diff --git a/DEPS b/DEPS
index 5724b180d..35052cb 100644
--- a/DEPS
+++ b/DEPS
@@ -127,11 +127,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling Skia
   # and whatever else without interference from each other.
-  'skia_revision': '969659dbb3137fb3b5c55e5fc46ec071b6fb5b96',
+  'skia_revision': '18e5841c0daea74657d22dbff2694e5026b8bb52',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling V8
   # and whatever else without interference from each other.
-  'v8_revision': '43b5c7b043dccc5261adb408ba2d845e52d845e2',
+  'v8_revision': '045e76296f66cba2ef67bcfb39fd3ff38236f282',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling swarming_client
   # and whatever else without interference from each other.
@@ -139,11 +139,11 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling ANGLE
   # and whatever else without interference from each other.
-  'angle_revision': 'b9039bf76bf3a4caba6475ce5d62c1cf8611978a',
+  'angle_revision': 'cf9b2853a7e71e67c1197ebafcb7c0f1e4ca6b68',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling SwiftShader
   # and whatever else without interference from each other.
-  'swiftshader_revision': 'b607bc8800c1a13d80e4c79be73172fa7d785017',
+  'swiftshader_revision': '7aafb27453d352a704ccae3805b43fc6422edaca',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling PDFium
   # and whatever else without interference from each other.
@@ -190,7 +190,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling catapult
   # and whatever else without interference from each other.
-  'catapult_revision': 'a74495a2956d6bfb592db832406acc93113ddda7',
+  'catapult_revision': 'b4fdbb737c9841960237a182dc531b1fafb3c2d1',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling libFuzzer
   # and whatever else without interference from each other.
@@ -254,7 +254,7 @@
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
-  'dawn_revision': 'fda0617505c160153d330d6ab47812a354203728',
+  'dawn_revision': '87bf834109fd5d372e62901101f285d4fb65fe67',
   # Three lines of non-changing comments so that
   # the commit queue can handle CLs rolling feed
   # and whatever else without interference from each other.
@@ -738,12 +738,12 @@
 
   # Build tools for Chrome OS. Note: This depends on third_party/pyelftools.
   'src/third_party/chromite': {
-      'url': Var('chromium_git') + '/chromiumos/chromite.git' + '@' + '12a4eb908a7b6d697bf75af753b9e08b3352ffa2',
+      'url': Var('chromium_git') + '/chromiumos/chromite.git' + '@' + '202f8887f83f2b5acc9be38ddac66475faa0ffd9',
       'condition': 'checkout_linux',
   },
 
   'src/third_party/cld_3/src':
-    Var('chromium_git') + '/external/github.com/google/cld_3.git' + '@' + '484afe9ba7438d078e60b3a26e7fb590213c0e17',
+    Var('chromium_git') + '/external/github.com/google/cld_3.git' + '@' + 'c0e79be769c519bd8f92cf6079be6155a1bff579',
 
   'src/third_party/colorama/src':
     Var('chromium_git') + '/external/colorama.git' + '@' + '799604a1041e9b3bc5d2789ecbd7e8db2e18e6b8',
@@ -763,7 +763,7 @@
   },
 
   'src/third_party/depot_tools':
-    Var('chromium_git') + '/chromium/tools/depot_tools.git' + '@' + 'c0546b9817eea795277e517d5dac382d6b69b778',
+    Var('chromium_git') + '/chromium/tools/depot_tools.git' + '@' + 'e83100437106c8303aa955d2bafb6b8b1978ed59',
 
   'src/third_party/devtools-node-modules':
     Var('chromium_git') + '/external/github.com/ChromeDevTools/devtools-node-modules' + '@' + Var('devtools_node_modules_revision'),
@@ -908,7 +908,7 @@
   },
 
   'src/third_party/hunspell_dictionaries':
-    Var('chromium_git') + '/chromium/deps/hunspell_dictionaries.git' + '@' + 'a9bac57ce6c9d390a52ebaad3259f5fdb871210e',
+    Var('chromium_git') + '/chromium/deps/hunspell_dictionaries.git' + '@' + 'f7ce90e84f5aa9acfbc9b7ca04e567bf471e5bcd',
 
   'src/third_party/icu':
     Var('chromium_git') + '/chromium/deps/icu.git' + '@' + '960f195aa87acaec46e6104ec93a596da7ae0843',
@@ -955,7 +955,7 @@
     Var('chromium_git') + '/chromium/llvm-project/compiler-rt/lib/fuzzer.git' + '@' +  Var('libfuzzer_revision'),
 
   'src/third_party/libaddressinput/src':
-    Var('chromium_git') + '/external/libaddressinput.git' + '@' + 'd7ed8e2f3f35ce9a3aafdfdc48745ceab66e7229',
+    Var('chromium_git') + '/external/libaddressinput.git' + '@' + '81e7ead903f5b71a326e0584f4325f106c804df1',
 
   'src/third_party/libaom/source/libaom':
     Var('aomedia_git') + '/aom.git' + '@' +  '625cded0550bb79efd10d98a9809a7ccd72a8f60',
@@ -1276,7 +1276,7 @@
     Var('chromium_git') + '/external/khronosgroup/webgl.git' + '@' + 'a0f51b2e123f39c9ff12e621b0b47dd28dd64424',
 
   'src/third_party/webrtc':
-    Var('webrtc_git') + '/src.git' + '@' + 'e11b7d2e8087262bc29d41ae3782ed94824cbe3f',
+    Var('webrtc_git') + '/src.git' + '@' + '8aa00f03714806b74f7f47d951b91af8e0f49968',
 
   'src/third_party/xdg-utils': {
       'url': Var('chromium_git') + '/chromium/deps/xdg-utils.git' + '@' + 'd80274d5869b17b8c9067a1022e4416ee7ed5e0d',
@@ -1317,7 +1317,7 @@
     Var('chromium_git') + '/v8/v8.git' + '@' +  Var('v8_revision'),
 
   'src-internal': {
-    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@4309189029fc996cb710002caab203228b77f8a1',
+    'url': 'https://chrome-internal.googlesource.com/chrome/src-internal.git@67e798b11f20401e6132adc5bff499de28291978',
     'condition': 'checkout_src_internal',
   },
 
diff --git a/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsTest.java b/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsTest.java
index da14008..cfa7690e 100644
--- a/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsTest.java
+++ b/android_webview/javatests/src/org/chromium/android_webview/test/AwContentsTest.java
@@ -11,6 +11,7 @@
 import android.graphics.Bitmap;
 import android.graphics.BitmapFactory;
 import android.graphics.Canvas;
+import android.graphics.Color;
 import android.os.Handler;
 import android.os.Looper;
 import android.os.Message;
@@ -758,6 +759,68 @@
     @Test
     @Feature({"AndroidWebView"})
     @SmallTest
+    public void testHardwareRenderingSmokeTest() throws Throwable {
+        AwTestContainerView testView =
+                mActivityTestRule.createAwTestContainerViewOnMainSync(mContentsClient);
+        final AwContents awContents = testView.getAwContents();
+        String html = "<html>"
+                + "  <body style=\""
+                + "       padding: 0;"
+                + "       margin: 0;"
+                + "       display: grid;"
+                + "       display: grid;"
+                + "       grid-template-columns: 50% 50%;"
+                + "       grid-template-rows: 50% 50%;\">"
+                + "   <div style=\"background-color: rgb(255, 0, 0);\"></div>"
+                + "   <div style=\"background-color: rgb(0, 255, 0);\"></div>"
+                + "   <div style=\"background-color: rgb(0, 0, 255);\"></div>"
+                + "   <div style=\"background-color: rgb(128, 128, 128);\"></div>"
+                + "  </body>"
+                + "</html>";
+        mActivityTestRule.loadDataSync(testView.getAwContents(),
+                mContentsClient.getOnPageFinishedHelper(), html, "text/html", false);
+        mActivityTestRule.waitForVisualStateCallback(testView.getAwContents());
+
+        // Poll for 10s in case raster is slow.
+        final Object lock = new Object();
+        final Object[] resultHolder = new Object[1];
+        for (int i = 0; i < 100; ++i) {
+            mActivityTestRule.runOnUiThread(() -> {
+                testView.readbackQuadrantColors((int[] result) -> {
+                    synchronized (lock) {
+                        resultHolder[0] = result;
+                        lock.notifyAll();
+                    }
+                });
+            });
+            int[] quadrantColors;
+            synchronized (lock) {
+                while (resultHolder[0] == null) {
+                    lock.wait();
+                }
+                quadrantColors = (int[]) resultHolder[0];
+            }
+            if (Color.rgb(255, 0, 0) == quadrantColors[0]
+                    && Color.rgb(0, 255, 0) == quadrantColors[1]
+                    && Color.rgb(0, 0, 255) == quadrantColors[2]
+                    && Color.rgb(128, 128, 128) == quadrantColors[3]) {
+                return;
+            }
+            Thread.sleep(100);
+        }
+        // If this test is failing for your CL, then chances are your change is breaking Android
+        // WebView hardware rendering. Please build the "real" webview and check if this is the
+        // case and if so, fix your CL.
+        int[] quadrantColors = (int[]) resultHolder[0];
+        Assert.assertEquals(Color.rgb(255, 0, 0), quadrantColors[0]);
+        Assert.assertEquals(Color.rgb(0, 255, 0), quadrantColors[1]);
+        Assert.assertEquals(Color.rgb(0, 0, 255), quadrantColors[2]);
+        Assert.assertEquals(Color.rgb(128, 128, 128), quadrantColors[3]);
+    }
+
+    @Test
+    @Feature({"AndroidWebView"})
+    @SmallTest
     public void testFixupOctothorpesInLoadDataContent() {
         // If there are no octothorpes the function should have no effect.
         final String noOctothorpeString = "<div id='foo1'>This content has no octothorpe</div>";
diff --git a/android_webview/test/shell/src/org/chromium/android_webview/test/AwTestContainerView.java b/android_webview/test/shell/src/org/chromium/android_webview/test/AwTestContainerView.java
index c19edf3..17ecebed 100644
--- a/android_webview/test/shell/src/org/chromium/android_webview/test/AwTestContainerView.java
+++ b/android_webview/test/shell/src/org/chromium/android_webview/test/AwTestContainerView.java
@@ -9,6 +9,7 @@
 import android.content.Intent;
 import android.content.res.Configuration;
 import android.graphics.Canvas;
+import android.graphics.Color;
 import android.graphics.PixelFormat;
 import android.graphics.Rect;
 import android.opengl.GLSurfaceView;
@@ -27,8 +28,11 @@
 import org.chromium.android_webview.AwContents;
 import org.chromium.android_webview.AwDrawFnImpl;
 import org.chromium.android_webview.shell.DrawFn;
+import org.chromium.base.Callback;
 import org.chromium.content_public.browser.WebContents;
 
+import java.nio.ByteBuffer;
+
 import javax.microedition.khronos.egl.EGLConfig;
 import javax.microedition.khronos.opengles.GL10;
 
@@ -55,10 +59,12 @@
         // are protected by it.
         private final Object mSyncLock = new Object();
         private int mFunctor;
+        private int mLastDrawnFunctor;
         private boolean mSyncDone;
         private boolean mPendingDestroy;
         private int mLastScrollX;
         private int mLastScrollY;
+        private Callback<int[]> mQuadrantReadbackCallback;
 
         // Only used by drawGL on render thread to store the value of scroll offsets at most recent
         // sync for subsequent draws.
@@ -80,7 +86,7 @@
 
                 @Override
                 public void onDrawFrame(GL10 gl) {
-                    HardwareView.this.onDrawFrame(mWidth, mHeight);
+                    HardwareView.this.onDrawFrame(gl, mWidth, mHeight);
                 }
 
                 @Override
@@ -98,6 +104,14 @@
             setRenderMode(GLSurfaceView.RENDERMODE_WHEN_DIRTY);
         }
 
+        public void readbackQuadrantColors(Callback<int[]> callback) {
+            synchronized (mSyncLock) {
+                assert mQuadrantReadbackCallback == null;
+                mQuadrantReadbackCallback = callback;
+            }
+            super.requestRender();
+        }
+
         public boolean isReadyToRender() {
             return mHaveSurface;
         }
@@ -169,32 +183,69 @@
             }
         }
 
-        public void onDrawFrame(int width, int height) {
+        public void onDrawFrame(GL10 gl, int width, int height) {
             int functor;
             int scrollX;
             int scrollY;
             synchronized (mSyncLock) {
-                functor = mFunctor;
-                mFunctor = 0;
                 scrollX = mLastScrollX;
                 scrollY = mLastScrollY;
 
-                if (functor != 0) {
+                if (mFunctor != 0) {
                     assert !mSyncDone;
+                    functor = mFunctor;
+                    mLastDrawnFunctor = mFunctor;
+                    mFunctor = 0;
                     DrawFn.sync(functor, false);
                     mSyncDone = true;
                     mSyncLock.notifyAll();
-                } else if (mPendingDestroy) {
-                    DrawFn.destroyReleased();
-                    mPendingDestroy = false;
-                    mSyncLock.notifyAll();
-                    return;
+                } else {
+                    functor = mLastDrawnFunctor;
+                    if (mPendingDestroy) {
+                        DrawFn.destroyReleased();
+                        mPendingDestroy = false;
+                        mLastDrawnFunctor = 0;
+                        mSyncLock.notifyAll();
+                        return;
+                    }
                 }
             }
             if (functor != 0) {
                 DrawFn.drawGL(functor, width, height, scrollX, scrollY);
+
+                Callback<int[]> quadrantReadbackCallback = null;
+                synchronized (mSyncLock) {
+                    if (mQuadrantReadbackCallback != null) {
+                        quadrantReadbackCallback = mQuadrantReadbackCallback;
+                        mQuadrantReadbackCallback = null;
+                    }
+                }
+                if (quadrantReadbackCallback != null) {
+                    int quadrantColors[] = new int[4];
+                    int quarterWidth = width / 4;
+                    int quarterHeight = height / 4;
+                    ByteBuffer buffer = ByteBuffer.allocate(4);
+                    gl.glReadPixels(quarterWidth, quarterHeight * 3, 1, 1, GL10.GL_RGBA,
+                            GL10.GL_UNSIGNED_BYTE, buffer);
+                    quadrantColors[0] = readbackToColor(buffer);
+                    gl.glReadPixels(quarterWidth * 3, quarterHeight * 3, 1, 1, GL10.GL_RGBA,
+                            GL10.GL_UNSIGNED_BYTE, buffer);
+                    quadrantColors[1] = readbackToColor(buffer);
+                    gl.glReadPixels(quarterWidth, quarterHeight, 1, 1, GL10.GL_RGBA,
+                            GL10.GL_UNSIGNED_BYTE, buffer);
+                    quadrantColors[2] = readbackToColor(buffer);
+                    gl.glReadPixels(quarterWidth * 3, quarterHeight, 1, 1, GL10.GL_RGBA,
+                            GL10.GL_UNSIGNED_BYTE, buffer);
+                    quadrantColors[3] = readbackToColor(buffer);
+                    quadrantReadbackCallback.onResult(quadrantColors);
+                }
             }
         }
+
+        private int readbackToColor(ByteBuffer buffer) {
+            return Color.argb(buffer.get(3) & 0xff, buffer.get(0) & 0xff, buffer.get(1) & 0xff,
+                    buffer.get(2) & 0xff);
+        }
     }
 
     private static boolean sCreatedOnce;
@@ -234,6 +285,14 @@
         return mHardwareView != null;
     }
 
+    /**
+     * Use glReadPixels to get 4 pixels from center of 4 quadrants. Result is in row-major order.
+     */
+    public void readbackQuadrantColors(Callback<int[]> callback) {
+        assert isBackedByHardwareView();
+        mHardwareView.readbackQuadrantColors(callback);
+    }
+
     public WebContents getWebContents() {
         return mAwContents.getWebContents();
     }
diff --git a/ash/shelf/login_shelf_view.cc b/ash/shelf/login_shelf_view.cc
index 87f3f72..74478fd 100644
--- a/ash/shelf/login_shelf_view.cc
+++ b/ash/shelf/login_shelf_view.cc
@@ -430,13 +430,11 @@
     }
   } else {
     // Focus goes to status area.
-    Shelf::ForWindow(GetWidget()->GetNativeWindow())
-        ->GetStatusAreaWidget()
-        ->status_area_widget_delegate()
+    StatusAreaWidget* status_area_widget =
+        Shelf::ForWindow(GetWidget()->GetNativeWindow())->GetStatusAreaWidget();
+    status_area_widget->status_area_widget_delegate()
         ->set_default_last_focusable_child(reverse);
-    Shell::Get()->focus_cycler()->FocusWidget(
-        Shelf::ForWindow(GetWidget()->GetNativeWindow())
-            ->GetStatusAreaWidget());
+    Shell::Get()->focus_cycler()->FocusWidget(status_area_widget);
   }
 }
 
diff --git a/ash/shelf/shelf_button.cc b/ash/shelf/shelf_button.cc
index abd273dd..10279b0 100644
--- a/ash/shelf/shelf_button.cc
+++ b/ash/shelf/shelf_button.cc
@@ -54,6 +54,10 @@
   return true;
 }
 
+void ShelfButton::AboutToRequestFocusFromTabTraversal(bool reverse) {
+  shelf_view_->OnShelfButtonAboutToRequestFocusFromTabTraversal(this, reverse);
+}
+
 // Do not remove this function to avoid unnecessary ChromeVox announcement
 // triggered by Button::GetAccessibleNodeData. (See https://crbug.com/932200)
 void ShelfButton::GetAccessibleNodeData(ui::AXNodeData* node_data) {
diff --git a/ash/shelf/shelf_button.h b/ash/shelf/shelf_button.h
index 38da03c..00bc50b8 100644
--- a/ash/shelf/shelf_button.h
+++ b/ash/shelf/shelf_button.h
@@ -23,6 +23,7 @@
   void OnMouseReleased(const ui::MouseEvent& event) override;
   void OnMouseCaptureLost() override;
   bool OnMouseDragged(const ui::MouseEvent& event) override;
+  void AboutToRequestFocusFromTabTraversal(bool reverse) override;
   void GetAccessibleNodeData(ui::AXNodeData* node_data) override;
   bool GetTooltipText(const gfx::Point& p,
                       base::string16* tooltip) const override;
diff --git a/ash/shelf/shelf_view.cc b/ash/shelf/shelf_view.cc
index 46ab053d..280da49 100644
--- a/ash/shelf/shelf_view.cc
+++ b/ash/shelf/shelf_view.cc
@@ -8,6 +8,7 @@
 #include <memory>
 
 #include "ash/drag_drop/drag_image_view.h"
+#include "ash/focus_cycler.h"
 #include "ash/metrics/user_metrics_recorder.h"
 #include "ash/public/cpp/ash_constants.h"
 #include "ash/public/cpp/shelf_item_delegate.h"
@@ -33,6 +34,7 @@
 #include "ash/system/model/system_tray_model.h"
 #include "ash/system/model/virtual_keyboard_model.h"
 #include "ash/system/status_area_widget.h"
+#include "ash/system/status_area_widget_delegate.h"
 #include "ash/wm/mru_window_tracker.h"
 #include "ash/wm/root_window_finder.h"
 #include "ash/wm/tablet_mode/tablet_mode_controller.h"
@@ -204,7 +206,7 @@
       new_index = 0;
 
     if (new_index >= overflow_cutoff)
-      shelf_view_->shelf_widget()->set_activated_from_overflow_bubble(true);
+      shelf_view_->shelf_widget()->set_activated_from_other_widget(true);
     return focusable_views[new_index];
   }
 
@@ -816,13 +818,44 @@
   return open_windows;
 }
 
+views::View* ShelfView::FindFirstFocusableChild() {
+  if (is_overflow_mode())
+    return main_shelf()->FindFirstFocusableChild();
+  return view_model_->view_at(first_visible_index());
+}
+
+views::View* ShelfView::FindLastFocusableChild() {
+  if (is_showing_overflow_bubble())
+    return overflow_shelf()->FindLastFocusableChild();
+  return overflow_button_->visible()
+             ? overflow_button_
+             : view_model_->view_at(last_visible_index());
+}
+
 views::View* ShelfView::FindFirstOrLastFocusableChild(bool last) {
-  if (last) {
-    return overflow_button_->visible()
-               ? overflow_button_
-               : view_model_->view_at(last_visible_index());
-  } else {
-    return view_model_->view_at(first_visible_index());
+  return last ? FindLastFocusableChild() : FindFirstFocusableChild();
+}
+
+void ShelfView::OnShelfButtonAboutToRequestFocusFromTabTraversal(
+    ShelfButton* button,
+    bool reverse) {
+  if (is_overflow_mode()) {
+    main_shelf()->OnShelfButtonAboutToRequestFocusFromTabTraversal(button,
+                                                                   reverse);
+    return;
+  }
+
+  // The logic here seems backwards, but is actually correct. For instance if
+  // the ShelfView's internal focus cycling logic attemmpts to focus the first
+  // child (e.g. app list button) after hitting Tab, we intercept that and
+  // instead, advance through to the status area.
+  if ((reverse && button == FindLastFocusableChild()) ||
+      (!reverse && button == FindFirstFocusableChild())) {
+    StatusAreaWidget* status_area_widget =
+        Shelf::ForWindow(GetWidget()->GetNativeWindow())->GetStatusAreaWidget();
+    status_area_widget->status_area_widget_delegate()
+        ->set_default_last_focusable_child(reverse);
+    Shell::Get()->focus_cycler()->FocusWidget(status_area_widget);
   }
 }
 
diff --git a/ash/shelf/shelf_view.h b/ash/shelf/shelf_view.h
index ad53ddcd..fd70f23 100644
--- a/ash/shelf/shelf_view.h
+++ b/ash/shelf/shelf_view.h
@@ -54,6 +54,7 @@
 class ScopedRootWindowForNewWindows;
 class Shelf;
 class ShelfAppButton;
+class ShelfButton;
 class ShelfModel;
 struct ShelfItem;
 class ShelfMenuModelAdapter;
@@ -264,7 +265,20 @@
   const std::vector<aura::Window*> GetOpenWindowsForShelfView(
       views::View* view);
 
+  // The three methods below return the first or last focusable child of the
+  // set including both the main shelf and the overflow shelf it it's showing.
+  // - The first focusable child is either the app list button, or the back
+  //   button in tablet mode.
+  // - The last focusable child can be either 1) the last app icon on the main
+  //   shelf if there aren't enough apps to overflow, 2) the overflow button
+  //   if it's visible but the overflow bubble isn't showing, or 3) the last
+  //   app icon in the overflow bubble if it's showing.
   views::View* FindFirstOrLastFocusableChild(bool last);
+  views::View* FindFirstFocusableChild();
+  views::View* FindLastFocusableChild();
+
+  void OnShelfButtonAboutToRequestFocusFromTabTraversal(ShelfButton* button,
+                                                        bool reverse);
 
   // Return the view model for test purposes.
   const views::ViewModel* view_model_for_test() const {
@@ -292,6 +306,9 @@
   //     small resolution screen, the overflow bubble can show the app list
   //     button.
   bool is_overflow_mode() const { return overflow_mode_; }
+  bool is_showing_overflow_bubble() const {
+    return overflow_bubble_ && overflow_bubble_->IsShowing();
+  }
 
   int first_visible_index() const { return first_visible_index_; }
   int last_visible_index() const { return last_visible_index_; }
diff --git a/ash/shelf/shelf_view_unittest.cc b/ash/shelf/shelf_view_unittest.cc
index e3c2213..4e878b4 100644
--- a/ash/shelf/shelf_view_unittest.cc
+++ b/ash/shelf/shelf_view_unittest.cc
@@ -90,6 +90,16 @@
   return display::Screen::GetScreen()->GetPrimaryDisplay().id();
 }
 
+void ExpectFocused(views::View* view) {
+  EXPECT_TRUE(view->GetWidget()->IsActive());
+  EXPECT_TRUE(view->Contains(view->GetFocusManager()->GetFocusedView()));
+}
+
+void ExpectNotFocused(views::View* view) {
+  EXPECT_FALSE(view->GetWidget()->IsActive());
+  EXPECT_FALSE(view->Contains(view->GetFocusManager()->GetFocusedView()));
+}
+
 class TestShelfObserver : public ShelfObserver {
  public:
   explicit TestShelfObserver(Shelf* shelf) : shelf_(shelf) {
@@ -3450,8 +3460,13 @@
     AddAppShortcut();
     AddAppShortcut();
 
-    // Focus the shelf.
     Shelf* shelf = Shelf::ForWindow(Shell::GetPrimaryRootWindow());
+    gfx::NativeWindow window = shelf->shelf_widget()->GetNativeWindow();
+    status_area_ = RootWindowController::ForWindow(window)
+                       ->GetStatusAreaWidget()
+                       ->GetContentsView();
+
+    // Focus the shelf.
     Shell::Get()->focus_cycler()->FocusWidget(shelf->shelf_widget());
   }
 
@@ -3466,6 +3481,9 @@
                        ui::EventFlags::EF_SHIFT_DOWN);
   }
 
+ protected:
+  views::View* status_area_ = nullptr;
+
  private:
   DISALLOW_COPY_AND_ASSIGN(ShelfViewFocusTest);
 };
@@ -3496,19 +3514,16 @@
   DoTab();
   DoTab();
   EXPECT_TRUE(test_api_->GetViewAt(4)->HasFocus());
-
-  // The last element is currently focused so pressing tab once should advance
-  // focus to the first element.
-  DoTab();
-  EXPECT_TRUE(test_api_->GetViewAt(1)->HasFocus());
 }
 
 // Tests that the expected views have focus when cycling backwards through shelf
 // items with shift tab.
 TEST_F(ShelfViewFocusTest, BackwardCycling) {
-  // The first element is currently focused so pressing shift tab once should
-  // advance focus to the last element.
-  DoShiftTab();
+  // The first element is currently focused. Let's advance to the last element
+  // first.
+  DoTab();
+  DoTab();
+  DoTab();
   EXPECT_TRUE(test_api_->GetViewAt(4)->HasFocus());
 
   // Pressing shift tab once should advance focus to the previous element.
@@ -3526,6 +3541,41 @@
   EXPECT_TRUE(::wm::IsActiveWindow(window.get()));
 }
 
+// Verifies that focus moves as expected between the shelf and the status area.
+TEST_F(ShelfViewFocusTest, FocusCyclingBetweenShelfAndStatusWidget) {
+  // The first element of the shelf is focused at start.
+
+  // Focus the next few elements.
+  DoTab();
+  EXPECT_TRUE(test_api_->GetViewAt(2)->HasFocus());
+  DoTab();
+  EXPECT_TRUE(test_api_->GetViewAt(3)->HasFocus());
+  DoTab();
+  EXPECT_TRUE(test_api_->GetViewAt(4)->HasFocus());
+
+  // This is the last element. Tabbing once more should go into the status
+  // area.
+  DoTab();
+  ExpectNotFocused(shelf_view_);
+  ExpectFocused(status_area_);
+
+  // Shift-tab: we should be back at the last element in the shelf.
+  DoShiftTab();
+  EXPECT_TRUE(test_api_->GetViewAt(4)->HasFocus());
+  ExpectNotFocused(status_area_);
+
+  // Go into the status area again.
+  DoTab();
+  ExpectNotFocused(shelf_view_);
+  ExpectFocused(status_area_);
+
+  // And keep going forward, now we should be cycling back to the first shelf
+  // element.
+  DoTab();
+  EXPECT_TRUE(test_api_->GetViewAt(1)->HasFocus());
+  ExpectNotFocused(status_area_);
+}
+
 class ShelfViewOverflowFocusTest : public ShelfViewFocusTest {
  public:
   ShelfViewOverflowFocusTest() = default;
@@ -3598,16 +3648,13 @@
   // Focus the overflow button.
   DoTab();
   EXPECT_TRUE(test_api_->overflow_button()->HasFocus());
-
-  DoTab();
-  EXPECT_TRUE(test_api_->GetViewAt(1)->HasFocus());
 }
 
 // Tests that when cycling through the items with shift tab, the items in the
 // overflow shelf are ignored because it is not visible.
 TEST_F(ShelfViewOverflowFocusTest, BackwardCycling) {
-  DoShiftTab();
-  EXPECT_TRUE(test_api_->overflow_button()->HasFocus());
+  while (!test_api_->overflow_button()->HasFocus())
+    DoTab();
 
   DoShiftTab();
   EXPECT_TRUE(test_api_->GetViewAt(last_item_on_main_shelf_index_)->HasFocus());
@@ -3634,20 +3681,6 @@
   const int first_index_overflow_shelf = last_item_on_main_shelf_index_ + 1;
   EXPECT_TRUE(overflow_shelf_test_api_->GetViewAt(first_index_overflow_shelf)
                   ->HasFocus());
-
-  // Focus the last item on the overflow shelf.
-  test_api_->overflow_bubble()
-      ->bubble_view()
-      ->GetWidget()
-      ->GetFocusManager()
-      ->SetFocusedView(overflow_shelf_test_api_->GetViewAt(
-          overflow_shelf_test_api_->GetLastVisibleIndex()));
-
-  // Tests that after pressing tab once more, the main shelf widget now is
-  // active, and the first item on the main shelf has focus.
-  DoTab();
-  EXPECT_TRUE(shelf_view_->shelf_widget()->IsActive());
-  EXPECT_TRUE(test_api_->GetViewAt(1)->HasFocus());
 }
 
 // Tests that backwards cycling through elements with shift tab works as
@@ -3655,23 +3688,11 @@
 TEST_F(ShelfViewOverflowFocusTest, BackwardCyclingWithBubbleOpen) {
   OpenOverflow();
 
-  // Tests that after pressing shift tab once, the overflow shelf bubble is
-  // active and the last item on the overflow shelf has focus.
-  DoShiftTab();
-  EXPECT_TRUE(
-      test_api_->overflow_bubble()->bubble_view()->GetWidget()->IsActive());
-  const int first_index_overflow_shelf = last_item_on_main_shelf_index_ + 1;
-  EXPECT_TRUE(overflow_shelf_test_api_
-                  ->GetViewAt(overflow_shelf_test_api_->GetLastVisibleIndex())
-                  ->HasFocus());
-
   // Focus the first item on the overflow shelf.
-  test_api_->overflow_bubble()
-      ->bubble_view()
-      ->GetWidget()
-      ->GetFocusManager()
-      ->SetFocusedView(
-          overflow_shelf_test_api_->GetViewAt(first_index_overflow_shelf));
+  while (!test_api_->overflow_bubble()->bubble_view()->GetWidget()->IsActive())
+    DoTab();
+  EXPECT_FALSE(shelf_view_->shelf_widget()->IsActive());
+  EXPECT_FALSE(test_api_->overflow_button()->HasFocus());
 
   // Tests that after pressing shift tab once, the main shelf is active and
   // the overflow button has focus.
@@ -3684,4 +3705,60 @@
   EXPECT_TRUE(test_api_->GetViewAt(last_item_on_main_shelf_index_)->HasFocus());
 }
 
+// Verifies that focus moves as expected between the shelf and the status area
+// when the overflow bubble is showing.
+TEST_F(ShelfViewOverflowFocusTest, FocusCyclingBetweenShelfAndStatusWidget) {
+  OpenOverflow();
+  const int first_index_overflow_shelf = last_item_on_main_shelf_index_ + 1;
+
+  // We start with the first shelf item focused. Shift-tab should focus the
+  // status area.
+  DoShiftTab();
+  ExpectNotFocused(shelf_view_);
+  ExpectFocused(status_area_);
+
+  // Focus the shelf again.
+  DoTab();
+  ExpectFocused(shelf_view_);
+  EXPECT_TRUE(test_api_->GetViewAt(1)->HasFocus());
+  ExpectNotFocused(status_area_);
+
+  // Now advance to the last item on the main shelf.
+  while (!test_api_->GetViewAt(last_item_on_main_shelf_index_)->HasFocus())
+    DoTab();
+  ExpectNotFocused(status_area_);
+
+  // Focus the overflow button
+  DoTab();
+  EXPECT_TRUE(test_api_->overflow_button()->HasFocus());
+
+  // Tab into the overflow bubble.
+  DoTab();
+  EXPECT_TRUE(overflow_shelf_test_api_->GetViewAt(first_index_overflow_shelf)
+                  ->HasFocus());
+
+  // Back onto the overflow button itself.
+  DoShiftTab();
+  EXPECT_TRUE(test_api_->overflow_button()->HasFocus());
+
+  // Now advance until we get to the status area.
+  while (!status_area_->GetWidget()->IsActive())
+    DoTab();
+
+  // Go back once, we should be in the overflow bubble again.
+  DoShiftTab();
+  ExpectNotFocused(status_area_);
+  ExpectFocused(test_api_->overflow_bubble()->bubble_view());
+
+  // Go into the status area again.
+  DoTab();
+  ExpectFocused(status_area_);
+
+  // Now advance until the status area isn't focused anymore.
+  while (status_area_->GetWidget()->IsActive())
+    DoTab();
+  // This should have brought focus to the first element on the shelf.
+  EXPECT_TRUE(test_api_->GetViewAt(1)->HasFocus());
+}
+
 }  // namespace ash
diff --git a/ash/shelf/shelf_widget.cc b/ash/shelf/shelf_widget.cc
index a87b74e..02aaab9 100644
--- a/ash/shelf/shelf_widget.cc
+++ b/ash/shelf/shelf_widget.cc
@@ -483,15 +483,24 @@
       default_last_focusable_child);
 }
 
+void ShelfWidget::FocusFirstOrLastFocusableChild(bool last) {
+  // This is only ever called during an active session.
+  if (!shelf_view_->visible())
+    return;
+  views::View* to_focus = shelf_view_->FindFirstOrLastFocusableChild(last);
+
+  Shell::Get()->focus_cycler()->FocusWidget(to_focus->GetWidget());
+  to_focus->GetFocusManager()->SetFocusedView(to_focus);
+}
+
 void ShelfWidget::OnWidgetActivationChanged(views::Widget* widget,
                                             bool active) {
   if (active) {
     // Do not focus the default element if the widget activation came from the
-    // overflow bubble focus cycling. The setter of
-    // |activated_from_overflow_bubble_| should handle focusing the correct
-    // view.
-    if (activated_from_overflow_bubble_) {
-      activated_from_overflow_bubble_ = false;
+    // another widget's focus cycling. The setter of
+    // |activated_from_other_widget_| should handle focusing the correct view.
+    if (activated_from_other_widget_) {
+      activated_from_other_widget_ = false;
       return;
     }
     delegate_view_->SetPaneFocusAndFocusDefault();
diff --git a/ash/shelf/shelf_widget.h b/ash/shelf/shelf_widget.h
index 6b89c32..2ba50cd 100644
--- a/ash/shelf/shelf_widget.h
+++ b/ash/shelf/shelf_widget.h
@@ -103,6 +103,10 @@
 
   void set_default_last_focusable_child(bool default_last_focusable_child);
 
+  // Finds the first or last focusable child of the set (main shelf + overflow)
+  // and focuses it.
+  void FocusFirstOrLastFocusableChild(bool last);
+
   // Overridden from views::WidgetObserver:
   void OnWidgetActivationChanged(views::Widget* widget, bool active) override;
 
@@ -127,8 +131,8 @@
     return &background_animator_;
   }
 
-  void set_activated_from_overflow_bubble(bool val) {
-    activated_from_overflow_bubble_ = val;
+  void set_activated_from_other_widget(bool val) {
+    activated_from_other_widget_ = val;
   }
 
  private:
@@ -166,10 +170,10 @@
   // Owned by the views hierarchy.
   LoginShelfView* const login_shelf_view_;
 
-  // Set to true when the widget is activated from the shelf overflow bubble.
-  // Do not focus the default element in this case. This should be set when
-  // cycling focus from the overflow bubble to the main shelf.
-  bool activated_from_overflow_bubble_ = false;
+  // Set to true when the widget is activated from another widget. Do not
+  // focus the default element in this case. This should be set when
+  // cycling focus from another widget to the shelf.
+  bool activated_from_other_widget_ = false;
 
   ScopedSessionObserver scoped_session_observer_;
 
diff --git a/ash/system/tray/tray_background_view.cc b/ash/system/tray/tray_background_view.cc
index 8e5d22d..d3595bc2 100644
--- a/ash/system/tray/tray_background_view.cc
+++ b/ash/system/tray/tray_background_view.cc
@@ -270,21 +270,34 @@
   if (!delegate || !delegate->ShouldFocusOut(reverse))
     return;
 
-  // At this point, we know we should focus out of the status widget.
-  // If we're not using a views-based shelf, delegate to system tray focus
-  // observers to decide where the focus goes next.
+  // At this point, we know we should focus out of the status widget. It
+  // remains to be determined whether we should bring focus to the shelf, or
+  // whether we should delegate to system tray focus observers to decide
+  // where the focus goes next.
+  bool should_focus_shelf = true;
+
   if (!ShelfWidget::IsUsingViewsShelf()) {
-    Shell::Get()->system_tray_notifier()->NotifyFocusOut(reverse);
+    // Never bring the focus to the shelf if it's not a views-based shelf as
+    // it is visually not on par with the status widget.
     return;
   }
 
   // If we are using a views-based shelf:
-  // * If we're going in reverse, always focus the shelf.
-  // * If we're going forward, focus the shelf in an active session, and let
-  //   the system tray focus observers focus the lock/login view otherwise.
-  if (reverse) {
+  // * If we're in an active session, always bring focus to the shelf whether
+  //   we are going in reverse or not.
+  // * Otherwise (login/lock screen, OOBE), bring focus to the shelf only
+  //   if we're going in reverse; if we're going forward, let the system tray
+  //   focus observers focus the lock/login view.
+  if (shelf->shelf_widget()->login_shelf_view()->visible()) {
+    // Login/lock screen or OOBE.
+    should_focus_shelf = reverse;
+  }
+
+  if (should_focus_shelf) {
     shelf->shelf_widget()->set_default_last_focusable_child(reverse);
+    shelf->shelf_widget()->set_activated_from_other_widget(true);
     Shell::Get()->focus_cycler()->FocusWidget(shelf->shelf_widget());
+    shelf->shelf_widget()->FocusFirstOrLastFocusableChild(reverse);
   } else {
     Shell::Get()->system_tray_notifier()->NotifyFocusOut(reverse);
   }
diff --git a/base/task/sequence_manager/sequence_manager_impl.cc b/base/task/sequence_manager/sequence_manager_impl.cc
index a8475b9..b4b82e3 100644
--- a/base/task/sequence_manager/sequence_manager_impl.cc
+++ b/base/task/sequence_manager/sequence_manager_impl.cc
@@ -129,15 +129,15 @@
   DCHECK(!controller_->GetBoundMessagePump() ||
          main_thread_only().task_execution_stack.empty());
 
-  // TODO(altimin): restore default task runner automatically when
-  // ThreadController is destroyed.
-  controller_->RestoreDefaultTaskRunner();
-
   for (internal::TaskQueueImpl* queue : main_thread_only().active_queues) {
     main_thread_only().selector.RemoveQueue(queue);
     queue->UnregisterTaskQueue();
   }
 
+  // TODO(altimin): restore default task runner automatically when
+  // ThreadController is destroyed.
+  controller_->RestoreDefaultTaskRunner();
+
   main_thread_only().active_queues.clear();
   main_thread_only().queues_to_gracefully_shutdown.clear();
   main_thread_only().selector.SetTaskQueueSelectorObserver(nullptr);
diff --git a/base/task/sequence_manager/sequence_manager_impl_unittest.cc b/base/task/sequence_manager/sequence_manager_impl_unittest.cc
index f8ebcf5..2e64024c 100644
--- a/base/task/sequence_manager/sequence_manager_impl_unittest.cc
+++ b/base/task/sequence_manager/sequence_manager_impl_unittest.cc
@@ -3920,6 +3920,21 @@
   EXPECT_TRUE(run);
 }
 
+TEST_P(SequenceManagerTest, DestructorPostsViaTaskRunnerHandleDuringShutdown) {
+  scoped_refptr<TestTaskQueue> task_queue = CreateTaskQueue();
+  bool run = false;
+  task_queue->task_runner()->PostTask(
+      FROM_HERE, RunOnDestruction(BindLambdaForTesting([&]() {
+        ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE,
+                                                base::BindOnce(&NopTask));
+        run = true;
+      })));
+
+  // Should not DCHECK when ThreadTaskRunnerHandle::Get() is invoked.
+  DestroySequenceManager();
+  EXPECT_TRUE(run);
+}
+
 TEST_P(SequenceManagerTest, CreateUnboundSequenceManagerWhichIsNeverBound) {
   // This should not crash.
   CreateUnboundSequenceManager();
diff --git a/base/trace_event/common/trace_event_common.h b/base/trace_event/common/trace_event_common.h
index f9ef03f5..6837eb9 100644
--- a/base/trace_event/common/trace_event_common.h
+++ b/base/trace_event/common/trace_event_common.h
@@ -984,8 +984,6 @@
   INTERNAL_TRACE_EVENT_ADD_WITH_ID(                                   \
       TRACE_EVENT_PHASE_LEAVE_CONTEXT, category_group, name, context, \
       TRACE_EVENT_FLAG_NONE)
-#define TRACE_EVENT_SCOPED_CONTEXT(category_group, name, context) \
-  INTERNAL_TRACE_EVENT_SCOPED_CONTEXT(category_group, name, context)
 
 // Macro to specify that two trace IDs are identical. For example,
 // TRACE_LINK_IDS(
diff --git a/base/trace_event/memory_infra_background_whitelist.cc b/base/trace_event/memory_infra_background_whitelist.cc
index 835fc28..56328efb 100644
--- a/base/trace_event/memory_infra_background_whitelist.cc
+++ b/base/trace_event/memory_infra_background_whitelist.cc
@@ -247,6 +247,7 @@
     "web_cache/Script_resources",
     "web_cache/XSL stylesheet_resources",
     "web_cache/Font_resources",
+    "web_cache/Code_cache",
     "web_cache/Other_resources",
     "partition_alloc/allocated_objects",
     "partition_alloc/partitions",
diff --git a/base/trace_event/trace_event.h b/base/trace_event/trace_event.h
index 6a5e097..9cc13a9 100644
--- a/base/trace_event/trace_event.h
+++ b/base/trace_event/trace_event.h
@@ -435,28 +435,6 @@
     }                                                                \
   } while (0)
 
-// Implementation detail: internal macro to enter and leave a
-// context based on the current scope.
-#define INTERNAL_TRACE_EVENT_SCOPED_CONTEXT(category_group, name, context) \
-  struct INTERNAL_TRACE_EVENT_UID(ScopedContext) {                         \
-   public:                                                                 \
-    INTERNAL_TRACE_EVENT_UID(ScopedContext)(uint64_t cid) : cid_(cid) {    \
-      TRACE_EVENT_ENTER_CONTEXT(category_group, name, cid_);               \
-    }                                                                      \
-    ~INTERNAL_TRACE_EVENT_UID(ScopedContext)() {                           \
-      TRACE_EVENT_LEAVE_CONTEXT(category_group, name, cid_);               \
-    }                                                                      \
-                                                                           \
-   private:                                                                \
-    uint64_t cid_;                                                         \
-    /* Local class friendly DISALLOW_COPY_AND_ASSIGN */                    \
-    INTERNAL_TRACE_EVENT_UID(ScopedContext)                                \
-    (const INTERNAL_TRACE_EVENT_UID(ScopedContext)&) {};                   \
-    void operator=(const INTERNAL_TRACE_EVENT_UID(ScopedContext)&) {};     \
-  };                                                                       \
-  INTERNAL_TRACE_EVENT_UID(ScopedContext)                                  \
-  INTERNAL_TRACE_EVENT_UID(scoped_context)(context);
-
 #if BUILDFLAG(ENABLE_LOCATION_SOURCE)
 
 // Implementation detail: internal macro to trace a task execution with the
diff --git a/base/trace_event/trace_event_unittest.cc b/base/trace_event/trace_event_unittest.cc
index 5c24ab1c..f94d0210 100644
--- a/base/trace_event/trace_event_unittest.cc
+++ b/base/trace_event/trace_event_unittest.cc
@@ -506,11 +506,6 @@
                               TRACE_ID_WITH_SCOPE("scope", context_id));
     TRACE_EVENT_LEAVE_CONTEXT("all", "TRACE_EVENT_LEAVE_CONTEXT call",
                               TRACE_ID_WITH_SCOPE("scope", context_id));
-    TRACE_EVENT_SCOPED_CONTEXT("disabled-by-default-cat",
-                               "TRACE_EVENT_SCOPED_CONTEXT disabled call",
-                               context_id);
-    TRACE_EVENT_SCOPED_CONTEXT("all", "TRACE_EVENT_SCOPED_CONTEXT call",
-                               context_id);
 
     TRACE_LINK_IDS("all", "TRACE_LINK_IDS simple call", 0x1000, 0x2000);
     TRACE_LINK_IDS("all", "TRACE_LINK_IDS scoped call",
@@ -943,33 +938,6 @@
     EXPECT_EQ("0x20151021", id);
   }
 
-  std::vector<const DictionaryValue*> scoped_context_calls =
-      FindTraceEntries(trace_parsed, "TRACE_EVENT_SCOPED_CONTEXT call");
-  EXPECT_EQ(2u, scoped_context_calls.size());
-  {
-    item = scoped_context_calls[0];
-    std::string ph;
-    EXPECT_TRUE((item && item->GetString("ph", &ph)));
-    EXPECT_EQ("(", ph);
-
-    std::string id;
-    EXPECT_FALSE((item && item->HasKey("scope")));
-    EXPECT_TRUE((item && item->GetString("id", &id)));
-    EXPECT_EQ("0x20151021", id);
-  }
-
-  {
-    item = scoped_context_calls[1];
-    std::string ph;
-    EXPECT_TRUE((item && item->GetString("ph", &ph)));
-    EXPECT_EQ(")", ph);
-
-    std::string id;
-    EXPECT_FALSE((item && item->HasKey("scope")));
-    EXPECT_TRUE((item && item->GetString("id", &id)));
-    EXPECT_EQ("0x20151021", id);
-  }
-
   EXPECT_FIND_("TRACE_LINK_IDS simple call");
   {
     std::string ph;
diff --git a/build/android/pylib/utils/app_bundle_utils.py b/build/android/pylib/utils/app_bundle_utils.py
index 7b6d0c6..48e97284 100644
--- a/build/android/pylib/utils/app_bundle_utils.py
+++ b/build/android/pylib/utils/app_bundle_utils.py
@@ -28,13 +28,17 @@
     sdk_version = int(
         re.search(r'minSdkVersion.*?(\d+)', manifest_data).group(1))
 
+  # Measure with one language split installed. Use Hindi because it is popular.
+  # resource_size.py looks for splits/base-hi.apk.
+  # Note: English is always included since it's in base-master.apk.
+  locales = ['hi']
   # Setting sdkVersion=minSdkVersion prevents multiple per-minSdkVersion .apk
   # files from being created within the .apks file.
   return {
       'screenDensity': 1000,  # Ignored since we don't split on density.
       'sdkVersion': sdk_version,
       'supportedAbis': _ALL_ABIS,  # Our .aab files are already split on abi.
-      'supportedLocales': ['en'],
+      'supportedLocales': locales,
   }
 
 
diff --git a/build/android/resource_sizes.py b/build/android/resource_sizes.py
index 301acf3..a5fa46c 100755
--- a/build/android/resource_sizes.py
+++ b/build/android/resource_sizes.py
@@ -188,14 +188,14 @@
   return sdk_version, skip_extract_lib
 
 
-def _NormalizeLanguagePaks(translations, normalized_apk_size, factor):
+def _NormalizeLanguagePaks(translations, factor):
   english_pak = translations.FindByPattern(r'.*/en[-_][Uu][Ss]\.l?pak')
   num_translations = translations.GetNumEntries()
+  ret = 0
   if english_pak:
-    normalized_apk_size -= translations.ComputeZippedSize()
-    normalized_apk_size += int(
-        english_pak.compress_size * num_translations * factor)
-  return normalized_apk_size
+    ret -= translations.ComputeZippedSize()
+    ret += int(english_pak.compress_size * num_translations * factor)
+  return ret
 
 
 def _NormalizeResourcesArsc(apk_path, num_arsc_files, num_translations,
@@ -297,7 +297,7 @@
     return self.ComputeExtractedSize() + self.ComputeZippedSize()
 
 
-def _DoApkAnalysis(apk_filename, is_bundle, tool_prefix, out_dir, report_func):
+def _DoApkAnalysis(apk_filename, apks_path, tool_prefix, out_dir, report_func):
   """Analyse APK to determine size contributions of different file classes."""
   file_groups = []
 
@@ -334,8 +334,10 @@
   # Will need to update multipliers once apk obfuscation is enabled.
   # E.g. with obfuscation, the 4.04 changes to 4.46.
   speed_profile_dex_multiplier = 1.17
-  is_shared_apk = sdk_version >= 24 and (
-      'Monochrome' in apk_filename or 'WebView' in apk_filename)
+  orig_filename = apks_path or apk_filename
+  is_monochrome = 'Monochrome' in orig_filename
+  is_webview = 'WebView' in orig_filename
+  is_shared_apk = sdk_version >= 24 and (is_monochrome or is_webview)
   if sdk_version < 21:
     # JellyBean & KitKat
     dex_multiplier = 1.16
@@ -388,6 +390,13 @@
     else:
       unknown.AddZipInfo(member)
 
+  if apks_path:
+    # We're mostly focused on size of Chrome for non-English locales, so assume
+    # Hindi (arbitrarily chosen) locale split is installed.
+    with zipfile.ZipFile(apks_path) as z:
+      hindi_apk_info = z.getinfo('splits/base-hi.apk')
+      total_apk_size += hindi_apk_info.file_size
+
   total_install_size = total_apk_size
   total_install_size_android_go = total_apk_size
   zip_overhead = total_apk_size
@@ -416,6 +425,9 @@
       total_install_size_android_go += extracted_size
       report_func('InstallBreakdownGo', group.name + ' size',
                   actual_size + extracted_size, 'bytes')
+    elif group is translations and apks_path:
+      # Assume Hindi rather than English (accounted for above in total_apk_size)
+      total_install_size_android_go += actual_size
     else:
       total_install_size_android_go += extracted_size
 
@@ -474,7 +486,13 @@
   # Normalized dex size: size within the zip + size on disk for Android Go
   # devices (which ~= uncompressed dex size).
   normalized_apk_size += java_code.ComputeUncompressedSize()
-  if not is_bundle:
+  if apks_path:
+    # Locale normalization not needed when measuring only one locale.
+    # E.g. a change that adds 300 chars of unstranslated strings would cause the
+    # metric to be off by only 390 bytes (assuming a multiplier of 2.3 for
+    # Hindi).
+    pass
+  else:
     # Avoid noise caused when strings change and translations haven't yet been
     # updated.
     num_translations = translations.GetNumEntries()
@@ -483,11 +501,9 @@
     if num_translations > 1:
       # Multipliers found by looking at MonochromePublic.apk and seeing how much
       # smaller en-US.pak is relative to the average locale.pak.
-      normalized_apk_size = _NormalizeLanguagePaks(translations,
-                                                   normalized_apk_size, 1.17)
+      normalized_apk_size += _NormalizeLanguagePaks(translations, 1.17)
     if num_stored_translations > 1:
-      normalized_apk_size = _NormalizeLanguagePaks(stored_translations,
-                                                   normalized_apk_size, 1.43)
+      normalized_apk_size += _NormalizeLanguagePaks(stored_translations, 1.43)
     if num_translations + num_stored_translations > 1:
       if num_translations == 0:
         # WebView stores all locale paks uncompressed.
@@ -624,8 +640,8 @@
     perf_tests_results_helper.ReportPerfResult(chartjson, *args)
 
   out_dir, tool_prefix = _ConfigOutDirAndToolsPrefix(args.out_dir)
-  is_bundle = args.input.endswith('.apks')
-  _DoApkAnalysis(apk_path, is_bundle, tool_prefix, out_dir, report_func)
+  apks_path = args.input if args.input.endswith('.apks') else None
+  _DoApkAnalysis(apk_path, apks_path, tool_prefix, out_dir, report_func)
   _DoDexAnalysis(apk_path, report_func)
   if args.estimate_patch_size:
     _PrintPatchSizeEstimate(apk_path, args.reference_apk_builder,
@@ -679,7 +695,14 @@
   elif args.input.endswith('.apks'):
     with tempfile.NamedTemporaryFile(suffix='.apk') as f:
       with zipfile.ZipFile(args.input) as z:
-        f.write(z.read('splits/base-master.apk'))
+        # Currently bundletool is creating two apks when .apks is created
+        # without specifying an sdkVersion. Always measure the one with an
+        # uncompressed shared library.
+        try:
+          info = z.getinfo('splits/base-master_2.apk')
+        except KeyError:
+          info = z.getinfo('splits/base-master.apk')
+        f.write(z.read(info))
         f.flush()
       _Analyze(f.name, chartjson, args)
   else:
diff --git a/chrome/android/java/res/drawable-hdpi/data_reduction_main_menu_chart.png b/chrome/android/java/res/drawable-hdpi/data_reduction_main_menu_chart.png
deleted file mode 100644
index b7a63efb..0000000
--- a/chrome/android/java/res/drawable-hdpi/data_reduction_main_menu_chart.png
+++ /dev/null
Binary files differ
diff --git a/chrome/android/java/res/drawable-hdpi/data_reduction_main_menu_chart_base.png b/chrome/android/java/res/drawable-hdpi/data_reduction_main_menu_chart_base.png
deleted file mode 100644
index ceff3ddc..0000000
--- a/chrome/android/java/res/drawable-hdpi/data_reduction_main_menu_chart_base.png
+++ /dev/null
Binary files differ
diff --git a/chrome/android/java/res/drawable-mdpi/data_reduction_main_menu_chart.png b/chrome/android/java/res/drawable-mdpi/data_reduction_main_menu_chart.png
deleted file mode 100644
index 0495d68..0000000
--- a/chrome/android/java/res/drawable-mdpi/data_reduction_main_menu_chart.png
+++ /dev/null
Binary files differ
diff --git a/chrome/android/java/res/drawable-mdpi/data_reduction_main_menu_chart_base.png b/chrome/android/java/res/drawable-mdpi/data_reduction_main_menu_chart_base.png
deleted file mode 100644
index bb553bb..0000000
--- a/chrome/android/java/res/drawable-mdpi/data_reduction_main_menu_chart_base.png
+++ /dev/null
Binary files differ
diff --git a/chrome/android/java/res/drawable-xhdpi/data_reduction_main_menu_chart.png b/chrome/android/java/res/drawable-xhdpi/data_reduction_main_menu_chart.png
deleted file mode 100644
index 702a2eb..0000000
--- a/chrome/android/java/res/drawable-xhdpi/data_reduction_main_menu_chart.png
+++ /dev/null
Binary files differ
diff --git a/chrome/android/java/res/drawable-xhdpi/data_reduction_main_menu_chart_base.png b/chrome/android/java/res/drawable-xhdpi/data_reduction_main_menu_chart_base.png
deleted file mode 100644
index f113023..0000000
--- a/chrome/android/java/res/drawable-xhdpi/data_reduction_main_menu_chart_base.png
+++ /dev/null
Binary files differ
diff --git a/chrome/android/java/res/drawable-xxhdpi/data_reduction_main_menu_chart.png b/chrome/android/java/res/drawable-xxhdpi/data_reduction_main_menu_chart.png
deleted file mode 100644
index 6fa16f9..0000000
--- a/chrome/android/java/res/drawable-xxhdpi/data_reduction_main_menu_chart.png
+++ /dev/null
Binary files differ
diff --git a/chrome/android/java/res/drawable-xxhdpi/data_reduction_main_menu_chart_base.png b/chrome/android/java/res/drawable-xxhdpi/data_reduction_main_menu_chart_base.png
deleted file mode 100644
index aa98e29..0000000
--- a/chrome/android/java/res/drawable-xxhdpi/data_reduction_main_menu_chart_base.png
+++ /dev/null
Binary files differ
diff --git a/chrome/android/java/res/drawable-xxxhdpi/data_reduction_main_menu_chart.png b/chrome/android/java/res/drawable-xxxhdpi/data_reduction_main_menu_chart.png
deleted file mode 100644
index 814a25c..0000000
--- a/chrome/android/java/res/drawable-xxxhdpi/data_reduction_main_menu_chart.png
+++ /dev/null
Binary files differ
diff --git a/chrome/android/java/res/drawable-xxxhdpi/data_reduction_main_menu_chart_base.png b/chrome/android/java/res/drawable-xxxhdpi/data_reduction_main_menu_chart_base.png
deleted file mode 100644
index a8874e1..0000000
--- a/chrome/android/java/res/drawable-xxxhdpi/data_reduction_main_menu_chart_base.png
+++ /dev/null
Binary files differ
diff --git a/chrome/android/java/res/drawable/data_reduction_main_menu_icon.xml b/chrome/android/java/res/drawable/data_reduction_main_menu_icon.xml
deleted file mode 100644
index 84ee8649..0000000
--- a/chrome/android/java/res/drawable/data_reduction_main_menu_icon.xml
+++ /dev/null
@@ -1,13 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- Copyright 2017 The Chromium Authors. All rights reserved.
-     Use of this source code is governed by a BSD-style license that can be
-     found in the LICENSE file. -->
-
-<layer-list xmlns:android="http://schemas.android.com/apk/res/android">
-    <item android:id="@+id/main_menu_chart">
-        <bitmap
-            android:src="@drawable/data_reduction_main_menu_chart"
-            android:gravity="bottom" />
-    </item>
-    <item android:drawable="@drawable/data_reduction_main_menu_chart_base" />
-</layer-list>
\ No newline at end of file
diff --git a/chrome/android/java/res/layout/data_reduction_main_menu_item.xml b/chrome/android/java/res/layout/data_reduction_main_menu_item.xml
index 444fd16..d96b651d 100644
--- a/chrome/android/java/res/layout/data_reduction_main_menu_item.xml
+++ b/chrome/android/java/res/layout/data_reduction_main_menu_item.xml
@@ -27,8 +27,8 @@
         <!-- ContentDescription is set in Java code. -->
         <ImageView
             tools:ignore="ContentDescription"
-            android:id="@+id/chart_icon"
-            android:src="@drawable/data_reduction_main_menu_icon"
+            android:id="@+id/icon"
+            android:src="@drawable/preview_pin_round"
             android:layout_width="@dimen/data_reduction_main_menu_icon_width"
             android:layout_height="match_parent"
             android:layout_gravity="start|center_vertical" />
diff --git a/chrome/android/java/res/values/dimens.xml b/chrome/android/java/res/values/dimens.xml
index 1ec0790..d183f00 100644
--- a/chrome/android/java/res/values/dimens.xml
+++ b/chrome/android/java/res/values/dimens.xml
@@ -168,7 +168,7 @@
 
     <!-- Data Saver -->
     <dimen name="data_usage_chart_height">252dp</dimen>
-    <dimen name="data_reduction_main_menu_icon_width">32dp</dimen>
+    <dimen name="data_reduction_main_menu_icon_width">24dp</dimen>
     <dimen name="data_saver_menu_footer_min_show_height">240dp</dimen>
 
     <!-- The size of the text for tab titles. -->
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/PasswordAccessoryInfoView.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/PasswordAccessoryInfoView.java
index 9b213a4..d2bed38 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/PasswordAccessoryInfoView.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/PasswordAccessoryInfoView.java
@@ -6,11 +6,14 @@
 
 import android.content.Context;
 import android.graphics.Bitmap;
+import android.graphics.Rect;
 import android.graphics.drawable.BitmapDrawable;
 import android.graphics.drawable.Drawable;
 import android.support.annotation.Nullable;
 import android.support.v7.content.res.AppCompatResources;
+import android.support.v7.widget.RecyclerView;
 import android.util.AttributeSet;
+import android.view.View;
 import android.widget.ImageView;
 import android.widget.LinearLayout;
 
@@ -26,6 +29,26 @@
     private ChipView mPassword;
 
     /**
+     * This decoration adds a space between the last PasswordAccessoryInfoView and the first
+     * non-PasswordAccessoryInfoView. This allows to define a margin below the whole list of
+     * PasswordAccessoryInfoViews without having to wrap them in a new layout. This would reduce
+     * the reusability of single info containers in a RecyclerView.
+     */
+    public static class DynamicBottomSpacer extends RecyclerView.ItemDecoration {
+        @Override
+        public void getItemOffsets(
+                Rect outRect, View view, RecyclerView parent, RecyclerView.State state) {
+            super.getItemOffsets(outRect, view, parent, state);
+            if (view instanceof PasswordAccessoryInfoView) return;
+            int previous = parent.indexOfChild(view) - 1;
+            if (previous < 0) return;
+            if (!(parent.getChildAt(previous) instanceof PasswordAccessoryInfoView)) return;
+            outRect.top = view.getContext().getResources().getDimensionPixelSize(
+                    R.dimen.keyboard_accessory_suggestion_padding);
+        }
+    }
+
+    /**
      * Constructor for inflating from XML.
      */
     public PasswordAccessoryInfoView(Context context, AttributeSet attrs) {
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/PasswordAccessorySheetModernViewBinder.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/PasswordAccessorySheetModernViewBinder.java
index 1f7e72f..fb177ef5 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/PasswordAccessorySheetModernViewBinder.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill/keyboard_accessory/PasswordAccessorySheetModernViewBinder.java
@@ -69,5 +69,6 @@
 
     static void initializeView(RecyclerView view, AccessorySheetTabModel model) {
         view.setAdapter(PasswordAccessorySheetCoordinator.createModernAdapter(model));
+        view.addItemDecoration(new PasswordAccessoryInfoView.DynamicBottomSpacer());
     }
 }
\ No newline at end of file
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/AssistantBottomBarCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/AssistantBottomBarCoordinator.java
index f458865..1f2d224b 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/AssistantBottomBarCoordinator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/AssistantBottomBarCoordinator.java
@@ -17,7 +17,6 @@
 import org.chromium.chrome.browser.autofill_assistant.details.AssistantDetailsCoordinator;
 import org.chromium.chrome.browser.autofill_assistant.header.AssistantHeaderCoordinator;
 import org.chromium.chrome.browser.autofill_assistant.payment.AssistantPaymentRequestCoordinator;
-import org.chromium.content_public.browser.WebContents;
 
 /**
  * Coordinator responsible for the Autofill Assistant bottom bar. This coordinator allows to enable
@@ -53,8 +52,7 @@
     private final AssistantPaymentRequestCoordinator mPaymentRequestCoordinator;
     private final AssistantCarouselCoordinator mCarouselCoordinator;
 
-    AssistantBottomBarCoordinator(
-            Context context, WebContents webContents, View assistantView, AssistantModel model) {
+    AssistantBottomBarCoordinator(Context context, View assistantView, AssistantModel model) {
         mBottomBarView = assistantView.findViewById(
                 org.chromium.chrome.autofill_assistant.R.id.autofill_assistant_bottombar);
         mSwipeIndicatorView = mBottomBarView.findViewById(
@@ -78,8 +76,8 @@
         mHeaderCoordinator =
                 new AssistantHeaderCoordinator(context, mBottomBarView, model.getHeaderModel());
         mDetailsCoordinator = new AssistantDetailsCoordinator(context, model.getDetailsModel());
-        mPaymentRequestCoordinator = new AssistantPaymentRequestCoordinator(
-                context, webContents, model.getPaymentRequestModel());
+        mPaymentRequestCoordinator =
+                new AssistantPaymentRequestCoordinator(context, model.getPaymentRequestModel());
         mCarouselCoordinator = new AssistantCarouselCoordinator(context, model.getCarouselModel());
 
         // Add child views to bottom bar.
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/AssistantCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/AssistantCoordinator.java
index 0e2fc196..3c17acf0 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/AssistantCoordinator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/AssistantCoordinator.java
@@ -16,7 +16,6 @@
 import org.chromium.chrome.browser.autofill_assistant.overlay.AssistantOverlayState;
 import org.chromium.chrome.browser.help.HelpAndFeedback;
 import org.chromium.chrome.browser.profiles.Profile;
-import org.chromium.content_public.browser.WebContents;
 
 /**
  * The main coordinator for the Autofill Assistant, responsible for instantiating all other
@@ -44,9 +43,20 @@
     private final AssistantKeyboardCoordinator mKeyboardCoordinator;
     private final AssistantOverlayCoordinator mOverlayCoordinator;
 
-    private boolean mShowingSnackbar;
+    /**
+     * Returns {@code true} if an AA UI is active on the given activity.
+     *
+     * <p>Used to avoid creating duplicate coordinators views.
+     *
+     * <p>TODO(crbug.com/806868): Refactor to have AssistantCoordinator owned by the activity, so
+     * it's easy to guarantee that there will be at most one per activity.
+     */
+    static boolean isActive(ChromeActivity activity) {
+        View found = activity.findViewById(R.id.autofill_assistant);
+        return found != null && found.getParent() != null;
+    }
 
-    AssistantCoordinator(ChromeActivity activity, WebContents webContents, Delegate delegate) {
+    AssistantCoordinator(ChromeActivity activity, Delegate delegate) {
         mActivity = activity;
         mDelegate = delegate;
         mModel = new AssistantModel();
@@ -58,8 +68,7 @@
                                  .findViewById(R.id.autofill_assistant);
 
         // Instantiate child components.
-        mBottomBarCoordinator =
-                new AssistantBottomBarCoordinator(activity, webContents, mAssistantView, mModel);
+        mBottomBarCoordinator = new AssistantBottomBarCoordinator(activity, mAssistantView, mModel);
         mKeyboardCoordinator = new AssistantKeyboardCoordinator(activity);
         mOverlayCoordinator =
                 new AssistantOverlayCoordinator(activity, mAssistantView, mModel.getOverlayModel());
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/AssistantSnackbar.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/AssistantSnackbar.java
index e8bcfcd..a1de3c8 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/AssistantSnackbar.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/AssistantSnackbar.java
@@ -7,7 +7,7 @@
 import org.chromium.chrome.autofill_assistant.R;
 import org.chromium.chrome.browser.ChromeActivity;
 import org.chromium.chrome.browser.snackbar.Snackbar;
-import org.chromium.chrome.browser.snackbar.SnackbarManager;
+import org.chromium.chrome.browser.snackbar.SnackbarManager.SnackbarController;
 
 /**
  * A simple UNDO snackbar with a delay.
@@ -26,24 +26,25 @@
     }
 
     /** Shows the snackbar and reports the result to {@code callback}. */
-    static void show(ChromeActivity activity, String message, Callback callback) {
-        Snackbar snackBar =
-                Snackbar.make(message,
-                                new SnackbarManager.SnackbarController() {
-                                    @Override
-                                    public void onAction(Object actionData) {
-                                        callback.onDismiss(/* undo= */ true);
-                                    }
+    static SnackbarController show(ChromeActivity activity, String message, Callback callback) {
+        SnackbarController controller = new SnackbarController() {
+            @Override
+            public void onAction(Object actionData) {
+                callback.onDismiss(/* undo= */ true);
+            }
 
-                                    @Override
-                                    public void onDismissNoAction(Object actionData) {
-                                        callback.onDismiss(/* undo= */ false);
-                                    }
-                                },
-                                Snackbar.TYPE_ACTION, Snackbar.UMA_AUTOFILL_ASSISTANT_STOP_UNDO)
+            @Override
+            public void onDismissNoAction(Object actionData) {
+                callback.onDismiss(/* undo= */ false);
+            }
+        };
+        Snackbar snackBar =
+                Snackbar.make(message, controller, Snackbar.TYPE_ACTION,
+                                Snackbar.UMA_AUTOFILL_ASSISTANT_STOP_UNDO)
                         .setAction(activity.getString(R.string.undo), /* actionData= */ null);
         snackBar.setSingleLine(false);
         snackBar.setDuration(DELAY_MS);
         activity.getSnackbarManager().showSnackbar(snackBar);
+        return controller;
     }
 }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantClient.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantClient.java
index ddd819c1..15dbe6a 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantClient.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantClient.java
@@ -91,6 +91,28 @@
         chooseAccountAsync(parameters.get(PARAMETER_USER_EMAIL), intentExtras);
     }
 
+    /**
+     * Gets rid of the UI, if there is one. Leaves Autofill Assistant running.
+     */
+    public void destroyUi() {
+        if (mNativeClientAndroid == 0) return;
+
+        nativeDestroyUI(mNativeClientAndroid);
+    }
+
+    /**
+     * Transfers ownership of the UI to an instance of Autofill Assistant running on
+     * the given tab/WebContents. Leaves Autofill Assistant running.
+     *
+     * <p>If Autofill Assistant is not running on the given WebContents, the UI is destroyed, as if
+     * {@link #destroyUi} was called.
+     */
+    public void transferUiTo(WebContents otherWebContents) {
+        if (mNativeClientAndroid == 0) return;
+
+        nativeTransferUITo(mNativeClientAndroid, otherWebContents);
+    }
+
     @CalledByNative
     private static AutofillAssistantClient create(long nativeClientAndroid) {
         return new AutofillAssistantClient(nativeClientAndroid);
@@ -233,4 +255,6 @@
     private native void nativeOnAccessToken(
             long nativeClientAndroid, boolean success, String accessToken);
     private native String nativeGetPrimaryAccountName(long nativeClientAndroid);
+    private native void nativeDestroyUI(long nativeClientAndroid);
+    private native void nativeTransferUITo(long nativeClientAndroid, Object otherWebContents);
 }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantUiController.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantUiController.java
index 22c3c2d..4e5c1556 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantUiController.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantUiController.java
@@ -4,6 +4,8 @@
 
 package org.chromium.chrome.browser.autofill_assistant;
 
+import android.support.annotation.Nullable;
+
 import org.chromium.base.annotations.CalledByNative;
 import org.chromium.base.annotations.JNINamespace;
 import org.chromium.base.task.PostTask;
@@ -12,6 +14,7 @@
 import org.chromium.chrome.browser.ChromeActivity;
 import org.chromium.chrome.browser.autofill_assistant.metrics.DropOutReason;
 import org.chromium.chrome.browser.customtabs.CustomTabActivity;
+import org.chromium.chrome.browser.snackbar.SnackbarManager.SnackbarController;
 import org.chromium.chrome.browser.tab.Tab;
 import org.chromium.chrome.browser.tabmodel.EmptyTabModelObserver;
 import org.chromium.chrome.browser.tabmodel.TabModel;
@@ -28,51 +31,82 @@
 // TODO(crbug.com/806868): This class should be removed once all logic is in native side and the
 // model is directly modified by the native AssistantMediator.
 class AutofillAssistantUiController implements AssistantCoordinator.Delegate {
-    private static final int GRACEFUL_SHUTDOWN_DELAY_MS = 5_000;
-
     private long mNativeUiController;
 
     private final ChromeActivity mActivity;
     private final AssistantCoordinator mCoordinator;
     private final ActivityTabProvider.ActivityTabTabObserver mActivityTabObserver;
+    private WebContents mWebContents;
+    private SnackbarController mSnackbarController;
 
+    /**
+     * Finds an activity to which a AA UI can be added.
+     *
+     * <p>The activity must not already have an AA UI installed.
+     */
     @CalledByNative
-    private static AutofillAssistantUiController createAndStartUi(
-            WebContents webContents, long nativeUiController) {
-        return new AutofillAssistantUiController(
-                ChromeActivity.fromWebContents(webContents), webContents, nativeUiController);
+    @Nullable
+    private static ChromeActivity findAppropriateActivity(WebContents webContents) {
+        ChromeActivity activity = ChromeActivity.fromWebContents(webContents);
+        if (activity != null && AssistantCoordinator.isActive(activity)) {
+            return null;
+        }
+
+        return activity;
     }
 
-    private AutofillAssistantUiController(
-            ChromeActivity activity, WebContents webContents, long nativeUiController) {
+    @CalledByNative
+    private static AutofillAssistantUiController create(
+            ChromeActivity activity, long nativeUiController) {
+        assert activity != null;
+        return new AutofillAssistantUiController(activity, nativeUiController);
+    }
+
+    private AutofillAssistantUiController(ChromeActivity activity, long nativeUiController) {
         mNativeUiController = nativeUiController;
         mActivity = activity;
-        mCoordinator = new AssistantCoordinator(activity, webContents, this);
+        mCoordinator = new AssistantCoordinator(activity, this);
         mActivityTabObserver =
                 new ActivityTabProvider.ActivityTabTabObserver(activity.getActivityTabProvider()) {
                     @Override
                     protected void onObservingDifferentTab(Tab tab) {
-                        // A null tab indicates that there's no selected tab; We're in the process
-                        // of selecting a new tab. TODO(crbug/925947): Hide AssistantCoordinator
-                        // instead of destroying it, in case the tab that's eventually selected also
-                        // has AutofillAssistant enabled or is the same tab.
-                        if (tab == null || tab.getWebContents() != webContents) {
-                            safeNativeDestroyUI();
+                        if (mWebContents == null) return;
+
+                        // Get rid of any undo snackbars right away before switching tabs, to avoid
+                        // confusion.
+                        dismissSnackbar();
+
+                        AssistantModel model = getModel();
+                        if (tab == null) {
+                            // A null tab indicates that there's no selected tab; Most likely, we're
+                            // in the process of selecting a new tab. Hide the UI for possible reuse
+                            // later.
+                            getModel().setVisible(false);
+                        } else if (tab.getWebContents() == mWebContents) {
+                            // The original tab was re-selected. Show it again
+                            model.setVisible(true);
+                        } else {
+                            // A new tab was selected. If Autofill Assistant is running on it,
+                            // attach the UI to that other instance, otherwise destroy the UI.
+                            AutofillAssistantClient.fromWebContents(mWebContents)
+                                    .transferUiTo(tab.getWebContents());
                         }
                     }
 
                     @Override
                     public void onActivityAttachmentChanged(Tab tab, boolean isAttached) {
-                        if (!isAttached && tab.getWebContents() == webContents) {
-                            safeNativeDestroyUI();
+                        if (mWebContents == null) return;
+
+                        if (!isAttached && tab.getWebContents() == mWebContents) {
+                            AutofillAssistantClient.fromWebContents(mWebContents).destroyUi();
                         }
                     }
                 };
 
-        initForCustomTab(activity, webContents);
+        initForCustomTab(activity);
     }
 
-    private void initForCustomTab(ChromeActivity activity, WebContents webContents) {
+    private void initForCustomTab(ChromeActivity activity) {
         if (!(activity instanceof CustomTabActivity)) {
             return;
         }
@@ -83,7 +117,7 @@
             @Override
             public void didSelectTab(Tab tab, int type, int lastId) {
                 // Shutdown the Autofill Assistant if the user switches to another tab.
-                if (tab.getWebContents() != webContents) {
+                if (tab.getWebContents() != mWebContents) {
                     currentTabModel.removeObserver(this);
                     safeNativeOnFatalError(activity.getString(R.string.autofill_assistant_give_up),
                             DropOutReason.TAB_CHANGED);
@@ -109,6 +143,11 @@
     // is to avoid boilerplate.
 
