+
+  // Register data types which are enabled on Android platforms only.
+  // |disabled_types| and |enabled_types| correspond only to those types
+  // being explicitly disabled/enabled by the command line.
+  void RegisterAndroidDataTypes(syncer::ModelTypeSet disabled_types,
+                                syncer::ModelTypeSet enabled_types);
 
   void ClearBrowsingData(base::Time start, base::Time end);
 
+  Profile* const profile_;
+
   // The sync api component factory in use by this client.
   scoped_ptr<sync_driver::SyncApiComponentFactory> component_factory_;
 
@@ -81,6 +95,8 @@
   // Used in integration tests.
   BrowsingDataRemover::Observer* browsing_data_remover_observer_;
 
+  base::WeakPtrFactory<ChromeSyncClient> weak_ptr_factory_;
+
   DISALLOW_COPY_AND_ASSIGN(ChromeSyncClient);
 };
 
diff --git a/chrome/browser/sync/profile_sync_components_factory_impl.cc b/chrome/browser/sync/profile_sync_components_factory_impl.cc
deleted file mode 100644
index a482550c..0000000
--- a/chrome/browser/sync/profile_sync_components_factory_impl.cc
+++ /dev/null
@@ -1,554 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/browser/sync/profile_sync_components_factory_impl.h"
-
-#include "base/command_line.h"
-#include "base/memory/ref_counted.h"
-#include "base/prefs/pref_service.h"
-#include "build/build_config.h"
-#include "chrome/browser/bookmarks/bookmark_model_factory.h"
-#include "chrome/browser/profiles/profile.h"
-#include "chrome/browser/search_engines/template_url_service_factory.h"
-#include "chrome/browser/sync/glue/theme_data_type_controller.h"
-#include "chrome/common/channel_info.h"
-#include "chrome/common/chrome_switches.h"
-#include "chrome/common/pref_names.h"
-#include "components/autofill/core/browser/autofill_wallet_data_type_controller.h"
-#include "components/autofill/core/browser/webdata/autofill_data_type_controller.h"
-#include "components/autofill/core/browser/webdata/autofill_profile_data_type_controller.h"
-#include "components/autofill/core/common/autofill_pref_names.h"
-#include "components/autofill/core/common/autofill_switches.h"
-#include "components/browser_sync/browser/profile_sync_service.h"
-#include "components/browser_sync/common/browser_sync_switches.h"
-#include "components/dom_distiller/core/dom_distiller_features.h"
-#include "components/history/core/browser/history_delete_directives_data_type_controller.h"
-#include "components/history/core/browser/typed_url_change_processor.h"
-#include "components/history/core/browser/typed_url_data_type_controller.h"
-#include "components/history/core/browser/typed_url_model_associator.h"
-#include "components/password_manager/sync/browser/password_data_type_controller.h"
-#include "components/search_engines/search_engine_data_type_controller.h"
-#include "components/sync_bookmarks/bookmark_change_processor.h"
-#include "components/sync_bookmarks/bookmark_data_type_controller.h"
-#include "components/sync_bookmarks/bookmark_model_associator.h"
-#include "components/sync_driver/data_type_manager_impl.h"
-#include "components/sync_driver/device_info_data_type_controller.h"
-#include "components/sync_driver/glue/chrome_report_unrecoverable_error.h"
-#include "components/sync_driver/glue/sync_backend_host.h"
-#include "components/sync_driver/glue/sync_backend_host_impl.h"
-#include "components/sync_driver/local_device_info_provider_impl.h"
-#include "components/sync_driver/proxy_data_type_controller.h"
-#include "components/sync_driver/sync_client.h"
-#include "components/sync_driver/ui_data_type_controller.h"
-#include "components/sync_sessions/session_data_type_controller.h"
-#include "content/public/browser/browser_thread.h"
-#include "google_apis/gaia/oauth2_token_service.h"
-#include "google_apis/gaia/oauth2_token_service_request.h"
-#include "net/url_request/url_request_context_getter.h"
-#include "sync/internal_api/public/attachments/attachment_downloader.h"
-#include "sync/internal_api/public/attachments/attachment_service.h"
-#include "sync/internal_api/public/attachments/attachment_service_impl.h"
-#include "sync/internal_api/public/attachments/attachment_uploader_impl.h"
-#include "ui/base/device_form_factor.h"
-
-#if defined(ENABLE_APP_LIST)
-#include "ui/app_list/app_list_switches.h"
-#endif
-
-#if defined(ENABLE_EXTENSIONS)
-#include "chrome/browser/sync/glue/extension_data_type_controller.h"
-#include "chrome/browser/sync/glue/extension_setting_data_type_controller.h"
-#endif
-
-#if defined(ENABLE_SUPERVISED_USERS)
-#include "chrome/browser/supervised_user/supervised_user_sync_data_type_controller.h"
-#endif
-
-using bookmarks::BookmarkModel;
-using browser_sync::AutofillDataTypeController;
-using browser_sync::AutofillProfileDataTypeController;
-using browser_sync::BookmarkChangeProcessor;
-using browser_sync::BookmarkDataTypeController;
-using browser_sync::BookmarkModelAssociator;
-using browser_sync::ChromeReportUnrecoverableError;
-#if defined(ENABLE_EXTENSIONS)
-using browser_sync::ExtensionDataTypeController;
-using browser_sync::ExtensionSettingDataTypeController;
-#endif
-using browser_sync::HistoryDeleteDirectivesDataTypeController;
-using browser_sync::PasswordDataTypeController;
-using browser_sync::SearchEngineDataTypeController;
-using browser_sync::SessionDataTypeController;
-using browser_sync::SyncBackendHost;
-using browser_sync::ThemeDataTypeController;
-using browser_sync::TypedUrlChangeProcessor;
-using browser_sync::TypedUrlDataTypeController;
-using browser_sync::TypedUrlModelAssociator;
-using content::BrowserThread;
-using sync_driver::DataTypeController;
-using sync_driver::DataTypeErrorHandler;
-using sync_driver::DataTypeManager;
-using sync_driver::DataTypeManagerImpl;
-using sync_driver::DataTypeManagerObserver;
-using sync_driver::DeviceInfoDataTypeController;
-using sync_driver::ProxyDataTypeController;
-using sync_driver::UIDataTypeController;
-
-namespace {
-
-syncer::ModelTypeSet GetDisabledTypesFromCommandLine(
-    const base::CommandLine& command_line) {
-  syncer::ModelTypeSet disabled_types;
-  std::string disabled_types_str =
-      command_line.GetSwitchValueASCII(switches::kDisableSyncTypes);
-
-  disabled_types = syncer::ModelTypeSetFromString(disabled_types_str);
-  return disabled_types;
-}
-
-syncer::ModelTypeSet GetEnabledTypesFromCommandLine(
-    const base::CommandLine& command_line) {
-  syncer::ModelTypeSet enabled_types;
-  if (command_line.HasSwitch(autofill::switches::kEnableWalletMetadataSync))
-    enabled_types.Put(syncer::AUTOFILL_WALLET_METADATA);
-
-  return enabled_types;
-}
-
-}  // namespace
-
-ProfileSyncComponentsFactoryImpl::ProfileSyncComponentsFactoryImpl(
-    Profile* profile,
-    base::CommandLine* command_line,
-    const GURL& sync_service_url,
-    OAuth2TokenService* token_service,
-    net::URLRequestContextGetter* url_request_context_getter)
-    : profile_(profile),
-      command_line_(command_line),
-      sync_service_url_(sync_service_url),
-      token_service_(token_service),
-      url_request_context_getter_(url_request_context_getter),
-      weak_factory_(this) {
-  DCHECK(token_service_);
-  DCHECK(url_request_context_getter_);
-}
-
-ProfileSyncComponentsFactoryImpl::~ProfileSyncComponentsFactoryImpl() {
-}
-
-void ProfileSyncComponentsFactoryImpl::RegisterDataTypes(
-    sync_driver::SyncClient* sync_client) {
-  syncer::ModelTypeSet disabled_types =
-      GetDisabledTypesFromCommandLine(*command_line_);
-  syncer::ModelTypeSet enabled_types =
-      GetEnabledTypesFromCommandLine(*command_line_);
-  RegisterCommonDataTypes(disabled_types, enabled_types, sync_client);
-#if !defined(OS_ANDROID)
-  RegisterDesktopDataTypes(disabled_types, enabled_types, sync_client);
-#endif
-}
-
-void ProfileSyncComponentsFactoryImpl::RegisterCommonDataTypes(
-    syncer::ModelTypeSet disabled_types,
-    syncer::ModelTypeSet enabled_types,
-    sync_driver::SyncClient* sync_client) {
-  sync_driver::SyncService* sync_service = sync_client->GetSyncService();
-  base::Closure error_callback =
-      base::Bind(&ChromeReportUnrecoverableError, chrome::GetChannel());
-  const scoped_refptr<base::SingleThreadTaskRunner> ui_thread =
-      BrowserThread::GetMessageLoopProxyForThread(BrowserThread::UI);
-  const scoped_refptr<base::SingleThreadTaskRunner> db_thread =
-      BrowserThread::GetMessageLoopProxyForThread(BrowserThread::DB);
-
-  // TODO(stanisc): can DEVICE_INFO be one of disabled datatypes?
-  sync_service->RegisterDataTypeController(new DeviceInfoDataTypeController(
-      ui_thread, error_callback, sync_client,
-      sync_service->GetLocalDeviceInfoProvider()));
-
-  // Autofill sync is enabled by default.  Register unless explicitly
-  // disabled.
-  if (!disabled_types.Has(syncer::AUTOFILL)) {
-    sync_service->RegisterDataTypeController(new AutofillDataTypeController(
-        ui_thread, db_thread, error_callback, sync_client));
-  }
-
-  // Autofill profile sync is enabled by default.  Register unless explicitly
-  // disabled.
-  if (!disabled_types.Has(syncer::AUTOFILL_PROFILE)) {
-    sync_service->RegisterDataTypeController(
-        new AutofillProfileDataTypeController(ui_thread, db_thread,
-                                              error_callback, sync_client));
-  }
-
-  // Wallet data sync is enabled by default, but behind a syncer experiment
-  // enforced by the datatype controller. Register unless explicitly disabled.
-  bool wallet_disabled = disabled_types.Has(syncer::AUTOFILL_WALLET_DATA);
-  if (!wallet_disabled) {
-    sync_service->RegisterDataTypeController(
-        new browser_sync::AutofillWalletDataTypeController(
-            ui_thread, db_thread, error_callback, sync_client,
-            syncer::AUTOFILL_WALLET_DATA));
-  }
-
-  // Wallet metadata sync depends on Wallet data sync and is disabled by
-  // default. Register if Wallet data is syncing and metadata sync is explicitly
-  // enabled.
-  if (!wallet_disabled && enabled_types.Has(syncer::AUTOFILL_WALLET_METADATA)) {
-    sync_service->RegisterDataTypeController(
-        new browser_sync::AutofillWalletDataTypeController(
-            ui_thread, db_thread, error_callback, sync_client,
-            syncer::AUTOFILL_WALLET_METADATA));
-  }
-
-  // Bookmark sync is enabled by default.  Register unless explicitly
-  // disabled.
-  if (!disabled_types.Has(syncer::BOOKMARKS)) {
-    sync_service->RegisterDataTypeController(
-        new BookmarkDataTypeController(ui_thread, error_callback, sync_client));
-  }
-
-  const bool history_disabled =
-      profile_->GetPrefs()->GetBoolean(prefs::kSavingBrowserHistoryDisabled);
-  // TypedUrl sync is enabled by default.  Register unless explicitly disabled,
-  // or if saving history is disabled.
-  if (!disabled_types.Has(syncer::TYPED_URLS) && !history_disabled) {
-    sync_service->RegisterDataTypeController(
-        new TypedUrlDataTypeController(ui_thread, error_callback, sync_client,
-                                       prefs::kSavingBrowserHistoryDisabled));
-  }
-
-  // Delete directive sync is enabled by default.  Register unless full history
-  // sync is disabled.
-  if (!disabled_types.Has(syncer::HISTORY_DELETE_DIRECTIVES) &&
-      !history_disabled) {
-    sync_service->RegisterDataTypeController(
-        new HistoryDeleteDirectivesDataTypeController(ui_thread, error_callback,
-                                                      sync_client));
-  }
-
-  // Session sync is enabled by default.  Register unless explicitly disabled.
-  // This is also disabled if the browser history is disabled, because the
-  // tab sync data is added to the web history on the server.
-  if (!disabled_types.Has(syncer::PROXY_TABS) && !history_disabled) {
-    sync_service->RegisterDataTypeController(
-        new ProxyDataTypeController(ui_thread, syncer::PROXY_TABS));
-    // TODO(zea): remove this once SyncedWindowDelegateGetter is componentized.
-    // For now, we know that the implementation of SyncService is always a
-    // ProfileSyncService at this level.
-    ProfileSyncService* pss = static_cast<ProfileSyncService*>(sync_service);
-    sync_service->RegisterDataTypeController(new SessionDataTypeController(
-        ui_thread, error_callback, sync_client,
-        pss->GetSyncedWindowDelegatesGetter(),
-        sync_service->GetLocalDeviceInfoProvider(),
-        prefs::kSavingBrowserHistoryDisabled));
-  }
-
-  // Favicon sync is enabled by default. Register unless explicitly disabled.
-  if (!disabled_types.Has(syncer::FAVICON_IMAGES) &&
-      !disabled_types.Has(syncer::FAVICON_TRACKING) &&
-      !history_disabled) {
-    // crbug/384552. We disable error uploading for this data types for now.
-    sync_service->RegisterDataTypeController(new UIDataTypeController(
-        ui_thread, base::Closure(), syncer::FAVICON_IMAGES, sync_client));
-    sync_service->RegisterDataTypeController(new UIDataTypeController(
-        ui_thread, base::Closure(), syncer::FAVICON_TRACKING, sync_client));
-  }
-
-  // Password sync is enabled by default.  Register unless explicitly
-  // disabled.
-  if (!disabled_types.Has(syncer::PASSWORDS)) {
-    sync_service->RegisterDataTypeController(new PasswordDataTypeController(
-        ui_thread, error_callback, sync_client,
-        sync_client->GetPasswordStateChangedCallback()));
-  }
-
-  if (!disabled_types.Has(syncer::PRIORITY_PREFERENCES)) {
-    sync_service->RegisterDataTypeController(new UIDataTypeController(
-        ui_thread, error_callback, syncer::PRIORITY_PREFERENCES, sync_client));
-  }
-
-  // Article sync is disabled by default.  Register only if explicitly enabled.
-  if (dom_distiller::IsEnableSyncArticlesSet()) {
-    sync_service->RegisterDataTypeController(new UIDataTypeController(
-        ui_thread, error_callback, syncer::ARTICLES, sync_client));
-  }
-
-#if defined(ENABLE_SUPERVISED_USERS)
-  sync_service->RegisterDataTypeController(
-      new SupervisedUserSyncDataTypeController(syncer::SUPERVISED_USER_SETTINGS,
-                                               error_callback, sync_client,
-                                               profile_));
-  sync_service->RegisterDataTypeController(
-      new SupervisedUserSyncDataTypeController(
-          syncer::SUPERVISED_USER_WHITELISTS, error_callback, sync_client,
-          profile_));
-#endif
-}
-
-void ProfileSyncComponentsFactoryImpl::RegisterDesktopDataTypes(
-    syncer::ModelTypeSet disabled_types,
-    syncer::ModelTypeSet enabled_types,
-    sync_driver::SyncClient* sync_client) {
-  sync_driver::SyncService* sync_service = sync_client->GetSyncService();
-  base::Closure error_callback =
-      base::Bind(&ChromeReportUnrecoverableError, chrome::GetChannel());
-  const scoped_refptr<base::SingleThreadTaskRunner> ui_thread =
-      BrowserThread::GetMessageLoopProxyForThread(BrowserThread::UI);
-
-#if defined(ENABLE_EXTENSIONS)
-  // App sync is enabled by default.  Register unless explicitly
-  // disabled.
-  if (!disabled_types.Has(syncer::APPS)) {
-    sync_service->RegisterDataTypeController(new ExtensionDataTypeController(
-        syncer::APPS, error_callback, sync_client, profile_));
-  }
-
-  // Extension sync is enabled by default.  Register unless explicitly
-  // disabled.
-  if (!disabled_types.Has(syncer::EXTENSIONS)) {
-    sync_service->RegisterDataTypeController(new ExtensionDataTypeController(
-        syncer::EXTENSIONS, error_callback, sync_client, profile_));
-  }
-#endif
-
-  // Preference sync is enabled by default.  Register unless explicitly
-  // disabled.
-  if (!disabled_types.Has(syncer::PREFERENCES)) {
-    sync_service->RegisterDataTypeController(new UIDataTypeController(
-        ui_thread, error_callback, syncer::PREFERENCES, sync_client));
-  }
-
-#if defined(ENABLE_THEMES)
-  // Theme sync is enabled by default.  Register unless explicitly disabled.
-  if (!disabled_types.Has(syncer::THEMES)) {
-    sync_service->RegisterDataTypeController(
-        new ThemeDataTypeController(error_callback, sync_client, profile_));
-  }
-#endif
-
-  // Search Engine sync is enabled by default.  Register unless explicitly
-  // disabled.
-  if (!disabled_types.Has(syncer::SEARCH_ENGINES)) {
-    sync_service->RegisterDataTypeController(new SearchEngineDataTypeController(
-        ui_thread, error_callback, sync_client,
-        TemplateURLServiceFactory::GetForProfile(profile_)));
-  }
-
-#if defined(ENABLE_EXTENSIONS)
-  // Extension setting sync is enabled by default.  Register unless explicitly
-  // disabled.
-  if (!disabled_types.Has(syncer::EXTENSION_SETTINGS)) {
-    sync_service->RegisterDataTypeController(
-        new ExtensionSettingDataTypeController(
-            syncer::EXTENSION_SETTINGS, error_callback, sync_client, profile_));
-  }
-
-  // App setting sync is enabled by default.  Register unless explicitly
-  // disabled.
-  if (!disabled_types.Has(syncer::APP_SETTINGS)) {
-    sync_service->RegisterDataTypeController(
-        new ExtensionSettingDataTypeController(
-            syncer::APP_SETTINGS, error_callback, sync_client, profile_));
-  }
-#endif
-
-#if defined(ENABLE_APP_LIST)
-  if (app_list::switches::IsAppListSyncEnabled()) {
-    sync_service->RegisterDataTypeController(new UIDataTypeController(
-        ui_thread, error_callback, syncer::APP_LIST, sync_client));
-  }
-#endif
-
-#if defined(OS_LINUX) || defined(OS_WIN) || defined(OS_CHROMEOS)
-  // Dictionary sync is enabled by default.
-  if (!disabled_types.Has(syncer::DICTIONARY)) {
-    sync_service->RegisterDataTypeController(new UIDataTypeController(
-        ui_thread, error_callback, syncer::DICTIONARY, sync_client));
-  }
-#endif
-
-#if defined(ENABLE_SUPERVISED_USERS)
-  sync_service->RegisterDataTypeController(
-      new SupervisedUserSyncDataTypeController(
-          syncer::SUPERVISED_USERS, error_callback, sync_client, profile_));
-  sync_service->RegisterDataTypeController(
-      new SupervisedUserSyncDataTypeController(
-          syncer::SUPERVISED_USER_SHARED_SETTINGS, error_callback, sync_client,
-          profile_));
-#endif
-
-#if defined(OS_CHROMEOS)
-  if (command_line_->HasSwitch(switches::kEnableWifiCredentialSync) &&
-      !disabled_types.Has(syncer::WIFI_CREDENTIALS)) {
-    sync_service->RegisterDataTypeController(new UIDataTypeController(
-        ui_thread, error_callback, syncer::WIFI_CREDENTIALS, sync_client));
-  }
-#endif
-}
-
-DataTypeManager* ProfileSyncComponentsFactoryImpl::CreateDataTypeManager(
-    const syncer::WeakHandle<syncer::DataTypeDebugInfoListener>&
-        debug_info_listener,
-    const DataTypeController::TypeMap* controllers,
-    const sync_driver::DataTypeEncryptionHandler* encryption_handler,
-    SyncBackendHost* backend,
-    DataTypeManagerObserver* observer) {
-  return new DataTypeManagerImpl(debug_info_listener, controllers,
-                                 encryption_handler, backend, observer);
-}
-
-browser_sync::SyncBackendHost*
-ProfileSyncComponentsFactoryImpl::CreateSyncBackendHost(
-    const std::string& name,
-    sync_driver::SyncClient* sync_client,
-    invalidation::InvalidationService* invalidator,
-    const base::WeakPtr<sync_driver::SyncPrefs>& sync_prefs,
-    const base::FilePath& sync_folder) {
-  return new browser_sync::SyncBackendHostImpl(
-      name, sync_client,
-      BrowserThread::GetMessageLoopProxyForThread(BrowserThread::UI),
-      invalidator, sync_prefs, sync_folder);
-}
-
-scoped_ptr<sync_driver::LocalDeviceInfoProvider>
-ProfileSyncComponentsFactoryImpl::CreateLocalDeviceInfoProvider() {
-  return scoped_ptr<sync_driver::LocalDeviceInfoProvider>(
-      new browser_sync::LocalDeviceInfoProviderImpl(
-          chrome::GetChannel(),
-          chrome::GetVersionString(),
-          ui::GetDeviceFormFactor() == ui::DEVICE_FORM_FACTOR_TABLET));
-}
-
-class TokenServiceProvider
-    : public OAuth2TokenServiceRequest::TokenServiceProvider {
- public:
-  TokenServiceProvider(
-      const scoped_refptr<base::SingleThreadTaskRunner>& task_runner,
-      OAuth2TokenService* token_service);
-
-  // OAuth2TokenServiceRequest::TokenServiceProvider implementation.
-  scoped_refptr<base::SingleThreadTaskRunner> GetTokenServiceTaskRunner()
-      override;
-  OAuth2TokenService* GetTokenService() override;
-
- private:
-  ~TokenServiceProvider() override;
-
-  scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
-  OAuth2TokenService* token_service_;
-};
-
-TokenServiceProvider::TokenServiceProvider(
-    const scoped_refptr<base::SingleThreadTaskRunner>& task_runner,
-    OAuth2TokenService* token_service)
-    : task_runner_(task_runner), token_service_(token_service) {
-}
-
-TokenServiceProvider::~TokenServiceProvider() {
-}
-
-scoped_refptr<base::SingleThreadTaskRunner>
-TokenServiceProvider::GetTokenServiceTaskRunner() {
-  return task_runner_;
-}
-
-OAuth2TokenService* TokenServiceProvider::GetTokenService() {
-  return token_service_;
-}
-
-scoped_ptr<syncer::AttachmentService>
-ProfileSyncComponentsFactoryImpl::CreateAttachmentService(
-    scoped_ptr<syncer::AttachmentStoreForSync> attachment_store,
-    const syncer::UserShare& user_share,
-    const std::string& store_birthday,
-    syncer::ModelType model_type,
-    syncer::AttachmentService::Delegate* delegate) {
-  scoped_ptr<syncer::AttachmentUploader> attachment_uploader;
-  scoped_ptr<syncer::AttachmentDownloader> attachment_downloader;
-  // Only construct an AttachmentUploader and AttachmentDownload if we have sync
-  // credentials. We may not have sync credentials because there may not be a
-  // signed in sync user (e.g. sync is running in "backup" mode).
-  if (!user_share.sync_credentials.email.empty() &&
-      !user_share.sync_credentials.scope_set.empty()) {
-    const scoped_refptr<base::SingleThreadTaskRunner> ui_thread =
-        BrowserThread::GetMessageLoopProxyForThread(BrowserThread::UI);
-
-    scoped_refptr<OAuth2TokenServiceRequest::TokenServiceProvider>
-        token_service_provider(
-            new TokenServiceProvider(ui_thread, token_service_));
-    // TODO(maniscalco): Use shared (one per profile) thread-safe instances of
-    // AttachmentUploader and AttachmentDownloader instead of creating a new one
-    // per AttachmentService (bug 369536).
-    attachment_uploader.reset(new syncer::AttachmentUploaderImpl(
-        sync_service_url_, url_request_context_getter_,
-        user_share.sync_credentials.email,
-        user_share.sync_credentials.scope_set, token_service_provider,
-        store_birthday, model_type));
-
-    token_service_provider =
-        new TokenServiceProvider(ui_thread, token_service_);
-    attachment_downloader = syncer::AttachmentDownloader::Create(
-        sync_service_url_, url_request_context_getter_,
-        user_share.sync_credentials.email,
-        user_share.sync_credentials.scope_set, token_service_provider,
-        store_birthday, model_type);
-  }
-
-  // It is important that the initial backoff delay is relatively large.  For
-  // whatever reason, the server may fail all requests for a short period of
-  // time.  When this happens we don't want to overwhelm the server with
-  // requests so we use a large initial backoff.
-  const base::TimeDelta initial_backoff_delay =
-      base::TimeDelta::FromMinutes(30);
-  const base::TimeDelta max_backoff_delay = base::TimeDelta::FromHours(4);
-  scoped_ptr<syncer::AttachmentService> attachment_service(
-      new syncer::AttachmentServiceImpl(
-          attachment_store.Pass(), attachment_uploader.Pass(),
-          attachment_downloader.Pass(), delegate, initial_backoff_delay,
-          max_backoff_delay));
-  return attachment_service.Pass();
-}
-
-sync_driver::SyncApiComponentFactory::SyncComponents
-    ProfileSyncComponentsFactoryImpl::CreateBookmarkSyncComponents(
-        sync_driver::SyncService* sync_service,
-        sync_driver::DataTypeErrorHandler* error_handler) {
-  BookmarkModel* bookmark_model =
-      BookmarkModelFactory::GetForProfile(profile_);
-  syncer::UserShare* user_share = sync_service->GetUserShare();
-  // TODO(akalin): We may want to propagate this switch up eventually.
-#if defined(OS_ANDROID)
-  const bool kExpectMobileBookmarksFolder = true;
-#else
-  const bool kExpectMobileBookmarksFolder = false;
-#endif
-  BookmarkModelAssociator* model_associator = new BookmarkModelAssociator(
-      bookmark_model, sync_service->GetSyncClient(), user_share, error_handler,
-      kExpectMobileBookmarksFolder);
-  BookmarkChangeProcessor* change_processor = new BookmarkChangeProcessor(
-      sync_service->GetSyncClient(), model_associator, error_handler);
-  return SyncComponents(model_associator, change_processor);
-}
-
-sync_driver::SyncApiComponentFactory::SyncComponents
-    ProfileSyncComponentsFactoryImpl::CreateTypedUrlSyncComponents(
-        sync_driver::SyncService* sync_service,
-        history::HistoryBackend* history_backend,
-        sync_driver::DataTypeErrorHandler* error_handler) {
-  DCHECK(!BrowserThread::CurrentlyOn(BrowserThread::UI));
-
-  const scoped_refptr<base::SingleThreadTaskRunner> ui_thread =
-      BrowserThread::GetMessageLoopProxyForThread(BrowserThread::UI);
-
-  // TODO(zea): Once TypedURLs are converted to SyncableService, remove
-  // |sync_service_| member, and make GetSyncService require it be called on
-  // the UI thread.
-  TypedUrlModelAssociator* model_associator =
-      new TypedUrlModelAssociator(sync_service,
-                                  history_backend,
-                                  error_handler);
-  TypedUrlChangeProcessor* change_processor = new TypedUrlChangeProcessor(
-      model_associator, history_backend, error_handler, ui_thread);
-  return SyncComponents(model_associator, change_processor);
-}
diff --git a/chrome/browser/sync/profile_sync_components_factory_impl_unittest.cc b/chrome/browser/sync/profile_sync_components_factory_impl_unittest.cc
deleted file mode 100644
index a2f2f1f..0000000
--- a/chrome/browser/sync/profile_sync_components_factory_impl_unittest.cc
+++ /dev/null
@@ -1,181 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include <vector>
-
-#include "base/command_line.h"
-#include "base/files/file_path.h"
-#include "base/memory/scoped_ptr.h"
-#include "base/message_loop/message_loop.h"
-#include "chrome/browser/signin/profile_oauth2_token_service_factory.h"
-#include "chrome/browser/sync/chrome_sync_client.h"
-#include "chrome/browser/sync/profile_sync_components_factory_impl.h"
-#include "chrome/browser/sync/profile_sync_service_factory.h"
-#include "chrome/browser/sync/profile_sync_test_util.h"
-#include "chrome/common/channel_info.h"
-#include "chrome/common/chrome_switches.h"
-#include "chrome/test/base/testing_profile.h"
-#include "components/browser_sync/browser/profile_sync_service.h"
-#include "components/browser_sync/common/browser_sync_switches.h"
-#include "components/signin/core/browser/profile_oauth2_token_service.h"
-#include "components/sync_driver/data_type_controller.h"
-#include "components/sync_driver/signin_manager_wrapper.h"
-#include "components/sync_driver/sync_util.h"
-#include "content/public/test/test_browser_thread_bundle.h"
-#include "google_apis/gaia/gaia_constants.h"
-#include "google_apis/gaia/oauth2_token_service.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "ui/app_list/app_list_switches.h"
-
-using sync_driver::DataTypeController;
-
-class ProfileSyncComponentsFactoryImplTest : public testing::Test {
- protected:
-  ProfileSyncComponentsFactoryImplTest()
-      : thread_bundle_(content::TestBrowserThreadBundle::DEFAULT) {}
-
-  void SetUp() override {
-    profile_.reset(new TestingProfile());
-    base::FilePath program_path(FILE_PATH_LITERAL("chrome.exe"));
-    command_line_.reset(new base::CommandLine(program_path));
-    scope_set_.insert(GaiaConstants::kChromeSyncOAuth2Scope);
-  }
-
-  // Returns the collection of default datatypes.
-  static std::vector<syncer::ModelType> DefaultDatatypes() {
-    std::vector<syncer::ModelType> datatypes;
-    datatypes.push_back(syncer::APPS);
-#if defined(ENABLE_APP_LIST)
-    if (app_list::switches::IsAppListSyncEnabled())
-      datatypes.push_back(syncer::APP_LIST);
-#endif
-    datatypes.push_back(syncer::APP_SETTINGS);
-    datatypes.push_back(syncer::AUTOFILL);
-    datatypes.push_back(syncer::AUTOFILL_PROFILE);
-    datatypes.push_back(syncer::AUTOFILL_WALLET_DATA);
-    datatypes.push_back(syncer::BOOKMARKS);
-    datatypes.push_back(syncer::DEVICE_INFO);
-#if defined(OS_LINUX) || defined(OS_WIN) || defined(OS_CHROMEOS)
-    datatypes.push_back(syncer::DICTIONARY);
-#endif
-    datatypes.push_back(syncer::EXTENSIONS);
-    datatypes.push_back(syncer::EXTENSION_SETTINGS);
-    datatypes.push_back(syncer::HISTORY_DELETE_DIRECTIVES);
-    datatypes.push_back(syncer::PASSWORDS);
-    datatypes.push_back(syncer::PREFERENCES);
-    datatypes.push_back(syncer::PRIORITY_PREFERENCES);
-    datatypes.push_back(syncer::SEARCH_ENGINES);
-    datatypes.push_back(syncer::SESSIONS);
-    datatypes.push_back(syncer::PROXY_TABS);
-    datatypes.push_back(syncer::THEMES);
-    datatypes.push_back(syncer::TYPED_URLS);
-    datatypes.push_back(syncer::FAVICON_TRACKING);
-    datatypes.push_back(syncer::FAVICON_IMAGES);
-    datatypes.push_back(syncer::SUPERVISED_USERS);
-    datatypes.push_back(syncer::SUPERVISED_USER_SETTINGS);
-    datatypes.push_back(syncer::SUPERVISED_USER_SHARED_SETTINGS);
-    datatypes.push_back(syncer::SUPERVISED_USER_WHITELISTS);
-
-    return datatypes;
-  }
-
-  // Returns the number of default datatypes.
-  static size_t DefaultDatatypesCount() {
-    return DefaultDatatypes().size();
-  }
-
-  // Asserts that all the default datatypes are in |map|, except
-  // for |exception_type|, which unless it is UNDEFINED, is asserted to
-  // not be in |map|.
-  static void CheckDefaultDatatypesInMapExcept(
-      DataTypeController::StateMap* map,
-      syncer::ModelTypeSet exception_types) {
-    std::vector<syncer::ModelType> defaults = DefaultDatatypes();
-    std::vector<syncer::ModelType>::iterator iter;
-    for (iter = defaults.begin(); iter != defaults.end(); ++iter) {
-      if (exception_types.Has(*iter))
-        EXPECT_EQ(0U, map->count(*iter))
-            << *iter << " found in dataypes map, shouldn't be there.";
-      else
-        EXPECT_EQ(1U, map->count(*iter))
-            << *iter << " not found in datatypes map";
-    }
-  }
-
-  // Asserts that if you disable types via the command line, all other types
-  // are enabled.
-  void TestSwitchDisablesType(syncer::ModelTypeSet types) {
-    command_line_->AppendSwitchASCII(switches::kDisableSyncTypes,
-                                     syncer::ModelTypeSetToString(types));
-    GURL sync_service_url =
-        GetSyncServiceURL(*command_line_, chrome::GetChannel());
-    ProfileOAuth2TokenService* token_service =
-        ProfileOAuth2TokenServiceFactory::GetForProfile(profile_.get());
-    scoped_ptr<sync_driver::SyncApiComponentFactory> factory(
-        new ProfileSyncComponentsFactoryImpl(
-            profile_.get(), command_line_.get(),
-            GetSyncServiceURL(*command_line_, chrome::GetChannel()),
-            token_service, profile_->GetRequestContext()));
-    scoped_ptr<sync_driver::SyncClient> sync_client(
-        new browser_sync::ChromeSyncClient(profile_.get(), factory.Pass()));
-    scoped_ptr<ProfileSyncService> pss(new ProfileSyncService(
-        sync_client.Pass(),
-        make_scoped_ptr<SigninManagerWrapper>(NULL), token_service,
-        browser_sync::MANUAL_START, base::Bind(&EmptyNetworkTimeUpdate),
-        profile_->GetPath(), profile_->GetRequestContext(),
-        profile_->GetDebugName(), chrome::GetChannel(),
-        content::BrowserThread::GetMessageLoopProxyForThread(
-            content::BrowserThread::DB),
-        content::BrowserThread::GetMessageLoopProxyForThread(
-            content::BrowserThread::FILE),
-        content::BrowserThread::GetBlockingPool()));
-    pss->GetSyncClient()->Initialize(pss.get());
-    DataTypeController::StateMap controller_states;
-    pss->GetDataTypeControllerStates(&controller_states);
-    EXPECT_EQ(DefaultDatatypesCount() - types.Size(), controller_states.size());
-    CheckDefaultDatatypesInMapExcept(&controller_states, types);
-  }
-
-  content::TestBrowserThreadBundle thread_bundle_;
-  scoped_ptr<Profile> profile_;
-  scoped_ptr<base::CommandLine> command_line_;
-  OAuth2TokenService::ScopeSet scope_set_;
-};
-
-TEST_F(ProfileSyncComponentsFactoryImplTest, CreatePSSDefault) {
-  ProfileOAuth2TokenService* token_service =
-      ProfileOAuth2TokenServiceFactory::GetForProfile(profile_.get());
-  scoped_ptr<sync_driver::SyncApiComponentFactory> factory(
-      new ProfileSyncComponentsFactoryImpl(
-          profile_.get(), command_line_.get(),
-          GetSyncServiceURL(*command_line_, chrome::GetChannel()),
-          token_service, profile_->GetRequestContext()));
-  scoped_ptr<sync_driver::SyncClient> sync_client(
-      new browser_sync::ChromeSyncClient(profile_.get(), factory.Pass()));
-  scoped_ptr<ProfileSyncService> pss(new ProfileSyncService(
-      sync_client.Pass(),
-      make_scoped_ptr<SigninManagerWrapper>(NULL), token_service,
-      browser_sync::MANUAL_START, base::Bind(&EmptyNetworkTimeUpdate),
-      profile_->GetPath(), profile_->GetRequestContext(),
-      profile_->GetDebugName(), chrome::GetChannel(),
-      content::BrowserThread::GetMessageLoopProxyForThread(
-          content::BrowserThread::DB),
-      content::BrowserThread::GetMessageLoopProxyForThread(
-          content::BrowserThread::FILE),
-      content::BrowserThread::GetBlockingPool()));
-  pss->GetSyncClient()->Initialize(pss.get());
-  DataTypeController::StateMap controller_states;
-  pss->GetDataTypeControllerStates(&controller_states);
-  EXPECT_EQ(DefaultDatatypesCount(), controller_states.size());
-  CheckDefaultDatatypesInMapExcept(&controller_states, syncer::ModelTypeSet());
-}
-
-TEST_F(ProfileSyncComponentsFactoryImplTest, CreatePSSDisableOne) {
-  TestSwitchDisablesType(syncer::ModelTypeSet(syncer::AUTOFILL));
-}
-
-TEST_F(ProfileSyncComponentsFactoryImplTest, CreatePSSDisableMultiple) {
-  TestSwitchDisablesType(
-      syncer::ModelTypeSet(syncer::AUTOFILL_PROFILE, syncer::BOOKMARKS));
-}
diff --git a/chrome/browser/sync/profile_sync_service_factory.cc b/chrome/browser/sync/profile_sync_service_factory.cc
index f4d7f4fd..e334815 100644
--- a/chrome/browser/sync/profile_sync_service_factory.cc
+++ b/chrome/browser/sync/profile_sync_service_factory.cc
@@ -6,7 +6,6 @@
 
 #include "base/command_line.h"
 #include "base/memory/singleton.h"
-#include "base/prefs/pref_service.h"
 #include "base/time/time.h"
 #include "chrome/browser/autofill/personal_data_manager_factory.h"
 #include "chrome/browser/bookmarks/bookmark_model_factory.h"
@@ -25,11 +24,11 @@
 #include "chrome/browser/signin/profile_oauth2_token_service_factory.h"
 #include "chrome/browser/signin/signin_manager_factory.h"
 #include "chrome/browser/sync/chrome_sync_client.h"
-#include "chrome/browser/sync/profile_sync_components_factory_impl.h"
 #include "chrome/browser/sync/supervised_user_signin_manager_wrapper.h"
 #include "chrome/browser/themes/theme_service_factory.h"
 #include "chrome/browser/web_data_service_factory.h"
 #include "chrome/common/channel_info.h"
+#include "components/browser_sync/browser/profile_sync_components_factory_impl.h"
 #include "components/browser_sync/browser/profile_sync_service.h"
 #include "components/keyed_service/content/browser_context_dependency_manager.h"
 #include "components/network_time/network_time_tracker.h"
@@ -148,18 +147,11 @@
   // once http://crbug.com/171406 has been fixed.
   AboutSigninInternalsFactory::GetForProfile(profile);
 
-  const GURL sync_service_url = GetSyncServiceURL(
-      *base::CommandLine::ForCurrentProcess(), chrome::GetChannel());
-
   scoped_ptr<SigninManagerWrapper> signin_wrapper(
       new SupervisedUserSigninManagerWrapper(profile, signin));
-  std::string account_id = signin_wrapper->GetAccountIdToUse();
-  OAuth2TokenService::ScopeSet scope_set;
-  scope_set.insert(signin_wrapper->GetSyncScopeToUse());
+
   ProfileOAuth2TokenService* token_service =
       ProfileOAuth2TokenServiceFactory::GetForProfile(profile);
-  net::URLRequestContextGetter* url_request_context_getter =
-      profile->GetRequestContext();
 
   // TODO(tim): Currently, AUTO/MANUAL settings refer to the *first* time sync
   // is set up and *not* a browser restart for a manual-start platform (where
@@ -170,14 +162,10 @@
   browser_sync::ProfileSyncServiceStartBehavior behavior =
       browser_defaults::kSyncAutoStarts ? browser_sync::AUTO_START
                                         : browser_sync::MANUAL_START;
-  scoped_ptr<sync_driver::SyncApiComponentFactory> sync_factory(
-      new ProfileSyncComponentsFactoryImpl(
-          profile, base::CommandLine::ForCurrentProcess(), sync_service_url,
-          token_service, url_request_context_getter));
-  scoped_ptr<browser_sync::ChromeSyncClient> sync_client(
-      new browser_sync::ChromeSyncClient(profile, sync_factory.Pass()));
+  browser_sync::ChromeSyncClient* chrome_sync_client =
+      new browser_sync::ChromeSyncClient(profile);
   ProfileSyncService* pss = new ProfileSyncService(
-      sync_client.Pass(), signin_wrapper.Pass(), token_service,
+      make_scoped_ptr(chrome_sync_client), signin_wrapper.Pass(), token_service,
       behavior, base::Bind(&UpdateNetworkTime), profile->GetPath(),
       profile->GetRequestContext(), profile->GetDebugName(),
       chrome::GetChannel(),
@@ -186,6 +174,8 @@
       content::BrowserThread::GetMessageLoopProxyForThread(
           content::BrowserThread::FILE),
       content::BrowserThread::GetBlockingPool());
+
+  // Will also initialize the sync client.
   pss->Initialize();
   return pss;
 }
diff --git a/chrome/browser/sync/profile_sync_service_factory_unittest.cc b/chrome/browser/sync/profile_sync_service_factory_unittest.cc
index 963d824..84ba8e76 100644
--- a/chrome/browser/sync/profile_sync_service_factory_unittest.cc
+++ b/chrome/browser/sync/profile_sync_service_factory_unittest.cc
@@ -5,20 +5,95 @@
 #include "base/command_line.h"
 #include "base/memory/scoped_ptr.h"
 #include "chrome/browser/sync/profile_sync_service_factory.h"
-#include "chrome/common/chrome_switches.h"
 #include "chrome/test/base/testing_profile.h"
+#include "components/browser_sync/browser/profile_sync_service.h"
 #include "components/browser_sync/common/browser_sync_switches.h"
+#include "components/sync_driver/data_type_controller.h"
 #include "content/public/test/test_browser_thread_bundle.h"
+#include "sync/internal_api/public/base/model_type.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "ui/app_list/app_list_switches.h"
+
+using sync_driver::DataTypeController;
 
 class ProfileSyncServiceFactoryTest : public testing::Test {
  protected:
-  ProfileSyncServiceFactoryTest() {}
+  ProfileSyncServiceFactoryTest() : profile_(new TestingProfile()) {}
 
-  void SetUp() override {
-    profile_.reset(new TestingProfile());
+  // Returns the collection of default datatypes.
+  std::vector<syncer::ModelType> DefaultDatatypes() {
+    std::vector<syncer::ModelType> datatypes;
+
+    // Desktop types.
+#if !defined(OS_ANDROID) && !defined(OS_IOS)
+    datatypes.push_back(syncer::APPS);
+#if defined(ENABLE_APP_LIST)
+    if (app_list::switches::IsAppListSyncEnabled())
+      datatypes.push_back(syncer::APP_LIST);
+#endif
+    datatypes.push_back(syncer::APP_SETTINGS);
+#if defined(OS_LINUX) || defined(OS_WIN) || defined(OS_CHROMEOS)
+    datatypes.push_back(syncer::DICTIONARY);
+#endif
+    datatypes.push_back(syncer::EXTENSIONS);
+    datatypes.push_back(syncer::EXTENSION_SETTINGS);
+    datatypes.push_back(syncer::PREFERENCES);
+    datatypes.push_back(syncer::SEARCH_ENGINES);
+    datatypes.push_back(syncer::THEMES);
+    datatypes.push_back(syncer::SUPERVISED_USERS);
+    datatypes.push_back(syncer::SUPERVISED_USER_SHARED_SETTINGS);
+#endif // !OS_ANDROID && !OS_IOS
+
+    // Common types.
+    datatypes.push_back(syncer::AUTOFILL);
+    datatypes.push_back(syncer::AUTOFILL_PROFILE);
+    datatypes.push_back(syncer::AUTOFILL_WALLET_DATA);
+    datatypes.push_back(syncer::AUTOFILL_WALLET_METADATA);
+    datatypes.push_back(syncer::BOOKMARKS);
+    datatypes.push_back(syncer::DEVICE_INFO);
+    datatypes.push_back(syncer::FAVICON_TRACKING);
+    datatypes.push_back(syncer::FAVICON_IMAGES);
+    datatypes.push_back(syncer::HISTORY_DELETE_DIRECTIVES);
+    datatypes.push_back(syncer::PASSWORDS);
+    datatypes.push_back(syncer::PRIORITY_PREFERENCES);
+    datatypes.push_back(syncer::SESSIONS);
+    datatypes.push_back(syncer::PROXY_TABS);
+    datatypes.push_back(syncer::SUPERVISED_USER_SETTINGS);
+    datatypes.push_back(syncer::SUPERVISED_USER_WHITELISTS);
+    datatypes.push_back(syncer::TYPED_URLS);
+
+    return datatypes;
   }
 
+  // Returns the number of default datatypes.
+  size_t DefaultDatatypesCount() { return DefaultDatatypes().size(); }
+
+  // Asserts that all the default datatypes are in |map|, except
+  // for |exception_type|, which unless it is UNDEFINED, is asserted to
+  // not be in |map|.
+  void CheckDefaultDatatypesInMapExcept(DataTypeController::StateMap* map,
+                                        syncer::ModelTypeSet exception_types) {
+    std::vector<syncer::ModelType> defaults = DefaultDatatypes();
+    std::vector<syncer::ModelType>::iterator iter;
+    for (iter = defaults.begin(); iter != defaults.end(); ++iter) {
+      if (exception_types.Has(*iter))
+        EXPECT_EQ(0U, map->count(*iter))
+            << *iter << " found in dataypes map, shouldn't be there.";
+      else
+        EXPECT_EQ(1U, map->count(*iter)) << *iter
+                                         << " not found in datatypes map";
+    }
+  }
+
+  void SetDisabledTypes(syncer::ModelTypeSet disabled_types) {
+    base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
+        switches::kDisableSyncTypes,
+        syncer::ModelTypeSetToString(disabled_types));
+  }
+
+  Profile* profile() { return profile_.get(); }
+
+ private:
   content::TestBrowserThreadBundle thread_bundle_;
   scoped_ptr<Profile> profile_;
 };
@@ -26,5 +101,42 @@
 // Verify that the disable sync flag disables creation of the sync service.
 TEST_F(ProfileSyncServiceFactoryTest, DisableSyncFlag) {
   base::CommandLine::ForCurrentProcess()->AppendSwitch(switches::kDisableSync);
-  EXPECT_EQ(nullptr, ProfileSyncServiceFactory::GetForProfile(profile_.get()));
+  EXPECT_EQ(nullptr, ProfileSyncServiceFactory::GetForProfile(profile()));
+}
+
+// Verify that a normal (no command line flags) PSS can be created and
+// properly initialized.
+TEST_F(ProfileSyncServiceFactoryTest, CreatePSSDefault) {
+  ProfileSyncService* pss = ProfileSyncServiceFactory::GetForProfile(profile());
+  DataTypeController::StateMap controller_states;
+  pss->GetDataTypeControllerStates(&controller_states);
+  EXPECT_EQ(DefaultDatatypesCount(), controller_states.size());
+  CheckDefaultDatatypesInMapExcept(&controller_states, syncer::ModelTypeSet());
+}
+
+// Verify that a PSS with a disabled datatype can be created and properly
+// initialized.
+TEST_F(ProfileSyncServiceFactoryTest, CreatePSSDisableOne) {
+  syncer::ModelTypeSet disabled_types(syncer::AUTOFILL);
+  SetDisabledTypes(disabled_types);
+  ProfileSyncService* pss = ProfileSyncServiceFactory::GetForProfile(profile());
+  DataTypeController::StateMap controller_states;
+  pss->GetDataTypeControllerStates(&controller_states);
+  EXPECT_EQ(DefaultDatatypesCount() - disabled_types.Size(),
+            controller_states.size());
+  CheckDefaultDatatypesInMapExcept(&controller_states, disabled_types);
+}
+
+// Verify that a PSS with multiple disabled datatypes can be created and
+// properly initialized.
+TEST_F(ProfileSyncServiceFactoryTest, CreatePSSDisableMultiple) {
+  syncer::ModelTypeSet disabled_types(syncer::AUTOFILL_PROFILE,
+                                      syncer::BOOKMARKS);
+  SetDisabledTypes(disabled_types);
+  ProfileSyncService* pss = ProfileSyncServiceFactory::GetForProfile(profile());
+  DataTypeController::StateMap controller_states;
+  pss->GetDataTypeControllerStates(&controller_states);
+  EXPECT_EQ(DefaultDatatypesCount() - disabled_types.Size(),
+            controller_states.size());
+  CheckDefaultDatatypesInMapExcept(&controller_states, disabled_types);
 }
diff --git a/chrome/browser/sync/profile_sync_service_mock.cc b/chrome/browser/sync/profile_sync_service_mock.cc
index 209187a..e5c8a3fb 100644
--- a/chrome/browser/sync/profile_sync_service_mock.cc
+++ b/chrome/browser/sync/profile_sync_service_mock.cc
@@ -21,12 +21,12 @@
 
 ProfileSyncServiceMock::ProfileSyncServiceMock(Profile* profile)
     : ProfileSyncServiceMock(
-          make_scoped_ptr(
-              new browser_sync::ChromeSyncClient(
-                  profile,
-                  make_scoped_ptr(new SyncApiComponentFactoryMock())))
-              .Pass(),
-          profile) {}
+          make_scoped_ptr(new browser_sync::ChromeSyncClient(profile)),
+          profile) {
+  static_cast<browser_sync::ChromeSyncClient*>(GetSyncClient())
+      ->SetSyncApiComponentFactoryForTesting(
+          make_scoped_ptr(new SyncApiComponentFactoryMock()));
+}
 
 ProfileSyncServiceMock::ProfileSyncServiceMock(
     scoped_ptr<sync_driver::SyncClient> sync_client,
diff --git a/chrome/browser/sync/profile_sync_service_startup_unittest.cc b/chrome/browser/sync/profile_sync_service_startup_unittest.cc
index 03160fd3..7c3afc81 100644
--- a/chrome/browser/sync/profile_sync_service_startup_unittest.cc
+++ b/chrome/browser/sync/profile_sync_service_startup_unittest.cc
@@ -118,20 +118,19 @@
   void SetUp() override {
     CHECK(profile_manager_.SetUp());
 
-    TestingProfile::TestingFactories testing_facotries;
-    testing_facotries.push_back(std::make_pair(
+    TestingProfile::TestingFactories testing_factories;
+    testing_factories.push_back(std::make_pair(
         SigninManagerFactory::GetInstance(), BuildFakeSigninManagerBase));
-    testing_facotries.push_back(
-            std::make_pair(ProfileOAuth2TokenServiceFactory::GetInstance(),
-                           BuildAutoIssuingFakeProfileOAuth2TokenService));
-    testing_facotries.push_back(
-            std::make_pair(ProfileSyncServiceFactory::GetInstance(),
-                           BuildService));
+    testing_factories.push_back(
+        std::make_pair(ProfileOAuth2TokenServiceFactory::GetInstance(),
+                       BuildAutoIssuingFakeProfileOAuth2TokenService));
+    testing_factories.push_back(
+        std::make_pair(ProfileSyncServiceFactory::GetInstance(), BuildService));
 
     profile_ = profile_manager_.CreateTestingProfile(
         "sync-startup-test", scoped_ptr<syncable_prefs::PrefServiceSyncable>(),
         base::UTF8ToUTF16("sync-startup-test"), 0, std::string(),
-        testing_facotries);
+        testing_factories);
   }
 
   void TearDown() override { sync_->RemoveObserver(&observer_); }
@@ -140,8 +139,9 @@
       content::BrowserContext* browser_context) {
     Profile* profile = static_cast<Profile*>(browser_context);
     scoped_ptr<browser_sync::ChromeSyncClient> sync_client(
-        new browser_sync::ChromeSyncClient(
-            profile, make_scoped_ptr(new SyncApiComponentFactoryMock())));
+        new browser_sync::ChromeSyncClient(profile));
+    sync_client->SetSyncApiComponentFactoryForTesting(
+        make_scoped_ptr(new SyncApiComponentFactoryMock()));
     return make_scoped_ptr(new TestProfileSyncServiceNoBackup(
         sync_client.Pass(), profile,
         make_scoped_ptr(new SigninManagerWrapper(
@@ -212,7 +212,7 @@
     browser_sync::SyncBackendHostMock* sync_backend_host =
         new browser_sync::SyncBackendHostMock();
     EXPECT_CALL(*GetSyncApiComponentFactoryMock(),
-                CreateSyncBackendHost(_, _, _, _, _))
+                CreateSyncBackendHost(_, _, _, _))
         .WillOnce(Return(sync_backend_host));
     return sync_backend_host;
   }
@@ -246,8 +246,9 @@
         ProfileOAuth2TokenServiceFactory::GetForProfile(profile);
     EXPECT_TRUE(signin->IsAuthenticated());
     scoped_ptr<browser_sync::ChromeSyncClient> sync_client(
-        new browser_sync::ChromeSyncClient(
-            profile, make_scoped_ptr(new SyncApiComponentFactoryMock())));
+        new browser_sync::ChromeSyncClient(profile));
+    sync_client->SetSyncApiComponentFactoryForTesting(
+        make_scoped_ptr(new SyncApiComponentFactoryMock()));
     return make_scoped_ptr(new TestProfileSyncServiceNoBackup(
         sync_client.Pass(), profile,
         make_scoped_ptr(new SigninManagerWrapper(signin)), oauth2_token_service,
@@ -378,7 +379,7 @@
               CreateDataTypeManager(_, _, _, _, _))
       .Times(0);
   EXPECT_CALL(*GetSyncApiComponentFactoryMock(),
-              CreateSyncBackendHost(_, _, _, _, _))
+              CreateSyncBackendHost(_, _, _, _))
       .Times(0);
   profile_->GetPrefs()->ClearPref(sync_driver::prefs::kSyncHasSetupCompleted);
   EXPECT_CALL(observer_, OnStateChanged()).Times(AnyNumber());
diff --git a/chrome/browser/sync/profile_sync_service_unittest.cc b/chrome/browser/sync/profile_sync_service_unittest.cc
index fe887df..a3efd965 100644
--- a/chrome/browser/sync/profile_sync_service_unittest.cc
+++ b/chrome/browser/sync/profile_sync_service_unittest.cc
@@ -35,7 +35,6 @@
 #include "components/signin/core/browser/account_tracker_service.h"
 #include "components/signin/core/browser/fake_profile_oauth2_token_service.h"
 #include "components/signin/core/browser/signin_manager.h"
-#include "components/signin/core/browser/signin_manager.h"
 #include "components/strings/grit/components_strings.h"
 #include "components/sync_driver/data_type_manager.h"
 #include "components/sync_driver/data_type_manager_observer.h"
@@ -106,11 +105,12 @@
 class TestChromeSyncClient : public ChromeSyncClient {
  public:
   TestChromeSyncClient(
-      Profile* profile,
       scoped_ptr<sync_driver::SyncApiComponentFactory> component_factory,
+      Profile* profile,
       sync_driver::ClearBrowsingDataCallback callback)
-      : ChromeSyncClient(profile, component_factory.Pass()),
-        callback_(callback) {}
+      : ChromeSyncClient(profile),
+        callback_(callback),
+        component_factory_(component_factory.Pass()) {}
   ~TestChromeSyncClient() override {}
 
  private:
@@ -119,8 +119,12 @@
       override {
     return callback_;
   }
+  sync_driver::SyncApiComponentFactory* GetSyncApiComponentFactory() override {
+    return component_factory_.get();
+  }
 
   sync_driver::ClearBrowsingDataCallback callback_;
+  scoped_ptr<sync_driver::SyncApiComponentFactory> component_factory_;
 };
 
 class TestSyncServiceObserver : public sync_driver::SyncServiceObserver {
@@ -255,7 +259,9 @@
  protected:
   ProfileSyncServiceTest()
       : thread_bundle_(content::TestBrowserThreadBundle::IO_MAINLOOP),
-        profile_manager_(TestingBrowserProcess::GetGlobal()) {}
+        profile_manager_(TestingBrowserProcess::GetGlobal()),
+        profile_(NULL),
+        components_factory_(NULL) {}
   ~ProfileSyncServiceTest() override {}
 
   void SetUp() override {
@@ -304,7 +310,7 @@
         new SyncApiComponentFactoryMock());
     components_factory_ = components_factory.get();
     scoped_ptr<ChromeSyncClient> sync_client(new TestChromeSyncClient(
-        profile_, components_factory.Pass(),
+        components_factory.Pass(), profile_,
         base::Bind(&ProfileSyncServiceTest::ClearBrowsingDataCallback,
                    base::Unretained(this))));
     service_.reset(new ProfileSyncService(
@@ -391,14 +397,14 @@
   }
 
   void ExpectSyncBackendHostCreation(int times) {
-    EXPECT_CALL(*components_factory_, CreateSyncBackendHost(_, _, _, _, _))
+    EXPECT_CALL(*components_factory_, CreateSyncBackendHost(_, _, _, _))
         .Times(times)
         .WillRepeatedly(ReturnNewSyncBackendHostMock());
   }
 
   void ExpectSyncBackendHostCreationCollectDeleteDir(
       int times, std::vector<bool> *delete_dir_param) {
-    EXPECT_CALL(*components_factory_, CreateSyncBackendHost(_, _, _, _, _))
+    EXPECT_CALL(*components_factory_, CreateSyncBackendHost(_, _, _, _))
         .Times(times)
         .WillRepeatedly(
             ReturnNewMockHostCollectDeleteDirParam(delete_dir_param));
@@ -406,13 +412,13 @@
 
   void ExpectSyncBackendHostCreationCaptureClearServerData(
       syncer::SyncManager::ClearServerDataCallback* captured_callback) {
-    EXPECT_CALL(*components_factory_, CreateSyncBackendHost(_, _, _, _, _))
+    EXPECT_CALL(*components_factory_, CreateSyncBackendHost(_, _, _, _))
         .Times(1)
         .WillOnce(ReturnNewMockHostCaptureClearServerData(captured_callback));
   }
 
   void PrepareDelayedInitSyncBackendHost() {
-    EXPECT_CALL(*components_factory_, CreateSyncBackendHost(_, _, _, _, _))
+    EXPECT_CALL(*components_factory_, CreateSyncBackendHost(_, _, _, _))
         .WillOnce(ReturnNewSyncBackendHostNoReturn());
   }
 
diff --git a/chrome/browser/sync/sessions/sessions_sync_manager_unittest.cc b/chrome/browser/sync/sessions/sessions_sync_manager_unittest.cc
index 6f12001..b4afe23 100644
--- a/chrome/browser/sync/sessions/sessions_sync_manager_unittest.cc
+++ b/chrome/browser/sync/sessions/sessions_sync_manager_unittest.cc
@@ -277,7 +277,7 @@
 
   void SetUp() override {
     BrowserWithTestWindowTest::SetUp();
-    sync_client_.reset(new browser_sync::ChromeSyncClient(profile(), nullptr));
+    sync_client_.reset(new browser_sync::ChromeSyncClient(profile()));
     browser_sync::NotificationServiceSessionsRouter* router(
         new browser_sync::NotificationServiceSessionsRouter(
             profile(), GetSyncSessionsClient(),
diff --git a/chrome/browser/sync/test/integration/single_client_wallet_sync_test.cc b/chrome/browser/sync/test/integration/single_client_wallet_sync_test.cc
index 0cfc95fb..69619dd9 100644
--- a/chrome/browser/sync/test/integration/single_client_wallet_sync_test.cc
+++ b/chrome/browser/sync/test/integration/single_client_wallet_sync_test.cc
@@ -137,7 +137,7 @@
       syncer::AUTOFILL_WALLET_DATA));
   // TODO(pvalenzuela): Assert that the local root node for AUTOFILL_WALLET_DATA
   // exists.
-  ASSERT_FALSE(GetClient(0)->service()->GetActiveDataTypes().Has(
+  ASSERT_TRUE(GetClient(0)->service()->GetActiveDataTypes().Has(
       syncer::AUTOFILL_WALLET_METADATA));
 }
 
@@ -157,7 +157,7 @@
   ASSERT_TRUE(SetupSync()) << "SetupSync() failed";
   ASSERT_TRUE(GetClient(0)->service()->GetActiveDataTypes().Has(
       syncer::AUTOFILL_WALLET_DATA));
-  ASSERT_FALSE(GetClient(0)->service()->GetActiveDataTypes().Has(
+  ASSERT_TRUE(GetClient(0)->service()->GetActiveDataTypes().Has(
       syncer::AUTOFILL_WALLET_METADATA));
 }
 
@@ -185,7 +185,7 @@
   ASSERT_FALSE(enabled_checker.TimedOut());
   ASSERT_TRUE(GetClient(0)->service()->GetActiveDataTypes().Has(
       syncer::AUTOFILL_WALLET_DATA));
-  ASSERT_FALSE(GetClient(0)->service()->GetActiveDataTypes().Has(
+  ASSERT_TRUE(GetClient(0)->service()->GetActiveDataTypes().Has(
       syncer::AUTOFILL_WALLET_METADATA));
 
   // Then disable the experiment.
diff --git a/chrome/browser/sync/test_profile_sync_service.cc b/chrome/browser/sync/test_profile_sync_service.cc
index ea7778be..2a724d8 100644
--- a/chrome/browser/sync/test_profile_sync_service.cc
+++ b/chrome/browser/sync/test_profile_sync_service.cc
@@ -126,22 +126,24 @@
     SigninManagerBase* signin,
     ProfileOAuth2TokenService* oauth2_token_service,
     browser_sync::ProfileSyncServiceStartBehavior behavior)
-    : ProfileSyncService(make_scoped_ptr(new browser_sync::ChromeSyncClient(
-                             profile,
-                             make_scoped_ptr(new SyncApiComponentFactoryMock))),
-                         make_scoped_ptr(new SigninManagerWrapper(signin)),
-                         oauth2_token_service,
-                         behavior,
-                         base::Bind(&EmptyNetworkTimeUpdate),
-                         profile->GetPath(),
-                         profile->GetRequestContext(),
-                         profile->GetDebugName(),
-                         chrome::GetChannel(),
-                         content::BrowserThread::GetMessageLoopProxyForThread(
-                             content::BrowserThread::DB),
-                         content::BrowserThread::GetMessageLoopProxyForThread(
-                             content::BrowserThread::FILE),
-                         content::BrowserThread::GetBlockingPool()) {
+    : ProfileSyncService(
+          make_scoped_ptr(new browser_sync::ChromeSyncClient(profile)),
+          make_scoped_ptr(new SigninManagerWrapper(signin)),
+          oauth2_token_service,
+          behavior,
+          base::Bind(&EmptyNetworkTimeUpdate),
+          profile->GetPath(),
+          profile->GetRequestContext(),
+          profile->GetDebugName(),
+          chrome::GetChannel(),
+          content::BrowserThread::GetMessageLoopProxyForThread(
+              content::BrowserThread::DB),
+          content::BrowserThread::GetMessageLoopProxyForThread(
+              content::BrowserThread::FILE),
+          content::BrowserThread::GetBlockingPool()) {
+  static_cast<browser_sync::ChromeSyncClient*>(GetSyncClient())
+      ->SetSyncApiComponentFactoryForTesting(
+          make_scoped_ptr(new SyncApiComponentFactoryMock));
   SetSyncSetupCompleted();
 }
 
@@ -169,9 +171,8 @@
   SyncApiComponentFactoryMock* components =
       sync_service->GetSyncApiComponentFactoryMock();
   // TODO(tim): Convert to a fake instead of mock.
-  EXPECT_CALL(*components,
-              CreateSyncBackendHost(testing::_, testing::_, testing::_,
-                                    testing::_, testing::_))
+  EXPECT_CALL(*components, CreateSyncBackendHost(testing::_, testing::_,
+                                                 testing::_, testing::_))
       .WillOnce(
           testing::Return(new browser_sync::SyncBackendHostForProfileSyncTest(
               profile, sync_service->GetSyncClient(),
diff --git a/chrome/browser/ui/app_list/search/launcher_search/launcher_search_provider.cc b/chrome/browser/ui/app_list/search/launcher_search/launcher_search_provider.cc
index 5645fc0c..a5e3028 100644
--- a/chrome/browser/ui/app_list/search/launcher_search/launcher_search_provider.cc
+++ b/chrome/browser/ui/app_list/search/launcher_search/launcher_search_provider.cc
@@ -59,9 +59,8 @@
   DCHECK(Service::Get(profile_)->IsQueryRunning());
 
   // Add this extension's results (erasing any existing results).
-  extension_results_.set(
-      extension_id,
-      make_scoped_ptr(new ScopedVector<LauncherSearchResult>(results.Pass())));
+  extension_results_[extension_id] =
+      make_scoped_ptr(new ScopedVector<LauncherSearchResult>(results.Pass()));
 
   // Update results with other extension results.
   ClearResults();
diff --git a/chrome/browser/ui/app_list/search/launcher_search/launcher_search_provider.h b/chrome/browser/ui/app_list/search/launcher_search/launcher_search_provider.h
index 768c6c33..a1ba785 100644
--- a/chrome/browser/ui/app_list/search/launcher_search/launcher_search_provider.h
+++ b/chrome/browser/ui/app_list/search/launcher_search/launcher_search_provider.h
@@ -5,7 +5,8 @@
 #ifndef CHROME_BROWSER_UI_APP_LIST_SEARCH_LAUNCHER_SEARCH_LAUNCHER_SEARCH_PROVIDER_H_
 #define CHROME_BROWSER_UI_APP_LIST_SEARCH_LAUNCHER_SEARCH_LAUNCHER_SEARCH_PROVIDER_H_
 
-#include "base/containers/scoped_ptr_map.h"
+#include <map>
+
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/scoped_vector.h"
 #include "base/stl_util.h"
@@ -40,9 +41,8 @@
   void StartInternal(const base::string16& query);
 
   // The search results of each extension.
-  base::ScopedPtrMap<extensions::ExtensionId,
-                     scoped_ptr<ScopedVector<LauncherSearchResult>>>
-      extension_results_;
+  std::map<extensions::ExtensionId,
+           scoped_ptr<ScopedVector<LauncherSearchResult>>> extension_results_;
 
   // A timer to delay query.
   base::OneShotTimer query_timer_;
diff --git a/chrome/browser/ui/ash/chrome_shell_delegate.cc b/chrome/browser/ui/ash/chrome_shell_delegate.cc
index 8001fae..0059c8b 100644
--- a/chrome/browser/ui/ash/chrome_shell_delegate.cc
+++ b/chrome/browser/ui/ash/chrome_shell_delegate.cc
@@ -24,7 +24,6 @@
 #include "chrome/browser/ui/browser_navigator_params.h"
 #include "chrome/browser/ui/browser_window.h"
 #include "chrome/grit/chromium_strings.h"
-#include "components/signin/core/common/profile_management_switches.h"
 #include "grit/theme_resources.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/resource/resource_bundle.h"
@@ -102,13 +101,6 @@
   return chrome::IsRunningInForcedAppMode();
 }
 
-bool ChromeShellDelegate::IsMultiAccountEnabled() const {
-#if defined(OS_CHROMEOS)
-  return switches::IsEnableAccountConsistency();
-#endif
-  return false;
-}
-
 bool ChromeShellDelegate::CanShowWindowForUser(aura::Window* window) const {
   return ::CanShowWindowForUser(window, base::Bind(&GetActiveBrowserContext));
 }
diff --git a/chrome/browser/ui/ash/chrome_shell_delegate.h b/chrome/browser/ui/ash/chrome_shell_delegate.h
index 747fefb..13e363f 100644
--- a/chrome/browser/ui/ash/chrome_shell_delegate.h
+++ b/chrome/browser/ui/ash/chrome_shell_delegate.h
@@ -56,7 +56,6 @@
   bool IsMultiProfilesEnabled() const override;
   bool IsIncognitoAllowed() const override;
   bool IsRunningInForcedAppMode() const override;
-  bool IsMultiAccountEnabled() const override;
   bool CanShowWindowForUser(aura::Window* window) const override;
   bool IsForceMaximizeOnFirstRun() const override;
   void PreInit() override;
diff --git a/chrome/browser/ui/ash/system_tray_delegate_chromeos.cc b/chrome/browser/ui/ash/system_tray_delegate_chromeos.cc
index fe63641..64bf317 100644
--- a/chrome/browser/ui/ash/system_tray_delegate_chromeos.cc
+++ b/chrome/browser/ui/ash/system_tray_delegate_chromeos.cc
@@ -74,7 +74,6 @@
 #include "chrome/browser/ui/ash/multi_user/multi_user_util.h"
 #include "chrome/browser/ui/ash/networking_config_delegate_chromeos.h"
 #include "chrome/browser/ui/ash/system_tray_delegate_utils.h"
-#include "chrome/browser/ui/ash/user_accounts_delegate_chromeos.h"
 #include "chrome/browser/ui/ash/volume_controller_chromeos.h"
 #include "chrome/browser/ui/ash/vpn_delegate_chromeos.h"
 #include "chrome/browser/ui/browser.h"
@@ -823,23 +822,6 @@
   return search_key_mapped_to_ == input_method::kCapsLockKey;
 }
 
-ash::tray::UserAccountsDelegate*
-SystemTrayDelegateChromeOS::GetUserAccountsDelegate(
-    const AccountId& account_id) {
-  auto it = accounts_delegates_.find(account_id);
-  if (it == accounts_delegates_.end()) {
-    const user_manager::User* user =
-        user_manager::UserManager::Get()->FindUser(account_id);
-    Profile* user_profile = ProfileHelper::Get()->GetProfileByUserUnsafe(user);
-    CHECK(user_profile);
-    accounts_delegates_.set(
-        account_id, scoped_ptr<ash::tray::UserAccountsDelegate>(
-                        new UserAccountsDelegateChromeOS(user_profile)));
-    it = accounts_delegates_.find(account_id);
-  }
-  return it->second;
-}
-
 void SystemTrayDelegateChromeOS::AddCustodianInfoTrayObserver(
     ash::CustodianInfoTrayObserver* observer) {
   custodian_info_changed_observers_.AddObserver(observer);
diff --git a/chrome/browser/ui/ash/system_tray_delegate_chromeos.h b/chrome/browser/ui/ash/system_tray_delegate_chromeos.h
index 1d65136..e849a7bd 100644
--- a/chrome/browser/ui/ash/system_tray_delegate_chromeos.h
+++ b/chrome/browser/ui/ash/system_tray_delegate_chromeos.h
@@ -16,7 +16,6 @@
 #include "base/callback_forward.h"
 #include "base/callback_list.h"
 #include "base/compiler_specific.h"
-#include "base/containers/scoped_ptr_hash_map.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
 #include "base/observer_list.h"
@@ -136,8 +135,6 @@
   int GetSystemTrayMenuWidth() override;
   void ActiveUserWasChanged() override;
   bool IsSearchKeyMappedToCapsLock() override;
-  ash::tray::UserAccountsDelegate* GetUserAccountsDelegate(
-      const AccountId& account_id) override;
   void AddCustodianInfoTrayObserver(
       ash::CustodianInfoTrayObserver* observer) override;
   void RemoveCustodianInfoTrayObserver(
@@ -293,8 +290,6 @@
   scoped_ptr<ash::NetworkingConfigDelegate> networking_config_delegate_;
   scoped_ptr<ash::VolumeControlDelegate> volume_control_delegate_;
   scoped_ptr<AccessibilityStatusSubscription> accessibility_subscription_;
-  base::ScopedPtrMap<AccountId, scoped_ptr<ash::tray::UserAccountsDelegate>>
-      accounts_delegates_;
   scoped_ptr<ShutdownPolicyHandler> shutdown_policy_handler_;
   scoped_ptr<ash::VPNDelegate> vpn_delegate_;
 
diff --git a/chrome/browser/ui/ash/user_accounts_delegate_chromeos.cc b/chrome/browser/ui/ash/user_accounts_delegate_chromeos.cc
deleted file mode 100644
index 1dbbb12..0000000
--- a/chrome/browser/ui/ash/user_accounts_delegate_chromeos.cc
+++ /dev/null
@@ -1,85 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "chrome/browser/ui/ash/user_accounts_delegate_chromeos.h"
-
-#include <algorithm>
-#include <iterator>
-
-#include "base/logging.h"
-#include "chrome/browser/chromeos/profiles/profile_helper.h"
-#include "chrome/browser/chromeos/ui/inline_login_dialog.h"
-#include "chrome/browser/signin/profile_oauth2_token_service_factory.h"
-#include "chrome/browser/signin/signin_manager_factory.h"
-#include "components/signin/core/browser/profile_oauth2_token_service.h"
-#include "components/signin/core/browser/signin_manager.h"
-#include "components/user_manager/user.h"
-#include "google_apis/gaia/gaia_auth_util.h"
-
-namespace chromeos {
-
-UserAccountsDelegateChromeOS::UserAccountsDelegateChromeOS(
-    Profile* user_profile)
-    : user_profile_(user_profile) {
-  ProfileOAuth2TokenServiceFactory::GetForProfile(user_profile_)
-      ->AddObserver(this);
-}
-
-UserAccountsDelegateChromeOS::~UserAccountsDelegateChromeOS() {
-  ProfileOAuth2TokenServiceFactory::GetForProfile(user_profile_)
-      ->RemoveObserver(this);
-}
-
-std::string UserAccountsDelegateChromeOS::GetPrimaryAccountId() {
-  return SigninManagerFactory::GetForProfile(user_profile_)
-      ->GetAuthenticatedAccountId();
-}
-
-std::vector<std::string>
-UserAccountsDelegateChromeOS::GetSecondaryAccountIds() {
-  ProfileOAuth2TokenService* token_service =
-      ProfileOAuth2TokenServiceFactory::GetForProfile(user_profile_);
-  std::vector<std::string> accounts = token_service->GetAccounts();
-  // Filter primary account.
-  std::vector<std::string>::iterator it =
-      std::remove(accounts.begin(), accounts.end(), GetPrimaryAccountId());
-  LOG_IF(WARNING, std::distance(it, accounts.end()) != 1)
-      << "Found " << std::distance(it, accounts.end())
-      << " primary accounts in the account list.";
-  accounts.erase(it, accounts.end());
-  return accounts;
-}
-
-std::string UserAccountsDelegateChromeOS::GetAccountDisplayName(
-    const std::string& account_id) {
-  const user_manager::User* user =
-      ProfileHelper::Get()->GetUserByProfile(user_profile_);
-  if (gaia::AreEmailsSame(user->email(), account_id) &&
-      !user->display_email().empty())
-    return user->display_email();
-  return account_id;
-}
-
-void UserAccountsDelegateChromeOS::DeleteAccount(
-    const std::string& account_id) {
-  ProfileOAuth2TokenService* oauth2_token_service =
-      ProfileOAuth2TokenServiceFactory::GetForProfile(user_profile_);
-  oauth2_token_service->RevokeCredentials(account_id);
-}
-
-void UserAccountsDelegateChromeOS::LaunchAddAccountDialog() {
-  ui::InlineLoginDialog::Show(user_profile_);
-}
-
-void UserAccountsDelegateChromeOS::OnRefreshTokenAvailable(
-    const std::string& account_id) {
-  NotifyAccountListChanged();
-}
-
-void UserAccountsDelegateChromeOS::OnRefreshTokenRevoked(
-    const std::string& account_id) {
-  NotifyAccountListChanged();
-}
-
-}  // namespace chromeos
diff --git a/chrome/browser/ui/ash/user_accounts_delegate_chromeos.h b/chrome/browser/ui/ash/user_accounts_delegate_chromeos.h
deleted file mode 100644
index c25663e..0000000
--- a/chrome/browser/ui/ash/user_accounts_delegate_chromeos.h
+++ /dev/null
@@ -1,42 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_BROWSER_UI_ASH_USER_ACCOUNTS_DELEGATE_CHROMEOS_H_
-#define CHROME_BROWSER_UI_ASH_USER_ACCOUNTS_DELEGATE_CHROMEOS_H_
-
-#include "ash/system/user/user_accounts_delegate.h"
-#include "base/compiler_specific.h"
-#include "base/macros.h"
-#include "google_apis/gaia/oauth2_token_service.h"
-
-class Profile;
-
-namespace chromeos {
-
-class UserAccountsDelegateChromeOS : public ash::tray::UserAccountsDelegate,
-                                     public OAuth2TokenService::Observer {
- public:
-  explicit UserAccountsDelegateChromeOS(Profile* user_profile);
-  ~UserAccountsDelegateChromeOS() override;
-
-  // Overridden from ash::tray::UserAccountsDelegate:
-  std::string GetPrimaryAccountId() override;
-  std::vector<std::string> GetSecondaryAccountIds() override;
-  std::string GetAccountDisplayName(const std::string& account_id) override;
-  void DeleteAccount(const std::string& account_id) override;
-  void LaunchAddAccountDialog() override;
-
-  // Overridden from OAuth2TokenServiceObserver:
-  void OnRefreshTokenAvailable(const std::string& account_id) override;
-  void OnRefreshTokenRevoked(const std::string& account_id) override;
-
- private:
-  Profile* user_profile_;
-
-  DISALLOW_COPY_AND_ASSIGN(UserAccountsDelegateChromeOS);
-};
-
-}  // namespace chromeos
-
-#endif  // CHROME_BROWSER_UI_ASH_USER_ACCOUNTS_DELEGATE_CHROMEOS_H_
diff --git a/chrome/browser/ui/autofill/autofill_popup_controller_impl.cc b/chrome/browser/ui/autofill/autofill_popup_controller_impl.cc
index 857811f..1827dc7 100644
--- a/chrome/browser/ui/autofill/autofill_popup_controller_impl.cc
+++ b/chrome/browser/ui/autofill/autofill_popup_controller_impl.cc
@@ -40,7 +40,7 @@
 // The vertical height of a separator in pixels.
 const size_t kSeparatorHeight = 1;
 
-#if !defined(OS_ANDROID)
+#if !defined(OS_ANDROID) || defined(USE_AURA)
 // Size difference between name and label in pixels.
 const int kLabelFontSizeDelta = -2;
 
@@ -62,7 +62,7 @@
   { "jcbCC", IDR_AUTOFILL_CC_GENERIC },
   { "masterCardCC", IDR_AUTOFILL_CC_MASTERCARD },
   { "visaCC", IDR_AUTOFILL_CC_VISA },
-#if defined(OS_ANDROID)
+#if defined(OS_ANDROID) && !defined(USE_AURA)
   { "scanCreditCardIcon", IDR_AUTOFILL_CC_SCAN_NEW },
   { "settings", IDR_AUTOFILL_SETTINGS },
 #endif
@@ -113,7 +113,7 @@
   controller_common_->SetKeyPressCallback(
       base::Bind(&AutofillPopupControllerImpl::HandleKeyPressEvent,
                  base::Unretained(this)));
-#if !defined(OS_ANDROID)
+#if !defined(OS_ANDROID) || defined(USE_AURA)
   label_font_list_ = value_font_list_.DeriveWithSizeDelta(kLabelFontSizeDelta);
   title_font_list_ = value_font_list_.DeriveWithStyle(gfx::Font::BOLD);
 #if defined(OS_MACOSX)
@@ -133,7 +133,7 @@
   DCHECK_EQ(suggestions_.size(), elided_values_.size());
   DCHECK_EQ(suggestions_.size(), elided_labels_.size());
 
-#if !defined(OS_ANDROID)
+#if !defined(OS_ANDROID) || defined(USE_AURA)
   // Android displays the long text with ellipsis using the view attributes.
 
   UpdatePopupBounds();
@@ -310,7 +310,7 @@
 }
 
 void AutofillPopupControllerImpl::UpdateBoundsAndRedrawPopup() {
-#if !defined(OS_ANDROID)
+#if !defined(OS_ANDROID) || defined(USE_AURA)
   // TODO(csharp): Since UpdatePopupBounds can change the position of the popup,
   // the popup could end up jumping from above the element to below it.
   // It is unclear if it is better to keep the popup where it was, or if it
@@ -359,10 +359,10 @@
     }
   }
 
-#if defined(OS_ANDROID)
+#if defined(OS_ANDROID) && !defined(USE_AURA)
   if (result == IDR_AUTOFILL_CC_SCAN_NEW && IsKeyboardAccessoryEnabled())
     result = IDR_AUTOFILL_CC_SCAN_NEW_KEYBOARD_ACCESSORY;
-#endif  // OS_ANDROID
+#endif
 
   return result;
 }
@@ -460,7 +460,7 @@
   return true;
 }
 
-#if !defined(OS_ANDROID)
+#if !defined(OS_ANDROID) || defined(USE_AURA)
 const gfx::FontList& AutofillPopupControllerImpl::GetValueFontListForRow(
     size_t index) const {
   if (suggestions_[index].frontend_id == POPUP_ITEM_ID_WARNING_MESSAGE)
@@ -603,7 +603,7 @@
   view_->InvalidateRow(row);
 }
 
-#if !defined(OS_ANDROID)
+#if !defined(OS_ANDROID) || defined(USE_AURA)
 int AutofillPopupControllerImpl::GetDesiredPopupWidth() const {
   int popup_width = controller_common_->RoundedElementBounds().width();
   for (size_t i = 0; i < GetLineCount(); ++i) {
@@ -657,7 +657,7 @@
 
   popup_bounds_ = controller_common_->GetPopupBounds(popup_width, popup_height);
 }
-#endif  // !defined(OS_ANDROID)
+#endif
 
 WeakPtr<AutofillPopupControllerImpl> AutofillPopupControllerImpl::GetWeakPtr() {
   return weak_ptr_factory_.GetWeakPtr();
diff --git a/chrome/browser/ui/autofill/autofill_popup_controller_impl.h b/chrome/browser/ui/autofill/autofill_popup_controller_impl.h
index e8540419..ecb981d 100644
--- a/chrome/browser/ui/autofill/autofill_popup_controller_impl.h
+++ b/chrome/browser/ui/autofill/autofill_popup_controller_impl.h
@@ -90,7 +90,7 @@
                                   base::string16* title,
                                   base::string16* body) override;
   bool RemoveSuggestion(int list_index) override;
-#if !defined(OS_ANDROID)
+#if !defined(OS_ANDROID) || defined(USE_AURA)
   const gfx::FontList& GetValueFontListForRow(size_t index) const override;
   const gfx::FontList& GetLabelFontList() const override;
 #endif
@@ -133,7 +133,7 @@
   virtual void InvalidateRow(size_t row);
 
   // Protected so tests can access.
-#if !defined(OS_ANDROID)
+#if !defined(OS_ANDROID) || defined(USE_AURA)
   // Calculates the desired width of the popup based on its contents.
   int GetDesiredPopupWidth() const;
 
@@ -157,7 +157,7 @@
   // when the popup is reused it doesn't leak values between uses.
   void ClearState();
 
-#if !defined(OS_ANDROID)
+#if !defined(OS_ANDROID) || defined(USE_AURA)
   // Calculates and sets the bounds of the popup, including placing it properly
   // to prevent it from going off the screen.
   void UpdatePopupBounds();
@@ -180,7 +180,7 @@
   std::vector<base::string16> elided_values_;
   std::vector<base::string16> elided_labels_;
 
-#if !defined(OS_ANDROID)
+#if !defined(OS_ANDROID) || defined(USE_AURA)
   // The fonts for the popup text.
   gfx::FontList value_font_list_;
   gfx::FontList label_font_list_;
diff --git a/chrome/browser/ui/autofill/chrome_autofill_client.cc b/chrome/browser/ui/autofill/chrome_autofill_client.cc
index 43dba05..386b20c 100644
--- a/chrome/browser/ui/autofill/chrome_autofill_client.cc
+++ b/chrome/browser/ui/autofill/chrome_autofill_client.cc
@@ -160,7 +160,7 @@
   autofill::SaveCardBubbleControllerImpl::CreateForWebContents(web_contents());
   autofill::SaveCardBubbleControllerImpl* controller =
       autofill::SaveCardBubbleControllerImpl::FromWebContents(web_contents());
-  controller->SetCallback(callback);
+  controller->InitializeForLocalSave(callback);
   controller->ShowBubble(false);
 #else
   AutofillCCInfoBarDelegate::Create(
@@ -171,8 +171,15 @@
 void ChromeAutofillClient::ConfirmSaveCreditCardToCloud(
     const base::Closure& callback,
     scoped_ptr<base::DictionaryValue> legal_message) {
-  // TODO(bondd): Implement upload UI.
-  ConfirmSaveCreditCardLocally(callback);
+// TODO(bondd): Implement save card bubble for OS_MACOSX.
+#if defined(TOOLKIT_VIEWS) && !defined(OS_MACOSX)
+  // Do lazy initialization of SaveCardBubbleControllerImpl.
+  autofill::SaveCardBubbleControllerImpl::CreateForWebContents(web_contents());
+  autofill::SaveCardBubbleControllerImpl* controller =
+      autofill::SaveCardBubbleControllerImpl::FromWebContents(web_contents());
+  controller->InitializeForUpload(callback, legal_message.Pass());
+  controller->ShowBubble(false);
+#endif
 }
 
 void ChromeAutofillClient::LoadRiskData(
diff --git a/chrome/browser/ui/autofill/save_card_bubble_controller.h b/chrome/browser/ui/autofill/save_card_bubble_controller.h
index 75ae33b..cfde68a 100644
--- a/chrome/browser/ui/autofill/save_card_bubble_controller.h
+++ b/chrome/browser/ui/autofill/save_card_bubble_controller.h
@@ -6,6 +6,7 @@
 #define CHROME_BROWSER_UI_AUTOFILL_SAVE_CARD_BUBBLE_CONTROLLER_H_
 
 #include "base/macros.h"
+#include "base/strings/string16.h"
 
 namespace autofill {
 
@@ -14,6 +15,13 @@
 // Interface that exposes controller functionality to SaveCardBubbleView.
 class SaveCardBubbleController {
  public:
+  // Returns the title that should be displayed in the bubble.
+  virtual base::string16 GetWindowTitle() const = 0;
+
+  // Returns the explanatory text that should be displayed in the bubble.
+  // Returns an empty string if no message should be displayed.
+  virtual base::string16 GetExplanatoryMessage() const = 0;
+
   virtual void OnSaveButton() = 0;
   virtual void OnCancelButton() = 0;
   virtual void OnLearnMoreClicked() = 0;
diff --git a/chrome/browser/ui/autofill/save_card_bubble_controller_impl.cc b/chrome/browser/ui/autofill/save_card_bubble_controller_impl.cc
index b7a80429..ceb341b5 100644
--- a/chrome/browser/ui/autofill/save_card_bubble_controller_impl.cc
+++ b/chrome/browser/ui/autofill/save_card_bubble_controller_impl.cc
@@ -11,6 +11,8 @@
 #include "chrome/browser/ui/location_bar/location_bar.h"
 #include "components/autofill/core/common/autofill_constants.h"
 #include "content/public/browser/navigation_details.h"
+#include "grit/components_strings.h"
+#include "ui/base/l10n/l10n_util.h"
 
 DEFINE_WEB_CONTENTS_USER_DATA_KEY(autofill::SaveCardBubbleControllerImpl);
 
@@ -28,7 +30,8 @@
 SaveCardBubbleControllerImpl::SaveCardBubbleControllerImpl(
     content::WebContents* web_contents)
     : content::WebContentsObserver(web_contents),
-      save_card_bubble_view_(nullptr) {
+      save_card_bubble_view_(nullptr),
+      is_uploading_(false) {
   DCHECK(web_contents);
 }
 
@@ -37,11 +40,20 @@
     save_card_bubble_view_->Hide();
 }
 
-void SaveCardBubbleControllerImpl::SetCallback(
+void SaveCardBubbleControllerImpl::InitializeForLocalSave(
     const base::Closure& save_card_callback) {
+  is_uploading_ = false;
   save_card_callback_ = save_card_callback;
 }
 
+void SaveCardBubbleControllerImpl::InitializeForUpload(
+    const base::Closure& save_card_callback,
+    scoped_ptr<base::DictionaryValue> legal_message) {
+  is_uploading_ = true;
+  save_card_callback_ = save_card_callback;
+  // TODO(bondd): Store legal_message here.
+}
+
 void SaveCardBubbleControllerImpl::ShowBubble(bool user_action) {
   DCHECK(!save_card_callback_.is_null());
 
@@ -70,6 +82,18 @@
   return save_card_bubble_view_;
 }
 
+base::string16 SaveCardBubbleControllerImpl::GetWindowTitle() const {
+  return l10n_util::GetStringUTF16(
+      is_uploading_ ? IDS_AUTOFILL_SAVE_CARD_BUBBLE_TITLE_TO_CLOUD
+                    : IDS_AUTOFILL_SAVE_CARD_BUBBLE_TITLE_LOCAL);
+}
+
+base::string16 SaveCardBubbleControllerImpl::GetExplanatoryMessage() const {
+  return is_uploading_ ? l10n_util::GetStringUTF16(
+                             IDS_AUTOFILL_SAVE_CARD_BUBBLE_UPLOAD_EXPLANATION)
+                       : base::string16();
+}
+
 void SaveCardBubbleControllerImpl::OnSaveButton() {
   save_card_callback_.Run();
   save_card_callback_.Reset();
diff --git a/chrome/browser/ui/autofill/save_card_bubble_controller_impl.h b/chrome/browser/ui/autofill/save_card_bubble_controller_impl.h
index 5368b5f..dfcd522 100644
--- a/chrome/browser/ui/autofill/save_card_bubble_controller_impl.h
+++ b/chrome/browser/ui/autofill/save_card_bubble_controller_impl.h
@@ -16,18 +16,22 @@
 
 // Implementation of per-tab class to control the save credit card bubble and
 // Omnibox icon.
-//
-// TODO(bondd): Add text strings so different dialog contents can be shown
-// depending upon whether upstreaming is available.
 class SaveCardBubbleControllerImpl
     : public SaveCardBubbleController,
       public content::WebContentsObserver,
       public content::WebContentsUserData<SaveCardBubbleControllerImpl> {
  public:
-  // |save_card_callback| will be invoked if/when the Save button is pressed.
-  void SetCallback(const base::Closure& save_card_callback);
+  // Sets up the controller for local save. |save_card_callback| will be invoked
+  // if and when the Save button is pressed.
+  void InitializeForLocalSave(const base::Closure& save_card_callback);
 
-  // SetCallback() must be called first.
+  // Sets up the controller for upload. |save_card_callback| will be invoked if
+  // and when the Save button is pressed. The contents of |legal_message| will
+  // be displayed in the bubble.
+  void InitializeForUpload(const base::Closure& save_card_callback,
+                           scoped_ptr<base::DictionaryValue> legal_message);
+
+  // InitializeForLocalSave() or InitializeForUpload() must be called first.
   void ShowBubble(bool user_action);
 
   // Returns true if Omnibox save credit card icon should be visible.
@@ -37,6 +41,8 @@
   SaveCardBubbleView* save_card_bubble_view() const;
 
   // SaveCardBubbleController:
+  base::string16 GetWindowTitle() const override;
+  base::string16 GetExplanatoryMessage() const override;
   void OnSaveButton() override;
   void OnCancelButton() override;
   void OnLearnMoreClicked() override;
@@ -64,6 +70,9 @@
   // show and the icon is not visible.
   base::Closure save_card_callback_;
 
+  // Governs whether the upload or local save version of the UI should be shown.
+  bool is_uploading_;
+
   // Used to measure the amount of time on a page; if it's less than some
   // reasonable limit, then don't close the bubble upon navigation.
   scoped_ptr<base::ElapsedTimer> timer_;
diff --git a/chrome/browser/ui/views/autofill/save_card_bubble_views.cc b/chrome/browser/ui/views/autofill/save_card_bubble_views.cc
index 64d7ae5..e48406e 100644
--- a/chrome/browser/ui/views/autofill/save_card_bubble_views.cc
+++ b/chrome/browser/ui/views/autofill/save_card_bubble_views.cc
@@ -11,6 +11,7 @@
 #include "ui/views/bubble/bubble_frame_view.h"
 #include "ui/views/controls/button/blue_button.h"
 #include "ui/views/controls/button/label_button.h"
+#include "ui/views/controls/label.h"
 #include "ui/views/controls/link.h"
 #include "ui/views/layout/grid_layout.h"
 #include "ui/views/layout/layout_constants.h"
@@ -19,8 +20,8 @@
 
 namespace {
 
-// Fixed width of the column holding the message text.
-const int kWidthOfMessageText = 375;
+// Fixed width of the bubble.
+const int kBubbleWidth = 395;
 
 // TODO(bondd): BubbleManager will eventually move this logic somewhere else,
 // and then kIsOkButtonOnLeftSide can be removed from here and
@@ -63,7 +64,7 @@
 }
 
 base::string16 SaveCardBubbleViews::GetWindowTitle() const {
-  return l10n_util::GetStringUTF16(IDS_AUTOFILL_SAVE_CARD_BUBBLE_TITLE_LOCAL);
+  return controller_->GetWindowTitle();
 }
 
 bool SaveCardBubbleViews::ShouldShowWindowTitle() const {
@@ -93,21 +94,40 @@
 
 void SaveCardBubbleViews::Init() {
   enum {
-    COLUMN_SET_ID_MESSAGE,
+    COLUMN_SET_ID_SPACER,
+    COLUMN_SET_ID_EXPLANATION,
     COLUMN_SET_ID_BUTTONS,
   };
 
   GridLayout* layout = new GridLayout(this);
   SetLayoutManager(layout);
 
-  // Set up ColumnSet that will contain the full-width message text.
+  // Add a column set with padding to establish a minimum width.
+  views::ColumnSet* cs = layout->AddColumnSet(COLUMN_SET_ID_SPACER);
+  cs->AddPaddingColumn(0, kBubbleWidth);
+  layout->StartRow(0, COLUMN_SET_ID_SPACER);
+
   int horizontal_inset = GetBubbleFrameView()->GetTitleInsets().left();
-  views::ColumnSet* cs = layout->AddColumnSet(COLUMN_SET_ID_MESSAGE);
-  cs->AddPaddingColumn(0, horizontal_inset);
-  // TODO(bondd): Current dialog layout has no message text, but future layouts
-  // will. This padding column is used until then to set the dialog width.
-  cs->AddPaddingColumn(1, kWidthOfMessageText);
-  cs->AddPaddingColumn(0, horizontal_inset);
+  // Optionally set up ColumnSet and label that will contain an explanation for
+  // upload.
+  base::string16 explanation = controller_->GetExplanatoryMessage();
+  if (!explanation.empty()) {
+    cs = layout->AddColumnSet(COLUMN_SET_ID_EXPLANATION);
+    cs->AddPaddingColumn(0, horizontal_inset);
+    // Fix the width of the label to ensure it breaks within the preferred size
+    // of the bubble.
+    cs->AddColumn(GridLayout::FILL, GridLayout::FILL, 0, GridLayout::FIXED,
+                  kBubbleWidth - (2 * horizontal_inset), 0);
+    cs->AddPaddingColumn(0, horizontal_inset);
+
+    layout->StartRow(0, COLUMN_SET_ID_EXPLANATION);
+    views::Label* explanation_label = new views::Label(explanation);
+    explanation_label->SetMultiLine(true);
+    explanation_label->SetHorizontalAlignment(gfx::ALIGN_LEFT);
+    layout->AddView(explanation_label);
+
+    layout->AddPaddingRow(0, views::kUnrelatedControlLargeHorizontalSpacing);
+  }
 
   // Set up ColumnSet that will contain the buttons and "learn more" link.
   cs = layout->AddColumnSet(COLUMN_SET_ID_BUTTONS);
diff --git a/chrome/browser/ui/views/frame/global_menu_bar_x11.cc b/chrome/browser/ui/views/frame/global_menu_bar_x11.cc
index b25516c5..b89ede7 100644
--- a/chrome/browser/ui/views/frame/global_menu_bar_x11.cc
+++ b/chrome/browser/ui/views/frame/global_menu_bar_x11.cc
@@ -206,11 +206,11 @@
 
   { MENU_SEPARATOR, MENU_SEPARATOR },
 
-  { IDS_HISTORY_VISITED_LINUX, MENU_DISABLED_ID, TAG_MOST_VISITED_HEADER },
+  { IDS_HISTORY_CLOSED_LINUX, MENU_DISABLED_ID, TAG_RECENTLY_CLOSED_HEADER },
 
   { MENU_SEPARATOR, MENU_SEPARATOR },
 
-  { IDS_HISTORY_CLOSED_LINUX, MENU_DISABLED_ID, TAG_RECENTLY_CLOSED_HEADER },
+  { IDS_HISTORY_VISITED_LINUX, MENU_DISABLED_ID, TAG_MOST_VISITED_HEADER },
 
   { MENU_SEPARATOR, MENU_SEPARATOR },
 
diff --git a/chrome/browser/ui/views/location_bar/icon_label_bubble_view.cc b/chrome/browser/ui/views/location_bar/icon_label_bubble_view.cc
index f6a1d47..3e2148e 100644
--- a/chrome/browser/ui/views/location_bar/icon_label_bubble_view.cc
+++ b/chrome/browser/ui/views/location_bar/icon_label_bubble_view.cc
@@ -49,6 +49,7 @@
   AddChildView(image_);
 
   label_->SetEnabledColor(text_color);
+  label_->SetHorizontalAlignment(gfx::ALIGN_LEFT);
 
   if (elide_in_middle)
     label_->SetElideBehavior(gfx::ELIDE_MIDDLE);
diff --git a/chrome/browser/ui/views/open_pdf_in_reader_bubble_view.cc b/chrome/browser/ui/views/open_pdf_in_reader_bubble_view.cc
index 9ae0edc..99b34a1 100644
--- a/chrome/browser/ui/views/open_pdf_in_reader_bubble_view.cc
+++ b/chrome/browser/ui/views/open_pdf_in_reader_bubble_view.cc
@@ -44,7 +44,6 @@
 
   base::string16 accept_text = model_->GetAcceptButtonText();
   open_in_reader_link_ = new views::Link(accept_text);
-  open_in_reader_link_->SetEnabled(true);
   open_in_reader_link_->set_listener(this);
   layout->StartRow(0, single_column_set_id);
   layout->AddView(open_in_reader_link_);
diff --git a/chrome/browser/ui/webui/media_router/media_router_dialog_controller_impl_browsertest.cc b/chrome/browser/ui/webui/media_router/media_router_dialog_controller_impl_browsertest.cc
index f094cc5..bb81b9a 100644
--- a/chrome/browser/ui/webui/media_router/media_router_dialog_controller_impl_browsertest.cc
+++ b/chrome/browser/ui/webui/media_router/media_router_dialog_controller_impl_browsertest.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "chrome/browser/ui/browser_commands.h"
 #include "chrome/browser/ui/browser_finder.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/browser/ui/webui/media_router/media_router_dialog_controller_impl.h"
@@ -74,20 +75,45 @@
 }
 
 IN_PROC_BROWSER_TEST_F(MediaRouterDialogControllerBrowserTest, Navigate) {
+  {
+    // Wait for the dialog to initialize.
+    TestNavigationObserver nav_observer(media_router_dialog_);
+    nav_observer.Wait();
+  }
+
   // New media router dialog is a constrained window, so the number of
   // tabs is still 1.
   EXPECT_EQ(1, browser()->tab_strip_model()->count());
   EXPECT_EQ(media_router_dialog_, dialog_controller_->GetMediaRouterDialog());
 
-  // Navigate to another URL.
-  content::WebContentsDestroyedWatcher dialog_watcher(media_router_dialog_);
+  {
+    // Navigate to another URL and block until the dialog WebContents has been
+    // destroyed.
+    content::WebContentsDestroyedWatcher dialog_watcher(media_router_dialog_);
+    ui_test_utils::NavigateToURL(browser(), GURL("about:blank"));
+    dialog_watcher.Wait();
+  }
 
-  ui_test_utils::NavigateToURL(browser(), GURL("about:blank"));
+  // Verify that dialog has been removed.
+  EXPECT_FALSE(dialog_controller_->GetMediaRouterDialog());
 
-  // Blocks until the dialog WebContents has been destroyed.
-  dialog_watcher.Wait();
+  // Open the dialog again.
+  EXPECT_TRUE(dialog_controller_->ShowMediaRouterDialog());
+  media_router_dialog_ = dialog_controller_->GetMediaRouterDialog();
+  ASSERT_TRUE(media_router_dialog_);
 
-  // Entry has been removed.
+  {
+    // Wait for the dialog to initialize.
+    TestNavigationObserver nav_observer(media_router_dialog_);
+    nav_observer.Wait();
+
+    // Refresh and block until dialog WebContents has been destroyed.
+    content::WebContentsDestroyedWatcher dialog_watcher(media_router_dialog_);
+    chrome::Reload(browser(), CURRENT_TAB);
+    dialog_watcher.Wait();
+  }
+
+  // Verify that dialog has been removed again.
   EXPECT_FALSE(dialog_controller_->GetMediaRouterDialog());
 }
 
diff --git a/chrome/browser/ui/webui/options/chromeos/internet_options_handler_strings.cc b/chrome/browser/ui/webui/options/chromeos/internet_options_handler_strings.cc
index b50dce0..189cd484 100644
--- a/chrome/browser/ui/webui/options/chromeos/internet_options_handler_strings.cc
+++ b/chrome/browser/ui/webui/options/chromeos/internet_options_handler_strings.cc
@@ -35,6 +35,7 @@
     {"vpnBuiltInProvider", IDS_NETWORK_VPN_BUILT_IN_PROVIDER},
     {"joinOtherNetwork", IDS_OPTIONS_SETTINGS_NETWORK_OTHER},
     {"networkDisabled", IDS_OPTIONS_SETTINGS_NETWORK_DISABLED},
+    {"networkProhibited", IDS_OPTIONS_SETTINGS_NETWORK_PROHIBITED},
     {"turnOffWifi", IDS_OPTIONS_SETTINGS_NETWORK_DISABLE_WIFI},
     {"turnOffWimax", IDS_OPTIONS_SETTINGS_NETWORK_DISABLE_WIMAX},
     {"turnOffCellular", IDS_OPTIONS_SETTINGS_NETWORK_DISABLE_CELLULAR},
diff --git a/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc b/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
index 88a7be4..fbb0ea8 100644
--- a/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
+++ b/chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc
@@ -208,6 +208,12 @@
                                   IDS_SETTINGS_CLEAR_DATA_4WEEKS);
   html_source->AddLocalizedString("clearDataEverything",
                                   IDS_SETTINGS_CLEAR_DATA_EVERYTHING);
+  html_source->AddLocalizedString(
+      "warnAboutNonClearedData",
+      IDS_SETTINGS_CLEAR_DATA_SOME_STUFF_REMAINS);
+  html_source->AddLocalizedString(
+      "clearsSyncedData",
+      IDS_SETTINGS_CLEAR_DATA_CLEARS_SYNCED_DATA);
 }
 
 #if !defined(OS_CHROMEOS)
diff --git a/chrome/browser/usb/usb_tab_helper.cc b/chrome/browser/usb/usb_tab_helper.cc
index 152dd0dae..29f875a1 100644
--- a/chrome/browser/usb/usb_tab_helper.cc
+++ b/chrome/browser/usb/usb_tab_helper.cc
@@ -51,7 +51,7 @@
     scoped_ptr<WebUSBPermissionProvider> permission_provider(
         new WebUSBPermissionProvider(render_frame_host));
     permission_provider->Bind(request.Pass());
-    permission_provider_.set(render_frame_host, permission_provider.Pass());
+    permission_provider_[render_frame_host] = permission_provider.Pass();
   } else {
     it->second->Bind(request.Pass());
   }
diff --git a/chrome/browser/usb/usb_tab_helper.h b/chrome/browser/usb/usb_tab_helper.h
index c2bb342..003f8dd 100644
--- a/chrome/browser/usb/usb_tab_helper.h
+++ b/chrome/browser/usb/usb_tab_helper.h
@@ -5,7 +5,8 @@
 #ifndef CHROME_BROWSER_USB_USB_TAB_HELPER_H_
 #define CHROME_BROWSER_USB_USB_TAB_HELPER_H_
 
-#include "base/containers/scoped_ptr_map.h"
+#include <map>
+
 #include "base/macros.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/browser/web_contents_user_data.h"
@@ -44,8 +45,8 @@
       content::RenderFrameHost* render_frame_host,
       mojo::InterfaceRequest<device::usb::PermissionProvider> request);
 
-  base::ScopedPtrMap<content::RenderFrameHost*,
-                     scoped_ptr<WebUSBPermissionProvider>> permission_provider_;
+  std::map<content::RenderFrameHost*, scoped_ptr<WebUSBPermissionProvider>>
+      permission_provider_;
 
   DISALLOW_COPY_AND_ASSIGN(UsbTabHelper);
 };
diff --git a/chrome/chrome_browser.gypi b/chrome/chrome_browser.gypi
index 62e9b11..d6a9b8e3 100644
--- a/chrome/chrome_browser.gypi
+++ b/chrome/chrome_browser.gypi
@@ -2895,8 +2895,6 @@
       'browser/sync/glue/synced_window_delegate_android.h',
       'browser/sync/glue/synced_window_delegates_getter_android.cc',
       'browser/sync/glue/synced_window_delegates_getter_android.h',
-      'browser/sync/profile_sync_components_factory_impl.cc',
-      'browser/sync/profile_sync_components_factory_impl.h',
       'browser/sync/profile_sync_service_android.cc',
       'browser/sync/profile_sync_service_android.h',
       'browser/sync/profile_sync_service_factory.cc',
diff --git a/chrome/chrome_browser_ui.gypi b/chrome/chrome_browser_ui.gypi
index fdddd1c9..773aeeb 100644
--- a/chrome/chrome_browser_ui.gypi
+++ b/chrome/chrome_browser_ui.gypi
@@ -613,8 +613,6 @@
       'browser/ui/ash/system_tray_delegate_common.h',
       'browser/ui/ash/system_tray_delegate_utils.cc',
       'browser/ui/ash/system_tray_delegate_utils.h',
-      'browser/ui/ash/user_accounts_delegate_chromeos.cc',
-      'browser/ui/ash/user_accounts_delegate_chromeos.h',
       'browser/ui/ash/volume_controller_chromeos.cc',
       'browser/ui/ash/volume_controller_chromeos.h',
       'browser/ui/ash/vpn_delegate_chromeos.cc',
diff --git a/chrome/chrome_common.gypi b/chrome/chrome_common.gypi
index dd9e066..6694cca 100644
--- a/chrome/chrome_common.gypi
+++ b/chrome/chrome_common.gypi
@@ -156,6 +156,8 @@
       'common/extensions/features/chrome_channel_feature_filter.h',
       'common/extensions/features/feature_channel.cc',
       'common/extensions/features/feature_channel.h',
+      'common/extensions/features/feature_util.cc',
+      'common/extensions/features/feature_util.h',
       'common/extensions/image_writer/image_writer_util_mac.cc',
       'common/extensions/image_writer/image_writer_util_mac.h',
       'common/extensions/manifest_handlers/app_icon_color_info.cc',
diff --git a/chrome/chrome_tests_unit.gypi b/chrome/chrome_tests_unit.gypi
index 8cec80c1..1171d043 100644
--- a/chrome/chrome_tests_unit.gypi
+++ b/chrome/chrome_tests_unit.gypi
@@ -13,6 +13,8 @@
       'browser/after_startup_task_utils_unittest.cc',
       'browser/android/bookmarks/partner_bookmarks_shim_unittest.cc',
       'browser/android/contextualsearch/contextual_search_delegate_unittest.cc',
+      'browser/android/data_usage/data_use_tab_model_test_utils.cc',
+      'browser/android/data_usage/data_use_tab_model_test_utils.h',
       'browser/android/data_usage/data_use_tab_model_unittest.cc',
       'browser/android/data_usage/data_use_ui_tab_model_unittest.cc',
       'browser/android/data_usage/external_data_use_observer_unittest.cc',
@@ -227,7 +229,6 @@
       'browser/sync/glue/search_engine_data_type_controller_unittest.cc',
       'browser/sync/glue/sync_backend_host_impl_unittest.cc',
       'browser/sync/profile_sync_auth_provider_unittest.cc',
-      'browser/sync/profile_sync_components_factory_impl_unittest.cc',
       'browser/sync/profile_sync_service_autofill_unittest.cc',
       'browser/sync/profile_sync_service_bookmark_unittest.cc',
       'browser/sync/profile_sync_service_factory_unittest.cc',
diff --git a/chrome/common/chrome_content_client.cc b/chrome/common/chrome_content_client.cc
index d4d321cd..12ef5ad 100644
--- a/chrome/common/chrome_content_client.cc
+++ b/chrome/common/chrome_content_client.cc
@@ -63,8 +63,7 @@
 
 #if defined(ENABLE_EXTENSIONS)
 #include "chrome/common/extensions/extension_process_policy.h"
-#include "extensions/common/features/behavior_feature.h"
-#include "extensions/common/features/feature_provider.h"
+#include "chrome/common/extensions/features/feature_util.h"
 #endif
 
 #if defined(ENABLE_PLUGINS)
@@ -627,10 +626,7 @@
 void ChromeContentClient::AddServiceWorkerSchemes(
     std::set<std::string>* schemes) {
 #if defined(ENABLE_EXTENSIONS)
-  if (extensions::FeatureProvider::GetBehaviorFeature(
-          extensions::BehaviorFeature::kServiceWorker)
-          ->IsAvailableToEnvironment()
-          .is_available())
+  if (extensions::feature_util::ExtensionServiceWorkersEnabled())
     schemes->insert(extensions::kExtensionScheme);
 #endif
 }
diff --git a/chrome/common/extensions/features/feature_util.cc b/chrome/common/extensions/features/feature_util.cc
new file mode 100644
index 0000000..76485fd
--- /dev/null
+++ b/chrome/common/extensions/features/feature_util.cc
@@ -0,0 +1,18 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/common/extensions/features/feature_util.h"
+
+#include "chrome/common/extensions/features/feature_channel.h"
+#include "components/version_info/version_info.h"
+
+namespace extensions {
+namespace feature_util {
+
+bool ExtensionServiceWorkersEnabled() {
+  return GetCurrentChannel() == version_info::Channel::UNKNOWN;
+}
+
+}  // namespace feature_util
+}  // namespace extensions
diff --git a/chrome/common/extensions/features/feature_util.h b/chrome/common/extensions/features/feature_util.h
new file mode 100644
index 0000000..c5f456db
--- /dev/null
+++ b/chrome/common/extensions/features/feature_util.h
@@ -0,0 +1,17 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_COMMON_EXTENSIONS_FEATURES_FEATURE_UTIL_H_
+#define CHROME_COMMON_EXTENSIONS_FEATURES_FEATURE_UTIL_H_
+
+namespace extensions {
+namespace feature_util {
+
+// Returns true if service workers are enabled for extension schemes.
+bool ExtensionServiceWorkersEnabled();
+
+}  // namespace feature_util
+}  // namespace extensions
+
+#endif  // CHROME_COMMON_EXTENSIONS_FEATURES_FEATURE_UTIL_H_
diff --git a/chrome/installer/mac/keystone_install.sh b/chrome/installer/mac/keystone_install.sh
index 7673926b..a5dbffe 100755
--- a/chrome/installer/mac/keystone_install.sh
+++ b/chrome/installer/mac/keystone_install.sh
@@ -31,7 +31,7 @@
 # 11  ksadmin failure
 # 12  dirpatcher failed for versioned directory
 # 13  dirpatcher failed for outer .app bundle
-# 14  The update is incompatible with the system
+# 14  The update is incompatible with the system (presently unused)
 #
 # The following exit codes can be used to convey special meaning to Keystone.
 # KeystoneRegistration will present these codes to Chrome as "success."
@@ -454,14 +454,6 @@
   # return value.
 }
 
-has_32_bit_only_cpu() {
-  local cpu_64_bit_capable="$(sysctl -n hw.cpu64bit_capable 2>/dev/null)"
-  [[ -z "${cpu_64_bit_capable}" || "${cpu_64_bit_capable}" -eq 0 ]]
-
-  # The return value of the comparison is used as this function's return
-  # value.
-}
-
 # Runs "defaults read" to obtain the value of a key in a property list. As
 # with "defaults read", an absolute path to a plist is supplied, without the
 # ".plist" extension.
@@ -495,79 +487,6 @@
   __CFPREFERENCES_AVOID_DAEMON=1 defaults read "${@}"
 }
 
-# Adjust the tag to contain the -32bit tag suffix. This is intended to be used
-# as a last resort, if sanity checks show that a non-32-bit update is about to
-# be applied to a 32-bit-only system. If this happens, it means that the
-# server delivered a non-32-bit update to a 32-bit-only system, most likely
-# because the tag was never updated to include the -32bit tag suffix.
-#
-# This mechanism takes a heavy-handed approach, clearing --tag-path and
-# --tag-key so that the channel identity will no longer follow the installed
-# application. However, it's expected that once -32bit is added to the tag,
-# the server will deliver a 32-bit update (possibly the final 32-bit version),
-# and once installed, that update will restore the --tag-path and --tag-key.
-# In any event, channel identity in this case may be moot, if 32-bit builds
-# are no longer being produced.
-#
-# This provides some resilience in the update system for old 32-bit-only
-# systems that aren't used during the window between when the -32bit tag
-# suffix begins being used and 32-bit releases end.
-mark_32_bit_only_system() {
-  local product_id="${1}"
-
-  # This step isn't critical.
-  local set_e=
-  if [[ "${-}" =~ e ]]; then
-    set_e="y"
-    set +e
-  fi
-
-  note "marking 32-bit-only system"
-
-  if ! ksadmin_supports_tagpath_tagkey; then
-    note "couldn't mark 32-bit-only system, no ksadmin support"
-    if [[ -n "${set_e}" ]]; then
-      set -e
-    fi
-    return 0
-  fi
-
-  local current_tag="$(ksadmin --productid "${product_id}" --print-tag)"
-  note "current_tag = ${current_tag}"
-
-  if grep -Eq -- '-32bit(-|$)' <<< "${current_tag}"; then
-    note "current tag already has -32bit"
-    if [[ -n "${set_e}" ]]; then
-      set -e
-    fi
-    return 0
-  fi
-
-  # This clears any other tag suffix, but that shouldn't be a problem. The
-  # only other currently-defined tag suffix component is -full, but -full and
-  # -32bit were introduced at the same time, so if -full appears, whatever set
-  # it would have already had enough knowledge to set -32bit as well, and this
-  # codepath wouldn't be entered.
-  local current_channel="$(sed -e 's/-.*//' <<< "${current_tag}")"
-  local new_tag="${current_channel}-32bit"
-  note "new_tag = ${new_tag}"
-
-  # Using ksadmin without --register only updates specified values in the
-  # ticket, without changing other existing values. Giving empty values for
-  # --tag-path and --tag-key clears those fields.
-  if ! ksadmin --productid "${product_id}" \
-               --tag "${new_tag}" --tag-path '' --tag-key ''; then
-    err "ksadmin failed to mark 32-bit-only system"
-  else
-    note "marked 32-bit-only system"
-  fi
-
-  # Go back to how things were.
-  if [[ -n "${set_e}" ]]; then
-    set -e
-  fi
-}
-
 # When a patch update fails because the old installed copy doesn't match the
 # expected state, mark_failed_patch_update updates the Keystone ticket by
 # adding "-full" to the tag. The server will see this on a subsequent update
@@ -601,10 +520,6 @@
 
   local tag="${channel}"
   local tag_key="${KS_CHANNEL_KEY}"
-  if has_32_bit_only_cpu; then
-    tag="${tag}-32bit"
-    tag_key="${tag_key}-32bit"
-  fi
 
   tag="${tag}-full"
   tag_key="${tag_key}-full"
@@ -1040,34 +955,6 @@
     note "update_versioned_dir = ${update_versioned_dir}"
   fi
 
-  if has_32_bit_only_cpu; then
-    # On a 32-bit-only system, make sure that the update contains 32-bit code.
-    note "system is 32-bit-only"
-
-    local test_binary
-    if [[ -z "${is_patch}" ]]; then
-      # For a full installer, the framework is available, so check it for
-      # 32-bit code.
-      local update_framework_dir="${update_versioned_dir}/${FRAMEWORK_DIR}"
-      test_binary="${update_framework_dir}/${FRAMEWORK_NAME}"
-    else
-      # No application code is guaranteed to be available at this point for a
-      # patch updater, but goobspatch is built alongside and will have the
-      # same bitness of the product that this updater will install, so it's a
-      # reasonable proxy.
-      test_binary="${patch_dir}/goobspatch"
-    fi
-    note "test_binary = ${test_binary}"
-
-    if ! file "${test_binary}" | grep -q 'i386$'; then
-      err "can't install non-32-bit update on 32-bit-only system"
-      mark_32_bit_only_system "${product_id}"
-      exit 14
-    else
-      note "update will run on a 32-bit-only system"
-    fi
-  fi
-
   ensure_writable_symlinks_recursive "${installed_app}"
 
   # By copying to ${installed_app}, the existing application name will be
@@ -1309,10 +1196,6 @@
 
   local tag="${channel}"
   local tag_key="${KS_CHANNEL_KEY}"
-  if has_32_bit_only_cpu; then
-    tag="${tag}-32bit"
-    tag_key="${tag_key}-32bit"
-  fi
   note "tag = ${tag}"
   note "tag_key = ${tag_key}"
 
diff --git a/chrome/installer/util/google_chrome_distribution.cc b/chrome/installer/util/google_chrome_distribution.cc
index 7c0992ca..86e53da9 100644
--- a/chrome/installer/util/google_chrome_distribution.cc
+++ b/chrome/installer/util/google_chrome_distribution.cc
@@ -9,6 +9,7 @@
 
 #include <windows.h>
 #include <msi.h>
+#include <shlobj.h>
 
 #include "base/files/file_path.h"
 #include "base/path_service.h"
@@ -16,6 +17,7 @@
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/win/registry.h"
+#include "base/win/scoped_comptr.h"
 #include "base/win/windows_version.h"
 #include "chrome/common/chrome_icon_resources_win.h"
 #include "chrome/installer/util/app_registration_data.h"
@@ -39,6 +41,8 @@
 const wchar_t kBrowserProgIdDesc[] = L"Chrome HTML Document";
 const wchar_t kCommandExecuteImplUuid[] =
     L"{5C65F4B0-3651-4514-B207-D10CB699B14B}";
+const wchar_t kEdgeAppId[] =
+    L"Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge";
 
 // Substitute the locale parameter in uninstall URL with whatever
 // Google Update tells us is the locale. In case we fail to find
@@ -56,6 +60,33 @@
   return LocalizeUrl(kSurveyUrl);
 }
 
+bool NavigateToUrlWithEdge(const base::string16& url) {
+  base::win::ScopedComPtr<IApplicationActivationManager> activator;
+  DWORD pid = 0;
+  return SUCCEEDED(
+             activator.CreateInstance(CLSID_ApplicationActivationManager)) &&
+         SUCCEEDED(activator->ActivateApplication(kEdgeAppId, url.c_str(),
+                                                  AO_NOERRORUI, &pid));
+}
+
+void NavigateToUrlWithIExplore(const base::string16& url) {
+  base::FilePath iexplore;
+  if (!PathService::Get(base::DIR_PROGRAM_FILES, &iexplore))
+    return;
+
+  iexplore = iexplore.AppendASCII("Internet Explorer");
+  iexplore = iexplore.AppendASCII("iexplore.exe");
+
+  base::string16 command = L"\"" + iexplore.value() + L"\" " + url;
+
+  int pid = 0;
+  // The reason we use WMI to launch the process is because the uninstall
+  // process runs inside a Job object controlled by the shell. As long as there
+  // are processes running, the shell will not close the uninstall applet. WMI
+  // allows us to escape from the Job object so the applet will close.
+  installer::WMIProcess::Launch(command, &pid);
+}
+
 }  // namespace
 
 GoogleChromeDistribution::GoogleChromeDistribution()
@@ -82,41 +113,34 @@
   // need to escape the string before using it in a URL.
   const base::string16 kVersionParam = L"crversion";
   const base::string16 kOSParam = L"os";
-  base::win::OSInfo::VersionNumber version_number =
-      base::win::OSInfo::GetInstance()->version_number();
-  base::string16 os_version = base::StringPrintf(L"%d.%d.%d",
-      version_number.major, version_number.minor, version_number.build);
 
-  base::FilePath iexplore;
-  if (!PathService::Get(base::DIR_PROGRAM_FILES, &iexplore))
-    return;
+  const base::win::OSInfo* os_info = base::win::OSInfo::GetInstance();
+  base::win::OSInfo::VersionNumber version_number = os_info->version_number();
+  base::string16 os_version =
+      base::StringPrintf(L"%d.%d.%d", version_number.major,
+                         version_number.minor, version_number.build);
 
-  iexplore = iexplore.AppendASCII("Internet Explorer");
-  iexplore = iexplore.AppendASCII("iexplore.exe");
-
-  base::string16 command = L"\"" + iexplore.value() + L"\" " +
-      GetUninstallSurveyUrl() +
-      L"&" + kVersionParam + L"=" + base::ASCIIToUTF16(version.GetString()) +
-      L"&" + kOSParam + L"=" + os_version;
+  base::string16 url = GetUninstallSurveyUrl() + L"&" + kVersionParam + L"=" +
+                       base::ASCIIToUTF16(version.GetString()) + L"&" +
+                       kOSParam + L"=" + os_version;
 
   base::string16 uninstall_metrics;
   if (installer::ExtractUninstallMetricsFromFile(local_data_path,
                                                  &uninstall_metrics)) {
     // The user has opted into anonymous usage data collection, so append
     // metrics and distribution data.
-    command += uninstall_metrics;
+    url += uninstall_metrics;
     if (!distribution_data.empty()) {
-      command += L"&";
-      command += distribution_data;
+      url += L"&";
+      url += distribution_data;
     }
   }
 
-  int pid = 0;
-  // The reason we use WMI to launch the process is because the uninstall
-  // process runs inside a Job object controlled by the shell. As long as there
-  // are processes running, the shell will not close the uninstall applet. WMI
-  // allows us to escape from the Job object so the applet will close.
-  installer::WMIProcess::Launch(command, &pid);
+  if (os_info->version() >= base::win::VERSION_WIN10 &&
+      NavigateToUrlWithEdge(url)) {
+    return;
+  }
+  NavigateToUrlWithIExplore(url);
 }
 
 base::string16 GoogleChromeDistribution::GetActiveSetupGuid() {
diff --git a/chrome/renderer/autofill/form_autofill_browsertest.cc b/chrome/renderer/autofill/form_autofill_browsertest.cc
index 227e244..dc2f1d1 100644
--- a/chrome/renderer/autofill/form_autofill_browsertest.cc
+++ b/chrome/renderer/autofill/form_autofill_browsertest.cc
@@ -26,7 +26,6 @@
 #include "third_party/WebKit/public/web/WebInputElement.h"
 #include "third_party/WebKit/public/web/WebLocalFrame.h"
 #include "third_party/WebKit/public/web/WebSelectElement.h"
-#include "third_party/WebKit/public/web/WebTextAreaElement.h"
 
 using base::ASCIIToUTF16;
 using blink::WebDocument;
@@ -38,7 +37,6 @@
 using blink::WebInputElement;
 using blink::WebSelectElement;
 using blink::WebString;
-using blink::WebTextAreaElement;
 using blink::WebVector;
 
 namespace autofill {
@@ -544,7 +542,8 @@
 
     // Get the textarea element we want to find.
     WebElement element = web_frame->document().getElementById("street-address");
-    WebTextAreaElement textarea_element = element.to<WebTextAreaElement>();
+    WebFormControlElement textarea_element =
+        element.to<WebFormControlElement>();
 
     // Find the form and verify it's the correct form.
     FormData form;
@@ -1375,7 +1374,7 @@
 
   static WebString GetValueWrapper(WebFormControlElement element) {
     if (element.formControlType() == "textarea")
-      return element.to<WebTextAreaElement>().value();
+      return element.to<WebFormControlElement>().value();
 
     if (element.formControlType() == "select-one")
       return element.to<WebSelectElement>().value();
@@ -1385,7 +1384,7 @@
 
   static WebString GetSuggestedValueWrapper(WebFormControlElement element) {
     if (element.formControlType() == "textarea")
-      return element.to<WebTextAreaElement>().suggestedValue();
+      return element.to<WebFormControlElement>().suggestedValue();
 
     if (element.formControlType() == "select-one")
       return element.to<WebSelectElement>().suggestedValue();
diff --git a/chrome/renderer/autofill/page_click_tracker_browsertest.cc b/chrome/renderer/autofill/page_click_tracker_browsertest.cc
index 104ef993..d901ffa8 100644
--- a/chrome/renderer/autofill/page_click_tracker_browsertest.cc
+++ b/chrome/renderer/autofill/page_click_tracker_browsertest.cc
@@ -13,7 +13,6 @@
 #include "third_party/WebKit/public/web/WebDocument.h"
 #include "third_party/WebKit/public/web/WebInputElement.h"
 #include "third_party/WebKit/public/web/WebSettings.h"
-#include "third_party/WebKit/public/web/WebTextAreaElement.h"
 #include "third_party/WebKit/public/web/WebView.h"
 #include "ui/events/keycodes/keyboard_codes.h"
 
diff --git a/chrome/renderer/extensions/chrome_extensions_dispatcher_delegate.cc b/chrome/renderer/extensions/chrome_extensions_dispatcher_delegate.cc
index 44bc83b8..03558f6 100644
--- a/chrome/renderer/extensions/chrome_extensions_dispatcher_delegate.cc
+++ b/chrome/renderer/extensions/chrome_extensions_dispatcher_delegate.cc
@@ -11,6 +11,7 @@
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/crash_keys.h"
 #include "chrome/common/extensions/features/feature_channel.h"
+#include "chrome/common/extensions/features/feature_util.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/grit/renderer_resources.h"
 #include "chrome/renderer/extensions/app_bindings.h"
@@ -261,7 +262,7 @@
 
 void ChromeExtensionsDispatcherDelegate::SetChannel(int channel) {
   extensions::SetCurrentChannel(static_cast<version_info::Channel>(channel));
-  if (extensions::GetCurrentChannel() == version_info::Channel::UNKNOWN) {
+  if (extensions::feature_util::ExtensionServiceWorkersEnabled()) {
     // chrome-extension: resources should be allowed to register ServiceWorkers.
     blink::WebSecurityPolicy::registerURLSchemeAsAllowingServiceWorkers(
         blink::WebString::fromUTF8(extensions::kExtensionScheme));
diff --git a/chrome/test/android/javatests/src/org/chromium/chrome/test/MultiActivityTestBase.java b/chrome/test/android/javatests/src/org/chromium/chrome/test/MultiActivityTestBase.java
index 311b6d0..ab5b3db 100644
--- a/chrome/test/android/javatests/src/org/chromium/chrome/test/MultiActivityTestBase.java
+++ b/chrome/test/android/javatests/src/org/chromium/chrome/test/MultiActivityTestBase.java
@@ -37,6 +37,10 @@
         })
 public abstract class MultiActivityTestBase extends InstrumentationTestCase
         implements Parameterizable {
+    // This extended wait is to deal with slow devices trying to start up Activities on slow debug
+    // builds (crbug.com/556902).
+    public static final long DEFAULT_MAX_TIME_TO_POLL_FOR_ACTIVITY_MS = 10000;
+
     protected static final String URL_1 = createTestUrl(1);
     protected static final String URL_2 = createTestUrl(2);
     protected static final String URL_3 = createTestUrl(3);
diff --git a/chrome/test/base/testing_profile.h b/chrome/test/base/testing_profile.h
index 7c3eb34a..e47926be 100644
--- a/chrome/test/base/testing_profile.h
+++ b/chrome/test/base/testing_profile.h
@@ -323,6 +323,14 @@
     profile_name_ = profile_name;
   }
 
+ private:
+  // We use a temporary directory to store testing profile data. This
+  // must be declared before anything that may make use of the
+  // directory so as to ensure files are closed before cleanup.  In a
+  // multi-profile environment, this is invalid and the directory is
+  // managed by the TestingProfileManager.
+  base::ScopedTempDir temp_dir_;
+
  protected:
   base::Time start_time_;
   scoped_ptr<syncable_prefs::PrefServiceSyncable> prefs_;
@@ -377,10 +385,6 @@
   // The proxy prefs tracker.
   scoped_ptr<PrefProxyConfigTracker> pref_proxy_config_tracker_;
 
-  // We use a temporary directory to store testing profile data. In a multi-
-  // profile environment, this is invalid and the directory is managed by the
-  // TestingProfileManager.
-  base::ScopedTempDir temp_dir_;
   // The path to this profile. This will be valid in either of the two above
   // cases.
   base::FilePath profile_path_;
diff --git a/chrome/test/chromedriver/window_commands.cc b/chrome/test/chromedriver/window_commands.cc
index 8f6a415..493cc48 100644
--- a/chrome/test/chromedriver/window_commands.cc
+++ b/chrome/test/chromedriver/window_commands.cc
@@ -402,13 +402,7 @@
     WebView* web_view,
     const base::DictionaryValue& params,
     scoped_ptr<base::Value>* value) {
-  const char kGetTitleScript[] =
-      "function() {"
-      "  if (document.title)"
-      "    return document.title;"
-      "  else"
-      "    return document.URL;"
-      "}";
+  const char kGetTitleScript[] = "function() {  return document.title;}";
   base::ListValue args;
   return web_view->CallFunction(std::string(), kGetTitleScript, args, value);
 }
diff --git a/chrome/test/data/extensions/api_test/automation/tests/tabs/attributes.js b/chrome/test/data/extensions/api_test/automation/tests/tabs/attributes.js
index 0e0595e..a42184c 100644
--- a/chrome/test/data/extensions/api_test/automation/tests/tabs/attributes.js
+++ b/chrome/test/data/extensions/api_test/automation/tests/tabs/attributes.js
@@ -93,12 +93,12 @@
       }
     }
     var input = textFields[0];
-    assertEq('text-input', input.description);
+    assertEq('text-input', input.name);
     assertEq(2, input.textSelStart);
     assertEq(8, input.textSelEnd);
 
     var textArea = textFields[1];
-    assertEq('textarea', textArea.description);
+    assertEq('textarea', textArea.name);
     for (var i = 0; i < EditableTextAttributes.length; i++) {
       var attribute = EditableTextAttributes[i];
       assertTrue(attribute in textArea,
@@ -108,7 +108,7 @@
     assertEq(0, textArea.textSelEnd);
 
     var ariaTextbox = textFields[2];
-    assertEq('textbox-role', ariaTextbox.description);
+    assertEq('textbox-role', ariaTextbox.name);
     assertEq(0, ariaTextbox.textSelStart);
     assertEq(0, ariaTextbox.textSelEnd);
 
@@ -122,7 +122,7 @@
     assertEq(1, spinButtons.length);
     var progressIndicators = rootNode.findAll({ role: 'progressIndicator' });
     assertEq(1, progressIndicators.length);
-    assertEq('progressbar-role', progressIndicators[0].description);
+    assertEq('progressbar-role', progressIndicators[0].name);
     var scrollBars = rootNode.findAll({ role: 'scrollBar' });
     assertEq(1, scrollBars.length);
 
@@ -140,13 +140,13 @@
     }
 
     var inputRange = sliders[0];
-    assertEq('range-input', inputRange.description);
+    assertEq('range-input', inputRange.name);
     assertEq(4, inputRange.valueForRange);
     assertEq(0, inputRange.minValueForRange);
     assertEq(5, inputRange.maxValueForRange);
 
     var ariaSlider = sliders[1];
-    assertEq('slider-role', ariaSlider.description);
+    assertEq('slider-role', ariaSlider.name);
     assertEq(7, ariaSlider.valueForRange);
     assertEq(1, ariaSlider.minValueForRange);
     assertEq(10, ariaSlider.maxValueForRange);
@@ -221,7 +221,7 @@
   },
 
   function testNoAttributes() {
-    var div = rootNode.find({ attributes: { description: 'main' } });
+    var div = rootNode.find({ attributes: { name: 'main' } });
     assertTrue(div !== undefined);
     var allAttributes = [].concat(ActiveDescendantAttribute,
                               LinkAttributes,
diff --git a/chrome/test/data/extensions/api_test/automation/tests/tabs/find.js b/chrome/test/data/extensions/api_test/automation/tests/tabs/find.js
index f171206..07b1f61 100644
--- a/chrome/test/data/extensions/api_test/automation/tests/tabs/find.js
+++ b/chrome/test/data/extensions/api_test/automation/tests/tabs/find.js
@@ -126,7 +126,7 @@
     assertEq(null, rootNode.find({ attributes: { name: 'ok' }}));
 
     // Find by value attribute - regexp.
-    var query = { attributes: { value: /relationship/ }};
+    var query = { attributes: { name: /relationship/ }};
     assertEq(p2, rootNode.find(query).parent);
 
     // Find by role and hierarchicalLevel attribute.
@@ -165,12 +165,12 @@
     var p2StaticText = p2.firstChild;
     assertTrue(
         p2StaticText.matches({ role: RoleType.staticText,
-                               attributes: { value: /relationship/ } }),
-        'p2StaticText should match value: /relationship/ (regex match)');
+                               attributes: { name: /relationship/ } }),
+        'p2StaticText should match name: /relationship/ (regex match)');
     assertFalse(
         p2StaticText.matches({ role: RoleType.staticText,
-                               attributes: { value: 'relationship' } }),
-      'p2 should not match value: \'relationship');
+                               attributes: { name: 'relationship' } }),
+      'p2 should not match name: \'relationship');
 
     chrome.test.succeed();
   }
diff --git a/chrome/test/data/extensions/api_test/automation/tests/tabs/sanity_check.js b/chrome/test/data/extensions/api_test/automation/tests/tabs/sanity_check.js
index b0c8846..553c86d 100644
--- a/chrome/test/data/extensions/api_test/automation/tests/tabs/sanity_check.js
+++ b/chrome/test/data/extensions/api_test/automation/tests/tabs/sanity_check.js
@@ -37,8 +37,7 @@
     state = RemoveUntestedStates(okButton.state);
     assertEq({enabled: true, focusable: true, readOnly: true}, state);
     var userNameInput = contentChildren[1];
-    assertEq('Username',
-             userNameInput.description);
+    assertEq('Username', userNameInput.name);
     state = RemoveUntestedStates(userNameInput.state);
     assertEq({editable: true, enabled: true, focusable: true}, state);
     var cancelButton = contentChildren[2];
diff --git a/chrome/test/data/webui/settings/cr_settings_browsertest.js b/chrome/test/data/webui/settings/cr_settings_browsertest.js
index 4ca1b9c1..848814c 100644
--- a/chrome/test/data/webui/settings/cr_settings_browsertest.js
+++ b/chrome/test/data/webui/settings/cr_settings_browsertest.js
@@ -29,6 +29,7 @@
   /** @override */
   extraLibraries: PolymerTest.getLibraries(ROOT_PATH).concat([
     'checkbox_tests.js',
+    'pref_util_tests.js',
     'prefs_test_cases.js',
     'prefs_tests.js',
   ]),
@@ -48,6 +49,7 @@
 TEST_F('CrSettingsBrowserTest', 'MAYBE_CrSettingsTest', function() {
   // Register mocha tests for each element.
   settings_checkbox.registerTests();
+  settings_prefUtil.registerTests();
   settings_prefs.registerTests();
 
   // Run all registered tests.
diff --git a/chrome/test/data/webui/settings/pref_util_tests.js b/chrome/test/data/webui/settings/pref_util_tests.js
new file mode 100644
index 0000000..43d8042
--- /dev/null
+++ b/chrome/test/data/webui/settings/pref_util_tests.js
@@ -0,0 +1,92 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/** @fileoverview Suite of tests for Settings.PrefUtil. */
+cr.define('settings_prefUtil', function() {
+  function registerTests() {
+    suite('PrefUtil', function() {
+      // Import source before running suite.
+      suiteSetup(function() {
+        return PolymerTest.importHtml(
+            'chrome://md-settings/prefs/pref_util.html');
+      });
+
+      // Tests that the given value is converted to the expected value, for a
+      // given prefType.
+      var expectStringToPrefValue = function(value, prefType, expectedValue) {
+        var pref = /** @type {PrefObject} */({type: prefType});
+        expectEquals(expectedValue,
+                     Settings.PrefUtil.stringToPrefValue(value, pref));
+      };
+
+      test('stringToPrefValue', function testStringToPrefValue() {
+        expectStringToPrefValue(
+            'true', chrome.settingsPrivate.PrefType.BOOLEAN, true);
+
+        expectStringToPrefValue(
+            'false', chrome.settingsPrivate.PrefType.BOOLEAN, false);
+
+        expectStringToPrefValue(
+            '42', chrome.settingsPrivate.PrefType.NUMBER, 42);
+
+        expectStringToPrefValue(
+            'Foo Bar', chrome.settingsPrivate.PrefType.STRING, 'Foo Bar');
+
+        var url = 'http://example.com';
+        expectStringToPrefValue(url, chrome.settingsPrivate.PrefType.URL, url);
+
+        try {
+          expectStringToPrefValue(
+              '[1, 2]', chrome.settingsPrivate.PrefType.LIST, '');
+          expectNotReached('List prefs should not be converted.');
+        } catch (e) {}
+
+        try {
+          expectStringToPrefValue(
+              '{foo: 1}', chrome.settingsPrivate.PrefType.DICTIONARY, '');
+          expectNotReached('Dictionary prefs should not be converted.');
+        } catch (e) {}
+      });
+
+      // Tests that the pref value is converted to the expected string, for a
+      // given prefType.
+      var expectPrefToString = function(prefType, prefValue, expectedValue) {
+        var pref = /** @type {PrefObject} */({
+          type: prefType,
+          value: prefValue,
+        });
+        expectEquals(expectedValue, Settings.PrefUtil.prefToString(pref));
+      };
+
+      test('prefToString', function testPrefToString() {
+        expectPrefToString(chrome.settingsPrivate.PrefType.BOOLEAN,
+                           false, 'false');
+
+        expectPrefToString(chrome.settingsPrivate.PrefType.NUMBER, 42, '42');
+
+        expectPrefToString(chrome.settingsPrivate.PrefType.STRING,
+                           'Foo Bar', 'Foo Bar');
+
+        var url = 'http://example.com';
+        expectPrefToString(chrome.settingsPrivate.PrefType.URL, url, url);
+
+        try {
+          expectPrefToString(chrome.settingsPrivate.PrefType.LIST,
+                             [1, 2], null);
+          expectNotReached('List prefs should not be handled.');
+        } catch (e) {}
+
+        try {
+          expectPrefToString(chrome.settingsPrivate.PrefType.DICTIONARY,
+                             {foo: 1}, null);
+          expectNotReached('Dictionary prefs should not be handled.');
+        } catch (e) {}
+      });
+    });
+  }
+
+  return {
+    registerTests: registerTests,
+  };
+});
diff --git a/chromeos/dbus/debug_daemon_client.cc b/chromeos/dbus/debug_daemon_client.cc
index 480494f..125dcb3 100644
--- a/chromeos/dbus/debug_daemon_client.cc
+++ b/chromeos/dbus/debug_daemon_client.cc
@@ -147,19 +147,6 @@
   }
 
   void GetPerfOutput(uint32_t duration,
-                     const GetPerfOutputCallback& callback) override {
-    dbus::MethodCall method_call(debugd::kDebugdInterface,
-                                 debugd::kGetRandomPerfOutput);
-    dbus::MessageWriter writer(&method_call);
-    writer.AppendUint32(duration);
-
-    debugdaemon_proxy_->CallMethod(
-        &method_call, dbus::ObjectProxy::TIMEOUT_USE_DEFAULT,
-        base::Bind(&DebugDaemonClientImpl::OnGetPerfOutput,
-                   weak_ptr_factory_.GetWeakPtr(), callback));
-  }
-
-  void GetPerfOutput(uint32_t duration,
                      const std::vector<std::string>& perf_args,
                      const GetPerfOutputCallback& callback) override {
     dbus::MethodCall method_call(debugd::kDebugdInterface,
diff --git a/chromeos/dbus/debug_daemon_client.h b/chromeos/dbus/debug_daemon_client.h
index 0950e90..86427a2 100644
--- a/chromeos/dbus/debug_daemon_client.h
+++ b/chromeos/dbus/debug_daemon_client.h
@@ -94,11 +94,6 @@
                           const std::vector<uint8>& perf_data,
                           const std::vector<uint8>& perf_stat)>;
 
-  // Runs perf for |duration| seconds and returns data collected.
-  // TODO(dhsharp): Remove this overload.
-  virtual void GetPerfOutput(uint32_t duration,
-                             const GetPerfOutputCallback& callback) = 0;
-
   // Runs perf with arguments for |duration| seconds and returns data collected.
   virtual void GetPerfOutput(uint32_t duration,
                              const std::vector<std::string>& perf_args,
diff --git a/chromeos/dbus/fake_debug_daemon_client.cc b/chromeos/dbus/fake_debug_daemon_client.cc
index 56f0bb5..8dd391c 100644
--- a/chromeos/dbus/fake_debug_daemon_client.cc
+++ b/chromeos/dbus/fake_debug_daemon_client.cc
@@ -82,16 +82,6 @@
 
 void FakeDebugDaemonClient::GetPerfOutput(
     uint32_t duration,
-    const GetPerfOutputCallback& callback) {
-  int status = 0;
-  std::vector<uint8> perf_data;
-  std::vector<uint8> perf_stat;
-  base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, base::Bind(callback, status, perf_data, perf_stat));
-}
-
-void FakeDebugDaemonClient::GetPerfOutput(
-    uint32_t duration,
     const std::vector<std::string>& perf_args,
     const GetPerfOutputCallback& callback) {
   int status = 0;
diff --git a/chromeos/dbus/fake_debug_daemon_client.h b/chromeos/dbus/fake_debug_daemon_client.h
index c101656..6f75e59 100644
--- a/chromeos/dbus/fake_debug_daemon_client.h
+++ b/chromeos/dbus/fake_debug_daemon_client.h
@@ -40,8 +40,6 @@
   void GetNetworkInterfaces(
       const GetNetworkInterfacesCallback& callback) override;
   void GetPerfOutput(uint32_t duration,
-                     const GetPerfOutputCallback& callback) override;
-  void GetPerfOutput(uint32_t duration,
                      const std::vector<std::string>& perf_args,
                      const GetPerfOutputCallback& callback) override;
   void GetScrubbedLogs(const GetLogsCallback& callback) override;
diff --git a/chromeos/network/network_state_handler.cc b/chromeos/network/network_state_handler.cc
index 5007837..e2ea522 100644
--- a/chromeos/network/network_state_handler.cc
+++ b/chromeos/network/network_state_handler.cc
@@ -114,6 +114,8 @@
     state = TECHNOLOGY_ENABLED;
   else if (shill_property_handler_->IsTechnologyEnabling(technology))
     state = TECHNOLOGY_ENABLING;
+  else if (shill_property_handler_->IsTechnologyProhibited(technology))
+    state = TECHNOLOGY_PROHIBITED;
   else if (shill_property_handler_->IsTechnologyUninitialized(technology))
     state = TECHNOLOGY_UNINITIALIZED;
   else if (shill_property_handler_->IsTechnologyAvailable(technology))
diff --git a/chromeos/network/network_state_handler.h b/chromeos/network/network_state_handler.h
index a700f821..7dd422c 100644
--- a/chromeos/network/network_state_handler.h
+++ b/chromeos/network/network_state_handler.h
@@ -74,7 +74,8 @@
     TECHNOLOGY_AVAILABLE,
     TECHNOLOGY_UNINITIALIZED,
     TECHNOLOGY_ENABLING,
-    TECHNOLOGY_ENABLED
+    TECHNOLOGY_ENABLED,
+    TECHNOLOGY_PROHIBITED
   };
 
   ~NetworkStateHandler() override;
@@ -94,6 +95,9 @@
   bool IsTechnologyEnabled(const NetworkTypePattern& type) const {
     return GetTechnologyState(type) == TECHNOLOGY_ENABLED;
   }
+  bool IsTechnologyProhibited(const NetworkTypePattern& type) const {
+    return GetTechnologyState(type) == TECHNOLOGY_PROHIBITED;
+  }
 
   // Asynchronously sets the technology enabled property for |type|. Only
   // NetworkTypePattern::Primitive, ::Mobile and ::Ethernet are supported.
diff --git a/chromeos/network/shill_property_handler.cc b/chromeos/network/shill_property_handler.cc
index eb73b832..41482be 100644
--- a/chromeos/network/shill_property_handler.cc
+++ b/chromeos/network/shill_property_handler.cc
@@ -143,6 +143,11 @@
   return enabling_technologies_.count(technology) != 0;
 }
 
+bool ShillPropertyHandler::IsTechnologyProhibited(
+    const std::string& technology) const {
+  return prohibited_technologies_.count(technology) != 0;
+}
+
 bool ShillPropertyHandler::IsTechnologyUninitialized(
     const std::string& technology) const {
   return uninitialized_technologies_.count(technology) != 0;
diff --git a/chromeos/network/shill_property_handler.h b/chromeos/network/shill_property_handler.h
index d88ac28..b4b6202a 100644
--- a/chromeos/network/shill_property_handler.h
+++ b/chromeos/network/shill_property_handler.h
@@ -114,6 +114,7 @@
   bool IsTechnologyAvailable(const std::string& technology) const;
   bool IsTechnologyEnabled(const std::string& technology) const;
   bool IsTechnologyEnabling(const std::string& technology) const;
+  bool IsTechnologyProhibited(const std::string& technology) const;
   bool IsTechnologyUninitialized(const std::string& technology) const;
 
   // Asynchronously sets the enabled state for |technology|.
diff --git a/components/autofill/content/renderer/autofill_agent.cc b/components/autofill/content/renderer/autofill_agent.cc
index f15a5806..ccb18f5 100644
--- a/components/autofill/content/renderer/autofill_agent.cc
+++ b/components/autofill/content/renderer/autofill_agent.cc
@@ -47,7 +47,6 @@
 #include "third_party/WebKit/public/web/WebLocalFrame.h"
 #include "third_party/WebKit/public/web/WebNode.h"
 #include "third_party/WebKit/public/web/WebOptionElement.h"
-#include "third_party/WebKit/public/web/WebTextAreaElement.h"
 #include "third_party/WebKit/public/web/WebUserGestureIndicator.h"
 #include "third_party/WebKit/public/web/WebView.h"
 #include "ui/base/l10n/l10n_util.h"
@@ -67,7 +66,6 @@
 using blink::WebNode;
 using blink::WebOptionElement;
 using blink::WebString;
-using blink::WebTextAreaElement;
 using blink::WebUserGestureIndicator;
 using blink::WebVector;
 
@@ -666,7 +664,7 @@
       return;
   } else {
     DCHECK(form_util::IsTextAreaElement(element));
-    if (!element.toConst<WebTextAreaElement>().suggestedValue().isEmpty())
+    if (!element.toConst<WebFormControlElement>().suggestedValue().isEmpty())
       return;
   }
 
diff --git a/components/autofill/content/renderer/form_autofill_util.cc b/components/autofill/content/renderer/form_autofill_util.cc
index c044532..6cf3b65f 100644
--- a/components/autofill/content/renderer/form_autofill_util.cc
+++ b/components/autofill/content/renderer/form_autofill_util.cc
@@ -32,7 +32,6 @@
 #include "third_party/WebKit/public/web/WebNode.h"
 #include "third_party/WebKit/public/web/WebOptionElement.h"
 #include "third_party/WebKit/public/web/WebSelectElement.h"
-#include "third_party/WebKit/public/web/WebTextAreaElement.h"
 
 using blink::WebDocument;
 using blink::WebElement;
@@ -45,7 +44,6 @@
 using blink::WebNode;
 using blink::WebOptionElement;
 using blink::WebSelectElement;
-using blink::WebTextAreaElement;
 using blink::WebString;
 using blink::WebVector;
 
diff --git a/components/autofill/content/renderer/form_cache.cc b/components/autofill/content/renderer/form_cache.cc
index 2650b439..61fea92 100644
--- a/components/autofill/content/renderer/form_cache.cc
+++ b/components/autofill/content/renderer/form_cache.cc
@@ -20,7 +20,6 @@
 #include "third_party/WebKit/public/web/WebInputElement.h"
 #include "third_party/WebKit/public/web/WebLocalFrame.h"
 #include "third_party/WebKit/public/web/WebSelectElement.h"
-#include "third_party/WebKit/public/web/WebTextAreaElement.h"
 #include "ui/base/l10n/l10n_util.h"
 
 using blink::WebConsoleMessage;
@@ -33,7 +32,6 @@
 using blink::WebNode;
 using blink::WebSelectElement;
 using blink::WebString;
-using blink::WebTextAreaElement;
 using blink::WebVector;
 
 namespace autofill {
diff --git a/components/autofill/content/renderer/page_click_tracker.cc b/components/autofill/content/renderer/page_click_tracker.cc
index c65bd4e..aa16731 100644
--- a/components/autofill/content/renderer/page_click_tracker.cc
+++ b/components/autofill/content/renderer/page_click_tracker.cc
@@ -13,15 +13,16 @@
 #include "third_party/WebKit/public/platform/WebPoint.h"
 #include "third_party/WebKit/public/platform/WebSize.h"
 #include "third_party/WebKit/public/web/WebDocument.h"
+#include "third_party/WebKit/public/web/WebFormControlElement.h"
 #include "third_party/WebKit/public/web/WebHitTestResult.h"
 #include "third_party/WebKit/public/web/WebInputElement.h"
 #include "third_party/WebKit/public/web/WebInputEvent.h"
 #include "third_party/WebKit/public/web/WebLocalFrame.h"
-#include "third_party/WebKit/public/web/WebTextAreaElement.h"
 #include "third_party/WebKit/public/web/WebUserGestureIndicator.h"
 #include "third_party/WebKit/public/web/WebView.h"
 
 using blink::WebElement;
+using blink::WebFormControlElement;
 using blink::WebGestureEvent;
 using blink::WebInputElement;
 using blink::WebInputEvent;
@@ -29,37 +30,22 @@
 using blink::WebNode;
 using blink::WebPoint;
 using blink::WebSize;
-using blink::WebTextAreaElement;
 using blink::WebUserGestureIndicator;
 
 namespace autofill {
 
 namespace {
 
-// Casts |node| to a WebInputElement.
-// Returns an empty (isNull()) WebInputElement if |node| is not a text field.
-const WebInputElement GetTextWebInputElement(const WebNode& node) {
-  if (!node.isElementNode())
-    return WebInputElement();
-  const WebElement element = node.toConst<WebElement>();
-  if (!element.hasHTMLTagName("input"))
-    return WebInputElement();
-  const WebInputElement* input = blink::toWebInputElement(&element);
-  if (!form_util::IsTextInput(input))
-    return WebInputElement();
-  return *input;
-}
-
-// Casts |node| to a WebTextAreaElement.
-// Returns an empty (isNull()) WebTextAreaElement if |node| is not a
-// textarea field.
-const WebTextAreaElement GetWebTextAreaElement(const WebNode& node) {
-  if (!node.isElementNode())
-    return WebTextAreaElement();
-  const WebElement element = node.toConst<WebElement>();
-  if (!element.hasHTMLTagName("textarea"))
-    return WebTextAreaElement();
-  return element.toConst<WebTextAreaElement>();
+// Casts |element| to a WebFormControlElement, but only if it's a text field.
+// Returns an empty (isNull()) wrapper otherwise.
+const WebFormControlElement GetTextFormControlElement(
+    const WebElement& element) {
+  if (!element.isFormControlElement())
+    return WebFormControlElement();
+  if (form_util::IsTextInput(blink::toWebInputElement(&element)) ||
+      element.hasHTMLTagName("textarea"))
+    return element.toConst<WebFormControlElement>();
+  return WebFormControlElement();
 }
 
 }  // namespace
@@ -102,19 +88,13 @@
 }
 
 void PageClickTracker::DoFocusChangeComplete() {
-  WebNode focused_node = render_frame()->GetFocusedElement();
-  if (focused_node_was_last_clicked_ && !focused_node.isNull()) {
-    const WebInputElement input_element = GetTextWebInputElement(focused_node);
-    if (!input_element.isNull()) {
-      listener_->FormControlElementClicked(input_element,
+  WebElement focused_element = render_frame()->GetFocusedElement();
+  if (focused_node_was_last_clicked_ && !focused_element.isNull()) {
+    const WebFormControlElement control =
+        GetTextFormControlElement(focused_element);
+    if (!control.isNull()) {
+      listener_->FormControlElementClicked(control,
                                            was_focused_before_now_);
-    } else {
-      const WebTextAreaElement textarea_element =
-          GetWebTextAreaElement(focused_node);
-      if (!textarea_element.isNull()) {
-        listener_->FormControlElementClicked(textarea_element,
-                                             was_focused_before_now_);
-      }
     }
   }
 
diff --git a/components/autofill/core/common/autofill_switches.cc b/components/autofill/core/common/autofill_switches.cc
index cefd0ecb..63edd24 100644
--- a/components/autofill/core/common/autofill_switches.cc
+++ b/components/autofill/core/common/autofill_switches.cc
@@ -71,10 +71,6 @@
 const char kEnableSuggestionsWithSubstringMatch[] =
     "enable-suggestions-with-substring-match";
 
-// Enables syncing usage counts and last use dates of Wallet addresses and
-// cards.
-const char kEnableWalletMetadataSync[]      = "enable-wallet-metadata-sync";
-
 // Ignores autocomplete="off" for Autofill data (profiles + credit cards).
 const char kIgnoreAutocompleteOffForAutofill[] =
     "ignore-autocomplete-off-autofill";
diff --git a/components/autofill/core/common/autofill_switches.h b/components/autofill/core/common/autofill_switches.h
index 8be409a..1c34827 100644
--- a/components/autofill/core/common/autofill_switches.h
+++ b/components/autofill/core/common/autofill_switches.h
@@ -28,7 +28,6 @@
 extern const char kEnablePasswordGeneration[];
 extern const char kEnableSingleClickAutofill[];
 extern const char kEnableSuggestionsWithSubstringMatch[];
-extern const char kEnableWalletMetadataSync[];
 extern const char kIgnoreAutocompleteOffForAutofill[];
 extern const char kLocalHeuristicsOnlyForPasswordGeneration[];
 extern const char kShowAutofillTypePredictions[];
diff --git a/components/autofill/ios/browser/resources/autofill_controller.js b/components/autofill/ios/browser/resources/autofill_controller.js
index d9b8e6c..16a4684 100644
--- a/components/autofill/ios/browser/resources/autofill_controller.js
+++ b/components/autofill/ios/browser/resources/autofill_controller.js
@@ -2021,22 +2021,21 @@
     __gCrWeb.autofill.getOptionStringsFromElement(element, field);
   }
 
-  if (!extractMask & __gCrWeb.autofill.EXTRACT_MASK_VALUE) {
+  if (!(extractMask & __gCrWeb.autofill.EXTRACT_MASK_VALUE)) {
     return;
   }
 
   var value = __gCrWeb.autofill.value(element);
 
-  if (!__gCrWeb.autofill.isAutofillableInputElement(element)) {
+  if (__gCrWeb.autofill.isSelectElement(element) &&
+      (extractMask & __gCrWeb.autofill.EXTRACT_MASK_OPTION_TEXT)) {
     // Convert the |select_element| value to text if requested.
-    if (extractMask & __gCrWeb.autofill.EXTRACT_MASK_OPTION_TEXT) {
-      var options = element.options;
-      for (var index = 0; index < options.length; ++index) {
-        var optionElement = options[index];
-        if (__gCrWeb.autofill.value(optionElement) === value) {
-          value = optionElement.text;
-          break;
-        }
+    var options = element.options;
+    for (var index = 0; index < options.length; ++index) {
+      var optionElement = options[index];
+      if (__gCrWeb.autofill.value(optionElement) === value) {
+        value = optionElement.text;
+        break;
       }
     }
   }
diff --git a/components/autofill_strings.grdp b/components/autofill_strings.grdp
index db016fe..df969ff 100644
--- a/components/autofill_strings.grdp
+++ b/components/autofill_strings.grdp
@@ -200,6 +200,12 @@
       Do you want Chromium to save this card?
     </message>
   </if>
+  <message name="IDS_AUTOFILL_SAVE_CARD_BUBBLE_TITLE_TO_CLOUD" desc="Title text for the Autofill save card bubble when the card is to be saved by uploading it to Google Payments.">
+    Do you want Google to save this card?
+  </message>
+  <message name="IDS_AUTOFILL_SAVE_CARD_BUBBLE_UPLOAD_EXPLANATION" desc="Explanation of the effect of the Autofill save card bubble when the card is to be saved by uploading it to Google Payments.">
+    Pay quickly on sites and apps across devices using cards you have saved with Google.
+  </message>
 
   <!-- Autofill credit card unmask prompt -->
   <message name="IDS_AUTOFILL_CARD_UNMASK_PROMPT_ERROR_TRY_AGAIN" desc="Error message that encourages the user to try to re-enter their credit card CVC after a previous failed attempt.">
diff --git a/components/browser_sync.gypi b/components/browser_sync.gypi
index e67b03db..03c178a 100644
--- a/components/browser_sync.gypi
+++ b/components/browser_sync.gypi
@@ -14,18 +14,23 @@
         '../net/net.gyp:net',
         '../sync/sync.gyp:sync',
         '../ui/base/ui_base.gyp:ui_base',
+        'autofill_core_browser',
         'autofill_core_common',
         'browser_sync_common',
         'components_strings.gyp:components_strings',
+        'dom_distiller_core',
         'history_core_browser',
         'invalidation_impl',
         'invalidation_public',
         'keyed_service_core',
+        'password_manager_sync_browser',
         'pref_registry',
         'signin_core_browser',
         'syncable_prefs',
+        'sync_bookmarks',
         'sync_driver',
         'sync_sessions',
+        'variations',
         'version_info',
       ],
       'include_dirs': [
@@ -33,6 +38,8 @@
       ],
       'sources': [
         # Note: file list duplicated in GN build.
+        'browser_sync/browser/profile_sync_components_factory_impl.cc',
+        'browser_sync/browser/profile_sync_components_factory_impl.h',
         'browser_sync/browser/profile_sync_service.cc',
         'browser_sync/browser/profile_sync_service.h',
         'browser_sync/browser/signin_confirmation_helper.cc',
diff --git a/components/browser_sync/browser/BUILD.gn b/components/browser_sync/browser/BUILD.gn
index 0966e41..e2123ce 100644
--- a/components/browser_sync/browser/BUILD.gn
+++ b/components/browser_sync/browser/BUILD.gn
@@ -6,6 +6,8 @@
 
 source_set("browser") {
   sources = [
+    "profile_sync_components_factory_impl.cc",
+    "profile_sync_components_factory_impl.h",
     "profile_sync_service.cc",
     "profile_sync_service.h",
     "signin_confirmation_helper.cc",
@@ -15,16 +17,21 @@
   deps = [
     "//base",
     "//base:prefs",
+    "//components/autofill/core/browser",
+    "//components/dom_distiller/core",
     "//components/history/core/browser",
     "//components/invalidation/impl",
     "//components/invalidation/public",
     "//components/keyed_service/core",
+    "//components/password_manager/sync/browser",
     "//components/pref_registry",
     "//components/signin/core/browser",
     "//components/strings",
     "//components/syncable_prefs",
+    "//components/sync_bookmarks",
     "//components/sync_driver",
     "//components/sync_sessions",
+    "//components/variations",
     "//components/version_info",
     "//components/version_info:generate_version_info",
     "//google_apis",
diff --git a/components/browser_sync/browser/DEPS b/components/browser_sync/browser/DEPS
index 4cb7215..23d2595 100644
--- a/components/browser_sync/browser/DEPS
+++ b/components/browser_sync/browser/DEPS
@@ -1,14 +1,18 @@
 include_rules = [
-  "+components/autofill/core/common",
+  "+components/autofill/core",
+  "+components/dom_distiller/core",
   "+components/history/core/browser",
   "+components/invalidation",
   "+components/keyed_service/core",
+  "+components/password_manager/sync/browser",
   "+components/pref_registry",
   "+components/signin/core/browser",
   "+components/syncable_prefs",
+  "+components/sync_bookmarks",
   "+components/sync_driver",
   "+components/sync_sessions",
   "+components/strings",
+  "+components/variations",
   "+components/version_info",
   "+google_apis",
   "+net",
diff --git a/components/browser_sync/browser/profile_sync_components_factory_impl.cc b/components/browser_sync/browser/profile_sync_components_factory_impl.cc
new file mode 100644
index 0000000..cca0b297
--- /dev/null
+++ b/components/browser_sync/browser/profile_sync_components_factory_impl.cc
@@ -0,0 +1,396 @@
+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/browser_sync/browser/profile_sync_components_factory_impl.h"
+
+#include "base/command_line.h"
+#include "base/memory/ref_counted.h"
+#include "base/prefs/pref_service.h"
+#include "build/build_config.h"
+#include "components/autofill/core/browser/autofill_wallet_data_type_controller.h"
+#include "components/autofill/core/browser/webdata/autofill_data_type_controller.h"
+#include "components/autofill/core/browser/webdata/autofill_profile_data_type_controller.h"
+#include "components/autofill/core/common/autofill_pref_names.h"
+#include "components/autofill/core/common/autofill_switches.h"
+#include "components/browser_sync/browser/profile_sync_service.h"
+#include "components/browser_sync/common/browser_sync_switches.h"
+#include "components/dom_distiller/core/dom_distiller_features.h"
+#include "components/history/core/browser/history_delete_directives_data_type_controller.h"
+#include "components/history/core/browser/typed_url_change_processor.h"
+#include "components/history/core/browser/typed_url_data_type_controller.h"
+#include "components/history/core/browser/typed_url_model_associator.h"
+#include "components/password_manager/sync/browser/password_data_type_controller.h"
+#include "components/sync_bookmarks/bookmark_change_processor.h"
+#include "components/sync_bookmarks/bookmark_data_type_controller.h"
+#include "components/sync_bookmarks/bookmark_model_associator.h"
+#include "components/sync_driver/data_type_manager_impl.h"
+#include "components/sync_driver/device_info_data_type_controller.h"
+#include "components/sync_driver/glue/chrome_report_unrecoverable_error.h"
+#include "components/sync_driver/glue/sync_backend_host.h"
+#include "components/sync_driver/glue/sync_backend_host_impl.h"
+#include "components/sync_driver/local_device_info_provider_impl.h"
+#include "components/sync_driver/proxy_data_type_controller.h"
+#include "components/sync_driver/sync_client.h"
+#include "components/sync_driver/ui_data_type_controller.h"
+#include "components/sync_sessions/session_data_type_controller.h"
+#include "google_apis/gaia/oauth2_token_service.h"
+#include "google_apis/gaia/oauth2_token_service_request.h"
+#include "net/url_request/url_request_context_getter.h"
+#include "sync/internal_api/public/attachments/attachment_downloader.h"
+#include "sync/internal_api/public/attachments/attachment_service.h"
+#include "sync/internal_api/public/attachments/attachment_service_impl.h"
+#include "sync/internal_api/public/attachments/attachment_uploader_impl.h"
+
+using bookmarks::BookmarkModel;
+using browser_sync::AutofillDataTypeController;
+using browser_sync::AutofillProfileDataTypeController;
+using browser_sync::BookmarkChangeProcessor;
+using browser_sync::BookmarkDataTypeController;
+using browser_sync::BookmarkModelAssociator;
+using browser_sync::ChromeReportUnrecoverableError;
+using browser_sync::HistoryDeleteDirectivesDataTypeController;
+using browser_sync::PasswordDataTypeController;
+using browser_sync::SessionDataTypeController;
+using browser_sync::SyncBackendHost;
+using browser_sync::TypedUrlChangeProcessor;
+using browser_sync::TypedUrlDataTypeController;
+using browser_sync::TypedUrlModelAssociator;
+using sync_driver::DataTypeController;
+using sync_driver::DataTypeErrorHandler;
+using sync_driver::DataTypeManager;
+using sync_driver::DataTypeManagerImpl;
+using sync_driver::DataTypeManagerObserver;
+using sync_driver::DeviceInfoDataTypeController;
+using sync_driver::ProxyDataTypeController;
+using sync_driver::UIDataTypeController;
+
+namespace {
+
+syncer::ModelTypeSet GetDisabledTypesFromCommandLine(
+    const base::CommandLine& command_line) {
+  syncer::ModelTypeSet disabled_types;
+  std::string disabled_types_str =
+      command_line.GetSwitchValueASCII(switches::kDisableSyncTypes);
+
+  disabled_types = syncer::ModelTypeSetFromString(disabled_types_str);
+  return disabled_types;
+}
+
+syncer::ModelTypeSet GetEnabledTypesFromCommandLine(
+    const base::CommandLine& command_line) {
+  return syncer::ModelTypeSet();
+}
+
+}  // namespace
+
+ProfileSyncComponentsFactoryImpl::ProfileSyncComponentsFactoryImpl(
+    sync_driver::SyncClient* sync_client,
+    version_info::Channel channel,
+    const std::string& version,
+    bool is_tablet,
+    const base::CommandLine& command_line,
+    const char* history_disabled_pref,
+    const GURL& sync_service_url,
+    const scoped_refptr<base::SingleThreadTaskRunner>& ui_thread,
+    const scoped_refptr<base::SingleThreadTaskRunner>& db_thread,
+    OAuth2TokenService* token_service,
+    net::URLRequestContextGetter* url_request_context_getter)
+    : sync_client_(sync_client),
+      channel_(channel),
+      version_(version),
+      is_tablet_(is_tablet),
+      command_line_(command_line),
+      history_disabled_pref_(history_disabled_pref),
+      sync_service_url_(sync_service_url),
+      ui_thread_(ui_thread),
+      db_thread_(db_thread),
+      token_service_(token_service),
+      url_request_context_getter_(url_request_context_getter),
+      weak_factory_(this) {
+  DCHECK(token_service_);
+  DCHECK(url_request_context_getter_);
+}
+
+ProfileSyncComponentsFactoryImpl::~ProfileSyncComponentsFactoryImpl() {}
+
+void ProfileSyncComponentsFactoryImpl::RegisterDataTypes(
+    const RegisterDataTypesMethod& register_platform_types_method) {
+  syncer::ModelTypeSet disabled_types =
+      GetDisabledTypesFromCommandLine(command_line_);
+  syncer::ModelTypeSet enabled_types =
+      GetEnabledTypesFromCommandLine(command_line_);
+  RegisterCommonDataTypes(disabled_types, enabled_types);
+  if (!register_platform_types_method.is_null())
+    register_platform_types_method.Run(disabled_types, enabled_types);
+}
+
+void ProfileSyncComponentsFactoryImpl::RegisterCommonDataTypes(
+    syncer::ModelTypeSet disabled_types,
+    syncer::ModelTypeSet enabled_types) {
+  sync_driver::SyncService* sync_service = sync_client_->GetSyncService();
+  base::Closure error_callback =
+      base::Bind(&ChromeReportUnrecoverableError, channel_);
+
+  // TODO(stanisc): can DEVICE_INFO be one of disabled datatypes?
+  sync_service->RegisterDataTypeController(new DeviceInfoDataTypeController(
+      ui_thread_, error_callback, sync_client_,
+      sync_service->GetLocalDeviceInfoProvider()));
+
+  // Autofill sync is enabled by default.  Register unless explicitly
+  // disabled.
+  if (!disabled_types.Has(syncer::AUTOFILL)) {
+    sync_service->RegisterDataTypeController(new AutofillDataTypeController(
+        ui_thread_, db_thread_, error_callback, sync_client_));
+  }
+
+  // Autofill profile sync is enabled by default.  Register unless explicitly
+  // disabled.
+  if (!disabled_types.Has(syncer::AUTOFILL_PROFILE)) {
+    sync_service->RegisterDataTypeController(
+        new AutofillProfileDataTypeController(ui_thread_, db_thread_,
+                                              error_callback, sync_client_));
+  }
+
+  // Wallet data sync is enabled by default, but behind a syncer experiment
+  // enforced by the datatype controller. Register unless explicitly disabled.
+  bool wallet_disabled = disabled_types.Has(syncer::AUTOFILL_WALLET_DATA);
+  if (!wallet_disabled) {
+    sync_service->RegisterDataTypeController(
+        new browser_sync::AutofillWalletDataTypeController(
+            ui_thread_, db_thread_, error_callback, sync_client_,
+            syncer::AUTOFILL_WALLET_DATA));
+  }
+
+  // Wallet metadata sync depends on Wallet data sync. Register if Wallet data
+  // is syncing and metadata sync is not explicitly disabled.
+  if (!wallet_disabled &&
+      !disabled_types.Has(syncer::AUTOFILL_WALLET_METADATA)) {
+    sync_service->RegisterDataTypeController(
+        new browser_sync::AutofillWalletDataTypeController(
+            ui_thread_, db_thread_, error_callback, sync_client_,
+            syncer::AUTOFILL_WALLET_METADATA));
+  }
+
+  // Bookmark sync is enabled by default.  Register unless explicitly
+  // disabled.
+  if (!disabled_types.Has(syncer::BOOKMARKS)) {
+    sync_service->RegisterDataTypeController(new BookmarkDataTypeController(
+        ui_thread_, error_callback, sync_client_));
+  }
+
+  const bool history_disabled =
+      sync_client_->GetPrefService()->GetBoolean(history_disabled_pref_);
+  // TypedUrl sync is enabled by default.  Register unless explicitly disabled,
+  // or if saving history is disabled.
+  if (!disabled_types.Has(syncer::TYPED_URLS) && !history_disabled) {
+    sync_service->RegisterDataTypeController(new TypedUrlDataTypeController(
+        ui_thread_, error_callback, sync_client_, history_disabled_pref_));
+  }
+
+  // Delete directive sync is enabled by default.  Register unless full history
+  // sync is disabled.
+  if (!disabled_types.Has(syncer::HISTORY_DELETE_DIRECTIVES) &&
+      !history_disabled) {
+    sync_service->RegisterDataTypeController(
+        new HistoryDeleteDirectivesDataTypeController(
+            ui_thread_, error_callback, sync_client_));
+  }
+
+  // Session sync is enabled by default.  Register unless explicitly disabled.
+  // This is also disabled if the browser history is disabled, because the
+  // tab sync data is added to the web history on the server.
+  if (!disabled_types.Has(syncer::PROXY_TABS) && !history_disabled) {
+    sync_service->RegisterDataTypeController(
+        new ProxyDataTypeController(ui_thread_, syncer::PROXY_TABS));
+    // TODO(zea): remove this once SyncedWindowDelegateGetter is componentized.
+    // For now, we know that the implementation of SyncService is always a
+    // ProfileSyncService at this level.
+    ProfileSyncService* pss = static_cast<ProfileSyncService*>(sync_service);
+    sync_service->RegisterDataTypeController(new SessionDataTypeController(
+        ui_thread_, error_callback, sync_client_,
+        pss->GetSyncedWindowDelegatesGetter(),
+        sync_service->GetLocalDeviceInfoProvider(), history_disabled_pref_));
+  }
+
+  // Favicon sync is enabled by default. Register unless explicitly disabled.
+  if (!disabled_types.Has(syncer::FAVICON_IMAGES) &&
+      !disabled_types.Has(syncer::FAVICON_TRACKING) && !history_disabled) {
+    // crbug/384552. We disable error uploading for this data types for now.
+    sync_service->RegisterDataTypeController(new UIDataTypeController(
+        ui_thread_, base::Closure(), syncer::FAVICON_IMAGES, sync_client_));
+    sync_service->RegisterDataTypeController(new UIDataTypeController(
+        ui_thread_, base::Closure(), syncer::FAVICON_TRACKING, sync_client_));
+  }
+
+  // Password sync is enabled by default.  Register unless explicitly
+  // disabled.
+  if (!disabled_types.Has(syncer::PASSWORDS)) {
+    sync_service->RegisterDataTypeController(new PasswordDataTypeController(
+        ui_thread_, error_callback, sync_client_,
+        sync_client_->GetPasswordStateChangedCallback()));
+  }
+
+  if (!disabled_types.Has(syncer::PRIORITY_PREFERENCES)) {
+    sync_service->RegisterDataTypeController(
+        new UIDataTypeController(ui_thread_, error_callback,
+                                 syncer::PRIORITY_PREFERENCES, sync_client_));
+  }
+
+  // Article sync is disabled by default.  Register only if explicitly enabled.
+  if (dom_distiller::IsEnableSyncArticlesSet()) {
+    sync_service->RegisterDataTypeController(new UIDataTypeController(
+        ui_thread_, error_callback, syncer::ARTICLES, sync_client_));
+  }
+}
+
+DataTypeManager* ProfileSyncComponentsFactoryImpl::CreateDataTypeManager(
+    const syncer::WeakHandle<syncer::DataTypeDebugInfoListener>&
+        debug_info_listener,
+    const DataTypeController::TypeMap* controllers,
+    const sync_driver::DataTypeEncryptionHandler* encryption_handler,
+    SyncBackendHost* backend,
+    DataTypeManagerObserver* observer) {
+  return new DataTypeManagerImpl(debug_info_listener, controllers,
+                                 encryption_handler, backend, observer);
+}
+
+browser_sync::SyncBackendHost*
+ProfileSyncComponentsFactoryImpl::CreateSyncBackendHost(
+    const std::string& name,
+    invalidation::InvalidationService* invalidator,
+    const base::WeakPtr<sync_driver::SyncPrefs>& sync_prefs,
+    const base::FilePath& sync_folder) {
+  return new browser_sync::SyncBackendHostImpl(
+      name, sync_client_, ui_thread_, invalidator, sync_prefs, sync_folder);
+}
+
+scoped_ptr<sync_driver::LocalDeviceInfoProvider>
+ProfileSyncComponentsFactoryImpl::CreateLocalDeviceInfoProvider() {
+  return scoped_ptr<sync_driver::LocalDeviceInfoProvider>(
+      new browser_sync::LocalDeviceInfoProviderImpl(channel_, version_,
+                                                    is_tablet_));
+}
+
+class TokenServiceProvider
+    : public OAuth2TokenServiceRequest::TokenServiceProvider {
+ public:
+  TokenServiceProvider(
+      const scoped_refptr<base::SingleThreadTaskRunner>& task_runner,
+      OAuth2TokenService* token_service);
+
+  // OAuth2TokenServiceRequest::TokenServiceProvider implementation.
+  scoped_refptr<base::SingleThreadTaskRunner> GetTokenServiceTaskRunner()
+      override;
+  OAuth2TokenService* GetTokenService() override;
+
+ private:
+  ~TokenServiceProvider() override;
+
+  scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
+  OAuth2TokenService* token_service_;
+};
+
+TokenServiceProvider::TokenServiceProvider(
+    const scoped_refptr<base::SingleThreadTaskRunner>& task_runner,
+    OAuth2TokenService* token_service)
+    : task_runner_(task_runner), token_service_(token_service) {}
+
+TokenServiceProvider::~TokenServiceProvider() {}
+
+scoped_refptr<base::SingleThreadTaskRunner>
+TokenServiceProvider::GetTokenServiceTaskRunner() {
+  return task_runner_;
+}
+
+OAuth2TokenService* TokenServiceProvider::GetTokenService() {
+  return token_service_;
+}
+
+scoped_ptr<syncer::AttachmentService>
+ProfileSyncComponentsFactoryImpl::CreateAttachmentService(
+    scoped_ptr<syncer::AttachmentStoreForSync> attachment_store,
+    const syncer::UserShare& user_share,
+    const std::string& store_birthday,
+    syncer::ModelType model_type,
+    syncer::AttachmentService::Delegate* delegate) {
+  scoped_ptr<syncer::AttachmentUploader> attachment_uploader;
+  scoped_ptr<syncer::AttachmentDownloader> attachment_downloader;
+  // Only construct an AttachmentUploader and AttachmentDownload if we have sync
+  // credentials. We may not have sync credentials because there may not be a
+  // signed in sync user (e.g. sync is running in "backup" mode).
+  if (!user_share.sync_credentials.email.empty() &&
+      !user_share.sync_credentials.scope_set.empty()) {
+    scoped_refptr<OAuth2TokenServiceRequest::TokenServiceProvider>
+        token_service_provider(
+            new TokenServiceProvider(ui_thread_, token_service_));
+    // TODO(maniscalco): Use shared (one per profile) thread-safe instances of
+    // AttachmentUploader and AttachmentDownloader instead of creating a new one
+    // per AttachmentService (bug 369536).
+    attachment_uploader.reset(new syncer::AttachmentUploaderImpl(
+        sync_service_url_, url_request_context_getter_,
+        user_share.sync_credentials.email,
+        user_share.sync_credentials.scope_set, token_service_provider,
+        store_birthday, model_type));
+
+    token_service_provider =
+        new TokenServiceProvider(ui_thread_, token_service_);
+    attachment_downloader = syncer::AttachmentDownloader::Create(
+        sync_service_url_, url_request_context_getter_,
+        user_share.sync_credentials.email,
+        user_share.sync_credentials.scope_set, token_service_provider,
+        store_birthday, model_type);
+  }
+
+  // It is important that the initial backoff delay is relatively large.  For
+  // whatever reason, the server may fail all requests for a short period of
+  // time.  When this happens we don't want to overwhelm the server with
+  // requests so we use a large initial backoff.
+  const base::TimeDelta initial_backoff_delay =
+      base::TimeDelta::FromMinutes(30);
+  const base::TimeDelta max_backoff_delay = base::TimeDelta::FromHours(4);
+  scoped_ptr<syncer::AttachmentService> attachment_service(
+      new syncer::AttachmentServiceImpl(
+          attachment_store.Pass(), attachment_uploader.Pass(),
+          attachment_downloader.Pass(), delegate, initial_backoff_delay,
+          max_backoff_delay));
+  return attachment_service.Pass();
+}
+
+sync_driver::SyncApiComponentFactory::SyncComponents
+ProfileSyncComponentsFactoryImpl::CreateBookmarkSyncComponents(
+    sync_driver::SyncService* sync_service,
+    sync_driver::DataTypeErrorHandler* error_handler) {
+  BookmarkModel* bookmark_model =
+      sync_service->GetSyncClient()->GetBookmarkModel();
+  syncer::UserShare* user_share = sync_service->GetUserShare();
+// TODO(akalin): We may want to propagate this switch up eventually.
+#if defined(OS_ANDROID) || defined(OS_IOS)
+  const bool kExpectMobileBookmarksFolder = true;
+#else
+  const bool kExpectMobileBookmarksFolder = false;
+#endif
+  BookmarkModelAssociator* model_associator = new BookmarkModelAssociator(
+      bookmark_model, sync_service->GetSyncClient(), user_share, error_handler,
+      kExpectMobileBookmarksFolder);
+  BookmarkChangeProcessor* change_processor = new BookmarkChangeProcessor(
+      sync_service->GetSyncClient(), model_associator, error_handler);
+  return SyncComponents(model_associator, change_processor);
+}
+
+sync_driver::SyncApiComponentFactory::SyncComponents
+ProfileSyncComponentsFactoryImpl::CreateTypedUrlSyncComponents(
+    sync_driver::SyncService* sync_service,
+    history::HistoryBackend* history_backend,
+    sync_driver::DataTypeErrorHandler* error_handler) {
+  DCHECK(!ui_thread_->BelongsToCurrentThread());
+
+  // TODO(zea): Once TypedURLs are converted to SyncableService, remove
+  // |sync_service_| member, and make GetSyncService require it be called on
+  // the UI thread.
+  TypedUrlModelAssociator* model_associator =
+      new TypedUrlModelAssociator(sync_service, history_backend, error_handler);
+  TypedUrlChangeProcessor* change_processor = new TypedUrlChangeProcessor(
+      model_associator, history_backend, error_handler, ui_thread_);
+  return SyncComponents(model_associator, change_processor);
+}
diff --git a/chrome/browser/sync/profile_sync_components_factory_impl.h b/components/browser_sync/browser/profile_sync_components_factory_impl.h
similarity index 74%
rename from chrome/browser/sync/profile_sync_components_factory_impl.h
rename to components/browser_sync/browser/profile_sync_components_factory_impl.h
index 0e7ede7..579d1b9c 100644
--- a/chrome/browser/sync/profile_sync_components_factory_impl.h
+++ b/components/browser_sync/browser/profile_sync_components_factory_impl.h
@@ -2,25 +2,23 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CHROME_BROWSER_SYNC_PROFILE_SYNC_COMPONENTS_FACTORY_IMPL_H__
-#define CHROME_BROWSER_SYNC_PROFILE_SYNC_COMPONENTS_FACTORY_IMPL_H__
+#ifndef COMPONENTS_BROWSER_SYNC_BROWSER_PROFILE_SYNC_COMPONENTS_FACTORY_IMPL_H__
+#define COMPONENTS_BROWSER_SYNC_BROWSER_PROFILE_SYNC_COMPONENTS_FACTORY_IMPL_H__
 
 #include <string>
 
 #include "base/basictypes.h"
+#include "base/command_line.h"
 #include "base/compiler_specific.h"
 #include "base/memory/weak_ptr.h"
 #include "components/sync_driver/sync_api_component_factory.h"
+#include "components/version_info/version_info.h"
 #include "sync/internal_api/public/base/model_type.h"
 #include "url/gurl.h"
 
 class OAuth2TokenService;
 class Profile;
 
-namespace base {
-class CommandLine;
-}
-
 namespace net {
 class URLRequestContextGetter;
 }
@@ -37,15 +35,22 @@
   // |url_request_context_getter| must outlive the
   // ProfileSyncComponentsFactoryImpl.
   ProfileSyncComponentsFactoryImpl(
-      Profile* profile,
-      base::CommandLine* command_line,
+      sync_driver::SyncClient* sync_client,
+      version_info::Channel channel,
+      const std::string& version,
+      bool is_tablet,
+      const base::CommandLine& command_line,
+      const char* history_disabled_pref,
       const GURL& sync_service_url,
+      const scoped_refptr<base::SingleThreadTaskRunner>& ui_thread,
+      const scoped_refptr<base::SingleThreadTaskRunner>& db_thread,
       OAuth2TokenService* token_service,
       net::URLRequestContextGetter* url_request_context_getter);
   ~ProfileSyncComponentsFactoryImpl() override;
 
-  void RegisterDataTypes(sync_driver::SyncClient* sync_client) override;
-
+  // SyncApiComponentFactory implementation:
+  void RegisterDataTypes(
+      const RegisterDataTypesMethod& register_platform_types_method) override;
   sync_driver::DataTypeManager* CreateDataTypeManager(
       const syncer::WeakHandle<syncer::DataTypeDebugInfoListener>&
           debug_info_listener,
@@ -53,25 +58,19 @@
       const sync_driver::DataTypeEncryptionHandler* encryption_handler,
       browser_sync::SyncBackendHost* backend,
       sync_driver::DataTypeManagerObserver* observer) override;
-
   browser_sync::SyncBackendHost* CreateSyncBackendHost(
       const std::string& name,
-      sync_driver::SyncClient* sync_client,
       invalidation::InvalidationService* invalidator,
       const base::WeakPtr<sync_driver::SyncPrefs>& sync_prefs,
       const base::FilePath& sync_folder) override;
-
   scoped_ptr<sync_driver::LocalDeviceInfoProvider>
   CreateLocalDeviceInfoProvider() override;
-
   scoped_ptr<syncer::AttachmentService> CreateAttachmentService(
       scoped_ptr<syncer::AttachmentStoreForSync> attachment_store,
       const syncer::UserShare& user_share,
       const std::string& store_birthday,
       syncer::ModelType model_type,
       syncer::AttachmentService::Delegate* delegate) override;
-
-  // Legacy datatypes that need to be converted to the SyncableService API.
   sync_driver::SyncApiComponentFactory::SyncComponents
   CreateBookmarkSyncComponents(
       sync_driver::SyncService* sync_service,
@@ -83,28 +82,26 @@
       sync_driver::DataTypeErrorHandler* error_handler) override;
 
  private:
-  // Register data types which are enabled on desktop platforms only.
-  // |disabled_types| and |enabled_types| correspond only to those types
-  // being explicitly enabled/disabled by the command line.
-  void RegisterDesktopDataTypes(syncer::ModelTypeSet disabled_types,
-                                syncer::ModelTypeSet enabled_types,
-                                sync_driver::SyncClient* sync_client);
-
   // Register data types which are enabled on both desktop and mobile.
   // |disabled_types| and |enabled_types| correspond only to those types
   // being explicitly enabled/disabled by the command line.
   void RegisterCommonDataTypes(syncer::ModelTypeSet disabled_types,
-                               syncer::ModelTypeSet enabled_types,
-                               sync_driver::SyncClient* sync_client);
+                               syncer::ModelTypeSet enabled_types);
 
   void DisableBrokenType(syncer::ModelType type,
                          const tracked_objects::Location& from_here,
                          const std::string& message);
 
-  Profile* profile_;
-  base::CommandLine* command_line_;
-
+  // Client/platform specific members.
+  sync_driver::SyncClient* const sync_client_;
+  const version_info::Channel channel_;
+  const std::string version_;
+  const bool is_tablet_;
+  const base::CommandLine command_line_;
+  const char* history_disabled_pref_;
   const GURL sync_service_url_;
+  const scoped_refptr<base::SingleThreadTaskRunner> ui_thread_;
+  const scoped_refptr<base::SingleThreadTaskRunner> db_thread_;
   OAuth2TokenService* const token_service_;
   net::URLRequestContextGetter* const url_request_context_getter_;
 
@@ -113,4 +110,4 @@
   DISALLOW_COPY_AND_ASSIGN(ProfileSyncComponentsFactoryImpl);
 };
 
-#endif  // CHROME_BROWSER_SYNC_PROFILE_SYNC_COMPONENTS_FACTORY_IMPL_H__
+#endif  // COMPONENTS_BROWSER_SYNC_BROWSER_PROFILE_SYNC_COMPONENTS_FACTORY_IMPL_H__
diff --git a/components/browser_sync/browser/profile_sync_service.cc b/components/browser_sync/browser/profile_sync_service.cc
index 3e5e0dce..dd6636b 100644
--- a/components/browser_sync/browser/profile_sync_service.cc
+++ b/components/browser_sync/browser/profile_sync_service.cc
@@ -211,6 +211,7 @@
       connection_status_(syncer::CONNECTION_NOT_ATTEMPTED),
       last_get_token_error_(GoogleServiceAuthError::AuthErrorNone()),
       network_resources_(new syncer::HttpBridgeNetworkResources),
+      start_behavior_(start_behavior),
       backend_mode_(IDLE),
       need_backup_(false),
       backup_finished_(false),
@@ -220,42 +221,6 @@
       startup_controller_weak_factory_(this) {
   DCHECK(thread_checker_.CalledOnValidThread());
   DCHECK(sync_client_);
-  startup_controller_.reset(new browser_sync::StartupController(
-      start_behavior,
-      oauth2_token_service,
-      &sync_prefs_,
-      signin_.get(),
-      base::Bind(&ProfileSyncService::StartUpSlowBackendComponents,
-                 startup_controller_weak_factory_.GetWeakPtr(),
-                 SYNC)));
-  backup_rollback_controller_.reset(new sync_driver::BackupRollbackController(
-      &sync_prefs_,
-      signin_.get(),
-      base::Bind(&ProfileSyncService::StartUpSlowBackendComponents,
-                 startup_controller_weak_factory_.GetWeakPtr(),
-                 BACKUP),
-      base::Bind(&ProfileSyncService::StartUpSlowBackendComponents,
-                 startup_controller_weak_factory_.GetWeakPtr(),
-                 ROLLBACK)));
-  scoped_ptr<browser_sync::LocalSessionEventRouter> router(
-      sync_client_->GetSyncSessionsClient()->GetLocalSessionEventRouter());
-  local_device_ = sync_client_->GetSyncApiComponentFactory()
-                      ->CreateLocalDeviceInfoProvider();
-  sync_stopped_reporter_.reset(new browser_sync::SyncStoppedReporter(
-      sync_service_url_, local_device_->GetSyncUserAgent(),
-      url_request_context_,
-      browser_sync::SyncStoppedReporter::ResultCallback()));
-  sessions_sync_manager_.reset(new SessionsSyncManager(
-      sync_client_->GetSyncSessionsClient(), &sync_prefs_, local_device_.get(),
-      router.Pass(),
-      base::Bind(&ProfileSyncService::NotifyForeignSessionUpdated,
-                 weak_factory_.GetWeakPtr()),
-      base::Bind(&ProfileSyncService::TriggerRefresh,
-                 weak_factory_.GetWeakPtr(),
-                 syncer::ModelTypeSet(syncer::SESSIONS))));
-  device_info_sync_service_.reset(
-      new DeviceInfoSyncService(local_device_.get()));
-
   std::string last_version = sync_prefs_.GetLastRunVersion();
   std::string current_version = PRODUCT_VERSION;
   sync_prefs_.SetLastRunVersion(current_version);
@@ -289,6 +254,41 @@
 void ProfileSyncService::Initialize() {
   sync_client_->Initialize(this);
 
+  startup_controller_.reset(new browser_sync::StartupController(
+      start_behavior_, oauth2_token_service_, &sync_prefs_, signin_.get(),
+      base::Bind(&ProfileSyncService::StartUpSlowBackendComponents,
+                 startup_controller_weak_factory_.GetWeakPtr(), SYNC)));
+  backup_rollback_controller_.reset(new sync_driver::BackupRollbackController(
+      &sync_prefs_, signin_.get(),
+      base::Bind(&ProfileSyncService::StartUpSlowBackendComponents,
+                 startup_controller_weak_factory_.GetWeakPtr(), BACKUP),
+      base::Bind(&ProfileSyncService::StartUpSlowBackendComponents,
+                 startup_controller_weak_factory_.GetWeakPtr(), ROLLBACK)));
+  scoped_ptr<browser_sync::LocalSessionEventRouter> router(
+      sync_client_->GetSyncSessionsClient()->GetLocalSessionEventRouter());
+  local_device_ = sync_client_->GetSyncApiComponentFactory()
+                      ->CreateLocalDeviceInfoProvider();
+  sync_stopped_reporter_.reset(new browser_sync::SyncStoppedReporter(
+      sync_service_url_, local_device_->GetSyncUserAgent(),
+      url_request_context_,
+      browser_sync::SyncStoppedReporter::ResultCallback()));
+  sessions_sync_manager_.reset(new SessionsSyncManager(
+      sync_client_->GetSyncSessionsClient(), &sync_prefs_, local_device_.get(),
+      router.Pass(),
+      base::Bind(&ProfileSyncService::NotifyForeignSessionUpdated,
+                 weak_factory_.GetWeakPtr()),
+      base::Bind(&ProfileSyncService::TriggerRefresh,
+                 weak_factory_.GetWeakPtr(),
+                 syncer::ModelTypeSet(syncer::SESSIONS))));
+  device_info_sync_service_.reset(
+      new DeviceInfoSyncService(local_device_.get()));
+
+  sync_driver::SyncApiComponentFactory::RegisterDataTypesMethod
+      register_platform_types_callback =
+          sync_client_->GetRegisterPlatformTypesCallback();
+  sync_client_->GetSyncApiComponentFactory()->RegisterDataTypes(
+      register_platform_types_callback);
+
   // We clear this here (vs Shutdown) because we want to remember that an error
   // happened on shutdown so we can display details (message, location) about it
   // in about:sync.
@@ -672,8 +672,8 @@
 
   backend_.reset(
       sync_client_->GetSyncApiComponentFactory()->CreateSyncBackendHost(
-          debug_identifier_, sync_client_.get(), invalidator,
-          sync_prefs_.AsWeakPtr(), directory_path_));
+          debug_identifier_, invalidator, sync_prefs_.AsWeakPtr(),
+          directory_path_));
 