     @CalledByNative
+    private void setWebContents(@Nullable WebContents webContents) {
+        mWebContents = webContents;
+    }
+
+    @CalledByNative
     private AssistantModel getModel() {
         return mCoordinator.getModel();
     }
@@ -116,19 +155,7 @@
     @CalledByNative
     private void clearNativePtr() {
         mNativeUiController = 0;
-    }
-
-    /** Destroys this instance and {@link AssistantCoordinator}. */
-    @CalledByNative
-    private void destroy(boolean delayed) {
         mActivityTabObserver.destroy();
-
-        if (delayed) {
-            // Give some time to the user to read any error message.
-            PostTask.postDelayedTask(
-                    UiThreadTaskTraits.DEFAULT, mCoordinator::destroy, GRACEFUL_SHUTDOWN_DELAY_MS);
-            return;
-        }
         mCoordinator.destroy();
     }
 
@@ -160,7 +187,14 @@
 
     @CalledByNative
     private void showSnackbar(String message) {
-        AssistantSnackbar.show(mActivity, message, this::safeSnackbarResult);
+        mSnackbarController = AssistantSnackbar.show(mActivity, message, this::safeSnackbarResult);
+    }
+
+    private void dismissSnackbar() {
+        if (mSnackbarController != null) {
+            mActivity.getSnackbarManager().dismissSnackbars(mSnackbarController);
+            mSnackbarController = null;
+        }
     }
 
     // Native methods.
@@ -174,11 +208,6 @@
     }
     private native void nativeStop(long nativeUiControllerAndroid, @DropOutReason int reason);
 
-    private void safeNativeDestroyUI() {
-        if (mNativeUiController != 0) nativeDestroyUI(mNativeUiController);
-    }
-    private native void nativeDestroyUI(long nativeUiControllerAndroid);
-
     private void safeNativeOnFatalError(String message, @DropOutReason int reason) {
         if (mNativeUiController != 0) nativeOnFatalError(mNativeUiController, message, reason);
     }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/overlay/AssistantOverlayCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/overlay/AssistantOverlayCoordinator.java
index 2496af2..ddbc023 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/overlay/AssistantOverlayCoordinator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/overlay/AssistantOverlayCoordinator.java
@@ -22,8 +22,8 @@
         mTouchEventFilter = assistantView.findViewById(
                 org.chromium.chrome.autofill_assistant.R.id.touch_event_filter);
 
-        mTouchEventFilter.init(mActivity.getFullscreenManager(),
-                mActivity.getActivityTab().getWebContents(), mActivity.getCompositorViewHolder());
+        mTouchEventFilter.init(
+                mActivity.getFullscreenManager(), mActivity.getCompositorViewHolder());
 
         // Listen for changes in the state.
         // TODO(crbug.com/806868): Bind model to view through a ViewBinder instead.
@@ -34,6 +34,8 @@
                 mTouchEventFilter.setTouchableArea(model.get(AssistantOverlayModel.TOUCHABLE_AREA));
             } else if (AssistantOverlayModel.DELEGATE == propertyKey) {
                 mTouchEventFilter.setDelegate(model.get(AssistantOverlayModel.DELEGATE));
+            } else if (AssistantOverlayModel.WEB_CONTENTS == propertyKey) {
+                mTouchEventFilter.setWebContents(model.get(AssistantOverlayModel.WEB_CONTENTS));
             }
         });
     }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/overlay/AssistantOverlayModel.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/overlay/AssistantOverlayModel.java
index c47824c..9921959 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/overlay/AssistantOverlayModel.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/overlay/AssistantOverlayModel.java
@@ -8,6 +8,7 @@
 
 import org.chromium.base.annotations.CalledByNative;
 import org.chromium.base.annotations.JNINamespace;
+import org.chromium.content_public.browser.WebContents;
 import org.chromium.ui.modelutil.PropertyModel;
 
 import java.util.ArrayList;
@@ -26,8 +27,11 @@
     public static final WritableObjectPropertyKey<AssistantOverlayDelegate> DELEGATE =
             new WritableObjectPropertyKey<>();
 
+    public static final WritableObjectPropertyKey<WebContents> WEB_CONTENTS =
+            new WritableObjectPropertyKey<>();
+
     public AssistantOverlayModel() {
-        super(STATE, TOUCHABLE_AREA, DELEGATE);
+        super(STATE, TOUCHABLE_AREA, DELEGATE, WEB_CONTENTS);
     }
 
     @CalledByNative
@@ -49,4 +53,9 @@
     private void setDelegate(AssistantOverlayDelegate delegate) {
         set(DELEGATE, delegate);
     }
+
+    @CalledByNative
+    private void setWebContents(WebContents webContents) {
+        set(WEB_CONTENTS, webContents);
+    }
 }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/overlay/TouchEventFilterView.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/overlay/TouchEventFilterView.java
index b3a5b2f..e0ff719 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/overlay/TouchEventFilterView.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/overlay/TouchEventFilterView.java
@@ -12,6 +12,7 @@
 import android.graphics.PorterDuffXfermode;
 import android.graphics.RectF;
 import android.support.annotation.IntDef;
+import android.support.annotation.Nullable;
 import android.util.AttributeSet;
 import android.util.TypedValue;
 import android.view.GestureDetector;
@@ -212,12 +213,9 @@
     }
 
     /** Initializes dependencies. */
-    public void init(ChromeFullscreenManager fullscreenManager, WebContents webContents,
-            View compositorView) {
+    public void init(ChromeFullscreenManager fullscreenManager, View compositorView) {
         mFullscreenManager = fullscreenManager;
         mFullscreenManager.addListener(this);
-        mGestureListenerManager = GestureListenerManager.fromWebContents(webContents);
-        mGestureListenerManager.addListener(this);
         maybeUpdateVerticalMargins();
         mCompositorView = compositorView;
     }
@@ -229,11 +227,20 @@
             mFullscreenManager.removeListener(this);
             mFullscreenManager = null;
         }
+        setWebContents(null);
+        cleanupCurrentGestureBuffer();
+    }
+
+    /** Sets the web content to listen to for scroll events. */
+    public void setWebContents(@Nullable WebContents webContents) {
         if (mGestureListenerManager != null) {
             mGestureListenerManager.removeListener(this);
             mGestureListenerManager = null;
         }
-        cleanupCurrentGestureBuffer();
+        if (webContents != null) {
+            mGestureListenerManager = GestureListenerManager.fromWebContents(webContents);
+            mGestureListenerManager.addListener(this);
+        }
     }
 
     /**
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/payment/AssistantPaymentRequestCoordinator.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/payment/AssistantPaymentRequestCoordinator.java
index fa56b45a..aece1b5 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/payment/AssistantPaymentRequestCoordinator.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/payment/AssistantPaymentRequestCoordinator.java
@@ -18,18 +18,14 @@
  * Coordinator for the Payment Request.
  */
 public class AssistantPaymentRequestCoordinator {
-    private final WebContents mWebContents;
     @Nullable
     private Runnable mOnVisibilityChanged;
     private final ViewGroup mView;
 
     private AssistantPaymentRequestDelegate mDelegate;
+    private AutofillAssistantPaymentRequest mPaymentRequest;
 
-    public AssistantPaymentRequestCoordinator(
-            Context context, WebContents webContents, AssistantPaymentRequestModel model) {
-        mWebContents = webContents;
-        assert webContents != null;
-
+    public AssistantPaymentRequestCoordinator(Context context, AssistantPaymentRequestModel model) {
         // TODO(crbug.com/806868): Remove this.
         mView = new LinearLayout(context);
         mView.addView(new View(context));
@@ -41,15 +37,10 @@
         model.addObserver((source, propertyKey) -> {
             if (AssistantPaymentRequestModel.DELEGATE == propertyKey) {
                 mDelegate = model.get(AssistantPaymentRequestModel.DELEGATE);
-            } else if (AssistantPaymentRequestModel.OPTIONS == propertyKey) {
-                AssistantPaymentRequestOptions options =
-                        model.get(AssistantPaymentRequestModel.OPTIONS);
-                if (options != null) {
-                    resetView(options);
-                    setVisible(true);
-                } else {
-                    setVisible(false);
-                }
+            } else if (AssistantPaymentRequestModel.WEB_CONTENTS == propertyKey
+                    || AssistantPaymentRequestModel.OPTIONS == propertyKey) {
+                resetView(model.get(AssistantPaymentRequestModel.WEB_CONTENTS),
+                        model.get(AssistantPaymentRequestModel.OPTIONS));
             }
         });
     }
@@ -77,13 +68,22 @@
         mOnVisibilityChanged = listener;
     }
 
-    private void resetView(AssistantPaymentRequestOptions options) {
-        AutofillAssistantPaymentRequest paymentRequest =
-                new AutofillAssistantPaymentRequest(mWebContents, options);
-        paymentRequest.show(mView.getChildAt(0), selectedPaymentInformation -> {
+    private void resetView(
+            @Nullable WebContents webContents, @Nullable AssistantPaymentRequestOptions options) {
+        if (mPaymentRequest != null) {
+            mPaymentRequest.close();
+            mPaymentRequest = null;
+        }
+        if (options == null || webContents == null) {
+            setVisible(false);
+            return;
+        }
+        mPaymentRequest = new AutofillAssistantPaymentRequest(webContents, options);
+        mPaymentRequest.show(mView.getChildAt(0), selectedPaymentInformation -> {
             if (mDelegate != null) {
                 mDelegate.onPaymentInformationSelected(selectedPaymentInformation);
             }
         });
+        setVisible(true);
     }
 }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/payment/AssistantPaymentRequestModel.java b/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/payment/AssistantPaymentRequestModel.java
index ab3246cb..d912840 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/payment/AssistantPaymentRequestModel.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/autofill_assistant/payment/AssistantPaymentRequestModel.java
@@ -6,6 +6,7 @@
 
 import org.chromium.base.annotations.CalledByNative;
 import org.chromium.base.annotations.JNINamespace;
+import org.chromium.content_public.browser.WebContents;
 import org.chromium.ui.modelutil.PropertyModel;
 
 /**
@@ -20,8 +21,12 @@
     public static final WritableObjectPropertyKey<AssistantPaymentRequestOptions> OPTIONS =
             new WritableObjectPropertyKey<>();
 
+    /** The web contents the payment request is associated to. */
+    public static final WritableObjectPropertyKey<WebContents> WEB_CONTENTS =
+            new WritableObjectPropertyKey<>();
+
     public AssistantPaymentRequestModel() {
-        super(DELEGATE, OPTIONS);
+        super(DELEGATE, OPTIONS, WEB_CONTENTS);
     }
 
     @CalledByNative
@@ -35,6 +40,11 @@
     }
 
     @CalledByNative
+    private void setWebContents(WebContents webContents) {
+        set(WEB_CONTENTS, webContents);
+    }
+
+    @CalledByNative
     private void clearOptions() {
         set(OPTIONS, null);
     }
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/background_sync/BackgroundSyncBackgroundTaskScheduler.java b/chrome/android/java/src/org/chromium/chrome/browser/background_sync/BackgroundSyncBackgroundTaskScheduler.java
index 75d2b4a..09c481d 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/background_sync/BackgroundSyncBackgroundTaskScheduler.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/background_sync/BackgroundSyncBackgroundTaskScheduler.java
@@ -71,13 +71,14 @@
         Bundle taskExtras = new Bundle();
         taskExtras.putLong(SOONEST_EXPECTED_WAKETIME, System.currentTimeMillis() + minDelayMs);
 
-        TaskInfo taskInfo = TaskInfo.createOneOffTask(TaskIds.BACKGROUND_SYNC_ONE_SHOT_JOB_ID,
-                                            BackgroundSyncBackgroundTask.class, minDelayMs)
-                                    .setRequiredNetworkType(TaskInfo.NetworkType.ANY)
-                                    .setUpdateCurrent(true)
-                                    .setIsPersisted(true)
-                                    .setExtras(taskExtras)
-                                    .build();
+        TaskInfo taskInfo =
+                TaskInfo.createOneOffTask(TaskIds.BACKGROUND_SYNC_ONE_SHOT_JOB_ID,
+                                BackgroundSyncBackgroundTask.class, minDelayMs, Integer.MAX_VALUE)
+                        .setRequiredNetworkType(TaskInfo.NetworkType.ANY)
+                        .setUpdateCurrent(true)
+                        .setIsPersisted(true)
+                        .setExtras(taskExtras)
+                        .build();
         // This will overwrite any existing task with this ID.
         return BackgroundTaskSchedulerFactory.getScheduler().schedule(
                 ContextUtils.getApplicationContext(), taskInfo);
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/preferences/datareduction/DataReductionMainMenuItem.java b/chrome/android/java/src/org/chromium/chrome/browser/preferences/datareduction/DataReductionMainMenuItem.java
index beb47d1..adf11cd5 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/preferences/datareduction/DataReductionMainMenuItem.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/preferences/datareduction/DataReductionMainMenuItem.java
@@ -5,10 +5,6 @@
 package org.chromium.chrome.browser.preferences.datareduction;
 
 import android.content.Context;
-import android.graphics.ColorMatrix;
-import android.graphics.ColorMatrixColorFilter;
-import android.graphics.drawable.Drawable;
-import android.graphics.drawable.LayerDrawable;
 import android.os.Bundle;
 import android.text.format.DateUtils;
 import android.text.format.Formatter;
@@ -46,7 +42,7 @@
 
         TextView itemText = (TextView) findViewById(R.id.menu_item_text);
         TextView itemSummary = (TextView) findViewById(R.id.menu_item_summary);
-        ImageView icon = (ImageView) findViewById(R.id.chart_icon);
+        ImageView icon = (ImageView) findViewById(R.id.icon);
         icon.setContentDescription(getContext().getString(
                 DataReductionBrandingResourceProvider.getDataSaverBrandedString(
                         R.string.data_reduction_title)));
@@ -78,11 +74,6 @@
             int textColorLink = ApiCompatibilityUtils.getColor(
                     getContext().getResources(), R.color.default_text_color_link);
             itemText.setTextColor(textColorLink);
-
-            // Reset the icon to blue.
-            LayerDrawable layers = (LayerDrawable) icon.getDrawable();
-            Drawable chart = layers.findDrawableByLayerId(R.id.main_menu_chart);
-            chart.setColorFilter(null);
         } else {
             DataReductionProxyUma.dataReductionProxyUIAction(
                     DataReductionProxyUma.ACTION_MAIN_MENU_DISPLAYED_OFF);
@@ -90,13 +81,6 @@
             itemText.setText(DataReductionBrandingResourceProvider.getDataSaverBrandedString(
                     R.string.data_reduction_title));
             itemSummary.setText(R.string.text_off);
-
-            // Make the icon grey.
-            LayerDrawable layers = (LayerDrawable) icon.getDrawable();
-            Drawable chart = layers.findDrawableByLayerId(R.id.main_menu_chart);
-            ColorMatrix matrix = new ColorMatrix();
-            matrix.setSaturation(0);
-            chart.setColorFilter(new ColorMatrixColorFilter(matrix));
         }
 
         setOnClickListener(this);
diff --git a/chrome/android/java/strings/android_chrome_strings.grd b/chrome/android/java/strings/android_chrome_strings.grd
index f14f490..77c1530 100644
--- a/chrome/android/java/strings/android_chrome_strings.grd
+++ b/chrome/android/java/strings/android_chrome_strings.grd
@@ -4003,7 +4003,7 @@
         Assistant Triggered Checkout
       </message>
       <message name="IDS_AUTOFILL_ASSISTANT_GOOGLE_TERMS_DESCRIPTION" desc="Message linking to the Google terms and conditions for Google Assistant in Chrome.">
-        By continuing, you agree that Chrome will send data from Chrome Autofill, the site’s URL and its content to Google to provide this service. You also agree that Chrome will send personal data you selected to the website via Chrome Autofill. \n\nVisit Chrome settings to turn off Google Assistant in Chrome and Chrome Autofill.  <ph name="BEGIN_LINK">&lt;link&gt;</ph>Learn more<ph name="END_LINK">&lt;/link&gt;</ph>
+        Chrome will send the site’s URL and content to Google. Your email and credit card type from Chrome Autofill will also be sent to Google to provide this service. Visit Chrome settings to turn off Google Assistant in Chrome and Chrome Autofill. <ph name="BEGIN_LINK">&lt;link&gt;</ph>Learn&#xA0;more<ph name="END_LINK">&lt;/link&gt;</ph>
       </message>
       <message name="IDS_AUTOFILL_ASSISTANT_GOOGLE_TERMS_URL" desc="URL for Google Autofill Assistant Terms of Service" translateable="false">
         http://support.google.com/assistant?p=fast_checkout
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantUiTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantUiTest.java
index 98fe8bdf..acb664a2 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantUiTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/autofill_assistant/AutofillAssistantUiTest.java
@@ -112,7 +112,6 @@
         AssistantCoordinator assistantCoordinator = ThreadUtils.runOnUiThreadBlocking(
                 ()
                         -> new AssistantCoordinator(getActivity(),
-                                mCustomTabActivityTestRule.getWebContents(),
                                 mCoordinatorDelegateMock));
 
         // Bottom sheet is shown when creating the AssistantCoordinator.
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/fullscreen/FullscreenManagerTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/fullscreen/FullscreenManagerTest.java
index 23156b83..1f1fd2d9 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/fullscreen/FullscreenManagerTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/fullscreen/FullscreenManagerTest.java
@@ -67,7 +67,6 @@
 @RunWith(ChromeJUnit4ClassRunner.class)
 @CommandLineFlags.Add({
         ChromeSwitches.DISABLE_FIRST_RUN_EXPERIENCE,
-        "enable-blink-features=FullscreenUnprefixed,FullscreenOptions",
 })
 @RetryOnFailure
 public class FullscreenManagerTest {
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/offlinepages/OfflinePageAutoFetchTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/offlinepages/OfflinePageAutoFetchTest.java
index 4f78044..67aec46f 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/offlinepages/OfflinePageAutoFetchTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/offlinepages/OfflinePageAutoFetchTest.java
@@ -134,7 +134,6 @@
             if (!NetworkChangeNotifier.isInitialized()) {
                 NetworkChangeNotifier.init();
             }
-            forceConnectivityState(false);
 
             OfflinePageBridge.getForProfile(mProfile).addObserver(
                     new OfflinePageBridge.OfflinePageModelObserver() {
@@ -145,6 +144,7 @@
                         }
                     });
         });
+        forceConnectivityState(false);
     }
 
     @After
@@ -158,6 +158,23 @@
     @Test
     @MediumTest
     @Feature({"OfflineAutoFetch"})
+    public void testAutoFetchTriggersOnDNSErrorWhenOffline() throws Exception {
+        attemptLoadPage("http://does.not.resolve.com");
+        waitForRequestCount(1);
+    }
+
+    @Test
+    @MediumTest
+    @Feature({"OfflineAutoFetch"})
+    public void testAutoFetchDoesNotTriggerOnDNSErrorWhenOnline() throws Exception {
+        forceConnectivityState(true);
+        attemptLoadPage("http://does.not.resolve.com");
+        waitForRequestCount(0);
+    }
+
+    @Test
+    @MediumTest
+    @Feature({"OfflineAutoFetch"})
     public void testAutoFetchOnDinoPage() throws Exception {
         startWebServer();
         final String testUrl = mWebServer.getBaseUrl();
@@ -392,6 +409,7 @@
             NetworkChangeNotifier.forceConnectivityState(connected);
             DeviceConditions.mForceNoConnectionForTesting = !connected;
         });
+        OfflineTestUtil.waitForConnectivityState(connected);
     }
 
     private void waitForHistogram(String histogramAndEnum, int delta) {
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/offlinepages/OfflineTestUtil.java b/chrome/android/javatests/src/org/chromium/chrome/browser/offlinepages/OfflineTestUtil.java
index 87a5f7f..9da95525 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/offlinepages/OfflineTestUtil.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/offlinepages/OfflineTestUtil.java
@@ -16,10 +16,12 @@
 import org.chromium.chrome.browser.offlinepages.OfflinePageBridge.OfflinePageModelObserver;
 import org.chromium.chrome.browser.profiles.Profile;
 import org.chromium.components.offline_items_collection.OfflineItem;
+import org.chromium.content_public.browser.test.util.CriteriaHelper;
 
 import java.util.ArrayList;
 import java.util.List;
 import java.util.concurrent.TimeoutException;
+import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicReference;
 
 /** Test utility functions for OfflinePages. */
@@ -149,6 +151,14 @@
         ThreadUtils.runOnUiThreadBlocking(() -> nativeClearIntercepts());
     }
 
+    // Waits for the connectivity state to change in the native network change notifier.
+    public static void waitForConnectivityState(boolean connected) {
+        AtomicBoolean done = new AtomicBoolean();
+        ThreadUtils.runOnUiThreadBlocking(
+                () -> nativeWaitForConnectivityState(connected, () -> done.set(true)));
+        CriteriaHelper.pollInstrumentationThread(() -> done.get());
+    }
+
     private static native void nativeGetRequestsInQueue(Callback<SavePageRequest[]> callback);
     private static native void nativeGetAllPages(
             List<OfflinePageItem> offlinePages, final Callback<List<OfflinePageItem>> callback);
@@ -156,4 +166,5 @@
     private static native void nativeInterceptWithOfflineError(String url, Runnable readyRunnable);
     private static native void nativeClearIntercepts();
     private static native void nativeDumpRequestCoordinatorState(Callback<String> callback);
+    private static native void nativeWaitForConnectivityState(boolean connected, Runnable callback);
 }
diff --git a/chrome/android/javatests/src/org/chromium/chrome/browser/widget/PromoDialogTest.java b/chrome/android/javatests/src/org/chromium/chrome/browser/widget/PromoDialogTest.java
index 5da01e14..5425d45 100644
--- a/chrome/android/javatests/src/org/chromium/chrome/browser/widget/PromoDialogTest.java
+++ b/chrome/android/javatests/src/org/chromium/chrome/browser/widget/PromoDialogTest.java
@@ -249,7 +249,7 @@
     public void testBasic_HeaderBehavior_WithIllustration() throws Exception {
         // With an illustration, the header View is part of the scrollable content.
         DialogParams dialogParams = new DialogParams();
-        dialogParams.drawableResource = R.drawable.data_reduction_main_menu_chart;
+        dialogParams.drawableResource = R.drawable.preview_pin_round;
         dialogParams.headerStringResource = R.string.data_reduction_promo_title;
         dialogParams.primaryButtonStringResource = R.string.data_reduction_enable_button;
 
diff --git a/chrome/android/junit/src/org/chromium/chrome/browser/background_sync/BackgroundSyncBackgroundTaskSchedulerTest.java b/chrome/android/junit/src/org/chromium/chrome/browser/background_sync/BackgroundSyncBackgroundTaskSchedulerTest.java
index c0804bd..33dcf49 100644
--- a/chrome/android/junit/src/org/chromium/chrome/browser/background_sync/BackgroundSyncBackgroundTaskSchedulerTest.java
+++ b/chrome/android/junit/src/org/chromium/chrome/browser/background_sync/BackgroundSyncBackgroundTaskSchedulerTest.java
@@ -87,7 +87,7 @@
         TaskInfo taskInfo = mTaskInfo.getValue();
         verifyFixedTaskInfoValues(taskInfo);
 
-        assertEquals(ONE_DAY_IN_MILLISECONDS, taskInfo.getOneOffInfo().getWindowEndTimeMs());
+        assertEquals(ONE_DAY_IN_MILLISECONDS, taskInfo.getOneOffInfo().getWindowStartTimeMs());
     }
 
     @Test
@@ -120,7 +120,7 @@
                 .schedule(eq(RuntimeEnvironment.application), eq(mTaskInfo.getValue()));
 
         TaskInfo taskInfo = mTaskInfo.getValue();
-        assertEquals(ONE_DAY_IN_MILLISECONDS, taskInfo.getOneOffInfo().getWindowEndTimeMs());
+        assertEquals(ONE_DAY_IN_MILLISECONDS, taskInfo.getOneOffInfo().getWindowStartTimeMs());
 
         BackgroundSyncBackgroundTaskScheduler.getInstance().launchBrowserIfStopped(
                 /* shouldLaunch= */ true,
@@ -129,7 +129,7 @@
                 .schedule(eq(RuntimeEnvironment.application), eq(mTaskInfo.getValue()));
 
         taskInfo = mTaskInfo.getValue();
-        assertEquals(ONE_WEEK_IN_MILLISECONDS, taskInfo.getOneOffInfo().getWindowEndTimeMs());
+        assertEquals(ONE_WEEK_IN_MILLISECONDS, taskInfo.getOneOffInfo().getWindowStartTimeMs());
     }
 
     @Test
diff --git a/chrome/app/generated_resources.grd b/chrome/app/generated_resources.grd
index e823d3b..718184d0 100644
--- a/chrome/app/generated_resources.grd
+++ b/chrome/app/generated_resources.grd
@@ -4740,7 +4740,7 @@
           The alternative browser could not be opened
         </message>
         <message name="IDS_ABOUT_BROWSER_SWITCH_COUNTDOWN_TITLE" desc="Shown while waiting for an alternative browser to open, with a countdown timer">
-          Opening in alternative browser in <ph name="COUNTDOWN_SECONDS">$1</ph> seconds
+          Opening in alternative browser in <ph name="COUNTDOWN_SECONDS">$1<ex>5</ex></ph> seconds
         </message>
         <message name="IDS_ABOUT_BROWSER_SWITCH_GENERIC_ERROR" desc="Generic error message when we don't know why we failed to open the alternative browser">
           <ph name="URL">$1<ex>ftp://example.com/</ex></ph> could not be open in an alternative browser. Please contact your system administrator.
@@ -5329,7 +5329,10 @@
           Saved passwords for <ph name="domain">$1<ex>example.com</ex></ph>
         </message>
         <message name="IDS_PASSWORD_MANAGER_ACCESSORY_ALL_PASSWORDS_LINK" desc="The text of the link in the password sheet that opens the password management section.">
-          Manage passwords...
+          Manage passwords
+        </message>
+        <message name="IDS_PASSWORD_MANAGER_ACCESSORY_GENERATE_PASSWORD_BUTTON_TITLE" desc="Text for the button used to generate a password.">
+          Suggest strong password
         </message>
       </if>
 
diff --git a/chrome/app/onboarding_welcome_strings.grdp b/chrome/app/onboarding_welcome_strings.grdp
index 342daaab..b82730f 100644
--- a/chrome/app/onboarding_welcome_strings.grdp
+++ b/chrome/app/onboarding_welcome_strings.grdp
@@ -67,8 +67,8 @@
   <message name="IDS_ONBOARDING_WELCOME_NTP_BACKGROUND_CITYSCAPE_TITLE" desc="Label for choosing a background/wallpaper from the 'Cityscape' category">
     Cityscape
   </message>
-  <message name="IDS_ONBOARDING_WELCOME_NTP_BACKGROUND_LIFE_TITLE" desc="Label for choosing a background/wallpaper from the 'Life' category, as in a category of photos of nature, flowers, and buildings.">
-    Life
+  <message name="IDS_ONBOARDING_WELCOME_NTP_BACKGROUND_EARTH_TITLE" desc="Label for choosing a background/wallpaper from the 'Earth' category, as in a category of photos of planets and outer space.">
+    Earth
   </message>
   <message name="IDS_ONBOARDING_WELCOME_NTP_BACKGROUND_GEOMETRIC_SHAPES_TITLE" desc="Label for choosing a background/wallpaper from the 'Geometric Shapes' category">
     Geometric shapes
diff --git a/chrome/browser/about_flags.cc b/chrome/browser/about_flags.cc
index e34b693..e47c714 100644
--- a/chrome/browser/about_flags.cc
+++ b/chrome/browser/about_flags.cc
@@ -3005,6 +3005,20 @@
      kOsDesktop,
      FEATURE_VALUE_TYPE(omnibox::kUIExperimentBlueSearchLoopAndSearchQuery)},
 
+    {"omnibox-ui-blue-titles-and-gray-urls-on-page-suggestions",
+     flag_descriptions::kOmniboxUIBlueTitlesAndGrayUrlsOnPageSuggestionsName,
+     flag_descriptions::
+         kOmniboxUIBlueTitlesAndGrayUrlsOnPageSuggestionsDescription,
+     kOsDesktop,
+     FEATURE_VALUE_TYPE(
+         omnibox::kUIExperimentBlueTitlesAndGrayUrlsOnPageSuggestions)},
+
+    {"omnibox-ui-blue-titles-on-page-suggestions",
+     flag_descriptions::kOmniboxUIBlueTitlesOnPageSuggestionsName,
+     flag_descriptions::kOmniboxUIBlueTitlesOnPageSuggestionsDescription,
+     kOsDesktop,
+     FEATURE_VALUE_TYPE(omnibox::kUIExperimentBlueTitlesOnPageSuggestions)},
+
     {"omnibox-ui-use-generic-search-engine-icon",
      flag_descriptions::kOmniboxUIUseGenericSearchEngineIconName,
      flag_descriptions::kOmniboxUIUseGenericSearchEngineIconDescription,
diff --git a/chrome/browser/android/autofill_assistant/client_android.cc b/chrome/browser/android/autofill_assistant/client_android.cc
index f734780..066fe347 100644
--- a/chrome/browser/android/autofill_assistant/client_android.cc
+++ b/chrome/browser/android/autofill_assistant/client_android.cc
@@ -120,6 +120,38 @@
   controller_->Start(initial_url, parameters);
 }
 
+void ClientAndroid::DestroyUI(
+    JNIEnv* env,
+    const base::android::JavaParamRef<jobject>& jcaller) {
+  DestroyUI();
+}
+
+void ClientAndroid::TransferUITo(
+    JNIEnv* env,
+    const base::android::JavaParamRef<jobject>& jcaller,
+    const base::android::JavaParamRef<jobject>& jother_web_contents) {
+  if (!ui_controller_android_)
+    return;
+
+  auto ui_ptr = std::move(ui_controller_android_);
+  // From this point on, the UIController, in ui_ptr, is either transferred or
+  // deleted.
+
+  if (!jother_web_contents)
+    return;
+
+  auto* other_web_contents =
+      content::WebContents::FromJavaWebContents(jother_web_contents);
+  DCHECK_NE(other_web_contents, web_contents_);
+
+  ClientAndroid* other_client =
+      ClientAndroid::FromWebContents(other_web_contents);
+  if (!other_client || !other_client->NeedsUI())
+    return;
+
+  other_client->SetUI(std::move(ui_ptr));
+}
+
 base::android::ScopedJavaLocalRef<jstring> ClientAndroid::GetPrimaryAccountName(
     JNIEnv* env,
     const JavaParamRef<jobject>& jcaller) {
@@ -147,16 +179,14 @@
     // onboarding.
   }
   if (!ui_controller_android_) {
-    ui_controller_android_ = std::make_unique<UiControllerAndroid>(
-        web_contents_, /* client= */ this, controller_.get());
+    std::unique_ptr<UiControllerAndroid> ui_ptr =
+        UiControllerAndroid::CreateFromWebContents(web_contents_);
+    if (ui_ptr)
+      SetUI(std::move(ui_ptr));
   }
 }
 
 void ClientAndroid::DestroyUI() {
-  if (!ui_controller_android_)
-    return;
-
-  ui_controller_android_->Destroy();
   ui_controller_android_.reset();
 }
 
@@ -221,7 +251,6 @@
     // done.
     return;
   }
-  ui_controller_android_.reset();
 
   Metrics::RecordDropOut(reason);
   controller_.reset();
@@ -250,6 +279,16 @@
   controller_ = std::make_unique<Controller>(web_contents_, /* client= */ this);
 }
 
+bool ClientAndroid::NeedsUI() {
+  return !ui_controller_android_ && controller_ && controller_->NeedsUI();
+}
+
+void ClientAndroid::SetUI(
+    std::unique_ptr<UiControllerAndroid> ui_controller_android) {
+  ui_controller_android_ = std::move(ui_controller_android);
+  ui_controller_android_->Attach(web_contents_, this, controller_.get());
+}
+
 WEB_CONTENTS_USER_DATA_KEY_IMPL(ClientAndroid);
 
 }  // namespace autofill_assistant.
diff --git a/chrome/browser/android/autofill_assistant/client_android.h b/chrome/browser/android/autofill_assistant/client_android.h
index 454c0a2..e7ed945 100644
--- a/chrome/browser/android/autofill_assistant/client_android.h
+++ b/chrome/browser/android/autofill_assistant/client_android.h
@@ -48,6 +48,13 @@
              const base::android::JavaParamRef<jstring>& jinitial_url,
              const base::android::JavaParamRef<jobjectArray>& parameterNames,
              const base::android::JavaParamRef<jobjectArray>& parameterValues);
+  void DestroyUI(JNIEnv* env,
+                 const base::android::JavaParamRef<jobject>& jcaller);
+  void TransferUITo(
+      JNIEnv* env,
+      const base::android::JavaParamRef<jobject>& jcaller,
+      const base::android::JavaParamRef<jobject>& jother_web_contents);
+
   base::android::ScopedJavaLocalRef<jstring> GetPrimaryAccountName(
       JNIEnv* env,
       const base::android::JavaParamRef<jobject>& jcaller);
@@ -79,6 +86,8 @@
 
   explicit ClientAndroid(content::WebContents* web_contents);
   void CreateController();
+  bool NeedsUI();
+  void SetUI(std::unique_ptr<UiControllerAndroid> ui_controller_android);
 
   WEB_CONTENTS_USER_DATA_KEY_DECL();
 
diff --git a/chrome/browser/android/autofill_assistant/ui_controller_android.cc b/chrome/browser/android/autofill_assistant/ui_controller_android.cc
index 580b441..b023f25 100644
--- a/chrome/browser/android/autofill_assistant/ui_controller_android.cc
+++ b/chrome/browser/android/autofill_assistant/ui_controller_android.cc
@@ -15,6 +15,7 @@
 #include "base/command_line.h"
 #include "base/metrics/field_trial_params.h"
 #include "base/task/post_task.h"
+#include "base/time/time.h"
 #include "chrome/browser/android/chrome_feature_list.h"
 #include "chrome/browser/autofill/android/personal_data_manager_android.h"
 #include "chrome/browser/autofill/personal_data_manager_factory.h"
@@ -51,24 +52,37 @@
 
 namespace autofill_assistant {
 
-UiControllerAndroid::UiControllerAndroid(content::WebContents* web_contents,
-                                         Client* client,
-                                         UiDelegate* ui_delegate)
-    : client_(client),
-      ui_delegate_(ui_delegate),
-      overlay_delegate_(this),
+namespace {
+
+// How long to leave the UI showing after AA has stopped.
+static constexpr base::TimeDelta kGracefulShutdownDelay =
+    base::TimeDelta::FromSeconds(5);
+
+}  // namespace
+
+// static
+std::unique_ptr<UiControllerAndroid> UiControllerAndroid::CreateFromWebContents(
+    content::WebContents* web_contents) {
+  JNIEnv* env = AttachCurrentThread();
+  auto jactivity = Java_AutofillAssistantUiController_findAppropriateActivity(
+      env, web_contents->GetJavaWebContents());
+  if (!jactivity) {
+    return nullptr;
+  }
+  return std::make_unique<UiControllerAndroid>(env, jactivity);
+}
+
+UiControllerAndroid::UiControllerAndroid(
+    JNIEnv* env,
+    const base::android::JavaRef<jobject>& jactivity)
+    : overlay_delegate_(this),
       header_delegate_(this),
       payment_request_delegate_(this),
       carousel_delegate_(this),
       weak_ptr_factory_(this) {
-  DCHECK(web_contents);
-  DCHECK(client);
-  DCHECK(ui_delegate);
-  JNIEnv* env = AttachCurrentThread();
   java_autofill_assistant_ui_controller_ =
-      Java_AutofillAssistantUiController_createAndStartUi(
-          env, web_contents->GetJavaWebContents(),
-          reinterpret_cast<intptr_t>(this));
+      Java_AutofillAssistantUiController_create(
+          env, jactivity, reinterpret_cast<intptr_t>(this));
 
   // Register overlay_delegate_ as delegate for the overlay.
   Java_AssistantOverlayModel_setDelegate(env, GetOverlayModel(),
@@ -81,7 +95,27 @@
   // Register payment_request_delegate_ as delegate for the payment request UI.
   Java_AssistantPaymentRequestModel_setDelegate(
       env, GetPaymentRequestModel(), payment_request_delegate_.GetJavaObject());
+}
 
+void UiControllerAndroid::Attach(content::WebContents* web_contents,
+                                 Client* client,
+                                 UiDelegate* ui_delegate) {
+  DCHECK(web_contents);
+  DCHECK(client);
+  DCHECK(ui_delegate);
+
+  client_ = client;
+  ui_delegate_ = ui_delegate;
+  captured_debug_context_.clear();
+
+  JNIEnv* env = AttachCurrentThread();
+  auto java_web_contents = web_contents->GetJavaWebContents();
+  Java_AutofillAssistantUiController_setWebContents(
+      env, java_autofill_assistant_ui_controller_, java_web_contents);
+  Java_AssistantPaymentRequestModel_setWebContents(
+      env, GetPaymentRequestModel(), java_web_contents);
+  Java_AssistantOverlayModel_setWebContents(env, GetOverlayModel(),
+                                            java_web_contents);
   if (ui_delegate->GetState() != AutofillAssistantState::INACTIVE) {
     // The UI was created for an existing Controller.
     OnStatusMessageChanged(ui_delegate->GetStatusMessage());
@@ -96,6 +130,7 @@
 
     OnStateChanged(ui_delegate->GetState());
   }
+  Java_AssistantModel_setVisible(env, GetModel(), true);
 }
 
 UiControllerAndroid::~UiControllerAndroid() {
@@ -268,6 +303,10 @@
   return captured_debug_context_;
 }
 
+void UiControllerAndroid::DestroySelf() {
+  client_->DestroyUI();
+}
+
 // Carousel related methods.
 
 base::android::ScopedJavaLocalRef<jobject>
@@ -353,27 +392,30 @@
       env, java_autofill_assistant_ui_controller_, on_accept);
 }
 
-void UiControllerAndroid::Destroy() {
-  Java_AutofillAssistantUiController_destroy(
-      AttachCurrentThread(), java_autofill_assistant_ui_controller_,
-      /* delayed= */ false);
-}
-
 void UiControllerAndroid::WillShutdown(Metrics::DropOutReason reason) {
-  JNIEnv* env = AttachCurrentThread();
-  Java_AutofillAssistantUiController_destroy(
-      env, java_autofill_assistant_ui_controller_,
-      /* delayed= */ ui_delegate_->GetState() ==
-          AutofillAssistantState::STOPPED);
   if (reason == Metrics::CUSTOM_TAB_CLOSED) {
     Java_AutofillAssistantUiController_scheduleCloseCustomTab(
-        env, java_autofill_assistant_ui_controller_);
+        AttachCurrentThread(), java_autofill_assistant_ui_controller_);
   }
 
   // Capture the debug context, for including into a feedback possibly sent
-  // later, after the delegate has been destroyed.
+  // later, after the delegate has been possibly destroyed.
+  DCHECK(ui_delegate_);
   captured_debug_context_ = ui_delegate_->GetDebugContext();
+  AutofillAssistantState final_state = ui_delegate_->GetState();
   ui_delegate_ = nullptr;
+
+  // Get rid of the UI, either immediately, or with a delay, to give time to
+  // users to read any message.
+  if (final_state != AutofillAssistantState::STOPPED) {
+    DestroySelf();
+  } else {
+    base::PostDelayedTaskWithTraits(
+        FROM_HERE, {content::BrowserThread::UI},
+        base::BindOnce(&UiControllerAndroid::DestroySelf,
+                       weak_ptr_factory_.GetWeakPtr()),
+        kGracefulShutdownDelay);
+  }
 }
 
 // Payment request related methods.
@@ -447,12 +489,6 @@
   client_->Shutdown(static_cast<Metrics::DropOutReason>(jreason));
 }
 
-void UiControllerAndroid::DestroyUI(
-    JNIEnv* env,
-    const base::android::JavaParamRef<jobject>& obj) {
-  client_->DestroyUI();
-}
-
 void UiControllerAndroid::OnFatalError(
     JNIEnv* env,
     const base::android::JavaParamRef<jobject>& obj,
diff --git a/chrome/browser/android/autofill_assistant/ui_controller_android.h b/chrome/browser/android/autofill_assistant/ui_controller_android.h
index 5e5761b..5d625b58 100644
--- a/chrome/browser/android/autofill_assistant/ui_controller_android.h
+++ b/chrome/browser/android/autofill_assistant/ui_controller_android.h
@@ -29,20 +29,32 @@
 // changes to the UI model.
 class UiControllerAndroid : public UiController {
  public:
+  static std::unique_ptr<UiControllerAndroid> CreateFromWebContents(
+      content::WebContents* web_contents);
+
   // pointers to |web_contents|, |client| must remain valid for the lifetime of
   // this instance.
   //
   // Pointer to |ui_delegate| must remain valid for the lifetime of this
   // instance or until WillShutdown is called.
-  UiControllerAndroid(content::WebContents* web_contents,
-                      Client* client,
-                      UiDelegate* ui_delegate);
+  UiControllerAndroid(JNIEnv* env,
+                      const base::android::JavaRef<jobject>& jactivity);
   ~UiControllerAndroid() override;
 
+  // Attaches the UI to the given client, its web contents and delegate.
+  //
+  // |web_contents| and |client| must remain valid for the lifetime of this
+  // instance or until Attach() is called again, with different pointers.
+  //
+  // |ui_delegate| must remain valid for the lifetime of this instance or until
+  // either Attach() or WillShutdown() are called.
+  void Attach(content::WebContents* web_contents,
+              Client* client,
+              UiDelegate* ui_delegate);
+
   // Called by ClientAndroid.
   void ShowOnboarding(JNIEnv* env,
                       const base::android::JavaParamRef<jobject>& on_accept);
-  void Destroy();
 
   // Overrides UiController:
   void OnStateChanged(AutofillAssistantState new_state) override;
@@ -77,7 +89,6 @@
   void Stop(JNIEnv* env,
             const base::android::JavaParamRef<jobject>& obj,
             int reason);
-  void DestroyUI(JNIEnv* env, const base::android::JavaParamRef<jobject>& obj);
   void OnFatalError(JNIEnv* env,
                     const base::android::JavaParamRef<jobject>& obj,
                     const base::android::JavaParamRef<jstring>& message,
@@ -87,11 +98,11 @@
       const base::android::JavaParamRef<jobject>& jcaller);
 
  private:
-  Client* const client_;
+  // A pointer to the client. nullptr until Attach() is called.
+  Client* client_ = nullptr;
 
-  // A pointer to the Autofill Assistant Controller. It can become nullptr after
-  // WillShutdown() has been called.
-  UiDelegate* ui_delegate_;
+  // A pointer to the ui_delegate. nullptr until Attach() is called.
+  UiDelegate* ui_delegate_ = nullptr;
   AssistantOverlayDelegate overlay_delegate_;
   AssistantHeaderDelegate header_delegate_;
   AssistantPaymentRequestDelegate payment_request_delegate_;
@@ -113,6 +124,7 @@
   void SetProgressPulsingEnabled(bool enabled);
   void SetAllowSwipingSheet(bool allow);
   std::string GetDebugContext();
+  void DestroySelf();
 
   // Hide the UI, show a snackbar with an undo button, and execute the given
   // action after a short delay unless the user taps the undo button.
diff --git a/chrome/browser/apps/guest_view/web_view_browsertest.cc b/chrome/browser/apps/guest_view/web_view_browsertest.cc
index 5b11d4f..e71944a 100644
--- a/chrome/browser/apps/guest_view/web_view_browsertest.cc
+++ b/chrome/browser/apps/guest_view/web_view_browsertest.cc
@@ -4260,7 +4260,7 @@
 // This verifies the fix for http://crbug.com/667708.
 IN_PROC_BROWSER_TEST_F(ChromeSignInWebViewTest,
                        ClosingChromeSignInShouldNotCrash) {
-  GURL signin_url{"chrome://chrome-signin"};
+  GURL signin_url{"chrome://chrome-signin/?reason=5"};
 
   AddTabAtIndex(0, signin_url, ui::PAGE_TRANSITION_TYPED);
   AddTabAtIndex(1, signin_url, ui::PAGE_TRANSITION_TYPED);
diff --git a/chrome/browser/chromeos/arc/auth/arc_auth_service.cc b/chrome/browser/chromeos/arc/auth/arc_auth_service.cc
index ee8bc92..8afb3be6 100644
--- a/chrome/browser/chromeos/arc/auth/arc_auth_service.cc
+++ b/chrome/browser/chromeos/arc/auth/arc_auth_service.cc
@@ -12,7 +12,6 @@
 #include "base/memory/singleton.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/time/time.h"
-#include "chrome/browser/browser_process.h"
 #include "chrome/browser/chromeos/arc/arc_optin_uma.h"
 #include "chrome/browser/chromeos/arc/arc_session_manager.h"
 #include "chrome/browser/chromeos/arc/arc_util.h"
@@ -23,11 +22,9 @@
 #include "chrome/browser/chromeos/profiles/profile_helper.h"
 #include "chrome/browser/lifetime/application_lifetime.h"
 #include "chrome/browser/profiles/profile.h"
-#include "chrome/browser/signin/account_tracker_service_factory.h"
 #include "chrome/browser/signin/identity_manager_factory.h"
 #include "chrome/browser/signin/signin_ui_util.h"
 #include "chrome/browser/ui/app_list/arc/arc_data_removal_dialog.h"
-#include "chromeos/account_manager/account_manager_factory.h"
 #include "chromeos/constants/chromeos_switches.h"
 #include "components/arc/arc_bridge_service.h"
 #include "components/arc/arc_browser_context_keyed_service_factory_base.h"
@@ -37,7 +34,6 @@
 #include "components/arc/arc_supervision_transition.h"
 #include "components/arc/arc_util.h"
 #include "components/prefs/pref_service.h"
-#include "components/signin/core/browser/account_tracker_service.h"
 #include "components/user_manager/user_manager.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
@@ -148,15 +144,14 @@
   return account_info;
 }
 
-bool IsPrimaryAccount(const chromeos::AccountManager::AccountKey& account_key) {
+bool IsPrimaryGaiaAccount(const std::string& gaia_id) {
   // |GetPrimaryUser| is fine because ARC is only available on the first
   // (Primary) account that participates in multi-signin.
   const user_manager::User* user =
       user_manager::UserManager::Get()->GetPrimaryUser();
   DCHECK(user);
-  const AccountId& primary_account_id = user->GetAccountId();
-
-  return chromeos::AccountMapperUtil::IsEqual(account_key, primary_account_id);
+  return user->GetAccountId().GetAccountType() == AccountType::GOOGLE &&
+         user->GetAccountId().GetGaiaId() == gaia_id;
 }
 
 std::string GetGaiaIdFromAccountName(
@@ -172,17 +167,6 @@
   return gaia_id;
 }
 
-chromeos::AccountManager* GetAccountManagerForProfile(Profile* profile) {
-  if (!chromeos::switches::IsAccountManagerEnabled())
-    return nullptr;
-
-  // TODO(sinhak): This will need to be independent of Profile, when
-  // Multi-Profile on Chrome OS is launched.
-  auto* factory =
-      g_browser_process->platform_part()->GetAccountManagerFactory();
-  return factory->GetAccountManager(profile->GetPath().value());
-}
-
 }  // namespace
 
 // static
@@ -197,12 +181,8 @@
 ArcAuthService::ArcAuthService(content::BrowserContext* browser_context,
                                ArcBridgeService* arc_bridge_service)
     : profile_(Profile::FromBrowserContext(browser_context)),
-      account_manager_(GetAccountManagerForProfile(profile_)),
-      account_tracker_service_(
-          AccountTrackerServiceFactory::GetInstance()->GetForProfile(profile_)),
       identity_manager_(IdentityManagerFactory::GetForProfile(profile_)),
       arc_bridge_service_(arc_bridge_service),
-      account_mapper_util_(account_tracker_service_),
       url_loader_factory_(
           content::BrowserContext::GetDefaultStoragePartition(profile_)
               ->GetURLLoaderFactoryForBrowserProcess()),
@@ -212,14 +192,9 @@
 
   ArcSessionManager::Get()->AddObserver(this);
   identity_manager_->AddObserver(this);
-  if (account_manager_)
-    account_manager_->AddObserver(this);
 }
 
 ArcAuthService::~ArcAuthService() {
-  if (account_manager_)
-    account_manager_->RemoveObserver(this);
-
   ArcSessionManager::Get()->RemoveObserver(this);
   arc_bridge_service_->auth()->RemoveObserver(this);
   arc_bridge_service_->auth()->SetHost(nullptr);
@@ -277,9 +252,8 @@
   }
 
   if (!account_name.has_value() ||
-      IsPrimaryAccount(chromeos::AccountManager::AccountKey{
-          GetGaiaIdFromAccountName(identity_manager_, account_name.value()),
-          chromeos::account_manager::AccountType::ACCOUNT_TYPE_GAIA})) {
+      IsPrimaryGaiaAccount(
+          GetGaiaIdFromAccountName(identity_manager_, account_name.value()))) {
     // Reauthorization for the Primary Account.
     // The check for |!account_name.has_value()| is for backwards compatibility
     // with older ARC versions, for which Mojo will set |account_name| to
@@ -394,9 +368,8 @@
   // ARC, or for signing in a new Secondary Account.
 