   // Initialize the backend.  Every time we start up a new SyncBackendHost,
   // we'll want to start from a fresh SyncDB, so delete any old one that might
diff --git a/components/browser_sync/browser/profile_sync_service.h b/components/browser_sync/browser/profile_sync_service.h
index 9909a29..32c998e08 100644
--- a/components/browser_sync/browser/profile_sync_service.h
+++ b/components/browser_sync/browser/profile_sync_service.h
@@ -230,7 +230,6 @@
     ROLLBACK    // Backend for rollback.
   };
 
-  // Takes ownership of |factory| and |signin_wrapper|.
   ProfileSyncService(
       scoped_ptr<sync_driver::SyncClient> sync_client,
       scoped_ptr<SigninManagerWrapper> signin_wrapper,
@@ -948,6 +947,7 @@
 
   scoped_ptr<syncer::NetworkResources> network_resources_;
 
+  browser_sync::ProfileSyncServiceStartBehavior start_behavior_;
   scoped_ptr<browser_sync::StartupController> startup_controller_;
 
   scoped_ptr<sync_driver::BackupRollbackController> backup_rollback_controller_;
diff --git a/components/cronet/android/api/src/org/chromium/net/CronetEngine.java b/components/cronet/android/api/src/org/chromium/net/CronetEngine.java
index 89c4c89..5047ab6e2 100644
--- a/components/cronet/android/api/src/org/chromium/net/CronetEngine.java
+++ b/components/cronet/android/api/src/org/chromium/net/CronetEngine.java
@@ -303,15 +303,13 @@
         }
 
         /**
-         * Sets experimental QUIC connection options, overwriting any pre-existing
-         * options. List of options is subject to change.
+         * Sets experimental options to be used in Cronet.
          *
-         * @param quicConnectionOptions comma-separated QUIC options (for example
-         * "PACE,IW10") to use if QUIC is enabled.
+         * @param options JSON formatted experimental options.
          * @return the builder to facilitate chaining.
          */
-        public Builder setExperimentalQuicConnectionOptions(String quicConnectionOptions) {
-            return putString(CronetEngineBuilderList.QUIC_OPTIONS, quicConnectionOptions);
+        public Builder setExperimentalOptions(String options) {
+            return putString(CronetEngineBuilderList.EXPERIMENTAL_OPTIONS, options);
         }
 
         /**
diff --git a/components/cronet/android/test/javatests/src/org/chromium/net/QuicTest.java b/components/cronet/android/test/javatests/src/org/chromium/net/QuicTest.java
index f18eb36..349b0030 100644
--- a/components/cronet/android/test/javatests/src/org/chromium/net/QuicTest.java
+++ b/components/cronet/android/test/javatests/src/org/chromium/net/QuicTest.java
@@ -10,6 +10,7 @@
 import org.chromium.base.Log;
 import org.chromium.base.annotations.SuppressFBWarnings;
 import org.chromium.base.test.util.Feature;
+import org.json.JSONObject;
 
 import java.io.File;
 import java.io.FileInputStream;
@@ -36,7 +37,12 @@
         builder.enableQUIC(true);
         builder.addQuicHint(QuicTestServer.getServerHost(), QuicTestServer.getServerPort(),
                 QuicTestServer.getServerPort());
-        builder.setExperimentalQuicConnectionOptions("PACE,IW10,FOO,DEADBEEF");
+
+        JSONObject quicParams =
+                new JSONObject().put("connection_options", "PACE,IW10,FOO,DEADBEEF");
+        JSONObject experimentalOptions = new JSONObject().put("QUIC", quicParams);
+        builder.setExperimentalOptions(experimentalOptions.toString());
+
         builder.setMockCertVerifierForTesting(MockCertVerifier.createMockCertVerifier(CERTS_USED));
         builder.setStoragePath(CronetTestFramework.getTestStorage(getContext()));
         builder.enableHttpCache(CronetEngine.Builder.HTTP_CACHE_DISK_NO_HTTP, 1000 * 1024);
diff --git a/components/cronet/url_request_context_config.cc b/components/cronet/url_request_context_config.cc
index 6072f39..5cd24b8 100644
--- a/components/cronet/url_request_context_config.cc
+++ b/components/cronet/url_request_context_config.cc
@@ -19,6 +19,10 @@
 
 namespace {
 
+// TODO(xunjieli): Refactor constants in io_thread.cc.
+const char kQuicFieldTrialName[] = "QUIC";
+const char kQuicConnectionOptions[] = "connection_options";
+
 // Using a reference to scoped_ptr is unavoidable because of the semantics of
 // RegisterCustomField.
 // TODO(xunjieli): Remove this once crbug.com/544976 is fixed.
@@ -31,6 +35,41 @@
   return success;
 }
 
+void ParseAndSetExperimentalOptions(
+    const std::string& experimental_options,
+    net::URLRequestContextBuilder* context_builder) {
+  if (experimental_options.empty())
+    return;
+
+  scoped_ptr<base::Value> options =
+      base::JSONReader::Read(experimental_options);
+
+  if (!options) {
+    DCHECK(false) << "Parsing experimental options failed: "
+                  << experimental_options;
+    return;
+  }
+
+  scoped_ptr<base::DictionaryValue> dict =
+      base::DictionaryValue::From(options.Pass());
+
+  if (!dict) {
+    DCHECK(false) << "Experimental options string is not a dictionary: "
+                  << experimental_options;
+    return;
+  }
+
+  const base::DictionaryValue* quic_args = nullptr;
+  if (dict->GetDictionary(kQuicFieldTrialName, &quic_args)) {
+    std::string quic_connection_options;
+    if (quic_args->GetString(kQuicConnectionOptions,
+                             &quic_connection_options)) {
+      context_builder->set_quic_connection_options(
+          net::QuicUtils::ParseQuicConnectionOptions(quic_connection_options));
+    }
+  }
+}
+
 }  // namespace
 
 #define DEFINE_CONTEXT_CONFIG(x) const char REQUEST_CONTEXT_CONFIG_##x[] = #x;
@@ -95,9 +134,10 @@
   }
   context_builder->set_user_agent(user_agent);
   context_builder->SetSpdyAndQuicEnabled(enable_spdy, enable_quic);
-  context_builder->set_quic_connection_options(
-      net::QuicUtils::ParseQuicConnectionOptions(quic_connection_options));
   context_builder->set_sdch_enabled(enable_sdch);
+
+  ParseAndSetExperimentalOptions(experimental_options, context_builder);
+
   if (mock_cert_verifier)
     context_builder->SetCertVerifier(mock_cert_verifier.Pass());
   // TODO(mef): Use |config| to set cookies.
@@ -125,8 +165,8 @@
   converter->RegisterRepeatedMessage(REQUEST_CONTEXT_CONFIG_QUIC_HINTS,
                                      &URLRequestContextConfig::quic_hints);
   converter->RegisterStringField(
-      REQUEST_CONTEXT_CONFIG_QUIC_OPTIONS,
-      &URLRequestContextConfig::quic_connection_options);
+      REQUEST_CONTEXT_CONFIG_EXPERIMENTAL_OPTIONS,
+      &URLRequestContextConfig::experimental_options);
   converter->RegisterStringField(
       REQUEST_CONTEXT_CONFIG_DATA_REDUCTION_PRIMARY_PROXY,
       &URLRequestContextConfig::data_reduction_primary_proxy);
diff --git a/components/cronet/url_request_context_config.h b/components/cronet/url_request_context_config.h
index 7389811a..7953d2d 100644
--- a/components/cronet/url_request_context_config.h
+++ b/components/cronet/url_request_context_config.h
@@ -75,8 +75,13 @@
   std::string user_agent;
   // App-provided list of servers that support QUIC.
   ScopedVector<QuicHint> quic_hints;
-  // Comma-separated list of QUIC connection options.
-  std::string quic_connection_options;
+  // Experimental options encoded as a string in a JSON format containing
+  // experiments and their corresponding configuration options. The format
+  // is a JSON object with the name of the experiment as the key, and the
+  // configuration options as the value. An example:
+  //   {"experiment1": {"option1": "option_value1", "option2": "option_value2",
+  //    ...}, "experiment2: {"option3", "option_value3", ...}, ...}
+  std::string experimental_options;
   // Enable Data Reduction Proxy with authentication key.
   std::string data_reduction_proxy_key;
   std::string data_reduction_primary_proxy;
diff --git a/components/cronet/url_request_context_config_list.h b/components/cronet/url_request_context_config_list.h
index f690061..7636e95 100644
--- a/components/cronet/url_request_context_config_list.h
+++ b/components/cronet/url_request_context_config_list.h
@@ -32,7 +32,7 @@
 DEFINE_CONTEXT_CONFIG(QUIC_HINT_PORT)
 DEFINE_CONTEXT_CONFIG(QUIC_HINT_ALT_PORT)
 
-DEFINE_CONTEXT_CONFIG(QUIC_OPTIONS)
+DEFINE_CONTEXT_CONFIG(EXPERIMENTAL_OPTIONS)
 
 // For Testing.
 DEFINE_CONTEXT_CONFIG(MOCK_CERT_VERIFIER)
diff --git a/components/html_viewer/BUILD.gn b/components/html_viewer/BUILD.gn
index 95d6539..85b973c2 100644
--- a/components/html_viewer/BUILD.gn
+++ b/components/html_viewer/BUILD.gn
@@ -186,7 +186,6 @@
     "//mojo/public/cpp/environment:environment",
     "//mojo/services/network/public/cpp",
     "//mojo/services/network/public/interfaces",
-    "//mojo/services/tracing/public/cpp",
     "//mojo/services/tracing/public/interfaces",
     "//net",
     "//skia",
diff --git a/components/html_viewer/ax_provider_impl.cc b/components/html_viewer/ax_provider_impl.cc
index ecb69b4..8ef9ae78 100644
--- a/components/html_viewer/ax_provider_impl.cc
+++ b/components/html_viewer/ax_provider_impl.cc
@@ -81,10 +81,12 @@
   if (ax_object.isAnchor()) {
     result->link = mojo::AxLink::New();
     result->link->url = String::From(ax_object.url().string());
-  } else if (ax_object.childCount() == 0 &&
-             !ax_object.stringValue().isEmpty()) {
-    result->text = mojo::AxText::New();
-    result->text->content = String::From(ax_object.stringValue());
+  } else if (ax_object.childCount() == 0) {
+    blink::WebString name = ax_object.name();
+    if (!name.isEmpty()) {
+      result->text = mojo::AxText::New();
+      result->text->content = String::From(name);
+    }
   }
 
   return result.Pass();
diff --git a/components/html_viewer/global_state.cc b/components/html_viewer/global_state.cc
index 9d7f46b..18077ca 100644
--- a/components/html_viewer/global_state.cc
+++ b/components/html_viewer/global_state.cc
@@ -16,7 +16,6 @@
 #include "gin/v8_initializer.h"
 #include "mojo/application/public/cpp/application_impl.h"
 #include "mojo/logging/init_logging.h"
-#include "mojo/services/tracing/public/cpp/tracing_impl.h"
 #include "third_party/WebKit/public/web/WebKit.h"
 #include "third_party/WebKit/public/web/WebRuntimeFeatures.h"
 #include "ui/base/resource/resource_bundle.h"
@@ -79,7 +78,6 @@
       discardable_memory_allocator_(kDesiredMaxMemory),
       compositor_thread_("compositor thread"),
       blink_settings_(new BlinkSettingsImpl()) {
-  tracing_.Initialize(app);
 }
 
 GlobalState::~GlobalState() {
diff --git a/components/html_viewer/global_state.h b/components/html_viewer/global_state.h
index c8c9523..a7c3894 100644
--- a/components/html_viewer/global_state.h
+++ b/components/html_viewer/global_state.h
@@ -14,7 +14,6 @@
 #include "components/mus/gles2/raster_thread_helper.h"
 #include "components/mus/public/interfaces/gpu.mojom.h"
 #include "components/resource_provider/public/cpp/resource_loader.h"
-#include "mojo/services/tracing/public/cpp/tracing_impl.h"
 #include "skia/ext/refptr.h"
 #include "ui/gfx/geometry/size.h"
 
@@ -118,8 +117,6 @@
   // memory based purging allocator working here.
   DiscardableMemoryAllocator discardable_memory_allocator_;
 
-  mojo::TracingImpl tracing_;
-
   scoped_ptr<scheduler::RendererScheduler> renderer_scheduler_;
   scoped_ptr<BlinkPlatformImpl> blink_platform_;
   base::Thread compositor_thread_;
diff --git a/components/html_viewer/stats_collection_controller.cc b/components/html_viewer/stats_collection_controller.cc
index 965c317..2190933 100644
--- a/components/html_viewer/stats_collection_controller.cc
+++ b/components/html_viewer/stats_collection_controller.cc
@@ -13,7 +13,7 @@
 #include "gin/handle.h"
 #include "gin/object_template_builder.h"
 #include "mojo/application/public/cpp/application_impl.h"
-#include "mojo/services/tracing/public/cpp/switches.h"
+#include "mojo/application/public/cpp/switches.h"
 #include "third_party/WebKit/public/web/WebKit.h"
 #include "third_party/WebKit/public/web/WebLocalFrame.h"
 
@@ -67,7 +67,7 @@
   // Only make startup tracing available when running in the context of a test.
   if (!app ||
       !base::CommandLine::ForCurrentProcess()->HasSwitch(
-          tracing::kEnableStatsCollectionBindings)) {
+          mojo::kEnableStatsCollectionBindings)) {
     return nullptr;
   }
 
@@ -105,7 +105,7 @@
   // Only make startup tracing available when running in the context of a test.
   if (!app ||
       !base::CommandLine::ForCurrentProcess()->HasSwitch(
-          tracing::kEnableStatsCollectionBindings)) {
+          mojo::kEnableStatsCollectionBindings)) {
     return nullptr;
   }
 
@@ -134,7 +134,7 @@
 std::string StatsCollectionController::GetHistogram(
     const std::string& histogram_name) {
   DCHECK(base::CommandLine::ForCurrentProcess()->HasSwitch(
-      tracing::kEnableStatsCollectionBindings));
+      mojo::kEnableStatsCollectionBindings));
 
   static bool startup_histogram_initialized = false;
   if (!startup_histogram_initialized) {
diff --git a/components/mus/BUILD.gn b/components/mus/BUILD.gn
index e89df7e..f75f1c3e 100644
--- a/components/mus/BUILD.gn
+++ b/components/mus/BUILD.gn
@@ -77,7 +77,6 @@
     "//components/mus/ws:lib",
     "//mojo/application/public/cpp",
     "//mojo/common:common_base",
-    "//mojo/services/tracing/public/cpp",
     "//ui/events",
     "//ui/gl:gl",
     "//ui/platform_window:platform_impls",
diff --git a/components/mus/example/BUILD.gn b/components/mus/example/BUILD.gn
index 03dd4b3..1c6102ec 100644
--- a/components/mus/example/BUILD.gn
+++ b/components/mus/example/BUILD.gn
@@ -22,7 +22,7 @@
     "//components/mus/example/mock_sysui",
     "//components/mus/example/views_examples",
     "//components/mus/example/window_type_launcher",
-    "//components/mus/example/wm",
+    "//mash/wm",
     "//mojo/runner",
   ]
 }
@@ -33,7 +33,7 @@
     "//base/test:run_all_unittests",
     "//base/test:test_config",
     "//base/test:test_support",
-    "//components/mus/example/wm:unittests",
+    "//mash/wm:unittests",
     "//mojo/platform_handle:platform_handle_impl",
   ]
 }
diff --git a/components/mus/example/DEPS b/components/mus/example/DEPS
new file mode 100644
index 0000000..c1c06e5
--- /dev/null
+++ b/components/mus/example/DEPS
@@ -0,0 +1,3 @@
+include_rules = [
+  "+mash",
+]
diff --git a/components/mus/example/mock_sysui/BUILD.gn b/components/mus/example/mock_sysui/BUILD.gn
index 2f8490d0..b15537a3 100644
--- a/components/mus/example/mock_sysui/BUILD.gn
+++ b/components/mus/example/mock_sysui/BUILD.gn
@@ -15,9 +15,9 @@
 
   deps = [
     "//base",
-    "//components/mus/example/wm/public/interfaces",
     "//components/mus/public/cpp",
     "//components/mus/public/interfaces",
+    "//mash/wm/public/interfaces",
     "//mojo/application/public/cpp",
     "//mojo/common:common_base",
     "//skia",
diff --git a/components/mus/example/mock_sysui/mock_sysui.cc b/components/mus/example/mock_sysui/mock_sysui.cc
index 71eafe3..5d80457 100644
--- a/components/mus/example/mock_sysui/mock_sysui.cc
+++ b/components/mus/example/mock_sysui/mock_sysui.cc
@@ -4,8 +4,8 @@
 
 #include "components/mus/example/mock_sysui/mock_sysui.h"
 
-#include "components/mus/example/wm/public/interfaces/container.mojom.h"
 #include "components/mus/public/cpp/property_type_converters.h"
+#include "mash/wm/public/interfaces/container.mojom.h"
 #include "mojo/application/public/cpp/application_connection.h"
 #include "mojo/application/public/cpp/application_impl.h"
 #include "ui/gfx/canvas.h"
@@ -25,9 +25,9 @@
     params.delegate = new DesktopBackground;
 
     std::map<std::string, std::vector<uint8_t>> properties;
-    properties[ash::mojom::kWindowContainer_Property] =
+    properties[mash::wm::mojom::kWindowContainer_Property] =
         mojo::TypeConverter<const std::vector<uint8_t>, int32_t>::Convert(
-            ash::mojom::CONTAINER_USER_BACKGROUND);
+            mash::wm::mojom::CONTAINER_USER_BACKGROUND);
     mus::Window* window =
         views::WindowManagerConnection::Get()->NewWindow(properties);
     params.native_widget = new views::NativeWidgetMus(
@@ -60,9 +60,9 @@
     params.delegate = new Shelf;
 
     std::map<std::string, std::vector<uint8_t>> properties;
-    properties[ash::mojom::kWindowContainer_Property] =
+    properties[mash::wm::mojom::kWindowContainer_Property] =
         mojo::TypeConverter<const std::vector<uint8_t>, int32_t>::Convert(
-            ash::mojom::CONTAINER_USER_SHELF);
+            mash::wm::mojom::CONTAINER_USER_SHELF);
     mus::Window* window =
         views::WindowManagerConnection::Get()->NewWindow(properties);
     params.native_widget = new views::NativeWidgetMus(
diff --git a/components/mus/mus_app.cc b/components/mus/mus_app.cc
index f464ba4..ac91a9a 100644
--- a/components/mus/mus_app.cc
+++ b/components/mus/mus_app.cc
@@ -18,7 +18,6 @@
 #include "mojo/application/public/cpp/application_impl.h"
 #include "mojo/application/public/cpp/application_runner.h"
 #include "mojo/public/c/system/main.h"
-#include "mojo/services/tracing/public/cpp/tracing_impl.h"
 #include "ui/events/event_switches.h"
 #include "ui/events/platform/platform_event_source.h"
 #include "ui/gl/gl_surface.h"
diff --git a/components/mus/mus_app.h b/components/mus/mus_app.h
index 069e665..3750428 100644
--- a/components/mus/mus_app.h
+++ b/components/mus/mus_app.h
@@ -17,7 +17,6 @@
 #include "mojo/application/public/cpp/application_delegate.h"
 #include "mojo/application/public/cpp/interface_factory.h"
 #include "mojo/common/weak_binding_set.h"
-#include "mojo/services/tracing/public/cpp/tracing_impl.h"
 
 namespace mojo {
 class ApplicationImpl;
diff --git a/components/mus/public/cpp/lib/window.cc b/components/mus/public/cpp/lib/window.cc
index c7f19d8..f34a469 100644
--- a/components/mus/public/cpp/lib/window.cc
+++ b/components/mus/public/cpp/lib/window.cc
@@ -167,7 +167,7 @@
     return;
 
   if (connection_)
-    static_cast<WindowTreeClientImpl*>(connection_)->DestroyWindow(id_);
+    tree_client()->DestroyWindow(id_);
   while (!children_.empty()) {
     Window* child = children_.front();
     if (!OwnsWindow(connection_, child)) {
@@ -188,8 +188,7 @@
   if (bounds_ == bounds)
     return;
   if (connection_)
-    static_cast<WindowTreeClientImpl*>(connection_)
-        ->SetBounds(this, bounds_, bounds);
+    tree_client()->SetBounds(this, bounds_, bounds);
   LocalSetBounds(bounds_, bounds);
 }
 
@@ -197,10 +196,8 @@
   if (!OwnsWindowOrIsRoot(this))
     return;
 
-  if (connection_) {
-    static_cast<WindowTreeClientImpl*>(connection_)
-        ->SetClientArea(id_, client_area);
-  }
+  if (connection_)
+    tree_client()->SetClientArea(id_, client_area);
   LocalSetClientArea(client_area);
 }
 
@@ -209,7 +206,7 @@
     return;
 
   if (connection_)
-    static_cast<WindowTreeClientImpl*>(connection_)->SetVisible(id_, value);
+    tree_client()->SetVisible(id_, value);
   LocalSetVisible(value);
 }
 
@@ -218,8 +215,7 @@
   mojom::SurfaceClientPtr client;
   mojo::InterfaceRequest<mojom::SurfaceClient> client_request =
       GetProxy(&client);
-  static_cast<WindowTreeClientImpl*>(connection_)
-      ->RequestSurface(id_, type, GetProxy(&surface), client.Pass());
+  tree_client()->RequestSurface(id_, type, GetProxy(&surface), client.Pass());
   return make_scoped_ptr(
       new WindowSurface(surface.PassInterface(), client_request.Pass()));
 }
@@ -260,7 +256,7 @@
     CHECK_EQ(child->connection(), connection_);
   LocalAddChild(child);
   if (connection_)
-    static_cast<WindowTreeClientImpl*>(connection_)->AddChild(child->id(), id_);
+    tree_client()->AddChild(child->id(), id_);
 }
 
 void Window::RemoveChild(Window* child) {
@@ -269,10 +265,8 @@
   if (connection_)
     CHECK_EQ(child->connection(), connection_);
   LocalRemoveChild(child);
-  if (connection_) {
-    static_cast<WindowTreeClientImpl*>(connection_)
-        ->RemoveChild(child->id(), id_);
-  }
+  if (connection_)
+    tree_client()->RemoveChild(child->id(), id_);
 }
 
 void Window::AddTransientWindow(Window* transient_window) {
@@ -280,18 +274,15 @@
     CHECK_EQ(transient_window->connection(), connection_);
   LocalAddTransientWindow(transient_window);
   if (connection_)
-    static_cast<WindowTreeClientImpl*>(connection_)
-        ->AddTransientWindow(this, transient_window->id());
+    tree_client()->AddTransientWindow(this, transient_window->id());
 }
 
 void Window::RemoveTransientWindow(Window* transient_window) {
   if (connection_)
     CHECK_EQ(transient_window->connection(), connection_);
   LocalRemoveTransientWindow(transient_window);
-  if (connection_) {
-    static_cast<WindowTreeClientImpl*>(connection_)
-        ->RemoveTransientWindowFromParent(transient_window);
-  }
+  if (connection_)
+    tree_client()->RemoveTransientWindowFromParent(transient_window);
 }
 
 void Window::MoveToFront() {
@@ -309,10 +300,8 @@
 void Window::Reorder(Window* relative, mojom::OrderDirection direction) {
   if (!LocalReorder(relative, direction))
     return;
-  if (connection_) {
-    static_cast<WindowTreeClientImpl*>(connection_)
-        ->Reorder(id_, relative->id(), direction);
-  }
+  if (connection_)
+    tree_client()->Reorder(id_, relative->id(), direction);
 }
 
 bool Window::Contains(Window* child) const {
@@ -344,36 +333,30 @@
 }
 
 void Window::SetTextInputState(mojo::TextInputStatePtr state) {
-  if (connection_) {
-    static_cast<WindowTreeClientImpl*>(connection_)
-        ->SetWindowTextInputState(id_, state.Pass());
-  }
+  if (connection_)
+    tree_client()->SetWindowTextInputState(id_, state.Pass());
 }
 
 void Window::SetImeVisibility(bool visible, mojo::TextInputStatePtr state) {
   // SetImeVisibility() shouldn't be used if the window is not editable.
   DCHECK(state.is_null() || state->type != mojo::TEXT_INPUT_TYPE_NONE);
-  if (connection_) {
-    static_cast<WindowTreeClientImpl*>(connection_)
-        ->SetImeVisibility(id_, visible, state.Pass());
-  }
+  if (connection_)
+    tree_client()->SetImeVisibility(id_, visible, state.Pass());
 }
 
 void Window::SetPreferredSize(const gfx::Size& size) {
   if (connection_)
-    static_cast<WindowTreeClientImpl*>(connection_)
-        ->SetPreferredSize(id_, size);
+    tree_client()->SetPreferredSize(id_, size);
 }
 
 void Window::SetResizeBehavior(mojom::ResizeBehavior resize_behavior) {
   if (connection_)
-    static_cast<WindowTreeClientImpl*>(connection_)
-        ->SetResizeBehavior(id_, resize_behavior);
+    tree_client()->SetResizeBehavior(id_, resize_behavior);
 }
 
 void Window::SetFocus() {
   if (connection_)
-    static_cast<WindowTreeClientImpl*>(connection_)->SetFocus(id_);
+    tree_client()->SetFocus(id_);
 }
 
 bool Window::HasFocus() const {
@@ -388,12 +371,10 @@
 void Window::Embed(mus::mojom::WindowTreeClientPtr client,
                    uint32_t policy_bitmask,
                    const EmbedCallback& callback) {
-  if (PrepareForEmbed()) {
-    static_cast<WindowTreeClientImpl*>(connection_)
-        ->Embed(id_, client.Pass(), policy_bitmask, callback);
-  } else {
+  if (PrepareForEmbed())
+    tree_client()->Embed(id_, client.Pass(), policy_bitmask, callback);
+  else
     callback.Run(false, 0);
-  }
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -451,7 +432,7 @@
   // TODO(beng): It'd be better to do this via a destruction observer in the
   //             WindowTreeClientImpl.
   if (connection_)
-    static_cast<WindowTreeClientImpl*>(connection_)->RemoveWindow(id_);
+    tree_client()->RemoveWindow(id_);
 
   // Clear properties.
   for (auto& pair : prop_map_) {
@@ -463,7 +444,7 @@
   FOR_EACH_OBSERVER(WindowObserver, observers_, OnWindowDestroyed(this));
 
   if (connection_ && connection_->GetRoot() == this)
-    static_cast<WindowTreeClientImpl*>(connection_)->OnRootDestroyed(this);
+    tree_client()->OnRootDestroyed(this);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -479,6 +460,10 @@
       visible_(false),
       drawn_(false) {}
 
+WindowTreeClientImpl* Window::tree_client() {
+  return static_cast<WindowTreeClientImpl*>(connection_);
+}
+
 void Window::SetSharedPropertyInternal(const std::string& name,
                                        const std::vector<uint8_t>* value) {
   if (!OwnsWindowOrIsRoot(this))
@@ -492,8 +477,7 @@
         memcpy(&transport_value.front(), &(value->front()), value->size());
     }
     // TODO: add test coverage of this (450303).
-    static_cast<WindowTreeClientImpl*>(connection_)
-        ->SetProperty(this, name, transport_value.Pass());
+    tree_client()->SetProperty(this, name, transport_value.Pass());
   }
   LocalSetSharedProperty(name, value);
 }
@@ -712,10 +696,8 @@
 }
 
 bool Window::PrepareForEmbed() {
-  if (!OwnsWindow(connection_, this) &&
-      !static_cast<WindowTreeClientImpl*>(connection_)->is_embed_root()) {
+  if (!OwnsWindow(connection_, this) && !tree_client()->is_embed_root())
     return false;
-  }
 
   while (!children_.empty())
     RemoveChild(children_[0]);
diff --git a/components/mus/public/cpp/window.h b/components/mus/public/cpp/window.h
index 7c7c6a7..8eea7d5 100644
--- a/components/mus/public/cpp/window.h
+++ b/components/mus/public/cpp/window.h
@@ -29,6 +29,7 @@
 class ServiceProviderImpl;
 class WindowObserver;
 class WindowSurface;
+class WindowTreeClientImpl;
 class WindowTreeConnection;
 
 namespace {
@@ -196,6 +197,8 @@
 
   Window(WindowTreeConnection* connection, Id id);
 
+  WindowTreeClientImpl* tree_client();
+
   // Applies a shared property change locally and forwards to the server. If
   // |data| is null, this property is deleted.
   void SetSharedPropertyInternal(const std::string& name,
diff --git a/components/mus/surfaces/BUILD.gn b/components/mus/surfaces/BUILD.gn
index 8f12ed5..65889ca 100644
--- a/components/mus/surfaces/BUILD.gn
+++ b/components/mus/surfaces/BUILD.gn
@@ -31,7 +31,6 @@
     "//mojo/application/public/cpp",
     "//mojo/converters/geometry",
     "//mojo/converters/surfaces",
-    "//mojo/services/tracing/public/cpp",
     "//ui/gfx",
     "//ui/gl",
     "//ui/mojo/geometry:interfaces",
diff --git a/components/mus/ws/BUILD.gn b/components/mus/ws/BUILD.gn
index e7f9223..6556d88 100644
--- a/components/mus/ws/BUILD.gn
+++ b/components/mus/ws/BUILD.gn
@@ -74,7 +74,6 @@
     "//mojo/converters/input_events",
     "//mojo/converters/surfaces",
     "//mojo/public/cpp/bindings:callback",
-    "//mojo/services/tracing/public/cpp",
     "//ui/events",
     "//ui/events/platform",
     "//ui/gfx",
diff --git a/components/mus/ws/server_window_surface.cc b/components/mus/ws/server_window_surface.cc
index f06b052..0ee1a52b 100644
--- a/components/mus/ws/server_window_surface.cc
+++ b/components/mus/ws/server_window_surface.cc
@@ -104,8 +104,14 @@
       input->surface_quad_state->surface.To<cc::SurfaceId>().id);
   WindowId other_window_id = WindowIdFromTransportId(id);
   ServerWindow* other_window = window()->GetChildWindow(other_window_id);
-  if (!other_window)
-    return false;
+  if (!other_window) {
+    DVLOG(2) << "The window ID '" << id << "' does not exist.";
+    // TODO(fsamuel): We return true here so that the CompositorFrame isn't
+    // entirely rejected. We just drop this SurfaceDrawQuad. This failure
+    // can happen if the client has an out of date view of the window tree.
+    // It would be nice if we can avoid reaching this state in the future.
+    return true;
+  }
 
   referenced_window_ids_.insert(other_window_id);
 
diff --git a/components/pdf_viewer/BUILD.gn b/components/pdf_viewer/BUILD.gn
index 984b212b..51d6df8 100644
--- a/components/pdf_viewer/BUILD.gn
+++ b/components/pdf_viewer/BUILD.gn
@@ -27,7 +27,6 @@
     "//mojo/public/cpp/bindings",
     "//mojo/services/network/public/cpp",
     "//mojo/services/network/public/interfaces",
-    "//mojo/services/tracing/public/cpp",
     "//mojo/services/tracing/public/interfaces",
     "//third_party/pdfium",
     "//ui/gfx/geometry",
diff --git a/components/pdf_viewer/pdf_viewer.cc b/components/pdf_viewer/pdf_viewer.cc
index 5dc90974..94fae5c 100644
--- a/components/pdf_viewer/pdf_viewer.cc
+++ b/components/pdf_viewer/pdf_viewer.cc
@@ -28,7 +28,6 @@
 #include "mojo/common/data_pipe_utils.h"
 #include "mojo/public/c/system/main.h"
 #include "mojo/public/cpp/bindings/binding.h"
-#include "mojo/services/tracing/public/cpp/tracing_impl.h"
 #include "third_party/pdfium/public/fpdf_ext.h"
 #include "third_party/pdfium/public/fpdfview.h"
 #include "ui/gfx/geometry/rect.h"
@@ -341,10 +340,6 @@
 
  private:
   // ApplicationDelegate:
-  void Initialize(mojo::ApplicationImpl* app) override {
-    tracing_.Initialize(app);
-  }
-
   bool ConfigureIncomingConnection(
       mojo::ApplicationConnection* connection) override {
     connection->AddService(this);
@@ -357,8 +352,6 @@
     new ContentHandlerImpl(request.Pass());
   }
 
-  mojo::TracingImpl tracing_;
-
   DISALLOW_COPY_AND_ASSIGN(PDFViewer);
 };
 }  // namespace
diff --git a/components/resources/autofill_scaled_resources.grdp b/components/resources/autofill_scaled_resources.grdp
index ec1db8a1..83b682c3 100644
--- a/components/resources/autofill_scaled_resources.grdp
+++ b/components/resources/autofill_scaled_resources.grdp
@@ -6,7 +6,7 @@
   <structure type="chrome_scaled_image" name="IDR_AUTOFILL_CC_MASTERCARD" file="autofill/mastercard.png" />
   <structure type="chrome_scaled_image" name="IDR_AUTOFILL_CC_VISA" file="autofill/visa.png" />
 
-  <if expr="is_android">
+  <if expr="is_android and not use_aura">
     <!-- These are not used on desktop, only Android, so use a placeholder file.
          TODO(rouslan): Remove non-keyboard-accessory icon when keyboard
          accessory becomes default on Android. -->
diff --git a/components/sync_driver/fake_sync_client.cc b/components/sync_driver/fake_sync_client.cc
index 51e2b38a..8645c2d6 100644
--- a/components/sync_driver/fake_sync_client.cc
+++ b/components/sync_driver/fake_sync_client.cc
@@ -16,6 +16,9 @@
 
 void DummyClearBrowsingDataCallback(base::Time start, base::Time end) {}
 
+void DummyRegisterPlatformTypesCallback(syncer::ModelTypeSet,
+                                        syncer::ModelTypeSet) {}
+
 }  // namespace
 
 FakeSyncClient::FakeSyncClient()
@@ -63,6 +66,11 @@
   return base::Bind(&base::DoNothing);
 }
 
+sync_driver::SyncApiComponentFactory::RegisterDataTypesMethod
+FakeSyncClient::GetRegisterPlatformTypesCallback() {
+  return base::Bind(&DummyRegisterPlatformTypesCallback);
+}
+
 autofill::PersonalDataManager* FakeSyncClient::GetPersonalDataManager() {
   return nullptr;
 }
diff --git a/components/sync_driver/fake_sync_client.h b/components/sync_driver/fake_sync_client.h
index dbe53760..9a74ad3f 100644
--- a/components/sync_driver/fake_sync_client.h
+++ b/components/sync_driver/fake_sync_client.h
@@ -27,6 +27,8 @@
   scoped_refptr<password_manager::PasswordStore> GetPasswordStore() override;
   ClearBrowsingDataCallback GetClearBrowsingDataCallback() override;
   base::Closure GetPasswordStateChangedCallback() override;
+  sync_driver::SyncApiComponentFactory::RegisterDataTypesMethod
+  GetRegisterPlatformTypesCallback() override;
   autofill::PersonalDataManager* GetPersonalDataManager() override;
   scoped_refptr<autofill::AutofillWebDataService> GetWebDataService() override;
   BookmarkUndoService* GetBookmarkUndoServiceIfExists() override;
diff --git a/components/sync_driver/generic_change_processor_unittest.cc b/components/sync_driver/generic_change_processor_unittest.cc
index 2524511..63e6187 100644
--- a/components/sync_driver/generic_change_processor_unittest.cc
+++ b/components/sync_driver/generic_change_processor_unittest.cc
@@ -85,7 +85,8 @@
   MockSyncApiComponentFactory() {}
 
   // SyncApiComponentFactory implementation.
-  void RegisterDataTypes(sync_driver::SyncClient* sync_client) override {}
+  void RegisterDataTypes(
+      const RegisterDataTypesMethod& register_platform_types_method) override {}
   sync_driver::DataTypeManager* CreateDataTypeManager(
       const syncer::WeakHandle<syncer::DataTypeDebugInfoListener>&
           debug_info_listener,
@@ -97,7 +98,6 @@
   };
   browser_sync::SyncBackendHost* CreateSyncBackendHost(
       const std::string& name,
-      SyncClient* sync_client,
       invalidation::InvalidationService* invalidator,
       const base::WeakPtr<sync_driver::SyncPrefs>& sync_prefs,
       const base::FilePath& sync_folder) override {
diff --git a/components/sync_driver/shared_change_processor_unittest.cc b/components/sync_driver/shared_change_processor_unittest.cc
index 8a1a24e..d277a3bf 100644
--- a/components/sync_driver/shared_change_processor_unittest.cc
+++ b/components/sync_driver/shared_change_processor_unittest.cc
@@ -42,7 +42,8 @@
   ~TestSyncApiComponentFactory() override {}
 
   // SyncApiComponentFactory implementation.
-  void RegisterDataTypes(sync_driver::SyncClient* sync_client) override {}
+  void RegisterDataTypes(
+      const RegisterDataTypesMethod& register_platform_types_method) override {}
   sync_driver::DataTypeManager* CreateDataTypeManager(
       const syncer::WeakHandle<syncer::DataTypeDebugInfoListener>&
           debug_info_listener,
@@ -54,7 +55,6 @@
   }
   browser_sync::SyncBackendHost* CreateSyncBackendHost(
       const std::string& name,
-      SyncClient* sync_client,
       invalidation::InvalidationService* invalidator,
       const base::WeakPtr<sync_driver::SyncPrefs>& sync_prefs,
       const base::FilePath& sync_folder) override {
diff --git a/components/sync_driver/sync_api_component_factory.h b/components/sync_driver/sync_api_component_factory.h
index 937fd73..d64bba15 100644
--- a/components/sync_driver/sync_api_component_factory.h
+++ b/components/sync_driver/sync_api_component_factory.h
@@ -57,6 +57,13 @@
 class SyncApiComponentFactory {
  public:
   virtual ~SyncApiComponentFactory() {}
+  // Callback to allow platform-specific datatypes to register themselves as
+  // data type controllers.
+  // |disabled_types| and |enabled_types| control the disable/enable state of
+  // types that are on or off by default (respectively).
+  typedef base::Callback<void(syncer::ModelTypeSet disabled_types,
+                              syncer::ModelTypeSet enabled_types)>
+      RegisterDataTypesMethod;
 
   // The various factory methods for the data type model associators
   // and change processors all return this struct.  This is needed
@@ -80,7 +87,8 @@
   };
 
   // Creates and registers enabled datatypes with the provided SyncClient.
-  virtual void RegisterDataTypes(sync_driver::SyncClient* sync_client) = 0;
+  virtual void RegisterDataTypes(
+      const RegisterDataTypesMethod& register_platform_types_method) = 0;
 
   // Instantiates a new DataTypeManager with a SyncBackendHost, a list of data
   // type controllers and a DataTypeManagerObserver.  The return pointer is
@@ -96,7 +104,6 @@
   // Creating this in the factory helps us mock it out in testing.
   virtual browser_sync::SyncBackendHost* CreateSyncBackendHost(
       const std::string& name,
-      SyncClient* sync_client,
       invalidation::InvalidationService* invalidator,
       const base::WeakPtr<sync_driver::SyncPrefs>& sync_prefs,
       const base::FilePath& sync_folder) = 0;
diff --git a/components/sync_driver/sync_api_component_factory_mock.h b/components/sync_driver/sync_api_component_factory_mock.h
index 70899c51..f89e5025 100644
--- a/components/sync_driver/sync_api_component_factory_mock.h
+++ b/components/sync_driver/sync_api_component_factory_mock.h
@@ -29,7 +29,7 @@
       sync_driver::ChangeProcessor* change_processor);
   ~SyncApiComponentFactoryMock() override;
 
-  MOCK_METHOD1(RegisterDataTypes, void(sync_driver::SyncClient*));
+  MOCK_METHOD1(RegisterDataTypes, void(const RegisterDataTypesMethod&));
   MOCK_METHOD5(CreateDataTypeManager,
                sync_driver::DataTypeManager*(
                    const syncer::WeakHandle<syncer::DataTypeDebugInfoListener>&,
@@ -37,10 +37,9 @@
                    const sync_driver::DataTypeEncryptionHandler*,
                    browser_sync::SyncBackendHost*,
                    sync_driver::DataTypeManagerObserver* observer));
-  MOCK_METHOD5(CreateSyncBackendHost,
+  MOCK_METHOD4(CreateSyncBackendHost,
                browser_sync::SyncBackendHost*(
                    const std::string& name,
-                   sync_driver::SyncClient* sync_client,
                    invalidation::InvalidationService* invalidator,
                    const base::WeakPtr<sync_driver::SyncPrefs>& sync_prefs,
                    const base::FilePath& sync_folder));
diff --git a/components/sync_driver/sync_client.h b/components/sync_driver/sync_client.h
index fda584d..5f44d1d 100644
--- a/components/sync_driver/sync_client.h
+++ b/components/sync_driver/sync_client.h
@@ -10,6 +10,7 @@
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
 #include "base/time/time.h"
+#include "components/sync_driver/sync_api_component_factory.h"
 #include "sync/internal_api/public/base/model_type.h"
 #include "sync/internal_api/public/engine/model_safe_worker.h"
 #include "sync/util/extensions_activity.h"
@@ -53,7 +54,6 @@
 
 namespace sync_driver {
 
-class SyncApiComponentFactory;
 class SyncService;
 
 typedef base::Callback<void(base::Time, base::Time)> ClearBrowsingDataCallback;
@@ -69,9 +69,7 @@
   SyncClient();
   virtual ~SyncClient();
 
-  // Initializes the sync client with the specified sync service. This will also
-  // register data type controllers with |service| (via
-  // SyncApiComponentFactory::RegisterDataTypes).
+  // Initializes the sync client with the specified sync service.
   virtual void Initialize(SyncService* service) = 0;
 
   // Returns the current SyncService instance.
@@ -90,6 +88,11 @@
   // have browsing data cleared.
   virtual ClearBrowsingDataCallback GetClearBrowsingDataCallback() = 0;
 
+  // Returns a callback that will register the types specific to the current
+  // platform.
+  virtual sync_driver::SyncApiComponentFactory::RegisterDataTypesMethod
+  GetRegisterPlatformTypesCallback() = 0;
+
   // Returns a callback that will be invoked when password sync state has
   // potentially been changed.
   virtual base::Closure GetPasswordStateChangedCallback() = 0;
diff --git a/components/test_runner/web_ax_object_proxy.cc b/components/test_runner/web_ax_object_proxy.cc
index 1c3b8d7..3160dea9 100644
--- a/components/test_runner/web_ax_object_proxy.cc
+++ b/components/test_runner/web_ax_object_proxy.cc
@@ -299,9 +299,7 @@
 }
 
 std::string GetAttributes(const blink::WebAXObject& object) {
-  blink::WebAXNameFrom nameFrom;
-  blink::WebVector<blink::WebAXObject> nameObjects;
-  std::string attributes(object.name(nameFrom, nameObjects).utf8());
+  std::string attributes(object.name().utf8());
   attributes.append("\n");
   attributes.append(GetRole(object));
   return attributes;
@@ -315,7 +313,8 @@
     blink::WebAXObject inline_text_box = object.childAt(i);
     DCHECK_EQ(inline_text_box.role(), blink::WebAXRoleInlineTextBox);
     int start = end;
-    end += inline_text_box.stringValue().length();
+    blink::WebString name = inline_text_box.name();
+    end += name.length();
     if (characterIndex < start || characterIndex >= end)
       continue;
     blink::WebRect inline_text_box_rect = inline_text_box.boundingBoxRect();
@@ -323,7 +322,7 @@
     blink::WebVector<int> character_offsets;
     inline_text_box.characterOffsets(character_offsets);
     DCHECK(character_offsets.size() > 0 &&
-           character_offsets.size() == inline_text_box.stringValue().length());
+           character_offsets.size() == name.length());
     switch (inline_text_box.textDirection()) {
       case blink::WebAXTextDirectionLR: {
         if (localIndex) {
@@ -393,7 +392,8 @@
     blink::WebAXObject inline_text_box = object.childAt(i);
     DCHECK_EQ(inline_text_box.role(), blink::WebAXRoleInlineTextBox);
     int start = end;
-    end += inline_text_box.stringValue().length();
+    blink::WebString name = inline_text_box.name();
+    end += name.length();
     if (end <= character_index)
       continue;
     int localIndex = character_index - start;
@@ -1299,9 +1299,7 @@
 
 std::string WebAXObjectProxy::Name() {
   accessibility_object_.updateLayoutAndCheckValidity();
-  blink::WebAXNameFrom nameFrom;
-  blink::WebVector<blink::WebAXObject> nameObjects;
-  return accessibility_object_.name(nameFrom, nameObjects).utf8();
+  return accessibility_object_.name().utf8();
 }
 
 std::string WebAXObjectProxy::NameFrom() {
diff --git a/content/browser/accessibility/accessibility_tree_formatter_mac.mm b/content/browser/accessibility/accessibility_tree_formatter_mac.mm
index 6246242..fd5747f 100644
--- a/content/browser/accessibility/accessibility_tree_formatter_mac.mm
+++ b/content/browser/accessibility/accessibility_tree_formatter_mac.mm
@@ -105,7 +105,8 @@
   id roleDescription = [obj roleDescription];
   if ([role isEqualToString:NSAccessibilityGroupRole] &&
       roleDescription != nil &&
-      ![roleDescription isEqualToString:@""]) {
+      ![roleDescription isEqualToString:@""] &&
+      ![roleDescription isEqualToString:@"group"]) {
     [tokens addObject:roleDescription];
   }
 
@@ -239,6 +240,9 @@
 
   NSArray* defaultAttributes =
       [NSArray arrayWithObjects:NSAccessibilityTitleAttribute,
+                                NSAccessibilityTitleUIElementAttribute,
+                                NSAccessibilityDescriptionAttribute,
+                                NSAccessibilityHelpAttribute,
                                 NSAccessibilityValueAttribute,
                                 nil];
   string s_value;
diff --git a/content/browser/accessibility/android_granularity_movement_browsertest.cc b/content/browser/accessibility/android_granularity_movement_browsertest.cc
index 6ddf830..74a67a4 100644
--- a/content/browser/accessibility/android_granularity_movement_browsertest.cc
+++ b/content/browser/accessibility/android_granularity_movement_browsertest.cc
@@ -204,7 +204,7 @@
   BrowserAccessibility* pre = root->PlatformGetChild(0);
   ASSERT_EQ(0U, pre->PlatformChildCount());
 
-  ASSERT_EQ(base::ASCIIToUTF16("'One,', 'two,', 'three!'"),
+  ASSERT_EQ(base::ASCIIToUTF16("'One, ', 'two, ', 'three!'"),
             TraverseNodeAtGranularity(pre, GRANULARITY_LINE));
 }
 
diff --git a/content/browser/accessibility/browser_accessibility.cc b/content/browser/accessibility/browser_accessibility.cc
index bf9faf2..196656c 100644
--- a/content/browser/accessibility/browser_accessibility.cc
+++ b/content/browser/accessibility/browser_accessibility.cc
@@ -270,7 +270,7 @@
     }
 
     std::string child_text;
-    child->GetStringAttribute(ui::AX_ATTR_VALUE, &child_text);
+    child->GetStringAttribute(ui::AX_ATTR_NAME, &child_text);
     int child_len = static_cast<int>(child_text.size());
     child_start = child_end;
     child_end += child_len;
@@ -369,7 +369,7 @@
         BrowserAccessibility* child = InternalGetChild(i);
         DCHECK_EQ(child->GetRole(), ui::AX_ROLE_INLINE_TEXT_BOX);
         const std::string& child_text = child->GetStringAttribute(
-            ui::AX_ATTR_VALUE);
+            ui::AX_ATTR_NAME);
         int child_len = static_cast<int>(child_text.size());
         child_end += child_len; // End is one past the last character.
 
@@ -725,10 +725,32 @@
   }
 }
 
+std::string BrowserAccessibility::ComputeAccessibleNameFromDescendants() {
+  std::string name;
+  for (size_t i = 0; i < InternalChildCount(); ++i) {
+    BrowserAccessibility* child = InternalGetChild(i);
+    std::string child_name;
+    if (child->GetStringAttribute(ui::AX_ATTR_NAME, &child_name)) {
+      if (!name.empty())
+        name += " ";
+      name += child_name;
+    } else if (!child->HasState(ui::AX_STATE_FOCUSABLE)) {
+      child_name = child->ComputeAccessibleNameFromDescendants();
+      if (!child_name.empty()) {
+        if (!name.empty())
+          name += " ";
+        name += child_name;
+      }
+    }
+  }
+
+  return name;
+}
+
 int BrowserAccessibility::GetStaticTextLenRecursive() const {
   if (GetRole() == ui::AX_ROLE_STATIC_TEXT ||
       GetRole() == ui::AX_ROLE_LINE_BREAK) {
-    return static_cast<int>(GetStringAttribute(ui::AX_ATTR_VALUE).size());
+    return static_cast<int>(GetStringAttribute(ui::AX_ATTR_NAME).size());
   }
 
   int len = 0;
diff --git a/content/browser/accessibility/browser_accessibility.h b/content/browser/accessibility/browser_accessibility.h
index d820508..a516b5f 100644
--- a/content/browser/accessibility/browser_accessibility.h
+++ b/content/browser/accessibility/browser_accessibility.h
@@ -298,6 +298,10 @@
   bool IsControl() const;
   bool IsTextControl() const;
 
+  // If an object is focusable but has no accessible name, use this
+  // to compute a name from its descendants.
+  std::string ComputeAccessibleNameFromDescendants();
+
  protected:
   BrowserAccessibility();
 
diff --git a/content/browser/accessibility/browser_accessibility_android.cc b/content/browser/accessibility/browser_accessibility_android.cc
index c16eb8d7..96411cb 100644
--- a/content/browser/accessibility/browser_accessibility_android.cc
+++ b/content/browser/accessibility/browser_accessibility_android.cc
@@ -315,9 +315,8 @@
     return base::string16();
   }
 
-  // See comment in browser_accessibility_win.cc for details.
-  // The difference here is that we can only expose one accessible
-  // name on Android, not 2 or 3 like on Windows or Mac.
+  // We can only expose one accessible name on Android,
+  // not 2 or 3 like on Windows or Mac.
 
   // First, always return the |value| attribute if this is an
   // input field.
@@ -345,57 +344,17 @@
         base::StringPrintf("#%02X%02X%02X", red, green, blue));
   }
 
-  // Always prefer visible text if this is a link. Sites sometimes add
-  // a "title" attribute to a link with more information, but we can't
-  // lose the link text.
-  base::string16 name = GetString16Attribute(ui::AX_ATTR_NAME);
-  if (!name.empty() && GetRole() == ui::AX_ROLE_LINK)
-    return name;
-
-  // If there's no text value, the basic rule is: prefer description
-  // (aria-labelledby or aria-label), then help (title), then name
-  // (inner text), then value (control value).  However, if
-  // title_elem_id is set, that means there's a label element
-  // supplying the name and then name takes precedence over help.
-  // TODO(dmazzoni): clean this up by providing more granular labels in
-  // Blink, making the platform-specific mapping to accessible text simpler.
+  base::string16 text = GetString16Attribute(ui::AX_ATTR_NAME);
   base::string16 description = GetString16Attribute(ui::AX_ATTR_DESCRIPTION);
-  base::string16 help = GetString16Attribute(ui::AX_ATTR_HELP);
-
-  base::string16 placeholder;
-  switch (GetRole()) {
-    case ui::AX_ROLE_DATE:
-    case ui::AX_ROLE_INPUT_TIME:
-    case ui::AX_ROLE_TEXT_FIELD:
-      GetHtmlAttribute("placeholder", &placeholder);
-  }
-
-  int title_elem_id = GetIntAttribute(
-      ui::AX_ATTR_TITLE_UI_ELEMENT);
-  base::string16 text;
-  if (!description.empty())
-    text = description;
-  else if (!name.empty()) {
-    text = name;
-    if (!help.empty()) {
-      // TODO(vkuzkokov): This is not the best way to pass 2 texts but this is
-      // how Blink seems to be doing it.
+  if (!description.empty()) {
+    if (!text.empty())
       text += base::ASCIIToUTF16(" ");
-      text += help;
-    }
-  } else if (!help.empty())
-    text = help;
-  else if (!placeholder.empty())
-    text = placeholder;
-  else if (!value.empty())
-    text = value;
-  else if (title_elem_id) {
-    BrowserAccessibility* title_elem =
-          manager()->GetFromID(title_elem_id);
-    if (title_elem)
-      text = static_cast<BrowserAccessibilityAndroid*>(title_elem)->GetText();
+    text += description;
   }
 
+  if (text.empty())
+    text = value;
+
   // This is called from PlatformIsLeaf, so don't call PlatformChildCount
   // from within this!
   if (text.empty() &&
@@ -410,7 +369,7 @@
   if (text.empty() && (IsLink() || GetRole() == ui::AX_ROLE_IMAGE)) {
     base::string16 url = GetString16Attribute(ui::AX_ATTR_URL);
     // Given a url like http://foo.com/bar/baz.png, just return the
-    // base name, e.g., "baz".
+    // base text, e.g., "baz".
     int trailing_slashes = 0;
     while (url.size() - trailing_slashes > 0 &&
            url[url.size() - trailing_slashes - 1] == '/') {
diff --git a/content/browser/accessibility/browser_accessibility_cocoa.h b/content/browser/accessibility/browser_accessibility_cocoa.h
index bdfe922..888cc4bb 100644
--- a/content/browser/accessibility/browser_accessibility_cocoa.h
+++ b/content/browser/accessibility/browser_accessibility_cocoa.h
@@ -37,6 +37,10 @@
 // from browserAccessibility_.
 - (ui::AXRole)internalRole;
 
+// Convenience method to determine if this object should expose its
+// accessible name in AXValue (as opposed to AXTitle/AXDescription).
+- (bool)shouldExposeNameInAXValue;
+
 // Convenience method to get the BrowserAccessibilityDelegate from
 // the manager.
 - (content::BrowserAccessibilityDelegate*)delegate;
diff --git a/content/browser/accessibility/browser_accessibility_cocoa.mm b/content/browser/accessibility/browser_accessibility_cocoa.mm
index 1007e5e6..84cf94c6 100644
--- a/content/browser/accessibility/browser_accessibility_cocoa.mm
+++ b/content/browser/accessibility/browser_accessibility_cocoa.mm
@@ -552,34 +552,69 @@
 }
 
 - (NSString*)description {
-  std::string description;
-  if (browserAccessibility_->GetStringAttribute(
-          ui::AX_ATTR_DESCRIPTION, &description)) {
-    return base::SysUTF8ToNSString(description);
-  }
-
-  // If the role is anything other than an image, or if there's
-  // a title or title UI element, just return an empty string.
-  if (![[self role] isEqualToString:NSAccessibilityImageRole])
-    return @"";
-  if (browserAccessibility_->HasStringAttribute(
-          ui::AX_ATTR_NAME)) {
-    return @"";
-  }
-  if ([self titleUIElement])
+  // Mac OS X wants static text exposed in AXValue.
+  if ([self shouldExposeNameInAXValue])
     return @"";
 
-  // The remaining case is an image where there's no other title.
-  // Return the base part of the filename as the description.
-  std::string url;
-  if (browserAccessibility_->GetStringAttribute(
-          ui::AX_ATTR_URL, &url)) {
-    // Given a url like http://foo.com/bar/baz.png, just return the
-    // base name, e.g., "baz.png".
-    size_t leftIndex = url.rfind('/');
-    std::string basename =
-        leftIndex != std::string::npos ? url.substr(leftIndex) : url;
-    return base::SysUTF8ToNSString(basename);
+  // If the name came from a single related element and it's present in the
+  // tree, it will be exposed in AXTitleUIElement.
+  std::vector<int32> labelledby_ids =
+      browserAccessibility_->GetIntListAttribute(ui::AX_ATTR_LABELLEDBY_IDS);
+  ui::AXNameFrom nameFrom = static_cast<ui::AXNameFrom>(
+      browserAccessibility_->GetIntAttribute(ui::AX_ATTR_NAME_FROM));
+  if (nameFrom == ui::AX_NAME_FROM_RELATED_ELEMENT &&
+      labelledby_ids.size() == 1 &&
+      browserAccessibility_->manager()->GetFromID(labelledby_ids[0])) {
+    return @"";
+  }
+
+  std::string name = browserAccessibility_->GetStringAttribute(
+      ui::AX_ATTR_NAME);
+  if (!name.empty()) {
+    // On Mac OS X, the accessible name of an object is exposed as its
+    // title if it comes from visible text, and as its description
+    // otherwise, but never both.
+    if (nameFrom == ui::AX_NAME_FROM_CONTENTS ||
+        nameFrom == ui::AX_NAME_FROM_RELATED_ELEMENT ||
+        nameFrom == ui::AX_NAME_FROM_VALUE) {
+      return @"";
+    } else {
+      return base::SysUTF8ToNSString(name);
+    }
+  }
+
+  // Given an image where there's no other title, return the base part
+  // of the filename as the description.
+  if ([[self role] isEqualToString:NSAccessibilityImageRole]) {
+    if (browserAccessibility_->HasStringAttribute(ui::AX_ATTR_NAME))
+      return @"";
+    if ([self titleUIElement])
+      return @"";
+
+    std::string url;
+    if (browserAccessibility_->GetStringAttribute(
+            ui::AX_ATTR_URL, &url)) {
+      // Given a url like http://foo.com/bar/baz.png, just return the
+      // base name, e.g., "baz.png".
+      size_t leftIndex = url.rfind('/');
+      std::string basename =
+          leftIndex != std::string::npos ? url.substr(leftIndex) : url;
+      return base::SysUTF8ToNSString(basename);
+    }
+  }
+
+  // If it's focusable but didn't have any other name or value, compute a name
+  // from its descendants.
+  std::string value = browserAccessibility_->GetStringAttribute(
+      ui::AX_ATTR_VALUE);
+  if (browserAccessibility_->HasState(ui::AX_STATE_FOCUSABLE) &&
+      !browserAccessibility_->IsControl() &&
+      value.empty() &&
+      [self internalRole] != ui::AX_ROLE_DATE_TIME &&
+      [self internalRole] != ui::AX_ROLE_WEB_AREA &&
+      [self internalRole] != ui::AX_ROLE_ROOT_WEB_AREA) {
+    return base::SysUTF8ToNSString(
+        browserAccessibility_->ComputeAccessibleNameFromDescendants());
   }
 
   return @"";
@@ -679,7 +714,7 @@
 
 - (NSString*)help {
   return NSStringForStringAttribute(
-      browserAccessibility_, ui::AX_ATTR_HELP);
+      browserAccessibility_, ui::AX_ATTR_DESCRIPTION);
 }
 
 - (NSNumber*)index {
@@ -735,6 +770,20 @@
 }
 
 - (NSString*)placeholderValue {
+  ui::AXNameFrom nameFrom = static_cast<ui::AXNameFrom>(
+      browserAccessibility_->GetIntAttribute(ui::AX_ATTR_NAME_FROM));
+  if (nameFrom == ui::AX_NAME_FROM_PLACEHOLDER) {
+    return NSStringForStringAttribute(
+        browserAccessibility_, ui::AX_ATTR_NAME);
+  }
+
+  ui::AXDescriptionFrom descriptionFrom = static_cast<ui::AXDescriptionFrom>(
+      browserAccessibility_->GetIntAttribute(ui::AX_ATTR_DESCRIPTION_FROM));
+  if (descriptionFrom == ui::AX_DESCRIPTION_FROM_PLACEHOLDER) {
+    return NSStringForStringAttribute(
+        browserAccessibility_, ui::AX_ATTR_DESCRIPTION);
+  }
+
   return NSStringForStringAttribute(
       browserAccessibility_, ui::AX_ATTR_PLACEHOLDER);
 }
@@ -753,7 +802,6 @@
 
 - (NSArray*)linkedUIElements {
   NSMutableArray* ret = [[[NSMutableArray alloc] init] autorelease];
-  [self addLinkedUIElementsFromAttribute:ui::AX_ATTR_OWNS_IDS addTo:ret];
   [self addLinkedUIElementsFromAttribute:ui::AX_ATTR_CONTROLS_IDS addTo:ret];
   [self addLinkedUIElementsFromAttribute:ui::AX_ATTR_FLOWTO_IDS addTo:ret];
   if ([ret count] == 0)
@@ -837,6 +885,19 @@
   return static_cast<ui::AXRole>(browserAccessibility_->GetRole());
 }
 
+// Returns true if this should expose its accessible name in AXValue.
+- (bool)shouldExposeNameInAXValue {
+  switch ([self internalRole]) {
+    case ui::AX_ROLE_LIST_BOX_OPTION:
+    case ui::AX_ROLE_LIST_MARKER:
+    case ui::AX_ROLE_MENU_LIST_OPTION:
+    case ui::AX_ROLE_STATIC_TEXT:
+      return true;
+    default:
+      return false;
+  }
+}
+
 - (content::BrowserAccessibilityDelegate*)delegate {
   return browserAccessibility_->manager() ?
       browserAccessibility_->manager()->delegate() :
@@ -1177,22 +1238,42 @@
 }
 
 - (NSString*)title {
-  return NSStringForStringAttribute(
-      browserAccessibility_, ui::AX_ATTR_NAME);
+  // Mac OS X wants static text exposed in AXValue.
+  if ([self shouldExposeNameInAXValue])
+    return @"";
+
+  // If the name came from a single related element and it's present in the
+  // tree, it will be exposed in AXTitleUIElement.
+  std::vector<int32> labelledby_ids =
+      browserAccessibility_->GetIntListAttribute(ui::AX_ATTR_LABELLEDBY_IDS);
+  ui::AXNameFrom nameFrom = static_cast<ui::AXNameFrom>(
+      browserAccessibility_->GetIntAttribute(ui::AX_ATTR_NAME_FROM));
+  if (nameFrom == ui::AX_NAME_FROM_RELATED_ELEMENT &&
+      labelledby_ids.size() == 1 &&
+      browserAccessibility_->manager()->GetFromID(labelledby_ids[0])) {
+    return @"";
+  }
+
+  // On Mac OS X, the accessible name of an object is exposed as its
+  // title if it comes from visible text, and as its description
+  // otherwise, but never both.
+  if (nameFrom == ui::AX_NAME_FROM_CONTENTS ||
+      nameFrom == ui::AX_NAME_FROM_RELATED_ELEMENT ||
+      nameFrom == ui::AX_NAME_FROM_VALUE) {
+    return NSStringForStringAttribute(
+        browserAccessibility_, ui::AX_ATTR_NAME);
+  }
+
+  return nil;
 }
 
 - (id)titleUIElement {
-  int titleElementId;
-  if (browserAccessibility_->GetIntAttribute(
-          ui::AX_ATTR_TITLE_UI_ELEMENT, &titleElementId)) {
-    BrowserAccessibility* titleElement =
-        browserAccessibility_->manager()->GetFromID(titleElementId);
-    if (titleElement)
-      return titleElement->ToBrowserAccessibilityCocoa();
-  }
   std::vector<int32> labelledby_ids =
       browserAccessibility_->GetIntListAttribute(ui::AX_ATTR_LABELLEDBY_IDS);
-  if (labelledby_ids.size() == 1) {
+  ui::AXNameFrom nameFrom = static_cast<ui::AXNameFrom>(
+      browserAccessibility_->GetIntAttribute(ui::AX_ATTR_NAME_FROM));
+  if (nameFrom == ui::AX_NAME_FROM_RELATED_ELEMENT &&
+      labelledby_ids.size() == 1) {
     BrowserAccessibility* titleElement =
         browserAccessibility_->manager()->GetFromID(labelledby_ids[0]);
     if (titleElement)
@@ -1216,11 +1297,11 @@
 }
 
 - (id)value {
-  // WebCore uses an attachmentView to get the below behavior.
-  // We do not have any native views backing this object, so need
-  // to approximate Cocoa ax behavior best as we can.
   NSString* role = [self role];
-  if ([role isEqualToString:@"AXHeading"]) {
+  if ([self shouldExposeNameInAXValue]) {
+    return NSStringForStringAttribute(
+        browserAccessibility_, ui::AX_ATTR_NAME);
+  } else if ([role isEqualToString:@"AXHeading"]) {
     int level = 0;
     if (browserAccessibility_->GetIntAttribute(
             ui::AX_ATTR_HIERARCHICAL_LEVEL, &level)) {
@@ -1835,10 +1916,9 @@
   }
 
   // Title UI Element.
-  if (browserAccessibility_->HasIntAttribute(ui::AX_ATTR_TITLE_UI_ELEMENT) ||
-      (browserAccessibility_->HasIntListAttribute(ui::AX_ATTR_LABELLEDBY_IDS) &&
-       browserAccessibility_->GetIntListAttribute(ui::AX_ATTR_LABELLEDBY_IDS)
-                            .size() == 1)) {
+  if (browserAccessibility_->HasIntListAttribute(ui::AX_ATTR_LABELLEDBY_IDS) &&
+      browserAccessibility_->GetIntListAttribute(ui::AX_ATTR_LABELLEDBY_IDS)
+                            .size() > 0) {
     [ret addObjectsFromArray:[NSArray arrayWithObjects:
          NSAccessibilityTitleUIElementAttribute,
          nil]];
@@ -1870,8 +1950,9 @@
     return NO;
 
   if ([attribute isEqualToString:NSAccessibilityFocusedAttribute])
-    return GetState(browserAccessibility_,
-        ui::AX_STATE_FOCUSABLE);
+    if ([self internalRole] == ui::AX_ROLE_DATE_TIME)
+      return NO;
+    return GetState(browserAccessibility_, ui::AX_STATE_FOCUSABLE);
   if ([attribute isEqualToString:NSAccessibilityValueAttribute]) {
     return browserAccessibility_->GetBoolAttribute(
         ui::AX_ATTR_CAN_SET_VALUE);
diff --git a/content/browser/accessibility/browser_accessibility_mac_unittest.mm b/content/browser/accessibility/browser_accessibility_mac_unittest.mm
index 34874e3..c85957f 100644
--- a/content/browser/accessibility/browser_accessibility_mac_unittest.mm
+++ b/content/browser/accessibility/browser_accessibility_mac_unittest.mm
@@ -30,7 +30,7 @@
     root.location.set_width(500);
     root.location.set_height(100);
     root.role = ui::AX_ROLE_ROOT_WEB_AREA;
-    root.AddStringAttribute(ui::AX_ATTR_HELP, "HelpText");
+    root.AddStringAttribute(ui::AX_ATTR_DESCRIPTION, "HelpText");
     root.child_ids.push_back(1001);
     root.child_ids.push_back(1002);
 
@@ -66,7 +66,8 @@
   BrowserAccessibilityCocoa* firstChild =
       [accessibility_ accessibilityHitTest:NSMakePoint(50, 50)];
   EXPECT_NSEQ(@"Child1",
-      [firstChild accessibilityAttributeValue:NSAccessibilityTitleAttribute]);
+      [firstChild
+       accessibilityAttributeValue:NSAccessibilityDescriptionAttribute]);
 }
 
 // Test doing a hit test on the edge of a child.
@@ -74,7 +75,8 @@
   BrowserAccessibilityCocoa* firstChild =
       [accessibility_ accessibilityHitTest:NSZeroPoint];
   EXPECT_NSEQ(@"Child1",
-      [firstChild accessibilityAttributeValue:NSAccessibilityTitleAttribute]);
+      [firstChild
+       accessibilityAttributeValue:NSAccessibilityDescriptionAttribute]);
 }
 
 // This will test a hit test with invalid coordinates.  It is assumed that
@@ -105,7 +107,7 @@
   BrowserAccessibilityCocoa* retainedFirstChild =
       [accessibility_ accessibilityHitTest:NSMakePoint(50, 50)];
   EXPECT_NSEQ(@"Child1", [retainedFirstChild
-      accessibilityAttributeValue:NSAccessibilityTitleAttribute]);
+      accessibilityAttributeValue:NSAccessibilityDescriptionAttribute]);
 
   // Retain it. This simulates what the system might do with an
   // accessibility object.
@@ -116,7 +118,7 @@
 
   // Now any attributes we query should return nil.
   EXPECT_EQ(nil, [retainedFirstChild
-      accessibilityAttributeValue:NSAccessibilityTitleAttribute]);
+      accessibilityAttributeValue:NSAccessibilityDescriptionAttribute]);
 
   // Don't leak memory in the test.
   [retainedFirstChild release];
diff --git a/content/browser/accessibility/browser_accessibility_manager_unittest.cc b/content/browser/accessibility/browser_accessibility_manager_unittest.cc
index d721c3ac..7604b3b 100644
--- a/content/browser/accessibility/browser_accessibility_manager_unittest.cc
+++ b/content/browser/accessibility/browser_accessibility_manager_unittest.cc
@@ -633,14 +633,14 @@
 
   ui::AXNodeData static_text;
   static_text.id = 2;
-  static_text.SetValue("Hello, world.");
+  static_text.SetName("Hello, world.");
   static_text.role = ui::AX_ROLE_STATIC_TEXT;
   static_text.location = gfx::Rect(100, 100, 29, 18);
   root.child_ids.push_back(2);
 
   ui::AXNodeData inline_text1;
   inline_text1.id = 3;
-  inline_text1.SetValue("Hello, ");
+  inline_text1.SetName("Hello, ");
   inline_text1.role = ui::AX_ROLE_INLINE_TEXT_BOX;
   inline_text1.location = gfx::Rect(100, 100, 29, 9);
   inline_text1.AddIntAttribute(ui::AX_ATTR_TEXT_DIRECTION,
@@ -659,7 +659,7 @@
 
   ui::AXNodeData inline_text2;
   inline_text2.id = 4;
-  inline_text2.SetValue("world.");
+  inline_text2.SetName("world.");
   inline_text2.role = ui::AX_ROLE_INLINE_TEXT_BOX;
   inline_text2.location = gfx::Rect(100, 109, 28, 9);
   inline_text2.AddIntAttribute(ui::AX_ATTR_TEXT_DIRECTION,
@@ -728,14 +728,14 @@
 
   ui::AXNodeData static_text;
   static_text.id = 2;
-  static_text.SetValue("123abc");
+  static_text.SetName("123abc");
   static_text.role = ui::AX_ROLE_STATIC_TEXT;
   static_text.location = gfx::Rect(100, 100, 60, 20);
   root.child_ids.push_back(2);
 
   ui::AXNodeData inline_text1;
   inline_text1.id = 3;
-  inline_text1.SetValue("123");
+  inline_text1.SetName("123");
   inline_text1.role = ui::AX_ROLE_INLINE_TEXT_BOX;
   inline_text1.location = gfx::Rect(100, 100, 30, 20);
   inline_text1.AddIntAttribute(ui::AX_ATTR_TEXT_DIRECTION,
@@ -750,7 +750,7 @@
 
   ui::AXNodeData inline_text2;
   inline_text2.id = 4;
-  inline_text2.SetValue("abc");
+  inline_text2.SetName("abc");
   inline_text2.role = ui::AX_ROLE_INLINE_TEXT_BOX;
   inline_text2.location = gfx::Rect(130, 100, 30, 20);
   inline_text2.AddIntAttribute(ui::AX_ATTR_TEXT_DIRECTION,
@@ -803,14 +803,14 @@
 
   ui::AXNodeData static_text;
   static_text.id = 2;
-  static_text.SetValue("ABC");
+  static_text.SetName("ABC");
   static_text.role = ui::AX_ROLE_STATIC_TEXT;
   static_text.location = gfx::Rect(100, 100, 16, 9);
   root.child_ids.push_back(2);
 
   ui::AXNodeData inline_text;
   inline_text.id = 3;
-  inline_text.SetValue("ABC");
+  inline_text.SetName("ABC");
   inline_text.role = ui::AX_ROLE_INLINE_TEXT_BOX;
   inline_text.location = gfx::Rect(100, 100, 16, 9);
   inline_text.AddIntAttribute(ui::AX_ATTR_TEXT_DIRECTION,
@@ -864,7 +864,7 @@
 
   ui::AXNodeData static_text1;
   static_text1.id = 3;
-  static_text1.SetValue("AB");
+  static_text1.SetName("AB");
   static_text1.role = ui::AX_ROLE_STATIC_TEXT;
   static_text1.location = gfx::Rect(100, 100, 40, 20);
   static_text1.child_ids.push_back(6);
@@ -876,14 +876,14 @@
 
   ui::AXNodeData static_text2;
   static_text2.id = 5;
-  static_text2.SetValue("CD");
+  static_text2.SetName("CD");
   static_text2.role = ui::AX_ROLE_STATIC_TEXT;
   static_text2.location = gfx::Rect(160, 100, 40, 20);
   static_text2.child_ids.push_back(7);
 
   ui::AXNodeData inline_text1;
   inline_text1.id = 6;
-  inline_text1.SetValue("AB");
+  inline_text1.SetName("AB");
   inline_text1.role = ui::AX_ROLE_INLINE_TEXT_BOX;
   inline_text1.location = gfx::Rect(100, 100, 40, 20);
   inline_text1.AddIntAttribute(ui::AX_ATTR_TEXT_DIRECTION,
@@ -896,7 +896,7 @@
 
   ui::AXNodeData inline_text2;
   inline_text2.id = 7;
-  inline_text2.SetValue("CD");
+  inline_text2.SetName("CD");
   inline_text2.role = ui::AX_ROLE_INLINE_TEXT_BOX;
   inline_text2.location = gfx::Rect(160, 100, 40, 20);
   inline_text2.AddIntAttribute(ui::AX_ATTR_TEXT_DIRECTION,
diff --git a/content/browser/accessibility/browser_accessibility_win.cc b/content/browser/accessibility/browser_accessibility_win.cc
index 175ddfa6..0ee584e 100644
--- a/content/browser/accessibility/browser_accessibility_win.cc
+++ b/content/browser/accessibility/browser_accessibility_win.cc
@@ -456,18 +456,7 @@
   if (!help)
     return E_INVALIDARG;
 
-  BrowserAccessibilityWin* target = GetTargetFromChildID(var_id);
-  if (!target)
-    return E_INVALIDARG;
-
-  base::string16 help_str = target->help();
-  if (help_str.empty())
-    return S_FALSE;
-
-  *help = SysAllocString(help_str.c_str());
-
-  DCHECK(*help);
-  return S_OK;
+  return S_FALSE;
 }
 
 STDMETHODIMP BrowserAccessibilityWin::get_accKeyboardShortcut(VARIANT var_id,
@@ -498,19 +487,6 @@
     return E_INVALIDARG;
 
   base::string16 name_str = target->name();
-
-  // If the name is empty, see if it's labeled by another element.
-  if (name_str.empty()) {
-    int title_elem_id;
-    if (target->GetIntAttribute(ui::AX_ATTR_TITLE_UI_ELEMENT,
-                                &title_elem_id)) {
-      BrowserAccessibilityWin* title_elem =
-          manager()->GetFromID(title_elem_id)->ToBrowserAccessibilityWin();
-      if (title_elem)
-        name_str = title_elem->GetNameRecursive();
-    }
-  }
-
   if (name_str.empty())
     return S_FALSE;
 
@@ -2145,6 +2121,7 @@
 
   base::string16 substr = text_str.substr(start_offset,
                                           end_offset - start_offset);
+
   if (substr.empty())
     return S_FALSE;
 
@@ -3404,98 +3381,22 @@
     }
   }
 
-  // The calculation of the accessible name of an element has been
-  // standardized in the HTML to Platform Accessibility APIs Implementation
-  // Guide (http://www.w3.org/TR/html-aapi/). In order to return the
-  // appropriate accessible name on Windows, we need to apply some logic
-  // to the fields we get from WebKit.
-  //
-  // TODO(dmazzoni): move most of this logic into WebKit.
-  //
-  // WebKit gives us:
-  //
-  //   name: the default name, e.g. inner text
-  //   title ui element: a reference to a <label> element on the same
-  //       page that labels this node.
-  //   description: accessible labels that override the default name:
-  //       aria-label or aria-labelledby or aria-describedby
-  //   help: the value of the "title" attribute
-  //
-  // On Windows, the logic we apply lets some fields take precedence and
-  // always returns the primary name in "name" and the secondary name,
-  // if any, in "description".
+  win_attributes_->name = GetString16Attribute(ui::AX_ATTR_NAME);
+  win_attributes_->description = GetString16Attribute(ui::AX_ATTR_DESCRIPTION);
 
-  int title_elem_id = GetIntAttribute(ui::AX_ATTR_TITLE_UI_ELEMENT);
-  base::string16 name = GetString16Attribute(ui::AX_ATTR_NAME);
-  base::string16 description = GetString16Attribute(ui::AX_ATTR_DESCRIPTION);
-  base::string16 help = GetString16Attribute(ui::AX_ATTR_HELP);
   base::string16 value = GetString16Attribute(ui::AX_ATTR_VALUE);
 
-  // WebKit annoyingly puts the title in the description if there's no other
-  // description, which just confuses the rest of the logic. Put it back.
-  // Now "help" is always the value of the "title" attribute, if present.
-  base::string16 title_attr;
-  if (GetHtmlAttribute("title", &title_attr) &&
-      description == title_attr &&
-      help.empty()) {
-    help = description;
-    description.clear();
-  }
-
-  // Now implement the main logic: the descripion should become the name if
-  // it's nonempty, and the help should become the description if
-  // there's no description - or the name if there's no name or description.
-  if (!description.empty()) {
-    name = description;
-    description.clear();
-  }
-  if (!help.empty() && description.empty()) {
-    description = help;
-    help.clear();
-  }
-  if (!description.empty() && name.empty() && !title_elem_id) {
-    name = description;
-    description.clear();
-  }
-
-  // If it's a text field, also consider the placeholder.
-  base::string16 placeholder;
-  if (GetRole() == ui::AX_ROLE_TEXT_FIELD &&
-      HasState(ui::AX_STATE_FOCUSABLE) &&
-      GetHtmlAttribute("placeholder", &placeholder)) {
-    if (name.empty() && !title_elem_id) {
-      name = placeholder;
-    } else if (description.empty()) {
-      description = placeholder;
-    }
-  }
-
   // On Windows, the value of a document should be its url.
   if (GetRole() == ui::AX_ROLE_ROOT_WEB_AREA ||
       GetRole() == ui::AX_ROLE_WEB_AREA) {
     value = base::UTF8ToUTF16(manager()->GetTreeData().url);
   }
 
-  // For certain roles (listbox option, static text, and list marker)
-  // WebKit stores the main accessible text in the "value" - swap it so
-  // that it's the "name".
-  if (name.empty() &&
-      (GetRole() == ui::AX_ROLE_STATIC_TEXT ||
-       GetRole() == ui::AX_ROLE_LIST_MARKER ||
-       IsListBoxOptionOrMenuListOption())) {
-    base::string16 tmp = value;
-    value = name;
-    name = tmp;
-  }
-
   // If this doesn't have a value and is linked then set its value to the url
   // attribute. This allows screen readers to read an empty link's destination.
   if (value.empty() && (ia_state() & STATE_SYSTEM_LINKED))
     value = GetString16Attribute(ui::AX_ATTR_URL);
 
-  win_attributes_->name = name;
-  win_attributes_->description = description;
-  win_attributes_->help = help;
   win_attributes_->value = value;
 
   // Clear any old relationships between this node and other nodes.
@@ -3504,17 +3405,10 @@
   relations_.clear();
 
   // Handle title UI element.
-  if (title_elem_id) {
-    // Add a labelled by relationship.
-    CComObject<BrowserAccessibilityRelation>* relation;
-    HRESULT hr = CComObject<BrowserAccessibilityRelation>::CreateInstance(
-        &relation);
-    DCHECK(SUCCEEDED(hr));
-    relation->AddRef();
-    relation->Initialize(this, IA2_RELATION_LABELLED_BY);
-    relation->AddTarget(title_elem_id);
-    relations_.push_back(relation);
-  }
+  AddRelations(ui::AX_ATTR_CONTROLS_IDS, IA2_RELATION_CONTROLLER_FOR);
+  AddRelations(ui::AX_ATTR_DESCRIBEDBY_IDS, IA2_RELATION_DESCRIBED_BY);
+  AddRelations(ui::AX_ATTR_FLOWTO_IDS, IA2_RELATION_FLOWS_TO);
+  AddRelations(ui::AX_ATTR_LABELLEDBY_IDS, IA2_RELATION_LABELLED_BY);
 
   UpdateRequiredAttributes();
   // If this is a web area for a presentational iframe, give it a role of
@@ -3581,8 +3475,6 @@
       manager->MaybeCallNotifyWinEvent(EVENT_OBJECT_NAMECHANGE, this);
     if (description() != old_win_attributes_->description)
       manager->MaybeCallNotifyWinEvent(EVENT_OBJECT_DESCRIPTIONCHANGE, this);
-    if (help() != old_win_attributes_->help)
-      manager->MaybeCallNotifyWinEvent(EVENT_OBJECT_HELPCHANGE, this);
     if (value() != old_win_attributes_->value)
       manager->MaybeCallNotifyWinEvent(EVENT_OBJECT_VALUECHANGE, this);
     if (ia_state() != old_win_attributes_->ia_state)
@@ -4230,6 +4122,25 @@
   }
 }
 
+void BrowserAccessibilityWin::AddRelations(
+    ui::AXIntListAttribute src_attr,
+    const base::string16& iaccessiblerelation_type) {
+  if (!HasIntListAttribute(src_attr))
+    return;
+
+  const std::vector<int32>& ids = GetIntListAttribute(src_attr);
+  for (size_t i = 0; i < ids.size(); ++i) {
+    CComObject<BrowserAccessibilityRelation>* relation;
+    HRESULT hr = CComObject<BrowserAccessibilityRelation>::CreateInstance(
+        &relation);
+    DCHECK(SUCCEEDED(hr));
+    relation->AddRef();
+    relation->Initialize(this, iaccessiblerelation_type);
+    relation->AddTarget(ids[i]);
+    relations_.push_back(relation);
+  }
+}
+
 void BrowserAccessibilityWin::InitRoleAndState() {
   int32 ia_role = 0;
   int32 ia_state = 0;
diff --git a/content/browser/accessibility/browser_accessibility_win.h b/content/browser/accessibility/browser_accessibility_win.h
index efcb42e..8004cbd 100644
--- a/content/browser/accessibility/browser_accessibility_win.h
+++ b/content/browser/accessibility/browser_accessibility_win.h
@@ -721,7 +721,6 @@
   }
   base::string16 name() const { return win_attributes_->name; }
   base::string16 description() const { return win_attributes_->description; }
-  base::string16 help() const { return win_attributes_->help; }
   base::string16 value() const { return win_attributes_->value; }
   base::string16 hypertext() const { return win_attributes_->hypertext; }
   std::map<int32, int32>& hyperlink_offset_to_index() const {
@@ -858,6 +857,11 @@
   // Updates object attributes of IA2 with html attributes.
   void UpdateRequiredAttributes();
 
+  // Given an int list attribute containing the ids of related elements,
+  // add a new IAccessibleRelation for this object with the given type name.
+  void AddRelations(ui::AXIntListAttribute src_attr,
+                    const base::string16& iaccessiblerelation_type);
+
   // Windows-specific unique ID (unique within the browser process),
   // used for get_accChild, NotifyWinEvent, and as the unique ID for
   // IAccessible2 and ISimpleDOM.
@@ -875,7 +879,6 @@
     // IAccessible name, description, help, value.
     base::string16 name;
     base::string16 description;
-    base::string16 help;
     base::string16 value;
 
     // IAccessible2 role and state.
diff --git a/content/browser/accessibility/browser_accessibility_win_unittest.cc b/content/browser/accessibility/browser_accessibility_win_unittest.cc
index 5049c14..29886bc1 100644
--- a/content/browser/accessibility/browser_accessibility_win_unittest.cc
+++ b/content/browser/accessibility/browser_accessibility_win_unittest.cc
@@ -348,13 +348,13 @@
   ui::AXNodeData static_text1;
   static_text1.id = 3;
   static_text1.role = ui::AX_ROLE_STATIC_TEXT;
-  static_text1.AddStringAttribute(ui::AX_ATTR_VALUE, line1);
+  static_text1.AddStringAttribute(ui::AX_ATTR_NAME, line1);
   static_text1.child_ids.push_back(4);
 
   ui::AXNodeData inline_box1;
   inline_box1.id = 4;
   inline_box1.role = ui::AX_ROLE_INLINE_TEXT_BOX;
-  inline_box1.AddStringAttribute(ui::AX_ATTR_VALUE, line1);
+  inline_box1.AddStringAttribute(ui::AX_ATTR_NAME, line1);
   std::vector<int32> word_start_offsets1;
   word_start_offsets1.push_back(0);
   word_start_offsets1.push_back(4);
@@ -365,18 +365,18 @@
   ui::AXNodeData line_break;
   line_break.id = 5;
   line_break.role = ui::AX_ROLE_LINE_BREAK;
-  line_break.AddStringAttribute(ui::AX_ATTR_VALUE, "\n");
+  line_break.AddStringAttribute(ui::AX_ATTR_NAME, "\n");
 
   ui::AXNodeData static_text2;
   static_text2.id = 6;
   static_text2.role = ui::AX_ROLE_STATIC_TEXT;
-  static_text2.AddStringAttribute(ui::AX_ATTR_VALUE, line2);
+  static_text2.AddStringAttribute(ui::AX_ATTR_NAME, line2);
   static_text2.child_ids.push_back(7);
 
   ui::AXNodeData inline_box2;
   inline_box2.id = 7;
   inline_box2.role = ui::AX_ROLE_INLINE_TEXT_BOX;
-  inline_box2.AddStringAttribute(ui::AX_ATTR_VALUE, line2);
+  inline_box2.AddStringAttribute(ui::AX_ATTR_NAME, line2);
   std::vector<int32> word_start_offsets2;
   word_start_offsets2.push_back(0);
   word_start_offsets2.push_back(5);
diff --git a/content/browser/accessibility/one_shot_accessibility_tree_search.cc b/content/browser/accessibility/one_shot_accessibility_tree_search.cc
index 1757c997..f3daa6b 100644
--- a/content/browser/accessibility/one_shot_accessibility_tree_search.cc
+++ b/content/browser/accessibility/one_shot_accessibility_tree_search.cc
@@ -20,8 +20,6 @@
     strings->push_back(node->GetString16Attribute(ui::AX_ATTR_NAME));
   if (node->HasStringAttribute(ui::AX_ATTR_DESCRIPTION))
     strings->push_back(node->GetString16Attribute(ui::AX_ATTR_DESCRIPTION));
-  if (node->HasStringAttribute(ui::AX_ATTR_HELP))
-    strings->push_back(node->GetString16Attribute(ui::AX_ATTR_HELP));
   if (node->HasStringAttribute(ui::AX_ATTR_VALUE))
     strings->push_back(node->GetString16Attribute(ui::AX_ATTR_VALUE));
   if (node->HasStringAttribute(ui::AX_ATTR_PLACEHOLDER))
diff --git a/content/browser/accessibility/touch_accessibility_aura_browsertest.cc b/content/browser/accessibility/touch_accessibility_aura_browsertest.cc
index 58407e5..fccadc4 100644
--- a/content/browser/accessibility/touch_accessibility_aura_browsertest.cc
+++ b/content/browser/accessibility/touch_accessibility_aura_browsertest.cc
@@ -97,7 +97,7 @@
         BrowserAccessibility* hit = manager->GetFromID(target_id);
         BrowserAccessibility* child = hit->PlatformGetChild(0);
         ASSERT_NE(nullptr, child);
-        cell_text = child->GetData().GetStringAttribute(ui::AX_ATTR_VALUE);
+        cell_text = child->GetData().GetStringAttribute(ui::AX_ATTR_NAME);
         VLOG(1) << "Got hover event in cell with text: " << cell_text;
       } while (cell_text != expected_cell_text);
     }
diff --git a/content/browser/compositor/browser_compositor_overlay_candidate_validator_mac.h b/content/browser/compositor/browser_compositor_overlay_candidate_validator_mac.h
index c2ccf65d..29d6461 100644
--- a/content/browser/compositor/browser_compositor_overlay_candidate_validator_mac.h
+++ b/content/browser/compositor/browser_compositor_overlay_candidate_validator_mac.h
@@ -20,6 +20,7 @@
 
   // cc::OverlayCandidateValidator implementation.
   void GetStrategies(cc::OverlayProcessor::StrategyList* strategies) override;
+  bool AllowCALayerOverlays() override;
   void CheckOverlaySupport(cc::OverlayCandidateList* surfaces) override;
 
   // BrowserCompositorOverlayCandidateValidator implementation.
diff --git a/content/browser/compositor/browser_compositor_overlay_candidate_validator_mac.mm b/content/browser/compositor/browser_compositor_overlay_candidate_validator_mac.mm
index c45007e..cdcc89d9 100644
--- a/content/browser/compositor/browser_compositor_overlay_candidate_validator_mac.mm
+++ b/content/browser/compositor/browser_compositor_overlay_candidate_validator_mac.mm
@@ -29,6 +29,12 @@
   strategies->push_back(make_scoped_ptr(new cc::OverlayStrategySandwich(this)));
 }
 
+bool BrowserCompositorOverlayCandidateValidatorMac::AllowCALayerOverlays() {
+  if (software_mirror_active_ || ca_layers_disabled_)
+    return false;
+  return true;
+}
+
 void BrowserCompositorOverlayCandidateValidatorMac::CheckOverlaySupport(
     cc::OverlayCandidateList* surfaces) {
   // SW mirroring copies out of the framebuffer, so we can't remove any
diff --git a/content/browser/compositor/browser_compositor_overlay_candidate_validator_ozone.cc b/content/browser/compositor/browser_compositor_overlay_candidate_validator_ozone.cc
index 8fbbc1a..d246219e 100644
--- a/content/browser/compositor/browser_compositor_overlay_candidate_validator_ozone.cc
+++ b/content/browser/compositor/browser_compositor_overlay_candidate_validator_ozone.cc
@@ -42,6 +42,10 @@
   strategies->push_back(make_scoped_ptr(new cc::OverlayStrategyUnderlay(this)));
 }
 
+bool BrowserCompositorOverlayCandidateValidatorOzone::AllowCALayerOverlays() {
+  return false;
+}
+
 void BrowserCompositorOverlayCandidateValidatorOzone::CheckOverlaySupport(
     cc::OverlayCandidateList* surfaces) {
   // SW mirroring copies out of the framebuffer, so we can't remove any
diff --git a/content/browser/compositor/browser_compositor_overlay_candidate_validator_ozone.h b/content/browser/compositor/browser_compositor_overlay_candidate_validator_ozone.h
index 4294229..b2a5722 100644
--- a/content/browser/compositor/browser_compositor_overlay_candidate_validator_ozone.h
+++ b/content/browser/compositor/browser_compositor_overlay_candidate_validator_ozone.h
@@ -25,6 +25,7 @@
 
   // cc::OverlayCandidateValidator implementation.
   void GetStrategies(cc::OverlayProcessor::StrategyList* strategies) override;
+  bool AllowCALayerOverlays() override;
   void CheckOverlaySupport(cc::OverlayCandidateList* surfaces) override;
 
   // BrowserCompositorOverlayCandidateValidator implementation.
diff --git a/content/browser/compositor/offscreen_browser_compositor_output_surface.cc b/content/browser/compositor/offscreen_browser_compositor_output_surface.cc
index da972c7..7f3d5eb 100644
--- a/content/browser/compositor/offscreen_browser_compositor_output_surface.cc
+++ b/content/browser/compositor/offscreen_browser_compositor_output_surface.cc
@@ -139,10 +139,14 @@
   // TODO(oshima): sync with the reflector's SwapBuffersComplete
   // (crbug.com/520567).
   // The original implementation had a flickering issue (crbug.com/515332).
-  uint32_t sync_point =
-      context_provider_->ContextGL()->InsertSyncPointCHROMIUM();
-  context_provider_->ContextSupport()->SignalSyncPoint(
-      sync_point, base::Bind(&OutputSurface::OnSwapBuffersComplete,
+  gpu::gles2::GLES2Interface* gl = context_provider_->ContextGL();
+  const GLuint64 fence_sync = gl->InsertFenceSyncCHROMIUM();
+  gl->ShallowFlushCHROMIUM();
+
+  gpu::SyncToken sync_token;
+  gl->GenUnverifiedSyncTokenCHROMIUM(fence_sync, sync_token.GetData());
+  context_provider_->ContextSupport()->SignalSyncToken(
+      sync_token, base::Bind(&OutputSurface::OnSwapBuffersComplete,
                              weak_ptr_factory_.GetWeakPtr()));
 }
 
diff --git a/content/browser/media/media_canplaytype_browsertest.cc b/content/browser/media/media_canplaytype_browsertest.cc
index 8629e01..36254bd3 100644
--- a/content/browser/media/media_canplaytype_browsertest.cc
+++ b/content/browser/media/media_canplaytype_browsertest.cc
@@ -45,6 +45,13 @@
 const char* kHevcSupported = kNot;
 #endif
 
+#if defined(ENABLE_MPEG2TS_STREAM_PARSER)
+const char* kMp2tsMaybe = kPropMaybe;
+const char* kMp2tsProbably = kPropProbably;
+#else
+const char* kMp2tsMaybe = kNot;
+const char* kMp2tsProbably = kNot;
+#endif
 
 namespace content {
 
@@ -88,6 +95,32 @@
     EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1.1234x6\"'"));
     EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1.12345x\"'"));
 
+    // Old-style avc1 codecs must be followed by two dot-separated decimal
+    // numbers (H.264 profile and level)
+    // Invalid formats
+    EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1..\"'"));
+    EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1.66.\"'"));
+    EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1.66.30.\"'"));
+    EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1.x66.30\"'"));
+    EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1.66x.30\"'"));
+    EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1.66.x30\"'"));
+    EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1.66.30x\"'"));
+    // Invalid level values
+    EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1.66.300\"'"));
+    EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1.66.-1\"'"));
+    EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1.66.x\"'"));
+    // Invalid profile values
+    EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1.0.30\"'"));
+    EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1.65.30\"'"));
+    EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1.67.30\"'"));
+    EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1.76.30\"'"));
+    EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1.78.30\"'"));
+    EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1.99.30\"'"));
+    EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1.101.30\"'"));
+    EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1.300.30\"'"));
+    EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1.-1.30\"'"));
+    EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"avc1.x.30\"'"));
+
     // AAC codecs must be followed by one or two valid hexadecimal numbers.
     EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"mp4a.no\"'"));
     EXPECT_EQ(kNot, CanPlay("'" + mime + "; codecs=\"mp4a.0k\"'"));
@@ -247,6 +280,7 @@
     EXPECT_EQ(kNot, CanPlay("'" + mime +"; codecs=\"avc3\"'"));
     EXPECT_EQ(kNot, CanPlay("'" + mime +"; codecs=\"avc1.4D401E\"'"));
     EXPECT_EQ(kNot, CanPlay("'" + mime +"; codecs=\"avc3.64001F\"'"));
+    EXPECT_EQ(kNot, CanPlay("'" + mime +"; codecs=\"avc1.66.30\"'"));
     EXPECT_EQ(kNot, CanPlay("'" + mime +"; codecs=\"avc1, vorbis\"'"));
     EXPECT_EQ(kNot, CanPlay("'" + mime +"; codecs=\"avc3, vorbis\"'"));
     EXPECT_EQ(kNot, CanPlay("'" + mime +"; codecs=\"avc1, opus\"'"));
@@ -293,6 +327,7 @@
     EXPECT_EQ(kNot, CanPlay("'" + mime +"; codecs=\"avc3\"'"));
     EXPECT_EQ(kNot, CanPlay("'" + mime +"; codecs=\"avc1.4D401E\"'"));
     EXPECT_EQ(kNot, CanPlay("'" + mime +"; codecs=\"avc3.64001F\"'"));
+    EXPECT_EQ(kNot, CanPlay("'" + mime +"; codecs=\"avc1.66.30\"'"));
     EXPECT_EQ(kNot, CanPlay("'" + mime +"; codecs=\"avc1, vorbis\"'"));
     EXPECT_EQ(kNot, CanPlay("'" + mime +"; codecs=\"avc3, vorbis\"'"));
     EXPECT_EQ(kNot, CanPlay("'" + mime +"; codecs=\"avc1, opus\"'"));
@@ -337,6 +372,7 @@
     EXPECT_EQ(kNot, CanPlay("'" + mime +"; codecs=\"avc3\"'"));
     EXPECT_EQ(kNot, CanPlay("'" + mime +"; codecs=\"avc1.4D401E\"'"));
     EXPECT_EQ(kNot, CanPlay("'" + mime +"; codecs=\"avc3.64001F\"'"));
+    EXPECT_EQ(kNot, CanPlay("'" + mime +"; codecs=\"avc1.66.30\"'"));
     EXPECT_EQ(kNot, CanPlay("'" + mime +"; codecs=\"avc1, 1\"'"));
     EXPECT_EQ(kNot, CanPlay("'" + mime +"; codecs=\"avc3, 1\"'"));
 
@@ -482,6 +518,7 @@
 
   EXPECT_EQ(kNot, CanPlay("'audio/mpeg; codecs=\"avc1.4D401E\"'"));
   EXPECT_EQ(kNot, CanPlay("'audio/mpeg; codecs=\"avc3.64001F\"'"));
+  EXPECT_EQ(kNot, CanPlay("'audio/mpeg; codecs=\"avc1.66.30\"'"));
 
   EXPECT_EQ(kNot, CanPlay("'audio/mpeg; codecs=\"mp4a.40.2\"'"));
   EXPECT_EQ(kNot, CanPlay("'audio/mpeg; codecs=\"mp4a.40.02\"'"));
@@ -496,6 +533,7 @@
 
   EXPECT_EQ(kNot, CanPlay("'audio/mp3; codecs=\"avc1.4D401E\"'"));
   EXPECT_EQ(kNot, CanPlay("'audio/mp3; codecs=\"avc3.64001F\"'"));
+  EXPECT_EQ(kNot, CanPlay("'audio/mp3; codecs=\"avc1.66.30\"'"));
 
   EXPECT_EQ(kNot, CanPlay("'audio/mp3; codecs=\"mp4a.40.2\"'"));
   EXPECT_EQ(kNot, CanPlay("'audio/mp3; codecs=\"mp4a.40.02\"'"));
@@ -510,6 +548,7 @@
 
   EXPECT_EQ(kNot, CanPlay("'audio/x-mp3; codecs=\"avc1.4D401E\"'"));
   EXPECT_EQ(kNot, CanPlay("'audio/x-mp3; codecs=\"avc3.64001F\"'"));
+  EXPECT_EQ(kNot, CanPlay("'audio/x-mp3; codecs=\"avc1.66.30\"'"));
 
   EXPECT_EQ(kNot, CanPlay("'audio/x-mp3; codecs=\"mp4a.40.2\"'"));
   EXPECT_EQ(kNot, CanPlay("'audio/x-mp3; codecs=\"mp4a.40.02\"'"));
@@ -532,6 +571,10 @@
   EXPECT_EQ(kPropProbably, CanPlay("'video/mp4; codecs=\"avc3.42801E\"'"));
   EXPECT_EQ(kPropProbably, CanPlay("'video/mp4; codecs=\"avc3.42C01E\"'"));
 
+  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"avc1.66.13\"'"));
+  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"avc1.77.30\"'"));
+  EXPECT_EQ(kNot, CanPlay("'video/mp4; codecs=\"avc1.100.40\"'"));
+
   EXPECT_EQ(kPropMaybe, CanPlay("'video/mp4; codecs=\"avc1.42E11E\"'"));
   EXPECT_EQ(kPropProbably, CanPlay("'video/mp4; codecs=\"avc1.42101E\"'"));
   EXPECT_EQ(kPropProbably, CanPlay("'video/mp4; codecs=\"avc1.42701E\"'"));
@@ -584,6 +627,10 @@
   EXPECT_EQ(kPropProbably, CanPlay("'video/x-m4v; codecs=\"avc3.42801E\"'"));
   EXPECT_EQ(kPropProbably, CanPlay("'video/x-m4v; codecs=\"avc3.42C01E\"'"));
 
+  EXPECT_EQ(kNot, CanPlay("'video/x-m4v; codecs=\"avc1.66.13\"'"));
+  EXPECT_EQ(kNot, CanPlay("'video/x-m4v; codecs=\"avc1.77.30\"'"));
+  EXPECT_EQ(kNot, CanPlay("'video/x-m4v; codecs=\"avc1.100.40\"'"));
+
   EXPECT_EQ(kPropMaybe, CanPlay("'video/x-m4v; codecs=\"avc1.42E11E\"'"));
   EXPECT_EQ(kPropProbably, CanPlay("'video/x-m4v; codecs=\"avc1.42101E\"'"));
   EXPECT_EQ(kPropProbably, CanPlay("'video/x-m4v; codecs=\"avc1.42701E\"'"));
@@ -637,6 +684,7 @@
 
   EXPECT_EQ(kNot, CanPlay("'audio/mp4; codecs=\"avc1.4D401E\"'"));
   EXPECT_EQ(kNot, CanPlay("'audio/mp4; codecs=\"avc3.64001F\"'"));
+  EXPECT_EQ(kNot, CanPlay("'audio/mp4; codecs=\"avc1.66.30\"'"));
 
   EXPECT_EQ(kNot, CanPlay("'audio/mp4; codecs=\"hev1.1.6.L93.B0\"'"));
   EXPECT_EQ(kNot, CanPlay("'audio/mp4; codecs=\"hvc1.1.6.L93.B0\"'"));
@@ -660,6 +708,7 @@
 
   EXPECT_EQ(kNot, CanPlay("'audio/x-m4a; codecs=\"avc1.4D401E\"'"));
   EXPECT_EQ(kNot, CanPlay("'audio/x-m4a; codecs=\"avc3.64001F\"'"));
+  EXPECT_EQ(kNot, CanPlay("'audio/x-m4a; codecs=\"avc1.66.30\"'"));
 
   EXPECT_EQ(kNot, CanPlay("'audio/x-m4a; codecs=\"hev1.1.6.L93.B0\"'"));
   EXPECT_EQ(kNot, CanPlay("'audio/x-m4a; codecs=\"hvc1.1.6.L93.B0\"'"));
@@ -1149,4 +1198,75 @@
   EXPECT_EQ(kNot, CanPlay("'audio/aac; codecs=\"mp4a.40.2\"'"));
 }
 
+IN_PROC_BROWSER_TEST_F(MediaCanPlayTypeTest, CodecSupportTest_Mpeg2Ts) {
+  EXPECT_EQ(kMp2tsMaybe, CanPlay("'video/mp2t'"));
+
+  // video/mp2t must support standard RFC 6381 compliant H.264 / AAC codec ids.
+  // H.264 baseline, main, high profiles
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.42E01E\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.4D401E\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.640028\"'"));
+  // AAC LC audio
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"mp4a.40.2\"'"));
+  // H.264 + AAC audio combinations
+  EXPECT_EQ(kMp2tsProbably,
+            CanPlay("'video/mp2t; codecs=\"avc1.42E01E,mp4a.40.2\"'"));
+  EXPECT_EQ(kMp2tsProbably,
+            CanPlay("'video/mp2t; codecs=\"avc1.4D401E,mp4a.40.2\"'"));
+  EXPECT_EQ(kMp2tsProbably,
+            CanPlay("'video/mp2t; codecs=\"avc1.640028,mp4a.40.2\"'"));
+
+  TestMPEGUnacceptableCombinations("video/mp2t");
+}
+
+IN_PROC_BROWSER_TEST_F(MediaCanPlayTypeTest,
+                       CodecSupportTest_Mpeg2Ts_LegacyAvc1_codec_ids) {
+  // Old-style avc1/H.264 codec ids that are still being used by some HLS
+  // streaming apps for backward compatibility.
+  // H.264 baseline profile
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.66.10\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.66.13\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.66.20\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.66.22\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.66.30\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.66.32\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.66.40\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.66.42\"'"));
+  // H.264 main profile
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.77.10\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.77.13\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.77.20\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.77.22\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.77.30\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.77.32\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.77.40\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.77.42\"'"));
+  // H.264 high profile
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.100.10\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.100.13\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.100.20\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.100.22\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.100.30\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.100.32\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.100.40\"'"));
+  EXPECT_EQ(kMp2tsProbably, CanPlay("'video/mp2t; codecs=\"avc1.100.42\"'"));
+
+  // H.264 + AAC audio combinations
+  EXPECT_EQ(kMp2tsProbably,
+            CanPlay("'video/mp2t; codecs=\"avc1.66.10,mp4a.40.2\"'"));
+  EXPECT_EQ(kMp2tsProbably,
+            CanPlay("'video/mp2t; codecs=\"avc1.66.30,mp4a.40.2\"'"));
+  EXPECT_EQ(kMp2tsProbably,
+            CanPlay("'video/mp2t; codecs=\"avc1.77.10,mp4a.40.2\"'"));
+  EXPECT_EQ(kMp2tsProbably,
+            CanPlay("'video/mp2t; codecs=\"avc1.77.30,mp4a.40.2\"'"));
+  EXPECT_EQ(kMp2tsProbably,
+            CanPlay("'video/mp2t; codecs=\"avc1.100.40,mp4a.40.2\"'"));
+}
+
+IN_PROC_BROWSER_TEST_F(MediaCanPlayTypeTest, CodecSupportTest_Mpeg2TsAudio) {
+  // audio/mp2t is currently not supported (see also crbug.com/556837).
+  EXPECT_EQ(kNot, CanPlay("'audio/mp2t; codecs=\"mp4a.40.2\"'"));
+}
+
 }  // namespace content
diff --git a/content/browser/renderer_host/media/video_capture_device_client.cc b/content/browser/renderer_host/media/video_capture_device_client.cc
index c484b190..4b6c4b39 100644
--- a/content/browser/renderer_host/media/video_capture_device_client.cc
+++ b/content/browser/renderer_host/media/video_capture_device_client.cc
@@ -392,8 +392,8 @@
     const tracked_objects::Location& from_here,
     const std::string& reason) {
   const std::string log_message = base::StringPrintf(
-      "Error on %s:%d: %s, OS message: %s", from_here.file_name(),
-      from_here.line_number(), reason.c_str(),
+      "error@ %s, %s, OS message: %s", from_here.ToString().c_str(),
+      reason.c_str(),
       logging::SystemErrorCodeToString(logging::GetLastSystemErrorCode())
           .c_str());
   DLOG(ERROR) << log_message;
diff --git a/content/browser/service_worker/service_worker_dispatcher_host.cc b/content/browser/service_worker/service_worker_dispatcher_host.cc
index 62e5a78e..d79f0a49 100644
--- a/content/browser/service_worker/service_worker_dispatcher_host.cc
+++ b/content/browser/service_worker/service_worker_dispatcher_host.cc
@@ -137,10 +137,10 @@
   TRACE_EVENT0("ServiceWorker",
                "ServiceWorkerDispatcherHost::OnFilterAdded");
   channel_ready_ = true;
-  std::vector<IPC::Message*> messages;
-  pending_messages_.release(&messages);
-  for (size_t i = 0; i < messages.size(); ++i) {
-    BrowserMessageFilter::Send(messages[i]);
+  std::vector<scoped_ptr<IPC::Message>> messages;
+  messages.swap(pending_messages_);
+  for (auto& message : messages) {
+    BrowserMessageFilter::Send(message.release());
   }
 }
 
@@ -231,7 +231,7 @@
     return true;
   }
 
-  pending_messages_.push_back(message);
+  pending_messages_.push_back(make_scoped_ptr(message));
   return true;
 }
 
diff --git a/content/browser/service_worker/service_worker_dispatcher_host.h b/content/browser/service_worker/service_worker_dispatcher_host.h
index f253540..7e8a9fe 100644
--- a/content/browser/service_worker/service_worker_dispatcher_host.h
+++ b/content/browser/service_worker/service_worker_dispatcher_host.h
@@ -8,7 +8,7 @@
 #include <vector>
 
 #include "base/id_map.h"
-#include "base/memory/scoped_vector.h"
+#include "base/memory/scoped_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/strings/string16.h"
 #include "content/browser/service_worker/service_worker_registration_status.h"
@@ -223,7 +223,7 @@
   RegistrationHandleMap registration_handles_;
 
   bool channel_ready_;  // True after BrowserMessageFilter::sender_ != NULL.
-  ScopedVector<IPC::Message> pending_messages_;
+  std::vector<scoped_ptr<IPC::Message>> pending_messages_;
 
   DISALLOW_COPY_AND_ASSIGN(ServiceWorkerDispatcherHost);
 };
diff --git a/content/browser/service_worker/service_worker_url_request_job.cc b/content/browser/service_worker/service_worker_url_request_job.cc
index 3948ee9..15c85a1 100644
--- a/content/browser/service_worker/service_worker_url_request_job.cc
+++ b/content/browser/service_worker/service_worker_url_request_job.cc
@@ -11,7 +11,7 @@
 #include "base/bind.h"
 #include "base/guid.h"
 #include "base/location.h"
-#include "base/memory/scoped_vector.h"
+#include "base/memory/scoped_ptr.h"
 #include "base/single_thread_task_runner.h"
 #include "base/strings/stringprintf.h"
 #include "base/thread_task_runner_handle.h"
@@ -507,8 +507,8 @@
     return false;
 
   // To ensure the blobs stick around until the end of the reading.
-  ScopedVector<storage::BlobDataHandle> handles;
-  ScopedVector<storage::BlobDataSnapshot> snapshots;
+  std::vector<scoped_ptr<storage::BlobDataHandle>> handles;
+  std::vector<scoped_ptr<storage::BlobDataSnapshot>> snapshots;
   // TODO(dmurph): Allow blobs to be added below, so that the context can
   // efficiently re-use blob items for the new blob.
   std::vector<const ResourceRequestBody::Element*> resolved_elements;
@@ -527,8 +527,8 @@
       DCHECK_NE(storage::DataElement::TYPE_BLOB, item->type());
       resolved_elements.push_back(item->data_element_ptr());
     }
-    handles.push_back(handle.release());
-    snapshots.push_back(snapshot.release());
+    handles.push_back(handle.Pass());
+    snapshots.push_back(snapshot.Pass());
   }
 
   const std::string uuid(base::GenerateGUID());
diff --git a/content/browser/web_contents/web_contents_android.cc b/content/browser/web_contents/web_contents_android.cc
index 1da0efe..782c6c8f 100644
--- a/content/browser/web_contents/web_contents_android.cc
+++ b/content/browser/web_contents/web_contents_android.cc
@@ -66,9 +66,35 @@
       env, j_json.obj(), callback.obj());
 }
 
-ScopedJavaLocalRef<jobject> WalkAXTreeDepthFirst(JNIEnv* env,
-      BrowserAccessibilityAndroid* node, float scale_factor,
-      float y_offset, float x_scroll) {
+struct AccessibilitySnapshotParams {
+  AccessibilitySnapshotParams(float scale,
+                              float horizontal_scroll,
+                              float vertical_offset)
+      : scale_factor(scale),
+        x_scroll(horizontal_scroll),
+        y_offset(vertical_offset),
+        has_tree_data(false),
+        should_select_leaf_nodes(false) {}
+
+  float scale_factor;
+  float x_scroll;
+  float y_offset;
+  bool has_tree_data;
+  // The current text selection within this tree, if any, expressed as the
+  // node ID and character offset of the anchor (selection start) and focus
+  // (selection end).
+  int32 sel_anchor_object_id;
+  int32 sel_anchor_offset;
+  int32 sel_focus_object_id;
+  int32 sel_focus_offset;
+  // if the flag is true, mark the leaf node as selected.
+  bool should_select_leaf_nodes;
+};
+
+ScopedJavaLocalRef<jobject> WalkAXTreeDepthFirst(
+    JNIEnv* env,
+    BrowserAccessibilityAndroid* node,
+    AccessibilitySnapshotParams* params) {
   ScopedJavaLocalRef<jstring> j_text =
       ConvertUTF16ToJavaString(env, node->GetText());
   ScopedJavaLocalRef<jstring> j_class =
@@ -81,39 +107,56 @@
   int color = 0;
   int bgcolor = 0;
   int text_style = 0;
+
   if (node->HasFloatAttribute(ui::AX_ATTR_FONT_SIZE)) {
     color = node->GetIntAttribute(ui::AX_ATTR_COLOR);
     bgcolor = node->GetIntAttribute(ui::AX_ATTR_BACKGROUND_COLOR);
     size =  node->GetFloatAttribute(ui::AX_ATTR_FONT_SIZE);
     text_style = node->GetIntAttribute(ui::AX_ATTR_TEXT_STYLE);
   }
+  float scale_factor = params->scale_factor;
   ScopedJavaLocalRef<jobject> j_node =
-      Java_WebContentsImpl_createAccessibilitySnapshotNode(env,
-          scale_factor * location.x() - x_scroll,
-          scale_factor * location.y() + y_offset,
+      Java_WebContentsImpl_createAccessibilitySnapshotNode(
+          env, scale_factor * location.x() - params->x_scroll,
+          scale_factor * location.y() + params->y_offset,
           scale_factor * node->GetScrollX(), scale_factor * node->GetScrollY(),
           scale_factor * location.width(), scale_factor * location.height(),
           j_text.obj(), color, bgcolor, scale_factor * size, text_style,
           j_class.obj());
 
+  if (params->has_tree_data && node->PlatformIsLeaf()) {
+    int start_selection = 0;
+    int end_selection = 0;
+    if (params->sel_anchor_object_id == node->GetId()) {
+      start_selection = params->sel_anchor_offset;
+      params->should_select_leaf_nodes = true;
+    }
+    if (params->should_select_leaf_nodes)
+      end_selection = node->GetText().length();
+
+    if (params->sel_focus_object_id == node->GetId()) {
+      end_selection = params->sel_focus_offset;
+      params->should_select_leaf_nodes = false;
+    }
+    if (end_selection > 0)
+      Java_WebContentsImpl_setAccessibilitySnapshotSelection(
+          env, j_node.obj(), start_selection, end_selection);
+  }
+
   for(uint32 i = 0; i < node->PlatformChildCount(); i++) {
     BrowserAccessibilityAndroid* child =
         static_cast<BrowserAccessibilityAndroid*>(
             node->PlatformGetChild(i));
-    Java_WebContentsImpl_addAccessibilityNodeAsChild(env,
-        j_node.obj(), WalkAXTreeDepthFirst(env, child, scale_factor, y_offset,
-            x_scroll).obj());
+    Java_WebContentsImpl_addAccessibilityNodeAsChild(
+        env, j_node.obj(), WalkAXTreeDepthFirst(env, child, params).obj());
   }
   return j_node;
 }
 
 // Walks over the AXTreeUpdate and creates a light weight snapshot.
-void AXTreeSnapshotCallback(
-    const ScopedJavaGlobalRef<jobject>& callback,
-    float scale_factor,
-    float y_offset,
-    float x_scroll,
-    const ui::AXTreeUpdate& result) {
+void AXTreeSnapshotCallback(const ScopedJavaGlobalRef<jobject>& callback,
+                            AccessibilitySnapshotParams* params,
+                            const ui::AXTreeUpdate& result) {
   JNIEnv* env = base::android::AttachCurrentThread();
   if (result.nodes.empty()) {
     Java_WebContentsImpl_onAccessibilitySnapshot(env, nullptr, callback.obj());
@@ -125,8 +168,14 @@
   manager->set_prune_tree_for_screen_reader(false);
   BrowserAccessibilityAndroid* root =
       static_cast<BrowserAccessibilityAndroid*>(manager->GetRoot());
-  ScopedJavaLocalRef<jobject> j_root =
-      WalkAXTreeDepthFirst(env, root, scale_factor, y_offset, x_scroll);
+  if (result.has_tree_data) {
+    params->has_tree_data = true;
+    params->sel_anchor_object_id = result.tree_data.sel_anchor_object_id;
+    params->sel_anchor_offset = result.tree_data.sel_anchor_offset;
+    params->sel_focus_object_id = result.tree_data.sel_focus_object_id;
+    params->sel_focus_offset = result.tree_data.sel_focus_offset;
+  }
+  ScopedJavaLocalRef<jobject> j_root = WalkAXTreeDepthFirst(env, root, params);
   Java_WebContentsImpl_onAccessibilitySnapshot(
       env, j_root.obj(), callback.obj());
 }
@@ -538,9 +587,11 @@
   gfx::DeviceDisplayInfo device_info;
   ContentViewCoreImpl* contentViewCore =
       ContentViewCoreImpl::FromWebContents(web_contents_);
+
+  AccessibilitySnapshotParams* params = new AccessibilitySnapshotParams(
+      contentViewCore->GetScaleFactor(), y_offset, x_scroll);
   WebContentsImpl::AXTreeSnapshotCallback snapshot_callback =
-      base::Bind(&AXTreeSnapshotCallback, j_callback,
-          contentViewCore->GetScaleFactor(), y_offset, x_scroll);
+      base::Bind(&AXTreeSnapshotCallback, j_callback, base::Owned(params));
   static_cast<WebContentsImpl*>(web_contents_)->RequestAXTreeSnapshot(
       snapshot_callback);
 }
diff --git a/content/browser/zygote_host/zygote_host_impl_linux.cc b/content/browser/zygote_host/zygote_host_impl_linux.cc
index a11d51f..a736fb0 100644
--- a/content/browser/zygote_host/zygote_host_impl_linux.cc
+++ b/content/browser/zygote_host/zygote_host_impl_linux.cc
@@ -160,7 +160,8 @@
   // or namespace sandbox. This is needed beacuse the processes are
   // non-dumpable, so /proc/pid/oom_score_adj can only be written by root.
   use_suid_sandbox_for_adj_oom_score_ =
-      using_namespace_sandbox || using_suid_sandbox;
+      !sandbox_binary_.empty() &&
+      (using_namespace_sandbox || using_suid_sandbox);
 
   // Start up the sandbox host process and get the file descriptor for the
   // renderers to talk to it.
diff --git a/content/public/android/java/src/org/chromium/content/browser/BackgroundSyncNetworkObserver.java b/content/public/android/java/src/org/chromium/content/browser/BackgroundSyncNetworkObserver.java
index fd7da07..c6f1e1f 100644
--- a/content/public/android/java/src/org/chromium/content/browser/BackgroundSyncNetworkObserver.java
+++ b/content/public/android/java/src/org/chromium/content/browser/BackgroundSyncNetworkObserver.java
@@ -13,6 +13,7 @@
 import org.chromium.base.annotations.CalledByNative;
 import org.chromium.base.annotations.JNINamespace;
 import org.chromium.base.annotations.NativeClassQualifiedName;
+import org.chromium.base.metrics.RecordHistogram;
 import org.chromium.net.NetworkChangeNotifierAutoDetect;
 import org.chromium.net.RegistrationPolicyAlwaysRegister;
 
@@ -69,6 +70,8 @@
     private void registerObserver(final long nativePtr) {
         ThreadUtils.assertOnUiThread();
         if (!canCreateObserver(mContext)) {
+            RecordHistogram.recordBooleanHistogram(
+                    "BackgroundSync.NetworkObserver.HasPermission", false);
             return;
         }
 
@@ -76,6 +79,8 @@
         if (mNotifier == null) {
             mNotifier = new NetworkChangeNotifierAutoDetect(this, mContext,
                                 new RegistrationPolicyAlwaysRegister());
+            RecordHistogram.recordBooleanHistogram(
+                    "BackgroundSync.NetworkObserver.HasPermission", true);
         }
         mNativePtrs.add(nativePtr);
 
diff --git a/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java b/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
index 90fac7e..de62b51 100644
--- a/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
+++ b/content/public/android/java/src/org/chromium/content/browser/ContentViewCore.java
@@ -2955,7 +2955,11 @@
     private void createVirtualStructure(ViewStructure viewNode, AccessibilitySnapshotNode node,
             int parentX, int parentY) {
         viewNode.setClassName(node.className);
-        viewNode.setText(node.text);
+        if (node.hasSelection) {
+            viewNode.setText(node.text, node.startSelection, node.endSelection);
+        } else {
+            viewNode.setText(node.text);
+        }
         viewNode.setDimens(node.x - parentX - node.scrollX, node.y - parentY, 0, node.scrollY,
                 node.width, node.height);
         viewNode.setChildCount(node.children.size());
diff --git a/content/public/android/java/src/org/chromium/content/browser/webcontents/WebContentsImpl.java b/content/public/android/java/src/org/chromium/content/browser/webcontents/WebContentsImpl.java
index a6f4cfb5..6ecb3f8 100644
--- a/content/public/android/java/src/org/chromium/content/browser/webcontents/WebContentsImpl.java
+++ b/content/public/android/java/src/org/chromium/content/browser/webcontents/WebContentsImpl.java
@@ -198,13 +198,13 @@
         // Unselect may get triggered when certain selection-related widgets
         // are destroyed. As the timing for such destruction is unpredictable,
         // safely guard against this case.
-        if (mNativeWebContentsAndroid == 0) return;
+        if (isDestroyed()) return;
         nativeUnselect(mNativeWebContentsAndroid);
     }
 
     @Override
     public void insertCSS(String css) {
-        if (mNativeWebContentsAndroid == 0) return;
+        if (isDestroyed()) return;
         nativeInsertCSS(mNativeWebContentsAndroid, css);
     }
 
@@ -307,6 +307,7 @@
 
     @Override
     public void evaluateJavaScript(String script, JavaScriptCallback callback) {
+        if (isDestroyed()) return;
         nativeEvaluateJavaScript(mNativeWebContentsAndroid, script, callback);
     }
 
@@ -403,6 +404,12 @@
         return node;
     }
 
+    @CalledByNative
+    private static void setAccessibilitySnapshotSelection(
+            AccessibilitySnapshotNode node, int start, int end) {
+        node.setSelection(start, end);
+    }
+
     @Override
     public void addObserver(WebContentsObserver observer) {
         assert mNativeWebContentsAndroid != 0;
diff --git a/content/public/android/java/src/org/chromium/content_public/browser/AccessibilitySnapshotNode.java b/content/public/android/java/src/org/chromium/content_public/browser/AccessibilitySnapshotNode.java
index f0f565f5..7814934 100644
--- a/content/public/android/java/src/org/chromium/content_public/browser/AccessibilitySnapshotNode.java
+++ b/content/public/android/java/src/org/chromium/content_public/browser/AccessibilitySnapshotNode.java
@@ -27,6 +27,10 @@
     public int color, bgcolor;
     public boolean bold, italic, underline, lineThrough;
 
+    public boolean hasSelection;
+    public int startSelection;
+    public int endSelection;
+
     public ArrayList<AccessibilitySnapshotNode> children =
             new ArrayList<AccessibilitySnapshotNode>();
 
@@ -54,6 +58,12 @@
         hasStyle = true;
     }
 
+    public void setSelection(int start, int end) {
+        hasSelection = true;
+        startSelection = start;
+        endSelection = end;
+    }
+
     public void addChild(AccessibilitySnapshotNode node) {
         children.add(node);
     }
diff --git a/content/renderer/accessibility/blink_ax_enum_conversion.cc b/content/renderer/accessibility/blink_ax_enum_conversion.cc
index 5c56c3c4..0322f59 100644
--- a/content/renderer/accessibility/blink_ax_enum_conversion.cc
+++ b/content/renderer/accessibility/blink_ax_enum_conversion.cc
@@ -478,4 +478,49 @@
   return ui::AX_SORT_DIRECTION_NONE;
 }
 
-}  // Namespace content.
+ui::AXNameFrom AXNameFromFromBlink(blink::WebAXNameFrom name_from) {
+  switch (name_from) {
+    case blink::WebAXNameFromUninitialized:
+      return ui::AX_NAME_FROM_UNINITIALIZED;
+    case blink::WebAXNameFromAttribute:
+      return ui::AX_NAME_FROM_ATTRIBUTE;
+    case blink::WebAXNameFromCaption:
+      return ui::AX_NAME_FROM_RELATED_ELEMENT;
+    case blink::WebAXNameFromContents:
+      return ui::AX_NAME_FROM_CONTENTS;
+    case blink::WebAXNameFromPlaceholder:
+      return ui::AX_NAME_FROM_PLACEHOLDER;
+    case blink::WebAXNameFromRelatedElement:
+      return ui::AX_NAME_FROM_RELATED_ELEMENT;
+    case blink::WebAXNameFromValue:
+      return ui::AX_NAME_FROM_VALUE;
+    case blink::WebAXNameFromTitle:
+      return ui::AX_NAME_FROM_ATTRIBUTE;
+    default:
+      NOTREACHED();
+  }
+
+  return ui::AX_NAME_FROM_UNINITIALIZED;
+}
+
+ui::AXDescriptionFrom AXDescriptionFromFromBlink(
+    blink::WebAXDescriptionFrom description_from) {
+  switch (description_from) {
+    case blink::WebAXDescriptionFromUninitialized:
+      return ui::AX_DESCRIPTION_FROM_UNINITIALIZED;
+    case blink::WebAXDescriptionFromAttribute:
+      return ui::AX_DESCRIPTION_FROM_ATTRIBUTE;
+    case blink::WebAXDescriptionFromContents:
+      return ui::AX_DESCRIPTION_FROM_CONTENTS;
+    case blink::WebAXDescriptionFromPlaceholder:
+      return ui::AX_DESCRIPTION_FROM_PLACEHOLDER;
+    case blink::WebAXDescriptionFromRelatedElement:
+      return ui::AX_DESCRIPTION_FROM_RELATED_ELEMENT;
+    default:
+      NOTREACHED();
+  }
+
+  return ui::AX_DESCRIPTION_FROM_UNINITIALIZED;
+}
+
+}  // namespace content.
diff --git a/content/renderer/accessibility/blink_ax_enum_conversion.h b/content/renderer/accessibility/blink_ax_enum_conversion.h
index 4c27400..84929d0 100644
--- a/content/renderer/accessibility/blink_ax_enum_conversion.h
+++ b/content/renderer/accessibility/blink_ax_enum_conversion.h
@@ -39,6 +39,11 @@
 ui::AXSortDirection AXSortDirectionFromBlink(
     blink::WebAXSortDirection sort_direction);
 
+ui::AXNameFrom AXNameFromFromBlink(blink::WebAXNameFrom name_from);
+
+ui::AXDescriptionFrom AXDescriptionFromFromBlink(
+    blink::WebAXDescriptionFrom description_from);
+
 }  // namespace content
 
 #endif  // CONTENT_RENDERER_ACCESSIBILITY_BLINK_AX_ENUM_CONVERSION_H_
diff --git a/content/renderer/accessibility/blink_ax_tree_source.cc b/content/renderer/accessibility/blink_ax_tree_source.cc
index 6ff315b..57158f61 100644
--- a/content/renderer/accessibility/blink_ax_tree_source.cc
+++ b/content/renderer/accessibility/blink_ax_tree_source.cc
@@ -106,7 +106,7 @@
     dst->AddIntListAttribute(attr, ids);
 }
 
-}  // Anonymous namespace
+}  // namespace
 
 BlinkAXTreeSource::BlinkAXTreeSource(RenderFrameImpl* render_frame)
     : render_frame_(render_frame),
@@ -258,7 +258,32 @@
   dst->state = AXStateFromBlink(src);
   dst->location = src.boundingBoxRect();
   dst->id = src.axID();
-  std::string name = src.deprecatedTitle().utf8();
+
+  blink::WebAXNameFrom nameFrom;
+  blink::WebVector<blink::WebAXObject> nameObjects;
+  blink::WebString web_name = src.name(nameFrom, nameObjects);
+  if (!web_name.isEmpty()) {
+    dst->AddStringAttribute(ui::AX_ATTR_NAME, web_name.utf8());
+    dst->AddIntAttribute(ui::AX_ATTR_NAME_FROM, AXNameFromFromBlink(nameFrom));
+    AddIntListAttributeFromWebObjects(
+        ui::AX_ATTR_LABELLEDBY_IDS, nameObjects, dst);
+  }
+
+  blink::WebAXDescriptionFrom descriptionFrom;
+  blink::WebVector<blink::WebAXObject> descriptionObjects;
+  blink::WebString web_description = src.description(
+      nameFrom, descriptionFrom, descriptionObjects);
+  if (!web_description.isEmpty()) {
+    dst->AddStringAttribute(ui::AX_ATTR_DESCRIPTION, web_description.utf8());
+    dst->AddIntAttribute(ui::AX_ATTR_DESCRIPTION_FROM,
+        AXDescriptionFromFromBlink(descriptionFrom));
+    AddIntListAttributeFromWebObjects(
+        ui::AX_ATTR_DESCRIBEDBY_IDS, descriptionObjects, dst);
+  }
+
+  blink::WebString web_placeholder = src.placeholder(nameFrom, descriptionFrom);
+  if (!web_placeholder.isEmpty())
+    dst->AddStringAttribute(ui::AX_ATTR_PLACEHOLDER, web_placeholder.utf8());
 
   std::string value;
   if (src.valueDescription().length()) {
@@ -288,8 +313,7 @@
   }
   if (src.invalidState() == blink::WebAXInvalidStateOther) {
     dst->AddStringAttribute(
-        ui::AX_ATTR_ARIA_INVALID_VALUE,
-        src.ariaInvalidValue().utf8());
+        ui::AX_ATTR_ARIA_INVALID_VALUE, src.ariaInvalidValue().utf8());
   }
 
   if (src.textDirection()) {
@@ -344,32 +368,15 @@
     dst->AddBoolAttribute(ui::AX_ATTR_BUTTON_MIXED, true);
   if (src.canSetValueAttribute())
     dst->AddBoolAttribute(ui::AX_ATTR_CAN_SET_VALUE, true);
-  if (src.deprecatedAccessibilityDescription().length()) {
-    dst->AddStringAttribute(
-        ui::AX_ATTR_DESCRIPTION,
-        src.deprecatedAccessibilityDescription().utf8());
-  }
   if (src.hasComputedStyle()) {
     dst->AddStringAttribute(
-        ui::AX_ATTR_DISPLAY,
-        src.computedStyleDisplay().utf8());
-  }
-  if (src.deprecatedHelpText().length())
-    dst->AddStringAttribute(ui::AX_ATTR_HELP, src.deprecatedHelpText().utf8());
-  if (src.deprecatedPlaceholder().length()) {
-    dst->AddStringAttribute(
-        ui::AX_ATTR_PLACEHOLDER,
-        src.deprecatedPlaceholder().utf8());
+        ui::AX_ATTR_DISPLAY, src.computedStyleDisplay().utf8());
   }
   if (src.keyboardShortcut().length()) {
     dst->AddStringAttribute(
         ui::AX_ATTR_SHORTCUT,
         src.keyboardShortcut().utf8());
   }
-  if (!src.deprecatedTitleUIElement().isDetached()) {
-    dst->AddIntAttribute(ui::AX_ATTR_TITLE_UI_ELEMENT,
-                         src.deprecatedTitleUIElement().axID());
-  }
   if (!src.ariaActiveDescendant().isDetached()) {
     dst->AddIntAttribute(ui::AX_ATTR_ACTIVEDESCENDANT_ID,
                          src.ariaActiveDescendant().axID());
@@ -510,12 +517,8 @@
                            src.minValueForRange());
   }
 
-  if (dst->role == ui::AX_ROLE_WEB_AREA) {
+  if (dst->role == ui::AX_ROLE_WEB_AREA)
     dst->AddStringAttribute(ui::AX_ATTR_HTML_TAG, "#document");
-    const WebDocument& document = src.document();
-    if (name.empty())
-      name = document.title().utf8();
-  }
 
   if (dst->role == ui::AX_ROLE_TABLE) {
     int column_count = src.columnCount();
@@ -578,8 +581,6 @@
                          AXSortDirectionFromBlink(src.sortDirection()));
   }
 
-  dst->AddStringAttribute(ui::AX_ATTR_NAME, name);
-
   // Add the ids of *indirect* children - those who are children of this node,
   // but whose parent is *not* this node. One example is a table
   // cell, which is a child of both a row and a column. Because the cell's
@@ -601,27 +602,10 @@
   if (src.ariaControls(controls))
     AddIntListAttributeFromWebObjects(ui::AX_ATTR_CONTROLS_IDS, controls, dst);
 
-  WebVector<WebAXObject> describedby;
-  if (src.deprecatedAriaDescribedby(describedby)) {
-    AddIntListAttributeFromWebObjects(
-        ui::AX_ATTR_DESCRIBEDBY_IDS, describedby, dst);
-  }
-
   WebVector<WebAXObject> flowTo;
   if (src.ariaFlowTo(flowTo))
     AddIntListAttributeFromWebObjects(ui::AX_ATTR_FLOWTO_IDS, flowTo, dst);
 
-  WebVector<WebAXObject> labelledby;
-  if (src.deprecatedAriaLabelledby(labelledby)) {
-    AddIntListAttributeFromWebObjects(
-        ui::AX_ATTR_LABELLEDBY_IDS, labelledby, dst);
-  }
-
-  WebVector<WebAXObject> owns;
-  if (src.ariaOwns(owns))
-    AddIntListAttributeFromWebObjects(ui::AX_ATTR_OWNS_IDS, owns, dst);
-
-
   if (src.isScrollableContainer()) {
     const gfx::Point& scrollOffset = src.scrollOffset();
     dst->AddIntAttribute(ui::AX_ATTR_SCROLL_X, scrollOffset.x());
diff --git a/content/renderer/gpu/compositor_output_surface.cc b/content/renderer/gpu/compositor_output_surface.cc
index 3f96ef3..f8c756c 100644
--- a/content/renderer/gpu/compositor_output_surface.cc
+++ b/content/renderer/gpu/compositor_output_surface.cc
@@ -125,9 +125,13 @@
 
     if (context_provider()) {
       gpu::gles2::GLES2Interface* context = context_provider()->ContextGL();
+      const uint64_t fence_sync = context->InsertFenceSyncCHROMIUM();
       context->Flush();
-      uint32 sync_point = context->InsertSyncPointCHROMIUM();
-      context_provider()->ContextSupport()->SignalSyncPoint(sync_point,
+
+      gpu::SyncToken sync_token;
+      context->GenUnverifiedSyncTokenCHROMIUM(fence_sync, sync_token.GetData());
+
+      context_provider()->ContextSupport()->SignalSyncToken(sync_token,
                                                             closure);
     } else {
       base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE, closure);
diff --git a/content/renderer/pepper/video_decoder_shim.cc b/content/renderer/pepper/video_decoder_shim.cc
index b2bbfd0..8efb3d8 100644
--- a/content/renderer/pepper/video_decoder_shim.cc
+++ b/content/renderer/pepper/video_decoder_shim.cc
@@ -689,7 +689,8 @@
   DCHECK(!decoder_);
 #if !defined(MEDIA_DISABLE_LIBVPX)
   if (config.codec() == media::kCodecVP9) {
-    decoder_.reset(new media::VpxVideoDecoder());
+    decoder_.reset(
+        new media::VpxVideoDecoder(base::ThreadTaskRunnerHandle::Get()));
   } else
 #endif
 
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index e4d5e87..c79384a8 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -477,9 +477,15 @@
   DCHECK(!browser_navigation_start.is_null());
   base::TimeTicks navigation_start =
       std::min(browser_navigation_start, renderer_navigation_start);
-  // TODO(csharrison) Investigate how big a problem the cross process
-  // monotonicity really is and on what platforms. Log UMA for:
-  // |renderer_navigation_start - browser_navigation_start|
+  base::TimeDelta difference =
+      renderer_navigation_start - browser_navigation_start;
+  if (difference > base::TimeDelta()) {
+    UMA_HISTOGRAM_TIMES("Navigation.Start.RendererBrowserDifference.Positive",
+                        difference);
+  } else {
+    UMA_HISTOGRAM_TIMES("Navigation.Start.RendererBrowserDifference.Negative",
+                        -difference);
+  }
   return navigation_start;
 }
 
diff --git a/content/test/data/accessibility/aria/aria-atomic-expected-mac.txt b/content/test/data/accessibility/aria/aria-atomic-expected-mac.txt
index a80696395..cf350978 100644
--- a/content/test/data/accessibility/aria/aria-atomic-expected-mac.txt
+++ b/content/test/data/accessibility/aria/aria-atomic-expected-mac.txt
@@ -1,5 +1,5 @@
 AXWebArea
-++AXGroup AXARIAAtomic='0'
+++AXGroup AXDescription='This test is for aria-atomic="false"' AXARIAAtomic='0'
 ++++AXStaticText AXValue='This test is for aria-atomic="false"' AXARIAAtomic='0'
-++AXGroup AXARIAAtomic='1'
+++AXGroup AXDescription='This test is for aria-atomic="true"' AXARIAAtomic='1'
 ++++AXStaticText AXValue='This test is for aria-atomic="true"' AXARIAAtomic='0'
diff --git a/content/test/data/accessibility/aria/aria-describedby-expected-mac.txt b/content/test/data/accessibility/aria/aria-describedby-expected-mac.txt
index 7186c12d..62908b2 100644
--- a/content/test/data/accessibility/aria/aria-describedby-expected-mac.txt
+++ b/content/test/data/accessibility/aria/aria-describedby-expected-mac.txt
@@ -1,5 +1,5 @@
 AXWebArea AXRoleDescription='HTML content'
 ++AXGroup AXRoleDescription='group'
-++++AXTextField AXRoleDescription='text field'
+++++AXTextField AXRoleDescription='text field' AXHelp='Your username should be your email id'
 ++AXGroup AXSubrole=AXUserInterfaceTooltip AXRoleDescription='tooltip'
 ++++AXStaticText AXRoleDescription='text' AXValue='Your username should be your email id'
diff --git a/content/test/data/accessibility/aria/aria-grabbed-expected-mac.txt b/content/test/data/accessibility/aria/aria-grabbed-expected-mac.txt
index 538c708a..b818a1ad 100644
--- a/content/test/data/accessibility/aria/aria-grabbed-expected-mac.txt
+++ b/content/test/data/accessibility/aria/aria-grabbed-expected-mac.txt
@@ -3,12 +3,12 @@
 ++++AXGroup AXTitle='grabbed-true blue' AXGrabbed='1'
 ++++++AXListMarker AXValue='•'
 ++++++AXStaticText AXValue='grabbed-true '
-++++++AXImage
+++++++AXImage AXDescription='blue'
 ++++AXGroup AXTitle='grabbed-false blue' AXGrabbed='0'
 ++++++AXListMarker AXValue='•'
 ++++++AXStaticText AXValue='grabbed-false '
-++++++AXImage
+++++++AXImage AXDescription='blue'
 ++++AXGroup AXTitle='grabbed-undefined blue'
 ++++++AXListMarker AXValue='•'
 ++++++AXStaticText AXValue='grabbed-undefined '
-++++++AXImage
+++++++AXImage AXDescription='blue'
diff --git a/content/test/data/accessibility/aria/aria-list-expected-mac.txt b/content/test/data/accessibility/aria/aria-list-expected-mac.txt
index 905a4c6f..2ed8d4f 100644
--- a/content/test/data/accessibility/aria/aria-list-expected-mac.txt
+++ b/content/test/data/accessibility/aria/aria-list-expected-mac.txt
@@ -1,8 +1,8 @@
 AXWebArea
-++AXList AXSubrole=AXContentList AXSelectedChildren=[] AXVisibleChildren=["AXGroup group 1","AXGroup group 2","AXGroup group 3"]
-++++AXGroup AXTitle='Item 1'
+++AXList AXSubrole=AXContentList AXSelectedChildren=[] AXVisibleChildren=["AXGroup 1","AXGroup 2","AXGroup 3"]
+++++AXGroup AXDescription='1'
 ++++++AXStaticText AXValue='Item 1'
-++++AXGroup AXTitle='Item 2'
+++++AXGroup AXDescription='2'
 ++++++AXStaticText AXValue='Item 2'
-++++AXGroup AXTitle='Item 3'
+++++AXGroup AXDescription='3'
 ++++++AXStaticText AXValue='Item 3'
diff --git a/content/test/data/accessibility/aria/aria-listbox-activedescendant-expected-mac.txt b/content/test/data/accessibility/aria/aria-listbox-activedescendant-expected-mac.txt
index 89728e17..f141691 100644
--- a/content/test/data/accessibility/aria/aria-listbox-activedescendant-expected-mac.txt
+++ b/content/test/data/accessibility/aria/aria-listbox-activedescendant-expected-mac.txt
@@ -1,5 +1,5 @@
 AXWebArea
 ++AXList AXOrientation='AXVerticalOrientation' AXSelectedChildren=["AXStaticText 3"] AXVisibleChildren=["AXStaticText 1","AXStaticText 2","AXStaticText 3"]
-++++AXStaticText AXTitle='Item 1'
-++++AXStaticText AXTitle='Item 2'
-++++AXStaticText AXTitle='Item 3'
+++++AXStaticText AXValue='1'
+++++AXStaticText AXValue='2'
+++++AXStaticText AXValue='3'
diff --git a/content/test/data/accessibility/aria/aria-listbox-aria-selected-expected-mac.txt b/content/test/data/accessibility/aria/aria-listbox-aria-selected-expected-mac.txt
index 1d79bc4..f7fcc2b1 100644
--- a/content/test/data/accessibility/aria/aria-listbox-aria-selected-expected-mac.txt
+++ b/content/test/data/accessibility/aria/aria-listbox-aria-selected-expected-mac.txt
@@ -1,7 +1,7 @@
 AXWebArea
 ++AXList AXOrientation='AXVerticalOrientation' AXSelectedChildren=["AXStaticText 4","AXStaticText 5"] AXVisibleChildren=["AXStaticText 1","AXStaticText 2","AXStaticText 3","AXStaticText 4","AXStaticText 5"]
-++++AXStaticText AXTitle='Item 1'
-++++AXStaticText AXTitle='Item 2'
-++++AXStaticText AXTitle='Item 3'
-++++AXStaticText AXTitle='Item 4'
-++++AXStaticText AXTitle='Item 5'
+++++AXStaticText AXValue='1'
+++++AXStaticText AXValue='2'
+++++AXStaticText AXValue='3'
+++++AXStaticText AXValue='4'
+++++AXStaticText AXValue='5'
diff --git a/content/test/data/accessibility/aria/aria-listbox-childfocus-expected-mac.txt b/content/test/data/accessibility/aria/aria-listbox-childfocus-expected-mac.txt
index fdb2f09e..b1249e9 100644
--- a/content/test/data/accessibility/aria/aria-listbox-childfocus-expected-mac.txt
+++ b/content/test/data/accessibility/aria/aria-listbox-childfocus-expected-mac.txt
@@ -1,5 +1,5 @@
 AXWebArea
 ++AXList AXOrientation='AXVerticalOrientation' AXSelectedChildren=["AXStaticText 2"] AXVisibleChildren=["AXStaticText 1","AXStaticText 2","AXStaticText 3"]
-++++AXStaticText AXTitle='Item 1'
-++++AXStaticText AXTitle='Item 2'
-++++AXStaticText AXTitle='Item 3'
+++++AXStaticText AXValue='1'
+++++AXStaticText AXValue='2'
+++++AXStaticText AXValue='3'
diff --git a/content/test/data/accessibility/aria/aria-listbox-expected-mac.txt b/content/test/data/accessibility/aria/aria-listbox-expected-mac.txt
index ed6790f..4b90377 100644
--- a/content/test/data/accessibility/aria/aria-listbox-expected-mac.txt
+++ b/content/test/data/accessibility/aria/aria-listbox-expected-mac.txt
@@ -1,4 +1,4 @@
 AXWebArea AXRoleDescription='HTML content'
 ++AXList AXRoleDescription='list'
-++++AXStaticText AXRoleDescription='text' AXTitle='Item 1'
-++++AXStaticText AXRoleDescription='text' AXTitle='Item 2'
+++++AXStaticText AXRoleDescription='text' AXValue='Item 1'
+++++AXStaticText AXRoleDescription='text' AXValue='Item 2'
diff --git a/content/test/data/accessibility/aria/aria-listitem-expected-mac.txt b/content/test/data/accessibility/aria/aria-listitem-expected-mac.txt
index fbb86ed..c73d12d7 100644
--- a/content/test/data/accessibility/aria/aria-listitem-expected-mac.txt
+++ b/content/test/data/accessibility/aria/aria-listitem-expected-mac.txt
@@ -1,6 +1,6 @@
 AXWebArea
-++AXList AXSubrole=AXContentList AXSelectedChildren=[] AXVisibleChildren=["AXGroup group 1","AXGroup group 2"]
-++++AXGroup AXTitle='Item 1'
+++AXList AXSubrole=AXContentList AXSelectedChildren=[] AXVisibleChildren=["AXGroup 1","AXGroup 2"]
+++++AXGroup AXDescription='1'
 ++++++AXStaticText AXValue='Item 1'
-++++AXGroup AXTitle='Item 2'
+++++AXGroup AXDescription='2'
 ++++++AXStaticText AXValue='Item 2'
diff --git a/content/test/data/accessibility/aria/aria-option-expected-mac.txt b/content/test/data/accessibility/aria/aria-option-expected-mac.txt
index 221b0541..4c10846 100644
--- a/content/test/data/accessibility/aria/aria-option-expected-mac.txt
+++ b/content/test/data/accessibility/aria/aria-option-expected-mac.txt
@@ -1,4 +1,4 @@
 AXWebArea AXRoleDescription='HTML content'
 ++AXList AXRoleDescription='list'
-++++AXStaticText AXRoleDescription='text' AXTitle='option 1'
-++++AXStaticText AXRoleDescription='text' AXTitle='option 2'
+++++AXStaticText AXRoleDescription='text' AXValue='option 1'
+++++AXStaticText AXRoleDescription='text' AXValue='label 2'
diff --git a/content/test/data/accessibility/aria/aria-posinset-expected-mac.txt b/content/test/data/accessibility/aria/aria-posinset-expected-mac.txt
index 36811b7e..4106f47 100644
--- a/content/test/data/accessibility/aria/aria-posinset-expected-mac.txt
+++ b/content/test/data/accessibility/aria/aria-posinset-expected-mac.txt
@@ -1,12 +1,12 @@
 AXWebArea AXRoleDescription='HTML content'
 ++AXList AXRoleDescription='list'
-++++AXStaticText AXRoleDescription='text' AXTitle='Item 1' AXARIASetSize='4' AXARIAPosInSet='1'
-++++AXStaticText AXRoleDescription='text' AXTitle='Item 2' AXARIASetSize='4' AXARIAPosInSet='2'
-++++AXStaticText AXRoleDescription='text' AXTitle='Item 3' AXARIASetSize='4' AXARIAPosInSet='3'
-++++AXStaticText AXRoleDescription='text' AXTitle='Item 4' AXARIASetSize='4' AXARIAPosInSet='4'
+++++AXStaticText AXRoleDescription='text' AXValue='Item 1' AXARIASetSize='4' AXARIAPosInSet='1'
+++++AXStaticText AXRoleDescription='text' AXValue='Item 2' AXARIASetSize='4' AXARIAPosInSet='2'
+++++AXStaticText AXRoleDescription='text' AXValue='Item 3' AXARIASetSize='4' AXARIAPosInSet='3'
+++++AXStaticText AXRoleDescription='text' AXValue='Item 4' AXARIASetSize='4' AXARIAPosInSet='4'
 ++AXList AXRoleDescription='list'
-++++AXStaticText AXRoleDescription='text' AXTitle='Item 1' AXARIASetSize='5' AXARIAPosInSet='1'
-++++AXStaticText AXRoleDescription='text' AXTitle='Item 2' AXARIASetSize='5' AXARIAPosInSet='2'
-++++AXStaticText AXRoleDescription='text' AXTitle='Item 3' AXARIASetSize='5' AXARIAPosInSet='3'
-++++AXStaticText AXRoleDescription='text' AXTitle='Item 4' AXARIASetSize='5' AXARIAPosInSet='4'
-++++AXStaticText AXRoleDescription='text' AXTitle='Item 5' AXARIASetSize='5' AXARIAPosInSet='5'
+++++AXStaticText AXRoleDescription='text' AXValue='Item 1' AXARIASetSize='5' AXARIAPosInSet='1'
+++++AXStaticText AXRoleDescription='text' AXValue='Item 2' AXARIASetSize='5' AXARIAPosInSet='2'
+++++AXStaticText AXRoleDescription='text' AXValue='Item 3' AXARIASetSize='5' AXARIAPosInSet='3'
+++++AXStaticText AXRoleDescription='text' AXValue='Item 4' AXARIASetSize='5' AXARIAPosInSet='4'
+++++AXStaticText AXRoleDescription='text' AXValue='Item 5' AXARIASetSize='5' AXARIAPosInSet='5'
diff --git a/content/test/data/accessibility/aria/aria-setsize-expected-mac.txt b/content/test/data/accessibility/aria/aria-setsize-expected-mac.txt
index 36811b7e..4106f47 100644
--- a/content/test/data/accessibility/aria/aria-setsize-expected-mac.txt
+++ b/content/test/data/accessibility/aria/aria-setsize-expected-mac.txt
@@ -1,12 +1,12 @@
 AXWebArea AXRoleDescription='HTML content'
 ++AXList AXRoleDescription='list'
-++++AXStaticText AXRoleDescription='text' AXTitle='Item 1' AXARIASetSize='4' AXARIAPosInSet='1'
-++++AXStaticText AXRoleDescription='text' AXTitle='Item 2' AXARIASetSize='4' AXARIAPosInSet='2'
-++++AXStaticText AXRoleDescription='text' AXTitle='Item 3' AXARIASetSize='4' AXARIAPosInSet='3'
-++++AXStaticText AXRoleDescription='text' AXTitle='Item 4' AXARIASetSize='4' AXARIAPosInSet='4'
+++++AXStaticText AXRoleDescription='text' AXValue='Item 1' AXARIASetSize='4' AXARIAPosInSet='1'
+++++AXStaticText AXRoleDescription='text' AXValue='Item 2' AXARIASetSize='4' AXARIAPosInSet='2'
+++++AXStaticText AXRoleDescription='text' AXValue='Item 3' AXARIASetSize='4' AXARIAPosInSet='3'
+++++AXStaticText AXRoleDescription='text' AXValue='Item 4' AXARIASetSize='4' AXARIAPosInSet='4'
 ++AXList AXRoleDescription='list'
-++++AXStaticText AXRoleDescription='text' AXTitle='Item 1' AXARIASetSize='5' AXARIAPosInSet='1'
-++++AXStaticText AXRoleDescription='text' AXTitle='Item 2' AXARIASetSize='5' AXARIAPosInSet='2'
-++++AXStaticText AXRoleDescription='text' AXTitle='Item 3' AXARIASetSize='5' AXARIAPosInSet='3'
-++++AXStaticText AXRoleDescription='text' AXTitle='Item 4' AXARIASetSize='5' AXARIAPosInSet='4'
-++++AXStaticText AXRoleDescription='text' AXTitle='Item 5' AXARIASetSize='5' AXARIAPosInSet='5'
+++++AXStaticText AXRoleDescription='text' AXValue='Item 1' AXARIASetSize='5' AXARIAPosInSet='1'
+++++AXStaticText AXRoleDescription='text' AXValue='Item 2' AXARIASetSize='5' AXARIAPosInSet='2'
+++++AXStaticText AXRoleDescription='text' AXValue='Item 3' AXARIASetSize='5' AXARIAPosInSet='3'
+++++AXStaticText AXRoleDescription='text' AXValue='Item 4' AXARIASetSize='5' AXARIAPosInSet='4'
+++++AXStaticText AXRoleDescription='text' AXValue='Item 5' AXARIASetSize='5' AXARIAPosInSet='5'
diff --git a/content/test/data/accessibility/aria/aria-sort-html-table-expected-mac.txt b/content/test/data/accessibility/aria/aria-sort-html-table-expected-mac.txt
index adf1065..4cfdfc1 100644
--- a/content/test/data/accessibility/aria/aria-sort-html-table-expected-mac.txt
+++ b/content/test/data/accessibility/aria/aria-sort-html-table-expected-mac.txt
@@ -1,5 +1,5 @@
 AXWebArea
-++AXTable
+++AXTable AXDescription='Data table'
 ++++AXRow
 ++++++AXCell
 ++++++++AXStaticText AXValue='Alphabet'
@@ -11,7 +11,7 @@
 ++++++++AXStaticText AXValue='B'
 ++++AXColumn
 ++++AXGroup
-++AXTable
+++AXTable AXDescription='Data table'
 ++++AXRow
 ++++++AXCell
 ++++++++AXStaticText AXValue='Alphabet'
@@ -23,7 +23,7 @@
 ++++++++AXStaticText AXValue='B'
 ++++AXColumn
 ++++AXGroup
-++AXTable
+++AXTable AXDescription='Data table'
 ++++AXRow
 ++++++AXCell AXSortDirection='AXSortDirectionAscending'
 ++++++++AXStaticText AXValue='Alphabet'
@@ -35,7 +35,7 @@
 ++++++++AXStaticText AXValue='B'
 ++++AXColumn
 ++++AXGroup
-++AXTable
+++AXTable AXDescription='Data table'
 ++++AXRow
 ++++++AXCell AXSortDirection='AXSortDirectionDescending'
 ++++++++AXStaticText AXValue='Alphabet'
@@ -47,7 +47,7 @@
 ++++++++AXStaticText AXValue='A'
 ++++AXColumn
 ++++AXGroup
-++AXTable
+++AXTable AXDescription='Data table'
 ++++AXRow
 ++++++AXCell AXSortDirection='AXSortDirectionUnknown'
 ++++++++AXStaticText AXValue='Alphabet'
@@ -59,7 +59,7 @@
 ++++++++AXStaticText AXValue='A'
 ++++AXColumn
 ++++AXGroup
-++AXTable
+++AXTable AXDescription='Data table'
 ++++AXRow
 ++++++AXCell
 ++++++++AXStaticText AXValue='Alphabet'
@@ -71,7 +71,7 @@
 ++++AXColumn
 ++++AXColumn
 ++++AXGroup
-++AXTable
+++AXTable AXDescription='Data table'
 ++++AXRow
 ++++++AXCell
 ++++++++AXStaticText AXValue='Alphabet'
@@ -83,7 +83,7 @@
 ++++AXColumn
 ++++AXColumn
 ++++AXGroup
-++AXTable
+++AXTable AXDescription='Data table'
 ++++AXRow
 ++++++AXCell AXSortDirection='AXSortDirectionAscending'
 ++++++++AXStaticText AXValue='Alphabet'
@@ -95,7 +95,7 @@
 ++++AXColumn
 ++++AXColumn
 ++++AXGroup
-++AXTable
+++AXTable AXDescription='Data table'
 ++++AXRow
 ++++++AXCell AXSortDirection='AXSortDirectionDescending'
 ++++++++AXStaticText AXValue='Alphabet'
@@ -107,7 +107,7 @@
 ++++AXColumn
 ++++AXColumn
 ++++AXGroup
-++AXTable
+++AXTable AXDescription='Data table'
 ++++AXRow
 ++++++AXCell AXSortDirection='AXSortDirectionUnknown'
 ++++++++AXStaticText AXValue='Alphabet'
@@ -119,7 +119,7 @@
 ++++AXColumn
 ++++AXColumn
 ++++AXGroup
-++AXTable
+++AXTable AXDescription='Data table'
 ++++AXRow
 ++++++AXCell
 ++++++++AXStaticText AXValue='Alphabet'
diff --git a/content/test/data/accessibility/aria/aria-tooltip-expected-mac.txt b/content/test/data/accessibility/aria/aria-tooltip-expected-mac.txt
index 7186c12d..62908b2 100644
--- a/content/test/data/accessibility/aria/aria-tooltip-expected-mac.txt
+++ b/content/test/data/accessibility/aria/aria-tooltip-expected-mac.txt
@@ -1,5 +1,5 @@
 AXWebArea AXRoleDescription='HTML content'
 ++AXGroup AXRoleDescription='group'
-++++AXTextField AXRoleDescription='text field'
+++++AXTextField AXRoleDescription='text field' AXHelp='Your username should be your email id'
 ++AXGroup AXSubrole=AXUserInterfaceTooltip AXRoleDescription='tooltip'
 ++++AXStaticText AXRoleDescription='text' AXValue='Your username should be your email id'
diff --git a/content/test/data/accessibility/html/a-name-calc-expected-android.txt b/content/test/data/accessibility/html/a-name-calc-expected-android.txt
index 79f5ea9..ec2f30e8 100644
--- a/content/test/data/accessibility/html/a-name-calc-expected-android.txt
+++ b/content/test/data/accessibility/html/a-name-calc-expected-android.txt
@@ -1,9 +1,9 @@
 android.webkit.WebView focusable focused scrollable
 ++android.view.View
 ++++android.view.View clickable focusable link name='InnerText0'
-++++android.view.View clickable focusable link name='InnerText1'
-++++android.view.View clickable focusable link name='InnerText2'
-++++android.view.View clickable focusable link name='InnerText3'
+++++android.view.View clickable focusable link name='InnerText1 Title1'
+++++android.view.View clickable focusable link name='Title2'
+++++android.view.View clickable focusable link name='LabelledBy3'
 ++++android.view.View clickable focusable link name='Title4'
 ++++android.view.View clickable focusable link name='Label5'
 ++++android.view.View clickable focusable link name='LabelledBy6'
diff --git a/content/test/data/accessibility/html/abbr-expected-mac.txt b/content/test/data/accessibility/html/abbr-expected-mac.txt
index a6ac2c9..422d2c4 100644
--- a/content/test/data/accessibility/html/abbr-expected-mac.txt
+++ b/content/test/data/accessibility/html/abbr-expected-mac.txt
@@ -1,6 +1,6 @@
 AXWebArea AXRoleDescription='HTML content'
 ++AXGroup AXRoleDescription='group'
 ++++AXStaticText AXRoleDescription='text' AXValue='The '
-++++AXUnknown AXRoleDescription='unknown'
+++++AXUnknown AXRoleDescription='unknown' AXDescription='World Health Organization'
 ++++++AXStaticText AXRoleDescription='text' AXValue='WHO'
 ++++AXStaticText AXRoleDescription='text' AXValue=' was founded in 1948.'
diff --git a/content/test/data/accessibility/html/button-name-calc-expected-android.txt b/content/test/data/accessibility/html/button-name-calc-expected-android.txt
index 3f858f58..bb59aba1 100644
--- a/content/test/data/accessibility/html/button-name-calc-expected-android.txt
+++ b/content/test/data/accessibility/html/button-name-calc-expected-android.txt
@@ -2,7 +2,7 @@
 ++android.view.View
 ++++android.widget.Button clickable focusable name='InnerText0'
 ++++android.widget.Button clickable focusable name='InnerText1 Title1'
-++++android.widget.Button clickable focusable name='AriaLabel2'
-++++android.widget.Button clickable focusable name='LabelledBy3'
-++++android.widget.Button clickable focusable name='LabelledBy4'
+++++android.widget.Button clickable focusable name='AriaLabel2 Title2'
+++++android.widget.Button clickable focusable name='LabelledBy3 Title3'
+++++android.widget.Button clickable focusable name='LabelledBy4 DescribedBy4'
 ++++android.widget.Button clickable focusable name='InnerText5 DescribedBy5'
diff --git a/content/test/data/accessibility/html/button-name-calc-expected-mac.txt b/content/test/data/accessibility/html/button-name-calc-expected-mac.txt
index 5e385370..d618f0b 100644
--- a/content/test/data/accessibility/html/button-name-calc-expected-mac.txt
+++ b/content/test/data/accessibility/html/button-name-calc-expected-mac.txt
@@ -2,7 +2,7 @@
 ++AXGroup
 ++++AXButton AXTitle='InnerText0'
 ++++AXButton AXTitle='InnerText1' AXHelp='Title1'
-++++AXButton AXTitle='InnerText2' AXDescription='AriaLabel2' AXHelp='Title2'
-++++AXButton AXTitle='InnerText3' AXDescription='LabelledBy3' AXHelp='Title3'
-++++AXButton AXTitle='InnerText4' AXDescription='LabelledBy4' AXHelp='DescribedBy4'
+++++AXButton AXDescription='AriaLabel2' AXHelp='Title2'
+++++AXButton AXTitle='LabelledBy3' AXHelp='Title3'
+++++AXButton AXTitle='LabelledBy4' AXHelp='DescribedBy4'
 ++++AXButton AXTitle='InnerText5' AXHelp='DescribedBy5'
diff --git a/content/test/data/accessibility/html/caption-expected-mac.txt b/content/test/data/accessibility/html/caption-expected-mac.txt
index 6ee2ad08..1b76505 100644
--- a/content/test/data/accessibility/html/caption-expected-mac.txt
+++ b/content/test/data/accessibility/html/caption-expected-mac.txt
@@ -1,5 +1,5 @@
 AXWebArea
-++AXTable AXTitle='Browser and Engine'
+++AXTable AXTitleUIElement='AXGroup'
 ++++AXGroup
 ++++++AXStaticText AXValue='Browser and Engine'
 ++++AXRow
diff --git a/content/test/data/accessibility/html/checkbox-name-calc-expected-android.txt b/content/test/data/accessibility/html/checkbox-name-calc-expected-android.txt
index e6551b6..425dab34 100644
--- a/content/test/data/accessibility/html/checkbox-name-calc-expected-android.txt
+++ b/content/test/data/accessibility/html/checkbox-name-calc-expected-android.txt
@@ -2,7 +2,7 @@
 ++android.view.View
 ++++android.widget.CheckBox checkable clickable focusable name='Title0'
 ++++android.widget.CheckBox checkable clickable focusable name='Label1 Title1'
-++++android.widget.CheckBox checkable clickable focusable name='AriaLabel2'
-++++android.widget.CheckBox checkable clickable focusable name='LabelledBy3'
-++++android.widget.CheckBox checkable clickable focusable name='LabelledBy4'
+++++android.widget.CheckBox checkable clickable focusable name='AriaLabel2 Title2'
+++++android.widget.CheckBox checkable clickable focusable name='LabelledBy3 Title3'
+++++android.widget.CheckBox checkable clickable focusable name='LabelledBy4 DescribedBy4'
 ++++android.widget.CheckBox checkable clickable focusable name='DescribedBy5'
diff --git a/content/test/data/accessibility/html/checkbox-name-calc-expected-mac.txt b/content/test/data/accessibility/html/checkbox-name-calc-expected-mac.txt
index 418d400..c930ab1 100644
--- a/content/test/data/accessibility/html/checkbox-name-calc-expected-mac.txt
+++ b/content/test/data/accessibility/html/checkbox-name-calc-expected-mac.txt
@@ -3,6 +3,6 @@
 ++++AXCheckBox AXDescription='Title0'
 ++++AXCheckBox AXTitle='Label1' AXHelp='Title1'
 ++++AXCheckBox AXDescription='AriaLabel2' AXHelp='Title2'
-++++AXCheckBox AXDescription='LabelledBy3' AXHelp='Title3'
-++++AXCheckBox AXDescription='LabelledBy4' AXHelp='DescribedBy4'
+++++AXCheckBox AXTitle='LabelledBy3' AXHelp='Title3'
+++++AXCheckBox AXTitle='LabelledBy4' AXHelp='DescribedBy4'
 ++++AXCheckBox AXHelp='DescribedBy5'
diff --git a/content/test/data/accessibility/html/checkbox-name-calc-expected-win.txt b/content/test/data/accessibility/html/checkbox-name-calc-expected-win.txt
index b913dd9..10eaf57 100644
--- a/content/test/data/accessibility/html/checkbox-name-calc-expected-win.txt
+++ b/content/test/data/accessibility/html/checkbox-name-calc-expected-win.txt
@@ -5,4 +5,4 @@
 ++++ROLE_SYSTEM_CHECKBUTTON name='AriaLabel2' FOCUSABLE description='Title2'
 ++++ROLE_SYSTEM_CHECKBUTTON name='LabelledBy3' FOCUSABLE description='Title3'
 ++++ROLE_SYSTEM_CHECKBUTTON name='LabelledBy4' FOCUSABLE description='DescribedBy4'
-++++ROLE_SYSTEM_CHECKBUTTON name='DescribedBy5' FOCUSABLE
+++++ROLE_SYSTEM_CHECKBUTTON FOCUSABLE description='DescribedBy5'
diff --git a/content/test/data/accessibility/html/cite-expected-mac.txt b/content/test/data/accessibility/html/cite-expected-mac.txt
index bcb37db..7a6b589 100644
--- a/content/test/data/accessibility/html/cite-expected-mac.txt
+++ b/content/test/data/accessibility/html/cite-expected-mac.txt
@@ -1,6 +1,6 @@
 AXWebArea
 ++AXGroup
-++++AXImage
+++++AXImage AXDescription='Pipe'
 ++AXGroup
 ++++AXStaticText AXValue='The pipe'
 ++++AXStaticText AXValue=' clicked by SomeOne.'
diff --git a/content/test/data/accessibility/html/contenteditable-descendants-expected-mac.txt b/content/test/data/accessibility/html/contenteditable-descendants-expected-mac.txt
index 327ecc9..3a1641d 100644
--- a/content/test/data/accessibility/html/contenteditable-descendants-expected-mac.txt
+++ b/content/test/data/accessibility/html/contenteditable-descendants-expected-mac.txt
@@ -8,7 +8,7 @@
 ++++++AXLink AXTitle='link'
 ++++++++AXStaticText AXValue='link'
 ++++++AXStaticText AXValue=' and an '
-++++++AXImage
+++++++AXImage AXDescription='Image'
 ++++++AXStaticText AXValue=' and a '
 ++++++AXButton AXTitle='Button'
 ++++++AXStaticText AXValue='.'
diff --git a/content/test/data/accessibility/html/contenteditable-descendants-with-selection-expected-mac.txt b/content/test/data/accessibility/html/contenteditable-descendants-with-selection-expected-mac.txt
index d3f666a..30821b4 100644
--- a/content/test/data/accessibility/html/contenteditable-descendants-with-selection-expected-mac.txt
+++ b/content/test/data/accessibility/html/contenteditable-descendants-with-selection-expected-mac.txt
@@ -7,7 +7,7 @@
 ++++++AXLink AXTitle='link'
 ++++++++AXStaticText AXValue='link'
 ++++++AXStaticText AXValue=' and an '
-++++++AXImage
+++++++AXImage AXDescription='Image'
 ++++++AXStaticText AXValue=' and a '
 ++++++AXButton AXTitle='Button'
 ++++++AXStaticText AXValue='.'
diff --git a/content/test/data/accessibility/html/div-expected-mac.txt b/content/test/data/accessibility/html/div-expected-mac.txt
index 94e98ba..5c236b8 100644
--- a/content/test/data/accessibility/html/div-expected-mac.txt
+++ b/content/test/data/accessibility/html/div-expected-mac.txt
@@ -1,3 +1,3 @@
 AXWebArea
-++AXGroup AXTitle='Focusable div'
+++AXGroup AXDescription='Focusable div'
 ++++AXStaticText AXValue='Focusable div'
diff --git a/content/test/data/accessibility/html/div-expected-win.txt b/content/test/data/accessibility/html/div-expected-win.txt
index 1ddc489..adb7276 100644
--- a/content/test/data/accessibility/html/div-expected-win.txt
+++ b/content/test/data/accessibility/html/div-expected-win.txt
@@ -1,3 +1,3 @@
 ROLE_SYSTEM_DOCUMENT READONLY FOCUSABLE
-++IA2_ROLE_SECTION name='Focusable div' FOCUSABLE
+++IA2_ROLE_SECTION FOCUSABLE
 ++++ROLE_SYSTEM_STATICTEXT name='Focusable div'
diff --git a/content/test/data/accessibility/html/element-class-id-src-attr-expected-mac.txt b/content/test/data/accessibility/html/element-class-id-src-attr-expected-mac.txt
index db4e81c..d97f1eee 100644
--- a/content/test/data/accessibility/html/element-class-id-src-attr-expected-mac.txt
+++ b/content/test/data/accessibility/html/element-class-id-src-attr-expected-mac.txt
@@ -2,4 +2,4 @@
 ++AXHeading AXTitle='Image' AXValue='1'
 ++++AXStaticText AXValue='Image'
 ++AXGroup
-++++AXImage
\ No newline at end of file
+++++AXImage AXDescription='ImageAlt'
diff --git a/content/test/data/accessibility/html/fieldset-expected-mac.txt b/content/test/data/accessibility/html/fieldset-expected-mac.txt
index 300b8fba..6d58014 100644
--- a/content/test/data/accessibility/html/fieldset-expected-mac.txt
+++ b/content/test/data/accessibility/html/fieldset-expected-mac.txt
@@ -1,5 +1,5 @@
 AXWebArea
 ++AXGroup
-++++AXGroup
+++++AXGroup AXTitleUIElement='AXGroup'
 ++++++AXGroup
 ++++++++AXStaticText AXValue='Browser Engine's:'
diff --git a/content/test/data/accessibility/html/figcaption-expected-mac.txt b/content/test/data/accessibility/html/figcaption-expected-mac.txt
index 00ec337..ebc1d7e 100644
--- a/content/test/data/accessibility/html/figcaption-expected-mac.txt
+++ b/content/test/data/accessibility/html/figcaption-expected-mac.txt
@@ -1,6 +1,6 @@
 AXWebArea
-++AXGroup AXTitle='Fig.1 - A green Box'
+++AXGroup AXTitleUIElement='AXGroup'
 ++++AXGroup
-++++++AXImage
+++++++AXImage AXDescription='This is a green box.'
 ++++AXGroup
 ++++++AXStaticText AXValue='Fig.1 - A green Box'
diff --git a/content/test/data/accessibility/html/figure-expected-mac.txt b/content/test/data/accessibility/html/figure-expected-mac.txt
index e302a15..b823c51 100644
--- a/content/test/data/accessibility/html/figure-expected-mac.txt
+++ b/content/test/data/accessibility/html/figure-expected-mac.txt
@@ -1,3 +1,3 @@
 AXWebArea AXRoleDescription='HTML content'
 ++AXGroup AXRoleDescription='figure'
-++++AXImage AXRoleDescription='image'
+++++AXImage AXRoleDescription='image' AXDescription='Sunspots'
diff --git a/content/test/data/accessibility/html/img-expected-mac.txt b/content/test/data/accessibility/html/img-expected-mac.txt
index 9e64cb0b..33a62c4 100644
--- a/content/test/data/accessibility/html/img-expected-mac.txt
+++ b/content/test/data/accessibility/html/img-expected-mac.txt
@@ -1,3 +1,3 @@
 AXWebArea
 ++AXGroup
-++++AXImage AXRoleDescription='image'
+++++AXImage AXRoleDescription='image' AXDescription='pipe'
diff --git a/content/test/data/accessibility/html/input-date-expected-mac.txt b/content/test/data/accessibility/html/input-date-expected-mac.txt
index b5c37dc1..ce93f09 100644
--- a/content/test/data/accessibility/html/input-date-expected-mac.txt
+++ b/content/test/data/accessibility/html/input-date-expected-mac.txt
@@ -1,14 +1,3 @@
 AXWebArea AXRoleDescription='HTML content'
 ++AXGroup AXRoleDescription='group'
-++++AXDateField AXRoleDescription='date field' AXValue='2008-09-01'
-++++++AXGroup AXRoleDescription='group'
-++++++++AXGroup AXRoleDescription='group'
-++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='9'
-++++++++++AXStaticText AXRoleDescription='text' AXValue='/'
-++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='1'
-++++++++++AXStaticText AXRoleDescription='text' AXValue='/'
-++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='2008'
-++++++AXPopUpButton AXRoleDescription='pop up button'
-++++++AXIncrementor AXRoleDescription='stepper' AXValue='0'
-++++++++AXButton AXRoleDescription='button'
-++++++++AXButton AXRoleDescription='button'
+++++AXDateField AXRoleDescription='date field' AXValue='2008-09-01' AXDescription='@NO_CHILDREN_DUMP'
diff --git a/content/test/data/accessibility/html/input-datetime-local-expected-win.txt b/content/test/data/accessibility/html/input-datetime-local-expected-win.txt
index 39b01a49..56935d5 100644
--- a/content/test/data/accessibility/html/input-datetime-local-expected-win.txt
+++ b/content/test/data/accessibility/html/input-datetime-local-expected-win.txt
@@ -3,15 +3,15 @@
 ++++IA2_ROLE_DATE_EDITOR FOCUSABLE ia2_hypertext='<obj0><obj1><obj2>'
 ++++++IA2_ROLE_SECTION ia2_hypertext='<obj0>'
 ++++++++IA2_ROLE_SECTION ia2_hypertext='<obj0>/<obj2>/<obj4><obj5>:<obj7><obj8>'
-++++++++++ROLE_SYSTEM_SPINBUTTON name='Month' FOCUSABLE ia2_hypertext='Month'
+++++++++++ROLE_SYSTEM_SPINBUTTON FOCUSABLE description='Month'
 ++++++++++ROLE_SYSTEM_STATICTEXT name='/' ia2_hypertext='/'
-++++++++++ROLE_SYSTEM_SPINBUTTON name='Day' FOCUSABLE ia2_hypertext='Day'
+++++++++++ROLE_SYSTEM_SPINBUTTON FOCUSABLE description='Day'
 ++++++++++ROLE_SYSTEM_STATICTEXT name='/' ia2_hypertext='/'
-++++++++++ROLE_SYSTEM_SPINBUTTON name='Year' FOCUSABLE ia2_hypertext='Year'
-++++++++++ROLE_SYSTEM_SPINBUTTON name='Hours' FOCUSABLE ia2_hypertext='Hours'
+++++++++++ROLE_SYSTEM_SPINBUTTON FOCUSABLE description='Year'
+++++++++++ROLE_SYSTEM_SPINBUTTON FOCUSABLE description='Hours'
 ++++++++++ROLE_SYSTEM_STATICTEXT name=':' ia2_hypertext=':'
-++++++++++ROLE_SYSTEM_SPINBUTTON name='Minutes' FOCUSABLE ia2_hypertext='Minutes'
-++++++++++ROLE_SYSTEM_SPINBUTTON name='AM/PM' FOCUSABLE ia2_hypertext='AM/PM'
+++++++++++ROLE_SYSTEM_SPINBUTTON FOCUSABLE description='Minutes'
+++++++++++ROLE_SYSTEM_SPINBUTTON FOCUSABLE description='AM/PM'
 ++++++ROLE_SYSTEM_BUTTONMENU FOCUSABLE
 ++++++ROLE_SYSTEM_SPINBUTTON ia2_hypertext='<obj0><obj1>'
 ++++++++ROLE_SYSTEM_PUSHBUTTON
diff --git a/content/test/data/accessibility/html/input-datetime-local.html b/content/test/data/accessibility/html/input-datetime-local.html
index 53ba67b..549ae330 100644
--- a/content/test/data/accessibility/html/input-datetime-local.html
+++ b/content/test/data/accessibility/html/input-datetime-local.html
@@ -1,6 +1,7 @@
 <!--
 @MAC-ALLOW:AXRole*
 @WIN-ALLOW:ia2_hypertext=*
+@WIN-ALLOW:description=*
 -->
 <!DOCTYPE html>
 <html>
diff --git a/content/test/data/accessibility/html/input-image-expected-mac.txt b/content/test/data/accessibility/html/input-image-expected-mac.txt
index 6ff9262..c438ea6 100644
--- a/content/test/data/accessibility/html/input-image-expected-mac.txt
+++ b/content/test/data/accessibility/html/input-image-expected-mac.txt
@@ -1,3 +1,3 @@
 AXWebArea AXRoleDescription='HTML content'
 ++AXGroup AXRoleDescription='group'
-++++AXButton AXRoleDescription='button'
+++++AXButton AXRoleDescription='button' AXDescription='Submit'
diff --git a/content/test/data/accessibility/html/input-month-expected-mac.txt b/content/test/data/accessibility/html/input-month-expected-mac.txt
index db28a64..67c80037 100644
--- a/content/test/data/accessibility/html/input-month-expected-mac.txt
+++ b/content/test/data/accessibility/html/input-month-expected-mac.txt
@@ -1,10 +1,10 @@
 AXWebArea AXRoleDescription='HTML content'
 ++AXGroup AXRoleDescription='group'
-++++AXTextField AXRoleDescription='text field'
+++++AXDateField AXRoleDescription='date field'
 ++++++AXGroup AXRoleDescription='group'
 ++++++++AXGroup AXRoleDescription='group'
-++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='0'
-++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='0'
+++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='0' AXHelp='Month'
+++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='0' AXHelp='Year'
 ++++++AXPopUpButton AXRoleDescription='pop up button'
 ++++++AXIncrementor AXRoleDescription='stepper' AXValue='0'
 ++++++++AXButton AXRoleDescription='button'
diff --git a/content/test/data/accessibility/html/input-radio-expected-mac.txt b/content/test/data/accessibility/html/input-radio-expected-mac.txt
index e54e00f8..a297a09 100644
--- a/content/test/data/accessibility/html/input-radio-expected-mac.txt
+++ b/content/test/data/accessibility/html/input-radio-expected-mac.txt
@@ -3,7 +3,6 @@
 ++++AXRadioButton AXValue='0'
 ++++AXStaticText AXValue='Radio1'
 ++++AXUnknown AXTitle='
-' AXValue='
 '
 ++++AXRadioButton AXValue='0'
 ++++AXStaticText AXValue='Radio2'
diff --git a/content/test/data/accessibility/html/input-text-expected-mac.txt b/content/test/data/accessibility/html/input-text-expected-mac.txt
index de61365..893526f3 100644
--- a/content/test/data/accessibility/html/input-text-expected-mac.txt
+++ b/content/test/data/accessibility/html/input-text-expected-mac.txt
@@ -1,3 +1,3 @@
 AXWebArea AXRoleDescription='HTML content'
 ++AXGroup AXRoleDescription='group'
-++++AXTextField AXRoleDescription='text field' AXPlaceholderValue='Name'
+++++AXTextField AXRoleDescription='text field' AXDescription='Name'
diff --git a/content/test/data/accessibility/html/input-text-name-calc-expected-android.txt b/content/test/data/accessibility/html/input-text-name-calc-expected-android.txt
index 5f8637e..849006f 100644
--- a/content/test/data/accessibility/html/input-text-name-calc-expected-android.txt
+++ b/content/test/data/accessibility/html/input-text-name-calc-expected-android.txt
@@ -1,9 +1,9 @@
 android.webkit.WebView focusable focused scrollable
 ++android.view.View
 ++++android.widget.EditText clickable editable_text focusable name='Title0' input_type=1
-++++android.widget.EditText clickable editable_text focusable name='Title1' input_type=1
-++++android.widget.EditText clickable editable_text focusable name='AriaLabel2' input_type=1
-++++android.widget.EditText clickable editable_text focusable name='LabelledBy3' input_type=1
+++++android.widget.EditText clickable editable_text focusable name='Label1 Title1' input_type=1
+++++android.widget.EditText clickable editable_text focusable name='AriaLabel2 Title2' input_type=1
+++++android.widget.EditText clickable editable_text focusable name='LabelledBy3 Title3' input_type=1
 ++++android.widget.EditText clickable editable_text focusable name='Placeholder4' input_type=1
-++++android.widget.EditText clickable editable_text focusable name='Title5' input_type=1
-++++android.widget.EditText clickable editable_text focusable name='LabelledBy6' input_type=1
+++++android.widget.EditText clickable editable_text focusable name='Placeholder5 Title5' input_type=1
+++++android.widget.EditText clickable editable_text focusable name='LabelledBy6 DescribedBy6' input_type=1
diff --git a/content/test/data/accessibility/html/input-text-name-calc-expected-win.txt b/content/test/data/accessibility/html/input-text-name-calc-expected-win.txt
index 3d1eb09..a5362ce3 100644
--- a/content/test/data/accessibility/html/input-text-name-calc-expected-win.txt
+++ b/content/test/data/accessibility/html/input-text-name-calc-expected-win.txt
@@ -5,5 +5,5 @@
 ++++ROLE_SYSTEM_TEXT name='AriaLabel2' FOCUSABLE description='Title2'
 ++++ROLE_SYSTEM_TEXT name='LabelledBy3' FOCUSABLE description='Title3'
 ++++ROLE_SYSTEM_TEXT name='Placeholder4' FOCUSABLE
-++++ROLE_SYSTEM_TEXT name='Title5' FOCUSABLE description='Placeholder5'
+++++ROLE_SYSTEM_TEXT name='Placeholder5' FOCUSABLE description='Title5'
 ++++ROLE_SYSTEM_TEXT name='LabelledBy6' FOCUSABLE description='DescribedBy6'
diff --git a/content/test/data/accessibility/html/input-time-expected-mac.txt b/content/test/data/accessibility/html/input-time-expected-mac.txt
index f2cee44..5b10bd9 100644
--- a/content/test/data/accessibility/html/input-time-expected-mac.txt
+++ b/content/test/data/accessibility/html/input-time-expected-mac.txt
@@ -3,10 +3,10 @@
 ++++AXTimeField AXRoleDescription='time field' AXValue='00:00:00'
 ++++++AXGroup AXRoleDescription='group'
 ++++++++AXGroup AXRoleDescription='group'
-++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='12'
+++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='12' AXHelp='Hours'
 ++++++++++AXStaticText AXRoleDescription='text' AXValue=':'
-++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='0'
-++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='1'
+++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='0' AXHelp='Minutes'
+++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='1' AXHelp='AM/PM'
 ++++++AXIncrementor AXRoleDescription='stepper' AXValue='0'
 ++++++++AXButton AXRoleDescription='button'
 ++++++++AXButton AXRoleDescription='button'
diff --git a/content/test/data/accessibility/html/input-time-expected-win.txt b/content/test/data/accessibility/html/input-time-expected-win.txt
index f34e41a1..d9f4fb98 100644
--- a/content/test/data/accessibility/html/input-time-expected-win.txt
+++ b/content/test/data/accessibility/html/input-time-expected-win.txt
@@ -3,10 +3,10 @@
 ++++ROLE_SYSTEM_GROUPING FOCUSABLE ia2_hypertext='<obj0><obj1>'
 ++++++IA2_ROLE_SECTION ia2_hypertext='<obj0>'
 ++++++++IA2_ROLE_SECTION ia2_hypertext='<obj0>:<obj2><obj3>'
-++++++++++ROLE_SYSTEM_SPINBUTTON name='Hours' FOCUSABLE xml-roles:spinbutton ia2_hypertext='Hours'
+++++++++++ROLE_SYSTEM_SPINBUTTON FOCUSABLE xml-roles:spinbutton description='Hours'
 ++++++++++ROLE_SYSTEM_STATICTEXT name=':' ia2_hypertext=':'
-++++++++++ROLE_SYSTEM_SPINBUTTON name='Minutes' FOCUSABLE xml-roles:spinbutton ia2_hypertext='Minutes'
-++++++++++ROLE_SYSTEM_SPINBUTTON name='AM/PM' FOCUSABLE xml-roles:spinbutton ia2_hypertext='AM/PM'
+++++++++++ROLE_SYSTEM_SPINBUTTON FOCUSABLE xml-roles:spinbutton description='Minutes'
+++++++++++ROLE_SYSTEM_SPINBUTTON FOCUSABLE xml-roles:spinbutton description='AM/PM'
 ++++++ROLE_SYSTEM_SPINBUTTON ia2_hypertext='<obj0><obj1>'
 ++++++++ROLE_SYSTEM_PUSHBUTTON
 ++++++++ROLE_SYSTEM_PUSHBUTTON
diff --git a/content/test/data/accessibility/html/input-time.html b/content/test/data/accessibility/html/input-time.html
index d422cbe..af75a6b8 100644
--- a/content/test/data/accessibility/html/input-time.html
+++ b/content/test/data/accessibility/html/input-time.html
@@ -2,6 +2,7 @@
 @MAC-ALLOW:AXRole*
 @WIN-ALLOW:ia2_hypertext=*
 @WIN-ALLOW:xml-roles*
+@WIN-ALLOW:description*
 -->
 <!DOCTYPE html>
 <html>
diff --git a/content/test/data/accessibility/html/input-week-expected-mac.txt b/content/test/data/accessibility/html/input-week-expected-mac.txt
index c0e41974..ffcba886 100644
--- a/content/test/data/accessibility/html/input-week-expected-mac.txt
+++ b/content/test/data/accessibility/html/input-week-expected-mac.txt
@@ -1,12 +1,12 @@
 AXWebArea AXRoleDescription='HTML content'
 ++AXGroup AXRoleDescription='group'
-++++AXTextField AXRoleDescription='text field'
+++++AXDateField AXRoleDescription='date field'
 ++++++AXGroup AXRoleDescription='group'
 ++++++++AXGroup AXRoleDescription='group'
 ++++++++++AXStaticText AXRoleDescription='text' AXValue='Week '
-++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='0'
+++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='0' AXHelp='Week'
 ++++++++++AXStaticText AXRoleDescription='text' AXValue=', '
-++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='0'
+++++++++++AXIncrementor AXRoleDescription='stepper' AXValue='0' AXHelp='Year'
 ++++++AXPopUpButton AXRoleDescription='pop up button'
 ++++++AXIncrementor AXRoleDescription='stepper' AXValue='0'
 ++++++++AXButton AXRoleDescription='button'
diff --git a/content/test/data/accessibility/html/input-week-expected-win.txt b/content/test/data/accessibility/html/input-week-expected-win.txt
index d9afbea..945d6e6 100644
--- a/content/test/data/accessibility/html/input-week-expected-win.txt
+++ b/content/test/data/accessibility/html/input-week-expected-win.txt
@@ -4,9 +4,9 @@
 ++++++IA2_ROLE_SECTION ia2_hypertext='<obj0>'
 ++++++++IA2_ROLE_SECTION ia2_hypertext='Week <obj1>, <obj3>'
 ++++++++++ROLE_SYSTEM_STATICTEXT name='Week ' ia2_hypertext='Week '
-++++++++++ROLE_SYSTEM_SPINBUTTON name='Week' FOCUSABLE ia2_hypertext='Week'
+++++++++++ROLE_SYSTEM_SPINBUTTON FOCUSABLE description='Week'
 ++++++++++ROLE_SYSTEM_STATICTEXT name=', ' ia2_hypertext=', '
-++++++++++ROLE_SYSTEM_SPINBUTTON name='Year' FOCUSABLE ia2_hypertext='Year'
+++++++++++ROLE_SYSTEM_SPINBUTTON FOCUSABLE description='Year'
 ++++++ROLE_SYSTEM_BUTTONMENU FOCUSABLE
 ++++++ROLE_SYSTEM_SPINBUTTON ia2_hypertext='<obj0><obj1>'
 ++++++++ROLE_SYSTEM_PUSHBUTTON
diff --git a/content/test/data/accessibility/html/input-week.html b/content/test/data/accessibility/html/input-week.html
index 3ef38b31..d2e8e15 100644
--- a/content/test/data/accessibility/html/input-week.html
+++ b/content/test/data/accessibility/html/input-week.html
@@ -1,6 +1,7 @@
 <!--
 @MAC-ALLOW:AXRole*
 @WIN-ALLOW:ia2_hypertext=*
+@WIN-ALLOW:description*
 -->
 <!DOCTYPE html>
 <html>
diff --git a/content/test/data/accessibility/html/legend-expected-mac.txt b/content/test/data/accessibility/html/legend-expected-mac.txt
index d648266d..3e700a77 100644
--- a/content/test/data/accessibility/html/legend-expected-mac.txt
+++ b/content/test/data/accessibility/html/legend-expected-mac.txt
@@ -1,6 +1,6 @@
 AXWebArea
 ++AXGroup
-++++AXGroup AXTitleUIElement='AXGroup group'
+++++AXGroup AXTitleUIElement='AXGroup'
 ++++++AXGroup
 ++++++++AXStaticText AXValue='Browser Engine's:'
 ++++++AXGroup
diff --git a/content/test/data/accessibility/html/link-inside-heading-expected-android.txt b/content/test/data/accessibility/html/link-inside-heading-expected-android.txt
index 151f98b..6befbdf 100644
--- a/content/test/data/accessibility/html/link-inside-heading-expected-android.txt
+++ b/content/test/data/accessibility/html/link-inside-heading-expected-android.txt
@@ -1,3 +1,3 @@
 android.webkit.WebView focusable focused scrollable
-++android.view.View heading
+++android.view.View heading name='Link In Heading'
 ++++android.view.View clickable focusable heading link name='Link In Heading'
diff --git a/content/test/data/accessibility/html/link-inside-heading-expected-mac.txt b/content/test/data/accessibility/html/link-inside-heading-expected-mac.txt
index 544ee981..82cd1e2 100644
--- a/content/test/data/accessibility/html/link-inside-heading-expected-mac.txt
+++ b/content/test/data/accessibility/html/link-inside-heading-expected-mac.txt
@@ -1,4 +1,4 @@
 AXWebArea
-++AXHeading AXValue='1'
+++AXHeading AXTitle='Link In Heading' AXValue='1'
 ++++AXLink AXTitle='Link In Heading'
 ++++++AXStaticText AXValue='Link In Heading'
diff --git a/content/test/data/accessibility/html/link-inside-heading-expected-win.txt b/content/test/data/accessibility/html/link-inside-heading-expected-win.txt
index 15c67c8..ecbbcad 100644
--- a/content/test/data/accessibility/html/link-inside-heading-expected-win.txt
+++ b/content/test/data/accessibility/html/link-inside-heading-expected-win.txt
@@ -1,4 +1,4 @@
 ROLE_SYSTEM_DOCUMENT READONLY FOCUSABLE
-++IA2_ROLE_HEADING
+++IA2_ROLE_HEADING name='Link In Heading'
 ++++ROLE_SYSTEM_LINK name='Link In Heading' FOCUSABLE
 ++++++ROLE_SYSTEM_STATICTEXT name='Link In Heading'
diff --git a/content/test/data/accessibility/html/optgroup-expected-mac.txt b/content/test/data/accessibility/html/optgroup-expected-mac.txt
index c69e19f..b51a75d 100644
--- a/content/test/data/accessibility/html/optgroup-expected-mac.txt
+++ b/content/test/data/accessibility/html/optgroup-expected-mac.txt
@@ -1,13 +1,13 @@
 AXWebArea AXRoleDescription='HTML content'
 ++AXGroup AXRoleDescription='group'
 ++++AXList AXRoleDescription='list'
-++++++AXGroup AXRoleDescription='group'
+++++++AXGroup AXRoleDescription='group' AXDescription='Enabled'
 ++++++++AXStaticText AXRoleDescription='text' AXValue='Enabled'
 ++++++AXStaticText AXRoleDescription='text' AXValue='One'
 ++++++AXStaticText AXRoleDescription='text' AXValue='Two'
 ++++++AXStaticText AXRoleDescription='text' AXValue='Three'
 ++++++AXStaticText AXRoleDescription='text' AXValue='Four'
-++++++AXGroup AXRoleDescription='group'
+++++++AXGroup AXRoleDescription='group' AXDescription='Disabled'
 ++++++++AXStaticText AXRoleDescription='text' AXValue='Disabled'
 ++++++AXStaticText AXRoleDescription='text' AXValue='One'
 ++++++AXStaticText AXRoleDescription='text' AXValue='Two'
diff --git a/content/test/data/accessibility/html/wbr-expected-mac.txt b/content/test/data/accessibility/html/wbr-expected-mac.txt
index b4ea772..2d893c0 100644
--- a/content/test/data/accessibility/html/wbr-expected-mac.txt
+++ b/content/test/data/accessibility/html/wbr-expected-mac.txt
@@ -1,5 +1,3 @@
-# The spec states that <wbr> should have a role of AXGroup, but that seems
-# wrong, so we assume this is correct.
 AXWebArea
 ++AXGroup
 ++++AXStaticText AXValue='Supercali'
diff --git a/extensions/browser/api/bluetooth/OWNERS b/extensions/browser/api/bluetooth/OWNERS
index 8880df9..ecefbc4 100644
--- a/extensions/browser/api/bluetooth/OWNERS
+++ b/extensions/browser/api/bluetooth/OWNERS
@@ -1,3 +1,4 @@
-rpaquay@chromium.org
-keybuk@chromium.org
 armansito@chromium.org
+keybuk@chromium.org
+rpaquay@chromium.org
+stevenjb@chromium.org
diff --git a/extensions/browser/api/networking_private/networking_private_chromeos.cc b/extensions/browser/api/networking_private/networking_private_chromeos.cc
index 7bddcb8e..fb79efb 100644
--- a/extensions/browser/api/networking_private/networking_private_chromeos.cc
+++ b/extensions/browser/api/networking_private/networking_private_chromeos.cc
@@ -121,6 +121,9 @@
     case NetworkStateHandler::TECHNOLOGY_ENABLED:
       state = private_api::DEVICE_STATE_TYPE_ENABLED;
       break;
+    case NetworkStateHandler::TECHNOLOGY_PROHIBITED:
+      state = private_api::DEVICE_STATE_TYPE_PROHIBITED;
+      break;
   }
   DCHECK_NE(private_api::DEVICE_STATE_TYPE_NONE, state);
   scoped_ptr<private_api::DeviceStateProperties> properties(
diff --git a/extensions/common/api/_behavior_features.json b/extensions/common/api/_behavior_features.json
index 1bbcc51..db8f7240 100644
--- a/extensions/common/api/_behavior_features.json
+++ b/extensions/common/api/_behavior_features.json
@@ -18,9 +18,6 @@
 // hashes back to ids.
 