   // Check if |account_name| points to a Secondary Account.
-  if (!IsPrimaryAccount(chromeos::AccountManager::AccountKey{
-          GetGaiaIdFromAccountName(identity_manager_, account_name),
-          chromeos::account_manager::AccountType::ACCOUNT_TYPE_GAIA})) {
+  if (!IsPrimaryGaiaAccount(
+          GetGaiaIdFromAccountName(identity_manager_, account_name))) {
     FetchSecondaryAccountInfo(account_name, std::move(callback));
     return;
   }
@@ -475,35 +448,23 @@
                      std::move(callback)));
 }
 
-void ArcAuthService::OnTokenUpserted(
-    const chromeos::AccountManager::AccountKey& account_key) {
+void ArcAuthService::OnRefreshTokenUpdatedForAccount(
+    const CoreAccountInfo& account_info) {
+  // TODO(sinhak): Identity Manager is specific to a Profile. Move this to a
+  // proper Profile independent entity once we have that.
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 
+  if (!chromeos::switches::IsAccountManagerEnabled())
+    return;
+
   // Ignore the update if ARC has not been provisioned yet.
   if (!arc::IsArcProvisioned(profile_))
     return;
 
-  if (account_key.account_type !=
-      chromeos::account_manager::AccountType::ACCOUNT_TYPE_GAIA) {
-    // We are only interested in Gaia accounts.
-    return;
-  }
-
-  const AccountInfo account_info =
-      account_mapper_util_.AccountKeyToGaiaAccountInfo(account_key);
-
-  // We may have received |OnTokenUpserted| for a variety of cases where a valid
-  // Gaia LST is not available for the account: The account could have just been
-  // migrated to Account Manager with a dummy initial token, the LST update
-  // could be an update to mark the LST as invalid, the token could have expired
-  // etc. In all of these cases, we should ignore the notification. If and when
-  // Account Manager gets updated with a valid token, we would receive another
-  // notification and we can process the account update then.
-  if (!identity_manager_->HasAccountWithRefreshToken(account_info.account_id) ||
-      identity_manager_->HasAccountWithRefreshTokenInPersistentErrorState(
+  if (identity_manager_->HasAccountWithRefreshTokenInPersistentErrorState(
           account_info.account_id)) {
     VLOG(1) << "Ignoring account update due to lack of a valid token: "
-            << account_key;
+            << account_info.email;
     return;
   }
 
@@ -517,13 +478,6 @@
   instance->OnAccountUpdated(account_name, mojom::AccountUpdateType::UPSERT);
 }
 
-void ArcAuthService::OnAccountRemoved(
-    const chromeos::AccountManager::AccountKey& account_key) {
-  // Ignore this notification. We depend on
-  // |AccountTrackerService::Observer::OnAccountRemoved| for account removal
-  // notifications. See crbug.com/904978.
-}
-
 void ArcAuthService::OnExtendedAccountInfoRemoved(
     const AccountInfo& account_info) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
@@ -531,10 +485,7 @@
   if (!chromeos::switches::IsAccountManagerEnabled())
     return;
 
-  DCHECK(!account_info.gaia.empty());
-  DCHECK(!IsPrimaryAccount(chromeos::AccountManager::AccountKey{
-      account_info.gaia /* id */, chromeos::account_manager::AccountType::
-                                      ACCOUNT_TYPE_GAIA /* account_type */}));
+  DCHECK(!IsPrimaryGaiaAccount(account_info.gaia));
 
   // Ignore the update if ARC has not been provisioned yet.
   if (!arc::IsArcProvisioned(profile_))
@@ -714,20 +665,17 @@
   ArcSessionManager::Get()->StopAndEnableArc();
 }
 
-void ArcAuthService::OnGetAccounts(
-    std::vector<chromeos::AccountManager::AccountKey> accounts) {
-  for (const auto& account_key : accounts)
-    OnTokenUpserted(account_key);
-}
-
 std::unique_ptr<ArcBackgroundAuthCodeFetcher>
 ArcAuthService::CreateArcBackgroundAuthCodeFetcher(
     const std::string& account_id,
     bool initial_signin) {
+  base::Optional<AccountInfo> account_info =
+      identity_manager_->FindAccountInfoForAccountWithRefreshTokenByAccountId(
+          account_id);
+  DCHECK(account_info.has_value());
   auto fetcher = std::make_unique<ArcBackgroundAuthCodeFetcher>(
       url_loader_factory_, profile_, account_id, initial_signin,
-      IsPrimaryAccount(
-          account_mapper_util_.OAuthAccountIdToAccountKey(account_id)));
+      IsPrimaryGaiaAccount(account_info.value().gaia));
   if (skip_merge_session_for_testing_)
     fetcher->SkipMergeSessionForTesting();
 
@@ -742,9 +690,10 @@
   if (!chromeos::switches::IsAccountManagerEnabled())
     return;
 
-  DCHECK(account_manager_);
-  account_manager_->GetAccounts(base::BindOnce(&ArcAuthService::OnGetAccounts,
-                                               weak_ptr_factory_.GetWeakPtr()));
+  const std::vector<AccountInfo> accounts =
+      identity_manager_->GetAccountsWithRefreshTokens();
+  for (const AccountInfo& account : accounts)
+    OnRefreshTokenUpdatedForAccount(account);
 }
 
 void ArcAuthService::DispatchAccountsInArc(
diff --git a/chrome/browser/chromeos/arc/auth/arc_auth_service.h b/chrome/browser/chromeos/arc/auth/arc_auth_service.h
index 92f6599..b5f49e86 100644
--- a/chrome/browser/chromeos/arc/auth/arc_auth_service.h
+++ b/chrome/browser/chromeos/arc/auth/arc_auth_service.h
@@ -14,10 +14,8 @@
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
 #include "base/optional.h"
-#include "chrome/browser/chromeos/account_mapper_util.h"
 #include "chrome/browser/chromeos/arc/arc_session_manager.h"
 #include "chrome/browser/chromeos/arc/auth/arc_active_directory_enrollment_token_fetcher.h"
-#include "chromeos/account_manager/account_manager.h"
 #include "components/arc/common/auth.mojom.h"
 #include "components/arc/connection_observer.h"
 #include "components/keyed_service/core/keyed_service.h"
@@ -48,7 +46,6 @@
 class ArcAuthService : public KeyedService,
                        public mojom::AuthHost,
                        public ConnectionObserver<mojom::AuthInstance>,
-                       public chromeos::AccountManager::Observer,
                        public identity::IdentityManager::Observer,
                        public ArcSessionManager::Observer {
  public:
@@ -95,13 +92,9 @@
   void SetURLLoaderFactoryForTesting(
       scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory);
 
-  // chromeos::AccountManager::Observer:
-  void OnTokenUpserted(
-      const chromeos::AccountManager::AccountKey& account_key) override;
-  void OnAccountRemoved(
-      const chromeos::AccountManager::AccountKey& account_key) override;
-
   // IdentityManager::Observer:
+  void OnRefreshTokenUpdatedForAccount(
+      const CoreAccountInfo& account_info) override;
   void OnExtendedAccountInfoRemoved(const AccountInfo& account_info) override;
 
   // ArcSessionManager::Observer:
@@ -171,10 +164,6 @@
   // Callback for data removal confirmation.
   void OnDataRemovalAccepted(bool accepted);
 
-  // |AccountManager::GetAccounts| callback.
-  void OnGetAccounts(
-      std::vector<chromeos::AccountManager::AccountKey> accounts);
-
   // Creates an |ArcBackgroundAuthCodeFetcher| for |account_id|. Can be used for
   // Device Account and Secondary Accounts. |initial_signin| denotes whether the
   // fetcher is being created for the initial ARC provisioning flow or for a
@@ -187,7 +176,7 @@
   // |pending_token_requests_|.
   void DeletePendingTokenRequest(ArcFetcherBase* fetcher);
 
-  // Triggers an async push of the accounts in Chrome OS Account Manager to ARC.
+  // Triggers an async push of the accounts in IdentityManager to ARC.
   void TriggerAccountsPushToArc();
 
   // Issues a request to ARC, which will complete callback with the list of
@@ -196,13 +185,9 @@
 
   // Non-owning pointers.
   Profile* const profile_;
-  chromeos::AccountManager* const account_manager_;
-  AccountTrackerService* const account_tracker_service_;
   identity::IdentityManager* const identity_manager_;
   ArcBridgeService* const arc_bridge_service_;
 
-  chromeos::AccountMapperUtil account_mapper_util_;
-
   scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory_;
   bool url_loader_factory_for_testing_set_ = false;
 
diff --git a/chrome/browser/chromeos/arc/auth/arc_auth_service_browsertest.cc b/chrome/browser/chromeos/arc/auth/arc_auth_service_browsertest.cc
index df078ee1..b752465 100644
--- a/chrome/browser/chromeos/arc/auth/arc_auth_service_browsertest.cc
+++ b/chrome/browser/chromeos/arc/auth/arc_auth_service_browsertest.cc
@@ -40,8 +40,6 @@
 #include "chrome/common/chrome_switches.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/testing_profile.h"
-#include "chromeos/account_manager/account_manager.h"
-#include "chromeos/account_manager/account_manager_factory.h"
 #include "chromeos/constants/chromeos_switches.h"
 #include "chromeos/cryptohome/cryptohome_parameters.h"
 #include "components/account_id/account_id.h"
@@ -78,7 +76,6 @@
 constexpr char kFakeGaiaId[] = "1234567890";
 constexpr char kSecondaryAccountEmail[] = "email.111@gmail.com";
 constexpr char kFakeAuthCode[] = "fake-auth-code";
-constexpr char kFakeToken[] = "fake-token";
 
 std::string GetFakeAuthTokenResponse() {
   return base::StringPrintf(R"({ "token" : "%s"})", kFakeAuthCode);
@@ -286,14 +283,9 @@
     auth_service_ = ArcAuthService::GetForBrowserContext(profile());
     DCHECK(auth_service_);
 
-    chromeos::AccountManagerFactory* factory =
-        g_browser_process->platform_part()->GetAccountManagerFactory();
-    chromeos::AccountManager* account_manager =
-        factory->GetAccountManager(profile()->GetPath().value());
     test_shared_loader_factory_ =
         base::MakeRefCounted<network::WeakWrapperSharedURLLoaderFactory>(
             &test_url_loader_factory_);
-    account_manager->SetUrlLoaderFactoryForTests(test_shared_loader_factory_);
     auth_service_->SetURLLoaderFactoryForTesting(test_shared_loader_factory_);
     // It is non-trivial to navigate through the merge session in a testing
     // context; currently we just skip it.
@@ -316,6 +308,11 @@
         ->SetInvalidRefreshTokenForAccount(account_id);
   }
 
+  void SetRefreshTokenForAccount(const std::string& account_id) {
+    identity_test_environment_adaptor_->identity_test_env()
+        ->SetRefreshTokenForAccount(account_id);
+  }
+
   void RequestGoogleAccountsInArc() {
     arc_google_accounts_.clear();
     arc_google_accounts_callback_called_ = false;
@@ -381,8 +378,16 @@
 // Tests that when ARC requests account info for a non-managed account, via
 // |RequestAccountInfoDeprecated| API, Chrome supplies the info configured in
 // SetAccountAndProfile() method.
+#if defined(MEMORY_SANITIZER)
+#define MAYBE_SuccessfulBackgroundFetchViaDeprecatedApi \
+  DISABLED_SuccessfulBackgroundFetchViaDeprecatedApi
+#else
+#define MAYBE_SuccessfulBackgroundFetchViaDeprecatedApi \
+  SuccessfulBackgroundFetchViaDeprecatedApi
+#endif
+// TODO(crbug.com/934796) The test is flaky on ChromeOs MSan.
 IN_PROC_BROWSER_TEST_F(ArcAuthServiceTest,
-                       SuccessfulBackgroundFetchViaDeprecatedApi) {
+                       MAYBE_SuccessfulBackgroundFetchViaDeprecatedApi) {
   SetAccountAndProfile(user_manager::USER_TYPE_REGULAR);
   test_url_loader_factory().AddResponse(arc::kAuthTokenExchangeEndPoint,
                                         GetFakeAuthTokenResponse());
@@ -403,7 +408,13 @@
 
 // Tests that when ARC requests account info for a non-managed account,
 // Chrome supplies the info configured in SetAccountAndProfile() method.
-IN_PROC_BROWSER_TEST_F(ArcAuthServiceTest, SuccessfulBackgroundFetch) {
+#if defined(MEMORY_SANITIZER)
+#define MAYBE_SuccessfulBackgroundFetch DISABLED_SuccessfulBackgroundFetch
+#else
+#define MAYBE_SuccessfulBackgroundFetch SuccessfulBackgroundFetch
+#endif
+// TODO(crbug.com/934796) The test is flaky on ChromeOs MSan.
+IN_PROC_BROWSER_TEST_F(ArcAuthServiceTest, MAYBE_SuccessfulBackgroundFetch) {
   SetAccountAndProfile(user_manager::USER_TYPE_REGULAR);
   test_url_loader_factory().AddResponse(arc::kAuthTokenExchangeEndPoint,
                                         GetFakeAuthTokenResponse());
@@ -422,8 +433,16 @@
   EXPECT_FALSE(auth_instance().account_info()->is_managed);
 }
 
+#if defined(MEMORY_SANITIZER)
+#define MAYBE_ReAuthenticatePrimaryAccountSucceeds \
+  DISABLED_ReAuthenticatePrimaryAccountSucceeds
+#else
+#define MAYBE_ReAuthenticatePrimaryAccountSucceeds \
+  ReAuthenticatePrimaryAccountSucceeds
+#endif
+// TODO(crbug.com/934796) The test is flaky on ChromeOs MSan.
 IN_PROC_BROWSER_TEST_F(ArcAuthServiceTest,
-                       ReAuthenticatePrimaryAccountSucceeds) {
+                       MAYBE_ReAuthenticatePrimaryAccountSucceeds) {
   SetAccountAndProfile(user_manager::USER_TYPE_REGULAR);
   test_url_loader_factory().AddResponse(arc::kAuthTokenExchangeEndPoint,
                                         GetFakeAuthTokenResponse());
@@ -442,8 +461,17 @@
   EXPECT_FALSE(auth_instance().account_info()->is_managed);
 }
 
-IN_PROC_BROWSER_TEST_F(ArcAuthServiceTest,
-                       ReAuthenticatePrimaryAccountFailsForInvalidAccount) {
+#if defined(MEMORY_SANITIZER)
+#define MAYBE_ReAuthenticatePrimaryAccountFailsForInvalidAccount \
+  DISABLED_ReAuthenticatePrimaryAccountFailsForInvalidAccount
+#else
+#define MAYBE_ReAuthenticatePrimaryAccountFailsForInvalidAccount \
+  ReAuthenticatePrimaryAccountFailsForInvalidAccount
+#endif
+// TODO(crbug.com/934796) The test is flaky on ChromeOs MSan.
+IN_PROC_BROWSER_TEST_F(
+    ArcAuthServiceTest,
+    MAYBE_ReAuthenticatePrimaryAccountFailsForInvalidAccount) {
   SetAccountAndProfile(user_manager::USER_TYPE_REGULAR);
   test_url_loader_factory().AddResponse(arc::kAuthTokenExchangeEndPoint,
                                         std::string() /* response */,
@@ -458,7 +486,16 @@
             auth_instance().sign_in_status());
 }
 
-IN_PROC_BROWSER_TEST_F(ArcAuthServiceTest, FetchSecondaryAccountInfoSucceeds) {
+#if defined(MEMORY_SANITIZER)
+#define MAYBE_FetchSecondaryAccountInfoSucceeds \
+  DISABLED_FetchSecondaryAccountInfoSucceeds
+#else
+#define MAYBE_FetchSecondaryAccountInfoSucceeds \
+  FetchSecondaryAccountInfoSucceeds
+#endif
+// TODO(crbug.com/934796) The test is flaky on ChromeOs MSan.
+IN_PROC_BROWSER_TEST_F(ArcAuthServiceTest,
+                       MAYBE_FetchSecondaryAccountInfoSucceeds) {
   // Add a Secondary Account.
   SetAccountAndProfile(user_manager::USER_TYPE_REGULAR);
   SeedAccountInfo(kSecondaryAccountEmail);
@@ -480,8 +517,16 @@
   EXPECT_FALSE(auth_instance().account_info()->is_managed);
 }
 
+#if defined(MEMORY_SANITIZER)
+#define MAYBE_FetchSecondaryAccountInfoFailsForInvalidAccounts \
+  DISABLED_FetchSecondaryAccountInfoFailsForInvalidAccounts
+#else
+#define MAYBE_FetchSecondaryAccountInfoFailsForInvalidAccounts \
+  FetchSecondaryAccountInfoFailsForInvalidAccounts
+#endif
+// TODO(crbug.com/934796) The test is flaky on ChromeOs MSan.
 IN_PROC_BROWSER_TEST_F(ArcAuthServiceTest,
-                       FetchSecondaryAccountInfoFailsForInvalidAccounts) {
+                       MAYBE_FetchSecondaryAccountInfoFailsForInvalidAccounts) {
   // Add a Secondary Account.
   SetAccountAndProfile(user_manager::USER_TYPE_REGULAR);
   SeedAccountInfo(kSecondaryAccountEmail);
@@ -499,7 +544,13 @@
             auth_instance().sign_in_status());
 }
 
-IN_PROC_BROWSER_TEST_F(ArcAuthServiceTest, FetchGoogleAccountsFromArc) {
+#if defined(MEMORY_SANITIZER)
+#define MAYBE_FetchGoogleAccountsFromArc DISABLED_FetchGoogleAccountsFromArc
+#else
+#define MAYBE_FetchGoogleAccountsFromArc FetchGoogleAccountsFromArc
+#endif
+// TODO(crbug.com/934796) The test is flaky on ChromeOs MSan.
+IN_PROC_BROWSER_TEST_F(ArcAuthServiceTest, MAYBE_FetchGoogleAccountsFromArc) {
   SetAccountAndProfile(user_manager::USER_TYPE_REGULAR);
 
   EXPECT_FALSE(arc_google_accounts_callback_called());
@@ -512,8 +563,17 @@
   EXPECT_EQ(kFakeGaiaId, arc_google_accounts()[0]->gaia_id);
 }
 
-IN_PROC_BROWSER_TEST_F(ArcAuthServiceTest,
-                       FetchGoogleAccountsFromArcWorksAcrossConnectionResets) {
+#if defined(MEMORY_SANITIZER)
+#define MAYBE_FetchGoogleAccountsFromArcWorksAcrossConnectionResets \
+  DISABLED_FetchGoogleAccountsFromArcWorksAcrossConnectionResets
+#else
+#define MAYBE_FetchGoogleAccountsFromArcWorksAcrossConnectionResets \
+  FetchGoogleAccountsFromArcWorksAcrossConnectionResets
+#endif
+// TODO(crbug.com/934796) The test is flaky on ChromeOs MSan.
+IN_PROC_BROWSER_TEST_F(
+    ArcAuthServiceTest,
+    MAYBE_FetchGoogleAccountsFromArcWorksAcrossConnectionResets) {
   SetAccountAndProfile(user_manager::USER_TYPE_REGULAR);
 
   // Close the connection.
@@ -548,79 +608,67 @@
     ArcAuthServiceTest::SetUp();
   }
 
-  AccountInfo SetupGaiaAccount(const std::string& email,
-                               const std::string& token) {
+  AccountInfo SetupGaiaAccount(const std::string& email) {
     SetAccountAndProfile(user_manager::USER_TYPE_REGULAR);
-    AccountInfo account_info = SeedAccountInfo(email);
-
-    chromeos::AccountManagerFactory* factory =
-        g_browser_process->platform_part()->GetAccountManagerFactory();
-    account_manager_ = factory->GetAccountManager(profile()->GetPath().value());
-    account_manager_->UpsertToken(
-        chromeos::AccountManager::AccountKey{
-            account_info.gaia,
-            chromeos::account_manager::AccountType::ACCOUNT_TYPE_GAIA},
-        token);
-    base::RunLoop().RunUntilIdle();
-    return account_info;
+    return SeedAccountInfo(email);
   }
 
-  chromeos::AccountManager* account_manager() { return account_manager_; }
-
  private:
   base::test::ScopedFeatureList scoped_feature_list_;
 
-  // Non-owned pointer.
-  chromeos::AccountManager* account_manager_ = nullptr;
-
   DISALLOW_COPY_AND_ASSIGN(ArcAuthServiceAccountManagerTest);
 };
 
+#if defined(MEMORY_SANITIZER)
+#define MAYBE_UnAuthenticatedAccountsAreNotPropagated \
+  DISABLED_UnAuthenticatedAccountsAreNotPropagated
+#else
+#define MAYBE_UnAuthenticatedAccountsAreNotPropagated \
+  UnAuthenticatedAccountsAreNotPropagated
+#endif
+// TODO(crbug.com/934796) The test is flaky on ChromeOs MSan.
 IN_PROC_BROWSER_TEST_F(ArcAuthServiceAccountManagerTest,
-                       UnAuthenticatedAccountsAreNotPropagated) {
-  const AccountInfo account_info =
-      SetupGaiaAccount(kSecondaryAccountEmail, kFakeToken);
-  SetInvalidRefreshTokenForAccount(account_info.account_id);
+                       MAYBE_UnAuthenticatedAccountsAreNotPropagated) {
+  const AccountInfo account_info = SetupGaiaAccount(kSecondaryAccountEmail);
 
-  // Don't bother checking |initial_num_calls|. AccountManager has a quirk that
-  // if you insert an account into it "too soon" (before it has been fully
-  // initialized), it notifies its observers twice for the inserted account.
-  // This case can only be triggered by tests.
   const int initial_num_calls = auth_instance().num_account_upserted_calls();
+  // 2 calls: 1 for the Primary Account and 1 for the Secondary Account.
+  EXPECT_EQ(2, initial_num_calls);
 
-  chromeos::AccountManager::AccountKey account_key{
-      account_info.gaia,
-      chromeos::account_manager::AccountType::ACCOUNT_TYPE_GAIA};
-  account_manager()->UpsertToken(account_key,
-                                 chromeos::AccountManager::kInvalidToken);
-
+  SetInvalidRefreshTokenForAccount(account_info.account_id);
   EXPECT_EQ(initial_num_calls, auth_instance().num_account_upserted_calls());
 }
 
+#if defined(MEMORY_SANITIZER)
+#define MAYBE_AccountUpdatesArePropagated DISABLED_AccountUpdatesArePropagated
+#else
+#define MAYBE_AccountUpdatesArePropagated AccountUpdatesArePropagated
+#endif
+// TODO(crbug.com/934796) The test is flaky on ChromeOs MSan.
 IN_PROC_BROWSER_TEST_F(ArcAuthServiceAccountManagerTest,
-                       AccountUpsertsArePropagated) {
-  AccountInfo account_info =
-      SetupGaiaAccount(kSecondaryAccountEmail, kFakeToken);
+                       MAYBE_AccountUpdatesArePropagated) {
+  AccountInfo account_info = SetupGaiaAccount(kSecondaryAccountEmail);
 
-  // Don't bother checking |initial_num_calls|. AccountManager has a quirk that
-  // if you insert an account into it "too soon" (before it has been fully
-  // initialized), it notifies its observers twice for the inserted account.
-  // This case can only be triggered by tests.
+  SetInvalidRefreshTokenForAccount(account_info.account_id);
   const int initial_num_calls = auth_instance().num_account_upserted_calls();
+  // 2 calls: 1 for the Primary Account and 1 for the Secondary Account.
+  EXPECT_EQ(2, initial_num_calls);
 
-  chromeos::AccountManager::AccountKey account_key{
-      account_info.gaia,
-      chromeos::account_manager::AccountType::ACCOUNT_TYPE_GAIA};
-  account_manager()->UpsertToken(account_key, "new-token");
-
-  // Expect exactly one call for the account insertion above.
+  SetRefreshTokenForAccount(account_info.account_id);
+  // Expect exactly one call for the account update above.
   EXPECT_EQ(1,
             auth_instance().num_account_upserted_calls() - initial_num_calls);
   EXPECT_EQ(kSecondaryAccountEmail, auth_instance().last_upserted_account());
 }
 
+#if defined(MEMORY_SANITIZER)
+#define MAYBE_AccountRemovalsArePropagated DISABLED_AccountRemovalsArePropagated
+#else
+#define MAYBE_AccountRemovalsArePropagated AccountRemovalsArePropagated
+#endif
+// TODO(crbug.com/934796) The test is flaky on ChromeOs MSan.
 IN_PROC_BROWSER_TEST_F(ArcAuthServiceAccountManagerTest,
-                       AccountRemovalsArePropagated) {
+                       MAYBE_AccountRemovalsArePropagated) {
   SetAccountAndProfile(user_manager::USER_TYPE_REGULAR);
   SeedAccountInfo(kSecondaryAccountEmail);
 
@@ -647,26 +695,6 @@
   EXPECT_EQ(kSecondaryAccountEmail, auth_instance().last_removed_account());
 }
 
-IN_PROC_BROWSER_TEST_F(ArcAuthServiceAccountManagerTest,
-                       AccountUpsertsAreNotPropagatedForInvalidTokens) {
-  const AccountInfo account_info =
-      SetupGaiaAccount(kSecondaryAccountEmail, kFakeToken);
-
-  // Don't bother checking |initial_num_calls|. AccountManager has a quirk that
-  // if you insert an account into it "too soon" (before it has been fully
-  // initialized), it notifies its observers twice for the inserted account.
-  // This case can only be triggered by tests.
-  const int initial_num_calls = auth_instance().num_account_upserted_calls();
-
-  chromeos::AccountManager::AccountKey account_key{
-      "object-guid",
-      chromeos::account_manager::AccountType::ACCOUNT_TYPE_ACTIVE_DIRECTORY};
-  account_manager()->UpsertToken(
-      account_key, chromeos::AccountManager::kActiveDirectoryDummyToken);
-
-  EXPECT_EQ(auth_instance().num_account_upserted_calls(), initial_num_calls);
-}
-
 class ArcRobotAccountAuthServiceTest : public ArcAuthServiceTest {
  public:
   ArcRobotAccountAuthServiceTest() = default;
@@ -779,8 +807,16 @@
   EXPECT_FALSE(auth_instance().account_info()->is_managed);
 }
 
+#if defined(MEMORY_SANITIZER)
+#define MAYBE_GetOfflineDemoAccountViaDeprecatedApi \
+  DISABLED_GetOfflineDemoAccountViaDeprecatedApi
+#else
+#define MAYBE_GetOfflineDemoAccountViaDeprecatedApi \
+  GetOfflineDemoAccountViaDeprecatedApi
+#endif
+// TODO(crbug.com/934796) The test is flaky on ChromeOs MSan.
 IN_PROC_BROWSER_TEST_F(ArcRobotAccountAuthServiceTest,
-                       GetOfflineDemoAccountViaDeprecatedApi) {
+                       MAYBE_GetOfflineDemoAccountViaDeprecatedApi) {
   chromeos::DemoSession::SetDemoConfigForTesting(
       chromeos::DemoSession::DemoModeConfig::kOffline);
   chromeos::DemoSession::StartIfInDemoMode();
@@ -800,7 +836,14 @@
   EXPECT_TRUE(auth_instance().account_info()->is_managed);
 }
 
-IN_PROC_BROWSER_TEST_F(ArcRobotAccountAuthServiceTest, GetOfflineDemoAccount) {
+#if defined(MEMORY_SANITIZER)
+#define MAYBE_GetOfflineDemoAccount DISABLED_GetOfflineDemoAccount
+#else
+#define MAYBE_GetOfflineDemoAccount GetOfflineDemoAccount
+#endif
+// TODO(crbug.com/934796) The test is flaky on ChromeOS MSan.
+IN_PROC_BROWSER_TEST_F(ArcRobotAccountAuthServiceTest,
+                       MAYBE_GetOfflineDemoAccount) {
   chromeos::DemoSession::SetDemoConfigForTesting(
       chromeos::DemoSession::DemoModeConfig::kOffline);
   chromeos::DemoSession::StartIfInDemoMode();
@@ -820,8 +863,17 @@
   EXPECT_TRUE(auth_instance().account_info()->is_managed);
 }
 
-IN_PROC_BROWSER_TEST_F(ArcRobotAccountAuthServiceTest,
-                       GetDemoAccountOnAuthTokenFetchFailureViaDeprecatedApi) {
+#if defined(MEMORY_SANITIZER)
+#define MAYBE_GetDemoAccountOnAuthTokenFetchFailureViaDeprecatedApi \
+  DISABLED_GetDemoAccountOnAuthTokenFetchFailureViaDeprecatedApi
+#else
+#define MAYBE_GetDemoAccountOnAuthTokenFetchFailureViaDeprecatedApi \
+  GetDemoAccountOnAuthTokenFetchFailureViaDeprecatedApi
+#endif
+// TODO(crbug.com/934796) The test is flaky on ChromeOS MSan.
+IN_PROC_BROWSER_TEST_F(
+    ArcRobotAccountAuthServiceTest,
+    MAYBE_GetDemoAccountOnAuthTokenFetchFailureViaDeprecatedApi) {
   chromeos::DemoSession::SetDemoConfigForTesting(
       chromeos::DemoSession::DemoModeConfig::kOnline);
   chromeos::DemoSession::StartIfInDemoMode();
@@ -894,8 +946,16 @@
 // Tests that when ARC requests account info for a child account, via
 // |RequestAccountInfoDeprecated| and Chrome supplies the info configured in
 // SetAccountAndProfile() above.
+#if defined(MEMORY_SANITIZER)
+#define MAYBE_ChildAccountFetchViaDeprecatedApi \
+  DISABLED_ChildAccountFetchViaDeprecatedApi
+#else
+#define MAYBE_ChildAccountFetchViaDeprecatedApi \
+  ChildAccountFetchViaDeprecatedApi
+#endif
+// TODO(crbug.com/934796) The test is flaky on ChromeOS MSan.
 IN_PROC_BROWSER_TEST_F(ArcAuthServiceChildAccountTest,
-                       ChildAccountFetchViaDeprecatedApi) {
+                       MAYBE_ChildAccountFetchViaDeprecatedApi) {
   SetAccountAndProfile(user_manager::USER_TYPE_CHILD);
   EXPECT_TRUE(profile()->IsChild());
   test_url_loader_factory().AddResponse(arc::kAuthTokenExchangeEndPoint,
@@ -917,7 +977,14 @@
 
 // Tests that when ARC requests account info for a child account and
 // Chrome supplies the info configured in SetAccountAndProfile() above.
-IN_PROC_BROWSER_TEST_F(ArcAuthServiceChildAccountTest, ChildAccountFetch) {
+#if defined(MEMORY_SANITIZER)
+#define MAYBE_ChildAccountFetch DISABLED_ChildAccountFetch
+#else
+#define MAYBE_ChildAccountFetch ChildAccountFetch
+#endif
+// TODO(crbug.com/934796) The test is flaky on ChromeOS MSan.
+IN_PROC_BROWSER_TEST_F(ArcAuthServiceChildAccountTest,
+                       MAYBE_ChildAccountFetch) {
   SetAccountAndProfile(user_manager::USER_TYPE_CHILD);
   EXPECT_TRUE(profile()->IsChild());
   test_url_loader_factory().AddResponse(arc::kAuthTokenExchangeEndPoint,
diff --git a/chrome/browser/chromeos/login/enrollment/OWNERS b/chrome/browser/chromeos/login/enrollment/OWNERS
index acbd0ca..08b56a4f 100644
--- a/chrome/browser/chromeos/login/enrollment/OWNERS
+++ b/chrome/browser/chromeos/login/enrollment/OWNERS
@@ -4,4 +4,5 @@
 bartfab@chromium.org
 emaxx@chromium.org
 poromov@chromium.org
+rsorokin@chromium.org
 tnagel@chromium.org
diff --git a/chrome/browser/flag-metadata.json b/chrome/browser/flag-metadata.json
index 1a10bb5..91f5204 100644
--- a/chrome/browser/flag-metadata.json
+++ b/chrome/browser/flag-metadata.json
@@ -1663,8 +1663,9 @@
   },
   {
     "name": "enable-show-autofill-signatures",
-    // "owners": [ "your-team" ],
-    "expiry_milestone": 76
+    "owners": [ "kolos" ],
+    // Used for debugging and QA by the autofill team for the indefinite future.
+    "expiry_milestone": -1
   },
   {
     "name": "enable-signed-http-exchange",
@@ -2007,8 +2008,8 @@
   },
   {
     "name": "enable-zero-state-suggestions",
-    // "owners": [ "your-team" ],
-    "expiry_milestone": 76
+    "owners": [ "jennyz", "xiyuan" ],
+    "expiry_milestone": 75
   },
   {
     "name": "enable-zero-suggest-redirect-to-chrome",
@@ -2572,6 +2573,16 @@
     "expiry_milestone": 80
   },
   {
+    "name": "omnibox-ui-blue-titles-and-gray-urls-on-page-suggestions",
+    "owners": [ "tommycli", "chrome-omnibox-team@google.com" ],
+    "expiry_milestone": 80
+  },
+  {
+    "name": "omnibox-ui-blue-titles-on-page-suggestions",
+    "owners": [ "tommycli", "chrome-omnibox-team@google.com" ],
+    "expiry_milestone": 80
+  },
+  {
     "name": "omnibox-ui-use-generic-search-engine-icon",
     "owners": [ "tommycli", "chrome-omnibox-team@google.com" ],
     "expiry_milestone": 80
@@ -3149,7 +3160,7 @@
   },
   {
     "name": "wake-on-wifi-packet",
-    // "owners": [ "your-team" ],
+    "owners": [ "abhishekbh", "chirantan" ],
     "expiry_milestone": 76
   },
   {
diff --git a/chrome/browser/flag_descriptions.cc b/chrome/browser/flag_descriptions.cc
index 99f82c1c..b9c388f 100644
--- a/chrome/browser/flag_descriptions.cc
+++ b/chrome/browser/flag_descriptions.cc
@@ -1363,6 +1363,16 @@
 const char kOmniboxUIBlueSearchLoopAndSearchQueryDescription[] =
     "Color the generic search icon and search terms blue.";
 
+const char kOmniboxUIBlueTitlesAndGrayUrlsOnPageSuggestionsName[] =
+    "Omnibox UI Blue Titles And Gray Urls On Page Suggestions";
+const char kOmniboxUIBlueTitlesAndGrayUrlsOnPageSuggestionsDescription[] =
+    "Displays navigation suggestions with blue titles and gray URLs.";
+
+const char kOmniboxUIBlueTitlesOnPageSuggestionsName[] =
+    "Omnibox UI Blue Titles On Page Suggestions";
+const char kOmniboxUIBlueTitlesOnPageSuggestionsDescription[] =
+    "Displays navigation suggestions with blue titles.";
+
 const char kOmniboxUIHideSteadyStateUrlSchemeName[] =
     "Omnibox UI Hide Steady-State URL Scheme";
 const char kOmniboxUIHideSteadyStateUrlSchemeDescription[] =
diff --git a/chrome/browser/flag_descriptions.h b/chrome/browser/flag_descriptions.h
index 6e01148..f4b277d 100644
--- a/chrome/browser/flag_descriptions.h
+++ b/chrome/browser/flag_descriptions.h
@@ -828,6 +828,12 @@
 extern const char kOmniboxUIBlueSearchLoopAndSearchQueryName[];
 extern const char kOmniboxUIBlueSearchLoopAndSearchQueryDescription[];
 
+extern const char kOmniboxUIBlueTitlesAndGrayUrlsOnPageSuggestionsName[];
+extern const char kOmniboxUIBlueTitlesAndGrayUrlsOnPageSuggestionsDescription[];
+
+extern const char kOmniboxUIBlueTitlesOnPageSuggestionsName[];
+extern const char kOmniboxUIBlueTitlesOnPageSuggestionsDescription[];
+
 extern const char kOmniboxUIHideSteadyStateUrlSchemeName[];
 extern const char kOmniboxUIHideSteadyStateUrlSchemeDescription[];
 
diff --git a/chrome/browser/media/webrtc/webrtc_log_uploader.cc b/chrome/browser/media/webrtc/webrtc_log_uploader.cc
index b77b6c7..ff329ad 100644
--- a/chrome/browser/media/webrtc/webrtc_log_uploader.cc
+++ b/chrome/browser/media/webrtc/webrtc_log_uploader.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/media/webrtc/webrtc_log_uploader.h"
 
 #include <stddef.h>
+#include <cstdlib>
 #include <utility>
 
 #include "base/bind.h"
@@ -669,7 +670,7 @@
             "WebRtcTextLogging.UploadFailureReason",
             WebRtcLoggingHandlerHost::UploadFailureReason::kNetworkError);
         base::UmaHistogramSparse("WebRtcTextLogging.UploadFailureNetErrorCode",
-                                 network_error_code);
+                                 std::abs(network_error_code));
       }
       error_message =
           base::StrCat({"Uploading failed, response code: ",
diff --git a/chrome/browser/metrics/process_memory_metrics_emitter.cc b/chrome/browser/metrics/process_memory_metrics_emitter.cc
index 6457faf2..ed51f423 100644
--- a/chrome/browser/metrics/process_memory_metrics_emitter.cc
+++ b/chrome/browser/metrics/process_memory_metrics_emitter.cc
@@ -252,6 +252,9 @@
     {"web_cache/Font_resources", "WebCache.FontResources", !kLargeMetric,
      kEffectiveSize, EmitTo::kUkmAndUmaAsSize,
      &Memory_Experimental::SetWebCache_FontResources},
+    {"web_cache/Code_cache", "WebCache.V8CodeCache", !kLargeMetric,
+     kEffectiveSize, EmitTo::kUkmAndUmaAsSize,
+     &Memory_Experimental::SetWebCache_V8CodeCache},
     {"web_cache/Other_resources", "WebCache.OtherResources", !kLargeMetric,
      kEffectiveSize, EmitTo::kUkmAndUmaAsSize,
      &Memory_Experimental::SetWebCache_OtherResources},
diff --git a/chrome/browser/net/system_network_context_manager.cc b/chrome/browser/net/system_network_context_manager.cc
index 4bdc1ca..bc24283e 100644
--- a/chrome/browser/net/system_network_context_manager.cc
+++ b/chrome/browser/net/system_network_context_manager.cc
@@ -475,6 +475,10 @@
   registry->RegisterStringPref(prefs::kAuthServerWhitelist, std::string());
   registry->RegisterStringPref(prefs::kAuthNegotiateDelegateWhitelist,
                                std::string());
+#if defined(OS_LINUX) || defined(OS_MACOSX) || defined(OS_CHROMEOS)
+  registry->RegisterBooleanPref(prefs::kUseKDCConstrainedDelegation, false);
+#endif  // defined(OS_LINUX) || defined(OS_MACOSX) || defined(OS_CHROMEOS)
+
 #if defined(OS_POSIX)
   registry->RegisterBooleanPref(
       prefs::kNtlmV2Enabled,
diff --git a/chrome/browser/offline_pages/android/offline_test_util_jni.cc b/chrome/browser/offline_pages/android/offline_test_util_jni.cc
index 4f3b096..aa1d24f 100644
--- a/chrome/browser/offline_pages/android/offline_test_util_jni.cc
+++ b/chrome/browser/offline_pages/android/offline_test_util_jni.cc
@@ -19,6 +19,7 @@
 #include "chrome/browser/profiles/profile_manager.h"
 #include "components/offline_pages/core/background/request_coordinator.h"
 #include "components/offline_pages/core/offline_page_model.h"
+#include "content/public/browser/network_service_instance.h"
 #include "content/public/test/url_loader_interceptor.h"
 #include "jni/OfflineTestUtil_jni.h"
 
@@ -105,6 +106,54 @@
 // This is a raw pointer because global destructors are disallowed.
 Interceptor* g_interceptor = nullptr;
 
+// Waits for the connection type to change to a desired value.
+class NetworkConnectionObserver
+    : public network::NetworkConnectionTracker::NetworkConnectionObserver {
+ public:
+  // Waits for connection type to change to |type|.
+  static void WaitForConnectionType(
+      network::mojom::ConnectionType type_to_wait_for,
+      base::android::ScopedJavaGlobalRef<jobject> callback) {
+    // NetworkConnectionObserver manages it's own lifetime.
+    new NetworkConnectionObserver(type_to_wait_for, std::move(callback));
+  }
+
+ private:
+  NetworkConnectionObserver(
+      network::mojom::ConnectionType type_to_wait_for,
+      base::android::ScopedJavaGlobalRef<jobject> callback)
+      : type_to_wait_for_(type_to_wait_for), callback_(std::move(callback)) {
+    content::GetNetworkConnectionTracker()->AddNetworkConnectionObserver(this);
+
+    // Call OnConnectionChanged() with the current state.
+    network::mojom::ConnectionType current_type;
+    if (content::GetNetworkConnectionTracker()->GetConnectionType(
+            &current_type,
+            base::BindOnce(&NetworkConnectionObserver::OnConnectionChanged,
+                           weak_factory_.GetWeakPtr()))) {
+      OnConnectionChanged(current_type);
+    }
+  }
+
+  ~NetworkConnectionObserver() override {
+    content::GetNetworkConnectionTracker()->RemoveNetworkConnectionObserver(
+        this);
+  }
+
+  // network::NetworkConnectionTracker::NetworkConnectionObserver:
+  void OnConnectionChanged(network::mojom::ConnectionType type) override {
+    if (type == type_to_wait_for_) {
+      base::android::RunRunnableAndroid(callback_);
+      delete this;
+    }
+  }
+
+  network::mojom::ConnectionType type_to_wait_for_ =
+      network::mojom::ConnectionType::CONNECTION_UNKNOWN;
+  base::android::ScopedJavaGlobalRef<jobject> callback_;
+  base::WeakPtrFactory<NetworkConnectionObserver> weak_factory_{this};
+};
+
 }  // namespace
 
 void JNI_OfflineTestUtil_GetRequestsInQueue(
@@ -188,4 +237,15 @@
   DumpRequestCoordinatorState(std::move(wrap_callback));
 }
 
+void JNI_OfflineTestUtil_WaitForConnectivityState(
+    JNIEnv* env,
+    jboolean connected,
+    const base::android::JavaParamRef<jobject>& callback) {
+  network::mojom::ConnectionType type =
+      connected ? network::mojom::ConnectionType::CONNECTION_UNKNOWN
+                : network::mojom::ConnectionType::CONNECTION_NONE;
+  NetworkConnectionObserver::WaitForConnectionType(
+      type, base::android::ScopedJavaGlobalRef<jobject>(env, callback));
+}
+
 }  // namespace offline_pages
diff --git a/chrome/browser/page_load_metrics/page_load_metrics_initialize.cc b/chrome/browser/page_load_metrics/page_load_metrics_initialize.cc
index 7c0e08a8..9b0740b 100644
--- a/chrome/browser/page_load_metrics/page_load_metrics_initialize.cc
+++ b/chrome/browser/page_load_metrics/page_load_metrics_initialize.cc
@@ -34,6 +34,7 @@
 #include "chrome/browser/page_load_metrics/observers/omnibox_suggestion_used_page_load_metrics_observer.h"
 #include "chrome/browser/page_load_metrics/observers/page_capping_page_load_metrics_observer.h"
 #include "chrome/browser/page_load_metrics/observers/prerender_page_load_metrics_observer.h"
+#include "chrome/browser/page_load_metrics/observers/previews_lite_page_redirect_metrics_observer.h"
 #include "chrome/browser/page_load_metrics/observers/previews_page_load_metrics_observer.h"
 #include "chrome/browser/page_load_metrics/observers/previews_ukm_observer.h"
 #include "chrome/browser/page_load_metrics/observers/protocol_page_load_metrics_observer.h"
@@ -117,6 +118,8 @@
     tracker->AddObserver(
         std::make_unique<PageCappingPageLoadMetricsObserver>());
     tracker->AddObserver(
+        std::make_unique<PreviewsLitePageRedirectMetricsObserver>());
+    tracker->AddObserver(
         std::make_unique<previews::PreviewsPageLoadMetricsObserver>());
     tracker->AddObserver(std::make_unique<previews::PreviewsUKMObserver>());
     tracker->AddObserver(
diff --git a/chrome/browser/policy/OWNERS b/chrome/browser/policy/OWNERS
index 4431760c..97e5e7d 100644
--- a/chrome/browser/policy/OWNERS
+++ b/chrome/browser/policy/OWNERS
@@ -4,6 +4,7 @@
 pastarmovj@chromium.org
 pmarko@chromium.org
 poromov@chromium.org
+rsorokin@chromium.org
 
 per-file browser_dm_token_storage*=georgesak@chromium.org
 per-file browser_dm_token_storage*=rogerta@chromium.org
diff --git a/chrome/browser/policy/configuration_policy_handler_list_factory.cc b/chrome/browser/policy/configuration_policy_handler_list_factory.cc
index 3ecf56d..20b54f7 100644
--- a/chrome/browser/policy/configuration_policy_handler_list_factory.cc
+++ b/chrome/browser/policy/configuration_policy_handler_list_factory.cc
@@ -326,6 +326,11 @@
   { key::kSafeSitesFilterBehavior,
     policy_prefs::kSafeSitesFilterBehavior,
     base::Value::Type::INTEGER},
+#if defined(OS_LINUX) || defined(OS_MACOSX) || defined(OS_CHROMEOS)
+  { key::kUseKDCConstrainedDelegation,
+    prefs::kUseKDCConstrainedDelegation,
+    base::Value::Type::BOOLEAN },
+#endif  // defined(OS_LINUX) || defined(OS_MACOSX) || defined(OS_CHROMEOS)
 #if defined(OS_POSIX)
   { key::kNtlmV2Enabled,
     prefs::kNtlmV2Enabled,
diff --git a/chrome/browser/policy/policy_browsertest.cc b/chrome/browser/policy/policy_browsertest.cc
index d3421ab..ef66f50 100644
--- a/chrome/browser/policy/policy_browsertest.cc
+++ b/chrome/browser/policy/policy_browsertest.cc
@@ -2690,13 +2690,7 @@
   EXPECT_FALSE(service->IsExtensionEnabled(kGoodCrxId));
 }
 
-#if defined(OS_LINUX)
-#define MAYBE_ExtensionAllowedTypes DISABLED_ExtensionAllowedTypes
-#else
-#define MAYBE_ExtensionAllowedTypes ExtensionAllowedTypes
-#endif
-// TODO(crbug.com/934297) The test is flaky (crashing) on Linux.
-IN_PROC_BROWSER_TEST_F(PolicyTest, MAYBE_ExtensionAllowedTypes) {
+IN_PROC_BROWSER_TEST_F(PolicyTest, ExtensionAllowedTypes) {
   // Verifies that extensions are blocked if policy specifies an allowed types
   // list and the extension's type is not on that list.
   extensions::ExtensionService* service = extension_service();
diff --git a/chrome/browser/profiles/host_zoom_map_browsertest.cc b/chrome/browser/profiles/host_zoom_map_browsertest.cc
index 6b64f54..74995f4a7 100644
--- a/chrome/browser/profiles/host_zoom_map_browsertest.cc
+++ b/chrome/browser/profiles/host_zoom_map_browsertest.cc
@@ -250,7 +250,7 @@
     WebviewBasedSigninUsesDefaultStoragePartitionForEmbedder) {
   GURL signin_url = signin::GetEmbeddedPromoURL(
       signin_metrics::AccessPoint::ACCESS_POINT_START_PAGE,
-      signin_metrics::Reason::REASON_SIGNIN_PRIMARY_ACCOUNT, false);
+      signin_metrics::Reason::REASON_FORCED_SIGNIN_PRIMARY_ACCOUNT, false);
   GURL test_url = ConstructTestServerURL(signin_url.spec().c_str());
   std::string test_host(test_url.host());
   std::string test_scheme(test_url.scheme());
diff --git a/chrome/browser/resources/welcome/onboarding_welcome/images/ntp_thumbnails/earth.jpg b/chrome/browser/resources/welcome/onboarding_welcome/images/ntp_thumbnails/earth.jpg
new file mode 100644
index 0000000..c4cbdc6
--- /dev/null
+++ b/chrome/browser/resources/welcome/onboarding_welcome/images/ntp_thumbnails/earth.jpg
Binary files differ
diff --git a/chrome/browser/resources/welcome/onboarding_welcome/images/ntp_thumbnails/life.jpg b/chrome/browser/resources/welcome/onboarding_welcome/images/ntp_thumbnails/life.jpg
deleted file mode 100644
index 58c9aa4..0000000
--- a/chrome/browser/resources/welcome/onboarding_welcome/images/ntp_thumbnails/life.jpg
+++ /dev/null
Binary files differ
diff --git a/chrome/browser/resources/welcome/onboarding_welcome/ntp_background/nux_ntp_background.html b/chrome/browser/resources/welcome/onboarding_welcome/ntp_background/nux_ntp_background.html
index e0dcca0..f1f15bc 100644
--- a/chrome/browser/resources/welcome/onboarding_welcome/ntp_background/nux_ntp_background.html
+++ b/chrome/browser/resources/welcome/onboarding_welcome/ntp_background/nux_ntp_background.html
@@ -83,6 +83,10 @@
         background-image: url(../images/ntp_thumbnails/cityscape.jpg);
       }
 
+      .earth {
+        background-image: url(../images/ntp_thumbnails/earth.jpg);
+      }
+
       .geometric-shapes {
         background-image: url(../images/ntp_thumbnails/geometric_shapes.jpg);
       }
@@ -91,10 +95,6 @@
         background-image: url(../images/ntp_thumbnails/landscape.jpg);
       }
 
-      .life {
-        background-image: url(../images/ntp_thumbnails/life.jpg);
-      }
-
       .ntp-background-title {
         border-top: var(--cr-separator-line);
         font-size: 14px;
diff --git a/chrome/browser/resources/welcome/onboarding_welcome/onboarding_welcome_resources.grd b/chrome/browser/resources/welcome/onboarding_welcome/onboarding_welcome_resources.grd
index 55b4f6a..86b5392 100644
--- a/chrome/browser/resources/welcome/onboarding_welcome/onboarding_welcome_resources.grd
+++ b/chrome/browser/resources/welcome/onboarding_welcome/onboarding_welcome_resources.grd
@@ -40,9 +40,9 @@
       <include name="IDR_NUX_NTP_BACKGROUND_LOGO_2X" file="images\ntp_background_2x.png" type="BINDATA" />
       <include name="IDR_NUX_NTP_BACKGROUND_THUMBNAIL_ART" file="images\ntp_thumbnails\art.jpg" type="BINDATA" />
       <include name="IDR_NUX_NTP_BACKGROUND_THUMBNAIL_CITYSCAPE" file="images\ntp_thumbnails\cityscape.jpg" type="BINDATA" />
+      <include name="IDR_NUX_NTP_BACKGROUND_THUMBNAIL_EARTH" file="images\ntp_thumbnails\earth.jpg" type="BINDATA" />
       <include name="IDR_NUX_NTP_BACKGROUND_THUMBNAIL_GEOMETRIC_SHAPES" file="images\ntp_thumbnails\geometric_shapes.jpg" type="BINDATA" />
       <include name="IDR_NUX_NTP_BACKGROUND_THUMBNAIL_LANDSCAPE" file="images\ntp_thumbnails\landscape.jpg" type="BINDATA" />
-      <include name="IDR_NUX_NTP_BACKGROUND_THUMBNAIL_LIFE" file="images\ntp_thumbnails\life.jpg" type="BINDATA" />
       <include name="IDR_NUX_SET_AS_DEFAULT_ILLUSTRATION_1X" file="images\set_as_default_illustration_1x.png" type="BINDATA" />
       <include name="IDR_NUX_SET_AS_DEFAULT_ILLUSTRATION_2X" file="images\set_as_default_illustration_2x.png" type="BINDATA" />
       <include name="IDR_NUX_SET_AS_DEFAULT_LOGO_1X" file="images\set_as_default_1x.png" type="BINDATA" />
diff --git a/chrome/browser/search/background/onboarding_ntp_backgrounds.cc b/chrome/browser/search/background/onboarding_ntp_backgrounds.cc
index 974e30a..d36cda5 100644
--- a/chrome/browser/search/background/onboarding_ntp_backgrounds.cc
+++ b/chrome/browser/search/background/onboarding_ntp_backgrounds.cc
@@ -27,6 +27,12 @@
                "_S57gvzBw859pj5Xl2pW_GpfG8k2GhE9LUFNKwA=w3840-h2160-p-k-no-nd-"
                "mv"),
 
+          // Earth
+          GURL("https://lh5.googleusercontent.com/proxy/"
+               "xvtq6_782kBajCBr0GISHpujOb51XLKUeEOJ2lLPKh12-"
+               "xNBTCtsoHT14NQcaH9l4JhatcXEMBkqgUeCWhb3XhdLnD1BiNzQ_LVydwg="
+               "w3840-h2160-p-k-no-nd-mv"),
+
           // Geometric Shapes
           GURL("https://lh3.googleusercontent.com/proxy/"
                "FWOBAVfQYasxV3KURX1VVKem1yOC2iazWAb8csOmqCDwI1CCzAA1zCpnAxR-"
@@ -38,12 +44,6 @@
                "nMIspgHzTUU0GzmiadmPphBelzF2xy9-tIiejZg3VvJTITxUb-1vILxf-"
                "IsCfyl94VSn6YvHa8_PiIyR9d3rwD8ZhNdQ1C1rnblP6zy3OaI=w3840-h2160-"
                "p-k-no-nd-mv"),
-
-          // Life
-          GURL("https://lh3.googleusercontent.com/proxy/"
-               "6gLbz6fLpHWeNGMCg-3SAr4V3qJsZN_Q-VePkM70-"
-               "FbHVROkRKx35pwEenRDVLuRSnQse6MTKo455BPVwULXX42R7VjAKJbm-4ivxQ="
-               "w3840-h2160-p-k-no-nd-mv"),
       }};
   return kOnboardingNtpBackgrounds;
 }
diff --git a/chrome/browser/signin/dice_browsertest.cc b/chrome/browser/signin/dice_browsertest.cc
index 85c8f2e..c19ab1b 100644
--- a/chrome/browser/signin/dice_browsertest.cc
+++ b/chrome/browser/signin/dice_browsertest.cc
@@ -780,7 +780,8 @@
 #endif
 IN_PROC_BROWSER_TEST_F(DiceBrowserTest, MAYBE_NoDiceFromWebUI) {
   // Navigate to Gaia and from the native tab, which uses an extension.
-  ui_test_utils::NavigateToURL(browser(), GURL("chrome:chrome-signin"));
+  ui_test_utils::NavigateToURL(browser(),
+                               GURL("chrome:chrome-signin?reason=5"));
 
   // Check that the request had no Dice request header.
   if (dice_request_header_.empty())
diff --git a/chrome/browser/signin/dice_response_handler_unittest.cc b/chrome/browser/signin/dice_response_handler_unittest.cc
index bdb5055..cde098e 100644
--- a/chrome/browser/signin/dice_response_handler_unittest.cc
+++ b/chrome/browser/signin/dice_response_handler_unittest.cc
@@ -23,6 +23,7 @@
 #include "components/signin/core/browser/account_tracker_service.h"
 #include "components/signin/core/browser/dice_account_reconcilor_delegate.h"
 #include "components/signin/core/browser/fake_account_fetcher_service.h"
+#include "components/signin/core/browser/fake_profile_oauth2_token_service.h"
 #include "components/signin/core/browser/fake_signin_manager.h"
 #include "components/signin/core/browser/mutable_profile_oauth2_token_service_delegate.h"
 #include "components/signin/core/browser/profile_oauth2_token_service.h"
diff --git a/chrome/browser/signin/identity_services_provider_android.cc b/chrome/browser/signin/identity_services_provider_android.cc
index b965675..683be19 100644
--- a/chrome/browser/signin/identity_services_provider_android.cc
+++ b/chrome/browser/signin/identity_services_provider_android.cc
@@ -4,11 +4,9 @@
 
 #include "base/android/jni_android.h"
 #include "chrome/browser/profiles/profile_android.h"
-#include "chrome/browser/signin/account_tracker_service_factory.h"
-#include "chrome/browser/signin/profile_oauth2_token_service_factory.h"
-#include "components/signin/core/browser/account_tracker_service.h"
-#include "components/signin/core/browser/oauth2_token_service_delegate_android.h"
+#include "chrome/browser/signin/identity_manager_factory.h"
 #include "jni/IdentityServicesProvider_jni.h"
+#include "services/identity/public/cpp/identity_manager.h"
 
 using base::android::JavaParamRef;
 using base::android::ScopedJavaLocalRef;
@@ -18,9 +16,9 @@
     JNIEnv* env,
     const JavaParamRef<jobject>& j_profile_android) {
   Profile* profile = ProfileAndroid::FromProfileAndroid(j_profile_android);
-  AccountTrackerService* service =
-      AccountTrackerServiceFactory::GetForProfile(profile);
-  return service->GetJavaObject();
+  identity::IdentityManager* identity_manager =
+      IdentityManagerFactory::GetForProfile(profile);
+  return identity_manager->LegacyGetAccountTrackerServiceJavaObject();
 }
 
 static ScopedJavaLocalRef<jobject>
@@ -28,9 +26,7 @@
     JNIEnv* env,
     const JavaParamRef<jobject>& j_profile_android) {
   Profile* profile = ProfileAndroid::FromProfileAndroid(j_profile_android);
-  ProfileOAuth2TokenService* service =
-      ProfileOAuth2TokenServiceFactory::GetForProfile(profile);
-  OAuth2TokenServiceDelegateAndroid* delegate =
-      static_cast<OAuth2TokenServiceDelegateAndroid*>(service->GetDelegate());
-  return delegate->GetJavaObject();
+  identity::IdentityManager* identity_manager =
+      IdentityManagerFactory::GetForProfile(profile);
+  return identity_manager->LegacyGetOAuth2TokenServiceJavaObject();
 }
diff --git a/chrome/browser/signin/identity_test_environment_profile_adaptor.cc b/chrome/browser/signin/identity_test_environment_profile_adaptor.cc
index e908f7f..b565582 100644
--- a/chrome/browser/signin/identity_test_environment_profile_adaptor.cc
+++ b/chrome/browser/signin/identity_test_environment_profile_adaptor.cc
@@ -12,6 +12,8 @@
 #include "chrome/browser/signin/identity_manager_factory.h"
 #include "chrome/browser/signin/profile_oauth2_token_service_factory.h"
 #include "chrome/browser/signin/signin_manager_factory.h"
+#include "components/signin/core/browser/fake_account_fetcher_service.h"
+#include "components/signin/core/browser/fake_profile_oauth2_token_service.h"
 #include "components/signin/core/browser/fake_signin_manager.h"
 
 namespace {
diff --git a/chrome/browser/sync/sync_ui_util.cc b/chrome/browser/sync/sync_ui_util.cc
index fb046fe..4528ae9 100644
--- a/chrome/browser/sync/sync_ui_util.cc
+++ b/chrome/browser/sync/sync_ui_util.cc
@@ -151,24 +151,27 @@
   syncer::SyncStatus status;
   service->QueryDetailedSyncStatus(&status);
 
+  // First check for an unrecoverable error.
+  if (service->HasUnrecoverableError()) {
+    if (status_label && link_label) {
+      GetStatusForUnrecoverableError(is_user_signout_allowed,
+                                     status.sync_protocol_error.action,
+                                     status_label, link_label, action_type);
+    }
+    return SYNC_ERROR;
+  }
+
+  // TODO(crbug.com/911153): What's the intended meaning of this condition?
+  // Should other disable reasons also be checked?
   if (service->GetUserSettings()->IsFirstSetupComplete() ||
       service->HasDisableReason(
           syncer::SyncService::DISABLE_REASON_ENTERPRISE_POLICY) ||
       service->HasDisableReason(
           syncer::SyncService::DISABLE_REASON_USER_CHOICE)) {
-    // The order or priority is going to be: 1. Unrecoverable errors.
-    // 2. Auth errors. 3. Protocol errors. 4. Passphrase errors.
+    // The order or priority is going to be:
+    // 1. Auth errors. 2. Actionable protocol errors. 3. Passphrase errors.
 
-    if (service->HasUnrecoverableError()) {
-      if (status_label && link_label) {
-        GetStatusForUnrecoverableError(is_user_signout_allowed,
-                                       status.sync_protocol_error.action,
-                                       status_label, link_label, action_type);
-      }
-      return SYNC_ERROR;
-    }
-
-    // Since there is no auth in progress, check for an auth error first.
+    // Check for an auth error first.
     if (auth_error.state() != GoogleServiceAuthError::NONE) {
       if (status_label && link_label) {
         GetStatusForAuthError(auth_error, status_label, link_label,
@@ -177,7 +180,9 @@
       return SYNC_ERROR;
     }
 
-    // We don't have an auth error. Check for an actionable error.
+    // We don't have an auth error. Check for an actionable protocol error.
+    // TODO(crbug.com/911153): Here the behavior (returned value) depends on
+    // whether the |status_label| param is null. That seems like a bug.
     if (status_label && link_label) {
       GetStatusForActionableError(status.sync_protocol_error.action,
                                   status_label, link_label, action_type);
@@ -210,12 +215,11 @@
       return PRE_SYNCED;
     }
 
-    // There is no error. Display "Last synced..." message.
     return SYNCED;
   }
 
-  // Either show auth error information with a link to re-login, auth in prog,
-  // or provide a link to continue with setup.
+  // If first setup is in progress, either show auth error information or just
+  // an "in progress" message.
   if (service->IsFirstSetupInProgress()) {
     if (auth_error.state() != GoogleServiceAuthError::NONE &&
         auth_error.state() != GoogleServiceAuthError::TWO_FACTOR) {
@@ -232,15 +236,6 @@
     return PRE_SYNCED;
   }
 
-  if (service->HasUnrecoverableError()) {
-    if (status_label && link_label) {
-      GetStatusForUnrecoverableError(is_user_signout_allowed,
-                                     status.sync_protocol_error.action,
-                                     status_label, link_label, action_type);
-    }
-    return SYNC_ERROR;
-  }
-
   if (ShouldRequestSyncConfirmation(service)) {
     if (status_label && link_label) {
       *status_label =
@@ -252,6 +247,9 @@
     return SYNC_ERROR;
   }
 
+  // TODO(crbug.com/906995): This code is only reachable if IsLocalSyncEnabled()
+  // is true. That should probably be handled more explicitly, and anyway this
+  // doesn't seem like an appropriate message for that case.
   // The user is signed in, but sync has been stopped.
   if (status_label) {
     *status_label =
diff --git a/chrome/browser/ui/views/payments/payment_request_dialog_view.cc b/chrome/browser/ui/views/payments/payment_request_dialog_view.cc
index 43a2410..4e44ab7 100644
--- a/chrome/browser/ui/views/payments/payment_request_dialog_view.cc
+++ b/chrome/browser/ui/views/payments/payment_request_dialog_view.cc
@@ -79,10 +79,13 @@
   AddChildView(view_stack_.get());
 
   SetupSpinnerOverlay();
-  // Show spinner when getting all payment instruments. The spinner will be
-  // hidden in OnGetAllPaymentInstrumentsFinished.
-  if (!request->state()->is_get_all_instruments_finished()) {
-    request->state()->AddObserver(this);
+
+  if (!request->state()->IsInitialized()) {
+    request->state()->AddInitializationObserver(this);
+    ++number_of_initialization_tasks_;
+  }
+
+  if (number_of_initialization_tasks_ > 0) {
     ShowProcessingSpinner();
   } else if (observer_for_testing_) {
     // When testing, signal that the processing spinner events have passed, even
@@ -233,18 +236,18 @@
     observer_for_testing_->OnSpecDoneUpdating();
 }
 
-void PaymentRequestDialogView::OnGetAllPaymentInstrumentsFinished() {
+void PaymentRequestDialogView::OnInitialized(
+    InitializationTask* initialization_task) {
+  initialization_task->RemoveInitializationObserver(this);
+  if (--number_of_initialization_tasks_ > 0)
+    return;
+
   HideProcessingSpinner();
+
   if (request_->state()->are_requested_methods_supported()) {
     request_->RecordDialogShownEventInJourneyLogger();
-    if (observer_for_testing_) {
-      // The OnGetAllPaymentInstrumentsFinished() method is called if the
-      // payment instruments were retrieved asynchronously. This method hides
-      // the "Processing" spinner, so the UI is now ready for interaction. Any
-      // test that opens UI can now interact with it. The OnDialogOpened() call
-      // notifies the tests of this event.
+    if (observer_for_testing_)
       observer_for_testing_->OnDialogOpened();
-    }
   }
 }
 
@@ -419,16 +422,14 @@
                             request_->spec(), request_->state(), this),
                         &controller_map_),
                     /* animate = */ false);
-  if (request_->state()->is_get_all_instruments_finished() &&
-      request_->state()->are_requested_methods_supported()) {
+
+  if (number_of_initialization_tasks_ > 0)
+    return;
+
+  if (request_->state()->are_requested_methods_supported()) {
     request_->RecordDialogShownEventInJourneyLogger();
-    if (observer_for_testing_) {
-      // The is_get_all_instruments_finished() method returns true if all
-      // payment instruments were retrieved synchronously. Any test that opens
-      // UI can now interact with it. The OnDialogOpened() call notifies the
-      // tests of this event.
+    if (observer_for_testing_)
       observer_for_testing_->OnDialogOpened();
-    }
   }
 }
 
diff --git a/chrome/browser/ui/views/payments/payment_request_dialog_view.h b/chrome/browser/ui/views/payments/payment_request_dialog_view.h
index 2abe09f..29d7028 100644
--- a/chrome/browser/ui/views/payments/payment_request_dialog_view.h
+++ b/chrome/browser/ui/views/payments/payment_request_dialog_view.h
@@ -11,6 +11,7 @@
 #include "base/callback_forward.h"
 #include "base/macros.h"
 #include "chrome/browser/ui/views/payments/view_stack.h"
+#include "components/payments/content/initialization_task.h"
 #include "components/payments/content/payment_request_dialog.h"
 #include "components/payments/content/payment_request_spec.h"
 #include "components/payments/content/payment_request_state.h"
@@ -46,7 +47,7 @@
 class PaymentRequestDialogView : public views::DialogDelegateView,
                                  public PaymentRequestDialog,
                                  public PaymentRequestSpec::Observer,
-                                 public PaymentRequestState::Observer {
+                                 public InitializationTask::Observer {
  public:
   class ObserverForTest {
    public:
@@ -119,9 +120,8 @@
   void OnStartUpdating(PaymentRequestSpec::UpdateReason reason) override;
   void OnSpecUpdated() override;
 
-  // PaymentRequestState::Observer:
-  void OnGetAllPaymentInstrumentsFinished() override;
-  void OnSelectedInformationChanged() override {}
+  // InitializationTask::Observer:
+  void OnInitialized(InitializationTask* initialization_task) override;
 
   void Pay();
   void GoBack();
@@ -211,6 +211,9 @@
   // controller_map_.
   bool being_closed_;
 
+  // The number of initialization tasks that are not yet initialized.
+  size_t number_of_initialization_tasks_ = 0;
+
   DISALLOW_COPY_AND_ASSIGN(PaymentRequestDialogView);
 };
 
diff --git a/chrome/browser/ui/views/sync/inline_login_ui_browsertest.cc b/chrome/browser/ui/views/sync/inline_login_ui_browsertest.cc
index 635dd4f3..32b3c59 100644
--- a/chrome/browser/ui/views/sync/inline_login_ui_browsertest.cc
+++ b/chrome/browser/ui/views/sync/inline_login_ui_browsertest.cc
@@ -18,6 +18,7 @@
 #include "chrome/browser/signin/identity_manager_factory.h"
 #include "chrome/browser/signin/identity_test_environment_profile_adaptor.h"
 #include "chrome/browser/signin/signin_promo.h"
+#include "chrome/browser/signin/signin_util.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_list.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
@@ -117,7 +118,7 @@
 GURL GetSigninPromoURL() {
   return signin::GetEmbeddedPromoURL(
       signin_metrics::AccessPoint::ACCESS_POINT_START_PAGE,
-      signin_metrics::Reason::REASON_SIGNIN_PRIMARY_ACCOUNT, false);
+      signin_metrics::Reason::REASON_FORCED_SIGNIN_PRIMARY_ACCOUNT, false);
 }
 
 // Mock the TestChromeWebUIControllerFactory::WebUIProvider to prove that we are
@@ -166,8 +167,7 @@
 
   MOCK_METHOD1(OnClientOAuthSuccess, void(const ClientOAuthResult& result));
   MOCK_METHOD1(OnClientOAuthFailure, void(const GoogleServiceAuthError& error));
-  MOCK_METHOD3(CreateSyncStarter,
-               void(Browser*, const GURL&, const std::string&));
+  MOCK_METHOD1(CreateSyncStarter, void(const std::string&));
 
   GaiaAuthFetcher* GetGaiaAuthFetcher() { return GetGaiaAuthFetcherForTest(); }
 
@@ -216,8 +216,7 @@
       bool confirm_untrusted_signin,
       bool is_force_sign_in_with_usermanager);
 
-  MOCK_METHOD3(CreateSyncStarter,
-               void(Browser*, const GURL&, const std::string&));
+  MOCK_METHOD1(CreateSyncStarter, void(const std::string&));
 
  private:
   DISALLOW_COPY_AND_ASSIGN(MockSyncStarterInlineSigninHelper);
@@ -417,7 +416,13 @@
 
 class InlineLoginHelperBrowserTest : public InProcessBrowserTest {
  public:
-  InlineLoginHelperBrowserTest() = default;
+  InlineLoginHelperBrowserTest() {
+    signin_util::SetForceSigninForTesting(true);
+  }
+
+  ~InlineLoginHelperBrowserTest() override {
+    signin_util::ResetForceSigninForTesting();
+  }
 
   void SetUpInProcessBrowserTestFixture() override {
     will_create_browser_context_services_subscription_ =
@@ -452,6 +457,8 @@
                                     base_url.spec());
   }
 
+  Profile* profile() { return profile_; }
+
   void SetUpOnMainThread() override {
     InProcessBrowserTest::SetUpOnMainThread();
 
@@ -466,13 +473,16 @@
     embedded_test_server()->StartAcceptingConnections();
 
     // Grab references to the fake signin manager and token service.
-    Profile* profile = browser()->profile();
+    ASSERT_GT(g_browser_process->profile_manager()->GetLoadedProfiles().size(),
+              0u);
+    profile_ = g_browser_process->profile_manager()->GetLoadedProfiles()[0];
     identity_test_env_profile_adaptor_ =
-        std::make_unique<IdentityTestEnvironmentProfileAdaptor>(profile);
+        std::make_unique<IdentityTestEnvironmentProfileAdaptor>(profile_);
   }
 
   void TearDownOnMainThread() override {
     identity_test_env_profile_adaptor_.reset();
+    InProcessBrowserTest::TearDownOnMainThread();
   }
 
   void SimulateStartAuthCodeForOAuth2TokenExchangeSuccess(
@@ -488,11 +498,11 @@
     GaiaAuthConsumer::ClientOAuthResult result;
     result.refresh_token = refresh_token;
     consumer->OnClientOAuthSuccess(result);
+    base::RunLoop().RunUntilIdle();
   }
 
   scoped_refptr<network::SharedURLLoaderFactory> test_shared_loader_factory() {
-    return content::BrowserContext::GetDefaultStoragePartition(
-               browser()->profile())
+    return content::BrowserContext::GetDefaultStoragePartition(profile_)
         ->GetURLLoaderFactoryForBrowserProcess();
   }
 
@@ -511,6 +521,7 @@
   std::unique_ptr<
       base::CallbackList<void(content::BrowserContext*)>::Subscription>
       will_create_browser_context_services_subscription_;
+  Profile* profile_ = nullptr;
 