 {
-  "service_worker": {
-    "channel": "trunk"
-  },
   "whitelisted_for_incognito": {
     "channel": "stable",
     "extension_types": "all",
diff --git a/extensions/common/api/networking_private.idl b/extensions/common/api/networking_private.idl
index 2cf52fd..75c3449 100644
--- a/extensions/common/api/networking_private.idl
+++ b/extensions/common/api/networking_private.idl
@@ -48,7 +48,9 @@
     // Enabled state has been requested but has not completed.
     Enabling,
     // Device is enabled.
-    Enabled
+    Enabled,
+    // Device is prohibited.
+    Prohibited
   };
 
   enum IPConfigType {
diff --git a/extensions/common/file_util.cc b/extensions/common/file_util.cc
index b6156291..8ec4c99 100644
--- a/extensions/common/file_util.cc
+++ b/extensions/common/file_util.cc
@@ -45,6 +45,13 @@
 namespace file_util {
 namespace {
 
+enum SafeInstallationFlag {
+  DEFAULT,   // Default case, controlled by a field trial.
+  DISABLED,  // Safe installation is disabled.
+  ENABLED,   // Safe installation is enabled.
+};
+SafeInstallationFlag g_use_safe_installation = DEFAULT;
+
 // Returns true if the given file path exists and is not zero-length.
 bool ValidateFilePath(const base::FilePath& path) {
   int64 size = 0;
@@ -97,6 +104,10 @@
 
 const base::FilePath::CharType kTempDirectoryName[] = FILE_PATH_LITERAL("Temp");
 
+void SetUseSafeInstallation(bool use_safe_installation) {
+  g_use_safe_installation = use_safe_installation ? ENABLED : DISABLED;
+}
+
 base::FilePath InstallExtension(const base::FilePath& unpacked_source_dir,
                                 const std::string& id,
                                 const std::string& version,
diff --git a/extensions/common/file_util.h b/extensions/common/file_util.h
index 5bb12874..3fda56ad 100644
--- a/extensions/common/file_util.h
+++ b/extensions/common/file_util.h
@@ -31,6 +31,9 @@
 
 extern const base::FilePath::CharType kTempDirectoryName[];
 
+// Sets the flag to enable safe installation (i.e. flush all installed files).
+void SetUseSafeInstallation(bool use_safe_installation);
+
 // Copies |unpacked_source_dir| into the right location under |extensions_dir|.
 // The destination directory is returned on success, or empty path is returned
 // on failure.
diff --git a/extensions/common/url_pattern_set.cc b/extensions/common/url_pattern_set.cc
index 28a4948..bd489e1 100644
--- a/extensions/common/url_pattern_set.cc
+++ b/extensions/common/url_pattern_set.cc
@@ -266,7 +266,6 @@
        ++i) {
     value->push_back(i->GetAsString());
   }
-  std::unique(value->begin(), value->end());
   return value.Pass();
 }
 
diff --git a/extensions/common/url_pattern_set_unittest.cc b/extensions/common/url_pattern_set_unittest.cc
index ce18203..3929a72 100644
--- a/extensions/common/url_pattern_set_unittest.cc
+++ b/extensions/common/url_pattern_set_unittest.cc
@@ -455,4 +455,23 @@
       URLPattern::SCHEME_HTTP, GURL("https://google.com/")));
 }
 
+TEST(URLPatternSetTest, ToStringVector) {
+  URLPatternSet set;
+  AddPattern(&set, "https://google.com/");
+  AddPattern(&set, "https://google.com/");
+  AddPattern(&set, "https://yahoo.com/");
+
+  scoped_ptr<std::vector<std::string>> string_vector(set.ToStringVector());
+
+  EXPECT_EQ(2UL, string_vector->size());
+
+  const auto begin = string_vector->begin();
+  const auto end = string_vector->end();
+
+  auto it = std::find(begin, end, "https://google.com/");
+  EXPECT_NE(it, end);
+  it = std::find(begin, end, "https://yahoo.com/");
+  EXPECT_NE(it, end);
+}
+
 }  // namespace extensions
diff --git a/gpu/command_buffer/build_gles2_cmd_buffer.py b/gpu/command_buffer/build_gles2_cmd_buffer.py
index fb30873..ea859c91 100755
--- a/gpu/command_buffer/build_gles2_cmd_buffer.py
+++ b/gpu/command_buffer/build_gles2_cmd_buffer.py
@@ -2566,8 +2566,9 @@
   'LineWidth': {
     'type': 'StateSet',
     'state': 'LineWidth',
+    'decoder_func': 'DoLineWidth',
     'valid_args': {
-      '0': '0.5f'
+      '0': '2.0f'
     },
   },
   'PolygonOffset': {
diff --git a/gpu/command_buffer/client/gles2_implementation.cc b/gpu/command_buffer/client/gles2_implementation.cc
index b7b8a7f..41e5b37c 100644
--- a/gpu/command_buffer/client/gles2_implementation.cc
+++ b/gpu/command_buffer/client/gles2_implementation.cc
@@ -321,11 +321,25 @@
 
 void GLES2Implementation::SignalSyncToken(const gpu::SyncToken& sync_token,
                                           const base::Closure& callback) {
-  gpu_control_->SignalSyncToken(
-      sync_token,
-      base::Bind(&GLES2Implementation::RunIfContextNotLost,
-                 weak_ptr_factory_.GetWeakPtr(),
-                 callback));
+  if (sync_token.HasData() &&
+      (sync_token.verified_flush() ||
+       gpu_control_->CanWaitUnverifiedSyncToken(&sync_token))) {
+
+    gpu::SyncToken intermediate_sync_token = sync_token;
+
+    // Mark the intermediate sync token as verified if we can wait on
+    // unverified sync tokens.
+    intermediate_sync_token.SetVerifyFlush();
+
+    gpu_control_->SignalSyncToken(
+        intermediate_sync_token,
+        base::Bind(&GLES2Implementation::RunIfContextNotLost,
+                   weak_ptr_factory_.GetWeakPtr(),
+                   callback));
+  } else {
+    // Invalid sync token, just call the callback immediately.
+    callback.Run();
+  }
 }
 
 void GLES2Implementation::SignalQuery(uint32 query,
diff --git a/gpu/command_buffer/client/gles2_implementation_unittest_autogen.h b/gpu/command_buffer/client/gles2_implementation_unittest_autogen.h
index c587367..2788e4f1 100644
--- a/gpu/command_buffer/client/gles2_implementation_unittest_autogen.h
+++ b/gpu/command_buffer/client/gles2_implementation_unittest_autogen.h
@@ -1357,9 +1357,9 @@
     cmds::LineWidth cmd;
   };
   Cmds expected;
-  expected.cmd.Init(0.5f);
+  expected.cmd.Init(2.0f);
 
-  gl_->LineWidth(0.5f);
+  gl_->LineWidth(2.0f);
   EXPECT_EQ(0, memcmp(&expected, commands_, sizeof(expected)));
 }
 
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder.cc b/gpu/command_buffer/service/gles2_cmd_decoder.cc
index 0b957479..3c5aa83 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder.cc
+++ b/gpu/command_buffer/service/gles2_cmd_decoder.cc
@@ -1753,6 +1753,8 @@
   bool DoIsVertexArrayOES(GLuint client_id);
   bool DoIsPathCHROMIUM(GLuint client_id);
 
+  void DoLineWidth(GLfloat width);
+
   // Wrapper for glLinkProgram
   void DoLinkProgram(GLuint program);
 
@@ -2291,6 +2293,8 @@
 
   bool force_shader_name_hashing_for_test;
 
+  GLfloat line_width_range_[2];
+
   DISALLOW_COPY_AND_ASSIGN(GLES2DecoderImpl);
 };
 
@@ -3165,6 +3169,8 @@
   viewport_max_width_ = viewport_params[0];
   viewport_max_height_ = viewport_params[1];
 
+  glGetFloatv(GL_ALIASED_LINE_WIDTH_RANGE, line_width_range_);
+
   state_.scissor_width = state_.viewport_width;
   state_.scissor_height = state_.viewport_height;
 
@@ -6841,6 +6847,11 @@
   }
 }
 
+void GLES2DecoderImpl::DoLineWidth(GLfloat width) {
+  glLineWidth(
+      std::min(std::max(width, line_width_range_[0]), line_width_range_[1]));
+}
+
 void GLES2DecoderImpl::DoLinkProgram(GLuint program_id) {
   TRACE_EVENT0("gpu", "GLES2DecoderImpl::DoLinkProgram");
   SCOPED_UMA_HISTOGRAM_TIMER("GPU.DoLinkProgramTime");
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder_autogen.h b/gpu/command_buffer/service/gles2_cmd_decoder_autogen.h
index de3b3443..4fb5ca33 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder_autogen.h
+++ b/gpu/command_buffer/service/gles2_cmd_decoder_autogen.h
@@ -2354,7 +2354,7 @@
   }
   if (state_.line_width != width) {
     state_.line_width = width;
-    glLineWidth(width);
+    DoLineWidth(width);
   }
   return error::kNoError;
 }
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder_unittest_2_autogen.h b/gpu/command_buffer/service/gles2_cmd_decoder_unittest_2_autogen.h
index 1ba9700..26abd1f 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder_unittest_2_autogen.h
+++ b/gpu/command_buffer/service/gles2_cmd_decoder_unittest_2_autogen.h
@@ -694,10 +694,10 @@
 }
 
 TEST_P(GLES2DecoderTest2, LineWidthValidArgs) {
-  EXPECT_CALL(*gl_, LineWidth(0.5f));
+  EXPECT_CALL(*gl_, LineWidth(2.0f));
   SpecializedSetup<cmds::LineWidth, 0>(true);
   cmds::LineWidth cmd;
-  cmd.Init(0.5f);
+  cmd.Init(2.0f);
   EXPECT_EQ(error::kNoError, ExecuteCmd(cmd));
   EXPECT_EQ(GL_NO_ERROR, GetGLError());
 }
diff --git a/gpu/command_buffer/service/gles2_cmd_decoder_unittest_base.cc b/gpu/command_buffer/service/gles2_cmd_decoder_unittest_base.cc
index 579688c..64a27582d 100644
--- a/gpu/command_buffer/service/gles2_cmd_decoder_unittest_base.cc
+++ b/gpu/command_buffer/service/gles2_cmd_decoder_unittest_base.cc
@@ -349,6 +349,12 @@
   EXPECT_CALL(*gl_, GetIntegerv(GL_MAX_VIEWPORT_DIMS, _))
       .WillOnce(SetArrayArgument<1>(
           max_viewport_dims, max_viewport_dims + arraysize(max_viewport_dims)))
+        .RetiresOnSaturation();
+
+  static GLfloat line_width_range[] = { 1.0f, 2.0f };
+  EXPECT_CALL(*gl_, GetFloatv(GL_ALIASED_LINE_WIDTH_RANGE, _))
+      .WillOnce(SetArrayArgument<1>(
+          line_width_range, line_width_range + arraysize(line_width_range)))
       .RetiresOnSaturation();
 
   SetupInitCapabilitiesExpectations(group_->feature_info()->IsES3Capable());
diff --git a/gpu/command_buffer/service/in_process_command_buffer.cc b/gpu/command_buffer/service/in_process_command_buffer.cc
index 7cb6179..49d7f19 100644
--- a/gpu/command_buffer/service/in_process_command_buffer.cc
+++ b/gpu/command_buffer/service/in_process_command_buffer.cc
@@ -927,6 +927,24 @@
   return true;
 }
 
+void InProcessCommandBuffer::SignalSyncTokenOnGpuThread(
+    const SyncToken& sync_token, const base::Closure& callback) {
+  gpu::SyncPointManager* sync_point_manager = service_->sync_point_manager();
+  DCHECK(sync_point_manager);
+
+  scoped_refptr<gpu::SyncPointClientState> release_state =
+      sync_point_manager->GetSyncPointClientState(
+          sync_token.namespace_id(), sync_token.command_buffer_id());
+
+  if (!release_state) {
+    callback.Run();
+    return;
+  }
+
+  sync_point_client_->Wait(release_state.get(), sync_token.release_count(),
+                           WrapCallback(callback));
+}
+
 void InProcessCommandBuffer::SignalQuery(unsigned query_id,
                                          const base::Closure& callback) {
   CheckSequencedThread();
@@ -986,20 +1004,11 @@
 
 void InProcessCommandBuffer::SignalSyncToken(const SyncToken& sync_token,
                                              const base::Closure& callback) {
-  gpu::SyncPointManager* sync_point_manager = service_->sync_point_manager();
-  DCHECK(sync_point_manager);
-
-  scoped_refptr<gpu::SyncPointClientState> release_state =
-      sync_point_manager->GetSyncPointClientState(
-          sync_token.namespace_id(), sync_token.command_buffer_id());
-
-  if (!release_state) {
-    callback.Run();
-    return;
-  }
-
-  sync_point_client_->Wait(release_state.get(), sync_token.release_count(),
-                           WrapCallback(callback));
+  CheckSequencedThread();
+  QueueTask(base::Bind(&InProcessCommandBuffer::SignalSyncTokenOnGpuThread,
+                       base::Unretained(this),
+                       sync_token,
+                       WrapCallback(callback)));
 }
 
 bool InProcessCommandBuffer::CanWaitUnverifiedSyncToken(
diff --git a/gpu/command_buffer/service/in_process_command_buffer.h b/gpu/command_buffer/service/in_process_command_buffer.h
index abd6e7a6..b6586199 100644
--- a/gpu/command_buffer/service/in_process_command_buffer.h
+++ b/gpu/command_buffer/service/in_process_command_buffer.h
@@ -224,6 +224,8 @@
   bool WaitFenceSyncOnGpuThread(gpu::CommandBufferNamespace namespace_id,
                                 uint64_t command_buffer_id,
                                 uint64_t release);
+  void SignalSyncTokenOnGpuThread(const SyncToken& sync_token,
+                                  const base::Closure& callback);
   void SignalQueryOnGpuThread(unsigned query_id, const base::Closure& callback);
   void DestroyTransferBufferOnGpuThread(int32 id);
   void CreateImageOnGpuThread(int32 id,
diff --git a/ios/net/cookies/cookie_store_ios_unittest.mm b/ios/net/cookies/cookie_store_ios_unittest.mm
index 7db6f40..66d5ba5b 100644
--- a/ios/net/cookies/cookie_store_ios_unittest.mm
+++ b/ios/net/cookies/cookie_store_ios_unittest.mm
@@ -42,7 +42,6 @@
   static const bool filters_schemes = false;
   static const bool has_path_prefix_bug = true;
   static const int creation_time_granularity_in_ms = 1000;
-  static const int enforces_prefixes = true;
 
   base::MessageLoop loop_;
 };
diff --git a/ios/web/web_state/ui/crw_web_controller.mm b/ios/web/web_state/ui/crw_web_controller.mm
index f599f35..aeb4c32 100644
--- a/ios/web/web_state/ui/crw_web_controller.mm
+++ b/ios/web/web_state/ui/crw_web_controller.mm
@@ -654,7 +654,9 @@
 - (void)showTransientContentView:(CRWContentView*)contentView {
   DCHECK(contentView);
   DCHECK(contentView.scrollView);
-  DCHECK([contentView.scrollView isDescendantOfView:contentView]);
+  // TODO(crbug.com/556848) Reenable DCHECK when |CRWWebControllerContainerView|
+  // is restructured so that subviews are not added during |layoutSubviews|.
+  // DCHECK([contentView.scrollView isDescendantOfView:contentView]);
   [self.containerView displayTransientContent:contentView];
 }
 
@@ -1796,19 +1798,24 @@
 - (void)finishHistoryNavigationFromEntry:(CRWSessionEntry*)fromEntry {
   [_delegate webWillFinishHistoryNavigationFromEntry:fromEntry];
 
-  // If the current entry has a serialized state object, inject its state into
-  // the web view.
-  web::NavigationItemImpl* currentItem =
-      self.currentSessionEntry.navigationItemImpl;
-  [self setPushedOrReplacedURL:currentItem->GetURL()
-                   stateObject:currentItem->GetSerializedStateObject()];
   // Only load the new URL if the current entry was not created by a JavaScript
   // window.history.pushState() call from |fromEntry|.
-  if (![_webStateImpl->GetNavigationManagerImpl().GetSessionController()
+  BOOL shouldLoadURL =
+      ![_webStateImpl->GetNavigationManagerImpl().GetSessionController()
           isPushStateNavigationBetweenEntry:fromEntry
-                                   andEntry:self.currentSessionEntry]) {
-    web::NavigationItem* currentItem =
-        _webStateImpl->GetNavigationManagerImpl().GetVisibleItem();
+                                   andEntry:self.currentSessionEntry];
+  // Set the serialized state if necessary.  State must be set if:
+  // - the transition between |fromEntry| and the current session entry is a
+  //   history.pushState, or
+  // - the current session entry has a serialized state object (occurs after a
+  //   history.replaceState).
+  web::NavigationItemImpl* currentItem =
+      self.currentSessionEntry.navigationItemImpl;
+  NSString* stateObject = currentItem->GetSerializedStateObject();
+  if (!shouldLoadURL || stateObject.length) {
+    [self setPushedOrReplacedURL:currentItem->GetURL() stateObject:stateObject];
+  }
+  if (shouldLoadURL) {
     GURL endURL = [self URLForHistoryNavigationFromItem:fromEntry.navigationItem
                                                  toItem:currentItem];
     ui::PageTransition transition = ui::PageTransitionFromInt(
diff --git a/ios/web/web_state/ui/crw_web_view_content_view.mm b/ios/web/web_state/ui/crw_web_view_content_view.mm
index d7b96010..cb13d34 100644
--- a/ios/web/web_state/ui/crw_web_view_content_view.mm
+++ b/ios/web/web_state/ui/crw_web_view_content_view.mm
@@ -7,6 +7,17 @@
 #include "base/logging.h"
 #include "base/mac/scoped_nsobject.h"
 
+namespace {
+
+// Background color RGB values for the content view which is displayed when the
+// |_webView| is offset from the screen due to user interaction. Displaying this
+// background color is handled by UIWebView but not WKWebView, so it needs to be
+// set in CRWWebViewContentView to support both. The color value matches that
+// used by UIWebView.
+const CGFloat kBackgroundRGBComponents[] = {0.75f, 0.74f, 0.76f};
+
+}  // namespace
+
 @interface CRWWebViewContentView () {
   // The web view being shown.
   base::scoped_nsobject<UIView> _webView;
@@ -27,7 +38,6 @@
     DCHECK([scrollView isDescendantOfView:webView]);
     _webView.reset([webView retain]);
     _scrollView.reset([scrollView retain]);
-    [self addSubview:_webView];
   }
   return self;
 }
@@ -50,6 +60,11 @@
   [super willMoveToSuperview:newSuperview];
   self.autoresizingMask =
       UIViewAutoresizingFlexibleWidth | UIViewAutoresizingFlexibleHeight;
+  [self addSubview:_webView];
+  self.backgroundColor = [UIColor colorWithRed:kBackgroundRGBComponents[0]
+                                         green:kBackgroundRGBComponents[1]
+                                          blue:kBackgroundRGBComponents[2]
+                                         alpha:1.0];
 }
 
 #pragma mark Accessors
diff --git a/ios/web/web_state/web_state_impl.mm b/ios/web/web_state/web_state_impl.mm
index 0a921e9..b307315 100644
--- a/ios/web/web_state/web_state_impl.mm
+++ b/ios/web/web_state/web_state_impl.mm
@@ -294,7 +294,6 @@
   DCHECK(Configured());
   DCHECK(content_view);
   DCHECK(content_view.scrollView);
-  DCHECK([content_view.scrollView isDescendantOfView:content_view]);
   [web_controller_ showTransientContentView:content_view];
 }
 
diff --git a/mandoline/services/core_services/BUILD.gn b/mandoline/services/core_services/BUILD.gn
index 642fe6d..90cfed5 100644
--- a/mandoline/services/core_services/BUILD.gn
+++ b/mandoline/services/core_services/BUILD.gn
@@ -47,7 +47,6 @@
     "//mojo/message_pump",
     "//mojo/public/cpp/bindings",
     "//mojo/services/tracing:lib",
-    "//mojo/services/tracing/public/cpp",
     "//third_party/icu",
     "//url",
   ]
diff --git a/mandoline/services/core_services/core_services_application_delegate.cc b/mandoline/services/core_services/core_services_application_delegate.cc
index 093beac..7a22c7b 100644
--- a/mandoline/services/core_services/core_services_application_delegate.cc
+++ b/mandoline/services/core_services/core_services_application_delegate.cc
@@ -17,7 +17,6 @@
 #include "mojo/application/public/cpp/application_runner.h"
 #include "mojo/logging/init_logging.h"
 #include "mojo/message_pump/message_pump_mojo.h"
-#include "mojo/services/tracing/public/cpp/tracing_impl.h"
 #include "mojo/services/tracing/tracing_app.h"
 #include "url/gurl.h"
 
@@ -99,7 +98,6 @@
 void CoreServicesApplicationDelegate::Initialize(mojo::ApplicationImpl* app) {
   base::PlatformThread::SetName("CoreServicesDispatcher");
   mojo::logging::InitLogging();
-  tracing_.Initialize(app);
 }
 
 bool CoreServicesApplicationDelegate::ConfigureIncomingConnection(
diff --git a/mandoline/services/core_services/core_services_application_delegate.h b/mandoline/services/core_services/core_services_application_delegate.h
index 168f068..03ee9d9d6 100644
--- a/mandoline/services/core_services/core_services_application_delegate.h
+++ b/mandoline/services/core_services/core_services_application_delegate.h
@@ -13,7 +13,6 @@
 #include "mojo/application/public/cpp/interface_factory_impl.h"
 #include "mojo/application/public/interfaces/content_handler.mojom.h"
 #include "mojo/common/weak_binding_set.h"
-#include "mojo/services/tracing/public/cpp/tracing_impl.h"
 
 namespace core_services {
 
@@ -52,7 +51,6 @@
   mojo::WeakBindingSet<ContentHandler> handler_bindings_;
 
   ScopedVector<ApplicationThread> application_threads_;
-  mojo::TracingImpl tracing_;
 
   base::WeakPtrFactory<CoreServicesApplicationDelegate> weak_factory_;
 
diff --git a/mandoline/ui/desktop_ui/BUILD.gn b/mandoline/ui/desktop_ui/BUILD.gn
index e84c565..12b8b76 100644
--- a/mandoline/ui/desktop_ui/BUILD.gn
+++ b/mandoline/ui/desktop_ui/BUILD.gn
@@ -43,7 +43,6 @@
     "//mojo/common:common_base",
     "//mojo/converters/geometry",
     "//mojo/public/cpp/bindings",
-    "//mojo/services/tracing/public/cpp",
     "//mojo/services/tracing/public/interfaces",
     "//skia",
     "//ui/gfx",
diff --git a/mandoline/ui/desktop_ui/browser_window.cc b/mandoline/ui/desktop_ui/browser_window.cc
index c049cf2..067bfb6 100644
--- a/mandoline/ui/desktop_ui/browser_window.cc
+++ b/mandoline/ui/desktop_ui/browser_window.cc
@@ -17,9 +17,9 @@
 #include "mandoline/ui/desktop_ui/find_bar_view.h"
 #include "mandoline/ui/desktop_ui/public/interfaces/omnibox.mojom.h"
 #include "mandoline/ui/desktop_ui/toolbar_view.h"
+#include "mojo/application/public/cpp/switches.h"
 #include "mojo/common/common_type_converters.h"
 #include "mojo/converters/geometry/geometry_type_converters.h"
-#include "mojo/services/tracing/public/cpp/switches.h"
 #include "mojo/services/tracing/public/interfaces/tracing.mojom.h"
 #include "ui/gfx/canvas.h"
 #include "ui/mojo/init/ui_init.h"
@@ -241,7 +241,7 @@
   static bool recorded_browser_startup_metrics = false;
   if (!recorded_browser_startup_metrics &&
       base::CommandLine::ForCurrentProcess()->HasSwitch(
-          tracing::kEnableStatsCollectionBindings)) {
+          mojo::kEnableStatsCollectionBindings)) {
     mojo::URLRequestPtr request(mojo::URLRequest::New());
     request->url = mojo::String::From("mojo:tracing");
     tracing::StartupPerformanceDataCollectorPtr collector;
diff --git a/mash/DEPS b/mash/DEPS
new file mode 100644
index 0000000..90cdc28
--- /dev/null
+++ b/mash/DEPS
@@ -0,0 +1,14 @@
+include_rules = [
+  "+components/mus/common/types.h",
+  "+components/mus/common/util.h",
+  "+components/mus/public",
+  "+mojo/application",
+  "+mojo/common",
+  "+mojo/converters",
+  "+mojo/public",
+  "+mojo/services/network/public",
+  "+mojo/services/tracing/public",
+  "+third_party/mojo_services",
+  "+third_party/skia/include",
+  "+ui",
+]
diff --git a/mash/OWNERS b/mash/OWNERS
new file mode 100644
index 0000000..e6a7642f
--- /dev/null
+++ b/mash/OWNERS
@@ -0,0 +1,4 @@
+ben@chromium.org
+erg@chromium.org
+msw@chromium.org
+sky@chromium.org
diff --git a/components/mus/example/wm/BUILD.gn b/mash/wm/BUILD.gn
similarity index 97%
rename from components/mus/example/wm/BUILD.gn
rename to mash/wm/BUILD.gn
index 79f0b9a..f26c2f4 100644
--- a/components/mus/example/wm/BUILD.gn
+++ b/mash/wm/BUILD.gn
@@ -40,10 +40,10 @@
 
   deps = [
     "//base",
-    "//components/mus/example/wm/public/interfaces",
     "//components/mus/common",
     "//components/mus/public/cpp",
     "//components/mus/public/interfaces",
+    "//mash/wm/public/interfaces",
     "//mojo/application/public/cpp",
     "//mojo/common:common_base",
     "//mojo/converters/geometry",
diff --git a/components/mus/example/wm/background_layout.cc b/mash/wm/background_layout.cc
similarity index 90%
rename from components/mus/example/wm/background_layout.cc
rename to mash/wm/background_layout.cc
index affa89c9..3e7a586 100644
--- a/components/mus/example/wm/background_layout.cc
+++ b/mash/wm/background_layout.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "components/mus/example/wm/background_layout.h"
+#include "mash/wm/background_layout.h"
 
 #include "components/mus/public/cpp/window.h"
 
diff --git a/components/mus/example/wm/background_layout.h b/mash/wm/background_layout.h
similarity index 72%
rename from components/mus/example/wm/background_layout.h
rename to mash/wm/background_layout.h
index 05a41b9b..bada5367 100644
--- a/components/mus/example/wm/background_layout.h
+++ b/mash/wm/background_layout.h
@@ -2,11 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef COMPONENTS_MUS_EXAMPLE_WM_BACKGROUND_LAYOUT_H_
-#define COMPONENTS_MUS_EXAMPLE_WM_BACKGROUND_LAYOUT_H_
+#ifndef MASH_WM_BACKGROUND_LAYOUT_H_
+#define MASH_WM_BACKGROUND_LAYOUT_H_
 
 #include "base/macros.h"
-#include "components/mus/example/wm/layout_manager.h"
+#include "mash/wm/layout_manager.h"
 
 // Lays out the desktop background within background containers.
 class BackgroundLayout : public LayoutManager {
@@ -22,4 +22,4 @@
   DISALLOW_COPY_AND_ASSIGN(BackgroundLayout);
 };
 
-#endif  // COMPONENTS_MUS_EXAMPLE_WM_BACKGROUND_LAYOUT_H_
+#endif  // MASH_WM_BACKGROUND_LAYOUT_H_
diff --git a/components/mus/example/wm/layout_manager.cc b/mash/wm/layout_manager.cc
similarity index 97%
rename from components/mus/example/wm/layout_manager.cc
rename to mash/wm/layout_manager.cc
index 9ac35a9..40b3bf5 100644
--- a/components/mus/example/wm/layout_manager.cc
+++ b/mash/wm/layout_manager.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "components/mus/example/wm/layout_manager.h"
+#include "mash/wm/layout_manager.h"
 
 #include "components/mus/public/cpp/property_type_converters.h"
 #include "components/mus/public/cpp/window.h"
diff --git a/components/mus/example/wm/layout_manager.h b/mash/wm/layout_manager.h
similarity index 90%
rename from components/mus/example/wm/layout_manager.h
rename to mash/wm/layout_manager.h
index 8f8c2ad..f29d5c0 100644
--- a/components/mus/example/wm/layout_manager.h
+++ b/mash/wm/layout_manager.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef COMPONENTS_MUS_EXAMPLE_WM_LAYOUT_MANAGER_H_
-#define COMPONENTS_MUS_EXAMPLE_WM_LAYOUT_MANAGER_H_
+#ifndef MASH_WM_LAYOUT_MANAGER_H_
+#define MASH_WM_LAYOUT_MANAGER_H_
 
 #include "base/macros.h"
 #include "components/mus/public/cpp/window_observer.h"
@@ -50,4 +50,4 @@
   DISALLOW_COPY_AND_ASSIGN(LayoutManager);
 };
 
-#endif  // COMPONENTS_MUS_EXAMPLE_WM_LAYOUT_MANAGER_H_
+#endif  // MASH_WM_LAYOUT_MANAGER_H_
diff --git a/components/mus/example/wm/main.cc b/mash/wm/main.cc
similarity index 85%
rename from components/mus/example/wm/main.cc
rename to mash/wm/main.cc
index c9ed845..578d8be 100644
--- a/components/mus/example/wm/main.cc
+++ b/mash/wm/main.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "components/mus/example/wm/window_manager_application.h"
+#include "mash/wm/window_manager_application.h"
 #include "mojo/application/public/cpp/application_runner.h"
 #include "mojo/public/c/system/main.h"
 
diff --git a/components/mus/example/wm/move_loop.cc b/mash/wm/move_loop.cc
similarity index 98%
rename from components/mus/example/wm/move_loop.cc
rename to mash/wm/move_loop.cc
index 926855e9..6c3ee7d 100644
--- a/components/mus/example/wm/move_loop.cc
+++ b/mash/wm/move_loop.cc
@@ -2,12 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "components/mus/example/wm/move_loop.h"
+#include "mash/wm/move_loop.h"
 
 #include "base/auto_reset.h"
-#include "components/mus/example/wm/property_util.h"
 #include "components/mus/public/cpp/window.h"
 #include "components/mus/public/interfaces/input_event_constants.mojom.h"
+#include "mash/wm/property_util.h"
 #include "ui/gfx/geometry/point_conversions.h"
 #include "ui/gfx/geometry/rect.h"
 
diff --git a/components/mus/example/wm/move_loop.h b/mash/wm/move_loop.h
similarity index 95%
rename from components/mus/example/wm/move_loop.h
rename to mash/wm/move_loop.h
index c6fc5c57..fd1a3e7 100644
--- a/components/mus/example/wm/move_loop.h
+++ b/mash/wm/move_loop.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef COMPONENTS_MUS_EXAMPLE_WM_MOVE_LOOP_H_
-#define COMPONENTS_MUS_EXAMPLE_WM_MOVE_LOOP_H_
+#ifndef MASH_WM_MOVE_LOOP_H_
+#define MASH_WM_MOVE_LOOP_H_
 
 #include "base/macros.h"
 #include "base/memory/scoped_ptr.h"
@@ -112,4 +112,4 @@
   DISALLOW_COPY_AND_ASSIGN(MoveLoop);
 };
 
-#endif  // COMPONENTS_MUS_EXAMPLE_WM_MOVE_LOOP_H_
+#endif  // MASH_WM_MOVE_LOOP_H_
diff --git a/components/mus/example/wm/move_loop_unittest.cc b/mash/wm/move_loop_unittest.cc
similarity index 98%
rename from components/mus/example/wm/move_loop_unittest.cc
rename to mash/wm/move_loop_unittest.cc
index 13229a4..462c7df7 100644
--- a/components/mus/example/wm/move_loop_unittest.cc
+++ b/mash/wm/move_loop_unittest.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "components/mus/example/wm/move_loop.h"
+#include "mash/wm/move_loop.h"
 
 #include "components/mus/public/cpp/tests/test_window.h"
 #include "mojo/converters/input_events/input_events_type_converters.h"
diff --git a/components/mus/example/wm/non_client_frame_controller.cc b/mash/wm/non_client_frame_controller.cc
similarity index 93%
rename from components/mus/example/wm/non_client_frame_controller.cc
rename to mash/wm/non_client_frame_controller.cc
index 5a56739..b9a95ed 100644
--- a/components/mus/example/wm/non_client_frame_controller.cc
+++ b/mash/wm/non_client_frame_controller.cc
@@ -2,11 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "components/mus/example/wm/non_client_frame_controller.h"
+#include "mash/wm/non_client_frame_controller.h"
 
-#include "components/mus/example/wm/non_client_frame_view_impl.h"
-#include "components/mus/example/wm/property_util.h"
 #include "components/mus/public/cpp/window.h"
+#include "mash/wm/non_client_frame_view_impl.h"
+#include "mash/wm/property_util.h"
 #include "ui/views/mus/native_widget_mus.h"
 #include "ui/views/widget/widget.h"
 
diff --git a/components/mus/example/wm/non_client_frame_controller.h b/mash/wm/non_client_frame_controller.h
similarity index 87%
rename from components/mus/example/wm/non_client_frame_controller.h
rename to mash/wm/non_client_frame_controller.h
index 57373841..dfedd07 100644
--- a/components/mus/example/wm/non_client_frame_controller.h
+++ b/mash/wm/non_client_frame_controller.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef COMPONENTS_MUS_EXAMPLE_WM_NON_CLIENT_FRAME_CONTROLLER_H_
-#define COMPONENTS_MUS_EXAMPLE_WM_NON_CLIENT_FRAME_CONTROLLER_H_
+#ifndef MASH_WM_NON_CLIENT_FRAME_CONTROLLER_H_
+#define MASH_WM_NON_CLIENT_FRAME_CONTROLLER_H_
 
 #include "base/macros.h"
 #include "components/mus/public/cpp/window_observer.h"
@@ -50,4 +50,4 @@
   DISALLOW_COPY_AND_ASSIGN(NonClientFrameController);
 };
 
-#endif  // COMPONENTS_MUS_EXAMPLE_WM_NON_CLIENT_FRAME_CONTROLLER_H_
+#endif  // MASH_WM_NON_CLIENT_FRAME_CONTROLLER_H_
diff --git a/components/mus/example/wm/non_client_frame_view_impl.cc b/mash/wm/non_client_frame_view_impl.cc
similarity index 95%
rename from components/mus/example/wm/non_client_frame_view_impl.cc
rename to mash/wm/non_client_frame_view_impl.cc
index 32994aa..976143b3 100644
--- a/components/mus/example/wm/non_client_frame_view_impl.cc
+++ b/mash/wm/non_client_frame_view_impl.cc
@@ -2,10 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "components/mus/example/wm/non_client_frame_view_impl.h"
+#include "mash/wm/non_client_frame_view_impl.h"
 
-#include "components/mus/example/wm/move_loop.h"
 #include "components/mus/public/cpp/window.h"
+#include "mash/wm/move_loop.h"
 #include "mojo/converters/input_events/input_events_type_converters.h"
 #include "ui/compositor/paint_recorder.h"
 #include "ui/gfx/canvas.h"
diff --git a/components/mus/example/wm/non_client_frame_view_impl.h b/mash/wm/non_client_frame_view_impl.h
similarity index 88%
rename from components/mus/example/wm/non_client_frame_view_impl.h
rename to mash/wm/non_client_frame_view_impl.h
index dafa1a2..e7e3eef 100644
--- a/components/mus/example/wm/non_client_frame_view_impl.h
+++ b/mash/wm/non_client_frame_view_impl.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef COMPONENTS_MUS_EXAMPLE_WM_NON_CLIENT_FRAME_VIEW_IMPL_H_
-#define COMPONENTS_MUS_EXAMPLE_WM_NON_CLIENT_FRAME_VIEW_IMPL_H_
+#ifndef MASH_WM_NON_CLIENT_FRAME_VIEW_IMPL_H_
+#define MASH_WM_NON_CLIENT_FRAME_VIEW_IMPL_H_
 
 #include "base/macros.h"
 #include "base/memory/scoped_ptr.h"
@@ -46,4 +46,4 @@
   DISALLOW_COPY_AND_ASSIGN(NonClientFrameViewImpl);
 };
 
-#endif  // COMPONENTS_MUS_EXAMPLE_WM_NON_CLIENT_FRAME_VIEW_IMPL_H_
+#endif  // MASH_WM_NON_CLIENT_FRAME_VIEW_IMPL_H_
diff --git a/components/mus/example/wm/property_util.cc b/mash/wm/property_util.cc
similarity index 82%
rename from components/mus/example/wm/property_util.cc
rename to mash/wm/property_util.cc
index 73cfa056..2855826 100644
--- a/components/mus/example/wm/property_util.cc
+++ b/mash/wm/property_util.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "components/mus/example/wm/property_util.h"
+#include "mash/wm/property_util.h"
 
 #include "components/mus/public/cpp/property_type_converters.h"
 #include "components/mus/public/cpp/window.h"
@@ -12,7 +12,7 @@
 
 mus::mojom::ShowState GetWindowShowState(const mus::Window* window) {
   if (window->HasSharedProperty(
-      mus::mojom::WindowManager::kShowState_Property)) {
+          mus::mojom::WindowManager::kShowState_Property)) {
     return static_cast<mus::mojom::ShowState>(
         window->GetSharedProperty<int32_t>(
             mus::mojom::WindowManager::kShowState_Property));
@@ -32,7 +32,7 @@
 
 gfx::Rect GetWindowUserSetBounds(const mus::Window* window) {
   if (window->HasSharedProperty(
-      mus::mojom::WindowManager::kUserSetBounds_Property)) {
+          mus::mojom::WindowManager::kUserSetBounds_Property)) {
     return window->GetSharedProperty<gfx::Rect>(
         mus::mojom::WindowManager::kUserSetBounds_Property);
   }
@@ -46,20 +46,20 @@
 
 gfx::Size GetWindowPreferredSize(const mus::Window* window) {
   if (window->HasSharedProperty(
-      mus::mojom::WindowManager::kPreferredSize_Property)) {
+          mus::mojom::WindowManager::kPreferredSize_Property)) {
     return window->GetSharedProperty<gfx::Size>(
         mus::mojom::WindowManager::kPreferredSize_Property);
   }
   return gfx::Size();
 }
 
-ash::mojom::Container GetRequestedContainer(const mus::Window* window) {
-  if (window->HasSharedProperty(ash::mojom::kWindowContainer_Property)) {
-    return static_cast<ash::mojom::Container>(
+mash::wm::mojom::Container GetRequestedContainer(const mus::Window* window) {
+  if (window->HasSharedProperty(mash::wm::mojom::kWindowContainer_Property)) {
+    return static_cast<mash::wm::mojom::Container>(
         window->GetSharedProperty<int32_t>(
-            ash::mojom::kWindowContainer_Property));
+            mash::wm::mojom::kWindowContainer_Property));
   }
-  return ash::mojom::CONTAINER_USER_WINDOWS;
+  return mash::wm::mojom::CONTAINER_USER_WINDOWS;
 }
 
 mus::mojom::ResizeBehavior GetResizeBehavior(const mus::Window* window) {
diff --git a/components/mus/example/wm/property_util.h b/mash/wm/property_util.h
similarity index 77%
rename from components/mus/example/wm/property_util.h
rename to mash/wm/property_util.h
index a32fa83..452c8f8 100644
--- a/components/mus/example/wm/property_util.h
+++ b/mash/wm/property_util.h
@@ -2,12 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef COMPONENTS_MUS_EXAMPLE_WM_PROPERTY_UTIL_H_
-#define COMPONENTS_MUS_EXAMPLE_WM_PROPERTY_UTIL_H_
+#ifndef MASH_WM_PROPERTY_UTIL_H_
+#define MASH_WM_PROPERTY_UTIL_H_
 
-#include "components/mus/example/wm/public/interfaces/container.mojom.h"
 #include "components/mus/public/interfaces/window_manager.mojom.h"
 #include "components/mus/public/interfaces/window_manager_constants.mojom.h"
+#include "mash/wm/public/interfaces/container.mojom.h"
 
 namespace gfx {
 class Rect;
@@ -29,11 +29,11 @@
 void SetWindowPreferredSize(mus::Window* window, const gfx::Size& size);
 gfx::Size GetWindowPreferredSize(const mus::Window* window);
 
-ash::mojom::Container GetRequestedContainer(const mus::Window* window);
+mash::wm::mojom::Container GetRequestedContainer(const mus::Window* window);
 
 mus::mojom::ResizeBehavior GetResizeBehavior(const mus::Window* window);
 
 void SetRestoreBounds(mus::Window* window, const gfx::Rect& bounds);
 gfx::Rect GetRestoreBounds(const mus::Window* window);
 
-#endif  // COMPONENTS_MUS_EXAMPLE_WM_PROPERTY_UTIL_H_
+#endif  // MASH_WM_PROPERTY_UTIL_H_
diff --git a/components/mus/example/wm/public/interfaces/BUILD.gn b/mash/wm/public/interfaces/BUILD.gn
similarity index 100%
rename from components/mus/example/wm/public/interfaces/BUILD.gn
rename to mash/wm/public/interfaces/BUILD.gn
diff --git a/components/mus/example/wm/public/interfaces/container.mojom b/mash/wm/public/interfaces/container.mojom
similarity index 96%
rename from components/mus/example/wm/public/interfaces/container.mojom
rename to mash/wm/public/interfaces/container.mojom
index efb82b8..07807433 100644
--- a/components/mus/example/wm/public/interfaces/container.mojom
+++ b/mash/wm/public/interfaces/container.mojom
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-module ash.mojom;
+module mash.wm.mojom;
 
 enum Container {
   ALL_USER_BACKGROUND = 1,
diff --git a/components/mus/example/wm/shelf_layout.cc b/mash/wm/shelf_layout.cc
similarity index 85%
rename from components/mus/example/wm/shelf_layout.cc
rename to mash/wm/shelf_layout.cc
index 712fadf..c3d6a45 100644
--- a/components/mus/example/wm/shelf_layout.cc
+++ b/mash/wm/shelf_layout.cc
@@ -2,12 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "components/mus/example/wm/shelf_layout.h"
+#include "mash/wm/shelf_layout.h"
 
-#include "components/mus/example/wm/property_util.h"
 #include "components/mus/public/cpp/property_type_converters.h"
 #include "components/mus/public/cpp/window.h"
 #include "components/mus/public/cpp/window_property.h"
+#include "mash/wm/property_util.h"
 #include "ui/gfx/geometry/rect.h"
 
 ShelfLayout::ShelfLayout(mus::Window* owner) : LayoutManager(owner) {
@@ -16,7 +16,7 @@
 ShelfLayout::~ShelfLayout() {}
 
 void ShelfLayout::WindowAdded(mus::Window* window) {
-   DCHECK_EQ(owner()->children().size(), 1U);
+  DCHECK_EQ(owner()->children().size(), 1U);
 }
 
 void ShelfLayout::LayoutWindow(mus::Window* window) {
diff --git a/components/mus/example/wm/shelf_layout.h b/mash/wm/shelf_layout.h
similarity index 72%
rename from components/mus/example/wm/shelf_layout.h
rename to mash/wm/shelf_layout.h
index e7126bb..c6f6e78 100644
--- a/components/mus/example/wm/shelf_layout.h
+++ b/mash/wm/shelf_layout.h
@@ -2,11 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef COMPONENTS_MUS_EXAMPLE_WM_SHELF_LAYOUT_H_
-#define COMPONENTS_MUS_EXAMPLE_WM_SHELF_LAYOUT_H_
+#ifndef MASH_WM_SHELF_LAYOUT_H_
+#define MASH_WM_SHELF_LAYOUT_H_
 
 #include "base/macros.h"
-#include "components/mus/example/wm/layout_manager.h"
+#include "mash/wm/layout_manager.h"
 
 // Lays out the shelf within shelf containers.
 class ShelfLayout : public LayoutManager {
@@ -22,4 +22,4 @@
   DISALLOW_COPY_AND_ASSIGN(ShelfLayout);
 };
 
-#endif  // COMPONENTS_MUS_EXAMPLE_WM_SHELF_LAYOUT_H_
+#endif  // MASH_WM_SHELF_LAYOUT_H_
diff --git a/components/mus/example/wm/window_layout.cc b/mash/wm/window_layout.cc
similarity index 96%
rename from components/mus/example/wm/window_layout.cc
rename to mash/wm/window_layout.cc
index b7f337f..3ae271e 100644
--- a/components/mus/example/wm/window_layout.cc
+++ b/mash/wm/window_layout.cc
@@ -2,12 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "components/mus/example/wm/window_layout.h"
+#include "mash/wm/window_layout.h"
 
-#include "components/mus/example/wm/property_util.h"
 #include "components/mus/public/cpp/property_type_converters.h"
 #include "components/mus/public/cpp/window.h"
 #include "components/mus/public/cpp/window_property.h"
+#include "mash/wm/property_util.h"
 
 WindowLayout::WindowLayout(mus::Window* owner) : LayoutManager(owner) {
   AddLayoutProperty(mus::mojom::WindowManager::kPreferredSize_Property);
diff --git a/components/mus/example/wm/window_layout.h b/mash/wm/window_layout.h
similarity index 79%
rename from components/mus/example/wm/window_layout.h
rename to mash/wm/window_layout.h
index 2c29accf..013b3df 100644
--- a/components/mus/example/wm/window_layout.h
+++ b/mash/wm/window_layout.h
@@ -2,11 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef COMPONENTS_MUS_EXAMPLE_WM_WINDOW_LAYOUT_H_
-#define COMPONENTS_MUS_EXAMPLE_WM_WINDOW_LAYOUT_H_
+#ifndef MASH_WM_WINDOW_LAYOUT_H_
+#define MASH_WM_WINDOW_LAYOUT_H_
 
 #include "base/macros.h"
-#include "components/mus/example/wm/layout_manager.h"
+#include "mash/wm/layout_manager.h"
 
 // Responsible for layout of top level windows.
 class WindowLayout : public LayoutManager {
@@ -29,4 +29,4 @@
   DISALLOW_COPY_AND_ASSIGN(WindowLayout);
 };
 
-#endif  // COMPONENTS_MUS_EXAMPLE_WM_WINDOW_LAYOUT_H_
+#endif  // MASH_WM_WINDOW_LAYOUT_H_
diff --git a/components/mus/example/wm/window_manager_application.cc b/mash/wm/window_manager_application.cc
similarity index 84%
rename from components/mus/example/wm/window_manager_application.cc
rename to mash/wm/window_manager_application.cc
index b0782de9..388c55f 100644
--- a/components/mus/example/wm/window_manager_application.cc
+++ b/mash/wm/window_manager_application.cc
@@ -2,16 +2,16 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "components/mus/example/wm/window_manager_application.h"
+#include "mash/wm/window_manager_application.h"
 
 #include "components/mus/common/util.h"
-#include "components/mus/example/wm/background_layout.h"
-#include "components/mus/example/wm/shelf_layout.h"
-#include "components/mus/example/wm/window_layout.h"
-#include "components/mus/example/wm/window_manager_impl.h"
 #include "components/mus/public/cpp/window.h"
 #include "components/mus/public/cpp/window_tree_connection.h"
 #include "components/mus/public/cpp/window_tree_host_factory.h"
+#include "mash/wm/background_layout.h"
+#include "mash/wm/shelf_layout.h"
+#include "mash/wm/window_layout.h"
+#include "mash/wm/window_manager_impl.h"
 #include "mojo/application/public/cpp/application_connection.h"
 #include "ui/mojo/init/ui_init.h"
 #include "ui/views/mus/aura_init.h"
@@ -22,7 +22,7 @@
 WindowManagerApplication::~WindowManagerApplication() {}
 
 mus::Window* WindowManagerApplication::GetWindowForContainer(
-    ash::mojom::Container container) {
+    mash::wm::mojom::Container container) {
   const mus::Id window_id = root_->connection()->GetConnectionId() << 16 |
                             static_cast<uint16_t>(container);
   return root_->GetChildById(window_id);
@@ -52,11 +52,11 @@
   root_->AddObserver(this);
   CreateContainers();
   background_layout_.reset(new BackgroundLayout(
-      GetWindowForContainer(ash::mojom::CONTAINER_USER_BACKGROUND)));
+      GetWindowForContainer(mash::wm::mojom::CONTAINER_USER_BACKGROUND)));
   shelf_layout_.reset(new ShelfLayout(
-      GetWindowForContainer(ash::mojom::CONTAINER_USER_SHELF)));
+      GetWindowForContainer(mash::wm::mojom::CONTAINER_USER_SHELF)));
   window_layout_.reset(new WindowLayout(
-      GetWindowForContainer(ash::mojom::CONTAINER_USER_WINDOWS)));
+      GetWindowForContainer(mash::wm::mojom::CONTAINER_USER_WINDOWS)));
 
   window_manager_.reset(new WindowManagerImpl(this));
 
@@ -110,9 +110,9 @@
 }
 
 void WindowManagerApplication::CreateContainers() {
-  for (uint16_t container =
-           static_cast<uint16_t>(ash::mojom::CONTAINER_ALL_USER_BACKGROUND);
-       container < static_cast<uint16_t>(ash::mojom::CONTAINER_COUNT);
+  for (uint16_t container = static_cast<uint16_t>(
+           mash::wm::mojom::CONTAINER_ALL_USER_BACKGROUND);
+       container < static_cast<uint16_t>(mash::wm::mojom::CONTAINER_COUNT);
        ++container) {
     mus::Window* window = root_->connection()->NewWindow();
     DCHECK_EQ(mus::LoWord(window->id()), container)
diff --git a/components/mus/example/wm/window_manager_application.h b/mash/wm/window_manager_application.h
similarity index 90%
rename from components/mus/example/wm/window_manager_application.h
rename to mash/wm/window_manager_application.h
index fdcec92..39e04840 100644
--- a/components/mus/example/wm/window_manager_application.h
+++ b/mash/wm/window_manager_application.h
@@ -2,19 +2,19 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef COMPONENTS_MUS_EXAMPLE_WM_WINDOW_MANAGER_APPLICATION_H_
-#define COMPONENTS_MUS_EXAMPLE_WM_WINDOW_MANAGER_APPLICATION_H_
+#ifndef MASH_WM_WINDOW_MANAGER_APPLICATION_H_
+#define MASH_WM_WINDOW_MANAGER_APPLICATION_H_
 
 #include "base/macros.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/memory/scoped_vector.h"
 #include "components/mus/common/types.h"
-#include "components/mus/example/wm/public/interfaces/container.mojom.h"
 #include "components/mus/public/cpp/window_manager_delegate.h"
 #include "components/mus/public/cpp/window_observer.h"
 #include "components/mus/public/cpp/window_tree_delegate.h"
 #include "components/mus/public/interfaces/window_manager.mojom.h"
 #include "components/mus/public/interfaces/window_tree_host.mojom.h"
+#include "mash/wm/public/interfaces/container.mojom.h"
 #include "mojo/application/public/cpp/application_delegate.h"
 #include "mojo/application/public/cpp/interface_factory_impl.h"
 #include "mojo/common/weak_binding_set.h"
@@ -50,7 +50,7 @@
   int window_count() { return window_count_; }
   void IncrementWindowCount() { ++window_count_; }
 
-  mus::Window* GetWindowForContainer(ash::mojom::Container container);
+  mus::Window* GetWindowForContainer(mash::wm::mojom::Container container);
   mus::Window* GetWindowById(mus::Id id);
 
   mojo::ApplicationImpl* app() { return app_; }
@@ -106,4 +106,4 @@
   DISALLOW_COPY_AND_ASSIGN(WindowManagerApplication);
 };
 
-#endif  // COMPONENTS_MUS_EXAMPLE_WM_WINDOW_MANAGER_APPLICATION_H_
+#endif  // MASH_WM_WINDOW_MANAGER_APPLICATION_H_
diff --git a/components/mus/example/wm/window_manager_apptest.cc b/mash/wm/window_manager_apptest.cc
similarity index 100%
rename from components/mus/example/wm/window_manager_apptest.cc
rename to mash/wm/window_manager_apptest.cc
diff --git a/components/mus/example/wm/window_manager_impl.cc b/mash/wm/window_manager_impl.cc
similarity index 90%
rename from components/mus/example/wm/window_manager_impl.cc
rename to mash/wm/window_manager_impl.cc
index 3cf1e718..06b6f9aa 100644
--- a/components/mus/example/wm/window_manager_impl.cc
+++ b/mash/wm/window_manager_impl.cc
@@ -2,19 +2,19 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "components/mus/example/wm/window_manager_impl.h"
+#include "mash/wm/window_manager_impl.h"
 
 #include "components/mus/common/types.h"
-#include "components/mus/example/wm/move_loop.h"
-#include "components/mus/example/wm/non_client_frame_controller.h"
-#include "components/mus/example/wm/property_util.h"
-#include "components/mus/example/wm/public/interfaces/container.mojom.h"
-#include "components/mus/example/wm/window_manager_application.h"
 #include "components/mus/public/cpp/property_type_converters.h"
 #include "components/mus/public/cpp/window.h"
 #include "components/mus/public/cpp/window_property.h"
 #include "components/mus/public/cpp/window_tree_connection.h"
 #include "components/mus/public/interfaces/input_events.mojom.h"
+#include "mash/wm/move_loop.h"
+#include "mash/wm/non_client_frame_controller.h"
+#include "mash/wm/property_util.h"
+#include "mash/wm/public/interfaces/container.mojom.h"
+#include "mash/wm/window_manager_application.h"
 #include "mojo/application/public/cpp/application_impl.h"
 #include "mojo/converters/geometry/geometry_type_converters.h"
 
@@ -34,7 +34,7 @@
 
 WindowManagerImpl::~WindowManagerImpl() {
   mus::Window* parent =
-      state_->GetWindowForContainer(ash::mojom::CONTAINER_USER_WINDOWS);
+      state_->GetWindowForContainer(mash::wm::mojom::CONTAINER_USER_WINDOWS);
   if (!parent)
     return;
 
@@ -141,6 +141,6 @@
 }
 
 mus::Window* WindowManagerImpl::GetContainerForChild(mus::Window* child) {
-  ash::mojom::Container container = GetRequestedContainer(child);
+  mash::wm::mojom::Container container = GetRequestedContainer(child);
   return state_->GetWindowForContainer(container);
 }
diff --git a/components/mus/example/wm/window_manager_impl.h b/mash/wm/window_manager_impl.h
similarity index 89%
rename from components/mus/example/wm/window_manager_impl.h
rename to mash/wm/window_manager_impl.h
index 3a1b791..cbea071c 100644
--- a/components/mus/example/wm/window_manager_impl.h
+++ b/mash/wm/window_manager_impl.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef COMPONENTS_MUS_EXAMPLE_WM_WINDOW_MANAGER_IMPL_H_
-#define COMPONENTS_MUS_EXAMPLE_WM_WINDOW_MANAGER_IMPL_H_
+#ifndef MASH_WM_WINDOW_MANAGER_IMPL_H_
+#define MASH_WM_WINDOW_MANAGER_IMPL_H_
 
 #include "base/macros.h"
 #include "components/mus/common/types.h"
@@ -44,4 +44,4 @@
   DISALLOW_COPY_AND_ASSIGN(WindowManagerImpl);
 };
 
-#endif  // COMPONENTS_MUS_EXAMPLE_WM_WINDOW_MANAGER_IMPL_H_
+#endif  // MASH_WM_WINDOW_MANAGER_IMPL_H_
diff --git a/media/BUILD.gn b/media/BUILD.gn
index b5e2e403..cf872b5 100644
--- a/media/BUILD.gn
+++ b/media/BUILD.gn
@@ -664,7 +664,7 @@
     "test/data/",
   ]
 
-  # TODO(wolenetz): Fix size_t to int trunctaion in win64.
+  # TODO(wolenetz): Fix size_t to int truncation in win64.
   # See http://crbug.com/171009
   configs += [ "//build/config/compiler:no_size_t_to_int_warning" ]
 
@@ -701,6 +701,12 @@
     ]
   }
 
+  # If ExternalClearKey is built, we can test CdmAdapter.
+  if (enable_pepper_cdms) {
+    sources += [ "cdm/cdm_adapter_unittest.cc" ]
+    deps += [ "//media/cdm/ppapi:clearkeycdm" ]
+  }
+
   if (media_use_ffmpeg) {
     sources += [
       "ffmpeg/ffmpeg_common_unittest.cc",
diff --git a/media/audio/cras/audio_manager_cras.cc b/media/audio/cras/audio_manager_cras.cc
index 890dc56b..e872ada 100644
--- a/media/audio/cras/audio_manager_cras.cc
+++ b/media/audio/cras/audio_manager_cras.cc
@@ -13,7 +13,6 @@
 #include "base/metrics/histogram.h"
 #include "base/nix/xdg_util.h"
 #include "base/stl_util.h"
-#include "base/sys_info.h"
 #include "chromeos/audio/audio_device.h"
 #include "chromeos/audio/cras_audio_handler.h"
 #include "media/audio/cras/cras_input.h"
@@ -59,12 +58,8 @@
 }
 
 bool IsBeamformingDefaultEnabled() {
-  if (base::FieldTrialList::FindFullName("ChromebookBeamforming") ==
-      "Enabled") {
-    return true;
-  }
-  const std::string& board = base::SysInfo::GetLsbReleaseBoard();
-  return board.find("buddy") != std::string::npos;
+  return base::FieldTrialList::FindFullName("ChromebookBeamforming") ==
+         "Enabled";
 }
 
 void AddDefaultDevice(AudioDeviceNames* device_names) {
diff --git a/media/base/android/media_drm_bridge.cc b/media/base/android/media_drm_bridge.cc
index fee16c7..f3ffc0f 100644
--- a/media/base/android/media_drm_bridge.cc
+++ b/media/base/android/media_drm_bridge.cc
@@ -529,6 +529,7 @@
   media_crypto_ready_cb_ = media_crypto_ready_cb;
 }
 
+//------------------------------------------------------------------------------
 // The following OnXxx functions are called from Java. The implementation must
 // only do minimal work and then post tasks to avoid reentrancy issues.
 
@@ -672,9 +673,10 @@
                                                jbyteArray j_session_id,
                                                jlong expiry_time_ms) {
   DVLOG(2) << __FUNCTION__ << ": " << expiry_time_ms << " ms";
-  session_expiration_update_cb_.Run(
-      AsString(env, j_session_id),
-      base::Time::FromDoubleT(expiry_time_ms / 1000.0));
+  task_runner_->PostTask(
+      FROM_HERE,
+      base::Bind(session_expiration_update_cb_, AsString(env, j_session_id),
+                 base::Time::FromDoubleT(expiry_time_ms / 1000.0)));
 }
 
 void MediaDrmBridge::OnLegacySessionError(JNIEnv* env,
@@ -701,6 +703,7 @@
       base::Bind(base::ResetAndReturn(&reset_credentials_cb_), success));
 }
 
+//------------------------------------------------------------------------------
 // The following are private methods.
 
 MediaDrmBridge::MediaDrmBridge(
diff --git a/media/base/mime_util.cc b/media/base/mime_util.cc
index 3679539..73cddfd 100644
--- a/media/base/mime_util.cc
+++ b/media/base/mime_util.cc
@@ -298,6 +298,9 @@
     {"audio/x-m4a", kMP4AudioCodecsExpression},
     {"video/mp4", kMP4VideoCodecsExpression},
     {"video/x-m4v", kMP4VideoCodecsExpression},
+#if defined(ENABLE_MPEG2TS_STREAM_PARSER)
+    {"video/mp2t", kMP4VideoCodecsExpression},
+#endif
     {"application/x-mpegurl", kMP4VideoCodecsExpression},
     {"application/vnd.apple.mpegurl", kMP4VideoCodecsExpression}};
 
@@ -343,6 +346,55 @@
     // avc1/avc3.XXXXXX may be ambiguous; handled by ParseH264CodecID().
 };
 
+#if defined(ENABLE_MPEG2TS_STREAM_PARSER)
+static const char kHexString[] = "0123456789ABCDEF";
+static char IntToHex(int i) {
+  DCHECK_GE(i, 0) << i << " not a hex value";
+  DCHECK_LE(i, 15) << i << " not a hex value";
+  return kHexString[i];
+}
+
+std::string TranslateLegacyAvc1CodecIds(const std::string& codec_id) {
+  // Special handling for old, pre-RFC 6381 format avc1 strings, which are still
+  // being used by some HLS apps to preserve backward compatibility with older
+  // iOS devices. The old format was avc1.<profile>.<level>
+  // Where <profile> is H.264 profile_idc encoded as a decimal number, i.e.
+  // 66 is baseline profile (0x42)
+  // 77 is main profile (0x4d)
+  // 100 is high profile (0x64)
+  // And <level> is H.264 level multiplied by 10, also encoded as decimal number
+  // E.g. <level> 31 corresponds to H.264 level 3.1
+  // See, for example, http://qtdevseed.apple.com/qadrift/testcases/tc-0133.php
+  uint32 level_start = 0;
+  std::string result;
+  if (base::StartsWith(codec_id, "avc1.66.", base::CompareCase::SENSITIVE)) {
+    level_start = 8;
+    result = "avc1.4200";
+  } else if (base::StartsWith(codec_id, "avc1.77.",
+                              base::CompareCase::SENSITIVE)) {
+    level_start = 8;
+    result = "avc1.4D00";
+  } else if (base::StartsWith(codec_id, "avc1.100.",
+                              base::CompareCase::SENSITIVE)) {
+    level_start = 9;
+    result = "avc1.6400";
+  }
+
+  uint32 level = 0;
+  if (level_start > 0 &&
+      base::StringToUint(codec_id.substr(level_start), &level) && level < 256) {
+    // This is a valid legacy avc1 codec id - return the codec id translated
+    // into RFC 6381 format.
+    result.push_back(IntToHex(level >> 4));
+    result.push_back(IntToHex(level & 0xf));
+    return result;
+  }
+
+  // This is not a valid legacy avc1 codec id - return the original codec id.
+  return codec_id;
+}
+#endif
+
 MimeUtil::MimeUtil() : allow_proprietary_codecs_(false) {
   InitializeMimeTypeMaps();
 }
@@ -489,6 +541,16 @@
     return IsCodecSupported(default_codec) ? IsSupported : IsNotSupported;
   }
 
+#if defined(ENABLE_MPEG2TS_STREAM_PARSER)
+  if (mime_type_lower_case == "video/mp2t") {
+    std::vector<std::string> codecs_to_check;
+    for (const auto& codec_id : codecs) {
+      codecs_to_check.push_back(TranslateLegacyAvc1CodecIds(codec_id));
+    }
+    return AreSupportedCodecs(it_strict_map->second, codecs_to_check);
+  }
+#endif
+
   return AreSupportedCodecs(it_strict_map->second, codecs);
 }
 
@@ -559,7 +621,7 @@
   }
 
   // Validate level.
-  *is_ambiguous = !IsValidH264Level(base::ToUpperASCII(codec_id.substr(9)));
+  *is_ambiguous = !IsValidH264Level(codec_id.substr(9));
   return true;
 }
 
diff --git a/media/base/mime_util_unittest.cc b/media/base/mime_util_unittest.cc
index d1d6722..8d44f0f 100644
--- a/media/base/mime_util_unittest.cc
+++ b/media/base/mime_util_unittest.cc
@@ -34,6 +34,12 @@
   EXPECT_TRUE(IsStrictMediaMimeType("application/x-mpegurl"));
   EXPECT_TRUE(IsStrictMediaMimeType("application/vnd.apple.mpegurl"));
 
+#if defined(ENABLE_MPEG2TS_STREAM_PARSER)
+  EXPECT_TRUE(IsStrictMediaMimeType("video/mp2t"));
+#else
+  EXPECT_FALSE(IsStrictMediaMimeType("video/mp2t"));
+#endif
+
   EXPECT_FALSE(IsStrictMediaMimeType("video/unknown"));
   EXPECT_FALSE(IsStrictMediaMimeType("Video/UNKNOWN"));
   EXPECT_FALSE(IsStrictMediaMimeType("audio/unknown"));
diff --git a/media/blink/BUILD.gn b/media/blink/BUILD.gn
index 54d5429..3b9365c 100644
--- a/media/blink/BUILD.gn
+++ b/media/blink/BUILD.gn
@@ -48,6 +48,8 @@
     "media_blink_export.h",
     "multibuffer.cc",
     "multibuffer.h",
+    "multibuffer_reader.cc",
+    "multibuffer_reader.h",
     "new_session_cdm_result_promise.cc",
     "new_session_cdm_result_promise.h",
     "texttrack_impl.cc",
@@ -122,6 +124,7 @@
     "mock_webframeclient.h",
     "mock_weburlloader.cc",
     "mock_weburlloader.h",
+    "multibuffer_unittest.cc",
     "run_all_unittests.cc",
     "test_random.h",
     "test_response_generator.cc",
diff --git a/media/blink/interval_map.h b/media/blink/interval_map.h
index e11a03c..74cdca7 100644
--- a/media/blink/interval_map.h
+++ b/media/blink/interval_map.h
@@ -124,8 +124,6 @@
 
   // Needed to make the following construct work:
   // for (const auto& interval_value_pair : interval_map)
-  // Note however that this will skip the "end" interval, which
-  // is usually ok since it generally has the default value.
   std::pair<Interval<KeyType>, ValueType> operator*() const {
     return std::make_pair(interval(), value());
   }
@@ -182,8 +180,7 @@
 
   // Increase [from..to) by |how_much|.
   void IncrementInterval(KeyType from, KeyType to, ValueType how_much) {
-    DCHECK_GT(to, from);
-    if (how_much == 0)
+    if (to <= from || how_much == 0)
       return;
     typename MapType::iterator a = MakeEntry(from);
     typename MapType::iterator b = MakeEntry(to);
@@ -197,7 +194,8 @@
 
   // Set [from..to) to |how_much|.
   void SetInterval(KeyType from, KeyType to, ValueType how_much) {
-    DCHECK_GT(to, from);
+    if (to <= from)
+      return;
     typename MapType::iterator a = MakeEntry(from);
     typename MapType::iterator b = MakeEntry(to);
     a->second = how_much;
diff --git a/media/blink/media_blink.gyp b/media/blink/media_blink.gyp
index 17a577d..3b08ee7 100644
--- a/media/blink/media_blink.gyp
+++ b/media/blink/media_blink.gyp
@@ -53,6 +53,8 @@
         'media_blink_export.h',
         'multibuffer.cc',
         'multibuffer.h',
+        'multibuffer_reader.cc',
+        'multibuffer_reader.h',
         'new_session_cdm_result_promise.cc',
         'new_session_cdm_result_promise.h',
         'texttrack_impl.cc',
@@ -128,6 +130,7 @@
         'mock_webframeclient.h',
         'mock_weburlloader.cc',
         'mock_weburlloader.h',
+        'multibuffer_unittest.cc',
         'run_all_unittests.cc',
         'test_random.h',
         'test_response_generator.cc',
diff --git a/media/blink/multibuffer_reader.cc b/media/blink/multibuffer_reader.cc
new file mode 100644
index 0000000..8f98167
--- /dev/null
+++ b/media/blink/multibuffer_reader.cc
@@ -0,0 +1,237 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/bind.h"
+#include "base/callback_helpers.h"
+#include "base/message_loop/message_loop.h"
+#include "media/blink/multibuffer_reader.h"
+#include "net/base/net_errors.h"
+
+namespace media {
+
+MultiBufferReader::MultiBufferReader(
+    MultiBuffer* multibuffer,
+    int64_t start,
+    int64_t end,
+    const base::Callback<void(int64_t, int64_t)>& progress_callback)
+    : multibuffer_(multibuffer),
+      // If end is -1, we use a very large (but still supported) value instead.
+      end_(end == -1LL ? (1LL << (multibuffer->block_size_shift() + 30)) : end),
+      preload_high_(0),
+      preload_low_(0),
+      max_buffer_forward_(0),
+      max_buffer_backward_(0),
+      pos_(start),
+      preload_pos_(-1),
+      loading_(true),
+      current_wait_size_(0),
+      progress_callback_(progress_callback),
+      weak_factory_(this) {
+  DCHECK_GE(start, 0);
+  DCHECK_GE(end_, 0);
+}
+
+MultiBufferReader::~MultiBufferReader() {
+  multibuffer_->RemoveReader(preload_pos_, this);
+  multibuffer_->IncrementMaxSize(
+      -block_ceil(max_buffer_forward_ + max_buffer_backward_));
+  multibuffer_->PinRange(block(pos_ - max_buffer_backward_),
+                         block_ceil(pos_ + max_buffer_forward_), -1);
+  multibuffer_->CleanupWriters(preload_pos_);
+}
+
+void MultiBufferReader::Seek(int64_t pos) {
+  DCHECK_GE(pos, 0);
+  if (pos == pos_)
+    return;
+  // Use a rangemap to compute the diff in pinning.
+  IntervalMap<MultiBuffer::BlockId, int32_t> tmp;
+  tmp.IncrementInterval(block(pos_ - max_buffer_backward_),
+                        block_ceil(pos_ + max_buffer_forward_), -1);
+  tmp.IncrementInterval(block(pos - max_buffer_backward_),
+                        block_ceil(pos + max_buffer_forward_), 1);
+
+  multibuffer_->PinRanges(tmp);
+
+  multibuffer_->RemoveReader(preload_pos_, this);
+  MultiBufferBlockId old_preload_pos = preload_pos_;
+  preload_pos_ = block(pos);
+  pos_ = pos;
+  UpdateInternalState();
+  multibuffer_->CleanupWriters(old_preload_pos);
+}
+
+void MultiBufferReader::SetMaxBuffer(int64_t backward, int64_t forward) {
+  // Safe, because we know this doesn't actually prune the cache right away.
+  multibuffer_->IncrementMaxSize(
+      -block_ceil(max_buffer_forward_ + max_buffer_backward_));
+  // Use a rangemap to compute the diff in pinning.
+  IntervalMap<MultiBuffer::BlockId, int32_t> tmp;
+  tmp.IncrementInterval(block(pos_ - max_buffer_backward_),
+                        block_ceil(pos_ + max_buffer_forward_), -1);
+  max_buffer_backward_ = backward;
+  max_buffer_forward_ = forward;
+  tmp.IncrementInterval(block(pos_ - max_buffer_backward_),
+                        block_ceil(pos_ + max_buffer_forward_), 1);
+  multibuffer_->PinRanges(tmp);
+
+  multibuffer_->IncrementMaxSize(
+      block_ceil(max_buffer_forward_ + max_buffer_backward_));
+}
+
+int64_t MultiBufferReader::Available() const {
+  int64_t unavailable_byte_pos =
+      static_cast<int64_t>(multibuffer_->FindNextUnavailable(block(pos_)))
+      << multibuffer_->block_size_shift();
+  return std::max<int64_t>(0, unavailable_byte_pos - pos_);
+}
+
+int64_t MultiBufferReader::TryRead(uint8_t* data, int64_t len) {
+  DCHECK_GT(len, 0);
+  current_wait_size_ = 0;
+  cb_.Reset();
+  DCHECK_LE(pos_ + len, end_);
+  const MultiBuffer::DataMap& data_map = multibuffer_->map();
+  MultiBuffer::DataMap::const_iterator i = data_map.find(block(pos_));
+  int64_t p = pos_;
+  int64_t bytes_read = 0;
+  while (bytes_read < len) {
+    if (i == data_map.end())
+      break;
+    if (i->first != block(p))
+      break;
+    if (i->second->end_of_stream())
+      break;
+    size_t offset = p & ((1LL << multibuffer_->block_size_shift()) - 1);
+    size_t tocopy =
+        std::min<size_t>(len - bytes_read, i->second->data_size() - offset);
+    memcpy(data, i->second->data() + offset, tocopy);
+    data += tocopy;
+    bytes_read += tocopy;
+    p += tocopy;
+    ++i;
+  }
+  Seek(p);
+  return bytes_read;
+}
+
+int MultiBufferReader::Wait(int64_t len, const base::Closure& cb) {
+  DCHECK_LE(pos_ + len, end_);
+  DCHECK_NE(Available(), -1);
+  DCHECK_LE(len, max_buffer_forward_);
+  current_wait_size_ = len;
+
+  cb_.Reset();
+  UpdateInternalState();
+
+  if (Available() >= current_wait_size_) {
+    return net::OK;
+  } else {
+    cb_ = cb;
+    return net::ERR_IO_PENDING;
+  }
+}
+
+void MultiBufferReader::SetPreload(int64_t preload_high, int64_t preload_low) {
+  DCHECK_GE(preload_high, preload_low);
+  multibuffer_->RemoveReader(preload_pos_, this);
+  preload_pos_ = block(pos_);
+  preload_high_ = preload_high;
+  preload_low_ = preload_low;
+  UpdateInternalState();
+}
+
+bool MultiBufferReader::IsLoading() const {
+  return loading_;
+}
+
+void MultiBufferReader::CheckWait() {
+  if (!cb_.is_null() &&
+      (Available() >= current_wait_size_ || Available() == -1)) {
+    // We redirect the call through a weak pointer to ourselves to guarantee
+    // there are no callbacks from us after we've been destroyed.
+    base::MessageLoop::current()->PostTask(
+        FROM_HERE,
+        base::Bind(&MultiBufferReader::Call, weak_factory_.GetWeakPtr(),
+                   base::ResetAndReturn(&cb_)));
+  }
+}
+
+void MultiBufferReader::Call(const base::Closure& cb) const {
+  cb.Run();
+}
+
+void MultiBufferReader::NotifyAvailableRange(
+    const Interval<MultiBufferBlockId>& range) {
+  // Update end_ if we can.
+  if (range.end > range.begin) {
+    auto i = multibuffer_->map().find(range.end - 1);
+    DCHECK(i != multibuffer_->map().end());
+    if (i->second->end_of_stream()) {
+      // This is an upper limit because the last-to-one block is allowed
+      // to be smaller than the rest of the blocks.
+      int64_t size_upper_limit = static_cast<int64_t>(range.end)
+                                 << multibuffer_->block_size_shift();
+      end_ = std::min(end_, size_upper_limit);
+    }
+  }
+  UpdateInternalState();
+  if (!progress_callback_.is_null()) {
+    // We redirect the call through a weak pointer to ourselves to guarantee
+    // there are no callbacks from us after we've been destroyed.
+    base::MessageLoop::current()->PostTask(
+        FROM_HERE,
+        base::Bind(&MultiBufferReader::Call, weak_factory_.GetWeakPtr(),
+                   base::Bind(progress_callback_,
+                              static_cast<int64_t>(range.begin)
+                                  << multibuffer_->block_size_shift(),
+                              static_cast<int64_t>(range.end)
+                                  << multibuffer_->block_size_shift())));
+    // We may be destroyed, do not touch |this|.
+  }
+}
+
+void MultiBufferReader::UpdateInternalState() {
+  int64_t effective_preload = loading_ ? preload_high_ : preload_low_;
+
+  loading_ = false;
+  if (preload_pos_ == -1) {
+    preload_pos_ = block(pos_);
+    DCHECK_GE(preload_pos_, 0);
+  }
+  MultiBuffer::BlockId max_preload = block_ceil(
+      std::min(end_, pos_ + std::max(effective_preload, current_wait_size_)));
+
+  // Note that we might not have been added to the multibuffer,
+  // removing ourselves is a no-op in that case.
+  multibuffer_->RemoveReader(preload_pos_, this);
+
+  // We explicitly allow preloading to go beyond the pinned region in the cache.
+  // It only happens when we want to preload something into the disk cache.
+  // Thus it is possible to have blocks between our current reading position
+  // and preload_pos_ be unavailable. When we get a Seek() call (possibly
+  // through TryRead()) we reset the preload_pos_ to the current reading
+  // position, and preload_pos_ will become the first unavailable block after
+  // our current reading position again.
+  preload_pos_ = multibuffer_->FindNextUnavailable(preload_pos_);
+  DCHECK_GE(preload_pos_, 0);
+
+  DVLOG(3) << "UpdateInternalState"
+           << " pp = " << preload_pos_
+           << " block_ceil(end_) = " << block_ceil(end_) << " end_ = " << end_
+           << " max_preload " << max_preload;
+
+  if (preload_pos_ < block_ceil(end_)) {
+    if (preload_pos_ < max_preload) {
+      loading_ = true;
+      multibuffer_->AddReader(preload_pos_, this);
+    } else if (multibuffer_->Contains(preload_pos_ - 1)) {
+      --preload_pos_;
+      multibuffer_->AddReader(preload_pos_, this);
+    }
+  }
+  CheckWait();
+}
+
+}  // namespace media
diff --git a/media/blink/multibuffer_reader.h b/media/blink/multibuffer_reader.h
new file mode 100644
index 0000000..44f14f9
--- /dev/null
+++ b/media/blink/multibuffer_reader.h
@@ -0,0 +1,158 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MEDIA_BLINK_MULTIBUFFER_READER_H_
+#define MEDIA_BLINK_MULTIBUFFER_READER_H_
+
+#include <stdint.h>
+
+#include <limits>
+#include <map>
+#include <set>
+
+#include "base/callback.h"
+#include "base/memory/weak_ptr.h"
+#include "media/blink/media_blink_export.h"
+#include "media/blink/multibuffer.h"
+
+namespace media {
+
+// Wrapper for MultiBuffer that offers a simple byte-reading
+// interface with prefetch.
+class MEDIA_BLINK_EXPORT MultiBufferReader
+    : NON_EXPORTED_BASE(public MultiBuffer::Reader) {
+ public:
+  // Note that |progress_callback| is guaranteed to be called if
+  // a redirect happens and the url_data is updated. Otherwise
+  // origin checks will become insecure.
+  // Users probably want to call SetMaxBuffer & SetPreload after
+  // creating the a MultiBufferReader.
+  // The progress callback will be called when the "available range"
+  // changes. (The number of bytes available for reading before and
+  // after the current position.) The arguments for the progress
+  // callback is the first byte available (from beginning of file)
+  // and the last byte available + 1. Note that there may be other
+  // regions of available data in the cache as well.
+  // If |end| is not known, use -1.
+  MultiBufferReader(
+      MultiBuffer* multibuffer,
+      int64_t start,
+      int64_t end,
+      const base::Callback<void(int64_t, int64_t)>& progress_callback);
+
+  ~MultiBufferReader() override;
+
+  // Returns number of bytes available for reading. When the rest of the file
+  // is available, the number returned will be greater than the number
+  // or readable bytes. If an error occurs, -1 is returned.
+  int64_t Available() const;
+
+  // Seek to a different position.
+  // If there is a pending Wait(), it will be cancelled.
+  void Seek(int64_t pos);
+
+  // Returns the current position.
+  int64_t Tell() const { return pos_; }
+
+  // Tries to read |len| bytes and advance position.
+  // Returns number of bytes read.
+  // If there is a pending Wait(), it will be cancelled.
+  int64_t TryRead(uint8_t* data, int64_t len);
+
+  // Wait until |len| bytes are available for reading.
+  // Returns net::OK if |len| bytes are already available, otherwise it will
+  // return net::ERR_IO_PENDING and call |cb| at some point later.
+  // |len| must be smaller or equal to max_buffer_forward.
+  int Wait(int64_t len, const base::Closure& cb);
+
+  // Set how much data we try to preload into the cache ahead of our current
+  // location. Normally, we preload until we have preload_high bytes, then
+  // stop until we fall below preload_low bytes. Note that preload can be
+  // set higher than max_buffer_forward, but the result is usually that
+  // some blocks will be freed between the current position and the preload
+  // position.
+  void SetPreload(int64_t preload_high, int64_t preload_low);
+
+  // Change how much data we pin to the cache.
+  // The range [current_position - backward ... current_position + forward)
+  // will be locked in the cache. Calling Wait() or TryRead() with values
+  // larger than |forward| is not supported.
+  void SetMaxBuffer(int64_t backward, int64_t forward);
+
+  // Returns true if we are currently loading data.
+  bool IsLoading() const;
+
+  // Reader implementation.
+  void NotifyAvailableRange(const Interval<MultiBufferBlockId>& range) override;
+
+  // Getters
+  int64_t preload_high() const { return preload_high_; }
+  int64_t preload_low() const { return preload_low_; }
+
+ private:
+  // Returns the block for a particular byte position.
+  MultiBufferBlockId block(int64_t byte_pos) const {
+    return byte_pos >> multibuffer_->block_size_shift();
+  }
+
+  // Returns the block for a particular byte position, rounding up.
+  MultiBufferBlockId block_ceil(int64_t byte_pos) const {
+    return block(byte_pos + (1LL << multibuffer_->block_size_shift()) - 1);
+  }
+
+  // Check if wait operation can complete now.
+  void CheckWait();
+
+  // Recalculate preload_pos_ and update our entry in the multibuffer
+  // reader index. Also call CheckWait(). This function is basically
+  // called anything changes, like when we get more data or seek to
+  // a new position.
+  void UpdateInternalState();
+
+  // Indirection function used to call callbacks. When we post a callback
+  // we indirect it through a weak_ptr and this function to make sure we
+  // don't call any callbacks after this object has been destroyed.
+  void Call(const base::Closure& cb) const;
+
+  // The multibuffer we're wrapping, not owned.
+  MultiBuffer* multibuffer_;
+
+  // We're not interested in reading past this position.
+  int64_t end_;
+
+  // Defer reading once we have this much data.
+  int64_t preload_high_;
+  // Stop deferring once we have this much data.
+  int64_t preload_low_;
+
+  // Pin this much data in the cache from the current position.
+  int64_t max_buffer_forward_;
+  int64_t max_buffer_backward_;
+
+  // Current position in bytes.
+  int64_t pos_;
+
+  // [block(pos_)..preload_pos_) are known to be in the cache.
+  // preload_pos_ is only allowed to point to a filled
+  // cache position if it is equal to end_ or pos_+preload_.
+  // This is a pointer to a slot in the cache, so the unit is
+  // blocks.
+  MultiBufferBlockId preload_pos_;
+
+  // True if we've requested data from the cache by calling WaitFor().
+  bool loading_;
+
+  // When Available() > current_wait_size_ we call cb_.
+  int64_t current_wait_size_;
+  base::Closure cb_;
+
+  // Progress callback.
+  base::Callback<void(int64_t, int64_t)> progress_callback_;
+
+  base::WeakPtrFactory<MultiBufferReader> weak_factory_;
+};
+
+}  // namespace media
+
+#endif  // MEDIA_BLINK_MULTIBUFFER_READER_H_
diff --git a/media/blink/multibuffer_unittest.cc b/media/blink/multibuffer_unittest.cc
new file mode 100644
index 0000000..59693ef1
--- /dev/null
+++ b/media/blink/multibuffer_unittest.cc
@@ -0,0 +1,508 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <deque>
+#include <string>
+#include <vector>
+
+#include "base/bind.h"
+#include "base/callback_helpers.h"
+#include "base/message_loop/message_loop.h"
+#include "media/blink/multibuffer.h"
+#include "media/blink/multibuffer_reader.h"
+#include "media/blink/test_random.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+const int kBlockSizeShift = 8;
+const size_t kBlockSize = 1UL << kBlockSizeShift;
+
+namespace media {
+class TestMultiBufferDataProvider;
+
+std::vector<TestMultiBufferDataProvider*> writers;
+
+class TestMultiBufferDataProvider : public media::MultiBuffer::DataProvider {
+ public:
+  TestMultiBufferDataProvider(MultiBufferBlockId pos,
+                              size_t file_size,
+                              int max_blocks_after_defer,
+                              bool must_read_whole_file,
+                              media::TestRandom* rnd)
+      : pos_(pos),
+        blocks_until_deferred_(1 << 30),
+        max_blocks_after_defer_(max_blocks_after_defer),
+        file_size_(file_size),
+        must_read_whole_file_(must_read_whole_file),
+        rnd_(rnd) {
+    writers.push_back(this);
+  }
+
+  ~TestMultiBufferDataProvider() override {
+    if (must_read_whole_file_) {
+      CHECK_GE(pos_ * kBlockSize, file_size_);
+    }
+    for (size_t i = 0; i < writers.size(); i++) {
+      if (writers[i] == this) {
+        writers[i] = writers.back();
+        writers.pop_back();
+        return;
+      }
+    }
+    LOG(FATAL) << "Couldn't find myself in writers!";
+  }
+
+  MultiBufferBlockId Tell() const override { return pos_; }
+
+  bool Available() const override { return !fifo_.empty(); }
+
+  scoped_refptr<DataBuffer> Read() override {
+    DCHECK(Available());
+    scoped_refptr<DataBuffer> ret = fifo_.front();
+    fifo_.pop_front();
+    ++pos_;
+    return ret;
+  }
+
+  void SetAvailableCallback(const base::Closure& cb) override {
+    DCHECK(!Available());
+    cb_ = cb;
+  }
+
+  void SetDeferred(bool deferred) override {
+    if (deferred) {
+      if (max_blocks_after_defer_ > 0) {
+        blocks_until_deferred_ = rnd_->Rand() % max_blocks_after_defer_;
+      } else if (max_blocks_after_defer_ < 0) {
+        blocks_until_deferred_ = -max_blocks_after_defer_;
+      } else {
+        blocks_until_deferred_ = 0;
+      }
+    } else {
+      blocks_until_deferred_ = 1 << 30;
+    }
+  }
+
+  bool Advance() {
+    if (blocks_until_deferred_ == 0)
+      return false;
+    --blocks_until_deferred_;
+
+    bool ret = true;
+    scoped_refptr<media::DataBuffer> block = new media::DataBuffer(kBlockSize);
+    size_t x = 0;
+    size_t byte_pos = (fifo_.size() + pos_) * kBlockSize;
+    for (x = 0; x < kBlockSize; x++, byte_pos++) {
+      if (byte_pos >= file_size_)
+        break;
+      block->writable_data()[x] =
+          static_cast<uint8_t>((byte_pos * 15485863) >> 16);
+    }
+    block->set_data_size(static_cast<int>(x));
+    fifo_.push_back(block);
+    if (byte_pos == file_size_) {
+      fifo_.push_back(DataBuffer::CreateEOSBuffer());
+      ret = false;
+    }
+    cb_.Run();
+    return ret;
+  }
+
+ private:
+  std::deque<scoped_refptr<media::DataBuffer>> fifo_;
+  MultiBufferBlockId pos_;
+  int32_t blocks_until_deferred_;
+  int32_t max_blocks_after_defer_;
+  size_t file_size_;
+  bool must_read_whole_file_;
+  base::Closure cb_;
+  media::TestRandom* rnd_;
+};
+
+class TestMultiBuffer : public media::MultiBuffer {
+ public:
+  explicit TestMultiBuffer(
+      int32_t shift,
+      const scoped_refptr<media::MultiBuffer::GlobalLRU>& lru,
+      media::TestRandom* rnd)
+      : media::MultiBuffer(shift, lru),
+        range_supported_(false),
+        create_ok_(true),
+        max_writers_(10000),
+        file_size_(1 << 30),
+        max_blocks_after_defer_(0),
+        must_read_whole_file_(false),
+        writers_created_(0),
+        rnd_(rnd) {}
+
+  void SetMaxWriters(size_t max_writers) { max_writers_ = max_writers; }
+
+  void CheckPresentState() {
+    IntervalMap<MultiBufferBlockId, int32_t> tmp;
+    for (DataMap::iterator i = data_.begin(); i != data_.end(); ++i) {
+      CHECK(i->second);  // Null poineters are not allowed in data_
+      CHECK_NE(!!pinned_[i->first], lru_->Contains(this, i->first))
+          << " i->first = " << i->first;
+      tmp.IncrementInterval(i->first, i->first + 1, 1);
+    }
+    IntervalMap<MultiBufferBlockId, int32_t>::const_iterator tmp_iterator =
+        tmp.begin();
+    IntervalMap<MultiBufferBlockId, int32_t>::const_iterator present_iterator =
+        present_.begin();
+    while (tmp_iterator != tmp.end() && present_iterator != tmp.end()) {
+      EXPECT_EQ(tmp_iterator.interval_begin(),
+                present_iterator.interval_begin());
+      EXPECT_EQ(tmp_iterator.interval_end(), present_iterator.interval_end());
+      EXPECT_EQ(tmp_iterator.value(), present_iterator.value());
+      ++tmp_iterator;
+      ++present_iterator;
+    }
+    EXPECT_TRUE(tmp_iterator == tmp.end());
+    EXPECT_TRUE(present_iterator == present_.end());
+  }
+
+  void CheckLRUState() {
+    for (DataMap::iterator i = data_.begin(); i != data_.end(); ++i) {
+      CHECK(i->second);  // Null poineters are not allowed in data_
+      CHECK_NE(!!pinned_[i->first], lru_->Contains(this, i->first))
+          << " i->first = " << i->first;
+      CHECK_EQ(1, present_[i->first]) << " i->first = " << i->first;
+    }
+  }
+
+  void SetFileSize(size_t file_size) { file_size_ = file_size; }
+
+  void SetMaxBlocksAfterDefer(int32_t max_blocks_after_defer) {
+    max_blocks_after_defer_ = max_blocks_after_defer;
+  }
+
+  void SetMustReadWholeFile(bool must_read_whole_file) {
+    must_read_whole_file_ = must_read_whole_file;
+  }
+
+  int32_t writers_created() const { return writers_created_; }
+
+  void SetRangeSupported(bool supported) { range_supported_ = supported; }
+
+ protected:
+  DataProvider* CreateWriter(const MultiBufferBlockId& pos) override {
+    DCHECK(create_ok_);
+    writers_created_++;
+    CHECK_LT(writers.size(), max_writers_);
+    return new TestMultiBufferDataProvider(
+        pos, file_size_, max_blocks_after_defer_, must_read_whole_file_, rnd_);
+  }
+  void Prune(size_t max_to_free) override {
+    // Prune should not cause additional writers to be spawned.
+    create_ok_ = false;
+    MultiBuffer::Prune(max_to_free);
+    create_ok_ = true;
+  }
+
+  bool RangeSupported() const override { return range_supported_; }
+
+ private:
+  bool range_supported_;
+  bool create_ok_;
+  size_t max_writers_;
+  size_t file_size_;
+  int32_t max_blocks_after_defer_;
+  bool must_read_whole_file_;
+  int32_t writers_created_;
+  media::TestRandom* rnd_;
+};
+}
+
+class MultiBufferTest : public testing::Test {
+ public:
+  MultiBufferTest()
+      : rnd_(42),
+        lru_(new media::MultiBuffer::GlobalLRU()),
+        multibuffer_(kBlockSizeShift, lru_, &rnd_) {}
+
+  void Advance() {
+    CHECK(media::writers.size());
+    media::writers[rnd_.Rand() % media::writers.size()]->Advance();
+  }
+
+  bool AdvanceAll() {
+    bool advanced = false;
+    for (size_t i = 0; i < media::writers.size(); i++) {
+      advanced |= media::writers[i]->Advance();
+    }
+    multibuffer_.CheckLRUState();
+    return advanced;
+  }
+
+ protected:
+  media::TestRandom rnd_;
+  scoped_refptr<media::MultiBuffer::GlobalLRU> lru_;
+  media::TestMultiBuffer multibuffer_;
+  base::MessageLoop message_loop_;
+};
+
+TEST_F(MultiBufferTest, ReadAll) {
+  multibuffer_.SetMaxWriters(1);
+  size_t pos = 0;
+  size_t end = 10000;
+  multibuffer_.SetFileSize(10000);
+  multibuffer_.SetMustReadWholeFile(true);
+  media::MultiBufferReader reader(&multibuffer_, pos, end,
+                                  base::Callback<void(int64_t, int64_t)>());
+  reader.SetMaxBuffer(2000, 5000);
+  reader.SetPreload(1000, 1000);
+  while (pos < end) {
+    unsigned char buffer[27];
+    buffer[17] = 17;
+    size_t to_read = std::min<size_t>(end - pos, 17);
+    int64_t bytes_read = reader.TryRead(buffer, to_read);
+    if (bytes_read) {
+      EXPECT_EQ(buffer[17], 17);
+      for (int64_t i = 0; i < bytes_read; i++) {
+        uint8_t expected = static_cast<uint8_t>((pos * 15485863) >> 16);
+        EXPECT_EQ(expected, buffer[i]) << " pos = " << pos;
+        pos++;
+      }
+    } else {
+      Advance();
+    }
+  }
+}
+
+TEST_F(MultiBufferTest, ReadAllAdvanceFirst) {
+  multibuffer_.SetMaxWriters(1);
+  size_t pos = 0;
+  size_t end = 10000;
+  multibuffer_.SetFileSize(10000);
+  multibuffer_.SetMustReadWholeFile(true);
+  media::MultiBufferReader reader(&multibuffer_, pos, end,
+                                  base::Callback<void(int64_t, int64_t)>());
+  reader.SetMaxBuffer(2000, 5000);
+  reader.SetPreload(1000, 1000);
+  while (pos < end) {
+    unsigned char buffer[27];
+    buffer[17] = 17;
+    size_t to_read = std::min<size_t>(end - pos, 17);
+    while (AdvanceAll())
+      ;
+    int64_t bytes = reader.TryRead(buffer, to_read);
+    EXPECT_GT(bytes, 0);
+    EXPECT_EQ(buffer[17], 17);
+    for (int64_t i = 0; i < bytes; i++) {
+      uint8_t expected = static_cast<uint8_t>((pos * 15485863) >> 16);
+      EXPECT_EQ(expected, buffer[i]) << " pos = " << pos;
+      pos++;
+    }
+  }
+}
+
+// Checks that if the data provider provides too much data after we told it
+// to defer, we kill it.
+TEST_F(MultiBufferTest, ReadAllAdvanceFirst_NeverDefer) {
+  multibuffer_.SetMaxWriters(1);
+  size_t pos = 0;
+  size_t end = 10000;
+  multibuffer_.SetFileSize(10000);
+  multibuffer_.SetMaxBlocksAfterDefer(-10000);
+  multibuffer_.SetRangeSupported(true);
+  media::MultiBufferReader reader(&multibuffer_, pos, end,
+                                  base::Callback<void(int64_t, int64_t)>());
+  reader.SetMaxBuffer(2000, 5000);
+  reader.SetPreload(1000, 1000);
+  while (pos < end) {
+    unsigned char buffer[27];
+    buffer[17] = 17;
+    size_t to_read = std::min<size_t>(end - pos, 17);
+    while (AdvanceAll())
+      ;
+    int64_t bytes = reader.TryRead(buffer, to_read);
+    EXPECT_GT(bytes, 0);
+    EXPECT_EQ(buffer[17], 17);
+    for (int64_t i = 0; i < bytes; i++) {
+      uint8_t expected = static_cast<uint8_t>((pos * 15485863) >> 16);
+      EXPECT_EQ(expected, buffer[i]) << " pos = " << pos;
+      pos++;
+    }
+  }
+  EXPECT_GT(multibuffer_.writers_created(), 1);
+}
+
+// Same as ReadAllAdvanceFirst_NeverDefer, but the url doesn't support
+// ranges, so we don't destroy it no matter how much data it provides.
+TEST_F(MultiBufferTest, ReadAllAdvanceFirst_NeverDefer2) {
+  multibuffer_.SetMaxWriters(1);
+  size_t pos = 0;
+  size_t end = 10000;
+  multibuffer_.SetFileSize(10000);
+  multibuffer_.SetMustReadWholeFile(true);
+  multibuffer_.SetMaxBlocksAfterDefer(-10000);
+  media::MultiBufferReader reader(&multibuffer_, pos, end,
+                                  base::Callback<void(int64_t, int64_t)>());
+  reader.SetMaxBuffer(2000, 5000);
+  reader.SetPreload(1000, 1000);
+  while (pos < end) {
+    unsigned char buffer[27];
+    buffer[17] = 17;
+    size_t to_read = std::min<size_t>(end - pos, 17);
+    while (AdvanceAll())
+      ;
+    int64_t bytes = reader.TryRead(buffer, to_read);
+    EXPECT_GT(bytes, 0);
+    EXPECT_EQ(buffer[17], 17);
+    for (int64_t i = 0; i < bytes; i++) {
+      uint8_t expected = static_cast<uint8_t>((pos * 15485863) >> 16);
+      EXPECT_EQ(expected, buffer[i]) << " pos = " << pos;
+      pos++;
+    }
+  }
+}
+
+TEST_F(MultiBufferTest, LRUTest) {
+  int64_t max_size = 17;
+  int64_t current_size = 0;
+  lru_->IncrementMaxSize(max_size);
+
+  multibuffer_.SetMaxWriters(1);
+  size_t pos = 0;
+  size_t end = 10000;
+  multibuffer_.SetFileSize(10000);
+  media::MultiBufferReader reader(&multibuffer_, pos, end,
+                                  base::Callback<void(int64_t, int64_t)>());
+  reader.SetPreload(10000, 10000);
+  // Note, no pinning, all data should end up in LRU.
+  EXPECT_EQ(current_size, lru_->Size());
+  current_size += max_size;
+  while (AdvanceAll())
+    ;
+  EXPECT_EQ(current_size, lru_->Size());
+  lru_->IncrementMaxSize(-max_size);
+  lru_->Prune(3);
+  current_size -= 3;
+  EXPECT_EQ(current_size, lru_->Size());
+  lru_->Prune(3);
+  current_size -= 3;
+  EXPECT_EQ(current_size, lru_->Size());
+  lru_->Prune(1000);
+  EXPECT_EQ(0, lru_->Size());
+}
+
+class ReadHelper {
+ public:
+  ReadHelper(size_t end,
+             size_t max_read_size,
+             media::MultiBuffer* multibuffer,
+             media::TestRandom* rnd)
+      : pos_(0),
+        end_(end),
+        max_read_size_(max_read_size),
+        read_size_(0),
+        rnd_(rnd),
+        reader_(multibuffer,
+                pos_,
+                end_,
+                base::Callback<void(int64_t, int64_t)>()) {
+    reader_.SetMaxBuffer(2000, 5000);
+    reader_.SetPreload(1000, 1000);
+  }
+
+  bool Read() {
+    if (read_size_ == 0)
+      return true;
+    unsigned char buffer[4096];
+    CHECK_LE(read_size_, static_cast<int64_t>(sizeof(buffer)));
+    CHECK_EQ(pos_, reader_.Tell());
+    int64_t bytes_read = reader_.TryRead(buffer, read_size_);
+    if (bytes_read) {
+      for (int64_t i = 0; i < bytes_read; i++) {
+        unsigned char expected = (pos_ * 15485863) >> 16;
+        EXPECT_EQ(expected, buffer[i]) << " pos = " << pos_;
+        pos_++;
+      }
+      CHECK_EQ(pos_, reader_.Tell());
+      return true;
+    }
+    return false;
+  }
+
+  void StartRead() {
+    CHECK_EQ(pos_, reader_.Tell());
+    read_size_ = std::min(1 + rnd_->Rand() % (max_read_size_ - 1), end_ - pos_);
+    if (!Read()) {
+      reader_.Wait(read_size_,
+                   base::Bind(&ReadHelper::WaitCB, base::Unretained(this)));
+    }
+  }
+
+  void WaitCB() { CHECK(Read()); }
+
+  void Seek() {
+    pos_ = rnd_->Rand() % end_;
+    reader_.Seek(pos_);
+    CHECK_EQ(pos_, reader_.Tell());
+  }
+
+ private:
+  int64_t pos_;
+  int64_t end_;
+  int64_t max_read_size_;
+  int64_t read_size_;
+  media::TestRandom* rnd_;
+  media::MultiBufferReader reader_;
+};
+
+TEST_F(MultiBufferTest, RandomTest) {
+  size_t file_size = 1000000;
+  multibuffer_.SetFileSize(file_size);
+  multibuffer_.SetMaxBlocksAfterDefer(10);
+  std::vector<ReadHelper*> read_helpers;
+  for (size_t i = 0; i < 20; i++) {
+    read_helpers.push_back(
+        new ReadHelper(file_size, 1000, &multibuffer_, &rnd_));
+  }
+  for (int i = 0; i < 10000; i++) {
+    if (rnd_.Rand() & 1) {
+      if (!media::writers.empty())
+        Advance();
+    } else {
+      size_t j = rnd_.Rand() % read_helpers.size();
+      if (rnd_.Rand() % 100 < 3)
+        read_helpers[j]->Seek();
+      read_helpers[j]->StartRead();
+      multibuffer_.CheckLRUState();
+    }
+  }
+  multibuffer_.CheckPresentState();
+  while (!read_helpers.empty()) {
+    delete read_helpers.back();
+    read_helpers.pop_back();
+  }
+}
+
+TEST_F(MultiBufferTest, RandomTest_RangeSupported) {
+  size_t file_size = 1000000;
+  multibuffer_.SetFileSize(file_size);
+  multibuffer_.SetMaxBlocksAfterDefer(10);
+  std::vector<ReadHelper*> read_helpers;
+  multibuffer_.SetRangeSupported(true);
+  for (size_t i = 0; i < 20; i++) {
+    read_helpers.push_back(
+        new ReadHelper(file_size, 1000, &multibuffer_, &rnd_));
+  }
+  for (int i = 0; i < 10000; i++) {
+    if (rnd_.Rand() & 1) {
+      if (!media::writers.empty())
+        Advance();
+    } else {
+      size_t j = rnd_.Rand() % read_helpers.size();
+      if (rnd_.Rand() % 100 < 3)
+        read_helpers[j]->Seek();
+      read_helpers[j]->StartRead();
+      multibuffer_.CheckLRUState();
+    }
+  }
+  multibuffer_.CheckPresentState();
+  while (!read_helpers.empty()) {
+    delete read_helpers.back();
+    read_helpers.pop_back();
+  }
+}
diff --git a/media/cast/net/cast_transport_sender_impl.cc b/media/cast/net/cast_transport_sender_impl.cc
index 936bf81..f4732193 100644
--- a/media/cast/net/cast_transport_sender_impl.cc
+++ b/media/cast/net/cast_transport_sender_impl.cc
@@ -19,7 +19,7 @@
 // See header file for what these mean.
 const char kOptionDscp[] = "DSCP";
 #if defined(OS_WIN)
-const char kOptionNonBlockingIO[] = "non_blocking_io";
+const char kOptionDisableNonBlockingIO[] = "disable_non_blocking_io";
 #endif
 const char kOptionPacerTargetBurstSize[] = "pacer_target_burst_size";
 const char kOptionPacerMaxBurstSize[] = "pacer_max_burst_size";
@@ -134,7 +134,7 @@
       transport_->SetDscp(net::DSCP_AF41);
     }
 #if defined(OS_WIN)
-    if (options->HasKey(kOptionNonBlockingIO)) {
+    if (!options->HasKey(kOptionDisableNonBlockingIO)) {
       transport_->UseNonBlockingIO();
     }
 #endif
diff --git a/media/cast/net/cast_transport_sender_impl.h b/media/cast/net/cast_transport_sender_impl.h
index 7a83afd..09b4299 100644
--- a/media/cast/net/cast_transport_sender_impl.h
+++ b/media/cast/net/cast_transport_sender_impl.h
@@ -59,19 +59,24 @@
   // |raw_events_callback| is a null callback.
   // |options| contains optional settings for the transport, possible
   // keys are:
-  //   "DSCP" (value ignored) - turns DSCP on
-  //   "non_blocking_io" (value ignored) - Windows only.
-  //                                       Turns on non-blocking IO for socket.
-  //   "pacer_target_burst_size": int - specifies how many packets to send
-  //                                    per 10 ms ideally.
-  //   "pacer_max_burst_size": int - specifies how many pakcets to send
-  //                                 per 10 ms, max
-  //   "send_buffer_min_size": int - specifies the minimum socket send buffer
-  //                                 size
-  //   "disable_wifi_scan" (value ignored) - disable wifi scans while streaming
-  //   "media_streaming_mode" (value ignored) - turn media streaming mode on
+  //   "DSCP" (value ignored)
+  //       - Turns DSCP on (higher IP Precedence and Type of Service).
+  //   "disable_non_blocking_io" (value ignored)
+  //       - Windows only.  Turns off non-blocking IO for the socket.
+  //         Note: Non-blocking IO is, by default, enabled on all platforms.
+  //   "pacer_target_burst_size": int
+  //        - Specifies how many packets to send per 10 ms ideally.
+  //   "pacer_max_burst_size": int
+  //        - Specifies how many pakcets to send per 10 ms, maximum.
+  //   "send_buffer_min_size": int
+  //        - Specifies the minimum socket send buffer size.
+  //   "disable_wifi_scan" (value ignored)
+  //        - Disable wifi scans while streaming.
+  //   "media_streaming_mode" (value ignored)
+  //        - Turn media streaming mode on.
   // Note, these options may be ignored on some platforms.
   // TODO(hubbe): Too many callbacks, replace with an interface.
+  // http://crbug.com/557477
   CastTransportSenderImpl(
       net::NetLog* net_log,
       base::TickClock* clock,
diff --git a/media/cdm/aes_decryptor.cc b/media/cdm/aes_decryptor.cc
index 8eaa058..1c3f367 100644
--- a/media/cdm/aes_decryptor.cc
+++ b/media/cdm/aes_decryptor.cc
@@ -309,8 +309,8 @@
   promise->resolve(session_id);
 
   // No URL needed for license requests.
-  session_message_cb_.Run(session_id, LICENSE_REQUEST, message,
-                          GURL::EmptyGURL());
+  GURL empty_gurl;
+  session_message_cb_.Run(session_id, LICENSE_REQUEST, message, empty_gurl);
 }
 
 void AesDecryptor::LoadSession(SessionType session_type,
diff --git a/media/cdm/cdm_adapter_unittest.cc b/media/cdm/cdm_adapter_unittest.cc
new file mode 100644
index 0000000..1b3f12b
--- /dev/null
+++ b/media/cdm/cdm_adapter_unittest.cc
@@ -0,0 +1,374 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/bind.h"
+#include "base/files/file_path.h"
+#include "base/files/file_util.h"
+#include "base/logging.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/path_service.h"
+#include "base/run_loop.h"
+#include "base/scoped_native_library.h"
+#include "media/base/cdm_callback_promise.h"
+#include "media/base/cdm_key_information.h"
+#include "media/base/media_keys.h"
+#include "media/cdm/api/content_decryption_module.h"
+#include "media/cdm/cdm_adapter.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+using ::testing::_;
+using ::testing::SaveArg;
+MATCHER(IsNotEmpty, "") {
+  return !arg.empty();
+}
+
+// TODO(jrummell): These tests are a subset of those in aes_decryptor_unittest.
+// Refactor aes_decryptor_unittest.cc to handle AesDecryptor directly and
+// via CdmAdapter once CdmAdapter supports decrypting functionality. There
+// will also be tests that only CdmAdapter supports, like file IO, which
+// will need to be handled separately.
+
+namespace media {
+
+// INITIALIZE_CDM_MODULE is a macro in api/content_decryption_module.h.
+// However, we need to pass it as a string to GetFunctionPointer() once it
+// is expanded.
+#define STRINGIFY(X) #X
+#define MAKE_STRING(X) STRINGIFY(X)
+
+const char kExternalClearKeyKeySystem[] = "org.chromium.externalclearkey";
+
+// File name of the External ClearKey CDM on different platforms.
+const base::FilePath::CharType kExternalClearKeyCdmFileName[] =
+#if defined(OS_MACOSX)
+    FILE_PATH_LITERAL("libclearkeycdm.dylib");
+#elif defined(OS_WIN)
+    FILE_PATH_LITERAL("clearkeycdm.dll");
+#else  // OS_LINUX, etc.
+    FILE_PATH_LITERAL("libclearkeycdm.so");
+#endif
+
+// Random key ID used to create a session.
+const uint8 kKeyId[] = {
+    // base64 equivalent is AQIDBAUGBwgJCgsMDQ4PEA
+    0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,
+    0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10,
+};
+
+const char kKeyIdAsJWK[] = "{\"kids\": [\"AQIDBAUGBwgJCgsMDQ4PEA\"]}";
+
+const uint8 kKeyIdAsPssh[] = {
+    0x00, 0x00, 0x00, 0x00, 'p',  's',  's',  'h',   // size = 0
+    0x01,                                            // version = 1
+    0x00, 0x00, 0x00,                                // flags
+    0x10, 0x77, 0xEF, 0xEC, 0xC0, 0xB2, 0x4D, 0x02,  // Common SystemID
+    0xAC, 0xE3, 0x3C, 0x1E, 0x52, 0xE2, 0xFB, 0x4B,
+    0x00, 0x00, 0x00, 0x01,                          // key count
+    0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08,  // key
+    0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10,
+    0x00, 0x00, 0x00, 0x00,  // datasize
+};
+
+// Key is 0x0405060708090a0b0c0d0e0f10111213,
+// base64 equivalent is BAUGBwgJCgsMDQ4PEBESEw.
+const char kKeyAsJWK[] =
+    "{"
+    "  \"keys\": ["
+    "    {"
+    "      \"kty\": \"oct\","
+    "      \"alg\": \"A128KW\","
+    "      \"kid\": \"AQIDBAUGBwgJCgsMDQ4PEA\","
+    "      \"k\": \"BAUGBwgJCgsMDQ4PEBESEw\""
+    "    }"
+    "  ],"
+    "  \"type\": \"temporary\""
+    "}";
+
+class CdmAdapterTest : public testing::Test {
+ public:
+  enum ExpectedResult { SUCCESS, FAILURE };
+
+  CdmAdapterTest() {}
+  ~CdmAdapterTest() override {}
+
+ protected:
+  // Initializes the adapter. |expected_result| tests that the call succeeds
+  // or generates an error.
+  void InitializeAndExpect(base::FilePath library_path,
+                           ExpectedResult expected_result) {
+    CdmConfig cdm_config;  // default settings of false are sufficient.
+
+    CdmAdapter::Create(
+        kExternalClearKeyKeySystem, library_path, cdm_config,
+        base::Bind(&CdmAdapterTest::OnSessionMessage, base::Unretained(this)),
+        base::Bind(&CdmAdapterTest::OnSessionClosed, base::Unretained(this)),
+        base::Bind(&CdmAdapterTest::OnLegacySessionError,
+                   base::Unretained(this)),
+        base::Bind(&CdmAdapterTest::OnSessionKeysChange,
+                   base::Unretained(this)),
+        base::Bind(&CdmAdapterTest::OnSessionExpirationUpdate,
+                   base::Unretained(this)),
+        base::Bind(&CdmAdapterTest::OnCdmCreated, base::Unretained(this),
+                   expected_result));
+    RunUntilIdle();
+  }
+
+  // Creates a new session using |key_id|. |session_id_| will be set
+  // when the promise is resolved. |expected_result| tests that
+  // CreateSessionAndGenerateRequest() succeeds or generates an error.
+  void CreateSessionAndExpect(EmeInitDataType data_type,
+                              const std::vector<uint8>& key_id,
+                              ExpectedResult expected_result) {
+    DCHECK(!key_id.empty());
+
+    if (expected_result == SUCCESS) {
+      EXPECT_CALL(*this,
+                  OnSessionMessage(IsNotEmpty(), _, _, GURL::EmptyGURL()));
+    }
+
+    adapter_->CreateSessionAndGenerateRequest(
+        MediaKeys::TEMPORARY_SESSION, data_type, key_id,
+        CreateSessionPromise(expected_result));
+    RunUntilIdle();
+  }
+
+  // Loads the session specified by |session_id|. |expected_result| tests
+  // that LoadSession() succeeds or generates an error.
+  void LoadSessionAndExpect(const std::string& session_id,
+                            ExpectedResult expected_result) {
+    DCHECK(!session_id.empty());
+    ASSERT_EQ(expected_result, FAILURE) << "LoadSession not supported.";
+
+    adapter_->LoadSession(MediaKeys::TEMPORARY_SESSION, session_id,
+                          CreateSessionPromise(expected_result));
+    RunUntilIdle();
+  }
+
+  // Updates the session specified by |session_id| with |key|. |expected_result|
+  // tests that the update succeeds or generates an error. |new_key_expected|
+  // is the expected parameter when the SessionKeysChange event happens.
+  void UpdateSessionAndExpect(std::string session_id,
+                              const std::string& key,
+                              ExpectedResult expected_result,
+                              bool new_key_expected) {
+    DCHECK(!key.empty());
+
+    if (expected_result == SUCCESS) {
+      EXPECT_CALL(*this,
+                  OnSessionKeysChangeCalled(session_id, new_key_expected));
+    } else {
+      EXPECT_CALL(*this, OnSessionKeysChangeCalled(_, _)).Times(0);
+    }
+
+    adapter_->UpdateSession(session_id,
+                            std::vector<uint8>(key.begin(), key.end()),
+                            CreatePromise(expected_result));
+    RunUntilIdle();
+  }
+
+  base::FilePath ExternalClearKeyLibrary() { return library_path_; }
+
+  std::string SessionId() { return session_id_; }
+
+ private:
+  void SetUp() override {
+    // Determine the location of the CDM. It is expected to be in the same
+    // directory as the current module.
+    base::FilePath current_module_dir;
+    ASSERT_TRUE(PathService::Get(base::DIR_MODULE, &current_module_dir));
+    library_path_ =
+        current_module_dir.Append(base::FilePath(kExternalClearKeyCdmFileName));
+    ASSERT_TRUE(base::PathExists(library_path_)) << library_path_.value();
+
+    // Now load the CDM library.
+    base::NativeLibraryLoadError error;
+    library_.Reset(base::LoadNativeLibrary(library_path_, &error));
+    ASSERT_TRUE(library_.is_valid()) << error.ToString();
+
+    // Call INITIALIZE_CDM_MODULE()
+    typedef void (*InitializeCdmFunc)();
+    InitializeCdmFunc initialize_cdm_func = reinterpret_cast<InitializeCdmFunc>(
+        library_.GetFunctionPointer(MAKE_STRING(INITIALIZE_CDM_MODULE)));
+    ASSERT_TRUE(initialize_cdm_func) << "No INITIALIZE_CDM_MODULE in library";
+    initialize_cdm_func();
+  }
+
+  void TearDown() override {
+    // Call DeinitializeCdmModule()
+    typedef void (*DeinitializeCdmFunc)();
+    DeinitializeCdmFunc deinitialize_cdm_func =
+        reinterpret_cast<DeinitializeCdmFunc>(
+            library_.GetFunctionPointer("DeinitializeCdmModule"));
+    ASSERT_TRUE(deinitialize_cdm_func)
+        << "No DeinitializeCdmModule() in library";
+    deinitialize_cdm_func();
+  }
+
+  void OnCdmCreated(ExpectedResult expected_result,
+                    const scoped_refptr<MediaKeys>& cdm,
+                    const std::string& error_message) {
+    if (cdm) {
+      EXPECT_EQ(expected_result, SUCCESS) << "CDM should not have loaded.";
+      adapter_ = cdm;
+    } else {
+      EXPECT_EQ(expected_result, FAILURE) << error_message;
+    }
+  }
+
+  // Create a promise. |expected_result| is used to indicate how the promise
+  // should be fulfilled.
+  scoped_ptr<SimpleCdmPromise> CreatePromise(ExpectedResult expected_result) {
+    if (expected_result == SUCCESS) {
+      EXPECT_CALL(*this, OnResolve());
+    } else {
+      EXPECT_CALL(*this, OnReject(_, _, IsNotEmpty()));
+    }
+
+    scoped_ptr<SimpleCdmPromise> promise(new CdmCallbackPromise<>(
+        base::Bind(&CdmAdapterTest::OnResolve, base::Unretained(this)),
+        base::Bind(&CdmAdapterTest::OnReject, base::Unretained(this))));
+    return promise.Pass();
+  }
+
+  // Create a promise to be used when a new session is created.
+  // |expected_result| is used to indicate how the promise should be fulfilled.
+  scoped_ptr<NewSessionCdmPromise> CreateSessionPromise(
+      ExpectedResult expected_result) {
+    if (expected_result == SUCCESS) {
+      EXPECT_CALL(*this, OnResolveWithSession(_))
+          .WillOnce(SaveArg<0>(&session_id_));
+    } else {
+      EXPECT_CALL(*this, OnReject(_, _, IsNotEmpty()));
+    }
+
+    scoped_ptr<NewSessionCdmPromise> promise(
+        new CdmCallbackPromise<std::string>(
+            base::Bind(&CdmAdapterTest::OnResolveWithSession,
+                       base::Unretained(this)),
+            base::Bind(&CdmAdapterTest::OnReject, base::Unretained(this))));
+    return promise.Pass();
+  }
+
+  void RunUntilIdle() { message_loop_.RunUntilIdle(); }
+
+  // Methods used for promise resolved/rejected.
+  MOCK_METHOD0(OnResolve, void());
+  MOCK_METHOD1(OnResolveWithSession, void(const std::string& session_id));
+  MOCK_METHOD3(OnReject,
+               void(MediaKeys::Exception exception_code,
+                    uint32 system_code,
+                    const std::string& error_message));
+
+  // Methods used for the events possibly generated by CdmAdapater.
+  MOCK_METHOD4(OnSessionMessage,
+               void(const std::string& session_id,
+                    MediaKeys::MessageType message_type,
+                    const std::vector<uint8_t>& message,
+                    const GURL& legacy_destination_url));
+  MOCK_METHOD1(OnSessionClosed, void(const std::string& session_id));
+  MOCK_METHOD4(OnLegacySessionError,
+               void(const std::string& session_id,
+                    MediaKeys::Exception exception,
+                    uint32_t system_code,
+                    const std::string& error_message));
+  MOCK_METHOD2(OnSessionKeysChangeCalled,
+               void(const std::string& session_id,
+                    bool has_additional_usable_key));
+  void OnSessionKeysChange(const std::string& session_id,
+                           bool has_additional_usable_key,
+                           CdmKeysInfo keys_info) {
+    // MOCK methods don't like CdmKeysInfo.
+    OnSessionKeysChangeCalled(session_id, has_additional_usable_key);
+  }
+  MOCK_METHOD2(OnSessionExpirationUpdate,
+               void(const std::string& session_id,
+                    const base::Time& new_expiry_time));
+
+  // Keep a reference to the CDM.
+  base::FilePath library_path_;
+  base::ScopedNativeLibrary library_;
+
+  scoped_refptr<MediaKeys> adapter_;
+
+  // |session_id_| is the latest result of calling CreateSession().
+  std::string session_id_;
+
+  base::MessageLoop message_loop_;
+
+  DISALLOW_COPY_AND_ASSIGN(CdmAdapterTest);
+};
+
+TEST_F(CdmAdapterTest, Initialize) {
+  InitializeAndExpect(ExternalClearKeyLibrary(), SUCCESS);
+}
+
+TEST_F(CdmAdapterTest, BadLibraryPath) {
+  InitializeAndExpect(base::FilePath(FILE_PATH_LITERAL("no_library_here")),
+                      FAILURE);
+}
+
+TEST_F(CdmAdapterTest, CreateWebmSession) {
+  InitializeAndExpect(ExternalClearKeyLibrary(), SUCCESS);
+
+  std::vector<uint8> key_id(kKeyId, kKeyId + arraysize(kKeyId));
+  CreateSessionAndExpect(EmeInitDataType::WEBM, key_id, SUCCESS);
+}
+
+TEST_F(CdmAdapterTest, CreateKeyIdsSession) {
+  InitializeAndExpect(ExternalClearKeyLibrary(), SUCCESS);
+
+  // Don't include the trailing /0 from the string in the data passed in.
+  std::vector<uint8> key_id(kKeyIdAsJWK,
+                            kKeyIdAsJWK + arraysize(kKeyIdAsJWK) - 1);
+  CreateSessionAndExpect(EmeInitDataType::KEYIDS, key_id, SUCCESS);
+}
+
+TEST_F(CdmAdapterTest, CreateCencSession) {
+  InitializeAndExpect(ExternalClearKeyLibrary(), SUCCESS);
+
+  std::vector<uint8> key_id(kKeyIdAsPssh,
+                            kKeyIdAsPssh + arraysize(kKeyIdAsPssh));
+#if defined(USE_PROPRIETARY_CODECS)
+  CreateSessionAndExpect(EmeInitDataType::CENC, key_id, SUCCESS);
+#else
+  CreateSessionAndExpect(EmeInitDataType::CENC, key_id, FAILURE);
+#endif
+}
+
+TEST_F(CdmAdapterTest, CreateSessionWithBadData) {
+  InitializeAndExpect(ExternalClearKeyLibrary(), SUCCESS);
+
+  // Use |kKeyId| but specify KEYIDS format.
+  std::vector<uint8> key_id(kKeyId, kKeyId + arraysize(kKeyId));
+  CreateSessionAndExpect(EmeInitDataType::KEYIDS, key_id, FAILURE);
+}
+
+TEST_F(CdmAdapterTest, LoadSession) {
+  InitializeAndExpect(ExternalClearKeyLibrary(), SUCCESS);
+
+  // LoadSession() is not supported by AesDecryptor.
+  std::vector<uint8> key_id(kKeyId, kKeyId + arraysize(kKeyId));
+  CreateSessionAndExpect(EmeInitDataType::KEYIDS, key_id, FAILURE);
+}
+
+TEST_F(CdmAdapterTest, UpdateSession) {
+  InitializeAndExpect(ExternalClearKeyLibrary(), SUCCESS);
+
+  std::vector<uint8> key_id(kKeyId, kKeyId + arraysize(kKeyId));
+  CreateSessionAndExpect(EmeInitDataType::WEBM, key_id, SUCCESS);
+
+  UpdateSessionAndExpect(SessionId(), kKeyAsJWK, SUCCESS, true);
+}
+
+TEST_F(CdmAdapterTest, UpdateSessionWithBadData) {
+  InitializeAndExpect(ExternalClearKeyLibrary(), SUCCESS);
+
+  std::vector<uint8> key_id(kKeyId, kKeyId + arraysize(kKeyId));
+  CreateSessionAndExpect(EmeInitDataType::WEBM, key_id, SUCCESS);
+
+  UpdateSessionAndExpect(SessionId(), "random data", FAILURE, true);
+}
+
+}  // namespace media
diff --git a/media/cdm/ppapi/external_clear_key/clear_key_cdm.cc b/media/cdm/ppapi/external_clear_key/clear_key_cdm.cc
index f6c7781..61f0820 100644
--- a/media/cdm/ppapi/external_clear_key/clear_key_cdm.cc
+++ b/media/cdm/ppapi/external_clear_key/clear_key_cdm.cc
@@ -212,23 +212,15 @@
   }
 }
 
-template<typename Type>
-class ScopedResetter {
- public:
-  explicit ScopedResetter(Type* object) : object_(object) {}
-  ~ScopedResetter() { object_->Reset(); }
-
- private:
-  Type* const object_;
-};
-
 void INITIALIZE_CDM_MODULE() {
+  DVLOG(1) << __FUNCTION__;
 #if defined(CLEAR_KEY_CDM_USE_FFMPEG_DECODER)
   av_register_all();
 #endif  // CLEAR_KEY_CDM_USE_FFMPEG_DECODER
 }
 
 void DeinitializeCdmModule() {
+  DVLOG(1) << __FUNCTION__;
 }
 
 void* CreateCdmInstance(int cdm_interface_version,
@@ -255,7 +247,8 @@
     return NULL;
 
   // TODO(jrummell): Obtain the proper origin for this instance.
-  return new media::ClearKeyCdm(host, key_system_string, GURL::EmptyGURL());
+  GURL empty_gurl;
+  return new media::ClearKeyCdm(host, key_system_string, empty_gurl);
 }
 
 const char* GetCdmVersion() {
diff --git a/media/filters/vpx_video_decoder.cc b/media/filters/vpx_video_decoder.cc
index 10b8d911..0a14d3e 100644
--- a/media/filters/vpx_video_decoder.cc
+++ b/media/filters/vpx_video_decoder.cc
@@ -26,7 +26,11 @@
 #include "base/trace_event/trace_event.h"
 #include "media/base/bind_to_current_loop.h"
 #include "media/base/decoder_buffer.h"
+#include "media/base/limits.h"
 #include "media/base/media_switches.h"
+#include "media/base/pipeline.h"
+#include "media/base/timestamp_constants.h"
+#include "media/base/video_util.h"
 
 // Include libvpx header files.
 // VPX_CODEC_DISABLE_COMPAT excludes parts of the libvpx API that provide
@@ -38,8 +42,6 @@
 #include "third_party/libvpx_new/source/libvpx/vpx/vpx_frame_buffer.h"
 }
 
-#include "third_party/libyuv/include/libyuv/convert.h"
-
 namespace media {
 
 // Always try to use three threads for video decoding.  There is little reason
@@ -76,31 +78,11 @@
   return decode_threads;
 }
 
-static vpx_codec_ctx* InitializeVpxContext(vpx_codec_ctx* context,
-                                           const VideoDecoderConfig& config) {
-  context = new vpx_codec_ctx();
-  vpx_codec_dec_cfg_t vpx_config = {0};
-  vpx_config.w = config.coded_size().width();
-  vpx_config.h = config.coded_size().height();
-  vpx_config.threads = GetThreadCount(config);
-
-  vpx_codec_err_t status = vpx_codec_dec_init(
-      context,
-      config.codec() == kCodecVP9 ? vpx_codec_vp9_dx() : vpx_codec_vp8_dx(),
-      &vpx_config, 0 /* flags */);
-  if (status == VPX_CODEC_OK)
-    return context;
-
-  DLOG(ERROR) << "vpx_codec_dec_init() failed: " << vpx_codec_error(context);
-  delete context;
-  return nullptr;
-}
-
 class VpxVideoDecoder::MemoryPool
-    : public base::trace_event::MemoryDumpProvider {
+    : public base::RefCountedThreadSafe<VpxVideoDecoder::MemoryPool>,
+      public base::trace_event::MemoryDumpProvider {
  public:
   MemoryPool();
-  ~MemoryPool() override;
 
   // Callback that will be called by libvpx when it needs a frame buffer.
   // Parameters:
@@ -129,6 +111,9 @@
   int NumberOfFrameBuffersInUseByDecoderAndVideoFrame() const;
 
  private:
+  friend class base::RefCountedThreadSafe<VpxVideoDecoder::MemoryPool>;
+  ~MemoryPool() override;
+
   // Reference counted frame buffers used for VP9 decoding. Reference counting
   // is done manually because both chromium and libvpx has to release this
   // before a buffer can be re-used.
@@ -152,26 +137,17 @@
   int in_use_by_decoder_ = 0;
   // Number of VP9FrameBuffer currently in use by the decoder and a video frame.
   int in_use_by_decoder_and_video_frame_ = 0;
-
-  // NOTE: Weak pointers must be invalidated before all other member variables.
-  base::WeakPtrFactory<MemoryPool> weak_factory_;
-
   DISALLOW_COPY_AND_ASSIGN(MemoryPool);
 };
 
-VpxVideoDecoder::MemoryPool::MemoryPool() : weak_factory_(this) {
-  base::trace_event::MemoryDumpManager::GetInstance()->RegisterDumpProvider(
-      this, "VpxVideoDecoder", base::ThreadTaskRunnerHandle::Get());
-}
+VpxVideoDecoder::MemoryPool::MemoryPool() {}
 
 VpxVideoDecoder::MemoryPool::~MemoryPool() {
   STLDeleteElements(&frame_buffers_);
-  base::trace_event::MemoryDumpManager::GetInstance()->UnregisterDumpProvider(
-      this);
 }
 
 VpxVideoDecoder::MemoryPool::VP9FrameBuffer*
-VpxVideoDecoder::MemoryPool::GetFreeFrameBuffer(size_t min_size) {
+    VpxVideoDecoder::MemoryPool::GetFreeFrameBuffer(size_t min_size) {
   // Check if a free frame buffer exists.
   size_t i = 0;
   for (; i < frame_buffers_.size(); ++i) {
@@ -233,9 +209,9 @@
   ++frame_buffer->ref_cnt;
   if (frame_buffer->ref_cnt > 1)
     ++in_use_by_decoder_and_video_frame_;
-  return BindToCurrentLoop(base::Bind(&MemoryPool::OnVideoFrameDestroyed,
-                                      weak_factory_.GetWeakPtr(),
-                                      frame_buffer));
+  return BindToCurrentLoop(
+             base::Bind(&MemoryPool::OnVideoFrameDestroyed, this,
+                        frame_buffer));
 }
 
 bool VpxVideoDecoder::MemoryPool::OnMemoryDump(
@@ -252,8 +228,9 @@
   size_t bytes_used = 0;
   size_t bytes_reserved = 0;
   for (const VP9FrameBuffer* frame_buffer : frame_buffers_) {
-    if (frame_buffer->ref_cnt)
+    if (frame_buffer->ref_cnt) {
       bytes_used += frame_buffer->data.size();
+    }
     bytes_reserved += frame_buffer->data.size();
   }
 
@@ -283,13 +260,15 @@
     --in_use_by_decoder_and_video_frame_;
 }
 
-VpxVideoDecoder::VpxVideoDecoder()
-    : state_(kUninitialized), vpx_codec_(nullptr), vpx_codec_alpha_(nullptr) {
-  thread_checker_.DetachFromThread();
-}
+VpxVideoDecoder::VpxVideoDecoder(
+    const scoped_refptr<base::SingleThreadTaskRunner>& task_runner)
+    : task_runner_(task_runner),
+      state_(kUninitialized),
+      vpx_codec_(NULL),
+      vpx_codec_alpha_(NULL) {}
 
 VpxVideoDecoder::~VpxVideoDecoder() {
-  DCHECK(thread_checker_.CalledOnValidThread());
+  DCHECK(task_runner_->BelongsToCurrentThread());
   CloseDecoder();
 }
 
@@ -298,12 +277,13 @@
 }
 
 void VpxVideoDecoder::Initialize(const VideoDecoderConfig& config,
-                                 bool /* low_delay */,
+                                 bool low_delay,
                                  const SetCdmReadyCB& /* set_cdm_ready_cb */,
                                  const InitCB& init_cb,
                                  const OutputCB& output_cb) {
-  DCHECK(thread_checker_.CalledOnValidThread());
+  DCHECK(task_runner_->BelongsToCurrentThread());
   DCHECK(config.IsValidConfig());
+  DCHECK(decode_cb_.is_null());
 
   InitCB bound_init_cb = BindToCurrentLoop(init_cb);
 
@@ -319,64 +299,32 @@
   bound_init_cb.Run(true);
 }
 
-void VpxVideoDecoder::Decode(const scoped_refptr<DecoderBuffer>& buffer,
-                             const DecodeCB& decode_cb) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  DCHECK(buffer.get());
-  DCHECK(!decode_cb.is_null());
-  DCHECK_NE(state_, kUninitialized)
-      << "Called Decode() before successful Initialize()";
+static vpx_codec_ctx* InitializeVpxContext(vpx_codec_ctx* context,
+                                           const VideoDecoderConfig& config) {
+  context = new vpx_codec_ctx();
+  vpx_codec_dec_cfg_t vpx_config = {0};
+  vpx_config.w = config.coded_size().width();
+  vpx_config.h = config.coded_size().height();
+  vpx_config.threads = GetThreadCount(config);
 
-  DecodeCB bound_decode_cb = BindToCurrentLoop(decode_cb);
-
-  if (state_ == kError) {
-    bound_decode_cb.Run(kDecodeError);
-    return;
+  vpx_codec_err_t status = vpx_codec_dec_init(context,
+                                              config.codec() == kCodecVP9 ?
+                                                  vpx_codec_vp9_dx() :
+                                                  vpx_codec_vp8_dx(),
+                                              &vpx_config,
+                                              0);
+  if (status != VPX_CODEC_OK) {
+    LOG(ERROR) << "vpx_codec_dec_init failed, status=" << status;
+    delete context;
+    return NULL;
   }
-  if (state_ == kDecodeFinished) {
-    bound_decode_cb.Run(kOk);
-    return;
-  }
-  if (state_ == kNormal && buffer->end_of_stream()) {
-    state_ = kDecodeFinished;
-    bound_decode_cb.Run(kOk);
-    return;
-  }
-
-  scoped_refptr<VideoFrame> video_frame;
-  if (!VpxDecode(buffer, &video_frame)) {
-    state_ = kError;
-    bound_decode_cb.Run(kDecodeError);
-    return;
-  }
-  // We might get a successfull VpxDecode but not a frame if only a partial
-  // decode happened.
-  if (video_frame.get())
-    output_cb_.Run(video_frame);
-
-  // VideoDecoderShim expects |decode_cb| call after |output_cb_|.
-  bound_decode_cb.Run(kOk);
-}
-
-void VpxVideoDecoder::Reset(const base::Closure& closure) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  state_ = kNormal;
-  // PostTask() to avoid calling |closure| inmediately.
-  base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE, closure);
+  return context;
 }
 
 bool VpxVideoDecoder::ConfigureDecoder(const VideoDecoderConfig& config) {
   if (config.codec() != kCodecVP8 && config.codec() != kCodecVP9)
     return false;
 
-  // These are the combinations of codec-pixel format supported in principle.
-  // Note that VP9 does not support Alpha in the current implementation.
-  DCHECK(
-      (config.codec() == kCodecVP8 && config.format() == PIXEL_FORMAT_YV12) ||
-      (config.codec() == kCodecVP8 && config.format() == PIXEL_FORMAT_YV12A) ||
-      (config.codec() == kCodecVP9 && config.format() == PIXEL_FORMAT_YV12) ||
-      (config.codec() == kCodecVP9 && config.format() == PIXEL_FORMAT_YV24));
-
 #if !defined(DISABLE_FFMPEG_VIDEO_DECODERS)
   // When FFmpegVideoDecoder is available it handles VP8 that doesn't have
   // alpha, and VpxVideoDecoder will handle VP8 with alpha.
@@ -390,59 +338,125 @@
   if (!vpx_codec_)
     return false;
 
-  // Configure VP9 to decode on our buffers to skip a data copy on decoding.
+  // We use our own buffers for VP9 so that there is no need to copy data after
+  // decoding.
   if (config.codec() == kCodecVP9) {
-    DCHECK_NE(PIXEL_FORMAT_YV12A, config.format());
-    DCHECK(vpx_codec_get_caps(vpx_codec_->iface) &
-           VPX_CODEC_CAP_EXTERNAL_FRAME_BUFFER);
-
-    memory_pool_ = make_scoped_ptr(new MemoryPool());
+    memory_pool_ = new MemoryPool();
+    base::trace_event::MemoryDumpManager::GetInstance()->RegisterDumpProvider(
+        memory_pool_.get(), "VpxVideoDecoder", task_runner_);
     if (vpx_codec_set_frame_buffer_functions(vpx_codec_,
                                              &MemoryPool::GetVP9FrameBuffer,
                                              &MemoryPool::ReleaseVP9FrameBuffer,
                                              memory_pool_.get())) {
-      DLOG(ERROR) << "Failed to configure external buffers. "
-                  << vpx_codec_error(vpx_codec_);
+      LOG(ERROR) << "Failed to configure external buffers.";
       return false;
     }
   }
 
-  if (config.format() != PIXEL_FORMAT_YV12A)
-    return true;
+  if (config.format() == PIXEL_FORMAT_YV12A) {
+    vpx_codec_alpha_ = InitializeVpxContext(vpx_codec_alpha_, config);
+    if (!vpx_codec_alpha_)
+      return false;
+  }
 
-  vpx_codec_alpha_ = InitializeVpxContext(vpx_codec_alpha_, config);
-  return !!vpx_codec_alpha_;
+  return true;
 }
 
 void VpxVideoDecoder::CloseDecoder() {
   if (vpx_codec_) {
     vpx_codec_destroy(vpx_codec_);
     delete vpx_codec_;
-    vpx_codec_ = nullptr;
-    memory_pool_ = nullptr;
+    vpx_codec_ = NULL;
+    base::trace_event::MemoryDumpManager::GetInstance()->UnregisterDumpProvider(
+        memory_pool_.get());
+    memory_pool_ = NULL;
   }
   if (vpx_codec_alpha_) {
     vpx_codec_destroy(vpx_codec_alpha_);
     delete vpx_codec_alpha_;
-    vpx_codec_alpha_ = nullptr;
+    vpx_codec_alpha_ = NULL;
   }
 }
 
+void VpxVideoDecoder::Decode(const scoped_refptr<DecoderBuffer>& buffer,
+                             const DecodeCB& decode_cb) {
+  DCHECK(task_runner_->BelongsToCurrentThread());
+  DCHECK(!decode_cb.is_null());
+  CHECK_NE(state_, kUninitialized);
+  CHECK(decode_cb_.is_null()) << "Overlapping decodes are not supported.";
+
+  decode_cb_ = BindToCurrentLoop(decode_cb);
+
+  if (state_ == kError) {
+    base::ResetAndReturn(&decode_cb_).Run(kDecodeError);
+    return;
+  }
+
+  // Return empty frames if decoding has finished.
+  if (state_ == kDecodeFinished) {
+    base::ResetAndReturn(&decode_cb_).Run(kOk);
+    return;
+  }
+
+  DecodeBuffer(buffer);
+}
+
+void VpxVideoDecoder::Reset(const base::Closure& closure) {
+  DCHECK(task_runner_->BelongsToCurrentThread());
+  DCHECK(decode_cb_.is_null());
+
+  state_ = kNormal;
+  task_runner_->PostTask(FROM_HERE, closure);
+}
+
+void VpxVideoDecoder::DecodeBuffer(const scoped_refptr<DecoderBuffer>& buffer) {
+  DCHECK(task_runner_->BelongsToCurrentThread());
+  DCHECK_NE(state_, kUninitialized);
+  DCHECK_NE(state_, kDecodeFinished);
+  DCHECK_NE(state_, kError);
+  DCHECK(!decode_cb_.is_null());
+  DCHECK(buffer.get());
+
+  // Transition to kDecodeFinished on the first end of stream buffer.
+  if (state_ == kNormal && buffer->end_of_stream()) {
+    state_ = kDecodeFinished;
+    base::ResetAndReturn(&decode_cb_).Run(kOk);
+    return;
+  }
+
+  scoped_refptr<VideoFrame> video_frame;
+  if (!VpxDecode(buffer, &video_frame)) {
+    state_ = kError;
+    base::ResetAndReturn(&decode_cb_).Run(kDecodeError);
+    return;
+  }
+
+  if (video_frame.get())
+    output_cb_.Run(video_frame);
+
+  // VideoDecoderShim expects that |decode_cb| is called only after
+  // |output_cb_|.
+  base::ResetAndReturn(&decode_cb_).Run(kOk);
+}
+
 bool VpxVideoDecoder::VpxDecode(const scoped_refptr<DecoderBuffer>& buffer,
                                 scoped_refptr<VideoFrame>* video_frame) {
   DCHECK(video_frame);
   DCHECK(!buffer->end_of_stream());
 
+  // Pass |buffer| to libvpx.
   int64 timestamp = buffer->timestamp().InMicroseconds();
   void* user_priv = reinterpret_cast<void*>(&timestamp);
+
   {
     TRACE_EVENT1("video", "vpx_codec_decode", "timestamp", timestamp);
-    vpx_codec_err_t status =
-        vpx_codec_decode(vpx_codec_, buffer->data(), buffer->data_size(),
-                         user_priv, 0 /* deadline */);
+    vpx_codec_err_t status = vpx_codec_decode(vpx_codec_,
+                                              buffer->data(),
+                                              buffer->data_size(),
+                                              user_priv,
+                                              0);
     if (status != VPX_CODEC_OK) {
-      DLOG(ERROR) << "vpx_codec_decode() error: "
-                  << vpx_codec_err_to_string(status);
+      LOG(ERROR) << "vpx_codec_decode() failed, status=" << status;
       return false;
     }
   }
@@ -451,17 +465,85 @@
   vpx_codec_iter_t iter = NULL;
   const vpx_image_t* vpx_image = vpx_codec_get_frame(vpx_codec_, &iter);
   if (!vpx_image) {
-    *video_frame = nullptr;
+    *video_frame = NULL;
     return true;
   }
 
-  if (vpx_image->user_priv != user_priv) {
-    DLOG(ERROR) << "Invalid output timestamp.";
+  if (vpx_image->user_priv != reinterpret_cast<void*>(&timestamp)) {
+    LOG(ERROR) << "Invalid output timestamp.";
     return false;
   }
 
-  CopyVpxImageToVideoFrame(vpx_image, video_frame);
+  const vpx_image_t* vpx_image_alpha = NULL;
+  if (vpx_codec_alpha_ && buffer->side_data_size() >= 8) {
+    // Pass alpha data to libvpx.
+    int64 timestamp_alpha = buffer->timestamp().InMicroseconds();
+    void* user_priv_alpha = reinterpret_cast<void*>(&timestamp_alpha);
+
+    // First 8 bytes of side data is side_data_id in big endian.
+    const uint64 side_data_id = base::NetToHost64(
+        *(reinterpret_cast<const uint64*>(buffer->side_data())));
+    if (side_data_id == 1) {
+      {
+        TRACE_EVENT1("video", "vpx_codec_decode_alpha",
+                     "timestamp_alpha", timestamp_alpha);
+        vpx_codec_err_t status = vpx_codec_decode(vpx_codec_alpha_,
+                                                  buffer->side_data() + 8,
+                                                  buffer->side_data_size() - 8,
+                                                  user_priv_alpha,
+                                                  0);
+        if (status != VPX_CODEC_OK) {
+          LOG(ERROR) << "vpx_codec_decode() failed on alpha, status=" << status;
+          return false;
+        }
+      }
+
+      // Gets pointer to decoded data.
+      vpx_codec_iter_t iter_alpha = NULL;
+      vpx_image_alpha = vpx_codec_get_frame(vpx_codec_alpha_, &iter_alpha);
+      if (!vpx_image_alpha) {
+        *video_frame = NULL;
+        return true;
+      }
+
+      if (vpx_image_alpha->user_priv !=
+          reinterpret_cast<void*>(&timestamp_alpha)) {
+        LOG(ERROR) << "Invalid output timestamp on alpha.";
+        return false;
+      }
+
+      if (vpx_image_alpha->d_h != vpx_image->d_h ||
+          vpx_image_alpha->d_w != vpx_image->d_w) {
+        LOG(ERROR) << "The alpha plane dimensions are not the same as the "
+                      "image dimensions.";
+        return false;
+      }
+    }
+  }
+
+  CopyVpxImageTo(vpx_image, vpx_image_alpha, video_frame);
   (*video_frame)->set_timestamp(base::TimeDelta::FromMicroseconds(timestamp));
+  return true;
+}
+
+void VpxVideoDecoder::CopyVpxImageTo(const vpx_image* vpx_image,
+                                     const struct vpx_image* vpx_image_alpha,
+                                     scoped_refptr<VideoFrame>* video_frame) {
+  CHECK(vpx_image);
+  CHECK(vpx_image->fmt == VPX_IMG_FMT_I420 ||
+        vpx_image->fmt == VPX_IMG_FMT_YV12 ||
+        vpx_image->fmt == VPX_IMG_FMT_I444);
+
+  VideoPixelFormat codec_format = PIXEL_FORMAT_YV12;
+  int uv_rows = (vpx_image->d_h + 1) / 2;
+
+  if (vpx_image->fmt == VPX_IMG_FMT_I444) {
+    CHECK(!vpx_codec_alpha_);
+    codec_format = PIXEL_FORMAT_YV24;
+    uv_rows = vpx_image->d_h;
+  } else if (vpx_codec_alpha_) {
+    codec_format = PIXEL_FORMAT_YV12A;
+  }
 
   // Default to the color space from the config, but if the bistream specifies
   // one, prefer that instead.
@@ -470,88 +552,6 @@
     color_space = COLOR_SPACE_HD_REC709;
   else if (vpx_image->cs == VPX_CS_BT_601)
     color_space = COLOR_SPACE_SD_REC601;
-  (*video_frame)
-      ->metadata()
-      ->SetInteger(VideoFrameMetadata::COLOR_SPACE, color_space);
-
-  if (!vpx_codec_alpha_)
-    return true;
-
-  if (buffer->side_data_size() < 8) {
-    // TODO(mcasas): Is this a warning or an error?
-    DLOG(WARNING) << "Making Alpha channel opaque due to missing input";
-    const uint32 kAlphaOpaqueValue = 255;
-    libyuv::SetPlane((*video_frame)->visible_data(VideoFrame::kAPlane),
-                     (*video_frame)->stride(VideoFrame::kAPlane),
-                     (*video_frame)->visible_rect().width(),
-                     (*video_frame)->visible_rect().height(),
-                     kAlphaOpaqueValue);
-    return true;
-  }
-
-  // First 8 bytes of side data is |side_data_id| in big endian.
-  const uint64 side_data_id = base::NetToHost64(
-      *(reinterpret_cast<const uint64*>(buffer->side_data())));
-  if (side_data_id != 1)
-    return true;
-
-  // Try and decode buffer->side_data() minus the first 8 bytes as a full frame.
-  int64 timestamp_alpha = buffer->timestamp().InMicroseconds();
-  void* user_priv_alpha = reinterpret_cast<void*>(&timestamp_alpha);
-  {
-    TRACE_EVENT1("video", "vpx_codec_decode_alpha", "timestamp_alpha",
-                 timestamp_alpha);
-    vpx_codec_err_t status = vpx_codec_decode(
-        vpx_codec_alpha_, buffer->side_data() + 8, buffer->side_data_size() - 8,
-        user_priv_alpha, 0 /* deadline */);
-    if (status != VPX_CODEC_OK) {
-      DLOG(ERROR) << "vpx_codec_decode() failed for the alpha: "
-                  << vpx_codec_error(vpx_codec_);
-      return false;
-    }
-  }
-
-  vpx_codec_iter_t iter_alpha = NULL;
-  const vpx_image_t* vpx_image_alpha =
-      vpx_codec_get_frame(vpx_codec_alpha_, &iter_alpha);
-  if (!vpx_image_alpha) {
-    *video_frame = nullptr;
-    return true;
-  }
-
-  if (vpx_image_alpha->user_priv != user_priv_alpha) {
-    DLOG(ERROR) << "Invalid output timestamp on alpha.";
-    return false;
-  }
-
-  if (vpx_image_alpha->d_h != vpx_image->d_h ||
-      vpx_image_alpha->d_w != vpx_image->d_w) {
-    DLOG(ERROR) << "The alpha plane dimensions are not the same as the "
-                   "image dimensions.";
-    return false;
-  }
-
-  libyuv::CopyPlane(vpx_image_alpha->planes[VPX_PLANE_Y],
-                    vpx_image_alpha->stride[VPX_PLANE_Y],
-                    (*video_frame)->visible_data(VideoFrame::kAPlane),
-                    (*video_frame)->stride(VideoFrame::kAPlane),
-                    (*video_frame)->visible_rect().width(),
-                    (*video_frame)->visible_rect().height());
-  return true;
-}
-
-void VpxVideoDecoder::CopyVpxImageToVideoFrame(
-    const struct vpx_image* vpx_image,
-    scoped_refptr<VideoFrame>* video_frame) {
-  CHECK(vpx_image);
-  CHECK(vpx_image->fmt == VPX_IMG_FMT_I420 ||
-        vpx_image->fmt == VPX_IMG_FMT_I444);
-
-  VideoPixelFormat codec_format = PIXEL_FORMAT_YV12;
-  if (vpx_image->fmt == VPX_IMG_FMT_I444)
-    codec_format = PIXEL_FORMAT_YV24;
-  else if (vpx_codec_alpha_)
-    codec_format = PIXEL_FORMAT_YV12A;
 
   // The mixed |w|/|d_h| in |coded_size| is intentional. Setting the correct
   // coded width is necessary to allow coalesced memory access, which may avoid
@@ -560,9 +560,7 @@
   const gfx::Size coded_size(vpx_image->w, vpx_image->d_h);
   const gfx::Size visible_size(vpx_image->d_w, vpx_image->d_h);
 
-  if (memory_pool_.get()) {
-    DCHECK_EQ(kCodecVP9, config_.codec());
-    DCHECK(!vpx_codec_alpha_) << "Uh-oh, VP9 and Alpha shouldn't coexist.";
+  if (!vpx_codec_alpha_ && memory_pool_.get()) {
     *video_frame = VideoFrame::WrapExternalYuvData(
         codec_format,
         coded_size, gfx::Rect(visible_size), config_.natural_size(),
@@ -575,6 +573,8 @@
         kNoTimestamp());
     video_frame->get()->AddDestructionObserver(
         memory_pool_->CreateFrameCallback(vpx_image->fb_priv));
+    video_frame->get()->metadata()->SetInteger(VideoFrameMetadata::COLOR_SPACE,
+                                               color_space);
 
     UMA_HISTOGRAM_COUNTS("Media.Vpx.VideoDecoderBuffersInUseByDecoder",
                          memory_pool_->NumberOfFrameBuffersInUseByDecoder());
@@ -585,24 +585,38 @@
     return;
   }
 
-  DCHECK(codec_format == PIXEL_FORMAT_YV12 ||
-         codec_format == PIXEL_FORMAT_YV12A);
-
   *video_frame = frame_pool_.CreateFrame(
-      codec_format, visible_size, gfx::Rect(visible_size),
-      config_.natural_size(), kNoTimestamp());
+      codec_format,
+      visible_size,
+      gfx::Rect(visible_size),
+      config_.natural_size(),
+      kNoTimestamp());
+  video_frame->get()->metadata()->SetInteger(VideoFrameMetadata::COLOR_SPACE,
+                                             color_space);
 
-  libyuv::I420Copy(
-      vpx_image->planes[VPX_PLANE_Y], vpx_image->stride[VPX_PLANE_Y],
-      vpx_image->planes[VPX_PLANE_U], vpx_image->stride[VPX_PLANE_U],
-      vpx_image->planes[VPX_PLANE_V], vpx_image->stride[VPX_PLANE_V],
-      (*video_frame)->visible_data(VideoFrame::kYPlane),
-      (*video_frame)->stride(VideoFrame::kYPlane),
-      (*video_frame)->visible_data(VideoFrame::kUPlane),
-      (*video_frame)->stride(VideoFrame::kUPlane),
-      (*video_frame)->visible_data(VideoFrame::kVPlane),
-      (*video_frame)->stride(VideoFrame::kVPlane), coded_size.width(),
-      coded_size.height());
+  CopyYPlane(vpx_image->planes[VPX_PLANE_Y],
+             vpx_image->stride[VPX_PLANE_Y],
+             vpx_image->d_h,
+             video_frame->get());
+  CopyUPlane(vpx_image->planes[VPX_PLANE_U],
+             vpx_image->stride[VPX_PLANE_U],
+             uv_rows,
+             video_frame->get());
+  CopyVPlane(vpx_image->planes[VPX_PLANE_V],
+             vpx_image->stride[VPX_PLANE_V],
+             uv_rows,
+             video_frame->get());
+  if (!vpx_codec_alpha_)
+    return;
+  if (!vpx_image_alpha) {
+    MakeOpaqueAPlane(
+        vpx_image->stride[VPX_PLANE_Y], vpx_image->d_h, video_frame->get());
+    return;
+  }
+  CopyAPlane(vpx_image_alpha->planes[VPX_PLANE_Y],
+             vpx_image_alpha->stride[VPX_PLANE_Y],
+             vpx_image_alpha->d_h,
+             video_frame->get());
 }
 
 }  // namespace media
diff --git a/media/filters/vpx_video_decoder.h b/media/filters/vpx_video_decoder.h
index bb54034c..5bbc086d 100644
--- a/media/filters/vpx_video_decoder.h
+++ b/media/filters/vpx_video_decoder.h
@@ -6,7 +6,6 @@
 #define MEDIA_FILTERS_VPX_VIDEO_DECODER_H_
 
 #include "base/callback.h"
-#include "base/threading/thread_checker.h"
 #include "media/base/demuxer_stream.h"
 #include "media/base/video_decoder.h"
 #include "media/base/video_decoder_config.h"
@@ -24,13 +23,12 @@
 
 // Libvpx video decoder wrapper.
 // Note: VpxVideoDecoder accepts only YV12A VP8 content or VP9 content. This is
-// done to avoid usurping FFmpeg for all VP8 decoding, because the FFmpeg VP8
+// done to avoid usurping FFmpeg for all vp8 decoding, because the FFmpeg VP8
 // decoder is faster than the libvpx VP8 decoder.
-// Alpha channel, if any, is sent in the DecoderBuffer's side_data() as a frame
-// on its own of which the Y channel is taken.
 class MEDIA_EXPORT VpxVideoDecoder : public VideoDecoder {
  public:
-  VpxVideoDecoder();
+  explicit VpxVideoDecoder(
+      const scoped_refptr<base::SingleThreadTaskRunner>& task_runner);
   ~VpxVideoDecoder() override;
 
   // VideoDecoder implementation.
@@ -59,30 +57,31 @@
 
   void CloseDecoder();
 
-  // Try to decode |buffer| into |video_frame|. Return true if all decoding
-  // succeeded. Note that decoding can succeed and still |video_frame| be
-  // nullptr if there has been a partial decoding.
+  void DecodeBuffer(const scoped_refptr<DecoderBuffer>& buffer);
   bool VpxDecode(const scoped_refptr<DecoderBuffer>& buffer,
                  scoped_refptr<VideoFrame>* video_frame);
 
-  void CopyVpxImageToVideoFrame(const struct vpx_image* vpx_image,
-                                scoped_refptr<VideoFrame>* video_frame);
+  void CopyVpxImageTo(const vpx_image* vpx_image,
+                      const struct vpx_image* vpx_image_alpha,
+                      scoped_refptr<VideoFrame>* video_frame);
 
-  base::ThreadChecker thread_checker_;
+  scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
 
   DecoderState state_;
 
   OutputCB output_cb_;
 
+  // TODO(xhwang): Merge DecodeBuffer() into Decode() and remove this.
+  DecodeCB decode_cb_;
+
   VideoDecoderConfig config_;
 
   vpx_codec_ctx* vpx_codec_;
   vpx_codec_ctx* vpx_codec_alpha_;
 
-  // |memory_pool_| is a single-threaded memory pool used for VP9 decoding
-  // with no alpha. |frame_pool_| is used for all other cases.
+  // Memory pool used for VP9 decoding.
   class MemoryPool;
-  scoped_ptr<MemoryPool> memory_pool_;
+  scoped_refptr<MemoryPool> memory_pool_;
 
   VideoFramePool frame_pool_;
 
diff --git a/media/media.gyp b/media/media.gyp
index d0c3f78..6dd8100 100644
--- a/media/media.gyp
+++ b/media/media.gyp
@@ -1398,6 +1398,15 @@
             'filters/decrypting_video_decoder_unittest.cc',
           ],
         }],
+        # If ExternalClearKey is built, we can test CdmAdapter.
+        ['enable_pepper_cdms == 1', {
+          'dependencies': [
+            'clearkeycdm',
+          ],
+          'sources': [
+            'cdm/cdm_adapter_unittest.cc',
+          ],
+        }],
         ['target_arch != "arm" and chromeos == 1 and use_x11 == 1', {
           'sources': [
             'filters/h264_bitstream_buffer_unittest.cc',
diff --git a/media/renderers/default_renderer_factory.cc b/media/renderers/default_renderer_factory.cc
index c1c2aaa5..6ebc372 100644
--- a/media/renderers/default_renderer_factory.cc
+++ b/media/renderers/default_renderer_factory.cc
@@ -78,7 +78,7 @@
     video_decoders.push_back(new GpuVideoDecoder(gpu_factories_));
 
 #if !defined(MEDIA_DISABLE_LIBVPX)
-  video_decoders.push_back(new VpxVideoDecoder());
+  video_decoders.push_back(new VpxVideoDecoder(media_task_runner));
 #endif
 
 #if !defined(MEDIA_DISABLE_FFMPEG) && !defined(DISABLE_FFMPEG_VIDEO_DECODERS)
diff --git a/media/test/data/eme_player_js/app_loader.js b/media/test/data/eme_player_js/app_loader.js
index a4ef2b5..f4a3e74 100644
--- a/media/test/data/eme_player_js/app_loader.js
+++ b/media/test/data/eme_player_js/app_loader.js
@@ -5,7 +5,7 @@
 // Adds a Javascript source tag to the document.
 function addScriptTag(src) {
   document.write(
-      '<script type="text/javascript" async="false" src="eme_player_js/' + src +
+      '<script type="text/javascript" src="eme_player_js/' + src +
       '"></script>');
 }
 
diff --git a/media/test/pipeline_integration_test_base.cc b/media/test/pipeline_integration_test_base.cc
index 9676b50..ca9dee9 100644
--- a/media/test/pipeline_integration_test_base.cc
+++ b/media/test/pipeline_integration_test_base.cc
@@ -231,7 +231,8 @@
 scoped_ptr<Renderer> PipelineIntegrationTestBase::CreateRenderer() {
   ScopedVector<VideoDecoder> video_decoders;
 #if !defined(MEDIA_DISABLE_LIBVPX)
-  video_decoders.push_back(new VpxVideoDecoder());
+  video_decoders.push_back(
+      new VpxVideoDecoder(message_loop_.task_runner()));
 #endif  // !defined(MEDIA_DISABLE_LIBVPX)
 
 #if !defined(MEDIA_DISABLE_FFMPEG)
diff --git a/mojo/application/public/cpp/BUILD.gn b/mojo/application/public/cpp/BUILD.gn
index fb34910b..f26cf73e 100644
--- a/mojo/application/public/cpp/BUILD.gn
+++ b/mojo/application/public/cpp/BUILD.gn
@@ -39,8 +39,14 @@
     "lib/service_provider_impl.cc",
     "lib/service_registry.cc",
     "lib/service_registry.h",
+    "lib/trace_provider_impl.cc",
+    "lib/trace_provider_impl.h",
+    "lib/tracing_impl.cc",
+    "lib/tracing_impl.h",
     "service_connector.h",
     "service_provider_impl.h",
+    "switches.cc",
+    "switches.h",
   ]
 
   deps = [
@@ -52,6 +58,7 @@
     "//mojo/message_pump",
     "//mojo/public/cpp/bindings",
     "//mojo/public/cpp/system",
+    "//mojo/services/tracing/public/interfaces",
   ]
 }
 
diff --git a/mojo/application/public/cpp/application_impl.h b/mojo/application/public/cpp/application_impl.h
index 90e79596..de2aff2 100644
--- a/mojo/application/public/cpp/application_impl.h
+++ b/mojo/application/public/cpp/application_impl.h
@@ -21,6 +21,8 @@
 
 namespace mojo {
 
+class TracingImpl;
+
 // TODO(beng): This comment is hilariously out of date.
 // Utility class for communicating with the Shell, and providing Services
 // to clients.
@@ -150,6 +152,7 @@
   ApplicationDelegate* delegate_;
   Binding<Application> binding_;
   ShellPtr shell_;
+  scoped_ptr<TracingImpl> tracing_impl_;
   std::string url_;
   Closure termination_closure_;
   AppLifetimeHelper app_lifetime_helper_;
diff --git a/mojo/application/public/cpp/lib/application_impl.cc b/mojo/application/public/cpp/lib/application_impl.cc
index 6d2fb46..99d2c69 100644
--- a/mojo/application/public/cpp/lib/application_impl.cc
+++ b/mojo/application/public/cpp/lib/application_impl.cc
@@ -10,6 +10,7 @@
 #include "base/message_loop/message_loop.h"
 #include "mojo/application/public/cpp/application_delegate.h"
 #include "mojo/application/public/cpp/lib/service_registry.h"
+#include "mojo/application/public/cpp/lib/tracing_impl.h"
 #include "mojo/public/cpp/bindings/interface_ptr.h"
 #include "mojo/public/cpp/environment/logging.h"
 
@@ -17,6 +18,8 @@
 
 namespace {
 
+bool g_has_tracing_service = false;
+
 void DefaultTerminationClosure() {
   if (base::MessageLoop::current() &&
       base::MessageLoop::current()->is_running())
@@ -106,6 +109,23 @@
   shell_ = shell.Pass();
   shell_.set_connection_error_handler([this]() { OnConnectionError(); });
   url_ = url;
+
+  if (!g_has_tracing_service) {
+    // Each copy of base in our process must have one tracing service,
+    // otherwise data will be double counted or not counted. When we load a
+    // mojo application, either in process or creating a child process, the
+    // copy of base loaded needs to be connected to the tracing service.  It's
+    // the responsibility of the first application to connect to the tracing
+    // service to establish this connection.
+    //
+    // This is safe because if this is a ContentHandler, it will outlive all
+    // its served Applications. If this is a raw mojo application, it is the
+    // only Application served.
+    tracing_impl_.reset(new TracingImpl);
+    tracing_impl_->Initialize(this);
+    g_has_tracing_service = true;
+  }
+
   delegate_->Initialize(this);
 }
 
diff --git a/mojo/services/tracing/public/cpp/trace_provider_impl.cc b/mojo/application/public/cpp/lib/trace_provider_impl.cc
similarity index 97%
rename from mojo/services/tracing/public/cpp/trace_provider_impl.cc
rename to mojo/application/public/cpp/lib/trace_provider_impl.cc
index 877ae202..3a325f5 100644
--- a/mojo/services/tracing/public/cpp/trace_provider_impl.cc
+++ b/mojo/application/public/cpp/lib/trace_provider_impl.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "mojo/services/tracing/public/cpp/trace_provider_impl.h"
+#include "mojo/application/public/cpp/lib/trace_provider_impl.h"
 
 #include "base/callback.h"
 #include "base/logging.h"
diff --git a/mojo/services/tracing/public/cpp/trace_provider_impl.h b/mojo/application/public/cpp/lib/trace_provider_impl.h
similarity index 88%
rename from mojo/services/tracing/public/cpp/trace_provider_impl.h
rename to mojo/application/public/cpp/lib/trace_provider_impl.h
index 5774911..4b836ca 100644
--- a/mojo/services/tracing/public/cpp/trace_provider_impl.h
+++ b/mojo/application/public/cpp/lib/trace_provider_impl.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef MOJO_SERVICES_TRACING_PUBLIC_CPP_TRACE_PROVIDER_IMPL_H_
-#define MOJO_SERVICES_TRACING_PUBLIC_CPP_TRACE_PROVIDER_IMPL_H_
+#ifndef MOJO_APPLICATION_PUBLIC_CPP_LIB_TRACE_PROVIDER_IMPL_H_
+#define MOJO_APPLICATION_PUBLIC_CPP_LIB_TRACE_PROVIDER_IMPL_H_
 
 #include "base/macros.h"
 #include "base/memory/ref_counted_memory.h"
@@ -48,4 +48,4 @@
 
 }  // namespace mojo
 
-#endif  // MOJO_SERVICES_TRACING_PUBLIC_CPP_TRACE_PROVIDER_IMPL_H_
+#endif  // MOJO_APPLICATION_PUBLIC_CPP_LIB_TRACE_PROVIDER_IMPL_H_
diff --git a/mojo/services/tracing/public/cpp/tracing_impl.cc b/mojo/application/public/cpp/lib/tracing_impl.cc
similarity index 82%
rename from mojo/services/tracing/public/cpp/tracing_impl.cc
rename to mojo/application/public/cpp/lib/tracing_impl.cc
index 788cd31..50b6b36 100644
--- a/mojo/services/tracing/public/cpp/tracing_impl.cc
+++ b/mojo/application/public/cpp/lib/tracing_impl.cc
@@ -2,14 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "mojo/services/tracing/public/cpp/tracing_impl.h"
+#include "mojo/application/public/cpp/lib/tracing_impl.h"
 
 #include "base/trace_event/trace_event_impl.h"
 #include "mojo/application/public/cpp/application_impl.h"
 
 #ifdef NDEBUG
 #include "base/command_line.h"
-#include "mojo/services/tracing/public/cpp/switches.h"
+#include "mojo/application/public/cpp/switches.h"
 #endif
 
 namespace mojo {
@@ -27,8 +27,7 @@
   connection_->AddService(this);
 
 #ifdef NDEBUG
-  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
-          tracing::kEarlyTracing)) {
+  if (base::CommandLine::ForCurrentProcess()->HasSwitch(kEarlyTracing)) {
     provider_impl_.ForceEnableTracing();
   }
 #else
diff --git a/mojo/services/tracing/public/cpp/tracing_impl.h b/mojo/application/public/cpp/lib/tracing_impl.h
similarity index 80%
rename from mojo/services/tracing/public/cpp/tracing_impl.h
rename to mojo/application/public/cpp/lib/tracing_impl.h
index 648023f8..2bcafa0f 100644
--- a/mojo/services/tracing/public/cpp/tracing_impl.h
+++ b/mojo/application/public/cpp/lib/tracing_impl.h
@@ -2,12 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef MOJO_SERVICES_TRACING_PUBLIC_CPP_TRACING_IMPL_H_
-#define MOJO_SERVICES_TRACING_PUBLIC_CPP_TRACING_IMPL_H_
+#ifndef MOJO_APPLICATION_PUBLIC_CPP_LIB_TRACING_IMPL_H_
+#define MOJO_APPLICATION_PUBLIC_CPP_LIB_TRACING_IMPL_H_
 
 #include "base/macros.h"
 #include "mojo/application/public/cpp/interface_factory.h"
-#include "mojo/services/tracing/public/cpp/trace_provider_impl.h"
+#include "mojo/application/public/cpp/lib/trace_provider_impl.h"
 #include "mojo/services/tracing/public/interfaces/tracing.mojom.h"
 
 namespace mojo {
@@ -37,4 +37,4 @@
 
 }  // namespace mojo
 
-#endif  // MOJO_SERVICES_TRACING_PUBLIC_CPP_TRACING_IMPL_H_
+#endif  // MOJO_APPLICATION_PUBLIC_CPP_LIB_TRACING_IMPL_H_
diff --git a/mojo/services/tracing/public/cpp/switches.cc b/mojo/application/public/cpp/switches.cc
similarity index 75%
rename from mojo/services/tracing/public/cpp/switches.cc
rename to mojo/application/public/cpp/switches.cc
index 1b838e6..102bd6f 100644
--- a/mojo/services/tracing/public/cpp/switches.cc
+++ b/mojo/application/public/cpp/switches.cc
@@ -2,9 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "mojo/services/tracing/public/cpp/switches.h"
+#include "mojo/application/public/cpp/switches.h"
 
-namespace tracing {
+namespace mojo {
 
 // Specifies if the |StatsCollectionController| needs to be bound in html pages.
 // This binding happens on per-frame basis and hence can potentially be a
@@ -15,8 +15,11 @@
 
 const char kTraceStartup[] = "trace-startup";
 
+// Sets the name of the output file for startup tracing.
+const char kTraceStartupOutputName[] = "trace-startup-output-name";
+
 #ifdef NDEBUG
 const char kEarlyTracing[] = "early-tracing";
 #endif
 
-}  // namespace tracing
+}  // namespace mojo
diff --git a/mojo/services/tracing/public/cpp/switches.h b/mojo/application/public/cpp/switches.h
similarity index 71%
rename from mojo/services/tracing/public/cpp/switches.h
rename to mojo/application/public/cpp/switches.h
index 8a1e512..0141e9a 100644
--- a/mojo/services/tracing/public/cpp/switches.h
+++ b/mojo/application/public/cpp/switches.h
@@ -2,16 +2,17 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef MOJO_SERVICES_TRACING_PUBLIC_CPP_SWITCHES_H_
-#define MOJO_SERVICES_TRACING_PUBLIC_CPP_SWITCHES_H_
+#ifndef MOJO_APPLICATION_PUBLIC_CPP_SWITCHES_H_
+#define MOJO_APPLICATION_PUBLIC_CPP_SWITCHES_H_
 
-namespace tracing {
+namespace mojo {
 
 // All switches in alphabetical order. The switches should be documented
 // alongside the definition of their values in the .cc file.
 extern const char kEnableStatsCollectionBindings[];
 
 extern const char kTraceStartup[];
+extern const char kTraceStartupOutputName[];
 
 #ifdef NDEBUG
 // In release builds, specifying this flag will force reporting of tracing
@@ -19,6 +20,6 @@
 extern const char kEarlyTracing[];
 #endif
 
-}  // namespace tracing
+}  // namespace mojo
 
-#endif  // MOJO_SERVICES_TRACING_PUBLIC_CPP_SWITCHES_H_
+#endif  // MOJO_APPLICATION_PUBLIC_CPP_SWITCHES_H_
diff --git a/mojo/edk/system/BUILD.gn b/mojo/edk/system/BUILD.gn
index 11a3a8f..1f04f65 100644
--- a/mojo/edk/system/BUILD.gn
+++ b/mojo/edk/system/BUILD.gn
@@ -17,14 +17,6 @@
   ]
 }
 
-mojom("master") {
-  sources = [
-    "master.mojom",
-  ]
-
-  with_environment = false
-}
-
 static_library("system") {
   # TODO(use_chrome_edk): this should be a component to match third_party,
   # but since third_party includes it, we either make it a static library
@@ -56,9 +48,6 @@
     "handle_table.h",
     "mapping_table.cc",
     "mapping_table.h",
-
-    #"master_impl.cc",
-    #"master_impl.h",
     "message_in_transit.cc",
     "message_in_transit.h",
     "message_in_transit_queue.cc",
@@ -100,8 +89,6 @@
   deps = [
     "//base",
     "//base/third_party/dynamic_annotations",
-
-    #":master",
   ]
 
   if (is_win) {
@@ -152,9 +139,6 @@
     "core_unittest.cc",
     "data_pipe_unittest.cc",
     "dispatcher_unittest.cc",
-
-    #"master_impl_unittest.cc",
-
     "message_in_transit_queue_unittest.cc",
     "message_in_transit_test_utils.cc",
     "message_in_transit_test_utils.h",
diff --git a/mojo/edk/system/master.mojom b/mojo/edk/system/master.mojom
deleted file mode 100644
index 0757a8d..0000000
--- a/mojo/edk/system/master.mojom
+++ /dev/null
@@ -1,11 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-module mojo;
-
-interface Master {
-  // These methods are only called on Windows.
-  HandleToToken(handle platform_handle) => (int32 result, uint64 token);
-  TokenToHandle(uint64 token) => (int32 result, handle platform_handle);
-};
diff --git a/mojo/edk/system/master_impl.cc b/mojo/edk/system/master_impl.cc
deleted file mode 100644
index 13b76f2..0000000
--- a/mojo/edk/system/master_impl.cc
+++ /dev/null
@@ -1,107 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "mojo/edk/system/master_impl.h"
-
-#include "base/containers/hash_tables.h"
-#include "base/lazy_instance.h"
-#include "base/logging.h"
-#include "base/rand_util.h"
-#include "mojo/edk/embedder/embedder.h"
-
-#if defined(OS_WIN)
-base::LazyInstance<base::hash_map<uint64_t, HANDLE>>::Leaky
-    g_token_map = LAZY_INSTANCE_INITIALIZER;
-#endif
-
-namespace mojo {
-namespace edk {
-
-MasterImpl::MasterImpl(base::ProcessId slave_pid)
-#if defined(OS_WIN)
-    : slave_process_(
-          base::Process::OpenWithAccess(slave_pid, PROCESS_DUP_HANDLE))
-#endif
-      {
-#if defined(OS_WIN)
-  DCHECK(slave_process_.IsValid());
-#endif
-}
-
-MasterImpl::~MasterImpl() {
-}
-
-void MasterImpl::HandleToToken(ScopedHandle platform_handle,
-                               const HandleToTokenCallback& callback) {
-#if defined(OS_WIN)
-  ScopedPlatformHandle sender_handle;
-  MojoResult unwrap_result = PassWrappedPlatformHandle(
-      platform_handle.get().value(), &sender_handle);
-  if (unwrap_result != MOJO_RESULT_OK) {
-    DLOG(WARNING) << "HandleToToken couldn't unwrap platform handle.";
-    callback.Run(unwrap_result, 0);
-    return;
-  }
-
-  HANDLE master_handle = NULL;
-  BOOL dup_result =
-      DuplicateHandle(slave_process_.Handle(), sender_handle.release().handle,
-                      base::GetCurrentProcessHandle(), &master_handle, 0,
-                      FALSE, DUPLICATE_SAME_ACCESS | DUPLICATE_CLOSE_SOURCE);
-  if (!dup_result) {
-    DLOG(WARNING) << "HandleToToken couldn't duplicate slave handle.";
-    callback.Run(MOJO_RESULT_INVALID_ARGUMENT, 0);
-    return;
-  }
-
-  uint64_t token = base::RandUint64();
-  g_token_map.Get()[token] = master_handle;
-  callback.Run(MOJO_RESULT_OK, token);
-#else
-  NOTREACHED();
-#endif
-}
-
-void MasterImpl::TokenToHandle(uint64_t token,
-                               const TokenToHandleCallback& callback) {
-#if defined(OS_WIN)
-  auto it = g_token_map.Get().find(token);
-  if (it == g_token_map.Get().end()) {
-    DLOG(WARNING) << "TokenToHandle didn't find token.";
-    callback.Run(MOJO_RESULT_INVALID_ARGUMENT, ScopedHandle());
-    return;
-  }
-
-  HANDLE slave_handle = NULL;
-  BOOL dup_result =
-      DuplicateHandle(base::GetCurrentProcessHandle(), it->second,
-                      slave_process_.Handle(), &slave_handle, 0,
-                      FALSE, DUPLICATE_SAME_ACCESS | DUPLICATE_CLOSE_SOURCE);
-  if (!dup_result) {
-    DLOG(WARNING) << "TokenToHandle couldn't duplicate slave handle.";
-    callback.Run(MOJO_RESULT_INTERNAL, ScopedHandle());
-    return;
-  }
-
-  ScopedPlatformHandle platform_handle;
-  platform_handle.reset(PlatformHandle(slave_handle));
-
-  MojoHandle handle;
-  MojoResult wrap_result = CreatePlatformHandleWrapper(
-      platform_handle.Pass(), &handle);
-  if (wrap_result != MOJO_RESULT_OK) {
-    DLOG(WARNING) << "TokenToHandle couldn't unwrap platform handle.";
-    callback.Run(wrap_result, ScopedHandle());
-    return;
-  }
-
-  callback.Run(MOJO_RESULT_OK, ScopedHandle(Handle(handle)));
-  g_token_map.Get().erase(it);
-#else
-  NOTREACHED();
-#endif
-}
-
-}  // namespace edk
-}  // namespace mojo
diff --git a/mojo/edk/system/master_impl.h b/mojo/edk/system/master_impl.h
deleted file mode 100644
index 621db13..0000000
--- a/mojo/edk/system/master_impl.h
+++ /dev/null
@@ -1,43 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef MOJO_EDK_SYSTEM_MASTER_IMPL_H_
-#define MOJO_EDK_SYSTEM_MASTER_IMPL_H_
-
-#include "base/process/process.h"
-#include "mojo/edk/system/master.mojom.h"
-#include "mojo/edk/system/system_impl_export.h"
-#include "mojo/public/cpp/system/macros.h"
-
-#if defined(OS_WIN)
-#include <windows.h>
-#endif
-
-namespace mojo {
-namespace edk {
-
-// An instance of this class exists in the maste process for each slave process.
-class MasterImpl : public Master {
- public:
-  explicit MasterImpl(base::ProcessId slave_pid);
-  ~MasterImpl() override;
-
-  // Master implementation:
-  void HandleToToken(ScopedHandle platform_handle,
-                     const HandleToTokenCallback& callback) override;
-  void TokenToHandle(uint64_t token,
-                     const TokenToHandleCallback& callback) override;
-
- private:
-#if defined(OS_WIN)
-  base::Process slave_process_;
-#endif
-
-  MOJO_DISALLOW_COPY_AND_ASSIGN(MasterImpl);
-};
-
-}  // namespace edk
-}  // namespace mojo
-
-#endif  // MOJO_EDK_SYSTEM_MASTER_IMPL_H_
diff --git a/mojo/edk/system/master_impl_unittest.cc b/mojo/edk/system/master_impl_unittest.cc
deleted file mode 100644
index a0a731e..0000000
--- a/mojo/edk/system/master_impl_unittest.cc
+++ /dev/null
@@ -1,120 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "mojo/edk/system/master_impl.h"
-
-#include "base/files/file_path.h"
-#include "base/files/file_util.h"
-#include "base/files/scoped_file.h"
-#include "base/files/scoped_temp_dir.h"
-#include "mojo/edk/embedder/embedder.h"
-#include "mojo/edk/test/test_utils.h"
-#include "mojo/public/c/system/macros.h"
-#include "testing/gtest/include/gtest/gtest.h"
-
-namespace mojo {
-namespace edk {
-namespace {
-
-static const char kHelloWorld[] = "hello world";
-
-#if defined(OS_WIN)
-
-class MasterImplTest : public ::testing::Test {
- public:
-  MasterImplTest() {}
-
-  // Returns a ScopedHandle to a file with the magic string.
-  ScopedHandle GetScopedHandle() {
-    if (!temp_dir_.IsValid())
-      CHECK(temp_dir_.CreateUniqueTempDir());
-    base::FilePath unused;
-    base::ScopedFILE fp(
-        CreateAndOpenTemporaryFileInDir(temp_dir_.path(), &unused));
-    CHECK(fp);
-    EXPECT_EQ(sizeof(kHelloWorld),
-              fwrite(kHelloWorld, 1, sizeof(kHelloWorld), fp.get()));
-    ScopedPlatformHandle platform_handle(
-        test::PlatformHandleFromFILE(fp.Pass()));
-    CHECK(platform_handle.is_valid());
-
-    MojoHandle handle;
-    MojoResult wrap_result = CreatePlatformHandleWrapper(
-        platform_handle.Pass(), &handle);
-    CHECK(wrap_result == MOJO_RESULT_OK);
-    return ScopedHandle(Handle(handle));
-  }
-
-  // Check that the given ScopedHandle has a file with the magic string.
-  bool CheckScopedHandle(ScopedHandle handle) {
-    ScopedPlatformHandle platform_handle;
-    MojoResult unwrap_result = PassWrappedPlatformHandle(
-        handle.get().value(), &platform_handle);
-    if (unwrap_result != MOJO_RESULT_OK)
-      return false;
-    base::ScopedFILE fp =
-        test::FILEFromPlatformHandle(platform_handle.Pass(), "rb").Pass();
-    if (!fp)
-      return false;
-    rewind(fp.get());
-    char read_buffer[1000] = {};
-    if (fread(read_buffer, 1, sizeof(read_buffer), fp.get()) !=
-        sizeof(kHelloWorld)) {
-      return false;
-    }
-    return std::string(read_buffer) == kHelloWorld;
-  }
-
- private:
-  base::ScopedTempDir temp_dir_;
-};
-
-TEST_F(MasterImplTest, Basic) {
-  MasterImpl master(base::GetCurrentProcId());
-  uint64_t token;
-  master.HandleToToken(GetScopedHandle(),
-                       [&token](int32_t result, uint64_t t) {
-                         ASSERT_EQ(result, MOJO_RESULT_OK);
-                         token = t;
-                       });
-
-  ScopedHandle handle;
-  master.TokenToHandle(token,
-                       [&handle](int32_t result, ScopedHandle h) {
-                         ASSERT_EQ(result, MOJO_RESULT_OK);
-                         handle = h.Pass();
-                       });
-
-  ASSERT_TRUE(CheckScopedHandle(handle.Pass()));
-}
-
-TEST_F(MasterImplTest, TokenIsRemoved) {
-  MasterImpl master(base::GetCurrentProcId());
-  uint64_t token;
-  master.HandleToToken(GetScopedHandle(),
-                       [&token](int32_t result, uint64_t t) {
-                         ASSERT_EQ(result, MOJO_RESULT_OK);
-                         token = t;
-                       });
-
-  ScopedHandle handle;
-  master.TokenToHandle(token,
-                       [&handle](int32_t result, ScopedHandle h) {
-                         ASSERT_EQ(result, MOJO_RESULT_OK);
-                         handle = h.Pass();
-                       });
-
-  ASSERT_TRUE(CheckScopedHandle(handle.Pass()));
-
-  master.TokenToHandle(token,
-                       [&handle](int32_t result, ScopedHandle h) {
-                         ASSERT_EQ(result, MOJO_RESULT_INVALID_ARGUMENT);
-                       });
-}
-
-#endif  // OS_WIN
-
-}  // namespace
-}  // namespace edk
-}  // namespace mojo
diff --git a/mojo/message_pump/handle_watcher_perftest.cc b/mojo/message_pump/handle_watcher_perftest.cc
index 4ea4f26c..10bfd927 100644
--- a/mojo/message_pump/handle_watcher_perftest.cc
+++ b/mojo/message_pump/handle_watcher_perftest.cc
@@ -90,7 +90,7 @@
 }
 
 TEST_P(HandleWatcherPerftest, StartStop) {
-  const uint64_t kIterations = 1000;
+  const uint64_t kIterations = 100000;
   MessagePipe pipe;
   HandleWatcher watcher;
 
@@ -103,7 +103,8 @@
 }
 
 TEST_P(HandleWatcherPerftest, StartAllThenStop_1000Handles) {
-  const uint64_t kIterations = 1000;
+  const uint64_t kIterations = 10;
+  const uint64_t kHandles = 1000;
 
   struct TestData {
     MessagePipe pipe;
@@ -112,28 +113,30 @@
   ScopedVector<TestData> data_vector;
   // Create separately from the start/stop loops to avoid affecting the
   // benchmark.
-  for (uint64_t i = 0; i < kIterations; i++) {
+  for (uint64_t i = 0; i < kHandles; i++) {
     scoped_ptr<TestData> test_data(new TestData);
     ASSERT_TRUE(test_data->pipe.handle0.is_valid());
     data_vector.push_back(test_data.Pass());
   }
 
   ScopedPerfTimer timer("StartAllThenStop_1000Handles", GetMessageLoopName(),
-                        kIterations);
-  for (uint64_t i = 0; i < kIterations; i++) {
-    TestData* test_data = data_vector[i];
-    test_data->watcher.Start(
-        test_data->pipe.handle0.get(), MOJO_HANDLE_SIGNAL_READABLE,
-        MOJO_DEADLINE_INDEFINITE, base::Bind(&NeverReached));
-  }
-  for (uint64_t i = 0; i < kIterations; i++) {
-    TestData* test_data = data_vector[i];
-    test_data->watcher.Stop();
+                        kIterations * kHandles);
+  for (uint64_t iter = 0; iter < kIterations; iter++) {
+    for (uint64_t i = 0; i < kHandles; i++) {
+      TestData* test_data = data_vector[i];
+      test_data->watcher.Start(
+          test_data->pipe.handle0.get(), MOJO_HANDLE_SIGNAL_READABLE,
+          MOJO_DEADLINE_INDEFINITE, base::Bind(&NeverReached));
+    }
+    for (uint64_t i = 0; i < kHandles; i++) {
+      TestData* test_data = data_vector[i];
+      test_data->watcher.Stop();
+    }
   }
 }
 
 TEST_P(HandleWatcherPerftest, StartAndSignal) {
-  const uint64_t kIterations = 1000;
+  const uint64_t kIterations = 10000;
   const std::string kMessage = "hello";
   MessagePipe pipe;
   HandleWatcher watcher;
diff --git a/mojo/message_pump/message_pump_mojo.cc b/mojo/message_pump/message_pump_mojo.cc
index a24349b..248c33a4 100644
--- a/mojo/message_pump/message_pump_mojo.cc
+++ b/mojo/message_pump/message_pump_mojo.cc
@@ -43,16 +43,10 @@
 };
 
 struct MessagePumpMojo::RunState {
-  RunState() : should_quit(false) {
-    CreateMessagePipe(NULL, &read_handle, &write_handle);
-  }
+  RunState() : should_quit(false) {}
 
   base::TimeTicks delayed_work_time;
 
-  // Used to wake up WaitForWork().
-  ScopedMessagePipeHandle read_handle;
-  ScopedMessagePipeHandle write_handle;
-
   bool should_quit;
 };
 
@@ -60,6 +54,11 @@
   DCHECK(!current())
       << "There is already a MessagePumpMojo instance on this thread.";
   g_tls_current_pump.Pointer()->Set(this);
+
+  MojoResult result = CreateMessagePipe(nullptr, &read_handle_, &write_handle_);
+  CHECK_EQ(result, MOJO_RESULT_OK);
+  CHECK(read_handle_.is_valid());
+  CHECK(write_handle_.is_valid());
 }
 
 MessagePumpMojo::~MessagePumpMojo() {
@@ -107,9 +106,6 @@
 
 void MessagePumpMojo::Run(Delegate* delegate) {
   RunState run_state;
-  // TODO: better deal with error handling.
-  CHECK(run_state.read_handle.is_valid());
-  CHECK(run_state.write_handle.is_valid());
   RunState* old_state = NULL;
   {
     base::AutoLock auto_lock(run_state_lock_);
@@ -130,9 +126,7 @@
 }
 
 void MessagePumpMojo::ScheduleWork() {
-  base::AutoLock auto_lock(run_state_lock_);
-  if (run_state_)
-    SignalControlPipe(*run_state_);
+  SignalControlPipe();
 }
 
 void MessagePumpMojo::ScheduleDelayedWork(
@@ -172,7 +166,7 @@
 
 bool MessagePumpMojo::DoInternalWork(const RunState& run_state, bool block) {
   const MojoDeadline deadline = block ? GetDeadlineForWait(run_state) : 0;
-  const WaitState wait_state = GetWaitState(run_state);
+  const WaitState wait_state = GetWaitState();
 
   const WaitManyResult wait_many_result =
       WaitMany(wait_state.handles, wait_state.wait_signals, deadline, nullptr);
@@ -181,7 +175,7 @@
   if (result == MOJO_RESULT_OK) {
     if (wait_many_result.index == 0) {
       // Control pipe was written to.
-      ReadMessageRaw(run_state.read_handle.get(), NULL, NULL, NULL, NULL,
+      ReadMessageRaw(read_handle_.get(), NULL, NULL, NULL, NULL,
                      MOJO_READ_MESSAGE_FLAG_MAY_DISCARD);
     } else {
       DCHECK(handlers_.find(wait_state.handles[wait_many_result.index]) !=
@@ -247,19 +241,18 @@
   DidSignalHandler();
 }
 
-void MessagePumpMojo::SignalControlPipe(const RunState& run_state) {
+void MessagePumpMojo::SignalControlPipe() {
   const MojoResult result =
-      WriteMessageRaw(run_state.write_handle.get(), NULL, 0, NULL, 0,
+      WriteMessageRaw(write_handle_.get(), NULL, 0, NULL, 0,
                       MOJO_WRITE_MESSAGE_FLAG_NONE);
   // If we can't write we likely won't wake up the thread and there is a strong
   // chance we'll deadlock.
   CHECK_EQ(MOJO_RESULT_OK, result);
 }
 
-MessagePumpMojo::WaitState MessagePumpMojo::GetWaitState(
-    const RunState& run_state) const {
+MessagePumpMojo::WaitState MessagePumpMojo::GetWaitState() const {
   WaitState wait_state;
-  wait_state.handles.push_back(run_state.read_handle.get());
+  wait_state.handles.push_back(read_handle_.get());
   wait_state.wait_signals.push_back(MOJO_HANDLE_SIGNAL_READABLE);
 
   for (HandleToHandler::const_iterator i = handlers_.begin();
diff --git a/mojo/message_pump/message_pump_mojo.h b/mojo/message_pump/message_pump_mojo.h
index 06869730..5e7eb6c 100644
--- a/mojo/message_pump/message_pump_mojo.h
+++ b/mojo/message_pump/message_pump_mojo.h
@@ -97,9 +97,9 @@
                            MojoResult result,
                            uint32_t result_index);
 
-  void SignalControlPipe(const RunState& run_state);
+  void SignalControlPipe();
 
-  WaitState GetWaitState(const RunState& run_state) const;
+  WaitState GetWaitState() const;
 
   // Returns the deadline for the call to MojoWaitMany().
   MojoDeadline GetDeadlineForWait(const RunState& run_state) const;
@@ -127,6 +127,10 @@
 
   base::ObserverList<Observer> observers_;
 
+  // Used to wake up run loop from |SignalControlPipe()|.
+  ScopedMessagePipeHandle read_handle_;
+  ScopedMessagePipeHandle write_handle_;
+
   DISALLOW_COPY_AND_ASSIGN(MessagePumpMojo);
 };
 
diff --git a/mojo/mojo_base.gyp b/mojo/mojo_base.gyp
index 9c308c6..9317698 100644
--- a/mojo/mojo_base.gyp
+++ b/mojo/mojo_base.gyp
@@ -241,8 +241,14 @@
         'application/public/cpp/lib/service_provider_impl.cc',
         'application/public/cpp/lib/service_registry.cc',
         'application/public/cpp/lib/service_registry.h',
+        'application/public/cpp/lib/trace_provider_impl.cc',
+        'application/public/cpp/lib/trace_provider_impl.h',
+        'application/public/cpp/lib/tracing_impl.cc',
+        'application/public/cpp/lib/tracing_impl.h',
         'application/public/cpp/service_connector.h',
         'application/public/cpp/service_provider_impl.h',
+        'application/public/cpp/switches.cc',
+        'application/public/cpp/switches.h',
       ],
       'dependencies': [
         'mojo_application_bindings',
@@ -256,6 +262,7 @@
       'dependencies': [
         'mojo_application_bindings_mojom',
         'mojo_services.gyp:network_service_bindings_lib',
+        'mojo_services.gyp:tracing_service_bindings_lib',
         '../third_party/mojo/mojo_public.gyp:mojo_cpp_bindings',
       ],
       'export_dependent_settings': [
diff --git a/mojo/mojo_services.gyp b/mojo/mojo_services.gyp
index cb6c2fc9..565f7dd 100644
--- a/mojo/mojo_services.gyp
+++ b/mojo/mojo_services.gyp
@@ -50,6 +50,27 @@
       ],
     },
     {
+      'target_name': 'tracing_service_bindings_mojom',
+      'type': 'none',
+      'variables': {
+        'mojom_files': [
+          'services/tracing/public/interfaces/tracing.mojom',
+        ],
+        'mojom_include_path': '<(DEPTH)/mojo/services',
+      },
+      'includes': [
+        '../third_party/mojo/mojom_bindings_generator_explicit.gypi',
+      ],
+    },
+    {
+      # GN version: //mojo/services/tracing/public/interfaces
+      'target_name': 'tracing_service_bindings_lib',
+      'type': 'static_library',
+      'dependencies': [
+        'tracing_service_bindings_mojom',
+      ],
+    },
+    {
       'target_name': 'updater_bindings_mojom',
       'type': 'none',
       'variables': {
diff --git a/mojo/public/cpp/bindings/BUILD.gn b/mojo/public/cpp/bindings/BUILD.gn
index 6438960..2d4064b 100644
--- a/mojo/public/cpp/bindings/BUILD.gn
+++ b/mojo/public/cpp/bindings/BUILD.gn
@@ -30,6 +30,7 @@
     "lib/filter_chain.h",
     "lib/fixed_buffer.cc",
     "lib/fixed_buffer.h",
+    "lib/interface_id.h",
     "lib/interface_ptr_internal.h",
     "lib/map_data_internal.h",
     "lib/map_internal.h",
@@ -42,6 +43,11 @@
     "lib/message_header_validator.h",
     "lib/message_internal.h",
     "lib/no_interface.cc",
+    "lib/pipe_control_message_handler.cc",
+    "lib/pipe_control_message_handler.h",
+    "lib/pipe_control_message_handler_delegate.h",
+    "lib/pipe_control_message_proxy.cc",
+    "lib/pipe_control_message_proxy.h",
     "lib/router.cc",
     "lib/router.h",
     "lib/string_serialization.cc",
@@ -69,6 +75,7 @@
   ]
 
   deps = [
+    "//base",
     "//mojo/public/cpp/environment",
     "//mojo/public/interfaces/bindings:bindings_cpp_sources",
   ]
diff --git a/mojo/public/cpp/bindings/lib/bindings_internal.h b/mojo/public/cpp/bindings/lib/bindings_internal.h
index 436f580..e00c2ab4 100644
--- a/mojo/public/cpp/bindings/lib/bindings_internal.h
+++ b/mojo/public/cpp/bindings/lib/bindings_internal.h
@@ -5,6 +5,7 @@
 #ifndef MOJO_PUBLIC_CPP_BINDINGS_LIB_BINDINGS_INTERNAL_H_
 #define MOJO_PUBLIC_CPP_BINDINGS_LIB_BINDINGS_INTERNAL_H_
 
+#include "mojo/public/cpp/bindings/lib/interface_id.h"
 #include "mojo/public/cpp/bindings/lib/template_util.h"
 #include "mojo/public/cpp/bindings/struct_ptr.h"
 #include "mojo/public/cpp/system/core.h"
@@ -64,13 +65,13 @@
 static_assert(sizeof(Interface_Data) == 8, "Bad_sizeof(Interface_Data)");
 
 struct AssociatedInterface_Data {
-  uint32_t interface_id;
+  InterfaceId interface_id;
   uint32_t version;
 };
 static_assert(sizeof(AssociatedInterface_Data) == 8,
               "Bad_sizeof(AssociatedInterface_Data)");
 
-using AssociatedInterfaceRequest_Data = uint32_t;
+using AssociatedInterfaceRequest_Data = InterfaceId;
 
 #pragma pack(pop)
 
diff --git a/mojo/public/cpp/bindings/lib/interface_id.h b/mojo/public/cpp/bindings/lib/interface_id.h
new file mode 100644
index 0000000..9baeedf
--- /dev/null
+++ b/mojo/public/cpp/bindings/lib/interface_id.h
@@ -0,0 +1,37 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MOJO_PUBLIC_CPP_BINDINGS_LIB_INTERFACE_ID_H_
+#define MOJO_PUBLIC_CPP_BINDINGS_LIB_INTERFACE_ID_H_
+
+#include <stdint.h>
+
+namespace mojo {
+namespace internal {
+
+// The size of the type matters because it is directly used in messages.
+using InterfaceId = uint32_t;
+
+// IDs of associated interface can be generated at both sides of the message
+// pipe. In order to avoid collision, the highest bit is used as namespace bit:
+// at the side where the client-side of the master interface lives, IDs are
+// generated with the namespace bit set to 1; at the opposite side IDs are
+// generated with the namespace bit set to 0.
+const uint32_t kInterfaceIdNamespaceMask = 0x80000000;
+
+const InterfaceId kMasterInterfaceId = 0x00000000;
+const InterfaceId kInvalidInterfaceId = 0xFFFFFFFF;
+
+inline bool IsMasterInterfaceId(InterfaceId id) {
+  return id == kMasterInterfaceId;
+}
+
+inline bool IsValidInterfaceId(InterfaceId id) {
+  return id != kInvalidInterfaceId;
+}
+
+}  // namespace internal
+}  // namespace mojo
+
+#endif  // MOJO_PUBLIC_CPP_BINDINGS_LIB_INTERFACE_ID_H_
diff --git a/mojo/public/cpp/bindings/lib/pipe_control_message_handler.cc b/mojo/public/cpp/bindings/lib/pipe_control_message_handler.cc
new file mode 100644
index 0000000..be996121
--- /dev/null
+++ b/mojo/public/cpp/bindings/lib/pipe_control_message_handler.cc
@@ -0,0 +1,75 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "mojo/public/cpp/bindings/lib/pipe_control_message_handler.h"
+
+#include "base/logging.h"
+#include "mojo/public/cpp/bindings/lib/message_builder.h"
+#include "mojo/public/cpp/bindings/lib/pipe_control_message_handler_delegate.h"
+#include "mojo/public/cpp/bindings/lib/validation_util.h"
+#include "mojo/public/interfaces/bindings/pipe_control_messages.mojom.h"
+
+namespace mojo {
+namespace internal {
+
+PipeControlMessageHandler::PipeControlMessageHandler(
+    PipeControlMessageHandlerDelegate* delegate)
+    : delegate_(delegate) {}
+
+PipeControlMessageHandler::~PipeControlMessageHandler() {}
+
+// static
+bool PipeControlMessageHandler::IsPipeControlMessage(const Message* message) {
+  return !IsValidInterfaceId(message->interface_id());
+}
+
+bool PipeControlMessageHandler::Accept(Message* message) {
+  if (!Validate(message))
+    return false;
+
+  if (message->name() == pipe_control::kRunOrClosePipeMessageId)
+    return RunOrClosePipe(message);
+
+  NOTREACHED();
+  return false;
+}
+
+bool PipeControlMessageHandler::Validate(const Message* message) {
+  if (message->name() == pipe_control::kRunOrClosePipeMessageId) {
+    if (!ValidateMessageIsRequestWithoutResponse(message))
+      return false;
+    return ValidateMessagePayload<
+        pipe_control::internal::RunOrClosePipeMessageParams_Data>(message);
+  }
+
+  return false;
+}
+
+bool PipeControlMessageHandler::RunOrClosePipe(Message* message) {
+  pipe_control::internal::RunOrClosePipeMessageParams_Data* params =
+      reinterpret_cast<
+          pipe_control::internal::RunOrClosePipeMessageParams_Data*>(
+          message->mutable_payload());
+  params->DecodePointersAndHandles(message->mutable_handles());
+
+  pipe_control::RunOrClosePipeMessageParamsPtr params_ptr;
+  Deserialize_(params, &params_ptr);
+
+  if (params_ptr->input->is_peer_associated_endpoint_closed_event()) {
+    return delegate_->OnPeerAssociatedEndpointClosed(
+        params_ptr->input->get_peer_associated_endpoint_closed_event()->id);
+  }
+  if (params_ptr->input->is_associated_endpoint_closed_before_sent_event()) {
+    return delegate_->OnAssociatedEndpointClosedBeforeSent(
+        params_ptr->input->get_associated_endpoint_closed_before_sent_event()
+            ->id);
+  }
+
+  DVLOG(1) << "Unsupported command in a RunOrClosePipe message pipe control "
+           << "message. Closing the pipe.";
+  return false;
+}
+
+}  // namespace internal
+}  // namespace mojo
diff --git a/mojo/public/cpp/bindings/lib/pipe_control_message_handler.h b/mojo/public/cpp/bindings/lib/pipe_control_message_handler.h
new file mode 100644
index 0000000..091e7c2
--- /dev/null
+++ b/mojo/public/cpp/bindings/lib/pipe_control_message_handler.h
@@ -0,0 +1,48 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MOJO_PUBLIC_CPP_BINDINGS_LIB_PIPE_CONTROL_MESSAGE_HANDLER_H_
+#define MOJO_PUBLIC_CPP_BINDINGS_LIB_PIPE_CONTROL_MESSAGE_HANDLER_H_
+
+#include "base/macros.h"
+#include "mojo/public/cpp/bindings/lib/interface_id.h"
+#include "mojo/public/cpp/bindings/message.h"
+
+namespace mojo {
+namespace internal {
+
+class PipeControlMessageHandlerDelegate;
+
+// Handler for messages defined in pipe_control_messages.mojom.
+class PipeControlMessageHandler : public MessageReceiver {
+ public:
+  explicit PipeControlMessageHandler(
+      PipeControlMessageHandlerDelegate* delegate);
+  ~PipeControlMessageHandler() override;
+
+  // NOTE: |message| must have passed message header validation.
+  static bool IsPipeControlMessage(const Message* message);
+
+  // MessageReceiver implementation:
+
+  // NOTE: |message| must:
+  //   - have passed message header validation; and
+  //   - be a pipe control message (i.e., IsPipeControlMessage() returns true).
+  // If the method returns false, the message pipe should be closed.
+  bool Accept(Message* message) override;
+
+ private:
+  // |message| must have passed message header validation.
+  bool Validate(const Message* message);
+  bool RunOrClosePipe(Message* message);
+
+  PipeControlMessageHandlerDelegate* const delegate_;
+
+  DISALLOW_COPY_AND_ASSIGN(PipeControlMessageHandler);
+};
+
+}  // namespace internal
+}  // namespace mojo
+
+#endif  // MOJO_PUBLIC_CPP_BINDINGS_LIB_PIPE_CONTROL_MESSAGE_HANDLER_H_
diff --git a/mojo/public/cpp/bindings/lib/pipe_control_message_handler_delegate.h b/mojo/public/cpp/bindings/lib/pipe_control_message_handler_delegate.h
new file mode 100644
index 0000000..f84be56
--- /dev/null
+++ b/mojo/public/cpp/bindings/lib/pipe_control_message_handler_delegate.h
@@ -0,0 +1,28 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MOJO_PUBLIC_CPP_BINDINGS_LIB_PIPE_CONTROL_MESSAGE_HANDLER_DELEGATE_H_
+#define MOJO_PUBLIC_CPP_BINDINGS_LIB_PIPE_CONTROL_MESSAGE_HANDLER_DELEGATE_H_
+
+#include "mojo/public/cpp/bindings/lib/interface_id.h"
+
+namespace mojo {
+namespace internal {
+
+class PipeControlMessageHandlerDelegate {
+ public:
+  // The implementation of the following methods should return false if the
+  // notification is unexpected. In that case, the user of this delegate is
+  // expected to close the message pipe.
+  virtual bool OnPeerAssociatedEndpointClosed(InterfaceId id) = 0;
+  virtual bool OnAssociatedEndpointClosedBeforeSent(InterfaceId id) = 0;
+
+ protected:
+  virtual ~PipeControlMessageHandlerDelegate() {}
+};
+
+}  // namespace internal
+}  // namespace mojo
+
+#endif  // MOJO_PUBLIC_CPP_BINDINGS_LIB_PIPE_CONTROL_MESSAGE_HANDLER_DELEGATE_H_
diff --git a/mojo/public/cpp/bindings/lib/pipe_control_message_proxy.cc b/mojo/public/cpp/bindings/lib/pipe_control_message_proxy.cc
new file mode 100644
index 0000000..bcd5cfa
--- /dev/null
+++ b/mojo/public/cpp/bindings/lib/pipe_control_message_proxy.cc
@@ -0,0 +1,65 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "mojo/public/cpp/bindings/lib/pipe_control_message_proxy.h"
+
+#include "base/compiler_specific.h"
+#include "mojo/public/cpp/bindings/lib/message_builder.h"
+#include "mojo/public/cpp/bindings/message.h"
+#include "mojo/public/interfaces/bindings/pipe_control_messages.mojom.h"
+
+namespace mojo {
+namespace internal {
+namespace {
+
+void SendRunOrClosePipeMessage(MessageReceiver* receiver,
+                               pipe_control::RunOrClosePipeInputPtr input) {
+  pipe_control::RunOrClosePipeMessageParamsPtr params_ptr(
+      pipe_control::RunOrClosePipeMessageParams::New());
+  params_ptr->input = input.Pass();
+
+  size_t size = GetSerializedSize_(params_ptr);
+  MessageBuilder builder(pipe_control::kRunOrClosePipeMessageId, size);
+
+  pipe_control::internal::RunOrClosePipeMessageParams_Data* params = nullptr;
+  Serialize_(params_ptr.Pass(), builder.buffer(), &params);
+  params->EncodePointersAndHandles(builder.message()->mutable_handles());
+  builder.message()->set_interface_id(kInvalidInterfaceId);
+  bool ok = receiver->Accept(builder.message());
+  // This return value may be ignored as !ok implies the underlying message pipe
+  // has encountered an error, which will be visible through other means.
+  ALLOW_UNUSED_LOCAL(ok);
+}
+
+}  // namespace
+
+PipeControlMessageProxy::PipeControlMessageProxy(MessageReceiver* receiver)
+    : receiver_(receiver) {}
+
+void PipeControlMessageProxy::NotifyPeerEndpointClosed(InterfaceId id) {
+  pipe_control::PeerAssociatedEndpointClosedEventPtr event(
+      pipe_control::PeerAssociatedEndpointClosedEvent::New());
+  event->id = id;
+
+  pipe_control::RunOrClosePipeInputPtr input(
+      pipe_control::RunOrClosePipeInput::New());
+  input->set_peer_associated_endpoint_closed_event(event.Pass());
+
+  SendRunOrClosePipeMessage(receiver_, input.Pass());
+}
+
+void PipeControlMessageProxy::NotifyEndpointClosedBeforeSent(InterfaceId id) {
+  pipe_control::AssociatedEndpointClosedBeforeSentEventPtr event(
+      pipe_control::AssociatedEndpointClosedBeforeSentEvent::New());
+  event->id = id;
+
+  pipe_control::RunOrClosePipeInputPtr input(
+      pipe_control::RunOrClosePipeInput::New());
+  input->set_associated_endpoint_closed_before_sent_event(event.Pass());
+
+  SendRunOrClosePipeMessage(receiver_, input.Pass());
+}
+
+}  // namespace internal
+}  // namespace mojo
diff --git a/mojo/public/cpp/bindings/lib/pipe_control_message_proxy.h b/mojo/public/cpp/bindings/lib/pipe_control_message_proxy.h
new file mode 100644
index 0000000..3804c4c
--- /dev/null
+++ b/mojo/public/cpp/bindings/lib/pipe_control_message_proxy.h
@@ -0,0 +1,36 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef MOJO_PUBLIC_CPP_BINDINGS_LIB_PIPE_CONTROL_MESSAGE_PROXY_H_
+#define MOJO_PUBLIC_CPP_BINDINGS_LIB_PIPE_CONTROL_MESSAGE_PROXY_H_
+
+#include "base/macros.h"
+#include "mojo/public/cpp/bindings/lib/interface_id.h"
+
+namespace mojo {
+
+class MessageReceiver;
+
+namespace internal {
+
+// Proxy for request messages defined in pipe_control_messages.mojom.
+class PipeControlMessageProxy {
+ public:
+  // Doesn't take ownership of |receiver|. It must outlive this object.
+  explicit PipeControlMessageProxy(MessageReceiver* receiver);
+
+  void NotifyPeerEndpointClosed(InterfaceId id);
+  void NotifyEndpointClosedBeforeSent(InterfaceId id);
+
+ private:
+  // Not owned.
+  MessageReceiver* receiver_;
+
+  DISALLOW_COPY_AND_ASSIGN(PipeControlMessageProxy);
+};
+
+}  // namespace internal
+}  // namespace mojo
+
+#endif  // MOJO_PUBLIC_CPP_BINDINGS_LIB_PIPE_CONTROL_MESSAGE_PROXY_H_
diff --git a/mojo/public/cpp/bindings/message.h b/mojo/public/cpp/bindings/message.h
index 7e34606..b0a403b3 100644
--- a/mojo/public/cpp/bindings/message.h
+++ b/mojo/public/cpp/bindings/message.h
@@ -40,6 +40,9 @@
   // Access the header.
   const internal::MessageHeader* header() const { return &data_->header; }
 
+  uint32_t interface_id() const { return data_->header.interface_id; }
+  void set_interface_id(uint32_t id) { data_->header.interface_id = id; }
+
   uint32_t name() const { return data_->header.name; }
   bool has_flag(uint32_t flag) const { return !!(data_->header.flags & flag); }
 
diff --git a/mojo/public/interfaces/bindings/BUILD.gn b/mojo/public/interfaces/bindings/BUILD.gn
index 6d755ea..f0f12f93 100644
--- a/mojo/public/interfaces/bindings/BUILD.gn
+++ b/mojo/public/interfaces/bindings/BUILD.gn
@@ -7,6 +7,7 @@
 mojom("bindings") {
   sources = [
     "interface_control_messages.mojom",
+    "pipe_control_messages.mojom",
   ]
 
   with_environment = false
diff --git a/mojo/public/interfaces/bindings/interface_control_messages.mojom b/mojo/public/interfaces/bindings/interface_control_messages.mojom
index 10bd269..2143c06 100644
--- a/mojo/public/interfaces/bindings/interface_control_messages.mojom
+++ b/mojo/public/interfaces/bindings/interface_control_messages.mojom
@@ -2,13 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-[DartPackage="mojo", JavaPackage="org.chromium.mojo.bindings"]
+[JavaPackage="org.chromium.mojo.bindings"]
 module mojo;
 
-// For each message pipe representing a user-defined interface, some control
-// functions are provided at the same end of the message pipe as the
-// user-defined interface, providing information about the user-defined
-// interface and controlling behavior of the message pipe.
+// For each user-defined interface, some control functions are provided at the
+// same end of the message pipe as the user-defined interface, providing
+// information about the user-defined interface.
 