   DISALLOW_COPY_AND_ASSIGN(InlineLoginHelperBrowserTest);
 };
@@ -518,13 +529,12 @@
 // Test signin helper calls correct fetcher methods when called with an
 // auth code.
 IN_PROC_BROWSER_TEST_F(InlineLoginHelperBrowserTest, WithAuthCode) {
-  base::WeakPtr<InlineLoginHandlerImpl> handler;
-  MockInlineSigninHelper helper(handler, test_shared_loader_factory(),
-                                browser()->profile(), GURL(), "foo@gmail.com",
-                                "gaiaid-12345", "password",
-                                "auth_code",  // auth code
-                                std::string(),
-                                false);  // confirm untrusted signin
+  InlineLoginHandlerImpl handler;
+  MockInlineSigninHelper helper(
+      handler.GetWeakPtr(), test_shared_loader_factory(), profile(), GURL(),
+      "foo@gmail.com", "gaiaid-12345", "password", "auth_code",
+      /*signin_scoped_device_id=*/std::string(),
+      /*confirm_untrusted_signin=*/false);
   base::RunLoop run_loop;
   EXPECT_CALL(helper, OnClientOAuthSuccess(_))
       .WillOnce(testing::InvokeWithoutArgs([&run_loop]() { run_loop.Quit(); }));
@@ -542,38 +552,33 @@
 // signing in with default sync options.
 IN_PROC_BROWSER_TEST_F(InlineLoginHelperBrowserTest,
                        SigninCreatesSyncStarter1) {
+  InlineLoginHandlerImpl handler;
   // See Source enum in components/signin/core/browser/signin_metrics.h for
   // possible values of access_point=, reason=.
-  GURL url("chrome://chrome-signin/?access_point=0&reason=0");
-  base::WeakPtr<InlineLoginHandlerImpl> handler;
+  GURL url("chrome://chrome-signin/?access_point=0&reason=5");
   // MockSyncStarterInlineSigninHelper will delete itself when done using
   // base::ThreadTaskRunnerHandle::DeleteSoon(), so need to delete here.  But
   // do need the RunUntilIdle() at the end.
   MockSyncStarterInlineSigninHelper* helper =
       new MockSyncStarterInlineSigninHelper(
-          handler,
-          content::BrowserContext::GetDefaultStoragePartition(
-              browser()->profile())
+          handler.GetWeakPtr(),
+          content::BrowserContext::GetDefaultStoragePartition(profile())
               ->GetURLLoaderFactoryForBrowserProcess(),
-          browser()->profile(), url, "foo@gmail.com", "gaiaid-12345",
-          "password",
-          "auth_code",  // auth code
-          std::string(),
-          false,  // confirm untrusted signin
-          false);
-  EXPECT_CALL(*helper, CreateSyncStarter(_, _, "refresh_token"));
+          profile(), url, "foo@gmail.com", "gaiaid-12345", "password",
+          "auth_code", /*signin_scoped_device_id=*/std::string(),
+          /*confirm_untrusted_signin=*/false,
+          /*is_force_sign_in_with_usermanager=*/false);
+  EXPECT_CALL(*helper, CreateSyncStarter("refresh_token"));
 
   ProfileAttributesEntry* entry;
   ASSERT_TRUE(g_browser_process->profile_manager()
                   ->GetProfileAttributesStorage()
-                  .GetProfileAttributesWithPath(browser()->profile()->GetPath(),
-                                                &entry));
+                  .GetProfileAttributesWithPath(profile()->GetPath(), &entry));
   entry->SetIsSigninRequired(true);
 
-  ASSERT_EQ(1ul, BrowserList::GetInstance()->size());
+  ASSERT_EQ(0ul, BrowserList::GetInstance()->size());
   SimulateOnClientOAuthSuccess(helper, "refresh_token");
-  base::RunLoop().RunUntilIdle();
-  ASSERT_EQ(1ul, BrowserList::GetInstance()->size());
+  ASSERT_EQ(0ul, BrowserList::GetInstance()->size());
   // if |force_sign_in_with_user_manager| is false, the profile should be
   // unlocked early and InlineLoginHelper won't try to do it again
   ASSERT_TRUE(entry->IsSigninRequired());
@@ -583,46 +588,43 @@
 // signing in and choosing what to sync first.
 IN_PROC_BROWSER_TEST_F(InlineLoginHelperBrowserTest,
                        SigninCreatesSyncStarter2) {
+  InlineLoginHandlerImpl handler;
   // See Source enum in components/signin/core/browser/signin_metrics.h for
   // possible values of access_point=, reason=.
-  const GURL url("chrome://chrome-signin/?access_point=0&reason=0");
-  base::WeakPtr<InlineLoginHandlerImpl> handler;
+  const GURL url("chrome://chrome-signin/?access_point=0&reason=5");
   // MockSyncStarterInlineSigninHelper will delete itself when done using
   // base::ThreadTaskRunnerHandle::DeleteSoon(), so need to delete here.  But
   // do need the RunUntilIdle() at the end.
   MockSyncStarterInlineSigninHelper* helper =
       new MockSyncStarterInlineSigninHelper(
-          handler, test_shared_loader_factory(), browser()->profile(), url,
-          "foo@gmail.com", "gaiaid-12345", "password",
-          "auth_code",  // auth code
-          std::string(),
-          false,  // confirm untrusted signin
-          false);
-  EXPECT_CALL(*helper, CreateSyncStarter(_, _, "refresh_token"));
+          handler.GetWeakPtr(), test_shared_loader_factory(), profile(), url,
+          "foo@gmail.com", "gaiaid-12345", "password", "auth_code",
+          /*signin_scoped_device_id=*/std::string(),
+          /*confirm_untrusted_signin=*/false,
+          /*is_force_sign_in_with_usermanager=*/false);
+  EXPECT_CALL(*helper, CreateSyncStarter("refresh_token"));
 
   SimulateOnClientOAuthSuccess(helper, "refresh_token");
-  base::RunLoop().RunUntilIdle();
 }
 
 // Test signin helper creates the untrusted signin dialog, and signin aborts
 // when the user cancels.
 IN_PROC_BROWSER_TEST_F(InlineLoginHelperBrowserTest,
                        UntrustedSigninDialogCancel) {
+  InlineLoginHandlerImpl handler;
   // See Source enum in components/signin/core/browser/signin_metrics.h for
   // possible values of access_point=, reason=.
-  GURL url("chrome://chrome-signin/?access_point=0&reason=0");
-  base::WeakPtr<InlineLoginHandlerImpl> handler;
+  GURL url("chrome://chrome-signin/?access_point=0&reason=5");
   // MockSyncStarterInlineSigninHelper will delete itself when done using
   // base::ThreadTaskRunnerHandle::DeleteSoon(), so need to delete here.  But
   // do need the RunUntilIdle() at the end.
   MockSyncStarterInlineSigninHelper* helper =
       new MockSyncStarterInlineSigninHelper(
-          handler, test_shared_loader_factory(), browser()->profile(), url,
-          "foo@gmail.com", "gaiaid-12345", "password",
-          "auth_code",  // auth code
-          std::string(),
-          true,  // confirm untrusted signin
-          false);
+          handler.GetWeakPtr(), test_shared_loader_factory(), profile(), url,
+          "foo@gmail.com", "gaiaid-12345", "password", "auth_code",
+          /*signin_scoped_device_id=*/std::string(),
+          /*confirm_untrusted_signin=*/true,
+          /*is_force_sign_in_with_usermanager=*/true);
   SimulateOnClientOAuthSuccess(helper, "refresh_token");
   EXPECT_TRUE(OneClickSigninDialogView::IsShowing());
   OneClickSigninDialogView::Hide();
@@ -634,22 +636,21 @@
 // when the user confirms.
 IN_PROC_BROWSER_TEST_F(InlineLoginHelperBrowserTest,
                        UntrustedSigninDialogConfirm) {
+  InlineLoginHandlerImpl handler;
   // See Source enum in components/signin/core/browser/signin_metrics.h for
   // possible values of access_point=, reason=.
-  GURL url("chrome://chrome-signin/?access_point=0&reason=0");
-  base::WeakPtr<InlineLoginHandlerImpl> handler;
+  GURL url("chrome://chrome-signin/?access_point=0&reason=5");
   // MockSyncStarterInlineSigninHelper will delete itself when done using
   // base::ThreadTaskRunnerHandle::DeleteSoon(), so need to delete here.  But
   // do need the RunUntilIdle() at the end.
   MockSyncStarterInlineSigninHelper* helper =
       new MockSyncStarterInlineSigninHelper(
-          handler, test_shared_loader_factory(), browser()->profile(), url,
-          "foo@gmail.com", "gaiaid-12345", "password",
-          "auth_code",  // auth code
-          std::string(),
-          true,  // confirm untrusted signin
-          false);
-  EXPECT_CALL(*helper, CreateSyncStarter(_, _, "refresh_token"));
+          handler.GetWeakPtr(), test_shared_loader_factory(), profile(), url,
+          "foo@gmail.com", "gaiaid-12345", "password", "auth_code",
+          /*signin_scoped_device_id=*/std::string(),
+          /*confirm_untrusted_signin=*/true,
+          /*is_force_sign_in_with_usermanager=*/true);
+  EXPECT_CALL(*helper, CreateSyncStarter("refresh_token"));
   SimulateOnClientOAuthSuccess(helper, "refresh_token");
   EXPECT_TRUE(OneClickSigninDialogView::IsShowing());
   views::DialogDelegateView* dialog_delegate =
@@ -663,28 +664,26 @@
 // re-auth.
 IN_PROC_BROWSER_TEST_F(InlineLoginHelperBrowserTest,
                        SigninCreatesSyncStarter4) {
+  InlineLoginHandlerImpl handler;
   // See Source enum in components/signin/core/browser/signin_metrics.h for
   // possible values of access_point=, reason=.
-  const GURL url("chrome://chrome-signin/?access_point=3&reason=0");
-  base::WeakPtr<InlineLoginHandlerImpl> handler;
+  const GURL url("chrome://chrome-signin/?access_point=3&reason=5");
   // MockSyncStarterInlineSigninHelper will delete itself when done using
   // base::ThreadTaskRunnerHandle::DeleteSoon(), so need to delete here.  But
   // do need the RunUntilIdle() at the end.
   MockSyncStarterInlineSigninHelper* helper =
       new MockSyncStarterInlineSigninHelper(
-          handler, test_shared_loader_factory(), browser()->profile(), url,
-          "foo@gmail.com", "gaiaid-12345", "password",
-          "auth_code",  // auth code
-          std::string(),
-          false,  // confirm untrusted signin
-          false);
+          handler.GetWeakPtr(), test_shared_loader_factory(), profile(), url,
+          "foo@gmail.com", "gaiaid-12345", "password", "auth_code",
+          /*signin_scoped_device_id=*/std::string(),
+          /*confirm_untrusted_signin=*/false,
+          /*is_force_sign_in_with_usermanager=*/false);
 
   // Even though "choose what to sync" is false, the source of the URL is
   // settings, which means the user wants to CONFIGURE_SYNC_FIRST.
-  EXPECT_CALL(*helper, CreateSyncStarter(_, _, "refresh_token"));
+  EXPECT_CALL(*helper, CreateSyncStarter("refresh_token"));
 
   SimulateOnClientOAuthSuccess(helper, "refresh_token");
-  base::RunLoop().RunUntilIdle();
 }
 
 // Test signin helper does not create sync starter when reauthenticating.
@@ -692,71 +691,49 @@
                        ReauthCallsUpdateCredentials) {
   ASSERT_EQ(0ul, identity_manager()->GetAccountsWithRefreshTokens().size());
 
+  InlineLoginHandlerImpl handler;
   // See Source enum in components/signin/core/browser/signin_metrics.h for
   // possible values of access_point=, reason=.
-  GURL url("chrome://chrome-signin/?access_point=3&reason=2");
-  base::WeakPtr<InlineLoginHandlerImpl> handler;
-  InlineSigninHelper helper(handler, test_shared_loader_factory(),
-                            browser()->profile(),
-                            Profile::CreateStatus::CREATE_STATUS_INITIALIZED,
-                            url, "foo@gmail.com", "gaiaid-12345", "password",
-                            "auth_code",  // auth code
-                            std::string(),
-                            false,  // confirm untrusted signin
-                            false);
-  SimulateOnClientOAuthSuccess(&helper, "refresh_token");
+  GURL url("chrome://chrome-signin/?access_point=3&reason=3");
+  // InlineSigninHelper will delete itself when done using
+  // base::ThreadTaskRunnerHandle::DeleteSoon(), so need to delete here.  But
+  // do need the RunUntilIdle() at the end.
+  InlineSigninHelper* helper = new InlineSigninHelper(
+      handler.GetWeakPtr(), test_shared_loader_factory(), profile(),
+      Profile::CreateStatus::CREATE_STATUS_INITIALIZED, url, "foo@gmail.com",
+      "gaiaid-12345", "password", "auth_code",
+      /*signin_scoped_device_id=*/std::string(),
+      /*confirm_untrusted_signin=*/false,
+      /*is_force_sign_in_with_usermanager=*/false);
+  SimulateOnClientOAuthSuccess(helper, "refresh_token");
   ASSERT_EQ(1ul, identity_manager()->GetAccountsWithRefreshTokens().size());
-  base::RunLoop().RunUntilIdle();
-}
-
-// Test signin helper does not create sync starter when adding another account
-// to profile.
-IN_PROC_BROWSER_TEST_F(InlineLoginHelperBrowserTest,
-                       AddAccountsCallsUpdateCredentials) {
-  ASSERT_EQ(0ul, identity_manager()->GetAccountsWithRefreshTokens().size());
-
-  // See Source enum in components/signin/core/browser/signin_metrics.h for
-  // possible values of access_point=, reason=.
-  GURL url("chrome://chrome-signin/?access_point=10&reason=1");
-  base::WeakPtr<InlineLoginHandlerImpl> handler;
-  InlineSigninHelper helper(handler, test_shared_loader_factory(),
-                            browser()->profile(),
-                            Profile::CreateStatus::CREATE_STATUS_INITIALIZED,
-                            url, "foo@gmail.com", "gaiaid-12345", "password",
-                            "auth_code",  // auth code
-                            std::string(),
-                            false,  // confirm untrusted signin
-                            false);
-  SimulateOnClientOAuthSuccess(&helper, "refresh_token");
-  ASSERT_EQ(1ul, identity_manager()->GetAccountsWithRefreshTokens().size());
-  base::RunLoop().RunUntilIdle();
 }
 
 IN_PROC_BROWSER_TEST_F(InlineLoginHelperBrowserTest,
                        ForceSigninWithUserManager) {
-  GURL url("chrome://chrome-signin/?access_point=0&reason=0");
-  base::WeakPtr<InlineLoginHandlerImpl> handler;
+  InlineLoginHandlerImpl handler;
+  GURL url("chrome://chrome-signin/?access_point=0&reason=5");
   // MockSyncStarterInlineSigninHelper will delete itself when done using
   // base::ThreadTaskRunnerHandle::DeleteSoon(), so need to delete here.  But
   // do need the RunUntilIdle() at the end.
   MockSyncStarterInlineSigninHelper* helper =
       new MockSyncStarterInlineSigninHelper(
-          handler, test_shared_loader_factory(), browser()->profile(), url,
+          handler.GetWeakPtr(), test_shared_loader_factory(), profile(), url,
           "foo@gmail.com", "gaiaid-12345", "password", "auth_code",
-          std::string(), false, true);
-  EXPECT_CALL(*helper, CreateSyncStarter(_, _, "refresh_token"));
+          /*signin_scoped_device_id=*/std::string(),
+          /*confirm_untrusted_signin=*/false,
+          /*is_force_sign_in_with_usermanager=*/true);
+  EXPECT_CALL(*helper, CreateSyncStarter("refresh_token"));
 
   ProfileAttributesEntry* entry;
   ASSERT_TRUE(g_browser_process->profile_manager()
                   ->GetProfileAttributesStorage()
-                  .GetProfileAttributesWithPath(browser()->profile()->GetPath(),
-                                                &entry));
+                  .GetProfileAttributesWithPath(profile()->GetPath(), &entry));
   entry->SetIsSigninRequired(true);
 
-  ASSERT_EQ(1ul, BrowserList::GetInstance()->size());
+  ASSERT_EQ(0ul, BrowserList::GetInstance()->size());
   SimulateOnClientOAuthSuccess(helper, "refresh_token");
-  base::RunLoop().RunUntilIdle();
-  ASSERT_EQ(2ul, BrowserList::GetInstance()->size());
+  ASSERT_EQ(1ul, BrowserList::GetInstance()->size());
   ASSERT_FALSE(entry->IsSigninRequired());
 }
 
@@ -820,7 +797,7 @@
 // load it inside the iframe of the login ui.
 IN_PROC_BROWSER_TEST_F(InlineLoginUISafeIframeBrowserTest, NoWebUIInIframe) {
   GURL url = GetSigninPromoURL().Resolve(
-      "?source=0&access_point=0&reason=0&frameUrl=chrome://foo");
+      "?source=0&access_point=0&reason=5&frameUrl=chrome://foo");
   EXPECT_CALL(foo_provider(), NewWebUI(_, _)).Times(0);
   ui_test_utils::NavigateToURL(browser(), url);
 }
diff --git a/chrome/browser/ui/webui/chromeos/smb_shares/smb_credentials_dialog.cc b/chrome/browser/ui/webui/chromeos/smb_shares/smb_credentials_dialog.cc
index 81e89216..d20bb68 100644
--- a/chrome/browser/ui/webui/chromeos/smb_shares/smb_credentials_dialog.cc
+++ b/chrome/browser/ui/webui/chromeos/smb_shares/smb_credentials_dialog.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/ui/webui/chromeos/smb_shares/smb_credentials_dialog.h"
 
 #include "base/json/json_writer.h"
+#include "base/strings/string_number_conversions.h"
 #include "chrome/browser/ui/webui/chromeos/smb_shares/smb_handler.h"
 #include "chrome/common/webui_url_constants.h"
 #include "chrome/grit/browser_resources.h"
@@ -35,18 +36,30 @@
   }
 }
 
+std::string GetDialogId(int32_t mount_id) {
+  return chrome::kChromeUISmbCredentialsURL + base::NumberToString(mount_id);
+}
+
 }  // namespace
 
 // static
 void SmbCredentialsDialog::Show(int32_t mount_id,
                                 const std::string& share_path) {
+  // If an SmbCredentialsDialog is already opened for |mount_id|, focus that
+  // dialog rather than opening a second one.
+  auto* instance = SystemWebDialogDelegate::FindInstance(GetDialogId(mount_id));
+  if (instance) {
+    instance->Focus();
+    return;
+  }
+
   SmbCredentialsDialog* dialog = new SmbCredentialsDialog(mount_id, share_path);
   dialog->ShowSystemDialog();
 }
 
 SmbCredentialsDialog::SmbCredentialsDialog(int32_t mount_id,
                                            const std::string& share_path)
-    : SystemWebDialogDelegate(GURL(chrome::kChromeUISmbCredentialsURL),
+    : SystemWebDialogDelegate(GURL(GetDialogId(mount_id)),
                               base::string16() /* title */),
       mount_id_(mount_id),
       share_path_(share_path) {}
diff --git a/chrome/browser/ui/webui/signin/inline_login_handler_impl.cc b/chrome/browser/ui/webui/signin/inline_login_handler_impl.cc
index 8ad7a26..f039d23 100644
--- a/chrome/browser/ui/webui/signin/inline_login_handler_impl.cc
+++ b/chrome/browser/ui/webui/signin/inline_login_handler_impl.cc
@@ -62,7 +62,6 @@
 #include "components/signin/core/browser/signin_investigator.h"
 #include "components/signin/core/browser/signin_metrics.h"
 #include "components/signin/core/browser/signin_pref_names.h"
-#include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/browser/web_ui.h"
 #include "google_apis/gaia/gaia_auth_fetcher.h"
@@ -75,17 +74,53 @@
 #include "ui/base/l10n/l10n_util.h"
 
 #if defined(OS_WIN)
-
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "chrome/credential_provider/common/gcp_strings.h"
-
 #endif  // defined(OS_WIN)
 
 namespace {
 
-// Specific implementation of DiceTurnSyncOnHelper::Delegate for forced signin
-// flows. Some confirmation prompts are skipped.
+// Subset of signin_metrics::Reason that is supported by the
+// InlineLoginHandlerImpl.
+enum class HandlerSigninReason {
+  FORCED_SIGNIN_PRIMARY_ACCOUNT,
+  UNLOCK,
+  FETCH_LST_ONLY
+};
+
+// Decodes the signin reason from the URL parameter.
+HandlerSigninReason GetHandlerSigninReason(const GURL& url) {
+  signin_metrics::Reason reason =
+      signin::GetSigninReasonForEmbeddedPromoURL(url);
+  switch (reason) {
+    case signin_metrics::Reason::REASON_FORCED_SIGNIN_PRIMARY_ACCOUNT:
+      return HandlerSigninReason::FORCED_SIGNIN_PRIMARY_ACCOUNT;
+    case signin_metrics::Reason::REASON_UNLOCK:
+      return HandlerSigninReason::UNLOCK;
+    case signin_metrics::Reason::REASON_FETCH_LST_ONLY:
+      return HandlerSigninReason::FETCH_LST_ONLY;
+    default:
+      NOTREACHED() << "Unexpected signin reason: " << static_cast<int>(reason);
+      return HandlerSigninReason::FORCED_SIGNIN_PRIMARY_ACCOUNT;
+  }
+}
+
+// Converts from HandlerSigninReason to signin_metrics::Reason.
+signin_metrics::Reason GetSigninReasonFromHandlerSigninReason(
+    HandlerSigninReason r) {
+  switch (r) {
+    case HandlerSigninReason::FORCED_SIGNIN_PRIMARY_ACCOUNT:
+      return signin_metrics::Reason::REASON_FORCED_SIGNIN_PRIMARY_ACCOUNT;
+    case HandlerSigninReason::UNLOCK:
+      return signin_metrics::Reason::REASON_UNLOCK;
+    case HandlerSigninReason::FETCH_LST_ONLY:
+      return signin_metrics::Reason::REASON_FETCH_LST_ONLY;
+  }
+}
+
+// Specific implementation of DiceTurnSyncOnHelper::Delegate for forced
+// signin flows. Some confirmation prompts are skipped.
 class ForcedSigninDiceTurnSyncOnHelperDelegate
     : public DiceTurnSyncOnHelperDelegateImpl {
  public:
@@ -181,21 +216,6 @@
   contents->OpenURL(params);
 }
 
-void RedirectToNtpOrAppsPageIfNecessary(
-    content::WebContents* contents,
-    signin_metrics::AccessPoint access_point) {
-  if (access_point != signin_metrics::AccessPoint::ACCESS_POINT_SETTINGS)
-    RedirectToNtpOrAppsPage(contents, access_point);
-}
-
-void CloseModalSigninIfNeeded(InlineLoginHandlerImpl* handler) {
-  if (handler) {
-    Browser* browser = handler->GetDesktopBrowser();
-    if (browser)
-      browser->signin_view_controller()->CloseModalSignin();
-  }
-}
-
 void SetProfileLocked(const base::FilePath profile_path, bool locked) {
   if (!profile_path.empty()) {
     ProfileManager* profile_manager = g_browser_process->profile_manager();
@@ -215,8 +235,7 @@
 void UnlockProfileAndHideLoginUI(const base::FilePath profile_path,
                                  InlineLoginHandlerImpl* handler) {
   SetProfileLocked(profile_path, false);
-  if (handler)
-    handler->CloseDialogFromJavascript();
+  handler->CloseDialogFromJavascript();
   UserManager::Hide();
 }
 
@@ -226,27 +245,11 @@
                     profiles::USER_MANAGER_SELECT_PROFILE_NO_ACTION);
 }
 
-// Returns true if the showAccountManagement parameter in the given url is set
-// to true.
-bool ShouldShowAccountManagement(const GURL& url, bool is_mirror_enabled) {
-  if (!is_mirror_enabled)
-    return false;
-
-  std::string value;
-  if (net::GetValueForKeyInQuery(url, kSignInPromoQueryKeyShowAccountManagement,
-                                 &value)) {
-    int enabled = 0;
-    if (base::StringToInt(value, &enabled) && enabled == 1)
-      return true;
-  }
-  return false;
-}
-
 // Callback for DiceTurnOnSyncHelper.
 void OnSyncSetupComplete(Profile* profile,
-                         base::WeakPtr<InlineLoginHandlerImpl> handler,
                          const std::string& username,
                          const std::string& password) {
+  DCHECK(signin_util::IsForceSigninEnabled());
   identity::IdentityManager* identity_manager =
       IdentityManagerFactory::GetForProfile(profile);
   bool has_primary_account = identity_manager->HasPrimaryAccount();
@@ -263,9 +266,7 @@
       LocalAuth::SetLocalAuthCredentials(profile, password);
   }
 
-  if (handler) {
-    handler->SyncStarterCallback(has_primary_account);
-  } else if (signin_util::IsForceSigninEnabled() && !has_primary_account) {
+  if (!has_primary_account) {
     BrowserList::CloseAllBrowsersWithProfile(
         profile, base::Bind(&LockProfileAndShowUserManager),
         // Cannot be called because skip_beforeunload is true.
@@ -303,6 +304,7 @@
   DCHECK(profile_);
   DCHECK(!email_.empty());
   DCHECK(!auth_code_.empty());
+  DCHECK(handler);
 
   gaia_auth_fetcher_.StartAuthCodeForOAuth2TokenExchangeWithDeviceId(
       auth_code_, signin_scoped_device_id);
@@ -326,17 +328,12 @@
 
 void InlineSigninHelper::OnClientOAuthSuccessAndBrowserOpened(
     const ClientOAuthResult& result,
-    Profile* profile,
-    Profile::CreateStatus status) {
-  Browser* browser = nullptr;
-  if (handler_)
-    browser = handler_->GetDesktopBrowser();
-
-  signin_metrics::Reason reason =
-      signin::GetSigninReasonForEmbeddedPromoURL(current_url_);
-  if (reason == signin_metrics::Reason::REASON_FETCH_LST_ONLY) {
-// Constants are only available on Windows for the Google Credential
-// Provider for Windows. Other platforms will just close the dialog here.
+    Profile* /*profile*/,
+    Profile::CreateStatus /*status*/) {
+  HandlerSigninReason reason = GetHandlerSigninReason(current_url_);
+  if (reason == HandlerSigninReason::FETCH_LST_ONLY) {
+// Constants are only available on Windows for the Google Credential Provider
+// for Windows.
 #if defined(OS_WIN)
     std::string json_retval;
     base::Value args(base::Value::Type::DICTIONARY);
@@ -350,8 +347,7 @@
 
     handler_->SendLSTFetchResultsMessage(args);
 #else
-    if (handler_)
-      handler_->CloseDialogFromJavascript();
+    NOTREACHED() << "Google Credential Provider is only available on Windows";
 #endif  // defined(OS_WIN)
     base::ThreadTaskRunnerHandle::Get()->DeleteSoon(FROM_HERE, this);
     return;
@@ -372,9 +368,8 @@
 
   std::string primary_email = identity_manager->GetPrimaryAccountInfo().email;
   if (gaia::AreEmailsSame(email_, primary_email) &&
-      (reason == signin_metrics::Reason::REASON_REAUTHENTICATION ||
-       reason == signin_metrics::Reason::REASON_UNLOCK) &&
-      !password_.empty() && profiles::IsLockAvailable(profile_)) {
+      reason == HandlerSigninReason::UNLOCK && !password_.empty() &&
+      profiles::IsLockAvailable(profile_)) {
     LocalAuth::SetLocalAuthCredentials(profile_, password_);
   }
 
@@ -392,9 +387,7 @@
   }
 #endif
 
-  if (reason == signin_metrics::Reason::REASON_REAUTHENTICATION ||
-      reason == signin_metrics::Reason::REASON_UNLOCK ||
-      reason == signin_metrics::Reason::REASON_ADD_SECONDARY_ACCOUNT) {
+  if (reason == HandlerSigninReason::UNLOCK) {
     identity_manager->GetAccountsMutator()->AddOrUpdateAccount(
         gaia_id_, email_, result.refresh_token,
         result.is_under_advanced_protection,
@@ -404,74 +397,60 @@
     if (signin::IsAutoCloseEnabledInEmbeddedURL(current_url_)) {
       // Close the gaia sign in tab via a task to make sure we aren't in the
       // middle of any webui handler code.
-      bool show_account_management = ShouldShowAccountManagement(
-          current_url_,
-          AccountConsistencyModeManager::IsMirrorEnabledForProfile(profile_));
       base::ThreadTaskRunnerHandle::Get()->PostTask(
-          FROM_HERE, base::BindOnce(&InlineLoginHandlerImpl::CloseTab, handler_,
-                                    show_account_management));
+          FROM_HERE,
+          base::BindOnce(&InlineLoginHandlerImpl::CloseTab, handler_));
     }
 
-    if (reason == signin_metrics::Reason::REASON_REAUTHENTICATION ||
-        reason == signin_metrics::Reason::REASON_UNLOCK) {
-      identity_manager->GetPrimaryAccountMutator()
-          ->LegacyMergeSigninCredentialIntoCookieJar();
-    }
-    LogSigninReason(reason);
+    identity_manager->GetPrimaryAccountMutator()
+        ->LegacyMergeSigninCredentialIntoCookieJar();
+    signin_metrics::LogSigninReason(
+        GetSigninReasonFromHandlerSigninReason(reason));
   } else {
     if (confirm_untrusted_signin_) {
       // Display a confirmation dialog to the user.
       base::RecordAction(
           base::UserMetricsAction("Signin_Show_UntrustedSigninPrompt"));
-      if (!browser)
-        browser = chrome::FindLastActiveWithProfile(profile_);
+      Browser* browser = chrome::FindLastActiveWithProfile(profile_);
       browser->window()->ShowOneClickSigninConfirmation(
           base::UTF8ToUTF16(email_),
           base::BindOnce(&InlineSigninHelper::UntrustedSigninConfirmed,
                          base::Unretained(this), result.refresh_token));
       return;
     }
-    CreateSyncStarter(browser, current_url_, result.refresh_token);
-    base::ThreadTaskRunnerHandle::Get()->DeleteSoon(FROM_HERE, this);
+    CreateSyncStarter(result.refresh_token);
   }
+  base::ThreadTaskRunnerHandle::Get()->DeleteSoon(FROM_HERE, this);
 }
 
 void InlineSigninHelper::UntrustedSigninConfirmed(
     const std::string& refresh_token,
     bool confirmed) {
+  DCHECK(signin_util::IsForceSigninEnabled());
   base::ThreadTaskRunnerHandle::Get()->DeleteSoon(FROM_HERE, this);
   if (confirmed) {
-    CreateSyncStarter(nullptr, current_url_, refresh_token);
+    CreateSyncStarter(refresh_token);
     return;
   }
 
   base::RecordAction(base::UserMetricsAction("Signin_Undo_Signin"));
-  if (handler_) {
-    handler_->SyncStarterCallback(false);
-  } else if (signin_util::IsForceSigninEnabled()) {
-    BrowserList::CloseAllBrowsersWithProfile(
-        profile_, base::Bind(&LockProfileAndShowUserManager),
-        // Cannot be called because  skip_beforeunload is true.
-        BrowserList::CloseCallback(),
-        /*skip_beforeunload=*/true);
-  }
+  BrowserList::CloseAllBrowsersWithProfile(
+      profile_, base::Bind(&LockProfileAndShowUserManager),
+      // Cannot be called because  skip_beforeunload is true.
+      BrowserList::CloseCallback(),
+      /*skip_beforeunload=*/true);
 }
 
-void InlineSigninHelper::CreateSyncStarter(Browser* browser,
-                                           const GURL& current_url,
-                                           const std::string& refresh_token) {
+void InlineSigninHelper::CreateSyncStarter(const std::string& refresh_token) {
+  DCHECK(signin_util::IsForceSigninEnabled());
   identity::IdentityManager* identity_manager =
       IdentityManagerFactory::GetForProfile(profile_);
   if (identity_manager->HasPrimaryAccount()) {
     // Already signed in, nothing to do.
-    if (handler_)
-      handler_->SyncStarterCallback(true);
     return;
   }
 
-  if (!browser)
-    browser = chrome::OpenEmptyWindow(profile_);
-
+  Browser* browser = chrome::FindLastActiveWithProfile(profile_);
   std::string account_id =
       identity_manager->GetAccountsMutator()->AddOrUpdateAccount(
           gaia_id_, email_, refresh_token,
@@ -480,18 +459,15 @@
               kInlineLoginHandler_Signin);
 
   std::unique_ptr<DiceTurnSyncOnHelper::Delegate> delegate =
-      signin_util::IsForceSigninEnabled()
-          ? std::make_unique<ForcedSigninDiceTurnSyncOnHelperDelegate>(browser)
-          : std::make_unique<DiceTurnSyncOnHelperDelegateImpl>(browser);
+      std::make_unique<ForcedSigninDiceTurnSyncOnHelperDelegate>(browser);
 
   new DiceTurnSyncOnHelper(
-      profile_, signin::GetAccessPointForEmbeddedPromoURL(current_url),
+      profile_, signin::GetAccessPointForEmbeddedPromoURL(current_url_),
       signin_metrics::PromoAction::PROMO_ACTION_NO_SIGNIN_PROMO,
-      signin::GetSigninReasonForEmbeddedPromoURL(current_url), account_id,
+      signin::GetSigninReasonForEmbeddedPromoURL(current_url_), account_id,
       DiceTurnSyncOnHelper::SigninAbortedMode::REMOVE_ACCOUNT,
       std::move(delegate),
-      base::BindOnce(&OnSyncSetupComplete, profile_, handler_, email_,
-                     password_));
+      base::BindOnce(&OnSyncSetupComplete, profile_, email_, password_));
 }
 
 void InlineSigninHelper::OnClientOAuthFailure(
@@ -499,9 +475,8 @@
   if (handler_)
     handler_->HandleLoginError(error.ToString(), base::string16());
 
-  signin_metrics::Reason reason =
-      signin::GetSigninReasonForEmbeddedPromoURL(current_url_);
-  if (reason != signin_metrics::Reason::REASON_FETCH_LST_ONLY) {
+  HandlerSigninReason reason = GetHandlerSigninReason(current_url_);
+  if (reason != HandlerSigninReason::FETCH_LST_ONLY) {
     AboutSigninInternals* about_signin_internals =
         AboutSigninInternalsFactory::GetForProfile(profile_);
     about_signin_internals->OnRefreshTokenReceived("Failure");
@@ -515,33 +490,6 @@
 
 InlineLoginHandlerImpl::~InlineLoginHandlerImpl() {}
 
-// This method is not called with webview sign in enabled.
-void InlineLoginHandlerImpl::DidFinishNavigation(
-    content::NavigationHandle* navigation_handle) {
-  if (!web_contents() || !navigation_handle->HasCommitted() ||
-      navigation_handle->IsErrorPage()) {
-    return;
-  }
-
-  // Returns early if this is not a gaia webview navigation.
-  content::RenderFrameHost* gaia_frame =
-      signin::GetAuthFrame(web_contents(), "signin-frame");
-  if (navigation_handle->GetRenderFrameHost() != gaia_frame)
-    return;
-
-  // Loading any untrusted (e.g., HTTP) URLs in the privileged sign-in process
-  // will require confirmation before the sign in takes effect.
-  const GURL kGaiaExtOrigin(
-      GaiaUrls::GetInstance()->signin_completed_continue_url().GetOrigin());
-  if (!navigation_handle->GetURL().is_empty()) {
-    GURL origin(navigation_handle->GetURL().GetOrigin());
-    if (navigation_handle->GetURL().spec() != url::kAboutBlankURL &&
-        origin != kGaiaExtOrigin && !gaia::IsGaiaSignonRealm(origin)) {
-      confirm_untrusted_signin_ = true;
-    }
-  }
-}
-
 // static
 void InlineLoginHandlerImpl::SetExtraInitParams(base::DictionaryValue& params) {
   params.SetString("service", "chromiumsync");
@@ -554,8 +502,7 @@
 
   content::WebContents* contents = web_ui()->GetWebContents();
   const GURL& current_url = contents->GetURL();
-  signin_metrics::Reason reason =
-      signin::GetSigninReasonForEmbeddedPromoURL(current_url);
+  HandlerSigninReason reason = GetHandlerSigninReason(current_url);
 
   const GURL& url = GaiaUrls::GetInstance()->embedded_signin_url();
   params.SetBoolean("isNewGaiaFlow", true);
@@ -564,7 +511,7 @@
   params.SetString("gaiaPath", url.path().substr(1));
 
 #if defined(OS_WIN)
-  if (reason == signin_metrics::Reason::REASON_FETCH_LST_ONLY) {
+  if (reason == HandlerSigninReason::FETCH_LST_ONLY) {
     std::string email_domains;
     if (net::GetValueForKeyInQuery(
             current_url, credential_provider::kEmailDomainsSigninPromoParameter,
@@ -596,23 +543,18 @@
 
   std::string flow;
   switch (reason) {
-    case signin_metrics::Reason::REASON_ADD_SECONDARY_ACCOUNT:
-      flow = "addaccount";
-      break;
-    case signin_metrics::Reason::REASON_REAUTHENTICATION:
-    case signin_metrics::Reason::REASON_UNLOCK:
+    case HandlerSigninReason::UNLOCK:
       flow = "reauth";
       break;
-    case signin_metrics::Reason::REASON_FORCED_SIGNIN_PRIMARY_ACCOUNT:
+    case HandlerSigninReason::FORCED_SIGNIN_PRIMARY_ACCOUNT:
       flow = "enterprisefsi";
       break;
-    default:
+    case HandlerSigninReason::FETCH_LST_ONLY:
       flow = "signin";
       break;
   }
   params.SetString("flow", flow);
 
-  content::WebContentsObserver::Observe(contents);
   LogHistogramValue(signin_metrics::HISTOGRAM_SHOWN);
 }
 
@@ -628,7 +570,7 @@
   const GURL& current_url = contents->GetURL();
 
   if (skip_for_now) {
-    SyncStarterCallback(false);
+    SyncSetupFailed();
     return;
   }
 
@@ -648,58 +590,39 @@
   // the current profile is the system profile.  In this case, use the email to
   // find the right profile to reauthenticate.  Otherwise the profile can be
   // taken from web_ui().
-  signin_metrics::Reason reason =
-      signin::GetSigninReasonForEmbeddedPromoURL(current_url);
+  HandlerSigninReason reason = GetHandlerSigninReason(current_url);
 
   Profile* profile = Profile::FromWebUI(web_ui());
-  if (reason != signin_metrics::Reason::REASON_FETCH_LST_ONLY &&
-      IsSystemProfile(profile)) {
-    ProfileManager* manager = g_browser_process->profile_manager();
-    base::FilePath path = profiles::GetPathOfProfileWithEmail(manager, email);
-    if (path.empty()) {
-      path = UserManager::GetSigninProfilePath();
-    }
-    if (!path.empty()) {
-      // If we are only reauthenticating a profile in the user manager (and not
-      // unlocking it), load the profile and finish the login.
-      if (reason == signin_metrics::Reason::REASON_REAUTHENTICATION) {
-        FinishCompleteLoginParams params(
-            this, partition, current_url, base::FilePath(),
-            confirm_untrusted_signin_, email, gaia_id, password, auth_code,
-            choose_what_to_sync, false);
-        ProfileManager::CreateCallback callback =
-            base::Bind(&InlineLoginHandlerImpl::FinishCompleteLogin, params);
-        profiles::LoadProfileAsync(path, callback);
-      } else {
-        // Otherwise, switch to the profile and finish the login. Pass the
-        // profile path so it can be marked as unlocked. Don't pass a handler
-        // pointer since it will be destroyed before the callback runs.
-        bool is_force_signin_enabled = signin_util::IsForceSigninEnabled();
-        InlineLoginHandlerImpl* handler = nullptr;
-        if (is_force_signin_enabled)
-          handler = this;
-        FinishCompleteLoginParams params(
-            handler, partition, current_url, path, confirm_untrusted_signin_,
-            email, gaia_id, password, auth_code, choose_what_to_sync,
-            is_force_signin_enabled);
-        ProfileManager::CreateCallback callback =
-            base::Bind(&InlineLoginHandlerImpl::FinishCompleteLogin, params);
-        if (is_force_signin_enabled) {
-          // Browser window will be opened after ClientOAuthSuccess.
-          profiles::LoadProfileAsync(path, callback);
-        } else {
-          profiles::SwitchToProfile(path, true, callback,
-                                    ProfileMetrics::SWITCH_PROFILE_UNLOCK);
-        }
-      }
-    }
-  } else {
+  if (reason == HandlerSigninReason::FETCH_LST_ONLY ||
+      !IsSystemProfile(profile)) {
     FinishCompleteLogin(FinishCompleteLoginParams(
                             this, partition, current_url, base::FilePath(),
                             confirm_untrusted_signin_, email, gaia_id, password,
                             auth_code, choose_what_to_sync, false),
                         profile, Profile::CREATE_STATUS_CREATED);
+    return;
   }
+
+  DCHECK(reason == HandlerSigninReason::FORCED_SIGNIN_PRIMARY_ACCOUNT ||
+         reason == HandlerSigninReason::UNLOCK);
+  DCHECK(signin_util::IsForceSigninEnabled());
+
+  ProfileManager* manager = g_browser_process->profile_manager();
+  base::FilePath path = profiles::GetPathOfProfileWithEmail(manager, email);
+  if (path.empty())
+    path = UserManager::GetSigninProfilePath();
+  if (path.empty())
+    return;
+
+  // Switch to the profile and finish the login. Pass the profile path so it can
+  // be marked as unlocked.
+  FinishCompleteLoginParams params(
+      this, partition, current_url, path, confirm_untrusted_signin_, email,
+      gaia_id, password, auth_code, choose_what_to_sync, true);
+  ProfileManager::CreateCallback callback =
+      base::BindRepeating(&InlineLoginHandlerImpl::FinishCompleteLogin, params);
+  // Browser window will be opened after ClientOAuthSuccess.
+  profiles::LoadProfileAsync(path, callback);
 }
 
 InlineLoginHandlerImpl::FinishCompleteLoginParams::FinishCompleteLoginParams(
@@ -737,8 +660,8 @@
     const FinishCompleteLoginParams& params,
     Profile* profile,
     Profile::CreateStatus status) {
-  signin_metrics::Reason reason =
-      signin::GetSigninReasonForEmbeddedPromoURL(params.url);
+  DCHECK(params.handler);
+  HandlerSigninReason reason = GetHandlerSigninReason(params.url);
 
   std::string default_email;
   net::GetValueForKeyInQuery(params.url, "email", &default_email);
@@ -746,7 +669,7 @@
   net::GetValueForKeyInQuery(params.url, "validateEmail", &validate_email);
 
 #if defined(OS_WIN)
-  if (reason == signin_metrics::Reason::REASON_FETCH_LST_ONLY) {
+  if (reason == HandlerSigninReason::FETCH_LST_ONLY) {
     std::string validate_gaia_id;
     net::GetValueForKeyInQuery(
         params.url, credential_provider::kValidateGaiaIdSigninPromoParameter,
@@ -758,10 +681,8 @@
     credential_provider::UiExitCodes exit_code = ValidateSigninEmail(
         validate_gaia_id, email_domains, params.email, params.gaia_id);
     if (exit_code != credential_provider::kUiecSuccess) {
-      if (params.handler) {
-        params.handler->HandleLoginError(base::NumberToString((int)exit_code),
-                                         base::UTF8ToUTF16(params.email));
-      }
+      params.handler->HandleLoginError(base::NumberToString((int)exit_code),
+                                       base::UTF8ToUTF16(params.email));
       return;
     } else {
       // Validation has already been done for GCPW, so clear the validate
@@ -773,18 +694,15 @@
   }
 #endif
 
-  // When doing a SAML sign in, this email check may result in a false
-  // positive.  This happens when the user types one email address in the
-  // gaia sign in page, but signs in to a different account in the SAML sign in
-  // page.
+  // When doing a SAML sign in, this email check may result in a false positive.
+  // This happens when the user types one email address in the gaia sign in
+  // page, but signs in to a different account in the SAML sign in page.
   if (validate_email == "1" && !default_email.empty()) {
     if (!gaia::AreEmailsSame(params.email, default_email)) {
-      if (params.handler) {
-        params.handler->HandleLoginError(
-            l10n_util::GetStringFUTF8(IDS_SYNC_WRONG_EMAIL,
-                                      base::UTF8ToUTF16(default_email)),
-            base::UTF8ToUTF16(params.email));
-      }
+      params.handler->HandleLoginError(
+          l10n_util::GetStringFUTF8(IDS_SYNC_WRONG_EMAIL,
+                                    base::UTF8ToUTF16(default_email)),
+          base::UTF8ToUTF16(params.email));
       return;
     }
   }
@@ -800,34 +718,22 @@
                         : signin_metrics::HISTOGRAM_WITH_DEFAULTS);
 
   CanOfferSigninType can_offer_for = CAN_OFFER_SIGNIN_FOR_ALL_ACCOUNTS;
-  switch (reason) {
-    case signin_metrics::Reason::REASON_ADD_SECONDARY_ACCOUNT:
+  if (reason == HandlerSigninReason::UNLOCK) {
+    std::string primary_username =
+        IdentityManagerFactory::GetForProfile(profile)
+            ->GetPrimaryAccountInfo()
+            .email;
+    if (!gaia::AreEmailsSame(default_email, primary_username))
       can_offer_for = CAN_OFFER_SIGNIN_FOR_SECONDARY_ACCOUNT;
-      break;
-    case signin_metrics::Reason::REASON_REAUTHENTICATION:
-    case signin_metrics::Reason::REASON_UNLOCK: {
-      std::string primary_username =
-          IdentityManagerFactory::GetForProfile(profile)
-              ->GetPrimaryAccountInfo()
-              .email;
-      if (!gaia::AreEmailsSame(default_email, primary_username))
-        can_offer_for = CAN_OFFER_SIGNIN_FOR_SECONDARY_ACCOUNT;
-      break;
-    }
-    default:
-      // No need to change |can_offer_for|.
-      break;
   }
 
   std::string error_msg;
-  bool can_offer = reason == signin_metrics::Reason::REASON_FETCH_LST_ONLY ||
+  bool can_offer = reason == HandlerSigninReason::FETCH_LST_ONLY ||
                    CanOfferSignin(profile, can_offer_for, params.gaia_id,
                                   params.email, &error_msg);
   if (!can_offer) {
-    if (params.handler) {
-      params.handler->HandleLoginError(error_msg,
-                                       base::UTF8ToUTF16(params.email));
-    }
+    params.handler->HandleLoginError(error_msg,
+                                     base::UTF8ToUTF16(params.email));
     return;
   }
 
@@ -838,13 +744,10 @@
 
   std::string signin_scoped_device_id =
       GetSigninScopedDeviceIdForProfile(profile);
-  base::WeakPtr<InlineLoginHandlerImpl> handler_weak_ptr;
-  if (params.handler)
-    handler_weak_ptr = params.handler->GetWeakPtr();
 
   // InlineSigninHelper will delete itself.
   new InlineSigninHelper(
-      handler_weak_ptr,
+      params.handler->GetWeakPtr(),
       params.partition->GetURLLoaderFactoryForBrowserProcess(), profile, status,
       params.url, params.email, params.gaia_id, params.password,
       params.auth_code, signin_scoped_device_id,
@@ -853,7 +756,7 @@
 
   // If opened from user manager to unlock a profile, make sure the user manager
   // is closed and that the profile is marked as unlocked.
-  if (reason != signin_metrics::Reason::REASON_FETCH_LST_ONLY &&
+  if (reason != HandlerSigninReason::FETCH_LST_ONLY &&
       !params.is_force_sign_in_with_usermanager) {
     UnlockProfileAndHideLoginUI(params.profile_path, params.handler);
   }
@@ -863,14 +766,12 @@
                                               const base::string16& email) {
   content::WebContents* contents = web_ui()->GetWebContents();
   const GURL& current_url = contents->GetURL();
-  signin_metrics::Reason reason =
-      signin::GetSigninReasonForEmbeddedPromoURL(current_url);
+  HandlerSigninReason reason = GetHandlerSigninReason(current_url);
 
-  if (reason == signin_metrics::Reason::REASON_FETCH_LST_ONLY) {
+  if (reason == HandlerSigninReason::FETCH_LST_ONLY) {
     base::Value error_value(base::Value::Type::DICTIONARY);
 #if defined(OS_WIN)
-    // If the message is an integer error code, send it as part
-    // of the result.
+    // If the message is an integer error code, send it as part of the result.
     int exit_code = 0;
     if (base::StringToInt(error_msg, &exit_code)) {
       error_value.SetKey(credential_provider::kKeyExitCode,
@@ -880,14 +781,13 @@
     SendLSTFetchResultsMessage(error_value);
     return;
   }
-  SyncStarterCallback(false);
+  SyncSetupFailed();
   Browser* browser = GetDesktopBrowser();
   Profile* profile = Profile::FromWebUI(web_ui());
 
   if (IsSystemProfile(profile))
     profile = g_browser_process->profile_manager()->GetProfileByPath(
         UserManager::GetSigninProfilePath());
-  CloseModalSigninIfNeeded(this);
   if (!error_msg.empty()) {
     LoginUIServiceFactory::GetForProfile(profile)->DisplayLoginResult(
         browser, base::UTF8ToUTF16(error_msg), email);
@@ -908,7 +808,7 @@
   return browser;
 }
 
-void InlineLoginHandlerImpl::SyncStarterCallback(bool sync_setup_success) {
+void InlineLoginHandlerImpl::SyncSetupFailed() {
   content::WebContents* contents = web_ui()->GetWebContents();
 
   if (contents->GetController().GetPendingEntry()) {
@@ -921,24 +821,10 @@
   const GURL& current_url = contents->GetLastCommittedURL();
   signin_metrics::AccessPoint access_point =
       signin::GetAccessPointForEmbeddedPromoURL(current_url);
-  bool auto_close = signin::IsAutoCloseEnabledInEmbeddedURL(current_url);
-
-  if (!sync_setup_success) {
-    RedirectToNtpOrAppsPage(contents, access_point);
-  } else if (auto_close) {
-    bool show_account_management = ShouldShowAccountManagement(
-        current_url, AccountConsistencyModeManager::IsMirrorEnabledForProfile(
-                         Profile::FromWebUI(web_ui())));
-    base::ThreadTaskRunnerHandle::Get()->PostTask(
-        FROM_HERE,
-        base::BindOnce(&InlineLoginHandlerImpl::CloseTab,
-                       weak_factory_.GetWeakPtr(), show_account_management));
-  } else {
-    RedirectToNtpOrAppsPageIfNecessary(contents, access_point);
-  }
+  RedirectToNtpOrAppsPage(contents, access_point);
 }
 
-void InlineLoginHandlerImpl::CloseTab(bool show_account_management) {
+void InlineLoginHandlerImpl::CloseTab() {
   content::WebContents* tab = web_ui()->GetWebContents();
   Browser* browser = chrome::FindBrowserWithWebContents(tab);
   if (browser) {
@@ -950,13 +836,5 @@
             index, TabStripModel::CommandCloseTab);
       }
     }
-
-    if (show_account_management) {
-      browser->window()->ShowAvatarBubbleFromAvatarButton(
-          BrowserWindow::AVATAR_BUBBLE_MODE_ACCOUNT_MANAGEMENT,
-          signin::ManageAccountsParams(),
-          signin_metrics::AccessPoint::ACCESS_POINT_AVATAR_BUBBLE_SIGN_IN,
-          false);
-    }
   }
 }
diff --git a/chrome/browser/ui/webui/signin/inline_login_handler_impl.h b/chrome/browser/ui/webui/signin/inline_login_handler_impl.h
index 047a9e3b..2782fc3 100644
--- a/chrome/browser/ui/webui/signin/inline_login_handler_impl.h
+++ b/chrome/browser/ui/webui/signin/inline_login_handler_impl.h
@@ -16,7 +16,6 @@
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/webui/signin/inline_login_handler.h"
 #include "chrome/browser/ui/webui/signin/signin_email_confirmation_dialog.h"
-#include "content/public/browser/web_contents_observer.h"
 #include "google_apis/gaia/gaia_auth_consumer.h"
 #include "google_apis/gaia/gaia_auth_fetcher.h"
 
@@ -33,8 +32,7 @@
 // Implementation for the inline login WebUI handler on desktop Chrome. Once
 // CrOS migrates to the same webview approach as desktop Chrome, much of the
 // code in this class should move to its base class |InlineLoginHandler|.
-class InlineLoginHandlerImpl : public InlineLoginHandler,
-                               public content::WebContentsObserver {
+class InlineLoginHandlerImpl : public InlineLoginHandler {
  public:
   InlineLoginHandlerImpl();
   ~InlineLoginHandlerImpl() override;
@@ -47,10 +45,9 @@
   }
 
   Browser* GetDesktopBrowser();
-  void SyncStarterCallback(bool sync_setup_success);
-  // Closes the current tab and shows the account management view of the avatar
-  // bubble if |show_account_management| is true.
-  void CloseTab(bool show_account_management);
+  void SyncSetupFailed();
+  // Closes the current tab.
+  void CloseTab();
   void HandleLoginError(const std::string& error_msg,
                         const base::string16& email);
 
@@ -124,10 +121,6 @@
                                   Profile* profile,
                                   Profile::CreateStatus status);
 
-  // content::WebContentsObserver implementation:
-  void DidFinishNavigation(
-      content::NavigationHandle* navigation_handle) override;
-
   // True if the user has navigated to untrusted domains during the signin
   // process.
   bool confirm_untrusted_signin_;
@@ -179,9 +172,7 @@
 
   // Creates the sync starter.  Virtual for tests. Call to exchange oauth code
   // for tokens.
-  virtual void CreateSyncStarter(Browser* browser,
-                                 const GURL& current_url,
-                                 const std::string& refresh_token);
+  virtual void CreateSyncStarter(const std::string& refresh_token);
 
   GaiaAuthFetcher gaia_auth_fetcher_;
   base::WeakPtr<InlineLoginHandlerImpl> handler_;
diff --git a/chrome/browser/ui/webui/signin/inline_login_ui.cc b/chrome/browser/ui/webui/signin/inline_login_ui.cc
index bc8c22d..6891b2c 100644
--- a/chrome/browser/ui/webui/signin/inline_login_ui.cc
+++ b/chrome/browser/ui/webui/signin/inline_login_ui.cc
@@ -13,6 +13,7 @@
 #include "chrome/browser/extensions/tab_helper.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/sessions/session_tab_helper.h"
+#include "chrome/browser/signin/signin_promo.h"
 #include "chrome/browser/ui/webui/metrics_handler.h"
 #include "chrome/browser/ui/webui/test_files_request_filter.h"
 #include "chrome/common/chrome_switches.h"
@@ -60,12 +61,49 @@
   return source;
 }
 
+// Returns whether |url| can be displayed in a chrome://chrome-signin tab,
+// depending on the signin reason that is encoded in the url.
+bool IsValidChromeSigninReason(const GURL& url) {
+#if defined(OS_CHROMEOS)
+  return true;
+#else
+  signin_metrics::Reason reason =
+      signin::GetSigninReasonForEmbeddedPromoURL(url);
+
+  switch (reason) {
+    case signin_metrics::Reason::REASON_FORCED_SIGNIN_PRIMARY_ACCOUNT:
+    case signin_metrics::Reason::REASON_UNLOCK:
+      // Used by the user manager.
+      return true;
+    case signin_metrics::Reason::REASON_FETCH_LST_ONLY:
+#if defined(OS_WIN)
+      // Used by the Google Credential Provider for Windows.
+      return true;
+#else
+      return false;
+#endif
+    case signin_metrics::Reason::REASON_SIGNIN_PRIMARY_ACCOUNT:
+    case signin_metrics::Reason::REASON_ADD_SECONDARY_ACCOUNT:
+    case signin_metrics::Reason::REASON_REAUTHENTICATION:
+    case signin_metrics::Reason::REASON_UNKNOWN_REASON:
+      return false;
+    case signin_metrics::Reason::REASON_MAX:
+      NOTREACHED();
+      return false;
+  }
+  NOTREACHED();
+#endif  // defined(OS_CHROMEOS)
+}
+
 }  // namespace
 
 InlineLoginUI::InlineLoginUI(content::WebUI* web_ui)
     : WebDialogUI(web_ui),
       auth_extension_(Profile::FromWebUI(web_ui)),
       weak_factory_(this) {
+  if (!IsValidChromeSigninReason(web_ui->GetWebContents()->GetVisibleURL()))
+    return;
+
   Profile* profile = Profile::FromWebUI(web_ui);
   content::WebUIDataSource::Add(profile, CreateWebUIDataSource());
 
diff --git a/chrome/browser/ui/webui/webui_webview_browsertest.cc b/chrome/browser/ui/webui/webui_webview_browsertest.cc
index d130729..3dadde4 100644
--- a/chrome/browser/ui/webui/webui_webview_browsertest.cc
+++ b/chrome/browser/ui/webui/webui_webview_browsertest.cc
@@ -126,7 +126,7 @@
 #else
     return GURL(signin::GetEmbeddedPromoURL(
         signin_metrics::AccessPoint::ACCESS_POINT_START_PAGE,
-        signin_metrics::Reason::REASON_SIGNIN_PRIMARY_ACCOUNT, false));
+        signin_metrics::Reason::REASON_FORCED_SIGNIN_PRIMARY_ACCOUNT, false));
 #endif
   }
 
diff --git a/chrome/browser/ui/webui/welcome/nux/ntp_background_handler.cc b/chrome/browser/ui/webui/welcome/nux/ntp_background_handler.cc
index ffb45ab..433b9612 100644
--- a/chrome/browser/ui/webui/welcome/nux/ntp_background_handler.cc
+++ b/chrome/browser/ui/webui/welcome/nux/ntp_background_handler.cc
@@ -25,9 +25,9 @@
 enum class NtpBackgrounds {
   kArt = 0,
   kCityscape = 1,
-  kGeometricShapes = 2,
-  kLandscape = 3,
-  kLife = 4,
+  kEarth = 2,
+  kGeometricShapes = 3,
+  kLandscape = 4,
 };
 
 NtpBackgroundHandler::NtpBackgroundHandler() {}
@@ -56,7 +56,17 @@
       GetOnboardingNtpBackgrounds();
 
   auto element = std::make_unique<base::DictionaryValue>();
-  int id = static_cast<int>(NtpBackgrounds::kCityscape);
+  int id = static_cast<int>(NtpBackgrounds::kEarth);
+  element->SetInteger("id", id);
+  element->SetString("title",
+                     l10n_util::GetStringUTF8(
+                         IDS_ONBOARDING_WELCOME_NTP_BACKGROUND_EARTH_TITLE));
+  element->SetString("imageUrl", onboardingNtpBackgrounds[id].spec());
+  element->SetString("thumbnailClass", "earth");
+  list_value.Append(std::move(element));
+
+  element = std::make_unique<base::DictionaryValue>();
+  id = static_cast<int>(NtpBackgrounds::kCityscape);
   element->SetInteger("id", id);
   element->SetString(
       "title", l10n_util::GetStringUTF8(
@@ -96,16 +106,6 @@
   element->SetString("thumbnailClass", "geometric-shapes");
   list_value.Append(std::move(element));
 
-  element = std::make_unique<base::DictionaryValue>();
-  id = static_cast<int>(NtpBackgrounds::kLife);
-  element->SetInteger("id", id);
-  element->SetString("title",
-                     l10n_util::GetStringUTF8(
-                         IDS_ONBOARDING_WELCOME_NTP_BACKGROUND_LIFE_TITLE));
-  element->SetString("imageUrl", onboardingNtpBackgrounds[id].spec());
-  element->SetString("thumbnailClass", "life");
-  list_value.Append(std::move(element));
-
   ResolveJavascriptCallback(*callback_id, list_value);
 }
 
@@ -136,6 +136,14 @@
           GURL("https://500px.com/photo/135751035/"
                "soulseek-by-%E5%B0%A4%E9%87%91%E5%B0%BC-ev-tchebotarev"));
       break;
+    case static_cast<int>(NtpBackgrounds::kEarth):
+      instant_service->SetCustomBackgroundURLWithAttributions(
+          onboardingNtpBackgrounds[backgroundIndex],
+          l10n_util::GetStringFUTF8(
+              IDS_ONBOARDING_WELCOME_NTP_BACKGROUND_PHOTO_BY_LABEL,
+              base::UTF8ToUTF16("NASA Image Library")),
+          "", GURL("https://www.google.com/sky/"));
+      break;
     case static_cast<int>(NtpBackgrounds::kGeometricShapes):
       instant_service->SetCustomBackgroundURLWithAttributions(
           onboardingNtpBackgrounds[backgroundIndex], "Tessellation 15",
@@ -152,16 +160,6 @@
           GURL("https://500px.com/photo/41149196/"
                "le-piscine-sunset-by-giulio-rosso-chioso"));
       break;
-    case static_cast<int>(NtpBackgrounds::kLife):
-      instant_service->SetCustomBackgroundURLWithAttributions(
-          onboardingNtpBackgrounds[backgroundIndex],
-          l10n_util::GetStringFUTF8(
-              IDS_ONBOARDING_WELCOME_NTP_BACKGROUND_PHOTO_BY_LABEL,
-              base::UTF8ToUTF16("Toa Heftiba on Unsplash")),
-          "",
-          GURL("https://unsplash.com/collections/1813652/"
-               "google-pixel-in-bloom-collection"));
-      break;
   }
 }
 
diff --git a/chrome/browser/ui/zoom/zoom_controller_browsertest.cc b/chrome/browser/ui/zoom/zoom_controller_browsertest.cc
index 04ec9ed..eac9522 100644
--- a/chrome/browser/ui/zoom/zoom_controller_browsertest.cc
+++ b/chrome/browser/ui/zoom/zoom_controller_browsertest.cc
@@ -247,7 +247,7 @@
 IN_PROC_BROWSER_TEST_F(ZoomControllerBrowserTest,
                        SettingsZoomAfterSigninWorks) {
   GURL signin_url(std::string(chrome::kChromeUIChromeSigninURL)
-                      .append("?access_point=0&reason=0"));
+                      .append("?access_point=0&reason=5"));
   // We open the signin page in a new tab so that the ZoomController is
   // created against the HostZoomMap of the special StoragePartition that
   // backs the signin page. When we subsequently navigate away from the
diff --git a/chrome/common/pref_names.cc b/chrome/common/pref_names.cc
index ebaea169..8d502c3 100644
--- a/chrome/common/pref_names.cc
+++ b/chrome/common/pref_names.cc
@@ -1695,6 +1695,13 @@
 // domain sub-content requests.
 const char kAllowCrossOriginAuthPrompt[] = "auth.allow_cross_origin_prompt";
 
+#if defined(OS_LINUX) || defined(OS_MACOSX) || defined(OS_CHROMEOS)
+// Boolean that specifies whether OK-AS-DELEGATE flag from KDC is respected. If
+// true kAuthNegotiateDelegateWhitelist value is ignored.
+const char kUseKDCConstrainedDelegation[] =
+    "auth.use_kdc_constrained_delegation";
+#endif  // defined(OS_LINUX) || defined(OS_MACOSX) || defined(OS_CHROMEOS)
+
 #if defined(OS_POSIX)
 // Boolean that specifies whether NTLMv2 is enabled.
 const char kNtlmV2Enabled[] = "auth.ntlm_v2_enabled";
diff --git a/chrome/common/pref_names.h b/chrome/common/pref_names.h
index f5305d3..653706f 100644
--- a/chrome/common/pref_names.h
+++ b/chrome/common/pref_names.h
@@ -684,6 +684,10 @@
 extern const char kAuthAndroidNegotiateAccountType[];
 extern const char kAllowCrossOriginAuthPrompt[];
 
+#if defined(OS_LINUX) || defined(OS_MACOSX) || defined(OS_CHROMEOS)
+extern const char kUseKDCConstrainedDelegation[];
+#endif  // defined(OS_LINUX) || defined(OS_MACOSX) || defined(OS_CHROMEOS)
+
 #if defined(OS_POSIX)
 extern const char kNtlmV2Enabled[];
 #endif  // defined(OS_POSIX)
diff --git a/chrome/test/chromedriver/chrome/status.cc b/chrome/test/chromedriver/chrome/status.cc
index 62a0e27a..67fc02f 100644
--- a/chrome/test/chromedriver/chrome/status.cc
+++ b/chrome/test/chromedriver/chrome/status.cc
@@ -74,6 +74,8 @@
       return "unable to set cookie";
     case kTargetDetached:
       return "target frame detached";
+    case kElementClickIntercepted:
+      return "element click intercepted";
     default:
       return "<unknown>";
   }
diff --git a/chrome/test/chromedriver/chrome/status.h b/chrome/test/chromedriver/chrome/status.h
index 67f4878..44e9a832 100644
--- a/chrome/test/chromedriver/chrome/status.h
+++ b/chrome/test/chromedriver/chrome/status.h
@@ -33,6 +33,7 @@
   kElementNotInteractable = 60,
   kInvalidArgument = 61,
   kNoSuchCookie = 62,
+  kElementClickIntercepted = 64,
   kUnsupportedOperation = 405,
   // Chrome-specific status codes.
   kChromeNotReachable = 100,
diff --git a/chrome/test/chromedriver/element_util.cc b/chrome/test/chromedriver/element_util.cc
index 51ea4616..dc9f885c 100644
--- a/chrome/test/chromedriver/element_util.cc
+++ b/chrome/test/chromedriver/element_util.cc
@@ -120,8 +120,8 @@
   if (!is_clickable) {
     std::string message;
     if (!dict->GetString("message", &message))
-      message = "element is not clickable";
-    return Status(kUnknownError, message);
+      message = "element click intercepted";
+    return Status(kElementClickIntercepted, message);
   }
   return Status(kOk);
 }
diff --git a/chrome/test/chromedriver/server/http_handler.cc b/chrome/test/chromedriver/server/http_handler.cc
index e569da1aa..55f13da 100644
--- a/chrome/test/chromedriver/server/http_handler.cc
+++ b/chrome/test/chromedriver/server/http_handler.cc
@@ -994,6 +994,9 @@
       response.reset(new net::HttpServerResponseInfo(net::HTTP_OK));
       break;
     // error codes
+    case kElementClickIntercepted:
+      response.reset(new net::HttpServerResponseInfo(net::HTTP_BAD_REQUEST));
+      break;
     case kElementNotInteractable:
       response.reset(new net::HttpServerResponseInfo(net::HTTP_BAD_REQUEST));
       break;
diff --git a/chrome/test/chromedriver/window_commands.cc b/chrome/test/chromedriver/window_commands.cc
index da132b1..31f10966 100644
--- a/chrome/test/chromedriver/window_commands.cc
+++ b/chrome/test/chromedriver/window_commands.cc
@@ -174,6 +174,20 @@
   }
 }
 