 ////////////////////////////////////////////////////////////////////////////////
 // Run@0xFFFFFFFF(RunInput input) => (RunOutput? output);
diff --git a/mojo/public/interfaces/bindings/pipe_control_messages.mojom b/mojo/public/interfaces/bindings/pipe_control_messages.mojom
new file mode 100644
index 0000000..c743ffe
--- /dev/null
+++ b/mojo/public/interfaces/bindings/pipe_control_messages.mojom
@@ -0,0 +1,50 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+[JavaPackage="org.chromium.mojo.bindings.pipecontrol"]
+module mojo.pipe_control;
+
+// For each message pipe running user-defined interfaces, some control
+// functions are provided and used by the routers at both ends of the pipe, so
+// that they can coordinate to manage interface endpoints.
+// All these control messages will have the interface ID field in the message
+// header set to invalid.
+
+////////////////////////////////////////////////////////////////////////////////
+// RunOrClosePipe@0xFFFFFFFE(RunOrClosePipeInput input);
+//
+// This control function runs the input command. If the operation fails or the
+// command is not supported, the message pipe is closed.
+
+const uint32 kRunOrClosePipeMessageId = 0xFFFFFFFE;
+
+struct RunOrClosePipeMessageParams {
+  RunOrClosePipeInput input;
+};
+
+union RunOrClosePipeInput {
+  PeerAssociatedEndpointClosedEvent peer_associated_endpoint_closed_event;
+  AssociatedEndpointClosedBeforeSentEvent
+      associated_endpoint_closed_before_sent_event;
+};
+
+// An event to notify that an interface endpoint set up at the message sender
+// side has been closed.
+// 
+// This event is only used for associated interfaces. When a master interface
+// is closed, the message pipe is shutdown directly.
+struct PeerAssociatedEndpointClosedEvent {
+  // The interface ID.
+  uint32 id;
+};
+
+// An event to notify that an interface endpoint that is meant to be set up at
+// the message receiver side has been closed before sent over the message pipe.
+//
+// This event is only used for associated interfaces.
+struct AssociatedEndpointClosedBeforeSentEvent {
+  // The interface ID.
+  uint32 id;
+};
+
diff --git a/mojo/public/tools/bindings/generators/java_templates/data_types_definition.tmpl b/mojo/public/tools/bindings/generators/java_templates/data_types_definition.tmpl
index e9c3b65..cd4ee86 100644
--- a/mojo/public/tools/bindings/generators/java_templates/data_types_definition.tmpl
+++ b/mojo/public/tools/bindings/generators/java_templates/data_types_definition.tmpl
@@ -292,6 +292,9 @@
                 break;
             }
 {%   endfor %}
+            default: {
+                break;
+            }
         }
     }
 
@@ -320,6 +323,9 @@
                 break;
             }
 {%   endfor %}
+            default: {
+                break;
+            }
         }
         return result;
     }
@@ -343,6 +349,8 @@
             case {{field.ordinal}}:
                 return {{equality(field.kind, 'm'~field|ucc, 'other.m'~field|ucc)}};
 {%   endfor %}
+            default:
+                break;
         }
         return false;
     }
@@ -357,9 +365,14 @@
         result = prime * result + org.chromium.mojo.bindings.BindingsHelper.hashCode(mTag_);
         switch (mTag_) {
 {%   for field in union.fields %}
-            case {{field.ordinal}}:
+            case {{field.ordinal}}: {
                 result = prime * result + {{hash(field.kind, 'm'~field|ucc)}};
+                break;
+            }
 {%   endfor %}
+            default: {
+                break;
+            }
         }
         return result;
     }
diff --git a/mojo/runner/BUILD.gn b/mojo/runner/BUILD.gn
index 49efb46..588e997 100644
--- a/mojo/runner/BUILD.gn
+++ b/mojo/runner/BUILD.gn
@@ -135,7 +135,6 @@
     "//mojo/runner/child:interfaces",
     "//mojo/runner/host:lib",
     "//mojo/services/network/public/interfaces",
-    "//mojo/services/tracing/public/cpp",
     "//mojo/services/tracing/public/interfaces",
     "//mojo/shell",
     "//mojo/util:filename_util",
diff --git a/mojo/runner/context.cc b/mojo/runner/context.cc
index a21323b0..1a9dca6 100644
--- a/mojo/runner/context.cc
+++ b/mojo/runner/context.cc
@@ -27,6 +27,8 @@
 #include "mojo/application/public/cpp/application_connection.h"
 #include "mojo/application/public/cpp/application_delegate.h"
 #include "mojo/application/public/cpp/application_impl.h"
+#include "mojo/application/public/cpp/lib/trace_provider_impl.h"
+#include "mojo/application/public/cpp/switches.h"
 #include "mojo/package_manager/package_manager_impl.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
 #include "mojo/runner/host/in_process_native_runner.h"
@@ -34,9 +36,6 @@
 #include "mojo/runner/register_local_aliases.h"
 #include "mojo/runner/switches.h"
 #include "mojo/runner/tracer.h"
-#include "mojo/services/tracing/public/cpp/switches.h"
-#include "mojo/services/tracing/public/cpp/trace_provider_impl.h"
-#include "mojo/services/tracing/public/cpp/tracing_impl.h"
 #include "mojo/services/tracing/public/interfaces/tracing.mojom.h"
 #include "mojo/shell/application_loader.h"
 #include "mojo/shell/connect_to_application_params.h"
@@ -193,10 +192,12 @@
 
   bool trace_startup = command_line.HasSwitch(switches::kTraceStartup);
   if (trace_startup) {
+    std::string output_name =
+        command_line.GetSwitchValueASCII(mojo::kTraceStartupOutputName);
     tracer_.Start(
         command_line.GetSwitchValueASCII(switches::kTraceStartup),
         command_line.GetSwitchValueASCII(switches::kTraceStartupDuration),
-        "mojo_runner.trace");
+        output_name.empty() ? "mojo_runner.trace" : output_name);
   }
 
   // ICU data is a thing every part of the system needs. This here warms
@@ -249,7 +250,7 @@
   params->set_exposed_services(tracing_exposed_services.Pass());
   application_manager_->ConnectToApplication(params.Pass());
 
-  if (command_line.HasSwitch(tracing::kTraceStartup)) {
+  if (command_line.HasSwitch(switches::kTraceStartup)) {
     tracing::TraceCollectorPtr coordinator;
     auto coordinator_request = GetProxy(&coordinator);
     tracing_services->ConnectToService(tracing::TraceCollector::Name_,
@@ -259,7 +260,7 @@
 
   // Record the shell startup metrics used for performance testing.
   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
-          tracing::kEnableStatsCollectionBindings)) {
+          mojo::kEnableStatsCollectionBindings)) {
     tracing::StartupPerformanceDataCollectorPtr collector;
     tracing_services->ConnectToService(
         tracing::StartupPerformanceDataCollector::Name_,
diff --git a/mojo/runner/tracer.h b/mojo/runner/tracer.h
index 6fd8b1c..56ab7cc5 100644
--- a/mojo/runner/tracer.h
+++ b/mojo/runner/tracer.h
@@ -12,8 +12,8 @@
 #include "base/callback.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted_memory.h"
+#include "mojo/application/public/cpp/lib/trace_provider_impl.h"
 #include "mojo/common/data_pipe_drainer.h"
-#include "mojo/services/tracing/public/cpp/trace_provider_impl.h"
 #include "mojo/services/tracing/public/interfaces/tracing.mojom.h"
 
 namespace mojo {
diff --git a/mojo/services/tracing/public/cpp/BUILD.gn b/mojo/services/tracing/public/cpp/BUILD.gn
deleted file mode 100644
index 02eed11a..0000000
--- a/mojo/services/tracing/public/cpp/BUILD.gn
+++ /dev/null
@@ -1,21 +0,0 @@
-# Copyright 2015 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-source_set("cpp") {
-  sources = [
-    "switches.cc",
-    "switches.h",
-    "trace_provider_impl.cc",
-    "trace_provider_impl.h",
-    "tracing_impl.cc",
-    "tracing_impl.h",
-  ]
-
-  deps = [
-    "//base",
-    "//mojo/application/public/cpp",
-    "//mojo/public/cpp/bindings",
-    "//mojo/services/tracing/public/interfaces",
-  ]
-}
diff --git a/mojo/shell/BUILD.gn b/mojo/shell/BUILD.gn
index 8478000..5892d64b 100644
--- a/mojo/shell/BUILD.gn
+++ b/mojo/shell/BUILD.gn
@@ -101,6 +101,7 @@
     "//mojo/package_manager",
     "//mojo/public/cpp/system",
     "//mojo/util:filename_util",
+    "//mojo/services/tracing:lib",
     "//third_party/mojo/src/mojo/edk/test:run_all_unittests",
     "//testing/gtest",
     "//url",
diff --git a/mojo/shell/application_manager_unittest.cc b/mojo/shell/application_manager_unittest.cc
index e13f616f..2cc6b55 100644
--- a/mojo/shell/application_manager_unittest.cc
+++ b/mojo/shell/application_manager_unittest.cc
@@ -14,6 +14,7 @@
 #include "mojo/application/public/cpp/interface_factory.h"
 #include "mojo/application/public/interfaces/service_provider.mojom.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
+#include "mojo/services/tracing/tracing_app.h"
 #include "mojo/shell/application_loader.h"
 #include "mojo/shell/application_manager.h"
 #include "mojo/shell/connect_util.h"
@@ -137,6 +138,15 @@
   DISALLOW_COPY_AND_ASSIGN(TestApplicationLoader);
 };
 
+class TracingApplicationLoader : public ApplicationLoader {
+ private:
+  // ApplicationLoader implementation.
+  void Load(const GURL& url,
+            InterfaceRequest<Application> application_request) override {
+    new ApplicationImpl(new tracing::TracingApp, application_request.Pass());
+  }
+};
+
 class ClosingApplicationLoader : public ApplicationLoader {
  private:
   // ApplicationLoader implementation.
@@ -403,6 +413,9 @@
     test_loader_->set_context(&context_);
     application_manager_->set_default_loader(
         scoped_ptr<ApplicationLoader>(test_loader_));
+    application_manager_->SetLoaderForURL(
+        make_scoped_ptr(new TracingApplicationLoader),
+        GURL("mojo:tracing"));
 
     TestServicePtr service_proxy;
     ConnectToService(application_manager_.get(), GURL(kTestURLString),
diff --git a/net/cookies/cookie_monster_unittest.cc b/net/cookies/cookie_monster_unittest.cc
index fddd625..4c2fc71 100644
--- a/net/cookies/cookie_monster_unittest.cc
+++ b/net/cookies/cookie_monster_unittest.cc
@@ -100,7 +100,6 @@
   static const bool filters_schemes = true;
   static const bool has_path_prefix_bug = false;
   static const int creation_time_granularity_in_ms = 0;
-  static const bool enforces_prefixes = true;
 };
 
 INSTANTIATE_TYPED_TEST_CASE_P(CookieMonster,
diff --git a/net/cookies/cookie_store_unittest.h b/net/cookies/cookie_store_unittest.h
index f4f4739..0432463 100644
--- a/net/cookies/cookie_store_unittest.h
+++ b/net/cookies/cookie_store_unittest.h
@@ -70,8 +70,6 @@
 //   // different creation times.
 //   static const int creation_time_granularity_in_ms;
 //
-//   // The cookie store enforces cookie prefixes.
-//   static const bool enforces_prefixes;
 // };
 
 template <class CookieStoreTestTraits>
@@ -158,8 +156,6 @@
     CookieOptions options;
     if (!CookieStoreTestTraits::supports_http_only)
       options.set_include_httponly();
-    if (CookieStoreTestTraits::enforces_prefixes)
-      options.set_enforce_prefixes();
     return SetCookieWithOptions(cs, url, cookie_line, options);
   }
 
diff --git a/net/url_request/url_request_context_builder.cc b/net/url_request/url_request_context_builder.cc
index a7beaa83..c753507 100644
--- a/net/url_request/url_request_context_builder.cc
+++ b/net/url_request/url_request_context_builder.cc
@@ -398,9 +398,13 @@
   scoped_ptr<HttpTransactionFactory> http_transaction_factory;
   if (http_cache_enabled_) {
     scoped_ptr<HttpCache::BackendFactory> http_cache_backend;
-    if (http_cache_params_.type == HttpCacheParams::DISK) {
+    if (http_cache_params_.type != HttpCacheParams::IN_MEMORY) {
+      BackendType backend_type =
+          http_cache_params_.type == HttpCacheParams::DISK
+              ? CACHE_BACKEND_DEFAULT
+              : CACHE_BACKEND_SIMPLE;
       http_cache_backend.reset(new HttpCache::DefaultBackend(
-          DISK_CACHE, CACHE_BACKEND_DEFAULT, http_cache_params_.path,
+          DISK_CACHE, backend_type, http_cache_params_.path,
           http_cache_params_.max_size, context->GetFileTaskRunner()));
     } else {
       http_cache_backend =
diff --git a/net/url_request/url_request_context_builder.h b/net/url_request/url_request_context_builder.h
index 135e748..260eccb7 100644
--- a/net/url_request/url_request_context_builder.h
+++ b/net/url_request/url_request_context_builder.h
@@ -52,8 +52,12 @@
  public:
   struct NET_EXPORT HttpCacheParams {
     enum Type {
+      // In-memory cache.
       IN_MEMORY,
+      // Disk cache using "default" backend.
       DISK,
+      // Disk cache using "simple" backend (SimpleBackendImpl).
+      DISK_SIMPLE,
     };
 
     HttpCacheParams();
diff --git a/remoting/host/linux/linux_me2me_host.py b/remoting/host/linux/linux_me2me_host.py
index 4bd039a7..d2642ac 100755
--- a/remoting/host/linux/linux_me2me_host.py
+++ b/remoting/host/linux/linux_me2me_host.py
@@ -766,7 +766,9 @@
         '%Y%m%d_%H%M%S', time.localtime(time.time()))
     log_file = tempfile.NamedTemporaryFile(prefix=log_file_prefix, delete=False)
     os.environ[LOG_FILE_ENV_VAR] = log_file.name
-    log_fd = log_file.file.fileno()
+
+    # The file-descriptor in this case is owned by the tempfile object.
+    log_fd = os.dup(log_file.file.fileno())
   else:
     log_fd = os.open(os.environ[LOG_FILE_ENV_VAR],
                      os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o600)
diff --git a/sync/android/javatests/src/org/chromium/sync/AndroidSyncSettingsTest.java b/sync/android/javatests/src/org/chromium/sync/AndroidSyncSettingsTest.java
index ef26ce2..e89c338 100644
--- a/sync/android/javatests/src/org/chromium/sync/AndroidSyncSettingsTest.java
+++ b/sync/android/javatests/src/org/chromium/sync/AndroidSyncSettingsTest.java
@@ -7,7 +7,6 @@
 import android.accounts.Account;
 import android.content.Context;
 import android.os.Bundle;
-import android.test.FlakyTest;
 import android.test.InstrumentationTestCase;
 import android.test.suitebuilder.annotation.SmallTest;
 
@@ -145,18 +144,14 @@
         });
     }
 
-    @FlakyTest
-    /*
-     * http://crbug.com/554154
-     * @SmallTest
-     * @Feature({"Sync"})
-     */
+    @SmallTest
+    @Feature({"Sync"})
     public void testAccountInitialization() throws InterruptedException {
         // mAccount was set to be syncable and not have periodic syncs.
         assertEquals(1, mSyncContentResolverDelegate.mSetIsSyncableCalls);
         assertEquals(1, mSyncContentResolverDelegate.mRemovePeriodicSyncCalls);
         AndroidSyncSettings.updateAccount(mContext, null);
-        getInstrumentation().waitForIdleSync();
+        mAccountManager.waitForGetAccountsTask();
         // mAccount was set to be not syncable.
         assertEquals(2, mSyncContentResolverDelegate.mSetIsSyncableCalls);
         assertEquals(1, mSyncContentResolverDelegate.mRemovePeriodicSyncCalls);
@@ -357,14 +352,12 @@
                 mSyncSettingsObserver.receivedNotification());
     }
 
-    /*@SmallTest
-    @Feature({"Sync"})*/
-    // http://crbug.com/527856
-    @DisabledTest
+    @SmallTest
+    @Feature({"Sync"})
     public void testIsSyncableOnSigninAndNotOnSignout() throws InterruptedException {
         assertTrue(mSyncContentResolverDelegate.getIsSyncable(mAccount, mAuthority) == 1);
         AndroidSyncSettings.updateAccount(mContext, null);
-        getInstrumentation().waitForIdleSync();
+        mAccountManager.waitForGetAccountsTask();
         assertTrue(mSyncContentResolverDelegate.getIsSyncable(mAccount, mAuthority) == 0);
         AndroidSyncSettings.updateAccount(mContext, mAccount);
         assertTrue(mSyncContentResolverDelegate.getIsSyncable(mAccount, mAuthority) == 1);
diff --git a/sync/api/entity_data.cc b/sync/api/entity_data.cc
index fdb9b47..8b10b352 100644
--- a/sync/api/entity_data.cc
+++ b/sync/api/entity_data.cc
@@ -12,7 +12,7 @@
 EntityData::~EntityData() {}
 
 void EntityData::Swap(EntityData* other) {
-  server_id.swap(other->server_id);
+  id.swap(other->id);
   client_tag_hash.swap(other->client_tag_hash);
   non_unique_name.swap(other->non_unique_name);
 
@@ -25,6 +25,12 @@
   unique_position.Swap(&other->unique_position);
 }
 
+EntityDataPtr EntityData::Pass() {
+  EntityDataPtr target;
+  target.swap_value(this);
+  return target.Pass();
+}
+
 void EntityDataTraits::SwapValue(EntityData* dest, EntityData* src) {
   dest->Swap(src);
 }
diff --git a/sync/api/entity_data.h b/sync/api/entity_data.h
index 5c966b9..66a6a99 100644
--- a/sync/api/entity_data.h
+++ b/sync/api/entity_data.h
@@ -16,6 +16,16 @@
 
 namespace syncer_v2 {
 
+struct EntityData;
+
+struct SYNC_EXPORT EntityDataTraits {
+  static void SwapValue(EntityData* dest, EntityData* src);
+  static bool HasValue(const EntityData& value);
+  static const EntityData& DefaultValue();
+};
+
+typedef syncer::ProtoValuePtr<EntityData, EntityDataTraits> EntityDataPtr;
+
 // A light-weight container for sync entity data which represents either
 // local data created on the ModelTypeService side or remote data created
 // on ModelTypeWorker.
@@ -28,7 +38,7 @@
   // Typically this is a server assigned sync ID, although for a local change
   // that represents a new entity this field might be either empty or contain
   // a temporary client sync ID.
-  std::string server_id;
+  std::string id;
 
   // A hash based on the client tag and model type.
   // Used for various map lookups. Should always be available.
@@ -56,7 +66,11 @@
   // True if EntityData represents deleted entity; otherwise false.
   // Note that EntityData would be considered to represent a deletion if it
   // specifics hasn't been set.
-  bool is_deleted() { return specifics.ByteSize() == 0; }
+  bool is_deleted() const { return specifics.ByteSize() == 0; }
+
+  // Transfers this struct's data to EntityDataPtr.
+  // The return value must be assigned into another EntityDataPtr.
+  EntityDataPtr Pass() WARN_UNUSED_RESULT;
 
  private:
   friend struct EntityDataTraits;
@@ -66,14 +80,6 @@
   DISALLOW_COPY_AND_ASSIGN(EntityData);
 };
 
-struct SYNC_EXPORT EntityDataTraits {
-  static void SwapValue(EntityData* dest, EntityData* src);
-  static bool HasValue(const EntityData& value);
-  static const EntityData& DefaultValue();
-};
-
-typedef syncer::ProtoValuePtr<EntityData, EntityDataTraits> EntityDataPtr;
-
 }  // namespace syncer_v2
 
 #endif  // SYNC_API_ENTITY_DATA_H_
diff --git a/sync/api/entity_data_unittest.cc b/sync/api/entity_data_unittest.cc
index b61f086..2277d3e 100644
--- a/sync/api/entity_data_unittest.cc
+++ b/sync/api/entity_data_unittest.cc
@@ -27,7 +27,7 @@
 TEST_F(EntityDataTest, Swap) {
   EntityData data;
   syncer::AddDefaultFieldValue(syncer::BOOKMARKS, &data.specifics);
-  data.server_id = "server_id";
+  data.id = "id";
   data.client_tag_hash = "client_tag_hash";
   data.non_unique_name = "non_unique_name";
   data.creation_time = base::Time::FromTimeT(10);
@@ -46,8 +46,7 @@
       &data.specifics.bookmark();
   const std::string* unique_position_value = &data.unique_position.value();
 
-  EntityDataPtr ptr;
-  ptr.swap_value(&data);
+  EntityDataPtr ptr(data.Pass());
 
   // Compare addresses of the data wrapped by EntityDataPtr to make sure that
   // the underlying objects are exactly the same.
@@ -55,7 +54,7 @@
   EXPECT_EQ(unique_position_value, &ptr->unique_position.value());
 
   // Compare other fields.
-  EXPECT_EQ("server_id", ptr->server_id);
+  EXPECT_EQ("id", ptr->id);
   EXPECT_EQ("client_tag_hash", ptr->client_tag_hash);
   EXPECT_EQ("non_unique_name", ptr->non_unique_name);
   EXPECT_EQ("parent_id", ptr->parent_id);
diff --git a/sync/engine/entity_tracker.cc b/sync/engine/entity_tracker.cc
index f8bfa8b..d4d2eab 100644
--- a/sync/engine/entity_tracker.cc
+++ b/sync/engine/entity_tracker.cc
@@ -14,14 +14,16 @@
 
 scoped_ptr<EntityTracker> EntityTracker::FromUpdateResponse(
     const UpdateResponseData& data) {
-  return make_scoped_ptr(new EntityTracker(data.id, data.client_tag_hash, 0,
-                                           data.response_version));
+  // TODO(stanisc): Share entire EntityData with EntityTracker.
+  return make_scoped_ptr(new EntityTracker(
+      data.entity->id, data.entity->client_tag_hash, 0, data.response_version));
 }
 
 scoped_ptr<EntityTracker> EntityTracker::FromCommitRequest(
     const CommitRequestData& data) {
+  // TODO(stanisc): Share entire EntityData with EntityTracker.
   return make_scoped_ptr(
-      new EntityTracker(data.id, data.client_tag_hash, 0, 0));
+      new EntityTracker(data.entity->id, data.entity->client_tag_hash, 0, 0));
 }
 
 EntityTracker::EntityTracker(const std::string& id,
@@ -44,22 +46,28 @@
 void EntityTracker::PrepareCommitProto(sync_pb::SyncEntity* commit_entity,
                                        int64* sequence_number) const {
   DCHECK(HasPendingCommit());
+  DCHECK(!client_tag_hash_.empty());
 
-  // Set ID if we have a server-assigned ID.  Otherwise, it will be up to
-  // our caller to assign a client-unique initial ID.
-  if (base_version_ != kUncommittedVersion) {
+  if (!id_.empty()) {
     commit_entity->set_id_string(id_);
   }
 
+  const EntityData& entity = pending_commit_->entity.value();
+  DCHECK_EQ(client_tag_hash_, entity.client_tag_hash);
+
   commit_entity->set_client_defined_unique_tag(client_tag_hash_);
   commit_entity->set_version(base_version_);
-  commit_entity->set_deleted(pending_commit_->deleted);
+  commit_entity->set_deleted(entity.is_deleted());
+
+  // TODO(stanisc): This doesn't support bookmarks yet.
+  DCHECK(entity.parent_id.empty());
   commit_entity->set_folder(false);
-  commit_entity->set_name(pending_commit_->non_unique_name);
-  if (!pending_commit_->deleted) {
-    commit_entity->set_ctime(syncer::TimeToProtoTime(pending_commit_->ctime));
-    commit_entity->set_mtime(syncer::TimeToProtoTime(pending_commit_->mtime));
-    commit_entity->mutable_specifics()->CopyFrom(pending_commit_->specifics);
+
+  commit_entity->set_name(entity.non_unique_name);
+  if (!entity.is_deleted()) {
+    commit_entity->set_ctime(syncer::TimeToProtoTime(entity.creation_time));
+    commit_entity->set_mtime(syncer::TimeToProtoTime(entity.modification_time));
+    commit_entity->mutable_specifics()->CopyFrom(entity.specifics);
   }
 
   *sequence_number = sequence_number_;
@@ -77,7 +85,7 @@
   sequence_number_ = data.sequence_number;
 
   // Don't commit deletions of server-unknown items.
-  if (data.deleted && !IsServerKnown()) {
+  if (data.entity->is_deleted() && !IsServerKnown()) {
     ClearPendingCommit();
     return;
   }
@@ -87,7 +95,7 @@
   // model thread could have a better ID value than we do.
 
   // This entity is identified by its client tag.  That value can never change.
-  DCHECK_EQ(client_tag_hash_, data.client_tag_hash);
+  DCHECK_EQ(client_tag_hash_, data.entity->client_tag_hash);
   pending_commit_.reset(new CommitRequestData(data));
 
   // Do our counter values indicate a conflict?  If so, don't commit.
diff --git a/sync/engine/entity_tracker_unittest.cc b/sync/engine/entity_tracker_unittest.cc
index 6e0a367..02dabf0d 100644
--- a/sync/engine/entity_tracker_unittest.cc
+++ b/sync/engine/entity_tracker_unittest.cc
@@ -41,25 +41,30 @@
 
   CommitRequestData MakeCommitRequestData(int64 sequence_number,
                                           int64 base_version) {
-    CommitRequestData data;
+    EntityData data;
     data.id = kServerId;
     data.client_tag_hash = kClientTagHash;
-    data.sequence_number = sequence_number;
-    data.base_version = base_version;
-    data.ctime = kCtime;
-    data.mtime = kMtime;
-    data.non_unique_name = kClientTag;
-    data.deleted = false;
+    data.creation_time = kCtime;
+    data.modification_time = kMtime;
     data.specifics = specifics;
-    return data;
+    data.non_unique_name = kClientTag;
+
+    CommitRequestData request_data;
+    request_data.entity = data.Pass();
+    request_data.sequence_number = sequence_number;
+    request_data.base_version = base_version;
+    return request_data;
   }
 
   UpdateResponseData MakeUpdateResponseData(int64 response_version) {
-    UpdateResponseData data;
+    EntityData data;
     data.id = kServerId;
     data.client_tag_hash = kClientTagHash;
-    data.response_version = response_version;
-    return data;
+
+    UpdateResponseData response_data;
+    response_data.entity = data.Pass();
+    response_data.response_version = response_version;
+    return response_data;
   }
 
   const std::string kServerId;
diff --git a/sync/engine/model_type_entity.cc b/sync/engine/model_type_entity.cc
index 0b635aa..a4dd505 100644
--- a/sync/engine/model_type_entity.cc
+++ b/sync/engine/model_type_entity.cc
@@ -140,15 +140,22 @@
 
 void ModelTypeEntity::InitializeCommitRequestData(
     CommitRequestData* request) const {
-  request->id = id_;
-  request->client_tag_hash = client_tag_hash_;
+  // TODO(stanisc): Switch ModelTypeEntity to EntityData to
+  // avoid temporary EntityData
+  EntityData data;
+  data.id = id_;
+  data.client_tag_hash = client_tag_hash_;
+  data.creation_time = ctime_;
+  data.modification_time = mtime_;
+  data.non_unique_name = non_unique_name_;
+
+  if (!deleted_) {
+    data.specifics.CopyFrom(specifics_);
+  }
+
+  request->entity = data.Pass();
   request->sequence_number = sequence_number_;
   request->base_version = base_version_;
-  request->ctime = ctime_;
-  request->mtime = mtime_;
-  request->non_unique_name = non_unique_name_;
-  request->deleted = deleted_;
-  request->specifics.CopyFrom(specifics_);
 }
 
 void ModelTypeEntity::SetCommitRequestInProgress() {
diff --git a/sync/engine/model_type_worker.cc b/sync/engine/model_type_worker.cc
index ca6f7385..b291d40 100644
--- a/sync/engine/model_type_worker.cc
+++ b/sync/engine/model_type_worker.cc
@@ -49,7 +49,7 @@
     scoped_ptr<EntityTracker> entity_tracker =
         EntityTracker::FromUpdateResponse(*it);
     entity_tracker->ReceivePendingUpdate(*it);
-    entities_.insert(it->client_tag_hash, entity_tracker.Pass());
+    entities_.insert(it->entity->client_tag_hash, entity_tracker.Pass());
   }
 
   if (cryptographer_) {
@@ -128,14 +128,15 @@
     DCHECK(!client_tag_hash.empty());
 
     // Prepare the message for the model thread.
+    EntityData data;
+    data.id = update_entity->id_string();
+    data.client_tag_hash = client_tag_hash;
+    data.creation_time = syncer::ProtoTimeToTime(update_entity->ctime());
+    data.modification_time = syncer::ProtoTimeToTime(update_entity->mtime());
+    data.non_unique_name = update_entity->name();
+
     UpdateResponseData response_data;
-    response_data.id = update_entity->id_string();
-    response_data.client_tag_hash = client_tag_hash;
     response_data.response_version = update_entity->version();
-    response_data.ctime = syncer::ProtoTimeToTime(update_entity->ctime());
-    response_data.mtime = syncer::ProtoTimeToTime(update_entity->mtime());
-    response_data.non_unique_name = update_entity->name();
-    response_data.deleted = update_entity->deleted();
 
     EntityTracker* entity_tracker = nullptr;
     EntityMap::const_iterator map_it = entities_.find(client_tag_hash);
@@ -153,14 +154,15 @@
     if (!specifics.has_encrypted()) {
       // No encryption.
       entity_tracker->ReceiveUpdate(update_entity->version());
-      response_data.specifics = specifics;
+      data.specifics = specifics;
+      response_data.entity = data.Pass();
       response_datas.push_back(response_data);
     } else if (specifics.has_encrypted() && cryptographer_ &&
                cryptographer_->CanDecrypt(specifics.encrypted())) {
       // Encrypted, but we know the key.
-      if (DecryptSpecifics(cryptographer_.get(), specifics,
-                           &response_data.specifics)) {
+      if (DecryptSpecifics(cryptographer_.get(), specifics, &data.specifics)) {
         entity_tracker->ReceiveUpdate(update_entity->version());
+        response_data.entity = data.Pass();
         response_data.encryption_key_name = specifics.encrypted().key_name();
         response_datas.push_back(response_data);
       }
@@ -168,7 +170,8 @@
                (!cryptographer_ ||
                 !cryptographer_->CanDecrypt(specifics.encrypted()))) {
       // Can't decrypt right now.  Ask the entity tracker to handle it.
-      response_data.specifics = specifics;
+      data.specifics = specifics;
+      response_data.entity = data.Pass();
       if (entity_tracker->ReceivePendingUpdate(response_data)) {
         // Send to the model thread for safe-keeping across restarts if the
         // tracker decides the update is worth keeping.
@@ -264,17 +267,18 @@
 }
 
 void ModelTypeWorker::StorePendingCommit(const CommitRequestData& request) {
-  if (!request.deleted) {
-    DCHECK_EQ(type_, syncer::GetModelTypeFromSpecifics(request.specifics));
+  const EntityData& data = request.entity.value();
+  if (!data.is_deleted()) {
+    DCHECK_EQ(type_, syncer::GetModelTypeFromSpecifics(data.specifics));
   }
 
   EntityTracker* entity;
-  EntityMap::const_iterator map_it = entities_.find(request.client_tag_hash);
+  EntityMap::const_iterator map_it = entities_.find(data.client_tag_hash);
   if (map_it == entities_.end()) {
     scoped_ptr<EntityTracker> scoped_entity =
         EntityTracker::FromCommitRequest(request);
     entity = scoped_entity.get();
-    entities_.insert(request.client_tag_hash, scoped_entity.Pass());
+    entities_.insert(data.client_tag_hash, scoped_entity.Pass());
   } else {
     entity = map_it->second;
   }
@@ -390,17 +394,31 @@
        ++it) {
     if (it->second->HasPendingUpdate()) {
       const UpdateResponseData& saved_pending = it->second->GetPendingUpdate();
+      const EntityData& data = saved_pending.entity.value();
 
       // We assume all pending updates are encrypted items for which we
       // don't have the key.
-      DCHECK(saved_pending.specifics.has_encrypted());
+      DCHECK(data.specifics.has_encrypted());
 
-      if (cryptographer_->CanDecrypt(saved_pending.specifics.encrypted())) {
-        UpdateResponseData decrypted_response = saved_pending;
-        if (DecryptSpecifics(cryptographer_.get(), saved_pending.specifics,
-                             &decrypted_response.specifics)) {
+      if (cryptographer_->CanDecrypt(data.specifics.encrypted())) {
+        EntityData decrypted_data;
+        if (DecryptSpecifics(cryptographer_.get(), data.specifics,
+                             &decrypted_data.specifics)) {
+          // Copy other fields one by one since EntityData doesn't allow
+          // copying.
+          // TODO(stanisc): this code is likely to be removed once we get
+          // rid of pending updates.
+          decrypted_data.id = data.id;
+          decrypted_data.client_tag_hash = data.client_tag_hash;
+          decrypted_data.non_unique_name = data.non_unique_name;
+          decrypted_data.creation_time = data.creation_time;
+          decrypted_data.modification_time = data.modification_time;
+
+          UpdateResponseData decrypted_response;
+          decrypted_response.entity = decrypted_data.Pass();
+          decrypted_response.response_version = saved_pending.response_version;
           decrypted_response.encryption_key_name =
-              saved_pending.specifics.encrypted().key_name();
+              data.specifics.encrypted().key_name();
           response_datas.push_back(decrypted_response);
 
           it->second->ClearPendingUpdate();
diff --git a/sync/engine/model_type_worker_unittest.cc b/sync/engine/model_type_worker_unittest.cc
index 7662241..06fc15c9 100644
--- a/sync/engine/model_type_worker_unittest.cc
+++ b/sync/engine/model_type_worker_unittest.cc
@@ -823,16 +823,17 @@
 
   ASSERT_TRUE(HasUpdateResponseOnModelThread("tag1"));
   UpdateResponseData update = GetUpdateResponseOnModelThread("tag1");
+  const EntityData& entity = update.entity.value();
 
-  EXPECT_FALSE(update.id.empty());
-  EXPECT_EQ(tag_hash, update.client_tag_hash);
+  EXPECT_FALSE(entity.id.empty());
+  EXPECT_EQ(tag_hash, entity.client_tag_hash);
   EXPECT_LT(0, update.response_version);
-  EXPECT_FALSE(update.ctime.is_null());
-  EXPECT_FALSE(update.mtime.is_null());
-  EXPECT_FALSE(update.non_unique_name.empty());
-  EXPECT_FALSE(update.deleted);
-  EXPECT_EQ("tag1", update.specifics.preference().name());
-  EXPECT_EQ("value1", update.specifics.preference().value());
+  EXPECT_FALSE(entity.creation_time.is_null());
+  EXPECT_FALSE(entity.modification_time.is_null());
+  EXPECT_FALSE(entity.non_unique_name.empty());
+  EXPECT_FALSE(entity.is_deleted());
+  EXPECT_EQ("tag1", entity.specifics.preference().name());
+  EXPECT_EQ("value1", entity.specifics.preference().value());
 }
 
 // Test commit of encrypted updates.
@@ -915,8 +916,8 @@
   // Test some basic properties regarding the update.
   ASSERT_TRUE(HasUpdateResponseOnModelThread("tag1"));
   UpdateResponseData update1 = GetUpdateResponseOnModelThread("tag1");
-  EXPECT_EQ("tag1", update1.specifics.preference().name());
-  EXPECT_EQ("value1", update1.specifics.preference().value());
+  EXPECT_EQ("tag1", update1.entity->specifics.preference().name());
+  EXPECT_EQ("value1", update1.entity->specifics.preference().value());
   EXPECT_TRUE(update1.encryption_key_name.empty());
 
   // Set received updates to be encrypted using the new nigori.
@@ -928,8 +929,8 @@
   // Test its basic features and the value of encryption_key_name.
   ASSERT_TRUE(HasUpdateResponseOnModelThread("tag2"));
   UpdateResponseData update2 = GetUpdateResponseOnModelThread("tag2");
-  EXPECT_EQ("tag2", update2.specifics.preference().name());
-  EXPECT_EQ("value2", update2.specifics.preference().value());
+  EXPECT_EQ("tag2", update2.entity->specifics.preference().name());
+  EXPECT_EQ("value2", update2.entity->specifics.preference().value());
   EXPECT_FALSE(update2.encryption_key_name.empty());
 }
 
@@ -975,8 +976,8 @@
   UpdateLocalCryptographer();
   ASSERT_TRUE(HasUpdateResponseOnModelThread("tag1"));
   UpdateResponseData update = GetUpdateResponseOnModelThread("tag1");
-  EXPECT_EQ("tag1", update.specifics.preference().name());
-  EXPECT_EQ("value1", update.specifics.preference().value());
+  EXPECT_EQ("tag1", update.entity->specifics.preference().name());
+  EXPECT_EQ("value1", update.entity->specifics.preference().value());
   EXPECT_FALSE(update.encryption_key_name.empty());
 }
 
@@ -1006,18 +1007,20 @@
 // Test decryption of pending updates saved across a restart.
 TEST_F(ModelTypeWorkerTest, RestorePendingEntries) {
   // Create a fake pending update.
+  EntityData entity;
+  entity.client_tag_hash = GenerateTagHash("tag1");
+  entity.id = "SomeID";
+  entity.creation_time =
+      base::Time::UnixEpoch() + base::TimeDelta::FromSeconds(10);
+  entity.modification_time =
+      base::Time::UnixEpoch() + base::TimeDelta::FromSeconds(11);
+  entity.non_unique_name = "encrypted";
+  entity.specifics = GenerateSpecifics("tag1", "value1");
+  EncryptUpdate(GetNthKeyParams(1), &(entity.specifics));
+
   UpdateResponseData update;
-
-  update.client_tag_hash = GenerateTagHash("tag1");
-  update.id = "SomeID";
+  update.entity = entity.Pass();
   update.response_version = 100;
-  update.ctime = base::Time::UnixEpoch() + base::TimeDelta::FromSeconds(10);
-  update.mtime = base::Time::UnixEpoch() + base::TimeDelta::FromSeconds(11);
-  update.non_unique_name = "encrypted";
-  update.deleted = false;
-
-  update.specifics = GenerateSpecifics("tag1", "value1");
-  EncryptUpdate(GetNthKeyParams(1), &(update.specifics));
 
   // Inject the update during CommitQueue initialization.
   UpdateResponseDataList saved_pending_updates;
@@ -1045,17 +1048,21 @@
   UpdateLocalCryptographer();
 
   // Create a fake pending update.
-  UpdateResponseData update;
-  update.client_tag_hash = GenerateTagHash("tag1");
-  update.id = "SomeID";
-  update.response_version = 100;
-  update.ctime = base::Time::UnixEpoch() + base::TimeDelta::FromSeconds(10);
-  update.mtime = base::Time::UnixEpoch() + base::TimeDelta::FromSeconds(11);
-  update.non_unique_name = "encrypted";
-  update.deleted = false;
+  EntityData entity;
+  entity.client_tag_hash = GenerateTagHash("tag1");
+  entity.id = "SomeID";
+  entity.creation_time =
+      base::Time::UnixEpoch() + base::TimeDelta::FromSeconds(10);
+  entity.modification_time =
+      base::Time::UnixEpoch() + base::TimeDelta::FromSeconds(11);
+  entity.non_unique_name = "encrypted";
 
-  update.specifics = GenerateSpecifics("tag1", "value1");
-  EncryptUpdate(GetNthKeyParams(1), &(update.specifics));
+  entity.specifics = GenerateSpecifics("tag1", "value1");
+  EncryptUpdate(GetNthKeyParams(1), &(entity.specifics));
+
+  UpdateResponseData update;
+  update.entity = entity.Pass();
+  update.response_version = 100;
 
   // Inject the update during CommitQueue initialization.
   UpdateResponseDataList saved_pending_updates;
diff --git a/sync/internal_api/public/non_blocking_sync_common.cc b/sync/internal_api/public/non_blocking_sync_common.cc
index 757e42cd..3ce8aa2 100644
--- a/sync/internal_api/public/non_blocking_sync_common.cc
+++ b/sync/internal_api/public/non_blocking_sync_common.cc
@@ -6,35 +6,20 @@
 
 namespace syncer_v2 {
 
-DataTypeState::DataTypeState() : initial_sync_done(false) {
-}
+DataTypeState::DataTypeState() {}
 
-DataTypeState::~DataTypeState() {
-}
+DataTypeState::~DataTypeState() {}
 
-CommitRequestData::CommitRequestData()
-    : sequence_number(0),
-      base_version(0),
-      deleted(false) {
-}
+CommitRequestData::CommitRequestData() {}
 
-CommitRequestData::~CommitRequestData() {
-}
+CommitRequestData::~CommitRequestData() {}
 
-CommitResponseData::CommitResponseData()
-    : sequence_number(0),
-      response_version(0) {
-}
+CommitResponseData::CommitResponseData() {}
 
-CommitResponseData::~CommitResponseData() {
-}
+CommitResponseData::~CommitResponseData() {}
 
-UpdateResponseData::UpdateResponseData()
-    : response_version(0),
-      deleted(false) {
-}
+UpdateResponseData::UpdateResponseData() {}
 
-UpdateResponseData::~UpdateResponseData() {
-}
+UpdateResponseData::~UpdateResponseData() {}
 
 }  // namespace syncer
diff --git a/sync/internal_api/public/non_blocking_sync_common.h b/sync/internal_api/public/non_blocking_sync_common.h
index 6e0deefd..f3ca352f 100644
--- a/sync/internal_api/public/non_blocking_sync_common.h
+++ b/sync/internal_api/public/non_blocking_sync_common.h
@@ -9,6 +9,7 @@
 #include <vector>
 
 #include "base/time/time.h"
+#include "sync/api/entity_data.h"
 #include "sync/base/sync_export.h"
 #include "sync/protocol/sync.pb.h"
 
@@ -39,27 +40,20 @@
   // This flag is set to true when the first download cycle is complete.  The
   // ModelTypeProcessor should not attempt to commit any items until this
   // flag is set.
-  bool initial_sync_done;
+  bool initial_sync_done = false;
 };
 
 struct SYNC_EXPORT_PRIVATE CommitRequestData {
   CommitRequestData();
   ~CommitRequestData();
 
-  std::string id;
-  std::string client_tag_hash;
+  EntityDataPtr entity;
 
   // Strictly incrementing number for in-progress commits.  More information
   // about its meaning can be found in comments in the files that make use of
   // this struct.
-  int64 sequence_number;
-
-  int64 base_version;
-  base::Time ctime;
-  base::Time mtime;
-  std::string non_unique_name;
-  bool deleted;
-  sync_pb::EntitySpecifics specifics;
+  int64 sequence_number = 0;
+  int64 base_version = 0;
 };
 
 struct SYNC_EXPORT_PRIVATE CommitResponseData {
@@ -68,22 +62,17 @@
 
   std::string id;
   std::string client_tag_hash;
-  int64 sequence_number;
-  int64 response_version;
+  int64 sequence_number = 0;
+  int64 response_version = 0;
 };
 
 struct SYNC_EXPORT_PRIVATE UpdateResponseData {
+  EntityDataPtr entity;
+
   UpdateResponseData();
   ~UpdateResponseData();
 
-  std::string id;
-  std::string client_tag_hash;
-  int64 response_version;
-  base::Time ctime;
-  base::Time mtime;
-  std::string non_unique_name;
-  bool deleted;
-  sync_pb::EntitySpecifics specifics;
+  int64 response_version = 0;
   std::string encryption_key_name;
 };
 
diff --git a/sync/internal_api/public/util/proto_value_ptr.h b/sync/internal_api/public/util/proto_value_ptr.h
index e634f7b8..dc0c98fa 100644
--- a/sync/internal_api/public/util/proto_value_ptr.h
+++ b/sync/internal_api/public/util/proto_value_ptr.h
@@ -9,7 +9,7 @@
 #include "base/memory/ref_counted.h"
 
 namespace syncer_v2 {
-FORWARD_DECLARE_TEST(EntityDataTest, Swap);
+struct EntityData;
 }  // namespace syncable
 
 namespace syncer {
@@ -52,6 +52,8 @@
 // value.
 template <typename T, typename Traits = DefaultProtoValuePtrTraits<T>>
 class ProtoValuePtr {
+  TYPE_WITH_MOVE_CONSTRUCTOR_FOR_CPP_03(ProtoValuePtr)
+
  private:
   // Immutable shareable ref-counted wrapper that embeds the value.
   class Wrapper : public base::RefCountedThreadSafe<Wrapper> {
@@ -75,10 +77,10 @@
     T value_;
   };
 
+ public:
   ProtoValuePtr() {}
   ~ProtoValuePtr() {}
 
- public:
   const T& value() const {
     return wrapper_ ? wrapper_->value() : Traits::DefaultValue();
   }
@@ -90,11 +92,11 @@
 
  private:
   friend struct syncable::EntryKernel;
+  friend struct syncer_v2::EntityData;
   FRIEND_TEST_ALL_PREFIXES(ProtoValuePtrTest, ValueAssignment);
   FRIEND_TEST_ALL_PREFIXES(ProtoValuePtrTest, ValueSwap);
   FRIEND_TEST_ALL_PREFIXES(ProtoValuePtrTest, SharingTest);
   FRIEND_TEST_ALL_PREFIXES(ProtoValuePtrTest, ParsingTest);
-  FRIEND_TEST_ALL_PREFIXES(syncer_v2::EntityDataTest, Swap);
 
   // set the value to copy of |new_value|.
   void set_value(const T& new_value) {
diff --git a/sync/internal_api/shared_model_type_processor.cc b/sync/internal_api/shared_model_type_processor.cc
index 9bfe4c21..df96e01 100644
--- a/sync/internal_api/shared_model_type_processor.cc
+++ b/sync/internal_api/shared_model_type_processor.cc
@@ -244,7 +244,8 @@
   for (UpdateResponseDataList::const_iterator list_it = response_list.begin();
        list_it != response_list.end(); ++list_it) {
     const UpdateResponseData& response_data = *list_it;
-    const std::string& client_tag_hash = response_data.client_tag_hash;
+    const EntityData& data = response_data.entity.value();
+    const std::string& client_tag_hash = data.client_tag_hash;
 
     // If we're being asked to apply an update to this entity, this overrides
     // the previous pending updates.
@@ -252,18 +253,18 @@
 
     EntityMap::const_iterator it = entities_.find(client_tag_hash);
     if (it == entities_.end()) {
+      // TODO(stanisc): Pass / share entire EntityData with ModelTypeEntity.
       scoped_ptr<ModelTypeEntity> entity = ModelTypeEntity::FromServerUpdate(
-          response_data.id, response_data.client_tag_hash,
-          response_data.non_unique_name, response_data.response_version,
-          response_data.specifics, response_data.deleted, response_data.ctime,
-          response_data.mtime, response_data.encryption_key_name);
+          data.id, data.client_tag_hash, data.non_unique_name,
+          response_data.response_version, data.specifics, data.is_deleted(),
+          data.creation_time, data.modification_time,
+          response_data.encryption_key_name);
       entities_.insert(client_tag_hash, entity.Pass());
     } else {
       ModelTypeEntity* entity = it->second;
       entity->ApplyUpdateFromServer(
-          response_data.response_version, response_data.deleted,
-          response_data.specifics, response_data.mtime,
-          response_data.encryption_key_name);
+          response_data.response_version, data.is_deleted(), data.specifics,
+          data.modification_time, response_data.encryption_key_name);
 
       // TODO: Do something special when conflicts are detected.
     }
@@ -285,7 +286,7 @@
   for (UpdateResponseDataList::const_iterator list_it = pending_updates.begin();
        list_it != pending_updates.end(); ++list_it) {
     const UpdateResponseData& update = *list_it;
-    const std::string& client_tag_hash = update.client_tag_hash;
+    const std::string& client_tag_hash = update.entity->client_tag_hash;
 
     UpdateMap::const_iterator lookup_it =
         pending_updates_map_.find(client_tag_hash);
diff --git a/sync/internal_api/shared_model_type_processor_unittest.cc b/sync/internal_api/shared_model_type_processor_unittest.cc
index 8017893..54475bbb 100644
--- a/sync/internal_api/shared_model_type_processor_unittest.cc
+++ b/sync/internal_api/shared_model_type_processor_unittest.cc
@@ -266,7 +266,7 @@
   const UpdateResponseDataList list = type_processor_->GetPendingUpdates();
   for (UpdateResponseDataList::const_iterator it = list.begin();
        it != list.end(); ++it) {
-    if (it->client_tag_hash == client_tag_hash)
+    if (it->entity->client_tag_hash == client_tag_hash)
       return true;
   }
   return false;
@@ -279,7 +279,7 @@
   const UpdateResponseDataList list = type_processor_->GetPendingUpdates();
   for (UpdateResponseDataList::const_iterator it = list.begin();
        it != list.end(); ++it) {
-    if (it->client_tag_hash == client_tag_hash)
+    if (it->entity->client_tag_hash == client_tag_hash)
       return *it;
   }
   NOTREACHED();
@@ -369,14 +369,16 @@
   // Verify the commit request this operation has triggered.
   EXPECT_EQ(1U, GetNumCommitRequestLists());
   ASSERT_TRUE(HasCommitRequestForTag("tag1"));
-  const CommitRequestData& tag1_data = GetLatestCommitRequestForTag("tag1");
+  const CommitRequestData& tag1_request_data =
+      GetLatestCommitRequestForTag("tag1");
+  const EntityData& tag1_data = tag1_request_data.entity.value();
 
+  EXPECT_EQ(kUncommittedVersion, tag1_request_data.base_version);
   EXPECT_TRUE(tag1_data.id.empty());
-  EXPECT_EQ(kUncommittedVersion, tag1_data.base_version);
-  EXPECT_FALSE(tag1_data.ctime.is_null());
-  EXPECT_FALSE(tag1_data.mtime.is_null());
+  EXPECT_FALSE(tag1_data.creation_time.is_null());
+  EXPECT_FALSE(tag1_data.modification_time.is_null());
   EXPECT_EQ("tag1", tag1_data.non_unique_name);
-  EXPECT_FALSE(tag1_data.deleted);
+  EXPECT_FALSE(tag1_data.is_deleted());
   EXPECT_EQ("tag1", tag1_data.specifics.preference().name());
   EXPECT_EQ("value1", tag1_data.specifics.preference().value());
 }
@@ -390,25 +392,30 @@
   WriteItem("tag1", "value1");
   EXPECT_EQ(1U, GetNumCommitRequestLists());
   ASSERT_TRUE(HasCommitRequestForTag("tag1"));
-  const CommitRequestData& tag1_v1_data = GetLatestCommitRequestForTag("tag1");
+  const CommitRequestData& tag1_v1_request_data =
+      GetLatestCommitRequestForTag("tag1");
+  const EntityData& tag1_v1_data = tag1_v1_request_data.entity.value();
 
   WriteItem("tag1", "value2");
   EXPECT_EQ(2U, GetNumCommitRequestLists());
 
   ASSERT_TRUE(HasCommitRequestForTag("tag1"));
-  const CommitRequestData& tag1_v2_data = GetLatestCommitRequestForTag("tag1");
+  const CommitRequestData& tag1_v2_request_data =
+      GetLatestCommitRequestForTag("tag1");
+  const EntityData& tag1_v2_data = tag1_v2_request_data.entity.value();
 
   // Test some of the relations between old and new commit requests.
+  EXPECT_GT(tag1_v2_request_data.sequence_number,
+            tag1_v1_request_data.sequence_number);
   EXPECT_EQ(tag1_v1_data.specifics.preference().value(), "value1");
-  EXPECT_GT(tag1_v2_data.sequence_number, tag1_v1_data.sequence_number);
 
   // Perform a thorough examination of the update-generated request.
+  EXPECT_EQ(kUncommittedVersion, tag1_v2_request_data.base_version);
   EXPECT_TRUE(tag1_v2_data.id.empty());
-  EXPECT_EQ(kUncommittedVersion, tag1_v2_data.base_version);
-  EXPECT_FALSE(tag1_v2_data.ctime.is_null());
-  EXPECT_FALSE(tag1_v2_data.mtime.is_null());
+  EXPECT_FALSE(tag1_v2_data.creation_time.is_null());
+  EXPECT_FALSE(tag1_v2_data.modification_time.is_null());
   EXPECT_EQ("tag1", tag1_v2_data.non_unique_name);
-  EXPECT_FALSE(tag1_v2_data.deleted);
+  EXPECT_FALSE(tag1_v2_data.is_deleted());
   EXPECT_EQ("tag1", tag1_v2_data.specifics.preference().name());
   EXPECT_EQ("value2", tag1_v2_data.specifics.preference().value());
 }
@@ -442,9 +449,9 @@
 
   EXPECT_GT(tag1_v2_data.sequence_number, tag1_v1_data.sequence_number);
 
-  EXPECT_TRUE(tag1_v2_data.id.empty());
+  EXPECT_TRUE(tag1_v2_data.entity->id.empty());
   EXPECT_EQ(kUncommittedVersion, tag1_v2_data.base_version);
-  EXPECT_TRUE(tag1_v2_data.deleted);
+  EXPECT_TRUE(tag1_v2_data.entity->is_deleted());
 }
 
 // Creates an item locally then deletes it.
diff --git a/sync/test/android/javatests/src/org/chromium/sync/test/util/MockAccountManager.java b/sync/test/android/javatests/src/org/chromium/sync/test/util/MockAccountManager.java
index 3b3fd39..8c3efc9 100644
--- a/sync/test/android/javatests/src/org/chromium/sync/test/util/MockAccountManager.java
+++ b/sync/test/android/javatests/src/org/chromium/sync/test/util/MockAccountManager.java
@@ -90,6 +90,10 @@
 
     private final SingleThreadedExecutor mExecutor;
 
+    // Tracks the number of in-progress getAccountsByType() tasks so that tests can wait for
+    // their completion.
+    private final ZeroCounter mGetAccountsTaskCounter;
+
     @VisibleForTesting
     public MockAccountManager(Context context, Context testContext, Account... accounts) {
         mContext = context;
@@ -98,6 +102,7 @@
         mTestContext = testContext;
         mMainHandler = new Handler(mContext.getMainLooper());
         mExecutor = new SingleThreadedExecutor();
+        mGetAccountsTaskCounter = new ZeroCounter();
         mAccounts = new HashSet<AccountHolder>();
         mAccountPermissionPreparations = new LinkedList<AccountAuthTokenPreparation>();
         if (accounts != null) {
@@ -139,6 +144,7 @@
 
     @Override
     public void getAccountsByType(final String type, final Callback<Account[]> callback) {
+        mGetAccountsTaskCounter.increment();
         new AsyncTask<Void, Void, Account[]>() {
             @Override
             protected Account[] doInBackground(Void... params) {
@@ -148,11 +154,18 @@
             @Override
             protected void onPostExecute(Account[] accounts) {
                 callback.onResult(accounts);
+                mGetAccountsTaskCounter.decrement();
             }
         }.executeOnExecutor(AsyncTask.THREAD_POOL_EXECUTOR);
     }
 
     @VisibleForTesting
+    public void waitForGetAccountsTask() throws InterruptedException {
+        // Wait until all tasks are done because we don't know which is being waited for.
+        mGetAccountsTaskCounter.waitUntilZero();
+    }
+
+    @VisibleForTesting
     public boolean addAccountHolderExplicitly(AccountHolder accountHolder) {
         return addAccountHolderExplicitly(accountHolder, false);
     }
@@ -643,4 +656,36 @@
                     + '}';
         }
     }
+
+    /**
+     * Simple concurrency helper class for waiting until a resource count becomes zero.
+     */
+    private static class ZeroCounter {
+        private static final int WAIT_TIMEOUT_MS = 10000;
+
+        private final Object mLock = new Object();
+        private int mCount = 0;
+
+        public void increment() {
+            synchronized (mLock) {
+                mCount++;
+            }
+        }
+
+        public void decrement() {
+            synchronized (mLock) {
+                if (--mCount == 0) {
+                    mLock.notifyAll();
+                }
+            }
+        }
+
+        public void waitUntilZero() throws InterruptedException {
+            synchronized (mLock) {
+                while (mCount != 0) {
+                    mLock.wait(WAIT_TIMEOUT_MS);
+                }
+            }
+        }
+    }
 }
diff --git a/sync/test/engine/mock_commit_queue.cc b/sync/test/engine/mock_commit_queue.cc
index a3eaa72f..347d40b 100644
--- a/sync/test/engine/mock_commit_queue.cc
+++ b/sync/test/engine/mock_commit_queue.cc
@@ -38,7 +38,7 @@
        lists_it != commit_request_lists_.rend(); ++lists_it) {
     for (CommitRequestDataList::const_iterator it = lists_it->begin();
          it != lists_it->end(); ++it) {
-      if (it->client_tag_hash == tag_hash) {
+      if (it->entity->client_tag_hash == tag_hash) {
         return true;
       }
     }
@@ -56,7 +56,7 @@
        lists_it != commit_request_lists_.rend(); ++lists_it) {
     for (CommitRequestDataList::const_iterator it = lists_it->begin();
          it != lists_it->end(); ++it) {
-      if (it->client_tag_hash == tag_hash) {
+      if (it->entity->client_tag_hash == tag_hash) {
         return *it;
       }
     }
@@ -77,22 +77,23 @@
     SetServerVersion(tag_hash, version);
   }
 
-  UpdateResponseData data;
+  EntityData data;
   data.id = GenerateId(tag_hash);
   data.client_tag_hash = tag_hash;
-  data.response_version = version;
-  data.deleted = false;
   data.specifics = specifics;
-
   // These elements should have no effect on behavior, but we set them anyway
   // so we can test they are properly copied around the system if we want to.
-  data.ctime = base::Time::UnixEpoch() + base::TimeDelta::FromDays(1);
-  data.mtime = data.ctime + base::TimeDelta::FromSeconds(version);
+  data.creation_time = base::Time::UnixEpoch() + base::TimeDelta::FromDays(1);
+  data.modification_time =
+      data.creation_time + base::TimeDelta::FromSeconds(version);
   data.non_unique_name = specifics.preference().name();
 
-  data.encryption_key_name = server_encryption_key_name_;
+  UpdateResponseData response_data;
+  response_data.entity = data.Pass();
+  response_data.response_version = version;
+  response_data.encryption_key_name = server_encryption_key_name_;
 
-  return data;
+  return response_data;
 }
 
 UpdateResponseData MockCommitQueue::TombstoneFromServer(
@@ -104,33 +105,35 @@
     SetServerVersion(tag_hash, version);
   }
 
-  UpdateResponseData data;
+  EntityData data;
   data.id = GenerateId(tag_hash);
   data.client_tag_hash = tag_hash;
-  data.response_version = version;
-  data.deleted = true;
-
   // These elements should have no effect on behavior, but we set them anyway
   // so we can test they are properly copied around the system if we want to.
-  data.ctime = base::Time::UnixEpoch() + base::TimeDelta::FromDays(1);
-  data.mtime = data.ctime + base::TimeDelta::FromSeconds(version);
+  data.creation_time = base::Time::UnixEpoch() + base::TimeDelta::FromDays(1);
+  data.modification_time =
+      data.creation_time + base::TimeDelta::FromSeconds(version);
   data.non_unique_name = "Name Non Unique";
 
-  data.encryption_key_name = server_encryption_key_name_;
+  UpdateResponseData response_data;
+  response_data.entity = data.Pass();
+  response_data.response_version = version;
+  response_data.encryption_key_name = server_encryption_key_name_;
 
-  return data;
+  return response_data;
 }
 
 CommitResponseData MockCommitQueue::SuccessfulCommitResponse(
     const CommitRequestData& request_data) {
-  const std::string& client_tag_hash = request_data.client_tag_hash;
+  const EntityData& entity = request_data.entity.value();
+  const std::string& client_tag_hash = entity.client_tag_hash;
 
   CommitResponseData response_data;
 
   if (request_data.base_version == 0) {
     // Server assigns new ID to newly committed items.
-    DCHECK(request_data.id.empty());
-    response_data.id = request_data.id;
+    DCHECK(entity.id.empty());
+    response_data.id = entity.id;
   } else {
     // Otherwise we reuse the ID from the request.
     response_data.id = GenerateId(client_tag_hash);
diff --git a/sync/test/engine/mock_model_type_processor.cc b/sync/test/engine/mock_model_type_processor.cc
index 31d5102..ec4e2fe 100644
--- a/sync/test/engine/mock_model_type_processor.cc
+++ b/sync/test/engine/mock_model_type_processor.cc
@@ -64,48 +64,56 @@
     const sync_pb::EntitySpecifics& specifics) {
   const int64 base_version = GetBaseVersion(tag_hash);
 
-  CommitRequestData data;
+  EntityData data;
 
   if (HasServerAssignedId(tag_hash)) {
     data.id = GetServerAssignedId(tag_hash);
   }
 
   data.client_tag_hash = tag_hash;
-  data.sequence_number = GetNextSequenceNumber(tag_hash);
-  data.deleted = false;
   data.specifics = specifics;
-  data.base_version = base_version;
 
   // These fields are not really used for much, but we set them anyway
   // to make this item look more realistic.
-  data.ctime = base::Time::UnixEpoch() + base::TimeDelta::FromDays(1);
-  data.mtime = data.ctime + base::TimeDelta::FromSeconds(base_version);
+  data.creation_time = base::Time::UnixEpoch() + base::TimeDelta::FromDays(1);
+  data.modification_time =
+      data.creation_time + base::TimeDelta::FromSeconds(base_version);
   data.non_unique_name = "Name: " + tag_hash;
 
-  return data;
+  CommitRequestData request_data;
+  request_data.entity = data.Pass();
+  request_data.sequence_number = GetNextSequenceNumber(tag_hash);
+  request_data.base_version = base_version;
+
+  return request_data;
 }
 
 CommitRequestData MockModelTypeProcessor::DeleteRequest(
     const std::string& tag_hash) {
   const int64 base_version = GetBaseVersion(tag_hash);
-  CommitRequestData data;
+
+  EntityData data;
 
   if (HasServerAssignedId(tag_hash)) {
     data.id = GetServerAssignedId(tag_hash);
   }
 
   data.client_tag_hash = tag_hash;
-  data.sequence_number = GetNextSequenceNumber(tag_hash);
-  data.base_version = base_version;
-  data.mtime = data.ctime + base::TimeDelta::FromSeconds(base_version);
-  data.deleted = true;
 
   // These fields have little or no effect on behavior.  We set them anyway to
   // make the test more realistic.
-  data.ctime = base::Time::UnixEpoch() + base::TimeDelta::FromDays(1);
+  data.creation_time = base::Time::UnixEpoch() + base::TimeDelta::FromDays(1);
   data.non_unique_name = "Name deleted";
 
-  return data;
+  data.modification_time =
+      data.creation_time + base::TimeDelta::FromSeconds(base_version);
+
+  CommitRequestData request_data;
+  request_data.entity = data.Pass();
+  request_data.sequence_number = GetNextSequenceNumber(tag_hash);
+  request_data.base_version = base_version;
+
+  return request_data;
 }
 
 size_t MockModelTypeProcessor::GetNumUpdateResponses() const {
@@ -200,11 +208,12 @@
   type_states_received_on_update_.push_back(type_state);
   for (UpdateResponseDataList::const_iterator it = response_list.begin();
        it != response_list.end(); ++it) {
-    update_response_items_.insert(std::make_pair(it->client_tag_hash, *it));
+    const std::string client_tag_hash = it->entity->client_tag_hash;
+    update_response_items_.insert(std::make_pair(client_tag_hash, *it));
 
     // Server wins.  Set the model's base version.
-    SetBaseVersion(it->client_tag_hash, it->response_version);
-    SetServerAssignedId(it->client_tag_hash, it->id);
+    SetBaseVersion(client_tag_hash, it->response_version);
+    SetServerAssignedId(client_tag_hash, it->entity->id);
   }
 }
 
diff --git a/testing/buildbot/chromium.fyi.json b/testing/buildbot/chromium.fyi.json
index 5fbc1d34..d1ed40c0 100644
--- a/testing/buildbot/chromium.fyi.json
+++ b/testing/buildbot/chromium.fyi.json
@@ -7,6 +7,94 @@
       }
     ]
   },
+  "Android User Builder Tests": {
+    "gtest_tests": [
+      {
+        "test": "android_webview_unittests"
+      },
+      {
+        "test": "base_unittests"
+      },
+      {
+        "override_compile_targets": [
+          "breakpad_unittests_deps"
+        ],
+        "test": "breakpad_unittests"
+      },
+      {
+        "test": "cc_unittests"
+      },
+      {
+        "test": "components_browsertests"
+      },
+      {
+        "test": "components_unittests"
+      },
+      {
+        "test": "content_browsertests"
+      },
+      {
+        "test": "content_unittests"
+      },
+      {
+        "test": "device_unittests"
+      },
+      {
+        "test": "events_unittests"
+      },
+      {
+        "test": "gl_tests"
+      },
+      {
+        "test": "gl_unittests"
+      },
+      {
+        "test": "gpu_unittests"
+      },
+      {
+        "test": "ipc_tests"
+      },
+      {
+        "test": "media_unittests"
+      },
+      {
+        "test": "midi_unittests"
+      },
+      {
+        "test": "net_unittests"
+      },
+      {
+        "override_compile_targets": [
+          "sandbox_linux_unittests_deps"
+        ],
+        "test": "sandbox_linux_unittests"
+      },
+      {
+        "test": "skia_unittests"
+      },
+      {
+        "test": "sql_unittests"
+      },
+      {
+        "test": "sync_unit_tests"
+      },
+      {
+        "test": "ui_android_unittests"
+      },
+      {
+        "test": "ui_base_unittests"
+      },
+      {
+        "test": "ui_touch_selection_unittests"
+      },
+      {
+        "test": "unit_tests"
+      },
+      {
+        "test": "webkit_unit_tests"
+      }
+    ]
+  },
   "Browser Side Navigation Linux": {
     "gtest_tests": [
       {
diff --git a/testing/buildbot/gn_isolate_map.pyl b/testing/buildbot/gn_isolate_map.pyl
index 904b6e0..0cf89ab5 100644
--- a/testing/buildbot/gn_isolate_map.pyl
+++ b/testing/buildbot/gn_isolate_map.pyl
@@ -80,6 +80,10 @@
     "label": "//third_party/WebKit/public:blink_platform_unittests",
     "type": "unknown",
   },
+  "breakpad_unittests": {
+    "label": "//breakpad:breakpad_unittests",
+    "type": "console_test_launcher",
+  },
   "browser_tests": {
     "label": "//chrome/test:browser_tests",
     "type": "windowed_test_launcher",
diff --git a/testing/buildbot/manage.py b/testing/buildbot/manage.py
index cccf298..8a3924ef 100755
--- a/testing/buildbot/manage.py
+++ b/testing/buildbot/manage.py
@@ -59,6 +59,7 @@
 
 SKIP_GN_ISOLATE_MAP_TARGETS = {
   # TODO(GYP): These targets have not been ported to GN yet.
+  'android_webview_unittests',
   'cast_media_unittests',
   'cast_shell_browser_test',
   'chromevox_tests',
diff --git a/third_party/WebKit/LayoutTests/TestExpectations b/third_party/WebKit/LayoutTests/TestExpectations
index 49c7233..3f90d9fa 100644
--- a/third_party/WebKit/LayoutTests/TestExpectations
+++ b/third_party/WebKit/LayoutTests/TestExpectations
@@ -258,8 +258,6 @@
 
 crbug.com/535408 fast/js/function-bind.html [ NeedsManualRebaseline ]
 
-crbug.com/334828 fast/box-shadow/inset-subpixel.html [ NeedsRebaseline ]
-
 crbug.com/552574 fast/js/regexp-caching.html [ NeedsManualRebaseline ]
 
 crbug.com/498539 http/tests/inspector/elements/styles/selector-line.html [ Pass Timeout ]
@@ -927,6 +925,42 @@
 crbug.com/546538 svg/clip-path/clip-path-evenodd-nonzero.svg [ NeedsManualRebaseline ]
 crbug.com/546538 svg/clip-path/clip-path-nonzero-evenodd.svg [ NeedsManualRebaseline ]
 
+crbug.com/548596 css3/selectors3/html/css3-modsel-23.html [ NeedsRebaseline ]
+crbug.com/548596 css3/selectors3/html/css3-modsel-69.html [ NeedsRebaseline ]
+crbug.com/548596 css3/selectors3/xhtml/css3-modsel-23.xml [ NeedsRebaseline ]
+crbug.com/548596 css3/selectors3/xhtml/css3-modsel-69.xml [ NeedsRebaseline ]
+crbug.com/548596 css3/selectors3/xml/css3-modsel-23.xml [ NeedsRebaseline ]
+crbug.com/548596 css3/selectors3/xml/css3-modsel-69.xml [ NeedsRebaseline ]
+crbug.com/548596 editing/input/caret-at-the-edge-of-contenteditable.html [ NeedsRebaseline ]
+crbug.com/548596 editing/input/caret-at-the-edge-of-input.html [ NeedsRebaseline ]
+crbug.com/548596 editing/input/editable-container-with-word-wrap-normal.html [ NeedsRebaseline ]
+crbug.com/548596 editing/pasteboard/drop-text-without-selection.html [ NeedsRebaseline ]
+crbug.com/548596 fast/clip/outline-overflowClip.html [ NeedsRebaseline ]
+crbug.com/548596 fast/css/text-overflow-input.html [ NeedsRebaseline ]
+crbug.com/548596 fast/events/autoscroll.html [ NeedsRebaseline ]
+crbug.com/548596 fast/forms/basic-inputs.html [ NeedsRebaseline ]
+crbug.com/548596 fast/forms/control-restrict-line-height.html [ NeedsRebaseline ]
+crbug.com/548596 fast/forms/input-appearance-preventDefault.html [ NeedsRebaseline ]
+crbug.com/548596 fast/forms/input-appearance-selection.html [ NeedsRebaseline ]
+crbug.com/548596 fast/forms/input-disabled-color.html [ NeedsRebaseline ]
+crbug.com/548596 fast/forms/input-text-drag-down.html [ NeedsRebaseline ]
+crbug.com/548596 fast/forms/input-text-scroll-left-on-blur.html [ NeedsRebaseline ]
+crbug.com/548596 fast/forms/input-text-word-wrap.html [ NeedsRebaseline ]
+crbug.com/548596 fast/forms/input-type-text-min-width.html [ NeedsRebaseline ]
+crbug.com/548596 fast/forms/minWidthPercent.html [ NeedsRebaseline ]
+crbug.com/548596 fast/forms/tabbing-input-iframe.html [ NeedsRebaseline ]
+crbug.com/548596 fast/forms/textfield-outline.html [ NeedsRebaseline ]
+crbug.com/548596 fast/overflow/overflow-focus-ring.html [ NeedsRebaseline ]
+crbug.com/548596 fast/repaint/caret-invalidation-in-overflow-scroll.html [ NeedsRebaseline ]
+crbug.com/548596 fast/replaced/width100percent-searchfield.html [ NeedsRebaseline ]
+crbug.com/548596 fast/replaced/width100percent-textfield.html [ NeedsRebaseline ]
+crbug.com/548596 tables/mozilla/bugs/bug59354.html [ NeedsRebaseline ]
+crbug.com/548596 tables/mozilla/bugs/bug96334.html [ NeedsRebaseline ]
+crbug.com/548596 fast/css/input-search-padding.html [ NeedsRebaseline ]
+crbug.com/548596 virtual/pointerevent/fast/events/autoscroll.html [ NeedsRebaseline ]
+crbug.com/548596 virtual/trustedeventsdefaultaction/fast/events/autoscroll.html [ NeedsRebaseline ]
+crbug.com/548596 virtual/syncpaint/fast/repaint/caret-invalidation-in-overflow-scroll.html [ NeedsRebaseline ]
+
 crbug.com/425113 svg/clip-path/clip-path-multiple-children.svg [ Failure ]
 
 crbug.com/480769 http/tests/inspector/service-workers/service-workers-redundant.html [ Crash Pass Slow Failure ]
@@ -1061,7 +1095,6 @@
 crbug.com/509025 [ Mac10.10 ] compositing/overflow/updating-scrolling-container.html [ Failure ]
 # TODO(chrishtr): uncomment/inspect rebaseline of this after fixing crbug.com/516016
 # crbug.com/509025 [ Mac10.10 ] compositing/repaint/should-not-clip-composited-overflow-scrolling-layer.html [ Failure ]
-crbug.com/509025 [ Mac10.10 ] compositing/squashing/iframe-inside-squashed-layer.html [ Failure ]
 crbug.com/509025 [ Mac10.10 ] compositing/squashing/invalidate-when-leaving-squashed-layer.html [ Failure ]
 crbug.com/509025 [ Mac10.10 ] compositing/squashing/invalidation-for-subpixel-offset-of-squashed-layer.html [ Failure ]
 crbug.com/509025 [ Mac10.10 ] compositing/squashing/invalidations-with-large-negative-margin.html [ Failure ]
@@ -1108,8 +1141,6 @@
 # Unclear semantics of ToString (actually ToPrimitive) across iframes.
 crbug.com/532469 http/tests/security/cross-frame-access-custom.html [ NeedsManualRebaseline ]
 
-crbug.com/507590 fast/block/float/containing-block-change-compositing.html [ Failure ]
-
 crbug.com/521730 [ Win10 ] compositing/plugins/invalidate_rect.html [ Crash ]
 crbug.com/521730 [ Win10 ] plugins/mouse-click-plugin-clears-selection.html [ Crash ]
 crbug.com/521730 [ Win10 ] plugins/windowless_plugin_paint_test.html [ Crash ]
diff --git a/third_party/WebKit/LayoutTests/accessibility/adjacent-continuations-cause-assertion-failure-expected.txt b/third_party/WebKit/LayoutTests/accessibility/adjacent-continuations-cause-assertion-failure-expected.txt
index 6439e0a4..deaa2873 100644
--- a/third_party/WebKit/LayoutTests/accessibility/adjacent-continuations-cause-assertion-failure-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/adjacent-continuations-cause-assertion-failure-expected.txt
@@ -7,16 +7,16 @@
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-AXRole: AXWebArea AXValue: 
-    AXRole: AXStaticText AXValue: x
-        AXRole: AXInlineTextBox AXValue: x
-    AXRole: AXDiv AXValue: 
-        AXRole: AXStaticText AXValue: y
-            AXRole: AXInlineTextBox AXValue: y
-    AXRole: AXStaticText AXValue: z
-        AXRole: AXInlineTextBox AXValue: z
-    AXRole: AXDiv AXValue: 
-        AXRole: AXStaticText AXValue: End of test
+AXRole: AXWebArea
+    AXRole: AXStaticText "x"
+        AXRole: AXInlineTextBox "x"
+    AXRole: AXDiv
+        AXRole: AXStaticText "y"
+            AXRole: AXInlineTextBox "y"
+    AXRole: AXStaticText "z"
+        AXRole: AXInlineTextBox "z"
+    AXRole: AXDiv
+        AXRole: AXStaticText "End of test"
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/third_party/WebKit/LayoutTests/accessibility/aria-tables-expected.txt b/third_party/WebKit/LayoutTests/accessibility/aria-tables-expected.txt
index c63ec611..eede4c6 100644
--- a/third_party/WebKit/LayoutTests/accessibility/aria-tables-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/aria-tables-expected.txt
@@ -9,40 +9,40 @@
 col head
 End of test
 
-AXRole: AXWebArea AXValue: 
-    AXRole: AXTable AXValue: 
-        AXRole: AXRow AXValue: 
-            AXRole: AXColumnHeader AXValue: 
-                AXRole: AXStaticText AXValue: col head
-                    AXRole: AXInlineTextBox AXValue: col head
-            AXRole: AXColumnHeader AXValue: 
-                AXRole: AXStaticText AXValue: col head
-                    AXRole: AXInlineTextBox AXValue: col head
-            AXRole: AXColumnHeader AXValue: 
-                AXRole: AXStaticText AXValue: col head
-                    AXRole: AXInlineTextBox AXValue: col head
-        AXRole: AXRow AXValue: 
-            AXRole: AXRowHeader AXValue: 
-                AXRole: AXStaticText AXValue: row head
-                    AXRole: AXInlineTextBox AXValue: row head
-            AXRole: AXCell AXValue: 
-                AXRole: AXStaticText AXValue: data
-                    AXRole: AXInlineTextBox AXValue: data
-            AXRole: AXRowHeader AXValue: 
-                AXRole: AXStaticText AXValue: row head
-                    AXRole: AXInlineTextBox AXValue: row head
-        AXRole: AXRow AXValue: 
-            AXRole: AXRowHeader AXValue: 
-                AXRole: AXStaticText AXValue: row head
-                    AXRole: AXInlineTextBox AXValue: row head
-            AXRole: AXRowHeader AXValue: 
-                AXRole: AXStaticText AXValue: row head
-                    AXRole: AXInlineTextBox AXValue: row head
-            AXRole: AXColumnHeader AXValue: 
-                AXRole: AXStaticText AXValue: col head
-                    AXRole: AXInlineTextBox AXValue: col head
-    AXRole: AXParagraph AXValue: 
-        AXRole: AXStaticText AXValue: End of test
+AXRole: AXWebArea
+    AXRole: AXTable
+        AXRole: AXRow
+            AXRole: AXColumnHeader
+                AXRole: AXStaticText "col head"
+                    AXRole: AXInlineTextBox "col head"
+            AXRole: AXColumnHeader
+                AXRole: AXStaticText "col head"
+                    AXRole: AXInlineTextBox "col head"
+            AXRole: AXColumnHeader
+                AXRole: AXStaticText "col head"
+                    AXRole: AXInlineTextBox "col head"
+        AXRole: AXRow
+            AXRole: AXRowHeader
+                AXRole: AXStaticText "row head"
+                    AXRole: AXInlineTextBox "row head"
+            AXRole: AXCell
+                AXRole: AXStaticText "data"
+                    AXRole: AXInlineTextBox "data"
+            AXRole: AXRowHeader
+                AXRole: AXStaticText "row head"
+                    AXRole: AXInlineTextBox "row head"
+        AXRole: AXRow
+            AXRole: AXRowHeader
+                AXRole: AXStaticText "row head"
+                    AXRole: AXInlineTextBox "row head"
+            AXRole: AXRowHeader
+                AXRole: AXStaticText "row head"
+                    AXRole: AXInlineTextBox "row head"
+            AXRole: AXColumnHeader
+                AXRole: AXStaticText "col head"
+                    AXRole: AXInlineTextBox "col head"
+    AXRole: AXParagraph
+        AXRole: AXStaticText "End of test"
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/third_party/WebKit/LayoutTests/accessibility/aria-text-role-expected.txt b/third_party/WebKit/LayoutTests/accessibility/aria-text-role-expected.txt
index 1144a843..e2d7f9a 100644
--- a/third_party/WebKit/LayoutTests/accessibility/aria-text-role-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/aria-text-role-expected.txt
@@ -5,7 +5,7 @@
 
 
 PASS textrole.role is 'AXRole: AXStaticText'
-PASS textrole.stringValue is 'AXValue: all at once'
+PASS textrole.name is 'all at once'
 PASS textrole.elementAtPoint(x, y).isEqual(textrole) is true
 PASS successfullyParsed is true
 
diff --git a/third_party/WebKit/LayoutTests/accessibility/aria-text-role.html b/third_party/WebKit/LayoutTests/accessibility/aria-text-role.html
index 637355f6..9b12db8 100644
--- a/third_party/WebKit/LayoutTests/accessibility/aria-text-role.html
+++ b/third_party/WebKit/LayoutTests/accessibility/aria-text-role.html
@@ -23,7 +23,7 @@
         document.getElementById("textrole").focus();
         var textrole = accessibilityController.focusedElement;
         shouldBe("textrole.role", "'AXRole: AXStaticText'");
-        shouldBe("textrole.stringValue", "'AXValue: all at once'");
+        shouldBe("textrole.name", "'all at once'");
 
         // now check the hit-testing
         var x = textrole.clickPointX;
diff --git a/third_party/WebKit/LayoutTests/accessibility/computed-name-expected.txt b/third_party/WebKit/LayoutTests/accessibility/computed-name-expected.txt
index 6470cda2..32344c7 100644
--- a/third_party/WebKit/LayoutTests/accessibility/computed-name-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/computed-name-expected.txt
@@ -112,7 +112,7 @@
 PASS input.computedName is "AriaLabel2"
 PASS input.computedName is "LabelledBy3"
 PASS input.computedName is "Placeholder4"
-PASS input.computedName is "Title5"
+PASS input.computedName is "Placeholder5"
 PASS input.computedName is "LabelledBy6"
 PASS successfullyParsed is true
 
diff --git a/third_party/WebKit/LayoutTests/accessibility/computed-name.html b/third_party/WebKit/LayoutTests/accessibility/computed-name.html
index 0edc0e0..5487b44 100644
--- a/third_party/WebKit/LayoutTests/accessibility/computed-name.html
+++ b/third_party/WebKit/LayoutTests/accessibility/computed-name.html
@@ -223,7 +223,7 @@
                aria-labelledby="lb3">
 
         <input id="c4" data-expectedName="Placeholder4" type="text" placeholder="Placeholder4">
-        <input id="c5" data-expectedName="Title5" type="text" placeholder="Placeholder5" title="Title5">
+        <input id="c5" data-expectedName="Placeholder5" type="text" placeholder="Placeholder5" title="Title5">
 
         <input id="c6" data-expectedName="LabelledBy6" type="text" title="Title6"
                aria-label="AriaLabel6" aria-labelledby="lb6"
diff --git a/third_party/WebKit/LayoutTests/accessibility/contenteditable-caret-position.html b/third_party/WebKit/LayoutTests/accessibility/contenteditable-caret-position.html
index 7a53eb7..25d2833e 100644
--- a/third_party/WebKit/LayoutTests/accessibility/contenteditable-caret-position.html
+++ b/third_party/WebKit/LayoutTests/accessibility/contenteditable-caret-position.html
@@ -262,12 +262,12 @@
                 assert_equals(mainAccessible.selectionEnd,
                     mainOffset + caretPosition);
 
-                assert_equals(rootAccessible.selectionAnchorObject.stringValue,
-                    "AXValue: " + contenteditableLines[lineNumber].textContent.trim());
+                assert_equals(rootAccessible.selectionAnchorObject.name,
+                    contenteditableLines[lineNumber].textContent.trim());
                 assert_equals(rootAccessible.selectionAnchorOffset,
                     characterOffset);
-                assert_equals(rootAccessible.selectionFocusObject.stringValue,
-                    "AXValue: " + contenteditableLines[lineNumber].textContent.trim());
+                assert_equals(rootAccessible.selectionFocusObject.name,
+                    contenteditableLines[lineNumber].textContent.trim());
                 assert_equals(rootAccessible.selectionFocusOffset,
                     characterOffset);
             }
diff --git a/third_party/WebKit/LayoutTests/accessibility/contenteditable-selection.html b/third_party/WebKit/LayoutTests/accessibility/contenteditable-selection.html
index 7879baa..fd740f2 100644
--- a/third_party/WebKit/LayoutTests/accessibility/contenteditable-selection.html
+++ b/third_party/WebKit/LayoutTests/accessibility/contenteditable-selection.html
@@ -79,11 +79,11 @@
         assert_equals(mainAccessible.selectionStart, 9);
         assert_equals(mainAccessible.selectionEnd, 30);
 
-        assert_equals(rootAccessible.selectionAnchorObject.stringValue,
-            "AXValue: " + line1.textContent);
+        assert_equals(rootAccessible.selectionAnchorObject.name,
+            line1.textContent);
         assert_equals(rootAccessible.selectionAnchorOffset, 0);
-        assert_equals(rootAccessible.selectionFocusObject.stringValue,
-            "AXValue: " + line3.textContent);
+        assert_equals(rootAccessible.selectionFocusObject.name,
+            line3.textContent);
         assert_equals(rootAccessible.selectionFocusOffset, 6);
     }, "Test selectNodeContents on a contenteditable.");
 </script>
@@ -236,11 +236,11 @@
                 assert_equals(mainAccessible.selectionStart, start + 9);
                 assert_equals(mainAccessible.selectionEnd, end + 9);
 
-                assert_equals(rootAccessible.selectionAnchorObject.stringValue,
-                    "AXValue: " + contenteditableLines[i].textContent);
+                assert_equals(rootAccessible.selectionAnchorObject.name,
+                    contenteditableLines[i].textContent);
                 assert_equals(rootAccessible.selectionAnchorOffset, 0);
-                assert_equals(rootAccessible.selectionFocusObject.stringValue,
-                    "AXValue: " + contenteditableLines[i].textContent);
+                assert_equals(rootAccessible.selectionFocusObject.name,
+                    contenteditableLines[i].textContent);
                 assert_equals(rootAccessible.selectionFocusOffset, 6);
             }
 
diff --git a/third_party/WebKit/LayoutTests/accessibility/deleting-iframe-destroys-axcache-expected.txt b/third_party/WebKit/LayoutTests/accessibility/deleting-iframe-destroys-axcache-expected.txt
index 37414078..e8e7639 100644
--- a/third_party/WebKit/LayoutTests/accessibility/deleting-iframe-destroys-axcache-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/deleting-iframe-destroys-axcache-expected.txt
@@ -14,32 +14,32 @@
 TEST COMPLETE
 
 Before:
-AXRole: AXWebArea AXValue: 
-    AXRole: AXParagraph AXValue: 
-        AXRole: AXStaticText AXValue: Before
-            AXRole: AXInlineTextBox AXValue: Before
-    AXRole: AXGroup AXValue: 
-        AXRole: AXUnknown AXValue: 
-            AXRole: AXScrollArea AXValue: 
-                AXRole: AXWebArea AXValue: 
-                    AXRole: AXGroup AXValue: 
-                        AXRole: AXButton AXValue: 
-    AXRole: AXParagraph AXValue: 
-        AXRole: AXStaticText AXValue: After
-            AXRole: AXInlineTextBox AXValue: After
-    AXRole: AXParagraph AXValue: 
-        AXRole: AXStaticText AXValue: End of test
+AXRole: AXWebArea
+    AXRole: AXParagraph
+        AXRole: AXStaticText "Before"
+            AXRole: AXInlineTextBox "Before"
+    AXRole: AXGroup
+        AXRole: AXUnknown
+            AXRole: AXScrollArea
+                AXRole: AXWebArea
+                    AXRole: AXGroup
+                        AXRole: AXButton "Click me"
+    AXRole: AXParagraph
+        AXRole: AXStaticText "After"
+            AXRole: AXInlineTextBox "After"
+    AXRole: AXParagraph
+        AXRole: AXStaticText "End of test"
 
 After:
-AXRole: AXWebArea AXValue: 
-    AXRole: AXParagraph AXValue: 
-        AXRole: AXStaticText AXValue: Before
-            AXRole: AXInlineTextBox AXValue: Before
-    AXRole: AXParagraph AXValue: 
-        AXRole: AXStaticText AXValue: After
-            AXRole: AXInlineTextBox AXValue: After
-    AXRole: AXParagraph AXValue: 
-        AXRole: AXStaticText AXValue: End of test
+AXRole: AXWebArea
+    AXRole: AXParagraph
+        AXRole: AXStaticText "Before"
+            AXRole: AXInlineTextBox "Before"
+    AXRole: AXParagraph
+        AXRole: AXStaticText "After"
+            AXRole: AXInlineTextBox "After"
+    AXRole: AXParagraph
+        AXRole: AXStaticText "End of test"
 
 PASS frameBodyRole == frameBody.role is false
 PASS frameGroupRole == frameGroup.role is false
diff --git a/third_party/WebKit/LayoutTests/accessibility/div-within-anchors-causes-crash-expected.txt b/third_party/WebKit/LayoutTests/accessibility/div-within-anchors-causes-crash-expected.txt
index 98e8426..d3b80c8 100644
--- a/third_party/WebKit/LayoutTests/accessibility/div-within-anchors-causes-crash-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/div-within-anchors-causes-crash-expected.txt
@@ -5,14 +5,14 @@
 
 
 Before:
-AXRole: AXWebArea AXValue: 
-    AXRole: AXLink AXValue: 
-    AXRole: AXDiv AXValue: 
-        AXRole: AXStaticText AXValue: End of test
+AXRole: AXWebArea
+    AXRole: AXLink
+    AXRole: AXDiv
+        AXRole: AXStaticText "End of test"
 After:
-AXRole: AXWebArea AXValue: 
-    AXRole: AXDiv AXValue: 
-        AXRole: AXStaticText AXValue: End of test
+AXRole: AXWebArea
+    AXRole: AXDiv
+        AXRole: AXStaticText "End of test"
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/third_party/WebKit/LayoutTests/accessibility/element-role-mapping-normal-expected.txt b/third_party/WebKit/LayoutTests/accessibility/element-role-mapping-normal-expected.txt
index 2cfa08c..b486e5f 100644
--- a/third_party/WebKit/LayoutTests/accessibility/element-role-mapping-normal-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/element-role-mapping-normal-expected.txt
@@ -48,167 +48,165 @@
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-AXRole: AXWebArea AXValue: 
-    AXRole: AXBanner AXValue: 
-        AXRole: AXStaticText AXValue: This is a Header for this page
-            AXRole: AXInlineTextBox AXValue: This is a Header for this page
-    AXRole: AXHeading AXValue: 
-        AXRole: AXStaticText AXValue: Heading
-            AXRole: AXInlineTextBox AXValue: Heading
-    AXRole: AXDiv AXValue: 
-        AXRole: AXStaticText AXValue: Division
-            AXRole: AXInlineTextBox AXValue: Division
-    AXRole: AXParagraph AXValue: 
-        AXRole: AXStaticText AXValue: Paragraph
-            AXRole: AXInlineTextBox AXValue: Paragraph
-    AXRole: AXGroup AXValue: 
-        AXRole: AXRuby AXValue: 
-            AXRole: AXAnnotation AXValue: 
-                AXRole: AXStaticText AXValue: 한국
-                    AXRole: AXInlineTextBox AXValue: 한국
-            AXRole: AXGroup AXValue: 
-                AXRole: AXStaticText AXValue: 韓國
-                    AXRole: AXInlineTextBox AXValue: 韓國
-    AXRole: AXDescriptionList AXValue: 
-        AXRole: AXDescriptionListTerm AXValue: 
-            AXRole: AXStaticText AXValue: Coffee
-                AXRole: AXInlineTextBox AXValue: Coffee
-        AXRole: AXDescriptionListDetail AXValue: 
-            AXRole: AXStaticText AXValue: - black hot drink
-                AXRole: AXInlineTextBox AXValue: - black hot drink
-        AXRole: AXDescriptionListTerm AXValue: 
-            AXRole: AXStaticText AXValue: Milk
-                AXRole: AXInlineTextBox AXValue: Milk
-        AXRole: AXDescriptionListDetail AXValue: 
-            AXRole: AXStaticText AXValue: - white cold drink
-                AXRole: AXInlineTextBox AXValue: - white cold drink
-    AXRole: AXGroup AXValue: 
-        AXRole: AXMath AXValue: 
-            AXRole: AXStaticText AXValue: x 
-                AXRole: AXInlineTextBox AXValue: x 
-            AXRole: AXStaticText AXValue: + 
-                AXRole: AXInlineTextBox AXValue: + 
-            AXRole: AXStaticText AXValue: a 
-                AXRole: AXInlineTextBox AXValue: a 
-            AXRole: AXStaticText AXValue: / 
-                AXRole: AXInlineTextBox AXValue: / 
-            AXRole: AXStaticText AXValue: b
-                AXRole: AXInlineTextBox AXValue: b
-    AXRole: AXMain AXValue: 
-        AXRole: AXArticle AXValue: 
-            AXRole: AXHeading AXValue: 
-                AXRole: AXStaticText AXValue: Most important heading here
-                    AXRole: AXInlineTextBox AXValue: Most important heading here
-            AXRole: AXHeading AXValue: 
-                AXRole: AXStaticText AXValue: Google Chrome
-                    AXRole: AXInlineTextBox AXValue: Google Chrome
-            AXRole: AXParagraph AXValue: 
-                AXRole: AXStaticText AXValue: Google Chrome is a free, open-source web browser developed by Google, released in 2008.
-                    AXRole: AXInlineTextBox AXValue: Google Chrome is a free, open-source web browser developed by Google, 
-                    AXRole: AXInlineTextBox AXValue: released in 2008.
-            AXRole: AXParagraph AXValue: 
-                AXRole: AXStaticText AXValue: Footer in article
-                    AXRole: AXInlineTextBox AXValue: Footer in article
-    AXRole: AXNavigation AXValue: 
-        AXRole: AXLink AXValue: 
-            AXRole: AXStaticText AXValue: HTML
-                AXRole: AXInlineTextBox AXValue: HTML
-        AXRole: AXStaticText AXValue:  | 
-            AXRole: AXInlineTextBox AXValue:  | 
-        AXRole: AXLink AXValue: 
-            AXRole: AXStaticText AXValue: CSS
-                AXRole: AXInlineTextBox AXValue: CSS
-        AXRole: AXStaticText AXValue:  | 
-            AXRole: AXInlineTextBox AXValue:  | 
-        AXRole: AXLink AXValue: 
-            AXRole: AXStaticText AXValue: JavaScript
-                AXRole: AXInlineTextBox AXValue: JavaScript
-        AXRole: AXStaticText AXValue:  |
-            AXRole: AXInlineTextBox AXValue:  |
-    AXRole: AXComplementary AXValue: 
-        AXRole: AXParagraph AXValue: 
-            AXRole: AXStaticText AXValue: Text that appears under aside
-                AXRole: AXInlineTextBox AXValue: Text that appears under aside
-    AXRole: AXPre AXValue: 
-        AXRole: AXStaticText AXValue: Text in a    pre
-element
-
-            AXRole: AXInlineTextBox AXValue: Text in a    pre
-            AXRole: AXInlineTextBox AXValue: 
-
-            AXRole: AXInlineTextBox AXValue: element
-            AXRole: AXInlineTextBox AXValue: 
-
-    AXRole: AXRegion AXValue: 
-        AXRole: AXHeading AXValue: 
-            AXRole: AXStaticText AXValue: Most important heading here
-                AXRole: AXInlineTextBox AXValue: Most important heading here
-        AXRole: AXParagraph AXValue: 
-            AXRole: AXStaticText AXValue: Section
-                AXRole: AXInlineTextBox AXValue: Section
-        AXRole: AXParagraph AXValue: 
-            AXRole: AXStaticText AXValue: Footer in section
-                AXRole: AXInlineTextBox AXValue: Footer in section
-    AXRole: AXContentInfo AXValue: 
-        AXRole: AXStaticText AXValue: Written by Julie
-            AXRole: AXInlineTextBox AXValue: Written by Julie
-        AXRole: AXUnknown AXValue: 
-
-            AXRole: AXInlineTextBox AXValue: 
-
-        AXRole: AXStaticText AXValue: Visit us at:www.chromium.org
-            AXRole: AXInlineTextBox AXValue: Visit us at:www.chromium.org
-        AXRole: AXUnknown AXValue: 
-
-            AXRole: AXInlineTextBox AXValue: 
-
-    AXRole: AXParagraph AXValue: 
-        AXRole: AXStaticText AXValue: January
-            AXRole: AXInlineTextBox AXValue: January
-        AXRole: AXDialog AXValue: 
-            AXRole: AXStaticText AXValue: This is an open dialog window
-                AXRole: AXInlineTextBox AXValue: This is an open dialog window
-    AXRole: AXGroup AXValue: 
-        AXRole: AXUnknown AXValue: 
-            AXRole: AXScrollArea AXValue: 
-                AXRole: AXWebArea AXValue: 
-        AXRole: AXUnknown AXValue: 
-            AXRole: AXScrollArea AXValue: 
-                AXRole: AXWebArea AXValue: 
-    AXRole: AXTable AXValue: 
-        AXRole: AXCaption AXValue: 
-            AXRole: AXStaticText AXValue: Caption
-                AXRole: AXInlineTextBox AXValue: Caption
-        AXRole: AXRow AXValue: 
-            AXRole: AXCell AXValue: 
-                AXRole: AXStaticText AXValue: Cell1
-                    AXRole: AXInlineTextBox AXValue: Cell1
-            AXRole: AXCell AXValue: 
-                AXRole: AXStaticText AXValue: Cell2
-                    AXRole: AXInlineTextBox AXValue: Cell2
-        AXRole: AXColumn AXValue: 
-            AXRole: AXCell AXValue: 
-                AXRole: AXStaticText AXValue: Cell1
-                    AXRole: AXInlineTextBox AXValue: Cell1
-        AXRole: AXColumn AXValue: 
-            AXRole: AXCell AXValue: 
-                AXRole: AXStaticText AXValue: Cell2
-                    AXRole: AXInlineTextBox AXValue: Cell2
-        AXRole: AXTableHeaderContainer AXValue: 
-    AXRole: AXFigure AXValue: 
-        AXRole: AXGroup AXValue: 
-            AXRole: AXImage AXValue: 
-        AXRole: AXFigcaption AXValue: 
-            AXRole: AXStaticText AXValue: Fig1. - Blue Box
-                AXRole: AXInlineTextBox AXValue: Fig1. - Blue Box
-    AXRole: AXGroup AXValue: 
-        AXRole: AXEmbeddedObject AXValue: 
-    AXRole: AXFooter AXValue: 
-        AXRole: AXParagraph AXValue: 
-            AXRole: AXStaticText AXValue: This is a footer.
-                AXRole: AXInlineTextBox AXValue: This is a footer.
-    AXRole: AXParagraph AXValue: 
-        AXRole: AXStaticText AXValue: End of test
+AXRole: AXWebArea
+    AXRole: AXBanner
+        AXRole: AXStaticText "This is a Header for this page"
+            AXRole: AXInlineTextBox "This is a Header for this page"
+    AXRole: AXHeading "Heading"
+        AXRole: AXStaticText "Heading"
+            AXRole: AXInlineTextBox "Heading"
+    AXRole: AXDiv
+        AXRole: AXStaticText "Division"
+            AXRole: AXInlineTextBox "Division"
+    AXRole: AXParagraph
+        AXRole: AXStaticText "Paragraph"
+            AXRole: AXInlineTextBox "Paragraph"
+    AXRole: AXGroup
+        AXRole: AXRuby
+            AXRole: AXAnnotation
+                AXRole: AXStaticText "한국"
+                    AXRole: AXInlineTextBox "한국"
+            AXRole: AXGroup
+                AXRole: AXStaticText "韓國"
+                    AXRole: AXInlineTextBox "韓國"
+    AXRole: AXDescriptionList
+        AXRole: AXDescriptionListTerm
+            AXRole: AXStaticText "Coffee"
+                AXRole: AXInlineTextBox "Coffee"
+        AXRole: AXDescriptionListDetail
+            AXRole: AXStaticText "- black hot drink"
+                AXRole: AXInlineTextBox "- black hot drink"
+        AXRole: AXDescriptionListTerm
+            AXRole: AXStaticText "Milk"
+                AXRole: AXInlineTextBox "Milk"
+        AXRole: AXDescriptionListDetail
+            AXRole: AXStaticText "- white cold drink"
+                AXRole: AXInlineTextBox "- white cold drink"
+    AXRole: AXGroup
+        AXRole: AXMath
+            AXRole: AXStaticText "x "
+                AXRole: AXInlineTextBox "x "
+            AXRole: AXStaticText "+ "
+                AXRole: AXInlineTextBox "+ "
+            AXRole: AXStaticText "a "
+                AXRole: AXInlineTextBox "a "
+            AXRole: AXStaticText "/ "
+                AXRole: AXInlineTextBox "/ "
+            AXRole: AXStaticText "b"
+                AXRole: AXInlineTextBox "b"
+    AXRole: AXMain
+        AXRole: AXArticle
+            AXRole: AXHeading "Most important heading here"
+                AXRole: AXStaticText "Most important heading here"
+                    AXRole: AXInlineTextBox "Most important heading here"
+            AXRole: AXHeading "Google Chrome"
+                AXRole: AXStaticText "Google Chrome"
+                    AXRole: AXInlineTextBox "Google Chrome"
+            AXRole: AXParagraph
+                AXRole: AXStaticText "Google Chrome is a free, open-source web browser developed by Google, released in 2008."
+                    AXRole: AXInlineTextBox "Google Chrome is a free, open-source web browser developed by Google, "
+                    AXRole: AXInlineTextBox "released in 2008."
+            AXRole: AXParagraph
+                AXRole: AXStaticText "Footer in article"
+                    AXRole: AXInlineTextBox "Footer in article"
+    AXRole: AXNavigation
+        AXRole: AXLink "HTML"
+            AXRole: AXStaticText "HTML"
+                AXRole: AXInlineTextBox "HTML"
+        AXRole: AXStaticText " | "
+            AXRole: AXInlineTextBox " | "
+        AXRole: AXLink "CSS"
+            AXRole: AXStaticText "CSS"
+                AXRole: AXInlineTextBox "CSS"
+        AXRole: AXStaticText " | "
+            AXRole: AXInlineTextBox " | "
+        AXRole: AXLink "JavaScript"
+            AXRole: AXStaticText "JavaScript"
+                AXRole: AXInlineTextBox "JavaScript"
+        AXRole: AXStaticText " |"
+            AXRole: AXInlineTextBox " |"
+    AXRole: AXComplementary
+        AXRole: AXParagraph
+            AXRole: AXStaticText "Text that appears under aside"
+                AXRole: AXInlineTextBox "Text that appears under aside"
+    AXRole: AXPre
+        AXRole: AXStaticText "Text in a    pre element "
+            AXRole: AXInlineTextBox "Text in a    pre"
+            AXRole: AXInlineTextBox "
+"
+            AXRole: AXInlineTextBox "element"
+            AXRole: AXInlineTextBox "
+"
+    AXRole: AXRegion
+        AXRole: AXHeading "Most important heading here"
+            AXRole: AXStaticText "Most important heading here"
+                AXRole: AXInlineTextBox "Most important heading here"
+        AXRole: AXParagraph
+            AXRole: AXStaticText "Section"
+                AXRole: AXInlineTextBox "Section"
+        AXRole: AXParagraph
+            AXRole: AXStaticText "Footer in section"
+                AXRole: AXInlineTextBox "Footer in section"
+    AXRole: AXContentInfo
+        AXRole: AXStaticText "Written by Julie"
+            AXRole: AXInlineTextBox "Written by Julie"
+        AXRole: AXUnknown "
+"
+            AXRole: AXInlineTextBox "
+"
+        AXRole: AXStaticText "Visit us at:www.chromium.org"
+            AXRole: AXInlineTextBox "Visit us at:www.chromium.org"
+        AXRole: AXUnknown "
+"
+            AXRole: AXInlineTextBox "
+"
+    AXRole: AXParagraph
+        AXRole: AXStaticText "January"
+            AXRole: AXInlineTextBox "January"
+        AXRole: AXDialog
+            AXRole: AXStaticText "This is an open dialog window"
+                AXRole: AXInlineTextBox "This is an open dialog window"
+    AXRole: AXGroup
+        AXRole: AXUnknown
+            AXRole: AXScrollArea
+                AXRole: AXWebArea
+        AXRole: AXUnknown
+            AXRole: AXScrollArea
+                AXRole: AXWebArea
+    AXRole: AXTable "Caption"
+        AXRole: AXCaption
+            AXRole: AXStaticText "Caption"
+                AXRole: AXInlineTextBox "Caption"
+        AXRole: AXRow
+            AXRole: AXCell
+                AXRole: AXStaticText "Cell1"
+                    AXRole: AXInlineTextBox "Cell1"
+            AXRole: AXCell
+                AXRole: AXStaticText "Cell2"
+                    AXRole: AXInlineTextBox "Cell2"
+        AXRole: AXColumn
+            AXRole: AXCell
+                AXRole: AXStaticText "Cell1"
+                    AXRole: AXInlineTextBox "Cell1"
+        AXRole: AXColumn
+            AXRole: AXCell
+                AXRole: AXStaticText "Cell2"
+                    AXRole: AXInlineTextBox "Cell2"
+        AXRole: AXTableHeaderContainer
+    AXRole: AXFigure "Fig1. - Blue Box"
+        AXRole: AXGroup
+            AXRole: AXImage "blue"
+        AXRole: AXFigcaption
+            AXRole: AXStaticText "Fig1. - Blue Box"
+                AXRole: AXInlineTextBox "Fig1. - Blue Box"
+    AXRole: AXGroup
+        AXRole: AXEmbeddedObject
+    AXRole: AXFooter
+        AXRole: AXParagraph
+            AXRole: AXStaticText "This is a footer."
+                AXRole: AXInlineTextBox "This is a footer."
+    AXRole: AXParagraph
+        AXRole: AXStaticText "End of test"
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/third_party/WebKit/LayoutTests/accessibility/first-letter-text-transform-causes-crash-expected.txt b/third_party/WebKit/LayoutTests/accessibility/first-letter-text-transform-causes-crash-expected.txt
index 77a30600..eb55ddf5 100644
--- a/third_party/WebKit/LayoutTests/accessibility/first-letter-text-transform-causes-crash-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/first-letter-text-transform-causes-crash-expected.txt
@@ -6,14 +6,14 @@
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-AXRole: AXWebArea AXValue: 
-    AXRole: AXDescriptionListTerm AXValue: 
-        AXRole: AXStaticText AXValue: D
-            AXRole: AXInlineTextBox AXValue: D
-        AXRole: AXStaticText AXValue: Dt
-            AXRole: AXInlineTextBox AXValue: Dt
-    AXRole: AXParagraph AXValue: 
-        AXRole: AXStaticText AXValue: End of test
+AXRole: AXWebArea
+    AXRole: AXDescriptionListTerm
+        AXRole: AXStaticText "D"
+            AXRole: AXInlineTextBox "D"
+        AXRole: AXStaticText "Dt"
+            AXRole: AXInlineTextBox "Dt"
+    AXRole: AXParagraph
+        AXRole: AXStaticText "End of test"
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/third_party/WebKit/LayoutTests/accessibility/img-alt-tag-only-whitespace-expected.txt b/third_party/WebKit/LayoutTests/accessibility/img-alt-tag-only-whitespace-expected.txt
index fbd2c8b..b9b8cc0 100644
--- a/third_party/WebKit/LayoutTests/accessibility/img-alt-tag-only-whitespace-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/img-alt-tag-only-whitespace-expected.txt
@@ -1,4 +1,4 @@
-CONSOLE MESSAGE: line 26: Image description: Image
+CONSOLE MESSAGE: line 26: Image description:    Image 
 
 
 
diff --git a/third_party/WebKit/LayoutTests/accessibility/inline-text-bidi-bounds-for-range.html b/third_party/WebKit/LayoutTests/accessibility/inline-text-bidi-bounds-for-range.html
index 7996a325..ed0985a 100644
--- a/third_party/WebKit/LayoutTests/accessibility/inline-text-bidi-bounds-for-range.html
+++ b/third_party/WebKit/LayoutTests/accessibility/inline-text-bidi-bounds-for-range.html
@@ -34,7 +34,7 @@
             // Get the bounds from the accessibility tree.
             var axParagraph = accessibilityController.accessibleElementById(elementId);
             var axStaticText = axParagraph.childAtIndex(0);
-            var text = axStaticText.stringValue.substr(9);
+            var text = axStaticText.name;
             var wordAxIndex = text.indexOf(word);
             eval('window.axBounds = ' + axStaticText.boundsForRange(wordAxIndex, wordAxIndex + word.length) + ';');
 
diff --git a/third_party/WebKit/LayoutTests/accessibility/inline-text-bounds-for-range.html b/third_party/WebKit/LayoutTests/accessibility/inline-text-bounds-for-range.html
index 38e04bd..39a7c7e 100644
--- a/third_party/WebKit/LayoutTests/accessibility/inline-text-bounds-for-range.html
+++ b/third_party/WebKit/LayoutTests/accessibility/inline-text-bounds-for-range.html
@@ -25,9 +25,7 @@
         var axParagraph = accessibilityController.accessibleElementById('paragraph');
         var axStaticText = axParagraph.childAtIndex(0);
 
-        // The first characters of stringValue are 'AXValue: ' - use substr to get rid of those.
-        // The accessible text shouldn't have any spaces.
-        var text = axStaticText.stringValue.substr(9);
+        var text = axStaticText.name;
         shouldBe("text.length", "185");
         debug("Accessible text: \"" + text + "\"");
 
@@ -35,7 +33,7 @@
         var appendedInlineText = '';
         for (var i = 0; i < axStaticText.childrenCount; i++) {
             var axInlineTextBox = axStaticText.childAtIndex(i);
-            appendedInlineText += axInlineTextBox.stringValue.substr(9);
+            appendedInlineText += axInlineTextBox.name;
         }
         shouldBe("appendedInlineText", "text");
 
diff --git a/third_party/WebKit/LayoutTests/accessibility/inline-text-change-style-expected.txt b/third_party/WebKit/LayoutTests/accessibility/inline-text-change-style-expected.txt
index 0d6b7ab..b838734 100644
--- a/third_party/WebKit/LayoutTests/accessibility/inline-text-change-style-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/inline-text-change-style-expected.txt
@@ -6,10 +6,10 @@
 
 
 PASS axStaticText.childrenCount is 2
-PASS axInlineBefore0.stringValue is 'AXValue: This paragraph contains '
-PASS axInlineBefore1.stringValue is 'AXValue: two lines of text.'
+PASS axInlineBefore0.name is 'This paragraph contains '
+PASS axInlineBefore1.name is 'two lines of text.'
 PASS axStaticText.childrenCount is 1
-PASS axInlineAfter0.stringValue is 'AXValue: This paragraph contains two lines of text.'
+PASS axInlineAfter0.name is 'This paragraph contains two lines of text.'
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/third_party/WebKit/LayoutTests/accessibility/inline-text-change-style.html b/third_party/WebKit/LayoutTests/accessibility/inline-text-change-style.html
index e05e8a2..6476091 100644
--- a/third_party/WebKit/LayoutTests/accessibility/inline-text-change-style.html
+++ b/third_party/WebKit/LayoutTests/accessibility/inline-text-change-style.html
@@ -26,9 +26,9 @@
         shouldBe("axStaticText.childrenCount", "2");
 
         window.axInlineBefore0 = axStaticText.childAtIndex(0);
-        shouldBe("axInlineBefore0.stringValue",  "'AXValue: This paragraph contains '");
+        shouldBe("axInlineBefore0.name",  "'This paragraph contains '");
         window.axInlineBefore1 = axStaticText.childAtIndex(1);
-        shouldBe("axInlineBefore1.stringValue", "'AXValue: two lines of text.'");
+        shouldBe("axInlineBefore1.name", "'two lines of text.'");
 
         // Modify the text.
         document.getElementById("p").style.width = "100em";
@@ -38,7 +38,7 @@
             // Make sure the inline text boxes changed.
             shouldBe("axStaticText.childrenCount", "1");
             window.axInlineAfter0 = axStaticText.childAtIndex(0);
-            shouldBe("axInlineAfter0.stringValue",  "'AXValue: This paragraph contains two lines of text.'");
+            shouldBe("axInlineAfter0.name",  "'This paragraph contains two lines of text.'");
             finishJSTest();
         });
     }
diff --git a/third_party/WebKit/LayoutTests/accessibility/inline-text-changes-expected.txt b/third_party/WebKit/LayoutTests/accessibility/inline-text-changes-expected.txt
index f86dd378..edc4ceae 100644
--- a/third_party/WebKit/LayoutTests/accessibility/inline-text-changes-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/inline-text-changes-expected.txt
@@ -6,13 +6,13 @@
 
 
 PASS axStaticText.childrenCount is 2
-PASS axInlineBefore0.stringValue is 'AXValue: This paragraph contains '
-PASS axInlineBefore1.stringValue is 'AXValue: two lines of text.'
+PASS axInlineBefore0.name is 'This paragraph contains '
+PASS axInlineBefore1.name is 'two lines of text.'
 PASS axStaticText.childrenCount is 3
-PASS axInlineAfter0.stringValue is 'AXValue: This paragraph contains '
-PASS axInlineAfter1.stringValue is 'AXValue: two lines of text. One '
-PASS axInlineAfter2.stringValue is 'AXValue: more sentence.'
-PASS axInlineBefore1.stringValue is 'AXValue: '
+PASS axInlineAfter0.name is 'This paragraph contains '
+PASS axInlineAfter1.name is 'two lines of text. One '
+PASS axInlineAfter2.name is 'more sentence.'
+PASS axInlineBefore1.name is ''
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/third_party/WebKit/LayoutTests/accessibility/inline-text-changes.html b/third_party/WebKit/LayoutTests/accessibility/inline-text-changes.html
index c5528fd..054bb70 100644
--- a/third_party/WebKit/LayoutTests/accessibility/inline-text-changes.html
+++ b/third_party/WebKit/LayoutTests/accessibility/inline-text-changes.html
@@ -26,9 +26,9 @@
         shouldBe("axStaticText.childrenCount", "2");
 
         window.axInlineBefore0 = axStaticText.childAtIndex(0);
-        shouldBe("axInlineBefore0.stringValue",  "'AXValue: This paragraph contains '");
+        shouldBe("axInlineBefore0.name",  "'This paragraph contains '");
         window.axInlineBefore1 = axStaticText.childAtIndex(1);
-        shouldBe("axInlineBefore1.stringValue", "'AXValue: two lines of text.'");
+        shouldBe("axInlineBefore1.name", "'two lines of text.'");
 
         // Modify the text.
         document.getElementById("p").innerText += ' One more sentence.';
@@ -38,14 +38,14 @@
             // Make sure the inline text boxes changed.
             shouldBe("axStaticText.childrenCount", "3");
             window.axInlineAfter0 = axStaticText.childAtIndex(0);
-            shouldBe("axInlineAfter0.stringValue",  "'AXValue: This paragraph contains '");
+            shouldBe("axInlineAfter0.name",  "'This paragraph contains '");
             window.axInlineAfter1 = axStaticText.childAtIndex(1);
-            shouldBe("axInlineAfter1.stringValue", "'AXValue: two lines of text. One '");
+            shouldBe("axInlineAfter1.name", "'two lines of text. One '");
             window.axInlineAfter2 = axStaticText.childAtIndex(2);
-            shouldBe("axInlineAfter2.stringValue", "'AXValue: more sentence.'");
+            shouldBe("axInlineAfter2.name", "'more sentence.'");
 
             // Make sure the old object pointing to the second text box is no longer valid.
-            shouldBe("axInlineBefore1.stringValue", "'AXValue: '");
+            shouldBe("axInlineBefore1.name", "''");
             finishJSTest();
         });
     }
diff --git a/third_party/WebKit/LayoutTests/accessibility/inline-text-input-expected.txt b/third_party/WebKit/LayoutTests/accessibility/inline-text-input-expected.txt
index 67d7196..a684c010 100644
--- a/third_party/WebKit/LayoutTests/accessibility/inline-text-input-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/inline-text-input-expected.txt
@@ -5,7 +5,7 @@
 
 
 PASS axInlineTextBox.role is 'AXRole: AXInlineTextBox'
-PASS axInlineTextBox.stringValue is 'AXValue: Value'
+PASS axInlineTextBox.name is 'Value'
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/third_party/WebKit/LayoutTests/accessibility/inline-text-input.html b/third_party/WebKit/LayoutTests/accessibility/inline-text-input.html
index 51b4de7..719e2e9 100644
--- a/third_party/WebKit/LayoutTests/accessibility/inline-text-input.html
+++ b/third_party/WebKit/LayoutTests/accessibility/inline-text-input.html
@@ -31,7 +31,7 @@
         var axStaticText = axDiv.childAtIndex(0);
         var axInlineTextBox = axStaticText.childAtIndex(0);
         shouldBe("axInlineTextBox.role", "'AXRole: AXInlineTextBox'");
-        shouldBe("axInlineTextBox.stringValue", "'AXValue: Value'");
+        shouldBe("axInlineTextBox.name", "'Value'");
     }
 </script>
 
diff --git a/third_party/WebKit/LayoutTests/accessibility/inline-text-word-boundaries.html b/third_party/WebKit/LayoutTests/accessibility/inline-text-word-boundaries.html
index 9fe64f4..8bc5cbe1 100644
--- a/third_party/WebKit/LayoutTests/accessibility/inline-text-word-boundaries.html
+++ b/third_party/WebKit/LayoutTests/accessibility/inline-text-word-boundaries.html
@@ -25,7 +25,7 @@
     if (window.accessibilityController) {
         var axParagraph = accessibilityController.accessibleElementById('paragraph');
         var axStaticText = axParagraph.childAtIndex(0);
-        var text = axStaticText.stringValue.substr(9);
+        var text = axStaticText.name;
         debug("Accessible text: \"" + text + "\"");
 
         for (var i = 0; i < text.length; i++) {
diff --git a/third_party/WebKit/LayoutTests/accessibility/legend-expected.txt b/third_party/WebKit/LayoutTests/accessibility/legend-expected.txt
index 47ae9b5..a1d1dc71 100644
--- a/third_party/WebKit/LayoutTests/accessibility/legend-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/legend-expected.txt
@@ -6,19 +6,19 @@
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-AXRole: AXWebArea AXValue: 
-    AXRole: AXGroup AXValue: 
-        AXRole: AXLegend AXValue:      << fieldset's titleUIElement
-            AXRole: AXStaticText AXValue: Choose a shipping method:
-                AXRole: AXInlineTextBox AXValue: Choose a shipping method:
-        AXRole: AXGroup AXValue: 
-            AXRole: AXRadioButton AXValue: 
-            AXRole: AXStaticText AXValue: Overnight
-                AXRole: AXInlineTextBox AXValue: Overnight
-    AXRole: AXDiv AXValue: 
-        AXRole: AXStaticText AXValue: End of test
+AXRole: AXWebArea
+    AXRole: AXGroup "Choose a shipping method:"
+        AXRole: AXLegend     << fieldset's titleUIElement
+            AXRole: AXStaticText "Choose a shipping method:"
+                AXRole: AXInlineTextBox "Choose a shipping method:"
+        AXRole: AXGroup
+            AXRole: AXRadioButton
+            AXRole: AXStaticText "Overnight"
+                AXRole: AXInlineTextBox "Overnight"
+    AXRole: AXDiv
+        AXRole: AXStaticText "End of test"
 PASS titleUIElement != null is true
-PASS titleUIElementText.stringValue is 'AXValue: Choose a shipping method:'
+PASS titleUIElementText.name is 'Choose a shipping method:'
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/third_party/WebKit/LayoutTests/accessibility/legend.html b/third_party/WebKit/LayoutTests/accessibility/legend.html
index 4d46fdf4..dc7b832d 100644
--- a/third_party/WebKit/LayoutTests/accessibility/legend.html
+++ b/third_party/WebKit/LayoutTests/accessibility/legend.html
@@ -35,9 +35,9 @@
         shouldBeTrue("titleUIElement != null");
         var titleUIElementText = titleUIElement;
         while (titleUIElementText && titleUIElementText.childrenCount)
-            titleUIElementText = titleUIElementText.childAtIndex(0); 
+            titleUIElementText = titleUIElementText.childAtIndex(0);
 
-        shouldBe("titleUIElementText.stringValue", "'AXValue: Choose a shipping method:'");
+        shouldBe("titleUIElementText.name", "'Choose a shipping method:'");
     }
 </script>
 
diff --git a/third_party/WebKit/LayoutTests/accessibility/listitem-presentation-inherited-expected.txt b/third_party/WebKit/LayoutTests/accessibility/listitem-presentation-inherited-expected.txt
index b0165203..e58a890 100644
--- a/third_party/WebKit/LayoutTests/accessibility/listitem-presentation-inherited-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/listitem-presentation-inherited-expected.txt
@@ -11,27 +11,27 @@
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-AXRole: AXWebArea AXValue: 
-    AXRole: AXListItem AXValue: 
-        AXRole: AXListMarker AXValue: •
-        AXRole: AXStaticText AXValue: Item 1
-            AXRole: AXInlineTextBox AXValue: Item 1
-    AXRole: AXListItem AXValue: 
-        AXRole: AXListMarker AXValue: •
-        AXRole: AXStaticText AXValue: Item 2
-            AXRole: AXInlineTextBox AXValue: Item 2
-    AXRole: AXListItem AXValue: 
-        AXRole: AXListMarker AXValue: •
-        AXRole: AXStaticText AXValue: Item 3
-            AXRole: AXInlineTextBox AXValue: Item 3
-    AXRole: AXStaticText AXValue: Plain Text 1
-        AXRole: AXInlineTextBox AXValue: Plain Text 1
-    AXRole: AXStaticText AXValue: Plain Text 2
-        AXRole: AXInlineTextBox AXValue: Plain Text 2
-    AXRole: AXStaticText AXValue: Plain Text 3
-        AXRole: AXInlineTextBox AXValue: Plain Text 3
-    AXRole: AXParagraph AXValue: 
-        AXRole: AXStaticText AXValue: End of test
+AXRole: AXWebArea
+    AXRole: AXListItem "Item 1"
+        AXRole: AXListMarker "•"
+        AXRole: AXStaticText "Item 1"
+            AXRole: AXInlineTextBox "Item 1"
+    AXRole: AXListItem "Item 2"
+        AXRole: AXListMarker "•"
+        AXRole: AXStaticText "Item 2"
+            AXRole: AXInlineTextBox "Item 2"
+    AXRole: AXListItem "Item 3"
+        AXRole: AXListMarker "•"
+        AXRole: AXStaticText "Item 3"
+            AXRole: AXInlineTextBox "Item 3"
+    AXRole: AXStaticText "Plain Text 1"
+        AXRole: AXInlineTextBox "Plain Text 1"
+    AXRole: AXStaticText "Plain Text 2"
+        AXRole: AXInlineTextBox "Plain Text 2"
+    AXRole: AXStaticText "Plain Text 3"
+        AXRole: AXInlineTextBox "Plain Text 3"
+    AXRole: AXParagraph
+        AXRole: AXStaticText "End of test"
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/third_party/WebKit/LayoutTests/accessibility/menu-list-open.html b/third_party/WebKit/LayoutTests/accessibility/menu-list-open.html
index 1424f791..15ce9c8 100644
--- a/third_party/WebKit/LayoutTests/accessibility/menu-list-open.html
+++ b/third_party/WebKit/LayoutTests/accessibility/menu-list-open.html
@@ -17,7 +17,7 @@
     accessibilityController.addNotificationListener(function listener(element, notification) {
         if (notification == "Focus") {
             assert_equals(element.role, "AXRole: AXMenuListOption");
-            assert_equals(element.stringValue, "AXValue: Alicia");
+            assert_equals(element.name, "Alicia");
             t.done();
         }
     });
diff --git a/third_party/WebKit/LayoutTests/accessibility/menu-list-popup-reuses-objects.html b/third_party/WebKit/LayoutTests/accessibility/menu-list-popup-reuses-objects.html
index 4c0d31e..0a0abfe7 100644
--- a/third_party/WebKit/LayoutTests/accessibility/menu-list-popup-reuses-objects.html
+++ b/third_party/WebKit/LayoutTests/accessibility/menu-list-popup-reuses-objects.html
@@ -33,7 +33,7 @@
     accessibilityController.accessibleElementById('foo');
 
     accessibilityController.addNotificationListener(function(element, notification) {
-        if (element.stringValue == axMenuListOption.stringValue) {
+        if (element.name == axMenuListOption.name) {
             window.element = element;
             shouldBe("element.isEqual(axMenuListOption)", "true");
             shouldBe("element.parentElement().isEqual(axMenuListPopup)", "true");
diff --git a/third_party/WebKit/LayoutTests/accessibility/menu-list-selection-changed-expected.txt b/third_party/WebKit/LayoutTests/accessibility/menu-list-selection-changed-expected.txt
index 2e52dd7..dd62d355 100644
--- a/third_party/WebKit/LayoutTests/accessibility/menu-list-selection-changed-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/menu-list-selection-changed-expected.txt
@@ -4,8 +4,8 @@
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-Got notification on option AXValue: Alicia isSelected=false
-Got notification on option AXValue: Kalinda isSelected=true
+Got notification on option Alicia isSelected=false
+Got notification on option Kalinda isSelected=true
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/third_party/WebKit/LayoutTests/accessibility/menu-list-selection-changed.html b/third_party/WebKit/LayoutTests/accessibility/menu-list-selection-changed.html
index b584cee..83402ab 100644
--- a/third_party/WebKit/LayoutTests/accessibility/menu-list-selection-changed.html
+++ b/third_party/WebKit/LayoutTests/accessibility/menu-list-selection-changed.html
@@ -27,7 +27,7 @@
     var result = "";
     accessibilityController.addNotificationListener(function(element, notification) {
         if (element.role == "AXRole: AXMenuListOption") {
-            debug("Got notification on option " + element.stringValue + " isSelected=" + element.isSelected);
+            debug("Got notification on option " + element.name + " isSelected=" + element.isSelected);
             if (element.isSelected)
                 finishJSTest();
         }
diff --git a/third_party/WebKit/LayoutTests/accessibility/name-calc-native-markup-input-buttons.html b/third_party/WebKit/LayoutTests/accessibility/name-calc-native-markup-input-buttons.html
index b8dad94e..bc7d1aa 100644
--- a/third_party/WebKit/LayoutTests/accessibility/name-calc-native-markup-input-buttons.html
+++ b/third_party/WebKit/LayoutTests/accessibility/name-calc-native-markup-input-buttons.html
@@ -176,7 +176,7 @@
 test(function(t) {
     var axImageInput1 = accessibilityController.accessibleElementById("image-input1");
     assert_equals(axImageInput1.name, "Submit");
-    assert_equals(axImageInput1.nameFrom, "attribute");
+    assert_equals(axImageInput1.nameFrom, "value");
 }, "Image input with no value");
 </script>
 
@@ -224,7 +224,7 @@
 test(function(t) {
     var axImageInput5 = accessibilityController.accessibleElementById("image-input5");
     assert_equals(axImageInput5.name, "Submit");
-    assert_equals(axImageInput5.nameFrom, "attribute");
+    assert_equals(axImageInput5.nameFrom, "value");
 }, "Image input with title only");
 </script>
 
diff --git a/third_party/WebKit/LayoutTests/accessibility/presentation-owned-elements-expected.txt b/third_party/WebKit/LayoutTests/accessibility/presentation-owned-elements-expected.txt
index 14ff2b3e..8d44edb 100644
--- a/third_party/WebKit/LayoutTests/accessibility/presentation-owned-elements-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/presentation-owned-elements-expected.txt
@@ -27,79 +27,79 @@
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-AXRole: AXWebArea AXValue: 
-    AXRole: AXDiv AXValue: 
-        AXRole: AXStaticText AXValue: These lists have a static text role because they have a presentation role.
-            AXRole: AXInlineTextBox AXValue: These lists have a static text role because they have a presentation role.
-    AXRole: AXStaticText AXValue: Presentation Item 1
-        AXRole: AXInlineTextBox AXValue: Presentation Item 1
-    AXRole: AXStaticText AXValue: Presentation Item 2
-        AXRole: AXInlineTextBox AXValue: Presentation Item 2
-    AXRole: AXDiv AXValue: 
-        AXRole: AXStaticText AXValue: The first list item has a listitem role even if ul has a presentation role because it has an explicit role.
-            AXRole: AXInlineTextBox AXValue: The first list item has a listitem role even if ul has a presentation role because it has an explicit role.
-    AXRole: AXListItem AXValue: 
-        AXRole: AXListMarker AXValue: •
-        AXRole: AXStaticText AXValue: Explicit Item 1
-            AXRole: AXInlineTextBox AXValue: Explicit Item 1
-    AXRole: AXStaticText AXValue: Implicit Item 2
-        AXRole: AXInlineTextBox AXValue: Implicit Item 2
-    AXRole: AXDiv AXValue: 
-        AXRole: AXStaticText AXValue: These two tables have static text roles because they have presentation roles.
-            AXRole: AXInlineTextBox AXValue: These two tables have static text roles because they have presentation roles.
-    AXRole: AXStaticText AXValue: Presentation th
-        AXRole: AXInlineTextBox AXValue: Presentation th
-    AXRole: AXStaticText AXValue: Presentation th
-        AXRole: AXInlineTextBox AXValue: Presentation th
-    AXRole: AXStaticText AXValue: Presentation th
-        AXRole: AXInlineTextBox AXValue: Presentation th
-    AXRole: AXDiv AXValue: 
-        AXRole: AXStaticText AXValue: The "Presentation th" has a static text role because it has a presentation role.
-            AXRole: AXInlineTextBox AXValue: The "Presentation th" has a static text role because it has a presentation role.
-    AXRole: AXStaticText AXValue: Presentation th
-        AXRole: AXInlineTextBox AXValue: Presentation th
-    AXRole: AXGroup AXValue: 
-        AXRole: AXStaticText AXValue: Normal td
-            AXRole: AXInlineTextBox AXValue: Normal td
-    AXRole: AXDiv AXValue: 
-        AXRole: AXStaticText AXValue: The row for "Explicit th" has a row role even if table has a presentation role because it has an explicit role.
-            AXRole: AXInlineTextBox AXValue: The row for "Explicit th" has a row role even if table has a presentation role because it has an explicit role.
-    AXRole: AXRow AXValue: 
-        AXRole: AXGroup AXValue: 
-            AXRole: AXStaticText AXValue: Explicit th
-                AXRole: AXInlineTextBox AXValue: Explicit th
-    AXRole: AXStaticText AXValue: Implicit td
-        AXRole: AXInlineTextBox AXValue: Implicit td
-    AXRole: AXDiv AXValue: 
-        AXRole: AXStaticText AXValue: The menu items except button have a static text role because it has a presentation role and is disabled.
-            AXRole: AXInlineTextBox AXValue: The menu items except button have a static text role because it has a presentation role and is disabled.
-        AXRole: AXUnknown AXValue: 
-
-            AXRole: AXInlineTextBox AXValue: 
-
-        AXRole: AXStaticText AXValue: Button has a button role because it has an explicit role.
-            AXRole: AXInlineTextBox AXValue: Button has a button role because it has an explicit role.
-    AXRole: AXStaticText AXValue:  I have a bike 
-        AXRole: AXInlineTextBox AXValue:  I have a bike 
-    AXRole: AXButton AXValue: Click me
-    AXRole: AXStaticText AXValue:  Male 
-        AXRole: AXInlineTextBox AXValue:  Male 
-    AXRole: AXStaticText AXValue:  Female
-        AXRole: AXInlineTextBox AXValue:  Female
-    AXRole: AXDiv AXValue: 
-        AXRole: AXStaticText AXValue: The option A has a static text role because it has a presentation role and is disabled.
-            AXRole: AXInlineTextBox AXValue: The option A has a static text role because it has a presentation role and is disabled.
-        AXRole: AXUnknown AXValue: 
-
-            AXRole: AXInlineTextBox AXValue: 
-
-        AXRole: AXStaticText AXValue: The option B has option role because it has an explicit role.
-            AXRole: AXInlineTextBox AXValue: The option B has option role because it has an explicit role.
-    AXRole: AXGroup AXValue: 
-        AXRole: AXStaticText AXValue: A
-        AXRole: AXListBoxOption AXValue: B
-    AXRole: AXParagraph AXValue: 
-        AXRole: AXStaticText AXValue: End of test
+AXRole: AXWebArea
+    AXRole: AXDiv
+        AXRole: AXStaticText "These lists have a static text role because they have a presentation role."
+            AXRole: AXInlineTextBox "These lists have a static text role because they have a presentation role."
+    AXRole: AXStaticText "Presentation Item 1"
+        AXRole: AXInlineTextBox "Presentation Item 1"
+    AXRole: AXStaticText "Presentation Item 2"
+        AXRole: AXInlineTextBox "Presentation Item 2"
+    AXRole: AXDiv
+        AXRole: AXStaticText "The first list item has a listitem role even if ul has a presentation role because it has an explicit role."
+            AXRole: AXInlineTextBox "The first list item has a listitem role even if ul has a presentation role because it has an explicit role."
+    AXRole: AXListItem "Explicit Item 1"
+        AXRole: AXListMarker "•"
+        AXRole: AXStaticText "Explicit Item 1"
+            AXRole: AXInlineTextBox "Explicit Item 1"
+    AXRole: AXStaticText "Implicit Item 2"
+        AXRole: AXInlineTextBox "Implicit Item 2"
+    AXRole: AXDiv
+        AXRole: AXStaticText "These two tables have static text roles because they have presentation roles."
+            AXRole: AXInlineTextBox "These two tables have static text roles because they have presentation roles."
+    AXRole: AXStaticText "Presentation th"
+        AXRole: AXInlineTextBox "Presentation th"
+    AXRole: AXStaticText "Presentation th"
+        AXRole: AXInlineTextBox "Presentation th"
+    AXRole: AXStaticText "Presentation th"
+        AXRole: AXInlineTextBox "Presentation th"
+    AXRole: AXDiv
+        AXRole: AXStaticText "The "Presentation th" has a static text role because it has a presentation role."
+            AXRole: AXInlineTextBox "The "Presentation th" has a static text role because it has a presentation role."
+    AXRole: AXStaticText "Presentation th"
+        AXRole: AXInlineTextBox "Presentation th"
+    AXRole: AXGroup
+        AXRole: AXStaticText "Normal td"
+            AXRole: AXInlineTextBox "Normal td"
+    AXRole: AXDiv
+        AXRole: AXStaticText "The row for "Explicit th" has a row role even if table has a presentation role because it has an explicit role."
+            AXRole: AXInlineTextBox "The row for "Explicit th" has a row role even if table has a presentation role because it has an explicit role."
+    AXRole: AXRow
+        AXRole: AXGroup
+            AXRole: AXStaticText "Explicit th"
+                AXRole: AXInlineTextBox "Explicit th"
+    AXRole: AXStaticText "Implicit td"
+        AXRole: AXInlineTextBox "Implicit td"
+    AXRole: AXDiv
+        AXRole: AXStaticText "The menu items except button have a static text role because it has a presentation role and is disabled."
+            AXRole: AXInlineTextBox "The menu items except button have a static text role because it has a presentation role and is disabled."
+        AXRole: AXUnknown "
+"
+            AXRole: AXInlineTextBox "
+"
+        AXRole: AXStaticText "Button has a button role because it has an explicit role."
+            AXRole: AXInlineTextBox "Button has a button role because it has an explicit role."
+    AXRole: AXStaticText " I have a bike "
+        AXRole: AXInlineTextBox " I have a bike "
+    AXRole: AXButton "Click me"
+    AXRole: AXStaticText " Male "
+        AXRole: AXInlineTextBox " Male "
+    AXRole: AXStaticText " Female"
+        AXRole: AXInlineTextBox " Female"
+    AXRole: AXDiv
+        AXRole: AXStaticText "The option A has a static text role because it has a presentation role and is disabled."
+            AXRole: AXInlineTextBox "The option A has a static text role because it has a presentation role and is disabled."
+        AXRole: AXUnknown "
+"
+            AXRole: AXInlineTextBox "
+"
+        AXRole: AXStaticText "The option B has option role because it has an explicit role."
+            AXRole: AXInlineTextBox "The option B has option role because it has an explicit role."
+    AXRole: AXGroup
+        AXRole: AXStaticText "A"
+        AXRole: AXListBoxOption "B"
+    AXRole: AXParagraph
+        AXRole: AXStaticText "End of test"
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/third_party/WebKit/LayoutTests/accessibility/render-counter-text-expected.txt b/third_party/WebKit/LayoutTests/accessibility/render-counter-text-expected.txt
index 9d56abe..62a8446 100644
--- a/third_party/WebKit/LayoutTests/accessibility/render-counter-text-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/render-counter-text-expected.txt
@@ -2,12 +2,12 @@
 
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
-PASS line1.childAtIndex(0).stringValue is 'AXValue: 1'
-PASS line1.childAtIndex(1).stringValue is 'AXValue: :'
-PASS line1.childAtIndex(2).stringValue is 'AXValue: line1'
-PASS line2.childAtIndex(0).stringValue is 'AXValue: 2'
-PASS line2.childAtIndex(1).stringValue is 'AXValue: :'
-PASS line2.childAtIndex(2).stringValue is 'AXValue: line2'
+PASS line1.childAtIndex(0).name is '1'
+PASS line1.childAtIndex(1).name is ':'
+PASS line1.childAtIndex(2).name is 'line1'
+PASS line2.childAtIndex(0).name is '2'
+PASS line2.childAtIndex(1).name is ':'
+PASS line2.childAtIndex(2).name is 'line2'
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/third_party/WebKit/LayoutTests/accessibility/render-counter-text.html b/third_party/WebKit/LayoutTests/accessibility/render-counter-text.html
index ebd38f9..8af37e7 100644
--- a/third_party/WebKit/LayoutTests/accessibility/render-counter-text.html
+++ b/third_party/WebKit/LayoutTests/accessibility/render-counter-text.html
@@ -24,16 +24,16 @@
 description("This tests that the text for LayoutCounter is exposed correctly.")
 
 if (window.testRunner && window.accessibilityController) {
-    
+
     var line1 = accessibilityController.accessibleElementById("line1");
-    shouldBe("line1.childAtIndex(0).stringValue", "'AXValue: 1'");
-    shouldBe("line1.childAtIndex(1).stringValue", "'AXValue: :'");
-    shouldBe("line1.childAtIndex(2).stringValue", "'AXValue: line1'");
+    shouldBe("line1.childAtIndex(0).name", "'1'");
+    shouldBe("line1.childAtIndex(1).name", "':'");
+    shouldBe("line1.childAtIndex(2).name", "'line1'");
 
     var line2 = accessibilityController.accessibleElementById("line2");
-    shouldBe("line2.childAtIndex(0).stringValue", "'AXValue: 2'");
-    shouldBe("line2.childAtIndex(1).stringValue", "'AXValue: :'");
-    shouldBe("line2.childAtIndex(2).stringValue", "'AXValue: line2'");
+    shouldBe("line2.childAtIndex(0).name", "'2'");
+    shouldBe("line2.childAtIndex(1).name", "':'");
+    shouldBe("line2.childAtIndex(2).name", "'line2'");
 
     document.getElementById("container").style.display = "none";
 }
diff --git a/third_party/WebKit/LayoutTests/accessibility/role-attribute-expected.txt b/third_party/WebKit/LayoutTests/accessibility/role-attribute-expected.txt
index 99cabf8..5948ec0af 100644
--- a/third_party/WebKit/LayoutTests/accessibility/role-attribute-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/role-attribute-expected.txt
@@ -12,39 +12,39 @@
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-AXRole: AXWebArea AXValue: 
-    AXRole: AXRadioGroup AXValue: 
-        AXRole: AXRadioButton AXValue: 
-        AXRole: AXRadioButton AXValue: 
-        AXRole: AXRadioButton AXValue: 
-    AXRole: AXList AXValue: 
-        AXRole: AXListItem AXValue: 
-            AXRole: AXListMarker AXValue: 1
-            AXRole: AXStaticText AXValue: Implicit Item 1
-                AXRole: AXInlineTextBox AXValue: Implicit Item 1
-        AXRole: AXListItem AXValue: 
-            AXRole: AXListMarker AXValue: 2
-            AXRole: AXStaticText AXValue: Implicit Item 2
-                AXRole: AXInlineTextBox AXValue: Implicit Item 2
-        AXRole: AXListItem AXValue: 
-            AXRole: AXListMarker AXValue: 3
-            AXRole: AXStaticText AXValue: Implicit Item 3
-                AXRole: AXInlineTextBox AXValue: Implicit Item 3
-    AXRole: AXGroup AXValue: 
-        AXRole: AXGroup AXValue: 
-            AXRole: AXTextField AXValue: Explicit Option 1
-            AXRole: AXTextField AXValue: Explicit Option 2
-        AXRole: AXListBox AXValue: 
-            AXRole: AXListBoxOption AXValue: Implicit Option 1
-            AXRole: AXListBoxOption AXValue: Implicit Option 2
-        AXRole: AXStatus AXValue: 
-        AXRole: AXProgressIndicator AXValue: 
-        AXRole: AXStatus AXValue: 5
-            AXRole: AXSliderThumb AXValue: 
-        AXRole: AXSlider AXValue: 5
-            AXRole: AXSliderThumb AXValue: 
-    AXRole: AXParagraph AXValue: 
-        AXRole: AXStaticText AXValue: End of test
+AXRole: AXWebArea
+    AXRole: AXRadioGroup
+        AXRole: AXRadioButton "Explicit Item 1"
+        AXRole: AXRadioButton "Explicit Item 2"
+        AXRole: AXRadioButton "Explicit Item 3"
+    AXRole: AXList
+        AXRole: AXListItem "Implicit Item 1"
+            AXRole: AXListMarker "1"
+            AXRole: AXStaticText "Implicit Item 1"
+                AXRole: AXInlineTextBox "Implicit Item 1"
+        AXRole: AXListItem "Implicit Item 2"
+            AXRole: AXListMarker "2"
+            AXRole: AXStaticText "Implicit Item 2"
+                AXRole: AXInlineTextBox "Implicit Item 2"
+        AXRole: AXListItem "Implicit Item 3"
+            AXRole: AXListMarker "3"
+            AXRole: AXStaticText "Implicit Item 3"
+                AXRole: AXInlineTextBox "Implicit Item 3"
+    AXRole: AXGroup
+        AXRole: AXGroup
+            AXRole: AXTextField "Explicit Option 1"
+            AXRole: AXTextField "Explicit Option 2"
+        AXRole: AXListBox
+            AXRole: AXListBoxOption "Implicit Option 1"
+            AXRole: AXListBoxOption "Implicit Option 2"
+        AXRole: AXStatus
+        AXRole: AXProgressIndicator
+        AXRole: AXStatus
+            AXRole: AXSliderThumb
+        AXRole: AXSlider
+            AXRole: AXSliderThumb
+    AXRole: AXParagraph
+        AXRole: AXStaticText "End of test"
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/third_party/WebKit/LayoutTests/accessibility/secure-textfield-title-ui.html b/third_party/WebKit/LayoutTests/accessibility/secure-textfield-title-ui.html
index 38514b1..c9d334a 100644
--- a/third_party/WebKit/LayoutTests/accessibility/secure-textfield-title-ui.html
+++ b/third_party/WebKit/LayoutTests/accessibility/secure-textfield-title-ui.html
@@ -4,15 +4,15 @@
         testRunner.dumpAsText();
 </script>
 <body id="body">
- 
+
     <!-- This test makes sure that a secure text field has the correct title ui element -->
 
     <label for="accountpassword"><span class="dslabel">Password</span></label><br>
     <input size="30" maxlength="32" id="accountpassword" type="password" name="theAccountPW">
-    
+
     <div id="result"></div>
 
-     
+
     <script>
         if (window.accessibilityController) {
             var result = document.getElementById("result");
@@ -21,11 +21,11 @@
             pass.focus();
             var titleUIElement = accessibilityController.focusedElement.nameElementAtIndex(0);
             var titleText = titleUIElement.childAtIndex(0);
-            if (titleText.stringValue == "AXValue: Password") {
+            if (titleText.name == "Password") {
                 result.innerText += "Test passed\n";
             }
             else {
-                 result.innerText += "Test failed\n";
+                result.innerText += "Test failed\n";
             }
         }
     </script>
diff --git a/third_party/WebKit/LayoutTests/accessibility/table-caption-expected.txt b/third_party/WebKit/LayoutTests/accessibility/table-caption-expected.txt
index 6e8ce99a..7eb1dce0 100644
--- a/third_party/WebKit/LayoutTests/accessibility/table-caption-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/table-caption-expected.txt
@@ -4,7 +4,7 @@
 
 
 PASS table.childrenCount is 5
-PASS captionText is 'AXValue: TableCaption'
+PASS captionText is 'TableCaption'
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/third_party/WebKit/LayoutTests/accessibility/table-caption.html b/third_party/WebKit/LayoutTests/accessibility/table-caption.html
index 551bea5..a75ffe4d 100644
--- a/third_party/WebKit/LayoutTests/accessibility/table-caption.html
+++ b/third_party/WebKit/LayoutTests/accessibility/table-caption.html
@@ -21,8 +21,8 @@
     if (window.accessibilityController) {
         var table = accessibilityController.accessibleElementById("table");
         shouldBe("table.childrenCount", "5");
-        window.captionText = table.childAtIndex(0).childAtIndex(0).stringValue;
-        shouldBe("captionText", "'AXValue: TableCaption'");
+        window.captionText = table.childAtIndex(0).childAtIndex(0).name;
+        shouldBe("captionText", "'TableCaption'");
         // Clear the HTML for cleaner results.
         document.getElementById("content").innerHTML = "";
     }
@@ -32,4 +32,3 @@
 
 </body>
 </html>
-
diff --git a/third_party/WebKit/LayoutTests/accessibility/table-header-column-row-expected.txt b/third_party/WebKit/LayoutTests/accessibility/table-header-column-row-expected.txt
index e34183c..fb6ce01d 100644
--- a/third_party/WebKit/LayoutTests/accessibility/table-header-column-row-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/table-header-column-row-expected.txt
@@ -24,152 +24,152 @@
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-AXRole: AXWebArea AXValue: 
-    AXRole: AXTable AXValue: 
-        AXRole: AXCaption AXValue: 
-            AXRole: AXStaticText AXValue: scope test
-                AXRole: AXInlineTextBox AXValue: scope test
-        AXRole: AXRow AXValue: 
-            AXRole: AXColumnHeader AXValue: 
-                AXRole: AXStaticText AXValue: col head
-                    AXRole: AXInlineTextBox AXValue: col head
-            AXRole: AXRowHeader AXValue: 
-                AXRole: AXStaticText AXValue: row head
-                    AXRole: AXInlineTextBox AXValue: row head
-            AXRole: AXColumnHeader AXValue: 
-                AXRole: AXStaticText AXValue: col head
-                    AXRole: AXInlineTextBox AXValue: col head
-        AXRole: AXRow AXValue: 
-            AXRole: AXColumnHeader AXValue: 
-                AXRole: AXStaticText AXValue: col head
-                    AXRole: AXInlineTextBox AXValue: col head
-            AXRole: AXCell AXValue: 
-                AXRole: AXStaticText AXValue: data
-                    AXRole: AXInlineTextBox AXValue: data
-            AXRole: AXRowHeader AXValue: 
-                AXRole: AXStaticText AXValue: row head
-                    AXRole: AXInlineTextBox AXValue: row head
-        AXRole: AXRow AXValue: 
-            AXRole: AXRowHeader AXValue: 
-                AXRole: AXStaticText AXValue: row head
-                    AXRole: AXInlineTextBox AXValue: row head
-            AXRole: AXCell AXValue: 
-                AXRole: AXStaticText AXValue: data
-                    AXRole: AXInlineTextBox AXValue: data
-            AXRole: AXColumnHeader AXValue: 
-                AXRole: AXStaticText AXValue: col head
-                    AXRole: AXInlineTextBox AXValue: col head
-    AXRole: AXTable AXValue: 
-        AXRole: AXCaption AXValue: 
-            AXRole: AXStaticText AXValue: row header and column header (1)
-                AXRole: AXInlineTextBox AXValue: row header and column header (1)
-        AXRole: AXRow AXValue: 
-            AXRole: AXCell AXValue: 
-                AXRole: AXStaticText AXValue: data
-                    AXRole: AXInlineTextBox AXValue: data
-            AXRole: AXRowHeader AXValue: 
-                AXRole: AXStaticText AXValue: row head
-                    AXRole: AXInlineTextBox AXValue: row head
-            AXRole: AXColumnHeader AXValue: 
-                AXRole: AXStaticText AXValue: column head
-                    AXRole: AXInlineTextBox AXValue: column head
-        AXRole: AXRow AXValue: 
-            AXRole: AXColumnHeader AXValue: 
-                AXRole: AXStaticText AXValue: column head
-                    AXRole: AXInlineTextBox AXValue: column head
-            AXRole: AXColumnHeader AXValue: 
-                AXRole: AXStaticText AXValue: column head
-                    AXRole: AXInlineTextBox AXValue: column head
-            AXRole: AXCell AXValue: 
-                AXRole: AXStaticText AXValue: data
-                    AXRole: AXInlineTextBox AXValue: data
-        AXRole: AXRow AXValue: 
-            AXRole: AXRowHeader AXValue: 
-                AXRole: AXStaticText AXValue: row head
-                    AXRole: AXInlineTextBox AXValue: row head
-            AXRole: AXCell AXValue: 
-                AXRole: AXStaticText AXValue: data
-                    AXRole: AXInlineTextBox AXValue: data
-            AXRole: AXRowHeader AXValue: 
-                AXRole: AXStaticText AXValue: row head
-                    AXRole: AXInlineTextBox AXValue: row head
-    AXRole: AXTable AXValue: 
-        AXRole: AXCaption AXValue: 
-            AXRole: AXStaticText AXValue: row header and column header (2)
-                AXRole: AXInlineTextBox AXValue: row header and column header (2)
-        AXRole: AXRow AXValue: 
-            AXRole: AXRowHeader AXValue: 
-                AXRole: AXStaticText AXValue: row head
-                    AXRole: AXInlineTextBox AXValue: row head
-            AXRole: AXCell AXValue: 
-                AXRole: AXStaticText AXValue: data
-                    AXRole: AXInlineTextBox AXValue: data
-            AXRole: AXCell AXValue: 
-                AXRole: AXStaticText AXValue: data
-                    AXRole: AXInlineTextBox AXValue: data
-        AXRole: AXRow AXValue: 
-            AXRole: AXColumnHeader AXValue: 
-                AXRole: AXStaticText AXValue: column head
-                    AXRole: AXInlineTextBox AXValue: column head
-            AXRole: AXColumnHeader AXValue: 
-                AXRole: AXStaticText AXValue: column head
-                    AXRole: AXInlineTextBox AXValue: column head
-            AXRole: AXColumnHeader AXValue: 
-                AXRole: AXStaticText AXValue: column head
-                    AXRole: AXInlineTextBox AXValue: column head
-        AXRole: AXRow AXValue: 
-            AXRole: AXCell AXValue: 
-                AXRole: AXStaticText AXValue: data
-                    AXRole: AXInlineTextBox AXValue: data
-            AXRole: AXCell AXValue: 
-                AXRole: AXStaticText AXValue: data
-                    AXRole: AXInlineTextBox AXValue: data
-            AXRole: AXCell AXValue: 
-                AXRole: AXStaticText AXValue: data
-                    AXRole: AXInlineTextBox AXValue: data
-    AXRole: AXTable AXValue: 
-        AXRole: AXCaption AXValue: 
-            AXRole: AXStaticText AXValue: row header and column header (3)
-                AXRole: AXInlineTextBox AXValue: row header and column header (3)
-        AXRole: AXRow AXValue: 
-            AXRole: AXCell AXValue: 
-            AXRole: AXColumnHeader AXValue: 
-                AXRole: AXStaticText AXValue: col head
-                    AXRole: AXInlineTextBox AXValue: col head
-        AXRole: AXRow AXValue: 
-            AXRole: AXColumnHeader AXValue: 
-                AXRole: AXStaticText AXValue: col head
-                    AXRole: AXInlineTextBox AXValue: col head
-            AXRole: AXColumnHeader AXValue: 
-                AXRole: AXStaticText AXValue: col head
-                    AXRole: AXInlineTextBox AXValue: col head
-        AXRole: AXRow AXValue: 
-            AXRole: AXRowHeader AXValue: 
-                AXRole: AXStaticText AXValue: row head
-                    AXRole: AXInlineTextBox AXValue: row head
-            AXRole: AXCell AXValue: 
-                AXRole: AXStaticText AXValue: data
-                    AXRole: AXInlineTextBox AXValue: data
-            AXRole: AXCell AXValue: 
-                AXRole: AXStaticText AXValue: data
-                    AXRole: AXInlineTextBox AXValue: data
-    AXRole: AXTable AXValue: 
-        AXRole: AXCaption AXValue: 
-            AXRole: AXStaticText AXValue: row header and column header (4)
-                AXRole: AXInlineTextBox AXValue: row header and column header (4)
-        AXRole: AXRow AXValue: 
-            AXRole: AXRowHeader AXValue: 
-                AXRole: AXStaticText AXValue: row head
-                    AXRole: AXInlineTextBox AXValue: row head
-            AXRole: AXColumnHeader AXValue: 
-                AXRole: AXStaticText AXValue: col head
-                    AXRole: AXInlineTextBox AXValue: col head
-        AXRole: AXRow AXValue: 
-            AXRole: AXRowHeader AXValue: 
-                AXRole: AXStaticText AXValue: row head
-                    AXRole: AXInlineTextBox AXValue: row head
-    AXRole: AXParagraph AXValue: 
-        AXRole: AXStaticText AXValue: End of test
+AXRole: AXWebArea
+    AXRole: AXTable "scope test"
+        AXRole: AXCaption
+            AXRole: AXStaticText "scope test"
+                AXRole: AXInlineTextBox "scope test"
+        AXRole: AXRow
+            AXRole: AXColumnHeader
+                AXRole: AXStaticText "col head"
+                    AXRole: AXInlineTextBox "col head"
+            AXRole: AXRowHeader
+                AXRole: AXStaticText "row head"
+                    AXRole: AXInlineTextBox "row head"
+            AXRole: AXColumnHeader
+                AXRole: AXStaticText "col head"
+                    AXRole: AXInlineTextBox "col head"
+        AXRole: AXRow
+            AXRole: AXColumnHeader
+                AXRole: AXStaticText "col head"
+                    AXRole: AXInlineTextBox "col head"
+            AXRole: AXCell
+                AXRole: AXStaticText "data"
+                    AXRole: AXInlineTextBox "data"
+            AXRole: AXRowHeader
+                AXRole: AXStaticText "row head"
+                    AXRole: AXInlineTextBox "row head"
+        AXRole: AXRow
+            AXRole: AXRowHeader
+                AXRole: AXStaticText "row head"
+                    AXRole: AXInlineTextBox "row head"
+            AXRole: AXCell
+                AXRole: AXStaticText "data"
+                    AXRole: AXInlineTextBox "data"
+            AXRole: AXColumnHeader
+                AXRole: AXStaticText "col head"
+                    AXRole: AXInlineTextBox "col head"
+    AXRole: AXTable "row header and column header (1)"
+        AXRole: AXCaption
+            AXRole: AXStaticText "row header and column header (1)"
+                AXRole: AXInlineTextBox "row header and column header (1)"
+        AXRole: AXRow
+            AXRole: AXCell
+                AXRole: AXStaticText "data"
+                    AXRole: AXInlineTextBox "data"
+            AXRole: AXRowHeader
+                AXRole: AXStaticText "row head"
+                    AXRole: AXInlineTextBox "row head"
+            AXRole: AXColumnHeader
+                AXRole: AXStaticText "column head"
+                    AXRole: AXInlineTextBox "column head"
+        AXRole: AXRow
+            AXRole: AXColumnHeader
+                AXRole: AXStaticText "column head"
+                    AXRole: AXInlineTextBox "column head"
+            AXRole: AXColumnHeader
+                AXRole: AXStaticText "column head"
+                    AXRole: AXInlineTextBox "column head"
+            AXRole: AXCell
+                AXRole: AXStaticText "data"
+                    AXRole: AXInlineTextBox "data"
+        AXRole: AXRow
+            AXRole: AXRowHeader
+                AXRole: AXStaticText "row head"
+                    AXRole: AXInlineTextBox "row head"
+            AXRole: AXCell
+                AXRole: AXStaticText "data"
+                    AXRole: AXInlineTextBox "data"
+            AXRole: AXRowHeader
+                AXRole: AXStaticText "row head"
+                    AXRole: AXInlineTextBox "row head"
+    AXRole: AXTable "row header and column header (2)"
+        AXRole: AXCaption
+            AXRole: AXStaticText "row header and column header (2)"
+                AXRole: AXInlineTextBox "row header and column header (2)"
+        AXRole: AXRow
+            AXRole: AXRowHeader
+                AXRole: AXStaticText "row head"
+                    AXRole: AXInlineTextBox "row head"
+            AXRole: AXCell
+                AXRole: AXStaticText "data"
+                    AXRole: AXInlineTextBox "data"
+            AXRole: AXCell
+                AXRole: AXStaticText "data"
+                    AXRole: AXInlineTextBox "data"
+        AXRole: AXRow
+            AXRole: AXColumnHeader
+                AXRole: AXStaticText "column head"
+                    AXRole: AXInlineTextBox "column head"
+            AXRole: AXColumnHeader
+                AXRole: AXStaticText "column head"
+                    AXRole: AXInlineTextBox "column head"
+            AXRole: AXColumnHeader
+                AXRole: AXStaticText "column head"
+                    AXRole: AXInlineTextBox "column head"
+        AXRole: AXRow
+            AXRole: AXCell
+                AXRole: AXStaticText "data"
+                    AXRole: AXInlineTextBox "data"
+            AXRole: AXCell
+                AXRole: AXStaticText "data"
+                    AXRole: AXInlineTextBox "data"
+            AXRole: AXCell
+                AXRole: AXStaticText "data"
+                    AXRole: AXInlineTextBox "data"
+    AXRole: AXTable "row header and column header (3)"
+        AXRole: AXCaption
+            AXRole: AXStaticText "row header and column header (3)"
+                AXRole: AXInlineTextBox "row header and column header (3)"
+        AXRole: AXRow
+            AXRole: AXCell
+            AXRole: AXColumnHeader
+                AXRole: AXStaticText "col head"
+                    AXRole: AXInlineTextBox "col head"
+        AXRole: AXRow
+            AXRole: AXColumnHeader
+                AXRole: AXStaticText "col head"
+                    AXRole: AXInlineTextBox "col head"
+            AXRole: AXColumnHeader
+                AXRole: AXStaticText "col head"
+                    AXRole: AXInlineTextBox "col head"
+        AXRole: AXRow
+            AXRole: AXRowHeader
+                AXRole: AXStaticText "row head"
+                    AXRole: AXInlineTextBox "row head"
+            AXRole: AXCell
+                AXRole: AXStaticText "data"
+                    AXRole: AXInlineTextBox "data"
+            AXRole: AXCell
+                AXRole: AXStaticText "data"
+                    AXRole: AXInlineTextBox "data"
+    AXRole: AXTable "row header and column header (4)"
+        AXRole: AXCaption
+            AXRole: AXStaticText "row header and column header (4)"
+                AXRole: AXInlineTextBox "row header and column header (4)"
+        AXRole: AXRow
+            AXRole: AXRowHeader
+                AXRole: AXStaticText "row head"
+                    AXRole: AXInlineTextBox "row head"
+            AXRole: AXColumnHeader
+                AXRole: AXStaticText "col head"
+                    AXRole: AXInlineTextBox "col head"
+        AXRole: AXRow
+            AXRole: AXRowHeader
+                AXRole: AXStaticText "row head"
+                    AXRole: AXInlineTextBox "row head"
+    AXRole: AXParagraph
+        AXRole: AXStaticText "End of test"
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/third_party/WebKit/LayoutTests/accessibility/table-header-expected.txt b/third_party/WebKit/LayoutTests/accessibility/table-header-expected.txt
index c46a1a2..5d900b9 100644
--- a/third_party/WebKit/LayoutTests/accessibility/table-header-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/table-header-expected.txt
@@ -6,8 +6,8 @@
 PASS table.rowCount is 2
 PASS tableheader.isValid is true
 PASS tableheader.childrenCount is 2
-PASS firstHeaderText is 'AXValue: header 1'
-PASS secondHeaderText is 'AXValue: header 2'
+PASS firstHeaderText is 'header 1'
+PASS secondHeaderText is 'header 2'
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/third_party/WebKit/LayoutTests/accessibility/table-header.html b/third_party/WebKit/LayoutTests/accessibility/table-header.html
index b933b27e..0297a70 100644
--- a/third_party/WebKit/LayoutTests/accessibility/table-header.html
+++ b/third_party/WebKit/LayoutTests/accessibility/table-header.html
@@ -24,13 +24,13 @@
         var tableheader = table.tableHeader();
         shouldBeTrue("tableheader.isValid");
         shouldBe("tableheader.childrenCount", "2");
-        window.firstHeaderText = tableheader.childAtIndex(0).childAtIndex(0).stringValue;
-        shouldBe("firstHeaderText", "'AXValue: header 1'");
-        window.secondHeaderText = tableheader.childAtIndex(1).childAtIndex(0).stringValue;
-        shouldBe("secondHeaderText", "'AXValue: header 2'");
+        window.firstHeaderText = tableheader.childAtIndex(0).childAtIndex(0).name;
+        shouldBe("firstHeaderText", "'header 1'");
+        window.secondHeaderText = tableheader.childAtIndex(1).childAtIndex(0).name;
+        shouldBe("secondHeaderText", "'header 2'");
 
         // Clear the HTML for cleaner results.
-        document.getElementById("content").innerHTML = "";  
+        document.getElementById("content").innerHTML = "";
     }
 
 
@@ -38,4 +38,3 @@
 
 </body>
 </html>
-
diff --git a/third_party/WebKit/LayoutTests/accessibility/table-with-empty-thead-causes-crash-expected.txt b/third_party/WebKit/LayoutTests/accessibility/table-with-empty-thead-causes-crash-expected.txt
index d7c5523..0eaea935 100644
--- a/third_party/WebKit/LayoutTests/accessibility/table-with-empty-thead-causes-crash-expected.txt
+++ b/third_party/WebKit/LayoutTests/accessibility/table-with-empty-thead-causes-crash-expected.txt
@@ -6,17 +6,17 @@
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-AXRole: AXWebArea AXValue: 
-    AXRole: AXTable AXValue: 
-        AXRole: AXRow AXValue: 
-            AXRole: AXCell AXValue: 
-                AXRole: AXStaticText AXValue: 1
-                    AXRole: AXInlineTextBox AXValue: 1
-            AXRole: AXCell AXValue: 
-                AXRole: AXStaticText AXValue: 2
-                    AXRole: AXInlineTextBox AXValue: 2
-    AXRole: AXParagraph AXValue: 
-        AXRole: AXStaticText AXValue: End of test
+AXRole: AXWebArea
+    AXRole: AXTable "table"
+        AXRole: AXRow
+            AXRole: AXCell
+                AXRole: AXStaticText "1"
+                    AXRole: AXInlineTextBox "1"
+            AXRole: AXCell
+                AXRole: AXStaticText "2"
+                    AXRole: AXInlineTextBox "2"
+    AXRole: AXParagraph
+        AXRole: AXStaticText "End of test"
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/third_party/WebKit/LayoutTests/animations/responsive/background-image-responsive.html b/third_party/WebKit/LayoutTests/animations/responsive/background-image-responsive.html
index 6ee3464a..4a7ef0b 100644
--- a/third_party/WebKit/LayoutTests/animations/responsive/background-image-responsive.html
+++ b/third_party/WebKit/LayoutTests/animations/responsive/background-image-responsive.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <script src="resources/responsive-test.js"></script>
 <script>
-assertResponsive({
+assertCSSResponsive({
   property: 'background-image',
   to: 'url("test://to")',
   configurations: [{
@@ -25,7 +25,7 @@
   }],
 });
 
-assertResponsive({
+assertCSSResponsive({
   property: 'background-image',
   from: 'inherit',
   to: 'url("test://to")',
diff --git a/third_party/WebKit/LayoutTests/animations/responsive/border-image-source-responsive.html b/third_party/WebKit/LayoutTests/animations/responsive/border-image-source-responsive.html
index 18112a3..c7aad1a 100644
--- a/third_party/WebKit/LayoutTests/animations/responsive/border-image-source-responsive.html
+++ b/third_party/WebKit/LayoutTests/animations/responsive/border-image-source-responsive.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <script src="resources/responsive-test.js"></script>
 <script>
-assertResponsive({
+assertCSSResponsive({
   property: 'border-image-source',
   from: 'inherit',
   to: 'url("test://to")',
@@ -26,7 +26,7 @@
   }],
 });
 
-assertResponsive({
+assertCSSResponsive({
   property: 'border-image-source',
   to: 'url("test://to")',
   configurations: [{
diff --git a/third_party/WebKit/LayoutTests/animations/responsive/box-shadow-responsive.html b/third_party/WebKit/LayoutTests/animations/responsive/box-shadow-responsive.html
index 9f07ab2..797d4891 100644
--- a/third_party/WebKit/LayoutTests/animations/responsive/box-shadow-responsive.html
+++ b/third_party/WebKit/LayoutTests/animations/responsive/box-shadow-responsive.html
@@ -1,26 +1,26 @@
 <!DOCTYPE html>
 <script src="resources/responsive-test.js"></script>
 <script>
-assertResponsive({
+assertCSSResponsive({
   property: 'box-shadow',
-  from: 'inherit',
-  to: 'green 20px 20px 20px 20px',
+  from: 'green 20px 20px 20px 20px',
+  to: 'inherit',
   configurations: [{
     state: {inherited: 'blue 0px 0px 0px 0px'},
     expect: [
-      {at: 0.25, is: 'rgb(0, 32, 191) 5px 5px 5px 5px'},
-      {at: 0.75, is: 'rgb(0, 96, 64) 15px 15px 15px 15px'},
+      {at: 0.25, is: 'rgb(0, 96, 64) 15px 15px 15px 15px'},
+      {at: 0.75, is: 'rgb(0, 32, 191) 5px 5px 5px 5px'},
     ],
   }, {
     state: {inherited: 'yellow 100px 100px 100px 100px'},
     expect: [
-      {at: 0.25, is: 'rgb(191, 223, 0) 80px 80px 80px 80px'},
-      {at: 0.75, is: 'rgb(64, 160, 0) 40px 40px 40px 40px'},
+      {at: 0.25, is: 'rgb(64, 160, 0) 40px 40px 40px 40px'},
+      {at: 0.75, is: 'rgb(191, 223, 0) 80px 80px 80px 80px'},
     ],
   }],
 });
 
-assertResponsive({
+assertCSSResponsive({
   property: 'box-shadow',
   from: 'inherit',
   to: 'green 20px 20px 20px 20px',
diff --git a/third_party/WebKit/LayoutTests/animations/responsive/color-responsive.html b/third_party/WebKit/LayoutTests/animations/responsive/color-responsive.html
index 5befc7b..094a1f3 100644
--- a/third_party/WebKit/LayoutTests/animations/responsive/color-responsive.html
+++ b/third_party/WebKit/LayoutTests/animations/responsive/color-responsive.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <script src="resources/responsive-test.js"></script>
 <script>
-assertResponsive({
+assertCSSResponsive({
   property: 'color',
   from: 'inherit',
   to: 'green',
@@ -20,7 +20,7 @@
   }],
 });
 
-assertResponsive({
+assertCSSResponsive({
   property: 'color',
   from: 'currentcolor',
   to: 'green',
@@ -38,4 +38,23 @@
     ],
   }],
 });
+
+assertResponsive({
+  property: 'color',
+  from: 'green',
+  to: 'currentcolor',
+  configurations: [{
+    state: {inherited: 'blue'},
+    expect: [
+      {at: 0.25, is: 'rgb(0, 96, 64)'},
+      {at: 0.75, is: 'rgb(0, 32, 191)'},
+    ],
+  }, {
+    state: {inherited: 'yellow'},
+    expect: [
+      {at: 0.25, is: 'rgb(64, 160, 0)'},
+      {at: 0.75, is: 'rgb(191, 223, 0)'},
+    ],
+  }],
+});
 </script>
diff --git a/third_party/WebKit/LayoutTests/animations/responsive/fill-responsive.html b/third_party/WebKit/LayoutTests/animations/responsive/fill-responsive.html
index 5979124..088785f 100644
--- a/third_party/WebKit/LayoutTests/animations/responsive/fill-responsive.html
+++ b/third_party/WebKit/LayoutTests/animations/responsive/fill-responsive.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <script src="resources/responsive-test.js"></script>
 <script>
-assertResponsive({
+assertCSSResponsive({
   property: 'fill',
   from: 'inherit',
   to: 'green',
diff --git a/third_party/WebKit/LayoutTests/animations/responsive/left-responsive.html b/third_party/WebKit/LayoutTests/animations/responsive/left-responsive.html
index 59ec1b0..dcda4e2 100644
--- a/third_party/WebKit/LayoutTests/animations/responsive/left-responsive.html
+++ b/third_party/WebKit/LayoutTests/animations/responsive/left-responsive.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <script src="resources/responsive-test.js"></script>
 <script>
-assertResponsive({
+assertCSSResponsive({
   property: 'left',
   from: 'inherit',
   to: '200px',
@@ -20,32 +20,32 @@
   }],
 });
 
-assertResponsive({
+assertCSSResponsive({
   property: 'left',
-  to: '200px',
+  from: '200px',
   configurations: [{
     state: {underlying: '100px'},
     expect: [
-      {at: 0.25, is: '125px'},
-      {at: 0.75, is: '175px'},
+      {at: 0.25, is: '175px'},
+      {at: 0.75, is: '125px'},
     ],
   }, {
     state: {underlying: 'auto'},
     expect: [
-      {at: 0.25, is: 'auto'},
-      {at: 0.75, is: '200px'},
+      {at: 0.25, is: '200px'},
+      {at: 0.75, is: 'auto'},
     ],
   }, {
     state: {underlying: 'inherit', inherited: '100px'},
     expect: [
-      {at: 0.25, is: '125px'},
-      {at: 0.75, is: '175px'},
+      {at: 0.25, is: '175px'},
+      {at: 0.75, is: '125px'},
     ],
   }, {
     state: {underlying: 'inherit', inherited: 'auto'},
     expect: [
-      {at: 0.25, is: 'auto'},
-      {at: 0.75, is: '200px'},
+      {at: 0.25, is: '200px'},
+      {at: 0.75, is: 'auto'},
     ],
   }],
 });
diff --git a/third_party/WebKit/LayoutTests/animations/responsive/line-height-responsive.html b/third_party/WebKit/LayoutTests/animations/responsive/line-height-responsive.html
index 0aec619..2f5c4903 100644
--- a/third_party/WebKit/LayoutTests/animations/responsive/line-height-responsive.html
+++ b/third_party/WebKit/LayoutTests/animations/responsive/line-height-responsive.html
@@ -6,7 +6,7 @@
 </style>
 <script src="resources/responsive-test.js"></script>
 <script>
-assertResponsive({
+assertCSSResponsive({
   property: 'line-height',
   from: 'inherit',
   to: '200px',
@@ -25,7 +25,7 @@
   }],
 });
 
-assertResponsive({
+assertCSSResponsive({
   property: 'line-height',
   to: '200px',
   configurations: [{
@@ -67,7 +67,7 @@
   }],
 });
 
-assertResponsive({
+assertCSSResponsive({
   property: 'line-height',
   to: '20',
   configurations: [{
diff --git a/third_party/WebKit/LayoutTests/animations/responsive/resources/responsive-test.js b/third_party/WebKit/LayoutTests/animations/responsive/resources/responsive-test.js
index e32eefd..2752474 100644
--- a/third_party/WebKit/LayoutTests/animations/responsive/resources/responsive-test.js
+++ b/third_party/WebKit/LayoutTests/animations/responsive/resources/responsive-test.js
@@ -3,29 +3,31 @@
 // found in the LICENSE file.
 
 /*
-Exported function:
-assertResponsive
+Exported functions:
+assertCSSResponsive
+assertSVGResponsive
 
-Call signature:
-assertResponsive({
-  property: <CSS Property>,
-  ?from: <CSS Value>,
-  ?to: <CSS Value>,
+Options format: {
+  ?targetTag: <Target element tag name>,
+  property: <Property/Attribute name>,
+  ?getter(target): <Reads animated value from target>,
+  ?from: <Value>,
+  ?to: <Value>,
   configurations: [{
     state: {
-      ?underlying: <CSS Value>,
+      ?underlying: <Value>,
       ?inherited: <CSS Value>,
     },
     expect: [
-      { at: <Float>, is: <CSS Value> }
+      { at: <Float>, is: <Value> },
     ],
   }],
-})
+}
 
 Description:
-assertResponsive takes a property specific interpolation and a list of style
-configurations with interpolation expectations that apply to each
-configuration.
+assertCSSResponsive() and assertSVGResponsive() take a property
+specific interpolation and a list of style configurations with interpolation
+expectations that apply to each configuration.
 It starts the interpolation in every configuration, changes the
 state to every other configuration (n * (n - 1) complexity) and asserts that
 each destination configuration's expectations are met.
@@ -36,9 +38,57 @@
 (function() {
 'use strict';
 var pendingResponsiveTests = [];
+var htmlNamespace = 'http://www.w3.org/1999/xhtml';
+var svgNamespace = 'http://www.w3.org/2000/svg';
 
-function assertResponsive(options) {
-  pendingResponsiveTests.push(options);
+function assertCSSResponsive(options) {
+  pendingResponsiveTests.push({
+    options,
+    bindings: {
+      prefixProperty(property) {
+        return property;
+      },
+      createTargetContainer(container) {
+        return createElement('div', container);
+      },
+      createTarget(container) {
+        return createElement('div', container, 'target');
+      },
+      setValue(target, property, value) {
+        target.style[property] = value;
+      },
+      getAnimatedValue(target, property) {
+        return getComputedStyle(target)[property];
+      },
+    },
+  });
+}
+
+function assertSVGResponsive(options) {
+  pendingResponsiveTests.push({
+    options,
+    bindings: {
+      prefixProperty(property) {
+        return 'svg' + property[0].toUpperCase() + property.slice(1);
+      },
+      createTargetContainer(container) {
+        var svgRoot = createElement('svg', container, 'svg-root', svgNamespace);
+        svgRoot.setAttribute('width', 0);
+        svgRoot.setAttribute('height', 0);
+        return svgRoot;
+      },
+      createTarget(targetContainer) {
+        console.assert(options.targetTag);
+        return createElement(options.targetTag, targetContainer, 'target', svgNamespace);
+      },
+      setValue(target, property, value) {
+        target.setAttribute(property, value);
+      },
+      getAnimatedValue(target, property) {
+        return options.getter ? options.getter(target) : target[property].animVal;
+      },
+    },
+  });
 }
 
 function createStateTransitions(configurations) {
@@ -58,8 +108,8 @@
   return stateTransitions;
 }
 
-function createElement(tag, container, className) {
-  var element = document.createElement(tag);
+function createElement(tag, container, className, namespace) {
+  var element = document.createElementNS(namespace || htmlNamespace, tag);
   if (container) {
     container.appendChild(element);
   }
@@ -69,23 +119,23 @@
   return element;
 }
 
-function createTargets(n, container) {
+function createTargets(bindings, n, container) {
   var targets = [];
   for (var i = 0; i < n; i++) {
-    targets.push(createElement('div', container, 'target'));
+    targets.push(bindings.createTarget(container));
   }
   return targets;
 }
 
-function setState(targets, property, state) {
+function setState(bindings, targets, property, state) {
   if (state.inherited) {
     var parent = targets[0].parentElement;
     console.assert(targets.every(function(target) { return target.parentElement === parent; }));
-    parent.style[property] = state.inherited;
+    bindings.setValue(parent, property, state.inherited);
   }
   if (state.underlying) {
     for (var target of targets) {
-      target.style[property] = state.underlying;
+      bindings.setValue(target, property, state.underlying);
     }
   }
 }
@@ -94,18 +144,18 @@
   return (keyframeName in options) ? `[${options[keyframeName]}]` : 'neutral';
 }
 
-function createKeyframes(options) {
+function createKeyframes(prefixedProperty, options) {
   var keyframes = [];
   if ('from' in options) {
     keyframes.push({
       offset: 0,
-      [options.property]: options.from,
+      [prefixedProperty]: options.from,
     });
   }
   if ('to' in options) {
     keyframes.push({
       offset: 1,
-      [options.property]: options.to,
+      [prefixedProperty]: options.to,
     });
   }
   return keyframes;
@@ -124,49 +174,57 @@
 }
 
 function runPendingResponsiveTests() {
-  var stateTransitionTests = [];
-  pendingResponsiveTests.forEach(function(options) {
-    var property = options.property;
-    var from = options.from;
-    var to = options.to;
-    var keyframes = createKeyframes(options);
-    var fromText = keyframeText(options, 'from');
-    var toText = keyframeText(options, 'to');
+  return new Promise(function(resolve) {
+    var stateTransitionTests = [];
+    pendingResponsiveTests.forEach(function(responsiveTest) {
+      var options = responsiveTest.options;
+      var bindings = responsiveTest.bindings;
+      var property = options.property;
+      var prefixedProperty = bindings.prefixProperty(property);
+      var from = options.from;
+      var to = options.to;
+      var keyframes = createKeyframes(prefixedProperty, options);
+      var fromText = keyframeText(options, 'from');
+      var toText = keyframeText(options, 'to');
 
-    var stateTransitions = createStateTransitions(options.configurations);
-    stateTransitions.forEach(function(stateTransition) {
-      var before = stateTransition.before;
-      var after = stateTransition.after;
-      var container = createElement('div', document.body);
-      var targets = createTargets(after.expect.length, container);
+      var stateTransitions = createStateTransitions(options.configurations);
+      stateTransitions.forEach(function(stateTransition) {
+        var before = stateTransition.before;
+        var after = stateTransition.after;
+        var container = bindings.createTargetContainer(document.body);
+        var targets = createTargets(bindings, after.expect.length, container);
 
-      setState(targets, property, before.state);
-      startPausedAnimations(targets, keyframes, after.expect.map(function(expectation) { return expectation.at; }));
-      stateTransitionTests.push({
-        applyStateTransition() {
-          setState(targets, property, after.state);
-        },
-        assert() {
-          for (var i = 0; i < targets.length; i++) {
-            var target = targets[i];
-            var expectation = after.expect[i];
-            var actual = getComputedStyle(target)[property];
-            test(function() {
-              assert_equals(actual, expectation.is);
-            }, `Animation on property <${property}> from ${fromText} to ${toText} with ${JSON.stringify(before.state)} changed to ${JSON.stringify(after.state)} at (${expectation.at}) is [${expectation.is}]`);
-          }
-        },
+        setState(bindings, targets, property, before.state);
+        startPausedAnimations(targets, keyframes, after.expect.map(function(expectation) { return expectation.at; }));
+        stateTransitionTests.push({
+          applyStateTransition() {
+            setState(bindings, targets, property, after.state);
+          },
+          assert() {
+            for (var i = 0; i < targets.length; i++) {
+              var target = targets[i];
+              var expectation = after.expect[i];
+              var actual = bindings.getAnimatedValue(target, property);
+              test(function() {
+                assert_equals(actual, expectation.is);
+              }, `Animation on property <${prefixedProperty}> from ${fromText} to ${toText} with ${JSON.stringify(before.state)} changed to ${JSON.stringify(after.state)} at (${expectation.at}) is [${expectation.is}]`);
+            }
+          },
+        });
       });
     });
-  });
 
-  // Separate style modification from measurement as different phases to avoid a style recalc storm.
-  for (var stateTransitionTest of stateTransitionTests) {
-    stateTransitionTest.applyStateTransition();
-  }
-  for (var stateTransitionTest of stateTransitionTests) {
-    stateTransitionTest.assert();
-  }
+    for (var stateTransitionTest of stateTransitionTests) {
+      stateTransitionTest.applyStateTransition();
+    }
+
+    requestAnimationFrame(function() {
+      for (var stateTransitionTest of stateTransitionTests) {
+        stateTransitionTest.assert();
+      }
+      resolve();
+    });
+  });
 }
 
 function loadScript(url) {
@@ -182,13 +240,13 @@
   return loadScript('../../resources/testharnessreport.js');
 }).then(function() {
   var asyncHandle = async_test('This test uses responsive-test.js.')
-  requestAnimationFrame(function() {
-    runPendingResponsiveTests();
-    asyncHandle.done()
+  runPendingResponsiveTests().then(function() {
+    asyncHandle.done();
   });
 });
 
 
-window.assertResponsive = assertResponsive;
+window.assertCSSResponsive = assertCSSResponsive;
+window.assertSVGResponsive = assertSVGResponsive;
 
 })();
diff --git a/third_party/WebKit/LayoutTests/animations/svg-attribute-composition/svg-points-composition-expected.txt b/third_party/WebKit/LayoutTests/animations/svg-attribute-composition/svg-points-composition-expected.txt
new file mode 100644
index 0000000..a432e0b0
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/animations/svg-attribute-composition/svg-points-composition-expected.txt
@@ -0,0 +1,65 @@
+CONSOLE WARNING: SVG's SMIL animations (<animate>, <set>, etc.) are deprecated and will be removed. Please use CSS animations or Web animations instead.
+This is a testharness.js-based test.
+PASS This test uses interpolation-test.js. 
+PASS SMIL: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to add [90 90, -10 -10] at (0) is [50 50, 50 50] 
+PASS SMIL: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to add [90 90, -10 -10] at (0.2) is [60 60, 42 42] 
+PASS SMIL: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to add [90 90, -10 -10] at (0.6) is [80 80, 26 26] 
+PASS SMIL: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to add [90 90, -10 -10] at (1) is [100 100, 10 10] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to add [90 90, -10 -10] at (-0.4) is [30 30, 66 66] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to add [90 90, -10 -10] at (0) is [50 50, 50 50] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to add [90 90, -10 -10] at (0.2) is [60 60, 42 42] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to add [90 90, -10 -10] at (0.6) is [80 80, 26 26] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to add [90 90, -10 -10] at (1) is [100 100, 10 10] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to add [90 90, -10 -10] at (1.4) is [120 120, -6 -6] 
+FAIL SMIL: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to add [90 90, -10 -10, 50 50] at (0) is [50 50, 50 50] assert_equals: expected "50 , 50 , 50 , 50 " but got "40 , 40 , 30 , 30 "
+FAIL SMIL: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to add [90 90, -10 -10, 50 50] at (0.2) is [50 50, 50 50] assert_equals: expected "50 , 50 , 50 , 50 " but got "40 , 40 , 30 , 30 "
+FAIL SMIL: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to add [90 90, -10 -10, 50 50] at (0.6) is [180 180, -20 -20, 100 100] assert_equals: expected "180 , 180 , - 20 , - 20 , 100 , 100 " but got "90 , 90 , - 10 , - 10 , 50 , 50 "
+FAIL SMIL: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to add [90 90, -10 -10, 50 50] at (1) is [180 180, -20 -20, 100 100] assert_equals: expected "180 , 180 , - 20 , - 20 , 100 , 100 " but got "90 , 90 , - 10 , - 10 , 50 , 50 "
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to add [90 90, -10 -10, 50 50] at (-0.4) is [50 50, 50 50] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to add [90 90, -10 -10, 50 50] at (0) is [50 50, 50 50] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to add [90 90, -10 -10, 50 50] at (0.2) is [50 50, 50 50] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to add [90 90, -10 -10, 50 50] at (0.6) is [180 180, -20 -20, 100 100] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to add [90 90, -10 -10, 50 50] at (1) is [180 180, -20 -20, 100 100] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to add [90 90, -10 -10, 50 50] at (1.4) is [180 180, -20 -20, 100 100] 
+FAIL SMIL: Interpolate attribute <points> with underlying [10 10, 20 20, 50 50] from add [40 40] to add [90 90, -10 -10] at (0) is [80 80] assert_equals: expected "80 , 80 " but got "40 , 40 "
+FAIL SMIL: Interpolate attribute <points> with underlying [10 10, 20 20, 50 50] from add [40 40] to add [90 90, -10 -10] at (0.2) is [80 80] assert_equals: expected "80 , 80 " but got "40 , 40 "
+FAIL SMIL: Interpolate attribute <points> with underlying [10 10, 20 20, 50 50] from add [40 40] to add [90 90, -10 -10] at (0.6) is [180 180, -20 -20] assert_equals: expected "180 , 180 , - 20 , - 20 " but got "90 , 90 , - 10 , - 10 "
+FAIL SMIL: Interpolate attribute <points> with underlying [10 10, 20 20, 50 50] from add [40 40] to add [90 90, -10 -10] at (1) is [180 180, -20 -20] assert_equals: expected "180 , 180 , - 20 , - 20 " but got "90 , 90 , - 10 , - 10 "
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20, 50 50] from add [40 40] to add [90 90, -10 -10] at (-0.4) is [80 80] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20, 50 50] from add [40 40] to add [90 90, -10 -10] at (0) is [80 80] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20, 50 50] from add [40 40] to add [90 90, -10 -10] at (0.2) is [80 80] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20, 50 50] from add [40 40] to add [90 90, -10 -10] at (0.6) is [180 180, -20 -20] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20, 50 50] from add [40 40] to add [90 90, -10 -10] at (1) is [180 180, -20 -20] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20, 50 50] from add [40 40] to add [90 90, -10 -10] at (1.4) is [180 180, -20 -20] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to replace [90 90, -10 -10] at (-0.4) is [34 34, 74 74] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to replace [90 90, -10 -10] at (0) is [50 50, 50 50] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to replace [90 90, -10 -10] at (0.2) is [58 58, 38 38] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to replace [90 90, -10 -10] at (0.6) is [74 74, 14 14] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to replace [90 90, -10 -10] at (1) is [90 90, -10 -10] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to replace [90 90, -10 -10] at (1.4) is [106 106, -34 -34] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to replace [90 90, -10 -10, 50 50] at (-0.4) is [50 50, 50 50] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to replace [90 90, -10 -10, 50 50] at (0) is [50 50, 50 50] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to replace [90 90, -10 -10, 50 50] at (0.2) is [50 50, 50 50] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to replace [90 90, -10 -10, 50 50] at (0.6) is [90 90, -10 -10, 50 50] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to replace [90 90, -10 -10, 50 50] at (1) is [90 90, -10 -10, 50 50] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from add [40 40, 30 30] to replace [90 90, -10 -10, 50 50] at (1.4) is [90 90, -10 -10, 50 50] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20, 50 50] from add [40 40] to replace [90 90, -10 -10] at (-0.4) is [80 80] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20, 50 50] from add [40 40] to replace [90 90, -10 -10] at (0) is [80 80] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20, 50 50] from add [40 40] to replace [90 90, -10 -10] at (0.2) is [80 80] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20, 50 50] from add [40 40] to replace [90 90, -10 -10] at (0.6) is [90 90, -10 -10] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20, 50 50] from add [40 40] to replace [90 90, -10 -10] at (1) is [90 90, -10 -10] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20, 50 50] from add [40 40] to replace [90 90, -10 -10] at (1.4) is [90 90, -10 -10] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from neutral to replace [90 90, -10 -10] at (-0.4) is [-22 -22, 32 32] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from neutral to replace [90 90, -10 -10] at (0) is [10 10, 20 20] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from neutral to replace [90 90, -10 -10] at (0.2) is [26 26, 14 14] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from neutral to replace [90 90, -10 -10] at (0.6) is [58 58, 2 2] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from neutral to replace [90 90, -10 -10] at (1) is [90 90, -10 -10] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from neutral to replace [90 90, -10 -10] at (1.4) is [122 122, -22 -22] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from neutral to replace [90 90, -10 -10, 50 50] at (-0.4) is [10 10, 20 20] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from neutral to replace [90 90, -10 -10, 50 50] at (0) is [10 10, 20 20] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from neutral to replace [90 90, -10 -10, 50 50] at (0.2) is [10 10, 20 20] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from neutral to replace [90 90, -10 -10, 50 50] at (0.6) is [90 90, -10 -10, 50 50] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from neutral to replace [90 90, -10 -10, 50 50] at (1) is [90 90, -10 -10, 50 50] 
+PASS Web Animations: Interpolate attribute <points> with underlying [10 10, 20 20] from neutral to replace [90 90, -10 -10, 50 50] at (1.4) is [90 90, -10 -10, 50 50] 
+Harness: the test ran to completion.
+
diff --git a/third_party/WebKit/LayoutTests/animations/svg-attribute-composition/svg-points-composition.html b/third_party/WebKit/LayoutTests/animations/svg-attribute-composition/svg-points-composition.html
new file mode 100644
index 0000000..68a2571
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/animations/svg-attribute-composition/svg-points-composition.html
@@ -0,0 +1,137 @@
+<!DOCTYPE html>
+<html>
+<body>
+<template id="target-template">
+<svg width="0" height="0">
+<polygon class="target" />
+</svg>
+</template>
+<script src="../svg-attribute-interpolation/resources/interpolation-test.js"></script>
+<script>
+'use strict';
+assertAttributeInterpolation({
+  property: 'points',
+  underlying: '10 10, 20 20',
+  from: '40 40, 30 30',
+  fromComposite: 'add',
+  to: '90 90, -10 -10',
+  toComposite: 'add',
+}, [
+  {at: -0.4, is: '30 30, 66 66'},
+  {at: 0, is: '50 50, 50 50'},
+  {at: 0.2, is: '60 60, 42 42'},
+  {at: 0.6, is: '80 80, 26 26'},
+  {at: 1, is: '100 100, 10 10'},
+  {at: 1.4, is: '120 120, -6 -6'},
+]);
+
+assertAttributeInterpolation({
+  property: 'points',
+  underlying: '10 10, 20 20',
+  from: '40 40, 30 30',
+  fromComposite: 'add',
+  to: '90 90, -10 -10, 50 50',
+  toComposite: 'add',
+}, [
+  {at: -0.4, is: '50 50, 50 50'},
+  {at: 0, is: '50 50, 50 50'},
+  {at: 0.2, is: '50 50, 50 50'},
+  {at: 0.6, is: '180 180, -20 -20, 100 100'},
+  {at: 1, is: '180 180, -20 -20, 100 100'},
+  {at: 1.4, is: '180 180, -20 -20, 100 100'},
+]);
+
+assertAttributeInterpolation({
+  property: 'points',
+  underlying: '10 10, 20 20, 50 50',
+  from: '40 40',
+  fromComposite: 'add',
+  to: '90 90, -10 -10',
+  toComposite: 'add',
+}, [
+  {at: -0.4, is: '80 80'},
+  {at: 0, is: '80 80'},
+  {at: 0.2, is: '80 80'},
+  {at: 0.6, is: '180 180, -20 -20'},
+  {at: 1, is: '180 180, -20 -20'},
+  {at: 1.4, is: '180 180, -20 -20'},
+]);
+
+assertAttributeInterpolation({
+  property: 'points',
+  underlying: '10 10, 20 20',
+  from: '40 40, 30 30',
+  fromComposite: 'add',
+  to: '90 90, -10 -10',
+  toComposite: 'replace',
+}, [
+  {at: -0.4, is: '34 34, 74 74'},
+  {at: 0, is: '50 50, 50 50'},
+  {at: 0.2, is: '58 58, 38 38'},
+  {at: 0.6, is: '74 74, 14 14'},
+  {at: 1, is: '90 90, -10 -10'},
+  {at: 1.4, is: '106 106, -34 -34'},
+]);
+
+assertAttributeInterpolation({
+  property: 'points',
+  underlying: '10 10, 20 20',
+  from: '40 40, 30 30',
+  fromComposite: 'add',
+  to: '90 90, -10 -10, 50 50',
+  toComposite: 'replace',
+}, [
+  {at: -0.4, is: '50 50, 50 50'},
+  {at: 0, is: '50 50, 50 50'},
+  {at: 0.2, is: '50 50, 50 50'},
+  {at: 0.6, is: '90 90, -10 -10, 50 50'},
+  {at: 1, is: '90 90, -10 -10, 50 50'},
+  {at: 1.4, is: '90 90, -10 -10, 50 50'},
+]);
+
+assertAttributeInterpolation({
+  property: 'points',
+  underlying: '10 10, 20 20, 50 50',
+  from: '40 40',
+  fromComposite: 'add',
+  to: '90 90, -10 -10',
+  toComposite: 'replace',
+}, [
+  {at: -0.4, is: '80 80'},
+  {at: 0, is: '80 80'},
+  {at: 0.2, is: '80 80'},
+  {at: 0.6, is: '90 90, -10 -10'},
+  {at: 1, is: '90 90, -10 -10'},
+  {at: 1.4, is: '90 90, -10 -10'},
+]);
+
+assertAttributeInterpolation({
+  property: 'points',
+  underlying: '10 10, 20 20',
+  to: '90 90, -10 -10',
+  toComposite: 'replace',
+}, [
+  {at: -0.4, is: '-22 -22, 32 32'},
+  {at: 0, is: '10 10, 20 20'},
+  {at: 0.2, is: '26 26, 14 14'},
+  {at: 0.6, is: '58 58, 2 2'},
+  {at: 1, is: '90 90, -10 -10'},
+  {at: 1.4, is: '122 122, -22 -22'},
+]);
+
+assertAttributeInterpolation({
+  property: 'points',
+  underlying: '10 10, 20 20',
+  to: '90 90, -10 -10, 50 50',
+  toComposite: 'replace',
+}, [
+  {at: -0.4, is: '10 10, 20 20'},
+  {at: 0, is: '10 10, 20 20'},
+  {at: 0.2, is: '10 10, 20 20'},
+  {at: 0.6, is: '90 90, -10 -10, 50 50'},
+  {at: 1, is: '90 90, -10 -10, 50 50'},
+  {at: 1.4, is: '90 90, -10 -10, 50 50'},
+]);
+</script>
+</body>
+</html>
diff --git a/third_party/WebKit/LayoutTests/animations/svg-attribute-interpolation/resources/interpolation-test.js b/third_party/WebKit/LayoutTests/animations/svg-attribute-interpolation/resources/interpolation-test.js
index 5a44159..6e24685b 100644
--- a/third_party/WebKit/LayoutTests/animations/svg-attribute-interpolation/resources/interpolation-test.js
+++ b/third_party/WebKit/LayoutTests/animations/svg-attribute-interpolation/resources/interpolation-test.js
@@ -368,10 +368,6 @@
     return target;
   }
 
-  function reprKeyframe(x) {
-    return (typeof x === 'string') ? "'" + x + "'" : null;
-  }
-
   function createTestTargets(interpolationTests, container, rebaselineContainer) {
     var targets = [];
     for (var interpolationTest of interpolationTests) {
@@ -385,14 +381,19 @@
 
     if (rebaselineTests) {
         var rebaseline = createElement('pre', rebaselineContainer);
+
+        var fromCode = 'from' in params ? `
+  from: '${params.from}',
+  fromComposite: '${params.fromComposite}',` : '';
+
+        var toCode = 'to' in params ? `
+  to: '${params.to}',
+  toComposite: '${params.toComposite}',` : '';
+
         rebaseline.appendChild(document.createTextNode(`\
 assertAttributeInterpolation({
   property: '${params.property}',
-  underlying: '${params.underlying}',
-  from: ${reprKeyframe(params.from)},
-  fromComposite: '${params.fromComposite}',
-  to: ${reprKeyframe(params.to)},
-  toComposite: '${params.toComposite}',
+  underlying: '${params.underlying}',${fromCode}${toCode}
 }, [\n`));
         var rebaselineExpectation;
         rebaseline.appendChild(rebaselineExpectation = document.createTextNode(''));
diff --git a/third_party/WebKit/LayoutTests/animations/svg-attribute-responsive/svg-points-responsive.html b/third_party/WebKit/LayoutTests/animations/svg-attribute-responsive/svg-points-responsive.html
new file mode 100644
index 0000000..76c31fd8
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/animations/svg-attribute-responsive/svg-points-responsive.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<script src="../responsive/resources/responsive-test.js"></script>
+<script>
+assertSVGResponsive({
+  targetTag: 'polygon',
+  property: 'points',
+  getter(target) {
+    return Array.from(target.animatedPoints).map(p => `${p.x} ${p.y}`).join(', ');
+  },
+  to: '10 20, 30 40',
+  configurations: [{
+    state: {underlying: '10 10, 20 20'},
+    expect: [
+      {at: 0.25, is: '10 12.5, 22.5 25'},
+      {at: 0.75, is: '10 17.5, 27.5 35'},
+    ],
+  }, {
+    state: {underlying: '10 10'},
+    expect: [
+      {at: 0.25, is: '10 10'},
+      {at: 0.75, is: '10 20, 30 40'},
+    ],
+  }],
+});
+</script>
diff --git a/third_party/WebKit/LayoutTests/platform/win/compositing/overflow/scrolling-without-painting-expected.txt b/third_party/WebKit/LayoutTests/compositing/overflow/scrolling-without-painting-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/compositing/overflow/scrolling-without-painting-expected.txt
rename to third_party/WebKit/LayoutTests/compositing/overflow/scrolling-without-painting-expected.txt
diff --git a/third_party/WebKit/LayoutTests/platform/win/compositing/overflow/updating-scrolling-content-expected.txt b/third_party/WebKit/LayoutTests/compositing/overflow/updating-scrolling-content-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/compositing/overflow/updating-scrolling-content-expected.txt
rename to third_party/WebKit/LayoutTests/compositing/overflow/updating-scrolling-content-expected.txt
diff --git a/third_party/WebKit/LayoutTests/editing/input/editable-container-with-word-wrap-normal.html b/third_party/WebKit/LayoutTests/editing/input/editable-container-with-word-wrap-normal.html
index cd22d46..21a5ce1 100644
--- a/third_party/WebKit/LayoutTests/editing/input/editable-container-with-word-wrap-normal.html
+++ b/third_party/WebKit/LayoutTests/editing/input/editable-container-with-word-wrap-normal.html
@@ -1,4 +1,4 @@
-<!DOCTYPE html>
+<!DOCTYPE html> 
 <html>
 <head>
 <title> Testcase for bug https://bugs.webkit.org/show_bug.cgi?id=89649 </title>
@@ -16,7 +16,7 @@
 <script>
 function runTest() {
     description('Testcase for bug <a href="http://www.webkit.org/b/89649">http://www.webkit.org/b/89649</a>. \
-The test case checks if caret is drawn properly (especially scrolls properly) inside a editable container having word-wrap:normal.');
+The test case checks if caret is drawn properly(especially scrolls properly) inside a editable container having word-wrap:normal.');
 
     editableContainer = document.getElementById('test');
     editableContainer.focus();
@@ -38,9 +38,9 @@
 
     debug('<br>Final caret rect is calculated by following constraints');
     debug('1) ScrollWidth = text content width + caret width');
-    debug('2) Caret rect is always within container bounding box (thus subtracting the scroll left)');
-    shouldBe("startCaretRect.left + editableContainer.scrollWidth - editableContainer.scrollLeft", "finalCaretRect.right");
-
+    debug('2) Caret rect is always within container bounding box (thus substracting the scroll left)');
+    shouldBe("startCaretRect.left + editableContainer.scrollWidth - editableContainer.scrollLeft - caretWidth", "finalCaretRect.right");
+    
     document.body.removeChild(editableContainer);
     isSuccessfullyParsed();
  }
diff --git a/third_party/WebKit/LayoutTests/fast/block/float/canvas-with-floats-marked-for-layout-expected.txt b/third_party/WebKit/LayoutTests/fast/block/float/canvas-with-floats-marked-for-layout-expected.txt
new file mode 100644
index 0000000..679eab45
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/block/float/canvas-with-floats-marked-for-layout-expected.txt
@@ -0,0 +1,6 @@
+PASS crbug.com/537656: If a canvas has been marked for layout it may have floats in its float lists that have been removed and require layout to rebuild them, so don't try to pre-empt layout by calculating width on the canvas using stale and unsafe float lists.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+    
+
diff --git a/third_party/WebKit/LayoutTests/fast/block/float/canvas-with-floats-marked-for-layout.html b/third_party/WebKit/LayoutTests/fast/block/float/canvas-with-floats-marked-for-layout.html
new file mode 100644
index 0000000..9666d3e
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/block/float/canvas-with-floats-marked-for-layout.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<script src="../../../resources/js-test.js"></script>
+<style>
+#container {
+    float:right;
+}
+canvas {
+    display: block;
+};
+</style>
+<div id="container">
+    <canvas></canvas>
+</div>
+<pre id="pre">
+    <canvas></canvas>
+</pre>
+<script>
+    document.body.offsetTop;
+    pre.style.position = 'absolute';
+    container.style.display = "table";
+    // This applies the style changes above to the layout tree without doing a layout. Naughty.
+    document.execCommand(false)
+    document.body.style.zoom=0.50
+    testPassed("crbug.com/537656: If a canvas has been marked for layout it may have floats in its float lists that have been removed and require layout to rebuild them, so don't try to pre-empt layout by calculating width on the canvas using stale and unsafe float lists.");
+</script>
diff --git a/third_party/WebKit/LayoutTests/fast/block/float/containing-block-change-compositing-expected.html b/third_party/WebKit/LayoutTests/fast/block/float/overhanging-float-container-add-compositing-expected.html
similarity index 64%
rename from third_party/WebKit/LayoutTests/fast/block/float/containing-block-change-compositing-expected.html
rename to third_party/WebKit/LayoutTests/fast/block/float/overhanging-float-container-add-compositing-expected.html
index 02acf717..c29d478 100644
--- a/third_party/WebKit/LayoutTests/fast/block/float/containing-block-change-compositing-expected.html
+++ b/third_party/WebKit/LayoutTests/fast/block/float/overhanging-float-container-add-compositing-expected.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <body style="margin: 0">
   <div style="height: 100px">
-  Tests layout and repaint of floating descendants of a container changing 3D transform. Passes if there is no red.
+  Tests layout and repaint of when a container of overhanging float adds 3D transform. Passes if there is no red.
   </div>
   <div style="position: absolute; top: 100px; left: 100px; width: 100px; height: 100px; background-color: green"></div>
 </body>
diff --git a/third_party/WebKit/LayoutTests/fast/block/float/containing-block-change-compositing.html b/third_party/WebKit/LayoutTests/fast/block/float/overhanging-float-container-add-compositing.html
similarity index 82%
rename from third_party/WebKit/LayoutTests/fast/block/float/containing-block-change-compositing.html
rename to third_party/WebKit/LayoutTests/fast/block/float/overhanging-float-container-add-compositing.html
index ae00ac4..d41769c7 100644
--- a/third_party/WebKit/LayoutTests/fast/block/float/containing-block-change-compositing.html
+++ b/third_party/WebKit/LayoutTests/fast/block/float/overhanging-float-container-add-compositing.html
@@ -2,12 +2,13 @@
 <script src="../../../resources/run-after-layout-and-paint.js"></script>
 <script>
 runAfterLayoutAndPaint(function() {
+  console.log('x');
   document.getElementById('container').style.transform = 'translateZ(0) translateX(100px)';
 }, true);
 </script>
 <body style="margin: 0">
   <div style="height: 100px">
-  Tests layout and repaint of floating descendants of a container changing 3D transform. Passes if there is no red.
+  Tests layout and repaint of when a container of overhanging float adds 3D transform. Passes if there is no red.
   </div>
   <div id="indicator" style="position: absolute; top: 100px; left: 100px; width: 100px; height: 100px; background-color: red"></div>
   <div>
diff --git a/third_party/WebKit/LayoutTests/fast/block/float/overhanging-float-container-remove-compositing-expected.html b/third_party/WebKit/LayoutTests/fast/block/float/overhanging-float-container-remove-compositing-expected.html
new file mode 100644
index 0000000..62b2553
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/block/float/overhanging-float-container-remove-compositing-expected.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<body style="margin: 0">
+  <div style="height: 100px">
+  Tests layout and repaint of when a container of overhanging float removes 3D transform. Passes if there is no red.
+  </div>
+  <div style="position: absolute; top: 100px; left: 0; width: 100px; height: 100px; background-color: green"></div>
+</body>
diff --git a/third_party/WebKit/LayoutTests/fast/block/float/overhanging-float-container-remove-compositing.html b/third_party/WebKit/LayoutTests/fast/block/float/overhanging-float-container-remove-compositing.html
new file mode 100644
index 0000000..52a1dfd8
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/block/float/overhanging-float-container-remove-compositing.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<script src="../../../resources/run-after-layout-and-paint.js"></script>
+<script>
+runAfterLayoutAndPaint(function() {
+  document.getElementById('container').style.transform = '';
+}, true);
+</script>
+<body style="margin: 0">
+  <div style="height: 100px">
+  Tests layout and repaint of when a container of overhanging float removes 3D transform. Passes if there is no red.
+  </div>
+  <div id="indicator" style="position: absolute; z-index: -1; top: 100px; left: 0; width: 100px; height: 100px; background-color: red"></div>
+  <div>
+    <div id="container" style="width: 0; height: 0; transform: translateZ(0) translateX(100px)">
+      <div style="float: left; width: 100px; height: 100px; background-color: green"></div>
+    </div>
+  </div>
+</body>
diff --git a/third_party/WebKit/LayoutTests/fast/events/javascript-uri-navigation-blocked-in-unload-handler-expected.txt b/third_party/WebKit/LayoutTests/fast/events/javascript-uri-navigation-blocked-in-unload-handler-expected.txt
new file mode 100644
index 0000000..695552ac
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/events/javascript-uri-navigation-blocked-in-unload-handler-expected.txt
@@ -0,0 +1,2 @@
+PASS: script executed
+
diff --git a/third_party/WebKit/LayoutTests/fast/events/javascript-uri-navigation-blocked-in-unload-handler.html b/third_party/WebKit/LayoutTests/fast/events/javascript-uri-navigation-blocked-in-unload-handler.html
new file mode 100644
index 0000000..b09105e
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/events/javascript-uri-navigation-blocked-in-unload-handler.html
@@ -0,0 +1,29 @@
+<html>
+<head>
+<title>Ensure that javascript: document navigations are blocked during onunload.</title>
+</head>
+<body>
+<pre id="console"></pre>
+<script>
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.waitUntilDone();
+}
+
+function log(msg) {
+    document.getElementById("console").appendChild(document.createTextNode(msg + "\n"));
+}
+
+var i = document.body.appendChild(document.createElement('iframe'));
+i.contentWindow.onunload = function() {
+    i.src = "javascript:top.log('PASS: script executed');" +
+            "'<script>top.log(\\'FAIL: document navigation not aborted\\');<" +
+            "/script>'";
+    if (window.testRunner)
+        testRunner.notifyDone();
+}
+
+i.src = "data:text/html,test";
+</script>
+</body>
+</html>
diff --git a/third_party/WebKit/LayoutTests/fast/inline/collapsing-text-after-list-markers-expected.html b/third_party/WebKit/LayoutTests/fast/inline/collapsing-text-after-list-markers-expected.html
new file mode 100644
index 0000000..6fbbd271
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/inline/collapsing-text-after-list-markers-expected.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<div>
+    <li>Text</li>
+    <li>Text</li>
+</div>
+<p>crbug.com/554903: The two texts above should be aligned with each other - any whitespace between the list marker and the text should be collapsed.</p>
diff --git a/third_party/WebKit/LayoutTests/fast/inline/collapsing-text-after-list-markers.html b/third_party/WebKit/LayoutTests/fast/inline/collapsing-text-after-list-markers.html
new file mode 100644
index 0000000..2b424910
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/fast/inline/collapsing-text-after-list-markers.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<div>
+    <li><span> </span>Text</li>
+    <li>Text</li>
+</div>
+<p>crbug.com/554903: The two texts above should be aligned with each other - any whitespace between the list marker and the text should be collapsed.</p>
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/destroy-scrollbar-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/destroy-scrollbar-expected.txt
index b5815912..9ae8990 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/destroy-scrollbar-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/destroy-scrollbar-expected.txt
@@ -9,8 +9,8 @@
         [185, 100, 15, 200]
       ],
       "paintInvalidationClients": [
-        "LayoutBlockFlow (positioned) DIV",
-        "VerticalScrollbar"
+        "VerticalScrollbar",
+        "LayoutBlockFlow (positioned) DIV"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/layout-state-only-positioned-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/layout-state-only-positioned-expected.txt
index 0fb1fe7c..afd819cb 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/layout-state-only-positioned-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/layout-state-only-positioned-expected.txt
@@ -10,8 +10,8 @@
         [3, 103, 10, 53]
       ],
       "paintInvalidationClients": [
-        "LayoutBlockFlow (positioned) DIV",
         "VerticalScrollbar",
+        "LayoutBlockFlow (positioned) DIV",
         "LayoutBlockFlow (positioned) DIV id='q'"
       ]
     }
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt
similarity index 99%
rename from third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt
rename to third_party/WebKit/LayoutTests/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt
index 4496a5e..c564a2d 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt
@@ -12,8 +12,8 @@
         [8, 8, 300, 300]
       ],
       "paintInvalidationClients": [
-        "VerticalScrollbar",
         "LayoutBlockFlow DIV id='innerDiv'",
+        "VerticalScrollbar",
         "LayoutBlockFlow DIV",
         "LayoutBlockFlow DIV"
       ]
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-move-after-scroll-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/overflow-move-after-scroll-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-move-after-scroll-expected.txt
rename to third_party/WebKit/LayoutTests/fast/repaint/overflow-move-after-scroll-expected.txt
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-scroll-after-move-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/overflow-scroll-after-move-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-scroll-after-move-expected.txt
rename to third_party/WebKit/LayoutTests/fast/repaint/overflow-scroll-after-move-expected.txt
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/overflow-scroll-body-appear-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/overflow-scroll-body-appear-expected.txt
index 99322b4..d62068de 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/overflow-scroll-body-appear-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/overflow-scroll-body-appear-expected.txt
@@ -6,6 +6,7 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
+        [785, 585, 15, 15],
         [8, 50, 784, 18],
         [8, 50, 769, 18],
         [8, 16, 2000, 2068],
@@ -15,9 +16,6 @@
         [0, 0, 785, 585]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "VerticalScrollbar",
         "RootInlineBox",
         "InlineTextBox 'You should see both vertical and horizontal scrollbars.'",
         "RootInlineBox",
@@ -28,7 +26,9 @@
         "LayoutView #document",
         "LayoutBlockFlow BODY",
         "LayoutBlockFlow P",
-        "LayoutBlockFlow P"
+        "LayoutBlockFlow P",
+        "HorizontalScrollbar",
+        "VerticalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/overflow-scroll-in-overflow-scroll-scrolled-expected.txt
similarity index 99%
copy from third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt
copy to third_party/WebKit/LayoutTests/fast/repaint/overflow-scroll-in-overflow-scroll-scrolled-expected.txt
index 4496a5e..c564a2d 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/overflow-scroll-in-overflow-scroll-scrolled-expected.txt
@@ -12,8 +12,8 @@
         [8, 8, 300, 300]
       ],
       "paintInvalidationClients": [
-        "VerticalScrollbar",
         "LayoutBlockFlow DIV id='innerDiv'",
+        "VerticalScrollbar",
         "LayoutBlockFlow DIV",
         "LayoutBlockFlow DIV"
       ]
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/repaint-composited-child-in-scrolled-container-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/repaint-composited-child-in-scrolled-container-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/fast/repaint/repaint-composited-child-in-scrolled-container-expected.txt
rename to third_party/WebKit/LayoutTests/fast/repaint/repaint-composited-child-in-scrolled-container-expected.txt
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/resize-scrollable-div-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/resize-scrollable-div-expected.txt
index 9b67d0c8..de13bc9 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/resize-scrollable-div-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/resize-scrollable-div-expected.txt
@@ -6,13 +6,20 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
+        [293, 393, 15, 15],
+        [293, 108, 15, 285],
+        [93, 193, 15, 15],
+        [93, 108, 15, 85],
+        [8, 393, 285, 15],
+        [8, 193, 85, 15],
         [8, 108, 300, 300],
         [8, 108, 100, 100]
       ],
       "paintInvalidationClients": [
         "LayoutBlockFlow DIV id='div'",
+        "HorizontalScrollbar",
         "VerticalScrollbar",
-        "HorizontalScrollbar"
+        "LayoutBlockFlow DIV id='div'"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/scroll-inside-table-cell-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/scroll-inside-table-cell-expected.txt
similarity index 99%
rename from third_party/WebKit/LayoutTests/platform/win/fast/repaint/scroll-inside-table-cell-expected.txt
rename to third_party/WebKit/LayoutTests/fast/repaint/scroll-inside-table-cell-expected.txt
index e72a83b..ffa6fa05 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/scroll-inside-table-cell-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/scroll-inside-table-cell-expected.txt
@@ -12,8 +12,8 @@
         [312, 112, 454, 469]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
         "LayoutTableCell (relative positioned) TD id='cellToScroll' class='relative'",
+        "HorizontalScrollbar",
         "LayoutBlockFlow (relative positioned) DIV class='relative red'",
         "LayoutBlockFlow (positioned) DIV class='absolute green'"
       ]
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/scroll-relative-table-inside-table-cell-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/scroll-relative-table-inside-table-cell-expected.txt
similarity index 99%
rename from third_party/WebKit/LayoutTests/platform/win/fast/repaint/scroll-relative-table-inside-table-cell-expected.txt
rename to third_party/WebKit/LayoutTests/fast/repaint/scroll-relative-table-inside-table-cell-expected.txt
index bf5f9e8..473fed3 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/scroll-relative-table-inside-table-cell-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/scroll-relative-table-inside-table-cell-expected.txt
@@ -12,8 +12,8 @@
         [1112, 1312, 454, 469]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
         "LayoutTableCell (relative positioned) TD id='cellToScroll' class='relative'",
+        "HorizontalScrollbar",
         "LayoutBlockFlow (relative positioned) DIV class='relative red'",
         "LayoutBlockFlow (positioned) DIV class='absolute green'"
       ]
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-invalidation-on-resize-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-invalidation-on-resize-expected.txt
index 6c9a2ed..88b08278 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-invalidation-on-resize-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-invalidation-on-resize-expected.txt
@@ -6,13 +6,20 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
+        [293, 135, 15, 15],
+        [293, 50, 15, 85],
+        [93, 135, 15, 15],
+        [93, 50, 15, 85],
+        [8, 135, 285, 15],
+        [8, 135, 85, 15],
         [8, 50, 300, 100],
         [8, 50, 100, 100]
       ],
       "paintInvalidationClients": [
         "LayoutBlockFlow (positioned) DIV id='scrollable'",
+        "HorizontalScrollbar",
         "VerticalScrollbar",
-        "HorizontalScrollbar"
+        "LayoutBlockFlow (positioned) DIV id='scrollable'"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-invalidation-on-resize-with-border-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-invalidation-on-resize-with-border-expected.txt
index 05ee1f8..6295919 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-invalidation-on-resize-with-border-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-invalidation-on-resize-with-border-expected.txt
@@ -6,13 +6,20 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
+        [303, 145, 15, 15],
+        [303, 60, 15, 85],
+        [103, 145, 15, 15],
+        [103, 60, 15, 85],
+        [18, 145, 285, 15],
+        [18, 145, 85, 15],
         [8, 50, 320, 120],
         [8, 50, 120, 120]
       ],
       "paintInvalidationClients": [
         "LayoutBlockFlow (positioned) DIV id='scrollable'",
+        "HorizontalScrollbar",
         "VerticalScrollbar",
-        "HorizontalScrollbar"
+        "LayoutBlockFlow (positioned) DIV id='scrollable'"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-parts-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-parts-expected.txt
index 5e1c8db..d0fb028 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-parts-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/scrollbar-parts-expected.txt
@@ -10,8 +10,8 @@
         [8, 93, 85, 15]
       ],
       "paintInvalidationClients": [
-        "VerticalScrollbar",
-        "HorizontalScrollbar"
+        "HorizontalScrollbar",
+        "VerticalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/shift-relative-positioned-container-with-image-addition-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/shift-relative-positioned-container-with-image-addition-expected.txt
index fcb36c3..cacd72eb 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/shift-relative-positioned-container-with-image-addition-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/shift-relative-positioned-container-with-image-addition-expected.txt
@@ -6,7 +6,6 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
-        [723, 88, 15, 90],
         [58, 230, 489, 537],
         [58, 136, 489, 537],
         [18, 96, 712, 74],
@@ -23,7 +22,7 @@
         [0, 0, 785, 735]
       ],
       "paintInvalidationClients": [
-        "LayoutIFrame IFRAME id='iframe'",
+        "VerticalScrollbar",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
         "LayoutIFrame IFRAME id='iframe'",
@@ -31,6 +30,7 @@
         "LayoutView #document",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow BODY",
+        "LayoutView #document",
         "LayoutBlockFlow (relative positioned) DIV class='relative'",
         "LayoutBlockFlow (relative positioned) DIV class='relative paddingTop'",
         "LayoutImage IMG",
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt
similarity index 99%
rename from third_party/WebKit/LayoutTests/platform/win/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt
rename to third_party/WebKit/LayoutTests/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt
index f871844..4e214a0 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt
@@ -16,8 +16,8 @@
         [8, 8, 306, 300]
       ],
       "paintInvalidationClients": [
-        "VerticalScrollbar",
         "LayoutBlockFlow DIV id='innerDiv'",
+        "VerticalScrollbar",
         "LayoutTable TABLE",
         "LayoutTableCell TD",
         "LayoutTableCell TD",
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/table-overflow-scroll-in-overflow-scroll-scrolled-expected.txt
similarity index 99%
copy from third_party/WebKit/LayoutTests/platform/win/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt
copy to third_party/WebKit/LayoutTests/fast/repaint/table-overflow-scroll-in-overflow-scroll-scrolled-expected.txt
index f871844..4e214a0 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/table-overflow-scroll-in-overflow-scroll-scrolled-expected.txt
@@ -16,8 +16,8 @@
         [8, 8, 306, 300]
       ],
       "paintInvalidationClients": [
-        "VerticalScrollbar",
         "LayoutBlockFlow DIV id='innerDiv'",
+        "VerticalScrollbar",
         "LayoutTable TABLE",
         "LayoutTableCell TD",
         "LayoutTableCell TD",
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/textarea-set-disabled-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/textarea-set-disabled-expected.txt
index f7119818..d3501d1 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/textarea-set-disabled-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/textarea-set-disabled-expected.txt
@@ -11,8 +11,6 @@
       ],
       "paintInvalidationClients": [
         "LayoutTextControl TEXTAREA",
-        "LayoutBlockFlow DIV id='inner-editor'",
-        "LayoutTextControl TEXTAREA",
         "LayoutBlockFlow DIV id='inner-editor'"
       ]
     }
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/window-resize-background-image-fixed-centered-composited-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/window-resize-background-image-fixed-centered-composited-expected.txt
index 79ed8e67..f5b4ad5 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/window-resize-background-image-fixed-centered-composited-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/window-resize-background-image-fixed-centered-composited-expected.txt
@@ -9,7 +9,6 @@
         [0, 0, 200, 8]
       ],
       "paintInvalidationClients": [
-        "VerticalScrollbar",
         "LayoutView #document",
         "LayoutBlockFlow HTML"
       ]
@@ -29,7 +28,6 @@
         [0, 0, 200, 8]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/window-resize-background-image-fixed-centered-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/window-resize-background-image-fixed-centered-expected.txt
index a6439968..90ed3c6 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/window-resize-background-image-fixed-centered-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/window-resize-background-image-fixed-centered-expected.txt
@@ -11,7 +11,6 @@
         [0, 0, 200, 8]
       ],
       "paintInvalidationClients": [
-        "VerticalScrollbar",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML"
@@ -33,7 +32,6 @@
         [0, 0, 200, 8]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/window-resize-background-image-generated-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/window-resize-background-image-generated-expected.txt
index a6439968..90ed3c6 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/window-resize-background-image-generated-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/window-resize-background-image-generated-expected.txt
@@ -11,7 +11,6 @@
         [0, 0, 200, 8]
       ],
       "paintInvalidationClients": [
-        "VerticalScrollbar",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML"
@@ -33,7 +32,6 @@
         [0, 0, 200, 8]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/window-resize-background-image-non-fixed-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/window-resize-background-image-non-fixed-expected.txt
index 5dcb69a8b..b262d221 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/window-resize-background-image-non-fixed-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/window-resize-background-image-non-fixed-expected.txt
@@ -10,7 +10,6 @@
         [0, 0, 200, 8]
       ],
       "paintInvalidationClients": [
-        "VerticalScrollbar",
         "LayoutView #document",
         "LayoutBlockFlow HTML"
       ]
@@ -31,7 +30,6 @@
         [0, 0, 200, 8]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/window-resize-media-query-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/window-resize-media-query-expected.txt
index b0c777d..c959b14 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/window-resize-media-query-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/window-resize-media-query-expected.txt
@@ -12,7 +12,6 @@
         [0, 0, 200, 8]
       ],
       "paintInvalidationClients": [
-        "VerticalScrollbar",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow BODY"
@@ -35,7 +34,6 @@
         [0, 0, 200, 8]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/window-resize-percent-html-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/window-resize-percent-html-expected.txt
index 33d49e64..746f169 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/window-resize-percent-html-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/window-resize-percent-html-expected.txt
@@ -12,7 +12,6 @@
         [0, 0, 200, 100]
       ],
       "paintInvalidationClients": [
-        "VerticalScrollbar",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow DIV"
@@ -35,7 +34,6 @@
         [0, 0, 200, 150]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/window-resize-percent-width-height-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/window-resize-percent-width-height-expected.txt
index bf48ceb..889e946 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/window-resize-percent-width-height-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/window-resize-percent-width-height-expected.txt
@@ -10,7 +10,6 @@
         [0, 100, 100, 50]
       ],
       "paintInvalidationClients": [
-        "VerticalScrollbar",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow (positioned) DIV"
@@ -31,7 +30,6 @@
         [0, 0, 300, 300]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/window-resize-positioned-bottom-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/window-resize-positioned-bottom-expected.txt
index 553d3fa..89dd60f 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/window-resize-positioned-bottom-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/window-resize-positioned-bottom-expected.txt
@@ -11,7 +11,6 @@
         [0, 160, 20, 20]
       ],
       "paintInvalidationClients": [
-        "VerticalScrollbar",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow (positioned) DIV"
@@ -31,7 +30,6 @@
         [0, 0, 300, 300]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML"
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/window-resize-positioned-percent-top-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/window-resize-positioned-percent-top-expected.txt
index bdb921a..ac471fb7 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/window-resize-positioned-percent-top-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/window-resize-positioned-percent-top-expected.txt
@@ -11,7 +11,6 @@
         [0, 100, 20, 20]
       ],
       "paintInvalidationClients": [
-        "VerticalScrollbar",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow (positioned) DIV"
@@ -31,7 +30,6 @@
         [0, 0, 300, 300]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML"
diff --git a/third_party/WebKit/LayoutTests/fast/repaint/window-resize-viewport-percent-expected.txt b/third_party/WebKit/LayoutTests/fast/repaint/window-resize-viewport-percent-expected.txt
index f13134c..5a192180 100644
--- a/third_party/WebKit/LayoutTests/fast/repaint/window-resize-viewport-percent-expected.txt
+++ b/third_party/WebKit/LayoutTests/fast/repaint/window-resize-viewport-percent-expected.txt
@@ -11,7 +11,6 @@
         [0, 20, 30, 10]
       ],
       "paintInvalidationClients": [
-        "VerticalScrollbar",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow DIV"
@@ -31,7 +30,6 @@
         [0, 0, 300, 300]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML"
diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector-enabled/reattach-after-editing-styles-expected.txt b/third_party/WebKit/LayoutTests/http/tests/inspector-enabled/reattach-after-editing-styles-expected.txt
index f0b716e..c09c4cd 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector-enabled/reattach-after-editing-styles-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector-enabled/reattach-after-editing-styles-expected.txt
@@ -3,57 +3,57 @@
 Opening front-end for the first time
 Dump initial styles:
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#testDiv  { (reattach-after-…-styles.html:7 -> reattach-after-editing-styles.html:7:1)
+#testDiv { (reattach-after-…-styles.html:7 -> reattach-after-editing-styles.html:7:1)
     font-family: arial;
 
 [expanded] 
-#testDiv  { (style.css:1 -> style.css:1:1)
+#testDiv { (style.css:1 -> style.css:1:1)
     color: red;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 Dump styles after editing:
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#testDiv, my-custom-tag  { (inspector-stylesheet:1 -> inspector-stylesheet:1:1)
+#testDiv, my-custom-tag { (inspector-stylesheet:1 -> inspector-stylesheet:1:1)
 
 [expanded] 
-#testDiv  { (reattach-after-…-styles.html:7 -> reattach-after-editing-styles.html:7:1)
+#testDiv { (reattach-after-…-styles.html:7 -> reattach-after-editing-styles.html:7:1)
     font-family: Helvetica;
 
 [expanded] 
-#testDiv  { (style.css:1 -> style.css:1:1)
+#testDiv { (style.css:1 -> style.css:1:1)
     color: green;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 Opening front-end second time
 Dump styles after inspector was reopened:
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#testDiv, my-custom-tag  { (<style>…</style>)
+#testDiv, my-custom-tag { (<style>…</style>)
 
 [expanded] 
-#testDiv  { (reattach-after-…-styles.html:7 -> reattach-after-editing-styles.html:7:1)
+#testDiv { (reattach-after-…-styles.html:7 -> reattach-after-editing-styles.html:7:1)
     font-family: Helvetica;
 
 [expanded] 
-#testDiv  { (style.css:1 -> style.css:1:1)
+#testDiv { (style.css:1 -> style.css:1:1)
     color: green;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector-enabled/shadow-dom-rules-expected.txt b/third_party/WebKit/LayoutTests/http/tests/inspector-enabled/shadow-dom-rules-expected.txt
index df1e2852..75cc7a5 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector-enabled/shadow-dom-rules-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector-enabled/shadow-dom-rules-expected.txt
@@ -5,14 +5,14 @@
 
 Running: testDumpStyles
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.red  { (<style>…</style>)
+.red { (<style>…</style>)
     color: red;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector-enabled/shadow-dom-rules-restart-expected.txt b/third_party/WebKit/LayoutTests/http/tests/inspector-enabled/shadow-dom-rules-restart-expected.txt
index e3259696..165a153 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector-enabled/shadow-dom-rules-restart-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector-enabled/shadow-dom-rules-restart-expected.txt
@@ -3,14 +3,14 @@
 This test checks that style sheets hosted inside shadow roots could be inspected if inspector is reopened.
 
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.red  { (<style>…</style>)
+.red { (<style>…</style>)
     color: red;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/elements-test.js b/third_party/WebKit/LayoutTests/http/tests/inspector/elements-test.js
index ba2b2f18..ae9fda6 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/elements-test.js
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/elements-test.js
@@ -373,19 +373,23 @@
     if (!section)
         return;
     InspectorTest.addResult("[expanded] " + (section.element.classList.contains("no-affect") ? "[no-affect] " : ""));
-    var chainEntries = section._titleElement.querySelectorAll(".media-list .media");
-    chainEntries = Array.prototype.slice.call(chainEntries);
-    if (section._titleElement.children[1])
-        chainEntries.push(section._titleElement.children[1]);
 
-    for (var j = 0; j < chainEntries.length; ++j) {
-        var chainEntry = chainEntries[j];
-        var entryLine = includeSelectorGroupMarks ? buildMarkedSelectors(chainEntry.children[1]) : chainEntry.children[1].textContent;
-        if (chainEntry.children[2])
-            entryLine += " " + chainEntry.children[2].textContent;
-        entryLine += " (" + extractText(chainEntry.children[0]) + ")";
-        InspectorTest.addResult(entryLine);
+    var medias = section._titleElement.querySelectorAll(".media-list .media");
+    for (var i = 0; i < medias.length; ++i) {
+        var media = medias[i];
+        InspectorTest.addResult(media.textContent);
     }
+    var selector = section._titleElement.querySelector(".selector");
+    var selectorText = includeSelectorGroupMarks ? buildMarkedSelectors(selector) : selector.textContent;
+    // Dump " {".
+    selectorText += selector.nextSibling.textContent;
+    var anchor = section._titleElement.querySelector(".styles-section-subtitle");
+    if (anchor) {
+        var anchorText = extractText(anchor);
+        selectorText += String.sprintf(" (%s)", anchorText);
+    }
+    InspectorTest.addResult(selectorText);
+
     InspectorTest.dumpStyleTreeOutline(section.propertiesTreeOutline, omitLonghands ? 1 : 2);
     InspectorTest.addResult("");
 }
diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/elements/styles/edit-css-with-source-url-expected.txt b/third_party/WebKit/LayoutTests/http/tests/inspector/elements/styles/edit-css-with-source-url-expected.txt
index a5a123e..a3768b3e0 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/elements/styles/edit-css-with-source-url-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/elements/styles/edit-css-with-source-url-expected.txt
@@ -13,29 +13,29 @@
 Stylesheet loaded.
 Dumping matched rules:
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected  { (foo.css:1 -> foo.css:1:1)
+#inspected { (foo.css:1 -> foo.css:1:1)
     color: red;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 Editing styles from elements panel:
 Styles edited.
 Dumping matched rules:
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected  { (foo.css:1 -> foo.css:1:1)
+#inspected { (foo.css:1 -> foo.css:1:1)
     color: green;
     : ;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 Dumping uiSourceCode content:
diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/elements/styles/selector-line-deprecated-expected.txt b/third_party/WebKit/LayoutTests/http/tests/inspector/elements/styles/selector-line-deprecated-expected.txt
index 0261189..849f71c 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/elements/styles/selector-line-deprecated-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/elements/styles/selector-line-deprecated-expected.txt
@@ -2,18 +2,18 @@
 
 Text
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#container #inspected  { (selector-line.scss:4 -> selector-line.scss:4:5)
+#container #inspected { (selector-line.scss:4 -> selector-line.scss:4:5)
     color: green;
 
 [expanded] 
-#inspected  { (selector-line-d…recated.html:4 -> selector-line-deprecated.html:4:1)
+#inspected { (selector-line-d…recated.html:4 -> selector-line-deprecated.html:4:1)
 /-- overloaded --/     color: green;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/elements/styles/selector-line-expected.txt b/third_party/WebKit/LayoutTests/http/tests/inspector/elements/styles/selector-line-expected.txt
index fd33a5c..0c4e8d6 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/elements/styles/selector-line-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/elements/styles/selector-line-expected.txt
@@ -2,18 +2,18 @@
 
 Text
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#container #inspected  { (selector-line.scss:4 -> selector-line.scss:4:5)
+#container #inspected { (selector-line.scss:4 -> selector-line.scss:4:5)
     color: green;
 
 [expanded] 
-#inspected  { (selector-line.html:4 -> selector-line.html:4:1)
+#inspected { (selector-line.html:4 -> selector-line.html:4:1)
 /-- overloaded --/     color: green;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/elements/styles/selector-line-sourcemap-header-deprecated-expected.txt b/third_party/WebKit/LayoutTests/http/tests/inspector/elements/styles/selector-line-sourcemap-header-deprecated-expected.txt
index 8cc8a37..fe753e9 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/elements/styles/selector-line-sourcemap-header-deprecated-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/elements/styles/selector-line-sourcemap-header-deprecated-expected.txt
@@ -2,14 +2,14 @@
 
 Text
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#container #inspected  { (selector-line-s…-header.scss:4 -> selector-line-sourcemap-header.scss:4:5)
+#container #inspected { (selector-line-s…-header.scss:4 -> selector-line-sourcemap-header.scss:4:5)
     color: green;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/http/tests/inspector/elements/styles/selector-line-sourcemap-header-expected.txt b/third_party/WebKit/LayoutTests/http/tests/inspector/elements/styles/selector-line-sourcemap-header-expected.txt
index 8cc8a37..fe753e9 100644
--- a/third_party/WebKit/LayoutTests/http/tests/inspector/elements/styles/selector-line-sourcemap-header-expected.txt
+++ b/third_party/WebKit/LayoutTests/http/tests/inspector/elements/styles/selector-line-sourcemap-header-expected.txt
@@ -2,14 +2,14 @@
 
 Text
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#container #inspected  { (selector-line-s…-header.scss:4 -> selector-line-sourcemap-header.scss:4:5)
+#container #inspected { (selector-line-s…-header.scss:4 -> selector-line-sourcemap-header.scss:4:5)
     color: green;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/http/tests/security/resources/cors-script.php b/third_party/WebKit/LayoutTests/http/tests/security/resources/cors-script.php
index fab2e07..80293eb 100644
--- a/third_party/WebKit/LayoutTests/http/tests/security/resources/cors-script.php
+++ b/third_party/WebKit/LayoutTests/http/tests/security/resources/cors-script.php
@@ -10,6 +10,11 @@
 if (strtolower($_GET["credentials"]) == "true") {
     header("Access-Control-Allow-Credentials: true");
 }
+
+if ($_SERVER["HTTP_SUBORIGIN"] == "foobar") {
+    header("Access-Control-Allow-Suborigin: foobar");
+}
+
 header("Content-Type: application/javascript");
 $delay = $_GET['delay'];
 if ($delay)
diff --git a/third_party/WebKit/LayoutTests/http/tests/security/suborigins/crossorigin/suborigin-cors-xhr-failure-output-expected.txt b/third_party/WebKit/LayoutTests/http/tests/security/suborigins/crossorigin/suborigin-cors-xhr-failure-output-expected.txt
new file mode 100644
index 0000000..89d54c99
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/security/suborigins/crossorigin/suborigin-cors-xhr-failure-output-expected.txt
@@ -0,0 +1,4 @@
+CONSOLE MESSAGE: line 9: If a Suborigin makes a request, a response without an Access-Control-Allow-Suborigin header should fail and should output a reasonable error message.
+CONSOLE ERROR: XMLHttpRequest cannot load http://127.0.0.1:8000/security/resources/cors-script.php?cors=false. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://foobar_127.0.0.1:8000' is therefore not allowed access.
+ALERT: PASS: XHR correctly failed
+
diff --git a/third_party/WebKit/LayoutTests/http/tests/security/suborigins/crossorigin/suborigin-cors-xhr-failure-output.php b/third_party/WebKit/LayoutTests/http/tests/security/suborigins/crossorigin/suborigin-cors-xhr-failure-output.php
new file mode 100644
index 0000000..f0b594b
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/security/suborigins/crossorigin/suborigin-cors-xhr-failure-output.php
@@ -0,0 +1,33 @@
+<?php
+header("Content-Security-Policy: suborigin foobar");
+?>
+<!DOCTYPE html>
+<html>
+<body>
+<script>
+if (window.testRunner) {
+    testRunner.waitUntilDone();
+    testRunner.dumpAsText();
+}
+console.log("If a Suborigin makes a request, a response without an Access-Control-Allow-Suborigin header should fail and should output a reasonable error message.");
+
+function success() {
+    alert("PASS: XHR correctly failed");
+    if (window.testRunner)
+        testRunner.notifyDone();
+}
+
+function failure() {
+    alert("FAIL: XHR incorrectly succeeded");
+    if (window.testRunner)
+        testRunner.notifyDone();
+}
+
+var xhr = new XMLHttpRequest();
+xhr.onerror = success;
+xhr.onload = failure;
+xhr.open("GET", "http://127.0.0.1:8000/security/resources/cors-script.php?cors=false");
+xhr.send();
+</script>
+</body>
+</html>
diff --git a/third_party/WebKit/LayoutTests/http/tests/security/suborigins/crossorigin/suborigin-cors-xhr-preflight.php b/third_party/WebKit/LayoutTests/http/tests/security/suborigins/crossorigin/suborigin-cors-xhr-preflight.php
new file mode 100644
index 0000000..ee757878
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/security/suborigins/crossorigin/suborigin-cors-xhr-preflight.php
@@ -0,0 +1,76 @@
+<?php
+header("Content-Security-Policy: suborigin foobar");
+?>
+<!DOCTYPE html>
+<html>
+<head>
+<title>Allow suborigin in HTTP header</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/security/suborigins/resources/suborigin-cors-lib.js"></script>
+</head>
+<body>
+<div id="container"></div>
+<script>
+// XMLHttpRequest tests
+var SuboriginXHRTest = function(pass, name, src, crossoriginValue) {
+    SuboriginTest.call(this, pass, "XHR: " + name, src, crossoriginValue);
+}
+
+SuboriginXHRTest.prototype.execute = function() {
+    var test = async_test(this.name);
+    var xhr = new XMLHttpRequest();
+
+    if (this.crossoriginValue === 'use-credentials') {
+        xhr.withCredentials = true;
+    }
+
+    if (this.pass) {
+        xhr.onload = function() {
+            test.done();
+        };
+        xhr.onerror = function() {
+            test.step(function() { assert_unreached("Good XHR fired error handler."); });
+        };
+    } else {
+        xhr.onload = function() {
+            test.step(function() { assert_unreached("Bad XHR successful."); });
+        };
+        xhr.onerror = function() {
+            test.done();
+        };
+    }
+
+    xhr.open("GET", this.src);
+    xhr.send();
+};
+
+var xorigin_preflight_script = "http://127.0.0.1:8000/security/resources/cors-script.php";
+
+// XHR preflight tests
+new SuboriginXHRTest(
+    true,
+    "Basic anonymous XHR preflight",
+    xorigin_preflight_script + "?cors=http://foobar_127.0.0.1:8000",
+    "anonymous").execute();
+
+new SuboriginXHRTest(
+    true,
+    "Basic anonymous XHR preflight with '*' ACAO",
+    xorigin_preflight_script + "?cors=*",
+    "anonymous").execute();
+
+new SuboriginXHRTest(
+    true,
+    "Basic XHR with credentials preflight",
+    xorigin_preflight_script + "?cors=http://foobar_127.0.0.1:8000&credentials=true",
+    "use-credentials").execute();
+
+new SuboriginXHRTest(
+    false,
+    "Basic XHR with credentials preflight with '*' ACAO",
+    xorigin_preflight_script + "?cors=*&credentials=true",
+    "use-credentials").execute();
+</script>
+</body>
+</html>
diff --git a/third_party/WebKit/LayoutTests/inspector-protocol/accessibility/accessibility-getRelationships-expected.txt b/third_party/WebKit/LayoutTests/inspector-protocol/accessibility/accessibility-getRelationships-expected.txt
index 7f12afa4..2cfc6ed 100644
--- a/third_party/WebKit/LayoutTests/inspector-protocol/accessibility/accessibility-getRelationships-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector-protocol/accessibility/accessibility-getRelationships-expected.txt
@@ -86,10 +86,6 @@
             "superseded": true
           }
         ]
-      },
-      "description": {
-        "type": "computedString",
-        "value": "Lunch Options"
       }
     }
   }
@@ -156,10 +152,6 @@
             "superseded": true
           }
         ]
-      },
-      "description": {
-        "type": "computedString",
-        "value": "Drink Options"
       }
     }
   }
diff --git a/third_party/WebKit/LayoutTests/inspector-protocol/accessibility/accessibility-ignoredNodes-expected.txt b/third_party/WebKit/LayoutTests/inspector-protocol/accessibility/accessibility-ignoredNodes-expected.txt
index d933c02..02c1514 100644
--- a/third_party/WebKit/LayoutTests/inspector-protocol/accessibility/accessibility-ignoredNodes-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector-protocol/accessibility/accessibility-ignoredNodes-expected.txt
@@ -74,7 +74,7 @@
       ],
       "name": {
         "type": "computedString",
-        "value": "non-hidden treeitem",
+        "value": "",
         "sources": [
           {
             "type": "relatedElement",
@@ -85,16 +85,8 @@
             "attribute": "aria-label"
           },
           {
-            "type": "contents",
-            "value": {
-              "type": "string",
-              "value": "non-hidden treeitem"
-            }
-          },
-          {
             "type": "attribute",
-            "attribute": "title",
-            "superseded": true
+            "attribute": "title"
           }
         ]
       }
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/elements-delete-inline-style-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/elements-delete-inline-style-expected.txt
index a6b5d44..f4feac6 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/elements-delete-inline-style-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/elements-delete-inline-style-expected.txt
@@ -2,19 +2,19 @@
 
 Before style property removal:
 [expanded] 
-element.style  { ()
+element.style { ()
     color: red;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 After style property removal:
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/elements-panel-styles-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/elements-panel-styles-expected.txt
index 002a92e0..8964158 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/elements-panel-styles-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/elements-panel-styles-expected.txt
@@ -55,29 +55,29 @@
 -webkit-font-smoothing: subpixel-antialiased
     subpixel-antialiased - element.style
 [expanded] 
-element.style  { ()
+element.style { ()
 /-- overloaded --/     display: none;
     -webkit-font-smoothing: subpixel-antialiased;
 
 [expanded] 
-#container .foo  { (elements-panel-styles.css:17 -> elements-panel-styles.css:17:1)
+#container .foo { (elements-panel-styles.css:17 -> elements-panel-styles.css:17:1)
     font-style: italic !important;
 
 [expanded] 
-body .foo  { (elements-panel-styles.css:6 -> elements-panel-styles.css:6:1)
+body .foo { (elements-panel-styles.css:6 -> elements-panel-styles.css:6:1)
 /-- overloaded --/     text-indent: 10px;
 
 [expanded] 
-.foo  { (elements-panel-styles.css:53 -> elements-panel-styles.css:53:1)
+.foo { (elements-panel-styles.css:53 -> elements-panel-styles.css:53:1)
 
 [expanded] 
-.foo, .foo::before  { (elements-panel-styles.css:34 -> elements-panel-styles.css:34:1)
+.foo, .foo::before { (elements-panel-styles.css:34 -> elements-panel-styles.css:34:1)
     content: "[before Foo]";
     color: blue;
     display: block !important;
 
 [expanded] 
-.foo  { (elements-panel-styles.css:21 -> elements-panel-styles.css:21:1)
+.foo { (elements-panel-styles.css:21 -> elements-panel-styles.css:21:1)
 /-- overloaded --/     color: black;
     margin-left: 1px;
     margin: 10px 0 2px;
@@ -102,53 +102,53 @@
     text-indent: 0 !important;
 
 [expanded] 
-div[Attributes Style]  { ()
+div[Attributes Style] { ()
     text-align: -webkit-left;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
 /-- overloaded --/     display: block;
 
 ======== Inherited from div#container ========
 [expanded] 
-#container  { (elements-panel-styles.css:10 -> elements-panel-styles.css:10:1)
+#container { (elements-panel-styles.css:10 -> elements-panel-styles.css:10:1)
     font-family: serif;
     font-size: 14px;
 /-- overloaded --/     color: red;
 
 ======== Inherited from body ========
 [expanded] 
-body  { (elements-panel-styles.css:1 -> elements-panel-styles.css:1:1)
+body { (elements-panel-styles.css:1 -> elements-panel-styles.css:1:1)
 /-- overloaded --/     font-size: 12px;
 /-- overloaded --/     text-indent: 20px !important;
 
 ======== Inherited from html ========
 [expanded] 
-html  { (elements-panel-styles.css:61 -> elements-panel-styles.css:61:1)
+html { (elements-panel-styles.css:61 -> elements-panel-styles.css:61:1)
 /-- overloaded --/     color: magenta !important;
 
 ======== Pseudo ::before element ========
 [expanded] 
-.foo::before  { (elements-panel-styles.css:57 -> elements-panel-styles.css:57:1)
+.foo::before { (elements-panel-styles.css:57 -> elements-panel-styles.css:57:1)
 
 [expanded] 
-.foo::before  { (elements-panel-styles.css:40 -> elements-panel-styles.css:40:1)
+.foo::before { (elements-panel-styles.css:40 -> elements-panel-styles.css:40:1)
     color: red;
 
 [expanded] 
-.foo, .foo::before  { (elements-panel-styles.css:34 -> elements-panel-styles.css:34:7)
+.foo, .foo::before { (elements-panel-styles.css:34 -> elements-panel-styles.css:34:7)
     content: "[before Foo]";
 /-- overloaded --/     color: blue;
     display: block !important;
 
 ======== Pseudo ::after element ========
 [expanded] 
-.foo::after  { (elements-panel-styles.css:48 -> elements-panel-styles.css:48:1)
+.foo::after { (elements-panel-styles.css:48 -> elements-panel-styles.css:48:1)
     font-family: courier;
     content: "[after Foo 2]";
 
 [expanded] 
-.foo::after  { (elements-panel-styles.css:44 -> elements-panel-styles.css:44:1)
+.foo::after { (elements-panel-styles.css:44 -> elements-panel-styles.css:44:1)
 /-- overloaded --/     content: "[after Foo]";
     color: green;
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/add-new-rule-invalid-selector-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/add-new-rule-invalid-selector-expected.txt
index b4debfd1..3d22cbc8 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/add-new-rule-invalid-selector-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/add-new-rule-invalid-selector-expected.txt
@@ -6,10 +6,10 @@
 
 Running: keyframesRuleSelector
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/add-new-rule-with-style-after-body-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/add-new-rule-with-style-after-body-expected.txt
index 61a4833a..5fadab0 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/add-new-rule-with-style-after-body-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/add-new-rule-with-style-after-body-expected.txt
@@ -3,16 +3,16 @@
 Text
 After adding new rule:
 [expanded] 
-element.style  { ()
+element.style { ()
     font-size: 12px;
 
 [expanded] [no-affect] 
-inspected  { (inspector-stylesheet:1 -> inspector-stylesheet:1:1)
+inspected { (inspector-stylesheet:1 -> inspector-stylesheet:1:1)
     color: maroon;
     : ;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/commit-selector-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/commit-selector-expected.txt
index 452f487..c3c3b341 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/commit-selector-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/commit-selector-expected.txt
@@ -3,41 +3,41 @@
 Text
 === Before selector modification ===
 [expanded] 
-element.style  { ()
+element.style { ()
     color: red;
 
 [expanded] 
-#inspected  { (commit-selector.html:4 -> commit-selector.html:4:1)
+#inspected { (commit-selector.html:4 -> commit-selector.html:4:1)
 /-- overloaded --/     color: green;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 === After non-affecting selector modification ===
 [expanded] 
-element.style  { ()
+element.style { ()
     color: red;
 
 [expanded] 
-hr, #inspected  { (commit-selector.html:4 -> commit-selector.html:4:5)
+hr, #inspected { (commit-selector.html:4 -> commit-selector.html:4:5)
 /-- overloaded --/     color: green;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 === After affecting selector modification ===
 [expanded] 
-element.style  { ()
+element.style { ()
     color: red;
 
 [expanded] [no-affect] 
-#inspectedChanged  { (commit-selector.html:4 -> commit-selector.html:4:1)
+#inspectedChanged { (commit-selector.html:4 -> commit-selector.html:4:1)
     color: green;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/commit-selector-mark-matching-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/commit-selector-mark-matching-expected.txt
index 394b61d6..21eadfe 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/commit-selector-mark-matching-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/commit-selector-mark-matching-expected.txt
@@ -5,25 +5,25 @@
 
 Running: addRule
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-foo, [$#inspected$], .bar, [$#inspected$]  { (inspector-stylesheet:1 -> inspector-stylesheet:1:6)
+foo, [$#inspected$], .bar, [$#inspected$] { (inspector-stylesheet:1 -> inspector-stylesheet:1:6)
 
 [expanded] 
-[$div$]  { (user agent stylesheet)
+[$div$] { (user agent stylesheet)
     display: block;
 
 
 Running: changeSelector
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-[$#inspected$], a, hr  { (inspector-stylesheet:1 -> inspector-stylesheet:1:1)
+[$#inspected$], a, hr { (inspector-stylesheet:1 -> inspector-stylesheet:1:1)
 
 [expanded] 
-[$div$]  { (user agent stylesheet)
+[$div$] { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/css-live-edit-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/css-live-edit-expected.txt
index 01c83204..3afbc35e 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/css-live-edit-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/css-live-edit-expected.txt
@@ -7,6 +7,6 @@
 font-size: 20px
     20px - body css-live-edit.css:1 -> css-live-edit.css:1:1
 [expanded] 
-element.style  { ()
+element.style { ()
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/cssom-media-insert-crash-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/cssom-media-insert-crash-expected.txt
index e0e2cfa..b6db668b 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/cssom-media-insert-crash-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/cssom-media-insert-crash-expected.txt
@@ -1,22 +1,21 @@
 Tests that the inspected page does not crash after inspecting element with CSSOM added rules. Bug 373508
 Inspecting this element crashes DevTools
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-@media all (cssom-media-insert-crash.html)
-#box  { (<style>…</style>)
+#box { (<style>…</style>)
     color: white;
     background: red;
 
 [expanded] 
-div  { (cssom-media-ins…-crash.html:20 -> cssom-media-insert-crash.html:20:1)
+div { (cssom-media-ins…-crash.html:20 -> cssom-media-insert-crash.html:20:1)
     border: 1px solid black;
 /-- overloaded --/     background-color: white;
     padding: 20px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/disable-property-workingcopy-update-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/disable-property-workingcopy-update-expected.txt
index 21d2412..20a3693 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/disable-property-workingcopy-update-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/disable-property-workingcopy-update-expected.txt
@@ -21,14 +21,14 @@
 
 ==Source frame contents end==
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected  { (disable-propert…y-update.css:1 -> disable-property-workingcopy-update.css:1:1)
+#inspected { (disable-propert…y-update.css:1 -> disable-property-workingcopy-update.css:1:1)
 /-- overloaded --/ /-- disabled --/     /* font-weight: bold; */
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
@@ -42,14 +42,14 @@
 
 ==Source frame contents end==
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected  { (disable-propert…y-update.css:1 -> disable-property-workingcopy-update.css:1:1)
+#inspected { (disable-propert…y-update.css:1 -> disable-property-workingcopy-update.css:1:1)
     font-weight: bold;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/dynamic-style-tag-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/dynamic-style-tag-expected.txt
index b6c93b9c..2222bc0 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/dynamic-style-tag-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/dynamic-style-tag-expected.txt
@@ -54,35 +54,35 @@
 }
 /*# sourceURL=inlineStyleCreatedByScript.css*/
 [expanded] 
-element.style  { ()
+element.style { ()
     color: red;
 
 [expanded] 
-.inline-style-created-by-script-with-source-url  { (inlineStyleCrea…ByScript.css:1 -> inlineStyleCreatedByScript.css:1:1)
+.inline-style-created-by-script-with-source-url { (inlineStyleCrea…ByScript.css:1 -> inlineStyleCreatedByScript.css:1:1)
 /-- overloaded --/     color: grey;
 
 [expanded] 
-.inline-style-created-by-script  { (<style>…</style>)
+.inline-style-created-by-script { (<style>…</style>)
 /-- overloaded --/     color: orange;
 
 [expanded] 
-.inline-style-added-by-document-write-with-source-url  { (inlineStyleAdde…entWrite.css:2 -> inlineStyleAddedByDocumentWrite.css:2:1)
+.inline-style-added-by-document-write-with-source-url { (inlineStyleAdde…entWrite.css:2 -> inlineStyleAddedByDocumentWrite.css:2:1)
 /-- overloaded --/     color: yellow;
 
 [expanded] 
-.inline-style-added-by-parser-in-document-write  { (<style>…</style>)
+.inline-style-added-by-parser-in-document-write { (<style>…</style>)
 /-- overloaded --/     color: blue;
 
 [expanded] 
-.inline-style-added-by-parser-with-source-url  { (inlineStyleAddedByParser.css:2 -> inlineStyleAddedByParser.css:2:1)
+.inline-style-added-by-parser-with-source-url { (inlineStyleAddedByParser.css:2 -> inlineStyleAddedByParser.css:2:1)
 /-- overloaded --/     color: green;
 
 [expanded] 
-.inline-style-added-by-parser  { (dynamic-style-tag.html:6 -> dynamic-style-tag.html:6:14)
+.inline-style-added-by-parser { (dynamic-style-tag.html:6 -> dynamic-style-tag.html:6:14)
 /-- overloaded --/     color: red;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/edit-inspector-stylesheet-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/edit-inspector-stylesheet-expected.txt
index 845c63f3..22b5ef1 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/edit-inspector-stylesheet-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/edit-inspector-stylesheet-expected.txt
@@ -9,14 +9,14 @@
 Inspector stylesheet content:
 #inspected { background-color: green; }
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected  { (inspector-stylesheet:1 -> inspector-stylesheet:1:1)
+#inspected { (inspector-stylesheet:1 -> inspector-stylesheet:1:1)
     background-color: green;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/edit-media-text-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/edit-media-text-expected.txt
index 8744936..2adf2f2 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/edit-media-text-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/edit-media-text-expected.txt
@@ -3,59 +3,57 @@
 Text
 === Before media text modification ===
 [expanded] 
-element.style  { ()
+element.style { ()
     color: red;
 
 [expanded] 
-@media screen and (max-device-width: 100000px) (edit-media-text.html:4 -> edit-media-text.html:4:8)
-#inspected  { (edit-media-text.html:8 -> edit-media-text.html:8:5)
+@media screen and (max-device-width: 100000px)
+#inspected { (edit-media-text.html:8 -> edit-media-text.html:8:5)
 /-- overloaded --/     color: blue;
 
 [expanded] 
-@media screen and (max-device-width: 100000px) (edit-media-text.html:4 -> edit-media-text.html:4:8)
-#inspected  { (edit-media-text.html:5 -> edit-media-text.html:5:5)
+@media screen and (max-device-width: 100000px)
+#inspected { (edit-media-text.html:5 -> edit-media-text.html:5:5)
 /-- overloaded --/     color: green;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 === After valid media text modification ===
 [expanded] 
-element.style  { ()
+element.style { ()
     color: red;
 
 [expanded] 
-@media screen and (max-device-width: 99999px) (edit-media-text.html:4 -> edit-media-text.html:4:8)
-#inspected  { (edit-media-text.html:8 -> edit-media-text.html:8:5)
+@media screen and (max-device-width: 99999px)
+#inspected { (edit-media-text.html:8 -> edit-media-text.html:8:5)
 /-- overloaded --/     color: blue;
 
 [expanded] 
-@media screen and (max-device-width: 99999px) (edit-media-text.html:4 -> edit-media-text.html:4:8)
-#inspected  { (edit-media-text.html:5 -> edit-media-text.html:5:5)
+@media screen and (max-device-width: 99999px)
+#inspected { (edit-media-text.html:5 -> edit-media-text.html:5:5)
 /-- overloaded --/     color: green;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 === After invalid media text modification ===
 [expanded] 
-element.style  { ()
+element.style { ()
     color: red;
 
 [expanded] 
-@media not all (edit-media-text.html:4 -> edit-media-text.html:4:8)
-#inspected  { (edit-media-text.html:8 -> edit-media-text.html:8:5)
+#inspected { (edit-media-text.html:8 -> edit-media-text.html:8:5)
 /-- overloaded --/     color: blue;
 
 [expanded] 
-@media not all (edit-media-text.html:4 -> edit-media-text.html:4:8)
-#inspected  { (edit-media-text.html:5 -> edit-media-text.html:5:5)
+#inspected { (edit-media-text.html:5 -> edit-media-text.html:5:5)
 /-- overloaded --/     color: green;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/edit-resource-referred-by-multiple-styletags-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/edit-resource-referred-by-multiple-styletags-expected.txt
index a343d86..f25404e 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/edit-resource-referred-by-multiple-styletags-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/edit-resource-referred-by-multiple-styletags-expected.txt
@@ -2,22 +2,22 @@
 
 Inspected node
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected  { (stylesheet.css:2 -> stylesheet.css:2:1)
+#inspected { (stylesheet.css:2 -> stylesheet.css:2:1)
     font-size: 2em;
 
 [expanded] 
-#inspected  { (stylesheet.css:2 -> stylesheet.css:2:1)
+#inspected { (stylesheet.css:2 -> stylesheet.css:2:1)
 /-- overloaded --/     font-size: 2em;
 
 [expanded] 
-#inspected  { (stylesheet.css:2 -> stylesheet.css:2:1)
+#inspected { (stylesheet.css:2 -> stylesheet.css:2:1)
 /-- overloaded --/     font-size: 2em;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/empty-background-url-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/empty-background-url-expected.txt
index 1bb1a59a..e3a5c4c 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-1/empty-background-url-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-1/empty-background-url-expected.txt
@@ -1,14 +1,14 @@
 Tests that empty url in the property value does not break inspector.
 
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected  { (empty-background-url.css:1 -> empty-background-url.css:1:1)
+#inspected { (empty-background-url.css:1 -> empty-background-url.css:1:1)
     background-image: url();
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/cssom-shorthand-important-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/cssom-shorthand-important-expected.txt
index 23643aac3..d4ac35e 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/cssom-shorthand-important-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/cssom-shorthand-important-expected.txt
@@ -2,10 +2,10 @@
 
 Text
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected  { (<style>…</style>)
+#inspected { (<style>…</style>)
     margin-top: 10px;
     padding: 10px 50px !important;
         padding-top: 10px;
@@ -14,7 +14,7 @@
         padding-left: 50px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/force-pseudo-state-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/force-pseudo-state-expected.txt
index ab9722f..2eb7706 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/force-pseudo-state-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/force-pseudo-state-expected.txt
@@ -4,23 +4,23 @@
 
 DIV with :hover and :active
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-div:active, a:active  { (force-pseudo-state.html:12 -> force-pseudo-state.html:12:1)
+div:active, a:active { (force-pseudo-state.html:12 -> force-pseudo-state.html:12:1)
     font-weight: bold;
 
 [expanded] 
-div:hover, a:hover  { (force-pseudo-state.html:4 -> force-pseudo-state.html:4:1)
+div:hover, a:hover { (force-pseudo-state.html:4 -> force-pseudo-state.html:4:1)
     color: red;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 ======== Inherited from body#mainBody.main1.main2.mainpage ========
 [expanded] 
-Style Attribute  { ()
+Style Attribute { ()
 /-- overloaded --/     font-weight: normal;
 
 - <html> [subtreeMarkerCount:1]
@@ -33,14 +33,14 @@
 
 DIV with :active and :focus
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-div:active, a:active  { (force-pseudo-state.html:12 -> force-pseudo-state.html:12:1)
+div:active, a:active { (force-pseudo-state.html:12 -> force-pseudo-state.html:12:1)
     font-weight: bold;
 
 [expanded] 
-div:focus, a:focus  { (force-pseudo-state.html:8 -> force-pseudo-state.html:8:1)
+div:focus, a:focus { (force-pseudo-state.html:8 -> force-pseudo-state.html:8:1)
     border: 1px solid green;
         border-top-color: green;
         border-top-style: solid;
@@ -56,19 +56,19 @@
         border-left-width: 1px;
 
 [expanded] 
-:focus  { (user agent stylesheet)
+:focus { (user agent stylesheet)
     outline: -webkit-focus-ring-color auto 5px;
         outline-color: -webkit-focus-ring-color;
         outline-style: auto;
         outline-width: 5px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 ======== Inherited from body#mainBody.main1.main2.mainpage ========
 [expanded] 
-Style Attribute  { ()
+Style Attribute { ()
 /-- overloaded --/     font-weight: normal;
 
 - <html> [subtreeMarkerCount:1]
@@ -81,15 +81,15 @@
 
 DIV with no forced state
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 ======== Inherited from body#mainBody.main1.main2.mainpage ========
 [expanded] 
-Style Attribute  { ()
+Style Attribute { ()
     font-weight: normal;
 
 - <html>
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/inactive-properties-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/inactive-properties-expected.txt
index a344686..fc0c153 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/inactive-properties-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/inactive-properties-expected.txt
@@ -7,20 +7,20 @@
     right - #inspected inactive-properties.html:20 -> inactive-properties.html:20:1
     OVERLOADED -webkit-left - element.style
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected  { (inactive-properties.html:20 -> inactive-properties.html:20:1)
+#inspected { (inactive-properties.html:20 -> inactive-properties.html:20:1)
 /-- overloaded --/     text-align: left;
 /-- overloaded --/     text-align: bar;
     text-align: right;
 
 [expanded] 
-div[Attributes Style]  { ()
+div[Attributes Style] { ()
 /-- overloaded --/     text-align: -webkit-left;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/inherited-mixed-case-properties-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/inherited-mixed-case-properties-expected.txt
index 3d9a49a..3758a58a 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/inherited-mixed-case-properties-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/inherited-mixed-case-properties-expected.txt
@@ -5,19 +5,19 @@
     block - div user agent stylesheet
 -webkit-font-smoothing: antialiased
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 ======== Inherited from div#container ========
 [expanded] 
-Style Attribute  { ()
+Style Attribute { ()
     CoLoR: blAck;
 
 [expanded] 
-#container  { (inherited-mixed…perties.html:4 -> inherited-mixed-case-properties.html:4:1)
+#container { (inherited-mixed…perties.html:4 -> inherited-mixed-case-properties.html:4:1)
     -webkit-FONT-smoothing: antialiased;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/inject-stylesheet-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/inject-stylesheet-expected.txt
index 9028f4b..74f6372 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/inject-stylesheet-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/inject-stylesheet-expected.txt
@@ -22,11 +22,10 @@
 -webkit-border-image: url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAQAAAC1+jfqAAAAiElE…s+LS30CAhBN5nNxeT5hbJ1zwmji2k+aF6NENIPf/hs54f0sZFUVAMigAAAABJRU5ErkJggg==") 100% / 1 / 0px stretch
     url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAQAAAC1+jfqAAAAiElE…s+LS30CAhBN5nNxeT5hbJ1zwmji2k+aF6NENIPf/hs54f0sZFUVAMigAAAABJRU5ErkJggg==") - #main injected stylesheet
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-media="screen" (inject-stylesheet.html)
-#main  { (inject-stylesheet.html:5 -> inject-stylesheet.html:5:3)
+#main { (inject-stylesheet.html:5 -> inject-stylesheet.html:5:3)
     background: blue;
         background-image: initial;
         background-position-x: initial;
@@ -40,12 +39,12 @@
         background-color: blue;
 
 [expanded] 
-#main  { (injected stylesheet)
+#main { (injected stylesheet)
     color: red;
     -webkit-border-image: url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAQAAAC1+jfqAAAAiElE…s+LS30CAhBN5nNxeT5hbJ1zwmji2k+aF6NENIPf/hs54f0sZFUVAMigAAAABJRU5ErkJggg==");
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 iframe style:
@@ -78,10 +77,10 @@
 margin-top: 8px
     8px - body user agent stylesheet
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#iframebody  { (injected stylesheet)
+#iframebody { (injected stylesheet)
     background: red;
         background-image: initial;
         background-position-x: initial;
@@ -95,8 +94,7 @@
         background-color: red;
 
 [expanded] 
-media="screen" (inject-stylesheet-iframe-data.html)
-body  { (inject-styleshe…me-data.html:4 -> inject-stylesheet-iframe-data.html:4:3)
+body { (inject-styleshe…me-data.html:4 -> inject-stylesheet-iframe-data.html:4:3)
 /-- overloaded --/     background: green;
     /-- overloaded --/     background-image: initial;
     /-- overloaded --/     background-position-x: initial;
@@ -110,7 +108,7 @@
     /-- overloaded --/     background-color: green;
 
 [expanded] 
-body  { (user agent stylesheet)
+body { (user agent stylesheet)
     display: block;
     margin: 8px;
         margin-top: 8px;
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/keyframes-rules-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/keyframes-rules-expected.txt
index c3ce2d4b..aa10810 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/keyframes-rules-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/keyframes-rules-expected.txt
@@ -6,15 +6,15 @@
 
 Running: testDumpStyles
 [expanded] 
-element.style  { ()
+element.style { ()
     background-color: white;
 
 [expanded] 
-*  { (keyframes-rules.html:9 -> keyframes-rules.html:9:1)
+* { (keyframes-rules.html:9 -> keyframes-rules.html:9:1)
 /-- overloaded --/     background-color: papayawhip;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/lazy-computed-style-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/lazy-computed-style-expected.txt
index 3267611..35b8e8e 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/lazy-computed-style-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/lazy-computed-style-expected.txt
@@ -2,10 +2,10 @@
 
 ==== All styles (should be no computed) ====
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected  { (lazy-computed-style.html:15 -> lazy-computed-style.html:15:1)
+#inspected { (lazy-computed-style.html:15 -> lazy-computed-style.html:15:1)
     background: gray;
         background-image: initial;
         background-position-x: initial;
@@ -19,17 +19,17 @@
         background-color: gray;
 
 [expanded] 
-#inspected  { (lazy-computed-style.html:10 -> lazy-computed-style.html:10:1)
+#inspected { (lazy-computed-style.html:10 -> lazy-computed-style.html:10:1)
 /-- overloaded --/     background-color: black;
     font-family: Courier;
 
 [expanded] 
-#inspected  { (lazy-computed-style.html:5 -> lazy-computed-style.html:5:1)
+#inspected { (lazy-computed-style.html:5 -> lazy-computed-style.html:5:1)
 /-- overloaded --/     background-color: green;
 /-- overloaded --/     font-family: Times;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 ==== All styles (computed should be there) ====
@@ -53,10 +53,10 @@
     Courier - #inspected lazy-computed-style.html:10 -> lazy-computed-style.html:10:1
     OVERLOADED Times - #inspected lazy-computed-style.html:5 -> lazy-computed-style.html:5:1
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected  { (lazy-computed-style.html:15 -> lazy-computed-style.html:15:1)
+#inspected { (lazy-computed-style.html:15 -> lazy-computed-style.html:15:1)
     background: gray;
         background-image: initial;
         background-position-x: initial;
@@ -70,17 +70,17 @@
         background-color: gray;
 
 [expanded] 
-#inspected  { (lazy-computed-style.html:10 -> lazy-computed-style.html:10:1)
+#inspected { (lazy-computed-style.html:10 -> lazy-computed-style.html:10:1)
 /-- overloaded --/     background-color: black;
     font-family: Courier;
 
 [expanded] 
-#inspected  { (lazy-computed-style.html:5 -> lazy-computed-style.html:5:1)
+#inspected { (lazy-computed-style.html:5 -> lazy-computed-style.html:5:1)
 /-- overloaded --/     background-color: green;
 /-- overloaded --/     font-family: Times;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/media-emulation-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/media-emulation-expected.txt
index 6c86f5f..c99ece23d 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/media-emulation-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/media-emulation-expected.txt
@@ -2,65 +2,64 @@
 
 Original style:
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#main  { (media-emulation.html:5 -> media-emulation.html:5:1)
+#main { (media-emulation.html:5 -> media-emulation.html:5:1)
     color: red;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 print media emulated:
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-@media print (media-emulation.html:7 -> media-emulation.html:7:8)
-#main  { (media-emulation.html:8 -> media-emulation.html:8:1)
+@media print
+#main { (media-emulation.html:8 -> media-emulation.html:8:1)
     color: black;
 
 [expanded] 
-#main  { (media-emulation.html:5 -> media-emulation.html:5:1)
+#main { (media-emulation.html:5 -> media-emulation.html:5:1)
 /-- overloaded --/     color: red;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 [expanded] 
-*  { (user agent stylesheet)
+* { (user agent stylesheet)
     -webkit-column-width: auto;
     -webkit-column-count: auto;
 
 tty media emulated:
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-@media tty (media-emulation.html:11 -> media-emulation.html:11:8)
-#main  { (media-emulation.html:12 -> media-emulation.html:12:1)
+#main { (media-emulation.html:12 -> media-emulation.html:12:1)
     color: green;
 
 [expanded] 
-#main  { (media-emulation.html:5 -> media-emulation.html:5:1)
+#main { (media-emulation.html:5 -> media-emulation.html:5:1)
 /-- overloaded --/     color: red;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 No media emulated:
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#main  { (media-emulation.html:5 -> media-emulation.html:5:1)
+#main { (media-emulation.html:5 -> media-emulation.html:5:1)
     color: red;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/media-queries-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/media-queries-expected.txt
index 05f0d25..64de80ad 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/media-queries-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/media-queries-expected.txt
@@ -2,29 +2,22 @@
 
 Main style:
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-media="all" (media-queries.html)
-@media screen (media-queries.css:5 -> media-queries.css:5:12)
-#main  { (media-queries.css:6 -> media-queries.css:6:7)
+#main { (media-queries.css:6 -> media-queries.css:6:7)
     color: yellow;
 
 [expanded] 
-media="all" (media-queries.html)
-@import screen (media-queries.css:3 -> media-queries.css:3:36)
-@media not aural (media-queries-1.css:5 -> media-queries-1.css:5:8)
-#main  { (media-queries-1.css:6 -> media-queries-1.css:6:5)
+#main { (media-queries-1.css:6 -> media-queries-1.css:6:5)
     border: 1px solid black;
 
 [expanded] 
-media="screen" (media-queries.html)
-@media not print (media-queries.html:5 -> media-queries.html:5:8)
-#main  { (media-queries.html:6 -> media-queries.html:6:5)
+#main { (media-queries.html:6 -> media-queries.html:6:5)
     background: blue;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/media-using-same-url-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/media-using-same-url-expected.txt
index d89a516..56b5ef22 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/media-using-same-url-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/media-using-same-url-expected.txt
@@ -2,22 +2,18 @@
 
 Main style:
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-media="screen" (media-using-same-url.html)
-@media not print (media-using-same-url.html:13 -> media-using-same-url.html:13:8)
-#main  { (media-using-same-url.html:14 -> media-using-same-url.html:14:1)
+#main { (media-using-same-url.html:14 -> media-using-same-url.html:14:1)
     color: white;
 
 [expanded] 
-media="screen" (media-using-same-url.html)
-@media not print (media-using-same-url.html:5 -> media-using-same-url.html:5:8)
-#main  { (media-using-same-url.html:6 -> media-using-same-url.html:6:1)
+#main { (media-using-same-url.html:6 -> media-using-same-url.html:6:1)
     background: blue;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/parse-comments-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/parse-comments-expected.txt
index cd802bf..41de493 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/parse-comments-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/parse-comments-expected.txt
@@ -2,23 +2,22 @@
 
 Main style:
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#main  { (parse-comments.html:25 -> parse-comments.html:25:1)
+#main { (parse-comments.html:25 -> parse-comments.html:25:1)
 /-- overloaded --/ /-- disabled --/     /* Comment: value; */
     color/* Comment: value */:/* Comment: value */ green/* Comment: value */;
 /-- overloaded --/ /-- disabled --/     /* Comment: value; */
 
 [expanded] 
-@media not print (parse-comments.html:7 -> parse-comments.html:7:29)
-#main  { (parse-comments.html:9 -> parse-comments.html:9:25)
+#main { (parse-comments.html:9 -> parse-comments.html:9:25)
 /-- overloaded --/ /-- disabled --/     /* Comment: value; */
     background /* Comment: value */ :/* Comment: value */blue/* Comment: value */;
 /-- overloaded --/ /-- disabled --/     /* Comment: value; */
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/parse-declaration-unterminated-comment-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/parse-declaration-unterminated-comment-expected.txt
index 1639ede..f9cb197a 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/parse-declaration-unterminated-comment-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/parse-declaration-unterminated-comment-expected.txt
@@ -1,19 +1,19 @@
 Tests that CSSParser correctly parses declarations with unterminated comments.
 
 [expanded] 
-element.style  { ()
+element.style { ()
     color: red /* foo: bar;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 [expanded] 
-element.style  { ()
+element.style { ()
     color: green;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/parse-declaration-with-quote-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/parse-declaration-with-quote-expected.txt
index 3f6c1e9d..fdb3dfb6 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/parse-declaration-with-quote-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/parse-declaration-with-quote-expected.txt
@@ -1,11 +1,11 @@
 Tests that CSSParser correctly parses declarations with unterminated strings. Blink bug 231127
 
 [expanded] 
-element.style  { ()
+element.style { ()
 /-- overloaded --/     color: red'foo;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/parse-utf8-bom-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/parse-utf8-bom-expected.txt
index a2b4315..31844c68 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/parse-utf8-bom-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/parse-utf8-bom-expected.txt
@@ -3,14 +3,14 @@
 I'm red.
 
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-h1  { (parse-utf8-bom-main.css:3 -> parse-utf8-bom-main.css:3:1)
+h1 { (parse-utf8-bom-main.css:3 -> parse-utf8-bom-main.css:3:1)
     color: red;
 
 [expanded] 
-h1  { (user agent stylesheet)
+h1 { (user agent stylesheet)
     display: block;
     font-size: 2em;
     -webkit-margin-before: 0.67em;
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/paste-property-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/paste-property-expected.txt
index d8d56f0..ec61fd3 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/paste-property-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/paste-property-expected.txt
@@ -3,38 +3,38 @@
 Text
 Before pasting:
 [expanded] 
-element.style  { ()
+element.style { ()
     font-size: 12px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 After pasting 'margin-left: 1px':
 [expanded] 
-element.style  { ()
+element.style { ()
     margin-left: 1px;
     font-size: 12px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 After pasting 'margin-top: 1px; color: red;':
 [expanded] 
-element.style  { ()
+element.style { ()
     margin-left: 1px;
     font-size: 12px;
     margin-top: 1px;
     color: red;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 After pasting 'foo: bar; moo: zoo' over 'margin-top':
 [expanded] 
-element.style  { ()
+element.style { ()
     margin-left: 1px;
     font-size: 12px;
 /-- overloaded --/     foo: bar;
@@ -42,7 +42,7 @@
     color: red;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/perform-undo-perform-of-mergable-action-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/perform-undo-perform-of-mergable-action-expected.txt
index 9be8626..1d3d2ef 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/perform-undo-perform-of-mergable-action-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/perform-undo-perform-of-mergable-action-expected.txt
@@ -2,50 +2,50 @@
 
 Initial value
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.container  { (perform-undo-pe…-action.html:7 -> perform-undo-perform-of-mergable-action.html:7:1)
+.container { (perform-undo-pe…-action.html:7 -> perform-undo-perform-of-mergable-action.html:7:1)
     font-weight: bold;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 After changing property
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.container  { (perform-undo-pe…-action.html:7 -> perform-undo-perform-of-mergable-action.html:7:1)
+.container { (perform-undo-pe…-action.html:7 -> perform-undo-perform-of-mergable-action.html:7:1)
     font-weight: normal;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 After undo
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.container  { (perform-undo-pe…-action.html:7 -> perform-undo-perform-of-mergable-action.html:7:1)
+.container { (perform-undo-pe…-action.html:7 -> perform-undo-perform-of-mergable-action.html:7:1)
     font-weight: bold;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 After perform
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.container  { (perform-undo-pe…-action.html:7 -> perform-undo-perform-of-mergable-action.html:7:1)
+.container { (perform-undo-pe…-action.html:7 -> perform-undo-perform-of-mergable-action.html:7:1)
     font-weight: normal;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/pseudo-elements-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/pseudo-elements-expected.txt
index 1f7a0fd..9abaa6b 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/pseudo-elements-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/pseudo-elements-expected.txt
@@ -17,32 +17,32 @@
 
 Running: dumpNormalNodeStyles
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-[$div$]  { (user agent stylesheet)
+[$div$] { (user agent stylesheet)
     display: block;
 
 ======== Pseudo ::before element ========
 [expanded] 
-[$#inspected:before$], .some-other-selector  { (pseudo-elements.html:4 -> pseudo-elements.html:4:1)
+[$#inspected:before$], .some-other-selector { (pseudo-elements.html:4 -> pseudo-elements.html:4:1)
     content: "BEFORE";
 
 ======== Pseudo ::after element ========
 [expanded] 
-[$#inspected:after$]  { (pseudo-elements.html:8 -> pseudo-elements.html:8:1)
+[$#inspected:after$] { (pseudo-elements.html:8 -> pseudo-elements.html:8:1)
     content: "AFTER";
 
 
 Running: dumpBeforeStyles
 [expanded] 
-[$#inspected:before$], .some-other-selector  { (pseudo-elements.html:4 -> pseudo-elements.html:4:1)
+[$#inspected:before$], .some-other-selector { (pseudo-elements.html:4 -> pseudo-elements.html:4:1)
     content: "BEFORE";
 
 
 Running: dumpAfterStyles
 [expanded] 
-[$#inspected:after$]  { (pseudo-elements.html:8 -> pseudo-elements.html:8:1)
+[$#inspected:after$] { (pseudo-elements.html:8 -> pseudo-elements.html:8:1)
     content: "AFTER";
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/region-style-crash-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/region-style-crash-expected.txt
index 1b8ee30..75b8583 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-2/region-style-crash-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-2/region-style-crash-expected.txt
@@ -7,14 +7,14 @@
 display: block
     block - p user agent stylesheet
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#p1  { (region-style-crash.html:6 -> region-style-crash.html:6:1)
+#p1 { (region-style-crash.html:6 -> region-style-crash.html:6:1)
     color: #ff0000;
 
 [expanded] 
-p  { (user agent stylesheet)
+p { (user agent stylesheet)
     display: block;
     -webkit-margin-before: 1em;
     -webkit-margin-after: 1em;
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/selector-list-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/selector-list-expected.txt
index 9d34dfe..5f4aa1a3 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/selector-list-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/selector-list-expected.txt
@@ -2,23 +2,23 @@
 
 Text
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-FOO bAr, #inspected, MOO>BAR, htML div, Foo~Moo, MOO  { (selector-list.html:14 -> selector-list.html:14:48)
+FOO bAr, #inspected, MOO>BAR, htML div, Foo~Moo, MOO { (selector-list.html:14 -> selector-list.html:14:48)
     color: green;
 
 [expanded] 
-#inspected  { (selector-list.html:10 -> selector-list.html:10:6)
+#inspected { (selector-list.html:10 -> selector-list.html:10:6)
 
 [expanded] 
-#InSpEcTeD  { (selector-list.html:7 -> selector-list.html:7:1)
+#InSpEcTeD { (selector-list.html:7 -> selector-list.html:7:1)
 
 [expanded] 
-#inspected  { (selector-list.html:4 -> selector-list.html:4:1)
+#inspected { (selector-list.html:4 -> selector-list.html:4:1)
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/shadow-dom-rules-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/shadow-dom-rules-expected.txt
index df1e2852..75cc7a5 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/shadow-dom-rules-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/shadow-dom-rules-expected.txt
@@ -5,14 +5,14 @@
 
 Running: testDumpStyles
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.red  { (<style>…</style>)
+.red { (<style>…</style>)
     color: red;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/style-rule-from-imported-stylesheet-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/style-rule-from-imported-stylesheet-expected.txt
index 2e8ce163..c5236173 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/style-rule-from-imported-stylesheet-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/style-rule-from-imported-stylesheet-expected.txt
@@ -2,28 +2,28 @@
 
  Rules before toggling:
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.square  { (imported-stylesheet.css:1 -> imported-stylesheet.css:1:1)
+.square { (imported-stylesheet.css:1 -> imported-stylesheet.css:1:1)
     background-color: red;
     display: inline-block;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
 /-- overloaded --/     display: block;
 
 Rules after toggling:
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.square  { (imported-stylesheet.css:1 -> imported-stylesheet.css:1:1)
+.square { (imported-stylesheet.css:1 -> imported-stylesheet.css:1:1)
 /-- overloaded --/ /-- disabled --/     /* background-color: red; */
     display: inline-block;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
 /-- overloaded --/     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-blank-property-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-blank-property-expected.txt
index 8cea843a..8deba58 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-blank-property-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-blank-property-expected.txt
@@ -3,38 +3,38 @@
 Text
 Before append:
 [expanded] 
-element.style  { ()
+element.style { ()
     font-size: 12px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 After insertion at index 0:
 [expanded] 
-element.style  { ()
+element.style { ()
     margin-left: 3px;
     font-size: 12px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 After appending and changing a 'compound' property:
 [expanded] 
-element.style  { ()
+element.style { ()
     margin-left: 3px;
     font-size: 12px;
     color: red;
     font-weight: bold;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 After insertion at index 2:
 [expanded] 
-element.style  { ()
+element.style { ()
     margin-left: 3px;
     font-size: 12px;
 /-- overloaded --/     third-property: third-value;
@@ -42,7 +42,7 @@
     font-weight: bold;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-invalid-property-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-invalid-property-expected.txt
index a3658fa..deb99af 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-invalid-property-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-invalid-property-expected.txt
@@ -3,20 +3,20 @@
 Text
 Before append:
 [expanded] 
-element.style  { ()
+element.style { ()
     font-size: 12px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 After append:
 [expanded] 
-element.style  { ()
+element.style { ()
     font-size: 12px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-new-rule-colon-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-new-rule-colon-expected.txt
index aaa4a2de..f8a6fc0 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-new-rule-colon-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-new-rule-colon-expected.txt
@@ -3,27 +3,27 @@
 Text
 After adding new rule (inspected):
 [expanded] 
-element.style  { ()
+element.style { ()
     font-size: 12px;
 
 [expanded] 
-foo, [$div#inspected$], bar  { (inspector-stylesheet:1 -> inspector-stylesheet:1:6)
+foo, [$div#inspected$], bar { (inspector-stylesheet:1 -> inspector-stylesheet:1:6)
     color: maroon;
 
 [expanded] 
-[$div$]  { (user agent stylesheet)
+[$div$] { (user agent stylesheet)
     display: block;
 
 After adding new rule (other):
 [expanded] 
-element.style  { ()
+element.style { ()
     color: red;
 
 [expanded] 
-div#other  { (inspector-stylesheet:5 -> inspector-stylesheet:5:1)
+div#other { (inspector-stylesheet:5 -> inspector-stylesheet:5:1)
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 Revision added: inspector-stylesheet
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-new-rule-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-new-rule-expected.txt
index af93c283..f37965b 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-new-rule-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-new-rule-expected.txt
@@ -3,47 +3,47 @@
 Text
 After adding new rule (inspected):
 [expanded] 
-element.style  { ()
+element.style { ()
     font-size: 12px;
 
 [expanded] 
-foo, [$div#inspected$], bar  { (inspector-stylesheet:1 -> inspector-stylesheet:1:6)
+foo, [$div#inspected$], bar { (inspector-stylesheet:1 -> inspector-stylesheet:1:6)
     color: maroon;
 
 [expanded] 
-[$div$]  { (user agent stylesheet)
+[$div$] { (user agent stylesheet)
     display: block;
 
 After adding new rule (other):
 [expanded] 
-element.style  { ()
+element.style { ()
     color: red;
 
 [expanded] 
-div#other  { (inspector-stylesheet:5 -> inspector-stylesheet:5:1)
+div#other { (inspector-stylesheet:5 -> inspector-stylesheet:5:1)
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.my-class  { (inspector-stylesheet:7 -> inspector-stylesheet:7:1)
+.my-class { (inspector-stylesheet:7 -> inspector-stylesheet:7:1)
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.class-1.class-2.class-3  { (inspector-stylesheet:9 -> inspector-stylesheet:9:1)
+.class-1.class-2.class-3 { (inspector-stylesheet:9 -> inspector-stylesheet:9:1)
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 Revision added: inspector-stylesheet
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-new-rule-tab-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-new-rule-tab-expected.txt
index aaa4a2de..f8a6fc0 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-new-rule-tab-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-new-rule-tab-expected.txt
@@ -3,27 +3,27 @@
 Text
 After adding new rule (inspected):
 [expanded] 
-element.style  { ()
+element.style { ()
     font-size: 12px;
 
 [expanded] 
-foo, [$div#inspected$], bar  { (inspector-stylesheet:1 -> inspector-stylesheet:1:6)
+foo, [$div#inspected$], bar { (inspector-stylesheet:1 -> inspector-stylesheet:1:6)
     color: maroon;
 
 [expanded] 
-[$div$]  { (user agent stylesheet)
+[$div$] { (user agent stylesheet)
     display: block;
 
 After adding new rule (other):
 [expanded] 
-element.style  { ()
+element.style { ()
     color: red;
 
 [expanded] 
-div#other  { (inspector-stylesheet:5 -> inspector-stylesheet:5:1)
+div#other { (inspector-stylesheet:5 -> inspector-stylesheet:5:1)
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 Revision added: inspector-stylesheet
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-new-rule-to-stylesheet-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-new-rule-to-stylesheet-expected.txt
index 753cca0..f2891b1 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-new-rule-to-stylesheet-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-add-new-rule-to-stylesheet-expected.txt
@@ -2,13 +2,13 @@
 
 Styled element
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#other, div  { (different-rule-types.css:48 -> different-rule-types.css:48:1)
+#other, div { (different-rule-types.css:48 -> different-rule-types.css:48:1)
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-cancel-editing-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-cancel-editing-expected.txt
index 414eba0..a1cc5822 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-cancel-editing-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-cancel-editing-expected.txt
@@ -2,20 +2,20 @@
 
 Text
 [expanded] 
-element.style  { ()
+element.style { ()
     color: red;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 After append:
 [expanded] 
-element.style  { ()
+element.style { ()
     color: red;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-change-node-while-editing-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-change-node-while-editing-expected.txt
index 98727f2..02eec8f6 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-change-node-while-editing-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-change-node-while-editing-expected.txt
@@ -2,15 +2,15 @@
 
 Text
 [expanded] 
-element.style  { ()
+element.style { ()
     color: red;
 
 [expanded] 
-element.style  { ()
+element.style { ()
     color: blue;
 
 [expanded] 
-element.style  { ()
+element.style { ()
     background: red;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-commit-editing-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-commit-editing-expected.txt
index 6dbe0ae..28e58bf 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-commit-editing-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-commit-editing-expected.txt
@@ -6,11 +6,11 @@
 
 Running: testFreeFlowEdit
 [expanded] 
-element.style  { ()
+element.style { ()
     color: red;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
@@ -25,11 +25,11 @@
 Running: dumpStyles
 After append:
 [expanded] 
-element.style  { ()
+element.style { ()
     color: green;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-computed-trace-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-computed-trace-expected.txt
index 8a7530d8..f991e87 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-computed-trace-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-computed-trace-expected.txt
@@ -30,7 +30,7 @@
 text-decoration-style: solid
     initial - div styles-computed-trace.html:9 -> styles-computed-trace.html:9:1
 [expanded] 
-element.style  { ()
+element.style { ()
 
 ==== Computed style for ID2 ====
 background-color: rgb(0, 0, 255)
@@ -51,14 +51,14 @@
 text-decoration-style: solid
     initial - div styles-computed-trace.html:9 -> styles-computed-trace.html:9:1
 [expanded] 
-element.style  { ()
+element.style { ()
 
 ==== Style for ID3 ====
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-button[Attributes Style]  { ()
+button[Attributes Style] { ()
     display: none;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-disable-inherited-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-disable-inherited-expected.txt
index 58a534f..88213ba6 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-disable-inherited-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-disable-inherited-expected.txt
@@ -2,23 +2,23 @@
 
 Before disable
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 ======== Inherited from div#container ========
 [expanded] 
-Style Attribute  { ()
+Style Attribute { ()
     font-weight: bold;
 
 After disable:
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-disable-property-after-selector-edit-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-disable-property-after-selector-edit-expected.txt
index 1f8bec1..f03e736 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-disable-property-after-selector-edit-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-disable-property-after-selector-edit-expected.txt
@@ -13,14 +13,14 @@
 
 
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected, .INSERTED-OTHER-SELECTOR  { (styles-disable-…r-edit.html:41 -> styles-disable-property-after-selector-edit.html:41:1)
+#inspected, .INSERTED-OTHER-SELECTOR { (styles-disable-…r-edit.html:41 -> styles-disable-property-after-selector-edit.html:41:1)
 /-- overloaded --/ /-- disabled --/     /* color: red; */
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-disable-then-change-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-disable-then-change-expected.txt
index 9e13ed1e..c00bd75c 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-disable-then-change-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-disable-then-change-expected.txt
@@ -2,17 +2,17 @@
 
 Before disable
 [expanded] 
-element.style  { ()
+element.style { ()
     font-weight: bold;
 
 After disable
 [expanded] 
-element.style  { ()
+element.style { ()
 /-- overloaded --/ /-- disabled --/     /* font-weight: bold; */
 
 After change
 [expanded] 
-element.style  { ()
+element.style { ()
     color: green;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-disable-then-delete-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-disable-then-delete-expected.txt
index ca5d4ee..5ba9364 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-disable-then-delete-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-disable-then-delete-expected.txt
@@ -2,16 +2,16 @@
 
 Before disable
 [expanded] 
-element.style  { ()
+element.style { ()
     font-weight: bold;
 
 After disable
 [expanded] 
-element.style  { ()
+element.style { ()
 /-- overloaded --/ /-- disabled --/     /* font-weight: bold; */
 
 After delete
 [expanded] 
-element.style  { ()
+element.style { ()
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-disable-then-enable-overriden-ua-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-disable-then-enable-overriden-ua-expected.txt
index 4bfaba3..b30c5017 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-disable-then-enable-overriden-ua-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-3/styles-disable-then-enable-overriden-ua-expected.txt
@@ -2,31 +2,31 @@
 
 Before disable
 [expanded] 
-element.style  { ()
+element.style { ()
     margin: 10px;
 
 [expanded] 
-body  { (user agent stylesheet)
+body { (user agent stylesheet)
     display: block;
 /-- overloaded --/     margin: 8px;
 
 After disable
 [expanded] 
-element.style  { ()
+element.style { ()
 /-- overloaded --/ /-- disabled --/     /* margin: 10px; */
 
 [expanded] 
-body  { (user agent stylesheet)
+body { (user agent stylesheet)
     display: block;
     margin: 8px;
 
 After enable
 [expanded] 
-element.style  { ()
+element.style { ()
     margin: 10px;
 
 [expanded] 
-body  { (user agent stylesheet)
+body { (user agent stylesheet)
     display: block;
 /-- overloaded --/     margin: 8px;
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-edit-property-after-invalid-rule-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-edit-property-after-invalid-rule-expected.txt
index 30280b5a..e3cc99f 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-edit-property-after-invalid-rule-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-edit-property-after-invalid-rule-expected.txt
@@ -2,28 +2,26 @@
 
 Initial value
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-media="screen" (styles-edit-property-after-invalid-rule.html)
-#container  { (styles-edit-pro…d-rule.html:10 -> styles-edit-property-after-invalid-rule.html:10:1)
+#container { (styles-edit-pro…d-rule.html:10 -> styles-edit-property-after-invalid-rule.html:10:1)
     padding: 15px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 After changing property
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-media="screen" (styles-edit-property-after-invalid-rule.html)
-#container  { (styles-edit-pro…d-rule.html:10 -> styles-edit-property-after-invalid-rule.html:10:1)
+#container { (styles-edit-pro…d-rule.html:10 -> styles-edit-property-after-invalid-rule.html:10:1)
     padding: 20px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-iframe-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-iframe-expected.txt
index 9846f36c..9db05c5 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-iframe-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-iframe-expected.txt
@@ -4,28 +4,26 @@
 
 Main frame style:
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-media="screen" (styles-iframe.html)
-#main  { (styles-iframe.html:2 -> styles-iframe.html:2:3)
+#main { (styles-iframe.html:2 -> styles-iframe.html:2:3)
     background: blue;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 iframe style:
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-media="screen" (styles-iframe-data.html)
-body  { (styles-iframe-data.html:4 -> styles-iframe-data.html:4:3)
+body { (styles-iframe-data.html:4 -> styles-iframe-data.html:4:3)
     background: green;
 
 [expanded] 
-body  { (user agent stylesheet)
+body { (user agent stylesheet)
     display: block;
     margin: 8px;
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-overriden-properties-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-overriden-properties-expected.txt
index 594f8dc..bf7c0d8 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-overriden-properties-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-overriden-properties-expected.txt
@@ -1,15 +1,15 @@
 Tests that overriding shorthands within rule are visible.
 
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#main  { (styles-override…perties.html:4 -> styles-overriden-properties.html:4:1)
+#main { (styles-override…perties.html:4 -> styles-overriden-properties.html:4:1)
 /-- overloaded --/     background: #000;
     background: #bada55;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-properties-overload-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-properties-overload-expected.txt
index d468cb3..c6ba76b 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-properties-overload-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-properties-overload-expected.txt
@@ -2,10 +2,10 @@
 
 Text.
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspect  { (styles-properti…erload.html:11 -> styles-properties-overload.html:11:1)
+#inspect { (styles-properti…erload.html:11 -> styles-properties-overload.html:11:1)
     margin-top: 1px;
     margin-left: 1px;
     margin-right: 1px;
@@ -20,7 +20,7 @@
         font-family: Arial;
 
 [expanded] 
-div  { (styles-properti…verload.html:6 -> styles-properties-overload.html:6:1)
+div { (styles-properti…verload.html:6 -> styles-properties-overload.html:6:1)
 /-- overloaded --/     margin: 1px;
     /-- overloaded --/     margin-top: 1px;
     /-- overloaded --/     margin-right: 1px;
@@ -41,12 +41,12 @@
         border-left-width: 1px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 ======== Inherited from div.container ========
 [expanded] 
-.container  { (styles-properti…erload.html:19 -> styles-properties-overload.html:19:1)
+.container { (styles-properti…erload.html:19 -> styles-properties-overload.html:19:1)
 /-- overloaded --/     font-size: 10px;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-source-lines-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-source-lines-expected.txt
index 9a3722e0..49abce2 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-source-lines-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-source-lines-expected.txt
@@ -1,33 +1,29 @@
 Tests that proper source lines are reported for the parsed styles.
 
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-media="screen" (styles-source-lines.html)
-#main, .at_line_49  { (styles-source-lines.html:49 -> styles-source-lines.html:49:1)
+#main, .at_line_49 { (styles-source-lines.html:49 -> styles-source-lines.html:49:1)
     border: 1px solid
     red;
 
 [expanded] 
-media="screen" (styles-source-lines.html)
-#main, .at_line_41  { (styles-source-lines.html:40 -> styles-source-lines.html:40:3)
+#main, .at_line_41 { (styles-source-lines.html:40 -> styles-source-lines.html:40:3)
     font-size: 10px;
 
 [expanded] 
-media="screen" (styles-source-lines.html)
-#main, .at_line_26  { (styles-source-lines.html:26 -> styles-source-lines.html:26:1)
+#main, .at_line_26 { (styles-source-lines.html:26 -> styles-source-lines.html:26:1)
     font-family: /*  Comment in 
                       value  */courier;
 
 [expanded] 
-media="screen" (styles-source-lines.html)
-#main, .at_line_11::before  { (styles-source-lines.html:11 -> styles-source-lines.html:11:1)
+#main, .at_line_11::before { (styles-source-lines.html:11 -> styles-source-lines.html:11:1)
     color: red;
     content: "Before";
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-source-lines-inline-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-source-lines-inline-expected.txt
index c0532ea..d38b30b 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-source-lines-inline-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-source-lines-inline-expected.txt
@@ -2,15 +2,15 @@
 
 
 [expanded] 
-element.style  { ()
+element.style { ()
     display: none;
 
 [expanded] 
-.foo  { (styles-source-l…-inline.html:7 -> styles-source-lines-inline.html:7:1)
+.foo { (styles-source-l…-inline.html:7 -> styles-source-lines-inline.html:7:1)
     color: blue;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
 /-- overloaded --/     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-source-lines-recovery-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-source-lines-recovery-expected.txt
index d7c4e2b..f12ac1d 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-source-lines-recovery-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-source-lines-recovery-expected.txt
@@ -1,22 +1,22 @@
 Tests that invalid rule inside @-rule doesn't break source code matching (http://crbug.com/317499).
 
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#main  { (styles-source-l…covery.html:25 -> styles-source-lines-recovery.html:25:1)
+#main { (styles-source-l…covery.html:25 -> styles-source-lines-recovery.html:25:1)
     color: white;
 
 [expanded] 
-#main  { (styles-source-l…covery.html:16 -> styles-source-lines-recovery.html:16:1)
+#main { (styles-source-l…covery.html:16 -> styles-source-lines-recovery.html:16:1)
 /-- overloaded --/     color: blue;
 
 [expanded] 
-#main  { (styles-source-l…ecovery.html:7 -> styles-source-lines-recovery.html:7:1)
+#main { (styles-source-l…ecovery.html:7 -> styles-source-lines-recovery.html:7:1)
 /-- overloaded --/     color: red;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-update-from-js-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-update-from-js-expected.txt
index b33f551..63e9447 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-update-from-js-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-update-from-js-expected.txt
@@ -6,7 +6,7 @@
 Running: testSetStyleAttribute
 <div id="container" style="color: #daC0DE; border: 1px solid black;">…</div>
 [expanded] 
-element.style  { ()
+element.style { ()
     color: #daC0DE;
     border: 1px solid black;
         border-top-color: black;
@@ -23,25 +23,25 @@
         border-left-width: 1px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
 Running: testSetStyleCSSText
 <div id="container" style="color: rgb(192, 255, 238);">…</div>
 [expanded] 
-element.style  { ()
+element.style { ()
     color: rgb(192, 255, 238);
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
 Running: testSetViaParsedAttributes
 <div id="container" style="color: rgb(192, 255, 238); border: 3px dashed green;">…</div>
 [expanded] 
-element.style  { ()
+element.style { ()
     color: rgb(192, 255, 238);
     border: 3px dashed green;
         border-top-color: green;
@@ -58,45 +58,45 @@
         border-left-width: 3px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
 Running: testSetViaAncestorClass
 <div id="child"></div>
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.red div:first-child  { (styles-update-from-js.html:4 -> styles-update-from-js.html:4:1)
+.red div:first-child { (styles-update-from-js.html:4 -> styles-update-from-js.html:4:1)
     background-color: red;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 ======== Inherited from div#container.red ========
 [expanded] 
-Style Attribute  { ()
+Style Attribute { ()
     color: rgb(192, 255, 238);
 
 
 Running: testSetViaSiblingAttr
 <div id="childSibling"></div>
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-div[foo="bar"] + div  { (styles-update-from-js.html:8 -> styles-update-from-js.html:8:1)
+div[foo="bar"] + div { (styles-update-from-js.html:8 -> styles-update-from-js.html:8:1)
     background-color: blue;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 ======== Inherited from div#container.red ========
 [expanded] 
-Style Attribute  { ()
+Style Attribute { ()
     color: rgb(192, 255, 238);
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-update-links-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-update-links-expected.txt
index f171ecb7..6eac6cb 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-update-links-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-update-links-expected.txt
@@ -6,40 +6,40 @@
 
 Running: testInsertProperty
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-@media (min-device-width: 1px) (styles-update-links.css:10 -> styles-update-links.css:10:8)
-.should-change  { (styles-update-links.css:11 -> styles-update-links.css:11:5)
+@media (min-device-width: 1px)
+.should-change { (styles-update-links.css:11 -> styles-update-links.css:11:5)
     font-family: monospace;
 
 [expanded] 
-.should-change  { (styles-update-links.css:7 -> styles-update-links.css:7:63)
+.should-change { (styles-update-links.css:7 -> styles-update-links.css:7:63)
     position: relative;
     margin: 1em;
 
 [expanded] 
-.should-change  { (styles-update-links.css:7 -> styles-update-links.css:7:19)
+.should-change { (styles-update-links.css:7 -> styles-update-links.css:7:19)
     border: 1px solid black;
 
 [expanded] 
-.should-change  { (styles-update-links.css:6 -> styles-update-links.css:6:3)
+.should-change { (styles-update-links.css:6 -> styles-update-links.css:6:3)
     color: red;
 
 [expanded] 
-.left-intact  { (styles-update-links.css:4 -> styles-update-links.css:4:1)
+.left-intact { (styles-update-links.css:4 -> styles-update-links.css:4:1)
     padding: 1em;
 
 [expanded] 
-.left-intact  { (styles-update-links.css:1 -> styles-update-links.css:1:1)
+.left-intact { (styles-update-links.css:1 -> styles-update-links.css:1:1)
     box-sizing: border-box;
 
 [expanded] 
-.left-intact  { (styles-update-links-2.css:19 -> styles-update-links-2.css:19:1)
+.left-intact { (styles-update-links-2.css:19 -> styles-update-links-2.css:19:1)
     line-height: 1;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
@@ -48,41 +48,41 @@
 
 
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-@media (min-device-width: 1px) (styles-update-links.css:12 -> styles-update-links.css:12:8)
-.should-change  { (styles-update-links.css:13 -> styles-update-links.css:13:5)
+@media (min-device-width: 1px)
+.should-change { (styles-update-links.css:13 -> styles-update-links.css:13:5)
     font-family: monospace;
 
 [expanded] 
-.should-change  { (styles-update-links.css:9 -> styles-update-links.css:9:51)
+.should-change { (styles-update-links.css:9 -> styles-update-links.css:9:51)
     position: relative;
     margin: 1em;
 
 [expanded] 
-.should-change  { (styles-update-links.css:9 -> styles-update-links.css:9:7)
+.should-change { (styles-update-links.css:9 -> styles-update-links.css:9:7)
     border: 1px solid black;
 
 [expanded] 
-.should-change  { (styles-update-links.css:6 -> styles-update-links.css:6:3)
+.should-change { (styles-update-links.css:6 -> styles-update-links.css:6:3)
     color: red;
 /-- overloaded --/     PROPERTY: INSERTED;
 
 [expanded] 
-.left-intact  { (styles-update-links.css:4 -> styles-update-links.css:4:1)
+.left-intact { (styles-update-links.css:4 -> styles-update-links.css:4:1)
     padding: 1em;
 
 [expanded] 
-.left-intact  { (styles-update-links.css:1 -> styles-update-links.css:1:1)
+.left-intact { (styles-update-links.css:1 -> styles-update-links.css:1:1)
     box-sizing: border-box;
 
 [expanded] 
-.left-intact  { (styles-update-links-2.css:19 -> styles-update-links-2.css:19:1)
+.left-intact { (styles-update-links-2.css:19 -> styles-update-links-2.css:19:1)
     line-height: 1;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 4 rule ranges are equal.
@@ -101,41 +101,41 @@
 
 
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-@media (min-device-width: 1px) (styles-update-links.css:12 -> styles-update-links.css:12:8)
-.should-change  { (styles-update-links.css:13 -> styles-update-links.css:13:5)
+@media (min-device-width: 1px)
+.should-change { (styles-update-links.css:13 -> styles-update-links.css:13:5)
     font-family: monospace;
 
 [expanded] 
-.should-change  { (styles-update-links.css:9 -> styles-update-links.css:9:77)
+.should-change { (styles-update-links.css:9 -> styles-update-links.css:9:77)
     position: relative;
     margin: 1em;
 
 [expanded] 
-.should-change, .INSERTED-OTHER-SELECTOR  { (styles-update-links.css:9 -> styles-update-links.css:9:7)
+.should-change, .INSERTED-OTHER-SELECTOR { (styles-update-links.css:9 -> styles-update-links.css:9:7)
     border: 1px solid black;
 
 [expanded] 
-.should-change  { (styles-update-links.css:6 -> styles-update-links.css:6:3)
+.should-change { (styles-update-links.css:6 -> styles-update-links.css:6:3)
     color: red;
 /-- overloaded --/     PROPERTY: INSERTED;
 
 [expanded] 
-.left-intact  { (styles-update-links.css:4 -> styles-update-links.css:4:1)
+.left-intact { (styles-update-links.css:4 -> styles-update-links.css:4:1)
     padding: 1em;
 
 [expanded] 
-.left-intact  { (styles-update-links.css:1 -> styles-update-links.css:1:1)
+.left-intact { (styles-update-links.css:1 -> styles-update-links.css:1:1)
     box-sizing: border-box;
 
 [expanded] 
-.left-intact  { (styles-update-links-2.css:19 -> styles-update-links-2.css:19:1)
+.left-intact { (styles-update-links-2.css:19 -> styles-update-links-2.css:19:1)
     line-height: 1;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 4 rule ranges are equal.
@@ -154,41 +154,41 @@
 
 
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-@media (min-device-width: 1px) (styles-update-links.css:12 -> styles-update-links.css:12:8)
-.should-change  { (styles-update-links.css:13 -> styles-update-links.css:13:5)
+@media (min-device-width: 1px)
+.should-change { (styles-update-links.css:13 -> styles-update-links.css:13:5)
     font-family: monospace;
 
 [expanded] 
-.should-change  { (styles-update-links.css:9 -> styles-update-links.css:9:81)
+.should-change { (styles-update-links.css:9 -> styles-update-links.css:9:81)
     position: relative;
     margin: 1em;
 
 [expanded] 
-.should-change, .INSERTED-OTHER-SELECTOR  { (styles-update-links.css:9 -> styles-update-links.css:9:7)
+.should-change, .INSERTED-OTHER-SELECTOR { (styles-update-links.css:9 -> styles-update-links.css:9:7)
 /-- overloaded --/ /-- disabled --/     /* border: 1px solid black; */
 
 [expanded] 
-.should-change  { (styles-update-links.css:6 -> styles-update-links.css:6:3)
+.should-change { (styles-update-links.css:6 -> styles-update-links.css:6:3)
     color: red;
 /-- overloaded --/     PROPERTY: INSERTED;
 
 [expanded] 
-.left-intact  { (styles-update-links.css:4 -> styles-update-links.css:4:1)
+.left-intact { (styles-update-links.css:4 -> styles-update-links.css:4:1)
     padding: 1em;
 
 [expanded] 
-.left-intact  { (styles-update-links.css:1 -> styles-update-links.css:1:1)
+.left-intact { (styles-update-links.css:1 -> styles-update-links.css:1:1)
     box-sizing: border-box;
 
 [expanded] 
-.left-intact  { (styles-update-links-2.css:19 -> styles-update-links-2.css:19:1)
+.left-intact { (styles-update-links-2.css:19 -> styles-update-links-2.css:19:1)
     line-height: 1;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 4 rule ranges are equal.
@@ -209,24 +209,24 @@
 
 
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-article, aside, footer, header, hgroup, main, nav, section  { (user agent stylesheet)
+article, aside, footer, header, hgroup, main, nav, section { (user agent stylesheet)
     display: block;
 
 ======== Pseudo ::before element ========
 [expanded] 
-#pseudo::before  { (styles-update-links.html:16 -> styles-update-links.html:16:1)
+#pseudo::before { (styles-update-links.html:16 -> styles-update-links.html:16:1)
     color: blue;
 
 ======== Pseudo ::after element ========
 [expanded] 
-#pseudo::after  { (styles-update-links.html:12 -> styles-update-links.html:12:1)
+#pseudo::after { (styles-update-links.html:12 -> styles-update-links.html:12:1)
     border: 1px solid black;
 
 [expanded] 
-#pseudo::after  { (styles-update-links.html:6 -> styles-update-links.html:6:1)
+#pseudo::after { (styles-update-links.html:6 -> styles-update-links.html:6:1)
 /-- overloaded --/     pseudo-property: "12";
 /-- overloaded --/     PROPERTY: INSERTED;
     color: red;
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-with-spaces-in-sourceURL-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-with-spaces-in-sourceURL-expected.txt
index cb598376..9b0535d 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-with-spaces-in-sourceURL-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/styles-with-spaces-in-sourceURL-expected.txt
@@ -1,14 +1,14 @@
 Verifies that links for URLs with spaces displayed properly for matched styles.
 
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected  { (style.css:1 -> style.css:1:1)
+#inspected { (style.css:1 -> style.css:1:1)
     background-color: blue;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/svg-style-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/svg-style-expected.txt
index 921b256..39f37888 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/svg-style-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/svg-style-expected.txt
@@ -2,18 +2,17 @@
 
  Main style:
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-media="all" (svg-style.xhtml)
-rect  { (svg-style.xhtml:38 -> svg-style.xhtml:38:10)
+rect { (svg-style.xhtml:38 -> svg-style.xhtml:38:10)
     fill: red;
 
 [expanded] 
-svg:rect[Attributes Style]  { ()
+svg:rect[Attributes Style] { ()
 
 [expanded] 
-*  { (user agent stylesheet)
+* { (user agent stylesheet)
     transform-origin: 0px 0px 0px;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/undo-add-new-rule-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/undo-add-new-rule-expected.txt
index d00eab0..4637466 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/undo-add-new-rule-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/undo-add-new-rule-expected.txt
@@ -3,17 +3,17 @@
 Text
 After adding new rule:
 [expanded] 
-element.style  { ()
+element.style { ()
     font-size: 12px;
 
 [expanded] 
-div.foo  { (inspector-stylesheet:3 -> inspector-stylesheet:3:1)
+div.foo { (inspector-stylesheet:3 -> inspector-stylesheet:3:1)
 
 [expanded] 
-div.foo  { (inspector-stylesheet:1 -> inspector-stylesheet:1:1)
+div.foo { (inspector-stylesheet:1 -> inspector-stylesheet:1:1)
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 ===== Style sheet text: =====
@@ -23,14 +23,14 @@
 =============================
 After undo:
 [expanded] 
-element.style  { ()
+element.style { ()
     color: red;
 
 [expanded] 
-div.foo  { (inspector-stylesheet:1 -> inspector-stylesheet:1:1)
+div.foo { (inspector-stylesheet:1 -> inspector-stylesheet:1:1)
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 ===== Style sheet text: =====
@@ -38,17 +38,17 @@
 =============================
 After redo:
 [expanded] 
-element.style  { ()
+element.style { ()
     font-size: 12px;
 
 [expanded] 
-div.foo  { (inspector-stylesheet:3 -> inspector-stylesheet:3:1)
+div.foo { (inspector-stylesheet:3 -> inspector-stylesheet:3:1)
 
 [expanded] 
-div.foo  { (inspector-stylesheet:1 -> inspector-stylesheet:1:1)
+div.foo { (inspector-stylesheet:1 -> inspector-stylesheet:1:1)
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 ===== Style sheet text: =====
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/undo-add-property-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/undo-add-property-expected.txt
index 6cf8449..5d7958d0 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles-4/undo-add-property-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles-4/undo-add-property-expected.txt
@@ -3,166 +3,166 @@
 === Last property ===
 (Initial value)
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.container  { (undo-add-property.html:7 -> undo-add-property.html:7:1)
+.container { (undo-add-property.html:7 -> undo-add-property.html:7:1)
     font-weight: bold;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 (After adding property)
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.container  { (undo-add-property.html:7 -> undo-add-property.html:7:1)
+.container { (undo-add-property.html:7 -> undo-add-property.html:7:1)
     font-weight: bold;
     margin-left: 2px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 (After undo)
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.container  { (undo-add-property.html:7 -> undo-add-property.html:7:1)
+.container { (undo-add-property.html:7 -> undo-add-property.html:7:1)
     font-weight: bold;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 (After redo)
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.container  { (undo-add-property.html:7 -> undo-add-property.html:7:1)
+.container { (undo-add-property.html:7 -> undo-add-property.html:7:1)
     font-weight: bold;
     margin-left: 2px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 === First property ===
 (Initial value)
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.container  { (undo-add-property.html:7 -> undo-add-property.html:7:1)
+.container { (undo-add-property.html:7 -> undo-add-property.html:7:1)
     font-weight: bold;
     margin-left: 2px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 (After adding property)
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.container  { (undo-add-property.html:7 -> undo-add-property.html:7:1)
+.container { (undo-add-property.html:7 -> undo-add-property.html:7:1)
     margin-top: 0px;
     font-weight: bold;
     margin-left: 2px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 (After undo)
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.container  { (undo-add-property.html:7 -> undo-add-property.html:7:1)
+.container { (undo-add-property.html:7 -> undo-add-property.html:7:1)
     font-weight: bold;
     margin-left: 2px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 (After redo)
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.container  { (undo-add-property.html:7 -> undo-add-property.html:7:1)
+.container { (undo-add-property.html:7 -> undo-add-property.html:7:1)
     margin-top: 0px;
     font-weight: bold;
     margin-left: 2px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 === Middle property ===
 (Initial value)
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.container  { (undo-add-property.html:7 -> undo-add-property.html:7:1)
+.container { (undo-add-property.html:7 -> undo-add-property.html:7:1)
     margin-top: 0px;
     font-weight: bold;
     margin-left: 2px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 (After adding property)
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.container  { (undo-add-property.html:7 -> undo-add-property.html:7:1)
+.container { (undo-add-property.html:7 -> undo-add-property.html:7:1)
     margin-top: 0px;
     margin-right: 1px;
     font-weight: bold;
     margin-left: 2px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 (After undo)
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.container  { (undo-add-property.html:7 -> undo-add-property.html:7:1)
+.container { (undo-add-property.html:7 -> undo-add-property.html:7:1)
     margin-top: 0px;
     font-weight: bold;
     margin-left: 2px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 (After redo)
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.container  { (undo-add-property.html:7 -> undo-add-property.html:7:1)
+.container { (undo-add-property.html:7 -> undo-add-property.html:7:1)
     margin-top: 0px;
     margin-right: 1px;
     font-weight: bold;
     margin-left: 2px;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles/cancel-upon-invalid-property-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles/cancel-upon-invalid-property-expected.txt
index 40106b45..6ba1027 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles/cancel-upon-invalid-property-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles/cancel-upon-invalid-property-expected.txt
@@ -2,26 +2,26 @@
 
 Text
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected  { (cancel-upon-inv…roperty.html:6 -> cancel-upon-invalid-property.html:6:1)
+#inspected { (cancel-upon-inv…roperty.html:6 -> cancel-upon-invalid-property.html:6:1)
     color: blue;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected  { (cancel-upon-inv…roperty.html:6 -> cancel-upon-invalid-property.html:6:1)
+#inspected { (cancel-upon-inv…roperty.html:6 -> cancel-upon-invalid-property.html:6:1)
     color: blue;
     : ;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles/undo-after-cancelled-editing-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles/undo-after-cancelled-editing-expected.txt
index c2450fb..15a23644 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles/undo-after-cancelled-editing-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles/undo-after-cancelled-editing-expected.txt
@@ -8,15 +8,15 @@
 
 Running: editProperty
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected  { (undo-after-canc…editing.html:6 -> undo-after-cancelled-editing.html:6:1)
+#inspected { (undo-after-canc…editing.html:6 -> undo-after-cancelled-editing.html:6:1)
     color: blue;
     : ;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
@@ -24,26 +24,26 @@
 
 Running: undoStyles
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected  { (undo-after-canc…editing.html:6 -> undo-after-cancelled-editing.html:6:1)
+#inspected { (undo-after-canc…editing.html:6 -> undo-after-cancelled-editing.html:6:1)
     color: blue;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
 Running: onUndoedProperty
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected  { (undo-after-canc…editing.html:6 -> undo-after-cancelled-editing.html:6:1)
+#inspected { (undo-after-canc…editing.html:6 -> undo-after-cancelled-editing.html:6:1)
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles/undo-change-property-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles/undo-change-property-expected.txt
index 3509fd3c..e298b17 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles/undo-change-property-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles/undo-change-property-expected.txt
@@ -2,50 +2,50 @@
 
 Initial value
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.container  { (undo-change-property.html:7 -> undo-change-property.html:7:1)
+.container { (undo-change-property.html:7 -> undo-change-property.html:7:1)
     font-weight: bold;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 After changing property
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.container  { (undo-change-property.html:7 -> undo-change-property.html:7:1)
+.container { (undo-change-property.html:7 -> undo-change-property.html:7:1)
     font-weight: normal;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 After undo
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.container  { (undo-change-property.html:7 -> undo-change-property.html:7:1)
+.container { (undo-change-property.html:7 -> undo-change-property.html:7:1)
     font-weight: bold;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 After redo
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-.container  { (undo-change-property.html:7 -> undo-change-property.html:7:1)
+.container { (undo-change-property.html:7 -> undo-change-property.html:7:1)
     font-weight: normal;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/inspector/elements/styles/undo-set-selector-text-expected.txt b/third_party/WebKit/LayoutTests/inspector/elements/styles/undo-set-selector-text-expected.txt
index 35e3346..098017d 100644
--- a/third_party/WebKit/LayoutTests/inspector/elements/styles/undo-set-selector-text-expected.txt
+++ b/third_party/WebKit/LayoutTests/inspector/elements/styles/undo-set-selector-text-expected.txt
@@ -2,50 +2,50 @@
 
 === Before selector modification ===
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected  { (undo-set-selector-text.html:4 -> undo-set-selector-text.html:4:1)
+#inspected { (undo-set-selector-text.html:4 -> undo-set-selector-text.html:4:1)
     color: green;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 === After selector modification ===
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected, #other  { (undo-set-selector-text.html:4 -> undo-set-selector-text.html:4:13)
+#inspected, #other { (undo-set-selector-text.html:4 -> undo-set-selector-text.html:4:13)
     color: green;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 === After undo ===
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected  { (undo-set-selector-text.html:4 -> undo-set-selector-text.html:4:1)
+#inspected { (undo-set-selector-text.html:4 -> undo-set-selector-text.html:4:1)
     color: green;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 === After redo ===
 [expanded] 
-element.style  { ()
+element.style { ()
 
 [expanded] 
-#inspected, #other  { (undo-set-selector-text.html:4 -> undo-set-selector-text.html:4:13)
+#inspected, #other { (undo-set-selector-text.html:4 -> undo-set-selector-text.html:4:13)
     color: green;
 
 [expanded] 
-div  { (user agent stylesheet)
+div { (user agent stylesheet)
     display: block;
 