+int KeyToKeyModifiers(std::string key) {
+  if (key == "Shift") {
+    return kShiftKeyModifierMask;
+  } else if (key == "Control") {
+    return kControlKeyModifierMask;
+  } else if (key == "Alt") {
+    return kAltKeyModifierMask;
+  } else if (key == "Meta") {
+    return kMetaKeyModifierMask;
+  } else {
+    return 0;
+  }
+}
+
 PointerType StringToPointerType(std::string pointer_type) {
   CHECK(pointer_type == "pen" || pointer_type == "mouse");
   if (pointer_type == "pen")
@@ -1386,7 +1400,29 @@
       std::max({longest_mouse_list_size, longest_touch_list_size,
                 longest_key_list_size, tick_durations.size()});
   std::map<std::string, gfx::Point> element_center_point;
+  int key_modifiers = 0;
   for (size_t i = 0; i < max_list_length; i++) {
+    std::list<KeyEvent> dispatch_key_events;
+    for (size_t j = 0; j < key_events_list.size(); j++) {
+      if (i < key_events_list[j].size() &&
+          key_events_list[j][i].type != kPauseEventType) {
+        const KeyEvent& event = key_events_list[j][i];
+        dispatch_key_events.push_back(event);
+        if (event.type == kKeyDownEventType) {
+          session->input_cancel_list.emplace_back(key_input_states[j], nullptr,
+                                                  nullptr, &event);
+          key_modifiers |= KeyToKeyModifiers(event.key);
+        } else if (event.type == kKeyUpEventType) {
+          key_modifiers &= ~KeyToKeyModifiers(event.key);
+        }
+      }
+    }
+    if (dispatch_key_events.size() > 0) {
+      Status status = web_view->DispatchKeyEvents(dispatch_key_events);
+      if (status.IsError())
+        return status;
+    }
+
     std::list<MouseEvent> dispatch_mouse_events;
     for (size_t j = 0; j < mouse_events_list.size(); j++) {
       if (i < mouse_events_list[j].size() &&
@@ -1405,6 +1441,7 @@
           event.x += element_center_point[event.element_id].x();
           event.y += element_center_point[event.element_id].y();
         }
+        event.modifiers = key_modifiers;
         dispatch_mouse_events.push_back(event);
       }
     }
@@ -1442,23 +1479,6 @@
         return status;
     }
 
-    std::list<KeyEvent> dispatch_key_events;
-    for (size_t j = 0; j < key_events_list.size(); j++) {
-      if (i < key_events_list[j].size() &&
-          key_events_list[j][i].type != kPauseEventType) {
-        const KeyEvent& event = key_events_list[j][i];
-        dispatch_key_events.push_back(event);
-        if (event.type == kKeyDownEventType) {
-          session->input_cancel_list.emplace_back(key_input_states[j], nullptr,
-                                                  nullptr, &event);
-        }
-      }
-    }
-    if (dispatch_key_events.size() > 0) {
-      Status status = web_view->DispatchKeyEvents(dispatch_key_events);
-      if (status.IsError())
-        return status;
-    }
     if (i < tick_durations.size() && tick_durations[i] > 0) {
       base::PlatformThread::Sleep(
           base::TimeDelta::FromMilliseconds(tick_durations[i]));
diff --git a/chrome/test/data/policy/policy_test_cases.json b/chrome/test/data/policy/policy_test_cases.json
index a38fcd87..f1cc86a 100644
--- a/chrome/test/data/policy/policy_test_cases.json
+++ b/chrome/test/data/policy/policy_test_cases.json
@@ -930,6 +930,16 @@
     ]
   },
 
+  "UseKDCConstrainedDelegation": {
+    "os": ["linux", "mac", "chromeos"],
+    "test_policy": { "UseKDCConstrainedDelegation": true },
+    "pref_mappings": [
+      { "pref": "auth.use_kdc_constrained_delegation",
+        "local_state": true
+      }
+    ]
+  },
+
   "GSSAPILibraryName": {
     "os": ["linux"],
     "test_policy": { "GSSAPILibraryName": "libwhatever.so" },
diff --git a/chromeos/components/drivefs/drivefs_host.h b/chromeos/components/drivefs/drivefs_host.h
index ab92a88..b6b7ff57 100644
--- a/chromeos/components/drivefs/drivefs_host.h
+++ b/chromeos/components/drivefs/drivefs_host.h
@@ -20,7 +20,6 @@
 #include "chromeos/components/drivefs/mojom/drivefs.mojom.h"
 #include "chromeos/disks/disk_mount_manager.h"
 #include "components/account_id/account_id.h"
-#include "services/identity/public/mojom/identity_manager.mojom.h"
 
 namespace drive {
 class DriveNotificationManager;
diff --git a/chromeos/policy/OWNERS b/chromeos/policy/OWNERS
index 6bc31f0..01fea61 100644
--- a/chromeos/policy/OWNERS
+++ b/chromeos/policy/OWNERS
@@ -5,5 +5,6 @@
 pastarmovj@chromium.org
 pmarko@chromium.org
 poromov@chromium.org
+rsorokin@chromium.org
 
 # COMPONENT: Enterprise
diff --git a/components/autofill_assistant/browser/controller.cc b/components/autofill_assistant/browser/controller.cc
index ba3964d..24f748e 100644
--- a/components/autofill_assistant/browser/controller.cc
+++ b/components/autofill_assistant/browser/controller.cc
@@ -446,6 +446,11 @@
     SetDetails(details);
 }
 
+bool Controller::NeedsUI() const {
+  return state_ != AutofillAssistantState::INACTIVE &&
+         state_ != AutofillAssistantState::STOPPED;
+}
+
 void Controller::Start(const GURL& initialUrl,
                        const std::map<std::string, std::string>& parameters) {
   if (state_ != AutofillAssistantState::INACTIVE) {
@@ -675,8 +680,7 @@
 
 void Controller::OnWebContentsFocused(
     content::RenderWidgetHost* render_widget_host) {
-  if (state_ != AutofillAssistantState::INACTIVE &&
-      state_ != AutofillAssistantState::STOPPED) {
+  if (NeedsUI()) {
     client_->ShowUI();
   }
 }
diff --git a/components/autofill_assistant/browser/controller.h b/components/autofill_assistant/browser/controller.h
index 622d813..7263a09 100644
--- a/components/autofill_assistant/browser/controller.h
+++ b/components/autofill_assistant/browser/controller.h
@@ -48,6 +48,9 @@
   Controller(content::WebContents* web_contents, Client* client);
   ~Controller() override;
 
+  // Returns true if the controller is in a state where UI is necessary.
+  bool NeedsUI() const;
+
   // Called when autofill assistant can start executing scripts.
   void Start(const GURL& initialUrl,
              const std::map<std::string, std::string>& parameters);
diff --git a/components/autofill_assistant/browser/element_area.cc b/components/autofill_assistant/browser/element_area.cc
index 28fec361..dcfc956e 100644
--- a/components/autofill_assistant/browser/element_area.cc
+++ b/components/autofill_assistant/browser/element_area.cc
@@ -39,12 +39,15 @@
   for (const auto& rectangle_proto : proto.rectangles()) {
     rectangles_.emplace_back();
     Rectangle& rectangle = rectangles_.back();
+    rectangle.full_width = rectangle_proto.full_width();
+    DVLOG(3) << "Touchable Rectangle"
+             << (rectangle.full_width ? " (full_width)" : "") << ":";
     for (const auto& element_proto : rectangle_proto.elements()) {
       rectangle.positions.emplace_back();
       ElementPosition& position = rectangle.positions.back();
       position.selector = Selector(element_proto);
+      DVLOG(3) << "  " << position.selector;
     }
-    rectangle.full_width = rectangle_proto.full_width();
   }
   ReportUpdate();
 
diff --git a/components/autofill_assistant/browser/service.cc b/components/autofill_assistant/browser/service.cc
index 7f564fcbb..76a540a 100644
--- a/components/autofill_assistant/browser/service.cc
+++ b/components/autofill_assistant/browser/service.cc
@@ -91,6 +91,7 @@
   url::StringPieceReplacements<std::string> action_replacements;
   action_replacements.SetPathStr(kActionEndpoint);
   script_action_server_url_ = server_url.ReplaceComponents(action_replacements);
+  VLOG(1) << "Using script domain " << script_action_server_url_.host();
 }
 
 Service::~Service() {}
diff --git a/components/autofill_assistant_strings.grdp b/components/autofill_assistant_strings.grdp
index 45c36e3..d16e1a87 100644
--- a/components/autofill_assistant_strings.grdp
+++ b/components/autofill_assistant_strings.grdp
@@ -2,10 +2,10 @@
 <grit-part>
   <if expr="is_android">
     <message name="IDS_AUTOFILL_ASSISTANT_DEFAULT_ERROR" desc="Text label that is shown when autofill assistant cannot help anymore, because something went wrong.">
-      Something went wrong. You can finish your order on the website.
+      Sorry, something went wrong.
     </message>
     <message name="IDS_AUTOFILL_ASSISTANT_GIVE_UP" desc="Text label that is shown when autofill assistant cannot help anymore, because of a user action." formatter_data="android_java">
-      I cannot help anymore, please continue on your own.
+      Looks like you navigated off on your own, I’ll leave you to it. Have a nice day :)
     </message>
     <message name="IDS_AUTOFILL_ASSISTANT_MAYBE_GIVE_UP" desc="Text label shown next to an UNDO button when user action indicate they want to continue on their own.">
       Continue manually?
diff --git a/components/certificate_transparency/data/log_list.json b/components/certificate_transparency/data/log_list.json
index 17e4b37..5d03b19 100644
--- a/components/certificate_transparency/data/log_list.json
+++ b/components/certificate_transparency/data/log_list.json
@@ -264,6 +264,7 @@
    "operated_by": [
     2
    ],
+   "disqualified_at": 1550275200,
    "dns_api_endpoint": "symantec.ct.googleapis.com"
   },
   {
@@ -274,6 +275,7 @@
    "operated_by": [
     2
    ],
+   "disqualified_at": 1550275200,
    "dns_api_endpoint": "symantec-vega.ct.googleapis.com"
   },
   {
@@ -284,6 +286,7 @@
    "operated_by": [
     2
    ],
+   "disqualified_at": 1550275200,
    "dns_api_endpoint": "symantec-sirius.ct.googleapis.com"
   },
   {
diff --git a/components/metrics/file_metrics_provider.cc b/components/metrics/file_metrics_provider.cc
index 3c497449..49efa12b 100644
--- a/components/metrics/file_metrics_provider.cc
+++ b/components/metrics/file_metrics_provider.cc
@@ -36,9 +36,6 @@
 
 namespace {
 
-const base::Feature kBackgroundIndependentMetrics = {
-    "BackgoundIndependentMetrics", base::FEATURE_ENABLED_BY_DEFAULT};
-
 // These structures provide values used to define how files are opened and
 // accessed. It obviates the need for multiple code-paths within several of
 // the methods.
@@ -779,23 +776,15 @@
   SourceInfo* source_ptr = source.get();
   DCHECK(source->allocator);
 
-  if (base::FeatureList::IsEnabled(kBackgroundIndependentMetrics)) {
-    // Do the actual work as a background task.
-    base::PostTaskAndReplyWithResult(
-        task_runner_.get(), FROM_HERE,
-        base::BindOnce(
-            &FileMetricsProvider::ProvideIndependentMetricsOnTaskRunner,
-            source_ptr, system_profile_proto, snapshot_manager),
-        base::BindOnce(&FileMetricsProvider::ProvideIndependentMetricsCleanup,
-                       weak_factory_.GetWeakPtr(), std::move(done_callback),
-                       std::move(source)));
-  } else {
-    // Do the actual work now, inline (for performance comparisons).
-    bool success = ProvideIndependentMetricsOnTaskRunner(
-        source_ptr, system_profile_proto, snapshot_manager);
-    ProvideIndependentMetricsCleanup(std::move(done_callback),
-                                     std::move(source), success);
-  }
+  // Do the actual work as a background task.
+  base::PostTaskAndReplyWithResult(
+      task_runner_.get(), FROM_HERE,
+      base::BindOnce(
+          &FileMetricsProvider::ProvideIndependentMetricsOnTaskRunner,
+          source_ptr, system_profile_proto, snapshot_manager),
+      base::BindOnce(&FileMetricsProvider::ProvideIndependentMetricsCleanup,
+                     weak_factory_.GetWeakPtr(), std::move(done_callback),
+                     std::move(source)));
 }
 
 void FileMetricsProvider::ProvideIndependentMetricsCleanup(
diff --git a/components/payments/content/BUILD.gn b/components/payments/content/BUILD.gn
index 0ac8683..0c55166 100644
--- a/components/payments/content/BUILD.gn
+++ b/components/payments/content/BUILD.gn
@@ -9,6 +9,8 @@
     "can_make_payment_query_factory.cc",
     "can_make_payment_query_factory.h",
     "content_payment_request_delegate.h",
+    "initialization_task.cc",
+    "initialization_task.h",
     "payment_request.cc",
     "payment_request.h",
     "payment_request_converter.cc",
diff --git a/components/payments/content/initialization_task.cc b/components/payments/content/initialization_task.cc
new file mode 100644
index 0000000..900cc00
--- /dev/null
+++ b/components/payments/content/initialization_task.cc
@@ -0,0 +1,31 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/payments/content/initialization_task.h"
+
+namespace payments {
+
+InitializationTask::Observer::~Observer() = default;
+
+InitializationTask::InitializationTask() = default;
+
+InitializationTask::~InitializationTask() = default;
+
+void InitializationTask::AddInitializationObserver(Observer* observer) {
+  observers_.AddObserver(observer);
+}
+
+void InitializationTask::RemoveInitializationObserver(Observer* observer) {
+  observers_.RemoveObserver(observer);
+}
+
+void InitializationTask::NotifyInitialized() {
+  DCHECK(!has_notified_);
+  has_notified_ = true;
+  for (Observer& observer : observers_) {
+    observer.OnInitialized(this);
+  }
+}
+
+}  // namespace payments
diff --git a/components/payments/content/initialization_task.h b/components/payments/content/initialization_task.h
new file mode 100644
index 0000000..16c094c
--- /dev/null
+++ b/components/payments/content/initialization_task.h
@@ -0,0 +1,105 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_PAYMENTS_CONTENT_INITIALIZATION_TASK_H_
+#define COMPONENTS_PAYMENTS_CONTENT_INITIALIZATION_TASK_H_
+
+#include "base/macros.h"
+#include "base/observer_list.h"
+#include "base/observer_list_types.h"
+
+namespace payments {
+
+// An interface for a task that takes time to initialize. Useful for monitoring
+// initialization of several asynchronous tasks.
+//
+// Sample usage:
+//
+//   class Foo : public InitializationTask {
+//    public:
+//     Foo() {}
+//
+//     ~Foo() override {}
+//
+//     // InitializationTask:
+//     bool IsInitialized() override {
+//       return is_initialized_;
+//     }
+//
+//     void SomeAction() {
+//       is_initialized_ = true;
+//       NotifyInitialized();
+//     }
+//
+//    private:
+//     bool is_initialized_ = false;
+//   };
+class InitializationTask {
+ public:
+  // An interface for an observer of an initialization task.
+  //
+  // Sample usage:
+  //
+  //   class Bar : public InitializationTask::Observer {
+  //    public:
+  //     explicit Bar(Foo* foo) : foo_(foo) {
+  //       if (foo_->IsInitialized()) {
+  //         UseFoo();
+  //       } else {
+  //         foo_->AddInitializationObserver(this);
+  //       }
+  //     }
+  //
+  //     ~Bar() override {}
+  //
+  //     // InitializationTask::Observer:
+  //     void OnInitialized(InitializationTask* initialization_task) override {
+  //       initialization_task->RemoveInitializationObserver(this);
+  //       UseFoo();
+  //     }
+  //
+  //     void UseFoo() {
+  //       foo_->DoSomethingInteresting();
+  //     }
+  //
+  //     private:
+  //       // Not owned. Must outlive Bar.
+  //       Foo* foo_;
+  //   };
+  class Observer : public base::CheckedObserver {
+   public:
+    ~Observer() override;
+
+    // Called when the observed task has initialized.
+    virtual void OnInitialized(InitializationTask* initialization_task) = 0;
+  };
+
+  InitializationTask();
+  virtual ~InitializationTask();
+
+  // Add the |observer| to be notified of initialization.
+  void AddInitializationObserver(Observer* observer);
+
+  // Remove the |observer| of initialization.
+  void RemoveInitializationObserver(Observer* observer);
+
+  // Notify all observers of initialization. Should be called at most once.
+  void NotifyInitialized();
+
+  // Whether the task has initialized.
+  virtual bool IsInitialized() const = 0;
+
+ private:
+  // The list of observers for this initialization task.
+  base::ObserverList<Observer> observers_;
+
+  // Whether NotifyInitialized() has been called.
+  bool has_notified_ = false;
+
+  DISALLOW_COPY_AND_ASSIGN(InitializationTask);
+};
+
+}  // namespace payments
+
+#endif  // COMPONENTS_PAYMENTS_CONTENT_INITIALIZATION_TASK_H_
diff --git a/components/payments/content/payment_request_state.cc b/components/payments/content/payment_request_state.cc
index c037288..c86818e9 100644
--- a/components/payments/content/payment_request_state.cc
+++ b/components/payments/content/payment_request_state.cc
@@ -453,6 +453,10 @@
   return payment_request_delegate_->GetAddressNormalizer();
 }
 
+bool PaymentRequestState::IsInitialized() const {
+  return get_all_instruments_finished_;
+}
+
 void PaymentRequestState::PopulateProfileCache() {
   std::vector<autofill::AutofillProfile*> profiles =
       personal_data_manager_->GetProfilesToSuggest();
@@ -556,6 +560,7 @@
 void PaymentRequestState::NotifyOnGetAllPaymentInstrumentsFinished() {
   for (auto& observer : observers_)
     observer.OnGetAllPaymentInstrumentsFinished();
+  NotifyInitialized();
 }
 
 void PaymentRequestState::NotifyOnSelectedInformationChanged() {
diff --git a/components/payments/content/payment_request_state.h b/components/payments/content/payment_request_state.h
index f149273..cc9dadfb 100644
--- a/components/payments/content/payment_request_state.h
+++ b/components/payments/content/payment_request_state.h
@@ -12,6 +12,7 @@
 #include "base/macros.h"
 #include "base/observer_list.h"
 #include "components/autofill/core/browser/address_normalizer.h"
+#include "components/payments/content/initialization_task.h"
 #include "components/payments/content/payment_request_spec.h"
 #include "components/payments/content/payment_response_helper.h"
 #include "components/payments/content/service_worker_payment_app_factory.h"
@@ -39,7 +40,8 @@
 // what the merchant has specified, as input into the "is ready to pay"
 // computation.
 class PaymentRequestState : public PaymentResponseHelper::Delegate,
-                            public PaymentRequestSpec::Observer {
+                            public PaymentRequestSpec::Observer,
+                            public InitializationTask {
  public:
   // Any class call add itself as Observer via AddObserver() and receive
   // notification about the state changing.
@@ -219,6 +221,9 @@
 
   autofill::AddressNormalizer* GetAddressNormalizer();
 
+  // InitializationTask:
+  bool IsInitialized() const override;
+
  private:
   // Fetches the Autofill Profiles for this user from the PersonalDataManager,
   // and stores copies of them, owned by this PaymentRequestState, in
diff --git a/components/policy/OWNERS b/components/policy/OWNERS
index 809c732..6a7add43 100644
--- a/components/policy/OWNERS
+++ b/components/policy/OWNERS
@@ -5,5 +5,6 @@
 pastarmovj@chromium.org
 pmarko@chromium.org
 poromov@chromium.org
+rsorokin@chromium.org
 
 # COMPONENT: Enterprise
diff --git a/components/policy/resources/OWNERS b/components/policy/resources/OWNERS
index 509d6d3..81f119d 100644
--- a/components/policy/resources/OWNERS
+++ b/components/policy/resources/OWNERS
@@ -13,5 +13,6 @@
 per-file policy_templates.json=pastarmovj@chromium.org
 per-file policy_templates.json=pmarko@chromium.org
 per-file policy_templates.json=poromov@chromium.org
+per-file policy_templates.json=rsorokin@chromium.org
 
 # COMPONENT: Enterprise
diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index 6b26cf0..7723b9b6 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json
@@ -396,6 +396,7 @@
         'EnableAuthNegotiatePort',
         'AuthServerWhitelist',
         'AuthNegotiateDelegateWhitelist',
+        'UseKDCConstrainedDelegation',
         'GSSAPILibraryName',
         'AuthAndroidNegotiateAccountType',
         'AllowCrossOriginAuthPrompt',
@@ -3277,7 +3278,28 @@
 
           Separate multiple server names with commas. Wildcards (*) are allowed.
 
-          If you leave this policy not set <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will not delegate user credentials even if a server is detected as Intranet.''',
+          If you leave this policy not set <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> will not delegate user credentials even if a server is detected as Intranet.
+
+          This policy is ignored if the 'UseKDCConstrainedDelegation' policy is true.''',
+    },
+    {
+      'name': 'UseKDCConstrainedDelegation',
+      'type': 'main',
+      'schema': { 'type': 'boolean' },
+      'supported_on': ['chrome.linux:74-','chrome.mac:74-','chrome_os:74-'],
+      'features': {
+        'dynamic_refresh': True,
+        'per_profile': False,
+      },
+      'example_value': True,
+      'id': 528,
+      'caption': '''Use KDC constrained delegation''',
+      'tags': ['website-sharing'],
+      'desc': '''Controls whether OK-AS-DELEGATE flag from KDC is respected or whether 'AuthNegotiateDelegateWhitelist' is used to constrain delegation of Kerberos tickets.
+
+          If this policy is true, HTTP authentication respects constrained delegation settings on the KDC. 'AuthNegotiateDelegateWhitelist' policy is ignored in that case. Please see https://tools.ietf.org/html/rfc5896.html for more information.
+
+          If this policy is not set or set to false, constrained delegation settings from KDC are ignored and 'AuthNegotiateDelegateWhitelist' policy is respected.''',
     },
     {
       'name': 'GSSAPILibraryName',
@@ -14962,5 +14984,5 @@
   },
   'placeholders': [],
   'deleted_policy_ids': [412],
-  'highest_id_currently_used':  527
+  'highest_id_currently_used':  528
 }
diff --git a/components/search_provider_logos/logo_service_impl_unittest.cc b/components/search_provider_logos/logo_service_impl_unittest.cc
index 66d559a9..cef9272f 100644
--- a/components/search_provider_logos/logo_service_impl_unittest.cc
+++ b/components/search_provider_logos/logo_service_impl_unittest.cc
@@ -72,12 +72,6 @@
 using MockLogoCallback = base::MockCallback<LogoCallback>;
 using MockEncodedLogoCallback = base::MockCallback<EncodedLogoCallback>;
 
-#if defined(OS_CHROMEOS)
-using SigninManagerForTest = FakeSigninManagerBase;
-#else
-using SigninManagerForTest = FakeSigninManager;
-#endif  // OS_CHROMEOS
-
 scoped_refptr<base::RefCountedString> EncodeBitmapAsPNG(
     const SkBitmap& bitmap) {
   scoped_refptr<base::RefCountedMemory> png_bytes =
diff --git a/components/signin/core/browser/account_reconcilor.h b/components/signin/core/browser/account_reconcilor.h
index 14911ca..4229397 100644
--- a/components/signin/core/browser/account_reconcilor.h
+++ b/components/signin/core/browser/account_reconcilor.h
@@ -135,7 +135,7 @@
   friend class AccountReconcilorTest;
   friend class DiceBrowserTestBase;
   FRIEND_TEST_ALL_PREFIXES(AccountReconcilorMirrorEndpointParamTest,
-                           SigninManagerRegistration);
+                           IdentityManagerRegistration);
   FRIEND_TEST_ALL_PREFIXES(AccountReconcilorMirrorEndpointParamTest, Reauth);
   FRIEND_TEST_ALL_PREFIXES(AccountReconcilorMirrorEndpointParamTest,
                            ProfileAlreadyConnected);
diff --git a/components/signin/core/browser/account_reconcilor_unittest.cc b/components/signin/core/browser/account_reconcilor_unittest.cc
index 2140932..424e2ac 100644
--- a/components/signin/core/browser/account_reconcilor_unittest.cc
+++ b/components/signin/core/browser/account_reconcilor_unittest.cc
@@ -47,12 +47,6 @@
 
 namespace {
 
-#if defined(OS_CHROMEOS)
-using FakeSigninManagerForTesting = FakeSigninManagerBase;
-#else
-using FakeSigninManagerForTesting = FakeSigninManager;
-#endif
-
 // An AccountReconcilorDelegate that records all calls (Spy pattern).
 class SpyReconcilorDelegate : public signin::AccountReconcilorDelegate {
  public:
@@ -609,11 +603,7 @@
 
 #if !defined(OS_CHROMEOS)
 
-// This method requires the use of the |TestSigninClient| to be created from the
-// |ChromeSigninClientFactory| because it overrides the |GoogleSigninSucceeded|
-// method with an empty implementation. On MacOS, the normal implementation
-// causes the try_bots to time out.
-TEST_P(AccountReconcilorMirrorEndpointParamTest, SigninManagerRegistration) {
+TEST_P(AccountReconcilorMirrorEndpointParamTest, IdentityManagerRegistration) {
   AccountReconcilor* reconcilor = GetMockReconcilor();
   ASSERT_TRUE(reconcilor);
   ASSERT_FALSE(reconcilor->IsRegisteredWithIdentityManager());
@@ -627,10 +617,6 @@
   ASSERT_FALSE(reconcilor->IsRegisteredWithIdentityManager());
 }
 
-// This method requires the use of the |TestSigninClient| to be created from the
-// |ChromeSigninClientFactory| because it overrides the |GoogleSigninSucceeded|
-// method with an empty implementation. On MacOS, the normal implementation
-// causes the try_bots to time out.
 TEST_P(AccountReconcilorMirrorEndpointParamTest, Reauth) {
   const std::string email = "user@gmail.com";
   AccountInfo account_info = ConnectProfileToAccount(email);
@@ -698,7 +684,8 @@
     // The syntax is:
     // - Tokens:
     //   A, B, C: Accounts for which we have a token in Chrome.
-    //   *: The next account is the main Chrome account (i.e. in SigninManager).
+    //   *: The next account is the main Chrome account (i.e. in
+    //   IdentityManager).
     //   x: The next account has a token error.
     // - API calls:
     //   U: Multilogin with mode UPDATE
@@ -1102,7 +1089,7 @@
   ASSERT_TRUE(reconcilor->IsRegisteredWithIdentityManager());
 
   // Reconcilor should not logout all accounts from the cookies when
-  // SigninManager signs out.
+  // the primary account is cleared in IdentityManager.
   EXPECT_CALL(*GetMockReconcilor(), PerformLogoutAllAccountsAction()).Times(0);
   EXPECT_CALL(*GetMockReconcilor(), PerformSetCookiesAction(::testing::_))
       .Times(0);
@@ -1635,7 +1622,8 @@
     // The syntax is:
     // - Tokens:
     //   A, B, C: Accounts for which we have a token in Chrome.
-    //   *: The next account is the main Chrome account (i.e. in SigninManager).
+    //   *: The next account is the main Chrome account (i.e. in
+    //   IdentityManager).
     //   x: The next account has a token error.
     // - Cookies:
     //   A, B, C: Accounts in the Gaia cookie (returned by ListAccounts).
@@ -2201,8 +2189,8 @@
 }
 
 #if !defined(OS_CHROMEOS)
-// This test does not run on ChromeOS because it calls
-// FakeSigninManagerForTesting::SignOut() which doesn't exist for ChromeOS.
+// This test does not run on ChromeOS because it clears the primary account,
+// which is not a flow that exists on ChromeOS.
 
 TEST_P(AccountReconcilorMirrorEndpointParamTest,
        SignoutAfterErrorDoesNotRecordUma) {
diff --git a/content/browser/media/session/media_session_impl.cc b/content/browser/media/session/media_session_impl.cc
index 123dab9..3f8cff547 100644
--- a/content/browser/media/session/media_session_impl.cc
+++ b/content/browser/media/session/media_session_impl.cc
@@ -674,8 +674,10 @@
   session_android_.reset(new MediaSessionAndroid(this));
 #endif  // defined(OS_ANDROID)
 
-  if (web_contents->GetMainFrame() && web_contents->GetMainFrame()->GetView())
+  if (web_contents && web_contents->GetMainFrame() &&
+      web_contents->GetMainFrame()->GetView()) {
     focused_ = web_contents->GetMainFrame()->GetView()->HasFocus();
+  }
 
   RebuildAndNotifyMetadataChanged();
 }
diff --git a/content/child/runtime_features.cc b/content/child/runtime_features.cc
index c3ef8dc..140d2812 100644
--- a/content/child/runtime_features.cc
+++ b/content/child/runtime_features.cc
@@ -382,6 +382,10 @@
   if (base::FeatureList::IsEnabled(features::kLazyImageVisibleLoadTimeMetrics))
     WebRuntimeFeatures::EnableLazyImageVisibleLoadTimeMetrics(true);
 
+  WebRuntimeFeatures::EnableRestrictDeviceSensorEventsToSecureContexts(
+      base::FeatureList::IsEnabled(
+          blink::features::kRestrictDeviceSensorEventsToSecureContexts));
+
   WebRuntimeFeatures::EnableRestrictLazyFrameLoadingToDataSaver(
       base::GetFieldTrialParamByFeatureAsBool(
           features::kLazyFrameLoading,
diff --git a/content/common/content_security_policy/content_security_policy_unittest.cc b/content/common/content_security_policy/content_security_policy_unittest.cc
index b681be8..909de5c3 100644
--- a/content/common/content_security_policy/content_security_policy_unittest.cc
+++ b/content/common/content_security_policy/content_security_policy_unittest.cc
@@ -167,7 +167,7 @@
       policy, CSPDirective::FrameSrc, GURL("https://not-example.com/"), false,
       false, &context, SourceLocation(), false));
 
-  // Register 'https' as bypassing CSP, which should now bypass is entirely.
+  // Register 'https' as bypassing CSP, which should now bypass it entirely.
   context.AddSchemeToBypassCSP("https");
 
   EXPECT_TRUE(ContentSecurityPolicy::Allow(
@@ -178,6 +178,24 @@
       false, &context, SourceLocation(), false));
 }
 
+TEST(ContentSecurityPolicy, RequestsAllowedWhenHostMixedCase) {
+  CSPContextTest context;
+  std::vector<std::string> report_end_points;  // empty
+  CSPSource source("https", "ExAmPle.com", false, url::PORT_UNSPECIFIED, false,
+                   "");
+  CSPSourceList source_list(false, false, false, {source});
+  ContentSecurityPolicy policy(
+      EmptyCspHeader(), {CSPDirective(CSPDirective::DefaultSrc, source_list)},
+      report_end_points, false);
+
+  EXPECT_TRUE(ContentSecurityPolicy::Allow(
+      policy, CSPDirective::FrameSrc, GURL("https://example.com/"), false,
+      false, &context, SourceLocation(), false));
+  EXPECT_FALSE(ContentSecurityPolicy::Allow(
+      policy, CSPDirective::FrameSrc, GURL("https://not-example.com/"), false,
+      false, &context, SourceLocation(), false));
+}
+
 TEST(ContentSecurityPolicy, FilesystemAllowedWhenBypassingCSP) {
   CSPContextTest context;
   std::vector<std::string> report_end_points;  // empty
@@ -197,7 +215,7 @@
       GURL("filesystem:https://not-example.com/file.txt"), false, false,
       &context, SourceLocation(), false));
 
-  // Register 'https' as bypassing CSP, which should now bypass is entirely.
+  // Register 'https' as bypassing CSP, which should now bypass it entirely.
   context.AddSchemeToBypassCSP("https");
 
   EXPECT_TRUE(ContentSecurityPolicy::Allow(
@@ -227,7 +245,7 @@
       policy, CSPDirective::FrameSrc, GURL("blob:https://not-example.com/"),
       false, false, &context, SourceLocation(), false));
 
-  // Register 'https' as bypassing CSP, which should now bypass is entirely.
+  // Register 'https' as bypassing CSP, which should now bypass it entirely.
   context.AddSchemeToBypassCSP("https");
 
   EXPECT_TRUE(ContentSecurityPolicy::Allow(
diff --git a/content/common/content_security_policy/csp_source.cc b/content/common/content_security_policy/csp_source.cc
index 2c8d142..f941a24d 100644
--- a/content/common/content_security_policy/csp_source.cc
+++ b/content/common/content_security_policy/csp_source.cc
@@ -4,6 +4,8 @@
 
 #include <sstream>
 
+#include "content/common/content_security_policy/csp_source.h"
+
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/common/content_security_policy/csp_context.h"
@@ -65,13 +67,14 @@
     if (source.host.empty())
       return true;
     // TODO(arthursonzogni): Chrome used to, incorrectly, match *.x.y to x.y.
-    // The renderer version of this function count how many times it happens.
+    // The renderer version of this function counts how many times it happens.
     // It might be useful to do it outside of blink too.
-    // See third_party/WebKit/Source/core/frame/csp/CSPSource.cpp
+    // See third_party/blink/renderer/core/frame/csp/csp_source.cc
     return base::EndsWith(url.host(), '.' + source.host,
                           base::CompareCase::INSENSITIVE_ASCII);
-  } else
-    return url.host() == source.host;
+  } else {
+    return base::EqualsCaseInsensitiveASCII(url.host(), source.host);
+  }
 }
 
 PortMatchingResult SourceAllowPort(const CSPSource& source, const GURL& url) {
diff --git a/content/public/android/java/src/org/chromium/content/browser/UiConstants.java b/content/public/android/java/src/org/chromium/content/browser/UiConstants.java
index 5234dcc..d405151 100644
--- a/content/public/android/java/src/org/chromium/content/browser/UiConstants.java
+++ b/content/public/android/java/src/org/chromium/content/browser/UiConstants.java
@@ -4,7 +4,6 @@
 
 package org.chromium.content.browser;
 
-import org.chromium.base.Log;
 import org.chromium.base.ThreadUtils;
 import org.chromium.base.annotations.CalledByNative;
 
@@ -12,7 +11,6 @@
  * Platform-provided UI constants.
  */
 public class UiConstants {
-    private static final String TAG = "UiConstants";
     private static final String UI_CONSTANTS_INTERNAL =
             "org.chromium.content.browser.UiConstantsInternal";
     private static UiConstants sInstance;
@@ -24,7 +22,6 @@
             sInstance = (UiConstants) Class.forName(UI_CONSTANTS_INTERNAL).newInstance();
         } catch (ClassNotFoundException | InstantiationException | IllegalAccessException
                 | IllegalArgumentException e) {
-            Log.w(TAG, "Could not summon UiConstantsInternal", e);
             sInstance = new UiConstants();
         }
         return sInstance;
diff --git a/content/renderer/media/stream/media_stream_renderer_factory_impl.cc b/content/renderer/media/stream/media_stream_renderer_factory_impl.cc
index 12c8e367..b934384 100644
--- a/content/renderer/media/stream/media_stream_renderer_factory_impl.cc
+++ b/content/renderer/media/stream/media_stream_renderer_factory_impl.cc
@@ -64,7 +64,7 @@
 
   blink::WebVector<blink::WebMediaStreamTrack> video_tracks =
       web_stream.VideoTracks();
-  if (video_tracks.IsEmpty() ||
+  if (video_tracks.empty() ||
       !MediaStreamVideoTrack::GetTrack(video_tracks[0])) {
     return nullptr;
   }
@@ -82,7 +82,7 @@
   DCHECK(!web_stream.IsNull());
   blink::WebVector<blink::WebMediaStreamTrack> audio_tracks =
       web_stream.AudioTracks();
-  if (audio_tracks.IsEmpty()) {
+  if (audio_tracks.empty()) {
     WebRtcLogMessage("No audio tracks in media stream (return null).");
     return nullptr;
   }
diff --git a/content/renderer/media/stream/user_media_processor.cc b/content/renderer/media/stream/user_media_processor.cc
index 7b848aa9..5e1cad7 100644
--- a/content/renderer/media/stream/user_media_processor.cc
+++ b/content/renderer/media/stream/user_media_processor.cc
@@ -82,7 +82,7 @@
   *stream_type = blink::MEDIA_NO_SERVICE;
 
   std::string source_constraint =
-      constraints.Basic().media_stream_source.Exact().IsEmpty()
+      constraints.Basic().media_stream_source.Exact().empty()
           ? std::string()
           : constraints.Basic().media_stream_source.Exact()[0].Utf8();
   if (!source_constraint.empty()) {
@@ -117,7 +117,7 @@
   *stream_type = blink::MEDIA_NO_SERVICE;
 
   std::string source_constraint =
-      constraints.Basic().media_stream_source.Exact().IsEmpty()
+      constraints.Basic().media_stream_source.Exact().empty()
           ? std::string()
           : constraints.Basic().media_stream_source.Exact()[0].Utf8();
   if (!source_constraint.empty()) {
diff --git a/content/renderer/media/stream/webmediaplayer_ms.cc b/content/renderer/media/stream/webmediaplayer_ms.cc
index b62fb01f..aa9c5b2 100644
--- a/content/renderer/media/stream/webmediaplayer_ms.cc
+++ b/content/renderer/media/stream/webmediaplayer_ms.cc
@@ -484,7 +484,7 @@
       web_stream_.VideoTracks();
 
   RendererReloadAction renderer_action = RendererReloadAction::KEEP_RENDERER;
-  if (video_tracks.IsEmpty()) {
+  if (video_tracks.empty()) {
     if (video_frame_provider_)
       renderer_action = RendererReloadAction::REMOVE_RENDERER;
     current_video_track_id_ = blink::WebString();
@@ -535,7 +535,7 @@
       web_stream_.AudioTracks();
 
   RendererReloadAction renderer_action = RendererReloadAction::KEEP_RENDERER;
-  if (audio_tracks.IsEmpty()) {
+  if (audio_tracks.empty()) {
     if (audio_renderer_)
       renderer_action = RendererReloadAction::REMOVE_RENDERER;
     current_audio_track_id_ = blink::WebString();
diff --git a/content/renderer/media/webrtc/rtc_peer_connection_handler.cc b/content/renderer/media/webrtc/rtc_peer_connection_handler.cc
index 2d43471..8cbcb6e 100644
--- a/content/renderer/media/webrtc/rtc_peer_connection_handler.cc
+++ b/content/renderer/media/webrtc/rtc_peer_connection_handler.cc
@@ -683,9 +683,6 @@
     }
 
     if (handler_) {
-      // |handler_| can become null after this call.
-      handler_->OnSignalingChange(states.signaling_state);
-
       // Process the rest of the state changes differently depending on SDP
       // semantics.
       if (sdp_semantics_ == webrtc::SdpSemantics::kPlanB) {
@@ -695,6 +692,9 @@
         ProcessStateChangesUnifiedPlan(std::move(states));
       }
 
+      // |handler_| can become null after this call.
+      handler_->OnSignalingChange(states.signaling_state);
+
       if (tracker_ && handler_) {
         tracker_->TrackSessionDescriptionCallback(handler_.get(), action_,
                                                   "OnSuccess", "");
diff --git a/content/renderer/media_recorder/media_recorder_handler.cc b/content/renderer/media_recorder/media_recorder_handler.cc
index ec0b85d7..0c14f151 100644
--- a/content/renderer/media_recorder/media_recorder_handler.cc
+++ b/content/renderer/media_recorder/media_recorder_handler.cc
@@ -249,17 +249,17 @@
   video_tracks_ = media_stream_.VideoTracks();
   audio_tracks_ = media_stream_.AudioTracks();
 
-  if (video_tracks_.IsEmpty() && audio_tracks_.IsEmpty()) {
+  if (video_tracks_.empty() && audio_tracks_.empty()) {
     LOG(WARNING) << __func__ << ": no media tracks.";
     return false;
   }
 
   const bool use_video_tracks =
-      !video_tracks_.IsEmpty() &&
+      !video_tracks_.empty() &&
       video_tracks_[0].Source().GetReadyState() !=
           blink::WebMediaStreamSource::kReadyStateEnded;
   const bool use_audio_tracks =
-      !audio_tracks_.IsEmpty() &&
+      !audio_tracks_.empty() &&
       blink::MediaStreamAudioTrack::From(audio_tracks_[0]) &&
       audio_tracks_[0].Source().GetReadyState() !=
           blink::WebMediaStreamSource::kReadyStateEnded;
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index cb07c32..0c3bb08 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -2501,7 +2501,7 @@
 
   if (notify_result_) {
     base::ListValue list;
-    if (!result.IsEmpty()) {
+    if (!result.empty()) {
       // It's safe to always use the main world context when converting
       // here. V8ValueConverterImpl shouldn't actually care about the
       // context scope, and it switches to v8::Object's creation context
diff --git a/infra/scripts/legacy/scripts/slave/chromium/sizes.py b/infra/scripts/legacy/scripts/slave/chromium/sizes.py
index b0701a9..bdc24d05 100755
--- a/infra/scripts/legacy/scripts/slave/chromium/sizes.py
+++ b/infra/scripts/legacy/scripts/slave/chromium/sizes.py
@@ -92,6 +92,12 @@
   build_dir = build_directory.GetBuildOutputDirectory(SRC_DIR)
   target_dir = os.path.join(build_dir, options.target)
 
+  """Set DEVELOPER_DIR to the hermetic Xcode.app so 'size' will work."""
+  if not 'DEVELOPER_DIR' in os.environ:
+    xcode_path = os.path.join(SRC_DIR, 'build', 'mac_files', 'Xcode.app');
+    if os.path.exists(xcode_path):
+      os.environ['DEVELOPER_DIR'] = xcode_path
+
   result = 0
   # Work with either build type.
   base_names = ('Chromium', 'Google Chrome')
diff --git a/ios/chrome/browser/signin/identity_test_environment_chrome_browser_state_adaptor.cc b/ios/chrome/browser/signin/identity_test_environment_chrome_browser_state_adaptor.cc
index 986b417..b92bef6db 100644
--- a/ios/chrome/browser/signin/identity_test_environment_chrome_browser_state_adaptor.cc
+++ b/ios/chrome/browser/signin/identity_test_environment_chrome_browser_state_adaptor.cc
@@ -7,7 +7,9 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "components/signin/core/browser/fake_account_fetcher_service.h"
 #include "components/signin/core/browser/fake_profile_oauth2_token_service.h"
+#include "components/signin/core/browser/fake_signin_manager.h"
 #include "components/signin/core/browser/test_signin_client.h"
 #include "components/signin/ios/browser/profile_oauth2_token_service_ios_delegate.h"
 #include "ios/chrome/browser/browser_state/chrome_browser_state.h"
diff --git a/media/blink/key_system_config_selector.cc b/media/blink/key_system_config_selector.cc
index 5f2bf5c..2ccbefd 100644
--- a/media/blink/key_system_config_selector.cc
+++ b/media/blink/key_system_config_selector.cc
@@ -517,7 +517,7 @@
 
   // 3. If the initDataTypes member of candidate configuration is non-empty,
   //    run the following steps:
-  if (!candidate.init_data_types.IsEmpty()) {
+  if (!candidate.init_data_types.empty()) {
     // 3.1. Let supported types be an empty sequence of DOMStrings.
     std::vector<blink::WebEncryptedMediaInitDataType> supported_types;
 
@@ -705,8 +705,8 @@
 
   // 15. If the videoCapabilities and audioCapabilities members in candidate
   //     configuration are both empty, return NotSupported.
-  if (candidate.video_capabilities.IsEmpty() &&
-      candidate.audio_capabilities.IsEmpty()) {
+  if (candidate.video_capabilities.empty() &&
+      candidate.audio_capabilities.empty()) {
     DVLOG(2) << "Rejecting requested configuration because "
              << "neither audioCapabilities nor videoCapabilities is specified";
     return CONFIGURATION_NOT_SUPPORTED;
@@ -715,7 +715,7 @@
   // 16. If the videoCapabilities member in candidate configuration is
   //     non-empty:
   std::vector<blink::WebMediaKeySystemMediaCapability> video_capabilities;
-  if (!candidate.video_capabilities.IsEmpty()) {
+  if (!candidate.video_capabilities.empty()) {
     // 16.1. Let video capabilities be the result of executing the Get
     //       Supported Capabilities for Audio/Video Type algorithm on Video,
     //       candidate configuration's videoCapabilities member, accumulated
@@ -741,7 +741,7 @@
   // 17. If the audioCapabilities member in candidate configuration is
   //     non-empty:
   std::vector<blink::WebMediaKeySystemMediaCapability> audio_capabilities;
-  if (!candidate.audio_capabilities.IsEmpty()) {
+  if (!candidate.audio_capabilities.empty()) {
     // 17.1. Let audio capabilities be the result of executing the Get
     //       Supported Capabilities for Audio/Video Type algorithm on Audio,
     //       candidate configuration's audioCapabilities member, accumulated
diff --git a/media/blink/key_system_config_selector_unittest.cc b/media/blink/key_system_config_selector_unittest.cc
index c587a625..c2bd18a 100644
--- a/media/blink/key_system_config_selector_unittest.cc
+++ b/media/blink/key_system_config_selector_unittest.cc
@@ -488,9 +488,9 @@
   SelectConfigReturnsConfig();
 
   EXPECT_EQ("", config_.label);
-  EXPECT_TRUE(config_.init_data_types.IsEmpty());
+  EXPECT_TRUE(config_.init_data_types.empty());
   EXPECT_EQ(1u, config_.audio_capabilities.size());
-  EXPECT_TRUE(config_.video_capabilities.IsEmpty());
+  EXPECT_TRUE(config_.video_capabilities.empty());
   EXPECT_EQ(MediaKeysRequirement::kNotAllowed, config_.distinctive_identifier);
   EXPECT_EQ(MediaKeysRequirement::kNotAllowed, config_.persistent_state);
   ASSERT_EQ(1u, config_.session_types.size());
@@ -700,7 +700,7 @@
   configs_.push_back(config);
 
   SelectConfigReturnsConfig();
-  EXPECT_TRUE(config_.session_types.IsEmpty());
+  EXPECT_TRUE(config_.session_types.empty());
 }
 
 TEST_F(KeySystemConfigSelectorTest, SessionTypes_SubsetSupported) {
diff --git a/media/gpu/v4l2/v4l2_device.cc b/media/gpu/v4l2/v4l2_device.cc
index f56b0bb..4f87445b 100644
--- a/media/gpu/v4l2/v4l2_device.cc
+++ b/media/gpu/v4l2/v4l2_device.cc
@@ -208,11 +208,11 @@
 
 // Module-private class that let users query/write V4L2 buffer information.
 // It also makes some private V4L2Queue methods available to this module only.
-class V4L2BufferQueueProxy {
+class V4L2BufferRefBase {
  public:
-  V4L2BufferQueueProxy(const struct v4l2_buffer* v4l2_buffer,
-                       base::WeakPtr<V4L2Queue> queue);
-  ~V4L2BufferQueueProxy();
+  V4L2BufferRefBase(const struct v4l2_buffer* v4l2_buffer,
+                    base::WeakPtr<V4L2Queue> queue);
+  ~V4L2BufferRefBase();
 
   bool QueueBuffer();
   void* GetPlaneMapping(const size_t plane);
@@ -237,12 +237,11 @@
   bool queued = false;
 
   SEQUENCE_CHECKER(sequence_checker_);
-  DISALLOW_COPY_AND_ASSIGN(V4L2BufferQueueProxy);
+  DISALLOW_COPY_AND_ASSIGN(V4L2BufferRefBase);
 };
 
-V4L2BufferQueueProxy::V4L2BufferQueueProxy(
-    const struct v4l2_buffer* v4l2_buffer,
-    base::WeakPtr<V4L2Queue> queue)
+V4L2BufferRefBase::V4L2BufferRefBase(const struct v4l2_buffer* v4l2_buffer,
+                                     base::WeakPtr<V4L2Queue> queue)
     : queue_(std::move(queue)), return_to_(queue_->free_buffers_) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK(V4L2_TYPE_IS_MULTIPLANAR(v4l2_buffer->type));
@@ -255,7 +254,7 @@
   v4l2_buffer_.m.planes = v4l2_planes_;
 }
 
-V4L2BufferQueueProxy::~V4L2BufferQueueProxy() {
+V4L2BufferRefBase::~V4L2BufferRefBase() {
   // We are the last reference and are only accessing the thread-safe
   // return_to_, so we are safe to call from any sequence.
   // If we have been queued, then the queue is our owner so we don't need to
@@ -264,7 +263,7 @@
     return_to_->ReturnBuffer(BufferId());
 }
 
-bool V4L2BufferQueueProxy::QueueBuffer() {
+bool V4L2BufferRefBase::QueueBuffer() {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   if (!queue_)
@@ -275,7 +274,7 @@
   return queued;
 }
 
-void* V4L2BufferQueueProxy::GetPlaneMapping(const size_t plane) {
+void* V4L2BufferRefBase::GetPlaneMapping(const size_t plane) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   if (!queue_)
@@ -292,8 +291,8 @@
 V4L2WritableBufferRef::V4L2WritableBufferRef(
     const struct v4l2_buffer* v4l2_buffer,
     base::WeakPtr<V4L2Queue> queue)
-    : buffer_data_(std::make_unique<V4L2BufferQueueProxy>(v4l2_buffer,
-                                                          std::move(queue))) {
+    : buffer_data_(
+          std::make_unique<V4L2BufferRefBase>(v4l2_buffer, std::move(queue))) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 }
 
@@ -493,8 +492,8 @@
 
 V4L2ReadableBuffer::V4L2ReadableBuffer(const struct v4l2_buffer* v4l2_buffer,
                                        base::WeakPtr<V4L2Queue> queue)
-    : buffer_data_(std::make_unique<V4L2BufferQueueProxy>(v4l2_buffer,
-                                                          std::move(queue))) {
+    : buffer_data_(
+          std::make_unique<V4L2BufferRefBase>(v4l2_buffer, std::move(queue))) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 }
 
diff --git a/media/gpu/v4l2/v4l2_device.h b/media/gpu/v4l2/v4l2_device.h
index 9cceeed..5f75c2a 100644
--- a/media/gpu/v4l2/v4l2_device.h
+++ b/media/gpu/v4l2/v4l2_device.h
@@ -44,7 +44,7 @@
 namespace media {
 
 class V4L2Queue;
-class V4L2BufferQueueProxy;
+class V4L2BufferRefBase;
 class V4L2BuffersList;
 
 // A unique reference to a buffer for clients to prepare and submit.
@@ -121,7 +121,7 @@
                         base::WeakPtr<V4L2Queue> queue);
   friend class V4L2BufferRefFactory;
 
-  std::unique_ptr<V4L2BufferQueueProxy> buffer_data_;
+  std::unique_ptr<V4L2BufferRefBase> buffer_data_;
 
   SEQUENCE_CHECKER(sequence_checker_);
   DISALLOW_COPY_AND_ASSIGN(V4L2WritableBufferRef);
@@ -164,7 +164,7 @@
   V4L2ReadableBuffer(const struct v4l2_buffer* v4l2_buffer,
                      base::WeakPtr<V4L2Queue> queue);
 
-  std::unique_ptr<V4L2BufferQueueProxy> buffer_data_;
+  std::unique_ptr<V4L2BufferRefBase> buffer_data_;
 
   SEQUENCE_CHECKER(sequence_checker_);
   DISALLOW_COPY_AND_ASSIGN(V4L2ReadableBuffer);
@@ -290,7 +290,7 @@
             enum v4l2_buf_type type,
             base::OnceClosure destroy_cb);
   friend class V4L2QueueFactory;
-  friend class V4L2BufferQueueProxy;
+  friend class V4L2BufferRefBase;
   friend class base::RefCountedThreadSafe<V4L2Queue>;
 
   SEQUENCE_CHECKER(sequence_checker_);
diff --git a/mojo/public/tools/bindings/generators/cpp_templates/module-forward.h.tmpl b/mojo/public/tools/bindings/generators/cpp_templates/module-forward.h.tmpl
index be9db6c..34931edb 100644
--- a/mojo/public/tools/bindings/generators/cpp_templates/module-forward.h.tmpl
+++ b/mojo/public/tools/bindings/generators/cpp_templates/module-forward.h.tmpl
@@ -72,6 +72,25 @@
 {%-   endfor %}
 {%- endif %}
 
+{%- if variant %}
+{%-   for namespace in namespaces_as_array %}
+namespace {{namespace}} {
+{%-   endfor %}
+
+{%- from "enum_macros.tmpl" import enum_forward%}
+{%- for enum in all_enums %}
+{%-   if enum|is_native_only_kind %}
+using {{enum|get_name_for_kind(flatten_nested_kind=True)}} = mojo::NativeEnum;
+{%-   else %}
+{{enum_forward(enum)}}
+{%-   endif %}
+{%- endfor %}
+
+{%-   for namespace in namespaces_as_array %}
+}  // namespace {{namespace}}
+{%-   endfor %}
+{%- endif %}
+
 {{namespace_begin()}}
 
 {#- These are non-variant header only. #}
diff --git a/net/base/data_url.cc b/net/base/data_url.cc
index 004f13c..c19e47f 100644
--- a/net/base/data_url.cc
+++ b/net/base/data_url.cc
@@ -56,11 +56,12 @@
 
   bool base64_encoded = false;
   for (; iter != meta_data.cend(); ++iter) {
-    if (!base64_encoded && *iter == kBase64Tag) {
+    if (!base64_encoded &&
+        base::EqualsCaseInsensitiveASCII(*iter, kBase64Tag)) {
       base64_encoded = true;
     } else if (charset->empty() &&
                base::StartsWith(*iter, kCharsetTag,
-                                base::CompareCase::SENSITIVE)) {
+                                base::CompareCase::INSENSITIVE_ASCII)) {
       *charset = std::string(iter->substr(kCharsetTag.size()));
       // The grammar for charset is not specially defined in RFC2045 and
       // RFC2397. It just needs to be a token.
diff --git a/net/disk_cache/entry_unittest.cc b/net/disk_cache/entry_unittest.cc
index 2e77309..c309f1b 100644
--- a/net/disk_cache/entry_unittest.cc
+++ b/net/disk_cache/entry_unittest.cc
@@ -83,6 +83,12 @@
   bool SimpleCacheMakeBadChecksumEntry(const std::string& key, int data_size);
   bool SimpleCacheThirdStreamFileExists(const char* key);
   void SyncDoomEntry(const char* key);
+  void CreateEntryWithHeaderBodyAndSideData(const std::string& key,
+                                            int data_size);
+  void TruncateFileFromEnd(int file_index,
+                           const std::string& key,
+                           int data_size,
+                           int truncate_size);
   void UseAfterBackendDestruction();
   void LastUsedTimePersists();
 };
@@ -4258,6 +4264,37 @@
   callback.WaitForResult();
 }
 
+void DiskCacheEntryTest::CreateEntryWithHeaderBodyAndSideData(
+    const std::string& key,
+    int data_size) {
+  // Use one buffer for simplicity.
+  scoped_refptr<net::IOBuffer> buffer =
+      base::MakeRefCounted<net::IOBuffer>(data_size);
+  CacheTestFillBuffer(buffer->data(), data_size, false);
+
+  disk_cache::Entry* entry = nullptr;
+  ASSERT_THAT(CreateEntry(key, &entry), IsOk());
+  for (int i = 0; i < disk_cache::kSimpleEntryStreamCount; ++i) {
+    EXPECT_EQ(data_size, WriteData(entry, i, /* offset */ 0, buffer.get(),
+                                   data_size, false));
+  }
+  entry->Close();
+}
+
+void DiskCacheEntryTest::TruncateFileFromEnd(int file_index,
+                                             const std::string& key,
+                                             int data_size,
+                                             int truncate_size) {
+  // Remove last eof bytes from cache file.
+  ASSERT_GT(data_size, truncate_size);
+  const int64_t new_size =
+      disk_cache::simple_util::GetFileSizeFromDataSize(key.size(), data_size) -
+      truncate_size;
+  const base::FilePath entry_path = cache_path_.AppendASCII(
+      disk_cache::simple_util::GetFilenameFromKeyAndFileIndex(key, file_index));
+  EXPECT_TRUE(TruncatePath(entry_path, new_size));
+}
+
 void DiskCacheEntryTest::UseAfterBackendDestruction() {
   disk_cache::Entry* entry = NULL;
   ASSERT_THAT(CreateEntry("the first key", &entry), IsOk());
@@ -4634,6 +4671,40 @@
   entry->Close();
 }
 
+TEST_F(DiskCacheEntryTest, SimpleCacheNoBodyEOF) {
+  SetSimpleCacheMode();
+  InitCache();
+
+  const std::string key("the first key");
+  const int kSize = 1024;
+  CreateEntryWithHeaderBodyAndSideData(key, kSize);
+
+  disk_cache::Entry* entry = nullptr;
+  ASSERT_THAT(OpenEntry(key, &entry), IsOk());
+  entry->Close();
+
+  TruncateFileFromEnd(0 /*header and body file index*/, key, kSize,
+                      static_cast<int>(sizeof(disk_cache::SimpleFileEOF)));
+  EXPECT_THAT(OpenEntry(key, &entry), IsError(net::ERR_FAILED));
+}
+
+TEST_F(DiskCacheEntryTest, SimpleCacheNoSideDataEOF) {
+  SetSimpleCacheMode();
+  InitCache();
+
+  const std::string key("the first key");
+  const int kSize = 1024;
+  CreateEntryWithHeaderBodyAndSideData(key, kSize);
+
+  disk_cache::Entry* entry = nullptr;
+  ASSERT_THAT(OpenEntry(key, &entry), IsOk());
+  entry->Close();
+
+  TruncateFileFromEnd(1 /*side data file_index*/, key, kSize,
+                      static_cast<int>(sizeof(disk_cache::SimpleFileEOF)));
+  EXPECT_THAT(OpenEntry(key, &entry), IsError(net::ERR_FAILED));
+}
+
 TEST_F(DiskCacheEntryTest, SimpleCacheReadWithoutKeySHA256) {
   // This test runs as APP_CACHE to make operations more synchronous.
   SetCacheType(net::APP_CACHE);
diff --git a/net/disk_cache/simple/simple_synchronous_entry.cc b/net/disk_cache/simple/simple_synchronous_entry.cc
index 3b7a83d9b..a45ceca 100644
--- a/net/disk_cache/simple/simple_synchronous_entry.cc
+++ b/net/disk_cache/simple/simple_synchronous_entry.cc
@@ -1457,9 +1457,21 @@
       out_entry_stat->set_data_size(
           2,
           GetDataSizeFromFileSize(key_.size(), out_entry_stat->data_size(2)));
-      if (out_entry_stat->data_size(2) < 0) {
+      const int32_t data_size_2 = out_entry_stat->data_size(2);
+      if (data_size_2 < 0) {
         DLOG(WARNING) << "Stream 2 file is too small.";
         return net::ERR_FAILED;
+      } else if (data_size_2 > 0) {
+        // Validate non empty stream 2.
+        SimpleFileEOF eof_record;
+        SimpleFileTracker::FileHandle file =
+            file_tracker_->Acquire(this, SubFileForFileIndex(i));
+        int file_offset =
+            out_entry_stat->GetEOFOffsetInFile(key_.size(), 2 /*stream index*/);
+        int ret_value_stream_2 =
+            GetEOFRecordData(file.get(), nullptr, i, file_offset, &eof_record);
+        if (ret_value_stream_2 != net::OK)
+          return ret_value_stream_2;
       }
     }
   }
diff --git a/net/socket/udp_socket_posix_unittest.cc b/net/socket/udp_socket_posix_unittest.cc
index 1fb23f9..42a42a1 100644
--- a/net/socket/udp_socket_posix_unittest.cc
+++ b/net/socket/udp_socket_posix_unittest.cc
@@ -658,7 +658,13 @@
   EXPECT_EQ(ERR_INVALID_HANDLE, rv);
 }
 
-TEST_F(UDPSocketPosixTest, WriteAsyncBasicDelay) {
+#if defined(OS_IOS)
+#define MAYBE_WriteAsyncBasicDelay DISABLED_WriteAsyncBasicDelay
+#else
+#define MAYBE_WriteAsyncBasicDelay WriteAsyncBasicDelay
+#endif
+// TODO(crbug.com/934778) The test is flaky on iOS.
+TEST_F(UDPSocketPosixTest, MAYBE_WriteAsyncBasicDelay) {
   socket_.SetWriteBatchingActive(true);
   socket_.SetWriteMultiCoreEnabled(true);
   DatagramBuffers buffers;
diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
index ecd6e339..55394a7 100644
--- a/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_parameters_restrictions.cc
@@ -34,7 +34,13 @@
 #if !defined(OS_NACL_NONSFI)
 #include <sys/ioctl.h>
 #include <sys/ptrace.h>
-#endif
+#if !defined(PTRACE_GET_THREAD_AREA) && defined(OS_LINUX) && \
+    !defined(OS_CHROMEOS)
+// Also include asm/ptrace-abi.h since ptrace.h in older libc (for instance
+// the one in Ubuntu 16.04 LTS) is missing PTRACE_GET_THREAD_AREA.
+#include <asm/ptrace-abi.h>
+#endif  // !PTRACE_GET_THREAD_AREA && OS_LINUX && !OS_CHROMEOS
+#endif  // !OS_NACL_NONSFI
 
 #if defined(OS_ANDROID)
 
diff --git a/services/identity/public/cpp/identity_manager.cc b/services/identity/public/cpp/identity_manager.cc
index 4c63543..2380220 100644
--- a/services/identity/public/cpp/identity_manager.cc
+++ b/services/identity/public/cpp/identity_manager.cc
@@ -16,6 +16,10 @@
 #include "services/identity/public/cpp/primary_account_mutator.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 
+#if defined(OS_ANDROID)
+#include "components/signin/core/browser/oauth2_token_service_delegate_android.h"
+#endif
+
 namespace identity {
 
 namespace {
@@ -317,6 +321,21 @@
 }
 #endif
 
+#if defined(OS_ANDROID)
+base::android::ScopedJavaLocalRef<jobject>
+IdentityManager::LegacyGetAccountTrackerServiceJavaObject() {
+  return account_tracker_service_->GetJavaObject();
+}
+
+base::android::ScopedJavaLocalRef<jobject>
+IdentityManager::LegacyGetOAuth2TokenServiceJavaObject() {
+  OAuth2TokenServiceDelegateAndroid* delegate =
+      static_cast<OAuth2TokenServiceDelegateAndroid*>(
+          token_service_->GetDelegate());
+  return delegate->GetJavaObject();
+}
+#endif
+
 void IdentityManager::AddObserver(Observer* observer) {
   observer_list_.AddObserver(observer);
 }
diff --git a/services/identity/public/cpp/identity_manager.h b/services/identity/public/cpp/identity_manager.h
index 0717b32..99655a8 100644
--- a/services/identity/public/cpp/identity_manager.h
+++ b/services/identity/public/cpp/identity_manager.h
@@ -27,6 +27,10 @@
 #include "components/signin/core/browser/signin_manager.h"
 #endif
 
+#if defined(OS_ANDROID)
+#include "base/android/jni_android.h"
+#endif
+
 // Necessary to declare this class as a friend.
 namespace arc {
 class ArcTermsOfServiceDefaultNegotiatorTest;
@@ -425,6 +429,22 @@
   void LegacyReloadAccountsFromSystem();
 #endif
 
+#if defined(OS_ANDROID)
+  // Returns a pointer to the AccountTrackerService Java instance associated
+  // with this object.
+  // TODO(https://crbug.com/934688): Eliminate this method once
+  // AccountTrackerService.java has no more client usage.
+  base::android::ScopedJavaLocalRef<jobject>
+  LegacyGetAccountTrackerServiceJavaObject();
+
+  // Returns a pointer to the OAuth2TokenService Java instance associated
+  // with this object.
+  // TODO(https://crbug.com/934688): Eliminate this method once
+  // OAuth2TokenService.java has no more client usage.
+  base::android::ScopedJavaLocalRef<jobject>
+  LegacyGetOAuth2TokenServiceJavaObject();
+#endif
+
   // Methods to register or remove observers.
   void AddObserver(Observer* observer);
   void RemoveObserver(Observer* observer);
diff --git a/services/identity/public/cpp/identity_test_environment.cc b/services/identity/public/cpp/identity_test_environment.cc
index de01f26..37df262 100644
--- a/services/identity/public/cpp/identity_test_environment.cc
+++ b/services/identity/public/cpp/identity_test_environment.cc
@@ -9,7 +9,11 @@
 
 #include "base/run_loop.h"
 #include "base/threading/thread_task_runner_handle.h"
+#include "components/signin/core/browser/account_tracker_service.h"
 #include "components/signin/core/browser/fake_account_fetcher_service.h"
+#include "components/signin/core/browser/fake_profile_oauth2_token_service.h"
+#include "components/signin/core/browser/fake_signin_manager.h"
+#include "components/signin/core/browser/gaia_cookie_manager_service.h"
 #include "components/signin/core/browser/test_signin_client.h"
 #include "components/sync_preferences/testing_pref_service_syncable.h"
 #include "google_apis/gaia/oauth2_access_token_consumer.h"
diff --git a/services/identity/public/cpp/identity_test_environment.h b/services/identity/public/cpp/identity_test_environment.h
index 220b1c0..eaa7e5c 100644
--- a/services/identity/public/cpp/identity_test_environment.h
+++ b/services/identity/public/cpp/identity_test_environment.h
@@ -7,13 +7,15 @@
 
 #include "base/optional.h"
 #include "components/signin/core/browser/account_consistency_method.h"
-#include "components/signin/core/browser/account_tracker_service.h"
-#include "components/signin/core/browser/fake_account_fetcher_service.h"
-#include "components/signin/core/browser/fake_profile_oauth2_token_service.h"
-#include "components/signin/core/browser/fake_signin_manager.h"
 #include "services/identity/public/cpp/identity_manager.h"
 #include "services/identity/public/cpp/identity_test_utils.h"
 