 
diff --git a/third_party/WebKit/LayoutTests/platform/win/paint/invalidation/invalidate-after-composited-scroll-expected.txt b/third_party/WebKit/LayoutTests/paint/invalidation/invalidate-after-composited-scroll-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/paint/invalidation/invalidate-after-composited-scroll-expected.txt
rename to third_party/WebKit/LayoutTests/paint/invalidation/invalidate-after-composited-scroll-expected.txt
diff --git a/third_party/WebKit/LayoutTests/platform/linux/compositing/squashing/iframe-inside-squashed-layer-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/compositing/squashing/iframe-inside-squashed-layer-expected.txt
index 51ad163..66fecc6 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/compositing/squashing/iframe-inside-squashed-layer-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/compositing/squashing/iframe-inside-squashed-layer-expected.txt
@@ -21,9 +21,6 @@
               "bounds": [300, 654],
               "drawsContent": true,
               "repaintRects": [
-                [285, 515, 15, 135],
-                [285, 500, 15, 150],
-                [285, 500, 15, 150],
                 [285, 500, 15, 150],
                 [8, 508, 284, 20],
                 [8, 508, 269, 142],
@@ -31,30 +28,19 @@
                 [0, 500, 300, 36],
                 [0, 500, 285, 150],
                 [0, 500, 285, 150],
-                [0, 500, 285, 150],
-                [0, 500, 15, 15],
-                [0, 500, 15, 15]
+                [0, 500, 285, 150]
               ],
               "paintInvalidationClients": [
                 "RootInlineBox",
                 "InlineTextBox 'test1'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
-                "LayoutIFrame IFRAME id='subframe'",
                 "RootInlineBox",
                 "InlineTextBox 'test1'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
                 "LayoutView #document",
                 "LayoutView #document",
                 "LayoutBlockFlow HTML",
-                "LayoutBlockFlow BODY"
+                "LayoutBlockFlow BODY",
+                "VerticalScrollbar",
+                "LayoutView #document"
               ]
             }
           ]
diff --git a/third_party/WebKit/LayoutTests/platform/linux/css2.1/t0505-c16-descendant-01-e-expected.png b/third_party/WebKit/LayoutTests/platform/linux/css2.1/t0505-c16-descendant-01-e-expected.png
index a646c53..7327fdc 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/css2.1/t0505-c16-descendant-01-e-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/linux/css2.1/t0505-c16-descendant-01-e-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/css2.1/t0505-c16-descendant-01-e-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/css2.1/t0505-c16-descendant-01-e-expected.txt
index 8517979..1cc121b 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/css2.1/t0505-c16-descendant-01-e-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/css2.1/t0505-c16-descendant-01-e-expected.txt
@@ -10,8 +10,7 @@
       LayoutBlockFlow {UL} at (0,36) size 784x20 [color=#008000]
         LayoutListItem {LI} at (40,0) size 744x20
           LayoutListMarker (anonymous) at (-18,0) size 7x19: bullet
-          LayoutInline {SPAN} at (0,0) size 4x19 [color=#FF0000]
-            LayoutText {#text} at (0,0) size 4x19
-              text run at (0,0) width 4: " "
-          LayoutText {#text} at (4,0) size 152x19
-            text run at (4,0) width 152: "This line should be green."
+          LayoutInline {SPAN} at (0,0) size 0x0 [color=#FF0000]
+            LayoutText {#text} at (0,0) size 0x0
+          LayoutText {#text} at (0,0) size 152x19
+            text run at (0,0) width 152: "This line should be green."
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/box-shadow/inset-subpixel-expected.png b/third_party/WebKit/LayoutTests/platform/linux/fast/box-shadow/inset-subpixel-expected.png
new file mode 100644
index 0000000..9498fea
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/box-shadow/inset-subpixel-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/box-shadow/inset-subpixel-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/box-shadow/inset-subpixel-expected.txt
new file mode 100644
index 0000000..a4860e48
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/box-shadow/inset-subpixel-expected.txt
@@ -0,0 +1,42 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  LayoutBlockFlow {HTML} at (0,0) size 800x600
+    LayoutBlockFlow {BODY} at (8,8) size 784x584
+      LayoutBlockFlow {DIV} at (0,0) size 784x125
+        LayoutBlockFlow {DIV} at (10,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (120,105) size 4x19
+          text run at (120,105) width 4: " "
+        LayoutBlockFlow {DIV} at (134,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (244,105) size 4x19
+          text run at (244,105) width 4: " "
+        LayoutBlockFlow {DIV} at (258,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (368,105) size 4x19
+          text run at (368,105) width 4: " "
+        LayoutBlockFlow {DIV} at (382,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (492,105) size 4x19
+          text run at (492,105) width 4: " "
+        LayoutBlockFlow {DIV} at (506,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (0,0) size 0x0
+      LayoutBlockFlow {DIV} at (0,125) size 784x125
+        LayoutBlockFlow {DIV} at (10,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (120,105) size 4x19
+          text run at (120,105) width 4: " "
+        LayoutBlockFlow {DIV} at (134,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (244,105) size 4x19
+          text run at (244,105) width 4: " "
+        LayoutBlockFlow {DIV} at (258,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (368,105) size 4x19
+          text run at (368,105) width 4: " "
+        LayoutBlockFlow {DIV} at (382,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (492,105) size 4x19
+          text run at (492,105) width 4: " "
+        LayoutBlockFlow {DIV} at (506,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px dashed #008000)]
+        LayoutText {#text} at (0,0) size 0x0
+      LayoutBlockFlow {DIV} at (0,250) size 600x324
+        LayoutInline {SPAN} at (0,0) size 586x307 [bgcolor=#FFFFE0] [border: (5px solid #008000)]
+          LayoutText {#text} at (27,13) size 566x297
+            text run at (27,13) width 566: "This sentence is too"
+            text run at (90,121) width 420: "long to fit on a"
+            text run at (133,229) width 314: "single line."
+        LayoutText {#text} at (0,0) size 0x0
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/details-open-repaint-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/details-open-repaint-expected.txt
index c2879d56..93de88a 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/details-open-repaint-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/details-open-repaint-expected.txt
@@ -16,6 +16,9 @@
         "LayoutBlockFlow DIV id='details-content'",
         "LayoutTextControl INPUT",
         "LayoutBlockFlow DIV id='inner-editor'",
+        "HorizontalScrollbar",
+        "VerticalScrollbar",
+        "LayoutBlockFlow DIV id='inner-editor'",
         "LayoutText #text",
         "LayoutText #text"
       ]
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/line-flow-with-floats-2-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/line-flow-with-floats-2-expected.txt
index bc9b109..a40321a 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/line-flow-with-floats-2-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/line-flow-with-floats-2-expected.txt
@@ -41,8 +41,6 @@
         "InlineTextBox ''",
         "InlineTextBox ' twist itself round and look up in her'",
         "RootInlineBox",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow P",
         "LayoutBlockFlow P",
@@ -106,7 +104,8 @@
         "InlineTextBox 'minute, \u2018and then,\u2019 thought she, \u2018what would become of\n'",
         "InlineTextBox 'me?'",
         "InlineTextBox 'They\u2019re dreadfully fond of beheading people here; the great'",
-        "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'"
+        "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'",
+        "VerticalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/line-flow-with-floats-8-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/line-flow-with-floats-8-expected.txt
index d13d981c..cf8a89ee 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/line-flow-with-floats-8-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/line-flow-with-floats-8-expected.txt
@@ -88,8 +88,6 @@
         "RootInlineBox",
         "InlineTextBox 'once in a minute.\n'",
         "RootInlineBox",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow P",
         "LayoutBlockFlow P",
@@ -118,7 +116,8 @@
         "InlineTextBox 'minute, \u2018and then,\u2019 thought she, \u2018what would become of\n'",
         "InlineTextBox 'me?'",
         "InlineTextBox 'They\u2019re dreadfully fond of beheading people here; the great'",
-        "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'"
+        "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'",
+        "VerticalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/overflow-scroll-body-appear-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/overflow-scroll-body-appear-expected.txt
index 38ec21f5..72c6d6b 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/overflow-scroll-body-appear-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/overflow-scroll-body-appear-expected.txt
@@ -6,6 +6,7 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
+        [785, 585, 15, 15],
         [8, 52, 784, 20],
         [8, 52, 769, 20],
         [8, 16, 2000, 2072],
@@ -15,9 +16,6 @@
         [0, 0, 785, 585]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "VerticalScrollbar",
         "RootInlineBox",
         "InlineTextBox 'You should see both vertical and horizontal scrollbars.'",
         "RootInlineBox",
@@ -28,7 +26,9 @@
         "LayoutView #document",
         "LayoutBlockFlow BODY",
         "LayoutBlockFlow P",
-        "LayoutBlockFlow P"
+        "LayoutBlockFlow P",
+        "HorizontalScrollbar",
+        "VerticalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/repaint-during-scroll-with-zoom-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
index 059f5b1..e7afc173 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
@@ -17,16 +17,14 @@
         [2, 64, 52, 18]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
-        "LayoutIFrame (positioned) IFRAME",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME",
         "LayoutIFrame (positioned) IFRAME",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow BODY",
         "LayoutText #text",
-        "InlineTextBox 'scroll me'"
+        "InlineTextBox 'scroll me'",
+        "HorizontalScrollbar",
+        "VerticalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/resize-scrollable-iframe-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/resize-scrollable-iframe-expected.txt
index a44898b..3949115 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/resize-scrollable-iframe-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/resize-scrollable-iframe-expected.txt
@@ -6,15 +6,13 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
-        [293, 108, 15, 285],
-        [293, 108, 15, 285],
+        [293, 393, 15, 15],
         [293, 108, 15, 285],
         [108, 108, 200, 300],
+        [93, 193, 15, 15],
         [93, 108, 200, 285],
         [93, 108, 15, 85],
         [8, 393, 285, 15],
-        [8, 393, 285, 15],
-        [8, 393, 285, 15],
         [8, 213, 784, 200],
         [8, 208, 300, 200],
         [8, 193, 285, 200],
@@ -25,26 +23,13 @@
       "paintInvalidationClients": [
         "InlineBox",
         "RootInlineBox",
-        "HorizontalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "HorizontalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "HorizontalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "HorizontalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
         "LayoutBlockFlow (anonymous)",
         "LayoutBlockFlow (anonymous)",
         "LayoutIFrame IFRAME id='iframe'",
         "LayoutView #document",
+        "LayoutView #document",
+        "HorizontalScrollbar",
+        "VerticalScrollbar",
         "LayoutView #document"
       ]
     }
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/shift-relative-positioned-container-with-image-addition-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/shift-relative-positioned-container-with-image-addition-expected.txt
index 51655b8c..7492bce2 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/shift-relative-positioned-container-with-image-addition-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/shift-relative-positioned-container-with-image-addition-expected.txt
@@ -6,7 +6,6 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
-        [723, 94, 15, 90],
         [58, 236, 489, 537],
         [58, 142, 489, 537],
         [18, 102, 712, 74],
@@ -23,7 +22,7 @@
         [0, 0, 785, 742]
       ],
       "paintInvalidationClients": [
-        "LayoutIFrame IFRAME id='iframe'",
+        "VerticalScrollbar",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
         "LayoutIFrame IFRAME id='iframe'",
@@ -31,6 +30,7 @@
         "LayoutView #document",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow BODY",
+        "LayoutView #document",
         "LayoutBlockFlow (relative positioned) DIV class='relative'",
         "LayoutBlockFlow (relative positioned) DIV class='relative paddingTop'",
         "LayoutImage IMG",
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/text-match-document-change-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/text-match-document-change-expected.txt
index 3499411..d04013d 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/text-match-document-change-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/text-match-document-change-expected.txt
@@ -7,7 +7,6 @@
       "drawsContent": true,
       "repaintRects": [
         [295, 102, 15, 400],
-        [295, 102, 15, 400],
         [18, 170, 269, 332],
         [18, 150, 269, 352],
         [18, 130, 269, 40],
@@ -22,15 +21,12 @@
         "LayoutText #text",
         "RootInlineBox",
         "RootInlineBox",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME id='iframe'",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow DIV id='to-be-changed'",
         "LayoutText #text",
         "InlineTextBox 'After change'",
-        "LayoutBlockFlow DIV"
+        "LayoutBlockFlow DIV",
+        "VerticalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/window-resize-vertical-writing-mode-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/window-resize-vertical-writing-mode-expected.txt
index 94beeadc..24524fe 100644
--- a/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/window-resize-vertical-writing-mode-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/linux/fast/repaint/window-resize-vertical-writing-mode-expected.txt
@@ -20,7 +20,6 @@
         "RootInlineBox",
         "InlineTextBox 'AAAA AAAA AAAA'",
         "InlineTextBox 'AAAA AAAA'",
-        "VerticalScrollbar",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
@@ -49,7 +48,6 @@
         [0, 0, 300, 300]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
diff --git a/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/details-open-repaint-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/details-open-repaint-expected.txt
new file mode 100644
index 0000000..93de88a
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/details-open-repaint-expected.txt
@@ -0,0 +1,28 @@
+{
+  "bounds": [800, 600],
+  "children": [
+    {
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [10, 75, 150, 16],
+        [8, 72, 784, 22],
+        [8, 72, 154, 22],
+        [8, 57, 11, 11]
+      ],
+      "paintInvalidationClients": [
+        "LayoutDetailsMarker DIV id='details-marker'",
+        "LayoutBlockFlow DIV id='details-content'",
+        "LayoutTextControl INPUT",
+        "LayoutBlockFlow DIV id='inner-editor'",
+        "HorizontalScrollbar",
+        "VerticalScrollbar",
+        "LayoutBlockFlow DIV id='inner-editor'",
+        "LayoutText #text",
+        "LayoutText #text"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/line-flow-with-floats-9-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/line-flow-with-floats-9-expected.txt
new file mode 100644
index 0000000..5a5ec87
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/line-flow-with-floats-9-expected.txt
@@ -0,0 +1,93 @@
+{
+  "bounds": [800, 600],
+  "children": [
+    {
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [372, 243, 48, 49],
+        [8, 80, 418, 519]
+      ],
+      "paintInvalidationClients": [
+        "InlineTextBox 'The chief difficulty Alice found at first was in managing her'",
+        "RootInlineBox",
+        "InlineTextBox 'flamingo: she succeeded in getting its body tucked away,'",
+        "RootInlineBox",
+        "InlineTextBox 'comfortably enough, under her arm, with its legs hanging'",
+        "RootInlineBox",
+        "InlineTextBox 'down,\n'",
+        "InlineTextBox 'but generally, just as she had got its neck nicely'",
+        "RootInlineBox",
+        "InlineTextBox 'straightened\n'",
+        "InlineTextBox 'out, and was going to give the hedgehog a'",
+        "RootInlineBox",
+        "InlineTextBox 'blow with its head, it\n'",
+        "InlineTextBox 'would'",
+        "InlineTextBox ' twist itself round and look up in her'",
+        "RootInlineBox",
+        "InlineTextBox 'face, with\n'",
+        "InlineTextBox 'such a puzzled expression that she could not help'",
+        "RootInlineBox",
+        "InlineTextBox 'bursting out\n'",
+        "InlineTextBox 'laughing: and when she had got its head down, and was'",
+        "RootInlineBox",
+        "InlineTextBox 'going to\n'",
+        "InlineTextBox 'begin again, it was very provoking to find that the'",
+        "RootInlineBox",
+        "InlineTextBox 'hedgehog had\n'",
+        "InlineTextBox 'unrolled itself, and was in the act of crawling away:'",
+        "RootInlineBox",
+        "InlineTextBox 'besides all\n'",
+        "InlineTextBox 'this, there was generally a ridge or furrow in the way'",
+        "RootInlineBox",
+        "InlineTextBox 'wherever\n'",
+        "InlineTextBox 'she wanted to send the hedgehog to, and, as the'",
+        "RootInlineBox",
+        "InlineTextBox 'doubled-up\n'",
+        "InlineTextBox 'soldiers were always getting up and walking off to'",
+        "RootInlineBox",
+        "InlineTextBox 'other parts of\n'",
+        "InlineTextBox 'the ground, Alice soon came to the conclusion that it'",
+        "RootInlineBox",
+        "InlineTextBox 'was a very\n'",
+        "InlineTextBox 'difficult game indeed.\n'",
+        "RootInlineBox",
+        "InlineTextBox 'The players all played at once without waiting\n'",
+        "InlineTextBox 'for'",
+        "RootInlineBox",
+        "InlineTextBox 'turns,\n'",
+        "InlineTextBox 'quarrelling all the while, and fighting for the'",
+        "RootInlineBox",
+        "InlineTextBox 'hedgehogs; and in\n'",
+        "InlineTextBox 'a very short time '",
+        "InlineTextBox 'the Queen'",
+        "RootInlineBox",
+        "InlineTextBox 'was in a furious passion, and went\n'",
+        "InlineTextBox 'stamping about, and'",
+        "RootInlineBox",
+        "InlineTextBox 'shouting \u2018Off with his head!\u2019 or \u2018Off with\n'",
+        "InlineTextBox 'her head!\u2019 about'",
+        "RootInlineBox",
+        "InlineTextBox 'once in a minute.\n'",
+        "RootInlineBox",
+        "InlineTextBox 'Alice began to feel very uneasy: to be sure, she had not as\n'",
+        "InlineTextBox 'yet had'",
+        "RootInlineBox",
+        "InlineTextBox 'any dispute with the Queen, but she knew that it might\n'",
+        "InlineTextBox 'happen any'",
+        "RootInlineBox",
+        "InlineTextBox 'minute, \u2018and then,\u2019 thought she, \u2018what would become of\n'",
+        "InlineTextBox 'me?'",
+        "RootInlineBox",
+        "InlineTextBox 'They\u2019re dreadfully fond of beheading people here; the great'",
+        "RootInlineBox",
+        "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'",
+        "RootInlineBox",
+        "LayoutBlockFlow P",
+        "LayoutBlockFlow (floating) SPAN id='yellowFloat'"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/overflow-scroll-body-appear-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/overflow-scroll-body-appear-expected.txt
new file mode 100644
index 0000000..72c6d6b
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/overflow-scroll-body-appear-expected.txt
@@ -0,0 +1,36 @@
+{
+  "bounds": [2008, 2096],
+  "children": [
+    {
+      "bounds": [2008, 2096],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [785, 585, 15, 15],
+        [8, 52, 784, 20],
+        [8, 52, 769, 20],
+        [8, 16, 2000, 2072],
+        [8, 16, 784, 20],
+        [8, 16, 769, 20],
+        [0, 0, 2008, 2096],
+        [0, 0, 785, 585]
+      ],
+      "paintInvalidationClients": [
+        "RootInlineBox",
+        "InlineTextBox 'You should see both vertical and horizontal scrollbars.'",
+        "RootInlineBox",
+        "InlineTextBox 'This is the test for '",
+        "InlineTextBox 'Bug 36461 - No vertical scrollbar after the CSS class change'",
+        "InlineTextBox '.'",
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow BODY",
+        "LayoutBlockFlow P",
+        "LayoutBlockFlow P",
+        "HorizontalScrollbar",
+        "VerticalScrollbar"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/repaint-during-scroll-with-zoom-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
new file mode 100644
index 0000000..e7afc173
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
@@ -0,0 +1,32 @@
+{
+  "bounds": [800, 600],
+  "children": [
+    {
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "backgroundColor": "#C0C0C0",
+      "repaintRects": [
+        [237, 64, 15, 236],
+        [2, 299, 235, 16],
+        [2, 64, 235, 236],
+        [2, 64, 235, 236],
+        [2, 64, 235, 236],
+        [2, 64, 225, 226],
+        [2, 64, 135, 136],
+        [2, 64, 52, 18]
+      ],
+      "paintInvalidationClients": [
+        "LayoutIFrame (positioned) IFRAME",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutText #text",
+        "InlineTextBox 'scroll me'",
+        "HorizontalScrollbar",
+        "VerticalScrollbar"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/resize-scrollable-iframe-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/resize-scrollable-iframe-expected.txt
new file mode 100644
index 0000000..3949115
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/resize-scrollable-iframe-expected.txt
@@ -0,0 +1,38 @@
+{
+  "bounds": [800, 600],
+  "children": [
+    {
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [293, 393, 15, 15],
+        [293, 108, 15, 285],
+        [108, 108, 200, 300],
+        [93, 193, 15, 15],
+        [93, 108, 200, 285],
+        [93, 108, 15, 85],
+        [8, 393, 285, 15],
+        [8, 213, 784, 200],
+        [8, 208, 300, 200],
+        [8, 193, 285, 200],
+        [8, 193, 85, 15],
+        [8, 108, 784, 304],
+        [8, 108, 285, 285]
+      ],
+      "paintInvalidationClients": [
+        "InlineBox",
+        "RootInlineBox",
+        "LayoutBlockFlow (anonymous)",
+        "LayoutBlockFlow (anonymous)",
+        "LayoutIFrame IFRAME id='iframe'",
+        "LayoutView #document",
+        "LayoutView #document",
+        "HorizontalScrollbar",
+        "VerticalScrollbar",
+        "LayoutView #document"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/shift-relative-positioned-container-with-image-addition-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/shift-relative-positioned-container-with-image-addition-expected.txt
new file mode 100644
index 0000000..7492bce2
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/shift-relative-positioned-container-with-image-addition-expected.txt
@@ -0,0 +1,42 @@
+{
+  "bounds": [785, 836],
+  "children": [
+    {
+      "bounds": [785, 836],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [58, 236, 489, 537],
+        [58, 142, 489, 537],
+        [18, 102, 712, 74],
+        [10, 94, 728, 90],
+        [10, 94, 728, 90],
+        [10, 94, 728, 90],
+        [8, 186, 769, 642],
+        [8, 186, 769, 642],
+        [8, 92, 769, 642],
+        [8, 92, 769, 642],
+        [8, 92, 732, 94],
+        [0, 742, 785, 94],
+        [0, 0, 785, 836],
+        [0, 0, 785, 742]
+      ],
+      "paintInvalidationClients": [
+        "VerticalScrollbar",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutIFrame IFRAME id='iframe'",
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutView #document",
+        "LayoutBlockFlow (relative positioned) DIV class='relative'",
+        "LayoutBlockFlow (relative positioned) DIV class='relative paddingTop'",
+        "LayoutImage IMG",
+        "LayoutText #text"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/text-match-document-change-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/text-match-document-change-expected.txt
new file mode 100644
index 0000000..d04013d
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/text-match-document-change-expected.txt
@@ -0,0 +1,34 @@
+{
+  "bounds": [800, 600],
+  "children": [
+    {
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [295, 102, 15, 400],
+        [18, 170, 269, 332],
+        [18, 150, 269, 352],
+        [18, 130, 269, 40],
+        [18, 130, 269, 20],
+        [18, 130, 235, 39],
+        [18, 130, 77, 19],
+        [10, 102, 285, 400]
+      ],
+      "paintInvalidationClients": [
+        "InlineTextBox 'To be changed: findme (Manual testing:'",
+        "InlineTextBox 'Find-in-page 'findme', then click here)'",
+        "LayoutText #text",
+        "RootInlineBox",
+        "RootInlineBox",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow DIV id='to-be-changed'",
+        "LayoutText #text",
+        "InlineTextBox 'After change'",
+        "LayoutBlockFlow DIV",
+        "VerticalScrollbar"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/window-resize-vertical-writing-mode-expected.txt b/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/window-resize-vertical-writing-mode-expected.txt
new file mode 100644
index 0000000..24524fe
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/linux/virtual/syncpaint/fast/repaint/window-resize-vertical-writing-mode-expected.txt
@@ -0,0 +1,121 @@
+{
+  "bounds": [200, 300],
+  "children": [
+    {
+      "bounds": [200, 300],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [173, 8, 19, 236],
+        [172, 8, 20, 284],
+        [164, 0, 36, 300],
+        [153, 8, 39, 140],
+        [152, 8, 40, 184],
+        [144, 0, 56, 200],
+        [0, 200, 200, 100],
+        [0, 0, 200, 300]
+      ],
+      "paintInvalidationClients": [
+        "RootInlineBox",
+        "RootInlineBox",
+        "InlineTextBox 'AAAA AAAA AAAA'",
+        "InlineTextBox 'AAAA AAAA'",
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutText #text",
+        "InlineTextBox 'AAAA AAAA AAAA AAAA AAAA'"
+      ]
+    }
+  ]
+}
+{
+  "bounds": [300, 300],
+  "children": [
+    {
+      "bounds": [300, 300],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [273, 8, 19, 236],
+        [272, 8, 20, 284],
+        [264, 0, 36, 300],
+        [200, 0, 100, 300],
+        [173, 8, 19, 236],
+        [172, 8, 20, 284],
+        [164, 0, 36, 300],
+        [0, 0, 300, 300]
+      ],
+      "paintInvalidationClients": [
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutText #text",
+        "InlineTextBox 'AAAA AAAA AAAA AAAA AAAA'"
+      ]
+    }
+  ]
+}
+{
+  "bounds": [300, 250],
+  "children": [
+    {
+      "bounds": [300, 250],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [273, 8, 19, 236],
+        [272, 8, 20, 284],
+        [264, 0, 36, 300],
+        [253, 8, 39, 188],
+        [252, 8, 40, 234],
+        [244, 0, 56, 250],
+        [0, 250, 300, 50],
+        [0, 0, 300, 250]
+      ],
+      "paintInvalidationClients": [
+        "RootInlineBox",
+        "InlineTextBox 'AAAA AAAA AAAA AAAA AAAA'",
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutText #text",
+        "InlineTextBox 'AAAA AAAA AAAA AAAA'",
+        "InlineTextBox 'AAAA'"
+      ]
+    }
+  ]
+}
+{
+  "bounds": [250, 250],
+  "children": [
+    {
+      "bounds": [250, 250],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [253, 8, 39, 188],
+        [252, 8, 40, 234],
+        [250, 0, 50, 250],
+        [244, 0, 56, 250],
+        [203, 8, 39, 188],
+        [202, 8, 40, 234],
+        [194, 0, 56, 250],
+        [0, 0, 250, 250]
+      ],
+      "paintInvalidationClients": [
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutText #text",
+        "InlineTextBox 'AAAA AAAA AAAA AAAA'",
+        "InlineTextBox 'AAAA'"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mavericks/compositing/squashing/iframe-inside-squashed-layer-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mavericks/compositing/squashing/iframe-inside-squashed-layer-expected.txt
deleted file mode 100644
index 8e140cfa..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac-mavericks/compositing/squashing/iframe-inside-squashed-layer-expected.txt
+++ /dev/null
@@ -1,72 +0,0 @@
-{
-  "bounds": [785, 1016],
-  "children": [
-    {
-      "bounds": [785, 1016],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "children": [
-        {
-          "shouldFlattenTransform": false,
-          "children": [
-            {
-              "position": [8, 8],
-              "bounds": [200, 1000],
-              "contentsOpaque": true,
-              "drawsContent": true,
-              "backgroundColor": "#D3D3D3"
-            },
-            {
-              "position": [8, 0],
-              "bounds": [300, 654],
-              "drawsContent": true,
-              "repaintRects": [
-                [285, 552, 15, 98],
-                [285, 515, 15, 135],
-                [285, 500, 15, 150],
-                [285, 500, 15, 150],
-                [285, 500, 15, 104],
-                [285, 500, 15, 52],
-                [8, 508, 284, 18],
-                [8, 508, 269, 142],
-                [0, 500, 300, 150],
-                [0, 500, 300, 34],
-                [0, 500, 285, 150],
-                [0, 500, 285, 150],
-                [0, 500, 285, 150],
-                [0, 500, 15, 15],
-                [0, 500, 15, 15]
-              ],
-              "paintInvalidationClients": [
-                "RootInlineBox",
-                "InlineTextBox 'test1'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
-                "LayoutIFrame IFRAME id='subframe'",
-                "RootInlineBox",
-                "InlineTextBox 'test1'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
-                "LayoutView #document",
-                "LayoutView #document",
-                "LayoutBlockFlow HTML",
-                "LayoutBlockFlow BODY"
-              ]
-            }
-          ]
-        }
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/submit/submit-focus-by-mouse-then-keydown-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/submit/submit-focus-by-mouse-then-keydown-expected.txt
index f48b2d7..1ea85a2a 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/submit/submit-focus-by-mouse-then-keydown-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/forms/submit/submit-focus-by-mouse-then-keydown-expected.txt
@@ -6,14 +6,15 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
+        [16, 11, 38, 13],
+        [16, 11, 38, 13],
         [3, 4, 64, 29]
       ],
       "paintInvalidationClients": [
         "LayoutButton INPUT",
         "LayoutBlockFlow (anonymous)",
         "LayoutText #text",
-        "InlineTextBox 'Submit'",
-        "LayoutButton INPUT"
+        "InlineTextBox 'Submit'"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/repaint/details-open-repaint-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/repaint/details-open-repaint-expected.txt
index 75e5a0d..7d95bd6 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/repaint/details-open-repaint-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-mavericks/fast/repaint/details-open-repaint-expected.txt
@@ -16,6 +16,9 @@
         "LayoutBlockFlow DIV id='details-content'",
         "LayoutTextControl INPUT",
         "LayoutBlockFlow DIV id='inner-editor'",
+        "HorizontalScrollbar",
+        "VerticalScrollbar",
+        "LayoutBlockFlow DIV id='inner-editor'",
         "LayoutText #text",
         "LayoutText #text"
       ]
diff --git a/third_party/WebKit/LayoutTests/platform/mac-mavericks/virtual/syncpaint/fast/repaint/details-open-repaint-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-mavericks/virtual/syncpaint/fast/repaint/details-open-repaint-expected.txt
new file mode 100644
index 0000000..7d95bd6
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-mavericks/virtual/syncpaint/fast/repaint/details-open-repaint-expected.txt
@@ -0,0 +1,28 @@
+{
+  "bounds": [800, 600],
+  "children": [
+    {
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [11, 71, 117, 13],
+        [8, 68, 784, 19],
+        [8, 68, 123, 19],
+        [8, 54, 11, 11]
+      ],
+      "paintInvalidationClients": [
+        "LayoutDetailsMarker DIV id='details-marker'",
+        "LayoutBlockFlow DIV id='details-content'",
+        "LayoutTextControl INPUT",
+        "LayoutBlockFlow DIV id='inner-editor'",
+        "HorizontalScrollbar",
+        "VerticalScrollbar",
+        "LayoutBlockFlow DIV id='inner-editor'",
+        "LayoutText #text",
+        "LayoutText #text"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/compositing/overflow/scrolling-without-painting-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/compositing/overflow/scrolling-without-painting-expected.txt
index 92078e8a..9a9a59e 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/compositing/overflow/scrolling-without-painting-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/compositing/overflow/scrolling-without-painting-expected.txt
@@ -34,13 +34,9 @@
                   "bounds": [15, 185],
                   "drawsContent": true,
                   "repaintRects": [
-                    [0, 0, 15, 185],
-                    [0, 0, 15, 185],
                     [0, 0, 15, 185]
                   ],
                   "paintInvalidationClients": [
-                    "##ALL##",
-                    "##ALL##",
                     "##ALL##"
                   ]
                 },
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/compositing/overflow/updating-scrolling-content-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/compositing/overflow/updating-scrolling-content-expected.txt
index c4a591d..d9e0f1fb 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/compositing/overflow/updating-scrolling-content-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/compositing/overflow/updating-scrolling-content-expected.txt
@@ -42,13 +42,9 @@
                   "bounds": [15, 185],
                   "drawsContent": true,
                   "repaintRects": [
-                    [0, 0, 15, 185],
-                    [0, 0, 15, 185],
                     [0, 0, 15, 185]
                   ],
                   "paintInvalidationClients": [
-                    "##ALL##",
-                    "##ALL##",
                     "##ALL##"
                   ]
                 },
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/compositing/repaint/should-not-clip-composited-overflow-scrolling-layer-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/compositing/repaint/should-not-clip-composited-overflow-scrolling-layer-expected.txt
index d71524d0..99d68de 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/compositing/repaint/should-not-clip-composited-overflow-scrolling-layer-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/compositing/repaint/should-not-clip-composited-overflow-scrolling-layer-expected.txt
@@ -37,13 +37,9 @@
                   "bounds": [485, 15],
                   "drawsContent": true,
                   "repaintRects": [
-                    [0, 0, 485, 15],
-                    [0, 0, 485, 15],
                     [0, 0, 485, 15]
                   ],
                   "paintInvalidationClients": [
-                    "##ALL##",
-                    "##ALL##",
                     "##ALL##"
                   ]
                 },
@@ -52,13 +48,9 @@
                   "bounds": [15, 485],
                   "drawsContent": true,
                   "repaintRects": [
-                    [0, 0, 15, 485],
-                    [0, 0, 15, 485],
                     [0, 0, 15, 485]
                   ],
                   "paintInvalidationClients": [
-                    "##ALL##",
-                    "##ALL##",
                     "##ALL##"
                   ]
                 },
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt
deleted file mode 100644
index 1cd4a718..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  "bounds": [800, 600],
-  "children": [
-    {
-      "bounds": [800, 600],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "repaintRects": [
-        [762, 265, 15, 43],
-        [762, 173, 15, 135],
-        [762, 8, 15, 257],
-        [8, 8, 769, 300],
-        [8, 8, 300, 300],
-        [8, 8, 300, 300]
-      ],
-      "paintInvalidationClients": [
-        "VerticalScrollbar",
-        "VerticalScrollbar",
-        "VerticalScrollbar",
-        "LayoutBlockFlow DIV id='innerDiv'",
-        "LayoutBlockFlow DIV",
-        "LayoutBlockFlow DIV"
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/overflow-move-after-scroll-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/overflow-move-after-scroll-expected.txt
index 659a4853..2f5cdaa 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/overflow-move-after-scroll-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/overflow-move-after-scroll-expected.txt
@@ -44,13 +44,9 @@
                   "bounds": [15, 385],
                   "drawsContent": true,
                   "repaintRects": [
-                    [0, 0, 15, 385],
-                    [0, 0, 15, 385],
                     [0, 0, 15, 385]
                   ],
                   "paintInvalidationClients": [
-                    "##ALL##",
-                    "##ALL##",
                     "##ALL##"
                   ]
                 },
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/overflow-scroll-after-move-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/overflow-scroll-after-move-expected.txt
index b7f0df5..197433d 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/overflow-scroll-after-move-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/overflow-scroll-after-move-expected.txt
@@ -44,13 +44,9 @@
                   "bounds": [15, 385],
                   "drawsContent": true,
                   "repaintRects": [
-                    [0, 0, 15, 385],
-                    [0, 0, 15, 385],
                     [0, 0, 15, 385]
                   ],
                   "paintInvalidationClients": [
-                    "##ALL##",
-                    "##ALL##",
                     "##ALL##"
                   ]
                 },
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/overflow-scroll-in-overflow-scroll-scrolled-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/overflow-scroll-in-overflow-scroll-scrolled-expected.txt
deleted file mode 100644
index 1cd4a718..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/overflow-scroll-in-overflow-scroll-scrolled-expected.txt
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  "bounds": [800, 600],
-  "children": [
-    {
-      "bounds": [800, 600],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "repaintRects": [
-        [762, 265, 15, 43],
-        [762, 173, 15, 135],
-        [762, 8, 15, 257],
-        [8, 8, 769, 300],
-        [8, 8, 300, 300],
-        [8, 8, 300, 300]
-      ],
-      "paintInvalidationClients": [
-        "VerticalScrollbar",
-        "VerticalScrollbar",
-        "VerticalScrollbar",
-        "LayoutBlockFlow DIV id='innerDiv'",
-        "LayoutBlockFlow DIV",
-        "LayoutBlockFlow DIV"
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/repaint-composited-child-in-scrolled-container-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/repaint-composited-child-in-scrolled-container-expected.txt
deleted file mode 100644
index 69f547e..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/repaint-composited-child-in-scrolled-container-expected.txt
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  "bounds": [800, 600],
-  "children": [
-    {
-      "bounds": [800, 600],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "repaintRects": [
-        [207, 293, 56, 15],
-        [151, 293, 112, 15],
-        [8, 293, 199, 15]
-      ],
-      "paintInvalidationClients": [
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "HorizontalScrollbar"
-      ],
-      "children": [
-        {
-          "position": [8, 8],
-          "bounds": [285, 285],
-          "shouldFlattenTransform": false,
-          "children": [
-            {
-              "position": [-315, 0],
-              "bounds": [600, 600],
-              "contentsOpaque": true,
-              "drawsContent": true,
-              "backgroundColor": "#FF0000",
-              "repaintRects": [
-                [0, 0, 600, 600]
-              ],
-              "paintInvalidationClients": [
-                "LayoutBlockFlow DIV id='inner'"
-              ]
-            }
-          ]
-        }
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/scroll-inside-table-cell-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/scroll-inside-table-cell-expected.txt
deleted file mode 100644
index 1c329173..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/scroll-inside-table-cell-expected.txt
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  "bounds": [800, 600],
-  "children": [
-    {
-      "bounds": [800, 600],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "repaintRects": [
-        [626, 564, 93, 15],
-        [534, 564, 185, 15],
-        [314, 564, 312, 15],
-        [314, 114, 450, 450],
-        [312, 114, 437, 450],
-        [312, 112, 454, 469]
-      ],
-      "paintInvalidationClients": [
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "LayoutTableCell (relative positioned) TD id='cellToScroll' class='relative'",
-        "LayoutBlockFlow (relative positioned) DIV class='relative red'",
-        "LayoutBlockFlow (positioned) DIV class='absolute green'"
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/scroll-relative-table-inside-table-cell-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/scroll-relative-table-inside-table-cell-expected.txt
deleted file mode 100644
index c1b9106..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/scroll-relative-table-inside-table-cell-expected.txt
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  "bounds": [1566, 1781],
-  "children": [
-    {
-      "bounds": [1566, 1781],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "repaintRects": [
-        [1426, 1764, 93, 15],
-        [1334, 1764, 185, 15],
-        [1114, 1764, 312, 15],
-        [1114, 1314, 450, 450],
-        [1112, 1314, 437, 450],
-        [1112, 1312, 454, 469]
-      ],
-      "paintInvalidationClients": [
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "LayoutTableCell (relative positioned) TD id='cellToScroll' class='relative'",
-        "LayoutBlockFlow (relative positioned) DIV class='relative red'",
-        "LayoutBlockFlow (positioned) DIV class='absolute green'"
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt
deleted file mode 100644
index d00a1ed3..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt
+++ /dev/null
@@ -1,37 +0,0 @@
-{
-  "bounds": [800, 600],
-  "children": [
-    {
-      "bounds": [800, 600],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "repaintRects": [
-        [762, 261, 15, 47],
-        [762, 170, 15, 138],
-        [762, 8, 15, 253],
-        [10, 8, 302, 300],
-        [10, 8, 302, 300],
-        [8, 8, 769, 300],
-        [8, 8, 306, 300],
-        [8, 8, 306, 300],
-        [8, 8, 306, 300],
-        [8, 8, 306, 300]
-      ],
-      "paintInvalidationClients": [
-        "VerticalScrollbar",
-        "VerticalScrollbar",
-        "VerticalScrollbar",
-        "LayoutBlockFlow DIV id='innerDiv'",
-        "LayoutTable TABLE",
-        "LayoutTableCell TD",
-        "LayoutTableCell TD",
-        "LayoutTableSection TBODY",
-        "LayoutTableRow TR",
-        "LayoutTableCell TD",
-        "LayoutTableRow TR",
-        "LayoutTableCell TD"
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/table-overflow-scroll-in-overflow-scroll-scrolled-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/table-overflow-scroll-in-overflow-scroll-scrolled-expected.txt
deleted file mode 100644
index d00a1ed3..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/table-overflow-scroll-in-overflow-scroll-scrolled-expected.txt
+++ /dev/null
@@ -1,37 +0,0 @@
-{
-  "bounds": [800, 600],
-  "children": [
-    {
-      "bounds": [800, 600],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "repaintRects": [
-        [762, 261, 15, 47],
-        [762, 170, 15, 138],
-        [762, 8, 15, 253],
-        [10, 8, 302, 300],
-        [10, 8, 302, 300],
-        [8, 8, 769, 300],
-        [8, 8, 306, 300],
-        [8, 8, 306, 300],
-        [8, 8, 306, 300],
-        [8, 8, 306, 300]
-      ],
-      "paintInvalidationClients": [
-        "VerticalScrollbar",
-        "VerticalScrollbar",
-        "VerticalScrollbar",
-        "LayoutBlockFlow DIV id='innerDiv'",
-        "LayoutTable TABLE",
-        "LayoutTableCell TD",
-        "LayoutTableCell TD",
-        "LayoutTableSection TBODY",
-        "LayoutTableRow TR",
-        "LayoutTableCell TD",
-        "LayoutTableRow TR",
-        "LayoutTableCell TD"
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/paint/invalidation/invalidate-after-composited-scroll-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/paint/invalidation/invalidate-after-composited-scroll-expected.txt
index 15604b4..6a2e951e 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/paint/invalidation/invalidate-after-composited-scroll-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/paint/invalidation/invalidate-after-composited-scroll-expected.txt
@@ -37,13 +37,9 @@
                   "bounds": [15, 200],
                   "drawsContent": true,
                   "repaintRects": [
-                    [0, 0, 15, 200],
-                    [0, 0, 15, 200],
                     [0, 0, 15, 200]
                   ],
                   "paintInvalidationClients": [
-                    "##ALL##",
-                    "##ALL##",
                     "##ALL##"
                   ]
                 }
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/virtual/prefer_compositing_to_lcd_text/compositing/overflow/scrolling-without-painting-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/virtual/prefer_compositing_to_lcd_text/compositing/overflow/scrolling-without-painting-expected.txt
index 92078e8a..9a9a59e 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/virtual/prefer_compositing_to_lcd_text/compositing/overflow/scrolling-without-painting-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/virtual/prefer_compositing_to_lcd_text/compositing/overflow/scrolling-without-painting-expected.txt
@@ -34,13 +34,9 @@
                   "bounds": [15, 185],
                   "drawsContent": true,
                   "repaintRects": [
-                    [0, 0, 15, 185],
-                    [0, 0, 15, 185],
                     [0, 0, 15, 185]
                   ],
                   "paintInvalidationClients": [
-                    "##ALL##",
-                    "##ALL##",
                     "##ALL##"
                   ]
                 },
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/virtual/prefer_compositing_to_lcd_text/compositing/overflow/updating-scrolling-content-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/virtual/prefer_compositing_to_lcd_text/compositing/overflow/updating-scrolling-content-expected.txt
index c4a591d..d9e0f1fb 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/virtual/prefer_compositing_to_lcd_text/compositing/overflow/updating-scrolling-content-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/virtual/prefer_compositing_to_lcd_text/compositing/overflow/updating-scrolling-content-expected.txt
@@ -42,13 +42,9 @@
                   "bounds": [15, 185],
                   "drawsContent": true,
                   "repaintRects": [
-                    [0, 0, 15, 185],
-                    [0, 0, 15, 185],
                     [0, 0, 15, 185]
                   ],
                   "paintInvalidationClients": [
-                    "##ALL##",
-                    "##ALL##",
                     "##ALL##"
                   ]
                 },
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/virtual/syncpaint/compositing/repaint/should-not-clip-composited-overflow-scrolling-layer-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/virtual/syncpaint/compositing/repaint/should-not-clip-composited-overflow-scrolling-layer-expected.txt
new file mode 100644
index 0000000..99d68de
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/virtual/syncpaint/compositing/repaint/should-not-clip-composited-overflow-scrolling-layer-expected.txt
@@ -0,0 +1,70 @@
+{
+  "bounds": [800, 600],
+  "children": [
+    {
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "children": [
+        {
+          "position": [8, 8],
+          "bounds": [500, 500],
+          "drawsContent": true,
+          "repaintRects": [
+            [-2000, -2000, 5000, 5000]
+          ],
+          "children": [
+            {
+              "bounds": [485, 485],
+              "children": [
+                {
+                  "bounds": [5000, 5000],
+                  "shouldFlattenTransform": false,
+                  "drawsContent": true,
+                  "repaintRects": [
+                    [0, 0, 5000, 5000]
+                  ],
+                  "paintInvalidationClients": [
+                    "LayoutBlockFlow DIV id='content'"
+                  ]
+                }
+              ]
+            },
+            {
+              "children": [
+                {
+                  "position": [0, 485],
+                  "bounds": [485, 15],
+                  "drawsContent": true,
+                  "repaintRects": [
+                    [0, 0, 485, 15]
+                  ],
+                  "paintInvalidationClients": [
+                    "##ALL##"
+                  ]
+                },
+                {
+                  "position": [485, 0],
+                  "bounds": [15, 485],
+                  "drawsContent": true,
+                  "repaintRects": [
+                    [0, 0, 15, 485]
+                  ],
+                  "paintInvalidationClients": [
+                    "##ALL##"
+                  ]
+                },
+                {
+                  "position": [485, 485],
+                  "bounds": [15, 15],
+                  "drawsContent": true
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/overflow-move-after-scroll-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/virtual/syncpaint/fast/repaint/overflow-move-after-scroll-expected.txt
similarity index 87%
rename from third_party/WebKit/LayoutTests/platform/mac/fast/repaint/overflow-move-after-scroll-expected.txt
rename to third_party/WebKit/LayoutTests/platform/mac-snowleopard/virtual/syncpaint/fast/repaint/overflow-move-after-scroll-expected.txt
index 10cb67cf..2f5cdaa 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/overflow-move-after-scroll-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/virtual/syncpaint/fast/repaint/overflow-move-after-scroll-expected.txt
@@ -36,15 +36,18 @@
               "children": [
                 {
                   "position": [0, 385],
-                  "bounds": [685, 15]
+                  "bounds": [685, 15],
+                  "drawsContent": true
                 },
                 {
                   "position": [685, 0],
                   "bounds": [15, 385],
+                  "drawsContent": true,
                   "repaintRects": [
-                    [0, 0, 15, 385],
-                    [0, 0, 15, 385],
                     [0, 0, 15, 385]
+                  ],
+                  "paintInvalidationClients": [
+                    "##ALL##"
                   ]
                 },
                 {
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/overflow-scroll-after-move-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/virtual/syncpaint/fast/repaint/overflow-scroll-after-move-expected.txt
similarity index 87%
rename from third_party/WebKit/LayoutTests/platform/mac/fast/repaint/overflow-scroll-after-move-expected.txt
rename to third_party/WebKit/LayoutTests/platform/mac-snowleopard/virtual/syncpaint/fast/repaint/overflow-scroll-after-move-expected.txt
index ebcc5e6d..197433d 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/overflow-scroll-after-move-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/virtual/syncpaint/fast/repaint/overflow-scroll-after-move-expected.txt
@@ -36,15 +36,18 @@
               "children": [
                 {
                   "position": [0, 385],
-                  "bounds": [285, 15]
+                  "bounds": [285, 15],
+                  "drawsContent": true
                 },
                 {
                   "position": [285, 0],
                   "bounds": [15, 385],
+                  "drawsContent": true,
                   "repaintRects": [
-                    [0, 0, 15, 385],
-                    [0, 0, 15, 385],
                     [0, 0, 15, 385]
+                  ],
+                  "paintInvalidationClients": [
+                    "##ALL##"
                   ]
                 },
                 {
diff --git a/third_party/WebKit/LayoutTests/platform/mac/paint/invalidation/invalidate-after-composited-scroll-expected.txt b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/virtual/syncpaint/paint/invalidation/invalidate-after-composited-scroll-expected.txt
similarity index 89%
rename from third_party/WebKit/LayoutTests/platform/mac/paint/invalidation/invalidate-after-composited-scroll-expected.txt
rename to third_party/WebKit/LayoutTests/platform/mac-snowleopard/virtual/syncpaint/paint/invalidation/invalidate-after-composited-scroll-expected.txt
index 834dfdc..6a2e951e 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/paint/invalidation/invalidate-after-composited-scroll-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac-snowleopard/virtual/syncpaint/paint/invalidation/invalidate-after-composited-scroll-expected.txt
@@ -35,10 +35,12 @@
                 {
                   "position": [185, 0],
                   "bounds": [15, 200],
+                  "drawsContent": true,
                   "repaintRects": [
-                    [0, 0, 15, 200],
-                    [0, 0, 15, 200],
                     [0, 0, 15, 200]
+                  ],
+                  "paintInvalidationClients": [
+                    "##ALL##"
                   ]
                 }
               ]
diff --git a/third_party/WebKit/LayoutTests/platform/mac/compositing/overflow/scrolling-without-painting-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/compositing/overflow/scrolling-without-painting-expected.txt
deleted file mode 100644
index 2f93caa5..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/compositing/overflow/scrolling-without-painting-expected.txt
+++ /dev/null
@@ -1,53 +0,0 @@
-{
-  "bounds": [800, 600],
-  "children": [
-    {
-      "bounds": [800, 600],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "children": [
-        {
-          "position": [8, 8],
-          "bounds": [202, 202],
-          "drawsContent": true,
-          "children": [
-            {
-              "position": [1, 1],
-              "bounds": [185, 185],
-              "children": [
-                {
-                  "bounds": [185, 1025],
-                  "shouldFlattenTransform": false,
-                  "drawsContent": true
-                }
-              ]
-            },
-            {
-              "children": [
-                {
-                  "position": [1, 186],
-                  "bounds": [185, 15]
-                },
-                {
-                  "position": [186, 1],
-                  "bounds": [15, 185],
-                  "repaintRects": [
-                    [0, 0, 15, 185],
-                    [0, 0, 15, 185],
-                    [0, 0, 15, 185]
-                  ]
-                },
-                {
-                  "position": [186, 186],
-                  "bounds": [15, 15],
-                  "drawsContent": true
-                }
-              ]
-            }
-          ]
-        }
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/mac/compositing/repaint/should-not-clip-composited-overflow-scrolling-layer-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/compositing/repaint/should-not-clip-composited-overflow-scrolling-layer-expected.txt
index e0cb92b3..778ead5 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/compositing/repaint/should-not-clip-composited-overflow-scrolling-layer-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/compositing/repaint/should-not-clip-composited-overflow-scrolling-layer-expected.txt
@@ -36,8 +36,6 @@
                   "position": [0, 485],
                   "bounds": [485, 15],
                   "repaintRects": [
-                    [0, 0, 485, 15],
-                    [0, 0, 485, 15],
                     [0, 0, 485, 15]
                   ]
                 },
@@ -45,8 +43,6 @@
                   "position": [485, 0],
                   "bounds": [15, 485],
                   "repaintRects": [
-                    [0, 0, 15, 485],
-                    [0, 0, 15, 485],
                     [0, 0, 15, 485]
                   ]
                 },
diff --git a/third_party/WebKit/LayoutTests/platform/mac/compositing/squashing/iframe-inside-squashed-layer-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/compositing/squashing/iframe-inside-squashed-layer-expected.txt
index 61f83ed..216140d8 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/compositing/squashing/iframe-inside-squashed-layer-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/compositing/squashing/iframe-inside-squashed-layer-expected.txt
@@ -21,14 +21,26 @@
               "bounds": [300, 654],
               "drawsContent": true,
               "repaintRects": [
-                [285, 552, 15, 98],
                 [285, 500, 15, 150],
-                [285, 500, 15, 150],
-                [285, 500, 15, 104],
-                [285, 500, 15, 52],
+                [8, 508, 284, 18],
+                [8, 508, 269, 142],
+                [0, 500, 300, 150],
+                [0, 500, 300, 34],
                 [0, 500, 285, 150],
-                [0, 500, 15, 15],
-                [0, 500, 15, 15]
+                [0, 500, 285, 150],
+                [0, 500, 285, 150]
+              ],
+              "paintInvalidationClients": [
+                "RootInlineBox",
+                "InlineTextBox 'test1'",
+                "RootInlineBox",
+                "InlineTextBox 'test1'",
+                "LayoutView #document",
+                "LayoutView #document",
+                "LayoutBlockFlow HTML",
+                "LayoutBlockFlow BODY",
+                "VerticalScrollbar",
+                "LayoutView #document"
               ]
             }
           ]
diff --git a/third_party/WebKit/LayoutTests/platform/mac/css2.1/t0505-c16-descendant-01-e-expected.png b/third_party/WebKit/LayoutTests/platform/mac/css2.1/t0505-c16-descendant-01-e-expected.png
index 1b46ce0..d8a4219 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/css2.1/t0505-c16-descendant-01-e-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/mac/css2.1/t0505-c16-descendant-01-e-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/css2.1/t0505-c16-descendant-01-e-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/css2.1/t0505-c16-descendant-01-e-expected.txt
index c9a829c..9a0a5f3 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/css2.1/t0505-c16-descendant-01-e-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/css2.1/t0505-c16-descendant-01-e-expected.txt
@@ -10,8 +10,7 @@
       LayoutBlockFlow {UL} at (0,34) size 784x18 [color=#008000]
         LayoutListItem {LI} at (40,0) size 744x18
           LayoutListMarker (anonymous) at (-17,0) size 7x18: bullet
-          LayoutInline {SPAN} at (0,0) size 4x18 [color=#FF0000]
-            LayoutText {#text} at (0,0) size 4x18
-              text run at (0,0) width 4: " "
-          LayoutText {#text} at (4,0) size 166x18
-            text run at (4,0) width 166: "This line should be green."
+          LayoutInline {SPAN} at (0,0) size 0x0 [color=#FF0000]
+            LayoutText {#text} at (0,0) size 0x0
+          LayoutText {#text} at (0,0) size 166x18
+            text run at (0,0) width 166: "This line should be green."
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/box-shadow/inset-subpixel-expected.png b/third_party/WebKit/LayoutTests/platform/mac/fast/box-shadow/inset-subpixel-expected.png
new file mode 100644
index 0000000..96d64d1
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/box-shadow/inset-subpixel-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/box-shadow/inset-subpixel-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/box-shadow/inset-subpixel-expected.txt
new file mode 100644
index 0000000..815c92a
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/box-shadow/inset-subpixel-expected.txt
@@ -0,0 +1,42 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  LayoutBlockFlow {HTML} at (0,0) size 800x600
+    LayoutBlockFlow {BODY} at (8,8) size 784x584
+      LayoutBlockFlow {DIV} at (0,0) size 784x124
+        LayoutBlockFlow {DIV} at (10,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (120,106) size 4x18
+          text run at (120,106) width 4: " "
+        LayoutBlockFlow {DIV} at (134,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (244,106) size 4x18
+          text run at (244,106) width 4: " "
+        LayoutBlockFlow {DIV} at (258,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (368,106) size 4x18
+          text run at (368,106) width 4: " "
+        LayoutBlockFlow {DIV} at (382,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (492,106) size 4x18
+          text run at (492,106) width 4: " "
+        LayoutBlockFlow {DIV} at (506,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (0,0) size 0x0
+      LayoutBlockFlow {DIV} at (0,124) size 784x124
+        LayoutBlockFlow {DIV} at (10,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (120,106) size 4x18
+          text run at (120,106) width 4: " "
+        LayoutBlockFlow {DIV} at (134,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (244,106) size 4x18
+          text run at (244,106) width 4: " "
+        LayoutBlockFlow {DIV} at (258,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (368,106) size 4x18
+          text run at (368,106) width 4: " "
+        LayoutBlockFlow {DIV} at (382,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (492,106) size 4x18
+          text run at (492,106) width 4: " "
+        LayoutBlockFlow {DIV} at (506,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px dashed #008000)]
+        LayoutText {#text} at (0,0) size 0x0
+      LayoutBlockFlow {DIV} at (0,248) size 600x324
+        LayoutInline {SPAN} at (0,0) size 590x309 [bgcolor=#FFFFE0] [border: (5px solid #008000)]
+          LayoutText {#text} at (25,12) size 570x299
+            text run at (25,12) width 570: "This sentence is too"
+            text run at (90,120) width 420: "long to fit on a"
+            text run at (132,228) width 316: "single line."
+        LayoutText {#text} at (0,0) size 0x0
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/button/button-reset-focus-by-mouse-then-keydown-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/button/button-reset-focus-by-mouse-then-keydown-expected.txt
index 6d9f499..5ba4f2e 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/button/button-reset-focus-by-mouse-then-keydown-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/button/button-reset-focus-by-mouse-then-keydown-expected.txt
@@ -6,14 +6,15 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
+        [16, 11, 29, 13],
+        [16, 11, 29, 13],
         [3, 4, 55, 29]
       ],
       "paintInvalidationClients": [
         "LayoutButton BUTTON",
         "LayoutBlockFlow (anonymous)",
         "LayoutText #text",
-        "InlineTextBox 'Reset'",
-        "LayoutButton BUTTON"
+        "InlineTextBox 'Reset'"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/checkbox/checkbox-focus-by-mouse-then-keydown-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/checkbox/checkbox-focus-by-mouse-then-keydown-expected.txt
index 5bfbcef6..549d144 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/checkbox/checkbox-focus-by-mouse-then-keydown-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/checkbox/checkbox-focus-by-mouse-then-keydown-expected.txt
@@ -9,7 +9,6 @@
         [5, 7, 23, 22]
       ],
       "paintInvalidationClients": [
-        "LayoutBlockFlow INPUT",
         "LayoutBlockFlow INPUT"
       ]
     }
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/radio/radio-focus-by-mouse-then-keydown-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/radio/radio-focus-by-mouse-then-keydown-expected.txt
index e20ffb7..12b44ba 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/radio/radio-focus-by-mouse-then-keydown-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/radio/radio-focus-by-mouse-then-keydown-expected.txt
@@ -9,7 +9,6 @@
         [5, 6, 23, 23]
       ],
       "paintInvalidationClients": [
-        "LayoutBlockFlow INPUT",
         "LayoutBlockFlow INPUT"
       ]
     }
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/range/range-focus-by-mouse-then-keydown-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/range/range-focus-by-mouse-then-keydown-expected.txt
index 09cb6633..964820d 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/range/range-focus-by-mouse-then-keydown-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/range/range-focus-by-mouse-then-keydown-expected.txt
@@ -6,14 +6,16 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
+        [67, 10, 15, 16],
+        [10, 10, 129, 16],
+        [10, 10, 129, 16],
         [7, 7, 135, 21]
       ],
       "paintInvalidationClients": [
         "LayoutSlider INPUT",
         "LayoutFlexibleBox DIV",
         "LayoutBlockFlow DIV id='track'",
-        "LayoutBlockFlow DIV id='thumb'",
-        "LayoutSlider INPUT"
+        "LayoutBlockFlow DIV id='thumb'"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/submit/submit-focus-by-mouse-then-keydown-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/submit/submit-focus-by-mouse-then-keydown-expected.txt
index 382bdd5..ee7c40c 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/forms/submit/submit-focus-by-mouse-then-keydown-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/forms/submit/submit-focus-by-mouse-then-keydown-expected.txt
@@ -6,14 +6,15 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
+        [16, 11, 36, 13],
+        [16, 11, 36, 13],
         [3, 4, 62, 29]
       ],
       "paintInvalidationClients": [
         "LayoutButton INPUT",
         "LayoutBlockFlow (anonymous)",
         "LayoutText #text",
-        "InlineTextBox 'Submit'",
-        "LayoutButton INPUT"
+        "InlineTextBox 'Submit'"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/button-checkbox-click-method-repaint-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/button-checkbox-click-method-repaint-expected.txt
index 2642dfd8b..4a6a7fa 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/button-checkbox-click-method-repaint-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/button-checkbox-click-method-repaint-expected.txt
@@ -9,7 +9,6 @@
         [10, 61, 31, 30]
       ],
       "paintInvalidationClients": [
-        "LayoutBlockFlow INPUT id='checkbox'",
         "LayoutBlockFlow INPUT id='checkbox'"
       ]
     }
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/details-open-repaint-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/details-open-repaint-expected.txt
index 803ae0b..1767b18 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/details-open-repaint-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/details-open-repaint-expected.txt
@@ -16,6 +16,9 @@
         "LayoutBlockFlow DIV id='details-content'",
         "LayoutTextControl INPUT",
         "LayoutBlockFlow DIV id='inner-editor'",
+        "HorizontalScrollbar",
+        "VerticalScrollbar",
+        "LayoutBlockFlow DIV id='inner-editor'",
         "LayoutText #text",
         "LayoutText #text"
       ]
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/line-flow-with-floats-9-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/line-flow-with-floats-9-expected.txt
index 09403909..8f7d6cf8 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/line-flow-with-floats-9-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/line-flow-with-floats-9-expected.txt
@@ -6,13 +6,8 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
-        [485, 297, 15, 303],
-        [485, 15, 15, 585],
         [485, 0, 15, 600],
         [485, 0, 15, 600],
-        [485, 0, 15, 600],
-        [485, 0, 15, 594],
-        [485, 0, 15, 297],
         [372, 389, 48, 81],
         [372, 371, 48, 81],
         [372, 245, 48, 49],
@@ -32,9 +27,7 @@
         [8, 569, 418, 21],
         [0, 0, 500, 600],
         [0, 0, 485, 600],
-        [0, 0, 485, 600],
-        [0, 0, 15, 15],
-        [0, 0, 15, 15]
+        [0, 0, 485, 600]
       ],
       "paintInvalidationClients": [
         "InlineTextBox 'The chief difficulty Alice found at first was in'",
@@ -112,24 +105,9 @@
         "InlineTextBox 'here; the great\n'",
         "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'",
         "RootInlineBox",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "LayoutIFrame IFRAME id='iframe'",
         "InlineTextBox 'here; the great\n'",
         "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'",
         "RootInlineBox",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
@@ -161,7 +139,9 @@
         "InlineTextBox 'become of\n'",
         "InlineTextBox 'me? They\u2019re dreadfully fond of beheading people'",
         "InlineTextBox 'here; the great\n'",
-        "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'"
+        "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'",
+        "VerticalScrollbar",
+        "LayoutView #document"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt
deleted file mode 100644
index f9928bb..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  "bounds": [800, 600],
-  "children": [
-    {
-      "bounds": [800, 600],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "repaintRects": [
-        [762, 288, 15, 20],
-        [762, 188, 15, 120],
-        [762, 8, 15, 280],
-        [8, 8, 769, 300],
-        [8, 8, 300, 300],
-        [8, 8, 300, 300]
-      ],
-      "paintInvalidationClients": [
-        "VerticalScrollbar",
-        "VerticalScrollbar",
-        "VerticalScrollbar",
-        "LayoutBlockFlow DIV id='innerDiv'",
-        "LayoutBlockFlow DIV",
-        "LayoutBlockFlow DIV"
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/overflow-scroll-in-overflow-scroll-scrolled-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/overflow-scroll-in-overflow-scroll-scrolled-expected.txt
deleted file mode 100644
index f9928bb..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/overflow-scroll-in-overflow-scroll-scrolled-expected.txt
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  "bounds": [800, 600],
-  "children": [
-    {
-      "bounds": [800, 600],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "repaintRects": [
-        [762, 288, 15, 20],
-        [762, 188, 15, 120],
-        [762, 8, 15, 280],
-        [8, 8, 769, 300],
-        [8, 8, 300, 300],
-        [8, 8, 300, 300]
-      ],
-      "paintInvalidationClients": [
-        "VerticalScrollbar",
-        "VerticalScrollbar",
-        "VerticalScrollbar",
-        "LayoutBlockFlow DIV id='innerDiv'",
-        "LayoutBlockFlow DIV",
-        "LayoutBlockFlow DIV"
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/repaint-composited-child-in-scrolled-container-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/repaint-composited-child-in-scrolled-container-expected.txt
deleted file mode 100644
index f02d0f1..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/repaint-composited-child-in-scrolled-container-expected.txt
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  "bounds": [800, 600],
-  "children": [
-    {
-      "bounds": [800, 600],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "repaintRects": [
-        [230, 293, 63, 15],
-        [168, 293, 125, 15],
-        [8, 293, 222, 15]
-      ],
-      "paintInvalidationClients": [
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "HorizontalScrollbar"
-      ],
-      "children": [
-        {
-          "position": [8, 8],
-          "bounds": [285, 285],
-          "shouldFlattenTransform": false,
-          "children": [
-            {
-              "position": [-315, 0],
-              "bounds": [600, 600],
-              "contentsOpaque": true,
-              "drawsContent": true,
-              "backgroundColor": "#FF0000",
-              "repaintRects": [
-                [0, 0, 600, 600]
-              ],
-              "paintInvalidationClients": [
-                "LayoutBlockFlow DIV id='inner'"
-              ]
-            }
-          ]
-        }
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/repaint-during-scroll-with-zoom-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
index 54c86235..788ee2a 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
@@ -7,12 +7,8 @@
       "drawsContent": true,
       "backgroundColor": "#C0C0C0",
       "repaintRects": [
-        [237, 78, 15, 222],
-        [237, 65, 15, 28],
-        [237, 64, 15, 15],
-        [17, 299, 220, 16],
-        [3, 299, 28, 16],
-        [2, 299, 15, 16],
+        [237, 64, 15, 236],
+        [2, 299, 235, 16],
         [2, 64, 235, 236],
         [2, 64, 235, 236],
         [2, 64, 235, 236],
@@ -21,24 +17,14 @@
         [2, 64, 58, 17]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
-        "LayoutIFrame (positioned) IFRAME",
-        "HorizontalScrollbar",
-        "LayoutIFrame (positioned) IFRAME",
-        "HorizontalScrollbar",
-        "LayoutIFrame (positioned) IFRAME",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME",
         "LayoutIFrame (positioned) IFRAME",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow BODY",
         "LayoutText #text",
-        "InlineTextBox 'scroll me'"
+        "InlineTextBox 'scroll me'",
+        "HorizontalScrollbar",
+        "VerticalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/resize-scrollable-iframe-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/resize-scrollable-iframe-expected.txt
index d62a990..3142a2ea 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/resize-scrollable-iframe-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/resize-scrollable-iframe-expected.txt
@@ -6,19 +6,13 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
-        [293, 148, 15, 245],
+        [293, 393, 15, 15],
         [293, 108, 15, 285],
-        [293, 108, 15, 285],
-        [293, 108, 15, 80],
-        [293, 108, 15, 40],
         [108, 108, 200, 300],
+        [93, 193, 15, 15],
         [93, 108, 200, 285],
         [93, 108, 15, 85],
-        [48, 393, 245, 15],
         [8, 393, 285, 15],
-        [8, 393, 285, 15],
-        [8, 393, 81, 15],
-        [8, 393, 40, 15],
         [8, 212, 784, 200],
         [8, 208, 300, 200],
         [8, 193, 285, 200],
@@ -29,34 +23,13 @@
       "paintInvalidationClients": [
         "InlineBox",
         "RootInlineBox",
-        "HorizontalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "HorizontalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "HorizontalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "HorizontalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "HorizontalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "HorizontalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
         "LayoutBlockFlow (anonymous)",
         "LayoutBlockFlow (anonymous)",
         "LayoutIFrame IFRAME id='iframe'",
         "LayoutView #document",
+        "LayoutView #document",
+        "HorizontalScrollbar",
+        "VerticalScrollbar",
         "LayoutView #document"
       ]
     }
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/scroll-inside-table-cell-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/scroll-inside-table-cell-expected.txt
deleted file mode 100644
index c3aefc5..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/scroll-inside-table-cell-expected.txt
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  "bounds": [800, 600],
-  "children": [
-    {
-      "bounds": [800, 600],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "repaintRects": [
-        [649, 564, 100, 15],
-        [550, 564, 199, 15],
-        [314, 564, 335, 15],
-        [314, 114, 450, 450],
-        [312, 114, 437, 450],
-        [312, 112, 454, 469]
-      ],
-      "paintInvalidationClients": [
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "LayoutTableCell (relative positioned) TD id='cellToScroll' class='relative'",
-        "LayoutBlockFlow (relative positioned) DIV class='relative red'",
-        "LayoutBlockFlow (positioned) DIV class='absolute green'"
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/scroll-relative-table-inside-table-cell-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/scroll-relative-table-inside-table-cell-expected.txt
deleted file mode 100644
index 01523d8..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/scroll-relative-table-inside-table-cell-expected.txt
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-  "bounds": [1566, 1781],
-  "children": [
-    {
-      "bounds": [1566, 1781],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "repaintRects": [
-        [1449, 1764, 100, 15],
-        [1350, 1764, 199, 15],
-        [1114, 1764, 335, 15],
-        [1114, 1314, 450, 450],
-        [1112, 1314, 437, 450],
-        [1112, 1312, 454, 469]
-      ],
-      "paintInvalidationClients": [
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "LayoutTableCell (relative positioned) TD id='cellToScroll' class='relative'",
-        "LayoutBlockFlow (relative positioned) DIV class='relative red'",
-        "LayoutBlockFlow (positioned) DIV class='absolute green'"
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt
deleted file mode 100644
index 3ea4ca1..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt
+++ /dev/null
@@ -1,37 +0,0 @@
-{
-  "bounds": [800, 600],
-  "children": [
-    {
-      "bounds": [800, 600],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "repaintRects": [
-        [762, 284, 15, 24],
-        [762, 185, 15, 123],
-        [762, 8, 15, 276],
-        [10, 8, 302, 300],
-        [10, 8, 302, 300],
-        [8, 8, 769, 300],
-        [8, 8, 306, 300],
-        [8, 8, 306, 300],
-        [8, 8, 306, 300],
-        [8, 8, 306, 300]
-      ],
-      "paintInvalidationClients": [
-        "VerticalScrollbar",
-        "VerticalScrollbar",
-        "VerticalScrollbar",
-        "LayoutBlockFlow DIV id='innerDiv'",
-        "LayoutTable TABLE",
-        "LayoutTableCell TD",
-        "LayoutTableCell TD",
-        "LayoutTableSection TBODY",
-        "LayoutTableRow TR",
-        "LayoutTableCell TD",
-        "LayoutTableRow TR",
-        "LayoutTableCell TD"
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/table-overflow-scroll-in-overflow-scroll-scrolled-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/table-overflow-scroll-in-overflow-scroll-scrolled-expected.txt
deleted file mode 100644
index 3ea4ca1..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/table-overflow-scroll-in-overflow-scroll-scrolled-expected.txt
+++ /dev/null
@@ -1,37 +0,0 @@
-{
-  "bounds": [800, 600],
-  "children": [
-    {
-      "bounds": [800, 600],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "repaintRects": [
-        [762, 284, 15, 24],
-        [762, 185, 15, 123],
-        [762, 8, 15, 276],
-        [10, 8, 302, 300],
-        [10, 8, 302, 300],
-        [8, 8, 769, 300],
-        [8, 8, 306, 300],
-        [8, 8, 306, 300],
-        [8, 8, 306, 300],
-        [8, 8, 306, 300]
-      ],
-      "paintInvalidationClients": [
-        "VerticalScrollbar",
-        "VerticalScrollbar",
-        "VerticalScrollbar",
-        "LayoutBlockFlow DIV id='innerDiv'",
-        "LayoutTable TABLE",
-        "LayoutTableCell TD",
-        "LayoutTableCell TD",
-        "LayoutTableSection TBODY",
-        "LayoutTableRow TR",
-        "LayoutTableCell TD",
-        "LayoutTableRow TR",
-        "LayoutTableCell TD"
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/text-match-document-change-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/text-match-document-change-expected.txt
index 8ff4f05..45dacf8 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/text-match-document-change-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/text-match-document-change-expected.txt
@@ -6,10 +6,7 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
-        [295, 178, 15, 324],
         [295, 102, 15, 400],
-        [295, 102, 15, 152],
-        [295, 102, 15, 76],
         [18, 164, 269, 338],
         [18, 146, 269, 356],
         [18, 128, 269, 36],
@@ -24,19 +21,12 @@
         "LayoutText #text",
         "RootInlineBox",
         "RootInlineBox",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME id='iframe'",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow DIV id='to-be-changed'",
         "LayoutText #text",
         "InlineTextBox 'After change'",
-        "LayoutBlockFlow DIV"
+        "LayoutBlockFlow DIV",
+        "VerticalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/window-resize-vertical-writing-mode-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/window-resize-vertical-writing-mode-expected.txt
index e304c931..7c96763 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/window-resize-vertical-writing-mode-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/fast/repaint/window-resize-vertical-writing-mode-expected.txt
@@ -20,7 +20,6 @@
         "RootInlineBox",
         "InlineTextBox 'AAAA AAAA AAAA'",
         "InlineTextBox 'AAAA AAAA'",
-        "VerticalScrollbar",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
@@ -49,7 +48,6 @@
         [0, 0, 300, 300]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
diff --git a/third_party/WebKit/LayoutTests/platform/mac/virtual/prefer_compositing_to_lcd_text/compositing/overflow/scrolling-without-painting-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/prefer_compositing_to_lcd_text/compositing/overflow/scrolling-without-painting-expected.txt
deleted file mode 100644
index 2f93caa5..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/virtual/prefer_compositing_to_lcd_text/compositing/overflow/scrolling-without-painting-expected.txt
+++ /dev/null
@@ -1,53 +0,0 @@
-{
-  "bounds": [800, 600],
-  "children": [
-    {
-      "bounds": [800, 600],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "children": [
-        {
-          "position": [8, 8],
-          "bounds": [202, 202],
-          "drawsContent": true,
-          "children": [
-            {
-              "position": [1, 1],
-              "bounds": [185, 185],
-              "children": [
-                {
-                  "bounds": [185, 1025],
-                  "shouldFlattenTransform": false,
-                  "drawsContent": true
-                }
-              ]
-            },
-            {
-              "children": [
-                {
-                  "position": [1, 186],
-                  "bounds": [185, 15]
-                },
-                {
-                  "position": [186, 1],
-                  "bounds": [15, 185],
-                  "repaintRects": [
-                    [0, 0, 15, 185],
-                    [0, 0, 15, 185],
-                    [0, 0, 15, 185]
-                  ]
-                },
-                {
-                  "position": [186, 186],
-                  "bounds": [15, 15],
-                  "drawsContent": true
-                }
-              ]
-            }
-          ]
-        }
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/mac/virtual/prefer_compositing_to_lcd_text/compositing/overflow/updating-scrolling-content-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/prefer_compositing_to_lcd_text/compositing/overflow/updating-scrolling-content-expected.txt
deleted file mode 100644
index 4be9ca9..0000000
--- a/third_party/WebKit/LayoutTests/platform/mac/virtual/prefer_compositing_to_lcd_text/compositing/overflow/updating-scrolling-content-expected.txt
+++ /dev/null
@@ -1,61 +0,0 @@
-{
-  "bounds": [800, 600],
-  "children": [
-    {
-      "bounds": [800, 600],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "children": [
-        {
-          "position": [8, 8],
-          "bounds": [200, 200],
-          "drawsContent": true,
-          "repaintRects": [
-            [0, 0, 185, 200]
-          ],
-          "children": [
-            {
-              "bounds": [185, 185],
-              "children": [
-                {
-                  "bounds": [185, 1200],
-                  "shouldFlattenTransform": false,
-                  "drawsContent": true,
-                  "repaintRects": [
-                    [0, 0, 185, 200]
-                  ],
-                  "paintInvalidationClients": [
-                    "LayoutBlockFlow DIV id='indicator'"
-                  ]
-                }
-              ]
-            },
-            {
-              "children": [
-                {
-                  "position": [0, 185],
-                  "bounds": [185, 15]
-                },
-                {
-                  "position": [185, 0],
-                  "bounds": [15, 185],
-                  "repaintRects": [
-                    [0, 0, 15, 185],
-                    [0, 0, 15, 185],
-                    [0, 0, 15, 185]
-                  ]
-                },
-                {
-                  "position": [185, 185],
-                  "bounds": [15, 15],
-                  "drawsContent": true
-                }
-              ]
-            }
-          ]
-        }
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/mac/compositing/overflow/updating-scrolling-content-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/compositing/repaint/should-not-clip-composited-overflow-scrolling-layer-expected.txt
similarity index 62%
rename from third_party/WebKit/LayoutTests/platform/mac/compositing/overflow/updating-scrolling-content-expected.txt
rename to third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/compositing/repaint/should-not-clip-composited-overflow-scrolling-layer-expected.txt
index 4be9ca9..778ead5 100644
--- a/third_party/WebKit/LayoutTests/platform/mac/compositing/overflow/updating-scrolling-content-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/compositing/repaint/should-not-clip-composited-overflow-scrolling-layer-expected.txt
@@ -8,24 +8,24 @@
       "children": [
         {
           "position": [8, 8],
-          "bounds": [200, 200],
+          "bounds": [500, 500],
           "drawsContent": true,
           "repaintRects": [
-            [0, 0, 185, 200]
+            [-2000, -2000, 5000, 5000]
           ],
           "children": [
             {
-              "bounds": [185, 185],
+              "bounds": [485, 485],
               "children": [
                 {
-                  "bounds": [185, 1200],
+                  "bounds": [5000, 5000],
                   "shouldFlattenTransform": false,
                   "drawsContent": true,
                   "repaintRects": [
-                    [0, 0, 185, 200]
+                    [0, 0, 5000, 5000]
                   ],
                   "paintInvalidationClients": [
-                    "LayoutBlockFlow DIV id='indicator'"
+                    "LayoutBlockFlow DIV id='content'"
                   ]
                 }
               ]
@@ -33,20 +33,21 @@
             {
               "children": [
                 {
-                  "position": [0, 185],
-                  "bounds": [185, 15]
-                },
-                {
-                  "position": [185, 0],
-                  "bounds": [15, 185],
+                  "position": [0, 485],
+                  "bounds": [485, 15],
                   "repaintRects": [
-                    [0, 0, 15, 185],
-                    [0, 0, 15, 185],
-                    [0, 0, 15, 185]
+                    [0, 0, 485, 15]
                   ]
                 },
                 {
-                  "position": [185, 185],
+                  "position": [485, 0],
+                  "bounds": [15, 485],
+                  "repaintRects": [
+                    [0, 0, 15, 485]
+                  ]
+                },
+                {
+                  "position": [485, 485],
                   "bounds": [15, 15],
                   "drawsContent": true
                 }
diff --git a/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/button-checkbox-click-method-repaint-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/button-checkbox-click-method-repaint-expected.txt
new file mode 100644
index 0000000..4a6a7fa
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/button-checkbox-click-method-repaint-expected.txt
@@ -0,0 +1,17 @@
+{
+  "bounds": [800, 600],
+  "children": [
+    {
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [10, 61, 31, 30]
+      ],
+      "paintInvalidationClients": [
+        "LayoutBlockFlow INPUT id='checkbox'"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/details-open-repaint-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/details-open-repaint-expected.txt
new file mode 100644
index 0000000..1767b18
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/details-open-repaint-expected.txt
@@ -0,0 +1,28 @@
+{
+  "bounds": [800, 600],
+  "children": [
+    {
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [11, 71, 125, 13],
+        [8, 68, 784, 19],
+        [8, 68, 131, 19],
+        [8, 54, 11, 11]
+      ],
+      "paintInvalidationClients": [
+        "LayoutDetailsMarker DIV id='details-marker'",
+        "LayoutBlockFlow DIV id='details-content'",
+        "LayoutTextControl INPUT",
+        "LayoutBlockFlow DIV id='inner-editor'",
+        "HorizontalScrollbar",
+        "VerticalScrollbar",
+        "LayoutBlockFlow DIV id='inner-editor'",
+        "LayoutText #text",
+        "LayoutText #text"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/line-flow-with-floats-9-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/line-flow-with-floats-9-expected.txt
similarity index 88%
rename from third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/line-flow-with-floats-9-expected.txt
rename to third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/line-flow-with-floats-9-expected.txt
index 56ddf6d..8f7d6cf8 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/line-flow-with-floats-9-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/line-flow-with-floats-9-expected.txt
@@ -6,13 +6,8 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
-        [485, 282, 15, 288],
-        [485, 15, 15, 585],
         [485, 0, 15, 600],
         [485, 0, 15, 600],
-        [485, 0, 15, 600],
-        [485, 0, 15, 564],
-        [485, 0, 15, 282],
         [372, 389, 48, 81],
         [372, 371, 48, 81],
         [372, 245, 48, 49],
@@ -32,9 +27,7 @@
         [8, 569, 418, 21],
         [0, 0, 500, 600],
         [0, 0, 485, 600],
-        [0, 0, 485, 600],
-        [0, 0, 15, 15],
-        [0, 0, 15, 15]
+        [0, 0, 485, 600]
       ],
       "paintInvalidationClients": [
         "InlineTextBox 'The chief difficulty Alice found at first was in'",
@@ -112,24 +105,9 @@
         "InlineTextBox 'here; the great\n'",
         "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'",
         "RootInlineBox",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "LayoutIFrame IFRAME id='iframe'",
         "InlineTextBox 'here; the great\n'",
         "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'",
         "RootInlineBox",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
@@ -161,7 +139,9 @@
         "InlineTextBox 'become of\n'",
         "InlineTextBox 'me? They\u2019re dreadfully fond of beheading people'",
         "InlineTextBox 'here; the great\n'",
-        "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'"
+        "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'",
+        "VerticalScrollbar",
+        "LayoutView #document"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt
similarity index 99%
copy from third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt
copy to third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt
index 4496a5e..c564a2d 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt
@@ -12,8 +12,8 @@
         [8, 8, 300, 300]
       ],
       "paintInvalidationClients": [
-        "VerticalScrollbar",
         "LayoutBlockFlow DIV id='innerDiv'",
+        "VerticalScrollbar",
         "LayoutBlockFlow DIV",
         "LayoutBlockFlow DIV"
       ]
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-move-after-scroll-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/overflow-move-after-scroll-expected.txt
similarity index 100%
copy from third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-move-after-scroll-expected.txt
copy to third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/overflow-move-after-scroll-expected.txt
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-scroll-after-move-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/overflow-scroll-after-move-expected.txt
similarity index 100%
copy from third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-scroll-after-move-expected.txt
copy to third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/overflow-scroll-after-move-expected.txt
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/overflow-scroll-in-overflow-scroll-scrolled-expected.txt
similarity index 99%
copy from third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt
copy to third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/overflow-scroll-in-overflow-scroll-scrolled-expected.txt
index 4496a5e..c564a2d 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-auto-in-overflow-auto-scrolled-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/overflow-scroll-in-overflow-scroll-scrolled-expected.txt
@@ -12,8 +12,8 @@
         [8, 8, 300, 300]
       ],
       "paintInvalidationClients": [
-        "VerticalScrollbar",
         "LayoutBlockFlow DIV id='innerDiv'",
+        "VerticalScrollbar",
         "LayoutBlockFlow DIV",
         "LayoutBlockFlow DIV"
       ]
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/repaint-composited-child-in-scrolled-container-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/repaint-composited-child-in-scrolled-container-expected.txt
similarity index 100%
copy from third_party/WebKit/LayoutTests/platform/win/fast/repaint/repaint-composited-child-in-scrolled-container-expected.txt
copy to third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/repaint-composited-child-in-scrolled-container-expected.txt
diff --git a/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/repaint-during-scroll-with-zoom-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
new file mode 100644
index 0000000..788ee2a
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
@@ -0,0 +1,32 @@
+{
+  "bounds": [800, 600],
+  "children": [
+    {
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "backgroundColor": "#C0C0C0",
+      "repaintRects": [
+        [237, 64, 15, 236],
+        [2, 299, 235, 16],
+        [2, 64, 235, 236],
+        [2, 64, 235, 236],
+        [2, 64, 235, 236],
+        [2, 64, 225, 226],
+        [2, 64, 135, 136],
+        [2, 64, 58, 17]
+      ],
+      "paintInvalidationClients": [
+        "LayoutIFrame (positioned) IFRAME",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutText #text",
+        "InlineTextBox 'scroll me'",
+        "HorizontalScrollbar",
+        "VerticalScrollbar"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/resize-scrollable-iframe-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/resize-scrollable-iframe-expected.txt
new file mode 100644
index 0000000..3142a2ea
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/resize-scrollable-iframe-expected.txt
@@ -0,0 +1,38 @@
+{
+  "bounds": [800, 600],
+  "children": [
+    {
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [293, 393, 15, 15],
+        [293, 108, 15, 285],
+        [108, 108, 200, 300],
+        [93, 193, 15, 15],
+        [93, 108, 200, 285],
+        [93, 108, 15, 85],
+        [8, 393, 285, 15],
+        [8, 212, 784, 200],
+        [8, 208, 300, 200],
+        [8, 193, 285, 200],
+        [8, 193, 85, 15],
+        [8, 108, 784, 304],
+        [8, 108, 285, 285]
+      ],
+      "paintInvalidationClients": [
+        "InlineBox",
+        "RootInlineBox",
+        "LayoutBlockFlow (anonymous)",
+        "LayoutBlockFlow (anonymous)",
+        "LayoutIFrame IFRAME id='iframe'",
+        "LayoutView #document",
+        "LayoutView #document",
+        "HorizontalScrollbar",
+        "VerticalScrollbar",
+        "LayoutView #document"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/scroll-inside-table-cell-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/scroll-inside-table-cell-expected.txt
similarity index 99%
copy from third_party/WebKit/LayoutTests/platform/win/fast/repaint/scroll-inside-table-cell-expected.txt
copy to third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/scroll-inside-table-cell-expected.txt
index e72a83b..ffa6fa05 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/scroll-inside-table-cell-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/scroll-inside-table-cell-expected.txt
@@ -12,8 +12,8 @@
         [312, 112, 454, 469]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
         "LayoutTableCell (relative positioned) TD id='cellToScroll' class='relative'",
+        "HorizontalScrollbar",
         "LayoutBlockFlow (relative positioned) DIV class='relative red'",
         "LayoutBlockFlow (positioned) DIV class='absolute green'"
       ]
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/scroll-relative-table-inside-table-cell-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/scroll-relative-table-inside-table-cell-expected.txt
similarity index 99%
copy from third_party/WebKit/LayoutTests/platform/win/fast/repaint/scroll-relative-table-inside-table-cell-expected.txt
copy to third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/scroll-relative-table-inside-table-cell-expected.txt
index bf5f9e8..473fed3 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/scroll-relative-table-inside-table-cell-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/scroll-relative-table-inside-table-cell-expected.txt
@@ -12,8 +12,8 @@
         [1112, 1312, 454, 469]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
         "LayoutTableCell (relative positioned) TD id='cellToScroll' class='relative'",
+        "HorizontalScrollbar",
         "LayoutBlockFlow (relative positioned) DIV class='relative red'",
         "LayoutBlockFlow (positioned) DIV class='absolute green'"
       ]
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt
similarity index 99%
copy from third_party/WebKit/LayoutTests/platform/win/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt
copy to third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt
index f871844..4e214a0 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt
@@ -16,8 +16,8 @@
         [8, 8, 306, 300]
       ],
       "paintInvalidationClients": [
-        "VerticalScrollbar",
         "LayoutBlockFlow DIV id='innerDiv'",
+        "VerticalScrollbar",
         "LayoutTable TABLE",
         "LayoutTableCell TD",
         "LayoutTableCell TD",
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/table-overflow-scroll-in-overflow-scroll-scrolled-expected.txt
similarity index 99%
copy from third_party/WebKit/LayoutTests/platform/win/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt
copy to third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/table-overflow-scroll-in-overflow-scroll-scrolled-expected.txt
index f871844..4e214a0 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/table-overflow-auto-in-overflow-auto-scrolled-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/table-overflow-scroll-in-overflow-scroll-scrolled-expected.txt
@@ -16,8 +16,8 @@
         [8, 8, 306, 300]
       ],
       "paintInvalidationClients": [
-        "VerticalScrollbar",
         "LayoutBlockFlow DIV id='innerDiv'",
+        "VerticalScrollbar",
         "LayoutTable TABLE",
         "LayoutTableCell TD",
         "LayoutTableCell TD",
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/text-match-document-change-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/text-match-document-change-expected.txt
similarity index 64%
copy from third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/text-match-document-change-expected.txt
copy to third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/text-match-document-change-expected.txt
index c25c8f1..45dacf8 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/text-match-document-change-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/text-match-document-change-expected.txt
@@ -6,10 +6,7 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
-        [295, 172, 15, 300],
         [295, 102, 15, 400],
-        [295, 102, 15, 141],
-        [295, 102, 15, 70],
         [18, 164, 269, 338],
         [18, 146, 269, 356],
         [18, 128, 269, 36],
@@ -24,19 +21,12 @@
         "LayoutText #text",
         "RootInlineBox",
         "RootInlineBox",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME id='iframe'",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow DIV id='to-be-changed'",
         "LayoutText #text",
         "InlineTextBox 'After change'",
-        "LayoutBlockFlow DIV"
+        "LayoutBlockFlow DIV",
+        "VerticalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/window-resize-vertical-writing-mode-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/window-resize-vertical-writing-mode-expected.txt
new file mode 100644
index 0000000..7c96763
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/fast/repaint/window-resize-vertical-writing-mode-expected.txt
@@ -0,0 +1,121 @@
+{
+  "bounds": [200, 300],
+  "children": [
+    {
+      "bounds": [200, 300],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [174, 8, 18, 284],
+        [174, 8, 18, 248],
+        [166, 0, 34, 300],
+        [156, 8, 36, 184],
+        [156, 8, 36, 147],
+        [148, 0, 52, 200],
+        [0, 200, 200, 100],
+        [0, 0, 200, 300]
+      ],
+      "paintInvalidationClients": [
+        "RootInlineBox",
+        "RootInlineBox",
+        "InlineTextBox 'AAAA AAAA AAAA'",
+        "InlineTextBox 'AAAA AAAA'",
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutText #text",
+        "InlineTextBox 'AAAA AAAA AAAA AAAA AAAA'"
+      ]
+    }
+  ]
+}
+{
+  "bounds": [300, 300],
+  "children": [
+    {
+      "bounds": [300, 300],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [274, 8, 18, 284],
+        [274, 8, 18, 248],
+        [266, 0, 34, 300],
+        [200, 0, 100, 300],
+        [174, 8, 18, 284],
+        [174, 8, 18, 248],
+        [166, 0, 34, 300],
+        [0, 0, 300, 300]
+      ],
+      "paintInvalidationClients": [
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutText #text",
+        "InlineTextBox 'AAAA AAAA AAAA AAAA AAAA'"
+      ]
+    }
+  ]
+}
+{
+  "bounds": [300, 250],
+  "children": [
+    {
+      "bounds": [300, 250],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [274, 8, 18, 284],
+        [274, 8, 18, 248],
+        [266, 0, 34, 300],
+        [256, 8, 36, 234],
+        [256, 8, 36, 197],
+        [248, 0, 52, 250],
+        [0, 250, 300, 50],
+        [0, 0, 300, 250]
+      ],
+      "paintInvalidationClients": [
+        "RootInlineBox",
+        "InlineTextBox 'AAAA AAAA AAAA AAAA AAAA'",
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutText #text",
+        "InlineTextBox 'AAAA AAAA AAAA AAAA'",
+        "InlineTextBox 'AAAA'"
+      ]
+    }
+  ]
+}
+{
+  "bounds": [250, 250],
+  "children": [
+    {
+      "bounds": [250, 250],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [256, 8, 36, 234],
+        [256, 8, 36, 197],
+        [250, 0, 50, 250],
+        [248, 0, 52, 250],
+        [206, 8, 36, 234],
+        [206, 8, 36, 197],
+        [198, 0, 52, 250],
+        [0, 0, 250, 250]
+      ],
+      "paintInvalidationClients": [
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutText #text",
+        "InlineTextBox 'AAAA AAAA AAAA AAAA'",
+        "InlineTextBox 'AAAA'"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/win/paint/invalidation/invalidate-after-composited-scroll-expected.txt b/third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/paint/invalidation/invalidate-after-composited-scroll-expected.txt
similarity index 100%
copy from third_party/WebKit/LayoutTests/platform/win/paint/invalidation/invalidate-after-composited-scroll-expected.txt
copy to third_party/WebKit/LayoutTests/platform/mac/virtual/syncpaint/paint/invalidation/invalidate-after-composited-scroll-expected.txt
diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/compositing/squashing/iframe-inside-squashed-layer-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/compositing/squashing/iframe-inside-squashed-layer-expected.txt
index 51ad163..66fecc6 100644
--- a/third_party/WebKit/LayoutTests/platform/win-xp/compositing/squashing/iframe-inside-squashed-layer-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win-xp/compositing/squashing/iframe-inside-squashed-layer-expected.txt
@@ -21,9 +21,6 @@
               "bounds": [300, 654],
               "drawsContent": true,
               "repaintRects": [
-                [285, 515, 15, 135],
-                [285, 500, 15, 150],
-                [285, 500, 15, 150],
                 [285, 500, 15, 150],
                 [8, 508, 284, 20],
                 [8, 508, 269, 142],
@@ -31,30 +28,19 @@
                 [0, 500, 300, 36],
                 [0, 500, 285, 150],
                 [0, 500, 285, 150],
-                [0, 500, 285, 150],
-                [0, 500, 15, 15],
-                [0, 500, 15, 15]
+                [0, 500, 285, 150]
               ],
               "paintInvalidationClients": [
                 "RootInlineBox",
                 "InlineTextBox 'test1'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
-                "LayoutIFrame IFRAME id='subframe'",
                 "RootInlineBox",
                 "InlineTextBox 'test1'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
                 "LayoutView #document",
                 "LayoutView #document",
                 "LayoutBlockFlow HTML",
-                "LayoutBlockFlow BODY"
+                "LayoutBlockFlow BODY",
+                "VerticalScrollbar",
+                "LayoutView #document"
               ]
             }
           ]
diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/css2.1/t0505-c16-descendant-01-e-expected.png b/third_party/WebKit/LayoutTests/platform/win-xp/css2.1/t0505-c16-descendant-01-e-expected.png
index 4507de8..915f099 100644
--- a/third_party/WebKit/LayoutTests/platform/win-xp/css2.1/t0505-c16-descendant-01-e-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win-xp/css2.1/t0505-c16-descendant-01-e-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/css2.1/t0505-c16-descendant-01-e-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/css2.1/t0505-c16-descendant-01-e-expected.txt
index 8517979..1cc121b 100644
--- a/third_party/WebKit/LayoutTests/platform/win-xp/css2.1/t0505-c16-descendant-01-e-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win-xp/css2.1/t0505-c16-descendant-01-e-expected.txt
@@ -10,8 +10,7 @@
       LayoutBlockFlow {UL} at (0,36) size 784x20 [color=#008000]
         LayoutListItem {LI} at (40,0) size 744x20
           LayoutListMarker (anonymous) at (-18,0) size 7x19: bullet
-          LayoutInline {SPAN} at (0,0) size 4x19 [color=#FF0000]
-            LayoutText {#text} at (0,0) size 4x19
-              text run at (0,0) width 4: " "
-          LayoutText {#text} at (4,0) size 152x19
-            text run at (4,0) width 152: "This line should be green."
+          LayoutInline {SPAN} at (0,0) size 0x0 [color=#FF0000]
+            LayoutText {#text} at (0,0) size 0x0
+          LayoutText {#text} at (0,0) size 152x19
+            text run at (0,0) width 152: "This line should be green."
diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/box-shadow/inset-subpixel-expected.png b/third_party/WebKit/LayoutTests/platform/win-xp/fast/box-shadow/inset-subpixel-expected.png
new file mode 100644
index 0000000..a48285e
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win-xp/fast/box-shadow/inset-subpixel-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/box-shadow/inset-subpixel-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/fast/box-shadow/inset-subpixel-expected.txt
new file mode 100644
index 0000000..a4860e48
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win-xp/fast/box-shadow/inset-subpixel-expected.txt
@@ -0,0 +1,42 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  LayoutBlockFlow {HTML} at (0,0) size 800x600
+    LayoutBlockFlow {BODY} at (8,8) size 784x584
+      LayoutBlockFlow {DIV} at (0,0) size 784x125
+        LayoutBlockFlow {DIV} at (10,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (120,105) size 4x19
+          text run at (120,105) width 4: " "
+        LayoutBlockFlow {DIV} at (134,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (244,105) size 4x19
+          text run at (244,105) width 4: " "
+        LayoutBlockFlow {DIV} at (258,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (368,105) size 4x19
+          text run at (368,105) width 4: " "
+        LayoutBlockFlow {DIV} at (382,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (492,105) size 4x19
+          text run at (492,105) width 4: " "
+        LayoutBlockFlow {DIV} at (506,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (0,0) size 0x0
+      LayoutBlockFlow {DIV} at (0,125) size 784x125
+        LayoutBlockFlow {DIV} at (10,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (120,105) size 4x19
+          text run at (120,105) width 4: " "
+        LayoutBlockFlow {DIV} at (134,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (244,105) size 4x19
+          text run at (244,105) width 4: " "
+        LayoutBlockFlow {DIV} at (258,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (368,105) size 4x19
+          text run at (368,105) width 4: " "
+        LayoutBlockFlow {DIV} at (382,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (492,105) size 4x19
+          text run at (492,105) width 4: " "
+        LayoutBlockFlow {DIV} at (506,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px dashed #008000)]
+        LayoutText {#text} at (0,0) size 0x0
+      LayoutBlockFlow {DIV} at (0,250) size 600x324
+        LayoutInline {SPAN} at (0,0) size 586x307 [bgcolor=#FFFFE0] [border: (5px solid #008000)]
+          LayoutText {#text} at (27,13) size 566x297
+            text run at (27,13) width 566: "This sentence is too"
+            text run at (90,121) width 420: "long to fit on a"
+            text run at (133,229) width 314: "single line."
+        LayoutText {#text} at (0,0) size 0x0
diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/details-open-repaint-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/details-open-repaint-expected.txt
index 2870ac5..fbce702 100644
--- a/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/details-open-repaint-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/details-open-repaint-expected.txt
@@ -16,6 +16,9 @@
         "LayoutBlockFlow DIV id='details-content'",
         "LayoutTextControl INPUT",
         "LayoutBlockFlow DIV id='inner-editor'",
+        "HorizontalScrollbar",
+        "VerticalScrollbar",
+        "LayoutBlockFlow DIV id='inner-editor'",
         "LayoutText #text",
         "LayoutText #text"
       ]
diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/overflow-scroll-body-appear-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/overflow-scroll-body-appear-expected.txt
index 38ec21f5..72c6d6b 100644
--- a/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/overflow-scroll-body-appear-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/overflow-scroll-body-appear-expected.txt
@@ -6,6 +6,7 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
+        [785, 585, 15, 15],
         [8, 52, 784, 20],
         [8, 52, 769, 20],
         [8, 16, 2000, 2072],
@@ -15,9 +16,6 @@
         [0, 0, 785, 585]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
-        "HorizontalScrollbar",
-        "VerticalScrollbar",
         "RootInlineBox",
         "InlineTextBox 'You should see both vertical and horizontal scrollbars.'",
         "RootInlineBox",
@@ -28,7 +26,9 @@
         "LayoutView #document",
         "LayoutBlockFlow BODY",
         "LayoutBlockFlow P",
-        "LayoutBlockFlow P"
+        "LayoutBlockFlow P",
+        "HorizontalScrollbar",
+        "VerticalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/repaint-during-scroll-with-zoom-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
index 059f5b1..e7afc173 100644
--- a/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
@@ -17,16 +17,14 @@
         [2, 64, 52, 18]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
-        "LayoutIFrame (positioned) IFRAME",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME",
         "LayoutIFrame (positioned) IFRAME",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow BODY",
         "LayoutText #text",
-        "InlineTextBox 'scroll me'"
+        "InlineTextBox 'scroll me'",
+        "HorizontalScrollbar",
+        "VerticalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/resize-scrollable-iframe-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/resize-scrollable-iframe-expected.txt
index a44898b..3949115 100644
--- a/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/resize-scrollable-iframe-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/resize-scrollable-iframe-expected.txt
@@ -6,15 +6,13 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
-        [293, 108, 15, 285],
-        [293, 108, 15, 285],
+        [293, 393, 15, 15],
         [293, 108, 15, 285],
         [108, 108, 200, 300],
+        [93, 193, 15, 15],
         [93, 108, 200, 285],
         [93, 108, 15, 85],
         [8, 393, 285, 15],
-        [8, 393, 285, 15],
-        [8, 393, 285, 15],
         [8, 213, 784, 200],
         [8, 208, 300, 200],
         [8, 193, 285, 200],
@@ -25,26 +23,13 @@
       "paintInvalidationClients": [
         "InlineBox",
         "RootInlineBox",
-        "HorizontalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "HorizontalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "HorizontalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "HorizontalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
         "LayoutBlockFlow (anonymous)",
         "LayoutBlockFlow (anonymous)",
         "LayoutIFrame IFRAME id='iframe'",
         "LayoutView #document",
+        "LayoutView #document",
+        "HorizontalScrollbar",
+        "VerticalScrollbar",
         "LayoutView #document"
       ]
     }
diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/shift-relative-positioned-container-with-image-addition-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/shift-relative-positioned-container-with-image-addition-expected.txt
index 51655b8c..7492bce2 100644
--- a/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/shift-relative-positioned-container-with-image-addition-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/shift-relative-positioned-container-with-image-addition-expected.txt
@@ -6,7 +6,6 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
-        [723, 94, 15, 90],
         [58, 236, 489, 537],
         [58, 142, 489, 537],
         [18, 102, 712, 74],
@@ -23,7 +22,7 @@
         [0, 0, 785, 742]
       ],
       "paintInvalidationClients": [
-        "LayoutIFrame IFRAME id='iframe'",
+        "VerticalScrollbar",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
         "LayoutIFrame IFRAME id='iframe'",
@@ -31,6 +30,7 @@
         "LayoutView #document",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow BODY",
+        "LayoutView #document",
         "LayoutBlockFlow (relative positioned) DIV class='relative'",
         "LayoutBlockFlow (relative positioned) DIV class='relative paddingTop'",
         "LayoutImage IMG",
diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/text-match-document-change-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/text-match-document-change-expected.txt
index aaa7e49..b15f962 100644
--- a/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/text-match-document-change-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/text-match-document-change-expected.txt
@@ -7,7 +7,6 @@
       "drawsContent": true,
       "repaintRects": [
         [295, 102, 15, 400],
-        [295, 102, 15, 400],
         [18, 170, 269, 332],
         [18, 150, 269, 352],
         [18, 130, 269, 40],
@@ -22,15 +21,12 @@
         "LayoutText #text",
         "RootInlineBox",
         "RootInlineBox",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME id='iframe'",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow DIV id='to-be-changed'",
         "LayoutText #text",
         "InlineTextBox 'After change'",
-        "LayoutBlockFlow DIV"
+        "LayoutBlockFlow DIV",
+        "VerticalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/window-resize-vertical-writing-mode-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/window-resize-vertical-writing-mode-expected.txt
index 94beeadc..24524fe 100644
--- a/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/window-resize-vertical-writing-mode-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win-xp/fast/repaint/window-resize-vertical-writing-mode-expected.txt
@@ -20,7 +20,6 @@
         "RootInlineBox",
         "InlineTextBox 'AAAA AAAA AAAA'",
         "InlineTextBox 'AAAA AAAA'",
-        "VerticalScrollbar",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
@@ -49,7 +48,6 @@
         [0, 0, 300, 300]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/details-open-repaint-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/details-open-repaint-expected.txt
new file mode 100644
index 0000000..2870ac5
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/details-open-repaint-expected.txt
@@ -0,0 +1,25 @@
+{
+  "bounds": [800, 600],
+  "children": [
+    {
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [10, 75, 149, 16],
+        [8, 72, 784, 22],
+        [8, 72, 153, 22],
+        [8, 57, 11, 11]
+      ],
+      "paintInvalidationClients": [
+        "LayoutDetailsMarker DIV id='details-marker'",
+        "LayoutBlockFlow DIV id='details-content'",
+        "LayoutTextControl INPUT",
+        "LayoutBlockFlow DIV id='inner-editor'",
+        "LayoutText #text",
+        "LayoutText #text"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/line-flow-with-floats-9-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/line-flow-with-floats-9-expected.txt
new file mode 100644
index 0000000..5a5ec87
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/line-flow-with-floats-9-expected.txt
@@ -0,0 +1,93 @@
+{
+  "bounds": [800, 600],
+  "children": [
+    {
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [372, 243, 48, 49],
+        [8, 80, 418, 519]
+      ],
+      "paintInvalidationClients": [
+        "InlineTextBox 'The chief difficulty Alice found at first was in managing her'",
+        "RootInlineBox",
+        "InlineTextBox 'flamingo: she succeeded in getting its body tucked away,'",
+        "RootInlineBox",
+        "InlineTextBox 'comfortably enough, under her arm, with its legs hanging'",
+        "RootInlineBox",
+        "InlineTextBox 'down,\n'",
+        "InlineTextBox 'but generally, just as she had got its neck nicely'",
+        "RootInlineBox",
+        "InlineTextBox 'straightened\n'",
+        "InlineTextBox 'out, and was going to give the hedgehog a'",
+        "RootInlineBox",
+        "InlineTextBox 'blow with its head, it\n'",
+        "InlineTextBox 'would'",
+        "InlineTextBox ' twist itself round and look up in her'",
+        "RootInlineBox",
+        "InlineTextBox 'face, with\n'",
+        "InlineTextBox 'such a puzzled expression that she could not help'",
+        "RootInlineBox",
+        "InlineTextBox 'bursting out\n'",
+        "InlineTextBox 'laughing: and when she had got its head down, and was'",
+        "RootInlineBox",
+        "InlineTextBox 'going to\n'",
+        "InlineTextBox 'begin again, it was very provoking to find that the'",
+        "RootInlineBox",
+        "InlineTextBox 'hedgehog had\n'",
+        "InlineTextBox 'unrolled itself, and was in the act of crawling away:'",
+        "RootInlineBox",
+        "InlineTextBox 'besides all\n'",
+        "InlineTextBox 'this, there was generally a ridge or furrow in the way'",
+        "RootInlineBox",
+        "InlineTextBox 'wherever\n'",
+        "InlineTextBox 'she wanted to send the hedgehog to, and, as the'",
+        "RootInlineBox",
+        "InlineTextBox 'doubled-up\n'",
+        "InlineTextBox 'soldiers were always getting up and walking off to'",
+        "RootInlineBox",
+        "InlineTextBox 'other parts of\n'",
+        "InlineTextBox 'the ground, Alice soon came to the conclusion that it'",
+        "RootInlineBox",
+        "InlineTextBox 'was a very\n'",
+        "InlineTextBox 'difficult game indeed.\n'",
+        "RootInlineBox",
+        "InlineTextBox 'The players all played at once without waiting\n'",
+        "InlineTextBox 'for'",
+        "RootInlineBox",
+        "InlineTextBox 'turns,\n'",
+        "InlineTextBox 'quarrelling all the while, and fighting for the'",
+        "RootInlineBox",
+        "InlineTextBox 'hedgehogs; and in\n'",
+        "InlineTextBox 'a very short time '",
+        "InlineTextBox 'the Queen'",
+        "RootInlineBox",
+        "InlineTextBox 'was in a furious passion, and went\n'",
+        "InlineTextBox 'stamping about, and'",
+        "RootInlineBox",
+        "InlineTextBox 'shouting \u2018Off with his head!\u2019 or \u2018Off with\n'",
+        "InlineTextBox 'her head!\u2019 about'",
+        "RootInlineBox",
+        "InlineTextBox 'once in a minute.\n'",
+        "RootInlineBox",
+        "InlineTextBox 'Alice began to feel very uneasy: to be sure, she had not as\n'",
+        "InlineTextBox 'yet had'",
+        "RootInlineBox",
+        "InlineTextBox 'any dispute with the Queen, but she knew that it might\n'",
+        "InlineTextBox 'happen any'",
+        "RootInlineBox",
+        "InlineTextBox 'minute, \u2018and then,\u2019 thought she, \u2018what would become of\n'",
+        "InlineTextBox 'me?'",
+        "RootInlineBox",
+        "InlineTextBox 'They\u2019re dreadfully fond of beheading people here; the great'",
+        "RootInlineBox",
+        "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'",
+        "RootInlineBox",
+        "LayoutBlockFlow P",
+        "LayoutBlockFlow (floating) SPAN id='yellowFloat'"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/overflow-scroll-body-appear-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/overflow-scroll-body-appear-expected.txt
new file mode 100644
index 0000000..38ec21f5
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/overflow-scroll-body-appear-expected.txt
@@ -0,0 +1,36 @@
+{
+  "bounds": [2008, 2096],
+  "children": [
+    {
+      "bounds": [2008, 2096],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [8, 52, 784, 20],
+        [8, 52, 769, 20],
+        [8, 16, 2000, 2072],
+        [8, 16, 784, 20],
+        [8, 16, 769, 20],
+        [0, 0, 2008, 2096],
+        [0, 0, 785, 585]
+      ],
+      "paintInvalidationClients": [
+        "HorizontalScrollbar",
+        "HorizontalScrollbar",
+        "VerticalScrollbar",
+        "RootInlineBox",
+        "InlineTextBox 'You should see both vertical and horizontal scrollbars.'",
+        "RootInlineBox",
+        "InlineTextBox 'This is the test for '",
+        "InlineTextBox 'Bug 36461 - No vertical scrollbar after the CSS class change'",
+        "InlineTextBox '.'",
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow BODY",
+        "LayoutBlockFlow P",
+        "LayoutBlockFlow P"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/repaint-during-scroll-with-zoom-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
similarity index 60%
rename from third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
rename to third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
index 4572d9c..059f5b1 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
@@ -7,30 +7,18 @@
       "drawsContent": true,
       "backgroundColor": "#C0C0C0",
       "repaintRects": [
-        [237, 78, 15, 192],
-        [237, 65, 15, 27],
-        [237, 64, 15, 15],
-        [16, 299, 191, 16],
-        [3, 299, 26, 16],
-        [2, 299, 14, 16],
+        [237, 64, 15, 236],
+        [2, 299, 235, 16],
         [2, 64, 235, 236],
         [2, 64, 235, 236],
         [2, 64, 235, 236],
         [2, 64, 225, 226],
         [2, 64, 135, 136],
-        [2, 64, 58, 17]
+        [2, 64, 52, 18]
       ],
       "paintInvalidationClients": [
         "HorizontalScrollbar",
         "LayoutIFrame (positioned) IFRAME",
-        "HorizontalScrollbar",
-        "LayoutIFrame (positioned) IFRAME",
-        "HorizontalScrollbar",
-        "LayoutIFrame (positioned) IFRAME",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME",
         "VerticalScrollbar",
         "LayoutIFrame (positioned) IFRAME",
         "LayoutIFrame (positioned) IFRAME",
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/resize-scrollable-iframe-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/resize-scrollable-iframe-expected.txt
similarity index 73%
rename from third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/resize-scrollable-iframe-expected.txt
rename to third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/resize-scrollable-iframe-expected.txt
index a4409204..a44898b 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/resize-scrollable-iframe-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/resize-scrollable-iframe-expected.txt
@@ -6,20 +6,16 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
-        [293, 144, 15, 219],
         [293, 108, 15, 285],
         [293, 108, 15, 285],
-        [293, 108, 15, 72],
-        [293, 108, 15, 36],
+        [293, 108, 15, 285],
         [108, 108, 200, 300],
         [93, 108, 200, 285],
         [93, 108, 15, 85],
-        [44, 393, 219, 15],
         [8, 393, 285, 15],
         [8, 393, 285, 15],
-        [8, 393, 72, 15],
-        [8, 393, 36, 15],
-        [8, 212, 784, 200],
+        [8, 393, 285, 15],
+        [8, 213, 784, 200],
         [8, 208, 300, 200],
         [8, 193, 285, 200],
         [8, 193, 85, 15],
@@ -37,14 +33,6 @@
         "LayoutIFrame IFRAME id='iframe'",
         "HorizontalScrollbar",
         "LayoutIFrame IFRAME id='iframe'",
-        "HorizontalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "HorizontalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
         "VerticalScrollbar",
         "LayoutIFrame IFRAME id='iframe'",
         "VerticalScrollbar",
diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/shift-relative-positioned-container-with-image-addition-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/shift-relative-positioned-container-with-image-addition-expected.txt
new file mode 100644
index 0000000..51655b8c
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/shift-relative-positioned-container-with-image-addition-expected.txt
@@ -0,0 +1,42 @@
+{
+  "bounds": [785, 836],
+  "children": [
+    {
+      "bounds": [785, 836],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [723, 94, 15, 90],
+        [58, 236, 489, 537],
+        [58, 142, 489, 537],
+        [18, 102, 712, 74],
+        [10, 94, 728, 90],
+        [10, 94, 728, 90],
+        [10, 94, 728, 90],
+        [8, 186, 769, 642],
+        [8, 186, 769, 642],
+        [8, 92, 769, 642],
+        [8, 92, 769, 642],
+        [8, 92, 732, 94],
+        [0, 742, 785, 94],
+        [0, 0, 785, 836],
+        [0, 0, 785, 742]
+      ],
+      "paintInvalidationClients": [
+        "LayoutIFrame IFRAME id='iframe'",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutIFrame IFRAME id='iframe'",
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutBlockFlow (relative positioned) DIV class='relative'",
+        "LayoutBlockFlow (relative positioned) DIV class='relative paddingTop'",
+        "LayoutImage IMG",
+        "LayoutText #text"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/text-match-document-change-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/text-match-document-change-expected.txt
similarity index 66%
rename from third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/text-match-document-change-expected.txt
rename to third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/text-match-document-change-expected.txt
index c25c8f1..aaa7e49 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/text-match-document-change-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/text-match-document-change-expected.txt
@@ -6,16 +6,14 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
-        [295, 172, 15, 300],
         [295, 102, 15, 400],
-        [295, 102, 15, 141],
-        [295, 102, 15, 70],
-        [18, 164, 269, 338],
-        [18, 146, 269, 356],
-        [18, 128, 269, 36],
-        [18, 128, 269, 18],
-        [18, 128, 256, 36],
-        [18, 128, 84, 18],
+        [295, 102, 15, 400],
+        [18, 170, 269, 332],
+        [18, 150, 269, 352],
+        [18, 130, 269, 40],
+        [18, 130, 269, 20],
+        [18, 130, 236, 39],
+        [18, 130, 77, 19],
         [10, 102, 285, 400]
       ],
       "paintInvalidationClients": [
@@ -28,10 +26,6 @@
         "LayoutIFrame (positioned) IFRAME id='iframe'",
         "VerticalScrollbar",
         "LayoutIFrame (positioned) IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME id='iframe'",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow DIV id='to-be-changed'",
         "LayoutText #text",
diff --git a/third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/window-resize-vertical-writing-mode-expected.txt b/third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/window-resize-vertical-writing-mode-expected.txt
new file mode 100644
index 0000000..94beeadc
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win-xp/virtual/syncpaint/fast/repaint/window-resize-vertical-writing-mode-expected.txt
@@ -0,0 +1,123 @@
+{
+  "bounds": [200, 300],
+  "children": [
+    {
+      "bounds": [200, 300],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [173, 8, 19, 236],
+        [172, 8, 20, 284],
+        [164, 0, 36, 300],
+        [153, 8, 39, 140],
+        [152, 8, 40, 184],
+        [144, 0, 56, 200],
+        [0, 200, 200, 100],
+        [0, 0, 200, 300]
+      ],
+      "paintInvalidationClients": [
+        "RootInlineBox",
+        "RootInlineBox",
+        "InlineTextBox 'AAAA AAAA AAAA'",
+        "InlineTextBox 'AAAA AAAA'",
+        "VerticalScrollbar",
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutText #text",
+        "InlineTextBox 'AAAA AAAA AAAA AAAA AAAA'"
+      ]
+    }
+  ]
+}
+{
+  "bounds": [300, 300],
+  "children": [
+    {
+      "bounds": [300, 300],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [273, 8, 19, 236],
+        [272, 8, 20, 284],
+        [264, 0, 36, 300],
+        [200, 0, 100, 300],
+        [173, 8, 19, 236],
+        [172, 8, 20, 284],
+        [164, 0, 36, 300],
+        [0, 0, 300, 300]
+      ],
+      "paintInvalidationClients": [
+        "HorizontalScrollbar",
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutText #text",
+        "InlineTextBox 'AAAA AAAA AAAA AAAA AAAA'"
+      ]
+    }
+  ]
+}
+{
+  "bounds": [300, 250],
+  "children": [
+    {
+      "bounds": [300, 250],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [273, 8, 19, 236],
+        [272, 8, 20, 284],
+        [264, 0, 36, 300],
+        [253, 8, 39, 188],
+        [252, 8, 40, 234],
+        [244, 0, 56, 250],
+        [0, 250, 300, 50],
+        [0, 0, 300, 250]
+      ],
+      "paintInvalidationClients": [
+        "RootInlineBox",
+        "InlineTextBox 'AAAA AAAA AAAA AAAA AAAA'",
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutText #text",
+        "InlineTextBox 'AAAA AAAA AAAA AAAA'",
+        "InlineTextBox 'AAAA'"
+      ]
+    }
+  ]
+}
+{
+  "bounds": [250, 250],
+  "children": [
+    {
+      "bounds": [250, 250],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [253, 8, 39, 188],
+        [252, 8, 40, 234],
+        [250, 0, 50, 250],
+        [244, 0, 56, 250],
+        [203, 8, 39, 188],
+        [202, 8, 40, 234],
+        [194, 0, 56, 250],
+        [0, 0, 250, 250]
+      ],
+      "paintInvalidationClients": [
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutText #text",
+        "InlineTextBox 'AAAA AAAA AAAA AAAA'",
+        "InlineTextBox 'AAAA'"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/win/compositing/squashing/iframe-inside-squashed-layer-expected.txt b/third_party/WebKit/LayoutTests/platform/win/compositing/squashing/iframe-inside-squashed-layer-expected.txt
index 5129e1e..743103a 100644
--- a/third_party/WebKit/LayoutTests/platform/win/compositing/squashing/iframe-inside-squashed-layer-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/compositing/squashing/iframe-inside-squashed-layer-expected.txt
@@ -21,9 +21,6 @@
               "bounds": [300, 653],
               "drawsContent": true,
               "repaintRects": [
-                [285, 515, 15, 135],
-                [285, 500, 15, 150],
-                [285, 500, 15, 150],
                 [285, 500, 15, 150],
                 [8, 508, 284, 18],
                 [8, 508, 269, 142],
@@ -31,30 +28,19 @@
                 [0, 500, 300, 34],
                 [0, 500, 285, 150],
                 [0, 500, 285, 150],
-                [0, 500, 285, 150],
-                [0, 500, 15, 15],
-                [0, 500, 15, 15]
+                [0, 500, 285, 150]
               ],
               "paintInvalidationClients": [
                 "RootInlineBox",
                 "InlineTextBox 'test1'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
-                "LayoutIFrame IFRAME id='subframe'",
                 "RootInlineBox",
                 "InlineTextBox 'test1'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
-                "VerticalScrollbar",
-                "LayoutIFrame IFRAME id='subframe'",
                 "LayoutView #document",
                 "LayoutView #document",
                 "LayoutBlockFlow HTML",
-                "LayoutBlockFlow BODY"
+                "LayoutBlockFlow BODY",
+                "VerticalScrollbar",
+                "LayoutView #document"
               ]
             }
           ]
diff --git a/third_party/WebKit/LayoutTests/platform/win/css2.1/t0505-c16-descendant-01-e-expected.png b/third_party/WebKit/LayoutTests/platform/win/css2.1/t0505-c16-descendant-01-e-expected.png
index b4ff7f6..e1cf4ab 100644
--- a/third_party/WebKit/LayoutTests/platform/win/css2.1/t0505-c16-descendant-01-e-expected.png
+++ b/third_party/WebKit/LayoutTests/platform/win/css2.1/t0505-c16-descendant-01-e-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/css2.1/t0505-c16-descendant-01-e-expected.txt b/third_party/WebKit/LayoutTests/platform/win/css2.1/t0505-c16-descendant-01-e-expected.txt
index 900653d..eb58a24 100644
--- a/third_party/WebKit/LayoutTests/platform/win/css2.1/t0505-c16-descendant-01-e-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/css2.1/t0505-c16-descendant-01-e-expected.txt
@@ -10,8 +10,7 @@
       LayoutBlockFlow {UL} at (0,34) size 784x18 [color=#008000]
         LayoutListItem {LI} at (40,0) size 744x18
           LayoutListMarker (anonymous) at (-17,0) size 7x17: bullet
-          LayoutInline {SPAN} at (0,0) size 4x17 [color=#FF0000]
-            LayoutText {#text} at (0,0) size 4x17
-              text run at (0,0) width 4: " "
-          LayoutText {#text} at (4,0) size 166x17
-            text run at (4,0) width 166: "This line should be green."
+          LayoutInline {SPAN} at (0,0) size 0x0 [color=#FF0000]
+            LayoutText {#text} at (0,0) size 0x0
+          LayoutText {#text} at (0,0) size 166x17
+            text run at (0,0) width 166: "This line should be green."
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/box-shadow/inset-subpixel-expected.png b/third_party/WebKit/LayoutTests/platform/win/fast/box-shadow/inset-subpixel-expected.png
new file mode 100644
index 0000000..65b14ce0
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/box-shadow/inset-subpixel-expected.png
Binary files differ
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/box-shadow/inset-subpixel-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/box-shadow/inset-subpixel-expected.txt
new file mode 100644
index 0000000..5c3705b8
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/box-shadow/inset-subpixel-expected.txt
@@ -0,0 +1,42 @@
+layer at (0,0) size 800x600
+  LayoutView at (0,0) size 800x600
+layer at (0,0) size 800x600
+  LayoutBlockFlow {HTML} at (0,0) size 800x600
+    LayoutBlockFlow {BODY} at (8,8) size 784x584
+      LayoutBlockFlow {DIV} at (0,0) size 784x124
+        LayoutBlockFlow {DIV} at (10,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (120,106) size 4x17
+          text run at (120,106) width 4: " "
+        LayoutBlockFlow {DIV} at (134,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (244,106) size 4x17
+          text run at (244,106) width 4: " "
+        LayoutBlockFlow {DIV} at (258,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (368,106) size 4x17
+          text run at (368,106) width 4: " "
+        LayoutBlockFlow {DIV} at (382,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (492,106) size 4x17
+          text run at (492,106) width 4: " "
+        LayoutBlockFlow {DIV} at (506,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (0,0) size 0x0
+      LayoutBlockFlow {DIV} at (0,124) size 784x124
+        LayoutBlockFlow {DIV} at (10,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (120,106) size 4x17
+          text run at (120,106) width 4: " "
+        LayoutBlockFlow {DIV} at (134,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (244,106) size 4x17
+          text run at (244,106) width 4: " "
+        LayoutBlockFlow {DIV} at (258,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (368,106) size 4x17
+          text run at (368,106) width 4: " "
+        LayoutBlockFlow {DIV} at (382,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px solid #008000)]
+        LayoutText {#text} at (492,106) size 4x17
+          text run at (492,106) width 4: " "
+        LayoutBlockFlow {DIV} at (506,10) size 100x100 [bgcolor=#FFFFE0] [border: (10px dashed #008000)]
+        LayoutText {#text} at (0,0) size 0x0
+      LayoutBlockFlow {DIV} at (0,248) size 600x324
+        LayoutInline {SPAN} at (0,0) size 590x306 [bgcolor=#FFFFE0] [border: (5px solid #008000)]
+          LayoutText {#text} at (25,14) size 570x296
+            text run at (25,14) width 570: "This sentence is too"
+            text run at (88,122) width 424: "long to fit on a"
+            text run at (132,230) width 316: "single line."
+        LayoutText {#text} at (0,0) size 0x0
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/button/button-reset-focus-by-mouse-then-keydown-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/forms/button/button-reset-focus-by-mouse-then-keydown-expected.txt
index ddb5cc0..d15b502 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/forms/button/button-reset-focus-by-mouse-then-keydown-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/forms/button/button-reset-focus-by-mouse-then-keydown-expected.txt
@@ -6,14 +6,15 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
+        [16, 11, 34, 16],
+        [16, 11, 34, 16],
         [7, 7, 52, 24]
       ],
       "paintInvalidationClients": [
         "LayoutButton BUTTON",
         "LayoutBlockFlow (anonymous)",
         "LayoutText #text",
-        "InlineTextBox 'Reset'",
-        "LayoutButton BUTTON"
+        "InlineTextBox 'Reset'"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/checkbox/checkbox-focus-by-mouse-then-keydown-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/forms/checkbox/checkbox-focus-by-mouse-then-keydown-expected.txt
index e9c33c2..9bf1229 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/forms/checkbox/checkbox-focus-by-mouse-then-keydown-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/forms/checkbox/checkbox-focus-by-mouse-then-keydown-expected.txt
@@ -9,7 +9,6 @@
         [11, 10, 15, 15]
       ],
       "paintInvalidationClients": [
-        "LayoutBlockFlow INPUT",
         "LayoutBlockFlow INPUT"
       ]
     }
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/radio/radio-focus-by-mouse-then-keydown-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/forms/radio/radio-focus-by-mouse-then-keydown-expected.txt
index 3121335f..2707b38 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/forms/radio/radio-focus-by-mouse-then-keydown-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/forms/radio/radio-focus-by-mouse-then-keydown-expected.txt
@@ -9,7 +9,6 @@
         [12, 10, 15, 15]
       ],
       "paintInvalidationClients": [
-        "LayoutBlockFlow INPUT",
         "LayoutBlockFlow INPUT"
       ]
     }
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/range/range-focus-by-mouse-then-keydown-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/forms/range/range-focus-by-mouse-then-keydown-expected.txt
index cbeaf31e..bda47d4e 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/forms/range/range-focus-by-mouse-then-keydown-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/forms/range/range-focus-by-mouse-then-keydown-expected.txt
@@ -6,14 +6,16 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
+        [69, 10, 11, 21],
+        [10, 10, 129, 21],
+        [10, 10, 129, 21],
         [9, 9, 131, 23]
       ],
       "paintInvalidationClients": [
         "LayoutSlider INPUT",
         "LayoutFlexibleBox DIV",
         "LayoutBlockFlow DIV id='track'",
-        "LayoutBlockFlow DIV id='thumb'",
-        "LayoutSlider INPUT"
+        "LayoutBlockFlow DIV id='thumb'"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/forms/submit/submit-focus-by-mouse-then-keydown-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/forms/submit/submit-focus-by-mouse-then-keydown-expected.txt
index 1f960dd..8ed123e 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/forms/submit/submit-focus-by-mouse-then-keydown-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/forms/submit/submit-focus-by-mouse-then-keydown-expected.txt
@@ -6,14 +6,15 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
+        [16, 11, 41, 16],
+        [16, 11, 41, 16],
         [7, 7, 59, 24]
       ],
       "paintInvalidationClients": [
         "LayoutButton INPUT",
         "LayoutBlockFlow (anonymous)",
         "LayoutText #text",
-        "InlineTextBox 'Submit'",
-        "LayoutButton INPUT"
+        "InlineTextBox 'Submit'"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/button-checkbox-click-method-repaint-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/repaint/button-checkbox-click-method-repaint-expected.txt
index 9f969a7a6..c37e1eb 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/button-checkbox-click-method-repaint-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/repaint/button-checkbox-click-method-repaint-expected.txt
@@ -9,7 +9,6 @@
         [12, 61, 30, 30]
       ],
       "paintInvalidationClients": [
-        "LayoutBlockFlow INPUT id='checkbox'",
         "LayoutBlockFlow INPUT id='checkbox'"
       ]
     }
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/details-open-repaint-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/repaint/details-open-repaint-expected.txt
index da28883..a5b4147 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/details-open-repaint-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/repaint/details-open-repaint-expected.txt
@@ -16,6 +16,9 @@
         "LayoutBlockFlow DIV id='details-content'",
         "LayoutTextControl INPUT",
         "LayoutBlockFlow DIV id='inner-editor'",
+        "HorizontalScrollbar",
+        "VerticalScrollbar",
+        "LayoutBlockFlow DIV id='inner-editor'",
         "LayoutText #text",
         "LayoutText #text"
       ]
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/line-flow-with-floats-9-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/repaint/line-flow-with-floats-9-expected.txt
index 5091d2f..85cbe25 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/line-flow-with-floats-9-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/repaint/line-flow-with-floats-9-expected.txt
@@ -6,9 +6,6 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
-        [485, 15, 15, 585],
-        [485, 0, 15, 600],
-        [485, 0, 15, 600],
         [485, 0, 15, 600],
         [485, 0, 15, 600],
         [372, 389, 48, 81],
@@ -32,9 +29,7 @@
         [8, 569, 418, 21],
         [0, 0, 500, 600],
         [0, 0, 485, 600],
-        [0, 0, 485, 600],
-        [0, 0, 15, 15],
-        [0, 0, 15, 15]
+        [0, 0, 485, 600]
       ],
       "paintInvalidationClients": [
         "InlineTextBox 'The chief difficulty Alice found at first was in'",
@@ -112,20 +107,9 @@
         "InlineTextBox 'here; the great\n'",
         "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'",
         "RootInlineBox",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "LayoutIFrame IFRAME id='iframe'",
         "InlineTextBox 'here; the great\n'",
         "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'",
         "RootInlineBox",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
@@ -170,7 +154,9 @@
         "InlineTextBox 'become of\n'",
         "InlineTextBox 'me? They\u2019re dreadfully fond of beheading people'",
         "InlineTextBox 'here; the great\n'",
-        "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'"
+        "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'",
+        "VerticalScrollbar",
+        "LayoutView #document"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-scroll-in-overflow-scroll-scrolled-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-scroll-in-overflow-scroll-scrolled-expected.txt
deleted file mode 100644
index 4496a5e..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/overflow-scroll-in-overflow-scroll-scrolled-expected.txt
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "bounds": [800, 600],
-  "children": [
-    {
-      "bounds": [800, 600],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "repaintRects": [
-        [762, 8, 15, 300],
-        [8, 8, 769, 300],
-        [8, 8, 300, 300],
-        [8, 8, 300, 300]
-      ],
-      "paintInvalidationClients": [
-        "VerticalScrollbar",
-        "LayoutBlockFlow DIV id='innerDiv'",
-        "LayoutBlockFlow DIV",
-        "LayoutBlockFlow DIV"
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/repaint-during-scroll-with-zoom-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
index 046abf9..a0b3e89 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
@@ -17,16 +17,14 @@
         [2, 64, 58, 16]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
-        "LayoutIFrame (positioned) IFRAME",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME",
         "LayoutIFrame (positioned) IFRAME",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow BODY",
         "LayoutText #text",
-        "InlineTextBox 'scroll me'"
+        "InlineTextBox 'scroll me'",
+        "HorizontalScrollbar",
+        "VerticalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/resize-scrollable-iframe-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/repaint/resize-scrollable-iframe-expected.txt
index 30e75d8..9a47d4b 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/resize-scrollable-iframe-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/repaint/resize-scrollable-iframe-expected.txt
@@ -6,15 +6,13 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
-        [293, 108, 15, 285],
-        [293, 108, 15, 285],
+        [293, 393, 15, 15],
         [293, 108, 15, 285],
         [108, 108, 200, 300],
+        [93, 193, 15, 15],
         [93, 108, 200, 285],
         [93, 108, 15, 85],
         [8, 393, 285, 15],
-        [8, 393, 285, 15],
-        [8, 393, 285, 15],
         [8, 212, 784, 200],
         [8, 208, 300, 200],
         [8, 193, 285, 200],
@@ -25,26 +23,13 @@
       "paintInvalidationClients": [
         "InlineBox",
         "RootInlineBox",
-        "HorizontalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "HorizontalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "HorizontalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "HorizontalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
         "LayoutBlockFlow (anonymous)",
         "LayoutBlockFlow (anonymous)",
         "LayoutIFrame IFRAME id='iframe'",
         "LayoutView #document",
+        "LayoutView #document",
+        "HorizontalScrollbar",
+        "VerticalScrollbar",
         "LayoutView #document"
       ]
     }
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/table-overflow-scroll-in-overflow-scroll-scrolled-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/repaint/table-overflow-scroll-in-overflow-scroll-scrolled-expected.txt
deleted file mode 100644
index f871844..0000000
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/table-overflow-scroll-in-overflow-scroll-scrolled-expected.txt
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  "bounds": [800, 600],
-  "children": [
-    {
-      "bounds": [800, 600],
-      "contentsOpaque": true,
-      "drawsContent": true,
-      "repaintRects": [
-        [762, 8, 15, 300],
-        [10, 8, 302, 300],
-        [10, 8, 302, 300],
-        [8, 8, 769, 300],
-        [8, 8, 306, 300],
-        [8, 8, 306, 300],
-        [8, 8, 306, 300],
-        [8, 8, 306, 300]
-      ],
-      "paintInvalidationClients": [
-        "VerticalScrollbar",
-        "LayoutBlockFlow DIV id='innerDiv'",
-        "LayoutTable TABLE",
-        "LayoutTableCell TD",
-        "LayoutTableCell TD",
-        "LayoutTableSection TBODY",
-        "LayoutTableRow TR",
-        "LayoutTableCell TD",
-        "LayoutTableRow TR",
-        "LayoutTableCell TD"
-      ]
-    }
-  ]
-}
-
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/text-match-document-change-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/repaint/text-match-document-change-expected.txt
index ec8e539c..e286cc9 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/text-match-document-change-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/repaint/text-match-document-change-expected.txt
@@ -7,7 +7,6 @@
       "drawsContent": true,
       "repaintRects": [
         [295, 102, 15, 400],
-        [295, 102, 15, 400],
         [18, 164, 269, 338],
         [18, 146, 269, 356],
         [18, 128, 269, 36],
@@ -22,15 +21,12 @@
         "LayoutText #text",
         "RootInlineBox",
         "RootInlineBox",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME id='iframe'",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow DIV id='to-be-changed'",
         "LayoutText #text",
         "InlineTextBox 'After change'",
-        "LayoutBlockFlow DIV"
+        "LayoutBlockFlow DIV",
+        "VerticalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/window-resize-vertical-writing-mode-expected.txt b/third_party/WebKit/LayoutTests/platform/win/fast/repaint/window-resize-vertical-writing-mode-expected.txt
index c759f07d..503eea7 100644
--- a/third_party/WebKit/LayoutTests/platform/win/fast/repaint/window-resize-vertical-writing-mode-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/fast/repaint/window-resize-vertical-writing-mode-expected.txt
@@ -20,7 +20,6 @@
         "RootInlineBox",
         "InlineTextBox 'AAAA AAAA AAAA'",
         "InlineTextBox 'AAAA AAAA'",
-        "VerticalScrollbar",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
@@ -49,7 +48,6 @@
         [0, 0, 300, 300]
       ],
       "paintInvalidationClients": [
-        "HorizontalScrollbar",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
diff --git a/third_party/WebKit/LayoutTests/platform/win/virtual/syncpaint/fast/repaint/details-open-repaint-expected.txt b/third_party/WebKit/LayoutTests/platform/win/virtual/syncpaint/fast/repaint/details-open-repaint-expected.txt
new file mode 100644
index 0000000..a5b4147
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win/virtual/syncpaint/fast/repaint/details-open-repaint-expected.txt
@@ -0,0 +1,28 @@
+{
+  "bounds": [800, 600],
+  "children": [
+    {
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [10, 71, 169, 16],
+        [8, 68, 784, 22],
+        [8, 68, 173, 22],
+        [8, 54, 11, 11]
+      ],
+      "paintInvalidationClients": [
+        "LayoutDetailsMarker DIV id='details-marker'",
+        "LayoutBlockFlow DIV id='details-content'",
+        "LayoutTextControl INPUT",
+        "LayoutBlockFlow DIV id='inner-editor'",
+        "HorizontalScrollbar",
+        "VerticalScrollbar",
+        "LayoutBlockFlow DIV id='inner-editor'",
+        "LayoutText #text",
+        "LayoutText #text"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/line-flow-with-floats-9-expected.txt b/third_party/WebKit/LayoutTests/platform/win/virtual/syncpaint/fast/repaint/line-flow-with-floats-9-expected.txt
similarity index 84%
copy from third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/line-flow-with-floats-9-expected.txt
copy to third_party/WebKit/LayoutTests/platform/win/virtual/syncpaint/fast/repaint/line-flow-with-floats-9-expected.txt
index 56ddf6d..85cbe25 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/line-flow-with-floats-9-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/virtual/syncpaint/fast/repaint/line-flow-with-floats-9-expected.txt
@@ -6,35 +6,30 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
-        [485, 282, 15, 288],
-        [485, 15, 15, 585],
         [485, 0, 15, 600],
         [485, 0, 15, 600],
-        [485, 0, 15, 600],
-        [485, 0, 15, 564],
-        [485, 0, 15, 282],
         [372, 389, 48, 81],
         [372, 371, 48, 81],
         [372, 245, 48, 49],
         [301, 422, 67, 18],
-        [178, 350, 145, 18],
-        [65, 386, 304, 36],
+        [178, 350, 146, 18],
         [65, 386, 304, 18],
+        [65, 386, 303, 36],
         [65, 368, 304, 18],
         [65, 368, 145, 18],
-        [14, 494, 407, 90],
-        [14, 476, 407, 90],
-        [14, 440, 355, 54],
-        [14, 422, 355, 54],
+        [14, 440, 355, 53],
+        [14, 422, 355, 53],
         [14, 404, 355, 36],
-        [14, 404, 355, 36],
+        [14, 404, 354, 36],
+        [14, 242, 406, 126],
+        [13, 494, 408, 90],
+        [13, 476, 408, 90],
+        [13, 242, 407, 126],
         [8, 572, 418, 18],
         [8, 569, 418, 21],
         [0, 0, 500, 600],
         [0, 0, 485, 600],
-        [0, 0, 485, 600],
-        [0, 0, 15, 15],
-        [0, 0, 15, 15]
+        [0, 0, 485, 600]
       ],
       "paintInvalidationClients": [
         "InlineTextBox 'The chief difficulty Alice found at first was in'",
@@ -112,30 +107,28 @@
         "InlineTextBox 'here; the great\n'",
         "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'",
         "RootInlineBox",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "LayoutIFrame IFRAME id='iframe'",
         "InlineTextBox 'here; the great\n'",
         "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'",
         "RootInlineBox",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame IFRAME id='iframe'",
         "LayoutView #document",
         "LayoutView #document",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow P",
         "LayoutBlockFlow (floating) SPAN id='yellowFloat'",
         "LayoutText #text",
+        "InlineTextBox 'begin again, it was very provoking to find that the'",
+        "InlineTextBox 'hedgehog had\n'",
+        "InlineTextBox 'unrolled itself, and was in the act of'",
+        "InlineTextBox 'crawling away: besides all\n'",
+        "InlineTextBox 'this, there was generally a'",
+        "InlineTextBox 'ridge or furrow in the way wherever\n'",
+        "InlineTextBox 'she wanted to'",
+        "InlineTextBox 'send the hedgehog to, and, as the doubled-up\n'",
+        "InlineTextBox 'soldiers were'",
+        "InlineTextBox 'always getting up and walking off to other parts of\n'",
+        "InlineTextBox 'the ground,'",
+        "InlineTextBox 'Alice soon came to the conclusion that it was a very'",
+        "LayoutText #text",
         "InlineTextBox 'difficult game indeed.\n'",
         "LayoutText #text",
         "InlineTextBox 'The players all played at once without waiting'",
@@ -161,7 +154,9 @@
         "InlineTextBox 'become of\n'",
         "InlineTextBox 'me? They\u2019re dreadfully fond of beheading people'",
         "InlineTextBox 'here; the great\n'",
-        "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'"
+        "InlineTextBox 'wonder is, that there\u2018s any one left alive!\u2019'",
+        "VerticalScrollbar",
+        "LayoutView #document"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/win/virtual/syncpaint/fast/repaint/repaint-during-scroll-with-zoom-expected.txt b/third_party/WebKit/LayoutTests/platform/win/virtual/syncpaint/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
new file mode 100644
index 0000000..a0b3e89
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win/virtual/syncpaint/fast/repaint/repaint-during-scroll-with-zoom-expected.txt
@@ -0,0 +1,32 @@
+{
+  "bounds": [800, 600],
+  "children": [
+    {
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "backgroundColor": "#C0C0C0",
+      "repaintRects": [
+        [237, 64, 15, 236],
+        [2, 299, 235, 16],
+        [2, 64, 235, 236],
+        [2, 64, 235, 236],
+        [2, 64, 235, 236],
+        [2, 64, 225, 226],
+        [2, 64, 135, 136],
+        [2, 64, 58, 16]
+      ],
+      "paintInvalidationClients": [
+        "LayoutIFrame (positioned) IFRAME",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutText #text",
+        "InlineTextBox 'scroll me'",
+        "HorizontalScrollbar",
+        "VerticalScrollbar"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/win/virtual/syncpaint/fast/repaint/resize-scrollable-iframe-expected.txt b/third_party/WebKit/LayoutTests/platform/win/virtual/syncpaint/fast/repaint/resize-scrollable-iframe-expected.txt
new file mode 100644
index 0000000..9a47d4b
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win/virtual/syncpaint/fast/repaint/resize-scrollable-iframe-expected.txt
@@ -0,0 +1,38 @@
+{
+  "bounds": [800, 600],
+  "children": [
+    {
+      "bounds": [800, 600],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [293, 393, 15, 15],
+        [293, 108, 15, 285],
+        [108, 108, 200, 300],
+        [93, 193, 15, 15],
+        [93, 108, 200, 285],
+        [93, 108, 15, 85],
+        [8, 393, 285, 15],
+        [8, 212, 784, 200],
+        [8, 208, 300, 200],
+        [8, 193, 285, 200],
+        [8, 193, 85, 15],
+        [8, 108, 784, 303],
+        [8, 108, 285, 285]
+      ],
+      "paintInvalidationClients": [
+        "InlineBox",
+        "RootInlineBox",
+        "LayoutBlockFlow (anonymous)",
+        "LayoutBlockFlow (anonymous)",
+        "LayoutIFrame IFRAME id='iframe'",
+        "LayoutView #document",
+        "LayoutView #document",
+        "HorizontalScrollbar",
+        "VerticalScrollbar",
+        "LayoutView #document"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/text-match-document-change-expected.txt b/third_party/WebKit/LayoutTests/platform/win/virtual/syncpaint/fast/repaint/text-match-document-change-expected.txt
similarity index 61%
copy from third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/text-match-document-change-expected.txt
copy to third_party/WebKit/LayoutTests/platform/win/virtual/syncpaint/fast/repaint/text-match-document-change-expected.txt
index c25c8f1..e286cc9 100644
--- a/third_party/WebKit/LayoutTests/platform/mac-snowleopard/fast/repaint/text-match-document-change-expected.txt
+++ b/third_party/WebKit/LayoutTests/platform/win/virtual/syncpaint/fast/repaint/text-match-document-change-expected.txt
@@ -6,15 +6,12 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
-        [295, 172, 15, 300],
         [295, 102, 15, 400],
-        [295, 102, 15, 141],
-        [295, 102, 15, 70],
         [18, 164, 269, 338],
         [18, 146, 269, 356],
         [18, 128, 269, 36],
         [18, 128, 269, 18],
-        [18, 128, 256, 36],
+        [18, 128, 257, 36],
         [18, 128, 84, 18],
         [10, 102, 285, 400]
       ],
@@ -24,19 +21,12 @@
         "LayoutText #text",
         "RootInlineBox",
         "RootInlineBox",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME id='iframe'",
-        "VerticalScrollbar",
-        "LayoutIFrame (positioned) IFRAME id='iframe'",
         "LayoutBlockFlow HTML",
         "LayoutBlockFlow DIV id='to-be-changed'",
         "LayoutText #text",
         "InlineTextBox 'After change'",
-        "LayoutBlockFlow DIV"
+        "LayoutBlockFlow DIV",
+        "VerticalScrollbar"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/platform/win/virtual/syncpaint/fast/repaint/window-resize-vertical-writing-mode-expected.txt b/third_party/WebKit/LayoutTests/platform/win/virtual/syncpaint/fast/repaint/window-resize-vertical-writing-mode-expected.txt
new file mode 100644
index 0000000..503eea7
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/platform/win/virtual/syncpaint/fast/repaint/window-resize-vertical-writing-mode-expected.txt
@@ -0,0 +1,121 @@
+{
+  "bounds": [200, 300],
+  "children": [
+    {
+      "bounds": [200, 300],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [175, 8, 17, 248],
+        [174, 8, 18, 284],
+        [166, 0, 34, 300],
+        [157, 8, 35, 147],
+        [156, 8, 36, 184],
+        [148, 0, 52, 200],
+        [0, 200, 200, 100],
+        [0, 0, 200, 300]
+      ],
+      "paintInvalidationClients": [
+        "RootInlineBox",
+        "RootInlineBox",
+        "InlineTextBox 'AAAA AAAA AAAA'",
+        "InlineTextBox 'AAAA AAAA'",
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutText #text",
+        "InlineTextBox 'AAAA AAAA AAAA AAAA AAAA'"
+      ]
+    }
+  ]
+}
+{
+  "bounds": [300, 300],
+  "children": [
+    {
+      "bounds": [300, 300],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [275, 8, 17, 248],
+        [274, 8, 18, 284],
+        [266, 0, 34, 300],
+        [200, 0, 100, 300],
+        [175, 8, 17, 248],
+        [174, 8, 18, 284],
+        [166, 0, 34, 300],
+        [0, 0, 300, 300]
+      ],
+      "paintInvalidationClients": [
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutText #text",
+        "InlineTextBox 'AAAA AAAA AAAA AAAA AAAA'"
+      ]
+    }
+  ]
+}
+{
+  "bounds": [300, 250],
+  "children": [
+    {
+      "bounds": [300, 250],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [275, 8, 17, 248],
+        [274, 8, 18, 284],
+        [266, 0, 34, 300],
+        [257, 8, 35, 197],
+        [256, 8, 36, 234],
+        [248, 0, 52, 250],
+        [0, 250, 300, 50],
+        [0, 0, 300, 250]
+      ],
+      "paintInvalidationClients": [
+        "RootInlineBox",
+        "InlineTextBox 'AAAA AAAA AAAA AAAA AAAA'",
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutText #text",
+        "InlineTextBox 'AAAA AAAA AAAA AAAA'",
+        "InlineTextBox 'AAAA'"
+      ]
+    }
+  ]
+}
+{
+  "bounds": [250, 250],
+  "children": [
+    {
+      "bounds": [250, 250],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [257, 8, 35, 197],
+        [256, 8, 36, 234],
+        [250, 0, 50, 250],
+        [248, 0, 52, 250],
+        [207, 8, 35, 197],
+        [206, 8, 36, 234],
+        [198, 0, 52, 250],
+        [0, 0, 250, 250]
+      ],
+      "paintInvalidationClients": [
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutText #text",
+        "InlineTextBox 'AAAA AAAA AAAA AAAA'",
+        "InlineTextBox 'AAAA'"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/resources/accessibility-helper.js b/third_party/WebKit/LayoutTests/resources/accessibility-helper.js
index 66235a3..3c0d2c8 100644
--- a/third_party/WebKit/LayoutTests/resources/accessibility-helper.js
+++ b/third_party/WebKit/LayoutTests/resources/accessibility-helper.js
@@ -10,14 +10,17 @@
     for (var i = 0; i < indent; i++)
         str += "    ";
     str += accessibilityObject.role;
-    str += " " + accessibilityObject.stringValue;
+    if (accessibilityObject.value)
+        str += " AXValue: " + accessibilityObject.value;
+    else if (accessibilityObject.name)
+        str += " \"" + accessibilityObject.name + "\"";
     str += allAttributesRequired && accessibilityObject.role == '' ? accessibilityObject.allAttributes() : '';
     str += targetObject && accessibilityObject.isEqual(targetObject) ? "     " + targetString : '';
     str += "\n";
 
     document.getElementById("console").innerText += str;
 
-    if (accessibilityObject.stringValue.indexOf('End of test') >= 0)
+    if (accessibilityObject.name.indexOf('End of test') >= 0)
         return false;
 
     var count = accessibilityObject.childrenCount;
diff --git a/third_party/WebKit/LayoutTests/svg/as-object/nested-embedded-svg-size-changes-no-layout-triggers-1-expected.txt b/third_party/WebKit/LayoutTests/svg/as-object/nested-embedded-svg-size-changes-no-layout-triggers-1-expected.txt
index 62ebeb5..9d685de1 100644
--- a/third_party/WebKit/LayoutTests/svg/as-object/nested-embedded-svg-size-changes-no-layout-triggers-1-expected.txt
+++ b/third_party/WebKit/LayoutTests/svg/as-object/nested-embedded-svg-size-changes-no-layout-triggers-1-expected.txt
@@ -6,21 +6,21 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
-        [386, 136, 15, 65],
-        [386, 1, 15, 200],
+        [285, 135, 15, 15],
+        [285, 0, 15, 135],
         [211, 11, 180, 180],
         [210, 10, 180, 180],
         [11, 11, 380, 180],
         [11, 11, 180, 180],
         [10, 10, 380, 180],
         [10, 10, 180, 180],
-        [1, 186, 400, 15],
         [1, 1, 400, 200],
         [1, 1, 400, 200],
         [1, 1, 400, 200],
         [1, 1, 400, 200],
         [1, 1, 400, 200],
         [1, 1, 400, 200],
+        [0, 135, 285, 15],
         [0, 0, 800, 202],
         [0, 0, 402, 202],
         [0, 0, 300, 150],
@@ -33,11 +33,10 @@
       "paintInvalidationClients": [
         "InlineBox",
         "RootInlineBox",
-        "LayoutEmbeddedObject OBJECT",
+        "HorizontalScrollbar",
+        "VerticalScrollbar",
         "RootInlineBox",
         "InlineBox",
-        "LayoutEmbeddedObject OBJECT",
-        "LayoutEmbeddedObject OBJECT",
         "RootInlineBox",
         "InlineBox",
         "LayoutBlockFlow BODY",
@@ -51,7 +50,8 @@
         "LayoutSVGRoot svg",
         "LayoutSVGRect rect",
         "LayoutSVGRect rect",
-        "LayoutText #text"
+        "LayoutText #text",
+        "LayoutView #document"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/svg/as-object/nested-embedded-svg-size-changes-no-layout-triggers-2-expected.txt b/third_party/WebKit/LayoutTests/svg/as-object/nested-embedded-svg-size-changes-no-layout-triggers-2-expected.txt
index 62ebeb5..9d685de1 100644
--- a/third_party/WebKit/LayoutTests/svg/as-object/nested-embedded-svg-size-changes-no-layout-triggers-2-expected.txt
+++ b/third_party/WebKit/LayoutTests/svg/as-object/nested-embedded-svg-size-changes-no-layout-triggers-2-expected.txt
@@ -6,21 +6,21 @@
       "contentsOpaque": true,
       "drawsContent": true,
       "repaintRects": [
-        [386, 136, 15, 65],
-        [386, 1, 15, 200],
+        [285, 135, 15, 15],
+        [285, 0, 15, 135],
         [211, 11, 180, 180],
         [210, 10, 180, 180],
         [11, 11, 380, 180],
         [11, 11, 180, 180],
         [10, 10, 380, 180],
         [10, 10, 180, 180],
-        [1, 186, 400, 15],
         [1, 1, 400, 200],
         [1, 1, 400, 200],
         [1, 1, 400, 200],
         [1, 1, 400, 200],
         [1, 1, 400, 200],
         [1, 1, 400, 200],
+        [0, 135, 285, 15],
         [0, 0, 800, 202],
         [0, 0, 402, 202],
         [0, 0, 300, 150],
@@ -33,11 +33,10 @@
       "paintInvalidationClients": [
         "InlineBox",
         "RootInlineBox",
-        "LayoutEmbeddedObject OBJECT",
+        "HorizontalScrollbar",
+        "VerticalScrollbar",
         "RootInlineBox",
         "InlineBox",
-        "LayoutEmbeddedObject OBJECT",
-        "LayoutEmbeddedObject OBJECT",
         "RootInlineBox",
         "InlineBox",
         "LayoutBlockFlow BODY",
@@ -51,7 +50,8 @@
         "LayoutSVGRoot svg",
         "LayoutSVGRect rect",
         "LayoutSVGRect rect",
-        "LayoutText #text"
+        "LayoutText #text",
+        "LayoutView #document"
       ]
     }
   ]
diff --git a/third_party/WebKit/LayoutTests/svg/hittest/rotated-text-expected.txt b/third_party/WebKit/LayoutTests/svg/hittest/rotated-text-expected.txt
new file mode 100644
index 0000000..f7f0fa5
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/hittest/rotated-text-expected.txt
@@ -0,0 +1,3 @@
+PASS
+PASS
+
diff --git a/third_party/WebKit/LayoutTests/svg/hittest/rotated-text.svg b/third_party/WebKit/LayoutTests/svg/hittest/rotated-text.svg
new file mode 100644
index 0000000..3ad3fcd
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/hittest/rotated-text.svg
@@ -0,0 +1,45 @@
+<svg onload="runTest()" width="500" height="150" viewBox="0 0 500 150" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+    <script src="../../resources/ahem.js"></script>
+    <rect id="background" width="100%" height="100%" fill="blue" />
+    <text id="upright" x="1em" y="1em">A B</text>
+    <text id="rotated" x="1em" y="3em" rotate="45 -45 -45 0">A B C</text>
+    <defs>
+        <style type="text/css">
+        <![CDATA[
+            text {
+                font-family: Ahem;
+                font-size: 40px;
+            }
+        ]]>
+        </style>
+        <script type="text/javascript">
+        <![CDATA[
+            function runTest() {
+                if (window.testRunner)
+                    testRunner.dumpAsText();
+
+                var uprightText = document.getElementById("upright");
+                var rotatedText = document.getElementById("rotated");
+                var background = document.getElementById("background");
+
+                // (135,25) is within a glyph cell of #upright, (165,25) is not.
+                if (document.elementFromPoint(135, 25) === uprightText && document.elementFromPoint(165, 25) === background)
+                    uprightText.textContent = "PASS";
+                else
+                    uprightText.textContent = "FAIL";
+
+                // (45,100) and (150,110) are both outside the rotated glyph cells of #rotated.
+                // (60,140), (125,110), and (220,110) are all inside the rotated glyph cells of #rotated.
+                if (document.elementFromPoint(45, 100) === background
+                        && document.elementFromPoint(150, 110) === background
+                        && document.elementFromPoint(60, 140) === rotatedText
+                        && document.elementFromPoint(125, 110) === rotatedText
+                        && document.elementFromPoint(220, 110) === rotatedText)
+                    rotatedText.textContent = "PASS";
+                else
+                    rotatedText.textContent = "FAIL";
+            }
+        ]]>
+        </script>
+    </defs>
+</svg>
diff --git a/third_party/WebKit/LayoutTests/svg/hittest/text-dominant-baseline-hanging-expected.txt b/third_party/WebKit/LayoutTests/svg/hittest/text-dominant-baseline-hanging-expected.txt
new file mode 100644
index 0000000..69cfc5a9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/hittest/text-dominant-baseline-hanging-expected.txt
@@ -0,0 +1,2 @@
+PASS
+
diff --git a/third_party/WebKit/LayoutTests/svg/hittest/text-dominant-baseline-hanging.svg b/third_party/WebKit/LayoutTests/svg/hittest/text-dominant-baseline-hanging.svg
new file mode 100644
index 0000000..a5acc11
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/hittest/text-dominant-baseline-hanging.svg
@@ -0,0 +1,29 @@
+<svg onload="runTest()" width="500" height="150" viewBox="0 0 1000 300" xmlns="http://www.w3.org/2000/svg">
+    <script src="../../resources/ahem.js"></script>
+    <text id="text" dominant-baseline="hanging" x="10" y="10">Foo</text>
+    <defs>
+        <style type="text/css">
+        <![CDATA[
+            text {
+                font-family: Ahem;
+                font-size: 40px;
+            }
+        ]]>
+        </style>
+        <script type="text/javascript">
+        <![CDATA[
+            function runTest() {
+                if (window.testRunner)
+                    testRunner.dumpAsText();
+
+                // (15,15) is contained within a glyph cell of #text.
+                var text = document.getElementById("text");
+                if (document.elementFromPoint(15, 15) === text)
+                    text.textContent = "PASS";
+                else
+                    text.textContent = "FAIL";
+            }
+        ]]>
+        </script>
+    </defs>
+</svg>
diff --git a/third_party/WebKit/LayoutTests/svg/hittest/text-multiple-dx-values-expected.txt b/third_party/WebKit/LayoutTests/svg/hittest/text-multiple-dx-values-expected.txt
new file mode 100644
index 0000000..69cfc5a9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/hittest/text-multiple-dx-values-expected.txt
@@ -0,0 +1,2 @@
+PASS
+
diff --git a/third_party/WebKit/LayoutTests/svg/hittest/text-multiple-dx-values.svg b/third_party/WebKit/LayoutTests/svg/hittest/text-multiple-dx-values.svg
new file mode 100644
index 0000000..7518e47
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/hittest/text-multiple-dx-values.svg
@@ -0,0 +1,31 @@
+<svg onload="runTest()" width="500" height="150" viewBox="0 0 1000 300" xmlns="http://www.w3.org/2000/svg">
+    <script src="../../resources/ahem.js"></script>
+    <rect id="background" width="100%" height="100%" fill="blue" />
+    <text id="text" x="10" y="1em" dx="0 50 100">Foo</text>
+    <defs>
+        <style type="text/css">
+        <![CDATA[
+            text {
+                font-family: Ahem;
+                font-size: 40px;
+            }
+        ]]>
+        </style>
+        <script type="text/javascript">
+        <![CDATA[
+            function runTest() {
+                if (window.testRunner)
+                    testRunner.dumpAsText();
+
+                // (15,15) is within a glyph cell of #text, (35,15) is not.
+                var text = document.getElementById("text");
+                var background = document.getElementById("background");
+                if (document.elementFromPoint(15, 15) === text && document.elementFromPoint(35, 15) === background)
+                    text.textContent = "PASS";
+                else
+                    text.textContent = "FAIL";
+            }
+        ]]>
+        </script>
+    </defs>
+</svg>
diff --git a/third_party/WebKit/LayoutTests/svg/hittest/text-with-multiple-tspans-expected.txt b/third_party/WebKit/LayoutTests/svg/hittest/text-with-multiple-tspans-expected.txt
new file mode 100644
index 0000000..69cfc5a9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/hittest/text-with-multiple-tspans-expected.txt
@@ -0,0 +1,2 @@
+PASS
+
diff --git a/third_party/WebKit/LayoutTests/svg/hittest/text-with-multiple-tspans.svg b/third_party/WebKit/LayoutTests/svg/hittest/text-with-multiple-tspans.svg
new file mode 100644
index 0000000..d38fedf5
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/hittest/text-with-multiple-tspans.svg
@@ -0,0 +1,40 @@
+<svg onload="runTest()" xmlns="http://www.w3.org/2000/svg" width="300" height="150" viewBox="0 0 300 150">
+    <script src="../../resources/ahem.js"></script>
+    <rect id="background" width="100%" height="100%" fill="blue" />
+    <text id="text">
+        <tspan id="tspan1" x="10" dy="1em">Foo</tspan>
+        <tspan id="tspan2" x="10" dy="1.2em">Foo bar baz</tspan>
+    </text>
+    <defs>
+        <style type="text/css">
+        <![CDATA[
+            text {
+                font-family: Ahem;
+                font-size: 40px;
+            }
+        ]]>
+        </style>
+        <script type="text/javascript">
+        <![CDATA[
+            function runTest() {
+                if (window.testRunner)
+                    testRunner.dumpAsText();
+
+                // (170,30) is within a glyph cell of #tspan1, (170,30) is not.
+                // (50,60) and (250,60) are bothin within a glyph cell of #tspan2.
+                var text = document.getElementById("text");
+                var tspan1 = document.getElementById("tspan1");
+                var tspan2 = document.getElementById("tspan2");
+                var background = document.getElementById("background");
+                if (document.elementFromPoint(50, 30) === tspan1
+                        && document.elementFromPoint(170, 30) === background
+                        && document.elementFromPoint(50, 60) === tspan2
+                        && document.elementFromPoint(250, 60) === tspan2)
+                    text.textContent = "PASS";
+                else
+                    text.textContent = "FAIL";
+            }
+        ]]>
+        </script>
+    </defs>
+</svg>
diff --git a/third_party/WebKit/LayoutTests/svg/hittest/text-with-text-node-and-content-elements-expected.txt b/third_party/WebKit/LayoutTests/svg/hittest/text-with-text-node-and-content-elements-expected.txt
new file mode 100644
index 0000000..69cfc5a9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/hittest/text-with-text-node-and-content-elements-expected.txt
@@ -0,0 +1,2 @@
+PASS
+
diff --git a/third_party/WebKit/LayoutTests/svg/hittest/text-with-text-node-and-content-elements.svg b/third_party/WebKit/LayoutTests/svg/hittest/text-with-text-node-and-content-elements.svg
new file mode 100644
index 0000000..61548b6f
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/hittest/text-with-text-node-and-content-elements.svg
@@ -0,0 +1,30 @@
+<svg onload="runTest()" width="500" height="150" viewBox="0 0 1000 300" xmlns="http://www.w3.org/2000/svg">
+    <script src="../../resources/ahem.js"></script>
+    <text id="text" x="10" y="1em">AAA <tspan id="tspan">BBB</tspan> CCC</text>
+    <defs>
+        <style type="text/css">
+        <![CDATA[
+            text {
+                font-family: Ahem;
+                font-size: 40px;
+            }
+        ]]>
+        </style>
+        <script type="text/javascript">
+        <![CDATA[
+            function runTest() {
+                if (window.testRunner)
+                    testRunner.dumpAsText();
+
+                // (15,15) is within an 'A' glyph cell of #text.
+                // (110,15) is within a 'B' glyph cell of #tspan.
+                var text = document.getElementById("text");
+                if (document.elementFromPoint(15, 15) === text && document.elementFromPoint(110, 15) === document.getElementById("tspan"))
+                    text.textContent = "PASS";
+                else
+                    text.textContent = "FAIL";
+            }
+        ]]>
+        </script>
+    </defs>
+</svg>
diff --git a/third_party/WebKit/LayoutTests/svg/hittest/text-with-text-node-only-expected.txt b/third_party/WebKit/LayoutTests/svg/hittest/text-with-text-node-only-expected.txt
new file mode 100644
index 0000000..69cfc5a9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/hittest/text-with-text-node-only-expected.txt
@@ -0,0 +1,2 @@
+PASS
+
diff --git a/third_party/WebKit/LayoutTests/svg/hittest/text-with-text-node-only.svg b/third_party/WebKit/LayoutTests/svg/hittest/text-with-text-node-only.svg
new file mode 100644
index 0000000..6764b4b
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/hittest/text-with-text-node-only.svg
@@ -0,0 +1,29 @@
+<svg onload="runTest()" width="500" height="150" viewBox="0 0 1000 300" xmlns="http://www.w3.org/2000/svg">
+    <script src="../../resources/ahem.js"></script>
+    <text id="text" x="10" y="1em">Foo</text>
+    <defs>
+        <style type="text/css">
+        <![CDATA[
+            text {
+                font-family: Ahem;
+                font-size: 40px;
+            }
+        ]]>
+        </style>
+        <script type="text/javascript">
+        <![CDATA[
+            function runTest() {
+                if (window.testRunner)
+                    testRunner.dumpAsText();
+
+                // (15,15) is contained within #text's glyph cell bounds.
+                var text = document.getElementById("text");
+                if (document.elementFromPoint(15, 15) === text)
+                    text.textContent = "PASS";
+                else
+                    text.textContent = "FAIL";
+            }
+        ]]>
+        </script>
+    </defs>
+</svg>
diff --git a/third_party/WebKit/LayoutTests/svg/hittest/text-with-text-path-expected.txt b/third_party/WebKit/LayoutTests/svg/hittest/text-with-text-path-expected.txt
new file mode 100644
index 0000000..69cfc5a9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/hittest/text-with-text-path-expected.txt
@@ -0,0 +1,2 @@
+PASS
+
diff --git a/third_party/WebKit/LayoutTests/svg/hittest/text-with-text-path.svg b/third_party/WebKit/LayoutTests/svg/hittest/text-with-text-path.svg
new file mode 100644
index 0000000..fdda5f2
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/svg/hittest/text-with-text-path.svg
@@ -0,0 +1,39 @@
+<svg onload="runTest()" width="500" height="150" viewBox="0 0 500 150" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+    <script src="../../resources/ahem.js"></script>
+    <rect id="background" width="100%" height="100%" fill="blue" />
+    <text id="text">
+        <textPath id="textPath" xlink:href="#path">This is text on a path</textPath>
+    </text>
+    <defs>
+        <path id="path"
+              d="M 100 200
+              C 200 100 300   0 400 100
+              C 500 200 600 300 700 200
+              C 800 100 900 100 900 100" />
+        <style type="text/css">
+        <![CDATA[
+            text {
+                font-family: Ahem;
+                font-size: 40px;
+            }
+        ]]>
+        </style>
+        <script type="text/javascript">
+        <![CDATA[
+            function runTest() {
+                if (window.testRunner)
+                    testRunner.dumpAsText();
+
+                // (160,120) is within #path's glyph cell bounds, (100,100) is not.
+                var text = document.getElementById("text");
+                var background = document.getElementById("background");
+                var textPath = document.getElementById("textPath");
+                if (document.elementFromPoint(160, 120) === textPath && document.elementFromPoint(100, 100) === background)
+                    text.textContent = "PASS";
+                else
+                    text.textContent = "FAIL";
+            }
+        ]]>
+        </script>
+    </defs>
+</svg>
diff --git a/third_party/WebKit/LayoutTests/platform/win/virtual/prefer_compositing_to_lcd_text/compositing/overflow/scrolling-without-painting-expected.txt b/third_party/WebKit/LayoutTests/virtual/prefer_compositing_to_lcd_text/compositing/overflow/scrolling-without-painting-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/virtual/prefer_compositing_to_lcd_text/compositing/overflow/scrolling-without-painting-expected.txt
rename to third_party/WebKit/LayoutTests/virtual/prefer_compositing_to_lcd_text/compositing/overflow/scrolling-without-painting-expected.txt
diff --git a/third_party/WebKit/LayoutTests/platform/win/virtual/prefer_compositing_to_lcd_text/compositing/overflow/updating-scrolling-content-expected.txt b/third_party/WebKit/LayoutTests/virtual/prefer_compositing_to_lcd_text/compositing/overflow/updating-scrolling-content-expected.txt
similarity index 100%
rename from third_party/WebKit/LayoutTests/platform/win/virtual/prefer_compositing_to_lcd_text/compositing/overflow/updating-scrolling-content-expected.txt
rename to third_party/WebKit/LayoutTests/virtual/prefer_compositing_to_lcd_text/compositing/overflow/updating-scrolling-content-expected.txt
diff --git a/third_party/WebKit/LayoutTests/virtual/stable/webexposed/global-interface-listing-expected.txt b/third_party/WebKit/LayoutTests/virtual/stable/webexposed/global-interface-listing-expected.txt
index 4311a8b..689838d 100644
--- a/third_party/WebKit/LayoutTests/virtual/stable/webexposed/global-interface-listing-expected.txt
+++ b/third_party/WebKit/LayoutTests/virtual/stable/webexposed/global-interface-listing-expected.txt
@@ -3003,7 +3003,6 @@
     method constructor
     method getBattery
     method getGamepads
-    method getStorageUpdates
     method javaEnabled
     method registerProtocolHandler
     method requestMIDIAccess
diff --git a/third_party/WebKit/LayoutTests/virtual/syncpaint/fast/repaint/overflow-scroll-body-appear-expected.txt b/third_party/WebKit/LayoutTests/virtual/syncpaint/fast/repaint/overflow-scroll-body-appear-expected.txt
new file mode 100644
index 0000000..d62068de
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/virtual/syncpaint/fast/repaint/overflow-scroll-body-appear-expected.txt
@@ -0,0 +1,36 @@
+{
+  "bounds": [2008, 2092],
+  "children": [
+    {
+      "bounds": [2008, 2092],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [785, 585, 15, 15],
+        [8, 50, 784, 18],
+        [8, 50, 769, 18],
+        [8, 16, 2000, 2068],
+        [8, 16, 784, 18],
+        [8, 16, 769, 18],
+        [0, 0, 2008, 2092],
+        [0, 0, 785, 585]
+      ],
+      "paintInvalidationClients": [
+        "RootInlineBox",
+        "InlineTextBox 'You should see both vertical and horizontal scrollbars.'",
+        "RootInlineBox",
+        "InlineTextBox 'This is the test for '",
+        "InlineTextBox 'Bug 36461 - No vertical scrollbar after the CSS class change'",
+        "InlineTextBox '.'",
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow BODY",
+        "LayoutBlockFlow P",
+        "LayoutBlockFlow P",
+        "HorizontalScrollbar",
+        "VerticalScrollbar"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/virtual/syncpaint/fast/repaint/shift-relative-positioned-container-with-image-addition-expected.txt b/third_party/WebKit/LayoutTests/virtual/syncpaint/fast/repaint/shift-relative-positioned-container-with-image-addition-expected.txt
new file mode 100644
index 0000000..cacd72eb
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/virtual/syncpaint/fast/repaint/shift-relative-positioned-container-with-image-addition-expected.txt
@@ -0,0 +1,42 @@
+{
+  "bounds": [785, 829],
+  "children": [
+    {
+      "bounds": [785, 829],
+      "contentsOpaque": true,
+      "drawsContent": true,
+      "repaintRects": [
+        [58, 230, 489, 537],
+        [58, 136, 489, 537],
+        [18, 96, 712, 74],
+        [10, 88, 728, 90],
+        [10, 88, 728, 90],
+        [10, 88, 728, 90],
+        [8, 180, 769, 641],
+        [8, 180, 769, 641],
+        [8, 86, 769, 641],
+        [8, 86, 769, 641],
+        [8, 86, 732, 94],
+        [0, 735, 785, 94],
+        [0, 0, 785, 829],
+        [0, 0, 785, 735]
+      ],
+      "paintInvalidationClients": [
+        "VerticalScrollbar",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutIFrame IFRAME id='iframe'",
+        "LayoutView #document",
+        "LayoutView #document",
+        "LayoutBlockFlow HTML",
+        "LayoutBlockFlow BODY",
+        "LayoutView #document",
+        "LayoutBlockFlow (relative positioned) DIV class='relative'",
+        "LayoutBlockFlow (relative positioned) DIV class='relative paddingTop'",
+        "LayoutImage IMG",
+        "LayoutText #text"
+      ]
+    }
+  ]
+}
+
diff --git a/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt b/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
index 33088f5..2a22fe9 100644
--- a/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
+++ b/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
@@ -3468,7 +3468,6 @@
     method constructor
     method getBattery
     method getGamepads
-    method getStorageUpdates
     method getVRDevices
     method isProtocolHandlerRegistered
     method javaEnabled
diff --git a/third_party/WebKit/PRESUBMIT.py b/third_party/WebKit/PRESUBMIT.py
index 435286e..ca89625 100644
--- a/third_party/WebKit/PRESUBMIT.py
+++ b/third_party/WebKit/PRESUBMIT.py
@@ -152,7 +152,7 @@
 def _CheckForPrintfDebugging(input_api, output_api):
     """Generally speaking, we'd prefer not to land patches that printf
     debug output."""
-    printf_re = input_api.re.compile(r'^\s*printf\(')
+    printf_re = input_api.re.compile(r'^\s*(printf\(|fprintf\(stderr,)')
     errors = input_api.canned_checks._FindNewViolationsOfRule(
         lambda _, x: not printf_re.search(x),
         input_api, None)
@@ -225,6 +225,37 @@
                 results.append(output_api.PresubmitError('Found an invalid preference %s in expected result %s:%s' % (error.group(1), f, line_num)))
     return results
 
+
+def _CheckForForbiddenNamespace(input_api, output_api):
+    """Checks that Blink uses Chromium namespaces only in permitted code."""
+    # This list is not exhaustive, but covers likely ones.
+    chromium_namespaces = ["base", "cc", "content", "gfx", "net", "ui"]
+    chromium_classes = ["scoped_ptr", "scoped_refptr"]
+
+    def source_file_filter(path):
+        return input_api.FilterSourceFile(path,
+                                          white_list=[r'third_party/WebKit/Source/.*\.(h|cpp)$'],
+                                          black_list=[r'third_party/WebKit/Source/(platform|wtf|web)/'])
+
+    comment_re = input_api.re.compile(r'^\s*//')
+    result = []
+    for namespace in chromium_namespaces:
+        namespace_re = input_api.re.compile(r'\b{0}::|^\s*using namespace {0};|^\s*namespace {0} \{{'.format(input_api.re.escape(namespace)))
+        uses_namespace_outside_comments = lambda line: namespace_re.search(line) and not comment_re.search(line)
+        errors = input_api.canned_checks._FindNewViolationsOfRule(lambda _, line: not uses_namespace_outside_comments(line),
+                                                                  input_api, source_file_filter)
+        if errors:
+            result += [output_api.PresubmitError('Do not use Chromium namespace {} inside Blink core:\n{}'.format(namespace, '\n'.join(errors)))]
+    for class_name in chromium_classes:
+        class_re = input_api.re.compile(r'\b{0}\b'.format(input_api.re.escape(class_name)))
+        uses_class_outside_comments = lambda line: class_re.search(line) and not comment_re.search(line)
+        errors = input_api.canned_checks._FindNewViolationsOfRule(lambda _, line: not uses_class_outside_comments(line),
+                                                                  input_api, source_file_filter)
+        if errors:
+            result += [output_api.PresubmitError('Do not use Chromium class {} inside Blink core:\n{}'.format(class_name, '\n'.join(errors)))]
+    return result
+
+
 def CheckChangeOnUpload(input_api, output_api):
     results = []
     results.extend(_CommonChecks(input_api, output_api))
@@ -232,6 +263,7 @@
     results.extend(_CheckForPrintfDebugging(input_api, output_api))
     results.extend(_CheckForDangerousTestFunctions(input_api, output_api))
     results.extend(_CheckForInvalidPreferenceError(input_api, output_api))
+    results.extend(_CheckForForbiddenNamespace(input_api, output_api))
     return results
 
 
diff --git a/third_party/WebKit/PerformanceTests/Canvas/setFontAndMeasureText.html b/third_party/WebKit/PerformanceTests/Canvas/setFontAndMeasureText.html
deleted file mode 100644
index 9212cc0e..0000000
--- a/third_party/WebKit/PerformanceTests/Canvas/setFontAndMeasureText.html
+++ /dev/null
@@ -1,28 +0,0 @@
-<!DOCTYPE html>
-<html>
-<body>
-<script src="../resources/runner.js"></script>
-<script>
-
-var canvas = document.createElement("canvas");
-var ctx = canvas.getContext("2d");
-var font1 = "bold 15px Arial";
-var font2 = "italic 20pt Calibri";
-
-function doTest() {
-    ctx.font = font1;
-    ctx.measureText("a");
-    ctx.font = font2;
-    ctx.measureText("b");
-}
-
-// Warm up the caches
-doTest();
-
-PerfTestRunner.measureRunsPerSecond({
-    description: "Measures performance of setting the current font and measuring text on a canvas.",
-    run: doTest
-});
-</script>
-</body>
-</html>
diff --git a/third_party/WebKit/PerformanceTests/Canvas/setFontAndMeasureTextSingleFont.html b/third_party/WebKit/PerformanceTests/Canvas/setFontAndMeasureTextSingleFont.html
deleted file mode 100644
index 11f8bcc4..0000000
--- a/third_party/WebKit/PerformanceTests/Canvas/setFontAndMeasureTextSingleFont.html
+++ /dev/null
@@ -1,25 +0,0 @@
-<!DOCTYPE html>
-<html>
-<body>
-<script src="../resources/runner.js"></script>
-<script>
-
-var canvas = document.createElement("canvas");
-var ctx = canvas.getContext("2d");
-var font1 = "bold 15px Arial";
-
-function doTest() {
-    ctx.font = font1;
-    ctx.measureText("a");
-}
-
-// Warm up the caches
-doTest();
-
-PerfTestRunner.measureRunsPerSecond({
-    description: "Measures performance of setting the current font and measuring text using the same font over and over.",
-    run: doTest
-});
-</script>
-</body>
-</html>
diff --git a/third_party/WebKit/PerformanceTests/Canvas/setFontAndMeasureTextWithStyleChange.html b/third_party/WebKit/PerformanceTests/Canvas/setFontAndMeasureTextWithStyleChange.html
deleted file mode 100644
index 45ac065f..0000000
--- a/third_party/WebKit/PerformanceTests/Canvas/setFontAndMeasureTextWithStyleChange.html
+++ /dev/null
@@ -1,48 +0,0 @@
-<!DOCTYPE html>
-<html>
-<body>
-<style>
-#div {
-    border = 'solid black 2px';
-    margin = '2px';
-    padding = '2px';
-}
-</style>
-<div id='parent'>
-    <div id='divWithText'>
-        Some text
-    </div>
-</div>
-<script src="../resources/runner.js"></script>
-<script>
-
-var parent = document.getElementById('parent');
-var divWithText = document.getElementById('divWithText');
-for (var i = 0; i < 500; i++) {
-    var child = document.createElement('div');
-    parent.appendChild(child);
-}
-var canvas = document.createElement("canvas");
-var ctx = canvas.getContext("2d");
-var font1 = "bold 15px Arial";
-var font2 = "italic 20pt Calibri";
-
-function doTest() {
-    divWithText.style.width = '100px';
-    ctx.font = font1;
-    ctx.measureText("a");
-    divWithText.style.width = '150px';
-    ctx.font = font2;
-    ctx.measureText("b");
-}
-
-// Warm up the caches
-doTest();
-
-PerfTestRunner.measureRunsPerSecond({
-    description: "Measures performance of setting the current font and measuring text on a canvas.",
-    run: doTest
-});
-</script>
-</body>
-</html>
diff --git a/third_party/WebKit/Source/DEPS b/third_party/WebKit/Source/DEPS
index a93d3c7..4660f28 100644
--- a/third_party/WebKit/Source/DEPS
+++ b/third_party/WebKit/Source/DEPS
@@ -1,4 +1,7 @@
 include_rules = [
+    "+base/gtest_prod_util.h",
+    "+testing/gmock/include/gmock",
+    "+testing/gtest/include/gtest",
     "+wtf",
 ]
 
diff --git a/third_party/WebKit/Source/core/animation/PointSVGInterpolation.h b/third_party/WebKit/Source/core/animation/PointSVGInterpolation.h
deleted file mode 100644
index 7478ce46..0000000
--- a/third_party/WebKit/Source/core/animation/PointSVGInterpolation.h
+++ /dev/null
@@ -1,39 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef PointSVGInterpolation_h
-#define PointSVGInterpolation_h
-
-#include "core/animation/SVGInterpolation.h"
-#include "core/svg/SVGPointList.h"
-#include "wtf/Allocator.h"
-
-namespace blink {
-
-class PointSVGInterpolation {
-    STATIC_ONLY(PointSVGInterpolation);
-public:
-    typedef SVGPointList ListType;
-    typedef void NonInterpolableType;
-
-    static PassOwnPtr<InterpolableList> toInterpolableValue(SVGPropertyBase* item)
-    {
-        OwnPtr<InterpolableList> result = InterpolableList::create(2);
-        result->set(0, InterpolableNumber::create(toSVGPoint(item)->x()));
-        result->set(1, InterpolableNumber::create(toSVGPoint(item)->y()));
-        return result.release();
-    }
-
-    static PassRefPtrWillBeRawPtr<SVGPoint> fromInterpolableValue(const InterpolableValue& value)
-    {
-        const InterpolableList& list = toInterpolableList(value);
-        return SVGPoint::create(FloatPoint(
-            toInterpolableNumber(list.get(0))->value(),
-            toInterpolableNumber(list.get(1))->value()));
-    }
-};
-
-}
-
-#endif // PointSVGInterpolation_h
diff --git a/third_party/WebKit/Source/core/animation/SVGAngleInterpolationType.cpp b/third_party/WebKit/Source/core/animation/SVGAngleInterpolationType.cpp
index 0a5fefc..ddfa8c6d 100644
--- a/third_party/WebKit/Source/core/animation/SVGAngleInterpolationType.cpp
+++ b/third_party/WebKit/Source/core/animation/SVGAngleInterpolationType.cpp
@@ -11,7 +11,7 @@
 
 namespace blink {
 
-PassOwnPtr<InterpolationValue> SVGAngleInterpolationType::maybeConvertNeutral() const
+PassOwnPtr<InterpolationValue> SVGAngleInterpolationType::maybeConvertNeutral(const UnderlyingValue&, ConversionCheckers&) const
 {
     return InterpolationValue::create(*this, InterpolableNumber::create(0));
 }
diff --git a/third_party/WebKit/Source/core/animation/SVGAngleInterpolationType.h b/third_party/WebKit/Source/core/animation/SVGAngleInterpolationType.h
index ee290b4..872c8493 100644
--- a/third_party/WebKit/Source/core/animation/SVGAngleInterpolationType.h
+++ b/third_party/WebKit/Source/core/animation/SVGAngleInterpolationType.h
@@ -16,7 +16,7 @@
     { }
 
 private:
-    PassOwnPtr<InterpolationValue> maybeConvertNeutral() const final;
+    PassOwnPtr<InterpolationValue> maybeConvertNeutral(const UnderlyingValue&, ConversionCheckers&) const final;
     PassOwnPtr<InterpolationValue> maybeConvertSVGValue(const SVGPropertyBase& svgValue) const final;
     PassRefPtrWillBeRawPtr<SVGPropertyBase> appliedSVGValue(const InterpolableValue&, const NonInterpolableValue*) const final;
 };
diff --git a/third_party/WebKit/Source/core/animation/SVGInterpolationType.cpp b/third_party/WebKit/Source/core/animation/SVGInterpolationType.cpp
index 0b18d60..f99ca0a 100644
--- a/third_party/WebKit/Source/core/animation/SVGInterpolationType.cpp
+++ b/third_party/WebKit/Source/core/animation/SVGInterpolationType.cpp
@@ -11,10 +11,10 @@
 
 namespace blink {
 
-PassOwnPtr<InterpolationValue> SVGInterpolationType::maybeConvertSingle(const PropertySpecificKeyframe& keyframe, const InterpolationEnvironment& environment, const UnderlyingValue&, ConversionCheckers&) const
+PassOwnPtr<InterpolationValue> SVGInterpolationType::maybeConvertSingle(const PropertySpecificKeyframe& keyframe, const InterpolationEnvironment& environment, const UnderlyingValue& underlyingValue, ConversionCheckers& conversionCheckers) const
 {
     if (keyframe.isNeutral())
-        return maybeConvertNeutral();
+        return maybeConvertNeutral(underlyingValue, conversionCheckers);
 
     RefPtrWillBeRawPtr<SVGPropertyBase> svgValue = environment.svgBaseValue().cloneForAnimation(toSVGPropertySpecificKeyframe(keyframe).value());
     return maybeConvertSVGValue(*svgValue);
diff --git a/third_party/WebKit/Source/core/animation/SVGInterpolationType.h b/third_party/WebKit/Source/core/animation/SVGInterpolationType.h
index 9befd48..4e49c6d 100644
--- a/third_party/WebKit/Source/core/animation/SVGInterpolationType.h
+++ b/third_party/WebKit/Source/core/animation/SVGInterpolationType.h
@@ -19,7 +19,7 @@
 
     const QualifiedName& attribute() const { return property().svgAttribute(); }
 
-    virtual PassOwnPtr<InterpolationValue> maybeConvertNeutral() const = 0;
+    virtual PassOwnPtr<InterpolationValue> maybeConvertNeutral(const UnderlyingValue&, ConversionCheckers&) const = 0;
     virtual PassOwnPtr<InterpolationValue> maybeConvertSVGValue(const SVGPropertyBase&) const = 0;
     virtual PassRefPtrWillBeRawPtr<SVGPropertyBase> appliedSVGValue(const InterpolableValue&, const NonInterpolableValue*) const = 0;
 
diff --git a/third_party/WebKit/Source/core/animation/SVGNumberInterpolationType.cpp b/third_party/WebKit/Source/core/animation/SVGNumberInterpolationType.cpp
index 0909666..8b561b84 100644
--- a/third_party/WebKit/Source/core/animation/SVGNumberInterpolationType.cpp
+++ b/third_party/WebKit/Source/core/animation/SVGNumberInterpolationType.cpp
@@ -12,7 +12,7 @@
 
 namespace blink {
 
-PassOwnPtr<InterpolationValue> SVGNumberInterpolationType::maybeConvertNeutral() const
+PassOwnPtr<InterpolationValue> SVGNumberInterpolationType::maybeConvertNeutral(const UnderlyingValue&, ConversionCheckers&) const
 {
     return InterpolationValue::create(*this, InterpolableNumber::create(0));
 }
diff --git a/third_party/WebKit/Source/core/animation/SVGNumberInterpolationType.h b/third_party/WebKit/Source/core/animation/SVGNumberInterpolationType.h
index 9bbd838..f0f432d 100644
--- a/third_party/WebKit/Source/core/animation/SVGNumberInterpolationType.h
+++ b/third_party/WebKit/Source/core/animation/SVGNumberInterpolationType.h
@@ -18,7 +18,7 @@
     { }
 
 private:
-    PassOwnPtr<InterpolationValue> maybeConvertNeutral() const final;
+    PassOwnPtr<InterpolationValue> maybeConvertNeutral(const UnderlyingValue&, ConversionCheckers&) const final;
     PassOwnPtr<InterpolationValue> maybeConvertSVGValue(const SVGPropertyBase& svgValue) const final;
     PassRefPtrWillBeRawPtr<SVGPropertyBase> appliedSVGValue(const InterpolableValue&, const NonInterpolableValue*) const final;
 
diff --git a/third_party/WebKit/Source/core/animation/SVGPointListInterpolationType.cpp b/third_party/WebKit/Source/core/animation/SVGPointListInterpolationType.cpp
new file mode 100644
index 0000000..de13fb6a
--- /dev/null
+++ b/third_party/WebKit/Source/core/animation/SVGPointListInterpolationType.cpp
@@ -0,0 +1,105 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "config.h"
+#include "core/animation/SVGPointListInterpolationType.h"
+
+#include "core/animation/InterpolationEnvironment.h"
+#include "core/svg/SVGPointList.h"
+
+namespace blink {
+
+static size_t getUnderlyingLength(const UnderlyingValue& underlyingValue)
+{
+    if (!underlyingValue)
+        return 0;
+    return toInterpolableList(underlyingValue->interpolableValue()).length();
+}
+
+class UnderlyingLengthChecker : public InterpolationType::ConversionChecker {
+public:
+    static PassOwnPtr<UnderlyingLengthChecker> create(const InterpolationType& type, size_t underlyingLength)
+    {
+        return adoptPtr(new UnderlyingLengthChecker(type, underlyingLength));
+    }
+
+    bool isValid(const InterpolationEnvironment&, const UnderlyingValue& underlyingValue) const final
+    {
+        return m_underlyingLength == getUnderlyingLength(underlyingValue);
+    }
+
+private:
+    UnderlyingLengthChecker(const InterpolationType& type, size_t underlyingLength)
+        : ConversionChecker(type)
+        , m_underlyingLength(underlyingLength)
+    {}
+
+    size_t m_underlyingLength;
+};
+
+PassOwnPtr<InterpolationValue> SVGPointListInterpolationType::maybeConvertNeutral(const UnderlyingValue& underlyingValue, ConversionCheckers& conversionCheckers) const
+{
+    size_t underlyingLength = getUnderlyingLength(underlyingValue);
+    conversionCheckers.append(UnderlyingLengthChecker::create(*this, underlyingLength));
+    if (underlyingLength == 0)
+        return nullptr;
+    OwnPtr<InterpolableList> result = InterpolableList::create(underlyingLength);
+    for (size_t i = 0; i < underlyingLength; i++)
+        result->set(i, InterpolableNumber::create(0));
+    return InterpolationValue::create(*this, result.release());
+}
+
+PassOwnPtr<InterpolationValue> SVGPointListInterpolationType::maybeConvertSVGValue(const SVGPropertyBase& svgValue) const
+{
+    if (svgValue.type() != AnimatedPoints)
+        return nullptr;
+
+    const SVGPointList& pointList = toSVGPointList(svgValue);
+    OwnPtr<InterpolableList> result = InterpolableList::create(pointList.length() * 2);
+    for (size_t i = 0; i < pointList.length(); i++) {
+        const SVGPoint& point = *pointList.at(i);
+        result->set(2 * i, InterpolableNumber::create(point.x()));
+        result->set(2 * i + 1, InterpolableNumber::create(point.y()));
+    }
+
+    return InterpolationValue::create(*this, result.release());
+}
+
+PassOwnPtr<PairwisePrimitiveInterpolation> SVGPointListInterpolationType::mergeSingleConversions(InterpolationValue& startValue, InterpolationValue& endValue) const
+{
+    size_t startLength = toInterpolableList(startValue.interpolableValue()).length();
+    size_t endLength = toInterpolableList(endValue.interpolableValue()).length();
+    if (startLength != endLength)
+        return nullptr;
+
+    return InterpolationType::mergeSingleConversions(startValue, endValue);
+}
+
+void SVGPointListInterpolationType::composite(UnderlyingValue& underlyingValue, double underlyingFraction, const InterpolationValue& value) const
+{
+    size_t startLength = toInterpolableList(underlyingValue->interpolableValue()).length();
+    size_t endLength = toInterpolableList(value.interpolableValue()).length();
+    if (startLength != endLength)
+        underlyingValue.set(&value);
+
+    InterpolationType::composite(underlyingValue, underlyingFraction, value);
+}
+
+PassRefPtrWillBeRawPtr<SVGPropertyBase> SVGPointListInterpolationType::appliedSVGValue(const InterpolableValue& interpolableValue, const NonInterpolableValue*) const
+{
+    RefPtrWillBeRawPtr<SVGPointList> result = SVGPointList::create();
+
+    const InterpolableList& list = toInterpolableList(interpolableValue);
+    ASSERT(list.length() % 2 == 0);
+    for (size_t i = 0; i < list.length(); i += 2) {
+        FloatPoint point = FloatPoint(
+            toInterpolableNumber(list.get(i))->value(),
+            toInterpolableNumber(list.get(i + 1))->value());
+        result->append(SVGPoint::create(point));
+    }
+
+    return result.release();
+}
+
+} // namespace blink
diff --git a/third_party/WebKit/Source/core/animation/SVGPointListInterpolationType.h b/third_party/WebKit/Source/core/animation/SVGPointListInterpolationType.h
new file mode 100644
index 0000000..d1ec5bf5
--- /dev/null
+++ b/third_party/WebKit/Source/core/animation/SVGPointListInterpolationType.h
@@ -0,0 +1,28 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef SVGPointListInterpolationType_h
+#define SVGPointListInterpolationType_h
+
+#include "core/animation/SVGInterpolationType.h"
+
+namespace blink {
+
+class SVGPointListInterpolationType : public SVGInterpolationType {
+public:
+    SVGPointListInterpolationType(const QualifiedName& attribute)
+        : SVGInterpolationType(attribute)
+    { }
+
+private:
+    PassOwnPtr<InterpolationValue> maybeConvertNeutral(const UnderlyingValue&, ConversionCheckers&) const final;
+    PassOwnPtr<InterpolationValue> maybeConvertSVGValue(const SVGPropertyBase& svgValue) const final;
+    PassOwnPtr<PairwisePrimitiveInterpolation> mergeSingleConversions(InterpolationValue& startValue, InterpolationValue& endValue) const final;
+    void composite(UnderlyingValue&, double underlyingFraction, const InterpolationValue&) const final;
+    PassRefPtrWillBeRawPtr<SVGPropertyBase> appliedSVGValue(const InterpolableValue&, const NonInterpolableValue*) const final;
+};
+
+} // namespace blink
+
+#endif // SVGPointListInterpolationType_h
diff --git a/third_party/WebKit/Source/core/animation/SVGValueInterpolationType.h b/third_party/WebKit/Source/core/animation/SVGValueInterpolationType.h
index 1c28f82..5f8e1c37 100644
--- a/third_party/WebKit/Source/core/animation/SVGValueInterpolationType.h
+++ b/third_party/WebKit/Source/core/animation/SVGValueInterpolationType.h
@@ -23,7 +23,7 @@
         return nullptr;
     }
 
-    PassOwnPtr<InterpolationValue> maybeConvertNeutral() const final
+    PassOwnPtr<InterpolationValue> maybeConvertNeutral(const UnderlyingValue&, ConversionCheckers&) const final
     {
         return nullptr;
     }
diff --git a/third_party/WebKit/Source/core/animation/StringKeyframe.cpp b/third_party/WebKit/Source/core/animation/StringKeyframe.cpp
index 3699bc78..14b2737 100644
--- a/third_party/WebKit/Source/core/animation/StringKeyframe.cpp
+++ b/third_party/WebKit/Source/core/animation/StringKeyframe.cpp
@@ -35,10 +35,10 @@
 #include "core/animation/NumberOptionalNumberSVGInterpolation.h"
 #include "core/animation/NumberSVGInterpolation.h"
 #include "core/animation/PathSVGInterpolation.h"
-#include "core/animation/PointSVGInterpolation.h"
 #include "core/animation/RectSVGInterpolation.h"
 #include "core/animation/SVGAngleInterpolationType.h"
 #include "core/animation/SVGNumberInterpolationType.h"
+#include "core/animation/SVGPointListInterpolationType.h"
 #include "core/animation/SVGStrokeDasharrayStyleInterpolation.h"
 #include "core/animation/SVGValueInterpolationType.h"
 #include "core/animation/TransformSVGInterpolation.h"
@@ -294,6 +294,8 @@
             || attribute == SVGNames::surfaceScaleAttr
             || attribute == SVGNames::zAttr) {
             applicableTypes->append(adoptPtr(new SVGNumberInterpolationType(attribute)));
+        } else if (attribute == SVGNames::pointsAttr) {
+            applicableTypes->append(adoptPtr(new SVGPointListInterpolationType(attribute)));
         } else if (attribute == HTMLNames::classAttr
             || attribute == SVGNames::clipPathUnitsAttr
             || attribute == SVGNames::edgeModeAttr
@@ -572,9 +574,6 @@
     case AnimatedPath:
         interpolation = PathSVGInterpolation::maybeCreate(fromValue, toValue, attribute);
         break;
-    case AnimatedPoints:
-        interpolation = ListSVGInterpolation<PointSVGInterpolation>::maybeCreate(fromValue, toValue, attribute);
-        break;
     case AnimatedRect:
         return RectSVGInterpolation::create(fromValue, toValue, attribute);
     case AnimatedTransformList:
@@ -584,6 +583,7 @@
     // Handled by SVGInterpolationTypes.
     case AnimatedAngle:
     case AnimatedNumber:
+    case AnimatedPoints:
         ASSERT_NOT_REACHED();
         // Fallthrough.
 
diff --git a/third_party/WebKit/Source/core/core.gypi b/third_party/WebKit/Source/core/core.gypi
index c1551df6..7211e741 100644
--- a/third_party/WebKit/Source/core/core.gypi
+++ b/third_party/WebKit/Source/core/core.gypi
@@ -918,6 +918,8 @@
             'animation/SVGInterpolationType.h',
             'animation/SVGNumberInterpolationType.cpp',
             'animation/SVGNumberInterpolationType.h',
+            'animation/SVGPointListInterpolationType.cpp',
+            'animation/SVGPointListInterpolationType.h',
             'animation/SVGStrokeDasharrayStyleInterpolation.cpp',
             'animation/SVGStrokeDasharrayStyleInterpolation.h',
             'animation/SVGValueInterpolationType.cpp',
@@ -928,7 +930,6 @@
             'animation/ListStyleInterpolation.h',
             'animation/PathSVGInterpolation.cpp',
             'animation/PathSVGInterpolation.h',
-            'animation/PointSVGInterpolation.h',
             'animation/ShadowInterpolationFunctions.cpp',
             'animation/ShadowInterpolationFunctions.h',
             'animation/StringKeyframe.cpp',
@@ -1992,6 +1993,8 @@
             'paint/ObjectPainter.h',
             'paint/PaintInfo.cpp',
             'paint/PaintInfo.h',
+            'paint/PaintInvalidationCapableScrollableArea.cpp',
+            'paint/PaintInvalidationCapableScrollableArea.h',
             'paint/PaintLayer.cpp',
             'paint/PaintLayerClipper.cpp',
             'paint/PaintLayerFilterInfo.cpp',
@@ -3806,6 +3809,7 @@
             'dom/DocumentStatisticsCollectorTest.cpp',
             'dom/DocumentTest.cpp',
             'dom/MainThreadTaskRunnerTest.cpp',
+            'dom/NodeTest.cpp',
             'dom/NthIndexCacheTest.cpp',
             'dom/RangeTest.cpp',
             'dom/ScriptRunnerTest.cpp',
diff --git a/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp b/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
index 05d1644..24d921b8 100644
--- a/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
+++ b/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
@@ -1825,6 +1825,17 @@
     return paintOrderList.release();
 }
 
+static PassRefPtrWillBeRawPtr<CSSValue> consumeNoneOrURI(CSSParserTokenRange& range)
+{
+    if (range.peek().id() == CSSValueNone)
+        return consumeIdent(range);
+
+    String url = consumeUrl(range);
+    if (url.isNull())
+        return nullptr;
+    return CSSURIValue::create(url);
+}
+
 PassRefPtrWillBeRawPtr<CSSValue> CSSPropertyParser::parseSingleValue(CSSPropertyID unresolvedProperty)
 {
     CSSPropertyID property = resolveCSSPropertyID(unresolvedProperty);
@@ -1981,6 +1992,10 @@
         return consumePaint(m_range, m_context);
     case CSSPropertyPaintOrder:
         return consumePaintOrder(m_range);
+    case CSSPropertyMarkerStart:
+    case CSSPropertyMarkerMid:
+    case CSSPropertyMarkerEnd:
+        return consumeNoneOrURI(m_range);
     default:
         return nullptr;
     }
@@ -2471,6 +2486,16 @@
         return consumeShorthandGreedily(webkitBorderAfterShorthand(), important);
     case CSSPropertyWebkitTextStroke:
         return consumeShorthandGreedily(webkitTextStrokeShorthand(), important);
+    case CSSPropertyMarker: {
+        ImplicitScope implicitScope(this);
+        RefPtrWillBeRawPtr<CSSValue> marker = parseSingleValue(CSSPropertyMarkerStart);
+        if (!marker || !m_range.atEnd())
+            return false;
+        addProperty(CSSPropertyMarkerStart, marker, important);
+        addProperty(CSSPropertyMarkerMid, marker, important);
+        addProperty(CSSPropertyMarkerEnd, marker.release(), important);
+        return true;
+    }
     default:
         m_currentShorthand = oldShorthand;
         return false;
diff --git a/third_party/WebKit/Source/core/css/parser/LegacyCSSPropertyParser.cpp b/third_party/WebKit/Source/core/css/parser/LegacyCSSPropertyParser.cpp
index 66060031..3055b69 100644
--- a/third_party/WebKit/Source/core/css/parser/LegacyCSSPropertyParser.cpp
+++ b/third_party/WebKit/Source/core/css/parser/LegacyCSSPropertyParser.cpp
@@ -1173,6 +1173,10 @@
     case CSSPropertyFloodColor:
     case CSSPropertyLightingColor:
     case CSSPropertyPaintOrder:
+    case CSSPropertyMarker:
+    case CSSPropertyMarkerStart:
+    case CSSPropertyMarkerMid:
+    case CSSPropertyMarkerEnd:
         validPrimitive = false;
         break;
 
@@ -5474,9 +5478,6 @@
 
     case CSSPropertyClipPath:
     case CSSPropertyFilter:
-    case CSSPropertyMarkerStart:
-    case CSSPropertyMarkerMid:
-    case CSSPropertyMarkerEnd:
     case CSSPropertyMask:
         if (id == CSSValueNone) {
             validPrimitive = true;
@@ -5520,21 +5521,6 @@
             parsedValue = parseSVGStrokeDasharray();
         break;
 
-    /* shorthand properties */
-    case CSSPropertyMarker: {
-        ShorthandScope scope(this, propId);
-        CSSPropertyParser::ImplicitScope implicitScope(this);
-        if (!parseValue(CSSPropertyMarkerStart, important))
-            return false;
-        if (m_valueList->current()) {
-            rollbackLastProperties(1);
-            return false;
-        }
-        CSSValue* value = m_parsedProperties.last().value();
-        addProperty(CSSPropertyMarkerMid, value, important);
-        addProperty(CSSPropertyMarkerEnd, value, important);
-        return true;
-    }
     default:
         // If you crash here, it's because you added a css property and are not handling it
         // in either this switch statement or the one in CSSPropertyParser::parseValue
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index c5447289..6522841 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -2182,7 +2182,17 @@
     if (!isActive())
         return;
 
+    // Frame navigation can cause a new Document to be attached. Don't allow that, since that will
+    // cause a situation where LocalFrame still has a Document attached after this finishes!
+    // Normally, it shouldn't actually be possible to trigger navigation here. However, plugins
+    // (see below) can cause lots of crazy things to happen, since plugin detach involves nested
+    // message loops.
+    FrameNavigationDisabler navigationDisabler(*m_frame);
+    // Defer widget updates to avoid plugins trying to run script inside ScriptForbiddenScope,
+    // which will crash the renderer after https://crrev.com/200984
     HTMLFrameOwnerElement::UpdateSuspendScope suspendWidgetHierarchyUpdates;
+    // Don't allow script to run in the middle of detach() because a detaching Document is not in a
+    // consistent state.
     ScriptForbiddenScope forbidScript;
     view()->dispose();
     m_markers->prepareForDestruction();
diff --git a/third_party/WebKit/Source/core/dom/Node.cpp b/third_party/WebKit/Source/core/dom/Node.cpp
index 9c1b87a5..733b797 100644
--- a/third_party/WebKit/Source/core/dom/Node.cpp
+++ b/third_party/WebKit/Source/core/dom/Node.cpp
@@ -953,7 +953,8 @@
         if (style.userDrag() == DRAG_ELEMENT && style.userSelect() == SELECT_NONE)
             return false;
     }
-    return parentOrShadowHostNode() ? parentOrShadowHostNode()->canStartSelection() : true;
+    ContainerNode* parent = ComposedTreeTraversal::parent(*this);
+    return parent ? parent->canStartSelection() : true;
 }
 
 bool Node::canParticipateInComposedTree() const
diff --git a/third_party/WebKit/Source/core/dom/NodeTest.cpp b/third_party/WebKit/Source/core/dom/NodeTest.cpp
new file mode 100644
index 0000000..dbec516
--- /dev/null
+++ b/third_party/WebKit/Source/core/dom/NodeTest.cpp
@@ -0,0 +1,42 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "config.h"
+#include "core/dom/Node.h"
+
+#include "core/editing/EditingTestBase.h"
+
+namespace blink {
+
+class NodeTest : public EditingTestBase {
+};
+
+TEST_F(NodeTest, canStartSelection)
+{
+    const char* bodyContent = "<a id=one href='http://www.msn.com'>one</a><b id=two>two</b>";
+    setBodyContent(bodyContent);
+    updateLayoutAndStyleForPainting();
+    Node* one = document().getElementById("one");
+    Node* two = document().getElementById("two");
+
+    EXPECT_FALSE(one->canStartSelection());
+    EXPECT_FALSE(one->firstChild()->canStartSelection());
+    EXPECT_TRUE(two->canStartSelection());
+    EXPECT_TRUE(two->firstChild()->canStartSelection());
+}
+
+TEST_F(NodeTest, canStartSelectionWithShadowDOM)
+{
+    const char* bodyContent = "<div id=host><span id=one>one</span></div>";
+    const char* shadowContent = "<a href='http://www.msn.com'><content></content></a>";
+    setBodyContent(bodyContent);
+    setShadowContent(shadowContent, "host");
+    updateLayoutAndStyleForPainting();
+    Node* one = document().getElementById("one");
+
+    EXPECT_FALSE(one->canStartSelection());
+    EXPECT_FALSE(one->firstChild()->canStartSelection());
+}
+
+} // namespace blink
diff --git a/third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp b/third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp
index 825e90c8..770adfb 100644
--- a/third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp
+++ b/third_party/WebKit/Source/core/fetch/CrossOriginAccessControl.cpp
@@ -69,7 +69,7 @@
     request.setFetchCredentialsMode(allowCredentials == AllowStoredCredentials ? WebURLRequest::FetchCredentialsModeInclude : WebURLRequest::FetchCredentialsModeOmit);
 
     if (securityOrigin)
-        request.setHTTPOrigin(securityOrigin->toAtomicString());
+        request.setHTTPOrigin(securityOrigin);
 }
 
 ResourceRequest createAccessControlPreflightRequest(const ResourceRequest& request, SecurityOrigin* securityOrigin)
@@ -133,6 +133,7 @@
 {
     AtomicallyInitializedStaticReference(AtomicString, allowOriginHeaderName, (new AtomicString("access-control-allow-origin", AtomicString::ConstructFromLiteral)));
     AtomicallyInitializedStaticReference(AtomicString, allowCredentialsHeaderName, (new AtomicString("access-control-allow-credentials", AtomicString::ConstructFromLiteral)));
+    AtomicallyInitializedStaticReference(AtomicString, allowSuboriginHeaderName, (new AtomicString("access-control-allow-suborigin", AtomicString::ConstructFromLiteral)));
 
     int statusCode = response.httpStatusCode();
 
@@ -142,6 +143,18 @@
     }
 
     const AtomicString& allowOriginHeaderValue = response.httpHeaderField(allowOriginHeaderName);
+
+    // Check Suborigins, unless the Access-Control-Allow-Origin is '*',
+    // which implies that all Suborigins are okay as well.
+    if (securityOrigin->hasSuborigin() && allowOriginHeaderValue != starAtom) {
+        const AtomicString& allowSuboriginHeaderValue = response.httpHeaderField(allowSuboriginHeaderName);
+        AtomicString atomicSuboriginName(securityOrigin->suboriginName());
+        if (allowSuboriginHeaderValue != starAtom && allowSuboriginHeaderValue != atomicSuboriginName) {
+            errorDescription = buildAccessControlFailureMessage("The 'Access-Control-Allow-Suborigin' header has a value '" + allowSuboriginHeaderValue + "' that is not equal to the supplied suborigin.", securityOrigin);
+            return false;
+        }
+    }
+
     if (allowOriginHeaderValue == starAtom) {
         // A wildcard Access-Control-Allow-Origin can not be used if credentials are to be sent,
         // even with Access-Control-Allow-Credentials set to true.
@@ -271,7 +284,7 @@
     if (redirectCrossOrigin) {
         // If now to a different origin, update/set Origin:.
         newRequest.clearHTTPOrigin();
-        newRequest.setHTTPOrigin(securityOrigin->toAtomicString());
+        newRequest.setHTTPOrigin(securityOrigin);
         // If the user didn't request credentials in the first place, update our
         // state so we neither request them nor expect they must be allowed.
         if (options.credentialsRequested == ClientDidNotRequestCredentials)
diff --git a/third_party/WebKit/Source/core/fetch/ImageResourceTest.cpp b/third_party/WebKit/Source/core/fetch/ImageResourceTest.cpp
index 7a6e07b..78a1ca6 100644
--- a/third_party/WebKit/Source/core/fetch/ImageResourceTest.cpp
+++ b/third_party/WebKit/Source/core/fetch/ImageResourceTest.cpp
@@ -135,7 +135,7 @@
     ASSERT_FALSE(cachedImage->image()->isNull());
     ASSERT_EQ(cachedImage->image()->width(), 1);
     ASSERT_EQ(cachedImage->image()->height(), 1);
-    ASSERT_EQ(client.imageChangedCount(), 2);
+    ASSERT_EQ(client.imageChangedCount(), 1);
     ASSERT_TRUE(client.notifyFinishedCalled());
 }
 
diff --git a/third_party/WebKit/Source/core/frame/FrameView.cpp b/third_party/WebKit/Source/core/frame/FrameView.cpp
index 29096603..dd65fe3 100644
--- a/third_party/WebKit/Source/core/frame/FrameView.cpp
+++ b/third_party/WebKit/Source/core/frame/FrameView.cpp
@@ -382,9 +382,6 @@
 
 void FrameView::invalidateRect(const IntRect& rect)
 {
-    // For querying PaintLayer::compositingState() when invalidating scrollbars.
-    // FIXME: do all scrollbar invalidations after layout of all frames is complete. It's currently not recursively true.
-    DisableCompositingQueryAsserts disabler;
     if (!parent()) {
         if (HostWindow* window = hostWindow())
             window->invalidateRect(rect);
@@ -400,7 +397,7 @@
         layoutObject->borderTop() + layoutObject->paddingTop());
     // FIXME: We should not allow paint invalidation out of paint invalidation state. crbug.com/457415
     DisablePaintInvalidationStateAsserts paintInvalidationAssertDisabler;
-    layoutObject->invalidatePaintRectangle(LayoutRect(paintInvalidationRect));
+    layoutObject->invalidatePaintRectangleNotInvalidatingDisplayItemClients(LayoutRect(paintInvalidationRect));
 }
 
 void FrameView::setFrameRect(const IntRect& newRect)
@@ -983,7 +980,7 @@
                     setHorizontalScrollbarMode(ScrollbarAlwaysOff); // This causes a horizontal scrollbar to disappear.
 
                 setScrollbarModes(hMode, vMode);
-                setScrollbarsSuppressed(false, true);
+                setScrollbarsSuppressed(false);
             } else if (hMode != currentHMode || vMode != currentVMode) {
                 setScrollbarModes(hMode, vMode);
             }
@@ -1057,10 +1054,6 @@
     frame().document()->layoutUpdated();
 }
 
-// The plan is to move to compositor-queried paint invalidation, in which case this
-// method would setNeedsRedraw on the GraphicsLayers with invalidations and
-// let the compositor pick which to actually draw.
-// See http://crbug.com/306706
 void FrameView::invalidateTreeIfNeeded(PaintInvalidationState& paintInvalidationState)
 {
     if (shouldThrottleRendering())
@@ -1076,12 +1069,11 @@
 
     rootForPaintInvalidation.invalidateTreeIfNeeded(paintInvalidationState);
 
-    // Invalidate the paint of the frameviews scrollbars if needed
-    if (hasVerticalBarDamage())
-        invalidateRect(verticalBarDamage());
-    if (hasHorizontalBarDamage())
-        invalidateRect(horizontalBarDamage());
-    resetScrollbarDamage();
+    if (!m_frame->settings() || !m_frame->settings()->rootLayerScrolls()) {
+        paintInvalidationState.setViewClippingAndScrollOffsetDisabled(true);
+        invalidatePaintOfScrollControlsIfNeeded(paintInvalidationState, paintInvalidationState.paintInvalidationContainer());
+        paintInvalidationState.setViewClippingAndScrollOffsetDisabled(false);
+    }
 
 #if ENABLE(ASSERT)
     layoutView()->assertSubtreeClearedPaintInvalidationState();
@@ -1509,8 +1501,7 @@
         if (delta != 0) {
             m_horizontalScrollbar->setElasticOverscroll(elasticOverscroll.width());
             scrollAnimator()->notifyContentAreaScrolled(FloatSize(delta, 0));
-            if (!m_scrollbarsSuppressed)
-                m_horizontalScrollbar->invalidate();
+            setScrollbarNeedsPaintInvalidation(m_horizontalScrollbar.get());
         }
     }
     if (m_verticalScrollbar) {
@@ -1518,8 +1509,7 @@
         if (delta != 0) {
             m_verticalScrollbar->setElasticOverscroll(elasticOverscroll.height());
             scrollAnimator()->notifyContentAreaScrolled(FloatSize(0, delta));
-            if (!m_scrollbarsSuppressed)
-                m_verticalScrollbar->invalidate();
+            setScrollbarNeedsPaintInvalidation(m_verticalScrollbar.get());
         }
     }
 }
@@ -2083,24 +2073,10 @@
     frame().loader().client()->didChangeScrollOffset();
 }
 
-void FrameView::invalidatePaintForTickmarks() const
+void FrameView::invalidatePaintForTickmarks()
 {
     if (Scrollbar* scrollbar = verticalScrollbar())
-        scrollbar->invalidate();
-}
-
-void FrameView::invalidateScrollbarRect(Scrollbar* scrollbar, const IntRect& rect)
-{
-    // Add in our offset within the FrameView.
-    IntRect dirtyRect = rect;
-    dirtyRect.moveBy(scrollbar->location());
-
-    layoutView()->invalidateDisplayItemClient(*scrollbar);
-
-    if (isInPerformLayout())
-        addScrollbarDamage(scrollbar, rect);
-    else
-        invalidateRect(dirtyRect);
+        setScrollbarNeedsPaintInvalidation(scrollbar);
 }
 
 void FrameView::getTickmarks(Vector<IntRect>& tickmarks) const
@@ -2300,7 +2276,7 @@
         if (!m_scrollCorner)
             m_scrollCorner = LayoutScrollbarPart::createAnonymous(doc);
         m_scrollCorner->setStyle(cornerStyle.release());
-        invalidateScrollCorner(cornerRect);
+        setScrollCornerNeedsPaintInvalidation();
     } else if (m_scrollCorner) {
         m_scrollCorner->destroy();
         m_scrollCorner = nullptr;
@@ -3025,7 +3001,7 @@
             cache->handleScrollbarUpdate(this);
     }
 
-    invalidateScrollCorner(scrollCornerRect());
+    setScrollCornerNeedsPaintInvalidation();
 }
 
 void FrameView::setHasVerticalScrollbar(bool hasBar)
@@ -3053,7 +3029,7 @@
             cache->handleScrollbarUpdate(this);
     }
 
-    invalidateScrollCorner(scrollCornerRect());
+    setScrollCornerNeedsPaintInvalidation();
 }
 
 void FrameView::setScrollbarModes(ScrollbarMode horizontalMode, ScrollbarMode verticalMode,
@@ -3220,16 +3196,12 @@
             width() - (m_verticalScrollbar ? m_verticalScrollbar->width() : 0),
             m_horizontalScrollbar->height());
         m_horizontalScrollbar->setFrameRect(adjustScrollbarRectForResizer(hBarRect, m_horizontalScrollbar.get()));
-        if (!m_scrollbarsSuppressed && oldRect != m_horizontalScrollbar->frameRect())
-            m_horizontalScrollbar->invalidate();
+        if (oldRect != m_horizontalScrollbar->frameRect())
+            setScrollbarNeedsPaintInvalidation(m_horizontalScrollbar.get());
 
-        if (m_scrollbarsSuppressed)
-            m_horizontalScrollbar->setSuppressInvalidation(true);
         m_horizontalScrollbar->setEnabled(contentsWidth() > clientWidth);
         m_horizontalScrollbar->setProportion(clientWidth, contentsWidth());
         m_horizontalScrollbar->offsetDidChange();
-        if (m_scrollbarsSuppressed)
-            m_horizontalScrollbar->setSuppressInvalidation(false);
     }
 
     if (m_verticalScrollbar) {
@@ -3240,16 +3212,12 @@
             m_verticalScrollbar->width(),
             height() - (m_horizontalScrollbar ? m_horizontalScrollbar->height() : 0));
         m_verticalScrollbar->setFrameRect(adjustScrollbarRectForResizer(vBarRect, m_verticalScrollbar.get()));
-        if (!m_scrollbarsSuppressed && oldRect != m_verticalScrollbar->frameRect())
-            m_verticalScrollbar->invalidate();
+        if (oldRect != m_verticalScrollbar->frameRect())
+            setScrollbarNeedsPaintInvalidation(m_verticalScrollbar.get());
 
-        if (m_scrollbarsSuppressed)
-            m_verticalScrollbar->setSuppressInvalidation(true);
         m_verticalScrollbar->setEnabled(contentsHeight() > clientHeight);
         m_verticalScrollbar->setProportion(clientHeight, contentsHeight());
         m_verticalScrollbar->offsetDidChange();
-        if (m_scrollbarsSuppressed)
-            m_verticalScrollbar->setSuppressInvalidation(false);
     }
 }
 
@@ -3352,8 +3320,6 @@
         return;
     InUpdateScrollbarsScope inUpdateScrollbarsScope(this);
 
-    IntSize oldVisibleSize = visibleContentSize();
-
     bool scrollbarExistenceChanged = false;
 
     if (needsScrollbarReconstruction()) {
@@ -3378,17 +3344,6 @@
         updateScrollCorner();
     }
 
-    // FIXME: We don't need to do this if we are composited.
-    IntSize newVisibleSize = visibleContentSize();
-    if (newVisibleSize.width() > oldVisibleSize.width()) {
-        if (shouldPlaceVerticalScrollbarOnLeft())
-            invalidateRect(IntRect(0, 0, newVisibleSize.width() - oldVisibleSize.width(), newVisibleSize.height()));
-        else
-            invalidateRect(IntRect(oldVisibleSize.width(), 0, newVisibleSize.width() - oldVisibleSize.width(), newVisibleSize.height()));
-    }
-    if (newVisibleSize.height() > oldVisibleSize.height())
-        invalidateRect(IntRect(0, oldVisibleSize.height(), newVisibleSize.width(), newVisibleSize.height() - oldVisibleSize.height()));
-
     setScrollOffsetFromUpdateScrollbars(desiredOffset);
 }
 
@@ -3569,24 +3524,6 @@
     }
 }
 
-void FrameView::setScrollbarsSuppressed(bool suppressed, bool repaintOnUnsuppress)
-{
-    if (suppressed == m_scrollbarsSuppressed)
-        return;
-
-    m_scrollbarsSuppressed = suppressed;
-
-    if (repaintOnUnsuppress && !suppressed) {
-        if (m_horizontalScrollbar)
-            m_horizontalScrollbar->invalidate();
-        if (m_verticalScrollbar)
-            m_verticalScrollbar->invalidate();
-
-        // Invalidate the scroll corner too on unsuppress.
-        invalidateScrollCorner(scrollCornerRect());
-    }
-}
-
 Scrollbar* FrameView::scrollbarAtRootFramePoint(const IntPoint& pointInRootFrame)
 {
     IntPoint pointInFrame = convertFromContainingWindow(pointInRootFrame);
@@ -3706,13 +3643,6 @@
     return !scrollCornerRect().isEmpty();
 }
 
-void FrameView::invalidateScrollCornerRect(const IntRect& rect)
-{
-    invalidateRect(rect);
-    if (m_scrollCorner)
-        layoutView()->invalidateDisplayItemClientForNonCompositingDescendantsOf(*m_scrollCorner);
-}
-
 ScrollBehavior FrameView::scrollBehaviorStyle() const
 {
     Element* scrollElement = m_frame->document()->scrollingElement();
@@ -4047,4 +3977,10 @@
     return m_hiddenForThrottling && m_crossOriginForThrottling;
 }
 
+LayoutBox& FrameView::boxForScrollControlPaintInvalidation() const
+{
+    ASSERT(layoutView());
+    return *layoutView();
+}
+
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/frame/FrameView.h b/third_party/WebKit/Source/core/frame/FrameView.h
index e704eaa..febffe1f 100644
--- a/third_party/WebKit/Source/core/frame/FrameView.h
+++ b/third_party/WebKit/Source/core/frame/FrameView.h
@@ -31,6 +31,7 @@
 #include "core/frame/LayoutSubtreeRootList.h"
 #include "core/frame/RootFrameViewport.h"
 #include "core/layout/LayoutAnalyzer.h"
+#include "core/paint/PaintInvalidationCapableScrollableArea.h"
 #include "core/paint/PaintPhase.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/Widget.h"
@@ -39,7 +40,6 @@
 #include "platform/graphics/Color.h"
 #include "platform/graphics/paint/TransformPaintPropertyNode.h"
 #include "platform/scroll/ScrollTypes.h"
-#include "platform/scroll/ScrollableArea.h"
 #include "platform/scroll/Scrollbar.h"
 #include "public/platform/WebDisplayMode.h"
 #include "public/platform/WebRect.h"
@@ -79,7 +79,7 @@
 
 typedef unsigned long long DOMTimeStamp;
 
-class CORE_EXPORT FrameView final : public Widget, public ScrollableArea {
+class CORE_EXPORT FrameView final : public Widget, public PaintInvalidationCapableScrollableArea {
     WILL_BE_USING_GARBAGE_COLLECTED_MIXIN(FrameView);
 
     friend class PaintControllerPaintTestBase;
@@ -339,7 +339,7 @@
         invalidatePaintForTickmarks();
     }
 
-    void invalidatePaintForTickmarks() const;
+    void invalidatePaintForTickmarks();
 
     // Since the compositor can resize the viewport due to top controls and
     // commit scroll offsets before a WebView::resize occurs, we need to adjust
@@ -350,7 +350,7 @@
     IntPoint maximumScrollPosition() const override;
 
     // ScrollableArea interface
-    void invalidateScrollbarRect(Scrollbar*, const IntRect&) override;
+    void scrollControlWasSetNeedsPaintInvalidation() override { }
     void getTickmarks(Vector<IntRect>&) const override;
     void scrollTo(const DoublePoint&);
     IntRect scrollableAreaBoundingBox() const override;
@@ -390,7 +390,7 @@
     // can be used to obtain those scrollbars.
     Scrollbar* horizontalScrollbar() const override { return m_horizontalScrollbar.get(); }
     Scrollbar* verticalScrollbar() const override { return m_verticalScrollbar.get(); }
-    LayoutScrollbarPart* scrollCorner() const { return m_scrollCorner; }
+    LayoutScrollbarPart* scrollCorner() const override { return m_scrollCorner; }
 
     void positionScrollbarLayers();
 
@@ -443,8 +443,8 @@
     // Scroll the actual contents of the view (either blitting or invalidating as needed).
     void scrollContents(const IntSize& scrollDelta);
 
-    // This gives us a means of blocking painting on our scrollbars until the first layout has occurred.
-    void setScrollbarsSuppressed(bool suppressed, bool repaintOnUnsuppress = false);
+    // This gives us a means of blocking updating our scrollbars until the first layout has occurred.
+    void setScrollbarsSuppressed(bool suppressed) { m_scrollbarsSuppressed = suppressed; }
     bool scrollbarsSuppressed() const { return m_scrollbarsSuppressed; }
 
     // Methods for converting between this frame and other coordinate spaces.
@@ -589,7 +589,6 @@
     void setHasHorizontalScrollbar(bool);
     void setHasVerticalScrollbar(bool);
 
-    void invalidateScrollCornerRect(const IntRect&) override;
     ScrollBehavior scrollBehaviorStyle() const override;
 
     void scrollContentsIfNeeded();
@@ -744,6 +743,10 @@
     void updateViewportIntersectionIfNeeded();
     void notifyIntersectionObservers();
 
+    // PaintInvalidationCapableScrollableArea
+    LayoutBox& boxForScrollControlPaintInvalidation() const override;
+    LayoutScrollbarPart* resizer() const override { return nullptr; }
+
     LayoutSize m_size;
 
     typedef HashSet<RefPtr<LayoutEmbeddedObject>> EmbeddedObjectSet;
diff --git a/third_party/WebKit/Source/core/frame/LocalFrame.cpp b/third_party/WebKit/Source/core/frame/LocalFrame.cpp
index 16bb9bb..455246e4 100644
--- a/third_party/WebKit/Source/core/frame/LocalFrame.cpp
+++ b/third_party/WebKit/Source/core/frame/LocalFrame.cpp
@@ -257,6 +257,8 @@
 
 void LocalFrame::navigate(const FrameLoadRequest& request)
 {
+    if (!isNavigationAllowed())
+        return;
     m_loader.load(request);
 }
 
@@ -878,6 +880,7 @@
     , m_eventHandler(adoptPtrWillBeNoop(new EventHandler(this)))
     , m_console(FrameConsole::create(*this))
     , m_inputMethodController(InputMethodController::create(*this))
+    , m_navigationDisableCount(0)
     , m_pageZoomFactor(parentPageZoomFactor(this))
     , m_textZoomFactor(parentTextZoomFactor(this))
     , m_inViewSourceMode(false)
@@ -909,4 +912,15 @@
 
 DEFINE_WEAK_IDENTIFIER_MAP(LocalFrame);
 
+FrameNavigationDisabler::FrameNavigationDisabler(LocalFrame& frame)
+    : m_frame(&frame)
+{
+    m_frame->disableNavigation();
+}
+
+FrameNavigationDisabler::~FrameNavigationDisabler()
+{
+    m_frame->enableNavigation();
+}
+
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/frame/LocalFrame.h b/third_party/WebKit/Source/core/frame/LocalFrame.h
index be53fd4..03af3b91 100644
--- a/third_party/WebKit/Source/core/frame/LocalFrame.h
+++ b/third_party/WebKit/Source/core/frame/LocalFrame.h
@@ -184,13 +184,15 @@
 
     bool shouldThrottleRendering() const;
 
-    // ========
-
     // Returns the frame scheduler, creating one if needed.
     WebFrameScheduler* frameScheduler();
     void updateFrameSecurityOrigin();
 
+    bool isNavigationAllowed() const { return m_navigationDisableCount == 0; }
+
 private:
+    friend class FrameNavigationDisabler;
+
     LocalFrame(FrameLoaderClient*, FrameHost*, FrameOwner*);
 
     // Internal Frame helper overrides:
@@ -204,6 +206,9 @@
         RespectImageOrientationEnum shouldRespectImageOrientation, const GlobalPaintFlags,
         IntRect paintingRect, float opacity = 1);
 
+    void enableNavigation() { --m_navigationDisableCount; }
+    void disableNavigation() { ++m_navigationDisableCount; }
+
     mutable FrameLoader m_loader;
     OwnPtrWillBeMember<NavigationScheduler> m_navigationScheduler;
 
@@ -221,6 +226,8 @@
     const OwnPtrWillBeMember<InputMethodController> m_inputMethodController;
     OwnPtr<WebFrameScheduler> m_frameScheduler;
 
+    int m_navigationDisableCount;
+
 #if ENABLE(OILPAN)
     // Oilpan: in order to reliably finalize plugin elements with
     // renderer-less plugins, the frame keeps track of them. When
@@ -327,6 +334,17 @@
 
 DECLARE_WEAK_IDENTIFIER_MAP(LocalFrame);
 
+class FrameNavigationDisabler {
+    WTF_MAKE_NONCOPYABLE(FrameNavigationDisabler);
+    STACK_ALLOCATED();
+public:
+    explicit FrameNavigationDisabler(LocalFrame&);
+    ~FrameNavigationDisabler();
+
+private:
+    RawPtrWillBeMember<LocalFrame> m_frame;
+};
+
 } // namespace blink
 
 // During refactoring, there are some places where we need to do type conversions that
diff --git a/third_party/WebKit/Source/core/frame/Navigator.cpp b/third_party/WebKit/Source/core/frame/Navigator.cpp
index 379afd2a..fcf0089 100644
--- a/third_party/WebKit/Source/core/frame/Navigator.cpp
+++ b/third_party/WebKit/Source/core/frame/Navigator.cpp
@@ -85,11 +85,6 @@
     return cookiesEnabled(m_frame->document());
 }
 
-void Navigator::getStorageUpdates()
-{
-    // FIXME: Remove this method or rename to yieldForStorageUpdates.
-}
-
 Vector<String> Navigator::languages()
 {
     Vector<String> languages;
diff --git a/third_party/WebKit/Source/core/frame/Navigator.h b/third_party/WebKit/Source/core/frame/Navigator.h
index a3129e08..9351b69 100644
--- a/third_party/WebKit/Source/core/frame/Navigator.h
+++ b/third_party/WebKit/Source/core/frame/Navigator.h
@@ -63,9 +63,6 @@
 
     String userAgent() const override;
 
-    // Relinquishes the storage lock, if one exists.
-    void getStorageUpdates();
-
     // NavigatorLanguage
     Vector<String> languages() override;
 
diff --git a/third_party/WebKit/Source/core/frame/NavigatorStorageUtils.idl b/third_party/WebKit/Source/core/frame/NavigatorStorageUtils.idl
index e41b6024..b408dc7d 100644
--- a/third_party/WebKit/Source/core/frame/NavigatorStorageUtils.idl
+++ b/third_party/WebKit/Source/core/frame/NavigatorStorageUtils.idl
@@ -8,6 +8,4 @@
     NoInterfaceObject, // Always used on target of 'implements'
 ] interface NavigatorStorageUtils {
     readonly attribute boolean cookieEnabled;
-    // TODO(philipj): This is called yieldForStorageUpdates() in the spec.
-    [Measure] void getStorageUpdates();
 };
diff --git a/third_party/WebKit/Source/core/frame/RootFrameViewport.cpp b/third_party/WebKit/Source/core/frame/RootFrameViewport.cpp
index 8c5e302ec..6bc56742 100644
--- a/third_party/WebKit/Source/core/frame/RootFrameViewport.cpp
+++ b/third_party/WebKit/Source/core/frame/RootFrameViewport.cpp
@@ -210,14 +210,9 @@
     return layoutViewport().shouldPlaceVerticalScrollbarOnLeft();
 }
 
-void RootFrameViewport::invalidateScrollbarRect(Scrollbar* scrollbar, const IntRect& rect)
+void RootFrameViewport::scrollControlWasSetNeedsPaintInvalidation()
 {
-    layoutViewport().invalidateScrollbarRect(scrollbar, rect);
-}
-
-void RootFrameViewport::invalidateScrollCornerRect(const IntRect& rect)
-{
-    layoutViewport().invalidateScrollCornerRect(rect);
+    layoutViewport().scrollControlWasSetNeedsPaintInvalidation();
 }
 
 GraphicsLayer* RootFrameViewport::layerForContainer() const
diff --git a/third_party/WebKit/Source/core/frame/RootFrameViewport.h b/third_party/WebKit/Source/core/frame/RootFrameViewport.h
index 83dbd0d2..fca0dfcc 100644
--- a/third_party/WebKit/Source/core/frame/RootFrameViewport.h
+++ b/third_party/WebKit/Source/core/frame/RootFrameViewport.h
@@ -58,8 +58,7 @@
     IntRect scrollableAreaBoundingBox() const override;
     bool userInputScrollable(ScrollbarOrientation) const override;
     bool shouldPlaceVerticalScrollbarOnLeft() const override;
-    void invalidateScrollbarRect(Scrollbar*, const IntRect&) override;
-    void invalidateScrollCornerRect(const IntRect&) override;
+    void scrollControlWasSetNeedsPaintInvalidation() override;
     GraphicsLayer* layerForContainer() const override;
     GraphicsLayer* layerForScrolling() const override;
     GraphicsLayer* layerForHorizontalScrollbar() const override;
diff --git a/third_party/WebKit/Source/core/frame/RootFrameViewportTest.cpp b/third_party/WebKit/Source/core/frame/RootFrameViewportTest.cpp
index 2b83908d..cf5dc16 100644
--- a/third_party/WebKit/Source/core/frame/RootFrameViewportTest.cpp
+++ b/third_party/WebKit/Source/core/frame/RootFrameViewportTest.cpp
@@ -89,8 +89,7 @@
     bool scrollbarsCanBeActive() const override { return true; }
     IntRect scrollableAreaBoundingBox() const override { return IntRect(); }
     bool shouldPlaceVerticalScrollbarOnLeft() const override { return true; }
-    void invalidateScrollbarRect(Scrollbar*, const IntRect&) override { }
-    void invalidateScrollCornerRect(const IntRect&) override { }
+    void scrollControlWasSetNeedsPaintInvalidation() override { }
     GraphicsLayer* layerForContainer() const override { return nullptr; }
     GraphicsLayer* layerForScrolling() const override { return nullptr; }
     GraphicsLayer* layerForHorizontalScrollbar() const override { return nullptr; }
diff --git a/third_party/WebKit/Source/core/frame/SubresourceIntegrity.h b/third_party/WebKit/Source/core/frame/SubresourceIntegrity.h
index 8fdec42..420c09e 100644
--- a/third_party/WebKit/Source/core/frame/SubresourceIntegrity.h
+++ b/third_party/WebKit/Source/core/frame/SubresourceIntegrity.h
@@ -5,6 +5,7 @@
 #ifndef SubresourceIntegrity_h
 #define SubresourceIntegrity_h
 
+#include "base/gtest_prod_util.h"
 #include "core/CoreExport.h"
 #include "core/fetch/IntegrityMetadata.h"
 #include "platform/Crypto.h"
@@ -40,12 +41,10 @@
     static IntegrityParseResult parseIntegrityAttribute(const WTF::String& attribute, IntegrityMetadataSet&, Document*);
 
 private:
-    // FIXME: After the merge with the Chromium repo, this should be refactored
-    // to use FRIEND_TEST in base/gtest_prod_util.h.
     friend class SubresourceIntegrityTest;
-    friend class SubresourceIntegrityTest_Parsing_Test;
-    friend class SubresourceIntegrityTest_ParseAlgorithm_Test;
-    friend class SubresourceIntegrityTest_Prioritization_Test;
+    FRIEND_TEST_ALL_PREFIXES(SubresourceIntegrityTest, Parsing);
+    FRIEND_TEST_ALL_PREFIXES(SubresourceIntegrityTest, ParseAlgorithm);
+    FRIEND_TEST_ALL_PREFIXES(SubresourceIntegrityTest, Prioritization);
 
     enum AlgorithmParseResult {
         AlgorithmValid,
diff --git a/third_party/WebKit/Source/core/frame/SubresourceIntegrityTest.cpp b/third_party/WebKit/Source/core/frame/SubresourceIntegrityTest.cpp
index 01ba4ef4..cda218a 100644
--- a/third_party/WebKit/Source/core/frame/SubresourceIntegrityTest.cpp
+++ b/third_party/WebKit/Source/core/frame/SubresourceIntegrityTest.cpp
@@ -14,11 +14,11 @@
 #include "platform/Crypto.h"
 #include "platform/weborigin/KURL.h"
 #include "platform/weborigin/SecurityOrigin.h"
+#include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/RefPtr.h"
 #include "wtf/Vector.h"
 #include "wtf/dtoa/utils.h"
 #include "wtf/text/WTFString.h"
-#include <gtest/gtest.h>
 
 namespace blink {
 
diff --git a/third_party/WebKit/Source/core/frame/UseCounter.h b/third_party/WebKit/Source/core/frame/UseCounter.h
index 895bda7f..7197833 100644
--- a/third_party/WebKit/Source/core/frame/UseCounter.h
+++ b/third_party/WebKit/Source/core/frame/UseCounter.h
@@ -684,7 +684,6 @@
         V8IDBDatabase_ObjectStoreNames_AttributeGetter = 824,
         V8IDBObjectStore_IndexNames_AttributeGetter = 825,
         V8IDBTransaction_ObjectStoreNames_AttributeGetter = 826,
-        V8Navigator_GetStorageUpdates_Method = 827,
         TextInputFired = 830,
         V8TextEvent_Data_AttributeGetter = 831,
         V8TextEvent_InitTextEvent_Method = 832,
diff --git a/third_party/WebKit/Source/core/frame/VisualViewport.cpp b/third_party/WebKit/Source/core/frame/VisualViewport.cpp
index e213c0895..0eedd169 100644
--- a/third_party/WebKit/Source/core/frame/VisualViewport.cpp
+++ b/third_party/WebKit/Source/core/frame/VisualViewport.cpp
@@ -543,12 +543,6 @@
     return frame->view()->visibleContentRect(IncludeScrollbars).size();
 }
 
-void VisualViewport::invalidateScrollbarRect(Scrollbar*, const IntRect&)
-{
-    // Do nothing. Visual scrollbars live on the compositor thread and will
-    // be updated when the viewport is synced to the CC.
-}
-
 void VisualViewport::setScrollOffset(const IntPoint& offset, ScrollType scrollType)
 {
     setScrollOffset(DoublePoint(offset), scrollType);
diff --git a/third_party/WebKit/Source/core/frame/VisualViewport.h b/third_party/WebKit/Source/core/frame/VisualViewport.h
index 5538abd..606f3079 100644
--- a/third_party/WebKit/Source/core/frame/VisualViewport.h
+++ b/third_party/WebKit/Source/core/frame/VisualViewport.h
@@ -186,8 +186,7 @@
     IntRect scrollableAreaBoundingBox() const override;
     bool userInputScrollable(ScrollbarOrientation) const override { return true; }
     bool shouldPlaceVerticalScrollbarOnLeft() const override { return false; }
-    void invalidateScrollbarRect(Scrollbar*, const IntRect&) override;
-    void invalidateScrollCornerRect(const IntRect&) override { }
+    void scrollControlWasSetNeedsPaintInvalidation() override { }
     void setScrollOffset(const IntPoint&, ScrollType) override;
     void setScrollOffset(const DoublePoint&, ScrollType) override;
     GraphicsLayer* layerForContainer() const override;
diff --git a/third_party/WebKit/Source/core/inspector/InspectorCSSAgent.cpp b/third_party/WebKit/Source/core/inspector/InspectorCSSAgent.cpp
index ff935c6..a7dc1e9 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorCSSAgent.cpp
+++ b/third_party/WebKit/Source/core/inspector/InspectorCSSAgent.cpp
@@ -1767,7 +1767,7 @@
 
     WillBeHeapVector<RefPtrWillBeMember<CSSStyleRule>> rules = filterDuplicateRules(styleResolver.pseudoCSSRulesForElement(element, pseudoId, StyleResolver::AllCSSRules));
     WillBeHeapVector<RefPtrWillBeMember<CSSStyleDeclaration>> styles;
-    if (element->style())
+    if (!pseudoId && element->style())
         styles.append(element->style());
     for (unsigned i = rules.size(); i > 0; --i) {
         CSSStyleSheet* parentStyleSheet = rules.at(i - 1)->parentStyleSheet();
diff --git a/third_party/WebKit/Source/core/inspector/InspectorOverlayPage.html b/third_party/WebKit/Source/core/inspector/InspectorOverlayPage.html
index da7b8d84..3671ee5 100644
--- a/third_party/WebKit/Source/core/inspector/InspectorOverlayPage.html
+++ b/third_party/WebKit/Source/core/inspector/InspectorOverlayPage.html
@@ -222,7 +222,7 @@
     content: "";
     position: absolute;
     width: 8px;
-    border-right: 2px dotted rgba(255, 255, 255, 0.4);
+    border-bottom: 2px dotted rgba(255, 255, 255, 0.4);
     top: 2px;
     left: 4px;
 }
@@ -1525,10 +1525,14 @@
     _onMouseWheel: function(event)
     {
         event.preventDefault();
-        if (event.wheelDelta > 0)
-            InspectorOverlayHost.previousSelector();
-        else
+        this._mouseWheelDelta = (this._mouseWheelDelta || 0) + event.wheelDelta;
+        if (this._mouseWheelDelta >= 120) {
             InspectorOverlayHost.nextSelector();
+            this._mouseWheelDelta = 0;
+        } else if (this._mouseWheelDelta <= -120) {
+            InspectorOverlayHost.previousSelector();
+            this._mouseWheelDelta = 0;
+        }
     },
 
     /**
diff --git a/third_party/WebKit/Source/core/layout/LayoutBlock.cpp b/third_party/WebKit/Source/core/layout/LayoutBlock.cpp
index e337c7de..ba3abb1d 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBlock.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBlock.cpp
@@ -618,8 +618,13 @@
         return;
 
     Vector<LayoutBlock*, 3> blocksToRemove;
+    Vector<LayoutBox*, 16> floatsToRemoveFromFloatLists;
     for (LayoutObject* child = firstChild(); child; child = child->nextSibling()) {
-        if (child->isFloatingOrOutOfFlowPositioned())
+        if (child->isFloating()) {
+            floatsToRemoveFromFloatLists.append(toLayoutBox(child));
+            continue;
+        }
+        if (child->isOutOfFlowPositioned())
             continue;
 
         // There are still block children in the container, so any anonymous wrappers are still needed.
@@ -642,6 +647,12 @@
         blocksToRemove.append(toLayoutBlock(child));
     }
 
+    // If we make an object's children inline we are going to frustrate any future attempts to remove
+    // floats from its children's float-lists before the next layout happens so remove them proactively here.
+    // TODO(rhogan): We need to understand if intruding floats in this object's float list need to be removed also.
+    for (size_t i = 0; i < floatsToRemoveFromFloatLists.size(); i++)
+        toLayoutBlockFlow(this)->markAllDescendantsWithFloatsForLayout(floatsToRemoveFromFloatLists[i]);
+
     for (size_t i = 0; i < blocksToRemove.size(); i++)
         collapseAnonymousBlockChild(this, blocksToRemove[i]);
     setChildrenInline(true);
diff --git a/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp b/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
index 32c4ec8..796ecfb 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBlockFlow.cpp
@@ -1734,7 +1734,10 @@
     if (floatToRemove)
         removeFloatingObject(floatToRemove);
 