+class AccountTrackerService;
+class FakeAccountFetcherService;
+class FakeProfileOAuth2TokenService;
+class FakeSigninManagerBase;
+class FakeSigninManager;
+class GaiaCookieManagerService;
 class IdentityTestEnvironmentChromeBrowserStateAdaptor;
 class IdentityTestEnvironmentProfileAdaptor;
 class PrefService;
diff --git a/services/tracing/public/cpp/tracing_features.cc b/services/tracing/public/cpp/tracing_features.cc
index 08887d9..66704a3b 100644
--- a/services/tracing/public/cpp/tracing_features.cc
+++ b/services/tracing/public/cpp/tracing_features.cc
@@ -20,14 +20,8 @@
                                             base::FEATURE_DISABLED_BY_DEFAULT};
 
 // Runs the tracing service as an in-process browser service.
-const base::Feature kTracingServiceInProcess {
-  "TracingServiceInProcess",
-#if defined(OS_ANDROID)
-      base::FEATURE_ENABLED_BY_DEFAULT
-#else
-      base::FEATURE_DISABLED_BY_DEFAULT
-#endif
-};
+const base::Feature kTracingServiceInProcess{"TracingServiceInProcess",
+                                             base::FEATURE_ENABLED_BY_DEFAULT};
 
 }  // namespace features
 
diff --git a/testing/buildbot/chromium.fyi.json b/testing/buildbot/chromium.fyi.json
index 7a2c8e1..c4aabb72 100644
--- a/testing/buildbot/chromium.fyi.json
+++ b/testing/buildbot/chromium.fyi.json
@@ -4157,17 +4157,6 @@
             }
           ]
         },
-        "test": "blink_common_unittests"
-      },
-      {
-        "swarming": {
-          "can_use_on_swarming_builders": true,
-          "dimension_sets": [
-            {
-              "kvm": "1"
-            }
-          ]
-        },
         "test": "blink_heap_unittests"
       },
       {
diff --git a/testing/buildbot/filters/mojo.fyi.network_webview_CTS_test.filter b/testing/buildbot/filters/mojo.fyi.network_webview_CTS_test.filter
index f5d050a..1c8d6a6 100644
--- a/testing/buildbot/filters/mojo.fyi.network_webview_CTS_test.filter
+++ b/testing/buildbot/filters/mojo.fyi.network_webview_CTS_test.filter
@@ -27,4 +27,4 @@
 -android.webkit.cts.WebViewSslTest.testSecureServerRequiringClientCertDoesCancelRequest
 -android.webkit.cts.WebViewTest.testSetDownloadListener
 -com.android.cts.webkit.WebViewDeviceSideStartupTest.testCookieManagerBlockingUiThread
--com.android.cts.webkit.WebViewDeviceSideStartupTest.testStrictModeNotViolatedOnStartup
+
diff --git a/testing/buildbot/test_suite_exceptions.pyl b/testing/buildbot/test_suite_exceptions.pyl
index 95325be..b834fa59 100644
--- a/testing/buildbot/test_suite_exceptions.pyl
+++ b/testing/buildbot/test_suite_exceptions.pyl
@@ -59,6 +59,7 @@
     'remove_from': [
       # chromium.linux
       'Fuchsia x64',
+      'fuchsia-fyi-x64-dbg',  # https://crbug.com/934582
     ],
   },
   'blink_heap_unittests': {
diff --git a/third_party/blink/common/features.cc b/third_party/blink/common/features.cc
index 6e9c0ff8..0024bee 100644
--- a/third_party/blink/common/features.cc
+++ b/third_party/blink/common/features.cc
@@ -187,6 +187,13 @@
 const base::Feature kForbidSyncXHRInPageDismissal{
     "ForbidSyncXHRInPageDismissal", base::FEATURE_DISABLED_BY_DEFAULT};
 
+// Emergency lever that can be used to restore DeviceOrientationEvent and
+// DeviceMotionEvent functionality in non-secure browsing contexts.
+// See: https://crbug.com/932078.
+const base::Feature kRestrictDeviceSensorEventsToSecureContexts{
+    "RestrictDeviceSensorEventsToSecureContexts",
+    base::FEATURE_DISABLED_BY_DEFAULT};
+
 const char kAutofillPreviewStyleExperimentBgColorParameterName[] = "bg_color";
 
 const char kAutofillPreviewStyleExperimentColorParameterName[] = "color";
diff --git a/third_party/blink/public/common/features.h b/third_party/blink/public/common/features.h
index c59f114..45a2cfd 100644
--- a/third_party/blink/public/common/features.h
+++ b/third_party/blink/public/common/features.h
@@ -55,6 +55,8 @@
 BLINK_COMMON_EXPORT extern const base::Feature kWasmCodeCache;
 BLINK_COMMON_EXPORT extern const base::Feature kWritableFilesAPI;
 BLINK_COMMON_EXPORT extern const base::Feature kForbidSyncXHRInPageDismissal;
+BLINK_COMMON_EXPORT extern const base::Feature
+    kRestrictDeviceSensorEventsToSecureContexts;
 
 BLINK_COMMON_EXPORT extern const char
     kAutofillPreviewStyleExperimentBgColorParameterName[];
diff --git a/third_party/blink/public/platform/web_runtime_features.h b/third_party/blink/public/platform/web_runtime_features.h
index cb55b46c..e96e76f 100644
--- a/third_party/blink/public/platform/web_runtime_features.h
+++ b/third_party/blink/public/platform/web_runtime_features.h
@@ -161,6 +161,8 @@
   BLINK_PLATFORM_EXPORT static void EnableRemotePlaybackAPI(bool);
   BLINK_PLATFORM_EXPORT static void EnableRenderingPipelineThrottling(bool);
   BLINK_PLATFORM_EXPORT static void EnableResourceLoadScheduler(bool);
+  BLINK_PLATFORM_EXPORT static void
+  EnableRestrictDeviceSensorEventsToSecureContexts(bool);
   BLINK_PLATFORM_EXPORT static void EnableRestrictLazyFrameLoadingToDataSaver(
       bool);
   BLINK_PLATFORM_EXPORT static void EnableRestrictLazyImageLoadingToDataSaver(
diff --git a/third_party/blink/public/platform/web_vector.h b/third_party/blink/public/platform/web_vector.h
index 3c030cf..3aeb4e4 100644
--- a/third_party/blink/public/platform/web_vector.h
+++ b/third_party/blink/public/platform/web_vector.h
@@ -144,8 +144,6 @@
     data_.resize(new_size);
   }
   bool empty() const { return data_.empty(); }
-  // TODO(slangley): Remove all uses of IsEmpty.
-  bool IsEmpty() const { return empty(); }
 
   size_t capacity() const { return data_.capacity(); }
   void reserve(size_t new_capacity) { data_.reserve(new_capacity); }
diff --git a/third_party/blink/renderer/core/css/css_selector.cc b/third_party/blink/renderer/core/css/css_selector.cc
index eefc6d1..8181052f 100644
--- a/third_party/blink/renderer/core/css/css_selector.cc
+++ b/third_party/blink/renderer/core/css/css_selector.cc
@@ -444,9 +444,6 @@
   if (match == pseudo_type_map_end || match->string != name.GetString())
     return CSSSelector::kPseudoUnknown;
 
-  if (match->type == CSSSelector::kPseudoFullscreen &&
-      !RuntimeEnabledFeatures::FullscreenUnprefixedEnabled())
-    return CSSSelector::kPseudoUnknown;
   if (match->type == CSSSelector::kPseudoFocusVisible &&
       !RuntimeEnabledFeatures::CSSFocusVisibleEnabled())
     return CSSSelector::kPseudoUnknown;
diff --git a/third_party/blink/renderer/core/css/style_engine.cc b/third_party/blink/renderer/core/css/style_engine.cc
index f8613fc..ed1b1a4 100644
--- a/third_party/blink/renderer/core/css/style_engine.cc
+++ b/third_party/blink/renderer/core/css/style_engine.cc
@@ -511,6 +511,15 @@
   return active_style_sheets;
 }
 
+void StyleEngine::ShadowRootInsertedToDocument(ShadowRoot& shadow_root) {
+  DCHECK(shadow_root.isConnected());
+  if (GetDocument().IsDetached() || !shadow_root.HasAdoptedStyleSheets())
+    return;
+  EnsureStyleSheetCollectionFor(shadow_root);
+  SetNeedsActiveStyleUpdate(shadow_root);
+  active_tree_scopes_.insert(&shadow_root);
+}
+
 void StyleEngine::ShadowRootRemovedFromDocument(ShadowRoot* shadow_root) {
   style_sheet_collection_map_.erase(shadow_root);
   active_tree_scopes_.erase(shadow_root);
@@ -671,9 +680,9 @@
     return;
   }
 
-  TreeScopeStyleSheetCollection& collection =
-      EnsureStyleSheetCollectionFor(scope);
-  collection.MarkSheetListDirty();
+  TreeScopeStyleSheetCollection* collection = StyleSheetCollectionFor(scope);
+  DCHECK(collection);
+  collection->MarkSheetListDirty();
   dirty_tree_scopes_.insert(&scope);
   GetDocument().ScheduleLayoutTreeUpdateIfNeeded();
 }
diff --git a/third_party/blink/renderer/core/css/style_engine.h b/third_party/blink/renderer/core/css/style_engine.h
index e3b29303..78e6761 100644
--- a/third_party/blink/renderer/core/css/style_engine.h
+++ b/third_party/blink/renderer/core/css/style_engine.h
@@ -217,6 +217,7 @@
 
   void ResetCSSFeatureFlags(const RuleFeatureSet&);
 
+  void ShadowRootInsertedToDocument(ShadowRoot&);
   void ShadowRootRemovedFromDocument(ShadowRoot*);
   void AddTreeBoundaryCrossingScope(const TreeScope&);
   const TreeOrderedList& TreeBoundaryCrossingScopes() const {
diff --git a/third_party/blink/renderer/core/dom/document_or_shadow_root.idl b/third_party/blink/renderer/core/dom/document_or_shadow_root.idl
index b7242fc1..b2dae97 100644
--- a/third_party/blink/renderer/core/dom/document_or_shadow_root.idl
+++ b/third_party/blink/renderer/core/dom/document_or_shadow_root.idl
@@ -22,6 +22,6 @@
     readonly attribute Element? pointerLockElement;
     // Fullscreen API
     // https://fullscreen.spec.whatwg.org/
-    [LenientSetter, RuntimeEnabled=FullscreenUnprefixed] readonly attribute Element? fullscreenElement;
+    [LenientSetter] readonly attribute Element? fullscreenElement;
     [RaisesException=Setter] attribute FrozenArray<CSSStyleSheet> adoptedStyleSheets;
 };
diff --git a/third_party/blink/renderer/core/dom/element.cc b/third_party/blink/renderer/core/dom/element.cc
index 2c19cf3..cbc3cb9f 100644
--- a/third_party/blink/renderer/core/dom/element.cc
+++ b/third_party/blink/renderer/core/dom/element.cc
@@ -3939,11 +3939,14 @@
       if (const ElementData* element_data = ToElement(n)->GetElementData()) {
         AttributeCollection attributes = element_data->Attributes();
         // Spec: xml:lang takes precedence -- http://www.w3.org/TR/xhtml1/#C_7
-        if (const Attribute* attribute = attributes.Find(xml_names::kLangAttr))
+        if (const Attribute* attribute =
+                attributes.Find(xml_names::kLangAttr)) {
           value = attribute->Value();
-        else if (const Attribute* attribute =
-                     attributes.Find(html_names::kLangAttr))
-          value = attribute->Value();
+        } else {
+          attribute = attributes.Find(html_names::kLangAttr);
+          if (attribute)
+            value = attribute->Value();
+        }
       }
     } else if (auto* document = DynamicTo<Document>(n)) {
       // checking the MIME content-language
@@ -4797,11 +4800,13 @@
   // can share it between both elements.
   // We can only do this if there are no presentation attributes and sharing the
   // data won't result in different case sensitivity of class or id.
-  if (other.element_data_->IsUnique() &&
-      !owner_documents_have_different_case_sensitivity &&
-      !other.element_data_->PresentationAttributeStyle())
+  auto* unique_element_data =
+      DynamicTo<UniqueElementData>(other.element_data_.Get());
+  if (unique_element_data && !owner_documents_have_different_case_sensitivity &&
+      !other.element_data_->PresentationAttributeStyle()) {
     const_cast<Element&>(other).element_data_ =
-        ToUniqueElementData(other.element_data_)->MakeShareableCopy();
+        unique_element_data->MakeShareableCopy();
+  }
 
   if (!other.element_data_->IsUnique() &&
       !owner_documents_have_different_case_sensitivity &&
@@ -4825,8 +4830,9 @@
   if (!element_data_) {
     element_data_ = UniqueElementData::Create();
   } else {
-    DCHECK(!element_data_->IsUnique());
-    element_data_ = ToShareableElementData(element_data_)->MakeUniqueCopy();
+    DCHECK(!IsA<UniqueElementData>(element_data_.Get()));
+    element_data_ =
+        To<ShareableElementData>(element_data_.Get())->MakeUniqueCopy();
   }
 }
 
diff --git a/third_party/blink/renderer/core/dom/element.h b/third_party/blink/renderer/core/dom/element.h
index 49890b1..b3861cd 100644
--- a/third_party/blink/renderer/core/dom/element.h
+++ b/third_party/blink/renderer/core/dom/element.h
@@ -1279,7 +1279,7 @@
 inline UniqueElementData& Element::EnsureUniqueElementData() {
   if (!GetElementData() || !GetElementData()->IsUnique())
     CreateUniqueElementData();
-  return ToUniqueElementData(*element_data_);
+  return To<UniqueElementData>(*element_data_);
 }
 
 inline void Element::InvalidateStyleAttribute() {
diff --git a/third_party/blink/renderer/core/dom/element_data.cc b/third_party/blink/renderer/core/dom/element_data.cc
index d556fd26..b96e04a9 100644
--- a/third_party/blink/renderer/core/dom/element_data.cc
+++ b/third_party/blink/renderer/core/dom/element_data.cc
@@ -79,16 +79,17 @@
 }
 
 void ElementData::FinalizeGarbageCollectedObject() {
-  if (is_unique_)
-    ToUniqueElementData(this)->~UniqueElementData();
+  if (auto* unique_element_data = DynamicTo<UniqueElementData>(this))
+    unique_element_data->~UniqueElementData();
   else
-    ToShareableElementData(this)->~ShareableElementData();
+    To<ShareableElementData>(this)->~ShareableElementData();
 }
 
 UniqueElementData* ElementData::MakeUniqueCopy() const {
-  if (IsUnique())
-    return MakeGarbageCollected<UniqueElementData>(ToUniqueElementData(*this));
-  return MakeGarbageCollected<UniqueElementData>(ToShareableElementData(*this));
+  if (auto* unique_element_data = DynamicTo<UniqueElementData>(this))
+    return MakeGarbageCollected<UniqueElementData>(*unique_element_data);
+  return MakeGarbageCollected<UniqueElementData>(
+      To<ShareableElementData>(*this));
 }
 
 bool ElementData::IsEquivalent(const ElementData* other) const {
@@ -109,10 +110,10 @@
 }
 
 void ElementData::Trace(Visitor* visitor) {
-  if (is_unique_)
-    ToUniqueElementData(this)->TraceAfterDispatch(visitor);
+  if (auto* unique_element_data = DynamicTo<UniqueElementData>(this))
+    unique_element_data->TraceAfterDispatch(visitor);
   else
-    ToShareableElementData(this)->TraceAfterDispatch(visitor);
+    To<ShareableElementData>(this)->TraceAfterDispatch(visitor);
 }
 
 void ElementData::TraceAfterDispatch(blink::Visitor* visitor) {
diff --git a/third_party/blink/renderer/core/dom/element_data.h b/third_party/blink/renderer/core/dom/element_data.h
index 052ba7b55..11406585 100644
--- a/third_party/blink/renderer/core/dom/element_data.h
+++ b/third_party/blink/renderer/core/dom/element_data.h
@@ -37,6 +37,7 @@
 #include "third_party/blink/renderer/core/dom/attribute_collection.h"
 #include "third_party/blink/renderer/core/dom/space_split_string.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
+#include "third_party/blink/renderer/platform/wtf/casting.h"
 #include "third_party/blink/renderer/platform/wtf/text/atomic_string.h"
 
 namespace blink {
@@ -108,11 +109,6 @@
   UniqueElementData* MakeUniqueCopy() const;
 };
 
-#define DEFINE_ELEMENT_DATA_TYPE_CASTS(thisType, pointerPredicate, \
-                                       referencePredicate)         \
-  DEFINE_TYPE_CASTS(thisType, ElementData, data, pointerPredicate, \
-                    referencePredicate)
-
 #if defined(COMPILER_MSVC)
 #pragma warning(push)
 // Disable "zero-sized array in struct/union" warning
@@ -147,9 +143,10 @@
   Attribute attribute_array_[0];
 };
 
-DEFINE_ELEMENT_DATA_TYPE_CASTS(ShareableElementData,
-                               !data->IsUnique(),
-                               !data.IsUnique());
+template <>
+struct DowncastTraits<ShareableElementData> {
+  static bool AllowFrom(const ElementData& data) { return !data.IsUnique(); }
+};
 
 #if defined(COMPILER_MSVC)
 #pragma warning(pop)
@@ -183,21 +180,22 @@
   AttributeVector attribute_vector_;
 };
 
-DEFINE_ELEMENT_DATA_TYPE_CASTS(UniqueElementData,
-                               data->IsUnique(),
-                               data.IsUnique());
+template <>
+struct DowncastTraits<UniqueElementData> {
+  static bool AllowFrom(const ElementData& data) { return data.IsUnique(); }
+};
 
 inline const CSSPropertyValueSet* ElementData::PresentationAttributeStyle()
     const {
   if (!is_unique_)
     return nullptr;
-  return ToUniqueElementData(this)->presentation_attribute_style_.Get();
+  return To<UniqueElementData>(this)->presentation_attribute_style_.Get();
 }
 
 inline AttributeCollection ElementData::Attributes() const {
-  if (IsUnique())
-    return ToUniqueElementData(this)->Attributes();
-  return ToShareableElementData(this)->Attributes();
+  if (auto* unique_element_data = DynamicTo<UniqueElementData>(this))
+    return unique_element_data->Attributes();
+  return To<ShareableElementData>(this)->Attributes();
 }
 
 inline AttributeCollection ShareableElementData::Attributes() const {
diff --git a/third_party/blink/renderer/core/dom/node.cc b/third_party/blink/renderer/core/dom/node.cc
index 50815259..75454d94 100644
--- a/third_party/blink/renderer/core/dom/node.cc
+++ b/third_party/blink/renderer/core/dom/node.cc
@@ -2105,10 +2105,10 @@
 
 void Node::PrintNodePathTo(std::ostream& stream) const {
   HeapVector<Member<const Node>, 16> chain;
-  const Node* node = this;
-  while (node->ParentOrShadowHostNode()) {
-    chain.push_back(node);
-    node = node->ParentOrShadowHostNode();
+  const Node* parent_node = this;
+  while (parent_node->ParentOrShadowHostNode()) {
+    chain.push_back(parent_node);
+    parent_node = parent_node->ParentOrShadowHostNode();
   }
   for (unsigned index = chain.size(); index > 0; --index) {
     const Node* node = chain[index - 1];
diff --git a/third_party/blink/renderer/core/dom/range.cc b/third_party/blink/renderer/core/dom/range.cc
index e2f86e3c..963e3c44 100644
--- a/third_party/blink/renderer/core/dom/range.cc
+++ b/third_party/blink/renderer/core/dom/range.cc
@@ -526,8 +526,6 @@
 
 DocumentFragment* Range::ProcessContents(ActionType action,
                                          ExceptionState& exception_state) {
-  typedef HeapVector<Member<Node>> NodeVector;
-
   DocumentFragment* fragment = nullptr;
   if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS)
     fragment = DocumentFragment::Create(*owner_document_.Get());
@@ -705,7 +703,7 @@
       }
 
       Node* n = container->firstChild();
-      HeapVector<Member<Node>> nodes;
+      NodeVector nodes;
       for (unsigned i = start_offset; n && i; i--)
         n = n->nextSibling();
       for (unsigned i = start_offset; n && i < end_offset;
@@ -720,7 +718,7 @@
 }
 
 void Range::ProcessNodes(ActionType action,
-                         HeapVector<Member<Node>>& nodes,
+                         NodeVector& nodes,
                          Node* old_container,
                          Node* new_container,
                          ExceptionState& exception_state) {
@@ -747,8 +745,6 @@
     Node* cloned_container,
     Node* common_root,
     ExceptionState& exception_state) {
-  typedef HeapVector<Member<Node>> NodeVector;
-
   NodeVector ancestors;
   for (Node& runner : NodeTraversal::AncestorsOf(*container)) {
     if (runner == common_root)
diff --git a/third_party/blink/renderer/core/dom/range.h b/third_party/blink/renderer/core/dom/range.h
index e25d568..0cc5e36 100644
--- a/third_party/blink/renderer/core/dom/range.h
+++ b/third_party/blink/renderer/core/dom/range.h
@@ -194,7 +194,7 @@
                                              unsigned end_offset,
                                              ExceptionState&);
   static void ProcessNodes(ActionType,
-                           HeapVector<Member<Node>>&,
+                           NodeVector&,
                            Node* old_container,
                            Node* new_container,
                            ExceptionState&);
diff --git a/third_party/blink/renderer/core/dom/shadow_root.cc b/third_party/blink/renderer/core/dom/shadow_root.cc
index 54d246a..14230a7 100644
--- a/third_party/blink/renderer/core/dom/shadow_root.cc
+++ b/third_party/blink/renderer/core/dom/shadow_root.cc
@@ -167,8 +167,7 @@
   if (!insertion_point.isConnected())
     return kInsertionDone;
 
-  if (HasAdoptedStyleSheets())
-    GetDocument().GetStyleEngine().SetNeedsActiveStyleUpdate(*this);
+  GetDocument().GetStyleEngine().ShadowRootInsertedToDocument(*this);
 
   GetDocument().GetSlotAssignmentEngine().Connected(*this);
 
diff --git a/third_party/blink/renderer/core/exported/web_frame_test.cc b/third_party/blink/renderer/core/exported/web_frame_test.cc
index a183152..c764d75 100644
--- a/third_party/blink/renderer/core/exported/web_frame_test.cc
+++ b/third_party/blink/renderer/core/exported/web_frame_test.cc
@@ -423,7 +423,7 @@
   // WebScriptExecutionCallback:
   void Completed(const WebVector<v8::Local<v8::Value>>& values) override {
     did_complete_ = true;
-    if (!values.IsEmpty()) {
+    if (!values.empty()) {
       if (values[0]->IsString()) {
         string_value_ =
             ToCoreString(values[0]->ToString(context_).ToLocalChecked());
diff --git a/third_party/blink/renderer/core/frame/csp/csp_source.cc b/third_party/blink/renderer/core/frame/csp/csp_source.cc
index 85264b2..6d6a493 100644
--- a/third_party/blink/renderer/core/frame/csp/csp_source.cc
+++ b/third_party/blink/renderer/core/frame/csp/csp_source.cc
@@ -115,7 +115,7 @@
 bool CSPSource::HostMatches(const String& host) const {
   bool match;
 
-  bool equal_hosts = host_ == host;
+  bool equal_hosts = EqualIgnoringASCIICase(host_, host);
   if (host_wildcard_ == kHasWildcard) {
     if (host_.IsEmpty()) {
       // host-part = "*"
diff --git a/third_party/blink/renderer/core/frame/csp/csp_source_test.cc b/third_party/blink/renderer/core/frame/csp/csp_source_test.cc
index 529f86d1..8e3f0b1 100644
--- a/third_party/blink/renderer/core/frame/csp/csp_source_test.cc
+++ b/third_party/blink/renderer/core/frame/csp/csp_source_test.cc
@@ -284,6 +284,22 @@
     // Please see http://crbug.com/692505
     EXPECT_FALSE(source.Matches(KURL(base, "http://.foo.bar")));
   }
+
+  // Host matching is case-insensitive.
+  {
+    CSPSource source(csp.Get(), "", "FoO.BaR", 0, "", CSPSource::kNoWildcard,
+                     CSPSource::kNoWildcard);
+    EXPECT_TRUE(source.Matches(KURL(base, "http://foo.bar")));
+    EXPECT_FALSE(source.Matches(KURL(base, "http://sub.foo.bar")));
+  }
+
+  // Wildcarded host matching is case-insensitive.
+  {
+    CSPSource source(csp.Get(), "", "FoO.BaR", 0, "", CSPSource::kHasWildcard,
+                     CSPSource::kNoWildcard);
+    EXPECT_TRUE(source.Matches(KURL(base, "http://sub.foo.bar")));
+    EXPECT_FALSE(source.Matches(KURL(base, "http://foo.bar")));
+  }
 }
 
 TEST_F(CSPSourceTest, DoesNotSubsume) {
diff --git a/third_party/blink/renderer/core/frame/csp/source_list_directive_test.cc b/third_party/blink/renderer/core/frame/csp/source_list_directive_test.cc
index 236e891..28b4331 100644
--- a/third_party/blink/renderer/core/frame/csp/source_list_directive_test.cc
+++ b/third_party/blink/renderer/core/frame/csp/source_list_directive_test.cc
@@ -1408,4 +1408,20 @@
   }
 }
 
+TEST_F(SourceListDirectiveTest, AllowHostMixedCase) {
+  KURL base;
+  // Non-wildcard sources should match hosts case-insensitively.
+  {
+    String sources = "http://ExAmPle.com";
+    SourceListDirective source_list("default-src", sources, csp.Get());
+    EXPECT_TRUE(source_list.Allows(KURL(base, "http://example.com")));
+  }
+  // Wildcard sources should match hosts case-insensitively.
+  {
+    String sources = "http://*.ExAmPle.com";
+    SourceListDirective source_list("default-src", sources, csp.Get());
+    EXPECT_TRUE(source_list.Allows(KURL(base, "http://www.example.com")));
+  }
+}
+
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/frame/deprecation.cc b/third_party/blink/renderer/core/frame/deprecation.cc
index cc908f24..f80ae20 100644
--- a/third_party/blink/renderer/core/frame/deprecation.cc
+++ b/third_party/blink/renderer/core/frame/deprecation.cc
@@ -58,6 +58,7 @@
   kM73,
   kM74,
   kM75,
+  kM76,
 };
 
 // Returns estimated milestone dates as human-readable strings.
@@ -100,6 +101,8 @@
       return "M74, around April 2019";
     case kM75:
       return "M75, around June 2019";
+    case kM76:
+      return "M76, around July 2019";
   }
 
   NOTREACHED();
@@ -147,12 +150,32 @@
       return 1555992000000;  // April 23, 2019.
     case kM75:
       return 1559620800000;  // June 4, 2019.
+    case kM76:
+      return 1564459200000;  // Jul 30, 2019.
   }
 
   NOTREACHED();
   return 0;
 }
 
+String GetDeviceSensorDeprecationMessage(const char* event_name,
+                                         const char* status_url) {
+  static constexpr char kConcreteMessage[] =
+      "The `%s` event is deprecated on insecure origins and will be removed in "
+      "%s. Event handlers can still be registered but are no longer invoked "
+      "since %s. See %s for more details.";
+  static constexpr char kGenericMessage[] =
+      "The `%s` event is deprecated on insecure origins and will be removed. "
+      "See %s for more details.";
+
+  if (blink::RuntimeEnabledFeatures::
+          RestrictDeviceSensorEventsToSecureContextsEnabled()) {
+    return String::Format(kConcreteMessage, event_name, MilestoneString(kM76),
+                          MilestoneString(kM74), status_url);
+  }
+  return String::Format(kGenericMessage, event_name, status_url);
+}
+
 struct DeprecationInfo {
   String id;
   Milestone anticipated_removal;
@@ -281,25 +304,22 @@
 
     // Powerful features on insecure origins (https://goo.gl/rStTGz)
     case WebFeature::kDeviceMotionInsecureOrigin:
-      return {"DeviceMotionInsecureOrigin", kUnknown,
-              "The devicemotion event is deprecated on insecure origins, and "
-              "support will be removed in the future. You should consider "
-              "switching your application to a secure origin, such as HTTPS. "
-              "See https://goo.gl/rStTGz for more details."};
+      return {"DeviceMotionInsecureOrigin", kM76,
+              GetDeviceSensorDeprecationMessage(
+                  "devicemotion",
+                  "https://www.chromestatus.com/feature/5688035094036480")};
 
     case WebFeature::kDeviceOrientationInsecureOrigin:
-      return {"DeviceOrientationInsecureOrigin", kUnknown,
-              "The deviceorientation event is deprecated on insecure origins, "
-              "and support will be removed in the future. You should consider "
-              "switching your application to a secure origin, such as HTTPS. "
-              "See https://goo.gl/rStTGz for more details."};
+      return {"DeviceOrientationInsecureOrigin", kM76,
+              GetDeviceSensorDeprecationMessage(
+                  "deviceorientation",
+                  "https://www.chromestatus.com/feature/5468407470227456")};
 
     case WebFeature::kDeviceOrientationAbsoluteInsecureOrigin:
-      return {"DeviceOrientationAbsoluteInsecureOrigin", kUnknown,
-              "The deviceorientationabsolute event is deprecated on insecure "
-              "origins, and support will be removed in the future. You should "
-              "consider switching your application to a secure origin, such as "
-              "HTTPS. See https://goo.gl/rStTGz for more details."};
+      return {"DeviceOrientationAbsoluteInsecureOrigin", kM76,
+              GetDeviceSensorDeprecationMessage(
+                  "deviceorientationabsolute",
+                  "https://www.chromestatus.com/feature/5468407470227456")};
 
     case WebFeature::kGeolocationInsecureOrigin:
     case WebFeature::kGeolocationInsecureOriginIframe:
diff --git a/third_party/blink/renderer/core/frame/frame_view.h b/third_party/blink/renderer/core/frame/frame_view.h
index 429a2e0..5b70233 100644
--- a/third_party/blink/renderer/core/frame/frame_view.h
+++ b/third_party/blink/renderer/core/frame/frame_view.h
@@ -6,6 +6,7 @@
 #define THIRD_PARTY_BLINK_RENDERER_CORE_FRAME_FRAME_VIEW_H_
 
 #include "third_party/blink/renderer/core/frame/embedded_content_view.h"
+#include "third_party/blink/renderer/platform/wtf/casting.h"
 
 namespace blink {
 
@@ -22,11 +23,12 @@
   bool IsFrameView() const override { return true; }
 };
 
-DEFINE_TYPE_CASTS(FrameView,
-                  EmbeddedContentView,
-                  embedded_content_view,
-                  embedded_content_view->IsFrameView(),
-                  embedded_content_view.IsFrameView());
+template <>
+struct DowncastTraits<FrameView> {
+  static bool AllowFrom(const EmbeddedContentView& embedded_content_view) {
+    return embedded_content_view.IsFrameView();
+  }
+};
 
 }  // namespace blink
 
diff --git a/third_party/blink/renderer/core/frame/fullscreen_controller.cc b/third_party/blink/renderer/core/frame/fullscreen_controller.cc
index 3c0cb04..58c5d388 100644
--- a/third_party/blink/renderer/core/frame/fullscreen_controller.cc
+++ b/third_party/blink/renderer/core/frame/fullscreen_controller.cc
@@ -172,8 +172,7 @@
   DCHECK(state_ == State::kInitial);
   blink::WebFullscreenOptions blink_options;
   // Only clone options if the feature is enabled.
-  if (RuntimeEnabledFeatures::FullscreenOptionsEnabled())
-    blink_options.prefers_navigation_bar = options->navigationUI() != "hide";
+  blink_options.prefers_navigation_bar = options->navigationUI() != "hide";
   GetWebFrameClient(frame).EnterFullscreen(blink_options);
 
   state_ = State::kEnteringFullscreen;
diff --git a/third_party/blink/renderer/core/frame/local_frame_view.cc b/third_party/blink/renderer/core/frame/local_frame_view.cc
index 2612a2d..a159266 100644
--- a/third_party/blink/renderer/core/frame/local_frame_view.cc
+++ b/third_party/blink/renderer/core/frame/local_frame_view.cc
@@ -2187,10 +2187,9 @@
   base::AutoReset<bool> past_layout_lifecycle_resetter(
       &past_layout_lifecycle_update_, false);
 
-  // If we're throttling, then we don't need to update lifecycle phases, only
-  // the throttling status.
+  // If we're throttling, then we don't need to update lifecycle phases. The
+  // throttling status will get updated in RunPostLifecycleSteps().
   if (ShouldThrottleRendering()) {
-    UpdateThrottlingStatusForSubtree();
     return Lifecycle().GetState() == target_state;
   }
 
diff --git a/third_party/blink/renderer/core/fullscreen/document_fullscreen.idl b/third_party/blink/renderer/core/fullscreen/document_fullscreen.idl
index c99b475..cc2cd81b 100644
--- a/third_party/blink/renderer/core/fullscreen/document_fullscreen.idl
+++ b/third_party/blink/renderer/core/fullscreen/document_fullscreen.idl
@@ -24,13 +24,13 @@
 [
     ImplementedAs=DocumentFullscreen
 ] partial interface Document {
-    [LenientSetter, RuntimeEnabled=FullscreenUnprefixed] readonly attribute boolean fullscreenEnabled;
-    [LenientSetter, Unscopable, RuntimeEnabled=FullscreenUnprefixed, ImplementedAs=fullscreenElement] readonly attribute boolean fullscreen;
+    [LenientSetter] readonly attribute boolean fullscreenEnabled;
+    [LenientSetter, Unscopable, ImplementedAs=fullscreenElement] readonly attribute boolean fullscreen;
 
-    [CallWith=ScriptState, RuntimeEnabled=FullscreenUnprefixed] Promise<void> exitFullscreen();
+    [CallWith=ScriptState] Promise<void> exitFullscreen();
 
-    [RuntimeEnabled=FullscreenUnprefixed] attribute EventHandler onfullscreenchange;
-    [RuntimeEnabled=FullscreenUnprefixed] attribute EventHandler onfullscreenerror;
+    attribute EventHandler onfullscreenchange;
+    attribute EventHandler onfullscreenerror;
 
     // Mozilla version
     [MeasureAs=PrefixedDocumentIsFullscreen, ImplementedAs=fullscreenElement] readonly attribute boolean webkitIsFullScreen;
diff --git a/third_party/blink/renderer/core/fullscreen/element_fullscreen.idl b/third_party/blink/renderer/core/fullscreen/element_fullscreen.idl
index 76d2d9c7..7bfb572 100644
--- a/third_party/blink/renderer/core/fullscreen/element_fullscreen.idl
+++ b/third_party/blink/renderer/core/fullscreen/element_fullscreen.idl
@@ -7,20 +7,16 @@
 [
     ImplementedAs=ElementFullscreen
 ] partial interface Element {
-    // TODO(dtapuska): If RuntimeEnabled=FullscreenUnprefixed is shipped before RuntimeEnabled=FullscreenOptions
-    // we need to split the optional FullscreenOptions out controlled by RuntimeEnabled=FullscreenOptions
-    [CallWith=ScriptState, RuntimeEnabled=FullscreenUnprefixed] Promise<void> requestFullscreen(optional FullscreenOptions options);
+    [CallWith=ScriptState] Promise<void> requestFullscreen(optional FullscreenOptions options);
 
-    [RuntimeEnabled=FullscreenUnprefixed] attribute EventHandler onfullscreenchange;
-    [RuntimeEnabled=FullscreenUnprefixed] attribute EventHandler onfullscreenerror;
+    attribute EventHandler onfullscreenchange;
+    attribute EventHandler onfullscreenerror;
 
     // Mozilla version
-    [LogActivity, LogAllWorlds, MeasureAs=PrefixedElementRequestFullScreen, ImplementedAs=webkitRequestFullscreen] void webkitRequestFullScreen();
-    [RuntimeEnabled=FullscreenOptions, LogActivity, LogAllWorlds, MeasureAs=PrefixedElementRequestFullScreen, ImplementedAs=webkitRequestFullscreen] void webkitRequestFullScreen(FullscreenOptions options);
+    [LogActivity, LogAllWorlds, MeasureAs=PrefixedElementRequestFullScreen, ImplementedAs=webkitRequestFullscreen] void webkitRequestFullScreen(optional FullscreenOptions options);
 
     // W3C version
-    [LogActivity, LogAllWorlds, MeasureAs=PrefixedElementRequestFullscreen] void webkitRequestFullscreen();
-    [RuntimeEnabled=FullscreenOptions, LogActivity, LogAllWorlds, MeasureAs=PrefixedElementRequestFullscreen] void webkitRequestFullscreen(FullscreenOptions options);
+    [LogActivity, LogAllWorlds, MeasureAs=PrefixedElementRequestFullscreen] void webkitRequestFullscreen(optional FullscreenOptions options);
 
     attribute EventHandler onwebkitfullscreenchange;
     attribute EventHandler onwebkitfullscreenerror;
diff --git a/third_party/blink/renderer/core/fullscreen/fullscreen.cc b/third_party/blink/renderer/core/fullscreen/fullscreen.cc
index 5c3bf4f..c0a20efb 100644
--- a/third_party/blink/renderer/core/fullscreen/fullscreen.cc
+++ b/third_party/blink/renderer/core/fullscreen/fullscreen.cc
@@ -501,7 +501,7 @@
 // https://fullscreen.spec.whatwg.org/#fullscreen-element
 Element* Fullscreen::FullscreenElementForBindingFrom(TreeScope& scope) {
   Element* element = FullscreenElementFrom(scope.GetDocument());
-  if (!element || !RuntimeEnabledFeatures::FullscreenUnprefixedEnabled())
+  if (!element)
     return element;
 
   // TODO(kochi): Once V0 code is removed, we can use the same logic for
diff --git a/third_party/blink/renderer/core/fullscreen/fullscreen_options.idl b/third_party/blink/renderer/core/fullscreen/fullscreen_options.idl
index a33dc291..9664b91 100644
--- a/third_party/blink/renderer/core/fullscreen/fullscreen_options.idl
+++ b/third_party/blink/renderer/core/fullscreen/fullscreen_options.idl
@@ -11,5 +11,5 @@
 };
 
 dictionary FullscreenOptions {
-    [RuntimeEnabled=FullscreenOptions] FullscreenNavigationUI navigationUI = "auto";
+    FullscreenNavigationUI navigationUI = "auto";
 };
diff --git a/third_party/blink/renderer/core/layout/layout_embedded_content.cc b/third_party/blink/renderer/core/layout/layout_embedded_content.cc
index 007144d6d..a6fa267 100644
--- a/third_party/blink/renderer/core/layout/layout_embedded_content.cc
+++ b/third_party/blink/renderer/core/layout/layout_embedded_content.cc
@@ -88,12 +88,7 @@
 }
 
 FrameView* LayoutEmbeddedContent::ChildFrameView() const {
-  EmbeddedContentView* embedded_content_view = GetEmbeddedContentView();
-
-  if (embedded_content_view && embedded_content_view->IsFrameView())
-    return ToFrameView(embedded_content_view);
-
-  return nullptr;
+  return DynamicTo<FrameView>(GetEmbeddedContentView());
 }
 
 WebPluginContainerImpl* LayoutEmbeddedContent::Plugin() const {
diff --git a/third_party/blink/renderer/core/page/drag_controller.cc b/third_party/blink/renderer/core/page/drag_controller.cc
index 205ec9c..3226f06 100644
--- a/third_party/blink/renderer/core/page/drag_controller.cc
+++ b/third_party/blink/renderer/core/page/drag_controller.cc
@@ -141,7 +141,8 @@
 }
 
 DragController::DragController(Page* page)
-    : page_(page),
+    : ContextLifecycleObserver(nullptr),
+      page_(page),
       document_under_mouse_(nullptr),
       drag_initiator_(nullptr),
       file_input_element_under_mouse_(nullptr),
@@ -1302,6 +1303,7 @@
                                   bool for_link) {
   did_initiate_drag_ = true;
   drag_initiator_ = frame->GetDocument();
+  SetContext(drag_initiator_);
 
   // TODO(pdr): |drag_location| and |event_pos| should be passed in as
   // FloatPoints and we should calculate these adjusted values in floating
@@ -1358,12 +1360,17 @@
   return *drag_state_;
 }
 
+void DragController::ContextDestroyed(ExecutionContext*) {
+  drag_state_ = nullptr;
+}
+
 void DragController::Trace(blink::Visitor* visitor) {
   visitor->Trace(page_);
   visitor->Trace(document_under_mouse_);
   visitor->Trace(drag_initiator_);
   visitor->Trace(drag_state_);
   visitor->Trace(file_input_element_under_mouse_);
+  ContextLifecycleObserver::Trace(visitor);
 }
 
 }  // namespace blink
diff --git a/third_party/blink/renderer/core/page/drag_controller.h b/third_party/blink/renderer/core/page/drag_controller.h
index 2a99d90..3be9f92 100644
--- a/third_party/blink/renderer/core/page/drag_controller.h
+++ b/third_party/blink/renderer/core/page/drag_controller.h
@@ -29,6 +29,7 @@
 #include "base/macros.h"
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/dom/events/event_target.h"
+#include "third_party/blink/renderer/core/execution_context/context_lifecycle_observer.h"
 #include "third_party/blink/renderer/core/page/drag_actions.h"
 #include "third_party/blink/renderer/platform/geometry/int_point.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
@@ -51,7 +52,10 @@
 class WebMouseEvent;
 
 class CORE_EXPORT DragController final
-    : public GarbageCollected<DragController> {
+    : public GarbageCollected<DragController>,
+      public ContextLifecycleObserver {
+  USING_GARBAGE_COLLECTED_MIXIN(DragController);
+
  public:
   static DragController* Create(Page*);
 
@@ -89,7 +93,10 @@
   // to the visual viewport.
   static FloatRect ClippedSelection(const LocalFrame&);
 
-  void Trace(blink::Visitor*);
+  // ContextLifecycleObserver.
+  void ContextDestroyed(ExecutionContext*) final;
+
+  void Trace(blink::Visitor*) final;
 
  private:
   DispatchEventResult DispatchTextInputEventFor(LocalFrame*, DragData*);
diff --git a/third_party/blink/renderer/core/scheduler/virtual_time_test.cc b/third_party/blink/renderer/core/scheduler/virtual_time_test.cc
index 56df3ae..2174623 100644
--- a/third_party/blink/renderer/core/scheduler/virtual_time_test.cc
+++ b/third_party/blink/renderer/core/scheduler/virtual_time_test.cc
@@ -25,7 +25,7 @@
 
  private:
   void Completed(const WebVector<v8::Local<v8::Value>>& values) override {
-    if (!values.IsEmpty() && !values[0].IsEmpty() && values[0]->IsString()) {
+    if (!values.empty() && !values[0].IsEmpty() && values[0]->IsString()) {
       result_ = ToCoreString(v8::Local<v8::String>::Cast(values[0]));
     }
   }
diff --git a/third_party/blink/renderer/core/svg/svg_svg_element.cc b/third_party/blink/renderer/core/svg/svg_svg_element.cc
index ee1c8b0..1c84ccb 100644
--- a/third_party/blink/renderer/core/svg/svg_svg_element.cc
+++ b/third_party/blink/renderer/core/svg/svg_svg_element.cc
@@ -453,24 +453,24 @@
                         y_->CurrentValue()->Value(length_context));
   } else if (mode == kScreenScope) {
     if (LayoutObject* layout_object = this->GetLayoutObject()) {
-      TransformationMatrix transform;
+      TransformationMatrix matrix;
       // Adjust for the zoom level factored into CSS coordinates (WK bug
       // #96361).
-      transform.Scale(1.0 / layout_object->StyleRef().EffectiveZoom());
+      matrix.Scale(1.0 / layout_object->StyleRef().EffectiveZoom());
 
       // Apply transforms from our ancestor coordinate space, including any
       // non-SVG ancestor transforms.
-      transform.Multiply(layout_object->LocalToAbsoluteTransform());
+      matrix.Multiply(layout_object->LocalToAbsoluteTransform());
 
       // At the SVG/HTML boundary (aka LayoutSVGRoot), we need to apply the
       // localToBorderBoxTransform to map an element from SVG viewport
       // coordinates to CSS box coordinates.
-      transform.Multiply(
+      matrix.Multiply(
           ToLayoutSVGRoot(layout_object)->LocalToBorderBoxTransform());
       // Drop any potential non-affine parts, because we're not able to convey
       // that information further anyway until getScreenCTM returns a DOMMatrix
       // (4x4 matrix.)
-      return transform.ToAffineTransform();
+      return matrix.ToAffineTransform();
     }
   }
   if (!HasEmptyViewBox()) {
diff --git a/third_party/blink/renderer/core/workers/installed_scripts_manager.h b/third_party/blink/renderer/core/workers/installed_scripts_manager.h
index 6aa7363b..8242236 100644
--- a/third_party/blink/renderer/core/workers/installed_scripts_manager.h
+++ b/third_party/blink/renderer/core/workers/installed_scripts_manager.h
@@ -10,6 +10,7 @@
 #include "third_party/blink/renderer/platform/network/content_security_policy_response_headers.h"
 #include "third_party/blink/renderer/platform/network/http_header_map.h"
 #include "third_party/blink/renderer/platform/weborigin/kurl.h"
+#include "third_party/blink/renderer/platform/wtf/allocator.h"
 #include "third_party/blink/renderer/platform/wtf/vector.h"
 
 namespace blink {
@@ -17,10 +18,14 @@
 // InstalledScriptsManager provides the scripts of workers that have been
 // installed. Currently it is only used for installed service workers.
 class InstalledScriptsManager {
+  USING_FAST_MALLOC(InstalledScriptsManager);
+
  public:
   InstalledScriptsManager() = default;
 
   class CORE_EXPORT ScriptData {
+    USING_FAST_MALLOC(ScriptData);
+
    public:
     ScriptData() = default;
     ScriptData(const KURL& script_url,
diff --git a/third_party/blink/renderer/core/workers/worker_backing_thread.h b/third_party/blink/renderer/core/workers/worker_backing_thread.h
index a84b5ba..3ce3b37b 100644
--- a/third_party/blink/renderer/core/workers/worker_backing_thread.h
+++ b/third_party/blink/renderer/core/workers/worker_backing_thread.h
@@ -11,6 +11,7 @@
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/platform/heap/thread_state.h"
 #include "third_party/blink/renderer/platform/scheduler/public/thread.h"
+#include "third_party/blink/renderer/platform/wtf/allocator.h"
 #include "third_party/blink/renderer/platform/wtf/forward.h"
 #include "third_party/blink/renderer/platform/wtf/threading_primitives.h"
 #include "v8/include/v8.h"
@@ -25,6 +26,8 @@
 // InitializeOnBackingThread() to use V8 and Oilpan functionalities, and call
 // ShutdownOnBackingThread() when it no longer needs the thread.
 class CORE_EXPORT WorkerBackingThread final {
+  USING_FAST_MALLOC(WorkerBackingThread);
+
  public:
   static std::unique_ptr<WorkerBackingThread> Create(
       const ThreadCreationParams& params) {
diff --git a/third_party/blink/renderer/core/workers/worker_settings.h b/third_party/blink/renderer/core/workers/worker_settings.h
index 38165f2..09be3646 100644
--- a/third_party/blink/renderer/core/workers/worker_settings.h
+++ b/third_party/blink/renderer/core/workers/worker_settings.h
@@ -8,10 +8,13 @@
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/frame/settings.h"
 #include "third_party/blink/renderer/platform/fonts/generic_font_family_settings.h"
+#include "third_party/blink/renderer/platform/wtf/allocator.h"
 
 namespace blink {
 
 class CORE_EXPORT WorkerSettings {
+  USING_FAST_MALLOC(WorkerSettings);
+
  public:
   explicit WorkerSettings(Settings*);
   static std::unique_ptr<WorkerSettings> Copy(WorkerSettings*);
diff --git a/third_party/blink/renderer/core/xml/parser/xml_document_parser.h b/third_party/blink/renderer/core/xml/parser/xml_document_parser.h
index 244a749..f14cd57 100644
--- a/third_party/blink/renderer/core/xml/parser/xml_document_parser.h
+++ b/third_party/blink/renderer/core/xml/parser/xml_document_parser.h
@@ -36,6 +36,7 @@
 #include "third_party/blink/renderer/platform/heap/handle.h"
 #include "third_party/blink/renderer/platform/loader/fetch/resource_client.h"
 #include "third_party/blink/renderer/platform/text/segmented_string.h"
+#include "third_party/blink/renderer/platform/wtf/allocator.h"
 #include "third_party/blink/renderer/platform/wtf/compiler.h"
 #include "third_party/blink/renderer/platform/wtf/hash_map.h"
 #include "third_party/blink/renderer/platform/wtf/ref_counted.h"
@@ -52,6 +53,8 @@
 class Text;
 
 class XMLParserContext : public RefCounted<XMLParserContext> {
+  USING_FAST_MALLOC(XMLParserContext);
+
  public:
   static scoped_refptr<XMLParserContext>
   CreateMemoryParser(xmlSAXHandlerPtr, void* user_data, const CString& chunk);
diff --git a/third_party/blink/renderer/core/xmlhttprequest/xml_http_request_progress_event_throttle.h b/third_party/blink/renderer/core/xmlhttprequest/xml_http_request_progress_event_throttle.h
index d3c13af..d426d691 100644
--- a/third_party/blink/renderer/core/xmlhttprequest/xml_http_request_progress_event_throttle.h
+++ b/third_party/blink/renderer/core/xmlhttprequest/xml_http_request_progress_event_throttle.h
@@ -30,6 +30,7 @@
 #include "base/memory/scoped_refptr.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
 #include "third_party/blink/renderer/platform/timer.h"
+#include "third_party/blink/renderer/platform/wtf/allocator.h"
 #include "third_party/blink/renderer/platform/wtf/forward.h"
 
 namespace blink {
@@ -98,6 +99,8 @@
   // ProgressEvent dispatching. This class represents such a deferred
   // "progress" ProgressEvent.
   class DeferredEvent {
+    DISALLOW_NEW();
+
    public:
     DeferredEvent();
     void Set(bool length_computable,
diff --git a/third_party/blink/renderer/modules/crypto/normalize_algorithm.cc b/third_party/blink/renderer/modules/crypto/normalize_algorithm.cc
index 89e2647..94db440 100644
--- a/third_party/blink/renderer/modules/crypto/normalize_algorithm.cc
+++ b/third_party/blink/renderer/modules/crypto/normalize_algorithm.cc
@@ -346,7 +346,7 @@
   if (!GetUint8Array(raw, property_name, bytes, context, error))
     return false;
 
-  if (bytes.IsEmpty()) {
+  if (bytes.empty()) {
     // Empty BigIntegers represent 0 according to the spec
     bytes = WebVector<uint8_t>(static_cast<size_t>(1u));
     DCHECK_EQ(0u, bytes[0]);
diff --git a/third_party/blink/renderer/modules/device_orientation/device_motion_controller.cc b/third_party/blink/renderer/modules/device_orientation/device_motion_controller.cc
index 02db4eb..f9e8906 100644
--- a/third_party/blink/renderer/modules/device_orientation/device_motion_controller.cc
+++ b/third_party/blink/renderer/modules/device_orientation/device_motion_controller.cc
@@ -14,6 +14,7 @@
 #include "third_party/blink/renderer/modules/device_orientation/device_motion_event_pump.h"
 #include "third_party/blink/renderer/modules/device_orientation/device_orientation_controller.h"
 #include "third_party/blink/renderer/modules/event_modules.h"
+#include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 #include "third_party/blink/renderer/platform/weborigin/security_origin.h"
 
 namespace blink {
@@ -54,6 +55,10 @@
           HostsUsingFeatures::Feature::kDeviceMotionInsecureHost);
       if (frame->GetSettings()->GetStrictPowerfulFeatureRestrictions())
         return;
+      if (RuntimeEnabledFeatures::
+              RestrictDeviceSensorEventsToSecureContextsEnabled()) {
+        return;
+      }
     }
   }
 
diff --git a/third_party/blink/renderer/modules/device_orientation/device_motion_event.idl b/third_party/blink/renderer/modules/device_orientation/device_motion_event.idl
index 5ee0c7a..c74cb7b 100644
--- a/third_party/blink/renderer/modules/device_orientation/device_motion_event.idl
+++ b/third_party/blink/renderer/modules/device_orientation/device_motion_event.idl
@@ -27,7 +27,7 @@
 
 [
     Constructor(DOMString type, optional DeviceMotionEventInit eventInitDict),
-    Exposed=Window
+    Exposed=Window, SecureContext=RestrictDeviceSensorEventsToSecureContexts
 ] interface DeviceMotionEvent : Event {
     readonly attribute DeviceMotionEventAcceleration? acceleration;
     readonly attribute DeviceMotionEventAcceleration? accelerationIncludingGravity;
diff --git a/third_party/blink/renderer/modules/device_orientation/device_motion_event_acceleration.idl b/third_party/blink/renderer/modules/device_orientation/device_motion_event_acceleration.idl
index a613c2e..cf3cd8c 100644
--- a/third_party/blink/renderer/modules/device_orientation/device_motion_event_acceleration.idl
+++ b/third_party/blink/renderer/modules/device_orientation/device_motion_event_acceleration.idl
@@ -25,6 +25,7 @@
 
 // https://w3c.github.io/deviceorientation/spec-source-orientation.html#devicemotion
 
+[SecureContext=RestrictDeviceSensorEventsToSecureContexts]
 interface DeviceMotionEventAcceleration {
     readonly attribute double? x;
     readonly attribute double? y;
diff --git a/third_party/blink/renderer/modules/device_orientation/device_motion_event_rotation_rate.idl b/third_party/blink/renderer/modules/device_orientation/device_motion_event_rotation_rate.idl
index 1d0890a..9f0349a 100644
--- a/third_party/blink/renderer/modules/device_orientation/device_motion_event_rotation_rate.idl
+++ b/third_party/blink/renderer/modules/device_orientation/device_motion_event_rotation_rate.idl
@@ -25,6 +25,7 @@
 
 // https://w3c.github.io/deviceorientation/spec-source-orientation.html#devicemotion
 
+[SecureContext=RestrictDeviceSensorEventsToSecureContexts]
 interface DeviceMotionEventRotationRate {
     readonly attribute double? alpha;
     readonly attribute double? beta;
diff --git a/third_party/blink/renderer/modules/device_orientation/device_orientation_absolute_controller.cc b/third_party/blink/renderer/modules/device_orientation/device_orientation_absolute_controller.cc
index da94bcb..861ddff 100644
--- a/third_party/blink/renderer/modules/device_orientation/device_orientation_absolute_controller.cc
+++ b/third_party/blink/renderer/modules/device_orientation/device_orientation_absolute_controller.cc
@@ -7,6 +7,7 @@
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/frame/settings.h"
 #include "third_party/blink/renderer/modules/device_orientation/device_orientation_event_pump.h"
+#include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 
 namespace blink {
 
@@ -50,6 +51,10 @@
       // DeviceOrientationController.
       if (frame->GetSettings()->GetStrictPowerfulFeatureRestrictions())
         return;
+      if (RuntimeEnabledFeatures::
+              RestrictDeviceSensorEventsToSecureContextsEnabled()) {
+        return;
+      }
     }
   }
 
diff --git a/third_party/blink/renderer/modules/device_orientation/device_orientation_controller.cc b/third_party/blink/renderer/modules/device_orientation/device_orientation_controller.cc
index 739f01a..af46558 100644
--- a/third_party/blink/renderer/modules/device_orientation/device_orientation_controller.cc
+++ b/third_party/blink/renderer/modules/device_orientation/device_orientation_controller.cc
@@ -16,6 +16,7 @@
 #include "third_party/blink/renderer/modules/device_orientation/device_orientation_event.h"
 #include "third_party/blink/renderer/modules/device_orientation/device_orientation_event_pump.h"
 #include "third_party/blink/renderer/modules/event_modules.h"
+#include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 #include "third_party/blink/renderer/platform/weborigin/security_origin.h"
 #include "third_party/blink/renderer/platform/wtf/assertions.h"
 
@@ -68,6 +69,10 @@
               ->GetSettings()
               ->GetStrictPowerfulFeatureRestrictions())
         return;
+      if (RuntimeEnabledFeatures::
+              RestrictDeviceSensorEventsToSecureContextsEnabled()) {
+        return;
+      }
     }
   }
 
diff --git a/third_party/blink/renderer/modules/device_orientation/device_orientation_event.idl b/third_party/blink/renderer/modules/device_orientation/device_orientation_event.idl
index 3c122ee..7577eba 100644
--- a/third_party/blink/renderer/modules/device_orientation/device_orientation_event.idl
+++ b/third_party/blink/renderer/modules/device_orientation/device_orientation_event.idl
@@ -27,7 +27,7 @@
 
 [
     Constructor(DOMString type, optional DeviceOrientationEventInit eventInitDict),
-    Exposed=Window
+    Exposed=Window, SecureContext=RestrictDeviceSensorEventsToSecureContexts
 ] interface DeviceOrientationEvent : Event {
     readonly attribute double? alpha;
     readonly attribute double? beta;
diff --git a/third_party/blink/renderer/modules/encryptedmedia/media_key_system_access.cc b/third_party/blink/renderer/modules/encryptedmedia/media_key_system_access.cc
index f6d8df05..f412eb8 100644
--- a/third_party/blink/renderer/modules/encryptedmedia/media_key_system_access.cc
+++ b/third_party/blink/renderer/modules/encryptedmedia/media_key_system_access.cc
@@ -127,13 +127,13 @@
   MediaKeySystemConfiguration* result = MediaKeySystemConfiguration::Create();
   // |initDataTypes|, |audioCapabilities|, and |videoCapabilities| can only be
   // empty if they were not present in the requested configuration.
-  if (!configuration.init_data_types.IsEmpty())
+  if (!configuration.init_data_types.empty())
     result->setInitDataTypes(
         ConvertInitDataTypes(configuration.init_data_types));
-  if (!configuration.audio_capabilities.IsEmpty())
+  if (!configuration.audio_capabilities.empty())
     result->setAudioCapabilities(
         ConvertCapabilities(configuration.audio_capabilities));
-  if (!configuration.video_capabilities.IsEmpty())
+  if (!configuration.video_capabilities.empty())
     result->setVideoCapabilities(
         ConvertCapabilities(configuration.video_capabilities));
 
diff --git a/third_party/blink/renderer/modules/service_worker/service_worker_script_cached_metadata_handler.cc b/third_party/blink/renderer/modules/service_worker/service_worker_script_cached_metadata_handler.cc
index 7824b25..fc05eac 100644
--- a/third_party/blink/renderer/modules/service_worker/service_worker_script_cached_metadata_handler.cc
+++ b/third_party/blink/renderer/modules/service_worker/service_worker_script_cached_metadata_handler.cc
@@ -77,9 +77,13 @@
     return;
   const String dump_name = dump_prefix + "/service_worker";
   auto* dump = pmd->CreateMemoryAllocatorDump(dump_name);
-  dump->AddScalar("size", "bytes", cached_metadata_->SerializedData().size());
+  dump->AddScalar("size", "bytes", GetCodeCacheSize());
   pmd->AddSuballocation(dump->Guid(),
                         String(WTF::Partitions::kAllocatedObjectPoolName));
 }
 
+size_t ServiceWorkerScriptCachedMetadataHandler::GetCodeCacheSize() const {
+  return (cached_metadata_) ? cached_metadata_->SerializedData().size() : 0;
+}
+
 }  // namespace blink
diff --git a/third_party/blink/renderer/modules/service_worker/service_worker_script_cached_metadata_handler.h b/third_party/blink/renderer/modules/service_worker/service_worker_script_cached_metadata_handler.h
index b7d47cfc..d395583 100644
--- a/third_party/blink/renderer/modules/service_worker/service_worker_script_cached_metadata_handler.h
+++ b/third_party/blink/renderer/modules/service_worker/service_worker_script_cached_metadata_handler.h
@@ -43,6 +43,7 @@
   bool IsServedFromCacheStorage() const override;
   void OnMemoryDump(WebProcessMemoryDump* pmd,
                     const String& dump_prefix) const override;
+  size_t GetCodeCacheSize() const override;
 
  private:
   Member<WorkerGlobalScope> worker_global_scope_;
diff --git a/third_party/blink/renderer/platform/exported/web_runtime_features.cc b/third_party/blink/renderer/platform/exported/web_runtime_features.cc
index ad41e3e..1573bf49 100644
--- a/third_party/blink/renderer/platform/exported/web_runtime_features.cc
+++ b/third_party/blink/renderer/platform/exported/web_runtime_features.cc
@@ -488,6 +488,12 @@
   RuntimeEnabledFeatures::SetResourceLoadSchedulerEnabled(enable);
 }
 
+void WebRuntimeFeatures::EnableRestrictDeviceSensorEventsToSecureContexts(
+    bool enable) {
+  RuntimeEnabledFeatures::SetRestrictDeviceSensorEventsToSecureContextsEnabled(
+      enable);
+}
+
 void WebRuntimeFeatures::EnableRestrictLazyFrameLoadingToDataSaver(
     bool enable) {
   RuntimeEnabledFeatures::SetRestrictLazyFrameLoadingToDataSaverEnabled(enable);
diff --git a/third_party/blink/renderer/platform/loader/fetch/cached_metadata_handler.h b/third_party/blink/renderer/platform/loader/fetch/cached_metadata_handler.h
index aa0e6a6..ed47029 100644
--- a/third_party/blink/renderer/platform/loader/fetch/cached_metadata_handler.h
+++ b/third_party/blink/renderer/platform/loader/fetch/cached_metadata_handler.h
@@ -72,6 +72,8 @@
   virtual void OnMemoryDump(WebProcessMemoryDump* pmd,
                             const String& dump_prefix) const = 0;
 
+  virtual size_t GetCodeCacheSize() const = 0;
+
  protected:
   CachedMetadataHandler() = default;
 };
diff --git a/third_party/blink/renderer/platform/loader/fetch/memory_cache.cc b/third_party/blink/renderer/platform/loader/fetch/memory_cache.cc
index ef241aa..3b01396 100644
--- a/third_party/blink/renderer/platform/loader/fetch/memory_cache.cc
+++ b/third_party/blink/renderer/platform/loader/fetch/memory_cache.cc
@@ -297,6 +297,7 @@
   decoded_size += o->DecodedSize();
   encoded_size += o->EncodedSize();
   overhead_size += o->OverheadSize();
+  code_cache_size += o->CodeCacheSize();
   encoded_size_duplicated_in_data_urls +=
       o->Url().ProtocolIsData() ? o->EncodedSize() : 0;
 }
@@ -428,8 +429,11 @@
     dump5->AddScalar("size", "bytes",
                      stats.fonts.encoded_size + stats.fonts.overhead_size);
     WebMemoryAllocatorDump* dump6 =
+        memory_dump->CreateMemoryAllocatorDump("web_cache/Code_cache");
+    dump6->AddScalar("size", "bytes", stats.scripts.code_cache_size);
+    WebMemoryAllocatorDump* dump7 =
         memory_dump->CreateMemoryAllocatorDump("web_cache/Other_resources");
-    dump6->AddScalar("size", "bytes",
+    dump7->AddScalar("size", "bytes",
                      stats.other.encoded_size + stats.other.overhead_size);
     return true;
   }
diff --git a/third_party/blink/renderer/platform/loader/fetch/memory_cache.h b/third_party/blink/renderer/platform/loader/fetch/memory_cache.h
index e8b66bf..3ac7b875 100644
--- a/third_party/blink/renderer/platform/loader/fetch/memory_cache.h
+++ b/third_party/blink/renderer/platform/loader/fetch/memory_cache.h
@@ -91,6 +91,7 @@
     size_t decoded_size;
     size_t encoded_size;
     size_t overhead_size;
+    size_t code_cache_size;
     size_t encoded_size_duplicated_in_data_urls;
 
     TypeStatistic()
@@ -99,6 +100,7 @@
           decoded_size(0),
           encoded_size(0),
           overhead_size(0),
+          code_cache_size(0),
           encoded_size_duplicated_in_data_urls(0) {}
 
     void AddResource(Resource*);
diff --git a/third_party/blink/renderer/platform/loader/fetch/resource.h b/third_party/blink/renderer/platform/loader/fetch/resource.h
index 8a37949..4fd6b2d1 100644
--- a/third_party/blink/renderer/platform/loader/fetch/resource.h
+++ b/third_party/blink/renderer/platform/loader/fetch/resource.h
@@ -233,6 +233,9 @@
 
   size_t DecodedSize() const { return decoded_size_; }
   size_t OverheadSize() const { return overhead_size_; }
+  size_t CodeCacheSize() const {
+    return (cache_handler_) ? cache_handler_->GetCodeCacheSize() : 0;
+  }
 
   bool IsLoaded() const { return status_ > ResourceStatus::kPending; }
 
diff --git a/third_party/blink/renderer/platform/loader/fetch/resource_fetcher.cc b/third_party/blink/renderer/platform/loader/fetch/resource_fetcher.cc
index c79c67c..007bb57e 100644
--- a/third_party/blink/renderer/platform/loader/fetch/resource_fetcher.cc
+++ b/third_party/blink/renderer/platform/loader/fetch/resource_fetcher.cc
@@ -61,7 +61,6 @@
 #include "third_party/blink/renderer/platform/mhtml/archive_resource.h"
 #include "third_party/blink/renderer/platform/mhtml/mhtml_archive.h"
 #include "third_party/blink/renderer/platform/network/encoded_form_data.h"
-#include "third_party/blink/renderer/platform/network/network_instrumentation.h"
 #include "third_party/blink/renderer/platform/network/network_utils.h"
 #include "third_party/blink/renderer/platform/probe/platform_probes.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
@@ -255,6 +254,32 @@
          stale_while_revalidate_allow_hosts->Find(host) != kNotFound;
 }
 