-    // Iterate over our children and mark them as needed.
+    // Iterate over our children and mark them as needed. If our children are inline, then the
+    // only boxes which could contain floats are atomic inlines (e.g. inline-block, float etc.) and these create formatting
+    // contexts, so can't pick up intruding floats from ancestors/siblings - making them safe to skip.
+    // TODO(rhogan): Should this be !createsNewFormattingContext() instead of !childrenInline()?
     if (!childrenInline()) {
         for (LayoutObject* child = firstChild(); child; child = child->nextSibling()) {
             if ((!floatToRemove && child->isFloatingOrOutOfFlowPositioned()) || !child->isLayoutBlock())
@@ -1850,6 +1853,7 @@
 
 void LayoutBlockFlow::styleDidChange(StyleDifference diff, const ComputedStyle* oldStyle)
 {
+    bool hadSelfPaintingLayer = hasSelfPaintingLayer();
     LayoutBlock::styleDidChange(diff, oldStyle);
 
     // After our style changed, if we lose our ability to propagate floats into next sibling
@@ -1857,7 +1861,20 @@
     // then mark its descendants with floats for layout and clear all floats from its next
     // sibling blocks that exist in our floating objects list. See bug 56299 and 62875.
     bool canPropagateFloatIntoSibling = !isFloatingOrOutOfFlowPositioned() && !avoidsFloats();
-    if (diff.needsFullLayout() && s_canPropagateFloatIntoSibling && !canPropagateFloatIntoSibling && hasOverhangingFloats()) {
+    bool siblingFloatPropagationChanged = diff.needsFullLayout() && s_canPropagateFloatIntoSibling && !canPropagateFloatIntoSibling && hasOverhangingFloats();
+
+    // When this object's self-painting layer status changed, we should update FloatingObjects::shouldPaint() flags for
+    // descendant overhanging floats in ancestors.
+    bool needsUpdateAncestorFloatObjectShouldPaintFlags = false;
+    if (hasSelfPaintingLayer() != hadSelfPaintingLayer && hasOverhangingFloats()) {
+        setNeedsLayout(LayoutInvalidationReason::StyleChange);
+        if (hadSelfPaintingLayer)
+            markAllDescendantsWithFloatsForLayout();
+        else
+            needsUpdateAncestorFloatObjectShouldPaintFlags = true;
+    }
+
+    if (siblingFloatPropagationChanged || needsUpdateAncestorFloatObjectShouldPaintFlags) {
         LayoutBlockFlow* parentBlockFlow = this;
         const FloatingObjectSet& floatingObjectSet = m_floatingObjects->set();
         FloatingObjectSetIterator end = floatingObjectSet.end();
@@ -1879,7 +1896,8 @@
         }
 
         parentBlockFlow->markAllDescendantsWithFloatsForLayout();
-        parentBlockFlow->markSiblingsWithFloatsForLayout();
+        if (siblingFloatPropagationChanged)
+            parentBlockFlow->markSiblingsWithFloatsForLayout();
     }
 
     if (diff.needsFullLayout() || !oldStyle)
diff --git a/third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp b/third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp
index cce4051..7295109 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBlockFlowLine.cpp
@@ -1856,6 +1856,7 @@
 }
 
 bool LayoutBlockFlow::generatesLineBoxesForInlineChild(LayoutObject* inlineObj)
+
 {
     ASSERT(inlineObj->parent() == this);
 
@@ -1867,9 +1868,13 @@
     return !it.atEnd();
 }
 
+
 void LayoutBlockFlow::addOverflowFromInlineChildren()
 {
     LayoutUnit endPadding = hasOverflowClip() ? paddingEnd() : LayoutUnit();
+    // FIXME: Need to find another way to do this, since scrollbars could show when we don't want them to.
+    if (hasOverflowClip() && !endPadding && node() && node()->isRootEditableElement() && style()->isLeftToRightDirection())
+        endPadding = 1;
     for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
         addLayoutOverflow(curr->paddedLayoutOverflowRect(endPadding));
         LayoutRect visualOverflow = curr->visualOverflowRect(curr->lineTop(), curr->lineBottom());
diff --git a/third_party/WebKit/Source/core/layout/LayoutBox.cpp b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
index c246454..80c7de4 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBox.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBox.cpp
@@ -1429,7 +1429,7 @@
     return rect.intersects(LayoutRect(layoutView->frameView()->scrollableArea()->visibleContentRectDouble()));
 }
 
-PaintInvalidationReason LayoutBox::invalidatePaintIfNeeded(PaintInvalidationState& paintInvalidationState, const LayoutBoxModelObject& newPaintInvalidationContainer)
+PaintInvalidationReason LayoutBox::invalidatePaintIfNeeded(PaintInvalidationState& paintInvalidationState, const LayoutBoxModelObject& paintInvalidationContainer)
 {
     PaintInvalidationReason fullInvalidationReason = fullPaintInvalidationReason();
     // If the current paint invalidation reason is PaintInvalidationDelayedFull, then this paint invalidation can delayed if the
@@ -1443,54 +1443,19 @@
         setShouldDoFullPaintInvalidation(PaintInvalidationFull);
     }
 
-    PaintInvalidationReason reason = LayoutBoxModelObject::invalidatePaintIfNeeded(paintInvalidationState, newPaintInvalidationContainer);
+    PaintInvalidationReason reason = LayoutBoxModelObject::invalidatePaintIfNeeded(paintInvalidationState, paintInvalidationContainer);
 
-    bool willDoFullInvalidation = view()->doingFullPaintInvalidation() || isFullPaintInvalidationReason(reason);
-    if (!willDoFullInvalidation)
+    if (!view()->doingFullPaintInvalidation() && !isFullPaintInvalidationReason(reason))
         invalidatePaintForOverflowIfNeeded();
 
-    // Issue paint invalidations for any scrollbars if there is a scrollable area for this layoutObject.
-    if (ScrollableArea* area = scrollableArea()) {
-        if (area->hasVerticalBarDamage()) {
-            if (!willDoFullInvalidation)
-                invalidatePaintRectangleNotInvalidatingDisplayItemClients(LayoutRect(area->verticalBarDamage()));
-            // TODO(wangxianzhu): Pass current bounds of the scrollbar to PaintController. crbug.com/547119.
-            if (Scrollbar* verticalScrollbar = area->verticalScrollbar())
-                invalidateDisplayItemClient(*verticalScrollbar);
-        }
-        if (area->hasHorizontalBarDamage()) {
-            if (!willDoFullInvalidation)
-                invalidatePaintRectangleNotInvalidatingDisplayItemClients(LayoutRect(area->horizontalBarDamage()));
-            // TODO(wangxianzhu): Pass current bounds of the scrollbar to PaintController. crbug.com/547119.
-            if (Scrollbar* horizontalScrollbar = area->horizontalScrollbar())
-                invalidateDisplayItemClient(*horizontalScrollbar);
-        }
-    }
+    if (PaintLayerScrollableArea* area = scrollableArea())
+        area->invalidatePaintOfScrollControlsIfNeeded(paintInvalidationState, paintInvalidationContainer);
 
     // This is for the next invalidatePaintIfNeeded so must be at the end.
     savePreviousBoxSizesIfNeeded();
     return reason;
 }
 
-void LayoutBox::clearPaintInvalidationState(const PaintInvalidationState& paintInvalidationState)
-{
-    LayoutBoxModelObject::clearPaintInvalidationState(paintInvalidationState);
-
-    if (ScrollableArea* area = scrollableArea())
-        area->resetScrollbarDamage();
-}
-
-#if ENABLE(ASSERT)
-bool LayoutBox::paintInvalidationStateIsDirty() const
-{
-    if (ScrollableArea* area = scrollableArea()) {
-        if (area->hasVerticalBarDamage() || area->hasHorizontalBarDamage())
-            return true;
-    }
-    return LayoutBoxModelObject::paintInvalidationStateIsDirty();
-}
-#endif
-
 LayoutRect LayoutBox::overflowClipRect(const LayoutPoint& location, OverlayScrollbarSizeRelevancy relevancy) const
 {
     // FIXME: When overflow-clip (CSS3) is implemented, we'll obtain the property
diff --git a/third_party/WebKit/Source/core/layout/LayoutBox.h b/third_party/WebKit/Source/core/layout/LayoutBox.h
index 896c08f3..2c3f18c 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBox.h
+++ b/third_party/WebKit/Source/core/layout/LayoutBox.h
@@ -879,12 +879,7 @@
         const LayoutRect& newBounds, const LayoutPoint& newPositionFromPaintInvalidationContainer) const override;
     void incrementallyInvalidatePaint(const LayoutBoxModelObject& paintInvalidationContainer, const LayoutRect& oldBounds, const LayoutRect& newBounds, const LayoutPoint& positionFromPaintInvalidationContainer) override;
 
-    void clearPaintInvalidationState(const PaintInvalidationState&) override;
-#if ENABLE(ASSERT)
-    bool paintInvalidationStateIsDirty() const override;
-#endif
-
-    PaintInvalidationReason invalidatePaintIfNeeded(PaintInvalidationState&, const LayoutBoxModelObject& newPaintInvalidationContainer) override;
+    PaintInvalidationReason invalidatePaintIfNeeded(PaintInvalidationState&, const LayoutBoxModelObject& paintInvalidationContainer) override;
 
     bool hasNonCompositedScrollbars() const final;
     void excludeScrollbars(LayoutRect&, OverlayScrollbarSizeRelevancy = IgnoreOverlayScrollbarSize) const;
diff --git a/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp b/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
index f04e9d6da..db014c3 100644
--- a/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutBoxModelObject.cpp
@@ -247,7 +247,7 @@
         bool newStyleIsFixedPosition = style()->position() == FixedPosition;
         bool oldStyleIsFixedPosition = oldStyle->position() == FixedPosition;
         if (newStyleIsFixedPosition != oldStyleIsFixedPosition)
-            invalidateDisplayItemClientForNonCompositingDescendants();
+            invalidateDisplayItemClientsIncludingNonCompositingDescendants(nullptr, PaintInvalidationStyleChange, nullptr);
     }
 
     // The used style for body background may change due to computed style change
diff --git a/third_party/WebKit/Source/core/layout/LayoutObject.cpp b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
index ddb466c5..1a84b2d 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObject.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutObject.cpp
@@ -3298,14 +3298,11 @@
 
 namespace {
 
-// TODO(trchen): Use std::function<void, LayoutObject&> and lambda when available.
-class LayoutObjectTraversalFunctor {
-public:
-    virtual void operator()(LayoutObject&) const = 0;
-};
-
+// TODO(trchen): Use std::function<void, LayoutObject&> when available.
+template <typename LayoutObjectTraversalFunctor>
 void traverseNonCompositingDescendants(LayoutObject&, const LayoutObjectTraversalFunctor&);
 
+template <typename LayoutObjectTraversalFunctor>
 void findNonCompositedDescendantLayerToTraverse(LayoutObject& object, const LayoutObjectTraversalFunctor& functor)
 {
     LayoutObject* descendant = object.nextInPreOrder(&object);
@@ -3336,6 +3333,7 @@
     }
 }
 
+template <typename LayoutObjectTraversalFunctor>
 void traverseNonCompositingDescendants(LayoutObject& object, const LayoutObjectTraversalFunctor& functor)
 {
     functor(object);
@@ -3360,37 +3358,24 @@
 
 } // unnamed namespace
 
-void LayoutObject::invalidateDisplayItemClientForNonCompositingDescendantsOf(const LayoutObject& object) const
+void LayoutObject::invalidateDisplayItemClientsIncludingNonCompositingDescendants(const LayoutBoxModelObject* paintInvalidationContainer, PaintInvalidationReason paintInvalidationReason, const LayoutRect* paintInvalidationRect) const
 {
-    // Not using enclosingCompositedContainer() directly because this object may be in an orphaned subtree.
-    PaintLayer* enclosingLayer = this->enclosingLayer();
-    if (!enclosingLayer)
-        return;
-
-    // TODO(wangxianzhu): This is a workaround for invalidation of detached custom scrollbar parts which can't find
-    // their own enclosing layers. May remove this when fixing crbug.com/547119 for scrollbars.
-    enclosingLayer->setNeedsRepaint();
-
     // This is valid because we want to invalidate the client in the display item list of the current backing.
     DisableCompositingQueryAsserts disabler;
-    const PaintLayer* paintInvalidationLayer = enclosingLayer->enclosingLayerForPaintInvalidationCrossingFrameBoundaries();
-    if (!paintInvalidationLayer)
-        return;
+    if (!paintInvalidationContainer) {
+        // Not using enclosingCompositedContainer() directly because this object may be in an orphaned subtree.
+        PaintLayer* enclosingLayer = this->enclosingLayer();
+        if (!enclosingLayer)
+            return;
+        const PaintLayer* paintInvalidationLayer = enclosingLayer->enclosingLayerForPaintInvalidationCrossingFrameBoundaries();
+        if (!paintInvalidationLayer)
+            return;
+        paintInvalidationContainer = paintInvalidationLayer->layoutObject();
+    }
 
-    class Functor : public LayoutObjectTraversalFunctor {
-    public:
-        explicit Functor(const LayoutBoxModelObject& paintInvalidationContainer) : m_paintInvalidationContainer(paintInvalidationContainer) { }
-        void operator()(LayoutObject& object) const override
-        {
-            // TODO(wangxianzhu): Ensure correct bounds for the client will be or has been passed to PaintController. crbug.com/547119.
-            object.invalidateDisplayItemClients(m_paintInvalidationContainer, PaintInvalidationFull, nullptr);
-        }
-    private:
-        const LayoutBoxModelObject& m_paintInvalidationContainer;
-    };
-
-    const LayoutBoxModelObject& paintInvalidationContainer = *paintInvalidationLayer->layoutObject();
-    traverseNonCompositingDescendants(const_cast<LayoutObject&>(object), Functor(paintInvalidationContainer));
+    traverseNonCompositingDescendants(const_cast<LayoutObject&>(*this), [&paintInvalidationContainer, paintInvalidationReason, paintInvalidationRect](LayoutObject& object) {
+        object.invalidateDisplayItemClients(*paintInvalidationContainer, paintInvalidationReason, paintInvalidationRect);
+    });
 }
 
 void LayoutObject::invalidatePaintOfPreviousPaintInvalidationRect(const LayoutBoxModelObject& paintInvalidationContainer, PaintInvalidationReason reason)
@@ -3416,36 +3401,21 @@
 
 void LayoutObject::invalidatePaintIncludingNonCompositingDescendants()
 {
-    class Functor : public LayoutObjectTraversalFunctor {
-    public:
-        explicit Functor(const LayoutBoxModelObject& paintInvalidationContainer) : m_paintInvalidationContainer(paintInvalidationContainer) { }
-        void operator()(LayoutObject& object) const override
-        {
-            object.invalidatePaintOfPreviousPaintInvalidationRect(m_paintInvalidationContainer, PaintInvalidationLayer);
-        }
-    private:
-        const LayoutBoxModelObject& m_paintInvalidationContainer;
-    };
-
     // Since we're only painting non-composited layers, we know that they all share the same paintInvalidationContainer.
     const LayoutBoxModelObject& paintInvalidationContainer = containerForPaintInvalidationOnRootedTree();
-    traverseNonCompositingDescendants(*this, Functor(paintInvalidationContainer));
+    traverseNonCompositingDescendants(*this, [&paintInvalidationContainer](LayoutObject& object) {
+        object.invalidatePaintOfPreviousPaintInvalidationRect(paintInvalidationContainer, PaintInvalidationLayer);
+    });
 }
 
 // FIXME: If we had a flag to force invalidations in a whole subtree, we could get rid of this function (crbug.com/410097).
 void LayoutObject::setShouldDoFullPaintInvalidationIncludingNonCompositingDescendants()
 {
-    class Functor : public LayoutObjectTraversalFunctor {
-    public:
-        void operator()(LayoutObject& object) const override
-        {
-            object.setShouldDoFullPaintInvalidation();
-        }
-    };
-
     // Need to access the current compositing status.
     DisableCompositingQueryAsserts disabler;
-    traverseNonCompositingDescendants(*this, Functor());
+    traverseNonCompositingDescendants(*this, [](LayoutObject& object) {
+        object.setShouldDoFullPaintInvalidation();
+    });
 }
 
 void LayoutObject::invalidatePaintIncludingNonSelfPaintingLayerDescendants(const LayoutBoxModelObject& paintInvalidationContainer)
diff --git a/third_party/WebKit/Source/core/layout/LayoutObject.h b/third_party/WebKit/Source/core/layout/LayoutObject.h
index 6b76d49..62831da 100644
--- a/third_party/WebKit/Source/core/layout/LayoutObject.h
+++ b/third_party/WebKit/Source/core/layout/LayoutObject.h
@@ -1300,14 +1300,7 @@
     DisplayItemClient displayItemClient() const { return toDisplayItemClient(this); }
 
     void invalidateDisplayItemClient(const DisplayItemClientWrapper&) const;
-    void invalidateDisplayItemClientForNonCompositingDescendants() const { invalidateDisplayItemClientForNonCompositingDescendantsOf(*this); }
-    // A normal object should use invalidateDisplayItemClientForNonCompositingDescendants()
-    // to invalidate its descendants which are painted on the same backing. However, for
-    // an object (e.g. LayoutScrollbarPart, custom scroll corner, custom resizer) which is
-    // not hooked up in the layout tree and not able to find its paint backing, it should
-    // let its owning layout object call the following function.
-    // FIXME: should we hook up scrollbar parts in the layout tree? crbug.com/484263.
-    void invalidateDisplayItemClientForNonCompositingDescendantsOf(const LayoutObject&) const;
+    void invalidateDisplayItemClientsIncludingNonCompositingDescendants(const LayoutBoxModelObject* paintInvalidationContainer, PaintInvalidationReason, const LayoutRect* paintInvalidationRect) const;
 
     // Called before anonymousChild.setStyle(). Override to set custom styles for the child.
     virtual void updateAnonymousChildStyle(const LayoutObject& anonymousChild, ComputedStyle& style) const { }
diff --git a/third_party/WebKit/Source/core/layout/LayoutScrollbar.cpp b/third_party/WebKit/Source/core/layout/LayoutScrollbar.cpp
index ec94233..f3016e76 100644
--- a/third_party/WebKit/Source/core/layout/LayoutScrollbar.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutScrollbar.cpp
@@ -201,7 +201,7 @@
                 toLayoutBlock(box)->notifyScrollbarThicknessChanged();
             box->setChildNeedsLayout();
             if (m_scrollableArea)
-                m_scrollableArea->invalidateScrollCorner(m_scrollableArea->scrollCornerRect());
+                m_scrollableArea->setScrollCornerNeedsPaintInvalidation();
         }
     }
 }
@@ -362,15 +362,10 @@
     return orientation() == HorizontalScrollbar ? partLayoutObject->size().width() : partLayoutObject->size().height();
 }
 
-void LayoutScrollbar::invalidateRect(const IntRect& rect)
+void LayoutScrollbar::invalidateDisplayItemClientsOfScrollbarParts(const LayoutBoxModelObject& paintInvalidationContainer, const LayoutRect& paintInvalidationRect)
 {
-    Scrollbar::invalidateRect(rect);
-
-    // FIXME: invalidate only the changed part.
-    if (LayoutBox* owningLayoutObject = this->owningLayoutObject()) {
-        for (auto& part : m_parts)
-            owningLayoutObject->invalidateDisplayItemClientForNonCompositingDescendantsOf(*part.value);
-    }
+    for (auto& part : m_parts)
+        part.value->invalidateDisplayItemClientsIncludingNonCompositingDescendants(&paintInvalidationContainer, PaintInvalidationScroll, &paintInvalidationRect);
 }
 
 }
diff --git a/third_party/WebKit/Source/core/layout/LayoutScrollbar.h b/third_party/WebKit/Source/core/layout/LayoutScrollbar.h
index b67a9016..defe3a9a 100644
--- a/third_party/WebKit/Source/core/layout/LayoutScrollbar.h
+++ b/third_party/WebKit/Source/core/layout/LayoutScrollbar.h
@@ -33,11 +33,13 @@
 
 namespace blink {
 
+class ComputedStyle;
+class LayoutBox;
+class LayoutBoxModelObject;
+class LayoutScrollbarPart;
 class LocalFrame;
 class Node;
-class LayoutBox;
-class LayoutScrollbarPart;
-class ComputedStyle;
+class PaintInvalidationState;
 
 class LayoutScrollbar final : public Scrollbar {
 public:
@@ -58,7 +60,7 @@
     LayoutScrollbarPart* getPart(ScrollbarPart partType) { return m_parts.get(partType); }
     const LayoutScrollbarPart* getPart(ScrollbarPart partType) const { return m_parts.get(partType); }
 
-    void invalidateRect(const IntRect&) override;
+    void invalidateDisplayItemClientsOfScrollbarParts(const LayoutBoxModelObject& paintInvalidationContainer, const LayoutRect& paintInvalidationRect);
 
     DECLARE_VIRTUAL_TRACE();
 
diff --git a/third_party/WebKit/Source/core/layout/LayoutScrollbarPart.cpp b/third_party/WebKit/Source/core/layout/LayoutScrollbarPart.cpp
index 0af88ce..87294efd 100644
--- a/third_party/WebKit/Source/core/layout/LayoutScrollbarPart.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutScrollbarPart.cpp
@@ -31,6 +31,7 @@
 #include "core/layout/LayoutScrollbar.h"
 #include "core/layout/LayoutScrollbarTheme.h"
 #include "core/layout/LayoutView.h"
+#include "core/paint/PaintLayerScrollableArea.h"
 #include "platform/LengthFunctions.h"
 
 namespace blink {
@@ -179,24 +180,14 @@
     clearPositionedState();
     setFloating(false);
     setHasOverflowClip(false);
-    if (oldStyle && m_scrollbar && m_part != NoPart && (diff.needsPaintInvalidation() || diff.needsLayout()))
-        m_scrollbar->theme()->invalidatePart(m_scrollbar, m_part);
+    if (oldStyle && (diff.needsPaintInvalidation() || diff.needsLayout()))
+        setNeedsPaintInvalidation();
 }
 
 void LayoutScrollbarPart::imageChanged(WrappedImagePtr image, const IntRect* rect)
 {
-    if (m_scrollbar && m_part != NoPart) {
-        m_scrollbar->theme()->invalidatePart(m_scrollbar, m_part);
-    } else {
-        if (FrameView* frameView = view()->frameView()) {
-            if (frameView->isFrameViewScrollCorner(this)) {
-                frameView->invalidateScrollCorner(frameView->scrollCornerRect());
-                return;
-            }
-        }
-
-        LayoutBlock::imageChanged(image, rect);
-    }
+    setNeedsPaintInvalidation();
+    LayoutBlock::imageChanged(image, rect);
 }
 
 LayoutObject* LayoutScrollbarPart::layoutObjectOwningScrollbar() const
@@ -204,4 +195,24 @@
     return (!m_scrollbar) ? nullptr : m_scrollbar->owningLayoutObject();
 }
 
+void LayoutScrollbarPart::setNeedsPaintInvalidation()
+{
+    if (m_scrollbar) {
+        m_scrollbar->setNeedsPaintInvalidation();
+        return;
+    }
+
+    // This LayoutScrollbarPart is a scroll corner or a resizer.
+    ASSERT(m_part == NoPart);
+    if (FrameView* frameView = view()->frameView()) {
+        if (frameView->isFrameViewScrollCorner(this)) {
+            frameView->setScrollCornerNeedsPaintInvalidation();
+            return;
+        }
+    }
+
+    // This LayoutScrollbarPart belongs to a PaintLayerScrollableArea.
+    toLayoutBox(parent())->scrollableArea()->setScrollCornerNeedsPaintInvalidation();
+}
+
 }
diff --git a/third_party/WebKit/Source/core/layout/LayoutScrollbarPart.h b/third_party/WebKit/Source/core/layout/LayoutScrollbarPart.h
index f0f9f98..67ce9d1 100644
--- a/third_party/WebKit/Source/core/layout/LayoutScrollbarPart.h
+++ b/third_party/WebKit/Source/core/layout/LayoutScrollbarPart.h
@@ -103,6 +103,8 @@
     void computeScrollbarWidth();
     void computeScrollbarHeight();
 
+    void setNeedsPaintInvalidation();
+
     GC_PLUGIN_IGNORE("http://crbug.com/509911")
     LayoutScrollbar* m_scrollbar;
     ScrollbarPart m_part;
diff --git a/third_party/WebKit/Source/core/layout/LayoutTheme.cpp b/third_party/WebKit/Source/core/layout/LayoutTheme.cpp
index 8d98eb2..85b2c3c2 100644
--- a/third_party/WebKit/Source/core/layout/LayoutTheme.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutTheme.cpp
@@ -448,8 +448,7 @@
     if (state == PressedControlState && !isEnabled(o))
         return false;
 
-    o.setShouldDoFullPaintInvalidation();
-    o.invalidateDisplayItemClientForNonCompositingDescendants();
+    o.setShouldDoFullPaintInvalidationIncludingNonCompositingDescendants();
     return true;
 }
 
diff --git a/third_party/WebKit/Source/core/layout/LayoutView.cpp b/third_party/WebKit/Source/core/layout/LayoutView.cpp
index 5313853..18b2dbe 100644
--- a/third_party/WebKit/Source/core/layout/LayoutView.cpp
+++ b/third_party/WebKit/Source/core/layout/LayoutView.cpp
@@ -455,12 +455,14 @@
         return;
 
     if (LayoutBox* obj = owner->layoutBox()) {
-        // Intersect the viewport with the paint invalidation rect.
-        LayoutRect viewRectangle = viewRect();
-        rect.intersect(viewRectangle);
+        if (!state || !state->viewClippingAndScrollOffsetDisabled()) {
+            // Intersect the viewport with the paint invalidation rect.
+            LayoutRect viewRectangle = viewRect();
+            rect.intersect(viewRectangle);
 
-        // Adjust for scroll offset of the view.
-        rect.moveBy(-viewRectangle.location());
+            // Adjust for scroll offset of the view.
+            rect.moveBy(-viewRectangle.location());
+        }
 
         // Adjust for frame border.
         rect.move(obj->contentBoxOffset());
diff --git a/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp b/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
index 58fc44f..b33e5f409 100644
--- a/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
+++ b/third_party/WebKit/Source/core/layout/PaintInvalidationState.cpp
@@ -18,6 +18,7 @@
     , m_cachedOffsetsEnabled(true)
     , m_forcedSubtreeInvalidationWithinContainer(false)
     , m_forcedSubtreeInvalidationRectUpdateWithinContainer(false)
+    , m_viewClippingAndScrollOffsetDisabled(false)
     , m_paintInvalidationContainer(*layoutView.containerForPaintInvalidation())
     , m_pendingDelayedPaintInvalidations(pendingDelayedPaintInvalidations)
 {
@@ -43,6 +44,7 @@
     , m_cachedOffsetsEnabled(true)
     , m_forcedSubtreeInvalidationWithinContainer(next.m_forcedSubtreeInvalidationWithinContainer)
     , m_forcedSubtreeInvalidationRectUpdateWithinContainer(next.m_forcedSubtreeInvalidationRectUpdateWithinContainer)
+    , m_viewClippingAndScrollOffsetDisabled(false)
     , m_paintInvalidationContainer(paintInvalidationContainer)
     , m_pendingDelayedPaintInvalidations(next.pendingDelayedPaintInvalidationTargets())
 {
@@ -101,6 +103,7 @@
     , m_cachedOffsetsEnabled(next.m_cachedOffsetsEnabled)
     , m_forcedSubtreeInvalidationWithinContainer(next.m_forcedSubtreeInvalidationWithinContainer)
     , m_forcedSubtreeInvalidationRectUpdateWithinContainer(next.m_forcedSubtreeInvalidationRectUpdateWithinContainer)
+    , m_viewClippingAndScrollOffsetDisabled(false)
     , m_clipRect(next.m_clipRect)
     , m_paintOffset(next.m_paintOffset)
     , m_paintInvalidationContainer(next.m_paintInvalidationContainer)
diff --git a/third_party/WebKit/Source/core/layout/PaintInvalidationState.h b/third_party/WebKit/Source/core/layout/PaintInvalidationState.h
index 53c2d7f..7667d4e 100644
--- a/third_party/WebKit/Source/core/layout/PaintInvalidationState.h
+++ b/third_party/WebKit/Source/core/layout/PaintInvalidationState.h
@@ -53,6 +53,11 @@
     void pushDelayedPaintInvalidationTarget(LayoutObject& obj) { m_pendingDelayedPaintInvalidations.append(&obj); }
     Vector<LayoutObject*>& pendingDelayedPaintInvalidationTargets() { return m_pendingDelayedPaintInvalidations; }
 
+    // Disable view clipping and scroll offset adjustment for paint invalidation of FrameView scrollbars.
+    // TODO(wangxianzhu): Remove this when root-layer-scrolls launches.
+    bool viewClippingAndScrollOffsetDisabled() const { return m_viewClippingAndScrollOffsetDisabled; }
+    void setViewClippingAndScrollOffsetDisabled(bool b) { m_viewClippingAndScrollOffsetDisabled = b; }
+
 private:
     PaintInvalidationState(const LayoutView&, Vector<LayoutObject*>& pendingDelayedPaintInvalidations, PaintInvalidationState* ownerPaintInvalidationState);
 
@@ -65,6 +70,7 @@
     mutable bool m_cachedOffsetsEnabled;
     bool m_forcedSubtreeInvalidationWithinContainer;
     bool m_forcedSubtreeInvalidationRectUpdateWithinContainer;
+    bool m_viewClippingAndScrollOffsetDisabled;
 
     LayoutRect m_clipRect;
 
diff --git a/third_party/WebKit/Source/core/layout/compositing/PaintLayerCompositor.cpp b/third_party/WebKit/Source/core/layout/compositing/PaintLayerCompositor.cpp
index 9da2256..bcdfca5f 100644
--- a/third_party/WebKit/Source/core/layout/compositing/PaintLayerCompositor.cpp
+++ b/third_party/WebKit/Source/core/layout/compositing/PaintLayerCompositor.cpp
@@ -1038,7 +1038,7 @@
         if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
             scrollingCoordinator->scrollableAreaScrollbarLayerDidChange(m_layoutView.frameView(), HorizontalScrollbar);
         if (Scrollbar* horizontalScrollbar = m_layoutView.frameView()->horizontalScrollbar())
-            m_layoutView.frameView()->invalidateScrollbar(horizontalScrollbar, IntRect(IntPoint(0, 0), horizontalScrollbar->frameRect().size()));
+            m_layoutView.frameView()->setScrollbarNeedsPaintInvalidation(horizontalScrollbar);
     }
 
     if (m_layerForVerticalScrollbar) {
@@ -1047,12 +1047,12 @@
         if (ScrollingCoordinator* scrollingCoordinator = this->scrollingCoordinator())
             scrollingCoordinator->scrollableAreaScrollbarLayerDidChange(m_layoutView.frameView(), VerticalScrollbar);
         if (Scrollbar* verticalScrollbar = m_layoutView.frameView()->verticalScrollbar())
-            m_layoutView.frameView()->invalidateScrollbar(verticalScrollbar, IntRect(IntPoint(0, 0), verticalScrollbar->frameRect().size()));
+            m_layoutView.frameView()->setScrollbarNeedsPaintInvalidation(verticalScrollbar);
     }
 
     if (m_layerForScrollCorner) {
         m_layerForScrollCorner = nullptr;
-        m_layoutView.frameView()->invalidateScrollCorner(m_layoutView.frameView()->scrollCornerRect());
+        m_layoutView.frameView()->setScrollCornerNeedsPaintInvalidation();
     }
 
     if (m_overflowControlsHostLayer) {
diff --git a/third_party/WebKit/Source/core/layout/line/BreakingContextInlineHeaders.h b/third_party/WebKit/Source/core/layout/line/BreakingContextInlineHeaders.h
index e271804..68da4d7a 100644
--- a/third_party/WebKit/Source/core/layout/line/BreakingContextInlineHeaders.h
+++ b/third_party/WebKit/Source/core/layout/line/BreakingContextInlineHeaders.h
@@ -412,6 +412,9 @@
     while (next && next.isFloatingOrOutOfFlowPositioned())
         next = bidiNextSkippingEmptyInlines(block, next);
 
+    if (next && isEmptyInline(next))
+        next = LineLayoutInline(next).firstChild();
+
     if (next && !next.isBR() && next.isText() && LineLayoutText(next).textLength() > 0) {
         LineLayoutText nextText(next);
         UChar nextChar = nextText.characterAt(0);
diff --git a/third_party/WebKit/Source/core/layout/line/InlineIterator.h b/third_party/WebKit/Source/core/layout/line/InlineIterator.h
index 73c2554..07108aba 100644
--- a/third_party/WebKit/Source/core/layout/line/InlineIterator.h
+++ b/third_party/WebKit/Source/core/layout/line/InlineIterator.h
@@ -269,6 +269,12 @@
 template <class Observer>
 static inline LineLayoutItem bidiNextSkippingEmptyInlines(LineLayoutItem root, LineLayoutItem current, Observer* observer)
 {
+    // TODO(rhogan): Rename this caller. It's used for a detailed walk of every object in an inline flow, for example during line layout.
+    // We always return empty inlines in bidiNextShared, which gives lie to the bidiNext[Skipping|Including]EmptyInlines
+    // naming scheme we use to call it. bidiNextSkippingEmptyInlines is the less fussy of the two callers,
+    // it will always try to advance and will return what it finds if it's a line layout object in isIteratorTarget or if
+    // it's an empty LayoutInline. If the LayoutInline has content, it will advance past the start of the LayoutLine and try to return
+    // one of its children.
     // The SkipEmptyInlines callers never care about endOfInlinePtr.
     return bidiNextShared(root, current, observer, SkipEmptyInlines);
 }
@@ -282,6 +288,12 @@
 
 static inline LineLayoutItem bidiNextIncludingEmptyInlines(LineLayoutItem root, LineLayoutItem current, bool* endOfInlinePtr = nullptr)
 {
+    // TODO(rhogan): Rename this caller. It's used for quick and dirty walks of inline children by InlineWalker, which isn't
+    // interested in the contents of inlines. Use cases include dirtying objects or simplified layout that leaves lineboxes intact.
+    // bidiNextIncludingEmptyInlines will return if the iterator is at the start of a LayoutInline (even if it hasn't
+    // advanced yet) unless it previously stopped at the start of the same LayoutInline the last time it tried to iterate.
+    // If it finds itself inside a LayoutInline that doesn't have anything in isIteratorTarget it will return the enclosing
+    // LayoutInline.
     InlineBidiResolver* observer = nullptr; // Callers who include empty inlines, never use an observer.
     return bidiNextShared(root, current, observer, IncludeEmptyInlines, endOfInlinePtr);
 }
diff --git a/third_party/WebKit/Source/core/layout/line/RootInlineBox.h b/third_party/WebKit/Source/core/layout/line/RootInlineBox.h
index a06f1d7..1f6b1d6b 100644
--- a/third_party/WebKit/Source/core/layout/line/RootInlineBox.h
+++ b/third_party/WebKit/Source/core/layout/line/RootInlineBox.h
@@ -107,7 +107,7 @@
     LayoutUnit lineHeight() const final;
 
     void paint(const PaintInfo&, const LayoutPoint&, LayoutUnit lineTop, LayoutUnit lineBottom) const override;
-    bool nodeAtPoint(HitTestResult&, const HitTestLocation& locationInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom) final;
+    bool nodeAtPoint(HitTestResult&, const HitTestLocation& locationInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom) override;
 
     using InlineBox::hasSelectedChildren;
     using InlineBox::setHasSelectedChildren;
diff --git a/third_party/WebKit/Source/core/layout/svg/line/SVGInlineTextBox.cpp b/third_party/WebKit/Source/core/layout/svg/line/SVGInlineTextBox.cpp
index 66d2879..372d0fb 100644
--- a/third_party/WebKit/Source/core/layout/svg/line/SVGInlineTextBox.cpp
+++ b/third_party/WebKit/Source/core/layout/svg/line/SVGInlineTextBox.cpp
@@ -264,12 +264,24 @@
             LayoutPoint boxOrigin(x(), y());
             boxOrigin.moveBy(accumulatedOffset);
             LayoutRect rect(boxOrigin, size());
-            // FIXME: both calls to rawValue() below is temporary and should be removed once the transition
-            // to LayoutUnit-based types is complete (crbug.com/321237)
             if (locationInContainer.intersects(rect)) {
-                lineLayoutItem().updateHitTestResult(result, locationInContainer.point() - toLayoutSize(accumulatedOffset));
-                if (!result.addNodeToListBasedTestResult(lineLayoutItem().node(), locationInContainer, rect))
-                    return true;
+                LineLayoutSVGInlineText lineLayoutItem = LineLayoutSVGInlineText(this->lineLayoutItem());
+                ASSERT(lineLayoutItem.scalingFactor());
+                float baseline = lineLayoutItem.scaledFont().fontMetrics().floatAscent() / lineLayoutItem.scalingFactor();
+
+                AffineTransform fragmentTransform;
+                for (const auto& fragment : m_textFragments) {
+                    FloatQuad fragmentQuad(FloatRect(fragment.x, fragment.y - baseline, fragment.width, fragment.height));
+                    fragment.buildFragmentTransform(fragmentTransform);
+                    if (!fragmentTransform.isIdentity())
+                        fragmentQuad = fragmentTransform.mapQuad(fragmentQuad);
+
+                    if (fragmentQuad.containsPoint(FloatPoint(locationInContainer.point()))) {
+                        lineLayoutItem.updateHitTestResult(result, locationInContainer.point() - toLayoutSize(accumulatedOffset));
+                        if (!result.addNodeToListBasedTestResult(lineLayoutItem.node(), locationInContainer, rect))
+                            return true;
+                    }
+                }
             }
         }
     }
diff --git a/third_party/WebKit/Source/core/layout/svg/line/SVGRootInlineBox.cpp b/third_party/WebKit/Source/core/layout/svg/line/SVGRootInlineBox.cpp
index 5ef2cf0..ba63b5c7 100644
--- a/third_party/WebKit/Source/core/layout/svg/line/SVGRootInlineBox.cpp
+++ b/third_party/WebKit/Source/core/layout/svg/line/SVGRootInlineBox.cpp
@@ -231,4 +231,16 @@
     collectLeafBoxesInLogicalOrder(leafBoxesInLogicalOrder, reverseInlineBoxRangeAndValueListsIfNeeded, &attributes);
 }
 
+bool SVGRootInlineBox::nodeAtPoint(HitTestResult& result, const HitTestLocation& locationInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom)
+{
+    for (InlineBox* leaf = firstLeafChild(); leaf; leaf = leaf->nextLeafChild()) {
+        if (!leaf->isSVGInlineTextBox())
+            continue;
+        if (leaf->nodeAtPoint(result, locationInContainer, accumulatedOffset, lineTop, lineBottom))
+            return true;
+    }
+
+    return false;
+}
+
 } // namespace blink
diff --git a/third_party/WebKit/Source/core/layout/svg/line/SVGRootInlineBox.h b/third_party/WebKit/Source/core/layout/svg/line/SVGRootInlineBox.h
index 525a1cf..cf5d704c 100644
--- a/third_party/WebKit/Source/core/layout/svg/line/SVGRootInlineBox.h
+++ b/third_party/WebKit/Source/core/layout/svg/line/SVGRootInlineBox.h
@@ -49,6 +49,8 @@
 
     InlineBox* closestLeafChildForPosition(const LayoutPoint&);
 
+    bool nodeAtPoint(HitTestResult&, const HitTestLocation& locationInContainer, const LayoutPoint& accumulatedOffset, LayoutUnit lineTop, LayoutUnit lineBottom) final;
+
 private:
     void reorderValueLists(Vector<SVGTextLayoutAttributes*>&);
     void layoutChildBoxes(InlineFlowBox*, LayoutRect* = nullptr);
diff --git a/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp b/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
index cb7d2ed6..a8248c54 100644
--- a/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
@@ -729,7 +729,7 @@
     OwnPtr<ResourceLoaderOptions> actualOptions;
     actualOptions.swap(m_actualOptions);
 
-    actualRequest->setHTTPOrigin(securityOrigin()->toAtomicString());
+    actualRequest->setHTTPOrigin(securityOrigin());
 
     clearResource();
 
diff --git a/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp b/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp
index 0fe7ebb..6084b70 100644
--- a/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp
+++ b/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp
@@ -97,16 +97,16 @@
 {
     bool isMainResource = type == FetchMainResource;
     if (!isMainResource) {
-        String outgoingOrigin;
+        RefPtr<SecurityOrigin> outgoingOrigin;
         if (!request.didSetHTTPReferrer()) {
-            outgoingOrigin = m_document->outgoingOrigin();
+            outgoingOrigin = m_document->securityOrigin();
             request.setHTTPReferrer(SecurityPolicy::generateReferrer(m_document->referrerPolicy(), request.url(), m_document->outgoingReferrer()));
         } else {
             RELEASE_ASSERT(SecurityPolicy::generateReferrer(request.referrerPolicy(), request.url(), request.httpReferrer()).referrer == request.httpReferrer());
-            outgoingOrigin = SecurityOrigin::createFromString(request.httpReferrer())->toString();
+            outgoingOrigin = SecurityOrigin::createFromString(request.httpReferrer());
         }
 
-        request.addHTTPOriginIfNeeded(AtomicString(outgoingOrigin));
+        request.addHTTPOriginIfNeeded(outgoingOrigin);
     }
 
     if (m_document)
diff --git a/third_party/WebKit/Source/core/loader/FrameLoader.cpp b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
index b6431fd7..86d7b44d 100644
--- a/third_party/WebKit/Source/core/loader/FrameLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
@@ -123,7 +123,7 @@
         request.setHTTPBody(formData);
         request.setHTTPContentType(item->formContentType());
         RefPtr<SecurityOrigin> securityOrigin = SecurityOrigin::createFromString(item->referrer().referrer);
-        request.addHTTPOriginIfNeeded(securityOrigin->toAtomicString());
+        request.addHTTPOriginIfNeeded(securityOrigin);
     }
     return request;
 }
@@ -311,7 +311,7 @@
 // This is the <iframe src="javascript:'html'"> case.
 void FrameLoader::replaceDocumentWhileExecutingJavaScriptURL(const String& source, Document* ownerDocument)
 {
-    if (!m_frame->document()->loader())
+    if (!m_frame->document()->loader() || m_frame->document()->pageDismissalEventBeingDispatched() != Document::NoDismissal)
         return;
 
     // DocumentLoader::replaceDocumentWhileExecutingJavaScriptURL can cause the DocumentLoader to get deref'ed and possible destroyed,
@@ -729,7 +729,7 @@
 
     request.setHTTPReferrer(referrer);
     RefPtr<SecurityOrigin> referrerOrigin = SecurityOrigin::createFromString(referrer.referrer);
-    request.addHTTPOriginIfNeeded(referrerOrigin->toAtomicString());
+    request.addHTTPOriginIfNeeded(referrerOrigin);
 }
 
 FrameLoadType FrameLoader::determineFrameLoadType(const FrameLoadRequest& request)
@@ -1054,7 +1054,7 @@
     if (pdl != m_provisionalDocumentLoader)
         return false;
     if (m_documentLoader) {
-        FrameNavigationDisabler navigationDisabler(m_frame);
+        FrameNavigationDisabler navigationDisabler(*m_frame);
         detachDocumentLoader(m_documentLoader);
     }
     // detachFromFrame() will abort XHRs that haven't completed, which can
diff --git a/third_party/WebKit/Source/core/loader/NavigationScheduler.cpp b/third_party/WebKit/Source/core/loader/NavigationScheduler.cpp
index 9001aff..68e6b76b 100644
--- a/third_party/WebKit/Source/core/loader/NavigationScheduler.cpp
+++ b/third_party/WebKit/Source/core/loader/NavigationScheduler.cpp
@@ -56,17 +56,6 @@
 
 unsigned NavigationDisablerForBeforeUnload::s_navigationDisableCount = 0;
 
-FrameNavigationDisabler::FrameNavigationDisabler(LocalFrame* frame)
-    : m_navigationScheduler(&frame->navigationScheduler())
-{
-    m_navigationScheduler->disableFrameNavigation();
-}
-
-FrameNavigationDisabler::~FrameNavigationDisabler()
-{
-    m_navigationScheduler->enableFrameNavigation();
-}
-
 class ScheduledNavigation : public NoBaseWillBeGarbageCollectedFinalized<ScheduledNavigation> {
     WTF_MAKE_NONCOPYABLE(ScheduledNavigation); USING_FAST_MALLOC_WILL_BE_REMOVED(ScheduledNavigation);
 public:
@@ -269,7 +258,6 @@
 NavigationScheduler::NavigationScheduler(LocalFrame* frame)
     : m_frame(frame)
     , m_navigateTaskFactory(CancellableTaskFactory::create(this, &NavigationScheduler::navigateTask))
-    , m_navigationDisableCount(0)
 {
 }
 
@@ -293,12 +281,12 @@
 
 inline bool NavigationScheduler::shouldScheduleReload() const
 {
-    return m_frame->page() && isFrameNavigationAllowed() && NavigationDisablerForBeforeUnload::isNavigationAllowed();
+    return m_frame->page() && m_frame->isNavigationAllowed() && NavigationDisablerForBeforeUnload::isNavigationAllowed();
 }
 
 inline bool NavigationScheduler::shouldScheduleNavigation(const String& url) const
 {
-    return m_frame->page() && isFrameNavigationAllowed() && (protocolIsJavaScript(url) || NavigationDisablerForBeforeUnload::isNavigationAllowed());
+    return m_frame->page() && m_frame->isNavigationAllowed() && (protocolIsJavaScript(url) || NavigationDisablerForBeforeUnload::isNavigationAllowed());
 }
 
 void NavigationScheduler::scheduleRedirect(double delay, const String& url)
diff --git a/third_party/WebKit/Source/core/loader/NavigationScheduler.h b/third_party/WebKit/Source/core/loader/NavigationScheduler.h
index 2551ef6..71a64fb7 100644
--- a/third_party/WebKit/Source/core/loader/NavigationScheduler.h
+++ b/third_party/WebKit/Source/core/loader/NavigationScheduler.h
@@ -75,13 +75,8 @@
     DECLARE_TRACE();
 
 private:
-    friend class FrameNavigationDisabler;
     explicit NavigationScheduler(LocalFrame*);
 
-    void disableFrameNavigation() { ++m_navigationDisableCount; }
-    void enableFrameNavigation() { --m_navigationDisableCount; }
-    bool isFrameNavigationAllowed() const { return !m_navigationDisableCount; }
-
     bool shouldScheduleReload() const;
     bool shouldScheduleNavigation(const String& url) const;
 
@@ -93,7 +88,6 @@
     RawPtrWillBeMember<LocalFrame> m_frame;
     OwnPtr<CancellableTaskFactory> m_navigateTaskFactory;
     OwnPtrWillBeMember<ScheduledNavigation> m_redirect;
-    int m_navigationDisableCount;
 };
 
 class NavigationDisablerForBeforeUnload {
@@ -115,17 +109,6 @@
     static unsigned s_navigationDisableCount;
 };
 
-class FrameNavigationDisabler {
-    WTF_MAKE_NONCOPYABLE(FrameNavigationDisabler);
-    STACK_ALLOCATED();
-public:
-    explicit FrameNavigationDisabler(LocalFrame*);
-    ~FrameNavigationDisabler();
-
-private:
-    RawPtrWillBeMember<NavigationScheduler> m_navigationScheduler;
-};
-
 } // namespace blink
 
 #endif // NavigationScheduler_h
diff --git a/third_party/WebKit/Source/core/paint/PaintInvalidationCapableScrollableArea.cpp b/third_party/WebKit/Source/core/paint/PaintInvalidationCapableScrollableArea.cpp
new file mode 100644
index 0000000..3aaf9f5c
--- /dev/null
+++ b/third_party/WebKit/Source/core/paint/PaintInvalidationCapableScrollableArea.cpp
@@ -0,0 +1,85 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "config.h"
+#include "core/paint/PaintInvalidationCapableScrollableArea.h"
+
+#include "core/frame/Settings.h"
+#include "core/html/HTMLFrameOwnerElement.h"
+#include "core/layout/LayoutBox.h"
+#include "core/layout/LayoutScrollbar.h"
+#include "core/layout/LayoutScrollbarPart.h"
+#include "core/layout/PaintInvalidationState.h"
+#include "core/paint/PaintLayer.h"
+
+namespace blink {
+
+void PaintInvalidationCapableScrollableArea::willRemoveScrollbar(Scrollbar* scrollbar, ScrollbarOrientation orientation)
+{
+    if (!scrollbar->isCustomScrollbar()
+        && !(orientation == HorizontalScrollbar ? layerForHorizontalScrollbar() : layerForVerticalScrollbar()))
+        boxForScrollControlPaintInvalidation().invalidateDisplayItemClient(*scrollbar);
+
+    ScrollableArea::willRemoveScrollbar(scrollbar, orientation);
+}
+
+// Returns true if the scroll control is invalidated.
+static bool invalidatePaintOfScrollControlIfNeeded(const IntRect& scrollControlRect, LayoutRect& previousPaintInvalidationRect, bool needsPaintInvalidation, LayoutBox& box, const PaintInvalidationState& paintInvalidationState, const LayoutBoxModelObject& paintInvalidationContainer)
+{
+    LayoutRect paintInvalidationRect(scrollControlRect);
+    if (!paintInvalidationRect.isEmpty())
+        PaintLayer::mapRectToPaintInvalidationBacking(&box, &paintInvalidationContainer, paintInvalidationRect, &paintInvalidationState);
+
+    if (paintInvalidationRect != previousPaintInvalidationRect) {
+        box.invalidatePaintUsingContainer(paintInvalidationContainer, previousPaintInvalidationRect, PaintInvalidationScroll);
+        previousPaintInvalidationRect = paintInvalidationRect;
+        needsPaintInvalidation = true;
+    }
+
+    if (needsPaintInvalidation) {
+        box.invalidatePaintUsingContainer(paintInvalidationContainer, paintInvalidationRect, PaintInvalidationScroll);
+        return true;
+    }
+
+    return false;
+}
+
+static void invalidatePaintOfScrollbarIfNeeded(Scrollbar* scrollbar, GraphicsLayer* scrollbarGraphicsLayer, LayoutRect& previousPaintInvalidationRect, bool needsPaintInvalidation, LayoutBox& box, const PaintInvalidationState& paintInvalidationState, const LayoutBoxModelObject& paintInvalidationContainer)
+{
+    IntRect scrollbarRect = scrollbar && !scrollbarGraphicsLayer ? scrollbar->frameRect() : IntRect();
+    if (!invalidatePaintOfScrollControlIfNeeded(scrollbarRect, previousPaintInvalidationRect, needsPaintInvalidation, box, paintInvalidationState, paintInvalidationContainer))
+        return;
+    if (!scrollbar)
+        return;
+
+    paintInvalidationContainer.invalidateDisplayItemClientOnBacking(*scrollbar, PaintInvalidationScroll, &previousPaintInvalidationRect);
+    if (scrollbar->isCustomScrollbar())
+        toLayoutScrollbar(scrollbar)->invalidateDisplayItemClientsOfScrollbarParts(paintInvalidationContainer, previousPaintInvalidationRect);
+}
+
+void PaintInvalidationCapableScrollableArea::invalidatePaintOfScrollControlsIfNeeded(const PaintInvalidationState& paintInvalidationState, const LayoutBoxModelObject& paintInvalidationContainer)
+{
+    LayoutBox& box = boxForScrollControlPaintInvalidation();
+    LayoutRect oldRect = m_horizontalScrollbarPreviousPaintInvalidationRect;
+    invalidatePaintOfScrollbarIfNeeded(horizontalScrollbar(), layerForHorizontalScrollbar(), m_horizontalScrollbarPreviousPaintInvalidationRect, horizontalScrollbarNeedsPaintInvalidation(), box, paintInvalidationState, paintInvalidationContainer);
+    bool scrollbarGeometryChanged = oldRect != m_horizontalScrollbarPreviousPaintInvalidationRect;
+
+    oldRect = m_verticalScrollbarPreviousPaintInvalidationRect;
+    invalidatePaintOfScrollbarIfNeeded(verticalScrollbar(), layerForVerticalScrollbar(), m_verticalScrollbarPreviousPaintInvalidationRect, verticalScrollbarNeedsPaintInvalidation(), box, paintInvalidationState, paintInvalidationContainer);
+    scrollbarGeometryChanged |= oldRect != m_verticalScrollbarPreviousPaintInvalidationRect;
+
+    if (scrollbarGeometryChanged)
+        paintInvalidationContainer.invalidateDisplayItemClientOnBacking(box, PaintInvalidationScroll, nullptr);
+
+    if (invalidatePaintOfScrollControlIfNeeded(scrollCornerRect(), m_scrollCornerPreviousPaintInvalidationRect, scrollCornerNeedsPaintInvalidation(), box, paintInvalidationState, paintInvalidationContainer)) {
+        if (LayoutScrollbarPart* scrollCorner = this->scrollCorner())
+            scrollCorner->invalidateDisplayItemClientsIncludingNonCompositingDescendants(&paintInvalidationContainer, PaintInvalidationScroll, &m_scrollCornerPreviousPaintInvalidationRect);
+        if (LayoutScrollbarPart* resizer = this->resizer())
+            resizer->invalidateDisplayItemClientsIncludingNonCompositingDescendants(&paintInvalidationContainer, PaintInvalidationScroll, &m_scrollCornerPreviousPaintInvalidationRect);
+    }
+
+    clearNeedsPaintInvalidationForScrollControls();
+}
+
+} // namespace blink
diff --git a/third_party/WebKit/Source/core/paint/PaintInvalidationCapableScrollableArea.h b/third_party/WebKit/Source/core/paint/PaintInvalidationCapableScrollableArea.h
new file mode 100644
index 0000000..1120378d
--- /dev/null
+++ b/third_party/WebKit/Source/core/paint/PaintInvalidationCapableScrollableArea.h
@@ -0,0 +1,39 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef PaintInvalidationCapableScrollableArea_h
+#define PaintInvalidationCapableScrollableArea_h
+
+#include "core/CoreExport.h"
+#include "platform/geometry/LayoutRect.h"
+#include "platform/scroll/ScrollableArea.h"
+
+namespace blink {
+
+class LayoutBox;
+class LayoutBoxModelObject;
+class LayoutScrollbarPart;
+class PaintInvalidationContainer;
+class PaintInvalidationState;
+
+// Base class of FrameView and PaintLayerScrollableArea to share paint invalidation code.
+// TODO(wangxianzhu): Combine this into PaintLayerScrollableArea when root-layer-scrolls launches.
+class CORE_EXPORT PaintInvalidationCapableScrollableArea : public ScrollableArea {
+public:
+    void willRemoveScrollbar(Scrollbar*, ScrollbarOrientation) override;
+    void invalidatePaintOfScrollControlsIfNeeded(const PaintInvalidationState&, const LayoutBoxModelObject& paintInvalidationContainer);
+
+private:
+    virtual LayoutBox& boxForScrollControlPaintInvalidation() const = 0;
+    virtual LayoutScrollbarPart* scrollCorner() const = 0;
+    virtual LayoutScrollbarPart* resizer() const = 0;
+
+    LayoutRect m_horizontalScrollbarPreviousPaintInvalidationRect;
+    LayoutRect m_verticalScrollbarPreviousPaintInvalidationRect;
+    LayoutRect m_scrollCornerPreviousPaintInvalidationRect;
+};
+
+} // namespace blink
+
+#endif // PaintInvalidationCapableScrollableArea_h
diff --git a/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp b/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp
index b7ea489..282ec66 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp
+++ b/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.cpp
@@ -199,61 +199,9 @@
     return layer()->hasCompositedLayerMapping() ? layer()->compositedLayerMapping()->layerForScrollCorner() : 0;
 }
 
-void PaintLayerScrollableArea::invalidateScrollbarRect(Scrollbar* scrollbar, const IntRect& rect)
+void PaintLayerScrollableArea::scrollControlWasSetNeedsPaintInvalidation()
 {
-    // See crbug.com/343132.
-    DisableCompositingQueryAsserts disabler;
-
-    ASSERT(scrollbar == horizontalScrollbar() || scrollbar == verticalScrollbar());
-    ASSERT(scrollbar == horizontalScrollbar() ? !layerForHorizontalScrollbar() : !layerForVerticalScrollbar());
-
-    IntRect scrollRect = rect;
-    // If we are not yet inserted into the tree, there is no need to issue paint invaldiations.
-    if (!box().isLayoutView() && !box().parent())
-        return;
-
-    if (scrollbar == verticalScrollbar())
-        scrollRect.move(verticalScrollbarStart(0, box().size().width()), box().borderTop());
-    else
-        scrollRect.move(horizontalScrollbarStart(0), box().size().height() - box().borderBottom() - scrollbar->height());
-
-    if (scrollRect.isEmpty())
-        return;
-
-    LayoutRect paintInvalidationRect = LayoutRect(scrollRect);
-    box().flipForWritingMode(paintInvalidationRect);
-
-    IntRect intRect = pixelSnappedIntRect(paintInvalidationRect);
-
-    if (box().frameView()->isInPerformLayout()) {
-        addScrollbarDamage(scrollbar, intRect);
-    } else {
-        // FIXME: We should not allow paint invalidation out of paint invalidation state. crbug.com/457415
-        DisablePaintInvalidationStateAsserts disabler;
-        // We have invalidated the displayItemClient of the scrollbar, but for now we still need to
-        // invalidate the rectangles to trigger repaints.
-        box().invalidatePaintRectangleNotInvalidatingDisplayItemClients(LayoutRect(intRect));
-        box().invalidateDisplayItemClient(*scrollbar);
-    }
-}
-
-void PaintLayerScrollableArea::invalidateScrollCornerRect(const IntRect& rect)
-{
-    ASSERT(!layerForScrollCorner());
-
-    if (m_scrollCorner) {
-        // FIXME: We should not allow paint invalidation out of paint invalidation state. crbug.com/457415
-        DisablePaintInvalidationStateAsserts disabler;
-        DisableCompositingQueryAsserts compositingDisabler;
-        m_scrollCorner->invalidatePaintRectangle(LayoutRect(rect));
-        box().invalidateDisplayItemClientForNonCompositingDescendantsOf(*m_scrollCorner);
-    } else {
-        box().invalidateDisplayItemClient(box());
-    }
-    if (m_resizer) {
-        m_resizer->invalidatePaintRectangle(LayoutRect(rect));
-        box().invalidateDisplayItemClientForNonCompositingDescendantsOf(*m_resizer);
-    }
+    box().setMayNeedPaintInvalidation();
 }
 
 bool PaintLayerScrollableArea::shouldUseIntegerScrollOffset() const
@@ -1036,8 +984,8 @@
     if (hasScrollbar == hasHorizontalScrollbar())
         return;
 
-    if (!hasScrollbar && !layerForHorizontalScrollbar())
-        horizontalScrollbar()->invalidate();
+    setScrollbarNeedsPaintInvalidation(horizontalScrollbar());
+
 
     m_scrollbarManager.setHasHorizontalScrollbar(hasScrollbar);
 
@@ -1047,10 +995,7 @@
     if (hasVerticalScrollbar())
         verticalScrollbar()->styleChanged();
 
-    // These are valid because we want to invalidate display item clients on the current backing.
-    DisablePaintInvalidationStateAsserts paintInvalidationAssertDisabler;
-    DisableCompositingQueryAsserts compositingAssertDisabler;
-    invalidateScrollCorner(scrollCornerRect());
+    setScrollCornerNeedsPaintInvalidation();
 
     // Force an update since we know the scrollbars have changed things.
     if (box().document().hasAnnotatedRegions())
@@ -1062,8 +1007,7 @@
     if (hasScrollbar == hasVerticalScrollbar())
         return;
 
-    if (!hasScrollbar && !layerForVerticalScrollbar())
-        verticalScrollbar()->invalidate();
+    setScrollbarNeedsPaintInvalidation(verticalScrollbar());
 
     m_scrollbarManager.setHasVerticalScrollbar(hasScrollbar);
 
@@ -1073,10 +1017,7 @@
     if (hasVerticalScrollbar())
         verticalScrollbar()->styleChanged();
 
-    // These are valid because we want to invalidate display item clients on the current backing.
-    DisablePaintInvalidationStateAsserts paintInvalidationAssertDisabler;
-    DisableCompositingQueryAsserts compositingAssertDisabler;
-    invalidateScrollCorner(scrollCornerRect());
+    setScrollCornerNeedsPaintInvalidation();
 
     // Force an update since we know the scrollbars have changed things.
     if (box().document().hasAnnotatedRegions())
@@ -1498,9 +1439,9 @@
     m_canDetachScrollbars = detach ? 1 : 0;
     if (!detach) {
         if (m_hBar && !m_hBarIsAttached)
-            destroyScrollbar(HorizontalScrollbar, true);
+            destroyScrollbar(HorizontalScrollbar);
         if (m_vBar && !m_vBarIsAttached)
-            destroyScrollbar(VerticalScrollbar, true);
+            destroyScrollbar(VerticalScrollbar);
     }
 }
 
@@ -1556,17 +1497,15 @@
     return widget.release();
 }
 
-void PaintLayerScrollableArea::ScrollbarManager::destroyScrollbar(ScrollbarOrientation orientation, bool invalidate)
+void PaintLayerScrollableArea::ScrollbarManager::destroyScrollbar(ScrollbarOrientation orientation)
 {
     RefPtrWillBeMember<Scrollbar>& scrollbar = orientation == HorizontalScrollbar ? m_hBar : m_vBar;
     ASSERT(orientation == HorizontalScrollbar ? !m_hBarIsAttached: !m_vBarIsAttached);
     if (!scrollbar)
         return;
 
-    if (invalidate) {
-        m_scrollableArea->box().invalidateDisplayItemClient(*scrollbar);
-        scrollbar->invalidate();
-    }
+    m_scrollableArea->setScrollbarNeedsPaintInvalidation(scrollbar.get());
+
     if (!scrollbar->isCustomScrollbar())
         m_scrollableArea->willRemoveScrollbar(scrollbar.get(), orientation);
 
diff --git a/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.h b/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.h
index c09f35f3..606c563 100644
--- a/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.h
+++ b/third_party/WebKit/Source/core/paint/PaintLayerScrollableArea.h
@@ -46,9 +46,9 @@
 
 #include "core/CoreExport.h"
 #include "core/layout/LayoutBox.h"
+#include "core/paint/PaintInvalidationCapableScrollableArea.h"
 #include "core/paint/PaintLayerFragment.h"
 #include "platform/heap/Handle.h"
-#include "platform/scroll/ScrollableArea.h"
 
 namespace blink {
 
@@ -97,7 +97,7 @@
 // to be painted on top of everything. Hardware accelerated overlay scrollbars
 // are painted by their associated GraphicsLayer that sets the paint flag
 // PaintLayerPaintingOverlayScrollbars.
-class CORE_EXPORT PaintLayerScrollableArea final : public NoBaseWillBeGarbageCollectedFinalized<PaintLayerScrollableArea>, public ScrollableArea {
+class CORE_EXPORT PaintLayerScrollableArea final : public NoBaseWillBeGarbageCollectedFinalized<PaintLayerScrollableArea>, public PaintInvalidationCapableScrollableArea {
     USING_FAST_MALLOC_WILL_BE_REMOVED(PaintLayerScrollableArea);
     WILL_BE_USING_GARBAGE_COLLECTED_MIXIN(PaintLayerScrollableArea);
     friend class Internals;
@@ -140,7 +140,7 @@
 
     private:
         PassRefPtrWillBeRawPtr<Scrollbar> createScrollbar(ScrollbarOrientation);
-        void destroyScrollbar(ScrollbarOrientation, bool invalidate = false);
+        void destroyScrollbar(ScrollbarOrientation);
 
     private:
         RawPtrWillBeMember<PaintLayerScrollableArea> m_scrollableArea;
@@ -188,8 +188,7 @@
     GraphicsLayer* layerForScrollCorner() const override;
 
     bool usesCompositedScrolling() const override;
-    void invalidateScrollbarRect(Scrollbar*, const IntRect&) override;
-    void invalidateScrollCornerRect(const IntRect&) override;
+    void scrollControlWasSetNeedsPaintInvalidation() override;
     bool shouldUseIntegerScrollOffset() const override;
     bool isActive() const override;
     bool isScrollCornerVisible() const override;
@@ -261,7 +260,7 @@
 
     bool hasScrollbar() const { return hasHorizontalScrollbar() || hasVerticalScrollbar(); }
 
-    LayoutScrollbarPart* scrollCorner() const { return m_scrollCorner; }
+    LayoutScrollbarPart* scrollCorner() const override { return m_scrollCorner; }
 
     void resize(const PlatformEvent&, const LayoutSize&);
     IntSize offsetFromResizeCorner(const IntPoint& absolutePoint) const;
@@ -321,7 +320,7 @@
     LayoutBox& box() const;
     PaintLayer* layer() const;
 
-    LayoutScrollbarPart* resizer() { return m_resizer; }
+    LayoutScrollbarPart* resizer() const override { return m_resizer; }
 
     const IntPoint& cachedOverlayScrollbarOffset() { return m_cachedOverlayScrollbarOffset; }
     void setCachedOverlayScrollbarOffset(const IntPoint& offset) { m_cachedOverlayScrollbarOffset = offset; }
@@ -365,6 +364,9 @@
 
     void updateCompositingLayersAfterScroll();
 
+    // PaintInvalidationCapableScrollableArea
+    LayoutBox& boxForScrollControlPaintInvalidation() const { return box(); }
+
     PaintLayer& m_layer;
 
     // Keeps track of whether the layer is currently resizing, so events can cause resizing to start and stop.
diff --git a/third_party/WebKit/Source/core/svg/SVGPointList.cpp b/third_party/WebKit/Source/core/svg/SVGPointList.cpp
index bc11d6b..b8ab686c 100644
--- a/third_party/WebKit/Source/core/svg/SVGPointList.cpp
+++ b/third_party/WebKit/Source/core/svg/SVGPointList.cpp
@@ -29,8 +29,6 @@
 
 namespace blink {
 
-DEFINE_SVG_PROPERTY_TYPE_CASTS(SVGPointList);
-
 SVGPointList::SVGPointList()
 {
 }
diff --git a/third_party/WebKit/Source/core/svg/SVGPointList.h b/third_party/WebKit/Source/core/svg/SVGPointList.h
index 6b0eb72..8a8e00c 100644
--- a/third_party/WebKit/Source/core/svg/SVGPointList.h
+++ b/third_party/WebKit/Source/core/svg/SVGPointList.h
@@ -68,6 +68,8 @@
     bool parse(const CharType*& ptr, const CharType* end);
 };
 
+DEFINE_SVG_PROPERTY_TYPE_CASTS(SVGPointList);
+
 } // namespace blink
 
 #endif // SVGPointList_h
diff --git a/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp b/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp
index bf7a846..14efa5d7 100644
--- a/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp
+++ b/third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp
@@ -906,7 +906,7 @@
         request.addHTTPHeaderFields(m_requestHeaders);
 
     ThreadableLoaderOptions options;
-    options.preflightPolicy = uploadEvents ? ForcePreflight : ConsiderPreflight;
+    options.preflightPolicy = (uploadEvents || securityOrigin()->hasSuborigin()) ? ForcePreflight : ConsiderPreflight;
     options.crossOriginRequestPolicy = UseAccessControl;
     options.initiator = FetchInitiatorTypeNames::xmlhttprequest;
     options.contentSecurityPolicyEnforcement = ContentSecurityPolicy::shouldBypassMainWorld(&executionContext) ? DoNotEnforceContentSecurityPolicy : EnforceConnectSrcDirective;
diff --git a/third_party/WebKit/Source/devtools/devtools.gypi b/third_party/WebKit/Source/devtools/devtools.gypi
index 0ebeb00c..abd0e4f 100644
--- a/third_party/WebKit/Source/devtools/devtools.gypi
+++ b/third_party/WebKit/Source/devtools/devtools.gypi
@@ -421,6 +421,7 @@
             'front_end/elements/spectrum.css',
             'front_end/elements/BezierEditor.js',
             'front_end/elements/BezierUI.js',
+            'front_end/elements/ClassesPaneWidget.js',
             'front_end/elements/ElementsBreadcrumbs.js',
             'front_end/elements/ElementsPanel.js',
             'front_end/elements/ElementsSidebarPane.js',
@@ -456,6 +457,18 @@
             'front_end/emulated_devices/google-nexus-5-vertical-keyboard-2x.png',
             'front_end/emulated_devices/google-nexus-5-vertical-navigation-1x.png',
             'front_end/emulated_devices/google-nexus-5-vertical-navigation-2x.png',
+            'front_end/emulated_devices/google-nexus-5x-horizontal-default-1x.png',
+            'front_end/emulated_devices/google-nexus-5x-horizontal-default-2x.png',
+            'front_end/emulated_devices/google-nexus-5x-horizontal-keyboard-1x.png',
+            'front_end/emulated_devices/google-nexus-5x-horizontal-keyboard-2x.png',
+            'front_end/emulated_devices/google-nexus-5x-horizontal-navigation-1x.png',
+            'front_end/emulated_devices/google-nexus-5x-horizontal-navigation-2x.png',
+            'front_end/emulated_devices/google-nexus-5x-vertical-default-1x.png',
+            'front_end/emulated_devices/google-nexus-5x-vertical-default-2x.png',
+            'front_end/emulated_devices/google-nexus-5x-vertical-keyboard-1x.png',
+            'front_end/emulated_devices/google-nexus-5x-vertical-keyboard-2x.png',
+            'front_end/emulated_devices/google-nexus-5x-vertical-navigation-1x.png',
+            'front_end/emulated_devices/google-nexus-5x-vertical-navigation-2x.png',
         ],
         'devtools_extensions_js_files': [
             'front_end/extensions/ExtensionAuditCategory.js',
diff --git a/third_party/WebKit/Source/devtools/front_end/animation/AnimationControlPane.js b/third_party/WebKit/Source/devtools/front_end/animation/AnimationControlPane.js
index 9b48eca..f2c7298 100644
--- a/third_party/WebKit/Source/devtools/front_end/animation/AnimationControlPane.js
+++ b/third_party/WebKit/Source/devtools/front_end/animation/AnimationControlPane.js
@@ -16,7 +16,7 @@
     this.element.createChild("div").createTextChild("Animations");
     var container = this.element.createChild("div", "animations-controls");
 
-    var toolbar = new WebInspector.Toolbar();
+    var toolbar = new WebInspector.Toolbar("");
     this._animationsPauseButton = new WebInspector.ToolbarButton("", "pause-toolbar-item");
     toolbar.appendToolbarItem(this._animationsPauseButton);
     this._animationsPauseButton.addEventListener("click", this._pauseButtonHandler.bind(this));
@@ -34,7 +34,6 @@
 }
 
 WebInspector.AnimationControlPane.prototype = {
-
     /**
      * @param {!Event} event
      */
@@ -56,10 +55,14 @@
     },
 
     /**
-     * @param {!WebInspector.Event=} event
+     * @override
+     * @return {!Promise<?>}
      */
-    _updateAnimationsPlaybackRate: function(event)
+    doUpdate: function()
     {
+        if (!this._target)
+            return Promise.resolve();
+
         /**
          * @param {number} playbackRate
          * @this {WebInspector.AnimationControlPane}
@@ -70,8 +73,7 @@
             this._animationsPlaybackLabel.textContent = playbackRate + "x";
         }
 
-        if (this._target)
-            WebInspector.AnimationModel.fromTarget(this._target).playbackRatePromise().then(setPlaybackRate.bind(this));
+        return WebInspector.AnimationModel.fromTarget(this._target).playbackRatePromise().then(setPlaybackRate.bind(this));
     },
 
     /**
@@ -84,11 +86,11 @@
             return;
 
         if (this._target)
-            this._target.resourceTreeModel.removeEventListener(WebInspector.ResourceTreeModel.EventTypes.MainFrameNavigated, this._updateAnimationsPlaybackRate, this);
+            this._target.resourceTreeModel.removeEventListener(WebInspector.ResourceTreeModel.EventTypes.MainFrameNavigated, this.update, this);
 
         this._target = node.target();
-        this._target.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.MainFrameNavigated, this._updateAnimationsPlaybackRate, this);
-        this._updateAnimationsPlaybackRate();
+        this._target.resourceTreeModel.addEventListener(WebInspector.ResourceTreeModel.EventTypes.MainFrameNavigated, this.update, this);
+        this.update();
     },
 
     __proto__: WebInspector.ElementsPanel.BaseToolbarPaneWidget.prototype
diff --git a/third_party/WebKit/Source/devtools/front_end/animation/AnimationTimeline.js b/third_party/WebKit/Source/devtools/front_end/animation/AnimationTimeline.js
index 908e853a..60c7d2ae 100644
--- a/third_party/WebKit/Source/devtools/front_end/animation/AnimationTimeline.js
+++ b/third_party/WebKit/Source/devtools/front_end/animation/AnimationTimeline.js
@@ -118,8 +118,7 @@
         var container = this.contentElement.createChild("div", "animation-timeline-header");
         var controls = container.createChild("div", "animation-controls");
 
-        var toolbar = new WebInspector.Toolbar(controls);
-        toolbar.element.classList.add("animation-controls-toolbar");
+        var toolbar = new WebInspector.Toolbar("animation-controls-toolbar", controls);
         this._controlButton = new WebInspector.ToolbarButton(WebInspector.UIString("Replay timeline"), "replay-outline-toolbar-item");
         this._controlButton.addEventListener("click", this._controlButtonToggle.bind(this));
         toolbar.appendToolbarItem(this._controlButton);
diff --git a/third_party/WebKit/Source/devtools/front_end/components/Linkifier.js b/third_party/WebKit/Source/devtools/front_end/components/Linkifier.js
index 203d65bb..b46d89c 100644
--- a/third_party/WebKit/Source/devtools/front_end/components/Linkifier.js
+++ b/third_party/WebKit/Source/devtools/front_end/components/Linkifier.js
@@ -228,20 +228,6 @@
     },
 
     /**
-     * @param {!WebInspector.CSSMedia} media
-     * @return {?Element}
-     */
-    linkifyMedia: function(media)
-    {
-        var location = media.rawLocation();
-        if (location)
-            return this.linkifyCSSLocation(location);
-
-        // The "linkedStylesheet" case.
-        return WebInspector.linkifyResourceAsNode(media.sourceURL, undefined, undefined, "subtitle", media.sourceURL);
-    },
-
-    /**
      * @param {!WebInspector.Target} target
      * @param {!Element} anchor
      */
diff --git a/third_party/WebKit/Source/devtools/front_end/components/ObjectPopoverHelper.js b/third_party/WebKit/Source/devtools/front_end/components/ObjectPopoverHelper.js
index 0c19759d..2602b135c 100644
--- a/third_party/WebKit/Source/devtools/front_end/components/ObjectPopoverHelper.js
+++ b/third_party/WebKit/Source/devtools/front_end/components/ObjectPopoverHelper.js
@@ -58,12 +58,13 @@
         /**
          * @param {!WebInspector.RemoteObject} funcObject
          * @param {!Element} popoverContentElement
+         * @param {!Element} popoverValueElement
          * @param {!Element} anchorElement
          * @param {?Array.<!WebInspector.RemoteObjectProperty>} properties
          * @param {?Array.<!WebInspector.RemoteObjectProperty>} internalProperties
          * @this {WebInspector.ObjectPopoverHelper}
          */
-        function didGetFunctionProperties(funcObject, popoverContentElement, anchorElement, properties, internalProperties)
+        function didGetFunctionProperties(funcObject, popoverContentElement, popoverValueElement, anchorElement, properties, internalProperties)
         {
             if (internalProperties) {
                 for (var i = 0; i < internalProperties.length; i++) {
@@ -73,6 +74,7 @@
                     }
                 }
             }
+            WebInspector.ObjectPropertiesSection.formatObjectAsFunction(funcObject, popoverValueElement, true);
             funcObject.functionDetails(didGetFunctionDetails.bind(this, popoverContentElement, anchorElement));
         }
 
@@ -146,13 +148,11 @@
 
                 if (result.type === "string")
                     valueElement.createTextChildren("\"", description, "\"");
-                else if (result.type === "function")
-                    WebInspector.ObjectPropertiesSection.formatObjectAsFunction(result, valueElement, true);
-                else
+                else if (result.type !== "function")
                     valueElement.textContent = description;
 
                 if (result.type === "function") {
-                    result.getOwnProperties(didGetFunctionProperties.bind(this, result, popoverContentElement, anchorElement));
+                    result.getOwnProperties(didGetFunctionProperties.bind(this, result, popoverContentElement, valueElement, anchorElement));
                     return;
                 }
                 popover.showForAnchor(popoverContentElement, anchorElement);
diff --git a/third_party/WebKit/Source/devtools/front_end/console/ConsoleView.js b/third_party/WebKit/Source/devtools/front_end/console/ConsoleView.js
index 37e42781..161452d 100644
--- a/third_party/WebKit/Source/devtools/front_end/console/ConsoleView.js
+++ b/third_party/WebKit/Source/devtools/front_end/console/ConsoleView.js
@@ -70,7 +70,7 @@
     this._preserveLogCheckbox = new WebInspector.ToolbarCheckbox(WebInspector.UIString("Preserve log"), WebInspector.UIString("Do not clear log on page reload / navigation"), WebInspector.moduleSetting("preserveConsoleLog"));
     this._progressToolbarItem = new WebInspector.ToolbarItem(createElement("div"));
 
-    var toolbar = new WebInspector.Toolbar(this._contentsElement);
+    var toolbar = new WebInspector.Toolbar("", this._contentsElement);
     toolbar.appendToolbarItem(WebInspector.ToolbarButton.createActionButton("console.clear"));
     toolbar.appendToolbarItem(this._filterBar.filterButton());
     toolbar.appendToolbarItem(this._executionContextComboBox);
diff --git a/third_party/WebKit/Source/devtools/front_end/devices/DevicesView.js b/third_party/WebKit/Source/devtools/front_end/devices/DevicesView.js
index c96370f0..8c6b55d2 100644
--- a/third_party/WebKit/Source/devtools/front_end/devices/DevicesView.js
+++ b/third_party/WebKit/Source/devtools/front_end/devices/DevicesView.js
@@ -592,7 +592,7 @@
         var inspect = createTextButton(WebInspector.UIString("Inspect"), doAction.bind(null, "inspect"), "device-inspect-button");
         titleRow.appendChild(inspect);
 
-        var toolbar = new WebInspector.Toolbar();
+        var toolbar = new WebInspector.Toolbar("");
         toolbar.appendToolbarItem(new WebInspector.ToolbarMenuButton("", "menu-toolbar-item", appendActions));
         titleRow.appendChild(toolbar.element);
 
diff --git a/third_party/WebKit/Source/devtools/front_end/elements/ClassesPaneWidget.js b/third_party/WebKit/Source/devtools/front_end/elements/ClassesPaneWidget.js
new file mode 100644
index 0000000..315200e
--- /dev/null
+++ b/third_party/WebKit/Source/devtools/front_end/elements/ClassesPaneWidget.js
@@ -0,0 +1,217 @@
+// Copyright (c) 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/**
+ * @constructor
+ * @extends {WebInspector.ElementsPanel.BaseToolbarPaneWidget}
+ * @param {!WebInspector.ToolbarItem} toolbarItem
+ */
+WebInspector.ClassesPaneWidget = function(toolbarItem)
+{
+    WebInspector.ElementsPanel.BaseToolbarPaneWidget.call(this, toolbarItem);
+    this.element.className = "styles-element-classes-pane";
+    var container = this.element.createChild("div", "title-container");
+    var input = container.createChild("input", "new-class-input monospace");
+    input.placeholder = WebInspector.UIString("Add new class");
+    input.addEventListener("keydown", this._onKeyDown.bind(this), false);
+    this._classesContainer = this.element.createChild("div", "source-code");
+    this._classesContainer.classList.add("styles-element-classes-container");
+
+    WebInspector.targetManager.addModelListener(WebInspector.DOMModel, WebInspector.DOMModel.Events.DOMMutated, this._onDOMMutated, this);
+    /** @type {!Set<!WebInspector.DOMNode>} */
+    this._mutatingNodes = new Set();
+}
+
+WebInspector.ClassesPaneWidget._classesSymbol = Symbol("WebInspector.ClassesPaneWidget._classesSymbol");
+
+WebInspector.ClassesPaneWidget.prototype = {
+    /**
+     * @param {!Event} event
+     */
+    _onKeyDown: function(event)
+    {
+        if (isEscKey(event)) {
+            event.target.value = "";
+            event.consume(true);
+            return;
+        }
+
+        if (!isEnterKey(event))
+            return;
+        var node = WebInspector.context.flavor(WebInspector.DOMNode);
+        if (!node)
+            return;
+
+        var text = event.target.value;
+        event.target.value = "";
+        var classNames = text.split(/[.,\s]/);
+        for (var className of classNames) {
+            var className = className.trim();
+            if (!className.length)
+                continue;
+            this._toggleClass(node, className, true);
+        }
+        this._installNodeClasses(node);
+        this.update();
+        event.consume(true);
+    },
+
+    /**
+     * @param {!WebInspector.Event} event
+     */
+    _onDOMMutated: function(event)
+    {
+        var node = /** @type {!WebInspector.DOMNode} */(event.data);
+        if (this._mutatingNodes.has(node))
+            return;
+        delete node[WebInspector.ClassesPaneWidget._classesSymbol];
+        this.update();
+    },
+
+    /**
+     * @override
+     * @return {!Promise.<?>}
+     */
+    doUpdate: function()
+    {
+        this._classesContainer.removeChildren();
+        var node = WebInspector.context.flavor(WebInspector.DOMNode);
+        if (!node)
+            return Promise.resolve();
+
+        var classes = this._nodeClasses(node);
+        var keys = classes.keysArray();
+        keys.sort(String.caseInsensetiveComparator);
+        for (var i = 0; i < keys.length; ++i) {
+            var className = keys[i];
+            var label = createCheckboxLabel(className, classes.get(className));
+            label.classList.add("monospace");
+            label.checkboxElement.addEventListener("click", this._onClick.bind(this, className), false);
+            this._classesContainer.appendChild(label);
+        }
+        return Promise.resolve();
+    },
+
+    /**
+     * @param {string} className
+     * @param {!Event} event
+     */
+    _onClick: function(className, event)
+    {
+        var node = WebInspector.context.flavor(WebInspector.DOMNode);
+        if (!node)
+            return;
+        var enabled = event.target.checked;
+        this._toggleClass(node, className, enabled);
+        this._installNodeClasses(node);
+    },
+
+    /**
+     * @param {!WebInspector.DOMNode} node
+     * @return {!Map<string, boolean>}
+     */
+    _nodeClasses: function(node)
+    {
+        var result = node[WebInspector.ClassesPaneWidget._classesSymbol];
+        if (!result) {
+            var classAttribute = node.getAttribute("class") || "";
+            var classes = classAttribute.split(/\s/);
+            result = new Map();
+            for (var i = 0; i < classes.length; ++i) {
+                var className = classes[i].trim();
+                if (!className.length)
+                    continue;
+                result.set(className, true);
+            }
+            node[WebInspector.ClassesPaneWidget._classesSymbol] = result;
+        }
+        return result;
+    },
+
+    /**
+     * @param {!WebInspector.DOMNode} node
+     * @param {string} className
+     * @param {boolean} enabled
+     */
+    _toggleClass: function(node, className, enabled)
+    {
+        var classes = this._nodeClasses(node);
+        classes.set(className, enabled);
+    },
+
+    /**
+     * @param {!WebInspector.DOMNode} node
+     */
+    _installNodeClasses: function(node)
+    {
+        var classes = this._nodeClasses(node);
+        var activeClasses = new Set();
+        for (var className of classes.keys()) {
+            if (classes.get(className))
+                activeClasses.add(className);
+        }
+
+        var newClasses = activeClasses.valuesArray();
+        newClasses.sort();
+        this._mutatingNodes.add(node);
+        node.setAttributeValue("class", newClasses.join(" "), onClassNameUpdated.bind(this));
+
+        /**
+         * @this {WebInspector.ClassesPaneWidget}
+         */
+        function onClassNameUpdated()
+        {
+            this._mutatingNodes.delete(node);
+        }
+    },
+
+    /**
+     * @override
+     * @param {?WebInspector.DOMNode} newNode
+     */
+    onNodeChanged: function(newNode)
+    {
+        this.update();
+    },
+
+    __proto__: WebInspector.ElementsPanel.BaseToolbarPaneWidget.prototype
+}
+
+/**
+ * @constructor
+ * @implements {WebInspector.ToolbarItem.Provider}
+ */
+WebInspector.ClassesPaneWidget.ButtonProvider = function()
+{
+    this._button = new WebInspector.ToolbarTextButton(WebInspector.UIString("Element Classes"), "class-toolbar-item", ".cls");
+    this._button.addEventListener("click", this._clicked, this);
+    this._view = new WebInspector.ClassesPaneWidget(this.item());
+    WebInspector.context.addFlavorChangeListener(WebInspector.DOMNode, this._nodeChanged, this);
+    this._nodeChanged();
+}
+
+WebInspector.ClassesPaneWidget.ButtonProvider.prototype = {
+    _clicked: function()
+    {
+        WebInspector.ElementsPanel.instance().showToolbarPane(!this._view.isShowing() ? this._view : null);
+    },
+
+    /**
+     * @override
+     * @return {!WebInspector.ToolbarItem}
+     */
+    item: function()
+    {
+        return this._button;
+    },
+
+    _nodeChanged: function()
+    {
+        var node = WebInspector.context.flavor(WebInspector.DOMNode);
+        var enabled = !!node;
+        this._button.setEnabled(enabled);
+        if (!enabled && this._button.toggled())
+            WebInspector.ElementsPanel.instance().showToolbarPane(null);
+    }
+}
diff --git a/third_party/WebKit/Source/devtools/front_end/elements/ComputedStyleWidget.js b/third_party/WebKit/Source/devtools/front_end/elements/ComputedStyleWidget.js
index a098597..d89d240 100644
--- a/third_party/WebKit/Source/devtools/front_end/elements/ComputedStyleWidget.js
+++ b/third_party/WebKit/Source/devtools/front_end/elements/ComputedStyleWidget.js
@@ -52,8 +52,7 @@
     var filterInput = WebInspector.StylesSidebarPane.createPropertyFilterElement(WebInspector.UIString("Filter"), hbox, filterCallback.bind(this));
     filterContainerElement.appendChild(filterInput);
 
-    var toolbar = new WebInspector.Toolbar(hbox);
-    toolbar.element.classList.add("styles-pane-toolbar");
+    var toolbar = new WebInspector.Toolbar("styles-pane-toolbar", hbox);
     toolbar.appendToolbarItem(new WebInspector.ToolbarCheckbox(WebInspector.UIString("Show all"), undefined, this._showInheritedComputedStylePropertiesSetting));
 
     this._propertiesOutline = new TreeOutlineInShadow();
diff --git a/third_party/WebKit/Source/devtools/front_end/elements/ElementStatePaneWidget.js b/third_party/WebKit/Source/devtools/front_end/elements/ElementStatePaneWidget.js
index cb2722a..c4046e4a 100644
--- a/third_party/WebKit/Source/devtools/front_end/elements/ElementStatePaneWidget.js
+++ b/third_party/WebKit/Source/devtools/front_end/elements/ElementStatePaneWidget.js
@@ -80,9 +80,7 @@
      */
     _pseudoStateForced: function(event)
     {
-        var node = /** @type{!WebInspector.DOMNode} */(event.data.node);
-        if (node === WebInspector.context.flavor(WebInspector.DOMNode))
-            this._updateInputs(node);
+        this.update();
     },
 
     /**
@@ -92,21 +90,29 @@
     onNodeChanged: function(newNode)
     {
         this._updateTarget(newNode? newNode.target() : null);
-        if (newNode)
-            this._updateInputs(newNode);
+        this.update();
     },
 
     /**
-     * @param {!WebInspector.DOMNode} node
+     * @override
+     * @return {!Promise.<?>}
      */
-    _updateInputs: function(node)
+    doUpdate: function()
     {
-        var nodePseudoState = WebInspector.CSSStyleModel.fromNode(node).pseudoState(node);
-        var inputs = this._inputs;
-        for (var i = 0; i < inputs.length; ++i) {
-            inputs[i].disabled = !!node.pseudoType();
-            inputs[i].checked = nodePseudoState.indexOf(inputs[i].state) >= 0;
+        var node = WebInspector.context.flavor(WebInspector.DOMNode);
+        if (node) {
+            var nodePseudoState = WebInspector.CSSStyleModel.fromNode(node).pseudoState(node);
+            for (var input of this._inputs) {
+                input.disabled = !!node.pseudoType();
+                input.checked = nodePseudoState.indexOf(input.state) >= 0;
+            }
+        } else {
+            for (var input of this._inputs) {
+                input.disabled = true;
+                input.checked = false;
+            }
         }
+        return Promise.resolve();
     },
 
     __proto__: WebInspector.ElementsPanel.BaseToolbarPaneWidget.prototype
diff --git a/third_party/WebKit/Source/devtools/front_end/elements/ElementsPanel.js b/third_party/WebKit/Source/devtools/front_end/elements/ElementsPanel.js
index 647c85d..d07b2a7 100644
--- a/third_party/WebKit/Source/devtools/front_end/elements/ElementsPanel.js
+++ b/third_party/WebKit/Source/devtools/front_end/elements/ElementsPanel.js
@@ -1221,12 +1221,12 @@
 
 /**
  * @constructor
- * @extends {WebInspector.Widget}
+ * @extends {WebInspector.ThrottledWidget}
  * @param {!WebInspector.ToolbarItem} toolbarItem
  */
 WebInspector.ElementsPanel.BaseToolbarPaneWidget = function(toolbarItem)
 {
-    WebInspector.Widget.call(this);
+    WebInspector.ThrottledWidget.call(this);
     this._toolbarItem = toolbarItem;
     WebInspector.context.addFlavorChangeListener(WebInspector.DOMNode, this._nodeChanged, this);
 }
@@ -1255,6 +1255,7 @@
     willHide: function()
     {
         this._toolbarItem.setToggled(false);
+        WebInspector.ThrottledWidget.prototype.willHide.call(this);
     },
 
     /**
@@ -1264,7 +1265,8 @@
     {
         this._toolbarItem.setToggled(true);
         this._nodeChanged();
+        WebInspector.ThrottledWidget.prototype.wasShown.call(this);
     },
 
-    __proto__: WebInspector.Widget.prototype
+    __proto__: WebInspector.ThrottledWidget.prototype
 }
\ No newline at end of file
diff --git a/third_party/WebKit/Source/devtools/front_end/elements/Spectrum.js b/third_party/WebKit/Source/devtools/front_end/elements/Spectrum.js
index 4199a07..5ea8bbc 100644
--- a/third_party/WebKit/Source/devtools/front_end/elements/Spectrum.js
+++ b/third_party/WebKit/Source/devtools/front_end/elements/Spectrum.js
@@ -54,8 +54,7 @@
     var contrastRatioSVG = this._colorElement.createSVGChild("svg", "spectrum-contrast-container fill");
     this._contrastRatioLine = contrastRatioSVG.createSVGChild("path", "spectrum-contrast-line");
 
-    var toolbar = new WebInspector.Toolbar(this.contentElement);
-    toolbar.element.classList.add("spectrum-eye-dropper");
+    var toolbar = new WebInspector.Toolbar("spectrum-eye-dropper", this.contentElement);
     this._colorPickerButton = new WebInspector.ToolbarButton(WebInspector.UIString("Toggle color picker"), "eyedropper-toolbar-item");
     this._colorPickerButton.setToggled(true);
     this._colorPickerButton.addEventListener("click", this._toggleColorPicker.bind(this, undefined));
@@ -116,16 +115,14 @@
     appendSwitcherIcon(paletteSwitcher);
     paletteSwitcher.addEventListener("click", this._togglePalettePanel.bind(this, true));
 
-    this._deleteIconToolbar = new WebInspector.Toolbar();
-    this._deleteIconToolbar.element.classList.add("delete-color-toolbar");
+    this._deleteIconToolbar = new WebInspector.Toolbar("delete-color-toolbar");
     this._deleteButton = new WebInspector.ToolbarButton("", "garbage-collect-toolbar-item");
     this._deleteIconToolbar.appendToolbarItem(this._deleteButton);
 
     var overlay = this.contentElement.createChild("div", "spectrum-overlay fill");
     overlay.addEventListener("click", this._togglePalettePanel.bind(this, false));
 
-    this._addColorToolbar = new WebInspector.Toolbar();
-    this._addColorToolbar.element.classList.add("add-color-toolbar");
+    this._addColorToolbar = new WebInspector.Toolbar("add-color-toolbar");
     var addColorButton = new WebInspector.ToolbarButton(WebInspector.UIString("Add to palette"), "add-toolbar-item");
     addColorButton.addEventListener("click", this._addColorToCustomPalette.bind(this));
     this._addColorToolbar.appendToolbarItem(addColorButton);
@@ -206,7 +203,7 @@
         this._palettePanel.removeChildren();
         var title = this._palettePanel.createChild("div", "palette-title");
         title.textContent = WebInspector.UIString("Color Palettes");
-        var toolbar = new WebInspector.Toolbar(this._palettePanel);
+        var toolbar = new WebInspector.Toolbar("", this._palettePanel);
         var closeButton = new WebInspector.ToolbarButton("Return to color picker", "delete-toolbar-item");
         closeButton.addEventListener("click", this._togglePalettePanel.bind(this, false));
         toolbar.appendToolbarItem(closeButton);
diff --git a/third_party/WebKit/Source/devtools/front_end/elements/StylesSidebarPane.js b/third_party/WebKit/Source/devtools/front_end/elements/StylesSidebarPane.js
index 1d6e0bea..e488f61 100644
--- a/third_party/WebKit/Source/devtools/front_end/elements/StylesSidebarPane.js
+++ b/third_party/WebKit/Source/devtools/front_end/elements/StylesSidebarPane.js
@@ -820,9 +820,7 @@
         items.push(menuButton);
 
         if (items.length) {
-            var sectionToolbar = new WebInspector.Toolbar();
-            sectionToolbar.element.classList.add("sidebar-pane-section-toolbar");
-            closeBrace.appendChild(sectionToolbar.element);
+            var sectionToolbar = new WebInspector.Toolbar("sidebar-pane-section-toolbar", closeBrace);
 
             for (var i = 0; i < items.length; ++i)
                 sectionToolbar.appendToolbarItem(items[i]);
@@ -860,11 +858,10 @@
         }
     }
 
-    this._selectorRefElement = createElementWithClass("div", "styles-section-subtitle");
     this._mediaListElement = this._titleElement.createChild("div", "media-list media-matches");
+    this._selectorRefElement = this._titleElement.createChild("div", "styles-section-subtitle");
     this._updateMediaList();
     this._updateRuleOrigin();
-    selectorContainer.insertBefore(this._selectorRefElement, selectorContainer.firstChild);
     this._titleElement.appendChild(selectorContainer);
     this._selectorContainer = selectorContainer;
 
@@ -1066,16 +1063,12 @@
             return;
         for (var i = mediaRules.length - 1; i >= 0; --i) {
             var media = mediaRules[i];
+            // Don't display trivial non-print media types.
+            if (!media.text.includes("(") && media.text !== "print")
+                continue;
             var mediaDataElement = this._mediaListElement.createChild("div", "media");
-            if (media.sourceURL) {
-                var anchor = this._parentPane._linkifier.linkifyMedia(media);
-                anchor.classList.add("subtitle");
-                mediaDataElement.appendChild(anchor);
-            }
-
             var mediaContainerElement = mediaDataElement.createChild("span");
             var mediaTextElement = mediaContainerElement.createChild("span", "media-text");
-            mediaTextElement.title = media.text;
             switch (media.source) {
             case WebInspector.CSSMedia.Source.LINKED_SHEET:
             case WebInspector.CSSMedia.Source.INLINE_SHEET:
@@ -1085,7 +1078,6 @@
                 var decoration = mediaContainerElement.createChild("span");
                 mediaContainerElement.insertBefore(decoration, mediaTextElement);
                 decoration.textContent = "@media ";
-                decoration.title = media.text;
                 mediaTextElement.textContent = media.text;
                 if (media.parentStyleSheetId) {
                     mediaDataElement.classList.add("editable-media");
@@ -1345,6 +1337,16 @@
         if (WebInspector.isBeingEdited(element))
             return;
 
+        if (WebInspector.KeyboardShortcut.eventHasCtrlOrMeta(/** @type {!MouseEvent} */(event)) && this.navigable) {
+            var cssModel = this._parentPane._cssModel;
+            var rawLocation = new WebInspector.CSSLocation(cssModel, /** @type {string} */(media.parentStyleSheetId), media.sourceURL, /** @type {number} */(media.lineNumberInSource()), media.columnNumberInSource());
+            var uiLocation = WebInspector.cssWorkspaceBinding.rawLocationToUILocation(rawLocation);
+            if (uiLocation)
+                WebInspector.Revealer.reveal(uiLocation);
+            event.consume(true);
+            return;
+        }
+
         var config = new WebInspector.InplaceEditor.Config(this._editingMediaCommitted.bind(this, media), this._editingMediaCancelled.bind(this, element), undefined, this._editingMediaBlurHandler.bind(this));
         WebInspector.InplaceEditor.startEditing(element, config);
 
diff --git a/third_party/WebKit/Source/devtools/front_end/elements/elementsPanel.css b/third_party/WebKit/Source/devtools/front_end/elements/elementsPanel.css
index 722a6d67..eeb57b0e 100644
--- a/third_party/WebKit/Source/devtools/front_end/elements/elementsPanel.css
+++ b/third_party/WebKit/Source/devtools/front_end/elements/elementsPanel.css
@@ -442,7 +442,6 @@
 
 .styles-sidebar-toolbar-pane-container {
     position: relative;
-    max-height: 60px;
     overflow: hidden;
 }
 
@@ -452,6 +451,31 @@
     margin-top: 0;
 }
 
+.styles-element-classes-pane {
+    background-color: #f3f3f3;
+    border-bottom: 1px solid rgb(189, 189, 189);
+    padding: 2px 4px;
+}
+
+.styles-element-classes-container {
+    display: flex;
+    flex-wrap: wrap;
+    justify-content: flex-start;
+}
+
+.styles-element-classes-pane label {
+    margin-right: 15px;
+}
+
+.styles-element-classes-pane .title-container {
+    padding-bottom: 2px;
+}
+
+.styles-element-classes-pane .new-class-input {
+    padding-left: 3px;
+    width: 100%;
+    border: 1px solid #ddd;
+}
 
 .styles-element-state-pane > div {
     margin: 6px 4px 2px;
@@ -610,7 +634,8 @@
 .styles-section:not(.read-only) .style-properties .webkit-css-property.styles-panel-hovered,
 .styles-section:not(.read-only) .style-properties .value .styles-panel-hovered,
 .styles-section:not(.read-only) .style-properties .value.styles-panel-hovered,
-.styles-section:not(.read-only) span.simple-selector.styles-panel-hovered {
+.styles-section:not(.read-only) span.simple-selector.styles-panel-hovered,
+.styles-section:not(.read-only) .media-text.styles-panel-hovered {
     text-decoration: underline;
     cursor: default;
 }
diff --git a/third_party/WebKit/Source/devtools/front_end/elements/module.json b/third_party/WebKit/Source/devtools/front_end/elements/module.json
index bc3fca6..fdebcfe0 100644
--- a/third_party/WebKit/Source/devtools/front_end/elements/module.json
+++ b/third_party/WebKit/Source/devtools/front_end/elements/module.json
@@ -75,6 +75,12 @@
         },
         {
             "type": "@WebInspector.ToolbarItem.Provider",
+            "className": "WebInspector.ClassesPaneWidget.ButtonProvider",
+            "order": 1,
+            "location": "styles-sidebarpane-toolbar"
+        },
+        {
+            "type": "@WebInspector.ToolbarItem.Provider",
             "className": "WebInspector.ElementStatePaneWidget.ButtonProvider",
             "order": 1,
             "location": "styles-sidebarpane-toolbar"
@@ -168,6 +174,7 @@
         "StylesSidebarPane.js",
         "ComputedStyleWidget.js",
         "ElementsPanel.js",
+        "ClassesPaneWidget.js",
         "ElementStatePaneWidget.js",
         "ElementsTreeElementHighlighter.js"
     ],
diff --git a/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-horizontal-default-1x.png b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-horizontal-default-1x.png
new file mode 100644
index 0000000..bf4c0d2d
--- /dev/null
+++ b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-horizontal-default-1x.png
Binary files differ
diff --git a/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-horizontal-default-2x.png b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-horizontal-default-2x.png
new file mode 100644
index 0000000..ba0ed57
--- /dev/null
+++ b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-horizontal-default-2x.png
Binary files differ
diff --git a/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-horizontal-keyboard-1x.png b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-horizontal-keyboard-1x.png
new file mode 100644
index 0000000..cd6e6277
--- /dev/null
+++ b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-horizontal-keyboard-1x.png
Binary files differ
diff --git a/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-horizontal-keyboard-2x.png b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-horizontal-keyboard-2x.png
new file mode 100644
index 0000000..d447c70
--- /dev/null
+++ b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-horizontal-keyboard-2x.png
Binary files differ
diff --git a/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-horizontal-navigation-1x.png b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-horizontal-navigation-1x.png
new file mode 100644
index 0000000..187f1e9d
--- /dev/null
+++ b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-horizontal-navigation-1x.png
Binary files differ
diff --git a/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-horizontal-navigation-2x.png b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-horizontal-navigation-2x.png
new file mode 100644
index 0000000..d93dfa5
--- /dev/null
+++ b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-horizontal-navigation-2x.png
Binary files differ
diff --git a/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-vertical-default-1x.png b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-vertical-default-1x.png
new file mode 100644
index 0000000..bbc14d2
--- /dev/null
+++ b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-vertical-default-1x.png
Binary files differ
diff --git a/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-vertical-default-2x.png b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-vertical-default-2x.png
new file mode 100644
index 0000000..70e0a96
--- /dev/null
+++ b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-vertical-default-2x.png
Binary files differ
diff --git a/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-vertical-keyboard-1x.png b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-vertical-keyboard-1x.png
new file mode 100644
index 0000000..86789f4
--- /dev/null
+++ b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-vertical-keyboard-1x.png
Binary files differ
diff --git a/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-vertical-keyboard-2x.png b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-vertical-keyboard-2x.png
new file mode 100644
index 0000000..039282d
--- /dev/null
+++ b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-vertical-keyboard-2x.png
Binary files differ
diff --git a/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-vertical-navigation-1x.png b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-vertical-navigation-1x.png
new file mode 100644
index 0000000..845b887b
--- /dev/null
+++ b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-vertical-navigation-1x.png
Binary files differ
diff --git a/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-vertical-navigation-2x.png b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-vertical-navigation-2x.png
new file mode 100644
index 0000000..2c21972
--- /dev/null
+++ b/third_party/WebKit/Source/devtools/front_end/emulated_devices/google-nexus-5x-vertical-navigation-2x.png
Binary files differ
diff --git a/third_party/WebKit/Source/devtools/front_end/emulated_devices/module.json b/third_party/WebKit/Source/devtools/front_end/emulated_devices/module.json
index 4a2630c..1020776 100644
--- a/third_party/WebKit/Source/devtools/front_end/emulated_devices/module.json
+++ b/third_party/WebKit/Source/devtools/front_end/emulated_devices/module.json
@@ -226,7 +226,7 @@
                     "touch",
                     "mobile"
                 ],
-                "show-by-default": true,
+                "show-by-default": false,
                 "screen": {
                     "device-pixel-ratio": 3,
                     "vertical": {
@@ -288,9 +288,9 @@
                     "touch",
                     "mobile"
                 ],
-                "show-by-default": false,
+                "show-by-default": true,
                 "screen": {
-                    "device-pixel-ratio": 2.6,
+                    "device-pixel-ratio": 2.625,
                     "vertical": {
                         "width": 411,
                         "height": 731
@@ -304,12 +304,38 @@
                     {
                         "title": "default",
                         "orientation": "vertical",
-                        "insets": { "left": 0, "top": 0, "right": 0, "bottom": 0 }
+                        "insets": { "left": 0, "top": 24, "right": 0, "bottom": 48 },
+                        "image": "@url(google-nexus-5x-vertical-default-1x.png) 1x, @url(google-nexus-5x-vertical-default-2x.png) 2x"
+                    },
+                    {
+                        "title": "navigation bar",
+                        "orientation": "vertical",
+                        "insets": { "left": 0, "top": 80, "right": 0, "bottom": 48 },
+                        "image": "@url(google-nexus-5x-vertical-navigation-1x.png) 1x, @url(google-nexus-5x-vertical-navigation-2x.png) 2x"
+                    },
+                    {
+                        "title": "keyboard",
+                        "orientation": "vertical",
+                        "insets": { "left": 0, "top": 80, "right": 0, "bottom": 342 },
+                        "image": "@url(google-nexus-5x-vertical-keyboard-1x.png) 1x, @url(google-nexus-5x-vertical-keyboard-2x.png) 2x"
                     },
                     {
                         "title": "default",
                         "orientation": "horizontal",
-                        "insets": { "left": 0, "top": 0, "right": 0, "bottom": 0 }
+                        "insets": { "left": 0, "top": 24, "right": 48, "bottom": 0 },
+                        "image": "@url(google-nexus-5x-horizontal-default-1x.png) 1x, @url(google-nexus-5x-horizontal-default-2x.png) 2x"
+                    },
+                    {
+                        "title": "navigation bar",
+                        "orientation": "horizontal",
+                        "insets": { "left": 0, "top": 80, "right": 48, "bottom": 0 },
+                        "image": "@url(google-nexus-5x-horizontal-navigation-1x.png) 1x, @url(google-nexus-5x-horizontal-navigation-2x.png) 2x"
+                    },
+                    {
+                        "title": "keyboard",
+                        "orientation": "horizontal",
+                        "insets": { "left": 0, "top": 80, "right": 48, "bottom": 222 },
+                        "image": "@url(google-nexus-5x-horizontal-keyboard-1x.png) 1x, @url(google-nexus-5x-horizontal-keyboard-2x.png) 2x"
                     }
                 ]
             }
diff --git a/third_party/WebKit/Source/devtools/front_end/emulation/DeviceModeModel.js b/third_party/WebKit/Source/devtools/front_end/emulation/DeviceModeModel.js
index 3b4936b..ae27d37 100644
--- a/third_party/WebKit/Source/devtools/front_end/emulation/DeviceModeModel.js
+++ b/third_party/WebKit/Source/devtools/front_end/emulation/DeviceModeModel.js
@@ -29,8 +29,6 @@
 
     /** @type {!WebInspector.DeviceModeModel.Type} */
     this._type = WebInspector.DeviceModeModel.Type.Desktop;
-    this._fitSetting.set(0);
-    this._deviceScaleFactorSetting.set(0);
     /** @type {?WebInspector.EmulatedDevice} */
     this._device = null;
     /** @type {?WebInspector.EmulatedDevice.Mode} */
diff --git a/third_party/WebKit/Source/devtools/front_end/emulation/DeviceModeView.js b/third_party/WebKit/Source/devtools/front_end/emulation/DeviceModeView.js
index 0de0a287..fcfb04d 100644
--- a/third_party/WebKit/Source/devtools/front_end/emulation/DeviceModeView.js
+++ b/third_party/WebKit/Source/devtools/front_end/emulation/DeviceModeView.js
@@ -204,6 +204,7 @@
     wasShown: function()
     {
         this._mediaInspector.setEnabled(true);
+        this._toolbar.restore();
     },
 
     /**
@@ -231,8 +232,7 @@
     /** @type {?WebInspector.EmulatedDevice} */
     this._lastDevice = null;
 
-    this._modeToolbar = new WebInspector.Toolbar();
-    this._modeToolbar.element.classList.add("device-mode-screen-options");
+    this._modeToolbar = new WebInspector.Toolbar("device-mode-screen-options");
     var modeButton = new WebInspector.ToolbarButton(WebInspector.UIString("Screen options"), "rotate-screen-toolbar-item");
     modeButton.addEventListener("click", this._modeMenuClicked, this);
     this._modeToolbar.appendToolbarItem(modeButton);
@@ -241,7 +241,7 @@
 
     var buttonsToolbarContainer = this._element.createChild("div", "device-mode-buttons-toolbar");
     buttonsToolbarContainer.createChild("div", "flex-auto");
-    var buttonsToolbar = new WebInspector.Toolbar(buttonsToolbarContainer);
+    var buttonsToolbar = new WebInspector.Toolbar("", buttonsToolbarContainer);
     this._desktopItem = new WebInspector.ToolbarButton(WebInspector.UIString("Desktop"), "desktop-toolbar-item");
     buttonsToolbar.appendToolbarItem(this._desktopItem);
     this._desktopItem.addEventListener("click", this._desktopButtonClick, this);
@@ -249,8 +249,7 @@
     buttonsToolbar.appendToolbarItem(this._mobileItem);
     this._mobileItem.addEventListener("click", this._mobileButtonClick, this);
 
-    this._optionsToolbar = new WebInspector.Toolbar(this._element);
-    this._optionsToolbar.element.classList.add("device-mode-options-toolbar");
+    this._optionsToolbar = new WebInspector.Toolbar("device-mode-options-toolbar", this._element);
     this._optionsToolbar.appendSeparator();
 
     this._deviceSelect = this._createDeviceSelect();
@@ -289,6 +288,9 @@
     this._optionsToolbar.appendSeparator();
 
     this._optionsToolbar.appendToolbarItem(new WebInspector.ToolbarMenuButton(WebInspector.UIString("More options"), "menu-toolbar-item", this._appendMenuItems.bind(this)));
+
+    this._persistenceSetting = WebInspector.settings.createSetting("emulation.deviceModeViewPersistence", {type: WebInspector.DeviceModeModel.Type.Desktop, device: "", orientation: "", mode: ""});
+    this._restored = false;
 }
 
 WebInspector.DeviceModeView.Toolbar.prototype = {
@@ -556,12 +558,15 @@
 
     update: function()
     {
+        var updatePersistence = false;
+
         if (this._model.type() !== this._cachedModelType) {
             var isDesktop = this._model.type() === WebInspector.DeviceModeModel.Type.Desktop;
             this._desktopItem.setToggled(isDesktop);
             this._mobileItem.setToggled(!isDesktop);
             this._deviceSelectItem.setVisible(!isDesktop);
             this._cachedModelType = this._model.type();
+            updatePersistence = true;
         }
 
         var resizable = this._model.isResizable();
@@ -621,6 +626,7 @@
             this._updateDeviceSelectedIndex();
 
             this._cachedModelDevice = device;
+            updatePersistence = true;
         }
 
         if (this._model.device() && this._model.mode())
@@ -628,5 +634,49 @@
 
         if (this._model.type() !== WebInspector.DeviceModeModel.Type.Desktop)
             this._lastDevice = this._model.device();
+
+        if (this._model.mode() !== this._cachedModelMode) {
+            this._cachedModelMode = this._model.mode();
+            updatePersistence = true;
+        }
+
+        if (updatePersistence) {
+            this._persistenceSetting.set({
+                type: this._cachedModelType,
+                device: this._cachedModelDevice ? this._cachedModelDevice.title : "",
+                orientation: this._cachedModelMode ? this._cachedModelMode.orientation : "",
+                mode: this._cachedModelMode ? this._cachedModelMode.title : ""
+            });
+        }
+    },
+
+    restore: function()
+    {
+        if (this._restored)
+            return;
+
+        this._restored = true;
+        var type = this._persistenceSetting.get().type;
+        if (type === WebInspector.DeviceModeModel.Type.Mobile) {
+            this._model.emulate(WebInspector.DeviceModeModel.Type.Mobile, null, null);
+        } else if (type === WebInspector.DeviceModeModel.Type.Device) {
+            var device = null;
+            for (var i = 0; i < this._deviceSelect.options.length; ++i) {
+                if (this._deviceSelect.options[i].device && this._deviceSelect.options[i].device.title === this._persistenceSetting.get().device)
+                    device = this._deviceSelect.options[i].device;
+            }
+            if (device) {
+                var mode = null;
+                for (var i = 0; i < device.modes.length; ++i) {
+                    if (device.modes[i].orientation === this._persistenceSetting.get().orientation && device.modes[i].title === this._persistenceSetting.get().mode)
+                        mode = device.modes[i];
+                }
+                this._model.emulate(WebInspector.DeviceModeModel.Type.Device, device, mode || device.modes[0]);
+            } else {
+                this._model.emulate(WebInspector.DeviceModeModel.Type.Mobile, null, null);
+            }
+        } else {
+            this._model.emulate(WebInspector.DeviceModeModel.Type.Desktop, null, null);
+        }
     }
 }
diff --git a/third_party/WebKit/Source/devtools/front_end/emulation/OverridesSupport.js b/third_party/WebKit/Source/devtools/front_end/emulation/OverridesSupport.js
index 3326d81e..c3478a83 100644
--- a/third_party/WebKit/Source/devtools/front_end/emulation/OverridesSupport.js
+++ b/third_party/WebKit/Source/devtools/front_end/emulation/OverridesSupport.js
@@ -758,7 +758,8 @@
 
     _onMainFrameNavigated: function()
     {
-        this._deviceMetricsChanged(false);
+        if (!Runtime.experiments.isEnabled("deviceMode"))
+            this._deviceMetricsChanged(false);
         this._updateUserAgentWarningMessage("");
         this._updateDeviceMetricsWarningMessage("");
     },
diff --git a/third_party/WebKit/Source/devtools/front_end/emulation/ResponsiveDesignView.js b/third_party/WebKit/Source/devtools/front_end/emulation/ResponsiveDesignView.js
index 750fcdf..56541828 100644
--- a/third_party/WebKit/Source/devtools/front_end/emulation/ResponsiveDesignView.js
+++ b/third_party/WebKit/Source/devtools/front_end/emulation/ResponsiveDesignView.js
@@ -636,7 +636,7 @@
 
     _createButtonsSection: function()
     {
-        var buttonsToolbar = new WebInspector.Toolbar(this._toolbarElement);
+        var buttonsToolbar = new WebInspector.Toolbar("", this._toolbarElement);
         buttonsToolbar.makeVertical();
         buttonsToolbar.setColor("white");
         buttonsToolbar.setToggledColor("rgb(105, 194, 236)");
diff --git a/third_party/WebKit/Source/devtools/front_end/emulation/mediaQueryInspector.css b/third_party/WebKit/Source/devtools/front_end/emulation/mediaQueryInspector.css
index 4581359f..7046717e 100644
--- a/third_party/WebKit/Source/devtools/front_end/emulation/mediaQueryInspector.css
+++ b/third_party/WebKit/Source/devtools/front_end/emulation/mediaQueryInspector.css
@@ -17,31 +17,31 @@
     top: 1px;
     bottom: 1px;
     white-space: nowrap;
-    border-radius: 2px;
-    -webkit-filter: brightness(130%);
-}
-
-.media-inspector-marker.media-inspector-marker-inactive {
-    -webkit-filter: brightness(100%);
 }
 
 .media-inspector-marker:hover {
     top: -1px;
     bottom: -1px;
-    -webkit-filter: brightness(130%) !important;
+    opacity: 1;
 }
 
 .media-inspector-marker-max-width {
-    background: linear-gradient(to left, rgba(255, 255, 255, 0.27), rgba(0,0,0,0) 30px), linear-gradient(to bottom, rgb(72, 139, 249), rgb(26, 113, 233));
-    border-radius: 0 2px 2px 0;
-    border-right: 2px solid rgb(171, 207, 255);
+    background-color: hsl(207, 90%, 77%);
+    border-right: 2px solid hsl(207, 90%, 61%);
+}
+
+.media-inspector-marker-max-width.media-inspector-marker-inactive:not(:hover) {
+    background-color: hsl(199, 94%, 94%);
 }
 
 .media-inspector-marker-min-max-width {
-    background: linear-gradient(to right, rgba(255, 255, 255, 0.27), rgba(0,0,0,0) 30px), linear-gradient(to left, rgba(255, 255, 255, 0.27), rgba(0,0,0,0) 30px), linear-gradient(to bottom, rgb(112, 174, 7), rgb(3, 131, 0));
-    border-radius: 2px;
-    border-left: 2px solid rgb(80, 226, 40);
-    border-right: 2px solid rgb(80, 226, 40);
+    background-color: hsl(88, 50%, 76%);
+    border-left: 2px solid #689F38;
+    border-right: 2px solid hsl(92, 48%, 42%);
+}
+
+.media-inspector-marker-min-max-width.media-inspector-marker-inactive:not(:hover) {
+    background-color: hsl(125, 39%, 94%);
 }
 
 .media-inspector-marker-min-max-width:hover {
@@ -49,9 +49,12 @@
 }
 
 .media-inspector-marker-min-width {
-    background: linear-gradient(to right, rgba(255, 255, 255, 0.27), rgba(0,0,0,0) 30px), linear-gradient(to bottom, hsl(31, 100%, 50%), hsl(25, 100%, 50%));
-    border-radius: 2px 0 0 2px;
-    border-left: 2px solid hsl(21, 100%, 79%);
+    background-color: hsl(36, 100%, 75%);
+    border-left: 2px solid hsl(30, 100%, 48%);
+}
+
+.media-inspector-marker-min-width.media-inspector-marker-inactive:not(:hover) {
+    background-color: hsl(37, 100%, 94%);
 }
 
 /* Media query labels */
diff --git a/third_party/WebKit/Source/devtools/front_end/extensions/ExtensionPanel.js b/third_party/WebKit/Source/devtools/front_end/extensions/ExtensionPanel.js
index 313362e..f014426e 100644
--- a/third_party/WebKit/Source/devtools/front_end/extensions/ExtensionPanel.js
+++ b/third_party/WebKit/Source/devtools/front_end/extensions/ExtensionPanel.js
@@ -43,8 +43,7 @@
     this._server = server;
     this._id = id;
     this.setHideOnDetach();
-    this._panelToolbar = new WebInspector.Toolbar(this.element);
-    this._panelToolbar.element.classList.add("hidden");
+    this._panelToolbar = new WebInspector.Toolbar("hidden", this.element);
 
     this._searchableView = new WebInspector.SearchableView(this);
     this._searchableView.show(this.element);
diff --git a/third_party/WebKit/Source/devtools/front_end/main/Main.js b/third_party/WebKit/Source/devtools/front_end/main/Main.js
index 6bbcc23..2bcbd05 100644
--- a/third_party/WebKit/Source/devtools/front_end/main/Main.js
+++ b/third_party/WebKit/Source/devtools/front_end/main/Main.js
@@ -872,7 +872,7 @@
             var toggleDockSideShorcuts = WebInspector.shortcutRegistry.shortcutDescriptorsForAction("main.toggle-dock");
             titleElement.title = WebInspector.UIString("Placement of DevTools relative to the page. (%s to restore last position)", toggleDockSideShorcuts[0].name);
             dockItemElement.appendChild(titleElement);
-            var dockItemToolbar = new WebInspector.Toolbar(dockItemElement);
+            var dockItemToolbar = new WebInspector.Toolbar("", dockItemElement);
             dockItemToolbar.makeBlueOnHover();
             var undock = new WebInspector.ToolbarButton(WebInspector.UIString("Undock into separate window"), "dock-toolbar-item-undock");
             var bottom = new WebInspector.ToolbarButton(WebInspector.UIString("Dock to bottom"), "dock-toolbar-item-bottom");
diff --git a/third_party/WebKit/Source/devtools/front_end/network/BlockedURLsPane.js b/third_party/WebKit/Source/devtools/front_end/network/BlockedURLsPane.js
index a45d385..34a7af3 100644
--- a/third_party/WebKit/Source/devtools/front_end/network/BlockedURLsPane.js
+++ b/third_party/WebKit/Source/devtools/front_end/network/BlockedURLsPane.js
@@ -17,7 +17,7 @@
     this._blockedURLsSetting = WebInspector.moduleSetting("blockedURLs");
     this._blockedURLsSetting.addChangeListener(this._update, this);
 
-    this._toolbar = new WebInspector.Toolbar(this.contentElement);
+    this._toolbar = new WebInspector.Toolbar("", this.contentElement);
     this._toolbar.element.addEventListener("click", consumeEvent);
     var addButton = new WebInspector.ToolbarButton(WebInspector.UIString("Add pattern"), "add-toolbar-item");
     addButton.addEventListener("click", this._addButtonClicked.bind(this));
diff --git a/third_party/WebKit/Source/devtools/front_end/network/NetworkPanel.js b/third_party/WebKit/Source/devtools/front_end/network/NetworkPanel.js
index 1375aaf5..de6bbaa 100644
--- a/third_party/WebKit/Source/devtools/front_end/network/NetworkPanel.js
+++ b/third_party/WebKit/Source/devtools/front_end/network/NetworkPanel.js
@@ -48,7 +48,7 @@
     /** @type {?WebInspector.NetworkPanel.FilmStripRecorder} */
     this._filmStripRecorder = null;
 
-    this._panelToolbar = new WebInspector.Toolbar(this.element);
+    this._panelToolbar = new WebInspector.Toolbar("", this.element);
     this._filterBar = new WebInspector.FilterBar("networkPanel", true);
     this.element.appendChild(this._filterBar.filtersElement());
 
diff --git a/third_party/WebKit/Source/devtools/front_end/platform/utilities.js b/third_party/WebKit/Source/devtools/front_end/platform/utilities.js
index 93e797ab..bda5b883 100644
--- a/third_party/WebKit/Source/devtools/front_end/platform/utilities.js
+++ b/third_party/WebKit/Source/devtools/front_end/platform/utilities.js
@@ -384,6 +384,20 @@
 }
 
 /**
+ * @param {string} a
+ * @param {string} b
+ * @return {number}
+ */
+String.caseInsensetiveComparator = function(a, b)
+{
+    a = a.toUpperCase();
+    b = b.toUpperCase();
+    if (a === b)
+        return 0;
+    return a > b ? 1 : -1;
+}
+
+/**
  * @param {number} num
  * @param {number} min
  * @param {number} max
diff --git a/third_party/WebKit/Source/devtools/front_end/profiler/ProfilesPanel.js b/third_party/WebKit/Source/devtools/front_end/profiler/ProfilesPanel.js
index 8d3883ce..cd206b4 100644
--- a/third_party/WebKit/Source/devtools/front_end/profiler/ProfilesPanel.js
+++ b/third_party/WebKit/Source/devtools/front_end/profiler/ProfilesPanel.js
@@ -458,7 +458,7 @@
     this.panelSidebarElement().classList.add("profiles-sidebar-tree-box");
     var toolbarContainerLeft = createElementWithClass("div", "profiles-toolbar");
     this.panelSidebarElement().insertBefore(toolbarContainerLeft, this.panelSidebarElement().firstChild);
-    var toolbar = new WebInspector.Toolbar(toolbarContainerLeft);
+    var toolbar = new WebInspector.Toolbar("", toolbarContainerLeft);
 
     this.recordButton = WebInspector.ToolbarButton.createActionButton("profiler.toggle-recording");
     toolbar.appendToolbarItem(this.recordButton);
@@ -467,8 +467,8 @@
     this.clearResultsButton.addEventListener("click", this._reset, this);
     toolbar.appendToolbarItem(this.clearResultsButton);
 
-    this._profileTypeToolbar = new WebInspector.Toolbar(this._toolbarElement);
-    this._profileViewToolbar = new WebInspector.Toolbar(this._toolbarElement);
+    this._profileTypeToolbar = new WebInspector.Toolbar("", this._toolbarElement);
+    this._profileViewToolbar = new WebInspector.Toolbar("", this._toolbarElement);
 
     this._profileGroups = {};
     this._launcherView = new WebInspector.MultiProfileLauncherView(this);
diff --git a/third_party/WebKit/Source/devtools/front_end/promises/PromisePane.js b/third_party/WebKit/Source/devtools/front_end/promises/PromisePane.js
index 2f97efb..92ff5a4 100644
--- a/third_party/WebKit/Source/devtools/front_end/promises/PromisePane.js
+++ b/third_party/WebKit/Source/devtools/front_end/promises/PromisePane.js
@@ -14,7 +14,7 @@
     this.registerRequiredCSS("promises/promisePane.css");
     this.element.classList.add("promises");
 
-    var toolbar = new WebInspector.Toolbar(this.element);
+    var toolbar = new WebInspector.Toolbar("", this.element);
     this._recordButton = new WebInspector.ToolbarButton("", "record-toolbar-item");
     this._recordButton.addEventListener("click", this._recordButtonClicked.bind(this));
     toolbar.appendToolbarItem(this._recordButton);
diff --git a/third_party/WebKit/Source/devtools/front_end/resources/IndexedDBViews.js b/third_party/WebKit/Source/devtools/front_end/resources/IndexedDBViews.js
index be2c4a74..9904322 100644
--- a/third_party/WebKit/Source/devtools/front_end/resources/IndexedDBViews.js
+++ b/third_party/WebKit/Source/devtools/front_end/resources/IndexedDBViews.js
@@ -206,8 +206,7 @@
 
     _createEditorToolbar: function()
     {
-        var editorToolbar = new WebInspector.Toolbar(this.element);
-        editorToolbar.element.classList.add("data-view-toolbar");
+        var editorToolbar = new WebInspector.Toolbar("data-view-toolbar", this.element);
 
         this._pageBackButton = new WebInspector.ToolbarButton(WebInspector.UIString("Show previous page"), "play-backwards-toolbar-item");
         this._pageBackButton.addEventListener("click", this._pageBackButtonClicked, this);
diff --git a/third_party/WebKit/Source/devtools/front_end/resources/ResourcesPanel.js b/third_party/WebKit/Source/devtools/front_end/resources/ResourcesPanel.js
index ca025aa3..3f84a4b 100644
--- a/third_party/WebKit/Source/devtools/front_end/resources/ResourcesPanel.js
+++ b/third_party/WebKit/Source/devtools/front_end/resources/ResourcesPanel.js
@@ -76,8 +76,7 @@
 
     var mainContainer = new WebInspector.VBox();
     this.storageViews = mainContainer.element.createChild("div", "vbox flex-auto");
-    this._storageViewToolbar = new WebInspector.Toolbar(mainContainer.element);
-    this._storageViewToolbar.element.classList.add("resources-toolbar");
+    this._storageViewToolbar = new WebInspector.Toolbar("resources-toolbar", mainContainer.element);
     this.splitWidget().setMainWidget(mainContainer);
 
     /** @type {!Map.<!WebInspector.Database, !Object.<string, !WebInspector.DatabaseTableView>>} */
diff --git a/third_party/WebKit/Source/devtools/front_end/resources/ServiceWorkerCacheViews.js b/third_party/WebKit/Source/devtools/front_end/resources/ServiceWorkerCacheViews.js
index 7768ce4..fb2ad90 100644
--- a/third_party/WebKit/Source/devtools/front_end/resources/ServiceWorkerCacheViews.js
+++ b/third_party/WebKit/Source/devtools/front_end/resources/ServiceWorkerCacheViews.js
@@ -47,8 +47,7 @@
 
     _createEditorToolbar: function()
     {
-        var editorToolbar = new WebInspector.Toolbar(this.element);
-        editorToolbar.element.classList.add("data-view-toolbar");
+        var editorToolbar = new WebInspector.Toolbar("data-view-toolbar", this.element);
 
         this._pageBackButton = new WebInspector.ToolbarButton(WebInspector.UIString("Show previous page"), "play-backwards-toolbar-item");
         this._pageBackButton.addEventListener("click", this._pageBackButtonClicked, this);
diff --git a/third_party/WebKit/Source/devtools/front_end/settings/SettingsScreen.js b/third_party/WebKit/Source/devtools/front_end/settings/SettingsScreen.js
index a42eacc..25c336e 100644
--- a/third_party/WebKit/Source/devtools/front_end/settings/SettingsScreen.js
+++ b/third_party/WebKit/Source/devtools/front_end/settings/SettingsScreen.js
@@ -349,7 +349,7 @@
         path.textContent = fileSystemPath;
         path.title = fileSystemPath;
 
-        var toolbar = new WebInspector.Toolbar();
+        var toolbar = new WebInspector.Toolbar("");
         var button = new WebInspector.ToolbarButton(WebInspector.UIString("Remove"), "delete-toolbar-item");
         button.addEventListener("click", this._removeFileSystemClicked.bind(this, fileSystem));
         toolbar.appendToolbarItem(button);
diff --git a/third_party/WebKit/Source/devtools/front_end/sources/SourcesPanel.js b/third_party/WebKit/Source/devtools/front_end/sources/SourcesPanel.js
index cb766c7..8bff5d3 100644
--- a/third_party/WebKit/Source/devtools/front_end/sources/SourcesPanel.js
+++ b/third_party/WebKit/Source/devtools/front_end/sources/SourcesPanel.js
@@ -713,8 +713,7 @@
      */
     _createDebugToolbar: function()
     {
-        var debugToolbar = new WebInspector.Toolbar();
-        debugToolbar.element.classList.add("scripts-debug-toolbar");
+        var debugToolbar = new WebInspector.Toolbar("scripts-debug-toolbar");
 
         var title, handler;
 
diff --git a/third_party/WebKit/Source/devtools/front_end/sources/SourcesView.js b/third_party/WebKit/Source/devtools/front_end/sources/SourcesView.js
index 96575cd0..7b8756d5 100644
--- a/third_party/WebKit/Source/devtools/front_end/sources/SourcesView.js
+++ b/third_party/WebKit/Source/devtools/front_end/sources/SourcesView.js
@@ -38,7 +38,7 @@
     this._historyManager = new WebInspector.EditingLocationHistoryManager(this, this.currentSourceFrame.bind(this));
 
     this._toolbarContainerElement = this.element.createChild("div", "sources-toolbar");
-    this._toolbarEditorActions = new WebInspector.Toolbar(this._toolbarContainerElement);
+    this._toolbarEditorActions = new WebInspector.Toolbar("", this._toolbarContainerElement);
 
     self.runtime.instancesPromise(WebInspector.SourcesView.EditorAction).then(appendButtonsForExtensions.bind(this));
     /**
@@ -50,7 +50,7 @@
         for (var i = 0; i < actions.length; ++i)
             this._toolbarEditorActions.appendToolbarItem(actions[i].button(this));
     }
-    this._scriptViewToolbarText = new WebInspector.Toolbar(this._toolbarContainerElement);
+    this._scriptViewToolbarText = new WebInspector.Toolbar("", this._toolbarContainerElement);
 
     WebInspector.startBatchUpdate();
     this._workspace.uiSourceCodes().forEach(this._addUISourceCode.bind(this));
diff --git a/third_party/WebKit/Source/devtools/front_end/timeline/TimelinePanel.js b/third_party/WebKit/Source/devtools/front_end/timeline/TimelinePanel.js
index 0f767b88..450c056 100644
--- a/third_party/WebKit/Source/devtools/front_end/timeline/TimelinePanel.js
+++ b/third_party/WebKit/Source/devtools/front_end/timeline/TimelinePanel.js
@@ -335,7 +335,7 @@
 
     _createToolbarItems: function()
     {
-        this._panelToolbar = new WebInspector.Toolbar(this.element);
+        this._panelToolbar = new WebInspector.Toolbar("", this.element);
 
         this._toggleTimelineButton = WebInspector.ToolbarButton.createActionButton("timeline.toggle-recording");
         this._panelToolbar.appendToolbarItem(this._toggleTimelineButton);
diff --git a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineTreeView.js b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineTreeView.js
index 268b1f53..63529f4 100644
--- a/third_party/WebKit/Source/devtools/front_end/timeline/TimelineTreeView.js
+++ b/third_party/WebKit/Source/devtools/front_end/timeline/TimelineTreeView.js
@@ -450,7 +450,7 @@
      */
     _populateToolbar: function(parent)
     {
-        var panelToolbar = new WebInspector.Toolbar(parent);
+        var panelToolbar = new WebInspector.Toolbar("", parent);
         this._groupByCombobox = new WebInspector.ToolbarComboBox(this._onGroupByChanged.bind(this));
         /**
          * @param {string} name
diff --git a/third_party/WebKit/Source/devtools/front_end/timeline/TransformController.js b/third_party/WebKit/Source/devtools/front_end/timeline/TransformController.js
index 768a18d..748147c 100644
--- a/third_party/WebKit/Source/devtools/front_end/timeline/TransformController.js
+++ b/third_party/WebKit/Source/devtools/front_end/timeline/TransformController.js
@@ -24,8 +24,7 @@
     this._minScale = 0;
     this._maxScale = Infinity;
 
-    this._controlPanelToolbar = new WebInspector.Toolbar();
-    this._controlPanelToolbar.element.classList.add("transform-control-panel");
+    this._controlPanelToolbar = new WebInspector.Toolbar("transform-control-panel");
 
     this._modeButtons = {};
     if (!disableRotate) {
diff --git a/third_party/WebKit/Source/devtools/front_end/ui/SearchableView.js b/third_party/WebKit/Source/devtools/front_end/ui/SearchableView.js
index 1ab9cf4..eded401 100644
--- a/third_party/WebKit/Source/devtools/front_end/ui/SearchableView.js
+++ b/third_party/WebKit/Source/devtools/front_end/ui/SearchableView.js
@@ -48,7 +48,7 @@
     this._footerElementContainer = this.contentElement.createChild("div", "search-bar hidden");
     this._footerElementContainer.style.order = 100;
 
-    var toolbar = new WebInspector.Toolbar(this._footerElementContainer);
+    var toolbar = new WebInspector.Toolbar("", this._footerElementContainer);
 
     if (this._searchProvider.supportsCaseSensitiveSearch()) {
         this._caseSensitiveButton = new WebInspector.ToolbarTextButton(WebInspector.UIString("Case sensitive"), "case-sensitive-search-toolbar-item", "Aa", 2);
diff --git a/third_party/WebKit/Source/devtools/front_end/ui/SidebarPane.js b/third_party/WebKit/Source/devtools/front_end/ui/SidebarPane.js
index e800e0cf..216b626 100644
--- a/third_party/WebKit/Source/devtools/front_end/ui/SidebarPane.js
+++ b/third_party/WebKit/Source/devtools/front_end/ui/SidebarPane.js
@@ -49,7 +49,7 @@
     toolbar: function()
     {
         if (!this._toolbar) {
-            this._toolbar = new WebInspector.Toolbar();
+            this._toolbar = new WebInspector.Toolbar("");
             this._toolbar.element.addEventListener("click", consumeEvent);
             this.element.insertBefore(this._toolbar.element, this.element.firstChild);
         }
diff --git a/third_party/WebKit/Source/devtools/front_end/ui/TabbedPane.js b/third_party/WebKit/Source/devtools/front_end/ui/TabbedPane.js
index e800583..3d5cf60 100644
--- a/third_party/WebKit/Source/devtools/front_end/ui/TabbedPane.js
+++ b/third_party/WebKit/Source/devtools/front_end/ui/TabbedPane.js
@@ -1290,8 +1290,7 @@
 
     enableMoreTabsButton: function()
     {
-        var toolbar = new WebInspector.Toolbar();
-        toolbar.element.classList.add("drawer-toolbar");
+        var toolbar = new WebInspector.Toolbar("drawer-toolbar");
         this._moreTabsButton = new WebInspector.ToolbarMenuButton("", "menu-toolbar-item", this._appendTabsToMenu.bind(this));
         toolbar.appendToolbarItem(this._moreTabsButton);
         this._tabbedPane.insertBeforeTabStrip(toolbar.element);
diff --git a/third_party/WebKit/Source/devtools/front_end/ui/Toolbar.js b/third_party/WebKit/Source/devtools/front_end/ui/Toolbar.js
index cfac7ffe..65c6a3761 100644
--- a/third_party/WebKit/Source/devtools/front_end/ui/Toolbar.js
+++ b/third_party/WebKit/Source/devtools/front_end/ui/Toolbar.js
@@ -30,13 +30,16 @@
 
 /**
  * @constructor
+ * @param {string} className
  * @param {!Element=} parentElement
  */
-WebInspector.Toolbar = function(parentElement)
+WebInspector.Toolbar = function(className, parentElement)
 {
     /** @type {!Array.<!WebInspector.ToolbarItem>} */
     this._items = [];
-    this.element = parentElement ? parentElement.createChild("div", "toolbar") : createElementWithClass("div", "toolbar");
+    this.element = parentElement ? parentElement.createChild("div") : createElement("div");
+    this.element.className = className;
+    this.element.classList.add("toolbar");
     this._shadowRoot = WebInspector.createShadowRootWithCoreStyles(this.element);
     this._shadowRoot.appendChild(WebInspector.Widget.createStyleElement("ui/toolbar.css"));
     this._contentElement = this._shadowRoot.createChild("div", "toolbar-shadow");
@@ -763,9 +766,7 @@
         document.documentElement.addEventListener("mouseup", mouseUp, false);
 
         var optionsGlassPane = new WebInspector.GlassPane(document);
-        var optionsBar = new WebInspector.Toolbar(optionsGlassPane.element);
-
-        optionsBar.element.classList.add("fill");
+        var optionsBar = new WebInspector.Toolbar("fill", optionsGlassPane.element);
         optionsBar._contentElement.classList.add("floating");
         const buttonHeight = 26;
 
@@ -1152,7 +1153,7 @@
  */
 WebInspector.ExtensibleToolbar = function(location, parentElement)
 {
-    WebInspector.Toolbar.call(this, parentElement);
+    WebInspector.Toolbar.call(this, "", parentElement);
     this._loadItems(location);
 }
 
diff --git a/third_party/WebKit/Source/devtools/front_end/ui/toolbar.css b/third_party/WebKit/Source/devtools/front_end/ui/toolbar.css
index 97d0cfa..f53bd1e 100644
--- a/third_party/WebKit/Source/devtools/front_end/ui/toolbar.css
+++ b/third_party/WebKit/Source/devtools/front_end/ui/toolbar.css
@@ -479,6 +479,7 @@
 }
 
 :host(.toolbar-gray-toggled) .pin-toolbar-item.toggled-on,
+:host(.toolbar-gray-toggled) .class-toolbar-item.toggled-on,
 :host(.toolbar-gray-toggled) .animation-toolbar-item.toggled-on {
     background-color: #f3f3f3;
 }
@@ -535,6 +536,10 @@
     color: rgb(94, 146, 233);
 }
 
+.class-toolbar-item.toggled-on .toolbar-button-text {
+    color: rgb(66, 129, 235);
+}
+
 .playback-rate-button.toggled-on > .toolbar-button-text {
     color: rgb(66, 129, 235);
 }
diff --git a/third_party/WebKit/Source/devtools/protocol.json b/third_party/WebKit/Source/devtools/protocol.json
index 002d0ff..eefed2fe 100644
--- a/third_party/WebKit/Source/devtools/protocol.json
+++ b/third_party/WebKit/Source/devtools/protocol.json
@@ -5199,7 +5199,7 @@
             },
             { "id": "AXValueNativeSourceType",
               "type": "string",
-              "enum": [ "figcaption", "label", "labelfor", "labelwrapped", "legend", "tablecaption", "other" ],
+              "enum": [ "figcaption", "label", "labelfor", "labelwrapped", "legend", "tablecaption", "title", "other" ],
               "description": "Enum of possible native property sources (as a subtype of a particular AXValueSourceType)."
             },
             {
@@ -5286,7 +5286,6 @@
                     { "name": "name", "$ref": "AXValue", "description": "The accessible name for this <code>Node</code>.", "optional": true },
                     { "name": "description", "$ref": "AXValue", "description": "The accessible description for this <code>Node</code>.", "optional": true },
                     { "name": "value", "$ref": "AXValue", "description": "The value for this <code>Node</code>.", "optional": true },
-                    { "name": "help", "$ref": "AXValue", "description": "Help.", "optional": true },
                     { "name": "properties", "type": "array", "items": { "$ref": "AXProperty" }, "description": "All other properties", "optional": true }
                 ],
                 "description": "A node in the accessibility tree."
diff --git a/third_party/WebKit/Source/modules/accessibility/AXImageMapLink.cpp b/third_party/WebKit/Source/modules/accessibility/AXImageMapLink.cpp
index 39c8559a..67c030d 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXImageMapLink.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXImageMapLink.cpp
@@ -103,30 +103,6 @@
     return areaElement()->href();
 }
 
-String AXImageMapLink::deprecatedAccessibilityDescription() const
-{
-    const AtomicString& ariaLabel = getAttribute(aria_labelAttr);
-    if (!ariaLabel.isEmpty())
-        return ariaLabel;
-    const AtomicString& alt = getAttribute(altAttr);
-    if (!alt.isEmpty())
-        return alt;
-
-    return String();
-}
-
-String AXImageMapLink::deprecatedTitle(TextUnderElementMode mode) const
-{
-    const AtomicString& title = getAttribute(titleAttr);
-    if (!title.isEmpty())
-        return title;
-    const AtomicString& summary = getAttribute(summaryAttr);
-    if (!summary.isEmpty())
-        return summary;
-
-    return String();
-}
-
 LayoutRect AXImageMapLink::elementRect() const
 {
     HTMLAreaElement* area = areaElement();
diff --git a/third_party/WebKit/Source/modules/accessibility/AXImageMapLink.h b/third_party/WebKit/Source/modules/accessibility/AXImageMapLink.h
index 27ac9f4..b4c0f7b 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXImageMapLink.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXImageMapLink.h
@@ -60,8 +60,6 @@
     KURL url() const override;
     bool isLink() const override { return true; }
     bool isLinked() const override { return true; }
-    String deprecatedTitle(TextUnderElementMode) const override;
-    String deprecatedAccessibilityDescription() const override;
     AXObject* computeParent() const override;
 
     LayoutRect elementRect() const override;
diff --git a/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp b/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp
index 2ed18aa..5f1efc79 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp
@@ -113,11 +113,12 @@
         words[i] = AXRange(wordBoundaries[i].startIndex, wordBoundaries[i].endIndex);
 }
 
-String AXInlineTextBox::stringValue() const
+String AXInlineTextBox::name(AXNameFrom& nameFrom, AXObject::AXObjectVector* nameObjects) const
 {
     if (!m_inlineTextBox)
         return String();
 
+    nameFrom = AXNameFromContents;
     return m_inlineTextBox->text();
 }
 
diff --git a/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.h b/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.h
index eee5e48..775ca341 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.h
@@ -50,7 +50,7 @@
     void setInlineTextBox(AbstractInlineTextBox* inlineTextBox) { m_inlineTextBox = inlineTextBox; }
 
     AccessibilityRole roleValue() const override { return InlineTextBoxRole; }
-    String stringValue() const override;
+    String name(AXNameFrom&, AXObject::AXObjectVector* nameObjects) const override;
     void textCharacterOffsets(Vector<int>&) const override;
     void wordBoundaries(Vector<AXRange>& words) const override;
     LayoutRect elementRect() const override;
diff --git a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp
index 51ed74d1..1698981 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp
@@ -592,17 +592,22 @@
     // find out if this element is inside of a label element.
     // if so, it may be ignored because it's the label for a checkbox or radio button
     AXObject* controlObject = correspondingControlForLabelElement();
-    if (controlObject && !controlObject->deprecatedExposesTitleUIElement() && controlObject->isCheckboxOrRadio()) {
-        if (ignoredReasons) {
-            HTMLLabelElement* label = labelElementContainer();
-            if (label && !label->isSameNode(node())) {
-                AXObject* labelAXObject = axObjectCache().getOrCreate(label);
-                ignoredReasons->append(IgnoredReason(AXLabelContainer, labelAXObject));
-            }
+    if (controlObject && controlObject->isCheckboxOrRadio()) {
+        AXNameFrom controlNameFrom;
+        AXObject::AXObjectVector controlNameObjects;
+        controlObject->name(controlNameFrom, &controlNameObjects);
+        if (controlNameFrom == AXNameFromRelatedElement) {
+            if (ignoredReasons) {
+                HTMLLabelElement* label = labelElementContainer();
+                if (label && !label->isSameNode(node())) {
+                    AXObject* labelAXObject = axObjectCache().getOrCreate(label);
+                    ignoredReasons->append(IgnoredReason(AXLabelContainer, labelAXObject));
+                }
 
-            ignoredReasons->append(IgnoredReason(AXLabelFor, controlObject));
+                ignoredReasons->append(IgnoredReason(AXLabelFor, controlObject));
+            }
+            return true;
         }
-        return true;
     }
 
     if (m_layoutObject->isBR())
@@ -1088,16 +1093,6 @@
 
     LayoutBoxModelObject* cssBox = layoutBoxModelObject();
 
-    if (ariaRoleAttribute() == StaticTextRole) {
-        String staticText = text();
-        if (!staticText.length())
-            staticText = deprecatedTextUnderElement(TextUnderElementAll);
-        return staticText;
-    }
-
-    if (m_layoutObject->isText())
-        return deprecatedTextUnderElement(TextUnderElementAll);
-
     if (cssBox && cssBox->isMenuList()) {
         // LayoutMenuList will go straight to the text() of its selected item.
         // This has to be overridden in the case where the selected item has an ARIA label.
@@ -1112,9 +1107,6 @@
         return toLayoutMenuList(m_layoutObject)->text();
     }
 
-    if (m_layoutObject->isListMarker())
-        return toLayoutListMarker(m_layoutObject)->text();
-
     if (isWebArea()) {
         // FIXME: Why would a layoutObject exist when the Document isn't attached to a frame?
         if (m_layoutObject->frame())
@@ -1145,6 +1137,42 @@
     return String();
 }
 
+String AXLayoutObject::textAlternative(bool recursive, bool inAriaLabelledByTraversal, AXObjectSet& visited, AXNameFrom& nameFrom, AXRelatedObjectVector* relatedObjects, NameSources* nameSources) const
+{
+    if (m_layoutObject) {
+        String textAlternative;
+        bool foundTextAlternative = false;
+
+        if (m_layoutObject->isBR()) {
+            textAlternative = String("\n");
+            foundTextAlternative = true;
+        } else if (m_layoutObject->isText() && (!recursive || !m_layoutObject->isCounter())) {
+            LayoutText* layoutText = toLayoutText(m_layoutObject);
+            String result = layoutText->plainText();
+            if (!result.isEmpty() || layoutText->isAllCollapsibleWhitespace())
+                textAlternative = result;
+            else
+                textAlternative = layoutText->text();
+            foundTextAlternative = true;
+        } else if (m_layoutObject->isListMarker() && !recursive) {
+            textAlternative = toLayoutListMarker(m_layoutObject)->text();
+            foundTextAlternative = true;
+        }
+
+        if (foundTextAlternative) {
+            nameFrom = AXNameFromContents;
+            if (nameSources) {
+                nameSources->append(NameSource(false));
+                nameSources->last().type = nameFrom;
+                nameSources->last().text = textAlternative;
+            }
+            return textAlternative;
+        }
+    }
+
+    return AXNodeObject::textAlternative(recursive, inAriaLabelledByTraversal, visited, nameFrom, relatedObjects, nameSources);
+}
+
 //
 // ARIA attributes.
 //
@@ -1188,21 +1216,21 @@
     accessibilityChildrenFromAttribute(aria_controlsAttr, controls);
 }
 
-void AXLayoutObject::deprecatedAriaDescribedbyElements(AXObjectVector& describedby) const
+void AXLayoutObject::ariaOwnsElements(AXObjectVector& owns) const
+{
+    accessibilityChildrenFromAttribute(aria_ownsAttr, owns);
+}
+
+void AXLayoutObject::ariaDescribedbyElements(AXObjectVector& describedby) const
 {
     accessibilityChildrenFromAttribute(aria_describedbyAttr, describedby);
 }
 
-void AXLayoutObject::deprecatedAriaLabelledbyElements(AXObjectVector& labelledby) const
+void AXLayoutObject::ariaLabelledbyElements(AXObjectVector& labelledby) const
 {
     accessibilityChildrenFromAttribute(aria_labelledbyAttr, labelledby);
 }
 
-void AXLayoutObject::ariaOwnsElements(AXObjectVector& owns) const
-{
-    accessibilityChildrenFromAttribute(aria_ownsAttr, owns);
-}
-
 bool AXLayoutObject::ariaHasPopup() const
 {
     return elementAttributeValue(aria_haspopupAttr);
@@ -1350,75 +1378,6 @@
 }
 
 //
-// Accessibility Text.
-//
-
-String AXLayoutObject::deprecatedTextUnderElement(TextUnderElementMode mode) const
-{
-    if (!m_layoutObject)
-        return String();
-
-    if (m_layoutObject->isBR())
-        return String("\n");
-
-    if (m_layoutObject->isFileUploadControl())
-        return toLayoutFileUploadControl(m_layoutObject)->buttonValue();
-
-    if (m_layoutObject->isText()) {
-        LayoutText* layoutText = toLayoutText(m_layoutObject);
-        String result = layoutText->plainText();
-        if (!result.isEmpty() || layoutText->isAllCollapsibleWhitespace())
-            return result;
-        return layoutText->text();
-    }
-
-    return AXNodeObject::deprecatedTextUnderElement(mode);
-}
-
-//
-// Accessibility Text - (To be deprecated).
-//
-
-String AXLayoutObject::deprecatedHelpText() const
-{
-    if (!m_layoutObject)
-        return String();
-
-    const AtomicString& ariaHelp = getAttribute(aria_helpAttr);
-    if (!ariaHelp.isEmpty())
-        return ariaHelp;
-
-    String describedBy = ariaDescribedByAttribute();
-    if (!describedBy.isEmpty())
-        return describedBy;
-
-    String description = deprecatedAccessibilityDescription();
-    for (LayoutObject* curr = m_layoutObject; curr; curr = curr->parent()) {
-        if (curr->node() && curr->node()->isHTMLElement()) {
-            const AtomicString& summary = toElement(curr->node())->getAttribute(summaryAttr);
-            if (!summary.isEmpty())
-                return summary;
-
-            // The title attribute should be used as help text unless it is already being used as descriptive text.
-            const AtomicString& title = toElement(curr->node())->getAttribute(titleAttr);
-            if (!title.isEmpty() && description != title)
-                return title;
-        }
-
-        // Only take help text from an ancestor element if its a group or an unknown role. If help was
-        // added to those kinds of elements, it is likely it was meant for a child element.
-        AXObject* axObj = axObjectCache().getOrCreate(curr);
-        if (axObj) {
-            AccessibilityRole role = axObj->roleValue();
-            if (role != GroupRole && role != UnknownRole)
-                break;
-        }
-    }
-
-    return String();
-}
-
-//
 // Position and size.
 //
 
@@ -1535,13 +1494,17 @@
 
     // Allow the element to perform any hit-testing it might need to do to reach non-layout children.
     result = result->elementAccessibilityHitTest(point);
-
     if (result && result->accessibilityIsIgnored()) {
         // If this element is the label of a control, a hit test should return the control.
         if (result->isAXLayoutObject()) {
             AXObject* controlObject = toAXLayoutObject(result)->correspondingControlForLabelElement();
-            if (controlObject && !controlObject->deprecatedExposesTitleUIElement())
-                return controlObject;
+            if (controlObject) {
+                AXNameFrom controlNameFrom;
+                AXObject::AXObjectVector controlNameObjects;
+                controlObject->name(controlNameFrom, &controlNameObjects);
+                if (controlObject && controlNameFrom == AXNameFromRelatedElement)
+                    return controlObject;
+            }
         }
 
         result = result->parentObjectUnignored();
diff --git a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.h b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.h
index 1e1ce4a..9ac6afe 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.h
@@ -125,8 +125,8 @@
     AXObject* activeDescendant() const override;
     void ariaFlowToElements(AXObjectVector&) const override;
     void ariaControlsElements(AXObjectVector&) const override;
-    void deprecatedAriaDescribedbyElements(AXObjectVector&) const override;
-    void deprecatedAriaLabelledbyElements(AXObjectVector&) const override;
+    void ariaDescribedbyElements(AXObjectVector&) const override;
+    void ariaLabelledbyElements(AXObjectVector&) const override;
     void ariaOwnsElements(AXObjectVector&) const override;
 
     bool ariaHasPopup() const override;
@@ -144,11 +144,8 @@
     bool liveRegionAtomic() const override;
     bool liveRegionBusy() const override;
 
-    // Accessibility Text.
-    String deprecatedTextUnderElement(TextUnderElementMode) const override;
-
-    // Accessibility Text - (To be deprecated).
-    String deprecatedHelpText() const override;
+    // AX name calc.
+    String textAlternative(bool recursive, bool inAriaLabelledByTraversal, AXObjectSet& visited, AXNameFrom&, AXRelatedObjectVector*, NameSources*) const override;
 
     // Methods that retrieve or manipulate the current selection.
 
diff --git a/third_party/WebKit/Source/modules/accessibility/AXListBoxOption.cpp b/third_party/WebKit/Source/modules/accessibility/AXListBoxOption.cpp
index 89988c4..924fe9b 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXListBoxOption.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXListBoxOption.cpp
@@ -138,19 +138,30 @@
     return true;
 }
 
-String AXListBoxOption::stringValue() const
+String AXListBoxOption::textAlternative(bool recursive, bool inAriaLabelledByTraversal, AXObjectSet& visited, AXNameFrom& nameFrom, AXRelatedObjectVector* relatedObjects, NameSources* nameSources) const
 {
+    // If nameSources is non-null, relatedObjects is used in filling it in, so it must be non-null as well.
+    if (nameSources)
+        ASSERT(relatedObjects);
+
     if (!node())
         return String();
 
-    const AtomicString& ariaLabel = getAttribute(aria_labelAttr);
-    if (!ariaLabel.isNull())
-        return ariaLabel;
+    bool foundTextAlternative = false;
+    String textAlternative = ariaTextAlternative(recursive, inAriaLabelledByTraversal, visited, nameFrom, relatedObjects, nameSources, &foundTextAlternative);
+    if (foundTextAlternative && !nameSources)
+        return textAlternative;
 
-    if (isHTMLOptionElement(node()))
-        return toHTMLOptionElement(node())->displayLabel();
+    nameFrom = AXNameFromContents;
+    textAlternative = toHTMLOptionElement(node())->displayLabel();
+    if (nameSources) {
+        nameSources->append(NameSource(foundTextAlternative));
+        nameSources->last().type = nameFrom;
+        nameSources->last().text = textAlternative;
+        foundTextAlternative = true;
+    }
 
-    return String();
+    return textAlternative;
 }
 
 void AXListBoxOption::setSelected(bool selected)
diff --git a/third_party/WebKit/Source/modules/accessibility/AXListBoxOption.h b/third_party/WebKit/Source/modules/accessibility/AXListBoxOption.h
index 680455f..c8e5e8ac 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXListBoxOption.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXListBoxOption.h
@@ -54,8 +54,7 @@
     bool isSelectedOptionActive() const override;
     void setSelected(bool) override;
     bool canSetSelectedAttribute() const override;
-    String stringValue() const override;
-    String deprecatedTitle(TextUnderElementMode) const override { return String(); }
+    String textAlternative(bool recursive, bool inAriaLabelledByTraversal, AXObjectSet& visited, AXNameFrom&, AXRelatedObjectVector*, NameSources*) const override;
 
 private:
     bool canHaveChildren() const override { return false; }
diff --git a/third_party/WebKit/Source/modules/accessibility/AXMediaControls.cpp b/third_party/WebKit/Source/modules/accessibility/AXMediaControls.cpp
index 0f7f1b5..419cb11 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXMediaControls.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXMediaControls.cpp
@@ -76,17 +76,7 @@
     return mediaControlElementType(layoutObject()->node());
 }
 
-String AccessibilityMediaControl::deprecatedTitle(TextUnderElementMode mode) const
-{
-    // FIXME: the ControlsPanel container should never be visible in the
-    // accessibility hierarchy.
-    if (controlType() == MediaControlsPanel)
-        return queryString(WebLocalizedString::AXMediaDefault);
-
-    return AXLayoutObject::deprecatedTitle(mode);
-}
-
-String AccessibilityMediaControl::deprecatedAccessibilityDescription() const
+String AccessibilityMediaControl::textAlternative(bool recursive, bool inAriaLabelledByTraversal, AXObjectSet& visited, AXNameFrom& nameFrom, AXRelatedObjectVector* relatedObjects, NameSources* nameSources) const
 {
     switch (controlType()) {
     case MediaEnterFullscreenButton:
@@ -118,7 +108,7 @@
     }
 }
 
-String AccessibilityMediaControl::deprecatedHelpText() const
+String AccessibilityMediaControl::description(AXNameFrom nameFrom, AXDescriptionFrom& descriptionFrom, AXObjectVector* descriptionObjects) const
 {
     switch (controlType()) {
     case MediaEnterFullscreenButton:
@@ -196,12 +186,12 @@
     return new AXMediaControlsContainer(layoutObject, axObjectCache);
 }
 
-String AXMediaControlsContainer::deprecatedAccessibilityDescription() const
+String AXMediaControlsContainer::textAlternative(bool recursive, bool inAriaLabelledByTraversal, AXObjectSet& visited, AXNameFrom& nameFrom, AXRelatedObjectVector* relatedObjects, NameSources* nameSources) const
 {
     return queryString(isControllingVideoElement() ? WebLocalizedString::AXMediaVideoElement : WebLocalizedString::AXMediaAudioElement);
 }
 
-String AXMediaControlsContainer::deprecatedHelpText() const
+String AXMediaControlsContainer::description(AXNameFrom nameFrom, AXDescriptionFrom& descriptionFrom, AXObjectVector* descriptionObjects) const
 {
     return queryString(isControllingVideoElement() ? WebLocalizedString::AXMediaVideoElementHelp : WebLocalizedString::AXMediaAudioElementHelp);
 }
@@ -240,7 +230,7 @@
     return localizedMediaTimeDescription(toHTMLInputElement(node)->value().toFloat());
 }
 
-String AccessibilityMediaTimeline::deprecatedHelpText() const
+String AccessibilityMediaTimeline::description(AXNameFrom nameFrom, AXDescriptionFrom& descriptionFrom, AXObjectVector* descriptionObjects) const
 {
     return queryString(isControllingVideoElement() ? WebLocalizedString::AXMediaVideoSliderHelp : WebLocalizedString::AXMediaAudioSliderHelp);
 }
@@ -270,7 +260,7 @@
     return accessibilityIsIgnoredByDefault(ignoredReasons);
 }
 
-String AccessibilityMediaTimeDisplay::deprecatedAccessibilityDescription() const
+String AccessibilityMediaTimeDisplay::textAlternative(bool recursive, bool inAriaLabelledByTraversal, AXObjectSet& visited, AXNameFrom& nameFrom, AXRelatedObjectVector* relatedObjects, NameSources* nameSources) const
 {
     if (controlType() == MediaCurrentTimeDisplay)
         return queryString(WebLocalizedString::AXMediaCurrentTimeDisplay);
diff --git a/third_party/WebKit/Source/modules/accessibility/AXMediaControls.h b/third_party/WebKit/Source/modules/accessibility/AXMediaControls.h
index 6520e61..589d4a90 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXMediaControls.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXMediaControls.h
@@ -45,9 +45,8 @@
 
     AccessibilityRole roleValue() const override;
 
-    String deprecatedTitle(TextUnderElementMode) const final;
-    String deprecatedAccessibilityDescription() const override;
-    String deprecatedHelpText() const override;
+    String textAlternative(bool recursive, bool inAriaLabelledByTraversal, AXObjectSet& visited, AXNameFrom&, AXRelatedObjectVector*, NameSources*) const override;
+    String description(AXNameFrom, AXDescriptionFrom&, AXObjectVector* descriptionObjects) const override;
 
 protected:
     AccessibilityMediaControl(LayoutObject*, AXObjectCacheImpl&);
@@ -62,7 +61,7 @@
     static AXObject* create(LayoutObject*, AXObjectCacheImpl&);
     ~AccessibilityMediaTimeline() override { }
 
-    String deprecatedHelpText() const override;
+    String description(AXNameFrom, AXDescriptionFrom&, AXObjectVector* descriptionObjects) const override;
     String valueDescription() const override;
     const AtomicString& getAttribute(const QualifiedName& attribute) const;
 
@@ -79,8 +78,8 @@
 
     AccessibilityRole roleValue() const override { return ToolbarRole; }
 
-    String deprecatedHelpText() const override;
-    String deprecatedAccessibilityDescription() const override;
+    String textAlternative(bool recursive, bool inAriaLabelledByTraversal, AXObjectSet& visited, AXNameFrom&, AXRelatedObjectVector*, NameSources*) const override;
+    String description(AXNameFrom, AXDescriptionFrom&, AXObjectVector* descriptionObjects) const override;
 
 private:
     AXMediaControlsContainer(LayoutObject*, AXObjectCacheImpl&);
@@ -98,7 +97,7 @@
     AccessibilityRole roleValue() const override { return StaticTextRole; }
 
     String stringValue() const override;
-    String deprecatedAccessibilityDescription() const override;
+    String textAlternative(bool recursive, bool inAriaLabelledByTraversal, AXObjectSet& visited, AXNameFrom&, AXRelatedObjectVector*, NameSources*) const override;
 
 private:
     AccessibilityMediaTimeDisplay(LayoutObject*, AXObjectCacheImpl&);
diff --git a/third_party/WebKit/Source/modules/accessibility/AXMenuList.cpp b/third_party/WebKit/Source/modules/accessibility/AXMenuList.cpp
index e268857..fa4212ae 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXMenuList.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXMenuList.cpp
@@ -77,6 +77,11 @@
     m_childrenDirty = false;
 }
 
+bool AXMenuList::nameFromContents() const
+{
+    return false;
+}
+
 void AXMenuList::addChildren()
 {
     ASSERT(!isDetached());
diff --git a/third_party/WebKit/Source/modules/accessibility/AXMenuList.h b/third_party/WebKit/Source/modules/accessibility/AXMenuList.h
index 8b6ceac..15d99c7 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXMenuList.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXMenuList.h
@@ -41,6 +41,7 @@
     AccessibilityExpanded isExpanded() const final;
     bool press() const override;
     void clearChildren() override;
+    bool nameFromContents() const override;
 
     void didUpdateActiveOption(int optionIndex);
     void didShowPopup();
diff --git a/third_party/WebKit/Source/modules/accessibility/AXMenuListOption.cpp b/third_party/WebKit/Source/modules/accessibility/AXMenuListOption.cpp
index cf362a1..66ea97b 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXMenuListOption.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXMenuListOption.cpp
@@ -119,9 +119,31 @@
     return grandparent->elementRect();
 }
 
-String AXMenuListOption::stringValue() const
+String AXMenuListOption::textAlternative(bool recursive, bool inAriaLabelledByTraversal, AXObjectSet& visited, AXNameFrom& nameFrom, AXRelatedObjectVector* relatedObjects, NameSources* nameSources) const
 {
-    return m_element ? m_element->displayLabel() : String();
+    // If nameSources is non-null, relatedObjects is used in filling it in, so it must be non-null as well.
+    if (nameSources)
+        ASSERT(relatedObjects);
+
+    if (!node())
+        return String();
+
+    bool foundTextAlternative = false;
+    String textAlternative = ariaTextAlternative(recursive, inAriaLabelledByTraversal, visited, nameFrom, relatedObjects, nameSources, &foundTextAlternative);
+    if (foundTextAlternative && !nameSources)
+        return textAlternative;
+
+    nameFrom = AXNameFromContents;
+    textAlternative = m_element->displayLabel();
+    if (nameSources) {
+        nameSources->append(NameSource(foundTextAlternative));
+        nameSources->last().type = nameFrom;
+        nameSources->last().text = textAlternative;
+        foundTextAlternative = true;
+    }
+
+    return textAlternative;
+
 }
 
 DEFINE_TRACE(AXMenuListOption)
diff --git a/third_party/WebKit/Source/modules/accessibility/AXMenuListOption.h b/third_party/WebKit/Source/modules/accessibility/AXMenuListOption.h
index de15b5b..52f585ee 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXMenuListOption.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXMenuListOption.h
@@ -58,7 +58,7 @@
     void setSelected(bool) override;
     bool canSetSelectedAttribute() const override;
     LayoutRect elementRect() const override;
-    String stringValue() const override;
+    String textAlternative(bool recursive, bool inAriaLabelledByTraversal, AXObjectSet& visited, AXNameFrom&, AXRelatedObjectVector*, NameSources*) const override;
     bool computeAccessibilityIsIgnored(IgnoredReasons* = nullptr) const override;
 
     RawPtrWillBeMember<HTMLOptionElement> m_element;
diff --git a/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp b/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp
index f5a7b28..001fcef 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp
@@ -156,15 +156,6 @@
     return String();
 }
 
-
-void AXNodeObject::ariaLabelledbyElements(WillBeHeapVector<RawPtrWillBeMember<Element>>& elements) const
-{
-    // Try both spellings, but prefer aria-labelledby, which is the official spec.
-    elementsFromAttribute(elements, aria_labelledbyAttr);
-    if (!elements.size())
-        elementsFromAttribute(elements, aria_labeledbyAttr);
-}
-
 bool AXNodeObject::computeAccessibilityIsIgnored(IgnoredReasons* ignoredReasons) const
 {
 #if ENABLE(ASSERT)
@@ -180,19 +171,24 @@
         return true;
     }
 
-    // Ignore labels that are already referenced by a control's title UI element.
+    // Ignore labels that are already referenced by a control.
     AXObject* controlObject = correspondingControlForLabelElement();
-    if (controlObject && !controlObject->deprecatedExposesTitleUIElement() && controlObject->isCheckboxOrRadio()) {
-        if (ignoredReasons) {
-            HTMLLabelElement* label = labelElementContainer();
-            if (label && !label->isSameNode(node())) {
-                AXObject* labelAXObject = axObjectCache().getOrCreate(label);
-                ignoredReasons->append(IgnoredReason(AXLabelContainer, labelAXObject));
-            }
+    if (controlObject && controlObject->isCheckboxOrRadio()) {
+        AXNameFrom controlNameFrom;
+        AXObject::AXObjectVector controlNameObjects;
+        controlObject->name(controlNameFrom, &controlNameObjects);
+        if (controlNameFrom == AXNameFromRelatedElement) {
+            if (ignoredReasons) {
+                HTMLLabelElement* label = labelElementContainer();
+                if (label && !label->isSameNode(node())) {
+                    AXObject* labelAXObject = axObjectCache().getOrCreate(label);
+                    ignoredReasons->append(IgnoredReason(AXLabelContainer, labelAXObject));
+                }
 
-            ignoredReasons->append(IgnoredReason(AXLabelFor, controlObject));
+                ignoredReasons->append(IgnoredReason(AXLabelFor, controlObject));
+            }
+            return true;
         }
-        return true;
     }
 
     Element* element = node()->isElementNode() ? toElement(node()) : node()->parentElement();
@@ -552,34 +548,6 @@
     return UnknownRole;
 }
 
-void AXNodeObject::tokenVectorFromAttribute(Vector<String>& tokens, const QualifiedName& attribute) const
-{
-    Node* node = this->node();
-    if (!node || !node->isElementNode())
-        return;
-
-    String attributeValue = getAttribute(attribute).string();
-    if (attributeValue.isEmpty())
-        return;
-
-    attributeValue.simplifyWhiteSpace();
-    attributeValue.split(' ', tokens);
-}
-
-void AXNodeObject::elementsFromAttribute(WillBeHeapVector<RawPtrWillBeMember<Element>>& elements, const QualifiedName& attribute) const
-{
-    Vector<String> ids;
-    tokenVectorFromAttribute(ids, attribute);
-    if (ids.isEmpty())
-        return;
-
-    TreeScope& scope = node()->treeScope();
-    for (const auto& id : ids) {
-        if (Element* idElement = scope.getElementById(AtomicString(id)))
-            elements.append(idElement);
-    }
-}
-
 void AXNodeObject::accessibilityChildrenFromAttribute(QualifiedName attr, AXObject::AXObjectVector& children) const
 {
     WillBeHeapVector<RawPtrWillBeMember<Element>> elements;
@@ -1139,33 +1107,6 @@
     return ElementTraversal::firstChild(*node);
 }
 
-bool AXNodeObject::deprecatedExposesTitleUIElement() const
-{
-    if (!isControl())
-        return false;
-
-    // If this control is ignored (because it's invisible),
-    // then the label needs to be exposed so it can be visible to accessibility.
-    if (accessibilityIsIgnored())
-        return true;
-
-    // ARIA: section 2A, bullet #3 says if aria-labelledby or aria-label appears, it should
-    // override the "label" element association.
-    bool hasTextAlternative = (!ariaLabelledbyAttribute().isEmpty() || !getAttribute(aria_labelAttr).isEmpty());
-
-    // Checkboxes and radio buttons use the text of their title ui element as their own AXTitle.
-    // This code controls whether the title ui element should appear in the AX tree (usually, no).
-    // It should appear if the control already has a label (which will be used as the AXTitle instead).
-    if (isCheckboxOrRadio())
-        return hasTextAlternative;
-
-    // When controls have their own descriptions, the title element should be ignored.
-    if (hasTextAlternative)
-        return false;
-
-    return true;
-}
-
 int AXNodeObject::headingLevel() const
 {
     // headings can be in block flow and non-block flow
@@ -1246,21 +1187,6 @@
     return String();
 }
 
-String AXNodeObject::deprecatedPlaceholder() const
-{
-    String placeholder;
-    if (node()) {
-        if (isHTMLInputElement(*node())) {
-            HTMLInputElement* inputElement = toHTMLInputElement(node());
-            placeholder = inputElement->strippedPlaceholder();
-        } else if (isHTMLTextAreaElement(*node())) {
-            HTMLTextAreaElement* textAreaElement = toHTMLTextAreaElement(node());
-            placeholder = textAreaElement->strippedPlaceholder();
-        }
-    }
-    return placeholder;
-}
-
 AccessibilityOrientation AXNodeObject::orientation() const
 {
     const AtomicString& ariaOrientation = getAttribute(aria_orientationAttr);
@@ -1321,21 +1247,6 @@
     return toElement(node)->innerText();
 }
 
-AXObject* AXNodeObject::deprecatedTitleUIElement() const
-{
-    if (!node() || !node()->isElementNode())
-        return 0;
-
-    if (isFieldset())
-        return axObjectCache().getOrCreate(toHTMLFieldSetElement(node())->legend());
-
-    HTMLLabelElement* label = labelForElement(toElement(node()));
-    if (label)
-        return axObjectCache().getOrCreate(label);
-
-    return 0;
-}
-
 AccessibilityButtonState AXNodeObject::checkboxOrRadioValue() const
 {
     if (isNativeCheckboxOrRadio())
@@ -1490,25 +1401,6 @@
     if (!node)
         return String();
 
-    if (ariaRoleAttribute() == StaticTextRole) {
-        String staticText = text();
-        if (!staticText.length())
-            staticText = deprecatedTextUnderElement(TextUnderElementAll);
-        return staticText;
-    }
-
-    if (node->isTextNode())
-        return deprecatedTextUnderElement(TextUnderElementAll);
-
-    return stringValueOfControl();
-}
-
-String AXNodeObject::stringValueOfControl() const
-{
-    Node* node = this->node();
-    if (!node)
-        return String();
-
     if (isHTMLSelectElement(*node)) {
         HTMLSelectElement& selectElement = toHTMLSelectElement(*node);
         int selectedIndex = selectElement.selectedIndex();
@@ -1549,7 +1441,7 @@
 String AXNodeObject::ariaLabelledbyAttribute() const
 {
     WillBeHeapVector<RawPtrWillBeMember<Element>> elements;
-    ariaLabelledbyElements(elements);
+    ariaLabelledbyElementVector(elements);
 
     return accessibilityDescriptionForElements(elements);
 }
@@ -1559,47 +1451,6 @@
     return m_ariaRole;
 }
 
-// When building the textUnderElement for an object, determine whether or not
-// we should include the inner text of this given descendant object or skip it.
-static bool shouldUseAccessibilityObjectInnerText(AXObject* obj)
-{
-    // Consider this hypothetical example:
-    // <div tabindex=0>
-    //   <h2>
-    //     Table of contents
-    //   </h2>
-    //   <a href="#start">Jump to start of book</a>
-    //   <ul>
-    //     <li><a href="#1">Chapter 1</a></li>
-    //     <li><a href="#1">Chapter 2</a></li>
-    //   </ul>
-    // </div>
-    //
-    // The goal is to return a reasonable title for the outer container div, because
-    // it's focusable - but without making its title be the full inner text, which is
-    // quite long. As a heuristic, skip links, controls, and elements that are usually
-    // containers with lots of children.
-
-    // Skip hidden children
-    if (obj->isInertOrAriaHidden())
-        return false;
-
-    // If something doesn't expose any children, then we can always take the inner text content.
-    // This is what we want when someone puts an <a> inside a <button> for example.
-    if (obj->isDescendantOfLeafNode())
-        return true;
-
-    // Skip focusable children, so we don't include the text of links and controls.
-    if (obj->canSetFocusAttribute())
-        return false;
-
-    // Skip big container elements like lists, tables, etc.
-    if (obj->isList() || obj->isAXTable() || obj->isTree() || obj->isCanvas())
-        return false;
-
-    return true;
-}
-
 // Returns the nearest LayoutBlockFlow ancestor which does not have an
 // inlineBoxWrapper - i.e. is not itself an inline object.
 static LayoutBlockFlow* nonInlineBlockFlow(LayoutObject* object)
@@ -1631,49 +1482,6 @@
     return b1 && b2 && b1 == b2;
 }
 
-String AXNodeObject::deprecatedTextUnderElement(TextUnderElementMode mode) const
-{
-    Node* node = this->node();
-    if (node && node->isTextNode())
-        return toText(node)->wholeText();
-
-    StringBuilder builder;
-    AXObject* previous = nullptr;
-    for (AXObject* child = firstChild(); child; child = child->nextSibling()) {
-        if (!shouldUseAccessibilityObjectInnerText(child))
-            continue;
-
-        if (child->isAXNodeObject()) {
-            HeapVector<Member<AccessibilityText>> textOrder;
-            toAXNodeObject(child)->deprecatedAlternativeText(textOrder);
-            if (textOrder.size() > 0) {
-                builder.append(textOrder[0]->text());
-                if (mode == TextUnderElementAny)
-                    break;
-                continue;
-            }
-        }
-
-        // If we're going between two layoutObjects that are in separate LayoutBoxes, add
-        // whitespace if it wasn't there already. Intuitively if you have
-        // <span>Hello</span><span>World</span>, those are part of the same LayoutBox
-        // so we should return "HelloWorld", but given <div>Hello</div><div>World</div> the
-        // strings are in separate boxes so we should return "Hello World".
-        if (previous && builder.length() && !isHTMLSpace(builder[builder.length() - 1])) {
-            if (!isInSameNonInlineBlockFlow(child->layoutObject(), previous->layoutObject()))
-                builder.append(' ');
-        }
-
-        builder.append(child->deprecatedTextUnderElement(mode));
-        previous = child;
-
-        if (mode == TextUnderElementAny && !builder.isEmpty())
-            break;
-    }
-
-    return builder.toString();
-}
-
 AXObject* AXNodeObject::findChildWithTagName(const HTMLQualifiedName& tagName) const
 {
     for (AXObject* child = firstChild(); child; child = child->nextSibling()) {
@@ -1684,177 +1492,6 @@
     return 0;
 }
 
-String AXNodeObject::deprecatedAccessibilityDescription() const
-{
-    // Static text should not have a description, it should only have a stringValue.
-    if (roleValue() == StaticTextRole)
-        return String();
-
-    String ariaDescription = ariaAccessibilityDescription();
-    if (!ariaDescription.isEmpty())
-        return ariaDescription;
-
-    if (isImage() || isInputImage() || isNativeImage() || isCanvas()) {
-        // Images should use alt as long as the attribute is present, even if empty.
-        // Otherwise, it should fallback to other methods, like the title attribute.
-        const AtomicString& alt = getAttribute(altAttr);
-        if (!alt.isNull())
-            return alt;
-    }
-
-    // An element's descriptive text is comprised of deprecatedTitle() (what's visible on the screen) and deprecatedAccessibilityDescription() (other descriptive text).
-    // Both are used to generate what a screen reader speaks.
-    // If this point is reached (i.e. there's no accessibilityDescription) and there's no deprecatedTitle(), we should fallback to using the title attribute.
-    // The title attribute is normally used as help text (because it is a tooltip), but if there is nothing else available, this should be used (according to ARIA).
-    if (deprecatedTitle(TextUnderElementAny).isEmpty())
-        return getAttribute(titleAttr);
-
-    if (roleValue() == FigureRole) {
-        AXObject* figcaption = findChildWithTagName(figcaptionTag);
-        if (figcaption)
-            return figcaption->deprecatedAccessibilityDescription();
-    }
-
-    return String();
-}
-
-String AXNodeObject::deprecatedTitle(TextUnderElementMode mode) const
-{
-    Node* node = this->node();
-    if (!node)
-        return String();
-
-    bool isInputElement = isHTMLInputElement(*node);
-    if (isInputElement) {
-        HTMLInputElement& input = toHTMLInputElement(*node);
-        if (input.isTextButton())
-            return input.valueWithDefault();
-    }
-
-    if (isInputElement || AXObject::isARIAInput(ariaRoleAttribute()) || isControl()) {
-        HTMLLabelElement* label = labelForElement(toElement(node));
-        if (label && !deprecatedExposesTitleUIElement())
-            return label->innerText();
-    }
-
-    // If this node isn't laid out, there's no inner text we can extract from a select element.
-    if (!isAXLayoutObject() && isHTMLSelectElement(*node))
-        return String();
-
-    switch (roleValue()) {
-    case PopUpButtonRole:
-        // Native popup buttons should not use their button children's text as a title. That value is retrieved through stringValue().
-        if (isHTMLSelectElement(*node))
-            return String();
-    case ButtonRole:
-    case ToggleButtonRole:
-    case CheckBoxRole:
-    case LineBreakRole:
-    case ListBoxOptionRole:
-    case ListItemRole:
-    case MenuButtonRole:
-    case MenuItemRole:
-    case MenuItemCheckBoxRole:
-    case MenuItemRadioRole:
-    case RadioButtonRole:
-    case SwitchRole:
-    case TabRole:
-        return deprecatedTextUnderElement(mode);
-    // SVGRoots should not use the text under itself as a title. That could include the text of objects like <text>.
-    case SVGRootRole:
-        return String();
-    case FigureRole: {
-        AXObject* figcaption = findChildWithTagName(figcaptionTag);
-        if (figcaption)
-            return figcaption->deprecatedTextUnderElement();
-    }
-    default:
-        break;
-    }
-
-    if (isHeading() || isLink())
-        return deprecatedTextUnderElement(mode);
-
-    // If it's focusable but it's not content editable or a known control type, then it will appear to
-    // the user as a single atomic object, so we should use its text as the default title.
-    if (isGenericFocusableElement())
-        return deprecatedTextUnderElement(mode);
-
-    return String();
-}
-
-String AXNodeObject::deprecatedHelpText() const
-{
-    Node* node = this->node();
-    if (!node)
-        return String();
-
-    const AtomicString& ariaHelp = getAttribute(aria_helpAttr);
-    if (!ariaHelp.isEmpty())
-        return ariaHelp;
-
-    String describedBy = ariaDescribedByAttribute();
-    if (!describedBy.isEmpty())
-        return describedBy;
-
-    String description = deprecatedAccessibilityDescription();
-    for (Node* curr = node; curr; curr = curr->parentNode()) {
-        if (curr->isHTMLElement()) {
-            const AtomicString& summary = toElement(curr)->getAttribute(summaryAttr);
-            if (!summary.isEmpty())
-                return summary;
-
-            // The title attribute should be used as help text unless it is already being used as descriptive text.
-            const AtomicString& title = toElement(curr)->getAttribute(titleAttr);
-            if (!title.isEmpty() && description != title)
-                return title;
-        }
-
-        // Only take help text from an ancestor element if its a group or an unknown role. If help was
-        // added to those kinds of elements, it is likely it was meant for a child element.
-        AXObject* axObj = axObjectCache().getOrCreate(curr);
-        if (axObj) {
-            AccessibilityRole role = axObj->roleValue();
-            if (role != GroupRole && role != UnknownRole)
-                break;
-        }
-    }
-
-    return String();
-}
-
-String AXNodeObject::computedName() const
-{
-    String title = this->deprecatedTitle(TextUnderElementAll);
-
-    String titleUIText;
-    if (title.isEmpty()) {
-        AXObject* titleUIElement = this->deprecatedTitleUIElement();
-        if (titleUIElement) {
-            titleUIText = titleUIElement->deprecatedTextUnderElement();
-            if (!titleUIText.isEmpty())
-                return titleUIText;
-        }
-    }
-
-    String description = deprecatedAccessibilityDescription();
-    if (!description.isEmpty())
-        return description;
-
-    if (!title.isEmpty())
-        return title;
-
-    String placeholder;
-    if (isHTMLInputElement(node())) {
-        HTMLInputElement* element = toHTMLInputElement(node());
-        placeholder = element->strippedPlaceholder();
-        if (!placeholder.isEmpty())
-            return placeholder;
-    }
-
-    return String();
-}
-
 //
 // New AX name calculation.
 //
@@ -1865,76 +1502,18 @@
     if (nameSources)
         ASSERT(relatedObjects);
 
-    bool alreadyVisited = visited.contains(this);
     bool foundTextAlternative = false;
-    visited.add(this);
-    String textAlternative;
 
     if (!node() && !layoutObject())
         return String();
 
-    // Step 2A from: http://www.w3.org/TR/accname-aam-1.1
-    if (!recursive && layoutObject()
-        && layoutObject()->style()->visibility() != VISIBLE
-        && !equalIgnoringCase(getAttribute(aria_hiddenAttr), "false")) {
-        return String();
-    }
-
-    // Step 2B from: http://www.w3.org/TR/accname-aam-1.1
-    if (!inAriaLabelledByTraversal && !alreadyVisited) {
-        const QualifiedName& attr = hasAttribute(aria_labeledbyAttr) && !hasAttribute(aria_labelledbyAttr) ? aria_labeledbyAttr : aria_labelledbyAttr;
-        nameFrom = AXNameFromRelatedElement;
-        if (nameSources) {
-            nameSources->append(NameSource(foundTextAlternative, attr));
-            nameSources->last().type = nameFrom;
-        }
-
-        const AtomicString& ariaLabelledby = getAttribute(attr);
-        if (!ariaLabelledby.isNull()) {
-            if (nameSources)
-                nameSources->last().attributeValue = ariaLabelledby;
-
-            textAlternative = textFromAriaLabelledby(visited, relatedObjects);
-
-            if (!textAlternative.isNull()) {
-                if (nameSources) {
-                    NameSource& source = nameSources->last();
-                    source.type = nameFrom;
-                    source.relatedObjects = *relatedObjects;
-                    source.text = textAlternative;
-                    foundTextAlternative = true;
-                } else {
-                    return textAlternative;
-                }
-            } else if (nameSources) {
-                nameSources->last().invalid = true;
-            }
-        }
-    }
-
-    // Step 2C from: http://www.w3.org/TR/accname-aam-1.1
-    nameFrom = AXNameFromAttribute;
-    if (nameSources) {
-        nameSources->append(NameSource(foundTextAlternative, aria_labelAttr));
-        nameSources->last().type = nameFrom;
-    }
-    const AtomicString& ariaLabel = getAttribute(aria_labelAttr);
-    if (!ariaLabel.isEmpty()) {
-        textAlternative = ariaLabel;
-
-        if (nameSources) {
-            NameSource& source = nameSources->last();
-            source.text = textAlternative;
-            source.attributeValue = ariaLabel;
-            foundTextAlternative = true;
-        } else {
-            return textAlternative;
-        }
-    }
+    String textAlternative = ariaTextAlternative(recursive, inAriaLabelledByTraversal, visited, nameFrom, relatedObjects, nameSources, &foundTextAlternative);
+    if (foundTextAlternative && !nameSources)
+        return textAlternative;
 
     // Step 2D from: http://www.w3.org/TR/accname-aam-1.1
     textAlternative = nativeTextAlternative(visited, nameFrom, relatedObjects, nameSources, &foundTextAlternative);
-    if (!textAlternative.isNull() && !nameSources)
+    if (!textAlternative.isEmpty() && !nameSources)
         return textAlternative;
 
     // Step 2E from: http://www.w3.org/TR/accname-aam-1.1
@@ -1947,7 +1526,7 @@
             return String::number(valueForRange());
         }
 
-        return stringValueOfControl();
+        return stringValue();
     }
 
     // Step 2F / 2G from: http://www.w3.org/TR/accname-aam-1.1
@@ -2037,48 +1616,6 @@
     return accumulatedText.toString();
 }
 
-String AXNodeObject::textFromElements(bool inAriaLabelledbyTraversal, AXObjectSet& visited, WillBeHeapVector<RawPtrWillBeMember<Element>>& elements, AXRelatedObjectVector* relatedObjects) const
-{
-    StringBuilder accumulatedText;
-    bool foundValidElement = false;
-    AXRelatedObjectVector localRelatedObjects;
-
-    for (const auto& element : elements) {
-        AXObject* axElement = axObjectCache().getOrCreate(element);
-        if (axElement) {
-            foundValidElement = true;
-
-            String result = recursiveTextAlternative(*axElement, inAriaLabelledbyTraversal, visited);
-            localRelatedObjects.append(new NameSourceRelatedObject(axElement, result));
-            if (!result.isEmpty()) {
-                if (!accumulatedText.isEmpty())
-                    accumulatedText.append(" ");
-                accumulatedText.append(result);
-            }
-        }
-    }
-    if (!foundValidElement)
-        return String();
-    if (relatedObjects)
-        *relatedObjects = localRelatedObjects;
-    return accumulatedText.toString();
-}
-
-String AXNodeObject::textFromAriaLabelledby(AXObjectSet& visited, AXRelatedObjectVector* relatedObjects) const
-{
-    WillBeHeapVector<RawPtrWillBeMember<Element>> elements;
-    ariaLabelledbyElements(elements);
-    return textFromElements(true, visited, elements, relatedObjects);
-}
-
-String AXNodeObject::textFromAriaDescribedby(AXRelatedObjectVector* relatedObjects) const
-{
-    AXObjectSet visited;
-    WillBeHeapVector<RawPtrWillBeMember<Element>> elements;
-    elementsFromAttribute(elements, aria_describedbyAttr);
-    return textFromElements(true, visited, elements, relatedObjects);
-}
-
 LayoutRect AXNodeObject::elementRect() const
 {
     // First check if it has a custom rect, for example if this element is tied to a canvas path.
@@ -2510,86 +2047,6 @@
     axObjectCache().updateAriaOwns(this, idVector, ownedChildren);
 }
 
-String AXNodeObject::deprecatedAlternativeTextForWebArea() const
-{
-    // The WebArea description should follow this order:
-    //     aria-label on the <html>
-    //     title on the <html>
-    //     <title> inside the <head> (of it was set through JS)
-    //     name on the <html>
-    // For iframes:
-    //     aria-label on the <iframe>
-    //     title on the <iframe>
-    //     name on the <iframe>
-
-    Document* document = this->document();
-    if (!document)
-        return String();
-
-    // Check if the HTML element has an aria-label for the webpage.
-    if (Element* documentElement = document->documentElement()) {
-        const AtomicString& ariaLabel = documentElement->getAttribute(aria_labelAttr);
-        if (!ariaLabel.isEmpty())
-            return ariaLabel;
-    }
-
-    if (HTMLFrameOwnerElement* owner = document->ownerElement()) {
-        if (isHTMLFrameElementBase(*owner)) {
-            const AtomicString& title = owner->getAttribute(titleAttr);
-            if (!title.isEmpty())
-                return title;
-        }
-        return owner->getNameAttribute();
-    }
-
-    String documentTitle = document->title();
-    if (!documentTitle.isEmpty())
-        return documentTitle;
-
-    if (HTMLElement* body = document->body())
-        return body->getNameAttribute();
-
-    return String();
-}
-
-void AXNodeObject::deprecatedAlternativeText(HeapVector<Member<AccessibilityText>>& textOrder) const
-{
-    if (isWebArea()) {
-        String webAreaText = deprecatedAlternativeTextForWebArea();
-        if (!webAreaText.isEmpty())
-            textOrder.append(AccessibilityText::create(webAreaText, AlternativeText));
-        return;
-    }
-
-    deprecatedAriaLabelledbyText(textOrder);
-
-    const AtomicString& ariaLabel = getAttribute(aria_labelAttr);
-    if (!ariaLabel.isEmpty())
-        textOrder.append(AccessibilityText::create(ariaLabel, AlternativeText));
-
-    if (isImage() || isInputImage() || isNativeImage() || isCanvas()) {
-        // Images should use alt as long as the attribute is present, even if empty.
-        // Otherwise, it should fallback to other methods, like the title attribute.
-        const AtomicString& alt = getAttribute(altAttr);
-        if (!alt.isNull())
-            textOrder.append(AccessibilityText::create(alt, AlternativeText));
-    }
-}
-
-void AXNodeObject::deprecatedAriaLabelledbyText(HeapVector<Member<AccessibilityText>>& textOrder) const
-{
-    String ariaLabelledby = ariaLabelledbyAttribute();
-    if (!ariaLabelledby.isEmpty()) {
-        WillBeHeapVector<RawPtrWillBeMember<Element>> elements;
-        ariaLabelledbyElements(elements);
-
-        for (const auto& element : elements) {
-            AXObject* axElement = axObjectCache().getOrCreate(element);
-            textOrder.append(AccessibilityText::create(ariaLabelledby, AlternativeText, axElement));
-        }
-    }
-}
-
 // Based on http://rawgit.com/w3c/aria/master/html-aam/html-aam.html#accessible-name-and-description-calculation
 String AXNodeObject::nativeTextAlternative(AXObjectSet& visited, AXNameFrom& nameFrom, AXRelatedObjectVector* relatedObjects, NameSources* nameSources, bool* foundTextAlternative) const
 {
@@ -2710,7 +2167,7 @@
         }
 
         // localised default value ("Submit")
-        nameFrom = AXNameFromAttribute;
+        nameFrom = AXNameFromValue;
         textAlternative = inputElement->locale().queryString(WebLocalizedString::SubmitButtonDefaultLabel);
         if (nameSources) {
             nameSources->append(NameSource(*foundTextAlternative, typeAttr));
@@ -2899,6 +2356,61 @@
         }
     }
 
+    // Document.
+    if (isWebArea()) {
+        Document* document = this->document();
+        if (document) {
+            nameFrom = AXNameFromAttribute;
+            if (nameSources) {
+                nameSources->append(NameSource(foundTextAlternative, aria_labelAttr));
+                nameSources->last().type = nameFrom;
+            }
+            if (Element* documentElement = document->documentElement()) {
+                const AtomicString& ariaLabel = documentElement->getAttribute(aria_labelAttr);
+                if (!ariaLabel.isEmpty()) {
+                    textAlternative = ariaLabel;
+
+                    if (nameSources) {
+                        NameSource& source = nameSources->last();
+                        source.text = textAlternative;
+                        source.attributeValue = ariaLabel;
+                        *foundTextAlternative = true;
+                    } else {
+                        return textAlternative;
+                    }
+                }
+            }
+
+            nameFrom = AXNameFromRelatedElement;
+            if (nameSources) {
+                nameSources->append(NameSource(*foundTextAlternative));
+                nameSources->last().type = nameFrom;
+                nameSources->last().nativeSource = AXTextFromNativeHTMLTitleElement;
+            }
+
+            textAlternative = document->title();
+
+            Element* titleElement = document->titleElement();
+            AXObject* titleAXObject = axObjectCache().getOrCreate(titleElement);
+            if (titleAXObject) {
+                if (relatedObjects) {
+                    localRelatedObjects.append(new NameSourceRelatedObject(titleAXObject, textAlternative));
+                    *relatedObjects = localRelatedObjects;
+                    localRelatedObjects.clear();
+                }
+
+                if (nameSources) {
+                    NameSource& source = nameSources->last();
+                    source.relatedObjects = *relatedObjects;
+                    source.text = textAlternative;
+                    *foundTextAlternative = true;
+                } else {
+                    return textAlternative;
+                }
+            }
+        }
+    }
+
     return textAlternative;
 }
 