+std::unique_ptr<TracedValue> UrlForTraceEvent(const KURL& url) {
+  std::unique_ptr<TracedValue> value = TracedValue::Create();
+  value->SetString("url", url.GetString());
+  return value;
+}
+
+std::unique_ptr<TracedValue> BeginResourceLoadData(
+    const blink::ResourceRequest& request) {
+  std::unique_ptr<TracedValue> value = TracedValue::Create();
+  value->SetString("url", request.Url().GetString());
+  return value;
+}
+
+std::unique_ptr<TracedValue> EndResourceLoadFailData() {
+  std::unique_ptr<TracedValue> value = TracedValue::Create();
+  value->SetString("outcome", "Fail");
+  return value;
+}
+
+std::unique_ptr<TracedValue> ResourcePrioritySetData(
+    blink::ResourceLoadPriority priority) {
+  std::unique_ptr<TracedValue> value = TracedValue::Create();
+  value->SetInteger("priority", static_cast<int>(priority));
+  return value;
+}
+
 }  // namespace
 
 ResourceFetcherInit::ResourceFetcherInit(
@@ -585,12 +610,6 @@
       false);
 }
 
-static std::unique_ptr<TracedValue> UrlForTraceEvent(const KURL& url) {
-  std::unique_ptr<TracedValue> value = TracedValue::Create();
-  value->SetString("url", url.GetString());
-  return value;
-}
-
 Resource* ResourceFetcher::ResourceForStaticData(
     const FetchParameters& params,
     const ResourceFactory& factory) {
@@ -815,8 +834,10 @@
 
   Context().AddAdditionalRequestHeaders(resource_request);
 
-  network_instrumentation::ResourcePrioritySet(identifier,
-                                               resource_request.Priority());
+  TRACE_EVENT_NESTABLE_ASYNC_INSTANT1(
+      TRACE_DISABLED_BY_DEFAULT("network"), "ResourcePrioritySet",
+      TRACE_ID_WITH_SCOPE("BlinkResourceID", TRACE_ID_LOCAL(identifier)),
+      "data", ResourcePrioritySetData(resource_request.Priority()));
 
   KURL url = MemoryCache::RemoveFragmentIdentifierIfNeeded(params.Url());
   base::Optional<ResourceRequestBlockedReason> blocked_reason =
@@ -871,8 +892,10 @@
                                            ResourceClient* client) {
   unsigned long identifier = CreateUniqueIdentifier();
   ResourceRequest& resource_request = params.MutableResourceRequest();
-  network_instrumentation::ScopedResourceLoadTracker
-      scoped_resource_load_tracker(identifier, resource_request);
+  TRACE_EVENT_NESTABLE_ASYNC_BEGIN1(
+      TRACE_DISABLED_BY_DEFAULT("network"), "ResourceLoad",
+      TRACE_ID_WITH_SCOPE("BlinkResourceID", TRACE_ID_LOCAL(identifier)),
+      "beginData", BeginResourceLoadData(resource_request));
   SCOPED_BLINK_UMA_HISTOGRAM_TIMER_THREAD_SAFE(
       "Blink.Fetch.RequestResourceTime");
   TRACE_EVENT1("blink", "ResourceFetcher::requestResource", "url",
@@ -1040,9 +1063,12 @@
   if (policy != kUse)
     InsertAsPreloadIfNecessary(resource, params, resource_type);
 
-  if (resource->Identifier() == identifier &&
-      (resource->StillNeedsLoad() || resource->IsLoading())) {
-    scoped_resource_load_tracker.ResourceLoadContinuesBeyondScope();
+  if (resource->Identifier() != identifier ||
+      (!resource->StillNeedsLoad() && !resource->IsLoading())) {
+    TRACE_EVENT_NESTABLE_ASYNC_END1(
+        TRACE_DISABLED_BY_DEFAULT("network"), "ResourceLoad",
+        TRACE_ID_WITH_SCOPE("BlinkResourceID", TRACE_ID_LOCAL(identifier)),
+        "endData", EndResourceLoadFailData());
   }
 
   return resource;
@@ -1933,8 +1959,11 @@
 
     resource->DidChangePriority(resource_load_priority,
                                 resource_priority.intra_priority_value);
-    network_instrumentation::ResourcePrioritySet(resource->Identifier(),
-                                                 resource_load_priority);
+    TRACE_EVENT_NESTABLE_ASYNC_INSTANT1(
+        TRACE_DISABLED_BY_DEFAULT("network"), "ResourcePrioritySet",
+        TRACE_ID_WITH_SCOPE("BlinkResourceID",
+                            TRACE_ID_LOCAL(resource->Identifier())),
+        "data", ResourcePrioritySetData(resource_load_priority));
     Context().DispatchDidChangeResourcePriority(
         resource->Identifier(), resource_load_priority,
         resource_priority.intra_priority_value);
diff --git a/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc b/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc
index a524c807..2e76ed0 100644
--- a/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc
+++ b/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc
@@ -48,6 +48,8 @@
 #include "third_party/blink/public/platform/web_url_response.h"
 #include "third_party/blink/renderer/platform/exported/wrapped_resource_request.h"
 #include "third_party/blink/renderer/platform/exported/wrapped_resource_response.h"
+#include "third_party/blink/renderer/platform/instrumentation/tracing/trace_event.h"
+#include "third_party/blink/renderer/platform/instrumentation/tracing/traced_value.h"
 #include "third_party/blink/renderer/platform/loader/cors/cors.h"
 #include "third_party/blink/renderer/platform/loader/cors/cors_error_string.h"
 #include "third_party/blink/renderer/platform/loader/fetch/bytes_consumer_for_data_consumer_handle.h"
@@ -63,7 +65,6 @@
 #include "third_party/blink/renderer/platform/network/http_names.h"
 #include "third_party/blink/renderer/platform/network/http_parsers.h"
 #include "third_party/blink/renderer/platform/network/mime/mime_type_registry.h"
-#include "third_party/blink/renderer/platform/network/network_instrumentation.h"
 #include "third_party/blink/renderer/platform/network/network_utils.h"
 #include "third_party/blink/renderer/platform/runtime_enabled_features.h"
 #include "third_party/blink/renderer/platform/scheduler/public/thread_scheduler.h"
@@ -79,6 +80,22 @@
 
 namespace {
 
+enum RequestOutcome { kSuccess, kFail };
+
+std::unique_ptr<TracedValue> EndResourceLoadData(RequestOutcome outcome) {
+  std::unique_ptr<TracedValue> value = TracedValue::Create();
+  switch (outcome) {
+    case RequestOutcome::kSuccess:
+      value->SetString("outcome", "Success");
+      break;
+    case RequestOutcome::kFail:
+      value->SetString("outcome", "Fail");
+      break;
+  }
+
+  return value;
+}
+
 bool IsThrottlableRequestContext(mojom::RequestContextType context) {
   // Requests that could run long should not be throttled as they
   // may stay there forever and avoid other requests from making
@@ -1081,9 +1098,11 @@
 }
 
 void ResourceLoader::DidFinishLoadingFirstPartInMultipart() {
-  network_instrumentation::EndResourceLoad(
-      resource_->Identifier(),
-      network_instrumentation::RequestOutcome::kSuccess);
+  TRACE_EVENT_NESTABLE_ASYNC_END1(
+      TRACE_DISABLED_BY_DEFAULT("network"), "ResourceLoad",
+      TRACE_ID_WITH_SCOPE("BlinkResourceID",
+                          TRACE_ID_LOCAL(resource_->Identifier())),
+      "endData", EndResourceLoadData(RequestOutcome::kSuccess));
 
   fetcher_->HandleLoaderFinish(
       resource_.Get(), TimeTicks(),
@@ -1122,9 +1141,11 @@
   has_seen_end_of_body_ = false;
   deferred_finish_loading_info_ = base::nullopt;
 
-  network_instrumentation::EndResourceLoad(
-      resource_->Identifier(),
-      network_instrumentation::RequestOutcome::kSuccess);
+  TRACE_EVENT_NESTABLE_ASYNC_END1(
+      TRACE_DISABLED_BY_DEFAULT("network"), "ResourceLoad",
+      TRACE_ID_WITH_SCOPE("BlinkResourceID",
+                          TRACE_ID_LOCAL(resource_->Identifier())),
+      "endData", EndResourceLoadData(RequestOutcome::kSuccess));
 
   fetcher_->HandleLoaderFinish(
       resource_.Get(), finish_time, ResourceFetcher::kDidFinishLoading,
@@ -1182,8 +1203,11 @@
   has_seen_end_of_body_ = false;
   deferred_finish_loading_info_ = base::nullopt;
 
-  network_instrumentation::EndResourceLoad(
-      resource_->Identifier(), network_instrumentation::RequestOutcome::kFail);
+  TRACE_EVENT_NESTABLE_ASYNC_END1(
+      TRACE_DISABLED_BY_DEFAULT("network"), "ResourceLoad",
+      TRACE_ID_WITH_SCOPE("BlinkResourceID",
+                          TRACE_ID_LOCAL(resource_->Identifier())),
+      "endData", EndResourceLoadData(RequestOutcome::kFail));
 
   fetcher_->HandleLoaderError(resource_.Get(), error,
                               inflight_keepalive_bytes_);
diff --git a/third_party/blink/renderer/platform/loader/fetch/script_cached_metadata_handler.cc b/third_party/blink/renderer/platform/loader/fetch/script_cached_metadata_handler.cc
index 040273e..f22afec2 100644
--- a/third_party/blink/renderer/platform/loader/fetch/script_cached_metadata_handler.cc
+++ b/third_party/blink/renderer/platform/loader/fetch/script_cached_metadata_handler.cc
@@ -71,11 +71,15 @@
     return;
   const String dump_name = dump_prefix + "/script";
   auto* dump = pmd->CreateMemoryAllocatorDump(dump_name);
-  dump->AddScalar("size", "bytes", cached_metadata_->SerializedData().size());
+  dump->AddScalar("size", "bytes", GetCodeCacheSize());
   pmd->AddSuballocation(dump->Guid(),
                         String(WTF::Partitions::kAllocatedObjectPoolName));
 }
 
+size_t ScriptCachedMetadataHandler::GetCodeCacheSize() const {
+  return (cached_metadata_) ? cached_metadata_->SerializedData().size() : 0;
+}
+
 void ScriptCachedMetadataHandler::SendToPlatform() {
   if (cached_metadata_) {
     const Vector<uint8_t>& serialized_data = cached_metadata_->SerializedData();
diff --git a/third_party/blink/renderer/platform/loader/fetch/script_cached_metadata_handler.h b/third_party/blink/renderer/platform/loader/fetch/script_cached_metadata_handler.h
index db1e8d8..75c0ee96 100644
--- a/third_party/blink/renderer/platform/loader/fetch/script_cached_metadata_handler.h
+++ b/third_party/blink/renderer/platform/loader/fetch/script_cached_metadata_handler.h
@@ -53,6 +53,7 @@
 
   // Sets the serialized metadata retrieved from the platform's cache.
   void SetSerializedCachedMetadata(const uint8_t*, size_t);
+  size_t GetCodeCacheSize() const override;
 
  private:
   void SendToPlatform();
diff --git a/third_party/blink/renderer/platform/loader/fetch/source_keyed_cached_metadata_handler.cc b/third_party/blink/renderer/platform/loader/fetch/source_keyed_cached_metadata_handler.cc
index aa0933c..48ba0ba 100644
--- a/third_party/blink/renderer/platform/loader/fetch/source_keyed_cached_metadata_handler.cc
+++ b/third_party/blink/renderer/platform/loader/fetch/source_keyed_cached_metadata_handler.cc
@@ -63,6 +63,11 @@
     // No memory to report here because it is attributed to |parent_|.
   }
 
+  size_t GetCodeCacheSize() const override {
+    // No need to implement this because it is attributed to |parent_|.
+    return 0;
+  }
+
  private:
   Member<SourceKeyedCachedMetadataHandler> parent_;
   Key key_;
diff --git a/third_party/blink/renderer/platform/loader/fetch/source_keyed_cached_metadata_handler.h b/third_party/blink/renderer/platform/loader/fetch/source_keyed_cached_metadata_handler.h
index f731b4e..b3af2d9 100644
--- a/third_party/blink/renderer/platform/loader/fetch/source_keyed_cached_metadata_handler.h
+++ b/third_party/blink/renderer/platform/loader/fetch/source_keyed_cached_metadata_handler.h
@@ -40,6 +40,11 @@
   }
   void OnMemoryDump(WebProcessMemoryDump* pmd,
                     const String& dump_prefix) const override;
+  size_t GetCodeCacheSize() const override {
+    // No need to implement this as inline scripts are not kept in
+    // blink::MemoryCache
+    return 0;
+  }
 
   void SetSerializedCachedMetadata(const uint8_t*, size_t);
 
diff --git a/third_party/blink/renderer/platform/loader/testing/mock_resource.h b/third_party/blink/renderer/platform/loader/testing/mock_resource.h
index c5e1974..da535a14 100644
--- a/third_party/blink/renderer/platform/loader/testing/mock_resource.h
+++ b/third_party/blink/renderer/platform/loader/testing/mock_resource.h
@@ -29,6 +29,7 @@
   bool IsServedFromCacheStorage() const override { return false; }
   void OnMemoryDump(WebProcessMemoryDump* pmd,
                     const String& dump_prefix) const override {}
+  size_t GetCodeCacheSize() const override { return 0; }
 
  private:
   std::unique_ptr<CachedMetadataSender> send_callback_;
diff --git a/third_party/blink/renderer/platform/network/BUILD.gn b/third_party/blink/renderer/platform/network/BUILD.gn
index 8db01f6..ed51c82 100644
--- a/third_party/blink/renderer/platform/network/BUILD.gn
+++ b/third_party/blink/renderer/platform/network/BUILD.gn
@@ -49,8 +49,6 @@
     "mime/mime_type_registry.h",
     "network_hints.cc",
     "network_hints.h",
-    "network_instrumentation.cc",
-    "network_instrumentation.h",
     "network_log.h",
     "network_state_notifier.cc",
     "network_state_notifier.h",
diff --git a/third_party/blink/renderer/platform/network/network_instrumentation.cc b/third_party/blink/renderer/platform/network/network_instrumentation.cc
deleted file mode 100644
index cf4f6a2..0000000
--- a/third_party/blink/renderer/platform/network/network_instrumentation.cc
+++ /dev/null
@@ -1,100 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "third_party/blink/renderer/platform/network/network_instrumentation.h"
-
-#include "base/trace_event/trace_event.h"
-#include "third_party/blink/renderer/platform/instrumentation/tracing/traced_value.h"
-#include "third_party/blink/renderer/platform/loader/fetch/resource_load_priority.h"
-#include "third_party/blink/renderer/platform/loader/fetch/resource_request.h"
-
-namespace blink {
-namespace network_instrumentation {
-
-using network_instrumentation::RequestOutcome;
-using blink::TracedValue;
-
-const char kBlinkResourceID[] = "BlinkResourceID";
-const char kResourceLoadTitle[] = "ResourceLoad";
-const char kResourcePrioritySetTitle[] = "ResourcePrioritySet";
-constexpr const char kNetInstrumentationCategory[] =
-    TRACE_DISABLED_BY_DEFAULT("network");
-
-const char* RequestOutcomeToString(RequestOutcome outcome) {
-  switch (outcome) {
-    case RequestOutcome::kSuccess:
-      return "Success";
-    case RequestOutcome::kFail:
-      return "Fail";
-    default:
-      NOTREACHED();
-      // We need to return something to avoid compiler warning.
-      return "This should never happen";
-  }
-}
-
-// Note: network_instrumentation code should do as much work as possible inside
-// the arguments of trace macros so that very little instrumentation overhead is
-// incurred if the trace category is disabled. See https://crbug.com/669666.
-
-namespace {
-
-std::unique_ptr<TracedValue> ScopedResourceTrackerBeginData(
-    const blink::ResourceRequest& request) {
-  std::unique_ptr<TracedValue> data = TracedValue::Create();
-  data->SetString("url", request.Url().GetString());
-  return data;
-}
-
-std::unique_ptr<TracedValue> ResourcePrioritySetData(
-    blink::ResourceLoadPriority priority) {
-  std::unique_ptr<TracedValue> data = TracedValue::Create();
-  data->SetInteger("priority", static_cast<int>(priority));
-  return data;
-}
-
-std::unique_ptr<TracedValue> EndResourceLoadData(RequestOutcome outcome) {
-  std::unique_ptr<TracedValue> data = TracedValue::Create();
-  data->SetString("outcome", RequestOutcomeToString(outcome));
-  return data;
-}
-
-}  // namespace
-
-ScopedResourceLoadTracker::ScopedResourceLoadTracker(
-    unsigned long resource_id,
-    const blink::ResourceRequest& request)
-    : resource_load_continues_beyond_scope_(false), resource_id_(resource_id) {
-  TRACE_EVENT_NESTABLE_ASYNC_BEGIN1(
-      kNetInstrumentationCategory, kResourceLoadTitle,
-      TRACE_ID_WITH_SCOPE(kBlinkResourceID, TRACE_ID_LOCAL(resource_id)),
-      "beginData", ScopedResourceTrackerBeginData(request));
-}
-
-ScopedResourceLoadTracker::~ScopedResourceLoadTracker() {
-  if (!resource_load_continues_beyond_scope_)
-    EndResourceLoad(resource_id_, RequestOutcome::kFail);
-}
-
-void ScopedResourceLoadTracker::ResourceLoadContinuesBeyondScope() {
-  resource_load_continues_beyond_scope_ = true;
-}
-
-void ResourcePrioritySet(unsigned long resource_id,
-                         blink::ResourceLoadPriority priority) {
-  TRACE_EVENT_NESTABLE_ASYNC_INSTANT1(
-      kNetInstrumentationCategory, kResourcePrioritySetTitle,
-      TRACE_ID_WITH_SCOPE(kBlinkResourceID, TRACE_ID_LOCAL(resource_id)),
-      "data", ResourcePrioritySetData(priority));
-}
-
-void EndResourceLoad(unsigned long resource_id, RequestOutcome outcome) {
-  TRACE_EVENT_NESTABLE_ASYNC_END1(
-      kNetInstrumentationCategory, kResourceLoadTitle,
-      TRACE_ID_WITH_SCOPE(kBlinkResourceID, TRACE_ID_LOCAL(resource_id)),
-      "endData", EndResourceLoadData(outcome));
-}
-
-}  // namespace network_instrumentation
-}  // namespace blink
diff --git a/third_party/blink/renderer/platform/network/network_instrumentation.h b/third_party/blink/renderer/platform/network/network_instrumentation.h
deleted file mode 100644
index 0c4f3873..0000000
--- a/third_party/blink/renderer/platform/network/network_instrumentation.h
+++ /dev/null
@@ -1,43 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef THIRD_PARTY_BLINK_RENDERER_PLATFORM_NETWORK_NETWORK_INSTRUMENTATION_H_
-#define THIRD_PARTY_BLINK_RENDERER_PLATFORM_NETWORK_NETWORK_INSTRUMENTATION_H_
-
-#include "third_party/blink/renderer/platform/loader/fetch/resource_load_priority.h"
-#include "third_party/blink/renderer/platform/platform_export.h"
-
-namespace blink {
-
-class ResourceRequest;
-
-namespace network_instrumentation {
-
-enum RequestOutcome { kSuccess, kFail };
-
-class PLATFORM_EXPORT ScopedResourceLoadTracker {
- public:
-  ScopedResourceLoadTracker(unsigned long resource_id,
-                            const blink::ResourceRequest&);
-  ~ScopedResourceLoadTracker();
-  void ResourceLoadContinuesBeyondScope();
-
- private:
-  // If this variable is false, close resource load slice at end of scope.
-  bool resource_load_continues_beyond_scope_;
-
-  const unsigned long resource_id_;
-
-  DISALLOW_COPY_AND_ASSIGN(ScopedResourceLoadTracker);
-};
-
-void PLATFORM_EXPORT ResourcePrioritySet(unsigned long resource_id,
-                                         blink::ResourceLoadPriority);
-
-void PLATFORM_EXPORT EndResourceLoad(unsigned long resource_id, RequestOutcome);
-
-}  // namespace network_instrumentation
-}  // namespace blink
-
-#endif  // THIRD_PARTY_BLINK_RENDERER_PLATFORM_NETWORK_NETWORK_INSTRUMENTATION_H_
diff --git a/third_party/blink/renderer/platform/runtime_enabled_features.json5 b/third_party/blink/renderer/platform/runtime_enabled_features.json5
index 20d28e95..8192c207e 100644
--- a/third_party/blink/renderer/platform/runtime_enabled_features.json5
+++ b/third_party/blink/renderer/platform/runtime_enabled_features.json5
@@ -571,15 +571,6 @@
       status: "experimental",
     },
     {
-      name: "FullscreenOptions",
-      status: "stable",
-    },
-    {
-      name: "FullscreenUnprefixed",
-      settable_from_internals: true,
-      status: "stable",
-    },
-    {
       name: "GamepadButtonAxisEvents",
       status: "experimental",
     },
@@ -1145,6 +1136,10 @@
       status: "stable",
     },
     {
+      // Controlled through the base::Feature with the same name.
+      name: "RestrictDeviceSensorEventsToSecureContexts",
+    },
+    {
       name: "RestrictLazyFrameLoadingToDataSaver",
     },
     {
diff --git a/third_party/blink/renderer/platform/web_vector_test.cc b/third_party/blink/renderer/platform/web_vector_test.cc
index 6066cbd5..790c49a 100644
--- a/third_party/blink/renderer/platform/web_vector_test.cc
+++ b/third_party/blink/renderer/platform/web_vector_test.cc
@@ -49,13 +49,13 @@
     EXPECT_EQ(input[i], output[i]);
 }
 
-TEST(WebVectorTest, IsEmpty) {
+TEST(WebVectorTest, Empty) {
   WebVector<int> vector;
-  ASSERT_TRUE(vector.IsEmpty());
+  ASSERT_TRUE(vector.empty());
   int value = 1;
   vector.Assign(&value, 1);
   ASSERT_EQ(1u, vector.size());
-  ASSERT_FALSE(vector.IsEmpty());
+  ASSERT_FALSE(vector.empty());
 }
 
 TEST(WebVectorTest, Swap) {
diff --git a/third_party/blink/web_tests/MSANExpectations b/third_party/blink/web_tests/MSANExpectations
index 43c64339..060e78a 100644
--- a/third_party/blink/web_tests/MSANExpectations
+++ b/third_party/blink/web_tests/MSANExpectations
@@ -239,3 +239,6 @@
 crbug.com/856601 [ Linux ] virtual/omt-worker-fetch/external/wpt/resource-timing/idlharness.any.html [ Pass Timeout ]
 crbug.com/856601 [ Linux ] virtual/speech-with-unified-autoplay/external/wpt/speech-api/idlharness.window.html [ Pass Timeout ]
 crbug.com/856601 [ Linux ] virtual/unified-autoplay/external/wpt/feature-policy/idlharness.window.html [ Pass Timeout ]
+
+# Sheriff 2019-02-22
+crbug.com/929122 [ Linux ] external/wpt/html/dom/interfaces.worker.html [ Timeout ]
diff --git a/third_party/blink/web_tests/TestExpectations b/third_party/blink/web_tests/TestExpectations
index 794e898e..298f229 100644
--- a/third_party/blink/web_tests/TestExpectations
+++ b/third_party/blink/web_tests/TestExpectations
@@ -3013,6 +3013,15 @@
 crbug.com/918664 external/wpt/css/vendor-imports/mozilla/mozilla-central-reftests/sizing/block-size-with-min-or-max-content-table-1a.html [ Failure Pass ]
 
 # ====== New tests from wpt-importer added here ======
+crbug.com/626703 [ Retina ] virtual/disabled-service-worker-servicification/external/wpt/service-workers/service-worker/clients-matchall-include-uncontrolled.https.html [ Timeout ]
+crbug.com/626703 [ Retina ] virtual/disabled-service-worker-servicification/external/wpt/service-workers/service-worker/clients-matchall-exact-controller.https.html [ Timeout ]
+crbug.com/626703 [ Retina ] virtual/disabled-service-worker-servicification/external/wpt/service-workers/service-worker/claim-with-redirect.https.html [ Timeout ]
+crbug.com/626703 [ Retina ] virtual/disabled-service-worker-servicification/external/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/close.https.html [ Timeout ]
+crbug.com/626703 [ Retina ] virtual/feature-policy-permissions/external/wpt/mediacapture-streams/MediaStreamTrack-getCapabilities.https.html [ Timeout ]
+crbug.com/626703 [ Retina ] virtual/disabled-service-worker-servicification/external/wpt/service-workers/service-worker/ServiceWorkerGlobalScope/extendable-message-event.https.html [ Timeout ]
+crbug.com/626703 [ Retina ] virtual/disabled-service-worker-servicification/external/wpt/service-workers/service-worker/navigation-redirect.https.html?client [ Timeout ]
+crbug.com/626703 [ Retina ] virtual/disabled-service-worker-servicification/external/wpt/service-workers/service-worker/multiple-update.https.html [ Timeout ]
+crbug.com/626703 [ Retina ] virtual/disabled-service-worker-servicification/external/wpt/service-workers/service-worker/update.https.html [ Timeout ]
 crbug.com/626703 external/wpt/reporting/disconnect.html [ Timeout ]
 crbug.com/626703 external/wpt/reporting/generateTestReport.html [ Timeout ]
 crbug.com/626703 external/wpt/reporting/bufferSize.html [ Timeout ]
@@ -3188,6 +3197,7 @@
 crbug.com/626703 [ Retina ] external/wpt/media-source/mediasource-detach.html [ Crash ]
 crbug.com/626703 [ Mac ] external/wpt/infrastructure/testdriver/actions/pause.html [ Pass Timeout ]
 crbug.com/626703 external/wpt/infrastructure/testdriver/actions/eventOrder.html [ Timeout ]
+crbug.com/626703 external/wpt/infrastructure/testdriver/actions/actionsWithKeyPressed.html [ Timeout ]
 crbug.com/626703 external/wpt/css/css-text/writing-system/writing-system-segment-break-001.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-text/writing-system/writing-system-line-break-001.html [ Failure ]
 crbug.com/626703 external/wpt/css/css-text/writing-system/writing-system-line-break-002.html [ Failure ]
@@ -6009,3 +6019,12 @@
 crbug.com/934636 virtual/outofblink-cors-ns/http/tests/security/cross-origin-indexeddb-allowed.html [ Crash Pass ]
 crbug.com/934768 [ Mac ] http/tests/devtools/tracing/worker-events.js [ Failure Pass ]
 crbug.com/934768 [ Mac ] virtual/threaded/http/tests/devtools/tracing/worker-events.js [ Failure Pass ]
+crbug.com/934818 [ Mac Debug ] virtual/threaded/http/tests/devtools/tracing/decode-resize.js [ Failure Pass ]
+crbug.com/934866 [ Mac ] virtual/outofblink-cors-ns/http/tests/security/cross-origin-worker-indexeddb-allowed.html [ Crash Pass ]
+
+# Device Sensor Events are being restricted to secure browsing contexts, but the change is still gated on a runtime flag.
+crbug.com/932078 http/tests/security/powerfulFeatureRestrictions/device-orientation-future-behavior-on-insecure-origin.html [ Skip ]
+crbug.com/932078 virtual/secure-device-sensor-events/http/tests/security/powerfulFeatureRestrictions/device-orientation-on-insecure-origin.html [ Skip ]
+crbug.com/932078 virtual/feature-policy-for-sandbox/http/tests/security/powerfulFeatureRestrictions/device-orientation-future-behavior-on-insecure-origin.html [ Skip ]
+crbug.com/932078 virtual/outofblink-cors/http/tests/security/powerfulFeatureRestrictions/device-orientation-future-behavior-on-insecure-origin.html [ Skip ]
+crbug.com/932078 virtual/outofblink-cors-ns/http/tests/security/powerfulFeatureRestrictions/device-orientation-future-behavior-on-insecure-origin.html [ Skip ]
diff --git a/third_party/blink/web_tests/VirtualTestSuites b/third_party/blink/web_tests/VirtualTestSuites
index e344f2e..48429b1 100644
--- a/third_party/blink/web_tests/VirtualTestSuites
+++ b/third_party/blink/web_tests/VirtualTestSuites
@@ -1051,5 +1051,10 @@
     "prefix": "feature-policy-for-sandbox",
     "base": "mhtml",
     "args": ["--enable-blink-features=FeaturePolicyForSandbox"]
+  },
+  {
+    "prefix": "secure-device-sensor-events",
+    "base": "http/tests/security/powerfulFeatureRestrictions/",
+    "args": ["--enable-features=RestrictDeviceSensorEventsToSecureContexts"]
   }
 ]
diff --git a/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_5.json b/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_5.json
index e0a8a9c2..1bb52a461 100644
--- a/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_5.json
+++ b/third_party/blink/web_tests/external/WPT_BASE_MANIFEST_5.json
@@ -57037,6 +57037,150 @@
      {}
     ]
    ],
+   "css/css-position/static-position/inline-level-absolute-in-block-level-context-001.html": [
+    [
+     "/css/css-position/static-position/inline-level-absolute-in-block-level-context-001.html",
+     [
+      [
+       "/css/reference/ref-filled-green-100px-square-only.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "css/css-position/static-position/inline-level-absolute-in-block-level-context-002.html": [
+    [
+     "/css/css-position/static-position/inline-level-absolute-in-block-level-context-002.html",
+     [
+      [
+       "/css/reference/ref-filled-green-100px-square-only.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "css/css-position/static-position/inline-level-absolute-in-block-level-context-003.html": [
+    [
+     "/css/css-position/static-position/inline-level-absolute-in-block-level-context-003.html",
+     [
+      [
+       "/css/reference/ref-filled-green-100px-square-only.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "css/css-position/static-position/inline-level-absolute-in-block-level-context-004.html": [
+    [
+     "/css/css-position/static-position/inline-level-absolute-in-block-level-context-004.html",
+     [
+      [
+       "/css/reference/ref-filled-green-100px-square-only.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "css/css-position/static-position/inline-level-absolute-in-block-level-context-005.html": [
+    [
+     "/css/css-position/static-position/inline-level-absolute-in-block-level-context-005.html",
+     [
+      [
+       "/css/reference/ref-filled-green-100px-square-only.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "css/css-position/static-position/inline-level-absolute-in-block-level-context-006.html": [
+    [
+     "/css/css-position/static-position/inline-level-absolute-in-block-level-context-006.html",
+     [
+      [
+       "/css/reference/ref-filled-green-100px-square-only.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "css/css-position/static-position/inline-level-absolute-in-block-level-context-007.html": [
+    [
+     "/css/css-position/static-position/inline-level-absolute-in-block-level-context-007.html",
+     [
+      [
+       "/css/reference/ref-filled-green-100px-square-only.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "css/css-position/static-position/inline-level-absolute-in-block-level-context-008.html": [
+    [
+     "/css/css-position/static-position/inline-level-absolute-in-block-level-context-008.html",
+     [
+      [
+       "/css/reference/ref-filled-green-100px-square-only.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "css/css-position/static-position/inline-level-absolute-in-block-level-context-009.html": [
+    [
+     "/css/css-position/static-position/inline-level-absolute-in-block-level-context-009.html",
+     [
+      [
+       "/css/reference/ref-filled-green-100px-square-only.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "css/css-position/static-position/inline-level-absolute-in-block-level-context-010.html": [
+    [
+     "/css/css-position/static-position/inline-level-absolute-in-block-level-context-010.html",
+     [
+      [
+       "/css/reference/ref-filled-green-100px-square-only.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "css/css-position/static-position/inline-level-absolute-in-block-level-context-011.html": [
+    [
+     "/css/css-position/static-position/inline-level-absolute-in-block-level-context-011.html",
+     [
+      [
+       "/css/reference/ref-filled-green-100px-square-only.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
+   "css/css-position/static-position/inline-level-absolute-in-block-level-context-012.html": [
+    [
+     "/css/css-position/static-position/inline-level-absolute-in-block-level-context-012.html",
+     [
+      [
+       "/css/reference/ref-filled-green-100px-square-only.html",
+       "=="
+      ]
+     ],
+     {}
+    ]
+   ],
    "css/css-position/static-position/vlr-ltr-ltr.html": [
     [
      "/css/css-position/static-position/vlr-ltr-ltr.html",
@@ -164495,6 +164639,11 @@
      {}
     ]
    ],
+   "html/browsers/windows/embedded-opener-remove-frame-expected.txt": [
+    [
+     {}
+    ]
+   ],
    "html/browsers/windows/nested-browsing-contexts/contains.json": [
     [
      {}
@@ -186560,6 +186709,16 @@
      {}
     ]
    ],
+   "signed-exchange/resources/invalid-cert-format.cbor": [
+    [
+     {}
+    ]
+   ],
+   "signed-exchange/resources/invalid-cert-format.cbor.headers": [
+    [
+     {}
+    ]
+   ],
    "signed-exchange/resources/sxg-location.html": [
     [
      {}
@@ -186610,6 +186769,16 @@
      {}
     ]
    ],
+   "signed-exchange/resources/sxg/sxg-cert-not-found-on-alt-origin.sxg": [
+    [
+     {}
+    ]
+   ],
+   "signed-exchange/resources/sxg/sxg-cert-not-found.sxg": [
+    [
+     {}
+    ]
+   ],
    "signed-exchange/resources/sxg/sxg-hsts.sxg": [
     [
      {}
@@ -186620,6 +186789,36 @@
      {}
     ]
    ],
+   "signed-exchange/resources/sxg/sxg-invalid-cert-format-on-alt-origin.sxg": [
+    [
+     {}
+    ]
+   ],
+   "signed-exchange/resources/sxg/sxg-invalid-cert-format.sxg": [
+    [
+     {}
+    ]
+   ],
+   "signed-exchange/resources/sxg/sxg-invalid-cert-sha256-cert-on-alt-origin.sxg": [
+    [
+     {}
+    ]
+   ],
+   "signed-exchange/resources/sxg/sxg-invalid-cert-sha256.sxg": [
+    [
+     {}
+    ]
+   ],
+   "signed-exchange/resources/sxg/sxg-invalid-format.sxg": [
+    [
+     {}
+    ]
+   ],
+   "signed-exchange/resources/sxg/sxg-invalid-integrity-header.sxg": [
+    [
+     {}
+    ]
+   ],
    "signed-exchange/resources/sxg/sxg-invalid-utf8-inner-url.sxg": [
     [
      {}
@@ -186630,6 +186829,11 @@
      {}
     ]
    ],
+   "signed-exchange/resources/sxg/sxg-location-cert-on-alt-origin.sxg": [
+    [
+     {}
+    ]
+   ],
    "signed-exchange/resources/sxg/sxg-location.sxg": [
     [
      {}
@@ -186660,6 +186864,16 @@
      {}
     ]
    ],
+   "signed-exchange/resources/sxg/sxg-validity-period-too-long-cert-on-alt-origin.sxg": [
+    [
+     {}
+    ]
+   ],
+   "signed-exchange/resources/sxg/sxg-validity-period-too-long.sxg": [
+    [
+     {}
+    ]
+   ],
    "speech-api/META.yml": [
     [
      {}
@@ -214655,6 +214869,12 @@
      {}
     ]
    ],
+   "css/css-scroll-snap/scroll-snap-stop-always.html": [
+    [
+     "/css/css-scroll-snap/scroll-snap-stop-always.html",
+     {}
+    ]
+   ],
    "css/css-scroll-snap/scroll-snap-type-proximity.html": [
     [
      "/css/css-scroll-snap/scroll-snap-type-proximity.html",
@@ -239517,6 +239737,12 @@
      }
     ]
    ],
+   "html/browsers/the-window-object/focus.window.js": [
+    [
+     "/html/browsers/the-window-object/focus.window.html",
+     {}
+    ]
+   ],
    "html/browsers/the-window-object/garbage-collection-and-browsing-contexts/discard_iframe_history_1.html": [
     [
      "/html/browsers/the-window-object/garbage-collection-and-browsing-contexts/discard_iframe_history_1.html",
@@ -239821,6 +240047,12 @@
      {}
     ]
    ],
+   "html/browsers/windows/embedded-opener-remove-frame.html": [
+    [
+     "/html/browsers/windows/embedded-opener-remove-frame.html",
+     {}
+    ]
+   ],
    "html/browsers/windows/embedded-opener.html": [
     [
      "/html/browsers/windows/embedded-opener.html",
@@ -265689,21 +265921,21 @@
      {}
     ]
    ],
-   "orientation-event/devicemotionevent-init.html": [
+   "orientation-event/devicemotionevent-init.https.html": [
     [
-     "/orientation-event/devicemotionevent-init.html",
+     "/orientation-event/devicemotionevent-init.https.html",
      {}
     ]
    ],
-   "orientation-event/deviceorientationabsoluteevent.html": [
+   "orientation-event/deviceorientationabsoluteevent.https.html": [
     [
-     "/orientation-event/deviceorientationabsoluteevent.html",
+     "/orientation-event/deviceorientationabsoluteevent.https.html",
      {}
     ]
    ],
-   "orientation-event/deviceorientationevent-init.html": [
+   "orientation-event/deviceorientationevent-init.https.html": [
     [
-     "/orientation-event/deviceorientationevent-init.html",
+     "/orientation-event/deviceorientationevent-init.https.html",
      {}
     ]
    ],
@@ -265713,9 +265945,9 @@
      {}
     ]
    ],
-   "orientation-event/ondeviceorientationabsolute.html": [
+   "orientation-event/ondeviceorientationabsolute.https.html": [
     [
-     "/orientation-event/ondeviceorientationabsolute.html",
+     "/orientation-event/ondeviceorientationabsolute.https.html",
      {}
     ]
    ],
@@ -280215,18 +280447,162 @@
      {}
     ]
    ],
+   "signed-exchange/reporting/sxg-reporting-navigation-cert_fetch_error-downgraded.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-navigation-cert_fetch_error-downgraded.tentative.html",
+     {}
+    ]
+   ],
+   "signed-exchange/reporting/sxg-reporting-navigation-cert_fetch_error.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-navigation-cert_fetch_error.tentative.html",
+     {}
+    ]
+   ],
+   "signed-exchange/reporting/sxg-reporting-navigation-cert_parse_error-downgraded.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-navigation-cert_parse_error-downgraded.tentative.html",
+     {}
+    ]
+   ],
+   "signed-exchange/reporting/sxg-reporting-navigation-cert_parse_error.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-navigation-cert_parse_error.tentative.html",
+     {}
+    ]
+   ],
+   "signed-exchange/reporting/sxg-reporting-navigation-cert_verification_error-downgraded.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-navigation-cert_verification_error-downgraded.tentative.html",
+     {}
+    ]
+   ],
+   "signed-exchange/reporting/sxg-reporting-navigation-cert_verification_error.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-navigation-cert_verification_error.tentative.html",
+     {}
+    ]
+   ],
+   "signed-exchange/reporting/sxg-reporting-navigation-failed-zero-success-fraction.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-navigation-failed-zero-success-fraction.tentative.html",
+     {}
+    ]
+   ],
+   "signed-exchange/reporting/sxg-reporting-navigation-invalid_integrity_header.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-navigation-invalid_integrity_header.tentative.html",
+     {}
+    ]
+   ],
+   "signed-exchange/reporting/sxg-reporting-navigation-mi_error.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-navigation-mi_error.tentative.html",
+     {}
+    ]
+   ],
    "signed-exchange/reporting/sxg-reporting-navigation-ok.tentative.html": [
     [
      "/signed-exchange/reporting/sxg-reporting-navigation-ok.tentative.html",
      {}
     ]
    ],
+   "signed-exchange/reporting/sxg-reporting-navigation-parse_error.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-navigation-parse_error.tentative.html",
+     {}
+    ]
+   ],
+   "signed-exchange/reporting/sxg-reporting-navigation-signature_verification_error-downgraded.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-navigation-signature_verification_error-downgraded.tentative.html",
+     {}
+    ]
+   ],
+   "signed-exchange/reporting/sxg-reporting-navigation-signature_verification_error.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-navigation-signature_verification_error.tentative.html",
+     {}
+    ]
+   ],
+   "signed-exchange/reporting/sxg-reporting-prefetch-cert_fetch_error-downgraded.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-prefetch-cert_fetch_error-downgraded.tentative.html",
+     {}
+    ]
+   ],
+   "signed-exchange/reporting/sxg-reporting-prefetch-cert_fetch_error.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-prefetch-cert_fetch_error.tentative.html",
+     {}
+    ]
+   ],
+   "signed-exchange/reporting/sxg-reporting-prefetch-cert_parse_error-downgraded.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-prefetch-cert_parse_error-downgraded.tentative.html",
+     {}
+    ]
+   ],
+   "signed-exchange/reporting/sxg-reporting-prefetch-cert_parse_error.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-prefetch-cert_parse_error.tentative.html",
+     {}
+    ]
+   ],
+   "signed-exchange/reporting/sxg-reporting-prefetch-cert_verification_error-downgraded.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-prefetch-cert_verification_error-downgraded.tentative.html",
+     {}
+    ]
+   ],
+   "signed-exchange/reporting/sxg-reporting-prefetch-cert_verification_error.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-prefetch-cert_verification_error.tentative.html",
+     {}
+    ]
+   ],
+   "signed-exchange/reporting/sxg-reporting-prefetch-failed-zero-success-feaction.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-prefetch-failed-zero-success-feaction.tentative.html",
+     {}
+    ]
+   ],
+   "signed-exchange/reporting/sxg-reporting-prefetch-invalid_integrity_header.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-prefetch-invalid_integrity_header.tentative.html",
+     {}
+    ]
+   ],
+   "signed-exchange/reporting/sxg-reporting-prefetch-mi_error.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-prefetch-mi_error.tentative.html",
+     {}
+    ]
+   ],
    "signed-exchange/reporting/sxg-reporting-prefetch-ok.tentative.html": [
     [
      "/signed-exchange/reporting/sxg-reporting-prefetch-ok.tentative.html",
      {}
     ]
    ],
+   "signed-exchange/reporting/sxg-reporting-prefetch-parse_error.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-prefetch-parse_error.tentative.html",
+     {}
+    ]
+   ],
+   "signed-exchange/reporting/sxg-reporting-prefetch-signature_verification_error-downgraded.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-prefetch-signature_verification_error-downgraded.tentative.html",
+     {}
+    ]
+   ],
+   "signed-exchange/reporting/sxg-reporting-prefetch-signature_verification_error.tentative.html": [
+    [
+     "/signed-exchange/reporting/sxg-reporting-prefetch-signature_verification_error.tentative.html",
+     {}
+    ]
+   ],
    "signed-exchange/sxg-double-prefetch.tentative.html": [
     [
      "/signed-exchange/sxg-double-prefetch.tentative.html",
@@ -287979,6 +288355,12 @@
      {}
     ]
    ],
+   "webrtc/RTCPeerConnection-onsignalingstatechanged.https.html": [
+    [
+     "/webrtc/RTCPeerConnection-onsignalingstatechanged.https.html",
+     {}
+    ]
+   ],
    "webrtc/RTCPeerConnection-ontrack.https.html": [
     [
      "/webrtc/RTCPeerConnection-ontrack.https.html",
@@ -355935,11 +356317,11 @@
    "reftest"
   ],
   "css/css-paint-api/parse-input-arguments-002.https.html": [
-   "6fc16c74701fd99b310f3624c357ad0d52be9234",
+   "b1b50e04045fb05ad7f967a7db26f86dcf5d36b7",
    "reftest"
   ],
   "css/css-paint-api/parse-input-arguments-003.https.html": [
-   "44fd850f9ab81756acf131839188de89ab807d86",
+   "3b1b0014f78a3ed0908273f0dc72b714f32c9aab",
    "reftest"
   ],
   "css/css-paint-api/parse-input-arguments-004.https.html": [
@@ -355947,11 +356329,11 @@
    "reftest"
   ],
   "css/css-paint-api/parse-input-arguments-005.https.html": [
-   "c12e00c92f5b8f9e0c99609251c872c083fb67df",
+   "0c5e539381bd8bc9295bfa54db070c2e6b9e2ac2",
    "reftest"
   ],
   "css/css-paint-api/parse-input-arguments-006.https.html": [
-   "664b7a8c1a0d4d40ce725b941f6c86a5dd0d647a",
+   "e99ab05a88d9fb6d8dff1a8a7dff880bc6bf0728",
    "reftest"
   ],
   "css/css-paint-api/parse-input-arguments-007.https.html": [
@@ -355959,23 +356341,23 @@
    "reftest"
   ],
   "css/css-paint-api/parse-input-arguments-008.https.html": [
-   "1914e3cf044e9c25340bcb88bd155429f721e312",
+   "e6b863c641c0a201851c1910da158db377292217",
    "reftest"
   ],
   "css/css-paint-api/parse-input-arguments-009.https.html": [
-   "21d004df0eee51e50a1b9359a1e70d5b3bf5923b",
+   "b23191ae34015c9a4fb7b3a4f711228b57b98b34",
    "reftest"
   ],
   "css/css-paint-api/parse-input-arguments-010.https.html": [
-   "d923479ea81a3345885012efa5ed610146333ece",
+   "e98b431648932559400e721a0414a3955403b50a",
    "reftest"
   ],
   "css/css-paint-api/parse-input-arguments-011.https.html": [
-   "6cea438fce21baf8de53649229414b1bb73bb2e7",
+   "b9d54bf413d79a13b89decb578d17834a7649799",
    "reftest"
   ],
   "css/css-paint-api/parse-input-arguments-012.https.html": [
-   "938150aa9aaf0400950f7ae6f1b6da2657ffb50f",
+   "14eebeb635a73feb7303c178818f1e02df3d854d",
    "reftest"
   ],
   "css/css-paint-api/parse-input-arguments-013.https.html": [
@@ -355991,7 +356373,7 @@
    "reftest"
   ],
   "css/css-paint-api/parse-input-arguments-016.https.html": [
-   "8c9d05dcd1ae3b1a6e8857509f8df25b92a16987",
+   "31cca45facab4fb2c312f57f0c42b3e361d4baef",
    "reftest"
   ],
   "css/css-paint-api/parse-input-arguments-017.https.html": [
@@ -356746,6 +357128,54 @@
    "279754ca4ea2102b8fd84b3225495f2a17816a08",
    "reftest"
   ],
+  "css/css-position/static-position/inline-level-absolute-in-block-level-context-001.html": [
+   "d6f8ed4e39ae3627cf91120b9d7679126fdaf016",
+   "reftest"
+  ],
+  "css/css-position/static-position/inline-level-absolute-in-block-level-context-002.html": [
+   "9b0f5c2beaf49036c4f669112a137c5ada66b610",
+   "reftest"
+  ],
+  "css/css-position/static-position/inline-level-absolute-in-block-level-context-003.html": [
+   "90db2d4f80d069c17cc490280e9ab82db8b61d9d",
+   "reftest"
+  ],
+  "css/css-position/static-position/inline-level-absolute-in-block-level-context-004.html": [
+   "a6b13b26c8f4972800a1473ad24f0e2f32636a73",
+   "reftest"
+  ],
+  "css/css-position/static-position/inline-level-absolute-in-block-level-context-005.html": [
+   "481c83a757d43b267da8475750312214daacff3d",
+   "reftest"
+  ],
+  "css/css-position/static-position/inline-level-absolute-in-block-level-context-006.html": [
+   "de5322f81998d2705405906d2946fce352baea11",
+   "reftest"
+  ],
+  "css/css-position/static-position/inline-level-absolute-in-block-level-context-007.html": [
+   "1168b1d2287c3e0797d64fcaeda5582a3976d475",
+   "reftest"
+  ],
+  "css/css-position/static-position/inline-level-absolute-in-block-level-context-008.html": [
+   "e10a7e191d3548b95b46d289ab57af6324581134",
+   "reftest"
+  ],
+  "css/css-position/static-position/inline-level-absolute-in-block-level-context-009.html": [
+   "86102fa1d9955594a0e7a49d323d118f729131d9",
+   "reftest"
+  ],
+  "css/css-position/static-position/inline-level-absolute-in-block-level-context-010.html": [
+   "95d43b9cfb2b1719bc5f8015e3773a9971d483db",
+   "reftest"
+  ],
+  "css/css-position/static-position/inline-level-absolute-in-block-level-context-011.html": [
+   "375566388ef6c88833e25241810c4e886aa5f3de",
+   "reftest"
+  ],
+  "css/css-position/static-position/inline-level-absolute-in-block-level-context-012.html": [
+   "1972317822b945b2a70712884ddb2d39b924420e",
+   "reftest"
+  ],
   "css/css-position/static-position/vlr-ltr-ltr.html": [
    "1d95b46a0ff039ebd37b5de429ef755029d3cb79",
    "reftest"
@@ -357650,6 +358080,10 @@
    "fde2211f9253467544376643d2e842c61adfe8be",
    "testharness"
   ],
+  "css/css-scroll-snap/scroll-snap-stop-always.html": [
+   "62446f54632f943eacf7e2bcd4bd1d98d346e97c",
+   "testharness"
+  ],
   "css/css-scroll-snap/scroll-snap-type-proximity.html": [
    "cfe990c4fcab85898899039f71fa353484558789",
    "testharness"
@@ -384203,7 +384637,7 @@
    "testharness"
   ],
   "css/cssom/CSSStyleSheet-constructable.html": [
-   "80189fe2f36e7c89f0445511460732fa77169108",
+   "5ee86ae4a6775abb47abff558b292b2303e2ef27",
    "testharness"
   ],
   "css/cssom/CSSStyleSheet.html": [
@@ -404710,6 +405144,10 @@
    "07662c63cd01337e3b6a53ce6001d187b719fbe7",
    "support"
   ],
+  "html/browsers/the-window-object/focus.window.js": [
+   "6ec7feee281e756ae6452e0f9b17d9b93032d010",
+   "testharness"
+  ],
   "html/browsers/the-window-object/garbage-collection-and-browsing-contexts/discard_iframe_history_1-1.html": [
    "217608e46ef78a915c4d6192505187067199273c",
    "support"
@@ -405134,6 +405572,14 @@
    "16481744cb91f79d4589e364e539ef8d4128bc90",
    "support"
   ],
+  "html/browsers/windows/embedded-opener-remove-frame-expected.txt": [
+   "b2fe3032be484df54f4e71aab73f3b0a36331caf",
+   "support"
+  ],
+  "html/browsers/windows/embedded-opener-remove-frame.html": [
+   "9bce93f0888ea25d713944efc9c8a4fdcc371da0",
+   "testharness"
+  ],
   "html/browsers/windows/embedded-opener.html": [
    "8e02664342f5493faa1f68e67804f2dd7f4d6491",
    "testharness"
@@ -428459,7 +428905,7 @@
    "support"
   ],
   "network-error-logging/support/nel.sub.js": [
-   "16aebd54a97cdcd9329c42eba6b4116c40993ca0",
+   "8fa83505320c997b877b9b4883cf2d96993afe84",
    "support"
   ],
   "network-error-logging/support/no-policy-pass.png": [
@@ -428471,7 +428917,7 @@
    "support"
   ],
   "network-error-logging/support/pass.png.sub.headers": [
-   "70796e913ace97d4d1a21ac0b1c19f6fbb6d01fc",
+   "15d246d8d9dd2070d4467071166cdda076324d8a",
    "support"
   ],
   "network-error-logging/support/redirect.py": [
@@ -435018,15 +435464,15 @@
    "243df98c09e6bdd29f814acaafa59f05cd293644",
    "support"
   ],
-  "orientation-event/devicemotionevent-init.html": [
+  "orientation-event/devicemotionevent-init.https.html": [
    "90563d8bbaea35f05bbe72df5acbae199fa4e02a",
    "testharness"
   ],
-  "orientation-event/deviceorientationabsoluteevent.html": [
+  "orientation-event/deviceorientationabsoluteevent.https.html": [
    "8ccf671cb3b84665eaa048f528e64a95c8793e65",
    "testharness"
   ],
-  "orientation-event/deviceorientationevent-init.html": [
+  "orientation-event/deviceorientationevent-init.https.html": [
    "b6485f696b446c83389518b9aaead9f1cb74884a",
    "testharness"
   ],
@@ -435050,7 +435496,7 @@
    "ed8309d6480eaaec45e986a3391854d67b01ba2d",
    "testharness"
   ],
-  "orientation-event/ondeviceorientationabsolute.html": [
+  "orientation-event/ondeviceorientationabsolute.https.html": [
    "73ce97ab5c1fd7220fb65e53fb51e0bfa86beb28",
    "testharness"
   ],
@@ -451702,14 +452148,110 @@
    "f1167f919ab39a85e38778c39fc64305eecd4921",
    "testharness"
   ],
+  "signed-exchange/reporting/sxg-reporting-navigation-cert_fetch_error-downgraded.tentative.html": [
+   "845b7e01ff28b92f4db7919a3f29661ee78df544",
+   "testharness"
+  ],
+  "signed-exchange/reporting/sxg-reporting-navigation-cert_fetch_error.tentative.html": [
+   "476af828e636a7587a3618acad1ce41a9715c0a3",
+   "testharness"
+  ],
+  "signed-exchange/reporting/sxg-reporting-navigation-cert_parse_error-downgraded.tentative.html": [
+   "d962b884e53c02fe483cfa7e92777e40b44f3767",
+   "testharness"
+  ],
+  "signed-exchange/reporting/sxg-reporting-navigation-cert_parse_error.tentative.html": [
+   "11dc4141b8a6f5f30ad8556dcc9ab6eeacb15be0",
+   "testharness"
+  ],
+  "signed-exchange/reporting/sxg-reporting-navigation-cert_verification_error-downgraded.tentative.html": [
+   "a1358e753000ecffc3caa0ee31427f38816cae30",
+   "testharness"
+  ],
+  "signed-exchange/reporting/sxg-reporting-navigation-cert_verification_error.tentative.html": [
+   "81520f9df987b0b85cebdac81a12be66882042c9",
+   "testharness"
+  ],
+  "signed-exchange/reporting/sxg-reporting-navigation-failed-zero-success-fraction.tentative.html": [
+   "c0e06c8a197b3af5749ff4d3f8c3aa07e1cefa42",
+   "testharness"
+  ],
+  "signed-exchange/reporting/sxg-reporting-navigation-invalid_integrity_header.tentative.html": [
+   "aaad0c84b7b532a0e3f8b5d923e9668d941c7c47",
+   "testharness"
+  ],
+  "signed-exchange/reporting/sxg-reporting-navigation-mi_error.tentative.html": [
+   "40d1ae01fc450d3c51bc482dff3acf77aa6a3dfc",
+   "testharness"
+  ],
   "signed-exchange/reporting/sxg-reporting-navigation-ok.tentative.html": [
    "ee9a50966d8f5581084b3518757ff74a6abed692",
    "testharness"
   ],
+  "signed-exchange/reporting/sxg-reporting-navigation-parse_error.tentative.html": [
+   "aaaa3872511aaf205f306e78769187d854b6ad15",
+   "testharness"
+  ],
+  "signed-exchange/reporting/sxg-reporting-navigation-signature_verification_error-downgraded.tentative.html": [
+   "87bbc369f2419ad65715f070ae5dbabba82e4607",
+   "testharness"
+  ],
+  "signed-exchange/reporting/sxg-reporting-navigation-signature_verification_error.tentative.html": [
+   "f57fd4d59670855bbf7edbfafac623ff38009f95",
+   "testharness"
+  ],
+  "signed-exchange/reporting/sxg-reporting-prefetch-cert_fetch_error-downgraded.tentative.html": [
+   "f663f35ce761f65686468b54884cd2ca37a1168c",
+   "testharness"
+  ],
+  "signed-exchange/reporting/sxg-reporting-prefetch-cert_fetch_error.tentative.html": [
+   "c17fc5c02986789e251004fc31fa23801c1f5302",
+   "testharness"
+  ],
+  "signed-exchange/reporting/sxg-reporting-prefetch-cert_parse_error-downgraded.tentative.html": [
+   "f1a5eb17f6211f01891c7608518f38794cd2b65f",
+   "testharness"
+  ],
+  "signed-exchange/reporting/sxg-reporting-prefetch-cert_parse_error.tentative.html": [
+   "00f41c0861c7aab56ffe6f184e4252a90823ed97",
+   "testharness"
+  ],
+  "signed-exchange/reporting/sxg-reporting-prefetch-cert_verification_error-downgraded.tentative.html": [
+   "4836dc1b94660071da2eeb39e460bcfebef2ab03",
+   "testharness"
+  ],
+  "signed-exchange/reporting/sxg-reporting-prefetch-cert_verification_error.tentative.html": [
+   "441a17af1052019494b998a0ca2dfa2a8ebca5ba",
+   "testharness"
+  ],
+  "signed-exchange/reporting/sxg-reporting-prefetch-failed-zero-success-feaction.tentative.html": [
+   "b0f7103053ba8e8ae938be3831de9b785d78047c",
+   "testharness"
+  ],
+  "signed-exchange/reporting/sxg-reporting-prefetch-invalid_integrity_header.tentative.html": [
+   "1fd431c1a0b056ef6d8550fb35e984ba2802e677",
+   "testharness"
+  ],
+  "signed-exchange/reporting/sxg-reporting-prefetch-mi_error.tentative.html": [
+   "2bbf0e8f2582f1dee3b73360f9f4240f52dc596f",
+   "testharness"
+  ],
   "signed-exchange/reporting/sxg-reporting-prefetch-ok.tentative.html": [
    "fb5fb58c9f7063c2abd45130ec4bfdf4b6bcc8cb",
    "testharness"
   ],
+  "signed-exchange/reporting/sxg-reporting-prefetch-parse_error.tentative.html": [
+   "171baf1b4a93d7e317592b431c92045d3313c132",
+   "testharness"
+  ],
+  "signed-exchange/reporting/sxg-reporting-prefetch-signature_verification_error-downgraded.tentative.html": [
+   "7340b75e35eb439a99f2b6869f8b24ddf4105325",
+   "testharness"
+  ],
+  "signed-exchange/reporting/sxg-reporting-prefetch-signature_verification_error.tentative.html": [
+   "d552c4a8c339777a4f6fa7c1ad9c9bd0c2a6b5b2",
+   "testharness"
+  ],
   "signed-exchange/resources/127.0.0.1.sxg.ext": [
    "8cdc25a9a7f36f3313813e967eb9e68f5e546ff6",
    "support"
@@ -451743,13 +452285,21 @@
    "support"
   ],
   "signed-exchange/resources/generate-test-sxgs.sh": [
-   "bb95df83295e1b2f81a569e93fd5d9d0ce548574",
+   "bae4ce0eaed3ffcd36d70e4931ea39ff1a3c3346",
    "support"
   ],
   "signed-exchange/resources/inner-url.html": [
    "5b247bbfe99a5e502f8d775c37c5d543dfea3fe3",
    "support"
   ],
+  "signed-exchange/resources/invalid-cert-format.cbor": [
+   "82f15ff924af48d09609ff12a9d43fbe672d5efd",
+   "support"
+  ],
+  "signed-exchange/resources/invalid-cert-format.cbor.headers": [
+   "d581d5987ea0f9d7c8164d680a4527f2ea519cd4",
+   "support"
+  ],
   "signed-exchange/resources/sxg-location.html": [
    "b3ebd2bde7acd2d1885838a37ab9cfc91c250551",
    "support"
@@ -451790,6 +452340,14 @@
    "6d8538882d27c40b0ffcf0845c090844aaec87b7",
    "support"
   ],
+  "signed-exchange/resources/sxg/sxg-cert-not-found-on-alt-origin.sxg": [
+   "2a7dbf6fa69ae29055e51f6c7d32d3ab4ceb6765",
+   "support"
+  ],
+  "signed-exchange/resources/sxg/sxg-cert-not-found.sxg": [
+   "072125400abb5b6a19039d798a5f29261154efaf",
+   "support"
+  ],
   "signed-exchange/resources/sxg/sxg-hsts.sxg": [
    "8f57c63dfab73eb5d05600f7563bb0a4ae938834",
    "support"
@@ -451798,6 +452356,30 @@
    "0093eb1d37d0df6e9a63569bab16133ead012d52",
    "support"
   ],
+  "signed-exchange/resources/sxg/sxg-invalid-cert-format-on-alt-origin.sxg": [
+   "62acedd390e1a40379f4f48994d6ef7673a46f0d",
+   "support"
+  ],
+  "signed-exchange/resources/sxg/sxg-invalid-cert-format.sxg": [
+   "30e4fcd9124955b498810069492ab7e83b208e63",
+   "support"
+  ],
+  "signed-exchange/resources/sxg/sxg-invalid-cert-sha256-cert-on-alt-origin.sxg": [
+   "066a3cc0a4d4c31c342fc06107e459e1def04cad",
+   "support"
+  ],
+  "signed-exchange/resources/sxg/sxg-invalid-cert-sha256.sxg": [
+   "46d2bb1386ea08ed742b786ac2ec710bedaa9db2",
+   "support"
+  ],
+  "signed-exchange/resources/sxg/sxg-invalid-format.sxg": [
+   "3fbb151b5ca329edd43d40c3289dbacbee328746",
+   "support"
+  ],
+  "signed-exchange/resources/sxg/sxg-invalid-integrity-header.sxg": [
+   "95d358245c909d7da0c2b6bbf08913c60aceda20",
+   "support"
+  ],
   "signed-exchange/resources/sxg/sxg-invalid-utf8-inner-url.sxg": [
    "65357e14ac671610935693d409da9c58c1fa75c7",
    "support"
@@ -451806,6 +452388,10 @@
    "62e88d638641ed4ed026319b27a53c6d04351076",
    "support"
   ],
+  "signed-exchange/resources/sxg/sxg-location-cert-on-alt-origin.sxg": [
+   "a2ddc77951cebbbdbcd95a4d275501b4f64677f5",
+   "support"
+  ],
   "signed-exchange/resources/sxg/sxg-location.sxg": [
    "1678b751bcba390d35687730bb24e13232e33eda",
    "support"
@@ -451830,6 +452416,14 @@
    "3edf285f1bd5affc5c575ca258a8cd3cfa546e35",
    "support"
   ],
+  "signed-exchange/resources/sxg/sxg-validity-period-too-long-cert-on-alt-origin.sxg": [
+   "294f97b097a457f06c38d209ba24344bcab719ba",
+   "support"
+  ],
+  "signed-exchange/resources/sxg/sxg-validity-period-too-long.sxg": [
+   "e90d9bc66de7fd3937c119afecec3cb4db5fa87c",
+   "support"
+  ],
   "signed-exchange/sxg-double-prefetch.tentative.html": [
    "d682741744fed929bee8e62fbae4857a4bfbf1d5",
    "testharness"
@@ -456423,7 +457017,7 @@
    "support"
   ],
   "web-animations/README.md": [
-   "f6efbf977f95bc9ab3cb6a061a841c6d4942250e",
+   "75493ce57b4c242195d9fb56e73154865d6f59bf",
    "support"
   ],
   "web-animations/animation-model/animation-types/accumulation-per-property-expected.txt": [
@@ -459202,6 +459796,10 @@
    "ac9d70c43eff1ddd0995dcea741f3b6ea850464b",
    "testharness"
   ],
+  "webrtc/RTCPeerConnection-onsignalingstatechanged.https.html": [
+   "fc3182d3d59ea5ba80cbcf022a76c4fc40f18a1a",
+   "testharness"
+  ],
   "webrtc/RTCPeerConnection-ontrack.https.html": [
    "10210129acd598fd959124fbe51462de8a1cdb0b",
    "testharness"
diff --git a/third_party/blink/web_tests/external/wpt/css/cssom/CSSStyleSheet-constructable.html b/third_party/blink/web_tests/external/wpt/css/cssom/CSSStyleSheet-constructable.html
index 80189fe..5ee86ae 100644
--- a/third_party/blink/web_tests/external/wpt/css/cssom/CSSStyleSheet-constructable.html
+++ b/third_party/blink/web_tests/external/wpt/css/cssom/CSSStyleSheet-constructable.html
@@ -228,6 +228,41 @@
   });
 }, 'Re-attaching shadow host with adopted stylesheets work');
 
+test(() => {
+  const sheet = new CSSStyleSheet();
+  sheet.replaceSync(":host { color: red; }");
+  const host = document.createElement("div");
+  let sr = host.attachShadow({mode: "open"});
+  sr.adoptedStyleSheets = [sheet];
+  document.body.appendChild(host);
+  assert_equals(getComputedStyle(host).color, "rgb(255, 0, 0)", "Style applies when connected");
+  sheet.replaceSync(":host { color: blue; }");
+  assert_equals(getComputedStyle(host).color, "rgb(0, 0, 255)", "Style update applies when connected");
+}, 'Attaching a shadow root that already has adopted stylesheets work');
+
+test(() => {
+
+  const sheet = new CSSStyleSheet();
+  sheet.replaceSync(":host([red]) { color: red; } :host(.blue) { color: blue; }");
+  const host = document.createElement("div");
+  host.toggleAttribute("red");
+  document.body.appendChild(host);
+  assert_equals(getComputedStyle(host).color, "rgb(0, 0, 0)", "No style applies yet");
+
+  let sr = host.attachShadow({mode: "open"});
+  sr.adoptedStyleSheets = [sheet];
+
+  assert_equals(getComputedStyle(host).color, "rgb(255, 0, 0)", "Style applies after adding style");
+  document.body.removeChild(host);
+  document.body.appendChild(host);
+  assert_equals(getComputedStyle(host).color, "rgb(255, 0, 0)", "Style applies after reattachment");
+  host.toggleAttribute("red");
+  assert_equals(getComputedStyle(host).color, "rgb(0, 0, 0)", "Attribute updates to the element after reattachment apply");
+  host.classList.toggle("blue");
+  assert_equals(getComputedStyle(host).color, "rgb(0, 0, 255)", "Class updates to the element after reattachment apply");
+
+}, "Re-attaching shadow host and updating attributes work");
+
 promise_test(() => {
   const plainSheet = new CSSStyleSheet();
   const redStyleSheetPromise = plainSheet.replace(redStyleTexts[0]);
diff --git a/third_party/blink/web_tests/external/wpt/fetch/data-urls/processing.any-expected.txt b/third_party/blink/web_tests/external/wpt/fetch/data-urls/processing.any-expected.txt
index 1e47de1..175aa9f99 100644
--- a/third_party/blink/web_tests/external/wpt/fetch/data-urls/processing.any-expected.txt
+++ b/third_party/blink/web_tests/external/wpt/fetch/data-urls/processing.any-expected.txt
@@ -1,5 +1,5 @@
 This is a testharness.js-based test.
-Found 71 tests; 46 PASS, 25 FAIL, 0 TIMEOUT, 0 NOTRUN.
+Found 71 tests; 49 PASS, 22 FAIL, 0 TIMEOUT, 0 NOTRUN.
 PASS Setup.
 PASS "data://test/,X"
 FAIL "data://test:test/,X" assert_unreached: Should have rejected: undefined Reached unreachable code
@@ -19,11 +19,11 @@
 FAIL "data:;x=x;charset=x,X" assert_equals: expected "text/plain;x=x;charset=x" but got "text/plain;charset=x"
 FAIL "data:;x=x,X" assert_equals: expected "text/plain;x=x" but got "text/plain;charset=US-ASCII"
 PASS "data:text/plain;charset=windows-1252,%C2%B1"
-FAIL "data:text/plain;Charset=UTF-8,%C2%B1" assert_equals: expected "text/plain;charset=UTF-8" but got "text/plain"
+PASS "data:text/plain;Charset=UTF-8,%C2%B1"
 PASS "data:image/gif,%C2%B1"
 PASS "data:IMAGE/gif,%C2%B1"
 FAIL "data:IMAGE/gif;hi=x,%C2%B1" assert_equals: expected "image/gif;hi=x" but got "image/gif"
-FAIL "data:IMAGE/gif;CHARSET=x,%C2%B1" assert_equals: expected "image/gif;charset=x" but got "image/gif"
+PASS "data:IMAGE/gif;CHARSET=x,%C2%B1"
 PASS "data: ,%FF"
 PASS "data:%20,%FF"
 PASS "data:\f,%FF"
@@ -60,7 +60,7 @@
 PASS "data:;base64 ,WA"
 PASS "data:;base64   ,WA"
 FAIL "data:;base 64,WA" assert_equals: expected "text/plain" but got "text/plain;charset=US-ASCII"
-FAIL "data:;BASe64,WA" assert_array_equals: lengths differ, expected 1 got 2
+PASS "data:;BASe64,WA"
 FAIL "data:;%62ase64,WA" assert_equals: expected "text/plain" but got "text/plain;charset=US-ASCII"
 PASS "data:%3Bbase64,WA"
 PASS "data:;charset=x,X"
@@ -70,6 +70,6 @@
 FAIL "data:;charset=,X" promise_test: Unhandled rejection with value: object "TypeError: Failed to fetch"
 FAIL "data:;charset,X" assert_equals: expected "text/plain" but got "text/plain;charset=US-ASCII"
 FAIL "data:;charset=\"x\",X" promise_test: Unhandled rejection with value: object "TypeError: Failed to fetch"
-FAIL "data:;CHARSET=\"X\",X" assert_equals: expected "text/plain;charset=X" but got "text/plain;charset=US-ASCII"
+FAIL "data:;CHARSET=\"X\",X" promise_test: Unhandled rejection with value: object "TypeError: Failed to fetch"
 Harness: the test ran to completion.
 
diff --git a/third_party/blink/web_tests/external/wpt/fetch/data-urls/processing.any.worker-expected.txt b/third_party/blink/web_tests/external/wpt/fetch/data-urls/processing.any.worker-expected.txt
index 1e47de1..175aa9f99 100644
--- a/third_party/blink/web_tests/external/wpt/fetch/data-urls/processing.any.worker-expected.txt
+++ b/third_party/blink/web_tests/external/wpt/fetch/data-urls/processing.any.worker-expected.txt
@@ -1,5 +1,5 @@
 This is a testharness.js-based test.
-Found 71 tests; 46 PASS, 25 FAIL, 0 TIMEOUT, 0 NOTRUN.
+Found 71 tests; 49 PASS, 22 FAIL, 0 TIMEOUT, 0 NOTRUN.
 PASS Setup.
 PASS "data://test/,X"
 FAIL "data://test:test/,X" assert_unreached: Should have rejected: undefined Reached unreachable code
@@ -19,11 +19,11 @@
 FAIL "data:;x=x;charset=x,X" assert_equals: expected "text/plain;x=x;charset=x" but got "text/plain;charset=x"
 FAIL "data:;x=x,X" assert_equals: expected "text/plain;x=x" but got "text/plain;charset=US-ASCII"
 PASS "data:text/plain;charset=windows-1252,%C2%B1"
-FAIL "data:text/plain;Charset=UTF-8,%C2%B1" assert_equals: expected "text/plain;charset=UTF-8" but got "text/plain"
+PASS "data:text/plain;Charset=UTF-8,%C2%B1"
 PASS "data:image/gif,%C2%B1"
 PASS "data:IMAGE/gif,%C2%B1"
 FAIL "data:IMAGE/gif;hi=x,%C2%B1" assert_equals: expected "image/gif;hi=x" but got "image/gif"
-FAIL "data:IMAGE/gif;CHARSET=x,%C2%B1" assert_equals: expected "image/gif;charset=x" but got "image/gif"
+PASS "data:IMAGE/gif;CHARSET=x,%C2%B1"
 PASS "data: ,%FF"
 PASS "data:%20,%FF"
 PASS "data:\f,%FF"
@@ -60,7 +60,7 @@
 PASS "data:;base64 ,WA"
 PASS "data:;base64   ,WA"
 FAIL "data:;base 64,WA" assert_equals: expected "text/plain" but got "text/plain;charset=US-ASCII"
-FAIL "data:;BASe64,WA" assert_array_equals: lengths differ, expected 1 got 2
+PASS "data:;BASe64,WA"
 FAIL "data:;%62ase64,WA" assert_equals: expected "text/plain" but got "text/plain;charset=US-ASCII"
 PASS "data:%3Bbase64,WA"
 PASS "data:;charset=x,X"
@@ -70,6 +70,6 @@
 FAIL "data:;charset=,X" promise_test: Unhandled rejection with value: object "TypeError: Failed to fetch"
 FAIL "data:;charset,X" assert_equals: expected "text/plain" but got "text/plain;charset=US-ASCII"
 FAIL "data:;charset=\"x\",X" promise_test: Unhandled rejection with value: object "TypeError: Failed to fetch"
-FAIL "data:;CHARSET=\"X\",X" assert_equals: expected "text/plain;charset=X" but got "text/plain;charset=US-ASCII"
+FAIL "data:;CHARSET=\"X\",X" promise_test: Unhandled rejection with value: object "TypeError: Failed to fetch"
 Harness: the test ran to completion.
 
diff --git a/third_party/blink/web_tests/external/wpt/html/browsers/the-window-object/focus.window.js b/third_party/blink/web_tests/external/wpt/html/browsers/the-window-object/focus.window.js
new file mode 100644
index 0000000..6ec7feee
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/browsers/the-window-object/focus.window.js
@@ -0,0 +1,15 @@
+async_test(t => {
+  const input = document.body.appendChild(document.createElement("input"));
+  input.onfocus = t.step_func(() => {
+    const frame = document.body.appendChild(document.createElement("iframe")),
+          frameW = frame.contentWindow;
+    frameW.onfocus = t.unreached_func();
+    frame.remove();
+    frameW.focus();
+    t.step_timeout(() => {
+      assert_equals(document.activeElement, input);
+      t.done();
+    }, 100);
+  });
+  input.focus();
+});
diff --git a/third_party/blink/web_tests/external/wpt/html/browsers/windows/embedded-opener-remove-frame-expected.txt b/third_party/blink/web_tests/external/wpt/html/browsers/windows/embedded-opener-remove-frame-expected.txt
new file mode 100644
index 0000000..b2fe3032
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/browsers/windows/embedded-opener-remove-frame-expected.txt
@@ -0,0 +1,4 @@
+This is a testharness.js-based test.
+FAIL opener and "removed" embedded documents openerGet is not a function
+Harness: the test ran to completion.
+
diff --git a/third_party/blink/web_tests/external/wpt/html/browsers/windows/embedded-opener-remove-frame.html b/third_party/blink/web_tests/external/wpt/html/browsers/windows/embedded-opener-remove-frame.html
new file mode 100644
index 0000000..9bce93f
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/html/browsers/windows/embedded-opener-remove-frame.html
@@ -0,0 +1,46 @@
+<!doctype html>
+<title>opener and "removed" embedded documents</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<div id=log></div>
+<iframe name=matchesastring></iframe>
+<script>
+async_test(t => {
+  const frame = document.querySelector("iframe"),
+        frameW = frame.contentWindow;
+  frame.onload = t.step_func(() => {
+    // Firefox and Chrome/Safari load differently
+    if (frame.contentWindow.location.href === "about:blank") {
+      return;
+    }
+
+    // Test bits
+    assert_equals(frameW.opener, window, "opener before removal");
+
+    const openerDesc = Object.getOwnPropertyDescriptor(frameW, "opener"),
+          openerGet = openerDesc.get;
+
+    assert_equals(openerGet(), window, "opener before removal via directly invoking the getter");
+    frame.remove();
+    assert_equals(frameW.opener, null, "opener after removal");
+    assert_equals(openerGet(), null, "opener after removal via directly invoking the getter");
+
+    frameW.opener = null;
+    assert_equals(openerGet(), null, "opener after setting it null via directly invoking the getter");
+    const openerDescNull = Object.getOwnPropertyDescriptor(frameW, "opener");
+    assert_not_equals(openerDescNull, openerDesc);
+    assert_object_equals(openerDescNull, openerDesc);
+
+    frameW.opener = "immaterial";
+    assert_equals(openerGet(), null, "opener after setting it \"immaterial\" via directly invoking the getter");
+    const openerDescImmaterial = Object.getOwnPropertyDescriptor(frameW, "opener");
+    assert_equals(openerDescImmaterial.value, "immaterial");
+    assert_true(openerDescImmaterial.writable);
+    assert_true(openerDescImmaterial.enumerable);
+    assert_true(openerDescImmaterial.configurable);
+
+    t.done();
+  });
+  window.open("/common/blank.html", "matchesastring");
+});
+</script>
diff --git a/third_party/blink/web_tests/external/wpt/infrastructure/metadata/infrastructure/testdriver/actions/actionsWithKeyPressed.html.ini b/third_party/blink/web_tests/external/wpt/infrastructure/metadata/infrastructure/testdriver/actions/actionsWithKeyPressed.html.ini
new file mode 100644
index 0000000..78bfa5f
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/infrastructure/metadata/infrastructure/testdriver/actions/actionsWithKeyPressed.html.ini
@@ -0,0 +1,3 @@
+[actionsWithKeyPressed.html]
+  expected:
+    if product == "safari": ERROR
diff --git a/third_party/blink/web_tests/external/wpt/infrastructure/testdriver/actions/actionsWithKeyPressed.html b/third_party/blink/web_tests/external/wpt/infrastructure/testdriver/actions/actionsWithKeyPressed.html
new file mode 100644
index 0000000..74e939f5
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/infrastructure/testdriver/actions/actionsWithKeyPressed.html
@@ -0,0 +1,67 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>TestDriver actions: actions with key pressed</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-actions.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+
+<style>
+div#test1, div#test2 {
+  position: fixed;
+  top: 0;
+  left: 0;
+  width: 100px;
+  height: 100px;
+  background-color: blue;
+}
+
+div#test2 {
+  position: fixed;
+  top: 100px;
+  left: 0;
+  width: 100px;
+  height: 100px;
+  background-color: green;
+}
+</style>
+
+<div id="test1">
+</div>
+
+<div id="test2">
+</div>
+
+<script>
+let keys = [];
+
+async_test(t => {
+  let test1 = document.getElementById("test1");
+  let test2 = document.getElementById("test2");
+  document.getElementById("test1").addEventListener("click",
+    e => {keys.push(e.getModifierState("Control"))});
+  document.getElementById("test2").addEventListener("click",
+    e => {keys.push(e.getModifierState("Control"))});
+
+  let actions = new test_driver.Actions()
+    .keyDown("\uE009")
+    .addTick()
+    .pointerMove(0, 0, {origin: test1})
+    .pointerDown()
+    .pointerUp()
+    .pointerMove(0, 0, {origin: test2})
+    .pointerDown()
+    .pointerUp()
+    .addTick()
+    .keyUp("\uE009")
+    .addTick()
+    .pointerMove(0, 0, {origin: test1})
+    .pointerDown()
+    .pointerUp();
+
+  actions.send()
+    .then(t.step_func_done(() => assert_array_equals(keys, [true, true, false])))
+    .catch(e => t.step_func(() => assert_unreached("Actions sequence failed " + e)));
+});
+</script>
diff --git a/third_party/blink/web_tests/external/wpt/orientation-event/devicemotionevent-init.html b/third_party/blink/web_tests/external/wpt/orientation-event/devicemotionevent-init.https.html
similarity index 100%
rename from third_party/blink/web_tests/external/wpt/orientation-event/devicemotionevent-init.html
rename to third_party/blink/web_tests/external/wpt/orientation-event/devicemotionevent-init.https.html
diff --git a/third_party/blink/web_tests/external/wpt/orientation-event/deviceorientationabsoluteevent.html b/third_party/blink/web_tests/external/wpt/orientation-event/deviceorientationabsoluteevent.https.html
similarity index 100%
rename from third_party/blink/web_tests/external/wpt/orientation-event/deviceorientationabsoluteevent.html
rename to third_party/blink/web_tests/external/wpt/orientation-event/deviceorientationabsoluteevent.https.html
diff --git a/third_party/blink/web_tests/external/wpt/orientation-event/deviceorientationevent-init.html b/third_party/blink/web_tests/external/wpt/orientation-event/deviceorientationevent-init.https.html
similarity index 100%
rename from third_party/blink/web_tests/external/wpt/orientation-event/deviceorientationevent-init.html
rename to third_party/blink/web_tests/external/wpt/orientation-event/deviceorientationevent-init.https.html
diff --git a/third_party/blink/web_tests/external/wpt/orientation-event/ondeviceorientationabsolute.html b/third_party/blink/web_tests/external/wpt/orientation-event/ondeviceorientationabsolute.https.html
similarity index 100%
rename from third_party/blink/web_tests/external/wpt/orientation-event/ondeviceorientationabsolute.html
rename to third_party/blink/web_tests/external/wpt/orientation-event/ondeviceorientationabsolute.https.html
diff --git a/third_party/blink/web_tests/external/wpt/svg/pservers/reftests/radialgradient-fully-overlapping.svg b/third_party/blink/web_tests/external/wpt/svg/pservers/reftests/radialgradient-fully-overlapping.svg
new file mode 100644
index 0000000..e16bb4a
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/svg/pservers/reftests/radialgradient-fully-overlapping.svg
@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:h="http://www.w3.org/1999/xhtml">
+  <title>Radial gradient with overlapping start and end circles</title>
+  <metadata>
+    <h:link rel="help" href="https://svgwg.org/svg2-draft/pservers.html#RadialGradientNotes"/>
+    <h:link rel="match" href="reference/green-100x100.svg"/>
+    <h:meta name="assert" content="If the start circle fully overlaps with the end circle, no gradient is drawn."/>
+  </metadata>
+
+  <rect width="100" height="100" fill="green"/>
+
+  <radialGradient id="fully_overlapping" r="100" fr="100">
+    <stop stop-color="red"/>
+    <stop stop-color="red" offset="1"/>
+  </radialGradient>
+  <rect width="100" height="100" fill="url(#fully_overlapping) orange"/>
+</svg>
diff --git a/third_party/blink/web_tests/external/wpt/webrtc/RTCPeerConnection-onsignalingstatechanged.https.html b/third_party/blink/web_tests/external/wpt/webrtc/RTCPeerConnection-onsignalingstatechanged.https.html
new file mode 100644
index 0000000..fc3182d
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/webrtc/RTCPeerConnection-onsignalingstatechanged.https.html
@@ -0,0 +1,30 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>RTCPeerConnection onsignalingstatechanged</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="RTCPeerConnection-helper.js"></script>
+<script>
+
+promise_test(async t => {
+  const [track] = (await navigator.mediaDevices.getUserMedia({video: true})).getTracks();
+  t.add_cleanup(() => track.stop());
+  const pc1 = new RTCPeerConnection();
+  t.add_cleanup(() => pc1.close());
+  const pc2 = new RTCPeerConnection();
+  t.add_cleanup(() => pc2.close());
+  pc1.addTrack(track, new MediaStream());
+  await pc1.setLocalDescription(await pc1.createOffer());
+  await pc2.setRemoteDescription(pc1.localDescription);
+  const signalingStateChangeResolver = new Resolver();
+  pc2.onsignalingstatechange = t.step_func(e => {
+    const transceiver = pc2.getTransceivers()[0];
+    assert_equals(pc2.signalingState, "stable");
+    assert_equals(transceiver.currentDirection, "recvonly");
+    signalingStateChangeResolver.resolve();
+  });
+  await pc2.setLocalDescription(await pc2.createAnswer());
+  await signalingStateChangeResolver;
+});
+
+</script>
diff --git a/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/device-orientation-future-behavior-on-insecure-origin.html b/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/device-orientation-future-behavior-on-insecure-origin.html
new file mode 100644
index 0000000..55e4db6
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/device-orientation-future-behavior-on-insecure-origin.html
@@ -0,0 +1,55 @@
+<!DOCTYPE html>
+<title>Device Sensor Events on Insecure Origin. Codifies expected behavior once https://github.com/w3c/deviceorientation/issues/47 is resolved.</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/get-host-info.js"></script>
+<script src="/resources/sensor-helpers.js"></script>
+<script src="/gen/layout_test_data/mojo/public/js/mojo_bindings.js"></script>
+<script src="/gen/services/device/public/mojom/sensor_provider.mojom.js"></script>
+<script>
+
+// Cannot use `step_timeout()` because we need the `sensor_test` infrastructure below,
+// which, however, is using `promise_test` internally. Cannot use `promise_rejects`
+// either, as `sensor_test` does not expose the `test_object`.
+function waitForLackOfEvent(eventName) {
+  return new Promise((resolve, reject) => {
+    window.addEventListener(eventName, reject);
+    window.setTimeout(() => {
+      window.removeEventListener(eventName, reject);
+      resolve();
+    }, 1000);
+  });
+}
+
+if (window.location.origin != get_host_info().UNAUTHENTICATED_ORIGIN) {
+  window.location = get_host_info().UNAUTHENTICATED_ORIGIN + window.location.pathname;
+  promise_test(_ => new Promise(_ => {}), "Stall tests on the wrong host.");
+} else {
+
+  test(() => {
+    assert_false('DeviceMotionEvent' in window);
+    assert_false('DeviceOrientationEvent' in window);
+    assert_false('DeviceMotionEventAcceleration' in window);
+    assert_false('DeviceMotionEventRotationRate' in window);
+  }, 'Event interfaces are not exposed on `window`.');
+
+  sensor_test(sensorProvider => {
+    const FAKE_ACCELERATION_DATA = [1, 2, 3];
+    const FAKE_LINEAR_ACCELERATION_DATA = [4, 5, 6];
+    const FAKE_GYROSCOPE_DATA = [7, 8, 9];
+    setMockSensorDataForType(sensorProvider, device.mojom.SensorType.ACCELEROMETER, FAKE_ACCELERATION_DATA);
+    setMockSensorDataForType(sensorProvider, device.mojom.SensorType.LINEAR_ACCELERATION, FAKE_LINEAR_ACCELERATION_DATA);
+    setMockSensorDataForType(sensorProvider, device.mojom.SensorType.GYROSCOPE, FAKE_GYROSCOPE_DATA);
+
+    return waitForLackOfEvent('devicemotion');
+  }, 'DeviceMotionEvent never fires.');
+
+  sensor_test(sensorProvider => {
+    const FAKE_ORIENTATION_DATA = [1.1, 2.2, 3.3];
+    setMockSensorDataForType(sensorProvider, device.mojom.SensorType.RELATIVE_ORIENTATION_EULER_ANGLES, FAKE_ORIENTATION_DATA);
+
+    return waitForLackOfEvent('deviceorientation');
+  }, 'DeviceOrientationEvent never fires.');
+}
+
+</script>
diff --git a/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/device-orientation-on-insecure-origin-expected.txt b/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/device-orientation-on-insecure-origin-expected.txt
new file mode 100644
index 0000000..d09230e
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/device-orientation-on-insecure-origin-expected.txt
@@ -0,0 +1,8 @@
+CONSOLE WARNING: line 429: The `devicemotion` event is deprecated on insecure origins and will be removed. See https://www.chromestatus.com/feature/5688035094036480 for more details.
+CONSOLE WARNING: line 429: The `deviceorientation` event is deprecated on insecure origins and will be removed. See https://www.chromestatus.com/feature/5468407470227456 for more details.
+This is a testharness.js-based test.
+PASS Event handlers as well as interfaces are exposed on `window`.
+PASS DeviceMotionEvent fires.
+PASS DeviceOrientationEvent fires.
+Harness: the test ran to completion.
+
diff --git a/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/device-orientation-on-insecure-origin.html b/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/device-orientation-on-insecure-origin.html
new file mode 100644
index 0000000..f969a3a
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/device-orientation-on-insecure-origin.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<title>Device Sensor Events on Insecure Origins</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/get-host-info.js"></script>
+<script>
+window.location = get_host_info().UNAUTHENTICATED_ORIGIN +
+    "/security/powerfulFeatureRestrictions/device-orientation.html";
+promise_test(_ => new Promise(_ => {}), "Stall tests on the wrong host.");
+</script>
diff --git a/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/device-orientation-on-secure-origin.https.html b/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/device-orientation-on-secure-origin.https.html
new file mode 100644
index 0000000..31b6f107
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/device-orientation-on-secure-origin.https.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<title>Device Sensor Events on Secure Origin</title>
+<script>
+window.location = "device-orientation.html";
+</script>
diff --git a/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/device-orientation.html b/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/device-orientation.html
new file mode 100644
index 0000000..12dd166b
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/device-orientation.html
@@ -0,0 +1,61 @@
+<!DOCTYPE html>
+<title>Device Sensor Events</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/get-host-info.js"></script>
+<script src="/resources/sensor-helpers.js"></script>
+<script src="/gen/layout_test_data/mojo/public/js/mojo_bindings.js"></script>
+<script src="/gen/services/device/public/mojom/sensor_provider.mojom.js"></script>
+<script>
+
+test(() => {
+  assert_true('ondevicemotion' in window);
+  assert_true('ondeviceorientation' in window);
+  assert_true('DeviceMotionEvent' in window);
+  assert_true('DeviceOrientationEvent' in window);
+  assert_true('DeviceMotionEventAcceleration' in window);
+  assert_true('DeviceMotionEventRotationRate' in window);
+}, 'Event handlers as well as interfaces are exposed on `window`.');
+
+sensor_test(async sensorProvider => {
+  const FAKE_ACCELERATION_DATA = [1, 2, 3];
+  const FAKE_LINEAR_ACCELERATION_DATA = [4, 5, 6];
+  const FAKE_GYROSCOPE_DATA = [7, 8, 9];
+  setMockSensorDataForType(sensorProvider, device.mojom.SensorType.ACCELEROMETER, FAKE_ACCELERATION_DATA);
+  setMockSensorDataForType(sensorProvider, device.mojom.SensorType.LINEAR_ACCELERATION, FAKE_LINEAR_ACCELERATION_DATA);
+  setMockSensorDataForType(sensorProvider, device.mojom.SensorType.GYROSCOPE, FAKE_GYROSCOPE_DATA);
+
+  const radToDeg = 180 / Math.PI;
+  return waitForEvent(new DeviceMotionEvent('devicemotion', {
+      acceleration: {
+          x: FAKE_LINEAR_ACCELERATION_DATA[0],
+          y: FAKE_LINEAR_ACCELERATION_DATA[1],
+          z: FAKE_LINEAR_ACCELERATION_DATA[2],
+      },
+      accelerationIncludingGravity: {
+          x: FAKE_ACCELERATION_DATA[0],
+          y: FAKE_ACCELERATION_DATA[1],
+          z: FAKE_ACCELERATION_DATA[2],
+      },
+      rotationRate: {
+          alpha: FAKE_GYROSCOPE_DATA[0] * radToDeg,
+          beta: FAKE_GYROSCOPE_DATA[1] * radToDeg,
+          gamma: FAKE_GYROSCOPE_DATA[2] * radToDeg,
+      },
+      interval: 16,
+  }));
+}, 'DeviceMotionEvent fires.');
+
+sensor_test(async sensorProvider => {
+  const FAKE_ORIENTATION_DATA = [1.1, 2.2, 3.3];
+  setMockSensorDataForType(sensorProvider, device.mojom.SensorType.RELATIVE_ORIENTATION_EULER_ANGLES, FAKE_ORIENTATION_DATA);
+
+  return waitForEvent(new DeviceOrientationEvent('deviceorientation', {
+      alpha: FAKE_ORIENTATION_DATA[2],
+      beta: FAKE_ORIENTATION_DATA[0],
+      gamma: FAKE_ORIENTATION_DATA[1],
+      absolute: false,
+  }));
+}, 'DeviceOrientationEvent fires.');
+
+</script>
diff --git a/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/old-powerful-features-on-insecure-origin-expected.txt b/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/old-powerful-features-on-insecure-origin-expected.txt
index 07a85126..f974fea 100644
--- a/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/old-powerful-features-on-insecure-origin-expected.txt
+++ b/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/old-powerful-features-on-insecure-origin-expected.txt
@@ -1,11 +1,7 @@
 CONSOLE WARNING: Application Cache is restricted to secure contexts. Please consider migrating your application to HTTPS, and eventually shifting over to Service Workers. See https://goo.gl/rStTGz for more details.
-CONSOLE WARNING: line 68: getCurrentPosition() and watchPosition() no longer work on insecure origins. To use this feature, you should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details.
-CONSOLE WARNING: line 87: getUserMedia() no longer works on insecure origins. To use this feature, you should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details.
-CONSOLE WARNING: line 429: The devicemotion event is deprecated on insecure origins, and support will be removed in the future. You should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details.
-CONSOLE WARNING: line 429: The deviceorientation event is deprecated on insecure origins, and support will be removed in the future. You should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details.
+CONSOLE WARNING: line 21: getCurrentPosition() and watchPosition() no longer work on insecure origins. To use this feature, you should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details.
+CONSOLE WARNING: line 40: getUserMedia() no longer works on insecure origins. To use this feature, you should consider switching your application to a secure origin, such as HTTPS. See https://goo.gl/rStTGz for more details.
 This is a testharness.js-based test.
-PASS device motion
-PASS device orientation
 PASS getCurrentPosition
 PASS watchPosition
 PASS navigator.webkitGetUserMedia
diff --git a/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/old-powerful-features-on-insecure-origin.html b/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/old-powerful-features-on-insecure-origin.html
index 3844a07..fe53098 100644
--- a/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/old-powerful-features-on-insecure-origin.html
+++ b/third_party/blink/web_tests/http/tests/security/powerfulFeatureRestrictions/old-powerful-features-on-insecure-origin.html
@@ -6,9 +6,6 @@
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="/resources/get-host-info.js"></script>
-<script src="/resources/sensor-helpers.js"></script>
-<script src="/gen/layout_test_data/mojo/public/js/mojo_bindings.js"></script>
-<script src="/gen/services/device/public/mojom/sensor_provider.mojom.js"></script>
 
 <body>
 <div id="target"></div>
@@ -19,50 +16,6 @@
     if (!window.internals)
         assert_unreached('window.internals is required for this test');
 
-    // Tests for APIs that are deprecated, but still allowed, on
-    // insecure origins
-    sensor_test(async sensorProvider => {
-        const fakeAccelerometerData = [1, 2, 3];
-        const fakeLinearAccelerationData = [4, 5, 6];
-        const fakeGyroscopeData = [7, 8, 9];
-
-        setMockSensorDataForType(sensorProvider, device.mojom.SensorType.ACCELEROMETER, fakeAccelerometerData);
-        setMockSensorDataForType(sensorProvider, device.mojom.SensorType.LINEAR_ACCELERATION, fakeLinearAccelerationData);
-        setMockSensorDataForType(sensorProvider, device.mojom.SensorType.GYROSCOPE, fakeGyroscopeData);
-
-        const radToDeg = 180 / Math.PI;
-        return waitForEvent(new DeviceMotionEvent('devicemotion', {
-            acceleration: {
-                x: fakeLinearAccelerationData[0],
-                y: fakeLinearAccelerationData[1],
-                z: fakeLinearAccelerationData[2],
-            },
-            accelerationIncludingGravity: {
-                x: fakeAccelerometerData[0],
-                y: fakeAccelerometerData[1],
-                z: fakeAccelerometerData[2],
-            },
-            rotationRate: {
-                alpha: fakeGyroscopeData[0] * radToDeg,
-                beta: fakeGyroscopeData[1] * radToDeg,
-                gamma: fakeGyroscopeData[2] * radToDeg,
-            },
-            interval: 16,
-        }));
-    }, 'device motion');
-
-    sensor_test(async sensorProvider => {
-        const fakeOrientationData = [1.1, 2.2, 3.3];
-        setMockSensorDataForType(sensorProvider, device.mojom.SensorType.RELATIVE_ORIENTATION_EULER_ANGLES, fakeOrientationData);
-
-        return waitForEvent(new DeviceOrientationEvent('deviceorientation', {
-            alpha: fakeOrientationData[2],
-            beta: fakeOrientationData[0],
-            gamma: fakeOrientationData[1],
-            absolute: false,
-        }));
-    }, 'device orientation');
-
     // Tests for APIs that have been turned off on insecure origins
     async_test(function() {
         navigator.geolocation.getCurrentPosition(
diff --git a/third_party/blink/web_tests/shadow-dom/fullscreen-element-in-shadow-complex.html b/third_party/blink/web_tests/shadow-dom/fullscreen-element-in-shadow-complex.html
index 304464a7..a113ce3 100644
--- a/third_party/blink/web_tests/shadow-dom/fullscreen-element-in-shadow-complex.html
+++ b/third_party/blink/web_tests/shadow-dom/fullscreen-element-in-shadow-complex.html
@@ -67,15 +67,6 @@
         assert_equals(host4.shadowRoot.fullscreenElement, null);
         assert_equals(host5.shadowRoot.fullscreenElement, null);
 
-        // TODO(kochi): The 'retargeting' behavior is controlled by
-        // 'FullscreenUnprefixed' runtime flag dynamically.  Until the
-        // flag is turned on, document.webkitFullscreenElement leaks the
-        // fullscreen element under shadow roots.
-        internals.runtimeFlags.fullscreenUnprefixedEnabled = false;
-        assert_false(internals.runtimeFlags.fullscreenUnprefixedEnabled);
-        assert_equals(document.webkitFullscreenElement, canvas);
-        assert_equals(document.webkitCurrentFullScreenElement, canvas);
-
         document.exitFullscreen();
         test.done();
     });
diff --git a/third_party/blink/web_tests/shadow-dom/fullscreen-element-in-shadow-simple.html b/third_party/blink/web_tests/shadow-dom/fullscreen-element-in-shadow-simple.html
index 380514c6..ba6fe82 100644
--- a/third_party/blink/web_tests/shadow-dom/fullscreen-element-in-shadow-simple.html
+++ b/third_party/blink/web_tests/shadow-dom/fullscreen-element-in-shadow-simple.html
@@ -36,15 +36,6 @@
 
         assert_equals(host0.shadowRoot.fullscreenElement, canvas);
 
-        // TODO(kochi): The 'retargeting' behavior is controlled by
-        // 'FullscreenUnprefixed' runtime flag dynamically.  Until the
-        // flag is turned on, document.webkitFullscreenElement leaks the
-        // fullscreen element under shadow roots.
-        internals.runtimeFlags.fullscreenUnprefixedEnabled = false;
-        assert_false(internals.runtimeFlags.fullscreenUnprefixedEnabled);
-        assert_equals(document.webkitFullscreenElement, canvas);
-        assert_equals(document.webkitCurrentFullScreenElement, canvas);
-
         document.exitFullscreen();
         test.done();
     });
diff --git a/third_party/blink/web_tests/shadow-dom/v0/fullscreen-element-in-v0.html b/third_party/blink/web_tests/shadow-dom/v0/fullscreen-element-in-v0.html
index 5e5fb17..66e94db 100644
--- a/third_party/blink/web_tests/shadow-dom/v0/fullscreen-element-in-v0.html
+++ b/third_party/blink/web_tests/shadow-dom/v0/fullscreen-element-in-v0.html
@@ -37,15 +37,6 @@
 
         assert_equals(host0.shadowRoot.fullscreenElement, null);
 
-        // TODO(kochi): The 'retargeting' behavior is controlled by
-        // 'FullscreenUnprefixed' runtime flag dynamically.  Until the
-        // flag is turned on, document.webkitFullscreenElement leaks the
-        // fullscreen element under shadow roots.
-        internals.runtimeFlags.fullscreenUnprefixedEnabled = false;
-        assert_false(internals.runtimeFlags.fullscreenUnprefixedEnabled);
-        assert_equals(document.webkitFullscreenElement, canvas);
-        assert_equals(document.webkitCurrentFullScreenElement, canvas);
-
         document.exitFullscreen();
         test.done();
     });
diff --git a/third_party/blink/web_tests/virtual/secure-device-sensor-events/http/tests/security/powerfulFeatureRestrictions/README.txt b/third_party/blink/web_tests/virtual/secure-device-sensor-events/http/tests/security/powerfulFeatureRestrictions/README.txt
new file mode 100644
index 0000000..a730acc
--- /dev/null
+++ b/third_party/blink/web_tests/virtual/secure-device-sensor-events/http/tests/security/powerfulFeatureRestrictions/README.txt
@@ -0,0 +1,3 @@
+This directory is for running Device Sensor Event API tests with the runtime
+flag RestrictDeviceSensorEventsToSecureContexts enabled, so that the API is only
+exposed to secure browsing contexts.
diff --git a/third_party/blink/web_tests/virtual/secure-device-sensor-events/http/tests/security/powerfulFeatureRestrictions/device-orientation-future-behavior-on-insecure-origin-expected.txt b/third_party/blink/web_tests/virtual/secure-device-sensor-events/http/tests/security/powerfulFeatureRestrictions/device-orientation-future-behavior-on-insecure-origin-expected.txt
new file mode 100644
index 0000000..8b3b9da
--- /dev/null
+++ b/third_party/blink/web_tests/virtual/secure-device-sensor-events/http/tests/security/powerfulFeatureRestrictions/device-orientation-future-behavior-on-insecure-origin-expected.txt
@@ -0,0 +1,8 @@
+CONSOLE WARNING: line 16: The `devicemotion` event is deprecated on insecure origins and will be removed in M76, around July 2019. Event handlers can still be registered but are no longer invoked since M74, around April 2019. See https://www.chromestatus.com/feature/5688035094036480 for more details.
+CONSOLE WARNING: line 16: The `deviceorientation` event is deprecated on insecure origins and will be removed in M76, around July 2019. Event handlers can still be registered but are no longer invoked since M74, around April 2019. See https://www.chromestatus.com/feature/5468407470227456 for more details.
+This is a testharness.js-based test.
+PASS Event interfaces are not exposed on `window`.
+PASS DeviceMotionEvent never fires.
+PASS DeviceOrientationEvent never fires.
+Harness: the test ran to completion.
+
diff --git a/third_party/blink/web_tests/virtual/webrtc-wpt-plan-b/external/wpt/webrtc/RTCPeerConnection-onsignalingstatechanged.https-expected.txt b/third_party/blink/web_tests/virtual/webrtc-wpt-plan-b/external/wpt/webrtc/RTCPeerConnection-onsignalingstatechanged.https-expected.txt
new file mode 100644
index 0000000..a152e35
--- /dev/null
+++ b/third_party/blink/web_tests/virtual/webrtc-wpt-plan-b/external/wpt/webrtc/RTCPeerConnection-onsignalingstatechanged.https-expected.txt
@@ -0,0 +1,4 @@
+This is a testharness.js-based test.
+FAIL RTCPeerConnection onsignalingstatechanged Cannot read property 'currentDirection' of undefined
+Harness: the test ran to completion.
+
diff --git a/third_party/boringssl/BUILD.gn b/third_party/boringssl/BUILD.gn
index 1afad40..051b3ed 100644
--- a/third_party/boringssl/BUILD.gn
+++ b/third_party/boringssl/BUILD.gn
@@ -237,6 +237,7 @@
         "src/ssl/test/fuzzer.h",
         "src/ssl/test/fuzzer_tags.h",
       ]
+      additional_configs = [ ":internal_config" ]
       deps = [
         ":boringssl_fuzzer",
       ]
@@ -305,6 +306,7 @@
       "src/ssl/test/fuzzer.h",
       "src/ssl/test/fuzzer_tags.h",
     ]
+    additional_configs = [ ":internal_config" ]
     deps = [
       ":boringssl_fuzzer_no_fuzzer_mode",
     ]
@@ -317,6 +319,7 @@
       "src/ssl/test/fuzzer.h",
       "src/ssl/test/fuzzer_tags.h",
     ]
+    additional_configs = [ ":internal_config" ]
     deps = [
       ":boringssl_fuzzer_no_fuzzer_mode",
     ]
diff --git a/third_party/flatbuffers/BUILD.gn b/third_party/flatbuffers/BUILD.gn
index eb247f9..3b4ac1b 100644
--- a/third_party/flatbuffers/BUILD.gn
+++ b/third_party/flatbuffers/BUILD.gn
@@ -84,6 +84,7 @@
     ":compiler_files",
     ":flatbuffers",
   ]
+  # TODO(https://crbug.com/934834): Re-enable chromium_code for this.
   configs -= [ "//build/config/compiler:chromium_code" ]
   configs += [ "//build/config/compiler:no_chromium_code" ]
 }
@@ -113,6 +114,9 @@
     ":flatbuffers",
     ":flatbuffers_samplebuffer",
   ]
+  # TODO(https://crbug.com/934834): Re-enable chromium_code for this.
+  configs -= [ "//build/config/compiler:chromium_code" ]
+  configs += [ "//build/config/compiler:no_chromium_code" ]
   data = [
     "src/tests/",
   ]
diff --git a/third_party/google_toolbox_for_mac/BUILD.gn b/third_party/google_toolbox_for_mac/BUILD.gn
index 78ca06a..67768b1 100644
--- a/third_party/google_toolbox_for_mac/BUILD.gn
+++ b/third_party/google_toolbox_for_mac/BUILD.gn
@@ -39,11 +39,6 @@
       "Cocoa.framework",
       "QuartzCore.framework",
     ]
-
-    # TODO(crbug.com/841631): GTM uses accessibility APIs that are deprecated as
-    # of 10.10. These can't yet be compiled out, so for now, ignore deprecated
-    # declarations in GTM altogether.
-    cflags = [ "-Wno-deprecated-declarations" ]
   } else {  # is_ios
     sources += [
       "src/DebugUtils/GTMMethodCheck.h",
diff --git a/third_party/libaddressinput/README.chromium b/third_party/libaddressinput/README.chromium
index a5311a7..0dd6a54a 100644
--- a/third_party/libaddressinput/README.chromium
+++ b/third_party/libaddressinput/README.chromium
@@ -1,8 +1,8 @@
 Name: libaddressinput
 URL: https://github.com/googlei18n/libaddressinput
 Version: 0
-Date: 10 November 2014
-Revision: 4d18a0d4be9add0dc479e7b939ed8d39f6ec0d73
+Date: 21 February 2019
+Revision: 81e7ead903f5b71a326e0584f4325f106c804df1
 License: Apache 2.0
 License File: LICENSE
 Security Critical: yes
diff --git a/tools/binary_size/libsupersize/archive.py b/tools/binary_size/libsupersize/archive.py
index ef8a76f..d9f327e 100644
--- a/tools/binary_size/libsupersize/archive.py
+++ b/tools/binary_size/libsupersize/archive.py
@@ -819,6 +819,38 @@
         symbol.object_path = ar.CreateThinObjectPath(archive_path, subpath)
 
 
+def _DeduceObjectPathForSwitchTables(raw_symbols, object_paths_by_name):
+  strip_num_suffix_regexp = re.compile(r'\s+\(\.\d+\)$')
+  num_switch_tables = 0
+  num_unassigned = 0
+  num_deduced = 0
+  num_arbitrations = 0
+  for s in raw_symbols:
+    if s.full_name.startswith('Switch table for '):
+      num_switch_tables += 1
+      # Strip 'Switch table for ' prefix.
+      name = s.full_name[17:]
+      # Strip, e.g., ' (.123)' suffix.
+      name = re.sub(strip_num_suffix_regexp, '', name)
+      object_paths = object_paths_by_name.get(name, None)
+      if not s.object_path:
+        if object_paths is None:
+          num_unassigned += 1
+        else:
+          num_deduced += 1
+          # If ambiguity arises, arbitrate by taking the first.
+          s.object_path = object_paths[0]
+          if len(object_paths) > 1:
+            num_arbitrations += 1
+      else:
+        assert object_paths and s.object_path in object_paths
+  if num_switch_tables > 0:
+    logging.info(
+        'Found %d switch tables: Deduced %d object paths with ' +
+        '%d arbitrations. %d remain unassigned.', num_switch_tables,
+        num_deduced, num_arbitrations, num_unassigned)
+
+
 def _ParseElfInfo(map_path, elf_path, tool_prefix, track_string_literals,
                   outdir_context=None, linker_name=None):
   """Adds ELF section sizes and symbols."""
@@ -901,6 +933,7 @@
           'Fetched path information for %d symbols from %d files',
           len(object_paths_by_name),
           len(outdir_context.elf_object_paths) + len(missed_object_paths))
+      _DeduceObjectPathForSwitchTables(raw_symbols, object_paths_by_name)
       # For aliases, this provides path information where there wasn't any.
       logging.info('Creating aliases for symbols shared by multiple paths')
       raw_symbols = _AssignNmAliasPathsAndCreatePathAliases(
diff --git a/tools/binary_size/libsupersize/demangle.py b/tools/binary_size/libsupersize/demangle.py
index 94374b8d..e155748 100644
--- a/tools/binary_size/libsupersize/demangle.py
+++ b/tools/binary_size/libsupersize/demangle.py
@@ -5,6 +5,7 @@
 """Utilities for demangling C++ symbols."""
 
 import collections
+import itertools
 import logging
 import re
 import subprocess
@@ -33,33 +34,50 @@
   return _PROMOTED_GLOBAL_NAME_RAW_PATTERN.sub('', name)
 
 
-def _IsLowerHex(s):
-  return _LOWER_HEX_PATTERN.match(s) is not None
+def _CanDemangle(name):
+  return name.startswith('_Z') or name.startswith('.Lswitch.table._Z')
 
 
-def _StripHashSuffix(names):
-  """Iterates |names| and strips suffixes that represent hash.
+def _ExtractDemanglablePart(names):
+  """For each name in |names|, yields the part that can be demangled."""
 
-  Some mangled symbols end with '$' followed by 32 lower-case hex digits. These
-  interfere with demangling by c++filt. This function is an adaptor for iterable
-  |name| to detect and strip these hash suffixes.
-  """
+  def _IsLowerHex(s):
+    return _LOWER_HEX_PATTERN.match(s) is not None
+
   for name in names:
+    # Strip prefixes before '_Z', e.g., '.Lswitch.table.'.
+    pos = name.find('_Z')
+    if pos > 0:
+      name = name[pos:]
+
+    # Some mangled symbols end with '$' followed by 32 lower-case hex digits.
+    # These interfere with demangling by c++filt. This function is an adaptor
+    # for iterable |name| to detect and strip these hash suffixes.
     if len(name) > 33 and name[-33] == '$' and _IsLowerHex(name[-32:]):
       yield name[:-33]
     else:
       yield name
 
 
+def _PostProcessDemangledSymbol(old_name, new_name):
+  new_name = StripLlvmPromotedGlobalNames(new_name)
+  if old_name.startswith('.Lswitch.table.'):
+    new_name = 'Switch table for ' + new_name  # Becomes ... [Switch table].
+  return new_name
+
+
 def _DemangleNames(names, tool_prefix):
   """Uses c++filt to demangle a list of names."""
   proc = subprocess.Popen([path_util.GetCppFiltPath(tool_prefix)],
                           stdin=subprocess.PIPE, stdout=subprocess.PIPE)
-  stdout = proc.communicate('\n'.join(_StripHashSuffix(names)))[0]
+  stdout = proc.communicate('\n'.join(_ExtractDemanglablePart(names)))[0]
   assert proc.returncode == 0
-  ret = [StripLlvmPromotedGlobalNames(line) for line in stdout.splitlines()]
+  ret = [
+      _PostProcessDemangledSymbol(old_name, new_name)
+      for (old_name, new_name) in itertools.izip(names, stdout.splitlines())
+  ]
   if logging.getLogger().isEnabledFor(logging.INFO):
-    fail_count = sum(1 for s in ret if s.startswith('_Z'))
+    fail_count = sum(1 for s in ret if _CanDemangle(s))
     if fail_count:
       logging.info('* Failed to demangle %d/%d items', fail_count, len(ret))
   return ret
@@ -67,12 +85,12 @@
 
 def DemangleRemainingSymbols(raw_symbols, tool_prefix):
   """Demangles any symbols that need it."""
-  to_process = [s for s in raw_symbols if s.full_name.startswith('_Z')]
+  to_process = [s for s in raw_symbols if _CanDemangle(s.full_name)]
   if not to_process:
     return
 
   logging.info('Demangling %d symbols', len(to_process))
-  names = _DemangleNames((s.full_name for s in to_process), tool_prefix)
+  names = _DemangleNames([s.full_name for s in to_process], tool_prefix)
   for i, name in enumerate(names):
     to_process[i].full_name = name
 
@@ -84,7 +102,7 @@
   """
   all_names = []
   for names in key_to_names.itervalues():
-    all_names.extend(n for n in names if n.startswith('_Z'))
+    all_names.extend(n for n in names if _CanDemangle(n))
   if not all_names:
     return key_to_names
 
@@ -92,7 +110,7 @@
   it = iter(_DemangleNames(all_names, tool_prefix))
   ret = {}
   for key, names in key_to_names.iteritems():
-    ret[key] = set(next(it) if n.startswith('_Z') else n for n in names)
+    ret[key] = set(next(it) if _CanDemangle(n) else n for n in names)
   assert(next(it, None) is None)
   return ret
 
@@ -103,7 +121,7 @@
   Keys may demangle to a common name. When this happens, the corresponding lists
   are merged in arbitrary order.
   """
-  keys = [key for key in name_to_list if key.startswith('_Z')]
+  keys = [key for key in name_to_list if _CanDemangle(key)]
   if not keys:
     return name_to_list
 
@@ -111,7 +129,7 @@
   key_iter = iter(_DemangleNames(keys, tool_prefix))
   ret = collections.defaultdict(list)
   for key, val in name_to_list.iteritems():
-    ret[next(key_iter) if key.startswith('_Z') else key] += val
+    ret[next(key_iter) if _CanDemangle(key) else key] += val
   assert(next(key_iter, None) is None)
   logging.info('* %d keys become %d keys' % (len(name_to_list), len(ret)))
   return ret
diff --git a/tools/chrome_proxy/webdriver/decorator_smoke.py b/tools/chrome_proxy/webdriver/decorator_smoke.py
index acc7fbf9..d2bc8a0 100644
--- a/tools/chrome_proxy/webdriver/decorator_smoke.py
+++ b/tools/chrome_proxy/webdriver/decorator_smoke.py
@@ -5,6 +5,7 @@
 import sys
 
 from decorators import AndroidOnly
+from decorators import ChromeVersionBetweenInclusiveM
 from decorators import ChromeVersionEqualOrAfterM
 from decorators import ChromeVersionBeforeM
 from decorators import SkipIfForcedBrowserArg
@@ -32,6 +33,15 @@
     self.fail('This function should not be called when the Chrome Milestone is '
       'greater than 0')
 
+  @ChromeVersionBetweenInclusiveM(0, 999999999)
+  def testVersionBetweenDecorator(self):
+    pass
+
+  @ChromeVersionBetweenInclusiveM(0, 1)
+  def testVersionBetweenDecorator(self):
+    self.fail('This function should not be called when the Chrome Milestone is '
+      'outside the range [0, 1].')
+
   @ChromeVersionEqualOrAfterM(999999999)
   def testVersionAfterDecorator(self):
     self.fail('This function should not be called when the Chrome Milestone is '
diff --git a/tools/chrome_proxy/webdriver/decorators.py b/tools/chrome_proxy/webdriver/decorators.py
index 03083f04..b6d558a 100644
--- a/tools/chrome_proxy/webdriver/decorators.py
+++ b/tools/chrome_proxy/webdriver/decorators.py
@@ -118,6 +118,21 @@
     return wrapper
   return puesdo_wrapper
 
+def ChromeVersionBetweenInclusiveM(after, before):
+  def puesdo_wrapper(func):
+    def wrapper(*args, **kwargs):
+      global chrome_version
+      if chrome_version == None:
+        chrome_version = GetChromeVersion()
+      if chrome_version <= before and chrome_version >= after:
+        func(*args, **kwargs)
+      else:
+        args[0].skipTest('This test only runs between M%d and M%d (inclusive).'
+          % (after, before))
+    return wrapper
+  return puesdo_wrapper
+
+
 def Slow(func):
   def wrapper(*args, **kwargs):
     if ParseFlags().skip_slow:
diff --git a/tools/chrome_proxy/webdriver/proxy_connection.py b/tools/chrome_proxy/webdriver/proxy_connection.py
index 03932ad1..192ad88 100644
--- a/tools/chrome_proxy/webdriver/proxy_connection.py
+++ b/tools/chrome_proxy/webdriver/proxy_connection.py
@@ -5,7 +5,7 @@
 import common
 from common import TestDriver
 from common import IntegrationTest
-from decorators import ChromeVersionEqualOrAfterM
+from decorators import ChromeVersionBetweenInclusiveM
 from emulation_server import BlackHoleHandler
 from emulation_server import InvalidTLSHandler
 from emulation_server import TCPResetHandler
@@ -13,7 +13,7 @@
 
 class ProxyConnection(IntegrationTest):
 
-  @ChromeVersionEqualOrAfterM(63)
+  @ChromeVersionBetweenInclusiveM(63, 72)
   def testTLSInjectionAfterHandshake(self):
     port = common.GetOpenPort()
     with TestDriver() as t:
@@ -37,7 +37,7 @@
       self.assertTrue(t.SleepUntilHistogramHasEntry('DataReductionProxy.'
         'InvalidResponseHeadersReceived.NetError'))
 
-  @ChromeVersionEqualOrAfterM(63)
+  @ChromeVersionBetweenInclusiveM(63, 72)
   def testTCPReset(self):
     port = common.GetOpenPort()
     with TestDriver() as t:
@@ -62,7 +62,7 @@
       self.assertTrue(t.SleepUntilHistogramHasEntry('DataReductionProxy.'
         'InvalidResponseHeadersReceived.NetError'))
 
-  @ChromeVersionEqualOrAfterM(63)
+  @ChromeVersionBetweenInclusiveM(63, 72)
   def testTLSReset(self):
     port = common.GetOpenPort()
     with TestDriver() as t:
@@ -85,7 +85,7 @@
       for response in responses:
         self.assertNotHasChromeProxyViaHeader(response)
 
-  @ChromeVersionEqualOrAfterM(66)
+  @ChromeVersionBetweenInclusiveM(66, 71)
   def testTCPBlackhole(self):
     port = common.GetOpenPort()
     with TestDriver() as t:
diff --git a/tools/gn/bootstrap/bootstrap.py b/tools/gn/bootstrap/bootstrap.py
index f12a63b9..8e121b5 100755
--- a/tools/gn/bootstrap/bootstrap.py
+++ b/tools/gn/bootstrap/bootstrap.py
@@ -97,7 +97,8 @@
       os.putenv(var, os.environ.get(var, '') + ' ' + ' '.join(vals))
 
     append_to_env('LDFLAGS', [
-        '-nodefaultlibs', 'libc++.gn.so', '-lc', '-lm',
+        '-nodefaultlibs', 'libc++.gn.so',
+        '-lpthread', '-lc', '-lm',
         '-Wl,-rpath="\$$ORIGIN/."', '-Wl,-rpath-link=.'
     ])
     append_to_env('CXXFLAGS', [
diff --git a/tools/metrics/histograms/enums.xml b/tools/metrics/histograms/enums.xml
index c91352c4..b47eb35 100644
--- a/tools/metrics/histograms/enums.xml
+++ b/tools/metrics/histograms/enums.xml
@@ -15509,6 +15509,7 @@
   <int value="525" label="PrintingAllowedPinModes"/>
   <int value="526" label="PrintingPinDefault"/>
   <int value="527" label="VoiceInteractionContextEnabled"/>
+  <int value="528" label="UseKDCConstrainedDelegation"/>
 </enum>
 
 <enum name="EnterprisePolicyInvalidations">
@@ -31659,6 +31660,8 @@
   <int value="-671992446" label="TranslateRankerEnforcement:disabled"/>
   <int value="-670188266" label="enable-zip-archiver-unpacker"/>
   <int value="-667517406" label="overscroll-history-navigation"/>
+  <int value="-667018797"
+      label="OmniboxUIExperimentBlueTitlesAndGrayUrlsOnPageSuggestions:disabled"/>
   <int value="-666508951" label="CrOSContainer:enabled"/>
   <int value="-663476391" label="enable-pixel-canvas-recording:enabled"/>
   <int value="-662064703" label="MediaSessionService:enabled"/>
@@ -31698,6 +31701,8 @@
   <int value="-599932554" label="DoodlesOnLocalNtp:disabled"/>
   <int value="-598050737" label="disable-es3-apis"/>
   <int value="-596337171" label="disable-ash-sidebar"/>
+  <int value="-595819071"
+      label="OmniboxUIExperimentBlueTitlesOnPageSuggestions:disabled"/>
   <int value="-593536514" label="ExperimentalTabController:enabled"/>
   <int value="-592331266" label="ForegroundNotificationManager:enabled"/>
   <int value="-589096918" label="ash-enable-fullscreen-app-list"/>
@@ -31795,6 +31800,8 @@
   <int value="-408769228" label="ArcGraphicBuffersVisualizationTool:disabled"/>
   <int value="-406850932" label="EnableEmojiContextMenu:enabled"/>
   <int value="-405380243" label="enable-encryption-migration"/>
+  <int value="-402038055"
+      label="OmniboxUIExperimentBlueTitlesAndGrayUrlsOnPageSuggestions:enabled"/>
   <int value="-401170566"
       label="OmniboxUIExperimentHideSuggestionUrlPath:disabled"/>
   <int value="-400584764" label="ChromeHomeNtpRedesign:enabled"/>
@@ -32627,6 +32634,8 @@
   <int value="1049885154" label="OfflinePagesPrefetching:disabled"/>
   <int value="1050048304" label="enable-font-cache-scaling"/>
   <int value="1050321458" label="new-profile-management"/>
+  <int value="1050442356"
+      label="OmniboxUIExperimentBlueTitlesOnPageSuggestions:enabled"/>
   <int value="1050664817" label="CSSFragmentIdentifiers:enabled"/>
   <int value="1053743655" label="NewOverviewAnimations:enabled"/>
   <int value="1054910800" label="enable-timezone-tracking-option"/>
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index fa393d5..5662c3c 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -142902,6 +142902,9 @@
   <suffix name="WebCache.ScriptResources"
       label="Only counting memory used by Script resources in Blink Web
              Cache."/>
+  <suffix name="WebCache.V8CodeCache"
+      label="Only counting memory of v8 code cache used by Script resources
+             in Blink Web Cache."/>
   <suffix name="WebCache.XSLStylesheetResources"
       label="Only counting memory used by XSL Stylesheet resources in Blink
              Web Cache."/>
diff --git a/tools/metrics/ukm/ukm.xml b/tools/metrics/ukm/ukm.xml
index 4b79ffe..aaa9cec4 100644
--- a/tools/metrics/ukm/ukm.xml
+++ b/tools/metrics/ukm/ukm.xml
@@ -3120,6 +3120,12 @@
       Measure of memory consumed by Script resources in Blink Web Cache.
     </summary>
   </metric>
+  <metric name="WebCache.V8CodeCache">
+    <summary>
+      Measure of memory consumed by V8 code cache held by Script resources in
+      Blink Web Cache.
+    </summary>
+  </metric>
   <metric name="WebCache.XSLStylesheetResources">
     <summary>
       Measure of memory consumed by XSL Stylesheet resources in Blink Web Cache.
diff --git a/tools/perf/expectations.config b/tools/perf/expectations.config
index 845deaf..2ee11be 100644
--- a/tools/perf/expectations.config
+++ b/tools/perf/expectations.config
@@ -396,7 +396,6 @@
 crbug.com/853212 [ Android_Webview ] v8.browsing_mobile/browse:news:cnn [ Skip ]
 crbug.com/877648 [ Android ] v8.browsing_mobile/browse:news:toi [ Skip ]
 crbug.com/877648 [ Android_Go ] v8.browsing_mobile/browse:news:cnn [ Skip ]
-crbug.com/931866 [ Android_Go ] v8.browsing_mobile/browse:news:cnn:2018 [ Skip ]
 crbug.com/901967 [ Nexus6_Webview ] v8.browsing_mobile/browse:news:toi [ Skip ]
 crbug.com/923116 [ Android ] v8.browsing_mobile/browse:shopping:avito [ Skip ]
 crbug.com/923517 [ Android_Go ] v8.browsing_mobile/browse:social:tumblr_infinite_scroll:2018 [ Skip ]
diff --git a/tools/perf/wpr/update_wpr.py b/tools/perf/wpr/update_wpr.py
index c5a42b6..078550c 100644
--- a/tools/perf/wpr/update_wpr.py
+++ b/tools/perf/wpr/update_wpr.py
@@ -26,6 +26,7 @@
 RUN_BENCHMARK = os.path.join(SRC_ROOT, 'tools', 'perf', 'run_benchmark')
 DATA_DIR = os.path.join(SRC_ROOT, 'tools', 'perf', 'page_sets', 'data')
 RECORD_WPR = os.path.join(SRC_ROOT, 'tools', 'perf', 'record_wpr')
+DEFAULT_REVIEWERS = ['perezju@chromium.org']
 
 
 class WprUpdater(object):
@@ -38,6 +39,8 @@
     self.repeat = args.repeat
     self.binary = args.binary
     self.output_dir = tempfile.mkdtemp()
+    self.bug_id = args.bug_id
+    self.reviewers = args.reviewers or DEFAULT_REVIEWERS
 
   def _PrepareEnv(self):
     # Enforce the same local settings for recording and replays on the bots.
@@ -252,6 +255,26 @@
     self._UploadArchiveToGoogleStorage(archive)
     return self._GitAddArtifactHash(archive)
 
+  def UploadCL(self, short_description=False):
+    cli_helpers.Step('UPLOAD CL: %s' % self.story)
+    if short_description:
+      commit_message = 'Automated upload'
+    else:
+      commit_message = (
+          'Add %s system health story\n\nThis CL was created automatically '
+          'with tools/perf/update_wpr script' % self.story)
+    if self.bug_id:
+      commit_message += '\n\nBug: %s' % self.bug_id
+    cli_helpers.Run(['git', 'commit', '-a', '-m', commit_message])
+    commit_msg_file = os.path.join(self.output_dir, 'commit_message.tmp')
+    with open(commit_msg_file, 'w') as fd:
+      fd.write(commit_message)
+    return cli_helpers.Run([
+      'git', 'cl', 'upload',
+      '--reviewers', ','.join(self.reviewers),
+      '--force',  # to prevent message editor from appearing
+      '--message-file', commit_msg_file], ok_fail=True)
+
 
 def Main(argv):
   parser = argparse.ArgumentParser()
@@ -263,6 +286,12 @@
       help='Specify the device serial number listed by `adb devices`. When not '
            'specified, the script runs in desktop mode.')
   parser.add_argument(
+      '-b', '--bug', dest='bug_id',
+      help='Bug ID to be referenced on created CL')
+  parser.add_argument(
+      '-r', '--reviewer', action='append', dest='reviewers',
+      help='Email of the reviewer(s) for the created CL.')
+  parser.add_argument(
       '--pageset-repeat', type=int, default=1, dest='repeat',
       help='Number of times to repeat the entire pageset.')
   parser.add_argument(
@@ -270,7 +299,7 @@
       help='Path to the Chromium/Chrome binary relative to output directory. '
            'Defaults to default Chrome browser installed if not specified.')
   parser.add_argument(
-      'command', choices=['live', 'record', 'replay', 'upload'],
+      'command', choices=['live', 'record', 'replay', 'upload', 'review'],
       help='Mode in which to run this script.')
 
   args = parser.parse_args(argv)
@@ -284,4 +313,6 @@
     updater.ReplayWpr()
   elif args.command == 'upload':
     updater.UploadWpr()
+  elif args.command == 'review':
+    updater.UploadCL()
   updater.Cleanup()
diff --git a/tools/perf/wpr/update_wpr_unittest.py b/tools/perf/wpr/update_wpr_unittest.py
index 7c7c715e..584c304 100644
--- a/tools/perf/wpr/update_wpr_unittest.py
+++ b/tools/perf/wpr/update_wpr_unittest.py
@@ -44,7 +44,8 @@
     mock.patch('os.path.exists', return_value=True).start()
 
     self.wpr_updater = update_wpr.WprUpdater(argparse.Namespace(
-      story='<story>', device_id=None, repeat=1, binary=None))
+      story='<story>', device_id=None, repeat=1, binary=None, bug_id=None,
+      reviewers=['someone@chromium.org']))
 
   def tearDown(self):
     mock.patch.stopall()
@@ -55,12 +56,16 @@
       'live',
       '-s', 'foo:bar:story:2019',
       '-d', 'H2345234FC33',
-      '--binary', '<binary>'
+      '--binary', '<binary>',
+      '-b', '1234',
+      '-r', 'test_user1@chromium.org',
+      '-r', 'test_user2@chromium.org',
     ])
     self.assertListEqual(wpr_updater_cls.mock_calls, [
       mock.call(argparse.Namespace(
         binary='<binary>', command='live', device_id='H2345234FC33',
-        repeat=1, story='foo:bar:story:2019')),
+        repeat=1, story='foo:bar:story:2019', bug_id='1234',
+        reviewers=['test_user1@chromium.org', 'test_user2@chromium.org'])),
       mock.call().LiveRun(),
       mock.call().Cleanup(),
     ])
@@ -205,6 +210,20 @@
       mock.call(['git', 'add', '<archive>.sha1'])
     ])
 
+  def testUploadCL(self):
+    self._run.return_value = 42
+    self.assertEqual(self.wpr_updater.UploadCL(), 42)
+    self.assertListEqual(self._run.mock_calls, [
+      mock.call([
+        'git', 'commit', '-a', '-m', 'Add <story> system health story\n\n'
+        'This CL was created automatically with tools/perf/update_wpr script'
+      ]),
+      mock.call([
+        'git', 'cl', 'upload', '--reviewers', 'someone@chromium.org',
+        '--force', '--message-file', '/tmp/dir/commit_message.tmp'
+      ], ok_fail=True),
+    ])
+
 
 if __name__ == "__main__":
   unittest.main()
diff --git a/ui/aura/mus/window_tree_client.cc b/ui/aura/mus/window_tree_client.cc
index 22ced9e..ed319142 100644
--- a/ui/aura/mus/window_tree_client.cc
+++ b/ui/aura/mus/window_tree_client.cc
@@ -726,13 +726,6 @@
     // only after the initial value from the server is received. The server
     // expects that if a LocalSurfaceIdAllocation is supplied, it must be valid.
     local_surface_id_allocation.reset();
-  } else if (window->window_mus_type() != WindowMusType::TOP_LEVEL) {
-    // |window_tree_host| may be null if this is called during creation of
-    // the window associated with the WindowTreeHostMus, or if there is an
-    // embedding.
-    WindowTreeHost* window_tree_host = window->GetWindow()->GetHost();
-    if (window_tree_host && window_tree_host->window() == window->GetWindow())
-      window_tree_host->compositor()->OnChildResizing();
   }
   const uint32_t change_id =
       ScheduleInFlightChange(std::make_unique<InFlightBoundsChange>(
diff --git a/ui/views_bridge_mac/bridged_native_widget_impl.mm b/ui/views_bridge_mac/bridged_native_widget_impl.mm
index aaf20c90..8d6dc4e8 100644
--- a/ui/views_bridge_mac/bridged_native_widget_impl.mm
+++ b/ui/views_bridge_mac/bridged_native_widget_impl.mm
@@ -815,10 +815,6 @@
 
 void BridgedNativeWidgetImpl::OnFullscreenTransitionStart(
     bool target_fullscreen_state) {
-  // Note: This can fail for fullscreen changes started externally, but a user
-  // shouldn't be able to do that if the window is invisible to begin with.
-  DCHECK(window_visible_);
-
   DCHECK_NE(target_fullscreen_state, target_fullscreen_state_);
   target_fullscreen_state_ = target_fullscreen_state;
   in_fullscreen_transition_ = true;