@@ -3113,6 +2625,28 @@
     return String();
 }
 
+String AXNodeObject::placeholder(AXNameFrom nameFrom, AXDescriptionFrom descriptionFrom) const
+{
+    if (nameFrom == AXNameFromPlaceholder)
+        return String();
+
+    if (descriptionFrom == AXDescriptionFromPlaceholder)
+        return String();
+
+    if (!node())
+        return String();
+
+    String placeholder;
+    if (isHTMLInputElement(*node())) {
+        HTMLInputElement* inputElement = toHTMLInputElement(node());
+        placeholder = inputElement->strippedPlaceholder();
+    } else if (isHTMLTextAreaElement(*node())) {
+        HTMLTextAreaElement* textAreaElement = toHTMLTextAreaElement(node());
+        placeholder = textAreaElement->strippedPlaceholder();
+    }
+    return placeholder;
+}
+
 DEFINE_TRACE(AXNodeObject)
 {
     visitor->trace(m_node);
diff --git a/third_party/WebKit/Source/modules/accessibility/AXNodeObject.h b/third_party/WebKit/Source/modules/accessibility/AXNodeObject.h
index 0061dbb9..e9c54f5 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXNodeObject.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXNodeObject.h
@@ -66,10 +66,7 @@
     void alterSliderValue(bool increase);
     String ariaAccessibilityDescription() const;
     String ariaAutoComplete() const;
-    void ariaLabelledbyElements(WillBeHeapVector<RawPtrWillBeMember<Element>>& elements) const;
     AccessibilityRole determineAriaRoleAttribute() const;
-    void tokenVectorFromAttribute(Vector<String>&, const QualifiedName&) const;
-    void elementsFromAttribute(WillBeHeapVector<RawPtrWillBeMember<Element>>& elements, const QualifiedName&) const;
     void accessibilityChildrenFromAttribute(QualifiedName attr, AXObject::AXObjectVector&) const;
 
     bool hasContentEditableAttributeSet() const;
@@ -80,7 +77,6 @@
     AXObject* menuButtonForMenu() const;
     Element* menuItemElementForMenu() const;
     Element* mouseButtonListener() const;
-    String deprecatedPlaceholder() const;
     AccessibilityRole remapAriaRoleDueToParent(AccessibilityRole) const;
     bool isNativeCheckboxOrRadio() const;
     void setNode(Node*);
@@ -139,12 +135,10 @@
     // Properties of static elements.
     RGBA32 colorValue() const final;
     bool canvasHasFallbackContent() const final;
-    bool deprecatedExposesTitleUIElement() const override;
     int headingLevel() const final;
     unsigned hierarchicalLevel() const final;
     AccessibilityOrientation orientation() const override;
     String text() const override;
-    AXObject* deprecatedTitleUIElement() const override;
 
     // Properties of interactive elements.
     AccessibilityButtonState checkboxOrRadioValue() const final;
@@ -162,17 +156,11 @@
     String ariaLabelledbyAttribute() const final;
     AccessibilityRole ariaRoleAttribute() const final;
 
-    // Accessibility Text.
-    String deprecatedTextUnderElement(TextUnderElementMode) const override;
-    String deprecatedAccessibilityDescription() const override;
-    String deprecatedTitle(TextUnderElementMode) const override;
-    String deprecatedHelpText() const override;
-    String computedName() const override;
-
-    // New AX name calculation.
+    // AX name calculation.
     String textAlternative(bool recursive, bool inAriaLabelledByTraversal, AXObjectSet& visited, AXNameFrom&, AXRelatedObjectVector*, NameSources*) const override;
     String description(AXNameFrom, AXDescriptionFrom&, AXObjectVector* descriptionObjects) const override;
     String description(AXNameFrom, AXDescriptionFrom&, DescriptionSources*, AXRelatedObjectVector*) const override;
+    String placeholder(AXNameFrom, AXDescriptionFrom) const override;
 
     // Location and click point in frame-relative coordinates.
     LayoutRect elementRect() const override;
@@ -216,19 +204,11 @@
 private:
     RawPtrWillBeMember<Node> m_node;
 
-    String deprecatedAlternativeTextForWebArea() const;
-    void deprecatedAlternativeText(HeapVector<Member<AccessibilityText>>&) const;
-    void deprecatedAriaLabelledbyText(HeapVector<Member<AccessibilityText>>&) const;
-
     String textFromDescendants(AXObjectSet& visited) const;
-    String textFromElements(bool inAriaLabelledByTraversal, AXObjectSet& visited, WillBeHeapVector<RawPtrWillBeMember<Element>>& elements, AXRelatedObjectVector* relatedObjects) const;
-    String textFromAriaLabelledby(AXObjectSet& visited, AXRelatedObjectVector* relatedObjects) const;
-    String textFromAriaDescribedby(AXRelatedObjectVector* relatedObjects) const;
     String nativeTextAlternative(AXObjectSet& visited, AXNameFrom&, AXRelatedObjectVector*, NameSources*, bool* foundTextAlternative) const;
     float stepValueForRange() const;
     AXObject* findChildWithTagName(const HTMLQualifiedName&) const;
     bool isDescendantOfElementType(const HTMLQualifiedName& tagName) const;
-    String stringValueOfControl() const;
 };
 
 DEFINE_AX_OBJECT_TYPE_CASTS(AXNodeObject, isAXNodeObject());
diff --git a/third_party/WebKit/Source/modules/accessibility/AXObject.cpp b/third_party/WebKit/Source/modules/accessibility/AXObject.cpp
index a42851d..5dd1f4cd 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXObject.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXObject.cpp
@@ -676,6 +676,13 @@
     return m_cachedIsPresentationalChild;
 }
 
+String AXObject::computedName() const
+{
+    AXNameFrom nameFrom;
+    AXObject::AXObjectVector nameObjects;
+    return name(nameFrom, &nameObjects);
+}
+
 String AXObject::name(AXNameFrom& nameFrom, AXObject::AXObjectVector* nameObjects) const
 {
     HeapHashSet<Member<const AXObject>> visited;
@@ -683,7 +690,7 @@
     String text = textAlternative(false, false, visited, nameFrom, &relatedObjects, nullptr);
 
     if (!node() || !isHTMLBRElement(node()))
-        text = text.simplifyWhiteSpace(isHTMLSpace<UChar>);
+        text = text.simplifyWhiteSpace(isHTMLSpace<UChar>, WTF::DoNotStripWhiteSpace);
 
     if (nameObjects) {
         nameObjects->clear();
@@ -709,6 +716,154 @@
     return axObj.textAlternative(true, inAriaLabelledByTraversal, visited, tmpNameFrom, nullptr, nullptr);
 }
 
+String AXObject::ariaTextAlternative(bool recursive, bool inAriaLabelledByTraversal, AXObjectSet& visited, AXNameFrom& nameFrom, AXRelatedObjectVector* relatedObjects, NameSources* nameSources, bool* foundTextAlternative) const
+{
+    String textAlternative;
+    bool alreadyVisited = visited.contains(this);
+    visited.add(this);
+
+    // Step 2A from: http://www.w3.org/TR/accname-aam-1.1
+    if (!recursive && layoutObject()
+        && layoutObject()->style()->visibility() != VISIBLE
+        && !equalIgnoringCase(getAttribute(aria_hiddenAttr), "false")) {
+        return String();
+    }
+
+    // Step 2B from: http://www.w3.org/TR/accname-aam-1.1
+    if (!inAriaLabelledByTraversal && !alreadyVisited) {
+        const QualifiedName& attr = hasAttribute(aria_labeledbyAttr) && !hasAttribute(aria_labelledbyAttr) ? aria_labeledbyAttr : aria_labelledbyAttr;
+        nameFrom = AXNameFromRelatedElement;
+        if (nameSources) {
+            nameSources->append(NameSource(*foundTextAlternative, attr));
+            nameSources->last().type = nameFrom;
+        }
+
+        const AtomicString& ariaLabelledby = getAttribute(attr);
+        if (!ariaLabelledby.isNull()) {
+            if (nameSources)
+                nameSources->last().attributeValue = ariaLabelledby;
+
+            textAlternative = textFromAriaLabelledby(visited, relatedObjects);
+
+            if (!textAlternative.isNull()) {
+                if (nameSources) {
+                    NameSource& source = nameSources->last();
+                    source.type = nameFrom;
+                    source.relatedObjects = *relatedObjects;
+                    source.text = textAlternative;
+                    *foundTextAlternative = true;
+                } else {
+                    *foundTextAlternative = true;
+                    return textAlternative;
+                }
+            } else if (nameSources) {
+                nameSources->last().invalid = true;
+            }
+        }
+    }
+
+    // Step 2C from: http://www.w3.org/TR/accname-aam-1.1
+    nameFrom = AXNameFromAttribute;
+    if (nameSources) {
+        nameSources->append(NameSource(*foundTextAlternative, aria_labelAttr));
+        nameSources->last().type = nameFrom;
+    }
+    const AtomicString& ariaLabel = getAttribute(aria_labelAttr);
+    if (!ariaLabel.isEmpty()) {
+        textAlternative = ariaLabel;
+
+        if (nameSources) {
+            NameSource& source = nameSources->last();
+            source.text = textAlternative;
+            source.attributeValue = ariaLabel;
+            *foundTextAlternative = true;
+        } else {
+            *foundTextAlternative = true;
+            return textAlternative;
+        }
+    }
+
+    return textAlternative;
+}
+
+String AXObject::textFromElements(bool inAriaLabelledbyTraversal, AXObjectSet& visited, WillBeHeapVector<RawPtrWillBeMember<Element>>& elements, AXRelatedObjectVector* relatedObjects) const
+{
+    StringBuilder accumulatedText;
+    bool foundValidElement = false;
+    AXRelatedObjectVector localRelatedObjects;
+
+    for (const auto& element : elements) {
+        AXObject* axElement = axObjectCache().getOrCreate(element);
+        if (axElement) {
+            foundValidElement = true;
+
+            String result = recursiveTextAlternative(*axElement, inAriaLabelledbyTraversal, visited);
+            localRelatedObjects.append(new NameSourceRelatedObject(axElement, result));
+            if (!result.isEmpty()) {
+                if (!accumulatedText.isEmpty())
+                    accumulatedText.append(" ");
+                accumulatedText.append(result);
+            }
+        }
+    }
+    if (!foundValidElement)
+        return String();
+    if (relatedObjects)
+        *relatedObjects = localRelatedObjects;
+    return accumulatedText.toString();
+}
+
+void AXObject::tokenVectorFromAttribute(Vector<String>& tokens, const QualifiedName& attribute) const
+{
+    Node* node = this->node();
+    if (!node || !node->isElementNode())
+        return;
+
+    String attributeValue = getAttribute(attribute).string();
+    if (attributeValue.isEmpty())
+        return;
+
+    attributeValue.simplifyWhiteSpace();
+    attributeValue.split(' ', tokens);
+}
+
+void AXObject::elementsFromAttribute(WillBeHeapVector<RawPtrWillBeMember<Element>>& elements, const QualifiedName& attribute) const
+{
+    Vector<String> ids;
+    tokenVectorFromAttribute(ids, attribute);
+    if (ids.isEmpty())
+        return;
+
+    TreeScope& scope = node()->treeScope();
+    for (const auto& id : ids) {
+        if (Element* idElement = scope.getElementById(AtomicString(id)))
+            elements.append(idElement);
+    }
+}
+
+void AXObject::ariaLabelledbyElementVector(WillBeHeapVector<RawPtrWillBeMember<Element>>& elements) const
+{
+    // Try both spellings, but prefer aria-labelledby, which is the official spec.
+    elementsFromAttribute(elements, aria_labelledbyAttr);
+    if (!elements.size())
+        elementsFromAttribute(elements, aria_labeledbyAttr);
+}
+
+String AXObject::textFromAriaLabelledby(AXObjectSet& visited, AXRelatedObjectVector* relatedObjects) const
+{
+    WillBeHeapVector<RawPtrWillBeMember<Element>> elements;
+    ariaLabelledbyElementVector(elements);
+    return textFromElements(true, visited, elements, relatedObjects);
+}
+
+String AXObject::textFromAriaDescribedby(AXRelatedObjectVector* relatedObjects) const
+{
+    AXObjectSet visited;
+    WillBeHeapVector<RawPtrWillBeMember<Element>> elements;
+    elementsFromAttribute(elements, aria_describedbyAttr);
+    return textFromElements(true, visited, elements, relatedObjects);
+}
+
 AccessibilityOrientation AXObject::orientation() const
 {
     // In ARIA 1.1, the default value for aria-orientation changed from
@@ -1480,13 +1635,13 @@
     case MenuItemCheckBoxRole:
     case MenuItemRadioRole:
     case MenuListOptionRole:
+    case PopUpButtonRole:
     case RadioButtonRole:
     case StaticTextRole:
     case StatusRole:
     case SwitchRole:
     case TabRole:
     case ToggleButtonRole:
-    case TreeItemRole:
         return true;
     default:
         return false;
diff --git a/third_party/WebKit/Source/modules/accessibility/AXObject.h b/third_party/WebKit/Source/modules/accessibility/AXObject.h
index d7c86a49..431c4d3 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXObject.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXObject.h
@@ -337,6 +337,7 @@
     AXTextFromNativeHTMLLabelWrapped,
     AXTextFromNativeHTMLLegend,
     AXTextFromNativeHTMLTableCaption,
+    AXTextFromNativeHTMLTitleElement,
 };
 
 // The source of the accessible description of an element. This is needed
@@ -668,22 +669,7 @@
     bool isPresentationalChild() const;
 
     //
-    // Deprecated text alternative calculation API. All of these will be replaced
-    // with the new API, below (under "New text alternative calculation API".
-    //
-
-    virtual bool deprecatedExposesTitleUIElement() const { return true; }
-    virtual AXObject* deprecatedTitleUIElement() const { return 0; }
-    virtual String deprecatedPlaceholder() const { return String(); }
-    virtual void deprecatedAriaDescribedbyElements(AXObjectVector& describedby) const { }
-    virtual void deprecatedAriaLabelledbyElements(AXObjectVector& labelledby) const { }
-    virtual String deprecatedAccessibilityDescription() const { return String(); }
-    virtual String deprecatedTitle(TextUnderElementMode mode = TextUnderElementAll) const { return String(); }
-    virtual String deprecatedHelpText() const { return String(); }
-    virtual String deprecatedTextUnderElement(TextUnderElementMode mode = TextUnderElementAll) const { return String(); }
-
-    //
-    // New text alternative calculation API (under development).
+    // Accessible name calculation
     //
 
     // Retrieves the accessible name of the object, an enum indicating where the name
@@ -708,7 +694,7 @@
     // Takes the result of nameFrom and descriptionFrom from calling |name| and |description|,
     // above, and retrieves the placeholder of the object, if present and if it wasn't already
     // exposed by one of the two functions above.
-    virtual String placeholder(AXNameFrom, AXDescriptionFrom) { return String(); }
+    virtual String placeholder(AXNameFrom, AXDescriptionFrom) const { return String(); }
 
     // Internal function used by name and description, above.
     typedef HeapHashSet<Member<const AXObject>> AXObjectSet;
@@ -716,7 +702,7 @@
 
     // Returns result of Accessible Name Calculation algorithm.
     // This is a simpler high-level interface to |name| used by Inspector.
-    virtual String computedName() const { return String(); }
+    String computedName() const;
 
     //
     // Properties of static elements.
@@ -774,6 +760,8 @@
     virtual void ariaFlowToElements(AXObjectVector&) const { }
     virtual void ariaControlsElements(AXObjectVector&) const { }
     virtual void ariaOwnsElements(AXObjectVector& owns) const { }
+    virtual void ariaDescribedbyElements(AXObjectVector&) const { }
+    virtual void ariaLabelledbyElements(AXObjectVector&) const { }
     virtual bool ariaHasPopup() const { return false; }
     virtual bool isEditable() const { return false; }
     bool isMultiline() const;
@@ -937,12 +925,19 @@
     AXObjectInclusion m_lastKnownIsIgnoredValue;
     LayoutRect m_explicitElementRect;
 
-    // Used only in recursive calls from textAlternative()
+    // Used only inside textAlternative():
     static String recursiveTextAlternative(const AXObject&, bool inAriaLabelledByTraversal, AXObjectSet& visited);
+    String ariaTextAlternative(bool recursive, bool inAriaLabelledByTraversal, AXObjectSet& visited, AXNameFrom&, AXRelatedObjectVector*, NameSources*, bool* foundTextAlternative) const;
+    String textFromElements(bool inAriaLabelledByTraversal, AXObjectSet& visited, WillBeHeapVector<RawPtrWillBeMember<Element>>& elements, AXRelatedObjectVector* relatedObjects) const;
+    void tokenVectorFromAttribute(Vector<String>&, const QualifiedName&) const;
+    void elementsFromAttribute(WillBeHeapVector<RawPtrWillBeMember<Element>>& elements, const QualifiedName&) const;
+    void ariaLabelledbyElementVector(WillBeHeapVector<RawPtrWillBeMember<Element>>& elements) const;
+    String textFromAriaLabelledby(AXObjectSet& visited, AXRelatedObjectVector* relatedObjects) const;
+    String textFromAriaDescribedby(AXRelatedObjectVector* relatedObjects) const;
 
     virtual const AXObject* inheritsPresentationalRoleFrom() const { return 0; }
 
-    bool nameFromContents() const;
+    virtual bool nameFromContents() const;
 
     AccessibilityRole buttonRoleType() const;
 
diff --git a/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp b/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp
index c786f17c..9e66b41 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXObjectCacheImpl.cpp
@@ -1313,34 +1313,7 @@
     if (!obj)
         return "";
 
-    String title = obj->deprecatedTitle();
-
-    String titleUIText;
-    if (title.isEmpty()) {
-        AXObject* titleUIElement = obj->deprecatedTitleUIElement();
-        if (titleUIElement) {
-            titleUIText = titleUIElement->deprecatedTextUnderElement();
-            if (!titleUIText.isEmpty())
-                return titleUIText;
-        }
-    }
-
-    String description = obj->deprecatedAccessibilityDescription();
-    if (!description.isEmpty())
-        return description;
-
-    if (!title.isEmpty())
-        return title;
-
-    String placeholder;
-    if (isHTMLInputElement(node)) {
-        HTMLInputElement* element = toHTMLInputElement(node);
-        placeholder = element->strippedPlaceholder();
-        if (!placeholder.isEmpty())
-            return placeholder;
-    }
-
-    return String();
+    return obj->computedName();
 }
 
 void AXObjectCacheImpl::onTouchAccessibilityHover(const IntPoint& location)
diff --git a/third_party/WebKit/Source/modules/accessibility/AXTable.cpp b/third_party/WebKit/Source/modules/accessibility/AXTable.cpp
index f697982..0ee5f480 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXTable.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXTable.cpp
@@ -569,30 +569,6 @@
     return false;
 }
 
-String AXTable::deprecatedTitle(TextUnderElementMode mode) const
-{
-    if (!isAXTable())
-        return AXLayoutObject::deprecatedTitle(mode);
-
-    String title;
-    if (!m_layoutObject)
-        return title;
-
-    // see if there is a caption
-    Node* tableElement = m_layoutObject->node();
-    if (isHTMLTableElement(tableElement)) {
-        HTMLTableCaptionElement* caption = toHTMLTableElement(tableElement)->caption();
-        if (caption)
-            title = caption->innerText();
-    }
-
-    // try the standard
-    if (title.isEmpty())
-        title = AXLayoutObject::deprecatedTitle(mode);
-
-    return title;
-}
-
 DEFINE_TRACE(AXTable)
 {
     visitor->trace(m_rows);
diff --git a/third_party/WebKit/Source/modules/accessibility/AXTable.h b/third_party/WebKit/Source/modules/accessibility/AXTable.h
index db4a61f..36f536f 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXTable.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXTable.h
@@ -68,8 +68,6 @@
     unsigned columnCount();
     unsigned rowCount();
 
-    String deprecatedTitle(TextUnderElementMode) const final;
-
     // all the cells in the table
     void cells(AXObjectVector&);
     AXTableCell* cellForColumnAndRow(unsigned column, unsigned row);
diff --git a/third_party/WebKit/Source/modules/accessibility/AXTableCell.cpp b/third_party/WebKit/Source/modules/accessibility/AXTableCell.cpp
index 2d55d6e..ac5baba 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXTableCell.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXTableCell.cpp
@@ -218,41 +218,4 @@
     return SortDirectionUndefined;
 }
 
-AXObject* AXTableCell::deprecatedTitleUIElement() const
-{
-    // Try to find if the first cell in this row is a <th>. If it is,
-    // then it can act as the title ui element. (This is only in the
-    // case when the table is not appearing as an AXTable.)
-    if (isTableCell() || !m_layoutObject || !m_layoutObject->isTableCell())
-        return 0;
-
-    // Table cells that are th cannot have title ui elements, since by definition
-    // they are title ui elements
-    if (isTableHeaderCell())
-        return 0;
-
-    LayoutTableCell* layoutCell = toLayoutTableCell(m_layoutObject);
-
-    // If this cell is in the first column, there is no need to continue.
-    int col = layoutCell->col();
-    if (!col)
-        return 0;
-
-    int row = layoutCell->rowIndex();
-
-    LayoutTableSection* section = layoutCell->section();
-    if (!section)
-        return 0;
-
-    LayoutTableCell* headerCell = section->primaryCellAt(row, 0);
-    if (!headerCell || headerCell == layoutCell)
-        return 0;
-
-    Node* cellElement = headerCell->node();
-    if (!cellElement || !cellElement->hasTagName(thTag))
-        return 0;
-
-    return axObjectCache().getOrCreate(headerCell);
-}
-
 } // namespace blink
diff --git a/third_party/WebKit/Source/modules/accessibility/AXTableCell.h b/third_party/WebKit/Source/modules/accessibility/AXTableCell.h
index 8d93b05..c3fbcbb6 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXTableCell.h
+++ b/third_party/WebKit/Source/modules/accessibility/AXTableCell.h
@@ -64,9 +64,6 @@
     bool isRowHeaderCell() const;
     bool isColumnHeaderCell() const;
 
-    // If a table cell is not exposed as a table cell, a TH element can serve as its title UI element.
-    AXObject* deprecatedTitleUIElement() const final;
-    bool deprecatedExposesTitleUIElement() const final { return true; }
     bool computeAccessibilityIsIgnored(IgnoredReasons* = nullptr) const final;
 };
 
diff --git a/third_party/WebKit/Source/modules/accessibility/InspectorAccessibilityAgent.cpp b/third_party/WebKit/Source/modules/accessibility/InspectorAccessibilityAgent.cpp
index 541b8df1..f4a1068 100644
--- a/third_party/WebKit/Source/modules/accessibility/InspectorAccessibilityAgent.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/InspectorAccessibilityAgent.cpp
@@ -40,11 +40,17 @@
 
 void fillCoreProperties(AXObject* axObject, PassRefPtr<AXNode> nodeObject)
 {
-    // core properties
-    String description = axObject->deprecatedAccessibilityDescription();
+    // Description (secondary to the accessible name).
+    AXNameFrom nameFrom;
+    AXObject::AXObjectVector nameObjects;
+    axObject->name(nameFrom, &nameObjects);
+    AXDescriptionFrom descriptionFrom;
+    AXObject::AXObjectVector descriptionObjects;
+    String description = axObject->description(nameFrom, descriptionFrom, &descriptionObjects);
     if (!description.isEmpty())
         nodeObject->setDescription(createValue(description, AXValueType::ComputedString));
 
+    // Value.
     if (axObject->supportsRangeValue()) {
         nodeObject->setValue(createValue(axObject->valueForRange()));
     } else {
@@ -52,10 +58,6 @@
         if (!stringValue.isEmpty())
             nodeObject->setValue(createValue(stringValue));
     }
-
-    String help = axObject->deprecatedHelpText();
-    if (!help.isEmpty())
-        nodeObject->setHelp(createValue(help, AXValueType::ComputedString));
 }
 
 void fillLiveRegionProperties(AXObject* axObject, PassRefPtr<TypeBuilder::Array<AXProperty>> properties)
@@ -272,12 +274,12 @@
         properties->addItem(createRelatedNodeListProperty(AXRelationshipAttributes::Controls, results, aria_controlsAttr, axObject));
     results.clear();
 
-    axObject->deprecatedAriaDescribedbyElements(results);
+    axObject->ariaDescribedbyElements(results);
     if (!results.isEmpty())
         properties->addItem(createRelatedNodeListProperty(AXRelationshipAttributes::Describedby, results, aria_describedbyAttr, axObject));
     results.clear();
 
-    axObject->deprecatedAriaLabelledbyElements(results);
+    axObject->ariaLabelledbyElements(results);
     if (!results.isEmpty())
         properties->addItem(createRelatedNodeListProperty(AXRelationshipAttributes::Labelledby, results, aria_labelledbyAttr, axObject));
     results.clear();
diff --git a/third_party/WebKit/Source/modules/accessibility/InspectorTypeBuilderHelper.cpp b/third_party/WebKit/Source/modules/accessibility/InspectorTypeBuilderHelper.cpp
index 2200acb8..c3f0d768 100644
--- a/third_party/WebKit/Source/modules/accessibility/InspectorTypeBuilderHelper.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/InspectorTypeBuilderHelper.cpp
@@ -216,6 +216,8 @@
         return AXValueNativeSourceType::Tablecaption;
     case AXTextFromNativeHTMLLegend:
         return AXValueNativeSourceType::Legend;
+    case AXTextFromNativeHTMLTitleElement:
+        return AXValueNativeSourceType::Title;
     default:
         return AXValueNativeSourceType::Other;
     }
diff --git a/third_party/WebKit/Source/platform/BUILD.gn b/third_party/WebKit/Source/platform/BUILD.gn
index 878d8fe5d3b..ec882fe 100644
--- a/third_party/WebKit/Source/platform/BUILD.gn
+++ b/third_party/WebKit/Source/platform/BUILD.gn
@@ -379,6 +379,10 @@
     sources += [ "text/LocaleICUTest.cpp" ]
   }
 
+  if (!is_mac) {
+    sources += [ "scroll/ScrollAnimatorTest.cpp" ]
+  }
+
   sources += [ "testing/RunAllTests.cpp" ]
 
   configs += [
diff --git a/third_party/WebKit/Source/platform/LayoutUnit.h b/third_party/WebKit/Source/platform/LayoutUnit.h
index 95e33a16..a32fc96 100644
--- a/third_party/WebKit/Source/platform/LayoutUnit.h
+++ b/third_party/WebKit/Source/platform/LayoutUnit.h
@@ -109,6 +109,7 @@
     operator int() const { return toInt(); }
     operator unsigned() const { return toUnsigned(); }
     operator double() const { return toDouble(); }
+    operator float() const { return toFloat(); }
     operator bool() const { return m_value; }
 
     LayoutUnit operator++(int)
diff --git a/third_party/WebKit/Source/platform/blink_platform.gypi b/third_party/WebKit/Source/platform/blink_platform.gypi
index 0aaf6ce..ce3355e 100644
--- a/third_party/WebKit/Source/platform/blink_platform.gypi
+++ b/third_party/WebKit/Source/platform/blink_platform.gypi
@@ -1103,6 +1103,13 @@
           ],
         }
       ],
+      ['OS!="mac"',
+        {
+          'platform_test_files': [
+            'scroll/ScrollAnimatorTest.cpp',
+          ],
+        }
+      ],
     ],
   },
 }
diff --git a/third_party/WebKit/Source/platform/exported/WebURLRequest.cpp b/third_party/WebKit/Source/platform/exported/WebURLRequest.cpp
index 0cdec27c..1b5f8a3 100644
--- a/third_party/WebKit/Source/platform/exported/WebURLRequest.cpp
+++ b/third_party/WebKit/Source/platform/exported/WebURLRequest.cpp
@@ -247,7 +247,7 @@
 
 void WebURLRequest::addHTTPOriginIfNeeded(const WebString& origin)
 {
-    m_private->m_resourceRequest->addHTTPOriginIfNeeded(origin);
+    m_private->m_resourceRequest->addHTTPOriginIfNeeded(WebSecurityOrigin::createFromString(origin));
 }
 
 bool WebURLRequest::hasUserGesture() const
diff --git a/third_party/WebKit/Source/platform/graphics/GraphicsLayer.cpp b/third_party/WebKit/Source/platform/graphics/GraphicsLayer.cpp
index 6dadd470..258e0dd9 100644
--- a/third_party/WebKit/Source/platform/graphics/GraphicsLayer.cpp
+++ b/third_party/WebKit/Source/platform/graphics/GraphicsLayer.cpp
@@ -125,7 +125,6 @@
     m_layer = adoptPtr(Platform::current()->compositorSupport()->createContentLayer(m_contentLayerDelegate.get()));
     m_layer->layer()->setDrawsContent(m_drawsContent && m_contentsVisible);
     m_layer->layer()->setWebLayerClient(this);
-    m_layer->setAutomaticallyComputeRasterScale(true);
 
     // TODO(rbyers): Expose control over this to the web - crbug.com/489802:
     setScrollBlocksOn(WebScrollBlocksOnStartTouch | WebScrollBlocksOnWheelEvent);
@@ -961,7 +960,7 @@
 void GraphicsLayer::setBackfaceVisibility(bool visible)
 {
     m_backfaceVisibility = visible;
-    m_layer->setDoubleSided(m_backfaceVisibility);
+    platformLayer()->setDoubleSided(m_backfaceVisibility);
 }
 
 void GraphicsLayer::setOpacity(float opacity)
diff --git a/third_party/WebKit/Source/platform/graphics/GraphicsLayerTest.cpp b/third_party/WebKit/Source/platform/graphics/GraphicsLayerTest.cpp
index 8123bc2c..f535eea 100644
--- a/third_party/WebKit/Source/platform/graphics/GraphicsLayerTest.cpp
+++ b/third_party/WebKit/Source/platform/graphics/GraphicsLayerTest.cpp
@@ -200,8 +200,7 @@
     IntSize contentsSize() const override { return IntSize(100, 100); }
     bool scrollbarsCanBeActive() const override { return false; }
     IntRect scrollableAreaBoundingBox() const override { return IntRect(); }
-    void invalidateScrollbarRect(Scrollbar*, const IntRect&) override { }
-    void invalidateScrollCornerRect(const IntRect&) override { }
+    void scrollControlWasSetNeedsPaintInvalidation() override { }
     bool userInputScrollable(ScrollbarOrientation) const override { return true; }
     bool shouldPlaceVerticalScrollbarOnLeft() const override { return false; }
     int pageStep(ScrollbarOrientation) const override { return 0; }
diff --git a/third_party/WebKit/Source/platform/mac/ScrollAnimatorMac.mm b/third_party/WebKit/Source/platform/mac/ScrollAnimatorMac.mm
index 5ff50a382..4e24d78 100644
--- a/third_party/WebKit/Source/platform/mac/ScrollAnimatorMac.mm
+++ b/third_party/WebKit/Source/platform/mac/ScrollAnimatorMac.mm
@@ -439,7 +439,7 @@
         break;
     }
 
-    _scrollbar->invalidate();
+    _scrollbar->setNeedsPaintInvalidation();
 }
 
 - (void)invalidate
@@ -1077,7 +1077,7 @@
     NSScrollerStyle newStyle = [m_scrollbarPainterController.get() scrollerStyle];
 
     if (Scrollbar* verticalScrollbar = scrollableArea()->verticalScrollbar()) {
-        verticalScrollbar->invalidate();
+        verticalScrollbar->setNeedsPaintInvalidation();
 
         ScrollbarPainter oldVerticalPainter = [m_scrollbarPainterController.get() verticalScrollerImp];
         ScrollbarPainter newVerticalPainter = [NSClassFromString(@"NSScrollerImp") scrollerImpWithStyle:newStyle
@@ -1095,7 +1095,7 @@
     }
 
     if (Scrollbar* horizontalScrollbar = scrollableArea()->horizontalScrollbar()) {
-        horizontalScrollbar->invalidate();
+        horizontalScrollbar->setNeedsPaintInvalidation();
 
         ScrollbarPainter oldHorizontalPainter = [m_scrollbarPainterController.get() horizontalScrollerImp];
         ScrollbarPainter newHorizontalPainter = [NSClassFromString(@"NSScrollerImp") scrollerImpWithStyle:newStyle
diff --git a/third_party/WebKit/Source/platform/network/ResourceRequest.cpp b/third_party/WebKit/Source/platform/network/ResourceRequest.cpp
index e0a0d44c..5ee3653 100644
--- a/third_party/WebKit/Source/platform/network/ResourceRequest.cpp
+++ b/third_party/WebKit/Source/platform/network/ResourceRequest.cpp
@@ -235,12 +235,20 @@
     m_didSetHTTPReferrer = false;
 }
 
+void ResourceRequest::setHTTPOrigin(PassRefPtr<SecurityOrigin> origin)
+{
+    setHTTPHeaderField("Origin", origin->toAtomicString());
+    if (origin->hasSuborigin())
+        setHTTPHeaderField("Suborigin", AtomicString(origin->suboriginName()));
+}
+
 void ResourceRequest::clearHTTPOrigin()
 {
     m_httpHeaderFields.remove("Origin");
+    m_httpHeaderFields.remove("Suborigin");
 }
 
-void ResourceRequest::addHTTPOriginIfNeeded(const AtomicString& origin)
+void ResourceRequest::addHTTPOriginIfNeeded(PassRefPtr<SecurityOrigin> origin)
 {
     if (!httpOrigin().isEmpty())
         return; // Request already has an Origin header.
@@ -257,10 +265,11 @@
     // For non-GET and non-HEAD methods, always send an Origin header so the
     // server knows we support this feature.
 
-    if (origin.isEmpty()) {
+    AtomicString originString = origin->toAtomicString();
+    if (originString.isEmpty()) {
         // If we don't know what origin header to attach, we attach the value
         // for an empty origin.
-        setHTTPOrigin(SecurityOrigin::createUnique()->toAtomicString());
+        setHTTPOrigin(SecurityOrigin::createUnique());
         return;
     }
     setHTTPOrigin(origin);
diff --git a/third_party/WebKit/Source/platform/network/ResourceRequest.h b/third_party/WebKit/Source/platform/network/ResourceRequest.h
index 1b30c2a..e4649d0 100644
--- a/third_party/WebKit/Source/platform/network/ResourceRequest.h
+++ b/third_party/WebKit/Source/platform/network/ResourceRequest.h
@@ -135,9 +135,12 @@
     void clearHTTPReferrer();
 
     const AtomicString& httpOrigin() const { return httpHeaderField("Origin"); }
-    void setHTTPOrigin(const AtomicString& httpOrigin) { setHTTPHeaderField("Origin", httpOrigin); }
+    const AtomicString& httpSuborigin() const { return httpHeaderField("Suborigin"); }
+    // Note that these will also set and clear, respectively, the
+    // Suborigin header, if appropriate.
+    void setHTTPOrigin(PassRefPtr<SecurityOrigin>);
     void clearHTTPOrigin();
-    void addHTTPOriginIfNeeded(const AtomicString& origin);
+    void addHTTPOriginIfNeeded(PassRefPtr<SecurityOrigin>);
 
     const AtomicString& httpUserAgent() const { return httpHeaderField("User-Agent"); }
     void setHTTPUserAgent(const AtomicString& httpUserAgent) { setHTTPHeaderField("User-Agent", httpUserAgent); }
diff --git a/third_party/WebKit/Source/web/tests/ScrollAnimatorTest.cpp b/third_party/WebKit/Source/platform/scroll/ScrollAnimatorTest.cpp
similarity index 99%
rename from third_party/WebKit/Source/web/tests/ScrollAnimatorTest.cpp
rename to third_party/WebKit/Source/platform/scroll/ScrollAnimatorTest.cpp
index d691c95..e1c1ea1 100644
--- a/third_party/WebKit/Source/web/tests/ScrollAnimatorTest.cpp
+++ b/third_party/WebKit/Source/platform/scroll/ScrollAnimatorTest.cpp
@@ -42,6 +42,8 @@
 using testing::Return;
 using testing::_;
 
+namespace {
+
 class MockScrollableArea : public NoBaseWillBeGarbageCollectedFinalized<MockScrollableArea>, public ScrollableArea {
     WILL_BE_USING_GARBAGE_COLLECTED_MIXIN(MockScrollableArea);
 public:
@@ -52,12 +54,10 @@
 
     MOCK_CONST_METHOD0(isActive, bool());
     MOCK_CONST_METHOD1(scrollSize, int(ScrollbarOrientation));
-    MOCK_METHOD2(invalidateScrollbar, void(Scrollbar*, const IntRect&));
     MOCK_CONST_METHOD0(isScrollCornerVisible, bool());
     MOCK_CONST_METHOD0(scrollCornerRect, IntRect());
     MOCK_METHOD2(setScrollOffset, void(const IntPoint&, ScrollType));
-    MOCK_METHOD2(invalidateScrollbarRect, void(Scrollbar*, const IntRect&));
-    MOCK_METHOD1(invalidateScrollCornerRect, void(const IntRect&));
+    MOCK_METHOD0(scrollControlWasSetNeedsPaintInvalidation, void());
     MOCK_CONST_METHOD0(enclosingScrollableArea, ScrollableArea*());
     MOCK_CONST_METHOD0(minimumScrollPosition, IntPoint());
     MOCK_CONST_METHOD0(maximumScrollPosition, IntPoint());
@@ -122,6 +122,8 @@
 
 };
 
+} // namespace
+
 TEST(ScrollAnimatorEnabled, Enabled)
 {
     OwnPtrWillBeRawPtr<MockScrollableArea> scrollableArea = MockScrollableArea::create(true);
diff --git a/third_party/WebKit/Source/platform/scroll/ScrollableArea.cpp b/third_party/WebKit/Source/platform/scroll/ScrollableArea.cpp
index f23801b..85016be 100644
--- a/third_party/WebKit/Source/platform/scroll/ScrollableArea.cpp
+++ b/third_party/WebKit/Source/platform/scroll/ScrollableArea.cpp
@@ -51,7 +51,6 @@
 
 struct SameSizeAsScrollableArea {
     virtual ~SameSizeAsScrollableArea();
-    IntRect scrollbarDamage[2];
 #if ENABLE(ASSERT) && ENABLE(OILPAN)
     VerifyEagerFinalization verifyEager;
 #endif
@@ -82,6 +81,9 @@
     : m_inLiveResize(false)
     , m_scrollbarOverlayStyle(ScrollbarOverlayStyleDefault)
     , m_scrollOriginChanged(false)
+    , m_horizontalScrollbarNeedsPaintInvalidation(false)
+    , m_verticalScrollbarNeedsPaintInvalidation(false)
+    , m_scrollCornerNeedsPaintInvalidation(false)
 {
 }
 
@@ -246,22 +248,13 @@
     // Tell the scrollbars to update their thumb postions.
     if (Scrollbar* horizontalScrollbar = this->horizontalScrollbar()) {
         horizontalScrollbar->offsetDidChange();
-        if (horizontalScrollbar->isOverlayScrollbar() && !hasLayerForHorizontalScrollbar()) {
-            if (!verticalScrollbar)
-                horizontalScrollbar->invalidate();
-            else {
-                // If there is both a horizontalScrollbar and a verticalScrollbar,
-                // then we must also invalidate the corner between them.
-                IntRect boundsAndCorner = horizontalScrollbar->boundsRect();
-                boundsAndCorner.setWidth(boundsAndCorner.width() + verticalScrollbar->width());
-                horizontalScrollbar->invalidateRect(boundsAndCorner);
-            }
-        }
+        if (horizontalScrollbar->isOverlayScrollbar() && !hasLayerForHorizontalScrollbar())
+            setScrollbarNeedsPaintInvalidation(horizontalScrollbar);
     }
     if (verticalScrollbar) {
         verticalScrollbar->offsetDidChange();
         if (verticalScrollbar->isOverlayScrollbar() && !hasLayerForVerticalScrollbar())
-            verticalScrollbar->invalidate();
+            setScrollbarNeedsPaintInvalidation(verticalScrollbar);
     }
 
     if (scrollPositionDouble() != oldPosition) {
@@ -402,16 +395,16 @@
 
     if (Scrollbar* scrollbar = horizontalScrollbar()) {
         ScrollbarTheme::theme()->updateScrollbarOverlayStyle(scrollbar);
-        scrollbar->invalidate();
+        setScrollbarNeedsPaintInvalidation(scrollbar);
     }
 
     if (Scrollbar* scrollbar = verticalScrollbar()) {
         ScrollbarTheme::theme()->updateScrollbarOverlayStyle(scrollbar);
-        scrollbar->invalidate();
+        setScrollbarNeedsPaintInvalidation(scrollbar);
     }
 }
 
-void ScrollableArea::invalidateScrollbar(Scrollbar* scrollbar, const IntRect& rect)
+void ScrollableArea::setScrollbarNeedsPaintInvalidation(Scrollbar* scrollbar)
 {
     if (scrollbar == horizontalScrollbar()) {
         if (GraphicsLayer* graphicsLayer = layerForHorizontalScrollbar()) {
@@ -419,7 +412,8 @@
             graphicsLayer->setContentsNeedsDisplay();
             return;
         }
-        invalidateScrollbarRect(scrollbar, rect);
+        m_horizontalScrollbarNeedsPaintInvalidation = true;
+        scrollControlWasSetNeedsPaintInvalidation();
         return;
     }
     if (scrollbar == verticalScrollbar()) {
@@ -428,20 +422,22 @@
             graphicsLayer->setContentsNeedsDisplay();
             return;
         }
-        invalidateScrollbarRect(scrollbar, rect);
+        m_verticalScrollbarNeedsPaintInvalidation = true;
+        scrollControlWasSetNeedsPaintInvalidation();
         return;
     }
     // Otherwise the scrollbar is just created and has not been set as either
     // horizontalScrollbar() or verticalScrollbar().
 }
 
-void ScrollableArea::invalidateScrollCorner(const IntRect& rect)
+void ScrollableArea::setScrollCornerNeedsPaintInvalidation()
 {
     if (GraphicsLayer* graphicsLayer = layerForScrollCorner()) {
         graphicsLayer->setNeedsDisplay();
         return;
     }
-    invalidateScrollCornerRect(rect);
+    m_scrollCornerNeedsPaintInvalidation = true;
+    scrollControlWasSetNeedsPaintInvalidation();
 }
 
 bool ScrollableArea::hasLayerForHorizontalScrollbar() const
diff --git a/third_party/WebKit/Source/platform/scroll/ScrollableArea.h b/third_party/WebKit/Source/platform/scroll/ScrollableArea.h
index 26b8fb9..bc261b7 100644
--- a/third_party/WebKit/Source/platform/scroll/ScrollableArea.h
+++ b/third_party/WebKit/Source/platform/scroll/ScrollableArea.h
@@ -147,10 +147,10 @@
 
     virtual bool isActive() const = 0;
     virtual int scrollSize(ScrollbarOrientation) const = 0;
-    virtual void invalidateScrollbar(Scrollbar*, const IntRect&);
+    void setScrollbarNeedsPaintInvalidation(Scrollbar*);
     virtual bool isScrollCornerVisible() const = 0;
     virtual IntRect scrollCornerRect() const = 0;
-    virtual void invalidateScrollCorner(const IntRect&);
+    void setScrollCornerNeedsPaintInvalidation();
     virtual void getTickmarks(Vector<IntRect>&) const { }
 
     // Convert points and rects between the scrollbar and its containing view.
@@ -235,25 +235,6 @@
     int maximumScrollPosition(ScrollbarOrientation orientation) { return orientation == HorizontalScrollbar ? maximumScrollPosition().x() : maximumScrollPosition().y(); }
     int clampScrollPosition(ScrollbarOrientation orientation, int pos)  { return std::max(std::min(pos, maximumScrollPosition(orientation)), minimumScrollPosition(orientation)); }
 
-    bool hasVerticalBarDamage() const { return !m_verticalBarDamage.isEmpty(); }
-    bool hasHorizontalBarDamage() const { return !m_horizontalBarDamage.isEmpty(); }
-    const IntRect& verticalBarDamage() const { return m_verticalBarDamage; }
-    const IntRect& horizontalBarDamage() const { return m_horizontalBarDamage; }
-
-    void addScrollbarDamage(Scrollbar* scrollbar, const IntRect& rect)
-    {
-        if (scrollbar == horizontalScrollbar())
-            m_horizontalBarDamage.unite(rect);
-        else
-            m_verticalBarDamage.unite(rect);
-    }
-
-    void resetScrollbarDamage()
-    {
-        m_verticalBarDamage = IntRect();
-        m_horizontalBarDamage = IntRect();
-    }
-
     virtual GraphicsLayer* layerForContainer() const;
     virtual GraphicsLayer* layerForScrolling() const { return 0; }
     virtual GraphicsLayer* layerForHorizontalScrollbar() const { return 0; }
@@ -270,8 +251,8 @@
 
     virtual ~ScrollableArea();
 
-    virtual void invalidateScrollbarRect(Scrollbar*, const IntRect&) = 0;
-    virtual void invalidateScrollCornerRect(const IntRect&) = 0;
+    // Called when any of horizontal scrollbar, vertical scrollbar and scroll corner is setNeedsPaintInvalidation.
+    virtual void scrollControlWasSetNeedsPaintInvalidation() = 0;
 
     // Returns the default scroll style this area should scroll with when not
     // explicitly specified. E.g. The scrolling behavior of an element can be
@@ -312,6 +293,16 @@
 
     void clearScrollAnimators();
 
+    bool horizontalScrollbarNeedsPaintInvalidation() const { return m_horizontalScrollbarNeedsPaintInvalidation; }
+    bool verticalScrollbarNeedsPaintInvalidation() const { return m_verticalScrollbarNeedsPaintInvalidation; }
+    bool scrollCornerNeedsPaintInvalidation() const { return m_scrollCornerNeedsPaintInvalidation; }
+    void clearNeedsPaintInvalidationForScrollControls()
+    {
+        m_horizontalScrollbarNeedsPaintInvalidation = false;
+        m_verticalScrollbarNeedsPaintInvalidation = false;
+        m_scrollCornerNeedsPaintInvalidation = false;
+    }
+
 private:
     void programmaticScrollHelper(const DoublePoint&, ScrollBehavior);
     void userScrollHelper(const DoublePoint&, ScrollBehavior);
@@ -334,10 +325,6 @@
     virtual int documentStep(ScrollbarOrientation) const;
     virtual float pixelStep(ScrollbarOrientation) const;
 
-    // Stores the paint invalidations for the scrollbars during layout.
-    IntRect m_horizontalBarDamage;
-    IntRect m_verticalBarDamage;
-
     struct ScrollableAreaAnimators {
         OwnPtr<ScrollAnimatorBase> scrollAnimator;
         OwnPtr<ProgrammaticScrollAnimator> programmaticScrollAnimator;
@@ -351,6 +338,10 @@
 
     unsigned m_scrollOriginChanged : 1;
 
+    unsigned m_horizontalScrollbarNeedsPaintInvalidation : 1;
+    unsigned m_verticalScrollbarNeedsPaintInvalidation : 1;
+    unsigned m_scrollCornerNeedsPaintInvalidation : 1;
+
     // There are 8 possible combinations of writing mode and direction. Scroll origin will be non-zero in the x or y axis
     // if there is any reversed direction or writing-mode. The combinations are:
     // writing-mode / direction     scrollOrigin.x() set    scrollOrigin.y() set
diff --git a/third_party/WebKit/Source/platform/scroll/ScrollableAreaTest.cpp b/third_party/WebKit/Source/platform/scroll/ScrollableAreaTest.cpp
index 916560a..08e9840 100644
--- a/third_party/WebKit/Source/platform/scroll/ScrollableAreaTest.cpp
+++ b/third_party/WebKit/Source/platform/scroll/ScrollableAreaTest.cpp
@@ -14,6 +14,8 @@
 
 namespace blink {
 
+namespace {
+
 class MockScrollableArea : public NoBaseWillBeGarbageCollectedFinalized<MockScrollableArea>, public ScrollableArea {
     WILL_BE_USING_GARBAGE_COLLECTED_MIXIN(MockScrollableArea);
 public:
@@ -24,11 +26,9 @@
 
     MOCK_CONST_METHOD0(isActive, bool());
     MOCK_CONST_METHOD1(scrollSize, int(ScrollbarOrientation));
-    MOCK_METHOD2(invalidateScrollbar, void(Scrollbar*, const IntRect&));
     MOCK_CONST_METHOD0(isScrollCornerVisible, bool());
     MOCK_CONST_METHOD0(scrollCornerRect, IntRect());
-    MOCK_METHOD2(invalidateScrollbarRect, void(Scrollbar*, const IntRect&));
-    MOCK_METHOD1(invalidateScrollCornerRect, void(const IntRect&));
+    MOCK_METHOD0(scrollControlWasSetNeedsPaintInvalidation, void());
     MOCK_CONST_METHOD0(enclosingScrollableArea, ScrollableArea*());
     MOCK_CONST_METHOD1(visibleContentRect, IntRect(IncludeScrollbarsInRect));
     MOCK_CONST_METHOD0(contentsSize, IntSize());
@@ -98,6 +98,8 @@
     FakeWebThread m_webThread;
 };
 
+} // namespace
+
 class ScrollableAreaTest : public testing::Test {
 public:
     ScrollableAreaTest() : m_oldPlatform(nullptr) { }
diff --git a/third_party/WebKit/Source/platform/scroll/Scrollbar.cpp b/third_party/WebKit/Source/platform/scroll/Scrollbar.cpp
index e549491b..19538b2 100644
--- a/third_party/WebKit/Source/platform/scroll/Scrollbar.cpp
+++ b/third_party/WebKit/Source/platform/scroll/Scrollbar.cpp
@@ -34,12 +34,6 @@
 #include "platform/scroll/ScrollableArea.h"
 #include "platform/scroll/ScrollbarTheme.h"
 
-#if ((OS(POSIX) && !OS(MACOSX)) || OS(WIN))
-// The position of the scrollbar thumb affects the appearance of the steppers, so
-// when the thumb moves, we have to invalidate them for painting.
-#define THUMB_POSITION_AFFECTS_BUTTONS
-#endif
-
 namespace blink {
 
 PassRefPtrWillBeRawPtr<Scrollbar> Scrollbar::create(ScrollableArea* scrollableArea, ScrollbarOrientation orientation, ScrollbarControlSize size)
@@ -65,7 +59,6 @@
     , m_enabled(true)
     , m_scrollTimer(this, &Scrollbar::autoscrollTimerFired)
     , m_overlapsResizer(false)
-    , m_suppressInvalidation(false)
     , m_isAlphaLocked(false)
     , m_elasticOverscroll(0)
 {
@@ -99,9 +92,8 @@
     if (frameRect == this->frameRect())
         return;
 
-    invalidate();
     Widget::setFrameRect(frameRect);
-    invalidate();
+    setNeedsPaintInvalidation();
 }
 
 ScrollbarOverlayStyle Scrollbar::scrollbarOverlayStyle() const
@@ -160,11 +152,7 @@
 
 void Scrollbar::updateThumb()
 {
-#ifdef THUMB_POSITION_AFFECTS_BUTTONS
-    invalidate();
-#else
-    theme()->invalidateParts(this, ForwardTrackPart | BackTrackPart | ThumbPart);
-#endif
+    setNeedsPaintInvalidation();
 }
 
 void Scrollbar::updateThumbPosition()
@@ -206,7 +194,7 @@
 
     // Handle the track.
     if ((m_pressedPart == BackTrackPart || m_pressedPart == ForwardTrackPart) && thumbUnderMouse(this)) {
-        theme()->invalidatePart(this, m_pressedPart);
+        setNeedsPaintInvalidation();
         setHoveredPart(ThumbPart);
         return;
     }
@@ -225,7 +213,7 @@
     // Handle the track.  We halt track scrolling once the thumb is level
     // with us.
     if ((m_pressedPart == BackTrackPart || m_pressedPart == ForwardTrackPart) && thumbUnderMouse(this)) {
-        theme()->invalidatePart(this, m_pressedPart);
+        setNeedsPaintInvalidation();
         setHoveredPart(ThumbPart);
         return;
     }
@@ -319,24 +307,21 @@
     if (part == m_hoveredPart)
         return;
 
-    if ((m_hoveredPart == NoPart || part == NoPart) && theme()->invalidateOnMouseEnterExit())
-        invalidate();  // Just invalidate the whole scrollbar, since the buttons at either end change anyway.
-    else if (m_pressedPart == NoPart) {  // When there's a pressed part, we don't draw a hovered state, so there's no reason to invalidate.
-        theme()->invalidatePart(this, part);
-        theme()->invalidatePart(this, m_hoveredPart);
-    }
+    if (((m_hoveredPart == NoPart || part == NoPart) && theme()->invalidateOnMouseEnterExit())
+        // When there's a pressed part, we don't draw a hovered state, so there's no reason to invalidate.
+        || m_pressedPart == NoPart)
+        setNeedsPaintInvalidation();
+
     m_hoveredPart = part;
 }
 
 void Scrollbar::setPressedPart(ScrollbarPart part)
 {
-    if (m_pressedPart != NoPart)
-        theme()->invalidatePart(this, m_pressedPart);
+    if (m_pressedPart != NoPart
+        // When we no longer have a pressed part, we can start drawing a hovered state on the hovered part.
+        || m_hoveredPart != NoPart)
+        setNeedsPaintInvalidation();
     m_pressedPart = part;
-    if (m_pressedPart != NoPart)
-        theme()->invalidatePart(this, m_pressedPart);
-    else if (m_hoveredPart != NoPart)  // When we no longer have a pressed part, we can start drawing a hovered state on the hovered part.
-        theme()->invalidatePart(this, m_hoveredPart);
 }
 
 bool Scrollbar::gestureEvent(const PlatformGestureEvent& evt)
@@ -406,12 +391,12 @@
                 // The mouse is moving back over the pressed part.  We
                 // need to start up the timer action again.
                 startTimerIfNeeded(theme()->autoscrollTimerDelay());
-                theme()->invalidatePart(this, m_pressedPart);
+                setNeedsPaintInvalidation();
             } else if (m_hoveredPart == m_pressedPart) {
                 // The mouse is leaving the pressed part.  Kill our timer
                 // if needed.
                 stopTimerIfNeeded();
-                theme()->invalidatePart(this, m_pressedPart);
+                setNeedsPaintInvalidation();
             }
         }
 
@@ -490,7 +475,7 @@
         return;
     m_enabled = e;
     theme()->updateEnabledState(this);
-    invalidate();
+    setNeedsPaintInvalidation();
 }
 
 bool Scrollbar::isOverlayScrollbar() const
@@ -511,15 +496,6 @@
     return m_scrollableArea && m_scrollableArea->isActive();
 }
 
-void Scrollbar::invalidateRect(const IntRect& rect)
-{
-    if (suppressInvalidation())
-        return;
-
-    if (m_scrollableArea)
-        m_scrollableArea->invalidateScrollbar(this, rect);
-}
-
 IntRect Scrollbar::convertToContainingView(const IntRect& localRect) const
 {
     if (m_scrollableArea)
@@ -563,4 +539,10 @@
     return m_scrollableArea->scrollPosition().y() - m_scrollableArea->minimumScrollPosition().y();
 }
 
+void Scrollbar::setNeedsPaintInvalidation()
+{
+    if (m_scrollableArea)
+        m_scrollableArea->setScrollbarNeedsPaintInvalidation(this);
+}
+
 } // namespace blink
diff --git a/third_party/WebKit/Source/platform/scroll/Scrollbar.h b/third_party/WebKit/Source/platform/scroll/Scrollbar.h
index 4f6596d..0ec1b88 100644
--- a/third_party/WebKit/Source/platform/scroll/Scrollbar.h
+++ b/third_party/WebKit/Source/platform/scroll/Scrollbar.h
@@ -65,9 +65,6 @@
     void setFrameRect(const IntRect&) override;
     IntRect frameRect() const override { return Widget::frameRect(); }
 
-    void invalidate() override { Widget::invalidate(); }
-    void invalidateRect(const IntRect&) override;
-
     ScrollbarOverlayStyle scrollbarOverlayStyle() const override;
     void getTickmarks(Vector<IntRect>&) const override;
     bool isScrollableAreaActive() const override;
@@ -129,9 +126,6 @@
 
     ScrollbarTheme* theme() const { return m_theme; }
 
-    bool suppressInvalidation() const { return m_suppressInvalidation; }
-    void setSuppressInvalidation(bool s) { m_suppressInvalidation = s; }
-
     IntRect convertToContainingView(const IntRect&) const override;
     IntRect convertFromContainingView(const IntRect&) const override;
 
@@ -152,6 +146,8 @@
     DisplayItemClient displayItemClient() const override { return toDisplayItemClient(this); }
     String debugName() const override { return m_orientation == HorizontalScrollbar ? "HorizontalScrollbar" : "VerticalScrollbar"; }
 
+    void setNeedsPaintInvalidation();
+
     // Promptly unregister from the theme manager + run finalizers of derived Scrollbars.
     EAGERLY_FINALIZE();
 #if ENABLE(OILPAN)
@@ -195,8 +191,6 @@
     Timer<Scrollbar> m_scrollTimer;
     bool m_overlapsResizer;
 
-    bool m_suppressInvalidation;
-
     bool m_isAlphaLocked;
 
     float m_elasticOverscroll;
@@ -204,6 +198,9 @@
 private:
     bool isScrollbar() const override { return true; }
 
+    void invalidate() override { setNeedsPaintInvalidation(); }
+    void invalidateRect(const IntRect&) override { setNeedsPaintInvalidation(); }
+
     float scrollableAreaCurrentPos() const;
 };
 
diff --git a/third_party/WebKit/Source/platform/scroll/ScrollbarTheme.cpp b/third_party/WebKit/Source/platform/scroll/ScrollbarTheme.cpp
index 9a1b08e..601dc30 100644
--- a/third_party/WebKit/Source/platform/scroll/ScrollbarTheme.cpp
+++ b/third_party/WebKit/Source/platform/scroll/ScrollbarTheme.cpp
@@ -170,46 +170,6 @@
     return result;
 }
 
-void ScrollbarTheme::invalidatePart(ScrollbarThemeClient* scrollbar, ScrollbarPart part)
-{
-    if (part == NoPart)
-        return;
-
-    IntRect result;
-    switch (part) {
-    case BackButtonStartPart:
-        result = backButtonRect(scrollbar, BackButtonStartPart, true);
-        break;
-    case BackButtonEndPart:
-        result = backButtonRect(scrollbar, BackButtonEndPart, true);
-        break;
-    case ForwardButtonStartPart:
-        result = forwardButtonRect(scrollbar, ForwardButtonStartPart, true);
-        break;
-    case ForwardButtonEndPart:
-        result = forwardButtonRect(scrollbar, ForwardButtonEndPart, true);
-        break;
-    case TrackBGPart:
-        result = trackRect(scrollbar, true);
-        break;
-    case ScrollbarBGPart:
-        result = scrollbar->frameRect();
-        break;
-    default: {
-        IntRect beforeThumbRect, thumbRect, afterThumbRect;
-        splitTrack(scrollbar, trackRect(scrollbar), beforeThumbRect, thumbRect, afterThumbRect);
-        if (part == BackTrackPart)
-            result = beforeThumbRect;
-        else if (part == ForwardTrackPart)
-            result = afterThumbRect;
-        else
-            result = thumbRect;
-    }
-    }
-    result.moveBy(-scrollbar->location());
-    scrollbar->invalidateRect(result);
-}
-
 void ScrollbarTheme::paintScrollCorner(GraphicsContext* context, const DisplayItemClientWrapper& displayItemClient, const IntRect& cornerRect)
 {
     if (cornerRect.isEmpty())
diff --git a/third_party/WebKit/Source/platform/scroll/ScrollbarTheme.h b/third_party/WebKit/Source/platform/scroll/ScrollbarTheme.h
index 35a072d..f078c02a 100644
--- a/third_party/WebKit/Source/platform/scroll/ScrollbarTheme.h
+++ b/third_party/WebKit/Source/platform/scroll/ScrollbarTheme.h
@@ -62,26 +62,6 @@
 
     virtual bool invalidateOnMouseEnterExit() { return false; }
 
-    void invalidateParts(ScrollbarThemeClient* scrollbar, ScrollbarControlPartMask mask)
-    {
-        if (mask & BackButtonStartPart)
-            invalidatePart(scrollbar, BackButtonStartPart);
-        if (mask & ForwardButtonStartPart)
-            invalidatePart(scrollbar, ForwardButtonStartPart);
-        if (mask & BackTrackPart)
-            invalidatePart(scrollbar, BackTrackPart);
-        if (mask & ThumbPart)
-            invalidatePart(scrollbar, ThumbPart);
-        if (mask & ForwardTrackPart)
-            invalidatePart(scrollbar, ForwardTrackPart);
-        if (mask & BackButtonEndPart)
-            invalidatePart(scrollbar, BackButtonEndPart);
-        if (mask & ForwardButtonEndPart)
-            invalidatePart(scrollbar, ForwardButtonEndPart);
-    }
-
-    virtual void invalidatePart(ScrollbarThemeClient*, ScrollbarPart);
-
     virtual void paintScrollCorner(GraphicsContext*, const DisplayItemClientWrapper&, const IntRect& cornerRect);
     virtual void paintTickmarks(GraphicsContext*, const ScrollbarThemeClient*, const IntRect&) { }
 
diff --git a/third_party/WebKit/Source/platform/testing/RunAllTests.cpp b/third_party/WebKit/Source/platform/testing/RunAllTests.cpp
index d63549b..dcf561c 100644
--- a/third_party/WebKit/Source/platform/testing/RunAllTests.cpp
+++ b/third_party/WebKit/Source/platform/testing/RunAllTests.cpp
@@ -37,6 +37,9 @@
 #include "wtf/MainThread.h"
 #include "wtf/Partitions.h"
 #include "wtf/WTF.h"
+#include <base/bind.h>
+#include <base/bind_helpers.h>
+#include <base/test/launcher/unit_test_launcher.h>
 #include <base/test/test_suite.h>
 #include <string.h>
 
@@ -50,10 +53,17 @@
     memset(buf, '\0', len);
 }
 
+static int runTestSuite(base::TestSuite* testSuite)
+{
+    int result = testSuite->Run();
+    blink::Heap::collectAllGarbage();
+    return result;
+}
+
 int main(int argc, char** argv)
 {
     WTF::setRandomSource(AlwaysZeroNumberSource);
-    WTF::initialize(CurrentTime, nullptr, nullptr, nullptr, nullptr);
+    WTF::initialize(CurrentTime, CurrentTime, CurrentTime, nullptr, nullptr);
     WTF::initializeMainThread(0);
 
     blink::TestingPlatformSupport::Config platformConfig;
@@ -61,8 +71,12 @@
 
     blink::Heap::init();
     blink::ThreadState::attachMainThread();
+    blink::ThreadState::current()->registerTraceDOMWrappers(nullptr, nullptr);
     blink::EventTracer::initialize();
-    int result = base::RunUnitTestsUsingBaseTestSuite(argc, argv);
+
+    base::TestSuite testSuite(argc, argv);
+    int result = base::LaunchUnitTests(argc, argv, base::Bind(runTestSuite, base::Unretained(&testSuite)));
+
     blink::ThreadState::detachMainThread();
     blink::Heap::shutdown();
 
diff --git a/third_party/WebKit/Source/platform/text/TextRun.cpp b/third_party/WebKit/Source/platform/text/TextRun.cpp
index e196d6b6a0..8fd2f85 100644
--- a/third_party/WebKit/Source/platform/text/TextRun.cpp
+++ b/third_party/WebKit/Source/platform/text/TextRun.cpp
@@ -36,9 +36,7 @@
     float float1;
     float float2;
     float float3;
-    uint32_t bitfields : 10;
-    bool b;
-    RefPtr<TextRun::RenderingContext> renderingContext;
+    uint32_t bitfields : 12;
     TabSize tabSize;
 };
 
diff --git a/third_party/WebKit/Source/platform/text/TextRun.h b/third_party/WebKit/Source/platform/text/TextRun.h
index 3257ff1..7154351 100644
--- a/third_party/WebKit/Source/platform/text/TextRun.h
+++ b/third_party/WebKit/Source/platform/text/TextRun.h
@@ -224,14 +224,6 @@
     void setTextJustify(TextJustify textJustify) { m_textJustify = static_cast<unsigned>(textJustify); }
     TextJustify textJustify() const { return static_cast<TextJustify>(m_textJustify); }
 
-    class RenderingContext : public RefCounted<RenderingContext> {
-    public:
-        virtual ~RenderingContext() { }
-    };
-
-    RenderingContext* renderingContext() const { return m_renderingContext.get(); }
-    void setRenderingContext(PassRefPtr<RenderingContext> context) { m_renderingContext = context; }
-
 private:
     union {
         const LChar* characters8;
@@ -255,8 +247,7 @@
     unsigned m_directionalOverride : 1; // Was this direction set by an override character.
     unsigned m_disableSpacing : 1;
     unsigned m_textJustify : 2;
-    bool m_normalizeSpace;
-    RefPtr<RenderingContext> m_renderingContext;
+    unsigned m_normalizeSpace : 1;
     TabSize m_tabSize;
 };
 
diff --git a/third_party/WebKit/Source/platform/weborigin/OriginAccessEntryTest.cpp b/third_party/WebKit/Source/platform/weborigin/OriginAccessEntryTest.cpp
index e500aa4..c689ab65 100644
--- a/third_party/WebKit/Source/platform/weborigin/OriginAccessEntryTest.cpp
+++ b/third_party/WebKit/Source/platform/weborigin/OriginAccessEntryTest.cpp
@@ -57,6 +57,17 @@
 
 class OriginAccessEntryTestPlatform : public blink::Platform {
 public:
+    OriginAccessEntryTestPlatform()
+        : m_oldPlatform(Platform::current())
+    {
+        Platform::initialize(this);
+    }
+
+    ~OriginAccessEntryTestPlatform()
+    {
+        Platform::initialize(m_oldPlatform);
+    }
+
     blink::WebPublicSuffixList* publicSuffixList() override
     {
         return &m_suffixList;
@@ -68,12 +79,19 @@
         RELEASE_ASSERT_NOT_REACHED();
     }
 
+    const unsigned char* getTraceCategoryEnabledFlag(const char* categoryName) override
+    {
+        static const unsigned char tracingIsDisabled = 0;
+        return &tracingIsDisabled;
+    }
+
     void setPublicSuffix(const blink::WebString& suffix)
     {
         m_suffixList.setPublicSuffix(suffix);
     }
 
 private:
+    blink::Platform* m_oldPlatform;
     OriginAccessEntryTestSuffixList m_suffixList;
 };
 
@@ -81,7 +99,6 @@
 {
     OriginAccessEntryTestPlatform platform;
     platform.setPublicSuffix("com");
-    Platform::initialize(&platform);
 
     RefPtr<SecurityOrigin> origin = SecurityOrigin::createFromString("http://www.google.com");
     OriginAccessEntry entry1("http", "google.com", OriginAccessEntry::AllowSubdomains);
@@ -90,8 +107,6 @@
     EXPECT_EQ(OriginAccessEntry::MatchesOrigin, entry1.matchesOrigin(*origin));
     EXPECT_EQ(OriginAccessEntry::DoesNotMatchOrigin, entry2.matchesOrigin(*origin));
     EXPECT_EQ(OriginAccessEntry::MatchesOriginButIsPublicSuffix, entry3.matchesOrigin(*origin));
-
-    Platform::shutdown();
 }
 
 TEST(OriginAccessEntryTest, AllowSubdomainsTest)
@@ -122,7 +137,6 @@
 
     OriginAccessEntryTestPlatform platform;
     platform.setPublicSuffix("com");
-    Platform::initialize(&platform);
 
     for (const auto& test : inputs) {
         SCOPED_TRACE(testing::Message() << "Host: " << test.host << ", Origin: " << test.origin);
@@ -130,8 +144,6 @@
         OriginAccessEntry entry1(test.protocol, test.host, OriginAccessEntry::AllowSubdomains);
         EXPECT_EQ(test.expected, entry1.matchesOrigin(*originToTest));
     }
-
-    Platform::shutdown();
 }
 
 TEST(OriginAccessEntryTest, AllowRegisterableDomainsTest)
@@ -162,7 +174,6 @@
 
     OriginAccessEntryTestPlatform platform;
     platform.setPublicSuffix("com");
-    Platform::initialize(&platform);
 
     for (const auto& test : inputs) {
         RefPtr<SecurityOrigin> originToTest = SecurityOrigin::createFromString(test.origin);
@@ -171,8 +182,6 @@
         SCOPED_TRACE(testing::Message() << "Host: " << test.host << ", Origin: " << test.origin << ", Domain: " << entry1.registerable().utf8().data());
         EXPECT_EQ(test.expected, entry1.matchesOrigin(*originToTest));
     }
-
-    Platform::shutdown();
 }
 
 TEST(OriginAccessEntryTest, AllowRegisterableDomainsTestWithDottedSuffix)
@@ -203,7 +212,6 @@
 
     OriginAccessEntryTestPlatform platform;
     platform.setPublicSuffix("appspot.com");
-    Platform::initialize(&platform);
 
     for (const auto& test : inputs) {
         RefPtr<SecurityOrigin> originToTest = SecurityOrigin::createFromString(test.origin);
@@ -212,8 +220,6 @@
         SCOPED_TRACE(testing::Message() << "Host: " << test.host << ", Origin: " << test.origin << ", Domain: " << entry1.registerable().utf8().data());
         EXPECT_EQ(test.expected, entry1.matchesOrigin(*originToTest));
     }
-
-    Platform::shutdown();
 }
 
 TEST(OriginAccessEntryTest, DisallowSubdomainsTest)
@@ -241,7 +247,6 @@
 
     OriginAccessEntryTestPlatform platform;
     platform.setPublicSuffix("com");
-    Platform::initialize(&platform);
 
     for (const auto& test : inputs) {
         SCOPED_TRACE(testing::Message() << "Host: " << test.host << ", Origin: " << test.origin);
@@ -249,8 +254,6 @@
         OriginAccessEntry entry1(test.protocol, test.host, OriginAccessEntry::DisallowSubdomains);
         EXPECT_EQ(test.expected, entry1.matchesOrigin(*originToTest));
     }
-
-    Platform::shutdown();
 }
 
 TEST(OriginAccessEntryTest, IPAddressTest)
@@ -273,15 +276,12 @@
 
     OriginAccessEntryTestPlatform platform;
     platform.setPublicSuffix("com");
-    Platform::initialize(&platform);
 
     for (const auto& test : inputs) {
         SCOPED_TRACE(testing::Message() << "Host: " << test.host);
         OriginAccessEntry entry(test.protocol, test.host, OriginAccessEntry::DisallowSubdomains);
         EXPECT_EQ(test.isIPAddress, entry.hostIsIPAddress()) << test.host;
     }
-
-    Platform::shutdown();
 }
 
 TEST(OriginAccessEntryTest, IPAddressMatchingTest)
@@ -300,7 +300,6 @@
 
     OriginAccessEntryTestPlatform platform;
     platform.setPublicSuffix("com");
-    Platform::initialize(&platform);
 
     for (const auto& test : inputs) {
         SCOPED_TRACE(testing::Message() << "Host: " << test.host << ", Origin: " << test.origin);
@@ -311,8 +310,6 @@
         OriginAccessEntry entry2(test.protocol, test.host, OriginAccessEntry::DisallowSubdomains);
         EXPECT_EQ(test.expected, entry2.matchesOrigin(*originToTest));
     }
-
-    Platform::shutdown();
 }
 
 } // namespace blink
diff --git a/third_party/WebKit/Source/web/BUILD.gn b/third_party/WebKit/Source/web/BUILD.gn
index 8eb1f1a..779c6339 100644
--- a/third_party/WebKit/Source/web/BUILD.gn
+++ b/third_party/WebKit/Source/web/BUILD.gn
@@ -16,9 +16,6 @@
                        "scope",
                        [ "web.gypi" ])
 web_unittest_files = web_gypi.web_unittest_files
-if (!is_mac) {
-  web_unittest_files += [ "tests/ScrollAnimatorTest.cpp" ]
-}
 
 component("web") {
   output_name = "blink_web"
diff --git a/third_party/WebKit/Source/web/WebAXObject.cpp b/third_party/WebKit/Source/web/WebAXObject.cpp
index f9aeac1..3f775e5 100644
--- a/third_party/WebKit/Source/web/WebAXObject.cpp
+++ b/third_party/WebKit/Source/web/WebAXObject.cpp
@@ -992,126 +992,12 @@
     return m_private->url();
 }
 
-WebString WebAXObject::deprecatedAccessibilityDescription() const
-{
-    if (isDetached())
-        return WebString();
-
-    ASSERT(isLayoutClean(m_private->document()));
-
-    return m_private->deprecatedAccessibilityDescription();
-}
-
-bool WebAXObject::deprecatedAriaDescribedby(WebVector<WebAXObject>& describedbyElements) const
-{
-    if (isDetached())
-        return false;
-
-    AXObject::AXObjectVector describedby;
-    m_private->deprecatedAriaDescribedbyElements(describedby);
-
-    WebVector<WebAXObject> result(describedby.size());
-    for (size_t i = 0; i < describedby.size(); i++)
-        result[i] = WebAXObject(describedby[i]);
-    describedbyElements.swap(result);
-
-    return true;
-}
-
-bool WebAXObject::deprecatedAriaLabelledby(WebVector<WebAXObject>& labelledbyElements) const
-{
-    if (isDetached())
-        return false;
-
-    AXObject::AXObjectVector labelledby;
-    m_private->deprecatedAriaLabelledbyElements(labelledby);
-
-    WebVector<WebAXObject> result(labelledby.size());
-    for (size_t i = 0; i < labelledby.size(); i++)
-        result[i] = WebAXObject(labelledby[i]);
-    labelledbyElements.swap(result);
-
-    return true;
-}
-
-WebString WebAXObject::deprecatedHelpText() const
-{
-    if (isDetached())
-        return WebString();
-
-    return m_private->deprecatedHelpText();
-}
-
-WebString WebAXObject::deprecatedPlaceholder() const
-{
-    if (isDetached())
-        return WebString();
-
-    return WebString(m_private->deprecatedPlaceholder());
-}
-
-WebString WebAXObject::deprecatedTitle() const
-{
-    if (isDetached())
-        return WebString();
-
-    ASSERT(isLayoutClean(m_private->document()));
-
-    return m_private->deprecatedTitle();
-}
-
-WebAXObject WebAXObject::deprecatedTitleUIElement() const
-{
-    if (isDetached())
-        return WebAXObject();
-
-    if (!m_private->deprecatedExposesTitleUIElement())
-        return WebAXObject();
-
-    return WebAXObject(m_private->deprecatedTitleUIElement());
-}
-
-WebString WebAXObject::accessibilityDescription() const
-{
-    return deprecatedAccessibilityDescription();
-}
-
-bool WebAXObject::ariaDescribedby(WebVector<WebAXObject>& describedbyElements) const
-{
-    return deprecatedAriaDescribedby(describedbyElements);
-}
-
-bool WebAXObject::ariaLabelledby(WebVector<WebAXObject>& labelledbyElements) const
-{
-    return deprecatedAriaLabelledby(labelledbyElements);
-}
-
-WebString WebAXObject::helpText() const
-{
-    return deprecatedHelpText();
-}
-
-WebString WebAXObject::placeholder() const
-{
-    return deprecatedPlaceholder();
-}
-
-WebString WebAXObject::title() const
-{
-    return deprecatedTitle();
-}
-
-WebAXObject WebAXObject::titleUIElement() const
-{
-    return deprecatedTitleUIElement();
-}
-
 WebString WebAXObject::name(WebAXNameFrom& outNameFrom, WebVector<WebAXObject>& outNameObjects) const
 {
     if (isDetached())
         return WebString();
 
-    AXNameFrom nameFrom = AXNameFromAttribute;
+    AXNameFrom nameFrom = AXNameFromUninitialized;
     HeapVector<Member<AXObject>> nameObjects;
     WebString result = m_private->name(nameFrom, &nameObjects);
     outNameFrom = static_cast<WebAXNameFrom>(nameFrom);
@@ -1124,12 +1010,22 @@
     return result;
 }
 
+WebString WebAXObject::name() const
+{
+    if (isDetached())
+        return WebString();
+
+    AXNameFrom nameFrom;
+    HeapVector<Member<AXObject>> nameObjects;
+    return m_private->name(nameFrom, &nameObjects);
+}
+
 WebString WebAXObject::description(WebAXNameFrom nameFrom, WebAXDescriptionFrom& outDescriptionFrom, WebVector<WebAXObject>& outDescriptionObjects) const
 {
     if (isDetached())
         return WebString();
 
-    AXDescriptionFrom descriptionFrom;
+    AXDescriptionFrom descriptionFrom = AXDescriptionFromUninitialized;
     HeapVector<Member<AXObject>> descriptionObjects;
     String result = m_private->description(static_cast<AXNameFrom>(nameFrom), descriptionFrom, &descriptionObjects);
     outDescriptionFrom = static_cast<WebAXDescriptionFrom>(descriptionFrom);
diff --git a/third_party/WebKit/Source/web/WebTextAreaElement.cpp b/third_party/WebKit/Source/web/WebTextAreaElement.cpp
deleted file mode 100644
index ad1e4fc..0000000
--- a/third_party/WebKit/Source/web/WebTextAreaElement.cpp
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "public/web/WebTextAreaElement.h"
-
-#include "core/HTMLNames.h"
-#include "core/html/HTMLTextAreaElement.h"
-#include "public/platform/WebString.h"
-#include "wtf/PassRefPtr.h"
-
-namespace blink {
-
-WebTextAreaElement::WebTextAreaElement(const PassRefPtrWillBeRawPtr<HTMLTextAreaElement>& element)
-    : WebFormControlElement(element)
-{
-}
-
-DEFINE_WEB_NODE_TYPE_CASTS(WebTextAreaElement, isHTMLTextAreaElement(constUnwrap<Node>()));
-
-WebTextAreaElement& WebTextAreaElement::operator=(const PassRefPtrWillBeRawPtr<HTMLTextAreaElement>& element)
-{
-    m_private = element;
-    return *this;
-}
-
-WebTextAreaElement::operator PassRefPtrWillBeRawPtr<HTMLTextAreaElement>() const
-{
-    return toHTMLTextAreaElement(m_private.get());
-}
-
-} // namespace blink
diff --git a/third_party/WebKit/Source/web/tests/VisualViewportTest.cpp b/third_party/WebKit/Source/web/tests/VisualViewportTest.cpp
index 6781d0b1..17e046a 100644
--- a/third_party/WebKit/Source/web/tests/VisualViewportTest.cpp
+++ b/third_party/WebKit/Source/web/tests/VisualViewportTest.cpp
@@ -1509,7 +1509,9 @@
     // Because of where the visual viewport is located, this should hit the bottom right
     // target (target 4).
     WebAXObject hitNode = webDoc.accessibilityObject().hitTest(WebPoint(154, 165));
-    EXPECT_EQ(std::string("Target4"), hitNode.title().utf8());
+    WebAXNameFrom nameFrom;
+    WebVector<WebAXObject> nameObjects;
+    EXPECT_EQ(std::string("Target4"), hitNode.name(nameFrom, nameObjects).utf8());
 }
 
 // Tests that the maximum scroll offset of the viewport can be fractional.
diff --git a/third_party/WebKit/Source/web/web.gypi b/third_party/WebKit/Source/web/web.gypi
index ea6eaaa1..9c003647 100644
--- a/third_party/WebKit/Source/web/web.gypi
+++ b/third_party/WebKit/Source/web/web.gypi
@@ -219,7 +219,6 @@
       'WebSpeechRecognitionResult.cpp',
       'WebStorageEventDispatcherImpl.cpp',
       'WebSurroundingText.cpp',
-      'WebTextAreaElement.cpp',
       'WebTextCheckingCompletionImpl.cpp',
       'WebTextCheckingCompletionImpl.h',
       'WebTextCheckingResult.cpp',
@@ -313,15 +312,5 @@
       'tests/sim/SimWebViewClient.cpp',
       'tests/sim/SimWebViewClient.h',
     ],
-    'conditions': [
-      ['OS!="mac"',
-        {
-          'web_unittest_files': [
-            # Mac uses ScrollAnimatorMac instead of ScrollAnimator.
-            'tests/ScrollAnimatorTest.cpp',
-          ],
-        }
-      ],
-    ],
   },
 }
diff --git a/third_party/WebKit/Source/wtf/ASCIICTypeTest.cpp b/third_party/WebKit/Source/wtf/ASCIICTypeTest.cpp
index 5904ba1..4947982 100644
--- a/third_party/WebKit/Source/wtf/ASCIICTypeTest.cpp
+++ b/third_party/WebKit/Source/wtf/ASCIICTypeTest.cpp
@@ -5,7 +5,7 @@
 #include "config.h"
 #include "wtf/ASCIICType.h"
 
-#include <gtest/gtest.h>
+#include "testing/gtest/include/gtest/gtest.h"
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/ArrayBufferBuilderTest.cpp b/third_party/WebKit/Source/wtf/ArrayBufferBuilderTest.cpp
index a877fd9..a12301e 100644
--- a/third_party/WebKit/Source/wtf/ArrayBufferBuilderTest.cpp
+++ b/third_party/WebKit/Source/wtf/ArrayBufferBuilderTest.cpp
@@ -31,8 +31,8 @@
 #include "config.h"
 #include "wtf/ArrayBufferBuilder.h"
 
+#include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/Assertions.h"
-#include <gtest/gtest.h>
 #include <limits.h>
 #include <string.h>
 
diff --git a/third_party/WebKit/Source/wtf/AssertionsTest.cpp b/third_party/WebKit/Source/wtf/AssertionsTest.cpp
index 6614a83..e00dae0 100644
--- a/third_party/WebKit/Source/wtf/AssertionsTest.cpp
+++ b/third_party/WebKit/Source/wtf/AssertionsTest.cpp
@@ -7,9 +7,8 @@
 #include "config.h"
 #include "wtf/Assertions.h"
 
+#include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/text/StringBuilder.h"
-
-#include <gtest/gtest.h>
 #include <stdio.h>
 
 namespace WTF {
diff --git a/third_party/WebKit/Source/wtf/CheckedArithmeticTest.cpp b/third_party/WebKit/Source/wtf/CheckedArithmeticTest.cpp
index d10572e..f8edb1d 100644
--- a/third_party/WebKit/Source/wtf/CheckedArithmeticTest.cpp
+++ b/third_party/WebKit/Source/wtf/CheckedArithmeticTest.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "wtf/CheckedArithmetic.h"
 
-#include <gtest/gtest.h>
+#include "testing/gtest/include/gtest/gtest.h"
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/DequeTest.cpp b/third_party/WebKit/Source/wtf/DequeTest.cpp
index 3c66d31..c00874255 100644
--- a/third_party/WebKit/Source/wtf/DequeTest.cpp
+++ b/third_party/WebKit/Source/wtf/DequeTest.cpp
@@ -26,10 +26,10 @@
 #include "config.h"
 #include "wtf/Deque.h"
 
+#include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/HashSet.h"
 #include "wtf/OwnPtr.h"
 #include "wtf/PassOwnPtr.h"
-#include <gtest/gtest.h>
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/FunctionalTest.cpp b/third_party/WebKit/Source/wtf/FunctionalTest.cpp
index c5e8fec..15af8e5 100644
--- a/third_party/WebKit/Source/wtf/FunctionalTest.cpp
+++ b/third_party/WebKit/Source/wtf/FunctionalTest.cpp
@@ -26,9 +26,9 @@
 #include "config.h"
 #include "wtf/Functional.h"
 
+#include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/OwnPtr.h"
 #include "wtf/RefCounted.h"
-#include <gtest/gtest.h>
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/HashMapTest.cpp b/third_party/WebKit/Source/wtf/HashMapTest.cpp
index cbdbca6..faa61e2 100644
--- a/third_party/WebKit/Source/wtf/HashMapTest.cpp
+++ b/third_party/WebKit/Source/wtf/HashMapTest.cpp
@@ -26,12 +26,12 @@
 #include "config.h"
 #include "wtf/HashMap.h"
 
+#include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/OwnPtr.h"
 #include "wtf/PassOwnPtr.h"
 #include "wtf/PassRefPtr.h"
 #include "wtf/RefCounted.h"
 #include "wtf/Vector.h"
-#include <gtest/gtest.h>
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/HashSetTest.cpp b/third_party/WebKit/Source/wtf/HashSetTest.cpp
index b6c753b..d402252 100644
--- a/third_party/WebKit/Source/wtf/HashSetTest.cpp
+++ b/third_party/WebKit/Source/wtf/HashSetTest.cpp
@@ -26,10 +26,10 @@
 #include "config.h"
 #include "wtf/HashSet.h"
 
+#include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/OwnPtr.h"
 #include "wtf/PassOwnPtr.h"
 #include "wtf/RefCounted.h"
-#include <gtest/gtest.h>
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/ListHashSetTest.cpp b/third_party/WebKit/Source/wtf/ListHashSetTest.cpp
index 12779f3..0db4d0a0 100644
--- a/third_party/WebKit/Source/wtf/ListHashSetTest.cpp
+++ b/third_party/WebKit/Source/wtf/ListHashSetTest.cpp
@@ -26,11 +26,11 @@
 #include "config.h"
 #include "wtf/ListHashSet.h"
 
+#include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/LinkedHashSet.h"
 #include "wtf/PassRefPtr.h"
 #include "wtf/RefCounted.h"
 #include "wtf/RefPtr.h"
-#include <gtest/gtest.h>
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/MathExtrasTest.cpp b/third_party/WebKit/Source/wtf/MathExtrasTest.cpp
index 616e4b78..2600450 100644
--- a/third_party/WebKit/Source/wtf/MathExtrasTest.cpp
+++ b/third_party/WebKit/Source/wtf/MathExtrasTest.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "wtf/MathExtras.h"
 
-#include <gtest/gtest.h>
+#include "testing/gtest/include/gtest/gtest.h"
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/OptionalTest.cpp b/third_party/WebKit/Source/wtf/OptionalTest.cpp
index 7974637..903eff6 100644
--- a/third_party/WebKit/Source/wtf/OptionalTest.cpp
+++ b/third_party/WebKit/Source/wtf/OptionalTest.cpp
@@ -5,7 +5,7 @@
 #include "config.h"
 #include "wtf/Optional.h"
 
-#include <gtest/gtest.h>
+#include "testing/gtest/include/gtest/gtest.h"
 
 namespace WTF {
 namespace {
diff --git a/third_party/WebKit/Source/wtf/PartitionAllocTest.cpp b/third_party/WebKit/Source/wtf/PartitionAllocTest.cpp
index 996c085d..77b1bf1 100644
--- a/third_party/WebKit/Source/wtf/PartitionAllocTest.cpp
+++ b/third_party/WebKit/Source/wtf/PartitionAllocTest.cpp
@@ -31,12 +31,12 @@
 #include "config.h"
 #include "wtf/PartitionAlloc.h"
 
+#include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/BitwiseOperations.h"
 #include "wtf/CPU.h"
 #include "wtf/OwnPtr.h"
 #include "wtf/PassOwnPtr.h"
 #include "wtf/Vector.h"
-#include <gtest/gtest.h>
 #include <stdlib.h>
 #include <string.h>
 
diff --git a/third_party/WebKit/Source/wtf/RefPtrTest.cpp b/third_party/WebKit/Source/wtf/RefPtrTest.cpp
index d0d9fed8..102105f 100644
--- a/third_party/WebKit/Source/wtf/RefPtrTest.cpp
+++ b/third_party/WebKit/Source/wtf/RefPtrTest.cpp
@@ -5,8 +5,8 @@
 #include "config.h"
 #include "wtf/RefPtr.h"
 
+#include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/text/StringImpl.h"
-#include <gtest/gtest.h>
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/SaturatedArithmeticTest.cpp b/third_party/WebKit/Source/wtf/SaturatedArithmeticTest.cpp
index 6a8cee5..1f96e745 100644
--- a/third_party/WebKit/Source/wtf/SaturatedArithmeticTest.cpp
+++ b/third_party/WebKit/Source/wtf/SaturatedArithmeticTest.cpp
@@ -31,7 +31,7 @@
 #include "config.h"
 #include "wtf/SaturatedArithmetic.h"
 
-#include <gtest/gtest.h>
+#include "testing/gtest/include/gtest/gtest.h"
 #include <limits.h>
 
 namespace WTF {
diff --git a/third_party/WebKit/Source/wtf/StringExtrasTest.cpp b/third_party/WebKit/Source/wtf/StringExtrasTest.cpp
index 5c9e0b1..5db8eaf 100644
--- a/third_party/WebKit/Source/wtf/StringExtrasTest.cpp
+++ b/third_party/WebKit/Source/wtf/StringExtrasTest.cpp
@@ -26,9 +26,9 @@
 #include "config.h"
 #include "wtf/StringExtras.h"
 
+#include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/text/CString.h"
 #include "wtf/text/WTFString.h"
-#include <gtest/gtest.h>
 #include <limits>
 
 namespace WTF {
diff --git a/third_party/WebKit/Source/wtf/StringHasherTest.cpp b/third_party/WebKit/Source/wtf/StringHasherTest.cpp
index 2b7f759..b71aae4 100644
--- a/third_party/WebKit/Source/wtf/StringHasherTest.cpp
+++ b/third_party/WebKit/Source/wtf/StringHasherTest.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "wtf/StringHasher.h"
 
-#include <gtest/gtest.h>
+#include "testing/gtest/include/gtest/gtest.h"
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/TemporaryChangeTest.cpp b/third_party/WebKit/Source/wtf/TemporaryChangeTest.cpp
index b1191ce..e2beff7 100644
--- a/third_party/WebKit/Source/wtf/TemporaryChangeTest.cpp
+++ b/third_party/WebKit/Source/wtf/TemporaryChangeTest.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "wtf/TemporaryChange.h"
 
-#include <gtest/gtest.h>
+#include "testing/gtest/include/gtest/gtest.h"
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/TreeNodeTest.cpp b/third_party/WebKit/Source/wtf/TreeNodeTest.cpp
index b42758e..80f4f3e5 100644
--- a/third_party/WebKit/Source/wtf/TreeNodeTest.cpp
+++ b/third_party/WebKit/Source/wtf/TreeNodeTest.cpp
@@ -26,10 +26,10 @@
 #include "config.h"
 #include "wtf/TreeNode.h"
 
+#include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/PassRefPtr.h"
 #include "wtf/RefCounted.h"
 #include "wtf/RefPtr.h"
-#include <gtest/gtest.h>
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/VectorTest.cpp b/third_party/WebKit/Source/wtf/VectorTest.cpp
index 89f4eb1..df283acd 100644
--- a/third_party/WebKit/Source/wtf/VectorTest.cpp
+++ b/third_party/WebKit/Source/wtf/VectorTest.cpp
@@ -26,11 +26,11 @@
 #include "config.h"
 #include "wtf/Vector.h"
 
+#include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/HashSet.h"
 #include "wtf/OwnPtr.h"
 #include "wtf/PassOwnPtr.h"
 #include "wtf/text/WTFString.h"
-#include <gtest/gtest.h>
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/dtoa_test.cpp b/third_party/WebKit/Source/wtf/dtoa_test.cpp
index 6fc078ec..6180b5cd0 100644
--- a/third_party/WebKit/Source/wtf/dtoa_test.cpp
+++ b/third_party/WebKit/Source/wtf/dtoa_test.cpp
@@ -5,7 +5,7 @@
 #include "config.h"
 #include "wtf/dtoa.h"
 
-#include <gtest/gtest.h>
+#include "testing/gtest/include/gtest/gtest.h"
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/testing/WTFTestPrintersTest.cpp b/third_party/WebKit/Source/wtf/testing/WTFTestPrintersTest.cpp
index 0077e7b6..9e8789c 100644
--- a/third_party/WebKit/Source/wtf/testing/WTFTestPrintersTest.cpp
+++ b/third_party/WebKit/Source/wtf/testing/WTFTestPrintersTest.cpp
@@ -30,10 +30,10 @@
 
 #include "config.h"
 
+#include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/StdLibExtras.h"
 #include "wtf/text/CString.h"
 #include "wtf/text/WTFString.h"
-#include <gtest/gtest.h>
 #include <sstream>
 #include <string>
 
diff --git a/third_party/WebKit/Source/wtf/text/AtomicStringTest.cpp b/third_party/WebKit/Source/wtf/text/AtomicStringTest.cpp
index 82c8691..4d87b8bf 100644
--- a/third_party/WebKit/Source/wtf/text/AtomicStringTest.cpp
+++ b/third_party/WebKit/Source/wtf/text/AtomicStringTest.cpp
@@ -29,9 +29,9 @@
  */
 
 #include "config.h"
-#include "AtomicString.h"
+#include "wtf/text/AtomicString.h"
 
-#include <gtest/gtest.h>
+#include "testing/gtest/include/gtest/gtest.h"
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/text/CStringTest.cpp b/third_party/WebKit/Source/wtf/text/CStringTest.cpp
index 087cbb6..fc8337a 100644
--- a/third_party/WebKit/Source/wtf/text/CStringTest.cpp
+++ b/third_party/WebKit/Source/wtf/text/CStringTest.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "wtf/text/CString.h"
 
-#include <gtest/gtest.h>
+#include "testing/gtest/include/gtest/gtest.h"
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/text/StringBufferTest.cpp b/third_party/WebKit/Source/wtf/text/StringBufferTest.cpp
index cf3775d7..7266db5 100644
--- a/third_party/WebKit/Source/wtf/text/StringBufferTest.cpp
+++ b/third_party/WebKit/Source/wtf/text/StringBufferTest.cpp
@@ -7,7 +7,7 @@
 #include "config.h"
 #include "wtf/text/StringBuffer.h"
 
-#include <gtest/gtest.h>
+#include "testing/gtest/include/gtest/gtest.h"
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/text/StringBuilderTest.cpp b/third_party/WebKit/Source/wtf/text/StringBuilderTest.cpp
index 64ef66c5..5f2e4e03 100644
--- a/third_party/WebKit/Source/wtf/text/StringBuilderTest.cpp
+++ b/third_party/WebKit/Source/wtf/text/StringBuilderTest.cpp
@@ -32,11 +32,11 @@
 #include "config.h"
 #include "wtf/text/StringBuilder.h"
 
+#include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/Assertions.h"
 #include "wtf/text/CString.h"
 #include "wtf/text/CharacterNames.h"
 #include "wtf/text/WTFString.h"
-#include <gtest/gtest.h>
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/text/StringImplTest.cpp b/third_party/WebKit/Source/wtf/text/StringImplTest.cpp
index 3173da6..c528134 100644
--- a/third_party/WebKit/Source/wtf/text/StringImplTest.cpp
+++ b/third_party/WebKit/Source/wtf/text/StringImplTest.cpp
@@ -26,8 +26,8 @@
 #include "config.h"
 #include "wtf/text/StringImpl.h"
 
+#include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/text/WTFString.h"
-#include <gtest/gtest.h>
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/text/StringOperatorsTest.cpp b/third_party/WebKit/Source/wtf/text/StringOperatorsTest.cpp
index efa0996..467062cb 100644
--- a/third_party/WebKit/Source/wtf/text/StringOperatorsTest.cpp
+++ b/third_party/WebKit/Source/wtf/text/StringOperatorsTest.cpp
@@ -29,8 +29,8 @@
 
 static int wtfStringCopyCount;
 
+#include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/text/WTFString.h"
-#include <gtest/gtest.h>
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/text/TextCodecReplacementTest.cpp b/third_party/WebKit/Source/wtf/text/TextCodecReplacementTest.cpp
index 6d3d1a69..bc4d3e7 100644
--- a/third_party/WebKit/Source/wtf/text/TextCodecReplacementTest.cpp
+++ b/third_party/WebKit/Source/wtf/text/TextCodecReplacementTest.cpp
@@ -3,16 +3,15 @@
 // found in the LICENSE file.
 
 #include "config.h"
-
 #include "wtf/text/TextCodecReplacement.h"
 
+#include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/OwnPtr.h"
 #include "wtf/text/CString.h"
 #include "wtf/text/TextCodec.h"
 #include "wtf/text/TextEncoding.h"
 #include "wtf/text/TextEncodingRegistry.h"
 #include "wtf/text/WTFString.h"
-#include <gtest/gtest.h>
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/text/TextCodecUTF8Test.cpp b/third_party/WebKit/Source/wtf/text/TextCodecUTF8Test.cpp
index 54f6a0f..56dcb66 100644
--- a/third_party/WebKit/Source/wtf/text/TextCodecUTF8Test.cpp
+++ b/third_party/WebKit/Source/wtf/text/TextCodecUTF8Test.cpp
@@ -29,15 +29,14 @@
  */
 
 #include "config.h"
-
 #include "wtf/text/TextCodecUTF8.h"
 
+#include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/OwnPtr.h"
 #include "wtf/text/TextCodec.h"
 #include "wtf/text/TextEncoding.h"
 #include "wtf/text/TextEncodingRegistry.h"
 #include "wtf/text/WTFString.h"
-#include <gtest/gtest.h>
 
 namespace WTF {
 
diff --git a/third_party/WebKit/Source/wtf/text/WTFStringTest.cpp b/third_party/WebKit/Source/wtf/text/WTFStringTest.cpp
index 66cf637..466505a 100644
--- a/third_party/WebKit/Source/wtf/text/WTFStringTest.cpp
+++ b/third_party/WebKit/Source/wtf/text/WTFStringTest.cpp
@@ -26,9 +26,9 @@
 #include "config.h"
 #include "wtf/text/WTFString.h"
 
+#include "testing/gtest/include/gtest/gtest.h"
 #include "wtf/MathExtras.h"
 #include "wtf/text/CString.h"
-#include <gtest/gtest.h>
 #include <limits>
 
 namespace WTF {
diff --git a/third_party/WebKit/public/blink_headers.gypi b/third_party/WebKit/public/blink_headers.gypi
index a3747be..1385663 100644
--- a/third_party/WebKit/public/blink_headers.gypi
+++ b/third_party/WebKit/public/blink_headers.gypi
@@ -481,7 +481,6 @@
       "web/WebTestInterfaceFactory.h",
       "web/WebTestingSupport.h",
       "web/WebTextAffinity.h",
-      "web/WebTextAreaElement.h",
       "web/WebTextCheckingCompletion.h",
       "web/WebTextCheckingResult.h",
       "web/WebTextCheckingType.h",
diff --git a/third_party/WebKit/public/platform/WebContentLayer.h b/third_party/WebKit/public/platform/WebContentLayer.h
index fd60d39..f6b82540 100644
--- a/third_party/WebKit/public/platform/WebContentLayer.h
+++ b/third_party/WebKit/public/platform/WebContentLayer.h
@@ -37,15 +37,6 @@
 
     // The WebContentLayer has ownership of this wrapper.
     virtual WebLayer* layer() = 0;
-
-    // Set to true if the backside of this layer's contents should be visible when composited.
-    // Defaults to false.
-    virtual void setDoubleSided(bool) {}
-
-    // Allow the compositor to determine the scale at which the layer should
-    // be rasterized based on the layer's hierarchy and transform. This defaults
-    // to false.
-    virtual void setAutomaticallyComputeRasterScale(bool) { }
 };
 
 } // namespace blink
diff --git a/third_party/WebKit/public/platform/WebLayer.h b/third_party/WebKit/public/platform/WebLayer.h
index 83089ca..b0ebba5 100644
--- a/third_party/WebKit/public/platform/WebLayer.h
+++ b/third_party/WebKit/public/platform/WebLayer.h
@@ -104,6 +104,10 @@
     virtual void setDrawsContent(bool) = 0;
     virtual bool drawsContent() const = 0;
 
+    // Set to true if the backside of this layer's contents should be visible
+    // when composited. Defaults to false.
+    virtual void setDoubleSided(bool) = 0;
+
     // Sets whether the layer's transform should be flattened.
     virtual void setShouldFlattenTransform(bool) = 0;
 
diff --git a/third_party/WebKit/public/web/WebAXObject.h b/third_party/WebKit/public/web/WebAXObject.h
index ee400f2..c60ec87 100644
--- a/third_party/WebKit/public/web/WebAXObject.h
+++ b/third_party/WebKit/public/web/WebAXObject.h
@@ -162,31 +162,11 @@
     BLINK_EXPORT WebAXTextStyle textStyle() const;
     BLINK_EXPORT WebURL url() const;
 
-    // Deprecated text alternative calculation API. All of these will be replaced
-    // with the new API, below (under "New text alternative calculation API".
-    BLINK_EXPORT WebString deprecatedAccessibilityDescription() const;
-    BLINK_EXPORT bool deprecatedAriaDescribedby(WebVector<WebAXObject>& describedbyElements) const;
-    BLINK_EXPORT bool deprecatedAriaLabelledby(WebVector<WebAXObject>& labelledbyElements) const;
-    BLINK_EXPORT WebString deprecatedHelpText() const;
-    BLINK_EXPORT WebString deprecatedPlaceholder() const;
-    BLINK_EXPORT WebString deprecatedTitle() const;
-    BLINK_EXPORT WebAXObject deprecatedTitleUIElement() const;
-
-    // FIXME(dmazzoni): remove these ASAP once Chromium only calls either explicitly-deprecated
-    // functions, above, or the new APIs, below.
-    BLINK_EXPORT WebString accessibilityDescription() const;
-    BLINK_EXPORT bool ariaDescribedby(WebVector<WebAXObject>& describedbyElements) const;
-    BLINK_EXPORT bool ariaLabelledby(WebVector<WebAXObject>& labelledbyElements) const;
-    BLINK_EXPORT WebString helpText() const;
-    BLINK_EXPORT WebString placeholder() const;
-    BLINK_EXPORT WebString title() const;
-    BLINK_EXPORT WebAXObject titleUIElement() const;
-
-    // New text alternative calculation API (under development).
-
     // Retrieves the accessible name of the object, an enum indicating where the name
     // was derived from, and a list of related objects that were used to derive the name, if any.
     BLINK_EXPORT WebString name(WebAXNameFrom&, WebVector<WebAXObject>& nameObjects) const;
+    // Simplified version of |name| when nameFrom and nameObjects aren't needed.
+    BLINK_EXPORT WebString name() const;
     // Takes the result of nameFrom from calling |name|, above, and retrieves the
     // accessible description of the object, which is secondary to |name|, an enum indicating
     // where the description was derived from, and a list of objects that were used to
diff --git a/third_party/WebKit/public/web/WebTextAreaElement.h b/third_party/WebKit/public/web/WebTextAreaElement.h
deleted file mode 100644
index 83c543e..0000000
--- a/third_party/WebKit/public/web/WebTextAreaElement.h
+++ /dev/null
@@ -1,64 +0,0 @@
-/*
- * Copyright (C) 2013 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef WebTextAreaElement_h
-#define WebTextAreaElement_h
-
-#include "WebFormControlElement.h"
-
-namespace blink {
-
-class HTMLTextAreaElement;
-
-// Provides access to some properties of a DOM textarea element node.
-class WebTextAreaElement final : public WebFormControlElement {
-public:
-    WebTextAreaElement() : WebFormControlElement() { }
-    WebTextAreaElement(const WebTextAreaElement& element) : WebFormControlElement(element) { }
-
-    WebTextAreaElement& operator=(const WebTextAreaElement& element)
-    {
-        WebFormControlElement::assign(element);
-        return *this;
-    }
-    void assign(const WebTextAreaElement& element) { WebFormControlElement::assign(element); }
-
-#if BLINK_IMPLEMENTATION
-    WebTextAreaElement(const PassRefPtrWillBeRawPtr<HTMLTextAreaElement>&);
-    WebTextAreaElement& operator=(const PassRefPtrWillBeRawPtr<HTMLTextAreaElement>&);
-    operator PassRefPtrWillBeRawPtr<HTMLTextAreaElement>() const;
-#endif
-};
-
-DECLARE_WEB_NODE_TYPE_CASTS(WebTextAreaElement);
-
-} // namespace blink
-
-#endif
diff --git a/third_party/closure_compiler/externs/networking_private.js b/third_party/closure_compiler/externs/networking_private.js
index aebf7f9..e190d47 100644
--- a/third_party/closure_compiler/externs/networking_private.js
+++ b/third_party/closure_compiler/externs/networking_private.js
@@ -58,6 +58,7 @@
   DISABLED: 'Disabled',
   ENABLING: 'Enabling',
   ENABLED: 'Enabled',
+  PROHIBITED: 'Prohibited',
 };
 
 /**
diff --git a/third_party/drmemory/README.chromium b/third_party/drmemory/README.chromium
index cc2f79c..2eb6bb4 100644
--- a/third_party/drmemory/README.chromium
+++ b/third_party/drmemory/README.chromium
@@ -1,7 +1,7 @@
 Name: Dr. Memory
 Short Name: drmemory
 URL: http://drmemory.org
-Version: 1.8.16724
+Version: 1.8.16756
 License: LGPL 2.1
 License File: NOT_SHIPPED
 Security Critical: no
diff --git a/third_party/drmemory/drmemory-windows-sfx.exe.sha1 b/third_party/drmemory/drmemory-windows-sfx.exe.sha1
index 682d504b..8471f83 100644
--- a/third_party/drmemory/drmemory-windows-sfx.exe.sha1
+++ b/third_party/drmemory/drmemory-windows-sfx.exe.sha1
@@ -1 +1 @@
-a7616bf2ecca0916dfd3ca2a9ab240dc201a6b9c
\ No newline at end of file
+b00700434ed74af32d3c3f8f2e76db21fcb5ff6d
\ No newline at end of file
diff --git a/third_party/libjingle/README.chromium b/third_party/libjingle/README.chromium
index 9ee3b5d..0a60e04 100644
--- a/third_party/libjingle/README.chromium
+++ b/third_party/libjingle/README.chromium
@@ -1,7 +1,7 @@
 Name: libjingle
 URL: http://www.webrtc.org
 Version: unknown
-Revision: 10659
+Revision: 10671
 License: BSD
 License File: source/talk/COPYING
 Security Critical: yes
diff --git a/third_party/mojo/mojo_public.gyp b/third_party/mojo/mojo_public.gyp
index 62991f92..5174838 100644
--- a/third_party/mojo/mojo_public.gyp
+++ b/third_party/mojo/mojo_public.gyp
@@ -120,6 +120,7 @@
         '../../mojo/public/cpp/bindings/lib/filter_chain.cc',
         '../../mojo/public/cpp/bindings/lib/filter_chain.h',
         '../../mojo/public/cpp/bindings/lib/fixed_buffer.cc',
+        '../../mojo/public/cpp/bindings/lib/interface_id.h',
         '../../mojo/public/cpp/bindings/lib/fixed_buffer.h',
         '../../mojo/public/cpp/bindings/lib/interface_ptr_internal.h',
         '../../mojo/public/cpp/bindings/lib/map_data_internal.h',
@@ -133,6 +134,11 @@
         '../../mojo/public/cpp/bindings/lib/message_header_validator.h',
         '../../mojo/public/cpp/bindings/lib/message_internal.h',
         '../../mojo/public/cpp/bindings/lib/no_interface.cc',
+        '../../mojo/public/cpp/bindings/lib/pipe_control_message_handler.cc',
+        '../../mojo/public/cpp/bindings/lib/pipe_control_message_handler.h',
+        '../../mojo/public/cpp/bindings/lib/pipe_control_message_handler_delegate.h',
+        '../../mojo/public/cpp/bindings/lib/pipe_control_message_proxy.cc',
+        '../../mojo/public/cpp/bindings/lib/pipe_control_message_proxy.h',
         '../../mojo/public/cpp/bindings/lib/router.cc',
         '../../mojo/public/cpp/bindings/lib/router.h',
         '../../mojo/public/cpp/bindings/lib/shared_data.h',
@@ -238,6 +244,7 @@
         'require_interface_bindings': 0,
         'mojom_files': [
           '../../mojo/public/interfaces/bindings/interface_control_messages.mojom',
+          '../../mojo/public/interfaces/bindings/pipe_control_messages.mojom',
         ],
       },
       'includes': [ 'mojom_bindings_generator_explicit.gypi' ],
diff --git a/tools/android/eclipse/.classpath b/tools/android/eclipse/.classpath
index f218445..6b98bc7 100644
--- a/tools/android/eclipse/.classpath
+++ b/tools/android/eclipse/.classpath
@@ -95,6 +95,23 @@
     <classpathentry kind="src" path="out/Debug/android_webview_test_apk/gen"/>
     <classpathentry kind="src" path="out/Debug/chrome_public_apk/gen"/>
     <classpathentry kind="src" path="out/Debug/content_shell_apk/gen"/>
+    <classpathentry kind="src" path="out/Debug/gen/base/base_android_java_enums_srcjar__generate_enum/enums"/>
+    <classpathentry kind="src" path="out/Debug/gen/base/base_multidex_gen__apply_gcc/java_cpp_template"/>
+    <classpathentry kind="src" path="out/Debug/gen/base/base_native_libraries_gen__apply_gcc/java_cpp_template"/>
+    <classpathentry kind="src" path="out/Debug/gen/chrome/android/chrome_android_java_enums_srcjar__generate_enum/enums"/>
+    <classpathentry kind="src" path="out/Debug/gen/chrome/android/chrome_public_apk__native_libraries_java__apply_gcc/java_cpp_template"/>
+    <classpathentry kind="src" path="out/Debug/gen/chrome/android/resource_id_javagen__apply_gcc/java_cpp_template"/>
+    <classpathentry kind="src" path="out/Debug/gen/chrome/content_setting_javagen__generate_enum/enums"/>
+    <classpathentry kind="src" path="out/Debug/gen/chrome/content_settings_type_javagen__generate_enum/enums"/>
+    <classpathentry kind="src" path="out/Debug/gen/chrome/page_info_connection_type_javagen__generate_enum/enums"/>
+    <classpathentry kind="src" path="out/Debug/gen/components/bookmarks/common/android/bookmark_type_javagen__generate_enum/enums"/>
+    <classpathentry kind="src" path="out/Debug/gen/components/dom_distiller/android/dom_distiller_core_font_family_javagen__apply_gcc/java_cpp_template"/>
+    <classpathentry kind="src" path="out/Debug/gen/components/dom_distiller/android/dom_distiller_core_theme_javagen__apply_gcc/java_cpp_template"/>
+    <classpathentry kind="src" path="out/Debug/gen/components/enhanced_bookmarks/enhanced_bookmarks_java_enums_srcjar__generate_enum/enums"/>
+    <classpathentry kind="src" path="out/Debug/gen/components/offline_pages/offline_pages_enums_java__generate_enum/enums"/>
+    <classpathentry kind="src" path="out/Debug/gen/components/omnibox/browser/autocomplete_match_type_javagen__generate_enum/enums"/>
+    <classpathentry kind="src" path="out/Debug/gen/content/browser/accessibility/content_browser_accessibility_java_enums_srcjar__generate_enum/enums"/>
+    <classpathentry kind="src" path="out/Debug/gen/content/public/android/content_public_android_java_enums_srcjar__generate_enum/enums"/>
     <classpathentry kind="src" path="out/Debug/gen/enums/accessibility_java"/>
     <classpathentry kind="src" path="out/Debug/gen/enums/activity_type_ids_java"/>
     <classpathentry kind="src" path="out/Debug/gen/enums/android_resource_type_java"/>
@@ -148,6 +165,10 @@
     <classpathentry kind="src" path="out/Debug/gen/enums/web_input_event_java"/>
     <classpathentry kind="src" path="out/Debug/gen/enums/web_text_input_type"/>
     <classpathentry kind="src" path="out/Debug/gen/enums/window_open_disposition_java"/>
+    <classpathentry kind="src" path="out/Debug/gen/media/base/android/media_java_enums_srcjar__generate_enum/enums"/>
+    <classpathentry kind="src" path="out/Debug/gen/net/android/net_android_java_enums_srcjar__generate_enum/enums"/>
+    <classpathentry kind="src" path="out/Debug/gen/net/android/net_errors_java__apply_gcc/java_cpp_template"/>
+    <classpathentry kind="src" path="out/Debug/gen/sync/android/java_enums__generate_enum/enums"/>
     <classpathentry kind="src" path="out/Debug/gen/templates/base_native_libraries_gen"/>
     <classpathentry kind="src" path="out/Debug/gen/templates/chrome_version_java"/>
     <classpathentry kind="src" path="out/Debug/gen/templates/dom_distiller_core_font_family_java"/>
@@ -155,6 +176,11 @@
     <classpathentry kind="src" path="out/Debug/gen/templates/load_states_list"/>
     <classpathentry kind="src" path="out/Debug/gen/templates/net_errors_java"/>
     <classpathentry kind="src" path="out/Debug/gen/templates/resource_id_java"/>
+    <classpathentry kind="src" path="out/Debug/gen/third_party/WebKit/public/blink_headers_java_enums_srcjar__generate_enum/enums"/>
+    <classpathentry kind="src" path="out/Debug/gen/ui/accessibility/ax_enumerations_srcjar__generate_enum/enums"/>
+    <classpathentry kind="src" path="out/Debug/gen/ui/android/java_enums_srcjar__generate_enum/enums"/>
+    <classpathentry kind="src" path="out/Debug/gen/ui/touch_selection/ui_touch_handle_orientation_srcjar__generate_enum/enums"/>
+    <classpathentry kind="src" path="out/Debug/gen/ui/touch_selection/ui_touch_selection_enums_srcjar__generate_enum/enums"/>
     <classpathentry kind="src" path="out/Debug/java_mojo/device_battery_mojo_bindings/src"/>
     <classpathentry kind="src" path="out/Debug/java_mojo/mojo_public_test_interfaces_mojom/src"/>
     <classpathentry kind="src" path="out/Debug/java_proto/cacheinvalidation_proto_java/src"/>
diff --git a/tools/battor_agent/battor_agent.cc b/tools/battor_agent/battor_agent.cc
index f9ef824c..e90934e 100644
--- a/tools/battor_agent/battor_agent.cc
+++ b/tools/battor_agent/battor_agent.cc
@@ -6,42 +6,130 @@
 
 #include <iostream>
 
+#include "base/bind.h"
 #include "base/callback.h"
-#include "base/memory/scoped_ptr.h"
+#include "base/location.h"
+#include "base/message_loop/message_loop.h"
+#include "base/run_loop.h"
+#include "base/time/time.h"
+#include "device/serial/serial.mojom.h"
 
-using device::serial::ReceiveError;
-using device::serial::SendError;
+namespace {
+
+// Callback for when the connection is opened. If an error occurs, error will be
+// set to BATTOR_ERROR_CONNECTION_FAILED.
+void OnConnectionOpened(battor::BattOrAgent::BattOrError* error,
+                        const base::Closure& callback,
+                        bool success) {
+  *error = success ? battor::BattOrAgent::BATTOR_ERROR_NONE
+                   : battor::BattOrAgent::BATTOR_ERROR_CONNECTION_FAILED;
+  callback.Run();
+}
+
+// Callback for when a command times out. If a timeout occurs, error will be set
+// to BATTOR_ERROR_TIMEOUT.
+void OnTimeout(battor::BattOrAgent::BattOrError* error,
+               const base::Closure& callback) {
+  *error = battor::BattOrAgent::BATTOR_ERROR_TIMEOUT;
+  callback.Run();
+}
+
+// Serial configuration parameters for the BattOr.
+const base::TimeDelta kSerialCommandTimeout = base::TimeDelta::FromSeconds(10);
+const uint32 kBattOrBitrate = 2000000;
+const device::serial::DataBits kBattOrDataBits =
+    device::serial::DATA_BITS_EIGHT;
+const device::serial::ParityBit kBattOrParityBit =
+    device::serial::PARITY_BIT_NONE;
+const device::serial::StopBits kBattOrStopBit = device::serial::STOP_BITS_ONE;
+const bool kBattOrCtsFlowControl = true;
+const bool kBattOrHasCtsFlowControl = true;
+
+}  // namespace
 
 namespace battor {
 
-BattOrAgent::BattOrAgent(const std::string& path) : path_(path) {
-  // TODO(charliea): Open up a serial connection with the BattOr.
-}
-
-BattOrAgent::~BattOrAgent() {
-  // TODO(charliea): Close the serial connection with the BattOr.
-}
+BattOrAgent::BattOrAgent(const std::string& path) : path_(path) {}
+BattOrAgent::~BattOrAgent() {}
 
 BattOrAgent::BattOrError BattOrAgent::StartTracing() {
+  BattOrError error = ConnectIfNeeded();
+  if (error != BATTOR_ERROR_NONE)
+    return error;
+
   // TODO(charliea): Tell the BattOr to start tracing.
   return BATTOR_ERROR_NONE;
 }
 
 BattOrAgent::BattOrError BattOrAgent::StopTracing(std::string* trace_output) {
+  BattOrError error = ConnectIfNeeded();
+  if (error != BATTOR_ERROR_NONE)
+    return error;
+
   // TODO(charliea): Tell the BattOr to stop tracing.
   *trace_output = "battor trace output";
+
+  ResetConnection();
   return BATTOR_ERROR_NONE;
 }
 
 BattOrAgent::BattOrError BattOrAgent::RecordClockSyncMarker(
     const std::string& marker) {
+  BattOrError error = ConnectIfNeeded();
+  if (error != BATTOR_ERROR_NONE)
+    return error;
+
   // TODO(charliea): Tell the BattOr to record the specified clock sync marker.
   return BATTOR_ERROR_NONE;
 }
 
 BattOrAgent::BattOrError BattOrAgent::IssueClockSyncMarker() {
+  BattOrError error = ConnectIfNeeded();
+  if (error != BATTOR_ERROR_NONE)
+    return error;
+
   // TODO(charliea): Tell atrace to issue a clock sync marker.
   return BATTOR_ERROR_NONE;
 }
 
+void BattOrAgent::ResetConnection() {
+  io_handler_ = nullptr;
+}
+
+BattOrAgent::BattOrError BattOrAgent::ConnectIfNeeded() {
+  if (io_handler_)
+    return BATTOR_ERROR_NONE;
+
+  io_handler_ = device::SerialIoHandler::Create(
+      base::MessageLoop::current()->task_runner(),
+      base::MessageLoop::current()->task_runner());
+
+  device::serial::ConnectionOptions options;
+  options.bitrate = kBattOrBitrate;
+  options.data_bits = kBattOrDataBits;
+  options.parity_bit = kBattOrParityBit;
+  options.stop_bits = kBattOrStopBit;
+  options.cts_flow_control = kBattOrCtsFlowControl;
+  options.has_cts_flow_control = kBattOrHasCtsFlowControl;
+
+  BattOrError error;
+  base::RunLoop run_loop;
+  base::MessageLoop::current()->task_runner()->PostDelayedTask(
+      FROM_HERE, base::Bind(&OnTimeout, &error, run_loop.QuitClosure()),
+      kSerialCommandTimeout);
+  io_handler_->Open(path_, options, base::Bind(&OnConnectionOpened, &error,
+                                               run_loop.QuitClosure()));
+  run_loop.Run();
+
+  if (error != BATTOR_ERROR_NONE) {
+    error = BATTOR_ERROR_CONNECTION_FAILED;
+    ResetConnection();
+  }
+
+  // TODO(charliea): Complete the inialization routine by sending the init
+  // message, setting the gain, reading the EEPROM, and setting the sample rate.
+
+  return error;
+}
+
 }  // namespace battor
diff --git a/tools/battor_agent/battor_agent.gyp b/tools/battor_agent/battor_agent.gyp
index 2680def9..cae7218c6 100644
--- a/tools/battor_agent/battor_agent.gyp
+++ b/tools/battor_agent/battor_agent.gyp
@@ -13,6 +13,8 @@
       'dependencies': [
         'battor_agent_lib',
         '../../device/serial/serial.gyp:device_serial',
+        '../../third_party/mojo/mojo_public.gyp:mojo_environment_standalone',
+        '../../third_party/mojo/mojo_public.gyp:mojo_public',
       ],
       'sources': [
         'battor_agent_bin.cc',
diff --git a/tools/battor_agent/battor_agent.h b/tools/battor_agent/battor_agent.h
index d37ef6e..b93f2cd 100644
--- a/tools/battor_agent/battor_agent.h
+++ b/tools/battor_agent/battor_agent.h
@@ -6,7 +6,8 @@
 
 #include "base/callback_forward.h"
 #include "base/macros.h"
-#include "device/serial/serial.mojom.h"
+#include "base/memory/ref_counted.h"
+#include "device/serial/serial_io_handler.h"
 
 namespace battor {
 
@@ -17,10 +18,22 @@
 // Because the communication is synchronous and passes over a serial connection,
 // callers wishing to avoid blocking the thread (like the Chromium tracing
 // controller) should issue these commands in a separate thread.
+//
+// The serial connection is automatically opened when the first command
+// (e.g. StartTracing(), StopTracing(), etc.) is issued, and automatically
+// closed when either StopTracing() or the destructor is called. For Telemetry,
+// this means that the connection must be reinitialized for every command that's
+// issued because a new BattOrAgent is constructed. For Chromium, we use the
+// same BattOrAgent for multiple commands and thus avoid having to reinitialize
+// the serial connection.
+//
+// This class is NOT thread safe.
 class BattOrAgent {
  public:
   enum BattOrError {
     BATTOR_ERROR_NONE,
+    BATTOR_ERROR_CONNECTION_FAILED,
+    BATTOR_ERROR_TIMEOUT,
   };
 
   explicit BattOrAgent(const std::string& path);
@@ -45,8 +58,19 @@
   static bool SupportsExplicitClockSync() { return true; }
 
  private:
+  // Initializes the serial connection with the BattOr. If the connection
+  // already exists, BATTOR_ERROR_NONE is immediately returned.
+  BattOrError ConnectIfNeeded();
+
+  // Resets the connection to its unopened state.
+  void ResetConnection();
+
+  // The path of the BattOr (e.g. "/dev/tty.battor_serial").
   std::string path_;
 
+  // IO handler capable of reading from and writing to the serial connection.
+  scoped_refptr<device::SerialIoHandler> io_handler_;
+
   DISALLOW_COPY_AND_ASSIGN(BattOrAgent);
 };
 
diff --git a/tools/battor_agent/battor_agent_bin.cc b/tools/battor_agent/battor_agent_bin.cc
index f490d0e..8532c49 100644
--- a/tools/battor_agent/battor_agent_bin.cc
+++ b/tools/battor_agent/battor_agent_bin.cc
@@ -10,7 +10,6 @@
 #include <iostream>
 
 #include "base/bind.h"
-#include "base/synchronization/waitable_event.h"
 #include "base/threading/thread.h"
 #include "device/serial/serial.mojom.h"
 #include "tools/battor_agent/battor_agent.h"
@@ -25,9 +24,6 @@
 
 namespace {
 
-// The maximum amount of time to wait for the BattOr Agent to execute a command.
-static const base::TimeDelta COMMAND_TIMEOUT = base::TimeDelta::FromSeconds(10);
-
 void PrintUsage() {
   cerr << "Usage: battor_agent <command> <arguments>" << endl
        << endl
diff --git a/tools/clang/scripts/update.py b/tools/clang/scripts/update.py
index 38c0e779..6cb14000 100755
--- a/tools/clang/scripts/update.py
+++ b/tools/clang/scripts/update.py
@@ -195,55 +195,6 @@
   RunCommand(command)
 
 
-def RevertPreviouslyPatchedFiles():
-  print 'Reverting previously patched files'
-  files = [
-    '%(clang)s/test/Index/crash-recovery-modules.m',
-    '%(clang)s/unittests/libclang/LibclangTest.cpp',
-    '%(compiler_rt)s/lib/asan/asan_rtl.cc',
-    '%(compiler_rt)s/test/asan/TestCases/Linux/new_array_cookie_test.cc',
-    '%(llvm)s/test/DebugInfo/gmlt.ll',
-    '%(llvm)s/lib/CodeGen/SpillPlacement.cpp',
-    '%(llvm)s/lib/CodeGen/SpillPlacement.h',
-    '%(llvm)s/lib/Transforms/Instrumentation/MemorySanitizer.cpp',
-    '%(clang)s/test/Driver/env.c',
-    '%(clang)s/lib/Frontend/InitPreprocessor.cpp',
-    '%(clang)s/test/Frontend/exceptions.c',
-    '%(clang)s/test/Preprocessor/predefined-exceptions.m',
-    '%(llvm)s/test/Bindings/Go/go.test',
-    '%(clang)s/lib/Parse/ParseExpr.cpp',
-    '%(clang)s/lib/Parse/ParseTemplate.cpp',
-    '%(clang)s/lib/Sema/SemaDeclCXX.cpp',
-    '%(clang)s/lib/Sema/SemaExprCXX.cpp',
-    '%(clang)s/test/SemaCXX/default2.cpp',
-    '%(clang)s/test/SemaCXX/typo-correction-delayed.cpp',
-    '%(compiler_rt)s/lib/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc',
-    '%(compiler_rt)s/test/tsan/signal_segv_handler.cc',
-    '%(compiler_rt)s/lib/sanitizer_common/sanitizer_coverage_libcdep.cc',
-    '%(compiler_rt)s/cmake/config-ix.cmake',
-    '%(compiler_rt)s/CMakeLists.txt',
-    '%(compiler_rt)s/lib/ubsan/ubsan_platform.h',
-    ]
-  for f in files:
-    f = f % {
-        'clang': CLANG_DIR,
-        'compiler_rt': COMPILER_RT_DIR,
-        'llvm': LLVM_DIR,
-        }
-    if os.path.exists(f):
-      os.remove(f)  # For unversioned files.
-      RunCommand(['svn', 'revert', f])
-
-
-def ApplyLocalPatches():
-  # There's no patch program on Windows by default.  We don't need patches on
-  # Windows yet, and maybe this not working on Windows will motivate us to
-  # remove patches over time.
-  assert sys.platform != 'win32'
-
-  # No patches.
-
-
 def DeleteChromeToolsShim():
   OLD_SHIM_DIR = os.path.join(LLVM_DIR, 'tools', 'zzz-chrometools')
   shutil.rmtree(OLD_SHIM_DIR, ignore_errors=True)
@@ -356,7 +307,6 @@
 
   AddCMakeToPath()
 
-  RevertPreviouslyPatchedFiles()
   DeleteChromeToolsShim()
 
   Checkout('LLVM', LLVM_REPO_URL + '/llvm/trunk', LLVM_DIR)
@@ -372,9 +322,6 @@
     # into it too (since OS X 10.6 doesn't have libc++abi.dylib either).
     Checkout('libcxxabi', LLVM_REPO_URL + '/libcxxabi/trunk', LIBCXXABI_DIR)
 
-  if args.with_patches and sys.platform != 'win32':
-    ApplyLocalPatches()
-
   cc, cxx = None, None
   libstdcpp = None
   if args.gcc_toolchain:  # This option is only used on Linux.
@@ -688,9 +635,6 @@
   parser.add_argument('--tools', nargs='*',
                       help='select which chrome tools to build',
                       default=['plugins', 'blink_gc_plugin'])
-  parser.add_argument('--without-patches', action='store_false',
-                      help="don't apply patches (default)", dest='with_patches',
-                      default=True)
 
   # For now, these flags are only used for the non-Windows flow, but argparser
   # gets mad if it sees a flag it doesn't recognize.
@@ -741,8 +685,6 @@
     PACKAGE_VERSION = LLVM_WIN_REVISION + '-0'
 
     args.force_local_build = True
-    # Skip local patches when using HEAD: they probably don't apply anymore.
-    args.with_patches = False
 
   return UpdateClang(args)
 
diff --git a/tools/clang/scripts/update.sh b/tools/clang/scripts/update.sh
index 6bb8ceff..5cee97d 100755
--- a/tools/clang/scripts/update.sh
+++ b/tools/clang/scripts/update.sh
@@ -82,7 +82,6 @@
 with_android=yes
 chrome_tools="plugins;blink_gc_plugin"
 gcc_toolchain=
-with_patches=yes
 
 if [[ "${OS}" = "Darwin" ]]; then
   with_android=
@@ -113,9 +112,6 @@
     --without-android)
       with_android=
       ;;
-    --without-patches)
-      with_patches=
-      ;;
     --with-chrome-tools)
       shift
       if [[ $# == 0 ]]; then
@@ -153,7 +149,6 @@
       echo "--gcc-toolchain: Set the prefix for which GCC version should"
       echo "    be used for building. For example, to use gcc in"
       echo "    /opt/foo/bin/gcc, use '--gcc-toolchain '/opt/foo"
-      echo "--without-patches: Don't apply local patches."
       echo
       exit 1
       ;;
@@ -169,9 +164,6 @@
 if [[ -n ${LLVM_FORCE_HEAD_REVISION:-''} ]]; then
   force_local_build=yes
 
-  # Skip local patches when using HEAD: they probably don't apply anymore.
-  with_patches=
-
   if ! [[ "$GYP_DEFINES" =~ .*OS=android.* ]]; then
     # Only build the Android ASan rt when targetting Android.
     with_android=
@@ -309,40 +301,6 @@
   exit 1
 fi
 
-echo Reverting previously patched files
-for i in \
-      "${CLANG_DIR}/test/Index/crash-recovery-modules.m" \
-      "${CLANG_DIR}/unittests/libclang/LibclangTest.cpp" \
-      "${COMPILER_RT_DIR}/lib/asan/asan_rtl.cc" \
-      "${COMPILER_RT_DIR}/test/asan/TestCases/Linux/new_array_cookie_test.cc" \
-      "${LLVM_DIR}/test/DebugInfo/gmlt.ll" \
-      "${LLVM_DIR}/lib/CodeGen/SpillPlacement.cpp" \
-      "${LLVM_DIR}/lib/CodeGen/SpillPlacement.h" \
-      "${LLVM_DIR}/lib/Transforms/Instrumentation/MemorySanitizer.cpp" \
-      "${CLANG_DIR}/test/Driver/env.c" \
-      "${CLANG_DIR}/lib/Frontend/InitPreprocessor.cpp" \
-      "${CLANG_DIR}/test/Frontend/exceptions.c" \
-      "${CLANG_DIR}/test/Preprocessor/predefined-exceptions.m" \
-      "${LLVM_DIR}/test/Bindings/Go/go.test" \
-      "${CLANG_DIR}/lib/Parse/ParseExpr.cpp" \
-      "${CLANG_DIR}/lib/Parse/ParseTemplate.cpp" \
-      "${CLANG_DIR}/lib/Sema/SemaDeclCXX.cpp" \
-      "${CLANG_DIR}/lib/Sema/SemaExprCXX.cpp" \
-      "${CLANG_DIR}/test/SemaCXX/default2.cpp" \
-      "${CLANG_DIR}/test/SemaCXX/typo-correction-delayed.cpp" \
-      "${COMPILER_RT_DIR}/lib/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc" \
-      "${COMPILER_RT_DIR}/test/tsan/signal_segv_handler.cc" \
-      "${COMPILER_RT_DIR}/lib/sanitizer_common/sanitizer_coverage_libcdep.cc" \
-      "${COMPILER_RT_DIR}/cmake/config-ix.cmake" \
-      "${COMPILER_RT_DIR}/CMakeLists.txt" \
-      "${COMPILER_RT_DIR}/lib/ubsan/ubsan_platform.h" \
-      ; do
-  if [[ -e "${i}" ]]; then
-    rm -f "${i}"  # For unversioned files.
-    svn revert "${i}"
-  fi;
-done
-
 echo Remove the Clang tools shim dir
 CHROME_TOOLS_SHIM_DIR=${ABS_LLVM_DIR}/tools/chrometools
 rm -rfv ${CHROME_TOOLS_SHIM_DIR}
@@ -382,11 +340,6 @@
                  "${LIBCXXABI_DIR}"
 fi
 
-if [[ -n "$with_patches" ]]; then
-  # No patches.
-  true
-fi
-
 # Echo all commands.
 set -x
 
diff --git a/tools/gn/bootstrap/bootstrap.py b/tools/gn/bootstrap/bootstrap.py
index 6c2b3ca6..6ca6802e 100755
--- a/tools/gn/bootstrap/bootstrap.py
+++ b/tools/gn/bootstrap/bootstrap.py
@@ -245,12 +245,14 @@
       'base/time/time.cc',
       'base/timer/elapsed_timer.cc',
       'base/timer/timer.cc',
+      'base/trace_event/heap_profiler_allocation_context.cc',
+      'base/trace_event/heap_profiler_allocation_context_tracker.cc',
+      'base/trace_event/heap_profiler_stack_frame_deduplicator.cc',
       'base/trace_event/memory_allocator_dump.cc',
       'base/trace_event/memory_allocator_dump_guid.cc',
       'base/trace_event/memory_dump_manager.cc',
       'base/trace_event/memory_dump_request_args.cc',
       'base/trace_event/memory_dump_session_state.cc',
-      'base/trace_event/memory_profiler_allocation_context.cc',
       'base/trace_event/process_memory_dump.cc',
       'base/trace_event/process_memory_maps.cc',
       'base/trace_event/process_memory_totals.cc',
diff --git a/tools/gn/scheduler.h b/tools/gn/scheduler.h
index 5d0502f..45225ce 100644
--- a/tools/gn/scheduler.h
+++ b/tools/gn/scheduler.h
@@ -121,4 +121,3 @@
 extern Scheduler* g_scheduler;
 
 #endif  // TOOLS_GN_SCHEDULER_H_
-
diff --git a/tools/gn/test_with_scope.cc b/tools/gn/test_with_scope.cc
index 4793f39e..896b5792 100644
--- a/tools/gn/test_with_scope.cc
+++ b/tools/gn/test_with_scope.cc
@@ -156,7 +156,7 @@
 TestParseInput::~TestParseInput() {
 }
 
-TestTarget::TestTarget(TestWithScope& setup,
+TestTarget::TestTarget(const TestWithScope& setup,
                        const std::string& label_string,
                        Target::OutputType type)
     : Target(setup.settings(), setup.ParseLabel(label_string)) {
diff --git a/tools/gn/test_with_scope.h b/tools/gn/test_with_scope.h
index 445fe77..75b0899d 100644
--- a/tools/gn/test_with_scope.h
+++ b/tools/gn/test_with_scope.h
@@ -5,6 +5,7 @@
 #ifndef TOOLS_GN_TEST_WITH_SCOPE_H_
 #define TOOLS_GN_TEST_WITH_SCOPE_H_
 
+#include <string>
 #include <vector>
 
 #include "base/macros.h"
@@ -29,7 +30,9 @@
 
   BuildSettings* build_settings() { return &build_settings_; }
   Settings* settings() { return &settings_; }
+  const Settings* settings() const { return &settings_; }
   Toolchain* toolchain() { return &toolchain_; }
+  const Toolchain* toolchain() const { return &toolchain_; }
   Scope* scope() { return &scope_; }
 
   // This buffer accumulates output from any print() commands executed in the
@@ -101,7 +104,7 @@
 // default to public visibility.
 class TestTarget : public Target {
  public:
-  TestTarget(TestWithScope& setup,
+  TestTarget(const TestWithScope& setup,
              const std::string& label_string,
              Target::OutputType type);
   ~TestTarget() override;
diff --git a/tools/metrics/OWNERS b/tools/metrics/OWNERS
index d38b77e..cf5b92c1 100644
--- a/tools/metrics/OWNERS
+++ b/tools/metrics/OWNERS
@@ -1,6 +1,6 @@
 asvitkine@chromium.org
+holte@chromium.org
 isherman@chromium.org
-jar@chromium.org
 jwd@chromium.org
 mpearson@chromium.org
 rkaplow@chromium.org
diff --git a/tools/metrics/actions/OWNERS b/tools/metrics/actions/OWNERS
new file mode 100644
index 0000000..038b3f4
--- /dev/null
+++ b/tools/metrics/actions/OWNERS
@@ -0,0 +1,3 @@
+# Metrics changes should always be reviewed by owners.
+per-file actions.xml=file://tools/metrics/OWNERS 
+per-file actions.xml=set noparent
diff --git a/tools/metrics/histograms/OWNERS b/tools/metrics/histograms/OWNERS
new file mode 100644
index 0000000..03caca8
--- /dev/null
+++ b/tools/metrics/histograms/OWNERS
@@ -0,0 +1,3 @@
+# Metrics changes should always be reviewed by owners.
+per-file histograms.xml=file://tools/metrics/OWNERS 
+per-file histograms.xml=set noparent
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index d37d8921..6686fa3 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -2770,6 +2770,16 @@
   </summary>
 </histogram>
 
+<histogram name="BackgroundSync.NetworkObserver.HasPermission" enum="Boolean">
+  <owner>iclelland@chromium.org</owner>
+  <summary>
+    Records whether the browser has sufficient permissions to create a
+    BackgroundSyncNetworkObserver object on Android, at the point when it tries
+    to create it. This should never be false, but is being tracked in order to
+    help resolve crbug.com/545473.
+  </summary>
+</histogram>
+
 <histogram name="BackgroundSync.Registration.OneShot"
     enum="BackgroundSyncStatus">
   <owner>iclelland@chromium.org</owner>
@@ -20974,6 +20984,32 @@
   </summary>
 </histogram>
 
+<histogram name="Navigation.Start.RendererBrowserDifference.Negative"
+    units="milliseconds">
+  <owner>csharrison@chromium.org</owner>
+  <summary>
+    The difference between Now() in the renderer and browser_navigation_start
+    for browser-initiated navigations if the difference is negative. This value
+    should ideally only reflect the IPC time between the browser process and
+    renderer process, but in practice could be skewed by inter-process timing
+    errors. If the clocks used for TimeTicks are monotonic across processes, all
+    samples should fall into the Positive bucket.
+  </summary>
+</histogram>
+
+<histogram name="Navigation.Start.RendererBrowserDifference.Positive"
+    units="milliseconds">
+  <owner>csharrison@chromium.org</owner>
+  <summary>
+    The difference between Now() in the renderer and browser_navigation_start
+    for browser-initiated navigations if the difference is positive. This value
+    should ideally only reflect the IPC time between the browser process and
+    renderer process, but in practice could be skewed by inter-process timing
+    errors. If the clocks used for TimeTicks are monotonic across processes, all
+    samples should fall into the Positive bucket.
+  </summary>
+</histogram>
+
 <histogram name="Navigation.TimeToCommit" units="milliseconds">
   <owner>carlosk@chromium.org</owner>
   <summary>
diff --git a/tools/metrics/rappor/OWNERS b/tools/metrics/rappor/OWNERS
index 52bf7a2..cdb260e 100644
--- a/tools/metrics/rappor/OWNERS
+++ b/tools/metrics/rappor/OWNERS
@@ -1,2 +1,3 @@
-asvitkine@chromium.org
-holte@chromium.org
+# Metrics changes should always be reviewed by owners.
+per-file rappor.xml=file://tools/metrics/OWNERS 
+per-file rappor.xml=set noparent
diff --git a/tools/telemetry/telemetry/core/cros_interface.py b/tools/telemetry/telemetry/core/cros_interface.py
index 5f37874..ee69f38 100644
--- a/tools/telemetry/telemetry/core/cros_interface.py
+++ b/tools/telemetry/telemetry/core/cros_interface.py
@@ -464,7 +464,9 @@
     SCREENSHOT_EXT = '.png'
 
     self.RunCmdOnDevice(['mkdir', '-p', SCREENSHOT_DIR])
-    for i in xrange(25):
+    # Large number of screenshots can increase hardware lab bandwidth
+    # dramatically, so keep this number low. crbug.com/524814.
+    for i in xrange(2):
       screenshot_file = ('%s%s-%d%s' %
                          (SCREENSHOT_DIR, screenshot_prefix, i, SCREENSHOT_EXT))
       if not self.FileExistsOnDevice(screenshot_file):
diff --git a/tools/telemetry/telemetry/internal/backends/chrome/android_browser_backend.py b/tools/telemetry/telemetry/internal/backends/chrome/android_browser_backend.py
index 177268a..6c857b7 100644
--- a/tools/telemetry/telemetry/internal/backends/chrome/android_browser_backend.py
+++ b/tools/telemetry/telemetry/internal/backends/chrome/android_browser_backend.py
@@ -12,6 +12,7 @@
 from telemetry.internal.backends import android_command_line_backend
 from telemetry.internal.backends import browser_backend
 from telemetry.internal.backends.chrome import chrome_browser_backend
+from telemetry.internal.browser import user_agent
 from telemetry.internal import forwarders
 
 from devil.android.sdk import intent
@@ -99,13 +100,17 @@
 
     self.platform_backend.DismissCrashDialogIfNeeded()
 
+    user_agent_dict = user_agent.GetChromeUserAgentDictFromType(
+        self.browser_options.browser_user_agent_type)
+
     browser_startup_args = self.GetBrowserStartupArgs()
     with android_command_line_backend.SetUpCommandLineFlags(
         self.device, self._backend_settings, browser_startup_args):
       self.device.StartActivity(
           intent.Intent(package=self._backend_settings.package,
                         activity=self._backend_settings.activity,
-                        action=None, data=url, category=None),
+                        action=None, data=url, category=None,
+                        extras=user_agent_dict),
           blocking=True)
 
       remote_devtools_port = self._backend_settings.GetDevtoolsRemotePort(
diff --git a/tools/telemetry/telemetry/internal/backends/chrome/cros_browser_backend.py b/tools/telemetry/telemetry/internal/backends/chrome/cros_browser_backend.py
index 6df641f..6c085ee2 100644
--- a/tools/telemetry/telemetry/internal/backends/chrome/cros_browser_backend.py
+++ b/tools/telemetry/telemetry/internal/backends/chrome/cros_browser_backend.py
@@ -144,7 +144,9 @@
 
         self._WaitForLogin()
       except exceptions.TimeoutException:
-        raise exceptions.LoginException('Timed out going through login screen')
+        self._cri.TakeScreenShot('login-screen')
+        raise exceptions.LoginException('Timed out going through login screen. '
+                                        + self._GetLoginStatus())
 
     logging.info('Browser is up!')
 
@@ -206,12 +208,21 @@
     username = '$guest' if self._is_guest else self._username
     return self._cri.IsCryptohomeMounted(username, self._is_guest)
 
+  def _GetLoginStatus(self):
+    """Returns login status. If logged in, empty string is returned."""
+    status = ''
+    if not self._IsCryptohomeMounted():
+      status += 'Cryptohome not mounted. '
+    if not self.HasBrowserFinishedLaunching():
+      status += 'Browser didn\'t launch. '
+    if self.oobe_exists:
+      status += 'OOBE not dismissed.'
+    return status
+
   def _IsLoggedIn(self):
     """Returns True if cryptohome has mounted, the browser is
     responsive to devtools requests, and the oobe has been dismissed."""
-    return (self._IsCryptohomeMounted() and
-            self.HasBrowserFinishedLaunching() and
-            not self.oobe_exists)
+    return not self._GetLoginStatus()
 
   def _WaitForLogin(self):
     # Wait for cryptohome to mount.
diff --git a/tools/telemetry/telemetry/internal/browser/user_agent.py b/tools/telemetry/telemetry/internal/browser/user_agent.py
index 0592c91..9c160c9 100644
--- a/tools/telemetry/telemetry/internal/browser/user_agent.py
+++ b/tools/telemetry/telemetry/internal/browser/user_agent.py
@@ -30,3 +30,8 @@
   if user_agent_type:
     return ['--user-agent=%s' % UA_TYPE_MAPPING[user_agent_type]]
   return []
+
+def GetChromeUserAgentDictFromType(user_agent_type):
+  if user_agent_type:
+    return {'userAgent': UA_TYPE_MAPPING[user_agent_type]}
+  return ''
diff --git a/tools/telemetry/telemetry/internal/platform/power_monitor/android_dumpsys_power_monitor_unittest.py b/tools/telemetry/telemetry/internal/platform/power_monitor/android_dumpsys_power_monitor_unittest.py
index d532b04..2f61b78 100644
--- a/tools/telemetry/telemetry/internal/platform/power_monitor/android_dumpsys_power_monitor_unittest.py
+++ b/tools/telemetry/telemetry/internal/platform/power_monitor/android_dumpsys_power_monitor_unittest.py
@@ -77,6 +77,16 @@
     with self.assertRaises(AssertionError):
       pm.StartMonitoringPower(browser)
 
+  def testBatteryChargingState(self):
+    browser = pm_mock.MockBrowser(_PACKAGE)
+    battery = pm_mock.MockBattery(_TYPICAL_POWER_DATA_MULTISAMPLE, voltage=5.0)
+    backend = pm_mock.MockPlatformBackend()
+    pm = android_dumpsys_power_monitor.DumpsysPowerMonitor(battery, backend)
+    self.assertEqual(battery.GetCharging(), True)
+    pm.StartMonitoringPower(browser)
+    self.assertEqual(battery.GetCharging(), False)
+    pm.StopMonitoringPower()
+    self.assertEqual(battery.GetCharging(), True)
 
 if __name__ == '__main__':
   unittest.main()
diff --git a/tools/telemetry/telemetry/internal/platform/power_monitor/android_power_monitor_base.py b/tools/telemetry/telemetry/internal/platform/power_monitor/android_power_monitor_base.py
index 3bec7a3..d140892 100644
--- a/tools/telemetry/telemetry/internal/platform/power_monitor/android_power_monitor_base.py
+++ b/tools/telemetry/telemetry/internal/platform/power_monitor/android_power_monitor_base.py
@@ -42,4 +42,4 @@
     if battery.GetCharging():
       logging.warning('Charging re-enabled during test.'
                       'Results may be inaccurate.')
-      battery.SetCharging(True)
+    battery.SetCharging(True)
diff --git a/tools/valgrind/drmemory/suppressions_full.txt b/tools/valgrind/drmemory/suppressions_full.txt
index b641e1e..212b9ed9 100644
--- a/tools/valgrind/drmemory/suppressions_full.txt
+++ b/tools/valgrind/drmemory/suppressions_full.txt
@@ -2047,19 +2047,10 @@
 content.dll!content::WebGraphicsContext3DCommandBufferImpl::CreateContext
 content.dll!content::WebGraphicsContext3DCommandBufferImpl::MaybeInitializeGL
 
-UNADDRESSABLE ACCESS
-name=https://github.com/DynamoRIO/drmemory/issues/1817
-system call NtUserBuildPropList parameter #1
-
+# Dr. Memory does not yet propagate uninits through ymm registers so we
+# avoid any false positives in the meantime that might show up in
+# libyuv and other code:
 UNINITIALIZED READ
-name=https://github.com/DynamoRIO/drmemory/issues/1816
-USER32.dll!DdeEnableCallback
-USER32.dll!EnumPropsExW
-SHELL32.dll!SHGetIconOverlayIndexA
-
-# This is the same as the above uninitialized read when the symbols get fixed.
-UNINITIALIZED READ
-name=https://github.com/DynamoRIO/drmemory/issues/1815
-USER32.dll!InternalEnumProps
-USER32.dll!EnumPropsExW
-SHELL32.dll!CWindowPropStore::GetCount
+name=https://github.com/DynamoRIO/drmemory/issues/1485
+instruction=*ymm*
+media.dll!*
diff --git a/tools/valgrind/memcheck/suppressions_linux.txt b/tools/valgrind/memcheck/suppressions_linux.txt
index 21e0368c..293e8c0 100644
--- a/tools/valgrind/memcheck/suppressions_linux.txt
+++ b/tools/valgrind/memcheck/suppressions_linux.txt
@@ -105,6 +105,6 @@
    fun:_Znw*
    obj:*
    ...
-   fun:*LoadNativeLibrary*
-   fun:*CdmAdapterTest*
+   fun:_dl_init
+   fun:dl_open_worker
 }
diff --git a/ui/accessibility/ax_enums.idl b/ui/accessibility/ax_enums.idl
index d160ef4..b3deda05 100644
--- a/ui/accessibility/ax_enums.idl
+++ b/ui/accessibility/ax_enums.idl
@@ -241,7 +241,6 @@
     container_live_status,
     description,
     display,
-    help,
     html_tag,
     // Only used when invalid_state == invalid_state_other.
     aria_invalid_value,
@@ -291,8 +290,15 @@
     // Tree control attributes.
     hierarchical_level,
 
+    // What information was used to compute the object's name
+    // (of type AXNameFrom).
+    name_from,
+
+    // What information was used to compute the object's description
+    // (of type AXDescriptionFrom).
+    description_from,
+
     // Relationships between this element and other elements.
-    title_ui_element,
     activedescendant_id,
 
     // Identifies a child tree which this node hosts.
@@ -305,7 +311,6 @@
     // In the case of AX_ROLE_COLOR_WELL, specifies the selected color.
     color_value,
 
-
     // Text attributes.
 
     // Foreground and background color in RGBA.
@@ -370,7 +375,6 @@
     describedby_ids,
     flowto_ids,
     labelledby_ids,
-    owns_ids,
 
     // Character indices where line breaks occur.
     line_breaks,
@@ -429,4 +433,20 @@
     sort_direction_other
   };
 
+  [cpp_enum_prefix_override="ax"] enum AXNameFrom {
+    name_from_uninitialized = 0,
+    name_from_attribute,
+    name_from_contents,
+    name_from_placeholder,
+    name_from_related_element,
+    name_from_value
+  };
+
+  [cpp_enum_prefix_override="ax"] enum AXDescriptionFrom {
+    description_from_uninitialized = 0,
+    description_from_attribute,
+    description_from_contents,
+    description_from_placeholder,
+    description_from_related_element
+  };
 };
diff --git a/ui/accessibility/ax_node_data.cc b/ui/accessibility/ax_node_data.cc
index 280e10b..194880c 100644
--- a/ui/accessibility/ax_node_data.cc
+++ b/ui/accessibility/ax_node_data.cc
@@ -389,8 +389,13 @@
             break;
         }
         break;
-      case AX_ATTR_TITLE_UI_ELEMENT:
-        result += " title_elem=" + value;
+      case AX_ATTR_NAME_FROM:
+        result += " name_from=" + ui::ToString(
+            static_cast<ui::AXNameFrom>(int_attributes[i].second));
+        break;
+      case AX_ATTR_DESCRIPTION_FROM:
+        result += " description_from=" + ui::ToString(
+            static_cast<ui::AXDescriptionFrom>(int_attributes[i].second));
         break;
       case AX_ATTR_ACTIVEDESCENDANT_ID:
         result += " activedescendant=" + value;
@@ -488,9 +493,6 @@
       case AX_ATTR_DISPLAY:
         result += " display=" + value;
         break;
-      case AX_ATTR_HELP:
-        result += " help=" + value;
-        break;
       case AX_ATTR_HTML_TAG:
         result += " html_tag=" + value;
         break;
@@ -510,7 +512,7 @@
         result += " container_live=" + value;
         break;
       case AX_ATTR_PLACEHOLDER:
-        result += "placeholder" + value;
+        result += " placeholder=" + value;
         break;
       case AX_ATTR_ROLE:
         result += " role=" + value;
@@ -605,9 +607,6 @@
       case AX_ATTR_LABELLEDBY_IDS:
         result += " labelledby_ids=" + IntVectorToString(values);
         break;
-      case AX_ATTR_OWNS_IDS:
-        result += " owns_ids=" + IntVectorToString(values);
-        break;
       case AX_ATTR_LINE_BREAKS:
         result += " line_breaks=" + IntVectorToString(values);
         break;
diff --git a/ui/accessibility/platform/ax_platform_node_mac.mm b/ui/accessibility/platform/ax_platform_node_mac.mm
index dd6ae35..43c1dd1 100644
--- a/ui/accessibility/platform/ax_platform_node_mac.mm
+++ b/ui/accessibility/platform/ax_platform_node_mac.mm
@@ -42,7 +42,7 @@
       {ui::AX_ROLE_COMPLEMENTARY, NSAccessibilityGroupRole},
       {ui::AX_ROLE_CONTENT_INFO, NSAccessibilityGroupRole},
       {ui::AX_ROLE_DATE, @"AXDateField"},
-      {ui::AX_ROLE_DATE_TIME, NSAccessibilityTextFieldRole},
+      {ui::AX_ROLE_DATE_TIME, @"AXDateField"},
       {ui::AX_ROLE_DEFINITION, NSAccessibilityGroupRole},
       {ui::AX_ROLE_DESCRIPTION_LIST_DETAIL, NSAccessibilityGroupRole},
       {ui::AX_ROLE_DESCRIPTION_LIST, NSAccessibilityListRole},
diff --git a/ui/accessibility/platform/ax_platform_node_win.cc b/ui/accessibility/platform/ax_platform_node_win.cc
index 2656a1c..37ad446 100644
--- a/ui/accessibility/platform/ax_platform_node_win.cc
+++ b/ui/accessibility/platform/ax_platform_node_win.cc
@@ -422,7 +422,7 @@
 STDMETHODIMP AXPlatformNodeWin::get_accHelp(
     VARIANT var_id, BSTR* help) {
   COM_OBJECT_VALIDATE_VAR_ID_1_ARG(var_id, help);
-  return GetStringAttributeAsBstr(ui::AX_ATTR_HELP, help);
+  return S_FALSE;
 }
 
 STDMETHODIMP AXPlatformNodeWin::get_accValue(VARIANT var_id, BSTR* value) {
diff --git a/ui/accessibility/platform/ax_platform_node_win_unittest.cc b/ui/accessibility/platform/ax_platform_node_win_unittest.cc
index 63d7401..08be59b 100644
--- a/ui/accessibility/platform/ax_platform_node_win_unittest.cc
+++ b/ui/accessibility/platform/ax_platform_node_win_unittest.cc
@@ -154,24 +154,6 @@
   ASSERT_EQ(E_INVALIDARG, root_obj->get_accDescription(bad_id, d2.Receive()));
 }
 
-TEST_F(AXPlatformNodeWinTest, TestIAccessibleHelp) {
-  AXNodeData root;
-  root.id = 1;
-  root.role = AX_ROLE_ROOT_WEB_AREA;
-  root.AddStringAttribute(AX_ATTR_HELP, "Help");
-  Init(root);
-
-  ScopedComPtr<IAccessible> root_obj(GetRootIAccessible());
-  ScopedBstr help;
-  ASSERT_EQ(S_OK, root_obj->get_accHelp(SELF, help.Receive()));
-  EXPECT_EQ(L"Help", base::string16(help));
-
-  ASSERT_EQ(E_INVALIDARG, root_obj->get_accHelp(SELF, nullptr));
-  ScopedVariant bad_id(999);
-  ScopedBstr h2;
-  ASSERT_EQ(E_INVALIDARG, root_obj->get_accHelp(bad_id, h2.Receive()));
-}
-
 TEST_F(AXPlatformNodeWinTest, TestIAccessibleValue) {
   AXNodeData root;
   root.id = 1;
diff --git a/ui/aura/window_tree_host_platform.cc b/ui/aura/window_tree_host_platform.cc
index 409f92a..2a7d054 100644
--- a/ui/aura/window_tree_host_platform.cc
+++ b/ui/aura/window_tree_host_platform.cc
@@ -49,7 +49,9 @@
 
 WindowTreeHostPlatform::WindowTreeHostPlatform()
     : widget_(gfx::kNullAcceleratedWidget),
-      current_cursor_(ui::kCursorNull) {}
+      current_cursor_(ui::kCursorNull) {
+  CreateCompositor();
+}
 
 void WindowTreeHostPlatform::SetPlatformWindow(
     scoped_ptr<ui::PlatformWindow> window) {
@@ -166,7 +168,6 @@
     gfx::AcceleratedWidget widget,
     float device_pixel_ratio) {
   widget_ = widget;
-  CreateCompositor();
   WindowTreeHost::OnAcceleratedWidgetAvailable();
 }
 
diff --git a/ui/aura/window_tree_host_x11.cc b/ui/aura/window_tree_host_x11.cc
index 7f2c720..e1abcac 100644
--- a/ui/aura/window_tree_host_x11.cc
+++ b/ui/aura/window_tree_host_x11.cc
@@ -218,6 +218,7 @@
   XSetWindowAttributes swa;
   memset(&swa, 0, sizeof(swa));
   swa.background_pixmap = None;
+  swa.bit_gravity = NorthWestGravity;
   swa.override_redirect = default_override_redirect;
   xwindow_ = XCreateWindow(
       xdisplay_, x_root_window_,
@@ -226,7 +227,7 @@
       CopyFromParent,  // depth
       InputOutput,
       CopyFromParent,  // visual
-      CWBackPixmap | CWOverrideRedirect,
+      CWBackPixmap | CWBitGravity | CWOverrideRedirect,
       &swa);
   if (ui::PlatformEventSource::GetInstance())
     ui::PlatformEventSource::GetInstance()->AddPlatformEventDispatcher(this);
diff --git a/ui/compositor/test/in_process_context_factory.cc b/ui/compositor/test/in_process_context_factory.cc
index 5d08817..a1165b2 100644
--- a/ui/compositor/test/in_process_context_factory.cc
+++ b/ui/compositor/test/in_process_context_factory.cc
@@ -60,10 +60,15 @@
       context_provider_->ContextSupport()->PartialSwapBuffers(
           frame->gl_frame_data->sub_buffer_rect);
     }
-    uint32_t sync_point =
-        context_provider_->ContextGL()->InsertSyncPointCHROMIUM();
-    context_provider_->ContextSupport()->SignalSyncPoint(
-        sync_point, base::Bind(&OutputSurface::OnSwapBuffersComplete,
+    gpu::gles2::GLES2Interface* gl = context_provider_->ContextGL();
+    const uint64_t fence_sync = gl->InsertFenceSyncCHROMIUM();
+    gl->ShallowFlushCHROMIUM();
+
+    gpu::SyncToken sync_token;
+    gl->GenUnverifiedSyncTokenCHROMIUM(fence_sync, sync_token.GetData());
+
+    context_provider_->ContextSupport()->SignalSyncToken(
+        sync_token, base::Bind(&OutputSurface::OnSwapBuffersComplete,
                                weak_ptr_factory_.GetWeakPtr()));
     client_->DidSwapBuffers();
   }
diff --git a/ui/gfx/icon_util.cc b/ui/gfx/icon_util.cc
index 4fdc878..10efeab2 100644
--- a/ui/gfx/icon_util.cc
+++ b/ui/gfx/icon_util.cc
@@ -239,24 +239,12 @@
   return new SkBitmap(CreateSkBitmapFromHICONHelper(icon, s));
 }
 
-scoped_ptr<SkBitmap> IconUtil::CreateSkBitmapFromIconResource(HMODULE module,
-                                                              int resource_id,
-                                                              int size) {
-  DCHECK_LE(size, kLargeIconSize);
-
-  // For everything except the Vista+ 256x256 icons, use |LoadImage()|.
-  if (size != kLargeIconSize) {
-    HICON icon_handle =
-        static_cast<HICON>(LoadImage(module, MAKEINTRESOURCE(resource_id),
-                                     IMAGE_ICON, size, size,
-                                     LR_DEFAULTCOLOR | LR_DEFAULTSIZE));
-    scoped_ptr<SkBitmap> bitmap(IconUtil::CreateSkBitmapFromHICON(icon_handle));
-    DestroyIcon(icon_handle);
-    return bitmap.Pass();
-  }
-
-  // For Vista+ 256x256 PNG icons, read the resource directly and find
-  // the corresponding icon entry to get its PNG bytes.
+// static
+scoped_ptr<gfx::ImageFamily> IconUtil::CreateImageFamilyFromIconResource(
+    HMODULE module,
+    int resource_id) {
+  // Read the resource directly so we can get the icon image sizes. This data
+  // will also be used to directly get the PNG bytes for large images.
   void* icon_dir_data = NULL;
   size_t icon_dir_size = 0;
   if (!base::win::GetResourceFromModule(module, resource_id, RT_GROUP_ICON,
@@ -268,31 +256,39 @@
 
   const GRPICONDIR* icon_dir =
       reinterpret_cast<const GRPICONDIR*>(icon_dir_data);
-  const GRPICONDIRENTRY* large_icon_entry = NULL;
+  scoped_ptr<gfx::ImageFamily> result(new gfx::ImageFamily);
   for (size_t i = 0; i < icon_dir->idCount; ++i) {
     const GRPICONDIRENTRY* entry = &icon_dir->idEntries[i];
-    // 256x256 icons are stored with width and height set to 0.
-    // See: http://en.wikipedia.org/wiki/ICO_(file_format)
-    if (entry->bWidth == 0 && entry->bHeight == 0) {
-      large_icon_entry = entry;
-      break;
+    if (entry->bWidth != 0 || entry->bHeight != 0) {
+      // Ignore the low-bit-depth versions of the icon.
+      if (entry->wBitCount != 32)
+        continue;
+
+      // For everything except the Vista+ 256x256 icons, use |LoadImage()|.
+      HICON icon_handle = static_cast<HICON>(LoadImage(
+          module, MAKEINTRESOURCE(resource_id), IMAGE_ICON, entry->bWidth,
+          entry->bHeight, LR_DEFAULTCOLOR | LR_DEFAULTSIZE));
+      scoped_ptr<SkBitmap> bitmap(
+          IconUtil::CreateSkBitmapFromHICON(icon_handle));
+      DestroyIcon(icon_handle);
+      result->Add(gfx::Image::CreateFrom1xBitmap(*bitmap));
+    } else {
+      // 256x256 icons are stored with width and height set to 0.
+      // See: http://en.wikipedia.org/wiki/ICO_(file_format)
+      void* png_data = NULL;
+      size_t png_size = 0;
+      if (!base::win::GetResourceFromModule(module, entry->nID, RT_ICON,
+                                            &png_data, &png_size)) {
+        return nullptr;
+      }
+      DCHECK(png_data);
+      DCHECK_EQ(png_size, entry->dwBytesInRes);
+
+      result->Add(gfx::Image::CreateFrom1xPNGBytes(
+          new base::RefCountedStaticMemory(png_data, png_size)));
     }
   }
-  if (!large_icon_entry)
-    return nullptr;
-
-  void* png_data = NULL;
-  size_t png_size = 0;
-  if (!base::win::GetResourceFromModule(module, large_icon_entry->nID, RT_ICON,
-                                        &png_data, &png_size)) {
-    return nullptr;
-  }
-  DCHECK(png_data);
-  DCHECK_EQ(png_size, large_icon_entry->dwBytesInRes);
-
-  gfx::Image image = gfx::Image::CreateFrom1xPNGBytes(
-      new base::RefCountedStaticMemory(png_data, png_size));
-  return make_scoped_ptr(new SkBitmap(image.AsBitmap()));
+  return result;
 }
 
 SkBitmap* IconUtil::CreateSkBitmapFromHICON(HICON icon) {
diff --git a/ui/gfx/icon_util.h b/ui/gfx/icon_util.h
index 46ac3f9..9b87581d 100644
--- a/ui/gfx/icon_util.h
+++ b/ui/gfx/icon_util.h
@@ -103,9 +103,9 @@
   // loaded .dll or .exe |module|. Supports loading smaller icon sizes as well
   // as the Vista+ 256x256 PNG icon size. If the icon could not be loaded or
   // found, returns a NULL scoped_ptr.
-  static scoped_ptr<SkBitmap> CreateSkBitmapFromIconResource(HMODULE module,
-                                                             int resource_id,
-                                                             int size);
+  static scoped_ptr<gfx::ImageFamily> CreateImageFamilyFromIconResource(
+      HMODULE module,
+      int resource_id);
 
   // Given a valid HICON handle representing an icon, this function converts
   // the icon into an SkBitmap object containing an ARGB bitmap using the
diff --git a/ui/gfx/icon_util_unittest.cc b/ui/gfx/icon_util_unittest.cc
index 5138e702..f47d190 100644
--- a/ui/gfx/icon_util_unittest.cc
+++ b/ui/gfx/icon_util_unittest.cc
@@ -4,6 +4,8 @@
 
 #include "ui/gfx/icon_util.h"
 
+#include <vector>
+
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/memory/scoped_ptr.h"
@@ -404,22 +406,23 @@
   CheckAllIconSizes(icon_filename, 48);
 }
 
-TEST_F(IconUtilTest, TestCreateSkBitmapFromIconResource48x48) {
+TEST_F(IconUtilTest, TestCreateImageFamilyFromIconResource) {
   HMODULE module = GetModuleHandle(NULL);
-  scoped_ptr<SkBitmap> bitmap(
-      IconUtil::CreateSkBitmapFromIconResource(module, IDR_MAINFRAME, 48));
-  ASSERT_TRUE(bitmap.get());
-  EXPECT_EQ(48, bitmap->width());
-  EXPECT_EQ(48, bitmap->height());
-}
+  scoped_ptr<gfx::ImageFamily> family(
+      IconUtil::CreateImageFamilyFromIconResource(module, IDR_MAINFRAME));
+  ASSERT_TRUE(family.get());
+  EXPECT_FALSE(family->empty());
+  std::vector<gfx::Image> images;
+  for (const auto& image : *family)
+    images.push_back(image);
 
-TEST_F(IconUtilTest, TestCreateSkBitmapFromIconResource256x256) {
-  HMODULE module = GetModuleHandle(NULL);
-  scoped_ptr<SkBitmap> bitmap(
-      IconUtil::CreateSkBitmapFromIconResource(module, IDR_MAINFRAME, 256));
-  ASSERT_TRUE(bitmap.get());
-  EXPECT_EQ(256, bitmap->width());
-  EXPECT_EQ(256, bitmap->height());
+  // Assert that the family contains all of the images from the icon resource.
+  EXPECT_EQ(5, images.size());
+  EXPECT_EQ(16, images[0].Width());
+  EXPECT_EQ(24, images[1].Width());
+  EXPECT_EQ(32, images[2].Width());
+  EXPECT_EQ(48, images[3].Width());
+  EXPECT_EQ(256, images[4].Width());
 }
 
 // This tests that kNumIconDimensionsUpToMediumSize has the correct value.
diff --git a/ui/gl/gl_surface_glx.cc b/ui/gl/gl_surface_glx.cc
index e66e637f..f94f064 100644
--- a/ui/gl/gl_surface_glx.cc
+++ b/ui/gl/gl_surface_glx.cc
@@ -477,9 +477,13 @@
   // extra blits in the driver), that we can resize exactly in Resize(),
   // correctly ordered with GL, so that we don't have invalid transient states.
   // See https://crbug.com/326995.
+  XSetWindowAttributes swa;
+  memset(&swa, 0, sizeof(swa));
+  swa.background_pixmap = 0;
+  swa.bit_gravity = NorthWestGravity;
   window_ = XCreateWindow(g_display, parent_window_, 0, 0, size_.width(),
                           size_.height(), 0, CopyFromParent, InputOutput,
-                          CopyFromParent, 0, nullptr);
+                          CopyFromParent, CWBackPixmap | CWBitGravity, &swa);
   XMapWindow(g_display, window_);
 
   ui::PlatformEventSource* event_source =
diff --git a/ui/native_theme/OWNERS b/ui/native_theme/OWNERS
new file mode 100644
index 0000000..4986915
--- /dev/null
+++ b/ui/native_theme/OWNERS
@@ -0,0 +1,2 @@
+estade@chromium.org
+pkasting@chromium.org
diff --git a/ui/native_theme/native_theme_dark_aura.cc b/ui/native_theme/native_theme_dark_aura.cc
index f33e67e..02c716f 100644
--- a/ui/native_theme/native_theme_dark_aura.cc
+++ b/ui/native_theme/native_theme_dark_aura.cc
@@ -5,6 +5,7 @@
 #include "ui/native_theme/native_theme_dark_aura.h"
 
 #include "ui/base/resource/material_design/material_design_controller.h"
+#include "ui/gfx/color_palette.h"
 
 namespace ui {
 
@@ -17,11 +18,13 @@
   if (!ui::MaterialDesignController::IsModeMaterial())
     return NativeThemeAura::GetSystemColor(color_id);
 
-  static const SkColor kLinkEnabledColor = SkColorSetRGB(0x7B, 0xAA, 0xF7);
+  static const SkColor kLinkEnabledColor = gfx::kGoogleBlue300;
 
   static const SkColor kTextfieldDefaultColor = SK_ColorWHITE;
   static const SkColor kTextfieldDefaultBackground =
       SkColorSetRGB(0x62, 0x62, 0x62);
+  static const SkColor kTextfieldSelectionBackgroundFocused =
+      SkColorSetA(gfx::kGoogleBlue700, 0xCC);
 
   static const SkColor kResultsTableNormalBackground =
       SkColorSetRGB(0x28, 0x28, 0x28);
@@ -29,16 +32,27 @@
   static const SkColor kResultsTableDimmedText =
       SkColorSetA(kResultsTableText, 0x80);
 
+  static const SkColor kThrobberSpinning = SK_ColorWHITE;
+  static const SkColor kThrobberWaiting = SkColorSetA(kThrobberSpinning, 0x80);
+
   switch (color_id) {
+    // Button
+    case kColorId_CallToActionColor:
+      return kLinkEnabledColor;
+
     // Link
     case kColorId_LinkEnabled:
+    case kColorId_LinkPressed:
       return kLinkEnabledColor;
 
     // Textfield
     case kColorId_TextfieldDefaultColor:
+    case kColorId_TextfieldSelectionColor:
       return kTextfieldDefaultColor;
     case kColorId_TextfieldDefaultBackground:
       return kTextfieldDefaultBackground;
+    case kColorId_TextfieldSelectionBackgroundFocused:
+      return kTextfieldSelectionBackgroundFocused;
 
     // Results Tables
     case kColorId_ResultsTableNormalBackground:
@@ -55,11 +69,39 @@
     case kColorId_ResultsTableSelectedDimmedText:
       return kResultsTableDimmedText;
 
-    default:
-      break;
-  }
+    // Colors for the material spinner (aka throbber).
+    case kColorId_ThrobberSpinningColor:
+    case kColorId_ThrobberLightColor:
+      return kThrobberSpinning;
+    case kColorId_ThrobberWaitingColor:
+      return kThrobberWaiting;
 
-  return NativeThemeAura::GetSystemColor(color_id);
+    // Intentional pass-throughs to NativeThemeAura.
+    case kColorId_ResultsTableHoveredBackground:
+    case kColorId_ResultsTableSelectedBackground:
+    case kColorId_ResultsTableNormalUrl:
+    case kColorId_ResultsTableHoveredUrl:
+    case kColorId_ResultsTableSelectedUrl:
+      return NativeThemeAura::GetSystemColor(color_id);
+
+    // Temporary pass-throughs to NativeThemeAura, for colors not yet defined
+    // for dark themes. TODO(estade): define colors for these and remove this
+    // block.
+    case kColorId_ResultsTableNormalDivider:
+    case kColorId_ResultsTableHoveredDivider:
+    case kColorId_ResultsTableSelectedDivider:
+    case kColorId_ResultsTablePositiveText:
+    case kColorId_ResultsTablePositiveHoveredText:
+    case kColorId_ResultsTablePositiveSelectedText:
+    case kColorId_ResultsTableNegativeText:
+    case kColorId_ResultsTableNegativeHoveredText:
+    case kColorId_ResultsTableNegativeSelectedText:
+      return NativeThemeAura::GetSystemColor(color_id);
+
+    // Any other color is not defined and shouldn't be used in a dark theme.
+    default:
+      return gfx::kPlaceholderColor;
+  }
 }
 
 NativeThemeDarkAura::NativeThemeDarkAura() {}
diff --git a/ui/platform_window/x11/x11_window.cc b/ui/platform_window/x11/x11_window.cc
index 91af8ed..073fe4da 100644
--- a/ui/platform_window/x11/x11_window.cc
+++ b/ui/platform_window/x11/x11_window.cc
@@ -126,6 +126,7 @@
   XSetWindowAttributes swa;
   memset(&swa, 0, sizeof(swa));
   swa.background_pixmap = None;
+  swa.bit_gravity = NorthWestGravity;
   swa.override_redirect = g_override_redirect;
   xwindow_ = XCreateWindow(xdisplay_,
                            xroot_window_,
@@ -137,7 +138,7 @@
                            CopyFromParent,  // depth
                            InputOutput,
                            CopyFromParent,  // visual
-                           CWBackPixmap | CWOverrideRedirect,
+                           CWBackPixmap | CWBitGravity | CWOverrideRedirect,
                            &swa);
 
   long event_mask = ButtonPressMask | ButtonReleaseMask | FocusChangeMask |
diff --git a/ui/views/controls/button/custom_button.cc b/ui/views/controls/button/custom_button.cc
index 61b595b..aafbf2d 100644
--- a/ui/views/controls/button/custom_button.cc
+++ b/ui/views/controls/button/custom_button.cc
@@ -251,6 +251,13 @@
 }
 
 bool CustomButton::AcceleratorPressed(const ui::Accelerator& accelerator) {
+  // Should only handle accelerators when active. However, only top level
+  // widgets can be active, so for child widgets check if they are focused
+  // instead.
+  if ((IsChildWidget() && !FocusInChildWidget()) ||
+      (!IsChildWidget() && !GetWidget()->IsActive())) {
+    return false;
+  }
   SetState(STATE_NORMAL);
   // TODO(beng): remove once NotifyClick takes ui::Event.
   ui::MouseEvent synthetic_event(
@@ -378,4 +385,14 @@
     SetState(STATE_NORMAL);
 }
 
+bool CustomButton::IsChildWidget() const {
+  return GetWidget() && GetWidget()->GetTopLevelWidget() != GetWidget();
+}
+
+bool CustomButton::FocusInChildWidget() const {
+  return GetWidget() &&
+         GetWidget()->GetRootView()->Contains(
+             GetFocusManager()->GetFocusedView());
+}
+
 }  // namespace views
diff --git a/ui/views/controls/button/custom_button.h b/ui/views/controls/button/custom_button.h
index 713cdea..869bcd7 100644
--- a/ui/views/controls/button/custom_button.h
+++ b/ui/views/controls/button/custom_button.h
@@ -135,6 +135,11 @@
   scoped_ptr<gfx::ThrobAnimation> hover_animation_;
 
  private:
+  // Returns true if this is not a top level widget. Virtual for tests.
+  virtual bool IsChildWidget() const;
+  // Returns true if the focus is not in a top level widget. Virtual for tests.
+  virtual bool FocusInChildWidget() const;
+
   // Should we animate when the state changes? Defaults to true.
   bool animate_on_state_change_;
 
diff --git a/ui/views/controls/button/custom_button_unittest.cc b/ui/views/controls/button/custom_button_unittest.cc
index e6e2ffc2..7a079fe 100644
--- a/ui/views/controls/button/custom_button_unittest.cc
+++ b/ui/views/controls/button/custom_button_unittest.cc
@@ -43,12 +43,36 @@
 
   void Reset() { notified_ = false; }
 
+  // CustomButton methods:
+  bool IsChildWidget() const override { return is_child_widget_; }
+  bool FocusInChildWidget() const override { return focus_in_child_widget_; }
+
+  void set_child_widget(bool b) { is_child_widget_ = b; }
+  void set_focus_in_child_widget(bool b) { focus_in_child_widget_ = b; }
+
  private:
   bool notified_ = false;
+  bool is_child_widget_ = false;
+  bool focus_in_child_widget_ = false;
 
   DISALLOW_COPY_AND_ASSIGN(TestCustomButton);
 };
 
+class TestWidget : public Widget {
+ public:
+  TestWidget() : Widget() {}
+
+  // Widget method:
+  bool IsActive() const override { return active_; }
+
+  void set_active(bool active) { active_ = active; }
+
+ private:
+  bool active_ = false;
+
+  DISALLOW_COPY_AND_ASSIGN(TestWidget);
+};
+
 class CustomButtonTest : public ViewsTestBase {
  public:
   CustomButtonTest() {}
@@ -59,7 +83,7 @@
 
     // Create a widget so that the CustomButton can query the hover state
     // correctly.
-    widget_.reset(new Widget);
+    widget_.reset(new TestWidget);
     Widget::InitParams params = CreateParams(Widget::InitParams::TYPE_POPUP);
     params.ownership = views::Widget::InitParams::WIDGET_OWNS_NATIVE_WIDGET;
     params.bounds = gfx::Rect(0, 0, 650, 650);
@@ -82,11 +106,11 @@
     ViewsTestBase::TearDown();
   }
 
-  Widget* widget() { return widget_.get(); }
+  TestWidget* widget() { return widget_.get(); }
   TestCustomButton* button() { return button_; }
 
  private:
-  scoped_ptr<Widget> widget_;
+  scoped_ptr<TestWidget> widget_;
   TestCustomButton* button_;
 
   DISALLOW_COPY_AND_ASSIGN(CustomButtonTest);
@@ -204,6 +228,33 @@
   EXPECT_FALSE(button()->notified());
 }
 
+TEST_F(CustomButtonTest, HandleAccelerator) {
+  // Child widgets shouldn't handle accelerators when they are not focused.
+  EXPECT_FALSE(button()->IsChildWidget());
+  EXPECT_FALSE(button()->FocusInChildWidget());
+  EXPECT_FALSE(widget()->IsActive());
+  button()->AcceleratorPressed(ui::Accelerator(ui::VKEY_RETURN, ui::EF_NONE));
+  EXPECT_FALSE(button()->notified());
+  // Child without focus.
+  button()->set_child_widget(true);
+  button()->set_focus_in_child_widget(false);
+  button()->AcceleratorPressed(ui::Accelerator(ui::VKEY_RETURN, ui::EF_NONE));
+  EXPECT_FALSE(button()->notified());
+  button()->Reset();
+  // Child with focus.
+  button()->set_child_widget(true);
+  button()->set_focus_in_child_widget(true);
+  button()->AcceleratorPressed(ui::Accelerator(ui::VKEY_RETURN, ui::EF_NONE));
+  EXPECT_TRUE(button()->notified());
+  button()->Reset();
+  // Not a child, but active.
+  button()->set_child_widget(false);
+  button()->set_focus_in_child_widget(true);
+  widget()->set_active(true);
+  button()->AcceleratorPressed(ui::Accelerator(ui::VKEY_RETURN, ui::EF_NONE));
+  EXPECT_TRUE(button()->notified());
+}
+
 // No touch on desktop Mac. Tracked in http://crbug.com/445520.
 #if !defined(OS_MACOSX) || defined(USE_AURA)
 
diff --git a/ui/views/controls/menu/menu_config.cc b/ui/views/controls/menu/menu_config.cc
index 4d1bb53..0d726c54 100644
--- a/ui/views/controls/menu/menu_config.cc
+++ b/ui/views/controls/menu/menu_config.cc
@@ -40,7 +40,6 @@
       use_outer_border(true),
       icons_in_label(false),
       check_selected_combobox_item(false),
-      native_theme(theme),
       show_delay(400),
       corner_radius(0) {
   Init(theme);
diff --git a/ui/views/controls/menu/menu_config.h b/ui/views/controls/menu/menu_config.h
index 936f80f..2a43aca 100644
--- a/ui/views/controls/menu/menu_config.h
+++ b/ui/views/controls/menu/menu_config.h
@@ -116,8 +116,6 @@
   // True if a combobox menu should put a checkmark next to the selected item.
   bool check_selected_combobox_item;
 
-  const ui::NativeTheme* native_theme;
-
   // Delay, in ms, between when menus are selected or moused over and the menu
   // appears.
   int show_delay;
diff --git a/ui/views/controls/menu/menu_controller.cc b/ui/views/controls/menu/menu_controller.cc
index b3a6ada..c744840 100644
--- a/ui/views/controls/menu/menu_controller.cc
+++ b/ui/views/controls/menu/menu_controller.cc
@@ -1217,8 +1217,7 @@
   }
 }
 
-MenuController::MenuController(ui::NativeTheme* theme,
-                               bool blocking,
+MenuController::MenuController(bool blocking,
                                internal::MenuControllerDelegate* delegate)
     : blocking_run_(blocking),
       showing_(false),
@@ -1238,7 +1237,6 @@
       active_mouse_view_id_(ViewStorage::GetInstance()->CreateStorageID()),
       delegate_(delegate),
       message_loop_depth_(0),
-      menu_config_(theme),
       closing_event_time_(base::TimeDelta()),
       menu_start_time_(base::TimeTicks()),
       is_combobox_(false),
@@ -1733,9 +1731,10 @@
 }
 
 void MenuController::StartShowTimer() {
-  show_timer_.Start(FROM_HERE,
-                    TimeDelta::FromMilliseconds(menu_config_.show_delay),
-                    this, &MenuController::CommitPendingSelection);
+  MenuItemView* item = pending_state_.item ? pending_state_.item : state_.item;
+  show_timer_.Start(
+      FROM_HERE, TimeDelta::FromMilliseconds(item->GetMenuConfig().show_delay),
+      this, &MenuController::CommitPendingSelection);
 }
 
 void MenuController::StopShowTimer() {
diff --git a/ui/views/controls/menu/menu_controller.h b/ui/views/controls/menu/menu_controller.h
index 0b5344d..2a26bf4 100644
--- a/ui/views/controls/menu/menu_controller.h
+++ b/ui/views/controls/menu/menu_controller.h
@@ -30,7 +30,6 @@
 class Screen;
 }
 namespace ui {
-class NativeTheme;
 class OSExchangeData;
 class ScopedEventDispatcher;
 }
@@ -303,8 +302,7 @@
 
   // Creates a MenuController. If |blocking| is true a nested message loop is
   // started in |Run|.
-  MenuController(ui::NativeTheme* theme,
-                 bool blocking,
+  MenuController(bool blocking,
                  internal::MenuControllerDelegate* delegate);
 
   ~MenuController() override;
@@ -636,8 +634,6 @@
   // showing a context menu from a menu).
   int message_loop_depth_;
 
-  views::MenuConfig menu_config_;
-
   // The timestamp of the event which closed the menu - or 0 otherwise.
   base::TimeDelta closing_event_time_;
 
diff --git a/ui/views/controls/menu/menu_controller_unittest.cc b/ui/views/controls/menu/menu_controller_unittest.cc
index 9aa008f8..6538333 100644
--- a/ui/views/controls/menu/menu_controller_unittest.cc
+++ b/ui/views/controls/menu/menu_controller_unittest.cc
@@ -214,7 +214,7 @@
   }
 
   void SetupMenuController() {
-    menu_controller_= new MenuController(nullptr, true, nullptr);
+    menu_controller_= new MenuController(true, nullptr);
     menu_controller_->owner_ = owner_.get();
     menu_controller_->showing_ = true;
     menu_controller_->SetSelection(
diff --git a/ui/views/controls/menu/menu_item_view.cc b/ui/views/controls/menu/menu_item_view.cc
index 36d6ab6..ff2737e 100644
--- a/ui/views/controls/menu/menu_item_view.cc
+++ b/ui/views/controls/menu/menu_item_view.cc
@@ -568,10 +568,7 @@
 }
 
 const MenuConfig& MenuItemView::GetMenuConfig() const {
-  const MenuController* controller = GetMenuController();
-  if (controller)
-    return controller->menu_config_;
-  return MenuConfig::instance(NULL);
+  return MenuConfig::instance(GetNativeTheme());
 }
 
 MenuItemView::MenuItemView(MenuItemView* parent,
diff --git a/ui/views/controls/menu/menu_runner_impl.cc b/ui/views/controls/menu/menu_runner_impl.cc
index 8ce4f3f3..b8270c2b 100644
--- a/ui/views/controls/menu/menu_runner_impl.cc
+++ b/ui/views/controls/menu/menu_runner_impl.cc
@@ -109,9 +109,7 @@
   owns_controller_ = false;
   if (!controller) {
     // No menus are showing, show one.
-    ui::NativeTheme* theme =
-        parent ? parent->GetNativeTheme() : ui::NativeTheme::instance();
-    controller = new MenuController(theme, !for_drop_, this);
+    controller = new MenuController(!for_drop_, this);
     owns_controller_ = true;
   }
   controller->set_is_combobox((run_types & MenuRunner::COMBOBOX) != 0);
diff --git a/ui/views/controls/menu/menu_scroll_view_container.cc b/ui/views/controls/menu/menu_scroll_view_container.cc
index f7490d8e..4412a33 100644
--- a/ui/views/controls/menu/menu_scroll_view_container.cc
+++ b/ui/views/controls/menu/menu_scroll_view_container.cc
@@ -8,6 +8,7 @@
 #include "third_party/skia/include/core/SkPath.h"
 #include "ui/accessibility/ax_view_state.h"
 #include "ui/gfx/canvas.h"
+#include "ui/gfx/color_palette.h"
 #include "ui/views/border.h"
 #include "ui/views/bubble/bubble_border.h"
 #include "ui/views/controls/menu/menu_config.h"
@@ -201,18 +202,11 @@
   bubble_border_->set_arrow_offset(offset);
 }
 
-void MenuScrollViewContainer::OnPaintBackground(gfx::Canvas* canvas) {
-  if (background()) {
-    View::OnPaintBackground(canvas);
-    return;
-  }
-
-  gfx::Rect bounds(0, 0, width(), height());
-  NativeTheme::ExtraParams extra;
-  const MenuConfig& menu_config = content_view_->GetMenuItem()->GetMenuConfig();
-  extra.menu_background.corner_radius = menu_config.corner_radius;
-  GetNativeTheme()->Paint(canvas->sk_canvas(),
-      NativeTheme::kMenuPopupBackground, NativeTheme::kNormal, bounds, extra);
+gfx::Size MenuScrollViewContainer::GetPreferredSize() const {
+  gfx::Size prefsize = scroll_view_->GetContents()->GetPreferredSize();
+  gfx::Insets insets = GetInsets();
+  prefsize.Enlarge(insets.width(), insets.height());
+  return prefsize;
 }
 
 void MenuScrollViewContainer::Layout() {
@@ -242,11 +236,24 @@
   scroll_view_->Layout();
 }
 
-gfx::Size MenuScrollViewContainer::GetPreferredSize() const {
-  gfx::Size prefsize = scroll_view_->GetContents()->GetPreferredSize();
-  gfx::Insets insets = GetInsets();
-  prefsize.Enlarge(insets.width(), insets.height());
-  return prefsize;
+void MenuScrollViewContainer::OnNativeThemeChanged(
+    const ui::NativeTheme* theme) {
+  if (arrow_ == BubbleBorder::NONE)
+    CreateDefaultBorder();
+}
+
+void MenuScrollViewContainer::OnPaintBackground(gfx::Canvas* canvas) {
+  if (background()) {
+    View::OnPaintBackground(canvas);
+    return;
+  }
+
+  gfx::Rect bounds(0, 0, width(), height());
+  NativeTheme::ExtraParams extra;
+  const MenuConfig& menu_config = content_view_->GetMenuItem()->GetMenuConfig();
+  extra.menu_background.corner_radius = menu_config.corner_radius;
+  GetNativeTheme()->Paint(canvas->sk_canvas(),
+      NativeTheme::kMenuPopupBackground, NativeTheme::kNormal, bounds, extra);
 }
 
 void MenuScrollViewContainer::GetAccessibleState(
@@ -270,8 +277,8 @@
 }
 
 void MenuScrollViewContainer::CreateDefaultBorder() {
-  arrow_ = BubbleBorder::NONE;
-  bubble_border_ = NULL;
+  DCHECK_EQ(arrow_, BubbleBorder::NONE);
+  bubble_border_ = nullptr;
 
   const MenuConfig& menu_config =
       content_view_->GetMenuItem()->GetMenuConfig();
@@ -286,11 +293,12 @@
   int right = menu_config.menu_horizontal_border_size + padding;
 
   if (menu_config.use_outer_border) {
+    SkColor color = GetNativeTheme()
+                        ? GetNativeTheme()->GetSystemColor(
+                              ui::NativeTheme::kColorId_MenuBorderColor)
+                        : gfx::kPlaceholderColor;
     SetBorder(views::Border::CreateBorderPainter(
-        new views::RoundRectPainter(
-            menu_config.native_theme->GetSystemColor(
-                ui::NativeTheme::kColorId_MenuBorderColor),
-            menu_config.corner_radius),
+        new views::RoundRectPainter(color, menu_config.corner_radius),
         gfx::Insets(top, left, bottom, right)));
   } else {
     SetBorder(Border::CreateEmptyBorder(top, left, bottom, right));
diff --git a/ui/views/controls/menu/menu_scroll_view_container.h b/ui/views/controls/menu/menu_scroll_view_container.h
index 1457cd9..dc83f25 100644
--- a/ui/views/controls/menu/menu_scroll_view_container.h
+++ b/ui/views/controls/menu/menu_scroll_view_container.h
@@ -31,10 +31,11 @@
   void SetBubbleArrowOffset(int offset);
 
   // View overrides.
-  void OnPaintBackground(gfx::Canvas* canvas) override;
-  void Layout() override;
   gfx::Size GetPreferredSize() const override;
+  void Layout() override;
+  void OnPaintBackground(gfx::Canvas* canvas) override;
   void GetAccessibleState(ui::AXViewState* state) override;
+  void OnNativeThemeChanged(const ui::NativeTheme* theme) override;
 
  protected:
   // View override.
diff --git a/ui/views/controls/menu/menu_separator_win.cc b/ui/views/controls/menu/menu_separator_win.cc
index ebbb38c..182cc2b 100644
--- a/ui/views/controls/menu/menu_separator_win.cc
+++ b/ui/views/controls/menu/menu_separator_win.cc
@@ -13,22 +13,19 @@
 #include "ui/gfx/win/dpi.h"
 #include "ui/native_theme/native_theme.h"
 #include "ui/native_theme/native_theme_aura.h"
-#include "ui/views/controls/menu/menu_config.h"
 #include "ui/views/controls/menu/menu_item_view.h"
 
 namespace views {
 
 void MenuSeparator::OnPaint(gfx::Canvas* canvas) {
-  const MenuConfig& config = parent_menu_item_->GetMenuConfig();
-
-  if (config.native_theme == ui::NativeThemeAura::instance()) {
+  ui::NativeTheme* native_theme = GetNativeTheme();
+  if (native_theme == ui::NativeThemeAura::instance()) {
     OnPaintAura(canvas);
     return;
   }
 
   gfx::Rect separator_bounds = GetPaintBounds();
 
-
   // Hack to get the separator to display correctly on Windows where we may
   // have fractional scales. We move the separator 1 pixel down to ensure that
   // it falls within the clipping rect which is scaled up.
@@ -39,7 +36,7 @@
     separator_bounds.set_y(1);
 
   ui::NativeTheme::ExtraParams extra;
-  config.native_theme->Paint(
+  native_theme->Paint(
       canvas->sk_canvas(), ui::NativeTheme::kMenuPopupSeparator,
       ui::NativeTheme::kNormal, separator_bounds, extra);
 }
diff --git a/ui/views/widget/desktop_aura/desktop_window_tree_host_x11.cc b/ui/views/widget/desktop_aura/desktop_window_tree_host_x11.cc
index 298c92b..d02dede8 100644
--- a/ui/views/widget/desktop_aura/desktop_window_tree_host_x11.cc
+++ b/ui/views/widget/desktop_aura/desktop_window_tree_host_x11.cc
@@ -1084,10 +1084,11 @@
 
 void DesktopWindowTreeHostX11::InitX11Window(
     const Widget::InitParams& params) {
-  unsigned long attribute_mask = CWBackPixmap;
+  unsigned long attribute_mask = CWBackPixmap | CWBitGravity;
   XSetWindowAttributes swa;
   memset(&swa, 0, sizeof(swa));
   swa.background_pixmap = None;
+  swa.bit_gravity = NorthWestGravity;
 
   ::Atom window_type;
   switch (params.type) {